summaryrefslogtreecommitdiff
path: root/ovn
Commit message (Collapse)AuthorAgeFilesLines
* ovn-controller: Don't bind non-existent interfaces.Gurucharan Shetty2017-03-102-1/+3
| | | | | | | | | | | | | | | | | | | | | | There are multiple reasons why a interface can exist in the Open vSwitch database but not exist in the system. For e.g, a restart of a host after a system crash. Ideally, whoever added the interface in the Open vSwitch database should remove those interfaces. But that usually does not happen in practise. Based on experience, I have observerd that on any long lasting OVS installation there are always a couple of stale interfaces. When a stale interface remains in the Open vSwitch database and the container/VM initially backing that stale interface is moved to a different machine, the two ovn-controllers start over-writing the OVN-SB's port_binding table in a loop. This situation can be avoided, if ovn-controller only binds the interfaces that actually have a valid 'ofport'. Signed-off-by: Gurucharan Shetty <guru@ovn.org> Acked-by: Russell Bryant <russell@ovn.org>
* ovn: specify options:nat-addresses as "router"Mickey Spiegel2017-03-072-31/+125
| | | | | | | | | | | | | | | | | | | | | | | | | Currently in OVN, the "nat-addresses" in the "options" column of a logical switch port of type "router" must be specified manually. Typically the user would specify as "nat-addresses" all of the NAT external IP addresses and load balancer IP addresses that have already been specified separately on the router. This patch allows the logical switch port's "nat-addresses" to be specified as the string "router". When ovn-northd sees this string, it automatically copies the following into the southbound Port_Binding's "nat-addresses" in the "options" column: The options:router-port's MAC address. Each NAT external IP address (of any NAT type) specified on the logical router of options:router-port. Each load balancer IP address specified on the logical router of options:router-port. This will cause the controller where the gateway router resides to issue gratuitous ARPs for each NAT external IP address and for each load balancer IP address specified on the gateway router. Signed-off-by: Mickey Spiegel <mickeys.dev@gmail.com> Acked-by: Gurucharan Shetty <guru@ovn.org> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn pacemaker: Pass --db-(n/s)b-addr option when starting ovsdb-serversNuman Siddique2017-02-221-0/+11
| | | | | | | | | | | | | | When pacemaker script, starts the ovsdb-servers in all the nodes, it doesn't pass the --db-(n/s)b-addr=MASTER_IP option. When pacemaker promotes a master, it won't be listening on the master ip address unless "ovn-nbctl set-connection" is used. In this patch this option, along with --db-(n/s)b-create-insecure-remote=yes for "tcp" connection types is passed when starting the OVN ovsdb-servers to overcome this issue. Signed-off-by: Numan Siddique <nusiddiq@redhat.com> Signed-off-by: Andy Zhou <azhou@ovn.org>
* ovn-northd ipam: handle the static MAC updates by the userNuman Siddique2017-02-151-0/+37
| | | | | | | | | | Changing the logical port's address from "MAC1 dynamic" to "MAC2 dynamic" is not handled by ovn-northd. This patch fixes this issue. Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=1408121 Signed-off-by: Numan Siddique <nusiddiq@redhat.com> Signed-off-by: Russell Bryant <russell@ovn.org>
* Remove build-time generated files when "make clean" is run.Justin Pettit2017-02-135-9/+9
| | | | | | | | | | | | "make clean" should remove all files generated by building a program, while "make distclean" should also remove files generated by configuring the program. Previously some generated files during the build process, such as man pages, were left behind when "make clean" was run. This commit only leaves configuration files after "make clean" is run, and removes all other generated files. Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* ofctrl: Free contents of symbol table in ofctrl_destroy().Ben Pfaff2017-02-081-0/+1
| | | | | | | | This fixes a memory leak, although it was not a significant leak because the symbol table is in use until shortly before ovn-controller exits. Reported-by: William Tu <u9012063@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn: Add missing netdev_close in setup_qos.Russell Bryant2017-02-031-0/+2
| | | | | | | | | | We missed calling netdev_close in a couple of places. One was in an error condition rarely hit. The second was just introduced and would be hit in all cases where QoS is not in use. Fixes: dc2dab6e6de5 ("ovn-controller: Configure interface QoS only if it would actually be used.") Signed-off-by: Russell Bryant <russell@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* ovn-trace: Style improvements.Ben Pfaff2017-02-021-3/+9
| | | | | Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Russell Bryant <russell@ovn.org>
