summaryrefslogtreecommitdiff
path: root/utilities/ovs-ofctl.8.in
Commit message (Collapse)AuthorAgeFilesLines
* Add OpenFlow extensions for group support in OpenFlow 1.0.Ben Pfaff2018-05-171-7/+7
| | | | | Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
* ovs-ofctl: Clean up Group description in man page.Justin Pettit2018-05-161-67/+65
| | | | | | | | | This fixes a few minor issues in the Group description of the ovs-ofctl man page. It also puts the description of the dump commands in the same section as the other Group-related commands. Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* Clean up some minor spelling and typos.Justin Pettit2018-03-141-1/+1
| | | | | Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* Support accepting and displaying table names in OVS tools.Ben Pfaff2018-02-011-39/+51
| | | | | | | | | | | | | | | | | | | | | | | | OpenFlow has little-known support for naming tables. Open vSwitch has supported table names for ages, but it has never used or displayed them outside of commands dedicated to table manipulation. This commit adds support for table names in ovs-ofctl. When a table has a name, it displays that name in flows and actions, so that, for example, the following: table=1, arp, actions=resubmit(,2) might become: table=ingress_acl, arp, actions=resubmit(,mac_learning) given appropriately named tables. For backward compatibility, only interactive ovs-ofctl commands by default display table names; to display them in scripts, use the new --names option. This feature was inspired by a talk that Kei Nohguchi presented at Open vSwitch 2017 Fall Conference. CC: Kei Nohguchi <kei@nohguchi.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Mark Michelson <mmichels@redhat.com> Reviewed-by: Yifeng Sun <pkusunyifeng@gmail.com>
* nsh: add dec_nsh_ttl actionYi Yang2018-01-111-1/+12
| | | | | | | | | | NSH ttl is a 6-bit field ranged from 0 to 63, it should be decremented by 1 every hop, if it is 0 or it is so after decremented, the packet should be dropped and a packet-in message is sent to main controller. Signed-off-by: Yi Yang <yi.y.yang@intel.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovs-ofctl: Better document stack push and pop actions.Ben Pfaff2017-12-241-15/+24
| | | | | | Requested-by: Leonid Ryzhyk <lryzhyk@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
* ofproto-dpif: Mark packets as "untracked" after call to ct().Justin Pettit2017-08-211-4/+6
| | | | | | | | | | | | | | | | | | | Packet and Connection state is only available to the processing path that follows the "recirc_table" argument of the ct() action. The previous behavior made these states available until the end of the pipeline. This commit changes the behavior so that the Packet and Connection state are cleared for the current processing path whenever ct() is called (in addition to reaching the end of the pipeline.) A future commit will remove the behavior that a "send to controller" action causes all packets for that flow to be handled via the slow-path. The current behavior of connection tracking state makes that difficult due to datapath actions containing multiple OpenFlow rules that may contain different connection tracking states. This change will make that future commit possible. Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Joe Stringer <joe@ovn.org>
* OF support and translation of generic encap and decapJan Scheurich2017-08-021-5/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds support for the OpenFlow actions generic encap and decap (as specified in ONF EXT-382) to the OVS control plane. CLI syntax for encap action with properties: encap(<header>) encap(<header>(<prop>=<value>,<tlv>(<class>,<type>,<value>),...)) For example: encap(ethernet) encap(nsh(md_type=1)) encap(nsh(md_type=2,tlv(0x1000,10,0x12345678),tlv(0x2000,20,0xfedcba9876543210))) CLI syntax for decap action: decap() decap(packet_type(ns=<pt_ns>,type=<pt_type>)) For example: decap() decap(packet_type(ns=0,type=0xfffe)) decap(packet_type(ns=1,type=0x894f)) The first header supported for encap and decap is "ethernet" to convert packets between packet_type (1,Ethertype) and (0,0). This commit also implements a skeleton for the