summaryrefslogtreecommitdiff
path: root/ofproto/tunnel.c
Commit message (Collapse)AuthorAgeFilesLines
* ofproto: Remove duplicated includesYunjian Wang2020-07-141-2/+0
| | | | | | | | Remove duplicated includes. Acked-by: Greg Rose <gvrose8192@gmail.com> Signed-off-by: Yunjian Wang <wangyunjian@huawei.com> Signed-off-by: William Tu <u9012063@gmail.com>
* erspan: Add flow-based erspan optionsGreg Rose2018-05-211-4/+7
| | | | | | | | | | The patch add supports for flow-based erspan options. The erspan_ver, erspan_idx, erspan_dir, and erspan_hwid can be set as "flow" so that its value is set by the openflow rule, instead of statically configured at port creation time. Signed-off-by: William Tu <u9012063@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* userspace: add erspan tunnel support.William Tu2018-05-211-0/+13
| | | | | | | | | | | | ERSPAN is a tunneling protocol based on GRE tunnel. The patch add erspan tunnel support for ovs-vswitchd with userspace datapath. Configuring erspan tunnel is similar to gre tunnel, but with additional erspan's parameters. Matching a flow on erspan's metadata is also supported, see ovs-fields for more details. Signed-off-by: William Tu <u9012063@gmail.com> Signed-off-by: Greg Rose <gvrose8192@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* tunnel: make tun_key_to_attr aware of tunnel type.William Tu2018-05-141-0/+10
| | | | | | | | | | | | | | | | | | | | | | | When there is a flow rule which forwards a packet from geneve port to another tunnel port, ex: gre, the tun_metadata carried from the geneve port might affect the outgoing port. For example, the datapath action from geneve port output to gre port (1) shows: set(tunnel(tun_id=0x7b,dst=2.2.2.2,ttl=64, geneve({class=0xffff,type=0,len=4,0x123}),flags(df|key))),1 Where the geneve(...) should not exist. When using kernel's tunnel port, this triggers an error saying: "Multiple metadata blocks provided", when there is a rule forwarding the geneve packet to vxlan/erspan tunnel port. A userspace test case using geneve and gre also demonstrates the issue. The patch makes the tun_key_to_attr aware of the tunnel type. So only the relevant output tunnel's options are set. Reported-by: Xiaoyan Jin <xiaoyanj@vmware.com> Signed-off-by: William Tu <u9012063@gmail.com> Cc: Greg Rose <gvrose8192@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* tunnel: fix tunnel flags set/clear.William Tu2018-01-101-0/+1
| | | | | | | | | | | | | | | | Existing code only set these tunnel flags (df, csum, and key) when the flag is set in the output tunnel port, but did not clear when the flag is unset. The patch fixes it by setting and clearing it accordingly. Two existing testcases need to fix: 'tunnel - Geneve option present' has no key set up, so we should match 'flags(df)' instead of 'flags(df|key)'. The second case 'tunnel - concomitant IPv6 and IPv4 tunnels' follows the same pattern. One additional test case 'tunnel - Mix Geneve/GRE options' is added. Signed-off-by: William Tu <u9012063@gmail.com> VMWare-BZ: #2019012 Signed-off-by: Ben Pfaff <blp@ovn.org>
* tunnel: Add ofproto/list-tunnels command for troubleshooting.Ben Pfaff2018-01-041-19/+55
| | | | | | | | I've recently had to debug some issues related to tunnel implementation. This command would make it easier to have some confidence in how tunnels are actually set up inside OVS. Signed-off-by: Ben Pfaff <blp@ovn.org>
* tunnel: Log sanely in tnl_port_receive().Ben Pfaff2018-01-041-13/+3
| | | | | | | | | | | | | | | When this function was introduced in 2012, it modified its 'flow' argument and logged the changes (at debug level). However, since 2013 it has no longer modified its 'flow' argument, but the logging was still oriented around the idea that it did. This commit fixes up the logging to make sense again. This doesn't fix an actual bug that causes problems, but it does fix a conceptual error. Fixes: 2301f7ebc15e ("tunnel: Make tnl_port_receive() parameter 'const'.") Signed-off-by: Ben Pfaff <blp@ovn.org> Reviewed-by: Yifeng Sun <pkusunyifeng@gmail.com>
* tunnel: Avoid flow_to_string() call when rate-limited.Ben Pfaff2018-01-041-4/+5
| | | | | | | | | flow_to_string() is relatively expensive. It is better to avoid it if the string is not actually going to be used. Signed-off-by: Ben Pfaff <blp@ovn.org> Reviewed-by: Yifeng Sun <pkusunyifeng@gmail.com> Acked-by: Ansis Atteka <aatteka@ovn.org>
