Ben Pfaff [Mon, 11 Oct 2010 17:28:28 +0000 (10:28 -0700)]
vswitchd: Support changing the type of a bridge port.
Until now, if the type of a bridge port changed in the database, then
ovs-vswitchd would report an error and keep it the same type. This commit
changes the behavior to something more reasonable: the old datapath port is
deleted and replaced by a new datapath port of the correct type.
Jesse Gross [Wed, 6 Oct 2010 02:14:21 +0000 (19:14 -0700)]
tunneling: Internal dev vport can be NULL.
Commit 4bee42 "tunnel: Correctly check for internal device." fixed
the call to internal_dev_get_vport() by first checking that the
device is in fact an internal device. However, it also accidentally
removed the check ensuring that the vport itself was not NULL. This
adds that check back by redoing the previous change in a more robust
manner.
Signed-off-by: Jesse Gross <jesse@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
Justin Pettit [Fri, 8 Oct 2010 20:50:16 +0000 (13:50 -0700)]
netdev: Don't divide by zero when "linux-htb" zero min-rate is used
A "min-rate" of zero for the "linux-htb" QoS type would cause a divide
by zero exception. This patch prevents that by just returning zero. A
later patch will try to enforce reasonable values for "min-rate".
Justin Pettit [Fri, 8 Oct 2010 06:30:06 +0000 (23:30 -0700)]
classifier: Add missing argument in CLASSIFIER_FOR_EACH_EXACT_RULE_SAFE
The CLASSIFIER_FOR_EACH_EXACT_RULE_SAFE macro was missing its "MEMBER"
argument. It doesn't currently cause any problems because no one uses
the macro.
Justin Pettit [Fri, 8 Oct 2010 06:51:02 +0000 (23:51 -0700)]
ovs-openflowd: Don't segfault when no controllers specified
If no controllers are specified on the command-line, ovs-openflowd adds
a couple of its own. The code that accounts for the controllers
correctly allocated space for them, but used the command-line count to
determine how many to set. This led to a segfault when later code tried
to dereference them.
Ben Pfaff [Thu, 7 Oct 2010 23:44:32 +0000 (16:44 -0700)]
ofproto: Drop flows from datapath more quickly under heavy load.
In normal operation it makes sense to keep track of all of the flows that
have been seen recently and to cache all of them in the kernel. Under
unusual conditions, such as those caused by network scanning tools or by an
actual targeted DoS attack against the vswitch, the number of flows can
explode to extremely high numbers (hundreds of thousands or more). In such
a situation the vswitch needs to guard against memory exhaustion by
expiring flows more quickly and more often. This commit implements an
inexpensive technique for determining which flows should be dropped in such
a situation.
Ben Pfaff [Wed, 29 Sep 2010 20:04:03 +0000 (13:04 -0700)]
ofproto: Iterate through exact-match rules first during expiration.
A wildcarded flow is idle only if all of its subrules have expired because
they were idle, so unless we expire exact-match rules first it is possible
that a wildcarded flow fails to expire as soon as it should.
(The current implementation of classifier_for_each() iterates through
exact-match rules before wildcarded rules, but nothing in the interface
guarantees that.)
Ben Pfaff [Wed, 29 Sep 2010 19:54:05 +0000 (12:54 -0700)]
ofproto: Drop unneeded poll_immediate_wake().
This poll_immediate_wake() is unnecessary because netflow_run() is always
called afterward within the same poll loop. It's better to delete it, to
avoid wasting CPU.
Ben Pfaff [Thu, 30 Sep 2010 17:13:47 +0000 (10:13 -0700)]
ofproto: Fix effective memory leak for uninstallable flows.
In one or two corner cases, flows cannot be installed because every packet
in the flow must be processed by userspace. The code to expire rules was
ignoring these uninstallable rules, and thus they would never get freed,
even after they became idle. This commit fixes the problem.
Ben Pfaff [Wed, 6 Oct 2010 21:39:56 +0000 (14:39 -0700)]
ofproto: Group functions related to flow expiration together.
This should be a purely stylistic change, with no effect on behavior.
This commit changes the callback pointer passed to the
classifier_for_each() from a pointer to an ofproto to a pointer to a
structure that includes an ofproto. Future commits planned will add
more members to this new structure.