translation of generic encap and decap actions in ofproto-dpif and adds support to encap and decap an Ethernet header. In general translation of encap commits pending actions and then rewrites struct flow in accordance with the new packet type and header. In the case of encap(ethernet) it suffices to change the packet type from (1, Ethertype) to (0,0) and set the dl_type accordingly. A new pending_encap flag in xlate ctx is set to mark that an corresponding datapath encap action must be triggered at the next commit. In the case of encap(ethernet) ofproto generetas a push_eth action. The general case for translation of decap() is to emit a datapath action to decap the current outermost header and then recirculate the packet to reparse the inner headers. In the special case of an Ethernet packet, decap() just changes the packet type from (0,0) to (1, dl_type) without a need to recirculate. The emission of the pop_eth action for the datapath is postponed to the next commit. Hence encap(ethernet) and decap() on an Ethernet packet are OF octions that only incur a cost in the dataplane when a modifed packet is actually committed, e.g. because it is sent out. They can freely be used for normalizing the packet type in the OF pipeline without degrading performance. Signed-off-by: Jan Scheurich <jan.scheurich@ericsson.com> Signed-off-by: Yi Yang <yi.y.yang@intel.com> Signed-off-by: Zoltan Balogh <zoltan.balogh@ericsson.com> Co-authored-by: Zoltan Balogh <zoltan.balogh@ericsson.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovs-ofctl: New option "--no-stats" for "ovs-ofctl dump-flows".Ben Pfaff2017-06-141-2/+12
| | | | | | | | | | | It's pretty common to want to omit statistics from output, to make it easier to read. This commit adds an ovs-ofctl option to make that easy. A lot of the OVS internal tests could use this, too, in place of ofctl_strip. This commit adopts it for a subset. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Aaron Conole <aconole@redhat.com>
* Replace most uses of and references to "ifconfig" by "ip".Ben Pfaff2017-06-011-2/+2
| | | | | | | | | | | | | | | | | | | | | | It's becoming more common that OSes include "ip" but not "ifconfig", so it's best to avoid using the latter. This commit removes most references to "ifconfig" and replaces them by "ip". It also adds a build-time check to make it harder to introduce new uses of "ifconfig". There are important differences between "ifconfig" and "ip": - An "ifconfig" command that sets an IP address also brings the interface up, but a similar "ip addr add" command does not, so it is often necessary (or at least precautionary) to add an "ip link set <dev> up" command. - "ifconfig" can infer a netmask from an IP adddress, but "ip" always assumes /32 if none is given. - "ifconfig" with address 0.0.0.0 removes any configured IP address, but "ip addr add" does not, so "ifconfig <dev> 0.0.0.0" must be replaced by "ip addr del" or "ip addr flush". Signed-off-by: Ben Pfaff <blp@ovn.org>
* Support accepting and displaying port names in OVS tools.Ben Pfaff2017-05-311-1/+31
| | | | | | | | | | | | | | Until now, most ovs-ofctl commands have not accepted names for ports, only numbers, and have not been able to display port names either. It's a lot easier for users if they can use and see meaningful names instead of arbitrary numbers. This commit adds that support. For backward compatibility, only interactive ovs-ofctl commands by default display port names; to display them in scripts, use the new --names option. Signed-off-by: Ben Pfaff <blp@ovn.org> Tested-by: Aaron Conole <aconole@redhat.com>
* ofp-parse: Parse pipeline fields in OF1.5 packet-outYi-Hung Wei2017-05-311-0/+5
| | | | | | | | | This patch adds support for parsing the pipeline match fields of OpenFlow 1.5 packet-out messages. With this patch, we can use ovs-ofctl to specify pipeline fileds for a packet-out message. Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* docs: Improve formatting for daemon options in a few manpages.Ben Pfaff2017-05-181-0/+1
