summaryrefslogtreecommitdiff
path: root/ofproto/ofproto-dpif-ipfix.c
Commit message (Collapse)AuthorAgeFilesLines
* ipfix: Make template and stats interval configurable.Adrian Moreno2023-02-271-10/+28
| | | | | | | | | Add options to the IPFIX table configure the interval to send statistics and template information. Reviewed-by: Simon Horman <simon.horman@corigine.com> Signed-off-by: Adrian Moreno <amorenoz@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* ofproto-ipfix: Use per-domain template timeouts.Adrian Moreno2023-02-211-24/+105
| | | | | | | | | | | | | | | | | IPFIX templates have to be sent for each Observation Domain ID. Currently, a timer is kept at each dpif_ipfix_exporter to send them. This works fine for per-bridge sampling where there is only one Observation Domain ID per exporter. However, this is does not work for per-flow sampling where more than one Observation Domain IDs can be specified by the controller. In this case, ovs-vswitchd will only send template information for one (arbitrary) DomainID. Fix per-flow sampling by using an hmap to keep a timer for each Observation Domain ID. Signed-off-by: Adrian Moreno <amorenoz@redhat.com> Reviewed-by: Simon Horman <simon.horman@corigine.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* ipfix: Trigger revalidation if ipfix options changes.lic1212022-06-281-17/+34
| | | | | | | | | | | ipfix cfg creation/deleting triggers revalidation. But this does not cover the case where ipfix options changes, which also suppose to trigger revalidation. Fixes: a9f5ee1199e1 ("ofproto-dpif: Trigger revalidation when ipfix config set.") Signed-off-by: lic121 <lic121@chinatelecom.cn> Acked-by: Eelco Chaudron <echaudro@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* hmap: use short version of safe loops if possible.Adrian Moreno2022-03-301-4/+4
| | | | | | | | | | | | | | | Using SHORT version of the *_SAFE loops makes the code cleaner and less error prone. So, use the SHORT version and remove the extra variable when possible for hmap and all its derived types. In order to be able to use both long and short versions without changing the name of the macro for all the clients, overload the existing name and select the appropriate version depending on the number of arguments. Acked-by: Dumitru Ceara <dceara@redhat.com> Acked-by: Eelco Chaudron <echaudro@redhat.com> Signed-off-by: Adrian Moreno <amorenoz@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* list: use short version of safe loops if possible.Adrian Moreno2022-03-301-2/+2
| | | | | | | | | | | | | | | Using the SHORT version of the *_SAFE loops makes the code cleaner and less error-prone. So, use the SHORT version and remove the extra variable when possible. In order to be able to use both long and short versions without changing the name of the macro for all the clients, overload the existing name and select the appropriate version depending on the number of arguments. Acked-by: Dumitru Ceara <dceara@redhat.com> Acked-by: Eelco Chaudron <echaudro@redhat.com> Signed-off-by: Adrian Moreno <amorenoz@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* Encap & Decap actions for MPLS packet type.Martin Varghese2022-01-171-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The encap & decap actions are extended to support MPLS packet type. Encap & decap actions adds and removes MPLS header at start of the packet. The existing PUSH MPLS & POP MPLS actions inserts & removes MPLS header between ethernet header and the IP header. Though this behaviour is fine for L3 VPN where an IP packet is encapsulated inside a MPLS tunnel, it does not suffice the L2 VPN requirements. In L2 VPN the ethernet packets must be encapsulated inside MPLS tunnel. In this change the encap & decap actions are extended to support MPLS packet type. The encap & decap adds and removes MPLS header at the start of packet as depicted below. Encapsulation: Actions - encap(mpls),encap(ethernet) Incoming packet -> | ETH | IP | Payload | 1 Actions - encap(mpls) [Datapath action - ADD_MPLS:0x8847] Outgoing packet -> | MPLS | ETH | Payload| 2 Actions - encap(ethernet) [ Datapath action - push_eth ] Outgoing packet -> | ETH | MPLS | ETH | Payload| Decapsulation: Incoming packet -> | ETH | MPLS | ETH | IP | Payload | Actions - decap(),decap(packet_type(ns=0,type=0)) 1 Actions - decap() [Datapath action - pop_eth) Outgoing packet -> | MPLS | ETH | IP | Payload| 2 Actions - decap(packet_type(ns=0,type=0)) [Datapath action - POP_MPLS:0x6558] Outgoing packet -> | ETH | IP | Payload| Signed-off-by: Martin Varghese <martin.varghese@nokia.com> Acked-by: Eelco Chaudron <echaudro@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* userspace: Avoid dp_hash recirculation for balance-tcp bond mode.Vishal Deep Ajmera2020-06-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: In OVS, flows with output over a bond interface of type “balance-tcp” gets translated by the ofproto layer into "HASH" and "RECIRC" datapath actions. After recirculation, the packet is forwarded to the bond member port based on 8-bits of the datapath hash value computed through dp_hash. This causes performance degradation in the following ways: 1. The recirculation of the packet implies another lookup of the packet’s flow key in the exact match cache (EMC) and potentially Megaflow classifier (DPCLS). This is the biggest cost factor. 