summaryrefslogtreecommitdiff
path: root/include
Commit message (Collapse)AuthorAgeFilesLines
* ofproto-dpif-xlate: Always mask ip proto field.Aaron Conole2023-04-061-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | The ofproto layer currently treats nw_proto field as overloaded to mean both that a proper nw layer exists, as well as the value contained in the header for the nw proto. However, this is incorrect behavior as relevant standards permit that any value, including '0' should be treated as a valid value. Because of this overload, when the ofproto layer builds action list for a packet with nw_proto of 0, it won't build the complete action list that we expect to be built for the packet. That will cause a bad behavior where all packets passing the datapath will fall into an incomplete action set. The fix here is to unwildcard nw_proto, allowing us to preserve setting actions for protocols which we know have support for the actions we program. This means that a traffic which contains nw_proto == 0 cannot cause connectivity breakage with other traffic on the link. Reported-by: David Marchand <dmarchand@redhat.com> Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=2134873 Acked-by: Ilya Maximets <i.maximets@ovn.org> Signed-off-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* userspace: Add SRv6 tunnel support.Nobuhiro MIKI2023-03-292-0/+2
| | | | | | | | | | | | | | | | | SRv6 (Segment Routing IPv6) tunnel vport is responsible for encapsulation and decapsulation the inner packets with IPv6 header and an extended header called SRH (Segment Routing Header). See spec in: https://datatracker.ietf.org/doc/html/rfc8754 This patch implements SRv6 tunneling in userspace datapath. It uses `remote_ip` and `local_ip` options as with existing tunnel protocols. It also adds a dedicated `srv6_segs` option to define a sequence of routers called segment list. Signed-off-by: Nobuhiro MIKI <nmiki@yahoo-corp.jp> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* sparse: Fix build with DPDK and GCC 12.David Marchand2023-02-101-4/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | rte_vect.h pulls some AVX512 instrinsics headers added in GCC 12 [1] trigger a lot of warnings: libtool: compile: env "REAL_CC=ccache gcc" "CHECK=sparse -Wsparse-error -I ../include/sparse -I ../include -m64 -I /usr/local/include " cgcc -target=x86_64 -target=host_os_specs -D__MMX__=1 -D__MMX_WITH_SSE__=1 -D__SSE2_MATH__=1 -D__SSE_MATH__=1 -D__SSE__=1 -D__SSE2__=1 -DHAVE_CONFIG_H -I. -I.. -I ../include -I ./include -I ../lib -I ./lib -Wstrict-prototypes -Wall -Wextra -Wno-sign-compare -Wpointer-arith -Wformat -Wformat-security -Wswitch-enum -Wunused-parameter -Wbad-function-cast -Wcast-align -Wstrict-prototypes -Wold-style-definition -Wmissing-prototypes -Wmissing-field-initializers -fno-strict-aliasing -Wswitch-bool -Wlogical-not-parentheses -Wsizeof-array-argument -Wbool-compare -Wshift-negative-value -Wduplicated-cond -Wshadow -Wmultistatement-macros -Wcast-align=strict -mssse3 -I/home/dmarchan/git/pub/dpdk.org/22.11/install/include -include rte_config.h -I/usr/local/include -Werror -D_FILE_OFFSET_BITS=64 -g -O2 -MT lib/bfd.lo -MD -MP -MF lib/.deps/bfd.Tpo -c ../lib/bfd.c -o lib/bfd.o ../lib/bfd.c: note: in included file (through /usr/lib/gcc/x86_64-redhat-linux/12//include/immintrin.h, /usr/lib/gcc/x86_64-redhat-linux/12//include/x86intrin.h, ...): /usr/lib/gcc/x86_64-redhat-linux/12//include/avx512fp16intrin.h:38:9: error: '_Float16' has implicit type /usr/lib/gcc/x86_64-redhat-linux/12//include/avx512fp16intrin.h:38:18: error: Expected ; at end of declaration /usr/lib/gcc/x86_64-redhat-linux/12//include/avx512fp16intrin.h:38:18: error: got __v8hf /usr/lib/gcc/x86_64-redhat-linux/12//include/avx512fp16intrin.h:62:41: error: Expected ; at end of statement /usr/lib/gcc/x86_64-redhat-linux/12//include/avx512fp16intrin.h:62:41: error: got { /usr/lib/gcc/x86_64-redhat-linux/12//include/avx512fp16intrin.h:420:32: error: Expected ) in expression /usr/lib/gcc/x86_64-redhat-linux/12//include/avx512fp16intrin.h:420:32: error: got __A /usr/lib/gcc/x86_64-redhat-linux/12//include/avx512fp16intrin.h:2271:61: error: Expected ) in function call /usr/lib/gcc/x86_64-redhat-linux/12//include/avx512fp16intrin.h:2271:61: error: got __A /usr/lib/gcc/x86_64-redhat-linux/12//include/avx512fp16intrin.h:2279:61: error: Expected ) in function call /usr/lib/gcc/x86_64-redhat-linux/12//include/avx512fp16intrin.h:2279:61: error: got __A /usr/lib/gcc/x86_64-redhat-linux/12//include/avx512fp16intrin.h:2328:50: error: Expected ) in function call [...] Besides, the list of headers by rte_memcpy.h is now out of sync with DPDK. OVS takes care to include the right headers in its sources. Simply make this header self-sufficient. 1: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=a68412117fa4 Signed-off-by: David Marchand <david.marchand@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* sparse: Fix numa.h for libnuma >= 2.0.13.Ilya Maximets2023-02-031-6/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Current numa.h header for sparse re-defines functions in a way that breaks the header from libnuma 2.0.13+, because the original issue was fixed in that version: https://github.com/numactl/numactl/commit/25dcde021dd4f1a1dcac2ba0094f1cb441a2e4a5 Sparse errors as a result: lib/netdev-afxdp.c: note: in included file (through include/sparse/numa.h): /usr/include/numa.h:346:26: error: macro "numa_get_interleave_mask_compat" passed 1 arguments, but takes just 0 /usr/include/numa.h:376:26: error: macro "numa_get_membind_compat" passed 1 arguments, but takes just 0 /usr/include/numa.h:406:26: error: macro "numa_get_run_node_mask_compat" passed 1 arguments, but takes just 0 /usr/include/numa.h:347:1: error: Expected ; at end of declaration /usr/include/numa.h:347:1: error: got { /usr/include/numa.h:351:9: error: 'tp' has implicit type It's hard to adjust defines to work with both versions of a header. Just defining all the functions we actually use in OVS instead and not including the original header. Fixes: e8568993e062 ("netdev-afxdp: NUMA-aware memory allocation for XSK related memory.") Reviewed-by: David Marchand <david.marchand@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* dpctl: Add support to count upcall packets.wangchuanlei2023-01-312-0/+18
