summaryrefslogtreecommitdiff
path: root/NEWS
Commit message (Collapse)AuthorAgeFilesLines
* netdev-dpdk: Allow arbitrary eal argumentsAaron Conole2016-04-291-1/+2
| | | | | | | | | | | | | | | | | | | A previous change moved some commonly used arguments from commandline to the database, and with it the ability to pass arbitrary arguments to EAL. This change allows arbitrary eal arguments to be provided via a new db entry 'other_config:dpdk-extra' which will tokenize the string and add it to the argument list. The only argument which will not be supported with this change is '--no-huge', which appears to break the system in other ways. Signed-off-by: Aaron Conole <aconole@redhat.com> Tested-by: Sean K Mooney <sean.k.mooney@intel.com> Tested-by: RobertX Wojciechowicz <robertx.wojciechowicz@intel.com> Tested-by: Kevin Traynor <kevin.traynor@intel.com> Acked-by: Panu Matilainen <pmatilai@redhat.com> Acked-by: Kevin Traynor <kevin.traynor@intel.com> Acked-by: Flavio Leitner <fbl@sysclose.org> Acked-by: Daniele Di Proietto <diproiettod@vmware.com>
* netdev-dpdk: Convert initialization from cmdline to dbAaron Conole2016-04-291-0/+5
| | | | | | | | | | | | | | | | Existing DPDK integration is provided by use of command line options which must be split out and passed to librte in a special manner. However, this forces any configuration to be passed by way of a special DPDK flag, and interferes with ovs+dpdk packaging solutions. This commit delays dpdk initialization until after the OVS database connection is established, at which point ovs initializes librte. It pulls all of the config data from the OVS database, and assembles a new argv/argc pair to be passed along. Signed-off-by: Aaron Conole <aconole@redhat.com> Acked-by: Kevin Traynor <kevin.traynor@intel.com> Acked-by: Daniele Di Proietto <diproiettod@vmware.com>
* Remove "VLAN splinters" feature.Pravin B Shelar2016-04-271-0/+1
| | | | | | | | | | | The "VLAN splinters" feature works around buggy device drivers in old Linux versions. But support for the old kernel is dropped, So now all supported kernel vlan drivers should be working fine with OVS kernel datapath. Following patch removes this deprecated feature. Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* ovs-ctl: Allow selective start for db and switchAaron Conole2016-03-251-0/+3
| | | | | | | | | | | | | | | Currently, ``ovs-ctl start'' will attempt to start both the DB and vswitchd. This is quite convenient when the database already has all of the configuration values required, and when using a single services file for systemd integration. The same goes for the ``ovs-ctl stop'' command. However, there are some cases which are not easily covered. The case where we want to set values in the database prior to starting the forwarding path, as well as the case of supporting multiple service files, one per daemon (which is how systemd expects services to look). Signed-off-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* tunneling: Enable IPv6 tuneling.Pravin B Shelar2016-03-241-0/+4
| | | | | | | | | | | | There is check to disable IPv6 tunneling. Following patch removes it and reintroduces the tunneling automake tests. This reverts mostly commit 250bd94d1e500a89c76cac944e660bd9c07ac364. There are couple of new autotests and updated documentation related to ipv6 tunneling added in this patch. Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* NEWS: Update (--color option for ovs-ofctl).Quentin Monnet2016-03-181-0/+1
| | | | | Signed-off-by: Quentin Monnet <quentin.monnet@6wind.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* NEWS: Add 2.5.0 release date.Russell Bryant2016-03-161-1/+1
| | | | | | | | OVS 2.5.0 was released. The date was updated in branch-2.5, but not master. Signed-off-by: Russell Bryant <russell@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* datapath: Drop support for kernel older than 3.10Pravin B Shelar2016-03-141-0/+2
| | | | | | | | | | | | | | | | Currently OVS out of tree datapath supports a large number of kernel versions. From 2.6.32 to 4.3 and various distribution-specific kernels. But at this point major features are only available on more recent kernels. For example, stateful services are only available starting in kernel 3.10 and STT is available on starting with 3.5. Since these features are becoming essential to many OVS deployments, and the effort of maintaining the backports is high. We have decided to drop support for older kernel. Following patch drops supports for kernel older than 3.10. Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Acked-by: Jesse Gross <jesse@kernel.org>
