ovsdb: Force strong references to non-root tables to be persistent.

When a strong reference to a non-root table is ephemeral, the database log
can contain inconsistencies.  In particular, if the column in question is
the only reference to a row, then the row will be created in one logged
transaction but the reference to it will not be logged (because it is
ephemeral).  Thus, any later occurrence of the row later in the log (to
modify it, to delete it, or just to reference it) will yield a transaction
error and reading the database will abort at that point.

This commit fixes the problem by forcing any column with a strong reference
to a non-root table to be persistent.

The change to ovsdb_schema_from_json() looks bigger than it really is: it
just swaps the order of two operations on the schema and updates their
comments.  Similarly for the update to ovs.db.DbSchema.__init__().

Bug #5144.
Reported-by: Sujatha Sumanth <ssumanth@nicira.com>
Bug #5149.
Reported-by: Ram Jothikumar <rjothikumar@nicira.com>

2 files changed, 49 insertions, 23 deletions

diff --git a/ovsdb/SPECS b/ovsdb/SPECS
index 3a9af9f39..d413c2845 100644
--- a/ovsdb/SPECS
+++ b/ovsdb/SPECS
@@ -184,12 +184,18 @@ is represented by <database-schema>, as described below.
         "ephemeral": <boolean>                    optional
         "mutable": <boolean>                      optional
 
-    The "type" specifies the type of data stored in this column.  If
-    "ephemeral" is specified as true, then this column's values are
+    The "type" specifies the type of data stored in this column.
+
+    If "ephemeral" is specified as true, then this column's values are
     not guaranteed to be durable; they may be lost when the database
-    restarts.  If "mutable" is specified as false, then this column's
-    values may not be modified after they are initially set with the
-    "insert" operation.
+    restarts.  A column whose type (either key or value) is a strong
+    reference to a table that is not part of the root set is always
+    durable, regardless of this value.  (Otherwise, restarting the
+    database could lose entire rows.)
+
+    If "mutable" is specified as false, then this column's values may
+    not be modified after they are initially set with the "insert"
+    operation.
 
 <type>
 
diff --git a/ovsdb/ovsdb.c b/ovsdb/ovsdb.c
index d4a27d40e..abe88e9f9 100644
--- a/ovsdb/ovsdb.c
+++ b/ovsdb/ovsdb.c
@@ -103,20 +103,36 @@ ovsdb_schema_from_file(const char *file_name, struct ovsdb_schema **schemap)
 }
 
 static struct ovsdb_error * WARN_UNUSED_RESULT
-ovsdb_schema_check_ref_table(const struct ovsdb_column *column,
+ovsdb_schema_check_ref_table(struct ovsdb_column *column,
                              const struct shash *tables,
                              const struct ovsdb_base_type *base,
                              const char *base_name)
 {
-    if (base->type == OVSDB_TYPE_UUID && base->u.uuid.refTableName
-        && !shash_find(tables, base->u.uuid.refTableName)) {
+    struct ovsdb_table_schema *refTable;
+
+    if (base->type != OVSDB_TYPE_UUID || !base->u.uuid.refTableName) {
+        return NULL;
+    }
+
+    refTable = shash_find_data(tables, base->u.uuid.refTableName);
+    if (!refTable) {
         return ovsdb_syntax_error(NULL, NULL,
                                   "column %s %s refers to undefined table %s",
                                   column->name, base_name,
                                   base->u.uuid.refTableName);
-    } else {
-        return NULL;
     }
+
+    if (ovsdb_base_type_is_strong_ref(base) && !refTable->is_root) {
+        /* We cannot allow a strong reference to a non-root table to be
+         * ephemeral: if it is the only reference to a row, then replaying the
+         * database log from disk will cause the referenced row to be deleted,
+         * even though it did exist in memory.  If there are references to that
+         * row later in the log (to modify it, to delete it, or just to point
+         * to it), then this will yield a transaction error. */
+        column->persistent = true;
+    }
+
+    return NULL;
 }
 
 static bool
@@ -198,7 +214,23 @@ ovsdb_schema_from_json(struct json *json, struct ovsdb_schema **schemap)
         shash_add(&schema->tables, table->name, table);
     }
 
-    /* Validate that all refTables refer to the names of tables that exist. */
+    /* "isRoot" was not part of the original schema definition.  Before it was
+     * added, there was no support for garbage collection.  So, for backward
+     * compatibility, if the root set is empty then assume that every table is
+     * in the root set. */
+    if (root_set_size(schema) == 0) {
+        SHASH_FOR_EACH (node, &schema->tables) {
+            struct ovsdb_table_schema *table = node->data;
+
+            table->is_root = true;
+        }
+    }
+
+    /* Validate that all refTables refer to the names of tables that exist.
+     *
+     * Also force certain columns to be persistent, as explained in
+     * ovsdb_schema_check_ref_table().  This requires 'is_root' to be known, so
+     * this must follow the loop updating 'is_root' above. */
     SHASH_FOR_EACH (node, &schema->tables) {
         struct ovsdb_table_schema *table = node->data;
         struct shash_node *node2;
@@ -220,18 +252,6 @@ ovsdb_schema_from_json(struct json *json, struct ovsdb_schema **schemap)
         }
     }
 
-    /* "isRoot" was not part of the original schema definition.  Before it was
-     * added, there was no support for garbage collection.  So, for backward
-     * compatibility, if the root set is empty then assume that every table is
-     * in the root set. */
-    if (root_set_size(schema) == 0) {
-        SHASH_FOR_EACH (node, &schema->tables) {
-            struct ovsdb_table_schema *table = node->data;
-
-            table->is_root = true;
-        }
-    }
-
     *schemap = schema;
     return 0;
 }