| | | | | | | | | Add support to count upcall packets per port, both succeed and failed, which is a better way to see how many packets upcalled on each interface. Acked-by: Eelco Chaudron <echaudro@redhat.com> Signed-off-by: wangchuanlei <wangchuanlei@inspur.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* openflow: Add extension to flush CT by generic match.Ales Musil2023-01-163-0/+49
| | | | | | | | | | | Add extension that allows to flush connections from CT by specifying fields that the connections should be matched against. This allows to match only some fields of the connection e.g. source address for orig direction. Reported-at: https://bugzilla.redhat.com/2120546 Signed-off-by: Ales Musil <amusil@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* ofp, dpif: Allow CT flush based on partial match.Ales Musil2023-01-162-0/+67
| | | | | | | | | | | | | | | | Currently, the CT can be flushed by dpctl only by specifying the whole 5-tuple. This is not very convenient when there are only some fields known to the user of CT flush. Add new struct ofp_ct_match which represents the generic filtering that can be done for CT flush. The match is done only on fields that are non-zero with exception to the icmp fields. This allows the filtering just within dpctl, however it is a preparation for OpenFlow extension. Reported-at: https://bugzilla.redhat.com/2120546 Signed-off-by: Ales Musil <amusil@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* netdev: Assume default link speed to be 10 Gbps instead of 100 Mbps.Ilya Maximets2022-11-301-0/+2
| | | | | | | | | | | | | | | | | | | | | 100 Mbps was a fair assumption 13 years ago. Modern days 10 Gbps seems like a good value in case no information is available otherwise. The change mainly affects QoS which is currently limited to 100 Mbps if the user didn't specify 'max-rate' and the card doesn't report the speed or OVS doesn't have a predefined enumeration for the speed reported by the NIC. Calculation of the path cost for STP/RSTP is also affected if OVS is unable to determine the link speed. Lower link speed adapters are typically good at reporting their speed, so chances for overshoot should be low. But newer high-speed adapters, for which there is no speed enumeration or if there are some other issues, will not suffer that much. Acked-by: Mike Pattrick <mkp@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* netdev-linux: Allow meter to work in tc software datapath when tc-policy is ↵Baowen Zheng2022-11-011-4/+7
| | | | | | | | | | | | | | | | | | | | | specified Add tc action flags when adding police action to offload meter table. There is a restriction that the flag of skip_sw/skip_hw should be same for filter rule and the independent created tc actions the rule uses. In this case, if we configure the tc-policy as skip_hw, filter rule will be created with skip_hw flag and the police action according to meter table will have no action flag, then flower rule will fail to add to tc kernel system. To fix this issue, we will add tc action flag when adding police action to offload a meter table, so it will allow meter table to work in tc software datapath. Fixes: 5c039ddc64ff ("netdev-linux: Add functions to manipulate tc police action") Signed-off-by: Baowen Zheng <baowen.zheng@corigine.com> Acked-by: Ilya Maximets <i.maximets@ovn.org> Signed-off-by: Simon Horman <simon.horman@corigine.com>
* sparse: Add a guard for netinet/ip6.h header on FreeBSD.Ilya Maximets2022-10-061-0/+4
| | | | | | | | | | | | | | Same as arpa/inet.h, the netinet/ip6.h on FreeBSD requires netinet/in.h to be included first. So, adding a similar guard. Also fixing one instance where this is not respected at the moment. We do have FreeBSD CI these days, but it is still nice to have a more clear error message. Fixes: b2befd5bb2db ("sparse: Add guards to prevent FreeBSD-incompatible #include order.") Acked-by: Mike Pattrick <mkp@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* datapath-windows: Alg support for ftp and tftp in conntrackldejing2022-09-201-0/+1
| | | | | | | | | | | | | | | | | | | | | This patch mainly support alg field in ct action when process ftp/tftp traffic. Tftp with alg mainly parse the tftp packet (IPv4/IPv6), extract connect info from the tftp packet and create the related connection. For ftp, previous version has supported process of ftp traffic. However, previous version regard traffic from or to port 21 as ftp traffic, this is incorrect in some scenario. This version adds alg field in ct for ftp traffic, we could use ct(alg=ftp) to process any ftp traffic from/to any port. IPv4/IPv6. Test cases: 1) ftp ipv4/ipv6 use alg field in the normal and nat scenario. 2) tftp ipv4/ipv6 use alg field in the normal and nat scenario. Signed-off-by: ldejing <ldejing@vmware.com> Signed-off-by: Alin-Gabriel Serdean <aserdean@ovn.org>
* dynamic-string: Add function for a sparse hex dump.Ilya Maximets2022-08-041-0/+2
| | | | | | | | New function to dump large and sparsely populated data structures like struct flow. Reviewed-by: Roi Dayan <roid@nvidia.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* make: Remove the Linux datapath.Greg Rose2022-07-153-1/+1178