Ben Pfaff [Wed, 6 Oct 2010 21:21:47 +0000 (14:21 -0700)]
ofproto: Avoid wasting memory malloc()'ing empty action sets for subrules.
GNU libc treats malloc(0) as malloc(1). Subrules always have an n_actions
of 0, so this code was wasting time and memory for subrules. This commit
stops doing that.
Also audits and fixes some very pedantic potential problems with null
pointers; e.g. the C standard says that NULL may not be compared with the
< operator, even if both arguments are null, and it also says that a null
pointer may not be passed to memcpy() or memcmp(), even if the length is
zero.
Jesse Gross [Wed, 6 Oct 2010 01:09:00 +0000 (18:09 -0700)]
datapath: Force our include directory to be first.
XenServer puts our header files in the standard system search path
by default. This is normally OK, except when we introduce new things
which aren't in those headers. Since the system picks up the older files
first this leads to undefined sysmbols.
Ethan Jackson [Fri, 1 Oct 2010 02:29:27 +0000 (02:29 +0000)]
xenserver: ovs-external-ids log to file instead of syslog
ovs-external-ids was crashing on startup because it was brought up
before /dev/log exists. The simplest solution to this problem is
to have it log to /var/log/openvswitch/ovs-external-ids.log . This
is consistent with vswitchd and ovsdb-server.
Jesse Gross [Sat, 2 Oct 2010 02:21:08 +0000 (19:21 -0700)]
tunnel: Correctly check for internal device.
With header caching we check to see if the next device in the stack
is an OVS device and, if so, cache that flow as well. However, the
test for this called internal_dev_get_vport() assuming that it would
return NULL if the device is not an internal device. It doesn't,
however, it just returns the offset from the device where the vport
data structure would be if it were an internal device. This changes
it to explicitly check for an internal device first to avoid a panic.
Justin Pettit [Sat, 2 Oct 2010 07:27:23 +0000 (00:27 -0700)]
Add Nicira extension for modifying queue without transmitting
The OpenFlow OFPAT_ENQUEUE action sets a queue id and outputs the packet
in one shot. There are times in which the queue should be set, but the
output port is not yet known. This commit adds the NXAST_SET_QUEUE and
NXAST_POP_QUEUE Nicira extension actions to modify the queue
configuration without requiring a port argument.
CC: Jeremy Stribling <strib@nicira.com> CC: Keith Amidon <keith@nicira.com>
If the netflow byte counter is UINT64_MAX, or at any rate much larger than
UINT32_MAX, netflow_expire() could loop for a very long time. This commit
avoids that case.
This is only a theoretical bug fix. I don't know of any actual bug that
would cause a counter to be that high.
Ben Pfaff [Fri, 1 Oct 2010 20:41:40 +0000 (13:41 -0700)]
ovs-controller: Improve QoS abilities.
This makes it a little easier to test Open vSwitch QoS features using
ovs-controller, by making it possible to assign queues on the basis of
input port, instead of just allowing a single queue for a whole switch.
Ben Pfaff [Thu, 23 Sep 2010 21:08:13 +0000 (14:08 -0700)]
ovs-controller: Make --with-flows read the file only once, at startup.
A couple of people have reported that ovs-controller --with-flows is
confusing. This seems to be because it doesn't read the file with the
flows until the first connection from a switch. Then, if the file has a
syntax error, it exits.
This commit changes the behavior so that it reads the file immediately at
startup instead.
Linux kernel queue numbers are one greater than OpenFlow queue numbers, for
HTB anyhow. The code to dump queues wasn't compensating for this, so this
commit fixes it up.
Ben Pfaff [Mon, 19 Jul 2010 20:46:52 +0000 (13:46 -0700)]
util: New macro OBJECT_CONTAINING.
This macro is a variant on CONTAINER_OF that takes an object pointer
instead of a type name as its second argument. In the following commit
this will simplify many users of CONTAINER_OF.
Ben Pfaff [Mon, 19 Jul 2010 19:57:22 +0000 (12:57 -0700)]
ofproto: Use hash table instead of sparse array for ofports.
