ovn-controller: Support multiple encaps simultaneously.
[cascardo/ovs.git] / ovn / controller / ovn-controller.c
index affc14b..3bd072a 100644 (file)
@@ -27,6 +27,7 @@
 #include "compiler.h"
 #include "daemon.h"
 #include "dirs.h"
+#include "dynamic-string.h"
 #include "openvswitch/vconn.h"
 #include "openvswitch/vlog.h"
 #include "ovn/lib/ovn-sb-idl.h"
 #include "ofctrl.h"
 #include "binding.h"
 #include "chassis.h"
+#include "encaps.h"
 #include "physical.h"
-#include "pipeline.h"
+#include "lflow.h"
 
 VLOG_DEFINE_THIS_MODULE(main);
 
 static unixctl_cb_func ovn_controller_exit;
+static unixctl_cb_func ct_zone_list;
 
 #define DEFAULT_BRIDGE_NAME "br-int"
 
@@ -55,194 +58,365 @@ static void parse_options(int argc, char *argv[]);
 OVS_NO_RETURN static void usage(void);
 
 static char *ovs_remote;
-static char *ovnsb_remote;
 
-
-static void
-get_initial_snapshot(struct ovsdb_idl *idl)
+const struct sbrec_chassis *
+get_chassis(struct ovsdb_idl *ovnsb_idl, const char *chassis_id)
 {
-    while (1) {
-        ovsdb_idl_run(idl);
-        if (ovsdb_idl_has_ever_connected(idl)) {
-            return;
+    const struct sbrec_chassis *chassis_rec;
+
+    SBREC_CHASSIS_FOR_EACH(chassis_rec, ovnsb_idl) {
+        if (!strcmp(chassis_rec->name, chassis_id)) {
+            break;
         }
-        ovsdb_idl_wait(idl);
-        poll_block();
     }
+
+    return chassis_rec;
+}
+
+uint32_t
+get_tunnel_type(const char *name)
+{
+    if (!strcmp(name, "geneve")) {
+        return GENEVE;
+    } else if (!strcmp(name, "stt")) {
+        return STT;
+    } else if (!strcmp(name, "vxlan")) {
+        return VXLAN;
+    }
+
+    return 0;
 }
 
 static const struct ovsrec_bridge *
-get_bridge(struct controller_ctx *ctx, const char *name)
+get_bridge(struct ovsdb_idl *ovs_idl, const char *br_name)
 {
     const struct ovsrec_bridge *br;
-
-    OVSREC_BRIDGE_FOR_EACH(br, ctx->ovs_idl) {
-        if (!strcmp(br->name, name)) {
+    OVSREC_BRIDGE_FOR_EACH (br, ovs_idl) {
+        if (!strcmp(br->name, br_name)) {
             return br;
         }
     }
-
     return NULL;
 }
 
-/* Retrieve the OVN integration bridge from the "external-ids:ovn-bridge"
- * key, the remote location from the "external-ids:ovn-remote" key, and
- * the chassis name from the "external-ids:system-id" key in the
- * Open_vSwitch table of the OVS database instance.
- *
- * xxx ovn-controller does not support changing any of these mid-run,
- * xxx but that should be addressed later. */
-static void
-get_core_config(struct controller_ctx *ctx, char **br_int_namep)
+static const struct ovsrec_bridge *
+create_br_int(struct controller_ctx *ctx,
+              const struct ovsrec_open_vswitch *cfg,
+              const char *bridge_name)
 {
-    while (1) {
-        ovsdb_idl_run(ctx->ovs_idl);
+    if (!ctx->ovs_idl_txn) {
+        return NULL;
+    }
 