2. The recirculated packets have a new “RSS” hash and compete with the original packets for the scarce number of EMC slots. This implies more EMC misses and potentially EMC thrashing causing costly DPCLS lookups. 3. The 256 extra megaflow entries per bond for dp_hash bond selection put additional load on the revalidation threads. Owing to this performance degradation, deployments stick to “balance-slb” bond mode even though it does not do active-active load balancing for VXLAN- and GRE-tunnelled traffic because all tunnel packet have the same source MAC address. Proposed optimization: This proposal introduces a new load-balancing output action instead of recirculation. Maintain one table per-bond (could just be an array of uint16's) and program it the same way internal flows are created today for each possible hash value (256 entries) from ofproto layer. Use this table to load-balance flows as part of output action processing. Currently xlate_normal() -> output_normal() -> bond_update_post_recirc_rules() -> bond_may_recirc() and compose_output_action__() generate 'dp_hash(hash_l4(0))' and 'recirc(<RecircID>)' actions. In this case the RecircID identifies the bond. For the recirculated packets the ofproto layer installs megaflow entries that match on RecircID and masked dp_hash and send them to the corresponding output port. Instead, we will now generate action as 'lb_output(<bond id>)' This combines hash computation (only if needed, else re-use RSS hash) and inline load-balancing over the bond. This action is used *only* for balance-tcp bonds in userspace datapath (the OVS kernel datapath remains unchanged). Example: Current scheme: With 8 UDP flows (with random UDP src port): flow-dump from pmd on cpu core: 2 recirc_id(0),in_port(7),<...> actions:hash(hash_l4(0)),recirc(0x1) recirc_id(0x1),dp_hash(0xf8e02b7e/0xff),<...> actions:2 recirc_id(0x1),dp_hash(0xb236c260/0xff),<...> actions:1 recirc_id(0x1),dp_hash(0x7d89eb18/0xff),<...> actions:1 recirc_id(0x1),dp_hash(0xa78d75df/0xff),<...> actions:2 recirc_id(0x1),dp_hash(0xb58d846f/0xff),<...> actions:2 recirc_id(0x1),dp_hash(0x24534406/0xff),<...> actions:1 recirc_id(0x1),dp_hash(0x3cf32550/0xff),<...> actions:1 New scheme: We can do with a single flow entry (for any number of new flows): in_port(7),<...> actions:lb_output(1) A new CLI has been added to dump datapath bond cache as given below. # ovs-appctl dpif-netdev/bond-show [dp] Bond cache: bond-id 1 : bucket 0 - slave 2 bucket 1 - slave 1 bucket 2 - slave 2 bucket 3 - slave 1 Co-authored-by: Manohar Krishnappa Chidambaraswamy <manukc@gmail.com> Signed-off-by: Manohar Krishnappa Chidambaraswamy <manukc@gmail.com> Signed-off-by: Vishal Deep Ajmera <vishal.deep.ajmera@ericsson.com> Tested-by: Matteo Croce <mcroce@redhat.com> Tested-by: Adrian Moreno <amorenoz@redhat.com> Acked-by: Eelco Chaudron <echaudro@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* userspace: Improved packet drop statistics.Anju Thomas2020-01-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently OVS maintains explicit packet drop/error counters only on port level. Packets that are dropped as part of normal OpenFlow processing are counted in flow stats of “drop” flows or as table misses in table stats. These can only be interpreted by controllers that know the semantics of the configured OpenFlow pipeline. Without that knowledge, it is impossible for an OVS user to obtain e.g. the total number of packets dropped due to OpenFlow rules. Furthermore, there are numerous other reasons for which packets can be dropped by OVS slow path that are not related to the OpenFlow pipeline. The generated datapath flow entries include a drop action to avoid further expensive upcalls to the slow path, but subsequent packets dropped by the datapath are not accounted anywhere. Finally, the datapath itself drops packets in certain error situations. Also, these drops are today not accounted for.This makes it difficult for OVS users to monitor packet drop in an OVS instance and to alert a management system in case of a unexpected increase of such drops. Also OVS trouble-shooters face difficulties in analysing packet drops. With this patch we implement following changes to address the issues mentioned above. 1. Identify and account all the silent packet drop scenarios 2. Display these drops in ovs-appctl coverage/show Co-authored-by: Rohith Basavaraja <rohith.basavaraja@gmail.com> Co-authored-by: Keshav Gupta <keshugupta1@gmail.com> Signed-off-by: Anju Thomas <anju.thomas@ericsson.com> Signed-off-by: Rohith Basavaraja <rohith.basavaraja@gmail.com> Signed-off-by: Keshav Gupta <keshugupta1@gmail.com> Acked-by: Eelco Chaudron <echaudro@redhat.com Acked-by: Ben Pfaff <blp@ovn.org> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* Add a new OVS action check_pkt_largerNuman Siddique2019-04-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a new action 'check_pkt_larger' which checks if the packet is larger than the given size and stores the result in the destination register. Usage: check_pkt_larger(len)->REGISTER Eg. match=...,actions=check_pkt_larger(1442)->NXM_NX_REG0[0],next; This