delta/openvswitch.git/build-aux, branch master

python: Include aliases in ofp_fields.py.

2022-12-21T17:36:02+00:00

We currently auto-generate a dictionary of field names and decoders.
However, sometimes fields can be specified by their cannonical NXM or
OXM names.

Modify gen_ofp_field_decoders to also generate a dictionary of aliases
so it's easy to map OXM/NXM names to their fields and decoding
information.

Signed-off-by: Adrian Moreno 
Acked-by: Mike Pattrick 
Signed-off-by: Ilya Maximets

Add support for OpenSSL 3.0 functions.

2022-10-07T08:52:20+00:00

In OpenSSL 3.0 some functions were deprecated and replaced.
This commit adds some #ifdef to build without warning on both
OpenSSL 1.x and OpenSSL 3.x.

For OpenSSL 3.x, the default built-in DH parameters are used (as
suggested by SSL_CTX_set_dh_auto manpage).

Signed-off-by: Timothy Redaelli 
Signed-off-by: Ilya Maximets

dhparams: Fix .c file generation with OpenSSL >= 3.0.

2022-10-07T08:52:20+00:00

Since OpenSSL upstream commit 1696b8909bbe
("Remove -C from dhparam,dsaparam,ecparam") "openssl dhparam" doesn't
support -C anymore.

This commit changes generate-dhparams-c to generate dhparams.c by parsing
"openssl dhparam -in "$1" -text -noout" output directly.

The generated file won't be used on OpenSSL >= 3.0, but it's still
needed to be generated if OVS is built on OpenSSL < 3.0.

Signed-off-by: Timothy Redaelli 
Signed-off-by: Ilya Maximets

xenserver: Remove xenserver.

2022-08-15T11:07:13+00:00

Remove the current xenserver implementation - it is obsolete and
since 3.0 we do not support kernel module builds [1].

1. https://mail.openvswitch.org/pipermail/ovs-dev/2022-July/395789.html

[i.maximets]
Can be added back if people willing to maintain it will be found.

Signed-off-by: Greg Rose 
Signed-off-by: Ilya Maximets

build-aux: Generate ofp field decoders.

2022-07-15T18:13:38+00:00

Based on meta-field information extracted by extract_ofp_fields,
autogenerate the right decoder to be used.

Acked-by: Eelco Chaudron 
Signed-off-by: Adrian Moreno 
Signed-off-by: Ilya Maximets

build-aux: Split extract-ofp-fields.

2022-07-15T15:40:55+00:00

In order to be able to reuse the core extraction logic, split the command
in two parts. The core extraction logic is moved to python/build while
the command that writes the different files out of the extracted field
info is kept in build-aux.

Acked-by: Eelco Chaudron 
Signed-off-by: Adrian Moreno 
Signed-off-by: Ilya Maximets

make: Remove the Linux datapath.

2022-07-15T11:45:55+00:00

Update the necessary make and configure files to remove the Linux
datapath and then remove the datapath.

Move datapath/linux/compat/include/linux/openvswitch.h to
include/linux/openvswitch.h because it is needed to generate header
files used by the userspace switch.

Also remove references to the Linux datapath from auxiliary files
and utilities since it is no longer supported.

Signed-off-by: Greg Rose 
Reviewed-by: David Marchand 
Signed-off-by: Ilya Maximets

debian: Update packaging source from Debian/Ubuntu.

2022-07-15T11:45:55+00:00

* Update upstream OVS debian packaging to be on par with package
  source in Debian/Ubuntu:
  - Provide a openvswitch-switch-dpdk package that integrates with
    the dpdk package in the distributions so that end users can opt
    into a DPDK-enabled Open vSwitch binary.
  - Provide systemd service files.
  - Provide openvswitch-source package for reproducible integrated
    build of for example OVN.
  - Stop building shared library and subsequently remove
    libopenvswitch and libopenvswitch-dev binary packages.

Co-authored-by: Luca Boccassi 
Signed-off-by: Luca Boccassi 
Co-authored-by: Christian Ehrhardt 
Signed-off-by: Christian Ehrhardt 
Co-authored-by: James Page 
Signed-off-by: James Page 
Co-authored-by: Corey Bryant 
Signed-off-by: Corey Bryant 
Signed-off-by: Frode Nordahl 
Signed-off-by: Ilya Maximets

ovs-actions: Convert man page from xml to rST.

2021-08-31T18:56:47+00:00

This way it's easier to show it on a website as it will be updated
automatically along with the rest of the documentation.

Sphinx doesn't render everything perfectly, but it looks good enough
in both man and html versions.  rST is a bit easier to read and it
takes less space.

Conversion performed manually since I didn't found any good tool
that can actually make the process any faster.

Along the way I replaced versions like x.y.90 with x.y+1, because
it doesn't seem correct to me to refer non-released versions of OVS
in the docs.  Fixed a couple of small mistakes like duplicated
paragraph and reference to a different section by incorrect name.
Also removed bits of xml->nroff conversion code that is not needed
anymore.

Signed-off-by: Ilya Maximets 
Acked-by: Roi Dayan

stream-ssl: Remove unsafe 1024 bit dh params

2021-07-07T20:25:32+00:00

Using 1024 bit params for DH is considered unsafe [1]. Additionally,
from [2]:

"Modern servers that do not support export ciphersuites are advised to
either use SSL_CTX_set_tmp_dh() or alternatively, use the callback but
ignore keylength and is_export and simply supply at least 2048-bit
parameters in the callback."

Additionally, using 1024 bit dh params may block clients running on
recent openssl version from connecting given the stricter default
security requirements of those new openssl versions. The error message
for these clients looks like:

error:141A318A:SSL routines:tls_process_ske_dhe:dh key too small:ssl/statem/statem_clnt.c:2150

As a workaround, this error can be suppressed tweaking the cipher list
(--ssl-ciphers) to either 'HIGH:!aNULL:!MD5:@SECLEVEL=1' to reduce
security requirements or 'HIGH:!aNULL:!MD5:!DH' to avoid using fixed
param DH based ciphers. The first option is recommended though as it
likely a fixed param DH cipher is the best possible option in that
situation.

[1] https://weakdh.org/
[2] https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_tmp_dh_callback.html

Signed-off-by: Jaime Caamaño Ruiz 
Signed-off-by: Ben Pfaff