aginwala [Fri, 23 Mar 2018 20:44:52 +0000 (13:44 -0700)]
Use new default nb and sb dbs for sandbox northd:
As per new clustering change, ovn-northd sandbox should use nb1.ovsdb and
sb1.ovsdb. It was updated in ovn-northd --help section but missed for sandbox.
This commit fixes the same
Reported-by: Mark Michelson <mmichels@redhat.com>
Reported-at: https://mail.openvswitch.org/pipermail/ovs-dev/2018-March/345535.html Signed-off-by: aginwala <aginwala@ebay.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
Ben Pfaff [Fri, 23 Mar 2018 22:46:58 +0000 (15:46 -0700)]
json: Avoid extra memory allocation and string copy parsing object members.
Until now, every time the JSON parser added an object member, it made an
extra copy of the member name and then freed the original copy. This is
wasteful, so this commit eliminates the extra copy.
Signed-off-by: Ben Pfaff <blp@ovn.org> Reviewed-by: Yifeng Sun <pkusunyifeng@gmail.com>
Ben Pfaff [Fri, 23 Mar 2018 22:46:49 +0000 (15:46 -0700)]
seq: Avoid some "possible leak" warnings from valgrind.
valgrind regards a block to be "possibly" leaked when no pointers exist to
the beginning of the block but some pointers do point to the middle of the
block. By moving the hmap_node in struct seq_waiter from the middle of the
struct to the beginning, as this commit does, the pointers to the node from
the hmap in struct seq point to the beginning of the block, which reassures
valgrind.
Signed-off-by: Ben Pfaff <blp@ovn.org> Reviewed-by: Yifeng Sun <pkusunyifeng@gmail.com>
Ben Pfaff [Tue, 20 Mar 2018 05:01:47 +0000 (22:01 -0700)]
ofp-flow: Reduce memory consumption for ofputil_flow_mod, using minimatch.
Until now, struct ofputil_flow_mod, which represents an OpenFlow flow table
modification request, has incorporated a struct match, which made the
overall ofputil_flow_mod about 2.5 kB. This is OK for a small number of
flows, but absurdly inflates memory requirements when there are hundreds of
thousands of flows. This commit fixes the problem by changing struct match
to struct minimatch inside ofputil_flow_mod, which reduces its size to
about 100 bytes plus the actual size of the flow match (usually a few dozen
bytes).
This affects memory usage of ovs-ofctl (when it adds a large number of
flows) more than ovs-vswitchd.
Reported-by: Michael Ben-Ami <mbenami@digitalocean.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Reviewed-by: Armando Migliaccio <armamig@gmail.com> Tested-by: Armando Migliaccio <armamig@gmail.com> Reviewed-by: Jan Scheurich <jan.scheurich@ericsson.com> Tested-by: Jan Scheurich <jan.scheurich@ericsson.com> Tested-by: Yifeng Sun <pkusunyifeng@gmail.com> Reviewed-by: Yifeng Sun <pkusunyifeng@gmail.com>
Ben Pfaff [Tue, 20 Mar 2018 04:34:26 +0000 (21:34 -0700)]
flow: Improve type-safety of MINIFLOW_GET_TYPE.
Until mow, this macro has blindly read the passed-in type's size, but
that's unnecessarily risky. This commit changes it to verify that the
passed-in type is the same size as the field and, on GCC and Clang, that
the types are compatible. It also adds a version that does not check,
for the one case where (currently) we deliberately read the wrong size,
and updates a few uses to use more precise field names.
Signed-off-by: Ben Pfaff <blp@ovn.org> Reviewed-by: Yifeng Sun <pkusunyifeng@gmail.com> Reviewed-by: Armando Migliaccio <armamig@gmail.com>
Ben Pfaff [Mon, 19 Mar 2018 20:11:26 +0000 (13:11 -0700)]
match: Add 'tun_md' member to struct minimatch.
struct match has had a 'tun_md' member for a long time, but struct
minimatch has never had one. This doesn't matter for the purposes for
which minimatch is currently used, but it means that a minimatch is not
completely substitutable for a match and therefore blocks some new uses.
This patch adds the member.