| | | | | | | | | | | | | | | | Update the necessary make and configure files to remove the Linux datapath and then remove the datapath. Move datapath/linux/compat/include/linux/openvswitch.h to include/linux/openvswitch.h because it is needed to generate header files used by the userspace switch. Also remove references to the Linux datapath from auxiliary files and utilities since it is no longer supported. Signed-off-by: Greg Rose <gvrose8192@gmail.com> Reviewed-by: David Marchand <david.marchand@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* classifier: Adjust segment boundary to execute prerequisite processing.Aaron Conole2022-06-071-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | During flow processing, the flow wildcards are checked as a series of stages, and these stages are intended to carry dependencies in a single direction. But when the neighbor discovery processing, for example, was executed there is an incorrect dependency chain - we need fields from stage 4 to determine whether we need fields from stage 3. We can build a set of flow rules to demonstrate this: table=0,priority=100,ipv6,ipv6_src=1000::/10 actions=resubmit(,1) table=0,priority=0 actions=NORMAL table=1,priority=110,ipv6,ipv6_dst=1000::3 actions=resubmit(,2) table=1,priority=100,ipv6,ipv6_dst=1000::4 actions=resubmit(,2) table=1,priority=0 actions=NORMAL table=2,priority=120,icmp6,nw_ttl=255,icmp_type=135,icmp_code=0,nd_sll=10:de:ad:be:ef:10 actions=NORMAL table=2,priority=100,tcp actions=NORMAL table=2,priority=100,icmp6 actions=NORMAL table=2,priority=0 actions=NORMAL With this set of flows, any IPv6 packet that executes through this pipeline will have the corresponding nd_sll field flagged as required match for classification even if that field doesn't make sense in such a context (for example, TCP packets). When the corresponding flow is installed into the kernel datapath, this field is not reflected when the revalidator executes the dump stage (see net/openvswitch/flow_netlink.c for more details). During the sweep stage, revalidator will compare the dumped WC with a generated WC - these will mismatch because the generated WC will match on the Neighbor Discovery fields, while the datapath WC will not match on these fields. We will then invalidate the flow and as a side effect force an upcall. By redefining the boundary, we shift these fields to the l4 subtable, and cause masks to be generated matching just the requisite fields. The list of fields being shifted: struct in6_addr nd_target; struct eth_addr arp_sha; struct eth_addr arp_tha; ovs_be16 tcp_flags; ovs_be16 pad2; struct ovs_key_nsh nsh; A standout field would be tcp_flags moving from l3 subtable matches to the l4 subtable matches. This reverts a partial performance optimization in the case of stateless firewalling. The tcp_flags field might have been a good candidate to retain in the l3 segment, but it got overloaded with ICMPv6 ND matching, and therefore we can't preserve this kind of optimization. Two other approaches were considered - moving the nd_target field alone and collapsing the l3/l4 segments into a single subtable for matching. Moving any field individually introduces ABI mismatch, and doesn't completely address the problems with other neighbor discovery related fields (such as nd_sll/nd_tll). Collapsing the two subtables creates an issue with datapath flow explosion, since the l3 and l4 fields will be unwildcarded together (this can be seen with some of the existing classifier tests). A simple test is added to showcase the behavior. Fixes: 476f36e83bc5 ("Classifier: Staged subtable matching.") Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=2081773 Reported-by: Numan Siddique <nusiddiq@redhat.com> Suggested-by: Ilya Maximets <i.maximets@ovn.org> Signed-off-by: Aaron Conole <aconole@redhat.com> Acked-by: Eelco Chaudron <echaudro@redhat.com> Acked-by: Cian Ferriter <cian.ferriter@intel.com> Tested-by: Numan Siddique <numans@ovn.org> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* netdev-linux: Properly access 32-bit aligned rtnl_link_stats64 structs.Dumitru Ceara2022-05-171-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Detected by UB Sanitizer when running system tests: lib/netdev-linux.c:6250:26: runtime error: member access within misaligned address 0x00000229a204 for type 'const struct rpl_rtnl_link_stats64', which requires 8 byte alignment 0x00000229a204: note: pointer points here c4 00 17 00 01 00 00 00 00 00 00 00 01 00 00 00 ^ 00 00 00 00 6e 00 00 00 00 00 00 00 6e 00 00 00 0 0x89f10e in netdev_stats_from_rtnl_link_stats64 lib/netdev-linux.c:6250 1 0x89f10e in get_stats_via_netlink lib/netdev-linux.c:6298 2 0x8a039a in netdev_linux_get_stats lib/netdev-linux.c:2227 3 0x68e149 in netdev_get_stats lib/netdev.c:1599 4 0x407b21 in iface_refresh_stats vswitchd/bridge.c:2687 5 0x419eb6 in iface_create vswitchd/bridge.c:2134 6 0x419eb6 in bridge_add_ports__ vswitchd/bridge.c:1170 7 0x41f71c in bridge_add_ports vswitchd/bridge.c:1181 8 0x41f71c in bridge_reconfigure vswitchd/bridge.c:898 9 0x429f59 in bridge_run vswitchd/bridge.c:3331 10 0x430af3 in main vswitchd/ovs-vswitchd.c:129 11 0x7fbdfd43eb74 in __libc_start_main (/lib64/libc.so.6+0x27b74) 12 0x4072fd in _start (/root/ovs/vswitchd/ovs-vswitchd+0x4072fd) Signed-off-by: Dumitru Ceara <dceara@redhat.com> Acked-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* ofp-actions: Use aligned structures when decoding ofp actions.Dumitru Ceara2022-05-172-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some openflow actions can be misaligned, e.g., actions whithin OF 1.0 replies to statistics reply messages which have a header of 12 bytes and no additional padding. Also, buggy controllers might incorrectly encode actions. When decoding multiple actions in ofpacts_decode(), make sure that when advancing to the next action it will be properly aligned (multiple of OFPACT_ALIGNTO). Detected by UB Sanitizer when running one of the fuzz tests: lib/ofp-actions.c:5347:12: runtime error: member access within misaligned address 0x0000016ba274 for type 'const struct nx_action_learn', which requires 8 byte alignment 0x0000016ba274: note: pointer points here 20 20 20 20 ff ff 00 38 00 00 23 20 00 10 20 20 ^ 20 20 20 20 20 20 20 20 20 20 20 20 00 03 20 00 0 0x52cece in decode_LEARN_common lib/ofp-actions.c:5347 1 0x52dcf6 in decode_NXAST_RAW_LEARN lib/ofp-actions.c:5463 2 0x548604 in ofpact_decode lib/ofp-actions.inc2:4723 3 0x53ee43 in ofpacts_decode lib/ofp-actions.c:7781 