* ofp-actions: Fix variable length meta-flow OXMs.Yi-Hung Wei2017-02-011-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, if a flow action that involves a tunnel metadata meta-flow field is dumped from vswitchd, the replied field length in the OXM header is filled with the maximum possible field length, instead of the length configured in the tunnel TLV mapping table. To solve this issue, this patch introduces the following changes. In order to maintain the correct length of variable length mf_fields (i.e. tun_metadata), this patch creates a per-switch based map (struct vl_mff_map) that hosts the variable length mf_fields. This map is updated when a controller adds/deletes tlv-mapping entries to/from a switch. Although the per-swtch based vl_mff_map only hosts tun_metadata for now, it is able to support new variable length mf_fields in the future. With this commit, when a switch decodes a flow action with mf_field, the switch firstly looks up the global mf_fields map to identify the mf_field type. For the variable length mf_fields, the switch uses the vl_mff_map to get the configured mf_field entries. By lookig up vl_mff_map, the switch can check if the added flow action access beyond the configured size of a variable length mf_field, and the switch reports an ofperr if the controller adds a flow with unmapped variable length mf_field. Later on, when a controller request flows from the switch, with the per-switch based mf_fields, the switch will encode the OXM header with correct length for variable length mf_fields. To use the vl_mff_map for decoding flow actions, extract-ofp-actions is updated to pass the vl_mff_map to the required action decoding functions. Also, a new error code is introduced to identify a flow with an invalid variable length mf_field. Moreover, a testcase is added to prevent future regressions. Committer notes: - Factor out common code - Style fixups - Rename OFPERR_NXFMFC_INVALID_VL_MFF -> OFPERR_NXFMFC_INVALID_TLV_FIELD VMWare-BZ: #1768370 Reported-by: Harold Lim <haroldl@vmware.com> Suggested-by: Joe Stringer <joe@ovn.org> Suggested-by: Jarno Rajahalme <jarno@ovn.org> Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com> Signed-off-by: Joe Stringer <joe@ovn.org>
* ovn-controller: Configure interface QoS only if it would actually be used.Ben Pfaff2017-02-011-6/+35
| | | | | | | | | | | | | | | | | | | | | Until now, ovn-controller has unconditionally configured linux-htb on physical interfaces. QoS is pretty much always trouble, but it's even more trouble if we set it up for no good reason. We received a bug report, in particular, that doing this disrupts connectivity in Docker. This commit attempts to make that less likely, by making ovn-controller only configure a qdisc if QoS support has in turn been configured in OVN. The same problems as before will recur if QoS support is actually configured, but at least now there's some purpose, and possibly a symptom that the user can better diagnose ("I turned on QoS and OVN stopped working" is at least a cause-and-effect chain that makes some sense). Reported-by: Ritesh Rekhi <ritesh.rekhi@nutanix.com> Reported-by: Hexin Wang <hexin.wang@nutanix.com> Reported-at: https://mail.openvswitch.org/pipermail/ovs-discuss/2017-February/043564.html Tested-by: Hexin Wang <hexin.wang@nutanix.com> Tested-at: https://mail.openvswitch.org/pipermail/ovs-discuss/2017-February/043575.html Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-controller: Fix memory leak and bug in setup_qos().Ben Pfaff2017-02-011-2/+5
| | | | | | | | | | The caller of netdev_get_qos() is responsible for freeing its 'details' smap. Also, the previous qdisc details, for some arbitrary previous type of QoS, aren't relevant for changing the type of QoS. Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn: fix slave node can not connect to the master node using SSL, for pacemakerGuoshuai Li2017-01-311-4/+56
| | | | | | | | | | The default slave node connect to the master node using TCP, and the pacemaker can not modify the protocol and port of the connection. Add pacemaker parameters to support the connection of the slave node to the master node using a different protocol and port. Signed-off-by: Guoshuai Li <ligs@dtdream.com> Acked-by: Andy Zhou <azhou@ovn.org>
* ovn-controller: Provide the option to set Encap.options:csumNuman Siddique2017-01-313-8/+23
| | | | | | | | | | | | | ovn-controller by default enables tunnel encapsulation checksums for geneve tunnels. With this patch user can set the desired value in Open_vSwitch.external_ids:ovn_encap_csum. This option will be useful in cases where enabling tunnel encapsulation checksums incur significant performance loss due to limitations in checksum offloading capabilities of the nics. Signed-off-by: Numan Siddique <nusiddiq@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-trace: Fix memory leaks.Ben Pfaff2017-01-311-1/+33