* tunnel: Fix deletion of datapath tunnel ports in case of reconfigurationBalazs Nemeth2017-11-281-17/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is an issue in OVS with tunnel deletion during the reconfiguration of OF tunnels. If the dst_port value is changed, the old tunnel map entry will not be deleted, because the tp_port argument of tnl_port_map_delete() has the new dst_port setting, hence the tunnel cannot be found in the list of tnl_port structures. The patch corrects this mechanism by adding a new argument, 'old_odp_port' to tnl_port_reconfigure(). This value is used to identify the datapath tunnel port which is being reconfigured. In connection with this fix, to unify the tunnel port map handling, odp_port value is used to search the proper port to insert and delete tunnel map entries as well. This variable can be used instead of tp_port, as it is unique for all datapath tunnel ports, and there is no need to reach dst_port from netdev_tunnel_config structure. This patch also adds a printout to check the reference counter of a tnl_port structure in tnl-port.c. Extending OVS unit test cases to have ref_cnt values in the expected dump. Adding new test cases to check if packet receiving is still working in the case of OF tunnel port deletion. Adding new test cases to check the reference counter in case of OF tunnel deletion or reconfiguration. Signed-off-by: Balazs Nemeth <balazs.nemeth@ericsson.com> Signed-off-by: Jan Scheurich <jan.scheurich@ericsson.com> Co-authored-by: Jan Scheurich <jan.scheurich@ericsson.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* userspace: Handling of versatile tunnel portsBen Pfaff2017-06-271-7/+20
| | | | | | | | | | In netdev_gre_build_header(), GRE protocol and VXLAN next_potocol is set based on packet_type of flow. If it's about an Ethernet packet, it is set to ETP_TYPE_TEB. Otherwise, if the name space is OFPHTN_ETHERNET, it is set according to the name space type. Signed-off-by: Jan Scheurich <jan.scheurich@ericsson.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* userspace: Add OXM field MFF_PACKET_TYPEJan Scheurich2017-06-271-2/+0
| | | | | | | | | | | | | | | | | | | | | | | Allow packet type namespace OFPHTN_ETHERTYPE as alternative pre-requisite for matching L3 protocols (MPLS, IP, IPv6, ARP etc). Change the meta-flow definition of packet_type field to use the new custom format MFS_PACKET_TYPE representing "(NS,NS_TYPE)". Parsing routine for MFS_PACKET_TYPE added to meta-flow.c. Formatting routine for field packet_type extracted from match_format() and moved to flow.c to be used from meta-flow.c for formatting MFS_PACKET_TYPE. Updated the ovs-fields man page source meta-flow.xml with documentation for packet-type-aware bridges and added documentation for field packet_type. Added packet_type to the matching properties in tests/ofproto.at. If dl_type is unwildcarded due to later packet modification, make sure it is cleared again if the original packet_type was not PT_ETH. Signed-off-by: Jan Scheurich <jan.scheurich@ericsson.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* userspace: L3 tunnel support for GRE and LISPJan Scheurich2017-06-021-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a boolean "layer3" configuration option for tunnel vports. The layer3 option defaults to false for all ports except LISP. GRE ports accept both true and false for "layer3". A tunnel vport configured with layer3=true receives L3 packets. which are then converted to Ethernet packets by pushing a dummy Ethernet heder at the ingress of the OpenFlow pipeline. The Ethernet header of a packet is stripped before sending to a layer3 tunnel vport. Presently a single GRE vport cannot carry both L2 and L3 packets. But it is possible to create two GRE vports representing the same GRE tunel, one with layer3=false, the other with layer3=true. L2 packet from the tunnel are received on the first vport, L3 packets on the second. The controller must send packets to the layer3 GRE vport to tunnel them without their Ethernet header. Units tests have been added to check the L3 tunnel handling. LISP tunnels are not yet supported by the netdev userspace datapath. Signed-off-by: Simon Horman <simon.horman@netronome.com> Signed-off-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: Yi Yang <yi.y.yang@intel.com> Signed-off-by: Jan Scheurich <jan.scheurich@ericsson.com> Co-authored-by: Zoltan Balogh <zoltan.balogh@ericsson.