patch makes use of the new datapath action - 'check_pkt_len' which was recently added in the commit [1]. At the start of ovs-vswitchd, datapath is probed for this action. If the datapath action is present, then 'check_pkt_larger' makes use of this datapath action. Datapath action 'check_pkt_len' takes these nlattrs * OVS_CHECK_PKT_LEN_ATTR_PKT_LEN - 'pkt_len' to check for * OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER (optional) - Nested actions to apply if the packet length is greater than the specified 'pkt_len' * OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL (optional) - Nested actions to apply if the packet length is lesser or equal to the specified 'pkt_len'. Let's say we have these flows added to an OVS bridge br-int table=0, priority=100 in_port=1,ip,actions=check_pkt_larger:100->NXM_NX_REG0[0],resubmit(,1) table=1, priority=200,in_port=1,ip,reg0=0x1/0x1 actions=output:3 table=1, priority=100,in_port=1,ip,actions=output:4 Then the action 'check_pkt_larger' will be translated as - check_pkt_len(size=100,gt(3),le(4)) datapath will check the packet length and if the packet length is greater than 100, it will output to port 3, else it will output to port 4. In case, datapath doesn't support 'check_pkt_len' action, the OVS action 'check_pkt_larger' sets SLOW_ACTION so that datapath flow is not added. This OVS action is intended to be used by OVN to check the packet length and generate an ICMP packet with type 3, code 4 and next hop mtu in the logical router pipeline if the MTU of the physical interface is lesser than the packet length. More information can be found here [2] [1] - https://kernel.googlesource.com/pub/scm/linux/kernel/git/davem/net-next/+/4d5ec89fc8d14dcdab7214a0c13a1c7321dc6ea9 [2] - https://mail.openvswitch.org/pipermail/ovs-discuss/2018-July/047039.html Reported-at: https://mail.openvswitch.org/pipermail/ovs-discuss/2018-July/047039.html Suggested-by: Ben Pfaff <blp@ovn.org> Signed-off-by: Numan Siddique <nusiddiq@redhat.com> CC: Ben Pfaff <blp@ovn.org> CC: Gregory Rose <gvrose8192@gmail.com> Acked-by: Mark Michelson <mmichels@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* treewide: Get rid of // comments, even inside comments.Ben Pfaff2019-01-251-1/+1
| | | | | | | | | | | | | Just a style fix. With this patch, the following reports no hits: git ls-files | grep '\.[ch]$' | grep -vE 'datapath|sflow' \ | xargs grep -n // | grep -vE "http|s/|'|\"" Acked-by: Ilya Maximets <i.maximets@samsung.com> Reported-by: Ilya Maximets <i.maximets@samsung.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* treewide: Convert leading tabs to spaces.Ben Pfaff2018-06-111-1/+1
| | | | | | | | | It's always been OVS coding style to use spaces rather than tabs for indentation, but some tabs have snuck in over time. This commit converts them to spaces. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
* ofproto-dpif-ipfix: Fix an issue in flow key partBenli Ye2018-02-151-3/+21
| | | | | | | | | | As struct ipfix_data_record_flow_key_iface didn't calculate its length in flow key part, it may cause problem when flow key part length is not enough. Use MAX_IF_LEN and MAX_IF_DESCR to pre-allocate memory for ipfix_data_record_flow_key_iface. Signed-off-by: Daniel Benli Ye <daniely@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ofp-util, ofp-parse: Break up into many separate modules.Ben Pfaff2018-02-131-0/+1
| | | | | | | | | | | | ofp-util had been far too large and monolithic for a long time. This commit breaks it up into units that make some logical sense. It also moves the pieces of ofp-parse that were specific to each unit into the relevant unit. Most of this commit is just moving code around. Signed-off-by: Ben Pfaff <blp@ovn.org> Reviewed-by: Yifeng Sun <pkusunyifeng@gmail.com>
* dpif: Add support for OVS_ACTION_ATTR_CT_CLEAREric Garver2018-01-201-0/+1
| | | | | | | | | | | | This supports using the ct_clear action in the kernel datapath. To preserve compatibility with current ct_clear behavior on old kernels, we only pass this action down to the datapath if a probe reveals the datapath actually supports it. Signed-off-by: Eric Garver <e@erig.me> Acked-by: William Tu <u9012063@gmail.com> Acked-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: Justin Pettit <jpettit@ovn.org>
* ofproto-dpif: Use a fixed size userspace cookie.Justin Pettit2018-01-101-1/+1
| | | | | | | This simplifies the cookie handling a bit. Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* ofproto-dpif-ipfix: add interface Information Elements to flow keyMichal Weglicki2018-01-101-94/+264