4 0x53efc1 in ofpacts_pull_openflow_actions__ lib/ofp-actions.c:7820 5 0x5409e1 in ofpacts_pull_openflow_instructions lib/ofp-actions.c:8396 6 0x5608a8 in ofputil_decode_flow_stats_reply lib/ofp-flow.c:1100 Acked-by: Adrian Moreno <amorenoz@redhat.com> Acked-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Dumitru Ceara <dceara@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* ofp-actions: Ensure aligned accesses to masked fields.Dumitru Ceara2022-05-171-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For example is parsing the OVN "eth.dst[40] = 1;" action, which triggered the following warning from UndefinedBehaviorSanitizer: lib/meta-flow.c:3210:9: runtime error: member access within misaligned address 0x000000de4e36 for type 'const union mf_value', which requires 8 byte alignment 0x000000de4e36: note: pointer points here 00 00 00 00 01 00 00 00 00 00 00 00 00 00 70 4e de 00 00 00 00 00 ^ 10 51 de 00 00 00 00 00 c0 4f 0 0x5818bc in mf_format lib/meta-flow.c:3210 1 0x5b6047 in format_SET_FIELD lib/ofp-actions.c:3342 2 0x5d68ab in ofpact_format lib/ofp-actions.c:9213 3 0x5d6ee0 in ofpacts_format lib/ofp-actions.c:9237 4 0x410922 in test_parse_actions tests/test-ovn.c:1360 To avoid this we now change the internal representation of the set_field actions, struct ofpact_set_field, such that the mask is always stored at a correctly aligned address, multiple of OFPACT_ALIGNTO. We also need to adapt the "ovs-ofctl show-flows - Oversized flow" test because now the ofpact representation of the set_field action uses more bytes in memory (for the extra alignment). Change the test to use dec_ttl instead. Acked-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Dumitru Ceara <dceara@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* treewide: Avoid offsetting NULL pointers.Dumitru Ceara2022-05-172-6/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is undefined behavior and was reported by UB Sanitizer: lib/meta-flow.c:3445:16: runtime error: member access within null pointer of type 'struct vl_mf_field' 0 0x6aad0f in mf_get_vl_mff lib/meta-flow.c:3445 1 0x6d96d7 in mf_from_oxm_header lib/nx-match.c:260 2 0x6d9e2e in nx_pull_header__ lib/nx-match.c:341 3 0x6daafa in nx_pull_header lib/nx-match.c:488 4 0x6abcb6 in mf_vl_mff_nx_pull_header lib/meta-flow.c:3605 5 0x73b9be in decode_NXAST_RAW_REG_MOVE lib/ofp-actions.c:2652 6 0x764ccd in ofpact_decode lib/ofp-actions.inc2:4681 [...] lib/sset.c:315:12: runtime error: applying zero offset to null pointer 0 0xcc2e6a in sset_at_position lib/sset.c:315:12 1 0x5734b3 in port_dump_next ofproto/ofproto-dpif.c:4083:20 [...] lib/ovsdb-data.c:2194:56: runtime error: applying zero offset to null pointer 0 0x5e9530 in ovsdb_datum_added_removed lib/ovsdb-data.c:2194:56 1 0x4d6258 in update_row_ref_count ovsdb/transaction.c:335:17 2 0x4c360b in for_each_txn_row ovsdb/transaction.c:1572:33 [...] lib/ofpbuf.c:440:30: runtime error: applying zero offset to null pointer 0 0x75066d in ofpbuf_push_uninit lib/ofpbuf.c:440 1 0x46ac8a in ovnacts_parse lib/actions.c:4190 2 0x46ad91 in ovnacts_parse_string lib/actions.c:4208 3 0x4106d1 in test_parse_actions tests/test-ovn.c:1324 [...] lib/ofp-actions.c:3205:22: runtime error: applying non-zero offset 2 to null pointer 0 0x6e1641 in set_field_split_str lib/ofp-actions.c:3205:22 [...] lib/tnl-ports.c:74:12: runtime error: applying zero offset to null pointer 0 0xceffe7 in tnl_port_cast lib/tnl-ports.c:74:12 1 0xcf14c3 in map_insert lib/tnl-ports.c:116:13 [...] ofproto/ofproto.c:8905:16: runtime error: applying zero offset to null pointer 0 0x556795 in eviction_group_hash_rule ofproto/ofproto.c:8905:16 1 0x503f8d in eviction_group_add_rule ofproto/ofproto.c:9022:42 [...] Also, it's valid to have an empty ofpact list and we should be able to try to iterate through it. UB Sanitizer report: include/openvswitch/ofp-actions.h:222:12: runtime error: applying zero offset to null pointer 0 0x665d69 in ofpact_end ./include/openvswitch/ofp-actions.h:222:12 1 0x66b2cf in ofpacts_put_openflow_actions lib/ofp-actions.c:8861:5 2 0x6ffdd1 in ofputil_encode_flow_mod lib/ofp-flow.c:447:9 [...] Signed-off-by: Dumitru Ceara <dceara@redhat.com> Acked-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* ofp-monitor: Support flow monitoring for OpenFlow 1.3, 1.4+.Vasu Dasari2022-04-284-24/+206
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Extended OpenFlow monitoring support * OpenFlow 1.3 with ONF extensions * OpenFlow 1.4+ as defined in OpenFlow specification 1.4+. ONF extensions are similar to Nicira extensions except for onf_flow_monitor_request{} where out_port is defined as 32-bit number OF(1.1) number, oxm match formats are used in update and request messages. Flow monitoring support in 1.4+ is slightly different from Nicira and ONF extensions. * More flow monitoring flags are defined. * Monitor add/modify/delete command is introduced in flow_monitor request message. * Addition of out_group as part of flow_monitor request message Description of changes: 1. Generate ofp-msgs.inc to be able to support 1.3, 1.4+ flow Monitoring messages. include/openvswitch/ofp-msgs.h 2. Modify openflow header files with protocol specific headers. include/openflow/openflow-1.3.h include/openflow/openflow-1.4.h 3. Modify OvS abstraction of openflow headers. ofp-monitor.h leverages enums from on nicira extensions for creating protocol abstraction headers. OF(1.4+) enums are superset of nicira extensions. include/openvswitch/ofp-monitor.h 4. Changes to these files reflect encoding and decoding of new protocol messages. lib/ofp-monitor.c 5. Changes to modules using ofp-monitor APIs. Most of the changes here are to migrate enums from nicira to OF 1.4+ versions. ofproto/connmgr.c ofproto/connmgr.h ofproto/ofproto-provider.h ofproto/ofproto.c 6. Extended protocol decoding tests to verify all protocol versions FLOW_MONITOR_CANCEL FLOW_MONITOR_PAUSED FLOW_MONITOR_RESUMED FLOW_MONITOR request FLOW_MONITOR reply tests/ofp-print.at 7. Modify flow