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* userspace: Switching of L3 packets in L2 pipelineJan Scheurich2017-06-021-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ports have a new layer3 attribute if they send/receive L3 packets. The packet_type included in structs dp_packet and flow is considered in ofproto-dpif. The classical L2 match fields (dl_src, dl_dst, dl_type, and vlan_tci, vlan_vid, vlan_pcp) now have Ethernet as pre-requisite. A dummy ethernet header is pushed to L3 packets received from L3 ports before the the pipeline processing starts. The ethernet header is popped before sending a packet to a L3 port. For datapath ports that can receive L2 or L3 packets, the packet_type becomes part of the flow key for datapath flows and is handled appropriately in dpif-netdev. In the 'else' branch in flow_put_on_pmd() function, the additional check flow_equal(&match.flow, &netdev_flow->flow) was removed, as a) the dpcls lookup is sufficient to uniquely identify a flow and b) it caused false negatives because the flow in netdev->flow may not properly masked. In dpif_netdev_flow_put() we now use the same method for constructing the netdev_flow_key as the one used when adding the flow to the dplcs to make sure these always match. The function netdev_flow_key_from_flow() used so far was not only inefficient but sometimes caused mismatches and subsequent flow update failures. The kernel datapath does not support the packet_type match field. Instead it encodes the packet type implictly by the presence or absence of the Ethernet attribute in the flow key and mask. This patch filters the PACKET_TYPE attribute out of netlink flow key and mask to be sent to the kernel datapath. Signed-off-by: Lorand Jakab <lojakab@cisco.com> Signed-off-by: Simon Horman <simon.horman@netronome.com> Signed-off-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: Yi Yang <yi.y.yang@intel.com> Signed-off-by: Jan Scheurich <jan.scheurich@ericsson.com> Co-authored-by: Zoltan Balogh <zoltan.balogh@ericsson.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* Support accepting and displaying port names in OVS tools.Ben Pfaff2017-05-311-6/+6
| | | | | | | | | | | | | | Until now, most ovs-ofctl commands have not accepted names for ports, only numbers, and have not been able to display port names either. It's a lot easier for users if they can use and see meaningful names instead of arbitrary numbers. This commit adds that support. For backward compatibility, only interactive ovs-ofctl commands by default display port names; to display them in scripts, use the new --names option. Signed-off-by: Ben Pfaff <blp@ovn.org> Tested-by: Aaron Conole <aconole@redhat.com>
* tunnel: Add support to configure ptk_markPravin B Shelar2017-01-281-0/+5
| | | | | | | | | | | | | | | | Today packet mark action is broken for Tunnel ports with tunnel monitoring. User can write a flow to set pkt-mark for any tunnel traffic, but there is no way to set the packet mark for corresponding BFD traffic. Following patch introduces new option in OVSDB tunnel configuration so that user can set skb-mark for given tunnel endpoint. OVS would set the mark according to the skb-mark option for all tunnel traffic including packets generated by vSwitchd like tunnel monitoring BFD packet. Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* tunnel: set udp dst-port in tunnel metadataPravin B Shelar2016-12-051-0/+1
| | | | | | | | | | | VxLan device expect valid tp-dst in tunnel metadata. Following patch sets consistent tp-dst with respect to the egress tunnel port. Reported-by: Gerhard Stenzel <gstenzel@linux.vnet.ibm.com> Tested-by: Gerhard Stenzel <gstenzel@linux.vnet.ibm.com> Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* openvswitch: Allow external IPsec tunnel management.Pravin B Shelar2016-09-271-13/+0
| | | | | | | | | | | | | | | | | | OVS GRE IPsec tunnel support has multiple issues, Therefore it was deprecated in OVS 2.6. Following patch removes support for GRE IPsec and allows external IPsec tunnel management for any type of tunnel not just GRE. e.g. user can encrypt Geneve or VxLan traffic. It can be done by using openflow pipeline to set skb-mark and using IPsec keying daemons to implement IPsec tunnels. This packet can be matched for the skb-mark to encrypt selective tunnel traffic. VMware-BZ: 1710701 Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Acked-by: Ansis Atteka <aatteka@ovn.org>
* json: Move from lib to include/openvswitch.Terry Wilson2016-07-221-1/+1