Signed-off-by: Ben Pfaff <blp@ovn.org> Reviewed-by: Yifeng Sun <pkusunyifeng@gmail.com> Reviewed-by: Armando Migliaccio <armamig@gmail.com>
Ian Stokes [Wed, 21 Mar 2018 20:11:22 +0000 (20:11 +0000)]
lib/tc: Fix sparse warnings.
"sparse" complains with the warning 'incorrect type in argument 1
(different base types)' in function nl_parse_flower_ip when parsing a key
flag and in function nl_msg_put_flower_options when writing the key
flag. Fix this by using network byte order when reading and writing key
flags to netlink messages.
Fixes: 83e86606 ("netdev-tc-offloads: Add support for IP fragmentation") Signed-off-by: Ian Stokes <ian.stokes@intel.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Roi Dayan <roid@mellanox.com>
Fragment mask (any and later) always exists so we need to test
for FLOW_NW_FRAG_LATER only if the state is FLOW_NW_FRAG_ANY.
Before this fix we could pass frag no and first at the same time to TC
which is also not tested there for bad frag state.
This fix make sure we only pass frag first/later if is frag.
Fixes: 83e866067ea6 ("netdev-tc-offloads: Add support for IP fragmentation") Signed-off-by: Roi Dayan <roid@mellanox.com> Reviewed-by: Paul Blakey <paulb@mellanox.com> Signed-off-by: Simon Horman <simon.horman@netronome.com>
Aaron Conole [Tue, 13 Feb 2018 21:42:16 +0000 (16:42 -0500)]
rhel: don't drop capabilities when running as root
Currently, regardless of which user is being set as the running user,
Open vSwitch daemons on RHEL systems drop capabilities. This means the
very powerful CAP_SYS_ADMIN is dropped, even when the user is 'root'.
For the majority of use cases this behavior works, as the user can
enable or disable various configurations, regardless of which datapath
functions are desired. However, when using certain DPDK PMDs, the
enablement and configuration calls require CAP_SYS_ADMIN.
Instead of retaining CAP_SYS_ADMIN in all cases, which would practically
nullify the uid/gid and privilege drop, we don't pass the --ovs-user
option to the daemons. This shunts the capability and privilege
dropping code.
Reported-by: Marcos Felipe Schwarz <marcos.f.sch@gmail.com>
Reported-at: https://mail.openvswitch.org/pipermail/ovs-discuss/2018-January/045955.html Fixes: e3e738a3d058 ("redhat: allow dpdk to also run as non-root user") Signed-off-by: Aaron Conole <aconole@redhat.com> Acked-By: Timothy Redaelli <tredaelli@redhat.com> Signed-off-by: Russell Bryant <russell@ovn.org>
Ben Pfaff [Mon, 1 Jan 2018 05:15:58 +0000 (21:15 -0800)]
ovsdb: Introduce experimental support for clustered databases.
This commit adds support for OVSDB clustering via Raft. Please read
ovsdb(7) for information on how to set up a clustered database. It is
simple and boils down to running "ovsdb-tool create-cluster" on one server
and "ovsdb-tool join-cluster" on each of the others and then starting
ovsdb-server in the usual way on all of them.
One you have a clustered database, you configure ovn-controller and
ovn-northd to use it by pointing them to all of the servers, e.g. where
previously you might have said "tcp:1.2.3.4" was the database server,
now you say that it is "tcp:1.2.3.4,tcp:5.6.7.8,tcp:9.10.11.12".
This also adds support for database clustering to ovs-sandbox.
Ben Pfaff [Wed, 6 Dec 2017 19:37:03 +0000 (11:37 -0800)]
ovsdb-server: Add new RPC "set_db_change_aware".
The _Server database recently added to ovsdb-server can be used to dump out
information about databases, but monitoring updates to _Server is not yet
very useful because for historical reasons ovsdb-server drops all of its
OVSDB connections whenever databases are added or removed or otherwise
change in some major way. It is not a good idea to change this behavior
for all clients, because some of them rely on it, but this commit
introduces a new RPC that allows clients that understand _Server to
suppress the connection-closing behavior.
Ben Pfaff [Fri, 15 Dec 2017 19:14:55 +0000 (11:14 -0800)]
ovsdb-server: Add support for a built-in _Server database.
The _Server database is valuable primarily because it provides database
clients a way to find out the details of changes to databases, schemas,
etc. in a granular, natural way. Until now, the only way that the server
could notify clients about these kinds of changes was to close the session;
when the client reconnects, it is expected to reassess the server's state.