monitoring tests to be able executed by all protocol versions. tests/ofproto.at 7. Modified documentation highlighting the change utilities/ovs-ofctl.8.in NEWS Signed-off-by: Vasu Dasari <vdasari@gmail.com> Reported-at: https://mail.openvswitch.org/pipermail/ovs-dev/2021-June/383915.html Acked-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* ofp-monitor: Extend Flow Monitoring support for OF 1.0-1.2 with Nicira ↵Vasu Dasari2022-04-282-5/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Extensions. Currently OVS supports flow-monitoring for OpenFlow 1.0 and Nicira Extenstions. Any other OpenFlow versioned messages are not accepted. This change will allow OpenFlow1.0-1.2 Flow Monitoring with Nicira extensions be accepted. Also made sure that flow-monitoring updates, flow monitoring pause messages, resume messages are sent in the same OpenFlow version as that of flow-monitor request. Description of changes: 1. Generate ofp-msgs.inc to be able to support 1.0-1.2 Flow Monitoring messages. include/openvswitch/ofp-msgs.h 2. Support vconn to accept user specified version and use it for vconn flow-monitoring session ofproto/ofproto.c 3. Modify APIs to use protocol as an argument to encode and decode messages include/openvswitch/ofp-monitor.h lib/ofp-monitor.c ofproto/connmgr.c ofproto/connmgr.h ofproto/ofproto.c 4. Modified following testcases to be verified across supported OF Versions ofproto - flow monitoring ofproto - flow monitoring with !own ofproto - flow monitoring with out_port ofproto - flow monitoring pause and resume ofproto - flow monitoring usable protocols tests/ofproto.at 5. Updated NEWS with the support added with this commit Signed-off-by: Vasu Dasari <vdasari@gmail.com> Reported-at: https://mail.openvswitch.org/pipermail/ovs-discuss/2020-December/050820.html Acked-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* hmap: use short version of safe loops if possible.Adrian Moreno2022-03-302-6/+35
| | | | | | | | | | | | | | | Using SHORT version of the *_SAFE loops makes the code cleaner and less error prone. So, use the SHORT version and remove the extra variable when possible for hmap and all its derived types. In order to be able to use both long and short versions without changing the name of the macro for all the clients, overload the existing name and select the appropriate version depending on the number of arguments. Acked-by: Dumitru Ceara <dceara@redhat.com> Acked-by: Eelco Chaudron <echaudro@redhat.com> Signed-off-by: Adrian Moreno <amorenoz@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* hmap: implement UB-safe hmap pop iterator.Adrian Moreno2022-03-301-12/+19
| | | | | | | | | | | | | HMAP_FOR_EACH_POP iterator has an additional difficulty, which is the use of two iterator variables of different types. In order to re-write this loop in a UB-safe manner, create a iterator struct to be used as loop variable. Acked-by: Dumitru Ceara <dceara@redhat.com> Acked-by: Eelco Chaudron <echaudro@redhat.com> Signed-off-by: Adrian Moreno <amorenoz@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* hmap: use multi-variable helpers for hmap loops.Adrian Moreno2022-03-301-30/+31
| | | | | | | | | | | | Rewrite hmap's loops using multi-variable helpers. For SAFE loops, use the LONG version of the multi-variable macros to keep backwards compatibility. Acked-by: Eelco Chaudron <echaudro@redhat.com> Acked-by: Dumitru Ceara <dceara@redhat.com> Signed-off-by: Adrian Moreno <amorenoz@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* list: use short version of safe loops if possible.Adrian Moreno2022-03-301-2/+28
| | | | | | | | | | | | | | | Using the SHORT version of the *_SAFE loops makes the code cleaner and less error-prone. So, use the SHORT version and remove the extra variable when possible. In order to be able to use both long and short versions without changing the name of the macro for all the clients, overload the existing name and select the appropriate version depending on the number of arguments. Acked-by: Dumitru Ceara <dceara@redhat.com> Acked-by: Eelco Chaudron <echaudro@redhat.com> Signed-off-by: Adrian Moreno <amorenoz@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* list: use multi-variable helpers for list loops.Adrian Moreno2022-03-301-31/+42
| | | | | | | | | | | | | | | | | | | | | | Use multi-variable iteration helpers to rewrite non-safe loops. There is an important behavior change compared with the previous implementation: When the loop ends normally (i.e: not via "break;"), the object pointer provided by the user is NULL. This is safer because it's not guaranteed that it would end up pointing a valid address. For pop iterator, set the variable to NULL when the loop ends. Clang-analyzer has successfully picked the potential null-pointer dereference on the code that triggered this change (bond.c) and nothing else has been detected. For _SAFE loops, use the LONG version for backwards compatibility. Acked-by: Eelco Chaudron <echaudro@redhat.com> Acked-by: Dumitru Ceara <dceara@redhat.com> Signed-off-by: Adrian Moreno <amorenoz@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* util: add helpers to overload SAFE macro.Adrian Moreno2022-03-301-0/+21
| | | | | | | | | | | | | | | | | Having both LONG and SHORT versions of the SAFE macros with different names is not very convenient. Add helpers that facilitate overloading such macros using a single name. In order to work around a known issue in MSVC [1], an indirection layer has to be introduced. [1] https://developercommunity.visualstudio.com/t/-va-args-seems-to-be-trated-as-a-single-parameter/460154 Acked-by: Dumitru Ceara <dceara@redhat.com> Acked-by: Eelco Chaudron <echaudro@redhat.com> Signed-off-by: Adrian Moreno <amorenoz@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* util: add safe multi-variable iterators.Adrian Moreno2022-03-301-0/+80