| | | | | | | | | | | | | | | To easily allow both in- and out-of-tree building of the Python wrapper for the OVS JSON parser (e.g. w/ pip), move json.h to include/openvswitch. This also requires moving lib/{hmap,shash}.h. Both hmap.h and shash.h were #include-ing "util.h" even though the headers themselves did not use anything from there, but rather from include/openvswitch/util.h. Fixing that required including util.h in several C files mostly due to OVS_NOT_REACHED and things like xmalloc. Signed-off-by: Terry Wilson <twilson@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* tunneling: get skb marking to work properly with tunnelsAnsis Atteka2016-07-211-1/+2
| | | | | | | | | | | | | | | There are two issues that this patch fixes: 1. it was impossible to set skb mark at all through NXM_NX_PKT_MARK register for tunnel packets; AND 2. ipsec_xxx tunnels would not be marked with the default IPsec mark (broken by d23df9a87 "lib/odp: Use masked set actions."). This patch also adds anti-regression tests to prevent such breakages in the future. Signed-off-by: Ansis Atteka <aatteka@ovn.org> VMware-BZ: #1653178 Acked-by: Jarno Rajahalme <jarno@ovn.org>
* netdev-native-tnl: Introduce ip_build_header()Pravin B Shelar2016-05-231-52/+3
| | | | | | | | | | The native tunneling build tunnel header code is spread across two different modules, it makes pretty hard to follow the code. Following patch refactors the code to move all code to netdev-ative-tnl module. Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Acked-by: Jesse Gross <jesse@kernel.org>
* tnl-ports: Handle STT ports.Pravin B Shelar2016-05-181-2/+6
| | | | | | | | STT uses TCP port so we need to filter traffic on basis of TCP port numbers. Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Acked-by: Jesse Gross <jesse@kernel.org>
* tunnel: Add IP ECN related functions.Pravin B Shelar2016-05-181-3/+3
| | | | | | | | Set and get functions for IP explicit congestion notification flag. These function would be used by STT reassembly code. Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Acked-by: Jesse Gross <jesse@kernel.org>
* tunneling: Fix for concomitant IPv4 and IPv6 tunnelsThadeu Lima de Souza Cascardo2016-04-211-0/+4
| | | | | | | | | | | When using an IPv6 tunnel on the same bridge as an IPv4 tunnel, the flow received from the IPv6 tunnel would have an IPv4 address added to it, causing problems when trying to put or execute the action on Linux datapath. Clearing the IPv6 address when we have a valid IPv4 address fixes this problem. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* Move lib/ofpbuf.h to include/openvswitch directoryBen Warren2016-03-301-1/+1
| | | | | | Signed-off-by: Ben Warren <ben@skyportsystems.com> Acked-by: Ryan Moats <rmoats@us.ibm.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* tunneling: Enable IPv6 tuneling.Pravin B Shelar2016-03-241-8/+0
| | | | | | | | | | | | There is check to disable IPv6 tunneling. Following patch removes it and reintroduces the tunneling automake tests. This reverts mostly commit 250bd94d1e500a89c76cac944e660bd9c07ac364. There are couple of new autotests and updated documentation related to ipv6 tunneling added in this patch. Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* Move lib/dynamic-string.h to include/openvswitch directoryBen Warren2016-03-191-1/+1
| | | | | Signed-off-by: Ben Warren <ben@skyportsystems.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* tunneling: Disable IPv6 tunnelPravin B Shelar2016-02-171-0/+8
| | | | | | | | | | | | | There are multiple issues in IPv6 userspace tunnel implementation. Even the kernel module that ships with 2.5 does not support IPv6 tunneling. There is not enough time to get all fixes in branch-2.5. So it make sense to disable the support on 2.5. Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Acked-by: Flavio Leitner <fbl@sysclose.org> Acked-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com> Acked-by: Jesse Gross <jesse@kernel.org>
* ofproto: Wildcard TTL on IP tunnelsHaggai Eran2016-01-191-1/+1
| | | | | | | | | | | | | There is no need to set the mask on the outer header IP TTL [1]. The only requirement is that the TTL will be non-zero. Clear the mask in tnl_wc_init(). [1] OVS VXLAN decap rule has full match on TTL for the outer headers? http://www.spinics.net/lists/netdev/msg351961.html Cc: Jesse Gross <jesse@kernel.org> Cc: Joe Stringer <joe@ovn.org> Signed-off-by: Haggai Eran <haggaie@mellanox.com> Signed-off-by: Jesse Gross <jesse@kernel.org>