* openflow: Support matching and modifying MPLS TTL field.Ben Pfaff2016-03-071-0/+1
| | | | | | | | Occasionally we get asked about this and I don't see a reason not to support it. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
* netdev_dpdk.c: Add QoS functionality.Ian Stokes2016-03-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | This patch provides the modifications required in netdev-dpdk.c and vswitch.xml to allow for a DPDK user space QoS algorithm. This patch adds a QoS configuration structure for netdev-dpdk and expected QoS operations 'dpdk_qos_ops'. Various helper functions are also supplied. Also included are the modifications required for vswitch.xml to allow a new QoS implementation for netdev-dpdk devices. This includes a new QoS type `egress-policer` as well as its expected QoS table entries. The QoS functionality implemented for DPDK devices is `egress-policer`. This can be used to drop egress packets at a configurable rate. The INSTALL.DPDK.md guide has also been modified to provide an example configuration of `egress-policer` QoS. Signed-off-by: Ian Stokes <ian.stokes@intel.com> Acked-by: Flavio Leitner <fbl@sysclose.org> Acked-by: Daniele Di Proietto <diproiettod@vmware.com>
* ofp: Add support for bundles extension in OpenFlow 1.3.Jarno Rajahalme2016-02-291-0/+4
| | | | | | | | | ONF Extension 230 adds support for OpenFlow 1.4 bundles to OpenFlow 1.3. Supporting this allows OpenFlow 1.3 controllers to start using bundles. Also the ovs-ofctl '--bundle' option can now be used with OpenFlow 1.3. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* rhel: provide our own SELinux custom policy packageAnsis Atteka2016-02-251-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CentOS, RHEL and Fedora distributions ship with their own Open vSwitch SELinux policy that is too strict and prevents Open vSwitch to work normally out of the box. As a solution, this patch introduces a new package which will "loosen" up "openvswitch_t" SELinux domain so that Open vSwitch could operate normally. Intended use-cases of this package are: 1. to allow users to install newer Open vSwitch on already released Fedora, RHEL and CentOS distributions where the default Open vSwitch SELinux policy that shipped with the corresponding Linux distribution is not up to date and did not anticipate that a newer Open vSwitch version might need to invoke new system calls or need to access certain system resources that it did not before; And 2. to provide alternative means through which Open vSwitch developers can proactively fix SELinux related policy issues without waiting for corresponding Linux distribution maintainers to update their central Open vSwitch SELinux policy. This patch was tested on Fedora 23 and CentOS 7. I verified that now on Fedora 23 Open vSwitch can create a NetLink socket; and that I did not see following error messages: vlog|INFO|opened log file /var/log/openvswitch/ovs-vswitchd.log ovs_numa|INFO|Discovered 2 CPU cores on NUMA node 0 ovs_numa|INFO|Discovered 1 NUMA nodes and 2 CPU cores reconnect|INFO|unix:/var/run/openvswitch/db.sock: connecting... reconnect|INFO|unix:/var/run/openvswitch/db.sock: connected netlink_socket|ERR|fcntl: Permission denied dpif_netlink|ERR|Generic Netlink family 'ovs_datapath' does not exist. The Open vSwitch kernel module is p robably not loaded. dpif|WARN|failed to enumerate system datapaths: Permission denied dpif|WARN|failed to create datapath ovs-system: Permission denied I did not test all Open vSwitch features so there still could be some OVS configuration that would get "Permission denied" errors. Since, Open vSwitch daemons on Ubuntu 15.10 by default run under "unconfined" SELinux domain, then there is no need to create a similar debian package for Ubuntu, because it works on default Ubuntu installation. Signed-off-by: Ansis Atteka <aatteka@nicira.com> Acked-by: Flavio Leitner <fbl@sysclose.com>
* INSTALL.DPDK: Add notes regarding vhost multiq configuration.Ian Stokes2016-02-241-1/+1
