summaryrefslogtreecommitdiff
path: root/ovn/utilities
Commit message (Collapse)AuthorAgeFilesLines
* ovn-trace: Include source file and line number reference in output.Ben Pfaff2016-10-072-4/+12
| | | | | | | | This should make it that much easier to track down the code that emitted a particular flow. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Andy Zhou <azhou@ovn.org>
* ovn-nbctl: Improve ovn-nbctl manpagenickcooper-zhangtonghao2016-10-051-8/+32
| | | | | | Signed-off-by: nickcooper-zhangtonghao <nickcooper-zhangtonghao@opencloud.tech> [blp@ovn.org added further improvements] Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-nbctl: Fix memory leak in nbctl_lr_route_addnickcooper-zhangtonghao2016-10-051-0/+6
| | | | | Signed-off-by: nickcooper-zhangtonghao <nickcooper-zhangtonghao@opencloud.tech> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-nbctl: Check the length of MAC addressnickcooper-zhangtonghao2016-10-051-1/+1
| | | | | | | | | | | | The command "ovn-nbctl lrp-add" should not set the MAC address which length is invalid to logical router port. This patch updates the eth_addr_from_string() to check trailing characters. We should use the ovs_scan() to check the "addresses" owned by the logical port, instead of eth_addr_from_string(). This patch also updates the ovn-nbctl tests. Signed-off-by: nickcooper-zhangtonghao <nickcooper-zhangtonghao@opencloud.tech> Signed-off-by: Ben Pfaff <blp@ovn.org>
* DSCP marking on packetsBabu Shanmugam2016-10-051-0/+5
| | | | | | | | | | | This patch adds support for marking qos on IP packets based on arbitrary match criteria for a logical switch. Signed-off-by: Babu Shanmugam <bschanmu@redhat.com> Suggested-by: Mickey Spiegel <mickeys.dev@gmail.com> Acked-by: Mickey Spiegel <mickeys.dev@gmail.com> [blp@ovn.org fixes races in the test and added ovn-trace checks] Signed-off-by: Ben Pfaff <blp@ovn.org>
* Check and allocate free qdisc queue id for ports with qos parametersBabu Shanmugam2016-10-041-0/+12
| | | | | | | | | | | | | | | | | | | ovn-northd processes the list of Port_Bindings and hashes the list of queues per chassis. When it finds a port with qos_parameters and without a queue_id, it allocates a free queue for the chassis that this port belongs. The queue_id information is stored in the options field of Port_binding table. Adds an action set_queue to the ingress table 0 of the logical flows which will be translated to openflow set_queue by ovn-controller ovn-controller opens the netdev corresponding to the tunnel interface's status:tunnel_egress_iface value and configures a HTB qdisc on it. Then for each SB port_binding that has queue_id set, it allocates a queue with the qos_parameters of that port. It also frees up unused queues. This patch replaces the older approach of policing Signed-off-by: Babu Shanmugam <bschanmu@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-nbctl: Add LB commands.nickcooper-zhangtonghao2016-10-032-1/+590
| | | | | | | | | | | | | | This patch provides the command line to create a load balancer. You can create a load balancer independently and add it to multiple switches or routers. A single load balancer can have multiple vips. Add a name column for the load balancer. With --add-duplicate, the command really creates a new load balancer with a duplicate name. This name has no special meaning or purpose other than to provide convenience for human interaction with the ovn-nb database. This patch also provides the unit tests and the documentation. Signed-off-by: nickcooper-zhangtonghao <nickcooper-zhangtonghao@opencloud.tech> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* ovn-nbctl: Remove unreachable code.nickcooper-zhangtonghao2016-10-031-2/+0
| | | | | Signed-off-by: nickcooper-zhangtonghao <nickcooper-zhangtonghao@opencloud.tech> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-nbctl: Fix memory leak in nbctl_lrp_add.nickcooper-zhangtonghao2016-10-031-4/+4
| | | | | Signed-off-by: nickcooper-zhangtonghao <nickcooper-zhangtonghao@opencloud.tech> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn: Initialize the databases.Gurucharan Shetty2016-09-231-0/+2
| | | | | | | | Without initializing the databases, commands of the form 'ovn-nbctl --wait=sb ls-add ls0' will simply hang. Signed-off-by: Gurucharan Shetty <guru@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* Windows: Extend support for binaries which allow detachAlin Serdean2016-09-141-0/+1
