Ben Pfaff [Thu, 27 Jan 2011 17:50:19 +0000 (09:50 -0800)]
tests: Tolerate different versions of tcpdump.
The tcpdump output format differs slightly from one version to another, so
this test that runs tcpdump would fail depending on the system it was run
on. This commit fixes the problem by using "sed" to trim off the part of
the line that can differ.
Ben Pfaff [Tue, 4 Jan 2011 23:32:39 +0000 (15:32 -0800)]
datapath: Make VERIFY_NUL_STRING return a negative error code.
This is the common kernel convention. None of the callers currently do
anything with the return code except for test whether it is nonzero, so
they don't need any changes.
Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Jesse Gross <jesse@nicira.com>
Ben Pfaff [Wed, 29 Dec 2010 23:06:16 +0000 (15:06 -0800)]
shash: New "smap" functions for working with string-to-string maps.
An shash always has string keys and sometimes it hash string values as
well. Usually the general-purpose shash functions are fine for working
with string-to-string maps, but this commit introduces a few more
specialized functions that only work with string-to-string maps. It's not
clear yet to me whether this should actually be a new data structure, so
for now the new functions just work on shashes.
This commit also converts one user of shash_destroy() to use smap_destroy().
This is the only existing user of these functions that I spotted as a
trivial conversion candidate while grepping.
These new functions will see more use in the following commit.
Ben Pfaff [Tue, 11 Jan 2011 19:02:32 +0000 (11:02 -0800)]
netlink-socket: Log Generic Netlink family names.
The ids for Generic Netlink family names aren't very helpful because they
can vary from machine to machine and even from one boot to the next. So
this change logs their names too.
Ben Pfaff [Sat, 22 Jan 2011 23:23:10 +0000 (15:23 -0800)]
netlink-socket: Make dumping and doing transactions on same nl_sock safe.
It's not safe to use a single Netlink fd to do multiple operations in an
synchronous way. Some of the limitations are fundamental; for example, the
kernel only supports a single "dump" operation at a time. Others are
limitations imposed by the OVS coding style; for example, our Netlink
library is not callback based, so nothing can be done about incoming
messages that can't be handled immediately. Regardless, in OVS multicast
groups, transactions, and dumps cannot coexist on a single nl_sock.
This is only mildly irritating at the moment, but it will become much worse
later on, when dpif-linux shifts to using Netlink dumps for listing various
kinds of datapath entities. When that happens, a dump will be in progress
in situations where the dpif-linux client might want to do other
operations. For example, it is reasonable for the client to list flows
and, in the middle, look up information on vports mentioned in those flows.
It might be possible to simply ban and avoid such nested operations--I have
not even audited the source tree to find out whether we do anything like
that already--but that seems like an unnecessary cramp on our coding style.
Furthermore, it's difficult to explain and justify without understanding
the implementation.
This patch takes another approach, by improving the Netlink socket library
to avoid artificial constraints. When an operation, or a dump, or joining
a multicast group would cause a problem, this patch makes the library
transparently create a separate Netlink socket. This solves the problem
without putting any onerous restrictions on use.
This commit also slightly simplifies netdev_vport_reset_names(). It had
been written to destroy the dump object before the Netlink socket that it
used, but this is no longer necessary and doing it in the opposite order
saved a few lines of code.
Ben Pfaff [Mon, 10 Jan 2011 00:57:45 +0000 (16:57 -0800)]
netlink-socket: Add functions for joining and leaving multicast groups.
When this library was originally implemented, support for Linux 2.4 was
important. The Netlink implementation in Linux only added support for
joining and leaving multicast groups after a socket is bound as of Linux
2.6.14, so the library did not support it either. But the current version
of Open vSwitch targets Linux 2.6.18 and over, so it's fine to add this
support now, and this commit does so.
This will be used more extensively in upcoming commits.
Ben Pfaff [Wed, 19 Jan 2011 21:17:22 +0000 (13:17 -0800)]
netlink: Add nl_attr_type constants for big-endian values.
These are semantically identical, so they might as well share existing
values, but they help to document the endianness of attributes in Netlink
attribute policies.