| | | | | | | | | | | Linux kernel network devices in a guest should have the number of multi-purpose channels configured when used with DPDK multiqueue on the host. This commit adds an example of how this can be done. Also add QEMU 2.5 requirements for multiqueue with DPDK in NEWS. Signed-off-by: Ian Stokes <ian.stokes@intel.com> Acked-by: Flavio Leitner <fbl@sysclose.org> Acked-by: Daniele Di Proietto <diproiettod@vmware.com>
* Implement OFPT_TABLE_STATUS Message.Saloni Jain2016-02-241-0/+1
| | | | | | | | | | | | | | On change in a table state, the controller needs to be informed with the OFPT_TABLE_STATUS message. The message is sent with reason OFPTR_VACANCY_DOWN or OFPTR_VACANCY_UP in case of change in remaining space eventually crossing any one of the threshold. Signed-off-by: Saloni Jain <saloni.jain@tcs.com> Co-authored-by: Rishi Bamba <rishi.bamba@tcs.com> Signed-off-by: Rishi Bamba <rishi.bamba@tcs.com> [blp@ovn.org added vacancy event initialization and tests and updated NEWS] Signed-off-by: Ben Pfaff <blp@ovn.org>
* dpif-netdev: Add dpif-netdev/pmd-rxq-show appctl command.Ilya Maximets2016-02-221-0/+3
| | | | | | | | | | | | | This command can be used to check the port/rxq assignment to pmd threads. For each pmd thread of the datapath shows list of queue-ids with port names. Additionally log message from pmd_thread_main() extended with queue-id, and type of this message changed from INFO to DBG. Signed-off-by: Ilya Maximets <i.maximets@samsung.com> Acked-by: Flavio Leitner <fbl@sysclose.org> Acked-by: Daniele Di Proietto <diproiettod@vmware.com>
* NEWS: Claim support for Python 3.Russell Bryant2016-02-221-1/+3
| | | | | | | | Also update the Python ovs package info to note that both Python 2 and 3 are supported. Signed-off-by: Russell Bryant <russell@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* Implement serializing the state of packet traversal in "continuations".Ben Pfaff2016-02-191-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | One purpose of OpenFlow packet-in messages is to allow a controller to interpose on the path of a packet through the flow tables. If, for example, the controller needs to modify a packet in some way that the switch doesn't directly support, the controller should be able to program the switch to send it the packet, then modify the packet and send it back to the switch to continue through the flow table. That's the theory. In practice, this doesn't work with any but the simplest flow tables. Packet-in messages simply don't include enough context to allow the flow table traversal to continue. For example: * Via "resubmit" actions, an Open vSwitch packet can have an effective "call stack", but a packet-in can't describe it, and so it would be lost. * A packet-in can't preserve the stack used by NXAST_PUSH and NXAST_POP actions. * A packet-in can't preserve the OpenFlow 1.1+ action set. * A packet-in can't preserve the state of Open vSwitch mirroring or connection tracking. This commit introduces a solution called "continuations". A continuation is the state of a packet's traversal through OpenFlow flow tables. A "controller" action with the "pause" flag, which is newly implemented in this commit, generates a continuation and sends it to the OpenFlow controller in a packet-in asynchronous message (only NXT_PACKET_IN2 supports continuations, so the controller must configure them with NXT_SET_PACKET_IN_FORMAT). The controller processes the packet-in, possibly modifying some of its data, and sends it back to the switch with an NXT_RESUME request, which causes flow table traversal to continue. In principle, a single packet can be paused and resumed multiple times. Another way to look at it is: - "pause" is an extension of the existing OFPAT_CONTROLLER action. It sends the packet to the controller, with full pipeline context (some of which is switch implementation dependent, and may thus vary from switch to switch). - A continuation is an extension of OFPT_PACKET_IN, allowing for implementation dependent metadata. - NXT_RESUME is an extension of OFPT_PACKET_OUT, with the semantics that the pipeline processing is continued with the original translation context from where it was left at the time it was paused. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* Support userdata in NXT_PACKET_IN2.Ben Pfaff2016-02-191-1/+2
| | | | | Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* Implement new packet-in format NXT_PACKET_IN2.Ben Pfaff2016-02-191-0/+1
| | | | | Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* ovsdb-server: Eliminating max session limitandy zhou2016-02-101-0/+3
| | | | | | | | | | | | | | | This patch removes limits on number of concurrent sessions allowed by ovsdb-server. Historically, it was not an design goal for OVSDB server to support very high number of sessions. The imposed limit reflects those design choices. Work is now underway to improve OVSDB scalability since supporting large of number of sessions is important for OVN, Removing this limit makes scalability testing possible. Signed-off-by: Andy Zhou <azhou@ovn.org> Acked-by: Han Zhou <zhouhan@gmail.com> Acked-by: Ben Pfaff <blp@ovn.org>
* vlog: Add vlog/close command.Ben Pfaff2016-02-101-0/+2
| | | | | | | Requested-by: P R Dinesh Requested-at: https://github.com/openvswitch/ovs/pull/94 Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Russell Bryant <russell@ovn.org>
* ovs-benchmark: Remove.Ben Pfaff2016-02-051-0/+2
| | | | | | | | This utility was completely broken and no one noticed for the time of a full release, so I think that's a safe sign that we should remove it. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* dpif-netdev: Allow different numbers of rx queues for different ports.Ilya Maximets2016-02-041-0/+4
| | | | | | | | | | | | | | | | | | | Currently, all of the PMD netdevs can only have the same number of rx queues, which is specified in other_config:n-dpdk-rxqs. Fix that by introducing of new option for PMD interfaces: 'n_rxq', which specifies the maximum number of rx queues to be created for this interface. Example: ovs-vsctl set Interface dpdk0 options:n_rxq=8 Old 'other_config:n-dpdk-rxqs' deleted. Signed-off-by: Ilya Maximets <i.maximets@samsung.com> Acked-by: Ben Pfaff <blp@ovn.org> Acked-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com>
* netdev-dpdk: Add vhost-user multiqueue supportFlavio Leitner2016-01-281-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | Most of the network cards today supports multiple receive and transmit queues (MQ). The core idea is that on packet reception, a NIC can send different packets to different queues to distribute processing among CPUs running in parallel. The packet distribution is based on a result of a filter applied on each packet headers. The filter should keep all packets from the same flow on the same queue to avoid re-ordering while distributing different flows among all available queues. This is how the packet moves in a typical vhost-user use-case: NIC OVS DPDK port ==== bridge --- vhost-user ==== qemu ==== virtio eth0 The DPDK ports, OVS bridges, virtio network driver and recently QEMU (vhost-user) supports MQ. This patch adds MQ support to OVS that leverages DPDK vhost library to implement vhost-user interfaces. Signed-off-by: Flavio Leitner <fbl@sysclose.org> Acked-by: Kevin Traynor <kevin.traynor@intel.com> Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com>
* NEWS: DPDK 2.2 is now required.Flavio Leitner2016-01-271-0/+1
| | | | | Signed-off-by: Flavio Leitner <fbl@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* openflow: Implement OF1.4+ OFPMP_QUEUE_DESC multipart message.Ben Pfaff2016-01-201-1/+3
| | | | | | | | | | | | | | | | | | OpenFlow 1.0 through 1.3 have a message OFPT_QUEUE_GET_CONFIG_REQUEST and its corresponding reply, for fetching a description of the queues configured on a given port. OpenFlow 1.4 changes this message to a multipart message OFPMP_QUEUE_DESC, which Open vSwitch has not until now implemented. This commit adds an implemntation of that message. Because the message is a replacement for the former one, this commit implements it using the same ofp-util functions as the former message, so that the client code doesn't have to distinguish a difference between versions. The ovs-ofctl command queue-get-config was previously undocumented (due only to an oversight). This commit corrects that and documents the new feature available with OpenFlow 1.4. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* ofproto: Implement OFPT_QUEUE_GET_CONFIG_REQUEST for OFPP_ANY in OF1.1+.Ben Pfaff2016-01-071-0/+3
| | | | | | | | | I was not previously aware that this feature was missing. Reported-by: Minoru TAKAHASHI <takahashi.minoru7@gmail.com> Reported-at: http://openvswitch.org/pipermail/discuss/2015-October/019229.html Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Andy Zhou <azhou@ovn.org>
