summaryrefslogtreecommitdiff
path: root/lib/learning-switch.c
Commit message (Collapse)AuthorAgeFilesLines
* ofp-flow: Reduce memory consumption for ofputil_flow_mod, using minimatch.Ben Pfaff2018-03-311-4/+10
| | | | | | | | | | | | | | | | | | | | | | | Until now, struct ofputil_flow_mod, which represents an OpenFlow flow table modification request, has incorporated a struct match, which made the overall ofputil_flow_mod about 2.5 kB. This is OK for a small number of flows, but absurdly inflates memory requirements when there are hundreds of thousands of flows. This commit fixes the problem by changing struct match to struct minimatch inside ofputil_flow_mod, which reduces its size to about 100 bytes plus the actual size of the flow match (usually a few dozen bytes). This affects memory usage of ovs-ofctl (when it adds a large number of flows) more than ovs-vswitchd. Reported-by: Michael Ben-Ami <mbenami@digitalocean.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Reviewed-by: Armando Migliaccio <armamig@gmail.com> Tested-by: Armando Migliaccio <armamig@gmail.com> Reviewed-by: Jan Scheurich <jan.scheurich@ericsson.com> Tested-by: Jan Scheurich <jan.scheurich@ericsson.com> Tested-by: Yifeng Sun <pkusunyifeng@gmail.com> Reviewed-by: Yifeng Sun <pkusunyifeng@gmail.com>
* ofp-util: Use consistent naming convention.Ben Pfaff2018-02-281-1/+1
| | | | | | | | Most of the tree now uses "encode" as the verb for making an OpenFlow message, so adopt it here in this very old code as well. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
* ofp-util, ofp-parse: Break up into many separate modules.Ben Pfaff2018-02-131-1/+6
| | | | | | | | | | | | ofp-util had been far too large and monolithic for a long time. This commit breaks it up into units that make some logical sense. It also moves the pieces of ofp-parse that were specific to each unit into the relevant unit. Most of this commit is just moving code around. Signed-off-by: Ben Pfaff <blp@ovn.org> Reviewed-by: Yifeng Sun <pkusunyifeng@gmail.com>
* Support accepting and displaying table names in OVS tools.Ben Pfaff2018-02-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | OpenFlow has little-known support for naming tables. Open vSwitch has supported table names for ages, but it has never used or displayed them outside of commands dedicated to table manipulation. This commit adds support for table names in ovs-ofctl. When a table has a name, it displays that name in flows and actions, so that, for example, the following: table=1, arp, actions=resubmit(,2) might become: table=ingress_acl, arp, actions=resubmit(,mac_learning) given appropriately named tables. For backward compatibility, only interactive ovs-ofctl commands by default display table names; to display them in scripts, use the new --names option. This feature was inspired by a talk that Kei Nohguchi presented at Open vSwitch 2017 Fall Conference. CC: Kei Nohguchi <kei@nohguchi.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Mark Michelson <mmichels@redhat.com> Reviewed-by: Yifeng Sun <pkusunyifeng@gmail.com>
* sparse: Add guards to prevent FreeBSD-incompatible #include order.Ben Pfaff2017-12-221-0/+1
| | | | | | | | | | FreeBSD insists that <sys/types.h> be included before <netinet/in.h> and that <netinet/in.h> be included before <arpa/inet.h>. This adds guards to the "sparse" headers to yield a warning if this order is violated. This commit also adjusts the order of many #includes to suit this requirement. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
* lib: Move lib/poll-loop.h to include/openvswitchXiao Liang2017-11-031-1/+1
| | | | | | | | Poll-loop is the core to implement main loop. It should be available in libopenvswitch. Signed-off-by: Xiao Liang <shaw.leon@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* lib: Move lib/rconn.h to include/openvswitchXiao Liang2017-10-311-1/+1
| | | | | | | | Rconn provides useful features over vconn. Make it available to library users. Signed-off-by: Xiao Liang <shaw.leon@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* Support accepting and displaying port names in OVS tools.Ben Pfaff2017-05-311-2/+2
| | | | | | | | | | | | | | Until now, most ovs-ofctl commands have not accepted names for ports, only numbers, and have not been able to display port names either. It's a lot easier for users if they can use and see meaningful names instead of arbitrary numbers. This commit adds that support. For backward compatibility, only interactive ovs-ofctl commands by default display port names; to display them in scripts, use the new --names option. Signed-off-by: Ben Pfaff <blp@ovn.org> Tested-by: Aaron Conole <aconole@redhat.com>
