<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">Hi Jaime,<br>
      <br>
      I have developed the driver to work with the openvswitch and
      black_ports and white_ports as you said, I tried to do filtering
      all the ports one by one, but it takes more than 4 or 5 hours to
      terminate with the net deployment. Then I saw that you can specify
      a port with a mask, but only Open vSwitch 1.6 and later supports
      masks, my nodes are Ubuntu 12.04 and I had to compile the last
      version of Open vSwitch<br>
      <a class="moz-txt-link-freetext"
href="http://openvswitch.org/cgi-bin/ovsman.cgi?page=utilities%2Fovs-ofctl.8">http://openvswitch.org/cgi-bin/ovsman.cgi?page=utilities%2Fovs-ofctl.8</a><br>
      Attached you can find my new OpenvSwitch.rb that does the
      filtering with the minimum rules possible applying masks.<br>
      I don't know if this could be uploaded to the issue tracking
      system, but by now with this driver you must compile Open vSwitch
      ( Ubuntu 12.04 )<br>
      <br>
      On 02/19/2013 11:19 AM, Jaime Melis wrote:<br>
    </div>
    <blockquote
cite="mid:CA+HrgRo3nGd1tkTF2BqRUVdAEDCgm_KN00=HQNhKt9Gj+5ufxA@mail.gmail.com"
      type="cite">
      <div dir="ltr">Hi Oriol
        <div><br>
        </div>
        <div style="">I don't know if creating that many rules will
          impact Open vSwitch's performance, I guess it's something you
          could ask in the Open vSwitch mailing list, or give it a try
          yourself and see if it works fine.</div>
        <div style=""><br>
        </div>
        <div style="">In any case I think that the approach you
          described above is the correct one.</div>
        <div style=""><br>
        </div>
        <div style="">cheers,<br>
          Jaime</div>
      </div>
      <div class="gmail_extra"><br>
        <br>
        <div class="gmail_quote"> On Mon, Feb 18, 2013 at 1:24 PM, Oriol
          Martí <span dir="ltr"><<a moz-do-not-send="true"
              href="mailto:omarti@cesca.cat" target="_blank">omarti@cesca.cat</a>></span>
          wrote:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <div>Hi Jaime, <br>
                looking at the file
                /var/lib/one/remotes/vnm/ovswitch/OpenvSwitch.rb<br>
                My idea is to add that black_ports look for : and do the
                command<br>
                   
                add_flow("tcp,dl_dst=#{@nic[:mac]},tp_dst=#{p}",:drop)<br>
                for every port in the range.<br>
                With the white_port, the normal behaviour is all closed
                but the indicated ports? my idea is to do the drop for
                all the ports but the indicated ports.<br>
                Is this correct? I'm not sure if this big amount of
                rules can add extra load to the node or it can derive to
                problems...<br>
                <br>
                Thanks,
                <div>
                  <div class="h5"><br>
                    <br>
                    On 02/18/2013 12:33 PM, Jaime Melis wrote:<br>
                  </div>
                </div>
              </div>
              <div>
                <div class="h5">
                  <blockquote type="cite">
                    <div dir="ltr">Hi Oriol,
                      <div><br>
                      </div>
                      <div>yes, WHITE_PORTS is not implement, and
                        neither are port ranges with semi-colon:</div>
                      <div><a moz-do-not-send="true"
href="http://opennebula.org/documentation:rel3.8:openvswitch#network_filtering"
                          target="_blank">http://opennebula.org/documentation:rel3.8:openvswitch#network_filtering</a><br>
                      </div>
                      <div><br>
                      </div>
                      <div>The reason is because iptables filters won't
                        work with Open vSwitch, so port filtering is
                        implemented via OpenFlow. If you find a way to
                        improve the drivers it would be really nice. Let
                        me know if I can help in any way.</div>
                      <div><br>
                      </div>
                      <div>cheers,<br>
                        Jaime</div>
                    </div>
                    <div class="gmail_extra"><br>
                      <br>
                      <div class="gmail_quote">On Mon, Feb 18, 2013 at
                        11:52 AM, Oriol Martí <span dir="ltr"><<a
                            moz-do-not-send="true"
                            href="mailto:omarti@cesca.cat"
                            target="_blank">omarti@cesca.cat</a>></span>
                        wrote:<br>
                        <blockquote class="gmail_quote" style="margin:0
                          0 0 .8ex;border-left:1px #ccc
                          solid;padding-left:1ex">Hi,<br>
                          I'm deploying the Open vswitch driver and when
                          I create one VM with the BLACK and WHITE_PORTS
                          it doesn't work.<br>
                          <br>
                          I've seen the code and I'm not sure, but I
                          think that white port is not implemented and
                          the black ports only is doing a strip for ","
                          not by ":", then if you want to configure a VM
                          with all the ports closed and only opened the
                          80 is very difficult to do because you would
                          have to write all the ports, one by one, and
                          is impossible to indicate a range of ports
                          like 80:65535<br>
                          <br>
                          I'm thinking to write the code necessary to do
                          that, but I'm not sure, because I don't know
                          the reason why is not finished.... Does
                          anybody know something about that?<br>
                          <br>
                          Best regards,<br>
                          <br>
_______________________________________________<br>
                          Users mailing list<br>
                          <a moz-do-not-send="true"
                            href="mailto:Users@lists.opennebula.org"
                            target="_blank">Users@lists.opennebula.org</a><br>
                          <a moz-do-not-send="true"
                            href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org"
                            target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a><br>
                        </blockquote>
                      </div>
                      <br>
                    </div>
                    <br clear="all">
                    <div><br>
                    </div>
                    -- <br>
                    Jaime Melis<br>
                    Project Engineer<br>
                    OpenNebula - The Open Source Toolkit for Cloud
                    Computing<br>
                    <a moz-do-not-send="true"
                      href="http://www.OpenNebula.org" target="_blank">www.OpenNebula.org</a>
                    | <a moz-do-not-send="true"
                      href="mailto:jmelis@opennebula.org"
                      target="_blank">jmelis@opennebula.org</a> </blockquote>
                  <br>
                </div>
              </div>
            </div>
          </blockquote>
        </div>
        <br>
        <br clear="all">
        <div><br>
        </div>
        -- <br>
        Jaime Melis<br>
        Project Engineer<br>
        OpenNebula - The Open Source Toolkit for Cloud Computing<br>
        <a moz-do-not-send="true" href="http://www.OpenNebula.org"
          target="_blank">www.OpenNebula.org</a> | <a
          moz-do-not-send="true" href="mailto:jmelis@opennebula.org"
          target="_blank">jmelis@opennebula.org</a> </div>
    </blockquote>
    <br>
    <br>
    <pre class="moz-signature" cols="72">-- 

......................................................................
         __
        / /          Oriol Martí Bonvehí
  C E / S / C A      Administrador de Sistemes
      /_/            Centre de Supercomputació de Catalunya

  Gran Capità, 2-4 (Edifici Nexus) · 08034 Barcelona
  T. 93 551 6212  · F.  93 205 6979 · <a class="moz-txt-link-abbreviated" href="mailto:omarti@cesca.cat">omarti@cesca.cat</a>
...................................................................... 
</pre>
  </body>
</html>