One way to provide this kind of granular information would be to add
specific JSON-RPC requests to obtain notifications for different kinds of
changes, but since ovsdb-server already provides granular and flexible
notification support for databases, using a database for the purpose is
convenient and avoids duplicating functionality.
Initially this database only reports databases' names and schemas, but
when clustering support is added in a later commit it will also report
important aspects of clustering and cluster status. Thus, this database
also reduces the need to add JSON-RPC calls to retrieve information about
new features.
Ben Pfaff [Fri, 1 Sep 2017 22:03:34 +0000 (15:03 -0700)]
ovn-sbctl: Allow retries by default.
Most of the OVS database-manipulation utilities (ovn-sbctl, ovn-nbctl,
ovs-vsctl, vtep-ctl) don't retry their connections by default because
they assume that the database is either up or down and likely to stay
that way. The OVN southbound database, however, is a likely candidate
for high availability clustering, so that even if it appears to be
down for a moment it will be available again soon. So, prepare for
the clustering implementation by enabling retry by default in
ovn-sbctl.
Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
Ben Pfaff [Fri, 15 Dec 2017 18:59:36 +0000 (10:59 -0800)]
ovsdb-idl: Break out database-specific stuff into new data structure.
Until now, a given ovsdb-idl instances has only monitored a single
database. In an upcoming commit, it will grow to also monitor a second
database that represents the state of the database server itself. Much of
the work is the same for both databases, so this commit breaks the common
code and data out into new data structures and functions.
Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
Ben Pfaff [Mon, 22 Jan 2018 19:22:57 +0000 (11:22 -0800)]
jsonrpc-server: Separate changing read_only status from reconnecting.
The code in jsonrpc-server conflated two different kinds of functionality.
It makes sense for the client to be able to change whether a particular
server is read-only. It also makes sense for the client to tell a server
to reconnect. The code in jsonrpc-server only provided a single function
that does both, which is weird. This commit breaks these apart.
Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
Ben Pfaff [Mon, 22 Jan 2018 19:20:47 +0000 (11:20 -0800)]
ovsdb: Drop distinction between monitors and replicas.
Until now, OVSDB distinguished "monitors", which are associated with OVSDB
JSON-RPC client sessions and allow clients to find out about database
changes, from "replicas", which are associated with databases and also find
out about database changes and act on them in some way. Now that
committing to disk has been broken into a separate concept, there is a
one-to-one and "onto" relationship between monitors and replicas: every
monitor M has a replica R and R is associated with M as well. It's easier
if we just treat them as a single entity, and that's what this commit
implements.
Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
Ben Pfaff [Tue, 12 Sep 2017 23:28:28 +0000 (16:28 -0700)]
ovsdb-server: Distinguish logs from other replicas.
Until now, ovsdb-server has internally chained a list of replicas from each
database. Whenever ovsdb_txn_commit() commits a transaction, it passes the
transaction to each replica. The first replica, which is always the disk
file that stores the database, is special because it is the only replica
that can report an error and thereby abort the transaction. This is a very
special property that genuinely distinguishes this first replica from the
others on the chain. This commit breaks that first replica out as a
separate kind of entity that is not on the list of replicas. When later
commits add support for clustering, there will only be more and more
special cases for the "first replica", so it makes sense to distinguish it
this way.
Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
Ben Pfaff [Mon, 22 Jan 2018 19:09:40 +0000 (11:09 -0800)]
jsonrpc: Allow jsonrpc_session to have more than one remote.
The implementation cycles through the remotes in random order. This allows
clients to perform some load balancing across alternative implementations
of a service.
Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Russell Bryant <russell@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
Ben Pfaff [Mon, 22 Jan 2018 19:04:58 +0000 (11:04 -0800)]
reconnect: Add ability to do a number of retries without backoff.
This is aimed at an upcoming database clustering implementation, where it's
desirable to try all of the cluster members quickly before backing off to
retry them again in sequence.
Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Russell Bryant <russell@ovn.org> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
Ben Pfaff [Fri, 8 Dec 2017 00:01:01 +0000 (16:01 -0800)]
log: Add async commit support.
The OVSDB log code has always had the ability to commit the log to disk and
wait for the commit to finish. This patch introduces a new feature that
allows the client to start a commit in the background and then to determine
asynchronously that the commit has completed. This will be especially
useful later for the distributed database feature.