| | | | | | | | | | | | | | Safe version of multi-variable iterator helpers declare an internal variable to store the next value of the iterator temporarily. Two versions of the macro are provided, one that still uses the NEXT variable for backwards compatibility and a shorter version that does not require the use of an additional variable provided by the user. Acked-by: Eelco Chaudron <echaudro@redhat.com> Acked-by: Dumitru Ceara <dceara@redhat.com> Signed-off-by: Adrian Moreno <amorenoz@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* util: add multi-variable loop iterator macros.Adrian Moreno2022-03-301-0/+43
| | | | | | | | | | | | | | | | | | | | Multi-variable loop iterators avoid potential undefined behavior by using an internal iterator variable to perform the iteration and only referencing the containing object (via OBJECT_CONTAINING) if the iterator has been validated via the second expression of the for statement. That way, the user can easily implement a loop that never tries to obtain the object containing NULL or stack-allocated non-contained nodes. When the loop ends normally (not via "break;") the user-provided variable is set to NULL. Acked-by: Eelco Chaudron <echaudro@redhat.com> Acked-by: Dumitru Ceara <dceara@redhat.com> Signed-off-by: Adrian Moreno <amorenoz@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* compat: Add gen_stats include to define tc hw stats.Paul Blakey2022-03-042-0/+82
| | | | | | | | | | Update kernel UAPI to support dumping hardware stats of tc filters. Signed-off-by: Paul Blakey <paulb@nvidia.com> Reviewed-by: Roi Dayan <roid@nvidia.com> Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* daemon-unix: Close log file in monitor process while waiting on child.Ben Pfaff2022-02-141-0/+2
| | | | | | | | | | | | | Until now, the monitor process held its log file open while it waited for the child to exit, and then it reopened it after the child exited. Holding the log file open this way prevented log rotation from freeing disk space. This commit avoids the problem by closing the log file before waiting, then reopening it afterward. Signed-off-by: Ben Pfaff <blp@ovn.org> Reported-by: Antonin Bas <abas@vmware.com> VMware-BZ: #2743409 Signed-off-by: William Tu <u9012063@gmail.com>
* openvswitch: Define the OVS_STATIC_TRACE() macro.Eelco Chaudron2022-01-182-0/+51
| | | | | | | | | This patch defines the OVS_STATIC_TRACE() macro, and as an example, adds two of them in the bridge run loop. Signed-off-by: Eelco Chaudron <echaudro@redhat.com> Acked-by: Paolo Valerio <pvalerio@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* json: Inline clone and destroy functions.Ilya Maximets2021-11-301-2/+24
| | | | | | | | | | With the next commit reference counting of json objects will take significant part of the CPU time for ovsdb-server. Inlining them to reduce the cost of a function call. Acked-by: Mike Pattrick <mkp@redhat.com> Acked-by: Dumitru Ceara <dceara@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* ofproto-dpif-xlate: Fix zone set from non-frozen-metadata fields.Peng He2021-10-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CT zone could be set from a field that is not included in frozen metadata. Consider the example rules which are typically seen in OpenStack security group rules: priority=100,in_port=1,tcp,ct_state=-trk,action=ct(zone=5,table=0) priority=100,in_port=1,tcp,ct_state=+trk,action=ct(commit,zone=NXM_NX_CT_ZONE[]),2 The zone is set from the first rule's ct action. These two rules will generate two megaflows: the first one uses zone=5 to query the CT module, the second one sets the zone-id from the first megaflow and commit to CT. The current implementation will generate a megaflow that does not use ct_zone=5 as a match, but directly commit into the ct using zone=5, as zone is set by an Imm not a field. Consider a situation that one changes the zone id (for example to 15) in the first rule, however, still keep the second rule unchanged. During this change, there is traffic hitting the two generated megaflows, the revaldiator would revalidate all megaflows, however, the revalidator will not change the second megaflow, because zone=5 is recorded in the megaflow, so the xlate will still translate the commit action into zone=5, and the new traffic will still commit to CT as zone=5, not zone=15, resulting in taffic drops and other issues. Just like OVS set-field convention, if a field X is set by Y (Y is a variable not an Imm), we should also mask Y as a match in the generated megaflow. An exception is that if the zone-id is set by the field that is included in the frozen state (i.e. regs) and this upcall is a resume of a thawed xlate, the un-wildcarding can be skipped, as the recirc_id is a hash of the values in these fields, and it will change following the changes of these fields. When the recirc_id changes, all megaflows with the old recirc id will be invalid later. Fixes: 07659514c3 ("Add support for connection tracking.") Reported-by: Sai Su <susai.ss@bytedance.com> Signed-off-by: Peng He <hepeng.0320@bytedance.com> Acked-by: Mark D. Gray <mark.d.gray@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* include/windows/unistd.h: Fixed type cast warning on Windows.Sergey Madaminov2021-09-161-1/+1