* rhel: Add support DPDK port creation via network scriptsPanu Matilainen2015-12-221-0/+2
| | | | | | | | | | Add support for creating a userspace bridge and the four DPDK port types via network scripts + basic documentation. Signed-off-by: Panu Matilainen <pmatilai@redhat.com> Acked-by: Aaron Conole <aconole@redhat.com> Acked-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovsdb: enable jasonrpc-server to service monitor2 requestAndy Zhou2015-12-111-1/+2
| | | | | | | | ovsdb-server now accepts the new "monitor2" request. The next patch will switch IDL to use monitor2 by default. Signed-off-by: Andy Zhou <azhou@nicira.com> Acked-by: Ben Pfaff <blp@ovn.org>
* NEWS: Improve organization.Ben Pfaff2015-12-071-6/+5
| | | | | Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
* Prepare for post-2.5.0 (2.5.90).Justin Pettit2015-12-031-0/+4
| | | | | Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Joe Stringer <joe@ovn.org>
* Prepare for 2.5.0.Justin Pettit2015-12-031-1/+1
| | | | | Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Joe Stringer <joe@ovn.org>
* NEWS: Add OVN.Russell Bryant2015-12-021-0/+4
| | | | | | | | Add OVN to NEWS as a post-2.4.0 feature. Signed-off-by: Russell Bryant <russell@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* Implement Openflow 1.4 Vacancy Events for OFPT_TABLE_MOD.Saloni Jain2015-11-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | OpenFlow 1.4 introduces the ability to turn on vacancy events with an OFPT_TABLE_MOD message specifying OFPTC_VACANCY_EVENTS. This commit adds support for the new feature in ovs-ofctl mod-table. As per the openflow specification-1.4, vacancy event adds a mechanism enabling the controller to get an early warning based on capacity threshold chosen by the controller. With this commit, vacancy events can be configured as: ovs-ofctl -O OpenFlow14 mod-table <bridge> <table> vacancy:<low,high> <low,high> specify vacancy threshold values in percentage for vacancy_down and vacancy_up respectively. To disable vacancy events, following command should be given: ovs-ofctl -O OpenFlow14 mod-table <bridge> <table> novacancy Signed-off-by: Saloni Jain <saloni.jain@tcs.com> Co-authored-by: Shashwat Srivastava <shashwat.srivastava@tcs.com> Signed-off-by: Shashwat Srivastava <shashwat.srivastava@tcs.com> Co-authored-by: Sandeep Kumar <sandeep.kumar16@tcs.com> Signed-off-by: Sandeep Kumar <sandeep.kumar16@tcs.com> [blp@ovn.org fixed a few typos] Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovs-ofctl: Add "out_group" keyword for OF1.1+ matching on output group.Ben Pfaff2015-11-291-0/+2
| | | | | | | | | | | It seems that OVS has never supported this OpenFlow feature in ovs-ofctl, which makes it hard to test. This commit adds support. (Open vSwitch has supported this in OpenFlow for a long time; it's only ovs-ofctl that didn't.) Signed-off-by: Ben Pfaff <blp@ovn.org> Reviewed-by: Simon Horman <simon.horman@netronome.com>
* vswitchd: Allow modifying ICMP type and code.Justin Pettit2015-11-091-0/+1
| | | | | Signed-off-by: Justin Pettit <jpettit@nicira.com> Acked-by: Flavio Leitner <fbl@sysclose.org>
* Add connection tracking label support.Joe Stringer2015-10-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | This patch adds a new 128-bit metadata field to the connection tracking interface. When a label is specified as part of the ct action and the connection is committed, the value is saved with the current connection. Subsequent ct lookups with the table specified will expose this metadata as the "ct_label" field in the flow. For example, to allow new TCP connections from port 1->2 and only allow established connections from port 2->1, and to associate a label with those connections: table=0,priority=1,action=drop table=0,arp,action=normal table=0,in_port=1,tcp,action=ct(commit,exec(set_field:1->ct_label)),2 table=0,in_port=2,ct_state=-trk,tcp,action=ct(table=1) table=1,in_port=2,ct_state=+trk,ct_label=1,tcp,action=1 Signed-off-by: Joe Stringer <joestringer@nicira.com> Acked-by: Jarno Rajahalme <jrajahalme@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