-        const struct ovsrec_open_vswitch *cfg;
-        cfg = ovsrec_open_vswitch_first(ctx->ovs_idl);
-        if (!cfg) {
-            VLOG_ERR("No Open_vSwitch row defined.");
-            ovsdb_idl_destroy(ctx->ovs_idl);
-            exit(EXIT_FAILURE);
-        }
+    ovsdb_idl_txn_add_comment(ctx->ovs_idl_txn,
+            "ovn-controller: creating integration bridge '%s'", bridge_name);
+
+    struct ovsrec_interface *iface;
+    iface = ovsrec_interface_insert(ctx->ovs_idl_txn);
+    ovsrec_interface_set_name(iface, bridge_name);
+    ovsrec_interface_set_type(iface, "internal");
+
+    struct ovsrec_port *port;
+    port = ovsrec_port_insert(ctx->ovs_idl_txn);
+    ovsrec_port_set_name(port, bridge_name);
+    ovsrec_port_set_interfaces(port, &iface, 1);
+
+    struct ovsrec_bridge *bridge;
+    bridge = ovsrec_bridge_insert(ctx->ovs_idl_txn);
+    ovsrec_bridge_set_name(bridge, bridge_name);
+    ovsrec_bridge_set_fail_mode(bridge, "secure");
+    const struct smap oc = SMAP_CONST1(&oc, "disable-in-band", "true");
+    ovsrec_bridge_set_other_config(bridge, &oc);
+    ovsrec_bridge_set_ports(bridge, &port, 1);
+
+    struct ovsrec_bridge **bridges;
+    size_t bytes = sizeof *bridges * cfg->n_bridges;
+    bridges = xmalloc(bytes + sizeof *bridges);
+    memcpy(bridges, cfg->bridges, bytes);
+    bridges[cfg->n_bridges] = bridge;
+    ovsrec_open_vswitch_verify_bridges(cfg);
+    ovsrec_open_vswitch_set_bridges(cfg, bridges, cfg->n_bridges + 1);
+
+    return bridge;
+}
 
-        const struct ovsrec_bridge *br_int;
-        const char *remote, *system_id, *br_int_name;
+static const struct ovsrec_bridge *
+get_br_int(struct controller_ctx *ctx)
+{
+    const struct ovsrec_open_vswitch *cfg;
+    cfg = ovsrec_open_vswitch_first(ctx->ovs_idl);
+    if (!cfg) {
+        return NULL;
+    }
 
-        br_int_name = smap_get(&cfg->external_ids, "ovn-bridge");
-        if (!br_int_name) {
-            br_int_name = DEFAULT_BRIDGE_NAME;
-        }
+    const char *br_int_name = smap_get(&cfg->external_ids, "ovn-bridge");
+    if (!br_int_name) {
+        br_int_name = DEFAULT_BRIDGE_NAME;
+    }
 
-        br_int = get_bridge(ctx, br_int_name);
-        if (!br_int) {
-            VLOG_INFO("Integration bridge '%s' does not exist.  Waiting...",
-                      br_int_name);
-            goto try_again;
-        }
+    const struct ovsrec_bridge *br;
+    br = get_bridge(ctx->ovs_idl, br_int_name);
+    if (!br) {
+        return create_br_int(ctx, cfg, br_int_name);
+    }
+    return br;
+}
 
-        remote = smap_get(&cfg->external_ids, "ovn-remote");
-        if (!remote) {
-            VLOG_INFO("OVN OVSDB remote not specified.  Waiting...");
-            goto try_again;
-        }
+static const char *
+get_chassis_id(const struct ovsdb_idl *ovs_idl)
+{
+    const struct ovsrec_open_vswitch *cfg = ovsrec_open_vswitch_first(ovs_idl);
+    return cfg ? smap_get(&cfg->external_ids, "system-id") : NULL;
+}
 
-        system_id = smap_get(&cfg->external_ids, "system-id");
-        if (!system_id) {
-            VLOG_INFO("system-id not specified.  Waiting...");
-            goto try_again;
-        }
+static char *
+patch_port_name(const struct ovsrec_bridge *b1, const struct ovsrec_bridge *b2)
+{
+    return xasprintf("patch-%s-to-%s", b1->name, b2->name);
+}
 
-        ovnsb_remote = xstrdup(remote);
-        ctx->chassis_id = xstrdup(system_id);
-        *br_int_namep = xstrdup(br_int_name);
-        return;
+/*
+ * Return true if the port is a patch port from b1 to b2
+ */
+static bool
+match_patch_port(const struct ovsrec_port *port,
+                 const struct ovsrec_bridge *b1,
+                 const struct ovsrec_bridge *b2)
+{
+    struct ovsrec_interface *iface;
+    size_t i;
+    char *peer_port_name;
+    bool res = false;
 