Ben Pfaff [Thu, 13 Jan 2011 20:36:06 +0000 (12:36 -0800)]
netlink: New functions for finding a specific attribute.
These functions are useful in the occasional case where a piece of code
only cares about one or a few attributes, probably knows that the format
is correct, and doesn't want to go to the trouble of doing a full parse.
Upcoming commits will add a user.
Ben Pfaff [Mon, 27 Dec 2010 22:32:45 +0000 (14:32 -0800)]
ofpbuf: Enable ofpbuf_push() to expand headroom.
Until now, ofpbuf_put() has been able to reallocate an ofpbuf to
expand the tailroom, but ofpbuf_push() has not been able to expand
the headroom in an analogous way. This omission is simply because
it has never been useful to do this. However, an upcoming change
will make the amount of headroom in an ofpbuf passed up from a
dpif to ofproto harder to predict. It seems that we might as well
simply implement expanding headroom, so this commit does that.
Ben Pfaff [Tue, 25 Jan 2011 23:23:31 +0000 (15:23 -0800)]
stream-ssl: Only cache SSL sessions after they shut down.
A cached SSL session may only be used for new connections after the initial
connection has shut down. As far as I can tell, nothing in the OpenSSL
documentation actually comes out and says this, but it is implied by
various examples found around the web and doing it this way makes caching
work much more reliably in my testing.
Ben Pfaff [Tue, 25 Jan 2011 23:17:32 +0000 (15:17 -0800)]
stream-ssl: Set a session context ID string on our SSL_CTX.
In the finest OpenSSL tradition of putting important documentation only in
code comments, ssl/ssl_sess.c in the OpenSSL tree has the following comment
inside ssl_get_prev_session():
/* We can't be sure if this session is being used out of
* context, which is especially important for SSL_VERIFY_PEER.
* The application should have used SSL[_CTX]_set_session_id_context.
*
* For this error case, we generate an error instead of treating
* the event like a cache miss (otherwise it would be easy for
* applications to effectively disable the session cache by
* accident without anyone noticing).
*/
This meant that ovs-controller couldn't effectively cache SSL server
sessions and we got a weird error whenever ovs-vswitchd tried.
Bug #4448. CC: David Tsai <dtsai@nicira.com> CC: Jeremy Stribling <strib@nicira.com>
Ethan Jackson [Tue, 25 Jan 2011 18:58:47 +0000 (10:58 -0800)]
ovs-bugtool: Indiscriminately capture all openvswitch log files.
ovs-bugtool was only capturing openvswitch core files. This commit
causes it to capture all files under /var/log/openvswitch and
/var/log/core. It also moves the ovs-bugtool output to
/var/log/ovs-bugtool.
Reported-by: Ben Pfaff <blp@nicira.com>
Bug #4481.
Ben Pfaff [Mon, 24 Jan 2011 22:03:57 +0000 (14:03 -0800)]
datapath: Move rcu_read_lock_held(), rcu_dereference_*() to rcupdate.h.
<linux/rcupdate.h> is the normal location of these functions, so we should
not put compat code for them in <linux/rtnetlink.h>.
This caused build failures for datapath/table.c, which in later commits
uses rcu_dereference_check() and rcu_dereference_protected() but does not
need RTNL.
Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Jesse Gross <jesse@nicira.com>
Ethan Jackson [Mon, 24 Jan 2011 18:54:17 +0000 (10:54 -0800)]
xenserver: Change all bridge's fail_mode when updating.
The ovs plugin's update command was only setting fail_mode for
bridges attached to pifs. This patch applies the fail_mode
setting to all bridges on the XenServer system.
Reported-by: David Tsai <dtsai@nicira.com> Signed-off-by: Ethan Jackson <ethan@nicira.com>
Ben Pfaff [Sat, 22 Jan 2011 01:09:21 +0000 (17:09 -0800)]
multipath: Fix off-by-one in hash_threshold multipath calculation.
0xffffffff / (0xffffffff / n) can have a value as large as n (consider the
n == 1 case), but we need a value no bigger than n-1. So add 1 before
dividing to fix the problem.
This caused a test failure on Debian "lenny" amd64 when apparently
unrelated code changed.