| | | | | | | | | | | On Windows we require service_start to be called to parse and setup requirements for '--detach' argument. Affected binaries: ovn-trace, ovsdb-client, ovs-testcontroller. Subsequent patches will be sent to adapt the tests with the new features. Signed-off-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* ovn-northd: Tag allocation for nested containers.Gurucharan Shetty2016-09-092-11/+15
| | | | | | | | | When there are hundreds of nodes controlled by OVN, the workflow to track and allocate unique tags across multiple hosts becomes complicated. It is much easier to let ovn-northd do the allocation. Signed-off-by: Gurucharan Shetty <guru@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* ovn-nbctl, tests: Clean up noisy memory leaksRyan Moats2016-09-091-0/+1
| | | | | | | | | | When run with valgrind, ovn-nbctl.c and tests/test-ovn.c reveal memory leaks of their own. This patch cleans these up so that they don't create noise when looking for leaks in the OVN daemon processes. Signed-off-by: Ryan Moats <rmoats@us.ibm.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-nbctl: Update man page for missing tables.Han Zhou2016-09-081-4/+29
| | | | | | | | There are tables added recently in ovn-nb, but not mentioned in man page of ovn-nbctl. Signed-off-by: Han Zhou <zhouhan@gmail.com> Signed-off-by: Russell Bryant <russell@ovn.org>
* ofp-actions: Waste less memory in set field and load actions.Jarno Rajahalme2016-08-311-12/+25
| | | | | | | | | | | | | | | Change the value and mask to be added to the end of the set field action without any extra bytes, exept for the usual ofp-actions padding to 8 bytes. Together with some structure member packing this saves on average about to 256 bytes for each set field and load action (as set field internal representation is also used for load actions). On a specific production data set each flow entry uses on average about 4.2 load or set field actions. This means that with this patch an average of more than 1kb can be saved for each flow with such a flow table. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* Add monitoring to ovsdb-serverConner Herriges2016-08-261-2/+2
| | | | | | | | | | | | | | | | | | | | | | | Monitoring is a valid option on POSIX based platforms. The monitor creates an additional process to monitor the ovsdb-server daemon. If the daemon dies due to a programming error, then the monitor process starts a new copy of it. If the daemon dies or exits for another reason, the monitor process exits. The monitor option is not currently enabled for either OVN Northbound or Southbound databases. The simplest method for doing this is to add --monitor to the calling lines in the start_ovsdb function in ovn-ctl, which is where ovsdb-server for ovn is currently started. This is the method employed by this patch. The second option would be to modify the code used by ovs-ctl to start ovsdb-server so that it will work for ovn, so that start_daemon from ovs-lib is used correctly and without modification. This option is certainly the more complex option, especially considering the northbound and southbound databases in ovn. Signed-off-by: Conner Herriges <conner.herriges@ibm.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-trace: Minor cleanups.Justin Pettit2016-08-122-5/+5
| | | | | | Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org> Acked-by: Ryan Moats <rmoats@us.ibm.com>
* ovn-trace: add generated files to .gitignore.Flavio Fernandes2016-08-231-0/+2
| | | | | Signed-off-by: Flavio Fernandes <flavio@flaviof.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* ovn: include ovn-trace.8 in DISTCLEANFILESLance Richardson2016-08-161-1/+2
| | | | | | | | Found by 'make distcheck'. Fixes: 4acd1e87a8bf ("ovn-trace: New utility.") Signed-off-by: Lance Richardson <lrichard@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-trace: New utility.Ben Pfaff2016-08-153-2/+1729
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new utility is intended to fulfill for OVN the purpose that "ofproto/trace" has for Open vSwitch. First, it's meant to be a useful tool for troubleshooting and diagnosis and in general for improving one's understanding of the emergent properties of a flow table. Second, it simplifies and increases the practical scope of testing, as well as making testing more reliable and repeatable and failures easier to interpret. This commit adds only a single test that uses the new utility, based on the oldest OVN end-to-end test "ovn -- 3 HVs, 1 LS, 3 lports/HV". The differences between the old and the new test illustrate properties of tracing. First, the new test does not start any ovn-controller processes or simulate any hypervisors in