* Add connection tracking mark support.Joe Stringer2015-10-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | This patch adds a new 32-bit metadata field to the connection tracking interface. When a mark is specified as part of the ct action and the connection is committed, the value is saved with the current connection. Subsequent ct lookups with the table specified will expose this metadata as the "ct_mark" field in the flow. For example, to allow new TCP connections from port 1->2 and only allow established connections from port 2->1, and to associate a mark with those connections: table=0,priority=1,action=drop table=0,arp,action=normal table=0,in_port=1,tcp,action=ct(commit,exec(set_field:1->ct_mark)),2 table=0,in_port=2,ct_state=-trk,tcp,action=ct(table=1) table=1,in_port=2,ct_state=+trk,ct_mark=1,tcp,action=1 Signed-off-by: Joe Stringer <joestringer@nicira.com> Acked-by: Jarno Rajahalme <jrajahalme@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
* Add support for connection tracking.Joe Stringer2015-10-131-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a new action and fields to OVS that allow connection tracking to be performed. This support works in conjunction with the Linux kernel support merged into the Linux-4.3 development cycle. Packets have two possible states with respect to connection tracking: Untracked packets have not previously passed through the connection tracker, while tracked packets have previously been through the connection tracker. For OpenFlow pipeline processing, untracked packets can become tracked, and they will remain tracked until the end of the pipeline. Tracked packets cannot become untracked. Connections can be unknown, uncommitted, or committed. Packets which are untracked have unknown connection state. To know the connection state, the packet must become tracked. Uncommitted connections have no connection state stored about them, so it is only possible for the connection tracker to identify whether they are a new connection or whether they are invalid. Committed connections have connection state stored beyond the lifetime of the packet, which allows later packets in the same connection to be identified as part of the same established connection, or related to an existing connection - for instance ICMP error responses. The new 'ct' action transitions the packet from "untracked" to "tracked" by sending this flow through the connection tracker. The following parameters are supported initally: - "commit": When commit is executed, the connection moves from uncommitted state to committed state. This signals that information about the connection should be stored beyond the lifetime of the packet within the pipeline. This allows future packets in the same connection to be recognized as part of the same "established" (est) connection, as well as identifying packets in the reply (rpl) direction, or packets related to an existing connection (rel). - "zone=[u16|NXM]": Perform connection tracking in the zone specified. Each zone is an independent connection tracking context. When the "commit" parameter is used, the connection will only be committed in the specified zone, and not in other zones. This is 0 by default. - "table=NUMBER": Fork pipeline processing in two. The original instance of the packet will continue processing the current actions list as an untracked packet. An additional instance of the packet will be sent to the connection tracker, which will be re-injected into the OpenFlow pipeline to resume processing in the specified table, with the ct_state and other ct match fields set. If the table is not specified, then the packet is submitted to the connection tracker, but the pipeline does not fork and the ct match fields are not populated. It is strongly recommended to specify a table later than the current table to prevent loops. When the "table" option is used, the packet that continues processing in the specified table will have the ct_state populated. The ct_state may have any of the following flags set: - Tracked (trk): Connection tracking has occurred. - Reply (rpl): The flow is in the reply direction. - Invalid (inv): The connection tracker couldn't identify the connection. - New (new): This is the beginning of a new connection. - Established (est): This is part of an already existing connection. - Related (rel): This connection is related to an existing connection. For more information, consult the ovs-ofctl(8) man pages. Below is a simple example flow table to allow outbound TCP traffic from port 1 and drop traffic from port 2 that was not initiated by port 1: table=0,priority=1,action=drop table=0,arp,action=normal table=0,in_port=1,tcp,ct_state=-trk,action=ct(commit,zone=9),2 table=0,in_port=2,tcp,ct_state=-trk,action=ct(zone=9,table=1) table=1,in_port=2,ct_state=+trk+est,tcp,action=1 table=1,in_port=2,ct_state=+trk+new,tcp,action=drop Based on original design by Justin Pettit, contributions from Thomas Graf and Daniele Di Proietto. Signed-off-by: Joe Stringer <joestringer@nicira.com> Acked-by: Jarno Rajahalme <jrajahalme@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