* ofp-util: Add flow metadata to ofputil_packet_outYi-Hung Wei2017-05-311-1/+2
| | | | | | | | | This patch adds flow metadata to ofputil_packet_out. It does not make any functional change. The flow metadata will be useful to support new packet-out message format in OpenFlow 1.5. Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* nx-match: Use vl_mff_map to parse match field.Yi-Hung Wei2017-03-151-1/+1
| | | | | | | | | | vl_mff_map is introduced in commit 04f48a68c428 ("ofp-actions: Fix variable length meta-flow OXMs") to account variable length mf_field, and it is used to decode variable length mf_field in ofp_action. In this patch, vl_mff_map is further used to decode the variable length match field as well. Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com> Signed-off-by: Joe Stringer <joe@ovn.org>
* Use PRIu32 format for ofp_port_tShu Shen2017-01-141-1/+1
| | | | | | | | | | Although ofp_port_t uses a 16-bit range, it is defined as a 32-bit type. The format strings throughout the code base were using PRIu16 for ofp_port_t which leads to the compiler to throw Wformat message on platforms that don't promote 16-bit to 32-bit integers, e.g., on macOS. Signed-off-by: Shu Shen <shu.shen@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* tun-metadata: Manage tunnel TLV mapping table on a per-bridge basis.Jesse Gross2016-09-191-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When using tunnel TLVs (at the moment, this means Geneve options), a controller must first map the class and type onto an appropriate OXM field so that it can be used in OVS flow operations. This table is managed using OpenFlow extensions. The original code that added support for TLVs made the mapping table global as a simplification. However, this is not really logically correct as the OpenFlow management commands are operating on a per-bridge basis. This removes the original limitation to make the table per-bridge. One nice result of this change is that it is generally clearer whether the tunnel metadata is in datapath or OpenFlow format. Rather than allowing ad-hoc format changes and trying to handle both formats in the tunnel metadata functions, the format is more clearly separated by function. Datapaths (both kernel and userspace) use datapath format and it is not changed during the upcall process. At the beginning of action translation, tunnel metadata is converted to OpenFlow format and flows and wildcards are translated back at the end of the process. As an additional benefit, this change improves performance in some flow setup situations by keeping the tunnel metadata in the original packet format in more cases. This helps when copies need to be made as the amount of data touched is only what is present in the packet rather than the maximum amount of metadata supported. Co-authored-by: Madhu Challa <challa@noironetworks.com> Signed-off-by: Madhu Challa <challa@noironetworks.com> Signed-off-by: Jesse Gross <jesse@kernel.org> Acked-by: Ben Pfaff <blp@ovn.org>
* json: Move from lib to include/openvswitch.Terry Wilson2016-07-221-2/+2
| | | | | | | | | | | | | | | To easily allow both in- and out-of-tree building of the Python wrapper for the OVS JSON parser (e.g. w/ pip), move json.h to include/openvswitch. This also requires moving lib/{hmap,shash}.h. Both hmap.h and shash.h were #include-ing "util.h" even though the headers themselves did not use anything from there, but rather from include/openvswitch/util.h. Fixing that required including util.h in several C files mostly due to OVS_NOT_REACHED and things like xmalloc. Signed-off-by: Terry Wilson <twilson@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* hmap: Add HMAP_FOR_EACH_POP.Daniele Di Proietto2016-04-261-3/+2
| | | | | | | Makes popping each member of the hmap a bit easier. Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com> Acked-by: Ben Pfaff <blp@ovn.org>
* Move lib/ofp-print.h to include/openvswitch directoryBen Warren2016-04-141-1/+1
| | | | | Signed-off-by: Ben Warren <ben@skyportsystems.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* Move lib/ofp-actions.h to include/openvswitch directoryBen Warren2016-04-141-1/+1
| | | | | Signed-off-by: Ben Warren <ben@skyportsystems.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* Move lib/ofp-msgs.h to include/openvswitch directoryBen Warren2016-04-141-7/+7