Ben Pfaff [Fri, 21 Jan 2011 22:49:01 +0000 (14:49 -0800)]
ofproto: Correctly compute length of flow stats in multipart flow stats.
In a flow table dump, the length of the first nx_flow_stats in the second
and subsequent OpenFlow messages was being miscalculated, because
append_nxstats_reply() changed the length of the message in such cases.
So we need to load the starting length after calling append_nxstats_reply()
instead of before.
Ben Pfaff [Fri, 21 Jan 2011 00:34:15 +0000 (16:34 -0800)]
datapath: Remove vport_del_all() because it is now a no-op.
vport_del_all() was created when vports could exist without being attached
to any datapath. Now, a vport is always attached to a datapath. This
function was only called on module unload, but the module can't be unloaded
if any datapath exists, so it won't ever have any work to do, and we might
as well delete it entirely.
Justin Pettit [Tue, 18 Jan 2011 08:01:24 +0000 (00:01 -0800)]
ovs-monitor-ipsec: Use "require" when adding SPD entries.
Previously, SPD entries were added with a level of "default". This uses
the system-wide default for the protocol when processing a matching
packet. Switch the level to "require" so that a SA is always used when
sending the packet.
Ethan Jackson [Wed, 19 Jan 2011 22:46:57 +0000 (14:46 -0800)]
xenserver: Allow NULL pool in configuration cache.
InterfaceReconfigure assumes the pool is in the configuration
cache. This is always true except when upgrading from an older
version of openvswitch which does record the pool. This can cause
upgrades to lock up.
Ethan Jackson [Mon, 17 Jan 2011 19:31:46 +0000 (11:31 -0800)]
xenserver: Allow unknown other-config attributes.
When saving the database cache, InterfaceReconfigure can crash if
unexpected attributes are in an object's other-config column. This
commit causes it to skip that attribute and log a warning.
Signed-off-by: Ethan Jackson <ethan@nicira.com> CC: Ian Campbell <Ian.Campbell@citrix.com> CC: Dominic Curran <Dominic.Curran@citrix.com>
Ethan Jackson [Fri, 14 Jan 2011 00:29:31 +0000 (16:29 -0800)]
route-table: Handle route updates more robustly.
The kernel does not broadcast rtnetlink route messages in all cases
one would expect. This can cause stale entires to end up in the
route table which may cause incorrect results for
route_table_get_ifindex() queries. This commit causes rtnetlink
route messages to dump the entire route table on the next
route_table_get_ifindex() query.
Ethan Jackson [Wed, 12 Jan 2011 22:55:18 +0000 (14:55 -0800)]
lib: Simplify rtnetlink routing functionality.
This commit removes the rtnetlink-route module and replaces it with
a much simpler to use route-table module. The route-table uses
rtnetlink to maintain a routing table which may be used to query
the egress interface of particular addresses.
This commit also converts netdev-vport to use the new route-table
module.
Ben Pfaff [Wed, 12 Jan 2011 18:44:43 +0000 (10:44 -0800)]
datapath: Get rid of compat.h, compat26.h in favor of modern approach.
I had completely forgotten that we had a top-level compat.h and compat26.h.
It's better to distribute their contents to individual compat headers, so
this commit does so and deletes them.
Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Jesse Gross <jesse@nicira.com>
Sajjad Lateef [Thu, 13 Jan 2011 01:07:58 +0000 (17:07 -0800)]
debian: Modify ovs-bugtool to include collectd rrd logs
collectd is a utility that stores rrd logs in the directory
/var/lib/collectd/rrd/ by default. rrd logs are created when
collectd is configured to output logs in Round Robin Database
format.
With this change, ovs-bugtool will include collectd logs in the
output bundle from /var/lib/collectd/rrd. The output bundle will
include all sub-directories of the specified collectd directory.
ovs-bugtool checks if a directory exists before it attempts to
include the directory contents in the output bundle. So, running
ovs-bugtool on a system that does not have collectd logs should
not negatively affect the behavior of ovs-bugtool.
Ben Pfaff [Wed, 12 Jan 2011 21:57:53 +0000 (13:57 -0800)]
ofp-print: Add tests for OpenFlow message formatting.