* lib/daemon: support --user option for all OVS daemonAndy Zhou2015-09-301-0/+1
| | | | | | | | | | OVS daemons can now support --user option to run as a non-root user with less privileges. See the manpage patch for more descriptions. Signed-off-by: Andy Zhou <azhou@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
* vlog: deprecate --syslog-target argumentAnsis Atteka2015-09-291-0/+2
| | | | | | | | | | | | Commit fe089c0d1e18 ("vlog: abstract out interface to syslog daemon") introduced --syslog-method flag that supersedes --syslog-target flag by: 1. making logging format configurable 2. letting daemon to also talk over UNIX domain socket (this is handy when local rsyslog daemon is running in different network namespace on the same host) Signed-off-by: Ansis Atteka <aatteka@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
* Set release dates for 2.4.0.Justin Pettit2015-08-241-1/+1
| | | | | Signed-off-by: Justin Pettit <jpettit@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
* tunneling: Remove gre64 tunnel support.Pravin B Shelar2015-08-201-0/+1
| | | | | | | | | | GRE64 was introduced to extend gre key from 32-bit to 64-bit using gre-key and sequence number field. But GRE64 is not standard protocol. There are not many users of this protocol. Therefore we have decided to remove it. Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Acked-by: Jesse Gross <jesse@nicira.com>
* Vagrantfile: Add test_ovs_system_userspace provision.Daniele Di Proietto2015-08-071-0/+3
| | | | | | | | | | | | | | Add 'test_ovs_system_userspace' provision. Command: # vagrant provision --provision-with=test_ovs_system_userspace will run "make check-system-userspace" in the vagrant launched VM. It may be more convenient to run this tests inside a vm rather than in the host, because they interact with system networking. Suggested-by: Joe Stringer <joestringer@nicira.com> Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com> Acked-by: Joe Stringer <joestringer@nicira.com>
* ofproto: Implement OF1.4 Set/Get asynchronous configuration messages.Niti Rohilla2015-07-271-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for Openflow1.4 set/get asynchronous configuration messages. OpenVSwitch already supports set/get asynchronous configuration messages for Openflow1.3. In this patch OFPT_SET_ASYNC_CONFIG message allows the controllers to set the configuration for OFPT_ROLE_STATUS, OFPT_TABLE_STATUS and OFPT_REQUESTFORWARD in addition to the Openflow1.3 messages. In a OFPT_SET_ASYNC, only the properties that shall be changed need to be included, properties that are omitted from the message are unchanged. The OFPT_GET_ASYNC_CONFIG is used to query the asynchronous configuration of switch. In a OFPT_GET_ASYNC_REPLY message, all properties must be included. According to Openflow1.4 the initial configuration shall be: - In the “master” or “equal” role, enable all OFPT_PACKET_IN messages, except those with reason OFPR_INVALID_TTL, enable all OFPT_PORT_STATUS and OFPT_FLOW_REMOVED messages, and disable all OFPT_ROLE_STATUS, OFPT_TABLE_STATUS and OFPT_REQUESTFORWARD messages. - In the “slave” role, enable all OFPT_PORT_STATUS messages and disable all OFPT_PACKET_IN, OFPT_FLOW_REMOVED, OFPT_ROLE_STATUS, OFPT_TABLE_STATUS and OFPT_REQUESTFORWARD messages. Signed-off-by: Niti Rohilla <niti.rohilla@tcs.