* netdev-vport: Add IPv6 support for build/push/pop tunnel headerThadeu Lima de Souza Cascardo2015-12-041-11/+33
| | | | | | | This includes VXLAN, GRE and Geneve. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* tunneling: extend flow_tnl with ipv6 addressesJiri Benc2015-11-301-6/+17
| | | | | | | | | | | | | | | | Note that because there's been no prerequisite on the outer protocol, we cannot add it now. Instead, treat the ipv4 and ipv6 dst fields in the way that either both are null, or at most one of them is non-null. [cascardo: abstract testing either dst with flow_tnl_dst_is_set] cascardo: using IPv4-mapped address is an exercise for the future, since this would require special handling of MFF_TUN_SRC and MFF_TUN_DST and OpenFlow messages. Signed-off-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com> Co-authored-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* tnl-arp-cache: Rename module and functions to tnl-neigh-cache.Thadeu Lima de Souza Cascardo2015-11-301-1/+0
| | | | | | | | | | | Since we don't distinguish between IPv4 and IPv6 lookups, consolidate ARP and ND cache into neighbor cache. Other references to ARP related to the ARP cache but that are not really about ARP have been renamed as well. tnl_arp_lookup is kept for lookups using IPv4 instead of IPv4-mapped addresses, but that is going to be removed in a later patch. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* tunneling: add IPv6 support to netdev_tunnel_configJiri Benc2015-11-301-6/+2
| | | | | | | | | Allow configuration of IPv6 tunnel endpoints. Signed-off-by: Jiri Benc <jbenc@redhat.com> Co-authored-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* packets: Change IPv6 functions to more closely resemble IPv4 ones.Justin Pettit2015-11-241-3/+3
| | | | | Signed-off-by: Justin Petitt <jpettit@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* tunneling: extend tnl_match with ipv6Jiri Benc2015-11-101-14/+22
| | | | | | | | | [cascardo: use IPv4-mapped IPv6 addresses] Signed-off-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com> Co-authored-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* userspace: Define and use struct eth_addr.Jarno Rajahalme2015-08-281-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Define struct eth_addr and use it instead of a uint8_t array for all ethernet addresses in OVS userspace. The struct is always the right size, and it can be assigned without an explicit memcpy, which makes code more readable. "struct eth_addr" is a good type name for this as many utility functions are already named accordingly. struct eth_addr can be accessed as bytes as well as ovs_be16's, which makes the struct 16-bit aligned. All use seems to be 16-bit aligned, so some algorithms on the ethernet addresses can be made a bit more efficient making use of this fact. As the struct fits into a register (in 64-bit systems) we pass it by value when possible. This patch also changes the few uses of Linux specific ETH_ALEN to OVS's own ETH_ADDR_LEN, and removes the OFP_ETH_ALEN, as it is no longer needed. This work stemmed from a desire to make all struct flow members assignable for unrelated exploration purposes. However, I think this might be a nice code readability improvement by itself. Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
* tunnel: Break tnl_xlate_init() into two separate functions.Ben Pfaff2015-07-311-47/+38
| | | | | | | | | | It seems to me that tnl_xlate_init() has two almost-separate tasks. First, it marks most of the 'wc' bits for tunnels. Second, it checks and updates ECN bits. This commit breaks tnl_xlate_init() into two separate functions, one for each of those tasks. Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
* tunnel: Drop 'base_flow' parameter from tnl_xlate_init().Ben Pfaff2015-07-241-7/+5
| | | | | | | | | At the point when tnl_xlate_init() is called, all of the members that tnl_xlate_init() examines in 'base_flow' have the same values in 'flow', so there's no point in passing both. Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
* tunneling: Allow matching and setting tunnel 'OAM' flag.Jesse Gross2015-07-151-1/+1