| | | | | | | | | | | | | | | | | | | | | | | Extend flow key part of data record to include following Information Elements: - ingressInterface - ingressInterfaceType - egressInterface - egressInterfaceType - interfaceName - interfaceDescription In case of input sampling we don't have information about egress port. Define templates depending not only on protocol types, but also on flow direction. Only egress flow will include egress information elements. With this change, dpif_ipfix_exporter stores every port in hmap rather than only tunnel ports. It allows to easily retrieve required information about interfaces during sampling upcalls. Co-authored-by: Michal Weglicki <michalx.weglicki@intel.com> Signed-off-by: Michal Weglicki <michalx.weglicki@intel.com> Signed-off-by: Przemyslaw Szczerbik <przemyslawx.szczerbik@intel.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* nsh: rework NSH netlink keys and actionsYi Yang2018-01-081-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch changes OVS_KEY_ATTR_NSH to nested attribute and adds three new NSH sub attribute keys: OVS_NSH_KEY_ATTR_BASE: for length-fixed NSH base header OVS_NSH_KEY_ATTR_MD1: for length-fixed MD type 1 context OVS_NSH_KEY_ATTR_MD2: for length-variable MD type 2 metadata Its intention is to align to NSH kernel implementation. NSH match fields, set and PUSH_NSH action all use the below nested attribute format: OVS_KEY_ATTR_NSH begin OVS_NSH_KEY_ATTR_BASE OVS_NSH_KEY_ATTR_MD1 OVS_KEY_ATTR_NSH end or OVS_KEY_ATTR_NSH begin OVS_NSH_KEY_ATTR_BASE OVS_NSH_KEY_ATTR_MD2 OVS_KEY_ATTR_NSH end In addition, NSH encap and decap actions are renamed as push_nsh and pop_nsh to meet action naming convention. Signed-off-by: Yi Yang <yi.y.yang@intel.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ofproto: Remove break after OVS_NOT_REACHED.Bhanuprakash Bodireddy2017-11-031-1/+0
| | | | | | | | The break statement would never be executed as OVS_NOT_REACHED() internally invokes abort() and causes process termination. Signed-off-by: Bhanuprakash Bodireddy <bhanuprakash.bodireddy@intel.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* lib: Move lib/poll-loop.h to include/openvswitchXiao Liang2017-11-031-1/+1
| | | | | | | | Poll-loop is the core to implement main loop. It should be available in libopenvswitch. Signed-off-by: Xiao Liang <shaw.leon@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ofproto-dpif-ipfix: Fix minor style variation.Joe Stringer2017-08-091-1/+1
| | | | | Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* ofproto-dpif-ipfix: Use common OVS functions for getting current time.Ben Pfaff2017-08-091-12/+11
| | | | | | | | | OVS has common infrastructure functions for getting the current time, but this code was not using them. It is not clear why, so this commit changes it to use them. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Andy Zhou <azhou@ovn.org>
* Generic encap and decap support for NSHJan Scheurich2017-08-071-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | This commit adds translation and netdev datapath support for generic encap and decap actions for the NSH MD1 header. The generic encap and decap actions are mapped to specific encap_nsh and decap_nsh actions in the datapath. The translation follows that general scheme that decap() of an NSH packet triggers recirculation after decapsulation, while encap(nsh) just modifies struct flow and sets the ctx->pending_encap flag to generate the encap_nsh action at the next commit to be able to include subsequent set_field actions for NSH headers. Support for the flexible MD2 format using TLV properties is foreseen in encap(nsh), but not yet fully implemented. The CLI syntax for encap of NSH is encap(nsh(md_type=1)) encap(nsh(md_type=2[,tlv(<tlv_class>,<tlv_type>,<hex_string>),...])) Signed-off-by: Jan Scheurich <jan.scheurich@ericsson.com> Signed-off-by: Yi Yang <yi.y.yang@intel.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ofproto-dpif-ipfix: add support for per-flow drop countersPrzemyslaw Szczerbik2017-08-021-9/+161
| | | | | | | | | | | | | | | | | | | | | Patch based on RFC 5102, section 5.10. It implements per-flow drop counters: - droppedPacketDeltaCount - droppedPacketTotalCount - droppedOctetDeltaCount - droppedOctetTotalCount In order to determine if packet is going to be dropped, flow actions associated with packet are read. If at least one of the following conditions is met, packet is not marked as dropped. Packet has at least one: - OVS_ACTION_ATTR_OUTPUT action - OVS_ACTION_ATTR_CLONE action with nested OVS_ACTION_ATTR_OUTPUT action - OVS_ACTION_ATTR_SAMPLE action with nested OVS_ACTION_ATTR_OUTPUT action and sampling probability is set to 100% Signed-off-by: Przemyslaw Szczerbik <przemyslawx.szczerbik@intel.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ofproto-dpif-ipfix: add Exporting Process Reliability StatisticsPrzemyslaw Szczerbik2017-07-131-25/+269
| | | | | | | | | | | | | | | | | | | This patch adds support for The Exporting Process Reliability Statistics Option Template, which is defined in RFC 5101, Section 4.3. For now, this Option Template includes only exporting process ID scope field and a single counter - notSentPacketTotalCount. Currently, Data Records that contain exporting process statistics are transmitted at regular intervals, immediately after sending (Options) Template Records. This behavior could be changed later on to allow the interval of sending exporting process statistics to be configurable as RFC recommends it. According to RFC 5101, Section 10.3.6. the frequency of the (Options) Template transmissions MUST be configurable. OvS doesn't comply to this requirement. Therefore, it seems to be a good idea to make both intervals configurable at the same time. Signed-off-by: Przemyslaw Szczerbik <przemyslawx.szczerbik@intel.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ofproto-dpif-ipfix: Multicast/Broadcast/Unicast counters.Przemyslaw Szczerbik2017-07-111-7/+135
