X-Git-Url: https://pintos-os.org/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=utilities%2Fovs-vsctl.8.in;h=7c01d0bd749513a5ebb76cd4dd2d5e2d15d5abd3;hb=d35a4ea82fb76398025d833d30d11d0d68050e56;hp=1ea80b79ae284829d2b0ab662af5468ba74161dc;hpb=577aebdfecb001155242aa9831613310f87ed13a;p=openvswitch diff --git a/utilities/ovs-vsctl.8.in b/utilities/ovs-vsctl.8.in index 1ea80b79..7c01d0bd 100644 --- a/utilities/ovs-vsctl.8.in +++ b/utilities/ovs-vsctl.8.in @@ -4,6 +4,13 @@ . ns . IP "\\$1" .. +.de ST +. PP +. RS -0.15in +. I "\\$1" +. RE +. PP +.. .TH ovs\-vsctl 8 "November 2009" "Open vSwitch" "Open vSwitch Manual" .ds PN ovs\-vsctl . @@ -67,11 +74,9 @@ contacts to query or modify configuration. The default is \fBunix:@RUNDIR@/ovsdb\-server\fR. \fIserver\fR must take one of the following forms: .RS -.IP "\fBtcp:\fIip\fB:\fIport\fR" -Connect to the given TCP \fIport\fR on \fIip\fR. -.IP "\fBunix:\fIfile\fR" -Connect to the Unix domain server socket named \fIfile\fR. +.so ovsdb/remote-active.man .RE +. .IP "\fB\-\-no\-wait\fR" Prevents \fBovs\-vsctl\fR from waiting for \fBovs\-vswitchd\fR to reconfigure itself according to the the modified database. This @@ -99,6 +104,15 @@ Prints a blank line for each command that has no output. .IP "\fB\-\-dry\-run\fR" Prevents \fBovs\-vsctl\fR from actually modifying the database. . +.IP "\fB-t \fIsecs\fR" +.IQ "\fB--timeout=\fIsecs\fR" +Limits runtime to approximately \fIsecs\fR seconds. A value of +zero will cause \fBovs\-vsctl\fR to wait forever. If the timeout expires, +\fBovs\-vsctl\fR will exit with a \fBSIGALRM\fR signal. If this option is +not used, \fBovs\-vsctl\fR uses a timeout of five seconds. +(A timeout would normally happen only if the database cannot be contacted.) +. +.so lib/ssl.man .so lib/vlog.man . .SH COMMANDS @@ -258,6 +272,116 @@ the output is the value for that \fIkey\fR or the empty string if \fIkey\fR is unset. If \fIkey\fR is omitted, the output is \fIkey\fB=\fIvalue\fR, one per line, for each key-value pair. . +.SS "OpenFlow Controller Connectivity" +. +\fBovs\-vswitchd\fR can perform all configured bridging and switching +locally, or it can be configured to connect a given bridge to an +external OpenFlow controller, such as NOX. +. +If a \fIbridge\fR argument is given, the settings apply only to the +specified bridge. Otherwise, they apply to the Open vSwitch instance, +and its configuration applies to any bridge that has not been explicitly +configured through a \fIbridge\fR argument. +. +.IP "\fBget\-controller\fR [\fIbridge\fR]" +Prints the configured controller target. +. +.IP "\fBdel\-controller\fR [\fIbridge\fR]" +Deletes the configured controller target. +. +.IP "\fBset\-controller\fR [\fIbridge\fR] \fItarget\fR" +Sets the configured controller target. The \fItarget\fR may use any of +the following forms: +. +.RS +.TP +.so lib/vconn-active.man +.RE +. +.ST "Controller Failure Settings" +. +When a controller is configured, it is, ordinarily, responsible for +setting up all flows on the switch. Thus, if the connection to +the controller fails, no new network connections can be set up. If +the connection to the controller stays down long enough, no packets +can pass through the switch at all. +.ST +If the value is \fBstandalone\fR, or if neither of these settings +is set, \fBovs\-vswitchd\fR will take over +responsibility for setting up +flows when no message has been received from the controller for three +times the inactivity probe interval (xxx needs to be exposed). In this mode, +\fBovs\-vswitchd\fR causes the datapath to act like an ordinary +MAC-learning switch. \fBovs\-vswitchd\fR will continue to retry connecting +to the controller in the background and, when the connection succeeds, +it discontinues its standalone behavior. +.ST +If this option is set to \fBsecure\fR, \fBovs\-vswitchd\fR will not +set up flows on its own when the controller connection fails. +. +.IP "\fBget\-fail\-mode\fR [\fIbridge\fR]" +Prints the configured failure mode. +. +.IP "\fBdel\-fail\-mode\fR [\fIbridge\fR]" +Deletes the configured failure mode. +. +.IP "\fBset\-fail\-mode\fR [\fIbridge\fR] \fBstandalone\fR|\fBsecure\fR" +Sets the configured failure mode. +. +.SS "SSL Configuration" +When \fBovs\-vswitchd\fR is configured to connect over SSL for management or +controller connectivity, the following parameters are required: +.TP +\fBprivate-key\fR +Specifies a PEM file containing the private key used as the virtual +switch's identity for SSL connections to the controller. +.TP +\fBcertificate\fR +Specifies a PEM file containing a certificate, signed by the +certificate authority (CA) used by the controller and manager, that +certifies the virtual switch's private key, identifying a trustworthy +switch. +.TP +\fBca-cert\fR +Specifies a PEM file containing the CA certificate used to verify that +the virtual switch is connected to a trustworthy controller. +.PP +These files are read only once, at \fBovs\-vswitchd\fR startup time. If +their contents change, \fBovs\-vswitchd\fR must be killed and restarted. +.PP +These SSL settings apply to all SSL connections made by the virtual +switch. +. +.IP "\fBget\-ssl\fR" +Prints the SSL configuration. +. +.IP "\fBdel\-ssl\fR" +Deletes the current SSL configuration. +. +.IP "[\fB\-\-bootstrap\fR] \fBset\-ssl\fR \fIprivate-key\fR \fIcertificate\fR \fIca-cert\fR" +Sets the SSL configuration. The \fB\-\-bootstrap\fR option is described +below. +. +.ST "CA Certificate Bootstrap" +Ordinarily, all of the files named in the SSL configuration must exist +when \fBovs\-vswitchd\fR starts. However, if the \fB\-\-bootstrap\fR +option is given, then \fBovs\-vswitchd\fR will attempt to obtain the +CA certificate from the controller on its first SSL connection and +save it to the named PEM file. If it is successful, it will +immediately drop the connection and reconnect, and from then on all +SSL connections must be authenticated by a certificate signed by the +CA certificate thus obtained. +.PP +\fBThis option exposes the SSL connection to a man-in-the-middle +attack obtaining the initial CA certificate\fR, but it may be useful +for bootstrapping. +.PP +This option is only useful if the controller sends its CA certificate +as part of the SSL certificate chain. The SSL protocol does not +require the controller to send the CA certificate, but +\fBcontroller\fR(8) can be configured to do so with the +\fB--peer-ca-cert\fR option. +. .SH "EXAMPLES" Create a new bridge named br0 and add port eth0 to it: .IP