Ben Pfaff [Wed, 1 Sep 2010 17:17:40 +0000 (10:17 -0700)]
ofproto: Get enough headroom in fail-open when connected to controller.
Since commit 750638bb "ofproto: Avoid ofpbuf_clone() for OFPAT_CONTROLLER
common case," send_packet_in() needs at least DPIF_RECV_MSG_PADDING bytes
of headroom, which ofpbuf_clone() doesn't supply. This commit should fix
that.
This fixes an assertion failure in ofpbuf_prealloc_headroom() via
send_packet_in().
netflow: Send multiple records for byte counts > UINT32_MAX
When a NetFlow record is to be sent for a flow that had more than 2^32
bytes, we used to set the byte count to UINT32_MAX. With this change,
we will send out multiple records to account for all the traffic.
Simon Horman [Tue, 31 Aug 2010 02:47:28 +0000 (11:47 +0900)]
datapath: Include net/udp.h in vport-capwap.c
net/udp.h is currently included indirectly via linux/ipv6.h which is
in turn included indirectly via linux/ip.h. However, this breaks down
if CONFIG_IPV6 is not set, leading to a number of build errors.
Joe Perches [Mon, 30 Aug 2010 07:24:54 +0000 (00:24 -0700)]
treewide: Use pr_fmt and pr_<level>
Signed-off-by: Joe Perches <joe@perches.com> Acked-by: Simon Horman <horms@verge.net.au>
[Jesse: Added missing pr_fmt in vport-gre.c and dp_sysfs_dp.c] Signed-off-by: Jesse Gross <jesse@nicira.com>
Jesse Gross [Mon, 30 Aug 2010 17:56:49 +0000 (10:56 -0700)]
datapath: Add compat functions for pr_*.
In the earliest kernels that we support this family of macros
wasn't defined at all. Later they were defined but did not include
the module name. Finally, pr_warn was made a synonym for pr_warning.
This harmonizes the behavior across all kernels.
Ben Pfaff [Mon, 30 Aug 2010 17:08:06 +0000 (10:08 -0700)]
INSTALL.Linux: Don't discourage building Debian packages.
For a while the Debian packages were not well maintained or regularly used,
but we at Nicira use them all the time now. We now aim to have them
accepted into Debian downstream, so we should at least not discourage
users from trying them out.
Ben Pfaff [Fri, 13 Aug 2010 17:46:12 +0000 (10:46 -0700)]
datapath: Avoid accesses past the end of skbuff data in actions.
Some of the flow actions that modify skbuff data did not check that the
skbuff was long enough before doing so. This commit fixes that problem.
Previously, the strategy for avoiding this was to only indicate the layer-3
nw_proto field in the flow if the corresponding layer-4 header was fully
present, so that if, for example, nw_proto was IPPROTO_TCP, this meant
that a TCP header was present. The original motivation for this patch was
to add corresponding code to only indicate a layer-2 dl_type if the
corresponding layer-3 header was fully present. But I'm now convinced that
this approach is conceptually wrong, because the meaning of a layer-N
header should not be affected by the meaning of a layer-(N+1) header.
This commit switches to a new approach. Now, when a header is missing, its
fields in the flow are simply zeroed and have no effect on the "type" field
for the outer header. Responsibility for ensuring that a header is fully
present is now shifted to the actions that wish to modify that header.
Ben Pfaff [Fri, 27 Aug 2010 19:41:00 +0000 (12:41 -0700)]
datapath: Fix default value of skb transport_header.
This commit started out as simply better documenting flow_extract(),
but then I realized that nothing cares about transport_header in the
non-IP case, so don't bother with it at all.
Ben Pfaff [Thu, 12 Aug 2010 22:37:47 +0000 (15:37 -0700)]
datapath: Avoid pskb_may_pull() checks where not needed.
These calls to pskb_may_pull() can be reduced to checks on skb->len because
in these contexts those headers will already have been pulled into the
skb linear area if it is there at all.
Ben Pfaff [Fri, 27 Aug 2010 19:32:05 +0000 (12:32 -0700)]
datapath: Report memory allocation errors in flow_extract().
Until now flow_extract() has simply returned a bogus flow when memory
allocation errors occurred. This fixes the problem by propagating the
error to the caller.
Ben Pfaff [Tue, 10 Aug 2010 18:23:02 +0000 (11:23 -0700)]
learning-switch: Ignore "packet_in"s caused by OFPP_CONTROLLER actions.
It seems best to ignore "packet_in"s caused by OFPP_CONTROLLER actions in
learning-switch, since someone might be experimenting and it's best not
to interfere with that.