Signed-off-by: Ben Pfaff <blp@ovn.org> Reviewed-by: Yifeng Sun <pkusunyifeng@gmail.com>
Ilya Maximets [Fri, 23 Mar 2018 09:56:53 +0000 (12:56 +0300)]
netdev-dpdk: Limit rate of DPDK logs.
DPDK could produce huge amount of logs. For example, in case of
exhausting of a mempool in vhost-user port, following message will be
printed on each call to 'rte_vhost_dequeue_burst()':
|ERR|VHOST_DATA: Failed to allocate memory for mbuf.
These messages are increasing ovs-vswitchd.log size extremely fast
making it unreadable and non-parsable by a common linux utils like
grep, less etc. Moreover continuously growing log could exhaust the
HDD space in a few hours breaking normal operation of the whole system.
To avoid such issues, DPDK log rate limited to 600 messages per minute.
This value is high, because we still want to see many big logs like
vhost-user configuration sequence. The debug messages are treated
separately to avoid looss of errors/warnings in case of intensive debug
enabled in DPDK.
Kevin Traynor [Thu, 22 Mar 2018 17:20:58 +0000 (17:20 +0000)]
netdev-dpdk: Remove 'error' from non error log.
Presently, if OVS tries to setup more queues than
are allowed by a specific NIC, OVS will handle
this case by retrying with a lower amount of queues.
Rather than reporting initial failed queue setups
in the logs as ERROR, they are reported as INFO but
contain the word 'error'. Unless a user has detailed
knowledge of OVS-DPDK workings, this is confusing.
Let's remove 'error' from the INFO log.
Signed-off-by: Kevin Traynor <ktraynor@redhat.com> Signed-off-by: Ian Stokes <ian.stokes@intel.com>
Ian Stokes [Thu, 8 Mar 2018 15:46:58 +0000 (15:46 +0000)]
dpdk: Use DPDK 17.11.1 release.
Modify docs and travis linux build script to use the DPDK 17.11.1
release branch to benefit from most recent bug fixes.
There are no new features introduced in the DPDK release, only back
ported bug fixes. For completeness these bug fixes have been documented
under the 17.11.1 section in the link below.
Kevin Traynor [Tue, 6 Mar 2018 12:07:09 +0000 (12:07 +0000)]
Documentation: Add note about dpdkvhostuser and IOMMU.
The docs describe IOMMU support for dpdkvhostuserclient ports,
but it is not mentioned in the section about dpdkvhostuser
ports. Add an explicit note to say IOMMU is not supported for
dpdkvhostuser ports.
CC: Maxime Coquelin <maxime.coquelin@redhat.com> Signed-off-by: Kevin Traynor <ktraynor@redhat.com> Signed-off-by: Ian Stokes <ian.stokes@intel.com>
Roi Dayan [Mon, 12 Mar 2018 12:58:47 +0000 (14:58 +0200)]
netdev-tc-offloads: Add support for IP fragmentation
Add support for frag no, first and later.
Signed-off-by: Roi Dayan <roid@mellanox.com> Reviewed-by: Shahar Klein <shahark@mellanox.com> Reviewed-by: Paul Blakey <paulb@mellanox.com> Signed-off-by: Simon Horman <simon.horman@netronome.com>
ovsdb-client: Set binary mode when doing backup/restore
Add some needed consistency on Windows for STD_IN/OUT file descriptors
when doing backup and restore.
Reported-at:https://mail.openvswitch.org/pipermail/ovs-dev/2018-January/343518.html Suggested-by: Ben Pfaff <blp@ovn.org> Co-authored-by: Ben Pfaff <blp@ovn.org> Signed-off-by: Ben Pfaff <blp@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
Ben Pfaff [Wed, 14 Mar 2018 21:57:23 +0000 (14:57 -0700)]
odp-util: Print eth() for Ethernet flows if packet_type is absent.