| | | | | | | | | | | | | | | | | | | | Currently, the function call type cast for getting file handle produces a warning during OvS compilation on Windows with the following message: ..\include\windows\unistd.h:97:25: warning: cast from function call of type 'intptr_t' (aka 'int') to non-matching type 'HANDLE' (aka 'void *') [-Wbad-function-cast] HANDLE h = (HANDLE) _get_osfhandle(fd); There is a function `LongToHandle()` to perform such cast [1]. But as `intptr_t` can be either `long long` for 64-bit or `int` for 32-bit, instead of clogging the code with `#ifdef` macros to use different cast functions, we can perform this cast directly. Signed-off-by: Sergey Madaminov <sergey.madaminov@gmail.com> Acked-by: Michael Santana <msantana@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* json: Add support for partially serialized json objects.Ilya Maximets2021-08-311-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Introducing a new json type JSON_SERIALIZED_OBJECT. It's not an actual type that can be seen in a json message on a wire, but internal type that is intended to hold a serialized version of some other json object. For this reason it's defined after the JSON_N_TYPES to not confuse parsers and other parts of the code that relies on compliance with RFC 4627. With this JSON type internal users may construct large JSON objects, parts of which are already serialized. This way, while serializing the larger object, data from JSON_SERIALIZED_OBJECT can be added directly to the result, without additional processing. This will be used by next commits to add pre-serialized JSON data to the raft_header structure, that can be converted to a JSON before writing the file transaction on disk or sending to other servers. Same technique can also be used to pre-serialize json_cache for ovsdb monitors, this should allow to not perform serialization for every client and will save some more memory. Since serialized JSON is just a string, reusing the 'json->string' pointer for it. Acked-by: Dumitru Ceara <dceara@redhat.com> Acked-by: Han Zhou <hzhou@ovn.org> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* netlink: Add support for parsing link layer address.Frode Nordahl2021-08-201-0/+8
| | | | | | | | | | | | | | Data retrieved from netlink and friends may include link layer address. Add type to nl_attr_type and min/max functions to allow use of nl_policy_parse with this type of data. While this will not be used by Open vSwitch itself at this time, sibling and derived projects want to use the great netlink library that OVS provides, and it is not possible to safely override the global nl_attr_type symbol at link time. Signed-off-by: Frode Nordahl <frode.nordahl@canonical.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* add port-based ingress policing based packet-per-second rate-limitingYong Xu2021-07-011-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | OVS has support for using policing to enforce a rate limit in kilobits per second. This is configured using OVSDB. f.e. $ ovs-vsctl set interface tap0 ingress_policing_rate=1000 $ ovs-vsctl set interface tap0 ingress_policing_burst=100 This patch adds a related feature, allowing policing to enforce a rate limit in kilo-packets per second. This is also configured using OVSDB. $ ovs-vsctl set interface tap0 ingress_policing_kpkts_rate=1000 $ ovs-vsctl set interface tap0 ingress_policing_kpkts_burst=100 The kilo-bit and kilo-packet rate limits may be used separately or in combination. Add separate action for BPS and PPS in netlink message. Revise code and change action result to pipe to allow traffic pipe into second action. This patch implements the feature for: * OVSDB (northbound API) * TC policer when used both with and without TC offload (kernel API) Signed-off-by: Yong Xu <yong.xu@corigine.com> Signed-off-by: Simon Horman <simon.horman@netronome.com>
* compat: Add ct_state flags definitionsPaul Blakey2021-03-151-1/+4
| | | | | | | | | Add TCA_FLOWER_KEY_CT_FLAGS_REPLY, and TCA_FLOWER_KEY_CT_FLAGS_INVALID. Signed-off-by: Paul Blakey <paulb@nvidia.com> Acked-by: Roi Dayan <roid@nvidia.com> Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: Simon Horman <simon.horman@netronome.com>
* dpdk: Update to use DPDK v20.11.Ian Stokes2020-12-163-0/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds support for DPDK v20.11, it includes the following changes. 1. travis: Remove explicit DPDK kmods configuration. 2. sparse: Fix build with 20.05 DPDK tracepoints. 3. netdev-dpdk: Remove experimental API flag. http://patchwork.ozlabs.org/project/openvswitch/list/?series=173216&state=* 4. sparse: Update to DPDK 20.05 trace point header. http://patchwork.ozlabs.org/project/openvswitch/list/?series=179604&state=* 5. sparse: Fix build with DPDK 20.08. http://patchwork.ozlabs.org/project/openvswitch/list/?series=200181&state=* 6. build: Add support for DPDK meson build. http://patchwork.ozlabs.org/project/openvswitch/list/?series=199138&state=* 7. netdev-dpdk: Remove usage of RTE_ETH_DEV_CLOSE_REMOVE flag. http://patchwork.ozlabs.org/project/openvswitch/list/?series=207850&state=* 8. netdev-dpdk: Fix build with 20.11-rc1. http://patchwork.ozlabs.org/project/openvswitch/list/?series=209006&state=* 9. sparse: Fix __ATOMIC_* redefinition errors http://patchwork.ozlabs.org/project/openvswitch/list/?series=209452&state=* 10. build: Remove DPDK make build references. http://patchwork.ozlabs.org/project/openvswitch/list/?series=216682&state=* For credit all authors of the original commits to 'dpdk-latest' with the above changes have been added as co-authors for this commit. Signed-off-by: David Marchand <david.marchand@redhat.com> Co-authored-by: David Marchand <david.marchand@redhat.com> Signed-off-by: Sunil Pai G <sunil.pai.g@intel.com> Co-authored-by: Sunil Pai G <sunil.pai.g@intel.com> Signed-off-by: Eli Britstein <elibr@nvidia.com> Co-authored-by: Eli Britstein <elibr@nvidia.com> Tested-by: Harry van Haaren <harry.van.haaren@intel.com> Tested-by: Govindharajan, Hariprasad <hariprasad.govindharajan@intel.com> Tested-by: Tonghao Zhang <xiangxia.m.yue@gmail.com> Acked-by: Ilya Maximets <i.maximets@ovn.org> Signed-off-by: Ian Stokes <ian.stokes@intel.com>
* Eliminate use of term "slave" in bond, LACP, and bundle contexts.Ben Pfaff2020-10-211-13/+15
| | | | | | | | | | | | | The new term is "member". Most of these changes should not change user-visible behavior. One place where they do is in "ovs-ofctl dump-flows", which will now output "members:..." inside "bundle" actions instead of "slaves:...". I don't expect this to cause real problems in most systems. The old syntax is still supported on input for backward compatibility. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com>
* conntrack: Rename "master" connection to "parent" connection.Ben Pfaff2020-10-211-7/+7
| | | | | Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com>