a nontrivial way. This is because ovn-trace does not actually forward packets or rely on the physical structure of the system. Second, whereas the old test tested not just the logical but also the physical structure of the system, it needed to have several logical ports, a total of 9 (3 on each of 3 HVs), whereas since this test only tests the logical network implementation it can use a smaller number. This property also means that the new test runs signicantly faster than the old one (less than a second on my laptop). In my opinion this approach points the way toward the future of OVN testing. Certainly, we need end-to-end tests. However, I believe that the bulk of our tests can be broken into ones that test the logical network implementation (using tracing) and ones that test physical/logical translation. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Ryan Moats <rmoats@us.ibm.com>
* ovn-northd: Copy name in logical datapath southbound representations.Ben Pfaff2016-08-151-3/+7
| | | | | | | | | | | This makes it easier to debug based on the southbound database without looking at the northbound representation. This commit adds the name to "ovn-sbctl dump-flows" output and it will be even more useful in an upcoming commit. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Ryan Moats <rmoats@us.ibm.com> Acked-by: Justin Pettit <jpettit@ovn.org>
* ovn-util: Add common functions for the default NB and SB databases.Ben Pfaff2016-08-152-39/+14
| | | | | | Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Ryan Moats <rmoats@us.ibm.com> Acked-by: Justin Pettit <jpettit@ovn.org>
* ovn-controller: Use UDP checksums when creating Geneve tunnels.Jesse Gross2016-08-131-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently metadata transmitted by OVN over Geneve tunnels is unprotected by any checksum other than the one provided by the link layer - this includes both the VNI and data stored in options. Turning on UDP checksums which cover this data has obvious benefits in terms of integrity protection. In terms of performance, this actually significantly increases throughput in most common cases when running on Linux based hosts without NICs supporting Geneve offload (around 60% for bulk traffic). The reason is that generally all NICs are capable of offloading transmitted and received UDP checksums (viewed as ordinary UDP packets and not as tunnels). The benefit comes on the receive side where the validated outer UDP checksum can be used to additionally validate an inner checksum (such as TCP), which in turn allows aggregation of packets to be more efficiently handled by the rest of the stack. Not all devices see such a benefit. The most notable exception is hardware VTEPs (currently using VXLAN but potentially Geneve in the future). These devices are designed to not buffer entire packets in their switching engines and are therefore unable to efficiently compute or validate UDP checksums. In addition certain versions of the Linux kernel are not able to fully take advantage of Geneve capable NIC offloads in the presence of checksums. (This is actually a pretty narrow corner case though - earlier versions of Linux don't support Geneve offloads at all and later versions support both offloads and checksums well.) In order avoid possible problems with these cases, efficient checksum receive performance is exposed as an encap option in the southbound database as a hint to remote senders. This currently defaults to off for hardware VTEPs and on for all other cases. Signed-off-by: Jesse Gross <jesse@kernel.org> Acked-by: Ryan Moats <rmoats@us.ibm.com> Acked-by: Ben Pfaff <blp@ovn.org>
* smap: New function smap_get_def().Ben Pfaff2016-08-081-2/+2
| | | | | Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Ryan Moats <rmoats@us.ibm.com>
* ovn-nbctl: Add details for common options to manpage.Ben Pfaff2016-08-081-16/+10
| | | | | | | | The new .xml files in this commit are translations to XML of the existing nroff fragments in .man files. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Ryan Moats <rmoats@us.ibm.com>
* ovn: Fix spelling errors in manpages.Ben Pfaff2016-08-082-2/+2
| | | | | Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Ryan Moats <rmoats@us.ibm.com>
* ovn-sbctl: Remove unused enum.Ben Pfaff2016-08-081-1/+0
| | | | | Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Ryan Moats <rmoats@us.ibm.com>
* ovn-nbctl: Add "sync" command to wait for previous changes to take effect.Ben Pfaff2016-08-082-2/+50