Ben Pfaff [Tue, 10 Aug 2010 18:05:01 +0000 (11:05 -0700)]
ofproto: Avoid ofpbuf_clone() for OFPAT_CONTROLLER common case.
This additionally optimizes the common case of the first packet of a flow
that consists only of an OFPAT_CONTROLLER action, by avoiding an
ofpbuf_clone() call along that path.
Ben Pfaff [Wed, 4 Aug 2010 21:08:26 +0000 (14:08 -0700)]
ofproto: Avoid user->kernel->user round-trip for many controller actions.
When an OpenFlow flow says to send packets to the controller, until now
ofproto has executed that using dpif_execute(), which passes the packet up
to the kernel. The kernel queues the packet into its "action" queue, and
then later ofproto pulls the packet back down from the kernel and sends it
to the controller.
However, this is unnecessary. Open vSwitch can just recognize in advance
that it will get the packet back and handle it directly, skipping the round
trip. This commit implements this optimization.
This generally affects only the first packet in a flow, since generally the
rest come directly down from the kernel. It only optimizes the "easy" case
where the first action in a flow is to send the packet to the controller,
since this seems to be the common case in the flows that I'm looking at
now.
Ben Pfaff [Fri, 20 Aug 2010 18:26:03 +0000 (11:26 -0700)]
configure: Enable OpenSSL support by default.
Years ago some users had broken OpenSSL libraries that didn't actually
work, so we disabled OpenSSL by default. By now, I hope that those users
have fixed their systems.
Ben Pfaff [Tue, 24 Aug 2010 23:00:27 +0000 (16:00 -0700)]
Add Nicira extension to OpenFlow for dropping spoofed ARP packets.
"ARP spoofing" is when a host claims an incorrect association between an
IP address and a MAC address for deceptive purposes. OpenFlow by itself
can prevent a host from sending out ARP replies from an incorrect MAC
address in the Ethernet L2 header, but it cannot control the MAC addresses
inside the ARP L3 packet. This commit adds a new action that can be used
to drop these spoofed packets.
CC: Paul Ingram <paul@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
Ben Pfaff [Thu, 26 Aug 2010 16:56:25 +0000 (09:56 -0700)]
vswitchd: Fix 100% CPU usage with bonds and --fake-proc-net.
The current date in milliseconds since the epoch is ~1,282,841,552,000,
which is greater than LONG_MAX of 4,294,967,295 on 32-bit systems, so
no matter what was stored into bond_next_fake_iface_update, it would always
appear to be expired. It really needs to be a 64-bit number. (This was
just a typo really.)
Since XenServer 5.5 requires --fake-proc-net, this probably fixes an
important bug there.
Ben Pfaff [Thu, 12 Aug 2010 22:12:28 +0000 (15:12 -0700)]
datapath: Free up flow_extract() return value for reporting errors.
flow_extract() can fail due to memory allocation errors in pskb_may_pull().
Currently it doesn't return those properly, instead just reporting a bogus
flow to the caller. But its return value is currently in use for reporting
whether the packet was an IPv4 fragment. This commit switches to reporting
that in the skb itself so that the return value can be reused to report
errors.
Justin Pettit [Tue, 24 Aug 2010 21:50:06 +0000 (14:50 -0700)]
xenserver: Add monitor-external-ids daemon
The monitor-external-ids daemon monitors the external_ids columns of the
Bridge and Interface OVSDB tables. Its primary responsibility is to
set the "bridge-id" and "iface-id" keys in the Bridge and Interface
tables, respectively. It also looks for the use of "network-uuids" in
the Bridge table and duplicates its value to the preferred
"xs-network-uuids".
Justin Pettit [Thu, 5 Aug 2010 01:52:17 +0000 (18:52 -0700)]
xenserver: Report the system type and version as external ids
The configuration schema defines the system-type and system-version
external-ids for the Open_vSwitch table. This commit adds support for
reporting them on XenServer.
Justin Pettit [Wed, 4 Aug 2010 06:00:04 +0000 (23:00 -0700)]
vswitch: Break out XenServer-specific external ids
As we move to new platforms, not all external identifiers will be
universally unique, but the "-uuid" suffix seemingly prevents their use.
Create new identifiers without the "-uuid" suffix. Change the existing
XenServer-specific external identifiers to contain a "xs-" prefix. This
also allows a XenServer integrator to define identifiers different from
the XenServer UUIDs, but still leave them in the config database to be
used by other programs.