| | | | | | | | | | | | | | | | | | | | | | | This patch implements following counters: - postMCastPacketDeltaCount - postMCastPacketTotalCount - postMCastOctetDeltaCount - postMCastOctetTotalCount - ingressUnicastPacketTotalCount - ingressMulticastPacketTotalCount - ingressBroadcastPacketTotalCount - egressUnicastPacketTotalCount - egressBroadcastPacketTotalCount For ingress/egress counters, flow direction is checked in order to determine which counters should be increased. Utility functions from lib/packets.h are used for checking if packet is unicast, multicast or broadcast. Co-authored-by: Michal Weglicki <michalx.weglicki@intel.com> Signed-off-by: Michal Weglicki <michalx.weglicki@intel.com> Signed-off-by: Przemyslaw Szczerbik <przemyslawx.szczerbik@intel.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ofproto-dpif-ipfix: Fix inefficent memory use in ipfix_send_template_msgs().Ben Pfaff2017-07-051-7/+8
| | | | | | | | | | | | | | | | | This fixes inefficient use of memory in ipfix_send_template_msgs(). This function was setting up a buffer with a stub, but only the first 4 or 8 bytes of the stub were actually used because the "sizeof" call used to size it was actually getting the size of a pointer. This meant that every template message was causing a series of allocations and reallocations. This commit fixes the problem. Found by Coverity. Reported-at: https://scan3.coverity.com/reports.htm#v16889/p10449/fileInstanceId=14762995&defectInstanceId=4304799&mergedDefectId=180398 Signed-off-by: Ben Pfaff <blp@ovn.org> Signed-off-by: Justin Pettit <jpettit@ovn.org>
* Revert "ofproto-dpif-ipfix: Fix severe memory leak in ↵Ben Pfaff2017-07-051-8/+7
| | | | | | | | | | | ipfix_send_template_msgs()." This reverts commit 4d6f69df54b7d6ec2956875c683a9564cb175662. There is nothing wrong with the commit itself, but the commit message is misleading. The following commit will re-apply it with a corrected commit message. Signed-off-by: Ben Pfaff <blp@ovn.org>
* ofproto-dpif-ipfix: Fix severe memory leak in ipfix_send_template_msgs().Ben Pfaff2017-06-271-7/+8
| | | | | | | | | | | | | | | | | | | This fixes a seemingly severe memory leak in ipfix_send_template_msgs(). This function was setting up a buffer with a stub, but only the first 4 or 8 bytes of the stub were actually used because the "sizeof" call used to size it was actually getting the size of a pointer. It never freed the buffer, leaking it. Additionally, after this code sent a template message, it started over from the same undersized stub, leaking another block of memory. This commit fixes both problems. Found by Coverity. Reported-at: https://scan3.coverity.com/reports.htm#v16889/p10449/fileInstanceId=14762995&defectInstanceId=4304799&mergedDefectId=180398 Signed-off-by: Ben Pfaff <blp@ovn.org> Signed-off-by: Justin Pettit <jpettit@ovn.org>
* ofproto-dpif-ipfix: add support for per-flow TCP countersPrzemyslaw Szczerbik2017-05-201-18/+126
| | | | | | | | This patch implements support for per-flow TCP IPFIX counters. It's based on RFC 5102, section 5.10. Signed-off-by: Przemyslaw Szczerbik <przemyslawx.szczerbik@intel.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ofproto-dpif-ipfix: Add total counters.mweglicx2017-05-081-25/+85
| | | | | | | | Implementation of IPFix counters which hold total values measured since metering process startup. Signed-off-by: Michal Weglicki <michalx.weglicki@intel.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* Add support for 802.1ad (QinQ tunneling)Eric Garver2017-03-161-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Flow key handling changes: - Add VLAN header array in struct flow, to record multiple 802.1q VLAN headers. - Add dpif multi-VLAN capability probing. If datapath supports multi-VLAN, increase the maximum depth of nested OVS_KEY_ATTR_ENCAP. Refactor VLAN handling in dpif-xlate: - Introduce 'xvlan' to track VLAN stack during flow processing. - Input and output VLAN translation according to the xbundle type. Push VLAN action support: - Allow ethertype 0x88a8 in VLAN headers and push_vlan action. - Support push_vlan on dot1q packets. Use other_config:vlan-limit in table Open_vSwitch to limit maximum VLANs that can be matched. This allows us to preserve backwards compatibility. Add test cases for VLAN depth limit, Multi-VLAN actions and QinQ VLAN handling Co-authored-by: Thomas F Herbert <thomasfherbert@gmail.com> Signed-off-by: Thomas F Herbert <thomasfherbert@gmail.com> Co-authored-by: Xiao Liang <shaw.leon@gmail.com> Signed-off-by: Xiao Liang <shaw.leon@gmail.com> Signed-off-by: Eric Garver <e@erig.me> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ofproto-dpif-ipfix: Fix assertion failure for bad configuration.Ben Pfaff2016-12-091-24/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The assertions in dpif_ipfix_set_options() made some bad assumptions about flow exporters. The code that added and removed exporters would add a flow exporter even if it had an invalid configuration ("broken"), but the assertions checked that broken flow exporters were not added. Thus, the when a flow exporter was broken, ovs-vswitchd would crash due to an assertion failure. Here is an example vsctl command