[Neutron][Firewall] Extend FWaaS to provide DSCP filtering

[Reedip]

Currently Firewall-as-a-Service provides filteration based on the protocol , Source and Destination Port and IP address.
However, there is a scope for implementing a deeper packet inspection , by implementing DSCP based filtering in FWaaS.

Intention of this bug is to submit a request for feature enhancement to include DSCP based filtering in the current Firewall implementation.

A similar proposal was pursued in [1]. This is a similar proposal in line with the Neutron's procedure for filing Feature Enhancements.

References:

[1]: https://blueprints.launchpad.net/neutron/+spec/neutron-fwaas-extension-dscp

[German Eichberger (german-eichberger)]

Having more L7 type filtering is definitely on the roadmap so this is a good feature.

[Lujin Luo (luo-lujin)]

Is this a request for RFE? If so, could you please add [RFE] at the beginning of the title and bring it to Neuton team IRC meeting?

[Reedip (reedip-banerjee-deactivatedaccount)]

Hi Lujin, this is probably an RFE, but I guess the Driver team would be best to comment on it, if it can be accepted as a feature or would be treated as a simple bug fix. Thats why I didnt put the [RFE} in the title yet.
I am waiting for one of the Driver Team core members to comment on this.
FWIW this is an RFE from FWaaS team

[YAMAMOTO Takashi (yamamoto)]

is fwaas v2 already stable? otherwise adding new features might not be a good idea for now.

[Reedip (reedip-banerjee-deactivatedaccount)]

Point noted, but implementation would be at a later stage, if there is a spec required for it.

[Miguel Lavalle (minsel)]

The FWaaS team indicated recently in regards to another RFE that they consider the V2.0 API stable enough to start adding features. I will move this RFE to the confirmed stage, based on German's feedback above and will ask other FWaaS team members to chime in

[Sridar Kandaswamy (skandasw)]

Yes I am +1 on this as well, it is a common use case where DSCP marks are used to convey some information (for example a L4-L7 classification) and enabling some filtering on that is good. I did file [1] referenced in the description above with this intent. Now I think the API is at a point to start looking at this.

[Miguel Lavalle (minsel)]

This RFE is approved

[Slawek Kaplonski (slaweq)]

Regarding current status of neutron-fwaas project I'm going to mark this one as won't fix for now.