Ben Pfaff [Sat, 21 Aug 2010 22:39:27 +0000 (15:39 -0700)]
Delete local copy of simplejson.
The previous commit dropped usage of simplejson from the Python
code in the tree, because it did not provide adequate features to
support the JSON-RPC engine. In particular simplejson is not a
"push parser"--you can't give it a byte or a character at a time
and have it tell you when it has read a whole JSON value.
Ben Pfaff [Wed, 25 Aug 2010 17:26:40 +0000 (10:26 -0700)]
Implement initial Python bindings for Open vSwitch database.
These initial bindings pass a few hundred of the corresponding tests
for C implementations of various bits of the Open vSwitch library API.
The poorest part of them is actually the Python IDL interface in
ovs.db.idl, which has not received enough attention yet. It appears
to work, but it doesn't yet support writes (transactions) and it is
difficult to use. I hope to improve it as it becomes clear what
semantics Python applications actually want from an IDL.
Ben Pfaff [Mon, 23 Aug 2010 19:18:05 +0000 (12:18 -0700)]
stream, vconn: Fix comments.
All streams and all vconns are "active", so there's no point in noting that
requirement in comments. (A long time ago, active and passive vconns were
conflated instead of having passive vconns broken out as pvconns. But
active and passive streams have always been distinct.)
Ben Pfaff [Wed, 25 Aug 2010 00:12:23 +0000 (17:12 -0700)]
debian: Use pfaffben@debian.org as uploader address for Ben Pfaff.
I use pfaffben@debian.org as my contact address for Debian packages, so
use it here too. I've had annoyed emails from folks when I am not
consistent about this, so fix it proactively.
Jesse Gross [Tue, 17 Aug 2010 22:09:53 +0000 (18:09 -0400)]
netdev: Don't assume all netdevs are available at runtime.
Currently we print a warning if a user tries to configure a
netdev that is not in the list that userspace knows about.
However, it is possible that a given netdev maybe be enabled but
when it tries to create a device it finds out that it can't
(not supported by kernel module, hardware not present, etc.).
This makes the behavior the same in both cases.
Jesse Gross [Thu, 12 Aug 2010 00:55:58 +0000 (20:55 -0400)]
datapath: Add support for CAPWAP UDP transport.
Add support for the transport portion of the CAPWAP protocol as
an alternative to GRE for L2 over L3 tunneling. This is not
full support for the CAPWAP protocol. CAPWAP covers management
of wireless access points and describes a control protocol for
setting those devices up. It also describes a data plane protocol
that allows packets to be tunneled to a controller for inspection.
This data plane protocol is the only component covered by this
commit.
Jesse Gross [Mon, 16 Aug 2010 14:32:41 +0000 (10:32 -0400)]
datapath: Add support for tunnel fragmentation.
Up until now it was assumed that encapsulated packets larger than
the MTU would be fragmented by the IP stack. However, some
tunneling protocols provide their own fragmentation mechanism. This
adds the necessary support to the generic tunnel code to support
fragmentation.
Jesse Gross [Wed, 11 Aug 2010 22:29:48 +0000 (18:29 -0400)]
netdev-gre: Genericize GRE netdev.
Since the GRE netdev doesn't actually implement any of the GRE
protocol, none of the code is really specific to GRE. This commit
makes the netdev a little more generic so that additional tunnel
types can easily piggyback on it in the future.
Jesse Gross [Wed, 11 Aug 2010 00:11:48 +0000 (20:11 -0400)]
datapath: Abstract tunneling implementation from GRE.
Much of the code in the GRE implementation is not specific to the
GRE protocol but is actually common to all types of tunnels. In
order to support future types of tunnels, move this code into a
common library.
Simon Horman [Mon, 23 Aug 2010 06:30:11 +0000 (15:30 +0900)]
datapath: Use rtnl_link_stats64
This adds compatibility with a series kernel changesets that
introduces 64bit statistics. The final changeset (to date) being
"net: Document that dev_get_stats() returns the given pointer".
The relevant changesets were added between 2.6.35 and 2.6.36-rc1.
Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Jesse Gross <jesse@nicira.com>
Simon Horman [Mon, 23 Aug 2010 06:30:10 +0000 (15:30 +0900)]
datapath: use rx_handler_data pointer
This adds compatibility with kernel changeset
"bridge: use rx_handler_data pointer to store net_bridge_port pointer"
which was added between 2.6.35 and 2.6.36-rc1.