that, run in the sandbox, would crash ovs-vswitchd: ovs-vsctl \ -- add-br br0 \ -- --id=@br0 get bridge br0 \ -- --id=@ipfix create ipfix target='["xyzzy"]' \ -- create flow_sample_collector_set id=1 bridge=@br0 ipfix=@ipfix The minimal fix would be to remove the assertions, but this would leave broken flow exporters in place. This commit goes a little farther and actually removes broken flow exporters. This fix pulls code out of an "if" statement to a higher level, so it is a smaller fix when viewed igoring space changes. This bug dates back to the introduction of IPFIX in 2013. VMware-BZ: #1779123 CC: Romain Lenglet <romain.lenglet@berabera.info> Fixes: 29089a540cfa ("Implement IPFIX export") Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* ofp-actions: Add "ingress" and "egress" options to "sample" action.Ben Pfaff2016-11-301-5/+11
| | | | | | | | | | | | | | | | | | | | Before Open vSwitch 2.5.90, IPFIX reports from Open vSwitch didn't include whether the packet was ingressing or egressing the switch. Starting in OVS 2.5.90, this information was available but only accurate if the action included a port number that indicated a tunnel. Conflating these two does not always make sense (not every packet involves a tunnel!), so this patch makes it possible for the sample action to simply say whether it's for ingress or egress. This is difficult to test, since the "tests" directory of OVS does not have a proper IPFIX listener. This passes those tests, plus a couple that just verify that the actions are properly parsed and formatted. Benli did test it end-to-end in a VMware use case. Requested-by: Benli Ye <daniely@vmware.com> Tested-by: Benli Ye <daniely@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Simon Horman <simon.horman@netronome.com>
* openvswitch: Allow external IPsec tunnel management.Pravin B Shelar2016-09-271-15/+0
| | | | | | | | | | | | | | | | | | OVS GRE IPsec tunnel support has multiple issues, Therefore it was deprecated in OVS 2.6. Following patch removes support for GRE IPsec and allows external IPsec tunnel management for any type of tunnel not just GRE. e.g. user can encrypt Geneve or VxLan traffic. It can be done by using openflow pipeline to set skb-mark and using IPsec keying daemons to implement IPsec tunnels. This packet can be matched for the skb-mark to encrypt selective tunnel traffic. VMware-BZ: 1710701 Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Acked-by: Ansis Atteka <aatteka@ovn.org>
* util: Expose function nullable_string_is_equal.Ilya Maximets2016-07-251-6/+0
| | | | | | | | Implementation of 'nullable_string_is_equal()' moved to util.c and reused inside dpif-netdev. Signed-off-by: Ilya Maximets <i.maximets@samsung.com> Acked-by: Daniele Di Proietto <diproiettod@vmware.com>
* json: Move from lib to include/openvswitch.Terry Wilson2016-07-221-1/+1
| | | | | | | | | | | | | | | To easily allow both in- and out-of-tree building of the Python wrapper for the OVS JSON parser (e.g. w/ pip), move json.h to include/openvswitch. This also requires moving lib/{hmap,shash}.h. Both hmap.h and shash.h were #include-ing "util.h" even though the headers themselves did not use anything from there, but rather from include/openvswitch/util.h. Fixing that required including util.h in several C files mostly due to OVS_NOT_REACHED and things like xmalloc. Signed-off-by: Terry Wilson <twilson@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* util: New function nullable_xstrdup().Ben Pfaff2016-06-261-6/+0
| | | | | | It's a pretty common pattern so create a function for it. Signed-off-by: Ben Pfaff <blp@ovn.org>
* ipfix: Export user specified virtual observation IDWenyu Zhang2016-06-241-11/+91
| | | | | | | | | | | | In virtual network, users want more info about the virtual point to observe the traffic. It should be a string to provide clear info, not a simple interger ID. Introduce "other-config: virtual_obs_id" in IPFIX, which is a string configured by user. Introduce an enterprise IPFIX entity "virtualObsID"(898) to export the value. The entity is a variable-length string. Signed-off-by: Wenyu Zhang <wenyuz@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* Revert "ipfix: Export user specified virtual observation ID".Ben Pfaff2016-06-241-91/+11
| | | | | | | | | | | | | | | | | | | | | | | This reverts commit 337bebe91c94d9d201e28811c469869d32e978ff, which caused a crash in test 1048 "ofproto-dpif - Flow IPFIX sanity check" (now test 1051) with the following backtrace: #0 hmap_first_with_hash (hmap=<optimized out>, hmap=<optimized out>, hash=<optimized out>) at ../lib/hmap.h:328 #1 smap_find__ (smap=0x94, key=key@entry=0x817f7ab "virtual_obs_id", key_len=14, hash=2537071222) at ../lib/smap.c:366 #2 0x0812b9d7 in smap_get_node (smap=0x9738a276, key=0x817f7ab "virtual_obs_id") at ../lib/smap.c:198 #3 0x0812ba30 in smap_get (smap=0x94, key=0x817f7ab "virtual_obs_id") at ../lib/smap.c:189 #4 0x08055a60 in bridge_configure_ipfix (br=<optimized out>) at ../vswitchd/bridge.c:1237 #5 bridge_reconfigure (ovs_cfg=0x94) at ../vswitchd/bridge.c:666 #6 0x080568d3 in bridge_run () at ../vswitchd/bridge.c:2972 #7 0x0804c9dd in main (argc=10, argv=0xffd8b934) at ../vswitchd/ovs-vswitchd.c:112 Signed-off-by: Ben Pfaff <blp@ovn.org>