| | | | | | | | | | | | | | | | | Several encapsulation formats have the concept of an 'OAM' bit which typically is used with networking tracing tools to distinguish test packets from real traffic. OVS already internally has support for this, however, it doesn't do anything with it and it also isn't exposed for controllers to use. This enables support through OpenFlow. There are several other tunnel flags which are consumed internally by OVS. It's not clear that it makes sense to use them externally so this does not expose those flags - although it should be easy to do so if necessary in the future. Signed-off-by: Jesse Gross <jesse@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
* tunneling: Don't match on source IP address for native tunnels.Jesse Gross2015-06-251-3/+2
| | | | | | | | | | | | | | | | | | | | | | | When doing native tunneling, we look at packets destined to the local port to see if they match tunnel protocols that we should intercept. The criteria are IP protocol, destination UDP port, etc. However, we also look at the source IP address of the packets. This should be a function of the port-based tunnel layer and not the tunnel receive code itself. For comparison, the kernel tunnel code has no idea about the IP addresses of its link partners. If port based tunnel is desired, it can be handled using the normal port tunnel layer, regardless of whether the packets originally came from userspace or the kernel. For port based tunneling, this bug has no effect - the check is simply redundant. However, it breaks flow-based native tunnels because the remote IP address is not known at port creation time. CC: Pravin Shelar <pshelar@nicira.com> Reported-by: David Griswold <David.Griswold@overturenetworks.com> Tested-by: David Griswold <David.Griswold@overturenetworks.com> Signed-off-by: Jesse Gross <jesse@nicira.com>
* ofproto-dpif: Avoid creating OpenFlow ports for duplicate tunnels.Ben Pfaff2015-06-051-4/+10
| | | | | | | | | | | | Until now, when two tunnels had an identical configuration, both of them were assigned OpenFlow ports, but only one of those OpenFlow ports was functional. With this commit, only one of the two (or more) identically configured tunnels will be assigned an OpenFlow port number. Reported-by: Keith Holleman <hollemanietf@gmail.com> Signed-off-by: Ben Pfaff <blp@nicira.com> Co-authored-by: Andy Zhou <azhou@nicira.com> Signed-off-by: Andy Zhou <azhou@nicira.com>
* netdev: Fix user space tunneling for set_tunnel action.Ricky Li2015-03-261-1/+1
| | | | | | | | | | | | | | | e.g. Set tunnel id for encapsulated VxLAN packet (out_key=flow): ovs-vsctl add-port int-br vxlan0 -- set interface vxlan0 \ type=vxlan options:remote_ip=172.168.1.2 options:out_key=flow ovs-ofctl add-flow int-br in_port=LOCAL, icmp,\ actions=set_tunnel:3, output:1 (1 is the port# of vxlan0) Output tunnel ID should be modified to 3 with this patch. Signed-off-by: Ricky Li <ricky.li@intel.com> Acked-by: Pravin B Shelar <pshelar@nicira.com>
* ofproto-dpif-xlate: Honor skip_wildcards in translation.Jarno Rajahalme2015-03-131-16/+19
| | | | | | | There is no need to do anything with wildcards when skip_wildcards is true. Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
* lib: Move vlog.h to <openvswitch/vlog.h>Thomas Graf2014-12-151-1/+1
| | | | | | | | A new function vlog_insert_module() is introduced to avoid using list_insert() from the vlog.h header. Signed-off-by: Thomas Graf <tgraf@noironetworks.com> Acked-by: Ben Pfaff <blp@nicira.com>
* tunnel: Recreate tunnel port only when the netdev status change.Alex Wang2014-12-051-3/+3
| | | | | | | | | | | | | | | | On current master, the 'struct tnl_port' in tunnel module will be recreated whenever the global connectivity sequence number changes (e.g. when adding unrelated flow). This is unnecessary and could cause drop of tunnel packet if a lookup happens between the removal and recreate. This commit fixes the above issue by only checking the netdev's own sequence number. Found by code inspection. Signed-off-by: Alex Wang <alexw@nicira.com> Acked-by: Joe Stringer <joestringer@nicira.com>
* openvswitch: Userspace tunneling.Pravin B Shelar2014-11-121-6/+67
| | | | | | | | | | | | | | | | | | | | | | | | | Following patch adds support for userspace tunneling. Tunneling needs three more component first is routing table which is configured by caching kernel routes and second is ARP cache which build automatically by snooping arp. And third is tunnel protocol table which list all listening protocols which is populated by vswitchd as tunnel ports are added. GRE and VXLAN protocol support is added in this patch. Tunneling works as follows: On packet receive vswitchd check if this packet is targeted to tunnel port. If it is then vswitchd inserts tunnel pop action which pops header and sends packet to tunnel port. On packet xmit rather than generating Set tunnel action it generate tunnel push action which has tunnel header data. datapath can use tunnel-push action data to generate header for each packet and forward this packet to output port. Since tunnel-push action contains most of packet header vswitchd needs to lookup routing table and arp table to build this action. Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Acked-by: Jarno Rajahalme <jrajahalme@nicira.com> Acked-by: Thomas Graf <tgraf@noironetworks.com> Acked-by: Ben Pfaff <blp@nicira.com>
