summaryrefslogtreecommitdiff
path: root/AUTHORS
Commit message (Collapse)AuthorAgeFilesLines
* ovs-sandbox: Use $schema for creating the db.Duffie Cooley2013-05-011-1/+1
| | | | | | | | The code here went to some trouble to properly set $schema and then ignored it. Signed-off-by: Duffie Cooley <dcooley@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* ofproto-dpif: Fix 'size' argument to fix_sflow_action().Ben Pfaff2013-04-301-0/+1
| | | | | | | | | | | The sflow action only uses 8 bytes of the total 16 for user_action_cookie, but fix_sflow_action() was checking for the presence of all 16, so if the sflow action wasn't followed by a few other actions then 'cookie' would end up NULL and the assertion would segfault. Bug #16659. Reported-by: Dhaval Badiani <dbadiani@vmware.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* python: fix a typo error in python/ovs/socket_util.py.Alex Wang2013-04-181-0/+1
| | | | | | | | | | | | | The commit 89d7ffa9 (python: Workaround UNIX socket path length limits), fixes most failed tests. But it has a typo and the typo causes the failure of test <unixctl server errors - Python> when the path length is very long (e.g. more than 90 characters). This patch fixes the above issue. Signed-off-by: Alex Wang <alexw@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* Correctly implement the OpenFlow 1.2+ OXM_OF_IP_DSCP field.Ben Pfaff2013-04-181-0/+1
| | | | | | | | | | | | | NXM puts the DSCP value in bits 2-7 of NXM_OF_IP_TOS. OXM puts the DSCP value in bits 0-6 of OXM_OF_IP_DSCP. Before this commit, Open vSwitch incorrectly implemented OXM_OF_IP_DSCP with the same format as NXM_OF_IP_TOS. This commit fixes the problem and adds a test (previously missing but I don't know why). Reported-by: Hiroshi Miyata <miyahiro.dazu@gmail.com> Tested-by: Hiroshi Miyata <miyahiro.dazu@gmail.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* debian: build with debugging symbolBen Pfaff2013-04-151-0/+1
| | | | | Signed-off-by: Zang MingJie <zealot0630@gmail.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* AUTHORS: Add Ansis Atteka.Ben Pfaff2013-04-111-0/+1
| | | | | | | I do not understand how this omission has gone on so long. CC: Ansis Atteka <aatteka@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* bridge: Complete initial configuration even with empty database.Ben Pfaff2013-04-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | If the database was empty, that is, it did not even contain an Open_vSwitch top-level configuration record, at ovs-vswitchd startup time, then OVS failed to detach and used 100% CPU. This commit fixes the problem. This problem was introduced by commit 63ff04e82623e765 (bridge: Only complete daemonization after db commits initial config.). This problem did not manifest if the initscripts supplied with Open vSwitch were used, because those initscripts always initialize the database before starting ovs-vswitchd, so this problem affects only users with hand-rolled local OVS startup scripts. Bug #16090. Reported-by: Pravin Shelar <pshelar@nicira.com> Tested-by: Pravin Shelar <pshelar@nicira.com> Reported-by: Paul Ingram <paul@nicira.com> Reported-by: Amre Shakimov <ashakimov@vmware.com> Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Ansis Atteka <aatteka@nicira.com>
* ovs-ctl: Connect to remote OVSDB managers only after ovs-vswitchd starts.Ben Pfaff2013-04-101-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Until now, ovs-ctl has started ovsdb-server with the full set of remote managers configured. This means that ovsdb-server immediately connects to these managers, before ovs-vswitchd even starts. Because the Open vSwitch schema has several ephemeral columns, there will be considerable startup churn in the database. For example, ovs-vswitchd will initially fill in the datapath-id and ofport columns as it starts and sets up the initial configuration. This churn wastes bandwidth to the remote managers and has potential for confusing them. This commit reduces the churn by changing ovs-ctl so that ovsdb-server connects to the remote managers only after ovs-vswitchd has finished its initial configuration. This means that remote managers will initially see a filled-in database, not one that has its ephemeral columns empty. This commit does not mean that managers can ignore the possibility that some columns have not yet been filled in. For example, some columns will still be briefly blank after a new bridge or a new port is added at runtime, because adding a bridge or port occurs in one transaction (made by the client adding the port, e.g. ovs-vsctl) and filling in those columns happens in a different transaction (made by ovs-vswitchd). But this commit does reduce the quantity of empty columns that I would expect a database client to observe in practice. Reported-by: Jeff Merrick <jmerrick@vmware.com> CC: Amar Padmanabhan <amar@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Ansis Atteka <aatteka@nicira.com> Bug #15983.