The main advantage of a sparse array over a hash table is that it can be
iterated in numerical order. But the OVS implementation of sparse arrays
is quite expensive in terms of memory: on a 32-bit system, a sparse array
with exactly 1 nonnull element has 512 bytes of overhead. In this case,
the sparse array's property of iteration in numerical order is not
important, so this commit converts it to a hash table to save memory.
Ben Pfaff [Mon, 19 Jul 2010 18:43:05 +0000 (11:43 -0700)]
sflow: Use hash table instead of sparse array for sflow ports.
The main advantage of a sparse array over a hash table is that it can be
iterated in numerical order. But the OVS implementation of sparse arrays
is quite expensive in terms of memory: on a 32-bit system, a sparse array
with exactly 1 nonnull element has 512 bytes of overhead. In this case,
the sparse array's property of iteration in numerical order is not
important, so this commit converts it to a hash table to save memory.
Ben Pfaff [Mon, 19 Jul 2010 18:23:05 +0000 (11:23 -0700)]
bridge: Use hash table instead of sparse array for bridge ports.
The main advantage of a sparse array over a hash table is that it can be
iterated in numerical order. But the OVS implementation of sparse arrays
is quite expensive in terms of memory: on a 32-bit system, a sparse array
with exactly 1 nonnull element has 512 bytes of overhead. In this case,
the sparse array's property of iteration in numerical order is not
important, so this commit converts it to a hash table to save memory.
Ben Pfaff [Mon, 19 Jul 2010 18:21:59 +0000 (11:21 -0700)]
netdev-linux: Use hash table instead of sparse array for QoS classes.
The main advantage of a sparse array over a hash table is that it can be
iterated in numerical order. But the OVS implementation of sparse arrays
is quite expensive in terms of memory: on a 32-bit system, a sparse array
with exactly 1 nonnull element has 512 bytes of overhead. In this case,
the sparse array's property of iteration in numerical order is not
important, so this commit converts it to a hash table to save memory.
Ethan Jackson [Tue, 28 Sep 2010 18:58:00 +0000 (11:58 -0700)]
debian: openvswitch-common ethtool should not be required
The ethtool package is only used to help ovs-bugtool create bug
reports and does not prevent the script from running if it's
missing. Making it a requirement for installation is a bit
draconian.
debian: Restart ovs-monitor-ipsec when --monitor specified
The OVS Python daemon library will restart a process when started with
"--monitor" that exits with RESTART_EXIT_CODE. Have ovs-monitor-ipsec
exit with this code when an uncaught exception occurs.
Ethan Jackson [Wed, 22 Sep 2010 19:40:39 +0000 (12:40 -0700)]
xenserver: monitor-external-ids should run with --monitor
The init script starts monitor-external-ids with --monitor when
configured to do so. Also made changes to guarantee that --monitor
actually restarts ovs-external-ids.
vswitch: Disable header-caching when IPsec is enabled
Header caching speeds up sending tunneled traffic by bypassing the Linux
IP stack. This also causes it to bypass IPsec processing, which will
break connectivity. This commit disables header caching when IPsec is
enabled.
debian: Use DODTIME instead of DIETIME in init scripts
Brad pointed out that openvswitch-ipsec init script defined the variable
DIETIME but attempted to use it as DODTIME. This commit uses DODTIME,
since it's the name used by the openvswitch-switch init script. The
openvswitch-controller init script had the same issue.
As suggested by Ben, the "s" suffixes are removed from sleep commands,
since they are a GNU extension.
Ben Pfaff [Wed, 22 Sep 2010 23:45:30 +0000 (16:45 -0700)]
ovs-vswitchd: Export system stats through Open_vSwitch table.
This is intended to provide controllers enough information to determine
whether a switch is overloaded or busted, to enable them to spread load
fairly across a group of switches.
Ben Pfaff [Thu, 23 Sep 2010 16:39:47 +0000 (09:39 -0700)]
daemon: Fix behavior of read_pidfile() for our own pidfile.
Opening a file descriptor and then closing it always discards any locks
held on the underlying file, even if the file is still open as another file
descriptor. This meant that calling read_pidfile() on the process's own
pidfile would discard the lock and make other OVS processes think that the
process had died. This commit fixes the problem.