OVS datapaths have two different ways to indicate what kind of packet a
flow matches. One way, used by the userspace datapath, is
OVS_KEY_ATTR_PACKET_TYPE. Another way, used by the kernel datapath, is
OVS_KEY_ATTR_ETHERTYPE when used in the absence of OVS_KEY_ATTR_ETHERNET;
when the latter is present, the packet is always an Ethernet packet. The
code to print datapath flows wasn't paying attention to this distinction
and always omitted eth() from the output when OVS_KEY_ATTR_ETHERNET was
fully wildcarded, which meant that upon later re-parsing the
OVS_KEY_ATTR_ETHERNET key was omitted, which made it look like a
non-Ethernet match was being described.
This commit makes odp_util_format() add eth() to the output when
OVS_KEY_ATTR_ETHERNET is present and OVS_KEY_ATTR_PACKET_TYPE is absent,
avoiding the problem.
Reported-by: Amar Padmanabhan <amarpadmanabhan@fb.com>
Reported-at: https://mail.openvswitch.org/pipermail/ovs-discuss/2017-December/045817.html Reported-by: Su Wang <suwang@vmware.com>
VMWare-BZ: #2070488 Signed-off-by: Ben Pfaff <blp@ovn.org> Tested-by: Yi-Hung Wei <yihung.wei@gmail.com> Acked-by: Yi-Hung Wei <yihung.wei@gmail.com>
Miguel Angel Ajo [Mon, 12 Mar 2018 10:31:25 +0000 (10:31 +0000)]
ovs-vsctl: Include bfd_status in "show" output for interfaces
Since OVS 2.8 OVN provides L3HA capabilities via BFD monitoring,
but checking the status of BFD is not obvious, and we provide
a simple way to visualize the status with this simple patch.
Signed-off-by: Miguel Angel Ajo <majopela@redhat.com> Tested-by: Miguel Angel Ajo <majopela@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
Daniel Alvarez [Sat, 10 Mar 2018 13:50:14 +0000 (14:50 +0100)]
ovsdb: Fix database compaction check
We want to compact database file if it has been over 24 hours since we
last compacted it and there's more than 100 commits regardless of the
size of the database. This patch fixes the previous comparisson which
checked if 24 hours was elapsed since the next scheduled compaction.
Signed-off-by: Daniel Alvarez <dalvarez@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
Ben Pfaff [Fri, 16 Feb 2018 22:03:51 +0000 (14:03 -0800)]
ofp-print: Move much of the printing code into message-specific files.
Until now, the ofp-print code has had a lot of logic specific to
individual messages. This code is better put with the other code specific
to those messages, so this commit starts to migrate it.
There is more work of a similar type to do, but this is a reasonable start.
Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
Ben Pfaff [Fri, 16 Feb 2018 19:43:56 +0000 (11:43 -0800)]
ofp-packet: Better abstract packet-in format.
This commit relieves the caller of code that deals with the format of
packet-in messages from some of the burden of understanding the packet
format. It also renames the constants to appear to be at a higher level of
abstraction.
Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
Ben Pfaff [Thu, 15 Feb 2018 22:38:28 +0000 (14:38 -0800)]
ofp-protocol: Better abstract changing the protocol used for flow matches.
The previous interface here required the client to understand, to some
extent, the low-level NXFF_* values and the encoding format for the
NXT_SET_FLOW_FORMAT and NXT_SET_FLOW_MOD_TABLE_ID messages. This commit
changes the interface so that the client only has to understand the
ofputil_protocol type used elsewhere and none of the encoding otherwise.
Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Justin Pettit <jpettit@ovn.org>
Ben Pfaff [Wed, 7 Mar 2018 18:26:35 +0000 (10:26 -0800)]
ovsdb-idl: Use modern form of <monitor-requests>.
Long ago, a <monitor-requests> object in the OVSDB protocol mapped a table
name to a single <monitor-request>. Since then, it has mapped a table name
to an *array of* <monitor-request> objects, but the OVSDB IDL has never
been updated to use the modern form. This commit makes that change.
When the Load_Balancer is added to the logical_switch,
the VIP has to be in a different subnet than the one used
for the logical_switch. Since VIP is in a different subnet,
you should connect your logical switch to either a OVN
logical router or a real router (this is because the client
can now send a packet with VIP as the destination IP address
and router's mac address as the destination MAC address).
Signed-off-by: Gurucharan Shetty <guru@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
Lorenzo Bianconi [Tue, 20 Feb 2018 17:39:44 +0000 (18:39 +0100)]
OVN: add acl reject support using icmp4 action
Whenever the acl reject rule is hit send back an ICMPv4 destination
unreachable packet and do not handle reject rule as drop one.