| | | | | Signed-off-by: Ben Warren <ben@skyportsystems.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* Move lib/ofp-util.h to include/openvswitch directoryBen Warren2016-04-141-1/+1
| | | | | | | | This commit also adds several #include directives in source files in order to make the 'ofp-util.h' move possible Signed-off-by: Ben Warren <ben@skyportsystems.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* Move lib/ofpbuf.h to include/openvswitch directoryBen Warren2016-03-301-1/+1
| | | | | | Signed-off-by: Ben Warren <ben@skyportsystems.com> Acked-by: Ryan Moats <rmoats@us.ibm.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* Move ofp-parse.h to include/openvswitch directoryBen Warren2016-03-301-1/+1
| | | | | Signed-off-by: Ben Warren <ben@skyportsystems.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* Move lib/ofp-errors.h to include/openvswitch directoryBen Warren2016-03-191-1/+1
| | | | | Signed-off-by: Ben Warren <ben@skyportsystems.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* Implement serializing the state of packet traversal in "continuations".Ben Pfaff2016-02-191-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | One purpose of OpenFlow packet-in messages is to allow a controller to interpose on the path of a packet through the flow tables. If, for example, the controller needs to modify a packet in some way that the switch doesn't directly support, the controller should be able to program the switch to send it the packet, then modify the packet and send it back to the switch to continue through the flow table. That's the theory. In practice, this doesn't work with any but the simplest flow tables. Packet-in messages simply don't include enough context to allow the flow table traversal to continue. For example: * Via "resubmit" actions, an Open vSwitch packet can have an effective "call stack", but a packet-in can't describe it, and so it would be lost. * A packet-in can't preserve the stack used by NXAST_PUSH and NXAST_POP actions. * A packet-in can't preserve the OpenFlow 1.1+ action set. * A packet-in can't preserve the state of Open vSwitch mirroring or connection tracking. This commit introduces a solution called "continuations". A continuation is the state of a packet's traversal through OpenFlow flow tables. A "controller" action with the "pause" flag, which is newly implemented in this commit, generates a continuation and sends it to the OpenFlow controller in a packet-in asynchronous message (only NXT_PACKET_IN2 supports continuations, so the controller must configure them with NXT_SET_PACKET_IN_FORMAT). The controller processes the packet-in, possibly modifying some of its data, and sends it back to the switch with an NXT_RESUME request, which causes flow table traversal to continue. In principle, a single packet can be paused and resumed multiple times. Another way to look at it is: - "pause" is an extension of the existing OFPAT_CONTROLLER action. It sends the packet to the controller, with full pipeline context (some of which is switch implementation dependent, and may thus vary from switch to switch). - A continuation is an extension of OFPT_PACKET_IN, allowing for implementation dependent metadata. - NXT_RESUME is an extension of OFPT_PACKET_OUT, with the semantics that the pipeline processing is continued with the original translation context from where it was left at the time it was paused. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* ofp-util: Rename struct ofputil_packet_in member 'len' to 'packet_len'.Ben Pfaff2016-02-191-1/+1
| | | | | | | | An upcoming commit will introduce another member that has a length, and it seems weird that bare 'len' would be one or the other. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* ofpbuf: New function ofpbuf_const_initializer().Ben Pfaff2016-02-191-4/+2
| | | | | | | | | | | | | | | A number of times I've looked at code and thought that it would be easier to understand if I could write an initializer instead of ofpbuf_use_const(). This commit adds a function for that purpose and adapts a lot of code to use it, in the places where I thought it made the code better. In theory this could improve code generation since the new function can be inlined whereas ofpbuf_use_const() isn't. But I guess that's probably insignificant; the intent of this change is code readability. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* ofp-util: Make decoding switch features harder to misuse (and fix leak).Ben Pfaff2016-01-201-1/+2