| | | | | Suggested-by: Justin Pettit <jpettit@ovn.org> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-nbctl: check for duplicated ACL adding.Han Zhou2017-01-312-2/+17
| | | | | | | | Check for duplicated ACL adding and add option --may-exist for ovn-nbctl acl-add. Signed-off-by: Han Zhou <zhouhan@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-trace: Possible null dereferenceAlin Serdean2017-01-301-1/+1
| | | | | | | Found by inspection. Signed-off-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* ovn: rewrite redirect-chassis description in ovn-nb.xmlMickey Spiegel2017-01-271-18/+18
| | | | | | | | | This optional patch addresses offline comments that the documentation in ovn-nb.xml should not describe southbound constructs or flow details, since it is user facing documentation. Signed-off-by: Mickey Spiegel <mickeys.dev@gmail.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* ovn: ovn-nbctl commands for distributed NATMickey Spiegel2017-01-272-10/+71
| | | | | | | | | This patch adds the new optional arguments "logical_port" and "external_mac" to lr-nat-add, and displays that information in lr-nat-list. Signed-off-by: Mickey Spiegel <mickeys.dev@gmail.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* ovn: distributed NAT flowsMickey Spiegel2017-01-276-80/+821
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch implements the flows required in the ingress and egress pipeline stages in order to support NAT on a distributed logical router. NAT functionality is associated with the logical router gateway port. The flows that carry out NAT functionality all have match conditions on inport or outport equal to the logical router gateway port. There are additional flows that are used to redirect traffic when necessary, using the tunnel key of a "chassisredirect" SB port binding in order to redirect traffic to the instance of the logical router gateway port on the centralized "redirect-chassis". North/south traffic subject to one-to-one "dnat_and_snat" is handled in a distributed manner, with south-to-north traffic going to the local instance of the logical router gateway port. North/south traffic subject to (possibly one-to-many) "snat" is handled in a centralized manner, with south-to-north traffic going to the instance of the logical router gateway port on the "redirect-chassis". North-to-south traffic is directed to the corresponding chassis by limiting ARP responses to the appropriate instance of the logical router gateway port on one chassis. For centralized NAT rules, this is the instance on the "redirect-chassis". For distributed NAT rules, this is the chassis where the corresponding logical port resides, using an ethernet address specified in the NB NAT rule to trigger upstream MAC learning. East/west NAT traffic is all handled in a centralized manner. While it is certainly possible to handle some of this traffic in a distributed manner, the centralized approach keeps the NAT flows simpler and cleaner. The expectation is that east/west NAT traffic is not as important to optimize as north/south NAT traffic, with most east/west traffic not requiring NAT. Automated tests are currently limited to only a single node. The single node automated tests cover both north/south and east/west traffic flows. Signed-off-by: Mickey Spiegel <mickeys.dev@gmail.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* ovn: avoid snat recirc only on gateway routersMickey Spiegel2017-01-273-10/+38
| | | | | | | | | | | | | | | | | | | | | | | | Currently, for performance reasons on gateway routers, ct_snat that does not specify an IP address does not immediately trigger recirculation. On gateway routers, ct_snat that does not specify an IP address happens in the UNSNAT pipeline stage, which is followed by the DNAT pipeline stage that triggers recirculation for all packets. This DNAT pipeline stage recirculation takes care of the recirculation needs of UNSNAT as well as other cases such as UNDNAT. On distributed routers, UNDNAT is handled in the egress pipeline stage, separately from DNAT in the ingress pipeline stages. The DNAT pipeline stage only triggers recirculation for some packets. Due to this difference in design, UNSNAT needs to trigger its own recirculation. This patch restricts the logic that avoids recirculation for ct_snat, so that it only applies to datapaths representing gateway routers. Signed-off-by: Mickey Spiegel <mickeys.dev@gmail.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* ovn: move load balancing flows after NAT flowsMickey Spiegel2017-01-271-70/+70
| | | | | | | | | | This will make it easy for distributed NAT to reuse some of the existing code for NAT flows, while leaving load balancing and defrag as functionality specific to gateway routers. There is no intent to change any functionality in this patch. Signed-off-by: Mickey Spiegel <mickeys.dev@gmail.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* ovn-northd: Add flows in DHCP_OPTIONS pipeline to support renew requestsNuman Siddique2017-01-251-4/+33