* ipfix: Export user specified virtual observation IDWenyu Zhang2016-06-241-11/+91
| | | | | | | | | | | | | | In virtual network, users want more info about the virtual point to observe the traffic. It should be a string to provide clear info, not a simple interger ID. Introduce "other-config: virtual_obs_id" in IPFIX, which is a string configured by user. Introduce an enterprise IPFIX entity "virtualObsID"(898) to export the value. The entity is a variable-length string. Signed-off-by: Wenyu Zhang <wenyuz@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ipfix: Support tunnel information for Flow IPFIX.Benli Ye2016-06-171-6/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support to export tunnel information for flow-based IPFIX. The original steps to configure flow level IPFIX: 1) Create a new record in Flow_Sample_Collector_Set table: 'ovs-vsctl -- create Flow_Sample_Collector_Set id=1 bridge="Bridge UUID"' 2) Add IPFIX configuration which is referred by corresponding row in Flow_Sample_Collector_Set table: 'ovs-vsctl -- set Flow_Sample_Collector_Set "Flow_Sample_Collector_Set UUID" ipfix=@i -- --id=@i create IPFIX targets=\"IP:4739\" obs_domain_id=123 obs_point_id=456 cache_active_timeout=60 cache_max_flows=13' 3) Add sample action to the flows: 'ovs-ofctl add-flow mybridge in_port=1, actions=sample'('probability=65535,collector_set_id=1, obs_domain_id=123,obs_point_id=456')',output:3' NXAST_SAMPLE action was used in step 3. In order to support exporting tunnel information, the NXAST_SAMPLE2 action was added and with NXAST_SAMPLE2 action in this patch, the step 3 should be configured like below: 'ovs-ofctl add-flow mybridge in_port=1, actions=sample'('probability=65535,collector_set_id=1,obs_domain_id=123, obs_point_id=456,sampling_port=3')',output:3' 'sampling_port' can be equal to ingress port or one of egress ports. If sampling port is equal to output port and the output port is a tunnel port, OVS_USERSPACE_ATTR_EGRESS_TUN_PORT will be set in the datapath flow sample action. When flow sample action upcall happens, tunnel information will be retrieved from the datapath and then IPFIX can export egress tunnel port information. If samping_port=65535 (OFPP_NONE), flow-based IPFIX will keep the same behavior as before. This patch mainly do three tasks: 1) Add a new flow sample action NXAST_SAMPLE2 to support exporting tunnel information. NXAST_SAMPLE2 action has a new added field 'sampling_port'. 2) Use 'other_configure: enable-tunnel-sampling' to enable or disable exporting tunnel information. 3) If 'sampling_port' is equal to output port and output port is a tunnel port, the translation of OpenFlow "sample" action should first emit set(tunnel(...)), then the sample action itself. It makes sure the egress tunnel information can be sampled. 4) Add a test of flow-based IPFIX for tunnel set. How to test flow-based IPFIX: 1) Setup a test environment with two Linux host with Docker supported 2) Create a Docker container and a GRE tunnel port on each host 3) Use ovs-docker to add the container on the bridge 4) Listen on port 4739 on the collector machine and use wireshark to filter 'cflow' packets. 5) Configure flow-based IPFIX: - 'ovs-vsctl -- create Flow_Sample_Collector_Set id=1 bridge="Bridge UUID"' - 'ovs-vsctl -- set Flow_Sample_Collector_Set "Flow_Sample_Collector_Set UUID" ipfix=@i -- --id=@i create IPFIX \ targets=\"IP:4739\" cache_active_timeout=60 cache_max_flows=13 \ other_config:enable-tunnel-sampling=true' - 'ovs-ofctl add-flow mybridge in_port=1, actions=sample'('probability=65535,collector_set_id=1,obs_domain_id=123, obs_point_id=456,sampling_port=3')',output:3' Note: The in-port is container port. The output port and sampling_port are both open flow port and the output port is a GRE tunnel port. 6) Ping from the container whose host enabled flow-based IPFIX. 7) Get the IPFIX template pakcets and IPFIX information packets. Signed-off-by: Benli Ye <daniely@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ipfix: Bug fix for not sending template packets on 32-bit OSBenli Ye2016-06-141-2/+2
| | | | | | | | | | | | | | | 'last_template_set_time' in truct dpif_ipfix_exporter is declared as time_t and time_t is long int type. If we initialize 'last_template_set_time' as TIME_MIN, whose value is -2147483648 on 32-bit OS and -2^63 on 64-bit OS. There will be a problem on 32-bit OS when comparing 'last_template_set_time' with a unisgned int type variable, because type casting will happen and negative value could be a large positive number. Fix this problem by simply initialize 'last_template_set_time' as 0. Signed-off-by: Benli Ye <daniely@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: William Tu <u9012063@gmail.com>
* ipfix: Add support for exporting ipfix statistics.Benli Ye2016-06-141-19/+171