* python.ovs.db.idl: Fix Row.delete() of a row already committed to the db.Ben Pfaff2013-04-081-0/+1
| | | | | | | | | | | Row.delete() handled the case of deleting a row that was added within the current transaction, but not yet committed, but it did not correctly handle the case of deleting a row that belonged to the database before the transaction started. This fixes the problem. Reported-by: Yeming Zhao <zhaoyeming@gmail.com> Tested-by: Yeming Zhao <zhaoyeming@gmail.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* extract-ofp-errors: Make Python 3 compatible.Damien Millescamps2013-03-221-0/+1
| | | | | | | | | | | | | | | | | | extract-ofp-errors doesn't work with python 3 for the following reasons: - several "SyntaxError: invalid syntax": print not a keyword anymore. As a function it requires '()' - AttributeError: 'dict' object has no attribute 'itervalues' Use values() instead. Test done: Generate using ofp-errors.inc as a reference Patch for python 3, then regenerate ofp-errors.inc Diff between the two outputs. Signed-off-by: Damien Millescamps <damien.millescamps@6wind.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* ovs-vsctl: Try connecting only once for active connections by default.Ben Pfaff2013-03-151-0/+1
| | | | | | | | | | | | | | | | | | | | | | | Until now, ovs-vsctl has kept trying to the database server until it succeeded or the timeout expired (if one was specified with --timeout). This meant that if ovsdb-server wasn't running, then ovs-vsctl would hang. The result was that almost every ovs-vsctl invocation in scripts specified a timeout on the off-chance that the database server might not be running. But it's difficult to choose a good timeout. A timeout that is too short can cause spurious failures. A timeout that is too long causes long delays if the server really isn't running. This commit should alleviate this problem. It changes ovs-vsctl's behavior so that, if it fails to connect to the server, it exits unsuccessfully. This makes --timeout obsolete for the purpose of avoiding a hang if the database server isn't running. (--timeout is still useful to avoid a hang if ovsdb-server is running but ovs-vswitchd is not, for ovs-vsctl commands that modify the database. --no-wait also avoids that issue.) Bug #2393. Bug #15594. Reported-by: Jeff Merrick <jmerrick@vmware.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* lib: Rename lib/pcap.h to avoid inclusion conflicts.Stephane A. Sezer2013-03-151-0/+1
| | | | | | | | | | | | | | lib/pcap.h has a name that conflicts with /usr/include/pcap.h. When one wants to include pcap.h from libpcap (i.e.: the one from /usr/include), one may end up with pcap.h from openvswitch. This change renames this header to pcap-file.h and updates all references to this file. This change was tested with `make distcheck`. Signed-off-by: Stephane A. Sezer <sas@cd80.net> Signed-off-by: Ben Pfaff <blp@nicira.com>
* AUTHORS: Add Andy Zhou.Ben Pfaff2013-02-281-0/+1
| | | | | CC: Andy Zhou <azhou@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* Add support for LISP tunnelingLorand Jakab2013-02-251-0/+1
| | | | | | | | | | | | | | | | LISP is an experimental layer 3 tunneling protocol, described in RFC 6830. This patch adds support for LISP tunneling. Since LISP encapsulated packets do not carry an Ethernet header, it is removed before encapsulation, and added with hardcoded source and destination MAC addresses after decapsulation. The harcoded MAC chosen for this purpose is the locally administered address 02:00:00:00:00:00. Flow actions can be used to rewrite this MAC for correct reception. As such, this patch is intended to be used for static network configurations, or with a LISP capable controller. Signed-off-by: Lorand Jakab <lojakab@cisco.com> Signed-off-by: Kyle Mestery <kmestery@cisco.com> Signed-off-by: Jesse Gross <jesse@nicira.com>