| | | | | | | | | | | | | daemon.man is meant to have a heading above it, but in a few manpages its text was running directly into the previous documentation because this had been overlooked. By adding .PP to daemon.man, we make this problem less severe if the heading is similarly omitted in future manpages, since at least it will then have its own paragraph instead of running into the previous one. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Andy Zhou <azhou@ovn.org>
* OpenFlow: Enable OpenFlow 1.4 by default.Ben Pfaff2017-05-011-1/+3
| | | | | | | Open vSwitch now supports all OpenFlow 1.4 required features, so enable it by default. Signed-off-by: Ben Pfaff <blp@ovn.org>
* ofp-actions: Document that learn(limit=0) is no limit.Joe Stringer2017-05-011-1/+1
| | | | | | | | | The documentation was unclear that specifying a limit of 0 is the same as specifying no limit. Controllers that wish to set a learn limit so that no more than 0 flows are learned may omit the learn action. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* ovs-ofctl: Document group selection algorithm.Ben Pfaff2017-04-241-4/+6
| | | | | Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* bundle: add nw_src/dst hash methodwenxu2017-04-061-2/+6
| | | | | | | Add only nw_src or nw_dst hash feature to bundle and multipath. Signed-off-by: wenxu <wenxu@ucloud.cn> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovs-ofctl: Document reset_counts, no_packet_counts, no_byte_counts.Ben Pfaff2017-03-301-2/+29
| | | | | Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* ofp-actions: Add limit to learn action.Daniele Di Proietto2017-03-161-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds a new feature to the learn actions: the possibility to limit the number of learned flows. To be compatible with users of the old learn action, a new structure is introduced as well as a new OpenFlow raw action number. There's a small corner case when we have to delete the ukey. This happens when: * The learned rule has expired (or has been deleted). * The ukey that learned the rule is still in the datapath. * No packets hit the datapath flow recently. In this case we cannot relearn the rule (because there are no new packets), and the actions might depend on the learn execution, so the only option is to delete the ukey. I don't think this has big performance implications since it's done only for ukey with no traffic. We could also slowpath it, but that will cause an action upcall and the correct datapath actions will be installed later by a revalidator. If we delete the ukey, the next upcall will be a miss upcall and that will immediatedly install the correct datapath flow. Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Force commit.Jarno Rajahalme2017-03-081-0/+12
| | | | | | Userspace support for force commit. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Joe Stringer <joe@ovn.org>
* actions: Add resubmit with conntrack tuple.Jarno Rajahalme2017-03-081-3/+16
| | | | | | | | | | Add resubmit option to use the conntrack original direction tuple swapped with the corresponding packet header fields during the lookup. This could allow the same ACL table be used for admitting return and/or related traffic as is used for admitting the original direction traffic. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Joe Stringer <joe@ovn.org>
* ovs-fields: New manpage to document Open vSwitch and OpenFlow fields.Ben Pfaff2017-01-251-982/+14
| | | | | | | | | There is still plenty of opportunity for improvement, but this new ovs-fields(7) manpage is much more comprehensive than ovs-ofctl(8) could be. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
* New action "ct_clear".Ben Pfaff2017-01-101-0/+6
| | | | | | | | | | | | | | This is being introduced specifically to allow a user of the "clone" action to clear the connection tracking state, but it's implemented as a separate action as a matter of clean design and in case another use case arises later. Reported-by: Mickey Spiegel <mickeys.dev@gmail.com> Reported-at: https://mail.openvswitch.org/pipermail/ovs-dev/2017-January/326981.html Fixes: 7ae62a676d3a ("ofp-actions: Add clone action.") Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Mickey Spiegel <mickeys.dev@gmail.com> Tested-by: Dong Jun <dongj@dtdream.com>
* ofproto-dpif-xlate: Make "clone" save action set and stack.Ben Pfaff2017-01-101-1/+2
