Add support for limiting the number of flows in an OpenFlow flow table.

Signed-off-by: Ben Pfaff <blp@nicira.com>

1 files changed, 220 insertions, 0 deletions

diff --git a/tests/ofproto.at b/tests/ofproto.at
index b54d1dd1b..7c34e14d6 100644
--- a/tests/ofproto.at
+++ b/tests/ofproto.at
@@ -201,3 +201,223 @@ NXST_FLOW reply:
 ])
 OVS_VSWITCHD_STOP
 AT_CLEANUP
+
+AT_SETUP([ofproto - flow table configuration])
+OVS_VSWITCHD_START
+# Check the default configuration.
+(echo "OFPST_TABLE reply (xid=0x1): 255 tables
+  0: classifier: wild=0x3fffff, max=1000000, active=0
+               lookup=0, matched=0"
+ x=1
+ while test $x -lt 255; do
+   printf "  %d: %-8s: wild=0x3fffff, max=1000000, active=0
+               lookup=0, matched=0
+" $x table$x
+   x=`expr $x + 1`
+ done) > expout
+AT_CHECK([ovs-ofctl dump-tables br0], [0], [expout])
+# Change the configuration.
+AT_CHECK(
+  [ovs-vsctl \
+     -- --id=@t0 create Flow_Table name=main \
+     -- --id=@t1 create Flow_Table flow-limit=1024 \
+     -- set bridge br0 'flow_tables={1=@t1,0=@t0}' \
+   | perl $srcdir/uuidfilt.pl],
+  [0], [<0>
+<1>
+])
+# Check that the configuration was updated.
+mv expout orig-expout
+(echo "OFPST_TABLE reply (xid=0x1): 255 tables
+  0: main    : wild=0x3fffff, max=1000000, active=0
+               lookup=0, matched=0
+  1: table1  : wild=0x3fffff, max=  1024, active=0
+               lookup=0, matched=0"
+ tail -n +6 orig-expout) > expout
+AT_CHECK([ovs-ofctl dump-tables br0], [0], [expout])
+OVS_VSWITCHD_STOP
+AT_CLEANUP
+
+AT_SETUP([ofproto - hard limits on flow table size])
+OVS_VSWITCHD_START
+# Configure a maximum of 4 flows.
+AT_CHECK(
+  [ovs-vsctl \
+     -- --id=@t0 create Flow_Table flow-limit=4 \
+     -- set bridge br0 flow_tables:0=@t0 \
+   | perl $srcdir/uuidfilt.pl],
+  [0], [<0>
+])
+# Add 4 flows.
+for in_port in 1 2 3 4; do
+    ovs-ofctl add-flow br0 in_port=$in_port,actions=drop
+done
+AT_CHECK([ovs-ofctl dump-flows br0 | ofctl_strip | sort], [0], [dnl
+ in_port=1 actions=drop
+ in_port=2 actions=drop
+ in_port=3 actions=drop
+ in_port=4 actions=drop
+NXST_FLOW reply:
+])
+# Adding another flow will be refused.
+AT_CHECK([ovs-ofctl add-flow br0 in_port=5,actions=drop], [1], [], [stderr])
+AT_CHECK([head -n 1 stderr], [0],
+  [OFPT_ERROR (xid=0x1): OFPFMFC_ALL_TABLES_FULL
+])
+# Also a mod-flow that would add a flow will be refused.
+AT_CHECK([ovs-ofctl mod-flows br0 in_port=5,actions=drop], [1], [], [stderr])
+AT_CHECK([head -n 1 stderr], [0],
+  [OFPT_ERROR (xid=0x1): OFPFMFC_ALL_TABLES_FULL
+])
+# Replacing or modifying an existing flow is allowed.
+AT_CHECK([ovs-ofctl add-flow br0 in_port=4,actions=normal])
+AT_CHECK([ovs-ofctl mod-flows br0 in_port=3,actions=output:1])
+AT_CHECK([ovs-ofctl dump-flows br0 | ofctl_strip | sort], [0], [dnl
+ in_port=1 actions=drop
+ in_port=2 actions=drop
+ in_port=3 actions=output:1
+ in_port=4 actions=NORMAL
+NXST_FLOW reply:
+])
+OVS_VSWITCHD_STOP
+AT_CLEANUP
+
+AT_SETUP([ofproto - eviction upon table overflow])
+OVS_VSWITCHD_START
+# Configure a maximum of 4 flows.