* FAQ: Clarify that "--all" was added in version 1.8.Ben Pfaff2013-02-251-0/+1
| | | | | Reported-by: David Palma <palma@onesource.pt> Signed-off-by: Ben Pfaff <blp@nicira.com>
* AUTHORS: Add Rich Lane.Jesse Gross2013-02-081-0/+1
| | | | Signed-off-by: Jesse Gross <jesse@nicira.com>
* rhel: Automatically start openvswitch service before bringing an ovs ↵Thomas Graf2013-01-251-0/+1
| | | | | | | | | | | interface up or down This patch modifies the ifup/ifdown scripts to automatically start the openvswitch service before ovs-vsctl is invoked thus not making it mandatory to auto-start openvswitch on boot. Signed-off-by: Thomas Graf <tgraf@redhat.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* ofproto: Remove redundant call to ofconn_get_ofprotoBen Pfaff2013-01-211-0/+1
| | | | | | | | This is a cosmetic change. Remove the redundant call to ofconn_get_ofproto in handle_flow_mod. Signed-off-by: Paraneetharan Chandrasekaran <paraneetharanc@gmail.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* bridge: Remove restriction on socket name.Pavithra Ramesh2013-01-161-0/+1
| | | | | | | | | | | Following patch removes restriction on the listening socket name that gets configured as bridge controller. Currently, we only connect to sockets in a specific directory with the name of the bridge. This patch removes the restriction on the bridge name, keeping the directory restriction. Bug #14029. Signed-off-by: Pavithra Ramesh <paramesh@vmware.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* AUTHORS: Add James Page.Jesse Gross2013-01-161-0/+1
| | | | Signed-off-by: Jesse Gross <jesse@nicira.com>
* bond: Fix comment on bond_entry::tagZoltan Kiss2013-01-151-0/+1
| | | | | | | The hash entry tag connects to facet(s), not slaves. Signed-off-by: Zoltan Kiss <zoltan.kiss@citrix.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* alloc_ofp_port does not allocate the port number correctlyKrishna Kondaka2013-01-111-0/+1
| | | | | | | | | | | | | | | | | alloc_ofp_port() does not allocate the port number correctly if the port number passed initially is already in use. The following if block if (ofp_port >= ofproto->max_ports || bitmap_is_set(ofproto->ofp_port_ids, ofp_port)) { is entered when either of the two conditions is true but the while block after this is not entered if the second condition above is true and the first condition is false. This results in an existing port_number to be re-assigned! Signed-off-by: Krishna Kondaka <kkondaka@vmware.com> Signed-off-by: Justin Pettit <jpettit@nicira.com>
* manpages: Fix buildSaul St. John2013-01-041-1/+1
| | | | | | | | | This patch fixes regressions in the dist and distclean targets, and in the Debian build process, that were introduced by commit d2cb6c956b (manpages: Put version number instead of date at bottom of page.). Signed-off-by: Saul St. John <sstjohn@cs.wisc.edu> Signed-off-by: Ben Pfaff <blp@nicira.com>
* ofp-actions: Fix the check for instruction ordering and duplication.Ben Pfaff2013-01-031-0/+1
| | | | | | | | | | | | | | | | | Open vSwitch enforces that, when instructions appear as Nicira extensions in OpenFlow 1.0 action lists, the instructions appear in the order that an OpenFlow 1.1+ switch would execute them and that no duplicates appear. But the check wasn't general enough, because it had been implemented when only one instruction was implemented and never later generalized. This commit fixes the problem. One of the tests was actually testing for the wrong behavior that the check implemented, so this commit corrects that test. It also updates another test with updated log messages. Reported-by: Jing Ai <ai_jing2000@hotmail.com> Tested-by: Jing Ai <ai_jing2000@hotmail.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* debian: Fix typo in comment in openvswitch-controller.default.Ben Pfaff2012-12-301-0/+2