| | | | | | | | | | It's slow to add --wait to every ovn-nbctl command; only the last command needs it. But it's sometimes inconvenient to add it to the last command if it's in a loop, etc. This makes it possible to separately wait for the OVN southbound or hypervisors to catch up to the northbound. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Ryan Moats <rmoats@us.ibm.com>
* ovn-nbctl: fix help message for lsp-get/set-addressesHan Zhou2016-08-022-6/+6
| | | | | Signed-off-by: Han Zhou <zhouhan@gmail.com> Signed-off-by: Russell Bryant <russell@ovn.org>
* ovn-northd, tests: Adding IPAM to ovn-northd.Nimay Desai2016-07-281-1/+1
| | | | | | | | | | | | | | | | | Added an IPv4 and MAC addresses management system to ovn-northd. When a logical switch's other_config:subnet field is set, logical ports attached to that switch that have the keyword "dynamic" in their addresses column will automatically be allocated a globally unique MAC address/unused IPv4 address within the provided subnet. The allocated address will populate the dynamic_addresses column. This can be useful for a user who wants to deploy many VM's or containers with networking capabilities, but does not care about the specific MAC/IPv4 addresses that are assigned. Added tests in ovn.at for ipam. Signed-off-by: Nimay Desai <nimaydesai1@gmail.com> Acked-by: Ben Pfaff <blp@ovn.org> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* ovn: Add ovn-controller-vtep debian packageRyan Moats2016-07-282-9/+45
| | | | | | | | | | | Having a separate debian package for deploying the ovn-controller-vtep binary enables the ability to assign specific nodes the role of communicating with VTEP enabled TORs. Change-Id: Ia36aea7d89bd011a57918820b2a9f6e3469b3e04 Signed-off-by: Ryan Moats <rmoats@us.ibm.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-nbctl: Improve usage message.Ben Pfaff2016-07-271-2/+2
| | | | | | | The most important change here is to delete misspelled "the". Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Numan Siddique <nusiddiq@redhat.com>
* ovn: Make it possible for CMS to detect when the OVN system is up-to-date.Ben Pfaff2016-07-264-4/+145
| | | | | | | | | | | | | | | | | Until now, there has been no reliable for the CMS (or ovn-nbctl, or anything else) to detect when changes made to the northbound configuration have been passed through to the southbound database or to the hypervisors. This commit adds this feature to the system, by adding sequence numbers to the northbound and southbound databases and adding code in ovn-nbctl, ovn-northd, and ovn-controller to keep those sequence numbers up-to-date. The biggest user-visible change from this commit is new a new option --wait to ovn-nbctl. With --wait=sb, ovn-nbctl now waits for ovn-northd to update the southbound database; with --wait=hv, it waits for the changes to make their way to Open vSwitch on every hypervisor. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Russell Bryant <russell@ovn.org>
* ovn-northd: Add logical flows to support native DHCPv4Numan Siddique2016-07-262-0/+227
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | OVN implements a native DHCPv4 support which caters to the common use case of providing an IP address to a booting instance by providing stateless replies to DHCPv4 requests based on statically configured address mappings. To do this it allows a short list of DHCPv4 options to be configured and applied at each compute host running ovn-controller. A new table 'DHCP_Options' is added in OVN NB DB to store the DHCP options. Logical ports refer to this table to configure the DHCPv4 options. For each logical port configured with DHCPv4 Options following flows are added - A logical flow which copies the DHCPv4 options to the DHCPv4 request packets using the 'put_dhcp_opts' action and advances the packet to the next stage. - A logical flow which implements the DHCP reponder by sending the DHCPv4 reply back to the inport once the 'put_dhcp_opts' action is applied. Signed-off-by: Numan Siddique <nusiddiq@redhat.com> Co-authored-by: Ben Pfaff <blp@ovn.org> Signed-off-by: Ben Pfaff <blp@ovn.org> Tested-by: Ramu Ramamurthy <ramu.ramamurthy@us.ibm.com> Acked-by: Ramu Ramamurthy <ramu.ramamurthy@us.ibm.com>
* json: Move from lib to include/openvswitch.Terry Wilson2016-07-222-3/+3
| | | | | | | | | | | | | | | To easily allow both in- and out-of-tree building of the Python wrapper for the OVS JSON parser (e.g. w/ pip), move json.h to include/openvswitch. This also requires moving lib/{hmap,shash}.h. Both hmap.h and shash.h were #include-ing "util.h" even though the headers themselves did not use anything from there, but rather from include/openvswitch/util.h. Fixing that required including util.h in several C files mostly due to OVS_NOT_REACHED and things like xmalloc. Signed-off-by: Terry Wilson <twilson@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-sbctl: Adjust formatting of lflow-list.Russell Bryant2016-07-131-1/+1