| | | | | | | | | | | | This is a design decision but it seems conceptually cleaner than having them leak through into the clone. Reported-by: Mickey Spiegel <mickeys.dev@gmail.com> Reported-at: https://mail.openvswitch.org/pipermail/ovs-dev/2017-January/326981.html Fixes: 7ae62a676d3a ("ofp-actions: Add clone action.") Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Mickey Spiegel <mickeys.dev@gmail.com> Tested-by: Dong Jun <dongj@dtdream.com>
* ovs-ofctl: Document the "clone" action.Ben Pfaff2017-01-051-0/+8
| | | | | | | | This was overlooked when "clone" was introduced. Fixes: 7ae62a676d3a ("ofp-actions: Add clone action.") Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Mickey Spiegel <mickeys.dev@gmail.com>
* ovs-ofctl.8: Document automatic helper assignment.Joe Stringer2017-01-051-0/+10
| | | | | | | | | | | | Due to upstream Linux feature "automatic helper assignment", up until recently when using ct() action with FTP traffic, it has not been necessary to specify the ALG parameter. However, automatic helper assignment was disabled in Linux 4.7 or later, in upstream commit 3bb398d925ec ("netfilter: nf_ct_helper: disable automatic helper assignment"). Document the need for this. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* ofp-parse: Allow match field names in actions and brackets in matches.Jarno Rajahalme2017-01-041-19/+26
| | | | | | | | | | | | | | | | | | | | | | | | Allow using match field names in addition to the canonical register names in actions (including 'load', 'move', 'push', 'pop', 'output', 'multipath', 'bundle_load', and 'learn'). Allow also leaving out the trailing '[]' to indicate full field. These changes allow simpler syntax similar to 'set_field' to be used also elsewhere. Correspondingly, allow the '[start..end]' syntax to be used in matches in addition to the more explicit 'value/mask' notation. For example, to match on the value 2 of the bits 14..15 of NXM_NX_REG0, the match could include: ... reg0[14..15]=2 ... instead of ... reg0=0x8000/0xc000 ... Note that only contiguous masks can be specified with the bracket notation. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* lib: Add support for tftp ct helper.Joe Stringer2017-01-031-4/+11
| | | | | | | | | The kernel datapath provides support for TFTP helpers, so add support for this ALG to the commandline and OpenFlow encoding/decoding. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Daniele Di Proietto <diproiettod@vmware.com> Acked-by: Ben Pfaff <blp@ovn.org>
* doc: Populate 'topics' sectionStephen Finucane2016-12-121-1/+1
| | | | | | | | | | | There are many docs that don't need to kept at the top level, along with many more hidden in random folders. Move them all. This also allows us to add the '-W' flag to Sphinx, ensuring unindexed docs result in build failures. Signed-off-by: Stephen Finucane <stephen@that.guru> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ofp-actions: Add "ingress" and "egress" options to "sample" action.Ben Pfaff2016-11-301-5/+13
| | | | | | | | | | | | | | | | | | | | Before Open vSwitch 2.5.90, IPFIX reports from Open vSwitch didn't include whether the packet was ingressing or egressing the switch. Starting in OVS 2.5.90, this information was available but only accurate if the action included a port number that indicated a tunnel. Conflating these two does not always make sense (not every packet involves a tunnel!), so this patch makes it possible for the sample action to simply say whether it's for ingress or egress. This is difficult to test, since the "tests" directory of OVS does not have a proper IPFIX listener. This passes those tests, plus a couple that just verify that the actions are properly parsed and formatted. Benli did test it end-to-end in a VMware use case. Requested-by: Benli Ye <daniely@vmware.com> Tested-by: Benli Ye <daniely@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Simon Horman <simon.horman@netronome.com>
* Add OpenFlow command to flush conntrack table entries.Justin Pettit2016-09-231-0/+6
| | | | | Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* tun-metadata: Manage tunnel TLV mapping table on a per-bridge basis.Jesse Gross2016-09-191-4/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When using tunnel TLVs (at the moment, this means Geneve options), a controller must first map the class and type onto an appropriate OXM field so that it can be used in OVS flow operations. This table is managed using OpenFlow extensions. The original code that added support for TLVs made the mapping table global as a simplification. However, this is not really logically correct as the OpenFlow management commands are operating on a per-bridge basis. This removes the original limitation to make the table per-bridge. One nice result of this change is that it is generally clearer whether the tunnel metadata is in datapath or OpenFlow format. Rather than allowing ad-hoc format changes and trying to handle both formats in the tunnel metadata functions, the format is more clearly separated by function. Datapaths (both kernel and userspace) use datapath format and it is not changed during the upcall process. At the beginning of action translation, tunnel metadata is converted to OpenFlow format and flows and wildcards are translated back at the end of the process. As an additional benefit, this change improves performance in some flow setup situations by keeping the tunnel metadata in the original packet format in more cases. This helps when copies need to be made as the amount of data touched is only what is present in the packet rather than the maximum amount of metadata supported. Co-authored-by: Madhu Challa <challa@noironetworks.com> Signed-off-by: Madhu Challa <challa@noironetworks.com> Signed-off-by: Jesse Gross <jesse@kernel.org> Acked-by: Ben Pfaff <blp@ovn.org>
* ovs-ofctl.8.in: Fix minor formatting issues.Justin Pettit2016-09-191-3/+3
| | | | | Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* xlate: Use dp_hash for select groups.Jarno Rajahalme2016-09-161-3/+35
| | | | | | | | | | | Add a new select group selection method "dp_hash", which uses minimal number of bits from the datapath calculated packet hash to inform the select group bucket selection. This makes the datapath flows more generic resulting in less upcalls to userspace, but adds recirculation prior to group selection. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* ofp-parse: Harden checking with group selection_method.Jarno Rajahalme2016-09-161-8/+8
| | | | | | | | Only allow fields when "selection_method=hash". Only allow selection_method_param when a non-nil selection_method is given. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* ofproto: Support packet_outs in bundles.Jarno Rajahalme2016-09-141-14/+48
| | | | | | | | | | | | | | | | | | | | | | | Add support for OFPT_PACKET_OUT messages in bundles. While ovs-ofctl already has a packet-out command, we did not have a string parser for it, as the parsing was done directly from command line arguments. This patch adds the string parser for packet-out messages, adds support for it into the 'ovs-ofctl packet-out' command, and adds a new ofctl/packet-out ovs-appctl command that can be used when ovs-ofctl is used as a flow monitor. The old 'ovs-ofctl packet-out syntax is deprecated' and will be removed in a later OVS release. The new packet-out parser is further supported with the ovs-ofctl bundle command, which allows bundles to mix flow mods, group mods and packet-out messages. Also the packet-outs in bundles are only executed if the whole bundle is successful. A failing packet-out translation may also make the whole bundle to fail. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* Add read-only option to ovs-dpctl and ovs-ofctl commands.Ryan Moats2016-08-151-0/+3
| | | | | | | | | ovs-dpctl and ovs-ofctl lack a read-only option to prevent running of commands that perform read-write operations. Add it and the necessary scaffolding to each. Signed-off-by: Ryan Moats <rmoats@us.ibm.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ovs-ofctl: Added clarifications and examples to manpage.Ori Shoshan2016-08-141-2/+22
| | | | | | | | Added a few examples and clarifications to the man page to explain points I had difficulty figuring out without reading code/tests. Signed-off-by: Ori Shoshan <ori.shoshan@guardicore.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ofproto: Support group mods in bundles.Jarno Rajahalme2016-07-291-13/+43