| | | | | | | Reported-by: Saul St. John Reported-by: Logan Rosen <logatronico@gmail.com> Reported-at: https://bugs.launchpad.net/ubuntu/+source/openvswitch/+bug/1094556 Signed-off-by: Ben Pfaff <blp@nicira.com>
* ofp-util: features reply of openflow13 does not have portsSUGYO Kazushi2012-12-271-0/+1
| | | | | | Signed-off-by: SUGYO Kazushi <sugyo.org@gmail.com> [blp@nicira.com moved the test from ofproto.c to ofp-util.c] Signed-off-by: Ben Pfaff <blp@nicira.com>
* ovs-vsctl: Allow command-specific options to mingle with global options.Ben Pfaff2012-12-101-0/+1
| | | | | | | | | | | | | | | | Until now, a command like "ovs-vsctl --may-exist add-br br0" yielded a confusing error message. Users had to realize that the correct form was "ovs-vsctl -- --may-exist add-br br0", but instead they often reported a bug or gave up in frustration. Even though the behavior was documented, it was counterintuitive. This commit allows command-specific options to be mixed with global options, making both forms of the command listed above equally acceptable. CC: 691508@bugs.debian.org Reported-by: Adam Heath <doogie@brainfood.com> Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Kyle Mestery <kmestery@cisco.com>
* INSTALL.RHEL: Explain how to work around RHEL 6 kernel-devel bug.Ben Pfaff2012-12-031-0/+1
| | | | | | | | Based on http://networkstatic.net/open-vswitch-red-hat-installation/ Reported-by: Brent Salisbury <brent.salisbury@gmail.com> Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Kyle Mestery <kmestery@cisco.com>
* bond: Fix segfault sending learning packets with LACP disabled.Ben Pfaff2012-11-291-0/+1
| | | | | | | | | | | | | | | | | | | | | It is essentially an invalid configuration to disable LACP but request TCP balancing: in this configuration, the bond drops all packets. But may_send_learning_packets() would still indicate that learning packets should be sent, so bond_compose_learning_packet() would try to choose an output slave for those packets, which would be NULL (because all packets are dropped), which would cause a segfault upon dereference. This commit fixes the problem by making may_send_learning_packets() no longer indicate that learning packets should be sent. I tested this issue by modifying bond_should_send_learning_packets() to always return true if may_send_learning_packets() returns true, and then introducing the invalid configuration described above. Without this comit, ovs-vswitchd segfaults quickly; with this commit, it does not. Bug #14090. Reported-by: Kiran Shanbhog <kiran@vmware.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* AUTHORS: Add Jarno Rajahalme.Ben Pfaff2012-11-271-0/+1
| | | | Signed-off-by: Ben Pfaff <blp@nicira.com>
* don't use select.POLL* constantsFUJITA Tomonori2012-11-191-0/+1
| | | | | | | | | | | Python doesn't have select.POLL* constants on some architectures (e.g. MacOSX). This code needs to define the constants for itself. It uses select.POLL* constants only internally (doesn't pass them outside). So there is no harm even if the definition would conflict with Python's those. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Signed-off-by: Ben Pfaff <blp@nicira.com>
* ovs-ctl: Fix implementation of --extra-dbs.Henry Mai2012-10-191-0/+1