Treat TCP connections as DROP for the moment since tcp_reset{} action
has not been implemented yet.
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
Lorenzo Bianconi [Tue, 20 Feb 2018 17:39:43 +0000 (18:39 +0100)]
OVN: add icmp4{} action support
icmp4 action is used to replace the IPv4 packet been processed with
an ICMPv4 packet initialized based on incoming IPv4 one.
Ethernet and IPv4 fields not listed are not changed:
- ip.proto = 1 (ICMPv4)
- ip.frag = 0 (not a fragment)
- ip.ttl = 255
- icmp4.type = 3 (destination unreachable)
- icmp4.code = 1 (host unreachable)
Prerequisite: ip4
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-By: Mark Michelson <mmichels@redhat.com>
Guoshuai Li [Thu, 1 Mar 2018 06:27:37 +0000 (14:27 +0800)]
python: Fix decoding error when the received data is larger than 4096.
It can only receive 4096 bytes of data each time in jsonrpc,
when there are similar and Chinese characters occupy multiple bytes,
it may receive half a character, this time the decoding will be abnormal.
We need to receive the completed character to decode.
Signed-off-by: Guoshuai Li <ligs@dtdream.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
Daniel Alvarez [Thu, 8 Mar 2018 22:20:56 +0000 (23:20 +0100)]
ovsdb: Loosen requirements for automatically compacting databases.
Before this patch, the databases were automatically compacted when a
transaction is logged when:
* It's been > 10 minutes after last compaction AND
* At least 100 commits have occurred AND
* Database has grown at least 4x since last compaction (and it's > 10M)
This patch changes the conditions as follows:
* It's been > 10 minutes after last compaction AND
* At least 100 commits have occurred AND either
- It's been > 24 hours after the last compaction OR
- Database has grown at least 2x since last compaction (and it's > 10M)
Reported-by: Daniel Alvarez <dalvarez@redhat.com>
Reported-at: https://mail.openvswitch.org/pipermail/ovs-discuss/2018-March/046309.html Signed-off-by: Daniel Alvarez <dalvarez@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
Eric Garver [Thu, 1 Mar 2018 22:59:41 +0000 (17:59 -0500)]
ofproto-dpif-xlate: translate action_set in clone action
A clone action saves the action_set prior to performing the clone, then
restores it afterwards. However when xlating the actions it neglects to
consider the action_set so any write_action() inside a clone() are
ignored. Unfortunately patch ports are internally implemented via
clone(). So a frame traversing to a second bridge via patch port will
never be affected by write_action() in the second bridge's flow table.
Lets make clone() aware of the action_set.
Signed-off-by: Eric Garver <e@erig.me> Signed-off-by: Ben Pfaff <blp@ovn.org>
m4: Try to use "python" as Python2 interpreter only as last resort
This patch tries to find Python 2 as "python2", then "python2.7" and finally
"python".
This is needed since "/usr/bin/python" is used as Python 3 on some Linux
distributions (for example on Arch Linux) and on Fedora 28
"/usr/bin/python" will be deprecated [1]:
"All scripts shall explicitly use /usr/bin/python2."
Anand Kumar [Tue, 6 Mar 2018 23:48:08 +0000 (15:48 -0800)]
datapath-windows: Do not drop Ip fragments less than MIN_FRAGMENT_SIZE
Previously ipfragment module would drop any fragments less than
MIN_FRAGMENT_SIZE (400 bytes), which was added to safeguard against the
vulnerability CVE-2000-0305. This check is incorrect, since minimum size
of the Ipfragment is 68 bytes (i.e. max length of Ip Header + 8 bytes of
L4 header). So Ip fragments less than MIN_FRAGMENT_SIZE (400 bytes) is not
guranted to be malformed or illegal.
To guard against security vulnerability CVE-2000-0305, for a given ip
datagram, ipfragments should be dropped only when number of smallest
fragments recieved reaches a certain threshold.
Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
Fix two $PYTHON leftovers.