+AT_CHECK(
+  [ovs-vsctl \
+     -- --id=@t0 create Flow_Table flow-limit=4 overflow-policy=evict \
+     -- set bridge br0 flow_tables:0=@t0 \
+   | perl $srcdir/uuidfilt.pl],
+  [0], [<0>
+])
+# Add 4 flows.
+for in_port in 4 3 2 1; do
+    ovs-ofctl add-flow br0 idle_timeout=${in_port}0,in_port=$in_port,actions=drop
+done
+AT_CHECK([ovs-ofctl dump-flows br0 | ofctl_strip | sort], [0], [dnl
+ idle_timeout=10,in_port=1 actions=drop
+ idle_timeout=20,in_port=2 actions=drop
+ idle_timeout=30,in_port=3 actions=drop
+ idle_timeout=40,in_port=4 actions=drop
+NXST_FLOW reply:
+])
+# Adding another flow will cause the one that expires soonest to be evicted.
+AT_CHECK([ovs-ofctl add-flow br0 in_port=5,actions=drop])
+AT_CHECK([ovs-ofctl dump-flows br0 | ofctl_strip | sort], [0], [dnl
+ idle_timeout=20,in_port=2 actions=drop
+ idle_timeout=30,in_port=3 actions=drop
+ idle_timeout=40,in_port=4 actions=drop
+ in_port=5 actions=drop
+NXST_FLOW reply:
+])
+# A mod-flow that adds a flow also causes eviction, but replacing or
+# modifying an existing flow doesn't.
+AT_CHECK([ovs-ofctl mod-flows br0 in_port=6,actions=drop])
+AT_CHECK([ovs-ofctl add-flow br0 in_port=4,actions=normal])
+AT_CHECK([ovs-ofctl mod-flows br0 in_port=3,actions=output:1])
+AT_CHECK([ovs-ofctl dump-flows br0 | ofctl_strip | sort], [0], [dnl
+ idle_timeout=30,in_port=3 actions=output:1
+ in_port=4 actions=NORMAL
+ in_port=5 actions=drop
+ in_port=6 actions=drop
+NXST_FLOW reply:
+])
+# Flows with no timeouts at all cannot be evicted.
+AT_CHECK([ovs-ofctl add-flow br0 in_port=7,actions=normal])
+AT_CHECK([ovs-ofctl add-flow br0 in_port=8,actions=drop], [1], [], [stderr])
+AT_CHECK([head -n 1 stderr], [0],
+  [OFPT_ERROR (xid=0x1): OFPFMFC_ALL_TABLES_FULL
+])
+AT_CHECK([ovs-ofctl dump-flows br0 | ofctl_strip | sort], [0], [dnl
+ in_port=4 actions=NORMAL
+ in_port=5 actions=drop
+ in_port=6 actions=drop
+ in_port=7 actions=NORMAL
+NXST_FLOW reply:
+])
+OVS_VSWITCHD_STOP
+AT_CLEANUP
+
+AT_SETUP([ofproto - eviction upon table overflow, with fairness])
+OVS_VSWITCHD_START
+# Configure a maximum of 4 flows.
+AT_CHECK(
+  [ovs-vsctl \
+     -- --id=@t0 create Flow_Table name=evict flow-limit=4 \
+                                   overflow-policy=evict \
+                                   groups='"NXM_OF_IN_PORT[[]]"' \
+     -- set bridge br0 flow_tables:0=@t0 \
+   | perl $srcdir/uuidfilt.pl],
+  [0], [<0>
+])
+# Add 4 flows.