| | | | | | | | | | | | Commit b4e8d1705 (ovsdb-server: Add support for multiple databases.) added the --extra-dbs option to ovs-ctl but failed to add a specific database name to the SSL options passed to ovsdb-server. This meant that ovsdb-server would fail to start if --extra-dbs were actually used, because it didn't know which database to look in for the SSL settings. Signed-off-by: Henry Mai <hmai@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* ofproto: Fix uninitialized field in ofputil_flow_update.Anupam Chanda2012-09-201-0/+1
| | | | | | | | | | | Two instances of ofputil_flow_update had the priority field uninitialized. This would cause flow updates to contain undefined priority values. This bug was introduced by commit 81a76618 (classifier: Break cls_rule 'flow' and 'wc' members into new "struct match".) Signed-off-by: Anupam Chanda <achanda@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* INSTALL: Recommend installing kernel modules with "make modules_install".Ben Pfaff2012-09-101-0/+1
| | | | | | Reported-by: Valentin Bud <valentin@hackaserver.com> Acked-by: Kyle Mestery <kmestery@cisco.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* lockfile: Log more helpful message when locking fails due to a conflict.Ben Pfaff2012-08-311-0/+1
| | | | | | Reported-by: rahim entezari <rahim.entezari@gmail.com> Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Ethan Jackson <ethan@nicira.com>
* bond: Tag flows according to their hash bucket, not just their slave.Ben Pfaff2012-08-211-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | The bonding code is supposed to tag flows two ways: - According to the chosen bond slave, to make it easy to invalidate all of the flows assigned to a given slave. - According to the hash value for a flow, to make it easy to invalidate all of the flows that hash into the same bucket. However, the code wasn't actually applying the hash-based tags. This meant that rebalancing didn't take effect immediately, and so after rebalancing we could get log messages like this: inconsistency in subfacet (actions were: 5) (correct actions: 4) specifying some flow that was moved by the rebalance. This commit fixes the problem by applying the hash-based tags. Bug #12847. Reported-by: Pratap Reddy <preddy@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Ethan Jackson <ethan@nicira.com>
* stream-ssl: Change "bootstrap race" log message from ERR to INFO.Ben Pfaff2012-08-131-0/+1
| | | | | | | | | This situation can and will happen, and we handle it successfully, so it's not an error. Bug #12922. Reported-by: Scott Hendricks <shendricks@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* AUTHORS: Add Kyle Mestery.Jesse Gross2012-08-081-0/+1
| | | | Signed-off-by: Jesse Gross <jesse@nicira.com>
* Adding checksum to IP packets created by ovs for testing.Mehak Mahajan2012-08-021-0/+1
| | | | | | | | | OVS provides a utility to create IP packets for the purpose of testing using ovs-appctl netdev-dummy/receive. These packets created by flow_compose() earlier did not have the IP checksum in them. With this commit, the checksum with be added to these test IP packets. Signed-off-by: Mehak Mahajan <mmahajan@nicira.com>
* datapath: fix typo in READMELeo Alterman2012-07-161-0/+1
| | | | Signed-off-by: Leo Alterman <lalterman@nicira.com>
* Add Tadaaki Nagao to AUTHORS.Jesse Gross2012-07-121-0/+1
| | | | Signed-off-by: Jesse Gross <jesse@nicira.com>
* ovs-vsctl: Correct example for removing a mirror.Ben Pfaff2012-07-121-0/+1
| | | | | Reported-by: Kris zhang <zhang.kris@gmail.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* FAQ: Patch ports are not targeted for upstream.Ben Pfaff2012-07-121-0/+1
| | | | | | | | The previous text was ambiguous. Reported-by: Konstantin Khorenko <khorenko@openvz.org> CC: Jesse Gross <jesse@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* debian: Add "netbase" dependency for /etc/protocols.Ben Pfaff2012-07-091-0/+1