| | | | | | | | | | | | | | Adjust the field width for a couple of elements in the output of the lflow-list sub-command of ovn-sbctl. We now have a table ID of 10, so set a field width of 2 to keep output aligned. Table names have grown to a max of 19 characters, so update the field width to keep output aligned. Finally, left justify values in fields, as I find that to look a little nicer. Also update sample output in OVN-Tutorial.md to match the current state. Signed-off-by: Russell Bryant <russell@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* sset: New function sset_from_delimited_string().Ben Pfaff2016-07-131-8/+2
| | | | | | | This simplifies code in a couple of places. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-By: Ryan Moats <rmoats@us.ibm.com>
* ovn-nbctl: Print router port networks in "show".Justin Pettit2016-07-131-2/+10
| | | | | Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* ovn: Support multiple addresses on a single logical router port.Justin Pettit2016-07-122-26/+76
| | | | | | | | | | | Supporting multiple addresses is only mildly interesting for IPv4. However, it is a requirement for IPv6, which will arrive in a future commit. This commit introduces the extract_lrp_networks() function to ovn-util.[ch]. Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* ovn-sbctl: Change lport-(un)bind to lsp-(un)bind.Russell Bryant2016-07-072-8/+8
| | | | | | | | | A previous commit changed the command names in ovn-nbctl from lport-* to lsp-*. Change lport-bind and lport-unbind in ovn-sbctl to match. Signed-off-by: Russell Bryant <russell@ovn.org> Acked-by: Amitabha Biswas <abiswas@us.ibm.com> Acked-by: Ben Pfaff <blp@ovn.org>
* ovn: Add support for Load balancers.Gurucharan Shetty2016-07-031-0/+4
| | | | | | | | | | | | | | | | | | | | | | This commit adds schema changes to the OVN_Northbound database to support Load balancers. In ovn-northd, it adds two logical tables to program logical flows. It adds a 'pre_lb' table that sits before 'pre_stateful' table. For packets that need to be load balanced, this table sets reg0[0] to act as a hint for the pre-stateful table to send the packet to the conntrack table for defragmentation. It also adds a 'lb' table that sits before 'stateful' table. For packets from established connections, this table sets reg0[2] to indicate to the 'stateful' table that the packet needs to be sent to connection tracking table to just do NAT. In stateful table, packet for a new connection that needs to be load balanced is given a ct_lb($IP_LIST) action. Signed-off-by: Gurucharan Shetty <guru@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* ovn: Add address set support for ACLs.Russell Bryant2016-07-032-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This feature was originally proposed here: http://openvswitch.org/pipermail/dev/2016-March/067440.html A common use case for OVN ACLs involves needing to match a set of IP addresses. outport == "lp1" && ip4.src == {10.0.0.5, 10.0.0.25, 10.0.0.50} This example match only has 3 addresses, but it could easily have hundreds of addresses. In some cases, the same large set of addresses needs to be used in several ACLs. This patch adds a new Address_Set table to OVN_Northbound so that a set of addresses can be specified once and then referred to by name in ACLs. To recreate the above example, you would first create an address set: $ ovn-nbctl create Address_Set name=set1 addresses="10.0.0.5","10.0.0.25","10.0.0.50" Then you can refer to this address set by name in an ACL match: outport == "lp1" && ip4.src == $set1 Signed-off-by: Russell Bryant <russell@ovn.org> Signed-off-by: Babu Shanmugam <bschanmu@redhat.com> Co-authored-by: Flavio Fernandes <flavio@flaviof.com> Signed-off-by: Flavio Fernandes <flavio@flaviof.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-nbctl: Improve manpage.nickcooper-zhangtonghao2016-07-031-2/+6
| | | | | | | | | If there are multiple logical switches or routers with a duplicate name, the configuration is slightly different. You should configure the logical switches or routers using the UUID instead of the name. Signed-off-by: nickcooper-zhangtonghao <nickcooper-zhangtonghao@opencloud.tech> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-nbctl: Fix double free in nbctl_lr_route_list().William Tu2016-07-021-1/+2