One in JSONRPC_REQ_REPLY_SUCCESS_PYN and the other in JSONRPC_REQ_REPLY_ERROR_PYN
Fixes: 58bed3df484b ("jsonrpc-py.at: Run tests with Python 2 and 3.") Signed-off-by: Timothy Redaelli <tredaelli@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
Mark Michelson [Wed, 7 Mar 2018 15:31:00 +0000 (09:31 -0600)]
ovn: Calculate UDP checksum for DNS over IPv6
Unlike IPv4, IPv6 mandates the calculation of the UDP checksum. For DNS
resolution in OVN, we were setting the checksum to 0, which results in
errors.
This patch fixes the problem by calculating the checksum for DNS over
IPv6. It also alters the applicable test by skipping the checksum when
comparing the expected and actual packets.
Signed-off-by: Mark Michelson <mmichels@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
Ben Pfaff [Tue, 6 Mar 2018 01:04:32 +0000 (17:04 -0800)]
tests: Wait for entire trace to hit log.
"over max translation" appears in the log before the trace, but we're
checking for the trace immediately after waiting. This changes the test
to wait for "packet is dropped" instead, which appears at the end of the
trace. This created a race and occasional test failures.
CC: William Tu <u9012063@gmail.com> Fixes: d1ea2cc3de99 ("xlate: auto ofproto trace when recursion too deep") Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: William Tu <u9012063@gmail.com>
Daniel Alvarez [Wed, 7 Mar 2018 18:02:30 +0000 (19:02 +0100)]
ovsdb: Fix time in log traces when compacting database
Current code is mixing wall and monotonic clocks and the traces are not
useful since the timestamps are not accurate. This patch fixes it by
using the same time reference for the log as used in the code.
Without this patch, the traces look like this:
compacting database online (1519124364.908 seconds old, 951 transactions)
Signed-off-by: Daniel Alvarez <dalvarez@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
rhel: Avoid losing bridge configuration after adding DPDK ports
Whenever a DPDK port is added to or deleted from an OVS bridge, the bridge
interface is reconfigured with the lowest MAC address among the connected DPDK
ports. When changing the MAC address, OVS performs a sequences of events
UP -> DOWN -> UP on the bridge interface. In deployments of OVS in RHEL
distribution this results in loosing Linux networking configuration attached to
the bridge interface (e.g. static routes).
This patch changes the interface configuration scripts used in a RHEL deployment
to trigger post-up operations on the bridge device after a change of MAC address.
Signed-off-by: Vishal Deep Ajmera <vishal.deep.ajmera@ericsson.com> Signed-off-by: Flavio Leitner <fbl@sysclose.org> Acked-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: Russell Bryant <russell@ovn.org>
The WDK 10 static analysis complains:
stt.c(427): warning C30030: Warning: Allocating executable memory via
specifying a MM_PAGE_PRIORITY type without a bitwise OR with
MdlMappingNoExecute.
Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org> Acked-by: Sairam Venugopal <vsairam@vmware.com>
William Tu [Thu, 1 Mar 2018 00:32:27 +0000 (16:32 -0800)]
xlate: auto ofproto trace when recursion too deep
Usually ofproto/trace is used to debug the flow translation error.
When translation error such as recursion too deep or too many resubmit,
the issue might happen momentary; flows causing the recursion expire
when users try to debug it. This patch enables the ofproto trace
automatically when recursion is too deep or too many resubmit, by
invoking the translation again, and log the ofproto trace as warnings.
Since the log will be huge, rate limit to one per minute.
VMWare-BZ: #2054659 Signed-off-by: William Tu <u9012063@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
Shashank Ram [Tue, 27 Feb 2018 19:57:37 +0000 (11:57 -0800)]
datapath-windows: Support to selectively compile targets
Adds support to selectively compile kernel driver for
target versions. This is useful when environments to
compile for all targets might not be available on the
user's machine, or if the user wants to only compile
some targets selectively.
Also once appveyor has support to build Win10 targets,
we will not pass the "--with-vstudiotargetver" to the
configure script.
Signed-off-by: Shashank Ram <rams@vmware.com> Acked-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
Anand Kumar [Wed, 28 Feb 2018 04:59:40 +0000 (20:59 -0800)]
datapath-windows: On Debug builds, dump NBL info based on OVS_DBG_DEFAULT macro
Currently nbl information is getting dumped whenever a nbl is copied or
allocated, since OVS_DBG_DEFAULT is set to OVS_DBG_INFO for debug builds,
which affects the ovs performance. Instead dump nbl information only when
OVS_DBG_DEFAULT is set to OVS_LOG_LOUD
Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
Daniel Alvarez [Wed, 28 Feb 2018 09:11:09 +0000 (10:11 +0100)]
python: avoid useless JSON conversion to enhance performance
This patch removes a useless conversion to/from JSON in the
processing of any 'modify' operations inside the process_update2
method in Python IDL implementation.