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is meaningful for user to check the stats of IPFIX. Using IPFIX stats, user can know how much flows the system can support. It is also can be used for performance check of IPFIX. IPFIX stats is added for per IPFIX exporter. If bridge IPFIX is enabled on the bridge, the whole bridge will have one exporter. For flow IPFIX, the system keeps per id (column in Flow_Sample_Collector_Set) per exporter. 1) Add 'ovs-ofctl dump-ipfix-bridge SWITCH' to export IPFIX stats of the bridge which enable bridge IPFIX. The output format: NXST_IPFIX_BRIDGE reply (xid=0x2): bridge ipfix: flows=0, current flows=0, sampled pkts=0, \ ipv4 ok=0, ipv6 ok=0, tx pkts=0 pkts errs=0, ipv4 errs=0, ipv6 errs=0, tx errs=0 2) Add 'ovs-ofctl dump-ipfix-flow SWITCH' to export IPFIX stats of the bridge which enable flow IPFIX. The output format: NXST_IPFIX_FLOW reply (xid=0x2): 2 ids id 1: flows=4, current flows=4, sampled pkts=14, ipv4 ok=13, \ ipv6 ok=0, tx pkts=0 pkts errs=0, ipv4 errs=0, ipv6 errs=0, tx errs=0 id 2: flows=0, current flows=0, sampled pkts=0, ipv4 ok=0, \ ipv6 ok=0, tx pkts=0 pkts errs=0, ipv4 errs=0, ipv6 errs=0, tx errs=0 flows: the number of total flow records, including those exported. current flows: the number of current flow records cached. sampled pkts: Successfully sampled packet count. ipv4 ok: successfully sampled IPv4 flow packet count. ipv6 ok: Successfully sampled IPv6 flow packet count. tx pkts: the count of IPFIX exported packets sent to the collector(s). pkts errs: count of packets failed when sampling, maybe not supported or other error. ipv4 errs: Count of IPV4 flow packet in the error packets. ipv6 errs: Count of IPV6 flow packet in the error packets. tx errs: the count of IPFIX exported packets failed when sending to the collector(s). Signed-off-by: Benli Ye <daniely@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ipfix: Bug fix for configuring IPFIX for flowsBenli Ye2016-06-051-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are two kinds of IPFIX: bridge level IPFIX and flow level IPFIX. Now if we only configure flow level IPFIX, even if there is no bridge IPFIX configuration, the datapath flow will contain a sample action for bridge IPFIX. Fix it. Steps to configure flow level IPFIX: 1) Create a new record in Flow_Sample_Collector_Set table: 'ovs-vsctl -- create Flow_Sample_Collector_Set id=1 bridge="Bridge UUID"' 2) Add IPFIX configuration which is referred by corresponding row in Flow_Sample_Collector_Set table: 'ovs-vsctl -- set Flow_Sample_Collector_Set "Flow_Sample_Collector_Set UUID" ipfix=@i -- --id=@i create IPFIX targets=\"IP:4739\" obs_domain_id=123 obs_point_id=456 cache_active_timeout=60 cache_max_flows=13' 3) Add sample action to the flows: 'ovs-ofctl add-flow mybridge in_port=1, actions=sample'('probability=65535,collector_set_id=1, obs_domain_id=123,obs_point_id=456')',output:LOCAL' Before this fix, if you only configure flow IPFIX, the datapath flow is: id(0),in_port(2),eth_type(0x0806), packets:0, bytes:0, used:never, actions:sample(sample=0.0%,actions(userspace(pid=4294960835, ipfix(output_port=4294967295)))),sample(sample=100.0%, actions(userspace(pid=4294960835,flow_sample(probability=65535, collector_set_id=1,obs_domain_id=123,obs_point_id=456)))), sample(sample=0.0%,actions(userspace(pid=4294960835, ipfix(output_port=1)))),1 The datapath flow should only contain the sample action like below: id(0),in_port(2),eth_type(0x0800),ipv4(frag=no), packets:9, bytes:871, used:0.656s, actions:sample(sample=100.0%,actions(userspace(pid=4294962911, flow_sample(probability=65535,collector_set_id=1,obs_domain_id=123, obs_point_id=456)))),1 Signed-off-by: Benli Ye <daniely@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* hmap: Add HMAP_FOR_EACH_POP.Daniele Di Proietto2016-04-261-3/+2
| | | | | | | Makes popping each member of the hmap a bit easier. Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com> Acked-by: Ben Pfaff <blp@ovn.org>
* Move lib/ofp-util.h to include/openvswitch directoryBen Warren2016-04-141-0/+1
| | | | | | | | This commit also adds several #include directives in source files in order to make the 'ofp-util.h' move possible Signed-off-by: Ben Warren <ben@skyportsystems.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* Move lib/ofpbuf.h to include/openvswitch directoryBen Warren2016-03-301-1/+1
| | | | | | Signed-off-by: Ben Warren <ben@skyportsystems.com> Acked-by: Ryan Moats <rmoats@us.ibm.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* list: Rename all functions in list.h with ovs_ prefix.Ben Warren2016-03-301-4/+4
| | | | | | | This attempts to prevent namespace collisions with other list libraries Signed-off-by: Ben Warren <ben@skyportsystems.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* list: Remove lib/list.h completely.Ben Warren2016-03-301-1/+1
| | | | | | | | All code is now in include/openvswitch/list.h. Signed-off-by: Ben Warren <ben@skyportsystems.com> Acked-by: Ryan Moats <rmoats@us.ibm.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ipfix: Skip BFD packets.Wenyu Zhang2015-12-031-1/+23
| | | | | | | | | | | | | | | The patch is to skip BFD packets in ipfix. Bidirectional Forwarding Detection (BFD) packets are for monitoring the tunnel link status and consumed by ovs itself, no need to sample them. Refer to IETF RFC 5881, BFD control packets are the UDP packets with destination port 3784 and BFD echo packets are the UDP packets with dst destination port 3785. Ipfix will skip both BFD control packets and BFD echo packets. Signed-off-by: Wenyu Zhang <wenyuz@vmware.com> [blp@ovn.org added check for IP] Signed-off-by: Ben Pfaff <blp@ovn.org>
View Lorry Controller Status