| | | | | | | | | | | | | | | | | | | Allow adding group mods in OpenFlow bundles. Group mods are executed atomically with any flow mods in the same bundle. Mods are executed in order, so that groups appearing in flow actions need to be inserted in to the bundle before the dependent flow mods. ovs-ofctl is enhanced to allow the '--bundle' option with group mod commands. add-groups file format is enhanced to allow each line to be preceded by one of the keywords "add", "modify", "delete", "add_or_mod", "insert_bucket", or "remove_bucket". ovs-ofctl also has a new "bundle" command that reads a file in which each line contains one flow mod or group mod, and then executes them all as a single atomic bundle transaction. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* ovs-ofctl: Fix font in manual.Ben Pfaff2016-07-241-1/+1
| | | | | | | | Without this fix, the remainder of the paragraph appears in bold, which was not intended. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Ryan Moats <rmoats@us.ibm.com>
* ofp-actions: Add extension to support "group" action in OF1.0.Ben Pfaff2016-07-141-2/+4
| | | | | | | | From time to time it confuses users that "group" actions disappear when using OpenFlow 1.0. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* Introduce 128-bit xxregs.Justin Pettit2016-07-121-0/+11
| | | | | | | These are needed to handle IPv6 addresses. Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* ovs-ofctl: Clarify CT action documentation.Jarno Rajahalme2016-07-061-8/+8
| | | | | | | Since the 'commit' flag is required to set the mark and/or labels, the set values are always available for following lookups. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* ofproto: Add relaxed group_mod command ADD_OR_MODJan Scheurich2016-07-021-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for a new Group Mod command OFPGC_ADD_OR_MOD to OVS for all OpenFlow versions that support groups (OF11 and higher). The new ADD_OR_MOD creates a group that does not yet exist (like ADD) and modifies an existing group (like MODIFY). Rational: In OpenFlow 1.x the Group Mod commands OFPGC_ADD and OFPGC_MODIFY have strict semantics: ADD fails if the group exists, while MODIFY fails if the group does not exist. This requires a controller to exactly know the state of the switch when programming a group in order not run the risk of getting an OFP Error message in response. This is hard to achieve and maintain at all times in view of possible switch and controller restarts or other connection losses between switch and controller. Due to the un-acknowledged nature of the Group Mod message programming groups safely and efficiently at the same time is virtually impossible as the controller has to either query the existence of the group prior to each Group Mod message or to insert a Barrier Request/Reply after every group to be sure that no Error can be received at a later stage and require a complicated roll-back of any dependent actions taken between the failed Group Mod and the Error. In the ovs-ofctl command line the ADD_OR_MOD command is made available through the new option --may-create in the mod-group command: $ ovs-ofctl -Oopenflow13 del-groups br-int group_id=100 $ ovs-ofctl -Oopenflow13 mod-group br-int group_id=100,type=indirect,bucket=actions=2 OFPT_ERROR (OF1.3) (xid=0x2): OFPGMFC_UNKNOWN_GROUP OFPT_GROUP_MOD (OF1.3) (xid=0x2): MOD group_id=100,type=indirect,bucket=actions=output:2 $ ovs-ofctl -Oopenflow13 --may-create mod-group br-int group_id=100,type=indirect,bucket=actions=2 $ ovs-ofctl -Oopenflow13 dump-groups br-int OFPST_GROUP_DESC reply (OF1.3) (xid=0x2): group_id=100,type=indirect,bucket=actions=output:2 $ ovs-ofctl -Oopenflow13 --may-create mod-group br-int group_id=100,type=indirect,bucket=actions=3 $ ovs-ofctl -Oopenflow13 dump-groups br-int OFPST_GROUP_DESC reply (OF1.3) (xid=0x2): group_id=100,type=indirect,bucket=actions=output:3 Signed-off-by: Jan Scheurich <jan.scheurich at web.de> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ofp-actions: Add truncate action.William