| | | | | | | | | The intent here was to free the error reported by ipv6_parse_cidr(), but in fact the error reported by that function was discarded and the previous error from ip_parse_cidr() was freed again. Signed-off-by: William Tu <u9012063@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-nbctl: Ability to update a route's output port.Gurucharan Shetty2016-07-011-0/+4
| | | | | | | | The command 'lr-route-add' currently cannot update the output port. Signed-off-by: Gurucharan Shetty <guru@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* util: New function nullable_xstrdup().Ben Pfaff2016-06-262-2/+2
| | | | | | It's a pretty common pattern so create a function for it. Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn: DNAT and SNAT on a gateway router.Gurucharan Shetty2016-06-211-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For traffic from physical space to virtual space we need DNAT. The DNAT happens in the gateway router and reaches the logical port. The return traffic should be unDNATed. Traffic originating in virtual space heading to physical space should be SNATed. The return traffic is unSNATted. East-west traffic with the public destination IP address needs a DNAT. This traffic is punted to the l3 gateway where DNAT takes place. This traffic is also SNATed and eventually loops back to its destination. The SNAT is needed because we need the reverse traffic to go back to the l3 gateway and not short-circuit directly to the source. This commit introduces 4 new logical actions. 1. ct_snat: To send the packet through SNAT zone to unSNAT packets. 2. ct_snat(IP): To SNAT to the provided IP address. 3. ct_dnat: To send the packet throgh DNAT zone to unDNAT packets. 4. ct_dnat(IP): To DNAT to the provided IP. This commit only provides the ability to do IP based NAT. This will eventually be enhanced to do PORT based NAT too. Command hints: Consider a distributed router "R1" that has switch foo (192.168.1.0/24) with a lport foo1 (192.168.1.2) and bar (192.168.2.0/24) with lport bar1 (192.168.2.2) connected to it. You connect "R1" to a gateway router "R2" via a switch "join" in (20.0.0.0/24) network. R2 has a switch "alice" (172.16.1.0/24) connected to it (to simulate external network). case: Add pure DNAT (north-south) Add a DNAT rule in R2: ovn-nbctl -- --id=@nat create nat type="dnat" logical_ip=192.168.1.2 \ external_ip=30.0.0.2 -- add logical_router R2 nat @nat Now alice1 should be able to ping 192.168.1.2 via 30.0.0.2. case2 : Add pure SNAT (south-north) Add a SNAT rule in R2: ovn-nbctl -- --id=@nat create nat type="snat" logical_ip=192.168.2.2 \ external_ip=30.0.0.1 -- add logical_router R2 nat @nat (You need a static route in R1 to send packets destined to outside world to go through R2. The logical_ip can be a subnet.) When bar1 pings alice1, alice1 receives traffic from 30.0.0.1 case3 : SNAT and DNAT (east-west traffic) When bar1 pings 30.0.0.2, the traffic jumps to the gateway router and loops back to foo1 with a source ip address of 30.0.0.1 Signed-off-by: Gurucharan Shetty <guru@ovn.org> Acked-by: Flavio Fernandes <flavio@flaviof.com>
* ovn-nbctl: Update logical switch commands.Justin Pettit2016-06-113-169/+165
| | | | | | | | | | | | | A few minor changes related to logical switch commands: - Use "ls" instead of "lswitch" to be more consistent with other command changes. - Use commands where possible in ovn unit tests. - Update references from "lswitch" to "ls" (code) or "switch" (user). Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ryan Moats <rmoats@us.ibm.com> Acked-by: Ben Pfaff <blp@ovn.org>
* ovn-nbctl: Update logical switch port commands.Justin Pettit2016-06-113-98/+95
| | | | | | | | | | | | | A few minor changes related to logical switch port commands: - Use "lsp" instead of "lport" to be more consistent with later changes. - Use commands where possible in ovn unit tests. - Update references from "lport" to "lsp" (code) or "port" (user). Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ryan Moats <rmoats@us.ibm.com> Acked-by: Ben Pfaff <blp@ovn.org>
* ovn: Use Logical_Switch_Port in NB.Justin Pettit2016-06-113-160/+163
| | | | | | | | | | | | We have both logical switch and router ports. Router ports are referenced in "Logical_Router_Port" table, so this make it more consistent. Also change internal use of "lport" to "lsp". Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ryan Moats <rmoats@us.ibm.com> Acked-by: Ben Pfaff <blp@ovn.org>
View Lorry Controller Status