Simon Horman [Thu, 23 Sep 2010 01:55:15 +0000 (10:55 +0900)]
debian: update copyright for xenserver/
Further to the recent work done by Ben Pfaff and Ian Campbell to
clarify the license of all the files in xenserver/ the debian/copyright.in
file seems to need updating.
Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Ben Pfaff <blp@nicira.com>
Ethan Jackson [Wed, 22 Sep 2010 06:57:13 +0000 (23:57 -0700)]
xenserver: Only put the primary XenServer UUID in default bridge-id
This patch defensively guarantees that the first id in
xs-network-uuids will belong to the primary network (as opposed to
a vlan). Given that the primary network id comes first, it parses
xs-network-ids and only copies the primary id to bridge-id when
monitor-external-ids is run.
Feature #3647
Signed-off-by: Ethan Jackson <ethan@nicira.com> Reviewed-by: Ben Pfaff <blp@nicira.com>
The ovs-monitor-ipsec daemon monitors the Interface table for GRE
entries. If an entry specifies other-config parameters "ipsec-local-ip"
and ("ipsec-psk" or "ipsec-cert"), it will create the appropriate
security associations so that all GRE traffic to the remote host will be
encrypted. In order for the two GRE tunnels to communicate, both sides
need to be configured for IPsec with appropriate authentication.
Currently, ovs-monitor-ipsec does not support certificate authentication
or ensure that an interface is actually attached to a bridge. Both of
these issues will be addressed in a forthcoming patch.
NB: While GRE-over-IPsec should work on any system with a relatively
recent racoon and setkey, it has only been tested on Debian. As such,
only Debian packaging has been provided.
Jesse Gross [Mon, 30 Aug 2010 22:34:04 +0000 (15:34 -0700)]
tunneling: Allow disabling tunnel header caching.
Tunnel header caching significantly improves performance by bypassing
much of the transmit path. However, in some special cases or for
debugging it may be desirable to traverse the entire IP stack. This
exposes that as an option (default is to enable header caching).
Signed-off-by: Jesse Gross <jesse@nicira.com> Reviewed-by: Ben Pfaff <blp@nicira.com>
Jesse Gross [Fri, 27 Aug 2010 20:55:02 +0000 (13:55 -0700)]
datapath: Add tunnel header caching.
On the transmit path we generate essentially the same tunnel header
for every packet to a given destination. However, each packet must
have the headers assembled in pieces, lookup the destination in the
routing table, and lookup the flow in OVS. This avoids that extra
work by caching all of the header and output path information and
only rebuilding it when something actually changes.
This optimization reduces CPU load on transmit by approximately 13%.
Signed-off-by: Jesse Gross <jesse@nicira.com> Reviewed-by: Ben Pfaff <blp@nicira.com>
Jesse Gross [Tue, 31 Aug 2010 22:38:25 +0000 (15:38 -0700)]
datapath: Backport workqueue functions.
An upcoming commit will use some workqueue functions that weren't
available on earlier kernels, so this backports those functions.
The backporting uses timers instead of delayed work queues because
the earlier versions of work queues have some unsafe corner cases.
In addition, this removes some unused work queue backporting code
that is no longer used because it is potentially unsafe.
Note that this commit changes the behavior of work queues: normally
they run in process context but the backported version runs in
softirq context.
Signed-off-by: Jesse Gross <jesse@nicira.com> Reviewed-by: Ben Pfaff <blp@nicira.com>
Jesse Gross [Sun, 29 Aug 2010 21:28:58 +0000 (14:28 -0700)]
datapath: Move is_frag out of struct ovs_skb_cb.
is_frag is only used for communication between two functions, which
means that it doesn't really need to be in the SKB CB. This wouldn't
necessarily be a problem except that there are also a number of other
paths that lead to this being uninitialized. This isn't a problem
now but uninitialized memory seems dangerous and there isn't much
upside.
Signed-off-by: Jesse Gross <jesse@nicira.com> Reviewed-by: Ben Pfaff <blp@nicira.com>
Jesse Gross [Sun, 29 Aug 2010 17:49:11 +0000 (10:49 -0700)]
datapath: Enable usage of cached flows.
An upcoming commit will add support for supplying cached flows for
packets entering the datapath. This adds the code in the datapath
itself to recognize these cached flows and use them instead of
extracting the flow fields and doing a lookup.