-try_again:
-        ovsdb_idl_wait(ctx->ovs_idl);
-        poll_block();
+    peer_port_name = patch_port_name(b2, b1);
+
+    for (i = 0; i < port->n_interfaces; i++) {
+        iface = port->interfaces[i];
+        if (strcmp(iface->type, "patch")) {
+            continue;
+        }
+        const char *peer;
+        peer = smap_get(&iface->options, "peer");
+        if (peer && !strcmp(peer, peer_port_name)) {
+            res = true;
+            break;
+        }
     }
 
+    free(peer_port_name);
+
+    return res;
 }
 
-struct idl_loop {
-    struct ovsdb_idl *idl;
-    unsigned int skip_seqno;
+static void
+create_patch_port(struct controller_ctx *ctx,
+                  const char *network,
+                  const struct ovsrec_bridge *b1,
+                  const struct ovsrec_bridge *b2)
+{
+    if (!ctx->ovs_idl_txn) {
+        return;
+    }
 
-    struct ovsdb_idl_txn *committing_txn;
-    unsigned int precommit_seqno;
+    char *port_name = patch_port_name(b1, b2);
+    char *peer_port_name = patch_port_name(b2, b1);
+
+    ovsdb_idl_txn_add_comment(ctx->ovs_idl_txn,
+            "ovn-controller: creating patch port '%s' from '%s' to '%s'",
+            port_name, b1->name, b2->name);
+
+    struct ovsrec_interface *iface;
+    iface = ovsrec_interface_insert(ctx->ovs_idl_txn);
+    ovsrec_interface_set_name(iface, port_name);
+    ovsrec_interface_set_type(iface, "patch");
+    const struct smap options = SMAP_CONST1(&options, "peer", peer_port_name);
+    ovsrec_interface_set_options(iface, &options);
+
+    struct ovsrec_port *port;
+    port = ovsrec_port_insert(ctx->ovs_idl_txn);
+    ovsrec_port_set_name(port, port_name);
+    ovsrec_port_set_interfaces(port, &iface, 1);
+    const struct smap ids = SMAP_CONST1(&ids, "ovn-patch-port", network);
+    ovsrec_port_set_external_ids(port, &ids);
+
+    struct ovsrec_port **ports;
+    ports = xmalloc(sizeof *ports * (b1->n_ports + 1));
+    memcpy(ports, b1->ports, sizeof *ports * b1->n_ports);
+    ports[b1->n_ports] = port;
+    ovsrec_bridge_verify_ports(b1);
+    ovsrec_bridge_set_ports(b1, ports, b1->n_ports + 1);
+
+    free(ports);
+    free(port_name);
+    free(peer_port_name);
+}
 
-    struct ovsdb_idl_txn *open_txn;
-};
+static void
+create_patch_ports(struct controller_ctx *ctx,
+                   const char *network,
+                   struct shash *existing_ports,
+                   const struct ovsrec_bridge *b1,
+                   const struct ovsrec_bridge *b2)
+{
+    size_t i;
 
-#define IDL_LOOP_INITIALIZER(IDL) { .idl = (IDL) }
+    for (i = 0; i < b1->n_ports; i++) {
+        if (match_patch_port(b1->ports[i], b1, b2)) {
+            /* Patch port already exists on b1 */
+            shash_find_and_delete(existing_ports, b1->ports[i]->name);
+            break;
+        }
+    }
+    if (i == b1->n_ports) {
+        create_patch_port(ctx, network, b1, b2);
+    }
+}
 
 static void
-idl_loop_destroy(struct idl_loop *loop)
+init_existing_ports(struct controller_ctx *ctx,
+                    struct shash *existing_ports)
 {
-    if (loop) {
-        ovsdb_idl_destroy(loop->idl);
+    const struct ovsrec_port *port;
+
+    OVSREC_PORT_FOR_EACH (port, ctx->ovs_idl) {
+        if (smap_get(&port->external_ids, "ovn-patch-port")) {
+            shash_add(existing_ports, port->name, port);
+        }
     }
 }
 