+ovs-ofctl add-flows br0 - <<EOF
+idle_timeout=10 in_port=2 dl_src=00:44:55:66:77:88 actions=drop
+idle_timeout=20 in_port=1 dl_src=00:11:22:33:44:55 actions=drop
+idle_timeout=30 in_port=1 dl_src=00:22:33:44:55:66 actions=drop
+idle_timeout=40 in_port=1 dl_src=00:33:44:55:66:77 actions=drop
+EOF
+AT_CHECK([ovs-ofctl dump-flows br0 | ofctl_strip | sort], [0], [dnl
+ idle_timeout=10,in_port=2,dl_src=00:44:55:66:77:88 actions=drop
+ idle_timeout=20,in_port=1,dl_src=00:11:22:33:44:55 actions=drop
+ idle_timeout=30,in_port=1,dl_src=00:22:33:44:55:66 actions=drop
+ idle_timeout=40,in_port=1,dl_src=00:33:44:55:66:77 actions=drop
+NXST_FLOW reply:
+])
+# Adding another flow will cause the one that expires soonest within
+# the largest group (those with in_port=1) to be evicted.  In this
+# case this is not the same as the one that expires soonest overall
+# (which is what makes the test interesting):
+AT_CHECK([ovs-ofctl add-flow br0 in_port=2,dl_src=00:55:66:77:88:99,actions=drop])
+AT_CHECK([ovs-ofctl dump-flows br0 | ofctl_strip | sort], [0], [dnl
+ idle_timeout=10,in_port=2,dl_src=00:44:55:66:77:88 actions=drop
+ idle_timeout=30,in_port=1,dl_src=00:22:33:44:55:66 actions=drop
+ idle_timeout=40,in_port=1,dl_src=00:33:44:55:66:77 actions=drop
+ in_port=2,dl_src=00:55:66:77:88:99 actions=drop
+NXST_FLOW reply:
+])
+# Enlarge the flow limit, change the eviction policy back to strictly
+# based on expiration, and and add some flows.
+AT_CHECK([ovs-vsctl set Flow_Table evict groups='[[]]' flow-limit=7])
+ovs-ofctl add-flows br0 - <<EOF
+idle_timeout=50 in_port=2 dl_src=00:66:77:88:99:aa actions=drop
+idle_timeout=60 in_port=2 dl_src=00:77:88:99:aa:bb actions=drop
+idle_timeout=70 in_port=2 dl_src=00:88:99:aa:bb:cc actions=drop
+EOF
+AT_CHECK([ovs-ofctl dump-flows br0 | ofctl_strip | sort], [0], [dnl
+ idle_timeout=10,in_port=2,dl_src=00:44:55:66:77:88 actions=drop
+ idle_timeout=30,in_port=1,dl_src=00:22:33:44:55:66 actions=drop
+ idle_timeout=40,in_port=1,dl_src=00:33:44:55:66:77 actions=drop
+ idle_timeout=50,in_port=2,dl_src=00:66:77:88:99:aa actions=drop
+ idle_timeout=60,in_port=2,dl_src=00:77:88:99:aa:bb actions=drop
+ idle_timeout=70,in_port=2,dl_src=00:88:99:aa:bb:cc actions=drop
+ in_port=2,dl_src=00:55:66:77:88:99 actions=drop
+NXST_FLOW reply:
+])
+# Adding another flow will cause the one that expires soonest overall
+# to be evicted.
+AT_CHECK([ovs-ofctl add-flow br0 'idle_timeout=80 in_port=2 dl_src=00:99:aa:bb:cc:dd actions=drop'])
+AT_CHECK([ovs-ofctl dump-flows br0 | ofctl_strip | sort], [0], [dnl
+ idle_timeout=30,in_port=1,dl_src=00:22:33:44:55:66 actions=drop
+ idle_timeout=40,in_port=1,dl_src=00:33:44:55:66:77 actions=drop
+ idle_timeout=50,in_port=2,dl_src=00:66:77:88:99:aa actions=drop
+ idle_timeout=60,in_port=2,dl_src=00:77:88:99:aa:bb actions=drop
+ idle_timeout=70,in_port=2,dl_src=00:88:99:aa:bb:cc actions=drop
+ idle_timeout=80,in_port=2,dl_src=00:99:aa:bb:cc:dd actions=drop
+ in_port=2,dl_src=00:55:66:77:88:99 actions=drop
+NXST_FLOW reply:
+])
+# Reducing the flow limit also causes the flows that expire soonest
+# overall to be evicted.
+AT_CHECK([ovs-vsctl set Flow_Table evict flow-limit=4])
+AT_CHECK([ovs-ofctl dump-flows br0 | ofctl_strip | sort], [0], [dnl
+ idle_timeout=60,in_port=2,dl_src=00:77:88:99:aa:bb actions=drop
+ idle_timeout=70,in_port=2,dl_src=00:88:99:aa:bb:cc actions=drop
+ idle_timeout=80,in_port=2,dl_src=00:99:aa:bb:cc:dd actions=drop
+ in_port=2,dl_src=00:55:66:77:88:99 actions=drop
+NXST_FLOW reply:
+])
+OVS_VSWITCHD_STOP
+AT_CLEANUP