| | | | | | | | | | | | | | | | | | | | | Until now, ofputil_decode_switch_features() has put the ports from the switch features message into a separate ofpbuf supplied as an argument. The natural desire for a caller is to just reuse an ofpbuf that it already has, and that's what one of the callers did. This however has the nonobvious effect of leaking the memory that the ofpbuf previously owned, since it gets replaced by an OFPBUF_CONST-type ofpbuf. This commit avoids the problem by changing the interface to pull the header from an ofpbuf that the caller already has. This fixes a leak in testcase 909 "ofproto-dpif - patch ports". Found by valgrind. Reported-by: William Tu <u9012063@gmail.com> Reported-at: http://openvswitch.org/pipermail/dev/2016-January/064771.html Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Andy Zhou <azhou@ovn.org>
* openflow: Better abstract handling of packet-in messages.Ben Pfaff2016-01-201-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Packet-in messages have been a bit of a mess. First, their abstraction in the form of struct ofputil_packet_in has some fields that are used in a clear way for incoming and outgoing packet-ins, and others (packet_len, total_len, buffer_id) have have confusing meanings or usage pattern depending on their direction. Second, it's very confusing how a packet-in has both a reason (OFPR_*) and a miss type (OFPROTO_PACKET_IN_*) and how those add up to the actual reason that is used "on the wire" for each OpenFlow version (and even whether the packet-in is sent at all!). Finally, there's all kind of low-level detail randomly scattered between connmgr, ofproto-dpif-xlate, and ofp-util. This commit attempts to clear up some of the confusion. It simplifies the struct ofputil_packet_in abstraction by removing the members that didn't have a clear and consistent meaning between incoming and outgoing packet-ins. It gets rid of OFPROTO_PACKET_IN_*, instead adding a couple of nonstandard OFPR_* reasons that add up to what OFPROTO_PACKET_IN_* was meant to say (in what I hope is a clearer way). And it consolidates the tricky parts into ofp-util, where I hope it will be easier to understand all in one place. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* learning-switch: Use "if"s instead of "switch" to reduce maintenance.Ben Pfaff2016-01-191-90/+9
| | | | | | | | | This code only cares about a very few kinds of OpenFlow messages, and it's unlikely that it will care about new ones, so replace the "switch" by "if" statements so that GCC won't complain about every new message. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* Better abstract OFPT_SET_CONFIG and OFPT_GET_CONFIG_REPLY, make stricter.Ben Pfaff2016-01-071-5/+4
| | | | | | | | | | | | | | | | | | | | The OFPT_SET_CONFIG and OFPT_GET_CONFIG_REPLY messages, which have the same format, have a 'flags' field in which OpenFlow defines some bits, which change somewhat from one version to another, and does not define others. Until now, Open vSwitch has not abstracted these messages at all and has ignored the bits that OpenFlow leaves undefined. This commit abstracts the messages in the same way as other OpenFlow messages and validates in OFPT_SET_CONFIG messages that the undefined bits are set to zero. OpenFlow 1.1 and 1.2, but not OpenFlow 1.0, define a flag named OFPC_INVALID_TTL_TO_CONTROLLER. Open vSwitch has until now also implemented this as an extension to OpenFlow 1.0, and this commit retains that extension. Reported-by: Manpreet Singh <er.manpreet25@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Andy Zhou <azhou@ovn.org>
* ofp-actions: Make composing actions harder to screw up.Ben Pfaff2016-01-041-1/+0
| | | | | | | | | | | | | | Until now, composing a fixed-length action with ofpact_put_<NAME>() failed to append any padding required after the action. This commit changes that so that these calls now add padding. This meant that the function ofpact_pad(), which was until now required in various unintuitive places, is no longer required, and removes it. Variable-length actions still require calling ofpact_update_len() after composition. I don't see a way to avoid that. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Russell Bryant <russell@ovn.org>
* Use initializers for struct ofputil_flow_mod instead of assignments.Ben Pfaff2016-01-041-33/+24