With this change it is now safe to (attempt to) insert both bridge and
datapath with newer (>=2.6.36) kernels, although whichever is inserted
second will fail to initialise on the call to netdev_rx_handler_register()
Signed-off-by: Simon Horman <horms@verge.net.au>
[Jesse: fixed merge conflicts in vport-netdev.c and netdevice.h] Signed-off-by: Jesse Gross <jesse@nicira.com>
Simon Horman [Mon, 23 Aug 2010 06:30:08 +0000 (15:30 +0900)]
datapath: rtable may not have a u. member
This brings the code up to sync with the kernel as
of changeset "net-next: remove useless union keyword",
which was added between 2.6.35 and 2.6.36-rc1
Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Jesse Gross <jesse@nicira.com>
Simon Horman [Mon, 23 Aug 2010 06:30:07 +0000 (15:30 +0900)]
datapath: Handle duplicate netdev in netdev_rx_handler_register()
For kernels that have netdev_rx_handler_register() (>=2.6.35),
duplicate netdevs are detected by netdev_rx_handler_register().
So by adding duplicate detection to the netdev_rx_handler_register()
compatibility code the explicit check in netdev_create() can be removed.
Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Jesse Gross <jesse@nicira.com>
Simon Horman [Mon, 23 Aug 2010 06:30:06 +0000 (15:30 +0900)]
datapath: dont use non-existent receive hooks
This adds compatibility with kernel changeset
of changeset "net: add rx_handler data pointer"
and thus "net: replace hooks in __netif_receive_skb V5",
which were added between 2.6.35 and 2.6.36-rc1
Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Jesse Gross <jesse@nicira.com>
Ben Pfaff [Fri, 20 Aug 2010 19:37:01 +0000 (12:37 -0700)]
Remove ezio-term and ovs-switchui utilities.
These utilities were useful when Nicira was building switches with 16x2 LCD
front panel displays, but they aren't useful for other environments and
even Nicira does not use that kind of switch any longer. So remove them
and all the build infrastructure on which they depended.
We enforce mutual exclusion when updating statistics by disabling
bottom halves and only writing to per-CPU state. However, reading
requires looking at the statistics for foreign CPUs, which could be
in the process of updating them since there isn't a lock. This means
we could get garbage values for 64-bit values on 32-bit machines or
byte counts that don't correspond to packet counts, etc.
This commit introduces a sequence lock for statistics values to avoid
this problem. Getting a write lock is very cheap - it only requires
incrementing a counter plus a memory barrier (which is compiled away
on x86) to acquire or release the lock and will never block. On
read we spin until the sequence number hasn't changed in the middle
of the operation, indicating that the we have a consistent set of
values.
Jesse Gross [Sat, 14 Aug 2010 16:25:58 +0000 (12:25 -0400)]
gre: Don't require incoming checksum.
The current meaning of the GRE checksum option is to include
checksums on transmit and require packets to have them on receive.
In addition, incoming packets with checksums are always validated
regardless of this option. Requiring checksums on receive creates
surprising behavior and interoperability issues. This disables the
requirement on receive. The new behavior is that the sender decides
whether to checksum packets and the receiver will validate packets
with checksums (similar to UDP).
Jesse Gross [Fri, 13 Aug 2010 03:31:03 +0000 (23:31 -0400)]
gre: Disable checksums by default.
GRE checksums aren't really all that useful because they only
add value for the GRE and inner Ethernet header. However, they
are expensive since they cover the entire packet, even though
most of the data is protected by L3 and L4 checksums. Therefore
disable checksumming by default to improve performance. In addition,
since CAPWAP doesn't support checksums this makes it consistent with
GRE.
Ben Pfaff [Mon, 16 Aug 2010 22:59:26 +0000 (15:59 -0700)]
Fix SSL boilerplate descriptions in manpages.
Some of the SSL boilerplate was specific to switches, but it was included
in OVSDB programs also. Make it more generic. Also document SSL options
in some manpages where they were missing.
Ben Pfaff [Mon, 16 Aug 2010 22:54:47 +0000 (15:54 -0700)]
ovs-vsctl: Fix parsing of short SSL options.
The short versions of the SSL options (e.g. -p, -c, -C) did not work,
because they were not in the string passed to getopt_long(). This commit
fixes the problem and should avoid its recurrence with any other short
options that we add in the future.
Ben Pfaff [Thu, 12 Aug 2010 00:24:13 +0000 (17:24 -0700)]
Remove vestigial support for Spanning Tree Protocol.
Open vSwitch has never properly supported IEEE 802.1D Spanning Tree
Protocol (STP), but it has various bits and pieces that claim to support
it. This commit deletes them, to reduce the amount of dead code in the
tree. We can always reintroduce it later if it proves to be a good idea.