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* Extend sFlow agent to report tunnel and MPLS structuresNeil McKee2015-07-211-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Packets are still sampled at ingress only, so the egress tunnel and/or MPLS structures are only included when there is just 1 output port. The actions are either provided by the datapath in the sample upcall or looked up in the userspace cache. The former is preferred because it is more reliable and does not present any new demands or constraints on the userspace cache, however the code falls back on the userspace lookup so that this solution can work with existing kernel datapath modules. If the lookup fails it is not critical: the compiled user-action-cookie is still available and provides the essential output port and output VLAN forwarding information just as before. The openvswitch actions can express almost any tunneling/mangling so the only totally faithful representation would be to somehow encode the whole list of flow actions in the sFlow output. However the standard sFlow tunnel structures can express most common real-world scenarios, so in parsing the actions we look for those and skip the encoding if we see anything unusual. For example, a single set(tunnel()) or tnl_push() is interpreted, but if a second such action is encountered then the egress tunnel reporting is suppressed. The sFlow standard allows "best effort" encoding so that if a field is not knowable or too onerous to look up then it can be left out. This is often the case for the layer-4 source port or even the src ip address of a tunnel. The assumption is that monitoring is enabled everywhere so a missing field can typically be seen at ingress to the next switch in the path. This patch also adds unit tests to check the sFlow encoding of set(tunnel()), tnl_push() and push_mpls() actions. The netlink attribute to request that actions be included in the upcall from the datapath is inserted for sFlow sampling only. To make that option be explicit would require further changes to the printing and parsing of actions in lib/odp-util.c, and to scripts in the test suite. Further enhancements to report on 802.1AD QinQ, 64-bit tunnel IDs, and NAT transformations can follow in future patches that make only incremental changes. Signed-off-by: Neil McKee <neil.mckee@inmon.com> [blp@nicira.com made stylistic and semantic changes] Signed-off-by: Ben Pfaff <blp@nicira.com>
* tunneling: Allow matching and setting tunnel 'OAM' flag.Jesse Gross2015-07-151-1/+2
| | | | | | | | | | | | | | | | | Several encapsulation formats have the concept of an 'OAM' bit which typically is used with networking tracing tools to distinguish test packets from real traffic. OVS already internally has support for this, however, it doesn't do anything with it and it also isn't exposed for controllers to use. This enables support through OpenFlow. There are several other tunnel flags which are consumed internally by OVS. It's not clear that it makes sense to use them externally so this does not expose those flags - although it should be easy to do so if necessary in the future. Signed-off-by: Jesse Gross <jesse@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
* hash: Add symmetric L3/L4 hash functions for multipath, bundle hashing.Jeroen van Bemmel2015-07-081-0/+1
| | | | | | Signed-off-by: Jeroen van Bemmel <jvb127@gmail.com> [blp@nicira.com made code style fixes, expanded documentation] Signed-off-by: Ben Pfaff <blp@nicira.com>
* Implement OpenFlow 1.4+ OFPMP_TABLE_DESC message.Ben Pfaff2015-07-031-0/+1
| | | | | | | Signed-off-by: Ben Pfaff <blp@nicira.com> Co-authored-by: Saloni Jain <saloni.jain@tcs.com> Signed-off-by: Saloni Jain <saloni.jain@tcs.com> Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
* Implement OpenFlow 1.4+ OFPTC_EVICTION.Ben Pfaff2015-07-031-0/+1
| | | | | | | | | | | | | | | | | | OpenFlow 1.4 introduces the ability to turn on flow table eviction with an OFPT_TABLE_MOD message specifying OFPTC_EVICTION. It also adds related machinery to other messages that mention OFPTC_* fields. This commit adds support for the new feature, implementing it as a second, parallel way to enable flow table eviction. It takes more work than it seems like it should because there is so much weirdness with the treatment of OFPTC_* flags over the evolution of OpenFlow; please refer to the explanation in DESIGN.md for more information. This commit also adds related support to ovs-ofctl, plus tests. Signed-off-by: Ben Pfaff <blp@nicira.com> Co-authored-by: Saloni Jain <saloni.jain@tcs.com> Signed-off-by: Saloni Jain <saloni.jain@tcs.com> Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
View Lorry Controller Status