Signed-off-by: Jesse Gross <jesse@nicira.com> Reviewed-by: Ben Pfaff <blp@nicira.com>
Jesse Gross [Sun, 29 Aug 2010 16:49:51 +0000 (09:49 -0700)]
datapath: Add ref counting for flows.
Currently flows are only used within the confines of one
rcu_read_lock()/rcu_read_unlock() session. However, with the
addition of header caching we will need to hold references to flows
for longer periods of time. This adds support for that by adding
refcounts to flows. RCU is still used for normal packet handling
to avoid a performance impact from constantly updating the refcount.
However, instead of directly freeing the flow after a grace period
we simply decrement the refcount.
Signed-off-by: Jesse Gross <jesse@nicira.com> Reviewed-by: Ben Pfaff <blp@nicira.com>
As the process to allocate a flow becomes more involved it becomes
more cumbersome for the code to be mixed in with the general
datapath so split it out into a new function.
Signed-off-by: Jesse Gross <jesse@nicira.com> Reviewed-by: Ben Pfaff <blp@nicira.com>
Ben Pfaff [Wed, 22 Sep 2010 16:32:58 +0000 (09:32 -0700)]
xenserver: Change license of xsconsole plugin to GPLv2.
This file was under a proprietary license because it was derived from
proprietary XenServer code. That upstream code is now under GPLv2, so
change the downstream code to GPLv2 also.
Acked-by: Ian Campbell <Ian.Campbell@citrix.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
Ben Pfaff [Wed, 22 Sep 2010 20:14:37 +0000 (13:14 -0700)]
xenserver: Add GPLv2 license text.
xsconsole is being relicensed under GPLv2 so we need to include the text.
It would be more usual to name this file COPYING and to name the LGPLv2.1
that is already named LICENSE as COPYING.LIB, but some of the files pulled
in from XenServer say that their license is in a file named LICENSE. I
don't expect that Citrix would be willing to change that, so it seems
better to keep LGPLv2.1 named LICENSE.
Ben Pfaff [Mon, 20 Sep 2010 17:56:15 +0000 (10:56 -0700)]
ovs-vsctl: Allow "get" commands to create @names also.
This is useful for adding records that refer to other records by UUID, e.g.
ovs-vsctl \
-- set bridge br0 mirrors=@m \
-- --id=@eth0 get port eth0 \
-- --id=@eth0 get port eth1 \
-- --id=@m create mirror name=mymirror select-dst-port=@eth0 \
select-src-port=@eth0 output-port=@eth1
Ben Pfaff [Tue, 21 Sep 2010 21:27:51 +0000 (14:27 -0700)]
tests: Add 5-second timeout to ovs-vsctl tests.
Otherwise some of the tests may not terminate if something goes wrong.
(Formerly, ovs-vsctl had a default timeout of 5 seconds, so this was not
necessary before.)
Ethan Jackson [Fri, 17 Sep 2010 23:05:04 +0000 (16:05 -0700)]
xenserver: reload sends SIGHUP to monitor-external-ids
When the init script's reload function is called it will send a
SIGHUP to monitor-external-ids. This will cause
monitor-external-ids to re-generate everything.
Simon Horman [Tue, 21 Sep 2010 03:06:13 +0000 (12:06 +0900)]
debian: Dont fail init if module cant be inserted
The problem here is that the daemon is started/restarted on
package installation, but the module may not be present at that
time and (as far as I know) its bad form to fail the package installation
in that circumstance.
In keeping with the way ipvsadm handles a similar problem,
exit with a non-error exit status if the module can't be inserted.
The loud error message is still displayed.
Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Ben Pfaff <blp@nicira.com>
Ethan Jackson [Fri, 17 Sep 2010 22:06:17 +0000 (15:06 -0700)]
python: timer_wait_until calculated current time incorrectly
The timer_wait_until function in poller.py was using Time.msec to
figure out the current time. Unfortunately, Time.msec does not in
exist. Changed to use ovs.timeval.msec .
This installs the Python runtime bindings for
Open vSwitch database into
/usr/share/python-support/openvswitch-python/ovs and
/usr/share/python-support/openvswitch-python/ovs/db
Updated FSF address in copyright file
Minor Whitespace re-formatting
Removed prerm, preinst, postinst files for openvswitch-python