| | | | | | | | | | | | A few bugs have been fixed lately that were related to struct ofputil_flow_mod not being fully initialized in a few places. This commit changes several pieces of code from using individual assignments to fields in struct ofputil_flow_mod, to using whole initializers or assignments to a whole struct. This should help prevent similar problems in the future. CC: Ilya Maximets <i.maximets@samsung.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Russell Bryant <russell@ovn.org>
* geneve-map-rename: rename geneve-map to tlv-map.Mengke Liu2015-12-151-3/+3
| | | | | | | | | | | | | | | | | | This patch renames the command name related with geneve-map to a more generic name as following: add-geneve-map -> add-tlv-map del-geneve-map -> del-tlv-map dump-geneve-map -> dump-tlv-map It also renames the Geneve_table to tlv_table. By doing this renaming, the NSH variable context header (the same TLV format as Geneve) or other protocol can reuse the field tun_metadata<N> in the future. Signed-off-by: Mengke Liu <mengke.liu@intel.com> Signed-off-by: Ricky Li <ricky.li@intel.com> Signed-off-by: Jesse Gross <jesse@kernel.org>
* ofproto: Implement OF1.4 Group & Meter change notification messagesNiti Rohilla2015-09-091-0/+1
| | | | | | | | | | | | | This patch adds support for Openflow1.4 Group & meter change notification messages. In a multi controller environment, when a controller modifies the state of group and meter table, the request that successfully modifies this state is forwarded to other controllers. Other controllers are informed with the OFPT_REQUESTFORWARD message. Request forwarding is enabled on a per controller channel basis using the Set Asynchronous Configuration Message. Signed-off-by: Niti Rohilla <niti.rohilla@tcs.com> Co-authored-by: Ben Pfaff <blp@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* Implement OpenFlow 1.4+ OFPMP_TABLE_DESC message.Ben Pfaff2015-07-031-0/+2
| | | | | | | Signed-off-by: Ben Pfaff <blp@nicira.com> Co-authored-by: Saloni Jain <saloni.jain@tcs.com> Signed-off-by: Saloni Jain <saloni.jain@tcs.com> Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
* openflow: Table maintenance commands for Geneve options.Jesse Gross2015-06-251-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to work with Geneve options, we need to maintain a mapping table between an option (defined by <class, type, length>) and an NXM field that can be operated on for the purposes of matches, actions, etc. This mapping must be explicitly specified by the user. Conceptually, this table could be communicated using either OpenFlow or OVSDB. Using OVSDB requires less code and definition of extensions than OpenFlow but introduces the possibility that mapping table updates and flow modifications are desynchronized from each other. This is dangerous because the mapping table signifcantly impacts the way that flows using Geneve options are installed and processed by OVS. Therefore, the mapping table is maintained using OpenFlow commands instead, which opens the possibility of using synchronization between table changes and flow modifications through barriers, bundles, etc. There are two primary groups of OpenFlow messages that are introduced as Nicira extensions: modification commands (add, delete, clear mappings) and table status request/reply to dump the current table along with switch information. Note that mappings should not be changed while they are in active use by a flow. The result of doing so is undefined. This only adds the OpenFlow infrastructure but doesn't actually do anything with the information yet after the messages have been decoded. Signed-off-by: Jesse Gross <jesse@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
* ofp-util: Convert flow_metadata to match structure.Jesse Gross2015-06-081-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | We have a special flow_metadata structure to represent the parts of a packet that aren't carried in the payload itself. This is used in the case where we need to send the packet as a Packet In to an OpenFlow controller. This is a subset of the more general struct flow. In practice, almost all operations we do on this structure involve converting it to or from a match or have code that is the same as a match. Serialization to NXM and back is done as a match. There is special flow_metadata formatting code that is almost identical to match formatting. The uses for struct flow_metadata aren't performance critical when it comes to memory, so we can save quite a bit of code by just using a match structure directly instead. In addition, as metadata increases and becomes more complex (Geneve options require some special handling beyond just additional fields), using the match structure means we only have to do this work in one place. Signed-off-by: Jesse Gross <jesse@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