Tu2016-06-241-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | The patch adds a new action to support packet truncation. The new action is formatted as 'output(port=n,max_len=m)', as output to port n, with packet size being MIN(original_size, m). One use case is to enable port mirroring to send smaller packets to the destination port so that only useful packet information is mirrored/copied, saving some performance overhead of copying entire packet payload. Example use case is below as well as shown in the testcases: - Output to port 1 with max_len 100 bytes. - The output packet size on port 1 will be MIN(original_packet_size, 100). # ovs-ofctl add-flow br0 'actions=output(port=1,max_len=100)' - The scope of max_len is limited to output action itself. The following packet size of output:1 and output:2 will be intact. # ovs-ofctl add-flow br0 \ 'actions=output(port=1,max_len=100),output:1,output:2' - The Datapath actions shows: # Datapath actions: trunc(100),1,1,2 Tested-at: https://travis-ci.org/williamtu/ovs-travis/builds/140037134 Signed-off-by: William Tu <u9012063@gmail.com> Acked-by: Pravin B Shelar <pshelar@ovn.org>
* ipfix: Support tunnel information for Flow IPFIX.Benli Ye2016-06-171-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support to export tunnel information for flow-based IPFIX. The original steps to configure flow level IPFIX: 1) Create a new record in Flow_Sample_Collector_Set table: 'ovs-vsctl -- create Flow_Sample_Collector_Set id=1 bridge="Bridge UUID"' 2) Add IPFIX configuration which is referred by corresponding row in Flow_Sample_Collector_Set table: 'ovs-vsctl -- set Flow_Sample_Collector_Set "Flow_Sample_Collector_Set UUID" ipfix=@i -- --id=@i create IPFIX targets=\"IP:4739\" obs_domain_id=123 obs_point_id=456 cache_active_timeout=60 cache_max_flows=13' 3) Add sample action to the flows: 'ovs-ofctl add-flow mybridge in_port=1, actions=sample'('probability=65535,collector_set_id=1, obs_domain_id=123,obs_point_id=456')',output:3' NXAST_SAMPLE action was used in step 3. In order to support exporting tunnel information, the NXAST_SAMPLE2 action was added and with NXAST_SAMPLE2 action in this patch, the step 3 should be configured like below: 'ovs-ofctl add-flow mybridge in_port=1, actions=sample'('probability=65535,collector_set_id=1,obs_domain_id=123, obs_point_id=456,sampling_port=3')',output:3' 'sampling_port' can be equal to ingress port or one of egress ports. If sampling port is equal to output port and the output port is a tunnel port, OVS_USERSPACE_ATTR_EGRESS_TUN_PORT will be set in the datapath flow sample action. When flow sample action upcall happens, tunnel information will be retrieved from the datapath and then IPFIX can export egress tunnel port information. If samping_port=65535 (OFPP_NONE), flow-based IPFIX will keep the same behavior as before. This patch mainly do three tasks: 1) Add a new flow sample action NXAST_SAMPLE2 to support exporting tunnel information. NXAST_SAMPLE2 action has a new added field 'sampling_port'. 2) Use 'other_configure: enable-tunnel-sampling' to enable or disable exporting tunnel information. 3) If 'sampling_port' is equal to output port and output port is a tunnel port, the translation of OpenFlow "sample" action should first emit set(tunnel(...)), then the sample action itself. It makes sure the egress tunnel information can be sampled. 4) Add a test of flow-based IPFIX for tunnel set. How to test flow-based IPFIX: 1) Setup a test environment with two Linux host with Docker supported 2) Create a Docker container and a GRE tunnel port on each host 3) Use ovs-docker to add the container on the bridge 4) Listen on port 4739 on the collector machine and use wireshark to filter 'cflow' packets. 5) Configure flow-based IPFIX: - 'ovs-vsctl -- create Flow_Sample_Collector_Set id=1 bridge="Bridge UUID"' - 'ovs-vsctl -- set Flow_Sample_Collector_Set "Flow_Sample_Collector_Set UUID" ipfix=@i -- --id=@i create IPFIX \ targets=\"IP:4739\" cache_active_timeout=60 cache_max_flows=13 \ other_config:enable-tunnel-sampling=true' - 'ovs-ofctl add-flow mybridge in_port=1, actions=sample'('probability=65535,collector_set_id=1,obs_domain_id=123, obs_point_id=456,sampling_port=3')',output:3' Note: The in-port is container port. The output port and sampling_port are both open flow port and the output port is a GRE tunnel port. 6) Ping from the container whose host enabled flow-based IPFIX. 