| | | | | | | | | | | | | | | | ovn-northd adds the flows to send the DHCPv4 packets to ovn-controller only with the match ip4.src = 0.0.0.0 and ip4.dst = 255.255.255.255. When a DHCPv4 lease is about to expire, before sending a DHCPDISCOVER packet, the client can send a DHCPREQUEST packet to renew its ip with ip4.src set to its offered ip and ip4.dst set to the DHCP server ip or broadcast ip. This patch supports this missing scenario by adding the necessary flows in DHCP_OPTIONS ingress pipeline. Signed-off-by: Numan Siddique <nusiddiq@redhat.com> Signed-off-by: Russell Bryant <russell@ovn.org>
* ovs-fields: New manpage to document Open vSwitch and OpenFlow fields.Ben Pfaff2017-01-252-2/+2
| | | | | | | | | There is still plenty of opportunity for improvement, but this new ovs-fields(7) manpage is much more comprehensive than ovs-ofctl(8) could be. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
* actions: Add new "ct_clear" action.Ben Pfaff2017-01-213-0/+21
| | | | | Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Mickey Spiegel <mickeys.dev@gmail.com>
* actions: Make "next" action able to jump from egress to ingress pipeline.Ben Pfaff2017-01-214-18/+106
| | | | | | | This feature is useful for centralized gateways. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Mickey Spiegel <mickeys.dev@gmail.com>
* actions: Introduce enum ovnact_pipeline.Ben Pfaff2017-01-211-22/+20
| | | | | | | | | This isn't used yet by the actions code, but an upcoming commit will introduce a user. This commit just adjusts ovn-trace to use this common type instead of its own local type. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Mickey Spiegel <mickeys.dev@gmail.com>
* actions: Omit table number when possible for formatting "next" action.Ben Pfaff2017-01-211-22/+22
| | | | | | | | | | | | | | | | Until now, formatting the "next" action has always required including the table number, because the action struct didn't include enough context so that the formatter could decide whether the table number was the next table or some other table. This is more or less OK, but an upcoming commit will add a "pipeline" field to the "next" action, which means that the same policy there would require that the pipeline always be printed. That's a little obnoxious because 99+% of the time, the pipeline to be printed is the same pipeline that the flow is in and printing it would be distracting. So it's better to store some context to help with formatting. This commit begins adopting that policy for the existing table number field. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Mickey Spiegel <mickeys.dev@gmail.com>
* actions: Separate action structures for "next" and "ct_next".Ben Pfaff2017-01-211-3/+8
| | | | | | | | | These actions aren't very similar but until now they both had the same action structure. These structures are going to diverge in an upcoming commit, so separate them now. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Mickey Spiegel <mickeys.dev@gmail.com>
* actions: Add new OVN action "clone".Ben Pfaff2017-01-213-14/+76
| | | | | Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Mickey Spiegel <mickeys.dev@gmail.com>
* actions: Make "free" functions per-struct, not per-action.Ben Pfaff2017-01-211-73/+20
| | | | | | | | | | | In some cases multiple kinds of OVN action share the same structure. In all of these cases, a given kind of structure is freed one particular way (it would be confusing if this were not the case), so there's no benefit in having per-action free functions. Therefore, this commit switches to a free function per structure type. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Mickey Spiegel <mickeys.dev@gmail.com>
* ovn-trace: Fix selection of table that "next" jumps to.Ben Pfaff2017-01-211-2/+2
| | | | | | | | | The common case is that "next" advances to the next table, but it can jump to any table. Reported-by: Mickey Spiegel <mickeys.dev@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Mickey Spiegel <mickeys.dev@gmail.com>
* actions: Make "arp { drop; };" acceptable.Ben Pfaff2017-01-201-10/+6
| | | | | | | | | | | | Before this commit, the OVN action parser would accept "arp {};" and then the formatter would format it back as "arp { drop; };", but the parser didn't accept the latter. There were basically two choices: make the parser accept "arp { drop; };" or make the formatter output "arp {};" (or both). This patch does (only) the former, and adds a test to avoid regression. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Mickey Spiegel <mickeys.dev@gmail.com>
* lex: Make lexer_force_match() work for LEX_T_END.Ben Pfaff2017-01-201-4/+9