* ofpbuf: Simplify ofpbuf API.Pravin B Shelar2015-03-031-8/+8
| | | | | | | | | | | | ofpbuf was complicated due to its wide usage across all layers of OVS, Now we have introduced independent dp_packet which can be used for datapath packet, we can simplify ofpbuf. Following patch removes DPDK mbuf and access API of ofpbuf members. Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Acked-by: Jarno Rajahalme <jrajahalme@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
* dp-packet: Remove ofpbuf dependency.Pravin B Shelar2015-03-031-5/+6
| | | | | | | | | | | | | Currently dp-packet make use of ofpbuf for managing packet buffers. That complicates ofpbuf, by making dp-packet independent of ofpbuf both libraries can be optimized for their own use case. This avoids mapping operation between ofpbuf and dp_packet in datapath upcalls. Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Acked-by: Jarno Rajahalme <jrajahalme@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
* mac-learning: Implement per-port MAC learning fairness.Ben Pfaff2015-02-131-5/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In "MAC flooding", an attacker transmits an overwhelming number of frames with unique Ethernet source address on a switch port. The goal is to force the switch to evict all useful MAC learning table entries, so that its behavior degenerates to that of a hub, flooding all traffic. In turn, that allows an attacker to eavesdrop on the traffic of other hosts attached to the switch, with all the risks that that entails. Before this commit, the Open vSwitch "normal" action that implements its standalone switch behavior (and that can be used by OpenFlow controllers as well) was vulnerable to MAC flooding attacks. This commit fixes the problem by implementing per-port fairness for MAC table entries: when the MAC table is at its maximum size, MAC table eviction always deletes an entry from the port with the most entries. Thus, MAC entries will never be evicted from ports with only a few entries if a port with a huge number of entries exists. Controllers could introduce their own MAC flooding vulnerabilities into OVS. For a controller that adds destination MAC based flows to an OpenFlow flow table as a reaction to "packet-in" events, such a bug, if it exists, would be in the controller code itself and would need to be fixed in the controller. For a controller that relies on the Open vSwitch "learn" action to add destination MAC based flows, Open vSwitch has existing support for eviction policy similar to that implemented in this commit through the "groups" column in the Flow_Table table documented in ovs-vswitchd.conf.db(5); we recommend that users of "learn" not already familiar with eviction groups to read that documentation. In addition to implementation of per-port MAC learning fairness, this commit includes some closely related changes: - Access to client-provided "port" data in struct mac_entry is now abstracted through helper functions, which makes it easier to ensure that the per-port data structures are maintained consistently. - The mac_learning_changed() function, which had become trivial, vestigial, and confusing, was removed. Its functionality was folded into the new function mac_entry_set_port(). - Many comments were added and improved; there had been a lot of comment rot in previous versions. CERT: VU#784996 Reported-by: "Ronny L. Bull - bullrl" <bullrl@clarkson.edu> Reported-at: http://www.irongeek.com/i.php?page=videos/derbycon4/t314-exploring-layer-2-network-security-in-virtualized-environments-ronny-l-bull-dr-jeanna-n-matthews Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Ethan Jackson <ethan@nicira.com>
* lib: Move vconn.h to <openvswitch/vconn.h>Thomas Graf2014-12-151-1/+1
| | | | | | | | Also moves definitions for struct vconn and pvconn to the public header. The provider interface is kept private. Signed-off-by: Thomas Graf <tgraf@noironetworks.com> Acked-by: Ben Pfaff <blp@nicira.com>
* lib: Move vlog.h to <openvswitch/vlog.h>Thomas Graf2014-12-151-1/+1