Previous code will make resources creation take longer as the number
of elements in the row grows because of that JSON conversion. This
patch eliminates it and now the time remains consant regardless
of the database contents improving performance and scaling.
Reported-by: Daniel Alvarez <dalvarez@redhat.com>
Reported-at: https://mail.openvswitch.org/pipermail/ovs-discuss/2018-February/046263.html Signed-off-by: Daniel Alvarez <dalvarez@redhat.com> Acked-by: Terry Wilson <twilson@redhat.com> Tested-By: Terry Wilson <twilson@redhat.com> Acked-by: Han Zhou <hzhou8@ebay.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
Jakub Sitnicki [Wed, 28 Feb 2018 16:06:45 +0000 (17:06 +0100)]
Fix type-setting in ovsdb-idlc man page.
- Remove extra escape sequences for switching to bold font.
- Add missing escape sequences for switching back to normal font.
Reported-at: https://mail.openvswitch.org/pipermail/ovs-dev/2018-February/344591.html Signed-off-by: Jakub Sitnicki <jkbs@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
Greg Rose [Mon, 26 Feb 2018 22:10:15 +0000 (14:10 -0800)]
compat: Fix RHEL 7 compile
frag_percpu_counter_batch is a variable, not a define, so checking if
it is defined is an error and causes warning messages during compile
on RHEL 7 (or other 3.10 based) builds. Use a compat #define from
acinclude.m4 instead.
Fixes: 64d8cb7295 ("compat:inet_frag.h: Check for frag_percpu_counter_batch") Signed-off-by: Greg Rose <gvrose8192@gmail.com> Acked-by: Pravin B Shelar <pshelar@ovn.org>
Balazs Nemeth [Mon, 26 Feb 2018 09:10:35 +0000 (09:10 +0000)]
tests: Make packet-type-aware.at hash independent
When compiling with -msse4.2 a test case of packet-type-aware.at will
fail due to the CRC32 based hash function is different from mhash.
Fix this issue with parsing the port statistics one-by-one.
Signed-off-by: Balazs Nemeth <balazs.nemeth@ericsson.com> CC: Jan Scheurich <jan.scheurich@ericsson.com> CC: Zoltan Balogh <zoltan.balogh@ericsson.com> Fixes: 00135b869d7c ("xlate: fix xport lookup for recirc") Signed-off-by: Ben Pfaff <blp@ovn.org>
Mark Michelson [Mon, 26 Feb 2018 20:04:02 +0000 (14:04 -0600)]
Refer to database manpages in *ctl manpages
The ovn-nbctl, ovn-sbctl, and ovs-vsctl manpages are inconsistent in
their "Database Commands" section when it comes to referring to what
database tables exist. This commit amends this by making each *ctl
manpage reference the corresponding database manpage instead.
To aid in having a more handy list, the --help text of ovn-nbctl,
ovn-sbctl, and ovs-vsctl have been modified to list the available
tables. This is also referenced in the manpages for those applications.
Signed-off-by: Mark Michelson <mmichels@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
Ben Pfaff [Fri, 23 Feb 2018 21:03:07 +0000 (13:03 -0800)]
ovn-northd: Consistently use Datapath_Binding UUID for hashing flows.
In one place, ovn-northd was hashing Logical_Switch or Logical_Router UUIDs
for ovn_lflow, and in another place it was hashing Datapath_Binding UUIDs.
This caused problems. This commit changes ovn-northd to always hash the
Datapath_Binding UUID.
Jacob Sitnicki reported the following performance improvement for a similar
fix:
Ilya Maximets [Mon, 26 Feb 2018 08:10:11 +0000 (11:10 +0300)]
ofproto-dpif-upcall: Fix using uninitialized fitness.
'upcall_xlate()' makes a decision to compose slow path actions
by checking the 'upcall->fitness', which is not initialized in
case of calling from the 'upcall_cb()'.
'upcall_cb()' receives the real flow, so the fitness should be
initialized as perfect.
projects / mirror_ovs.git / log