| | | | | | | | | | | | Without this change, lexer_force_match(lex, LEX_T_END) mostly works, except that in the failure case it emits an error that says "expecting `$'", which is a surprising error message. Arguably, lexer_force_end() could be removed entirely, but I don't see a real problem with the existing arrangement. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Mickey Spiegel <mickeys.dev@gmail.com>
* actions: Fix "arp" and "nd_na" followed by another action.Ben Pfaff2017-01-201-3/+5
| | | | | | | | | | | | OVN logical actions are supposed to be padded to a multiple of 8 bytes, but the code for parsing "arp" and "nd_na" actions didn't do this properly. The result was that it worked OK if one of these actions was the last one in a sequence of logical actions, but failed badly if they were in the middle. This commit fixes the problem, adds assertions to make it harder for the problem to recur, and adds a test. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Mickey Spiegel <mickeys.dev@gmail.com>
* ovn: Introduce distributed gateway port and "chassisredirect" port bindingMickey Spiegel2017-01-1910-23/+611
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently OVN distributed logical routers achieve reachability to physical networks by passing through a "join" logical switch to a centralized gateway router, which then connects to another logical switch that has a localnet port connecting to the physical network. This patch adds logical port and port binding abstractions that allow an OVN distributed logical router to connect directly to a logical switch that has a localnet port connecting to the physical network. In this patch, this logical router port is called a "distributed gateway port". The primary design goal of distributed gateway ports is to allow as much traffic as possible to be handled locally on the hypervisor where a VM or container resides. Whenever possible, packets from the VM or container to the outside world should be processed completely on that VM's or container's hypervisor, eventually traversing a localnet port instance on that hypervisor to the physical network. Whenever possible, packets from the outside world to a VM or container should be directed through the physical network directly to the VM's or container's hypervisor, where the packet will enter the integration bridge through a localnet port. However, due to the implications of the use of L2 learning in the physical network, as well as the need to support advanced features such as one-to-many NAT (aka IP masquerading), where multiple logical IP addresses spread across multiple chassis are mapped to one external IP address, it will be necessary to handle some of the logical router processing on a specific chassis in a centralized manner. For this reason, the user must associate a chassis with each distributed gateway port. In order to allow for the distributed processing of some packets, distributed gateway ports need to be logical patch ports that effectively reside on every hypervisor, rather than "l3gateway" ports that are bound to a particular chassis. However, the flows associated with distributed gateway ports often need to be associated with physical locations. This is implemented in this patch (and subsequent patches) by adding "is_chassis_resident()" match conditions to several logical router flows. While most of the physical location dependent aspects of distributed gateway ports can be handled by restricting some flows to specific chassis, one additional mechanism is required. When a packet leaves the ingress pipeline and the logical egress port is the distributed gateway port, one of two different sets of actions is required at table 32: - If the packet can be handled locally on the sender's hypervisor (e.g. one-to-one NAT traffic), then the packet should just be resubmitted locally to table 33, in the normal manner for distributed logical patch ports. - However, if the packet needs to be handled on the chassis associated with the distributed gateway port (e.g. one-to-many SNAT traffic or non-NAT traffic), then table 32 must send the packet on a tunnel port to that chassis. In order to trigger the second set of actions, the "chassisredirect" type of southbound port_binding is introduced. Setting the logical egress port to the type "chassisredirect" logical port is simply a way to indicate that although the packet is destined for the distributed gateway port, it needs to be redirected to a different chassis. At table 32, packets with this logical egress port are sent to a specific chassis, in the same way that table 32 directs packets whose logical egress port is a VIF or a type "l3gateway" port to different chassis. Once the packet arrives at that chassis, table 33 resets the logical egress port to the value representing the distributed gateway port. For each distributed gateway port, there is one type "chassisredirect" port, in addition to the distributed logical patch port representing the distributed gateway port. A "chassisredirect" port represents a particular instance, bound to a specific chassis, of an otherwise distributed port. A "chassisredirect" port is associated with a chassis in the same manner as a "l3gateway" port. However, unlike "l3gateway" ports, "chassisredirect" ports have no associated IP or MAC addresses, and "chassisredirect" ports should never be used as the "inport". Any pipeline stages that depend on port specific IP or MAC addresses should be carried out in the context of the distributed gateway port's logical patch port. Although the abstraction represented by the "chassisredirect" port binding is generalized, in this patch the "chassisredirect" port binding is only created for NB logical router ports that specify the new "redirect-chassis" option. There is no explicit notion of a "chassisredirect" port in the NB database. The expectation is when capabilities are implemented that take advantage of "chassisredirect" ports (e.g. distributed gateway ports), flows specifying a "chassisredirect" port as the outport will be added as part of that capability. Signed-off-by: Mickey Spiegel <mickeys.dev@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn: add is_chassis_resident match expression componentMickey Spiegel2017-01-196-14/+222
| | | | | | | | | | | | | | | | | | | | | This patch introduces a new match expression component is_chassis_resident(). Unlike match expression comparisons, is_chassis_resident is not pushed down to OpenFlow. It is a conditional that is evaluated in the controller during expr_simplify(), when it is replaced by a boolean expression. The is_chassis_resident conditional evaluates to "true" when the specified string identifies a port name that is resident on this controller chassis, i.e., the corresponding southbound database Port_Binding has a chassis column that matches this chassis. Otherwise it evaluates to "false". This allows higher level features to specify flows that are only installed on some chassis rather than on all chassis with the corresponding datapath. Suggested-by: Ben Pfaff <blp@ovn.org> Signed-off-by: Mickey Spiegel <mickeys.dev@gmail.com> Acked-by: Ben Pfaff <blp@ovn.org> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-nbctl: Ability to bootstrap CA certificate.Gurucharan Shetty2017-01-192-0/+7
| | | | | | | | | | | | | Utilities like ovs-vsctl have the ability to bootstrap CA certificate. It looks useful for ovn-nbctl to have the same ability too. One could connect over to OVN NB database over SSL for transactions without having to copy over the certificate being used by ovsdb-server backing OVN NB. Signed-off-by: Gurucharan Shetty <guru@ovn.org> Acked-by: Lance Richardson <lrichard@redhat.com> Acked-by: Ben Pfaff <blp@ovn.org>
* ovn-ctl: Add bootstrap ovn-controller CA certificate option.Gurucharan Shetty2017-01-182-2/+19
| | | | | | | | | | | | | ovn-controller accepts the option --bootstrap-ca-cert. With this commit, ovn-ctl will let user pass a value for that via --ovn-controller-ssl-bootstrap-ca-cert option. Bootstrapping is useful for ovn-controller as you don't have to copy the controller's certificate (self-signed or otherwise) to every host. Signed-off-by: Gurucharan Shetty <guru@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org> Acked-by: Lance Richardson <lrichard@redhat.com>
* libX: add new release / version info tagsAaron Conole2017-01-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit uses the $PACKAGE_VERSION automake variable to construct a release and version info combination which sets the library name to be: libfoo-$(OVS_MAJOR_VERSION).so.$(OVS_MINOR_VERSION).0.$(OVS_MICRO_VERSION) where formerly, it was always: libfoo.so.1.0.0 This allows releases of Open vSwitch libraries to reflect which specific versions they came with, and sets up a psuedo ABI-versioning scheme. In this fashion, future releases of Open vSwitch could be installed alongside older releases, allowing 3rd party utilities linked against previous versions to continue to function. ex: $ ldd /path/to/utility linux-vdso.so.1 (0x00007ffe92cf6000) libopenvswitch-2.so.6 => /lib64/libopenvswitch-2.so.6 (0x00007f733b7a3000) libssl.so.10 => /lib64/libssl.so.10 (0x00007f733b530000) ... Note the library name and version information. Signed-off-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn: document logical routers and logical patch ports in ovn-architectureMickey Spiegel2017-01-171-8/+140
| | | | | | | | This patch adds a description of logical routers and logical patch ports, including gateway routers, to ovn/ovn-architecture.7.xml. Signed-off-by: Mickey Spiegel <mickeys.dev@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn: specify addresses of type "router" lsps as "router"Mickey Spiegel2017-01-134-2/+61