* tunnel: Convert rwlock to fat-rwlock.Pravin B Shelar2014-11-121-11/+23
| | | | | | | | | | Tunnel lookup is done in slow path but DPDK tunneling slow path is called in PMD context. Therefore it is better to convert rwlock to fat rwlock. Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Acked-by: Thomas Graf <tgraf@noironetworks.com> Acked-by: Ben Pfaff <blp@nicira.com>
* tunnel: Add to nw_tos bits instead of replacing them in tnl_port_send().Ben Pfaff2014-10-231-1/+1
| | | | | | | | | | | We normally only add 1-bits to wc->masks for datapath flow matching purposes, never removing them. In this case, the bits that get set to zero will be set back to 1 later on in the function, so this does not fix any actual bug, but the principle of only setting to 1, not to 0, seems sound to me. Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Justin Pettit <jpettit@nicira.com>
* Extend OVS IPFIX exporter to export tunnel headersWenyu Zhang2014-08-181-0/+4
| | | | | | | | | | | | | | | | | | | | | | Extend IPFIX exporter to export tunnel headers when both input and output of the port. Add three other_config options in IPFIX table: enable-input-sampling, enable-output-sampling and enable-tunnel-sampling, to control whether sampling tunnel info, on which direction (input or output). Insert sampling action before output action and the output tunnel port is sent to datapath in the sampling action. Make datapath collect output tunnel info and send it back to userpace in upcall message with a new additional optional attribute. Add a tunnel ports map to make the tunnel port lookup faster in sampling upcalls in IPFIX exporter. Make the IPFIX exporter generate IPFIX template sets with enterprise elements for the tunnel info, save the tunnel info in IPFIX cache entries, and send IPFIX DATA with tunnel info. Add flowDirection element in IPFIX templates. Signed-off-by: Wenyu Zhang <wenyuz@vmware.com> Acked-by: Romain Lenglet <rlenglet@vmware.com> Acked-by: Ben Pfaff <blp@nicira.com> Acked-by: Pravin B Shelar <pshelar@nicira.com>
* tunnel: Fix bug where misconfiguration persists.Joe Stringer2014-05-081-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, misconfiguring a tunnel port to use the exact same settings would cause the corresponding netdev to never be destroyed. When attempting to re-use the port as a different type, this would fail and result in a discrepancy between reported port type and actual netdev in use. An example configuration that would previously give unexpected behaviour: ovs-vsctl add-port br0 p0 -- set int p0 type=gre options:remote_ip=1.2.3.4 ovs-vsctl add-port br0 p1 -- set int p1 type=internal ovs-vsctl set int p1 type=gre options:remote_ip=1.2.3.4 ovs-vsctl set int p1 type=internal The final command would report in the ovs-vswitchd logs that it is attempting to configure the port with the same gre settings as p0, despite the command specifying the type as internal. Even after deleting and re-adding the port, the message would reappear. This patch fixes the bug by dereferencing the netdev in the failure case of tnl_port_add__(), and ensures that the tnl_port structure is freed in that case as well. Bug #1198386. Signed-off-by: Joe Stringer <joestringer@nicira.com> Acked-by: Ryan Wilson <wryan@vmware.com> Acked-by: Alex Wang <alexw@nicira.com>
* Clarify tunnel wildcarding.Jarno Rajahalme2014-04-111-1/+6
| | | | | | | | | | | | | It would seem we should set the 'tunnel.ip_dst' in 'wc' when calling tnl_port_should_receive(), as it is reading that flow field. However, since tunnels' datapath port numbers are different from the non-tunnel ports, and we always unwildcard the 'in_port', we do not need to unwildcard the 'tunnel.ip_dst' for non-tunneled packets. Also, 'nw_tos' need not be unwildcarded if it is not examined. Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
View Lorry Controller Status