7) Get the IPFIX template pakcets and IPFIX information packets. Signed-off-by: Benli Ye <daniely@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* ipfix: Add support for exporting ipfix statistics.Benli Ye2016-06-141-1/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is meaningful for user to check the stats of IPFIX. Using IPFIX stats, user can know how much flows the system can support. It is also can be used for performance check of IPFIX. IPFIX stats is added for per IPFIX exporter. If bridge IPFIX is enabled on the bridge, the whole bridge will have one exporter. For flow IPFIX, the system keeps per id (column in Flow_Sample_Collector_Set) per exporter. 1) Add 'ovs-ofctl dump-ipfix-bridge SWITCH' to export IPFIX stats of the bridge which enable bridge IPFIX. The output format: NXST_IPFIX_BRIDGE reply (xid=0x2): bridge ipfix: flows=0, current flows=0, sampled pkts=0, \ ipv4 ok=0, ipv6 ok=0, tx pkts=0 pkts errs=0, ipv4 errs=0, ipv6 errs=0, tx errs=0 2) Add 'ovs-ofctl dump-ipfix-flow SWITCH' to export IPFIX stats of the bridge which enable flow IPFIX. The output format: NXST_IPFIX_FLOW reply (xid=0x2): 2 ids id 1: flows=4, current flows=4, sampled pkts=14, ipv4 ok=13, \ ipv6 ok=0, tx pkts=0 pkts errs=0, ipv4 errs=0, ipv6 errs=0, tx errs=0 id 2: flows=0, current flows=0, sampled pkts=0, ipv4 ok=0, \ ipv6 ok=0, tx pkts=0 pkts errs=0, ipv4 errs=0, ipv6 errs=0, tx errs=0 flows: the number of total flow records, including those exported. current flows: the number of current flow records cached. sampled pkts: Successfully sampled packet count. ipv4 ok: successfully sampled IPv4 flow packet count. ipv6 ok: Successfully sampled IPv6 flow packet count. tx pkts: the count of IPFIX exported packets sent to the collector(s). pkts errs: count of packets failed when sampling, maybe not supported or other error. ipv4 errs: Count of IPV4 flow packet in the error packets. ipv6 errs: Count of IPV6 flow packet in the error packets. tx errs: the count of IPFIX exported packets failed when sending to the collector(s). Signed-off-by: Benli Ye <daniely@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* nat: documentation and parsing fixes.Jarno Rajahalme2016-05-181-1/+76
| | | | | | | Add the missing NAT documentation to ovs-ofctl man page and add validation of the NAT flags to NAT action decoding and parsing. Signed-off-by: Jarno Rajahalme <jarno@ovn.org>
* ofproto-dpif: Do not count resubmit to later tables against limit.Ben Pfaff2016-05-091-4/+24
| | | | | | | | | | | | | | | | | | | | | | | | Open vSwitch must ensure that flow translation takes a finite amount of time. Until now it has implemented this by limiting the depth of recursion. The initial limit, in version 1.0.1, was no recursion at all, and then over the years it has increased to 8 levels, then 16, then 32, and 64 for the last few years. Now reports are coming in that 64 levels are inadequate for some OVN setups. The natural inclination would be to double the limit again to 128 levels. This commit attempts another approach. Instead of increasing the limit, it reduces the class of resubmits that count against the limit. Since the goal for the depth limit is to prevent an infinite amount of work, it's not necessary to count resubmits that can't lead to infinite work. In particular, a resubmit from a table numbered x to a table y > x cannot do this, because any OpenFlow switch has a finite number of tables. Because in fact a resubmit (or goto_table) from one table to a later table is the most common form of an OpenFlow pipeline, I suspect that this will greatly alleviate the pressure to increase the depth limit. Reported-by: Guru Shetty <guru@ovn.org> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Ryan Moats <rmoats@us.ibm.com>
* manpages: Update documentation for ct_* masks.Joe Stringer2016-04-151-2/+2
| | | | | | | | These have been supported all along, but the documentation neglected to mention the fact. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
View Lorry Controller Status