| | | | | | | | | | | | | | | | | | | | Currently in OVN, when a logical switch port of type "router" is created, the MAC and optionally IP addresses of the peer logical router port must be specified again as the addresses of the logical switch port. This patch allows the logical switch port's addresses to be specified as the string "router", rather than explicitly copying the logical router port's MAC and optionally IP addresses. The router addresses are used to populate the logical switch's destination lookup, and to populate op->lsp_addrs in ovn-northd.c, which in turn is used to generate logical switch ARP and ND replies. Since ipam already looks at logical router ports, the only ipam modification necessary is to skip logical switch ports with addresses "router". Signed-off-by: Mickey Spiegel <mickeys.dev@gmail.com> Acked-by: Ben Pfaff <blp@ovn.org> Signed-off-by: Ben Pfaff <blp@ovn.org>
* db-ctl-base: Always support all tables in schema.Ben Pfaff2017-01-132-108/+30
| | | | | | | | | | | | | | | | | When one adds a new table to a database schema, it's easy to forget to add the table to the list of tables in the *ctl.c program. When this happens, the database commands for that program don't work on that table at all, even for commands like "list" and "create" that don't need any special help. This patch fixes that problem, by making sure that db-ctl-base always has the complete list of tables. Previously, each ctl_table_class pointed directly to the corresponding ovsdb_idl_table_class. With this patch, there are instead two parallel arrays, one of ovsdb_idl_table_classes and the other of ctl_table_classes. This change accounts for the bulk of the change to the db-ctl-base code. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Lance Richardson <lrichard@redhat.com>
* ovn-controller: Clear conntrack state inside clone action.Ben Pfaff2017-01-101-1/+2
| | | | | | | | | | | | | | | ovn-controller implements traversal from one OVN logical network to another using the Open vSwitch "clone" action. The "clone" action preserves connection tracking state, which is confusing for passing from one logical datapath to another because this state is only relevant for a single logical datapath and does not make sense in the new one. This commit fixes a problem sometimes seen by ensuring that the connection tracking state is cleared when these traversals happen. Reported-by: Numan Siddique <nusiddiq@redhat.com> Reported-at: https://mail.openvswitch.org/pipermail/ovs-dev/2017-January/326948.html Fixes: f1a8bd06d58f ("ovn-controller: Drop most uses of OVS patch ports.") Tested-by: Dong Jun <dongj@dtdream.com>
* ovn-nbctl: Fix documentation for "ovn-nbctl acl-add".zhaojingjing2017-01-061-1/+1
| | | | | | | | | | The range of "PRIORITY" for "ovn-nbctl acl-add " command is 1 to 65534 in ovn-nbctl.8.xml",When configuring this command, it indicates that " priority must in range 0...32767".The range of priority is inconsistent in "ovn-nbctl.8.xml" and "ovn-nbctl.c". Signed-off-by: zhaojingjing <zhao.jingjing1@zte.com.cn> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovn-nbctl: Specify the range of the tag for "ovn-nbctl lsp-add" command.zhaojingjing2017-01-062-2/+5
| | | | | | | | When configuring the wrong tag for "ovn-nbctl lsp-add" command， it shows "invalid tag". The range of the tag is not known. Signed-off-by: zhaojingjing <zhao.jingjing1@zte.com.cn> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ofctrl: Fix warning from sparse.Ben Pfaff2017-01-051-1/+1
| | | | | | | | | We've used sparse "bitwise" annotations to make ofp_ports into a different type, so this is required to avoid a sparse warning. Fixes: 714651c7db6a ("ovn-controller: Introduce "inject-pkt" ovs-appctl command.") Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
* ofctrl: Fix version check in ofctrl_inject_packet().Ben Pfaff2017-01-051-2/+2
| | | | | | | | | | "enum ofp_version" is unsigned in the System V ABI used by Linux, so it will never be less than 0, so an rconn with an unnegotiated version will never be found properly. This fixes the problem. Fixes: 714651c7db6a ("ovn-controller: Introduce "inject-pkt" ovs-appctl command.") Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
* ovn-controller: Introduce "inject-pkt" ovs-appctl command.Justin Pettit2017-01-055-8/+181
| | | | | | | | | Add the ability to inject a packet into the connected Open vSwitch instance. This is primarily useful for testing when a test requires side-effects from an actual packet, so ovn-trace won't do. Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* ovn-controller: Remove "_p" from pointer arguments in lflow.c.Justin Pettit2017-01-051-11/+11
| | | | | | | This more closely follows our coding standards. Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* ovn-controller: Expose address sets to the main loop.Justin Pettit2017-01-053-32/+32
| | | | | | | | Other functions in the main loop will need access to address sets in a future commit. Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
View Lorry Controller Status