It's become clear over the past few weeks that some people really depend
on the formatting of ofp-print output. It has also become clear that OVS
doesn't have anything that actually checks or enforces the formatting of
the output. The former is not something I want to encourage, but the
latter is somewhat worrisome because the formatting does change from time
to time and I want to make sure that that is intentional.
So this commit adds at least one test for each supported OpenFlow and
Nicira extension message, so that we can better keep track of changes.
Ethan Jackson [Wed, 5 Jan 2011 19:51:15 +0000 (11:51 -0800)]
bridge: Move tunnel_egress_iface to status column.
This commit removes the tunnel_egress_iface column from the
interface table and moves it's data to the status column. In the
process it reverts the database to version 1.0.0.
Justin Pettit [Tue, 11 Jan 2011 05:32:09 +0000 (21:32 -0800)]
xenserver: Remove "Required-" parameters from "openvswitch" init script.
Commit 72dfb3b (xenserver: Add LSB init info to scripts.) added LSB init
info to the XenServer scripts. This was verified to work on XenServer
5.5, but newer versions of XenServer interpret these values and alter
when "openvswitch" gets called. This causes XenServer to not come up
with its networking configuration properly.
By removing the "Required-" parameters, OVS will properly come up. This
is just a temporary fix, and a more proper one will be forthcoming.
Ben Pfaff [Mon, 10 Jan 2011 20:54:26 +0000 (12:54 -0800)]
tests: Fix Y2011 bug in testsuite.
The tests have been failing for a few days now, because the PKI expired a
few days into 2011. This commit instead generates the PKI at "make check"
time, which has the additional benefit of getting some test exposure for
the ovs-pki program.
Reported-by: Aaron M. Ucko <ucko@debian.org> CC: 609506@bugs.debian.org
Patrick Mullaney [Wed, 15 Dec 2010 19:07:10 +0000 (11:07 -0800)]
xenserver: Remove Linux bridge on startup if no bridges exist.
Otherwise, if the bridge module is loaded but no bridges exist, on all
but the most recent Linux kernels this prevents the Open vSwitch kernel
module from loading.
Patrick Mullaney [Wed, 15 Dec 2010 18:39:08 +0000 (10:39 -0800)]
xenserver: Don't require /etc/xensource/network.conf if not on XenServer.
On XenServer systems, the "network mode" (that is, whether the network
uses OpenvSwitch or the Linux bridge) is stored in
/etc/xensource/network.conf. On other systems, we can't expect it to be
there. This changes the init script to tolerate its absence, treating that
as meaning that Open vSwitch should be used (otherwise, why did the admin
install it?).
NETWORK_MODE can always be overridden in /etc/sysconfig/openvswitch anyway.
Signed-off-by: Patrick Mullaney <pm.mullaney@gmail.com>
[changed back to read /etc/xensource/network.conf if present] Signed-off-by: Ben Pfaff <blp@nicira.com>
Ben Pfaff [Wed, 5 Jan 2011 19:08:25 +0000 (11:08 -0800)]
xenserver: Generate system UUID for non-XenServer systems.
Currently the scripts in xensever/ are intended specifically for XenServer,
but supporting other distros seems like a worthy goal, so this is a step
in the right direction.
It would be good to be able to determine a suitable system-type and
system-version, but those are less important than system-id.
Signed-off-by: Patrick Mullaney <pm.mullaney@gmail.com>
[changed not to set xs-system-uuid on non-XenServer systems]
[whitespace changes]
[changed to handle missing uuidgen, suggested by Justin Pettit] Signed-off-by: Ben Pfaff <blp@nicira.com>
Ben Pfaff [Wed, 5 Jan 2011 19:00:41 +0000 (11:00 -0800)]
xenserver: Be compatible with non-XenServer func libraries in init script.
XenServer has its function library in /etc/init.d/functions but other
distros have it in different places. Currently this init script is
specifically intended for XenServer but adding compatibility with other
distros seems like a worthwhile goal.
Also, SuSE does not have the "action" function, so test whether it is
implemented and when not supply a fallback.
Signed-off-by: Patrick Mullaney <pm.mullaney@gmail.com>
[changed to only define action() if not already defined] Signed-off-by: Ben Pfaff <blp@nicira.com>