| | | | | | | | | | ovs-ctl.in uses /etc/protocols, which is in the "netbase" package, so a dependency is required. Debian bug #680537. CC: 680537@bugs.debian.org Reported-by: Bastian Blank <waldi@debian.org> Signed-off-by: Ben Pfaff <blp@nicira.com>
* bond: Sending learning packets on active-backup.Ethan Jackson2012-07-051-0/+1
| | | | | | | | | | | | | | | | | | | Suppose we have an active bond with two ports, eth1 and eth2, attached to a standard L2 learning switch which does not know it's participating in a bond (i.e. isn't running LACP). Suppose eth1 is active and therefore the L2 learning switch is forwarding traffic to eth1 as instructed by its learning table. Now suppose, for some reason, OVS fails over from eth1 to eth2. For each destination MAC, the L2 learning switch will continue sending traffic to eth1, which will be dropped, until either traffic from that MAC appears on eth2, or the learning table entries expire. To alleviate this issue, this patch sends learning packets on newly active interfaces in active-backup bonds in order to educate the upstream network of the change. Requested-by: Frido Roose <fr.roose@gmail.com> Signed-off-by: Ethan Jackson <ethan@nicira.com>
* ovs-check-dead-ifs: Tolerate processes that disappear during run.Ben Pfaff2012-07-051-0/+1
| | | | | | | | | os.listdir("/proc/%d/fd" % pid) throws OSError if 'pid' died since the list of pids was obtained. Bug #12375. Reported-by: Amey Bhide <abhide@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* ovs-brcompatd: Fix sending replies to kernel requests.Ben Pfaff2012-07-051-0/+2
| | | | | | | | | | | | | | | Commit 7d7447 (netlink: Postpone choosing sequence numbers until send time.) broke ovs-brcompatd because it prevented userspace replies to kernel requests from using the correct sequence numbers. This commit fixes it. Atzm Watanabe found the root cause and provided an alternative patch to avoid the problem. Reported-by: André Ruß <andre.russ@hybris.com> Reported-by: Atzm Watanabe <atzm@stratosphere.co.jp> Tested-by: Atzm Watanabe <atzm@stratosphere.co.jp> Signed-off-by: Ben Pfaff <blp@nicira.com>
* ofproto: Report nonexistent ports and queues as errors in queue stats.Ben Pfaff2012-06-271-0/+1
| | | | | | | | | Until now, Open vSwitch has ignored missing ports and queues in most cases in queue stats requests, simply returning an empty set of statistics. It seems that it is better to report an error, so this commit does this. Reported-by: Prabina Pattnaik <Prabina.Pattnaik@nechclst.in> Signed-off-by: Ben Pfaff <blp@nicira.com>
* lib: Do not assume sig_atomic_t is int.Ed Maste2012-06-261-0/+1
| | | | | | | | On FreeBSD sig_atomic_t is long, which causes the comparison in fatal_signal_run to be true when no signal has been reported. Signed-off-by: Ed Maste <emaste@freebsd.org> Signed-off-by: Ben Pfaff <blp@nicira.com>
* build: automake complains IntegrationGuide is missingIsaku Yamahata2012-06-201-0/+1
| | | | | | | | | | | | | | | | | | | Change set of 502c471406b32e5afcdea62fa8307f9856d05437 added IntegrationGuide, but it wasn't added to EXTRA_DIST. So automake complains. This patch adds the file to EXTRA_DIST. > make[3]: Leaving directory `/openvswitch/build/datapath' > The distribution is missing the following files: > IntegrationGuide > make[2]: *** [dist-hook-git] Error 1 > make[2]: *** Waiting for unfinished jobs.... > make[2]: Leaving directory `/openvswitch/build' > make[1]: *** [all-recursive] Error 1 > make[1]: Leaving directory `/openvswitch/build' > make: *** [all] Error 2 Signed-off-by: Isaku Yamahata <yamahata@valinux.co.jp> Signed-off-by: Ben Pfaff <blp@nicira.com>