| | | | | | | | A new function vlog_insert_module() is introduced to avoid using list_insert() from the vlog.h header. Signed-off-by: Thomas Graf <tgraf@noironetworks.com> Acked-by: Ben Pfaff <blp@nicira.com>
* Add support for OpenFlow 1.4+ "importance" values.Rishi Bamba2014-11-101-0/+1
| | | | | | | | | | | | | | | This patch enables a user to set importance for a new rule via add-flow OF1.4+ in the OVS and display the same via dump-flows command OF1.4+. The changes are made in accordance with OpenFlow 1.4 specs to implement eviction on the basis of "importance". This patch also enhances the diff-flows & replace-flows CLI for addition of importance parameter in a rule. This doesn't actually implement eviction on the basis of importance, which will happen in a later patch. Signed-off-by: Rishi Bamba <rishi.bamba@tcs.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* ovs-testcontroller: Fix priority of non table-miss flow entries.Jean Tourrilhes2014-11-041-1/+1
| | | | Signed-off-by: Jean Tourrilhes <jt@hpl.hp.com>
* learning-switch: Make test-controller work with OpenFlow 1.3+.Ben Pfaff2014-08-121-2/+42
| | | | | | | | | | | | The controller setup in my personal test environment has been broken for a while. I figured that it wasn't anything important, though, because no one else had reported similar problems. Anyway, it turns out that enabling OpenFlow 1.3 by default broke test-controller because OpenFlow 1.3 doesn't send table misses to the controller by default. This commit fixes the problem. Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Alex Wang <alexw@nicira.com>
* Add basic implementation for OpenFlow 1.4 bundlesAlexandru Copot2014-05-021-0/+2
| | | | | | | | | | | | This is only the communication part of the bundles functionality. The actual message pre-validation and commits are not implemented. We also enable OF1.4 for all the tests. Signed-off-by: Alexandru Copot <alex.mihai.c@gmail.com> Cc: Daniel Baluta <dbaluta@ixiacom.com> [blp@nicira.com made ofputil_decode_bundle_add() more obviously correct] Signed-off-by: Ben Pfaff <blp@nicira.com>
* ofpbuf: Introduce access api for base, data and size.Pravin Shelar2014-03-301-10/+10
| | | | | | | These functions will be used by later patches. Following patch does not change functionality. Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
* lib: simplify flow_extract() APIAndy Zhou2014-02-281-3/+2
| | | | | | | | | | Change the flow_extract() API to accept struct pkt_metadata, instead of individual metadata fields. It will make the API more logical and easier to maintain when we need to expand metadata down the road. Signed-off-by: Andy Zhou <azhou@nicira.com> Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>¬
* include/openflow: Add OpenFlow 1.4 header fileAlexandru Copot2013-10-291-0/+1
| | | | | | | | It contains only Set-Async-Config and Role status message definitions. Signed-off-by: Alexandru Copot <alex.mihai.c@gmail.com> Cc: Daniel Baluta <dbaluta@ixiacom.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* ovs-controller: Avoid dereferencing NULL pointer when the switch acts as a hubZhengLingyun2013-10-081-11/+15
| | | | | | | | Starting ovs-controller with '-H' option will lead to a segment fault problem. Add a check, and adjust the indentation of the following code. Signed-off-by: ZhengLingyun <konghuarukhr@163.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* openflow-1.1+: OFPT_TABLE_MOD (part 1)Andy Zhou2013-09-071-0/+1
| | | | | | | | | | | | | Added infrastructure to support Openflow OFPT_TABLE_MOD message. This patch does not include the flexible table miss handling code that is necessary to support the semantics specified in OFPT_TABLE_MOD messages. Current flow miss behavior continues to conform to Openflow 1.0. Future commits to add more flexible table miss support are needed to fully support OPFT_TABLE_MOD for Openflow-1.1+. Signed-off-by: Andy Zhou <azhou@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
* Implement OpenFlow 1.1+ "groups" protocol.Neil Zhu2013-09-021-0/+1
| | | | | | | | | | | | | This doesn't include a dpif implementation of groups functionality. In its current form, it is untested. Signed-off-by: Neil Zhu <zhuj@centecnetworks.com> Co-authored-by: Ben Pfaff <blp@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com> Co-authored-by: Simon Horman <horms@verge.net.au> Signed-off-by: Simon Horman <horms@verge.net.au> Co-authored-by: Jarno Rajahalme <jrajahalme@nicira.com> Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
View Lorry Controller Status