In FWaaS, when someone makes a change to a firewall rule we know, Who, What, When, and Where

[Nate Johnston]

In the FWaaS service, create the ability for administrators to engage an 'audit trail' feature. The audit trail would notate every change to firewalls that causes a security change. The output would be to the notification queue.

Audit notations should contain all information necessary to process them. For example, an audit notation that says "user abcde1234 permitted port 22 traffic from firewall group A to firewall group B" is not enough information. In order to determine what needs to be scanned, the consumer of the audit would need to subsequently query FWaaS to determine the membership of the 2 firewall groups cited. Notations should carry enough information so that no subsequent querying is required for processing.

The notification should encompass all of:

- Who: Identity of the user initiating the change.
- What: The information on what was changed. Should include port information, whether access was permitted or disallowed, etc.
- Where: A list of all affected ports/IP addresses/instances, grouped by connection origin/destination. This could be abbreviated to indicate an entire tenant if that is the target.
- When: Timestamp indicating when the change was initiated.

Use case: This would allow a customer's security group to subscribe to a collated feed of all security events in order to detect those events that should trigger an audit or vulnerability scan.

[Travis Truman (travis-truman)]

Presumably, the deletion of firewalls would also cause a notification to be emitted. That's not explicit above, but I believe implied.

[Nate Johnston (nate-johnston)]

@travis: Yes, this would apply for any change, which should encompass the full spectrum of create/update/delete.

[Ihar Hrachyshka (ihar-hrachyshka)]

Doesn't base neutron API router already issue notifications for all resource changes?

[Kevin Benton (kevinbenton)]

@Ihar, I think this point wouldn't be included in the API notification because it sounds calculated.

"- Where: A list of all affected ports/IP addresses/instances, grouped by connection origin/destination. This could be abbreviated to indicate an entire tenant if that is the target."

[Armando Migliaccio (armando-migliaccio)]

This makes sense to me.

[Kevin Benton (kevinbenton)]

Moving to rfe-postponed for now unless we have a volunteer to implement the feature in FWaaS.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/452372

[OpenStack Infra (hudson-openstack)]

Change abandoned by Armando Migliaccio (<email address hidden>) on branch: master
Review: https://review.openstack.org/452372
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Slawek Kaplonski (<email address hidden>) on branch: master
Review: https://review.opendev.org/461657
Reason: According to what we agreed during Shanghai PTG, I abandon this patch for now due to no activity. If You would be interested in continue work on this, feel free to restore the patch.

[Slawek Kaplonski (slaweq)]

This bug has had a related patch abandoned and has been automatically un-assigned due to inactivity. Please re-assign yourself if you are continuing work or adjust the state as appropriate if it is no longer valid.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Slawek Kaplonski (<email address hidden>) on branch: master
Review: https://review.opendev.org/452372
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.