* Eliminate "whitelist" and "blacklist" terms.Ben Pfaff2020-10-161-1/+1
| | | | | | | | There is one remaining use under datapath. That change should happen upstream in Linux first according to our usual policy. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org>
* Use primary/secondary, not master/slave, as names for OpenFlow roles.Ben Pfaff2020-10-165-25/+26
| | | | | Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org>
* ctags: Include new annotations to ctags ignore list.Flavio Leitner2020-07-041-0/+2
| | | | | | | | | | | | | | | The annotation OVS_NO_THREAD_SAFETY_ANALYSIS and OVS_LOCKABLE are not part of the list, so ctags can't find functions using them. The annotation list comes from a regex and to include more items make the regex more difficult to read and maintain. Convert to a static list because it isn't supposed to change much and there is no standard names. Also add a comment to remind to keep the list up-to-date. Signed-off-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: William Tu <u9012063@gmail.com>
* netdev-offload-tc: Revert tunnel src/dst port masks handlingRoi Dayan2020-06-191-3/+0
| | | | | | | | | | | | | | | | The cited commit intended to add tc support for masking tunnel src/dst ips and ports. It's not possible to do tunnel ports masking with openflow rules and the default mask for tunnel ports set to 0 in tnl_wc_init(), unlike tunnel ports default mask which is full mask. So instead of never passing tunnel ports to tc, revert the changes to tunnel ports to always pass the tunnel port. In sw classification is done by the kernel, but for hw we must match the tunnel dst port. Fixes: 5f568d049130 ("netdev-offload-tc: Allow to match the IP and port mask of tunnel") Signed-off-by: Roi Dayan <roid@mellanox.com> Reviewed-by: Eli Britstein <elibr@mellanox.com> Signed-off-by: Simon Horman <simon.horman@netronome.com>
* netdev-offload-tc: Allow installing arp rules to TC dp.Tonghao Zhang2020-06-081-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | This patch allows to install arp rules to tc dp. In the future, arp will be offloaded to hardware to be processed. So OvS enable this now. $ ovs-appctl dpctl/add-flow 'recirc_id(0),in_port(3),eth(),\ eth_type(0x0806),arp(op=2,tha=00:50:56:e1:4b:ab,tip=10.255.1.116)' 2 $ ovs-appctl dpctl/dump-flows ... arp(tip=10.255.1.116,op=2,tha=00:50:56:e1:4b:ab) ... $ tc filter show dev <ethx> ingress ... eth_type arp arp_tip 10.255.1.116 arp_op reply arp_tha 00:50:56:e1:4b:ab not_in_hw action order 1: mirred (Egress Redirect to device <ethy>) stolen ... Signed-off-by: Tonghao Zhang <xiangxia.m.yue@gmail.com> Signed-off-by: Simon Horman <simon.horman@netronome.com>
* netdev-offload-tc: Allow to match the IP and port mask of tunnelTonghao Zhang2020-06-031-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows users to offload the TC flower rules with tunnel mask. This patch allows masked match of the following, where previously supported an exact match was supported: * Remote (dst) tunnel endpoint address * Local (src) tunnel endpoint address * Remote (dst) tunnel endpoint UDP port And also allows masked match of the following, where previously no match was supported: * Local (src) tunnel endpoint UDP port In some case, mask is useful as wildcards. For example, DDOS, in that case, we don’t want to allow specified hosts IPs or only source Ports to access the targeted host. For example: $ ovs-appctl dpctl/add-flow "tunnel(dst=2.2.2.100,src=2.2.2.0/255.255.255.0,tp_dst=4789),\ recirc_id(0),in_port(3),eth(),eth_type(0x0800),ipv4()" "" $ tc filter show dev vxlan_sys_4789 ingress ... eth_type ipv4 enc_dst_ip 2.2.2.100 enc_src_ip 2.2.2.0/24 enc_dst_port 4789 enc_ttl 64 in_hw in_hw_count 2 action order 1: gact action drop ... Signed-off-by: Tonghao Zhang <xiangxia.m.yue@gmail.com> Acked-by: Roi Dayan <roid@mellanox.com> Signed-off-by: Simon Horman <simon.horman@netronome.com>
* sparse: Fix typo in DPDK endian conversion macros.David Marchand2020-05-051-4/+4
| | | | | | | | | | | | | | This header is duplicated from the DPDK generic header. Fix typo identified in DPDK [1]. While at it, RTE_EXEC_ENV_BSDAPP has been replaced with RTE_EXEC_ENV_FREEBSD in 19.05 [2]. 1: https://git.dpdk.org/dpdk/commit/?id=a3e283ed904c 2: https://git.dpdk.org/dpdk/commit/?id=5fbc1d498f54 Signed-off-by: David Marchand <david.marchand@redhat.com> Signed-off-by: Ian Stokes <ian.stokes@intel.com>
* ofp-actions: Add delete field actionYi-Hung Wei2020-04-291-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a new OpenFlow action, delete field, to delete a field in packets. Currently, only the tun_metadata fields are supported. One use case to add this action is to support multiple versions of geneve tunnel metadatas to be exchanged among different versions of networks. For example, we may introduce tun_metadata2 to replace old tun_metadata1, but still want to provide backward compatibility to the older release. In this case, in the new OpenFlow pipeline, we would like to support the case to receive a packet with tun_metadata1, do some processing. And if the packet is going to a switch in the newer release, we would like to delete the value in tun_metadata1 and set a value into tun_metadata2. Currently, ovs does not provide an action to remove a value in tun_metadata if the value is present. This patch fulfills the gap by adding the delete_field action. For example, the OpenFlow syntax to delete tun_metadata1 is: actions=delete_field:tun_metadata1 Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com> Signed-off-by: William Tu <u9012063@gmail.com> Acked-by: William Tu <u9012063@gmail.com>
* util: Update OVS_TYPEOF macro for C++ enabled applications.Archana Holla2020-04-071-0/+2
| | | | | | | | OVS_TYPEOF macro doesn’t return the type of object for non __GNUC__ platforms. Updating it to use "decltype" keyword when used from C++ code. Signed-off-by: Archana Holla <harchana@vmware.com> Signed-off-by: William Tu <u9012063@gmail.com>
View Lorry Controller Status