-static struct ovsdb_idl_txn *
-idl_loop_run(struct idl_loop *loop)
+static void
+remove_port(struct controller_ctx *ctx,
+            const struct ovsrec_port *port)
 {
-    ovsdb_idl_run(loop->idl);
-    loop->open_txn = (loop->committing_txn
-                      || ovsdb_idl_get_seqno(loop->idl) == loop->skip_seqno
-                      ? NULL
-                      : ovsdb_idl_txn_create(loop->idl));
-    return loop->open_txn;
+    const struct ovsrec_bridge *bridge;
+
+    /* We know the port we want to delete, but we have to find the bridge its on
+     * to do so.  Note this only runs on a config change that should be pretty
+     * rare. */
+    OVSREC_BRIDGE_FOR_EACH (bridge, ctx->ovs_idl) {
+        size_t i;
+        for (i = 0; i < bridge->n_ports; i++) {
+            if (bridge->ports[i] != port) {
+                continue;
+            }
+            struct ovsrec_port **new_ports;
+            new_ports = xmemdup(bridge->ports,
+                    sizeof *new_ports * (bridge->n_ports - 1));
+            if (i != bridge->n_ports - 1) {
+                /* Removed port was not last */
+                new_ports[i] = bridge->ports[bridge->n_ports - 1];
+            }
+            ovsrec_bridge_verify_ports(bridge);
+            ovsrec_bridge_set_ports(bridge, new_ports, bridge->n_ports - 1);
+            free(new_ports);
+            ovsrec_port_delete(port);
+            return;
+        }
+    }
 }
 
 static void
-idl_loop_commit_and_wait(struct idl_loop *loop)
+parse_bridge_mappings(struct controller_ctx *ctx,
+                      const struct ovsrec_bridge *br_int,
+                      const char *mappings_cfg)
 {
-    if (loop->open_txn) {
-        loop->committing_txn = loop->open_txn;
-        loop->open_txn = NULL;
+    struct shash existing_ports = SHASH_INITIALIZER(&existing_ports);
+    init_existing_ports(ctx, &existing_ports);
+
+    char *cur, *next, *start;
+    next = start = xstrdup(mappings_cfg);
+    while ((cur = strsep(&next, ",")) && *cur) {
+        char *network, *bridge = cur;
+        const struct ovsrec_bridge *ovs_bridge;
+
+        network = strsep(&bridge, ":");
+        if (!bridge || !*network || !*bridge) {
+            VLOG_ERR("Invalid ovn-bridge-mappings configuration: '%s'",
+                    mappings_cfg);
+            break;
+        }
+
+        ovs_bridge = get_bridge(ctx->ovs_idl, bridge);
+        if (!ovs_bridge) {
+            VLOG_WARN("Bridge '%s' not found for network '%s'",
+                    bridge, network);
+            continue;
+        }
 
-        loop->precommit_seqno = ovsdb_idl_get_seqno(loop->idl);
+        create_patch_ports(ctx, network, &existing_ports, br_int, ovs_bridge);
+        create_patch_ports(ctx, network, &existing_ports, ovs_bridge, br_int);
+    }
+    free(start);
+
+    /* Any ports left in existing_ports are related to configuration that has
+     * been removed, so we should delete the ports now. */
+    struct shash_node *port_node, *port_next_node;
+    SHASH_FOR_EACH_SAFE (port_node, port_next_node, &existing_ports) {
+        struct ovsrec_port *port = port_node->data;
+        shash_delete(&existing_ports, port_node);
+        remove_port(ctx, port);
     }
+    shash_destroy(&existing_ports);
+}
 
-    struct ovsdb_idl_txn *txn = loop->committing_txn;
-    if (txn) {
-        enum ovsdb_idl_txn_status status = ovsdb_idl_txn_commit(txn);
-        if (status != TXN_INCOMPLETE) {
-            switch (status) {
-            case TXN_TRY_AGAIN:
-                /* We want to re-evaluate the database when it's changed from
-                 * the contents that it had when we started the commit.  (That
-                 * might have already happened.) */
-                loop->skip_seqno = loop->precommit_seqno;
-                if (ovsdb_idl_get_seqno(loop->idl) != loop->skip_seqno) {
-                    poll_immediate_wake();
-                }
-                break;
-
-            case TXN_SUCCESS:
-                /* If the database has already changed since we started the
-                 * commit, re-evaluate it immediately to avoid missing a change
-                 * for a while. */
-                if (ovsdb_idl_get_seqno(loop->idl) != loop->precommit_seqno) {
-                    poll_immediate_wake();
-                }
-                break;
-
-            case TXN_UNCHANGED:
-            case TXN_ABORTED:
-            case TXN_NOT_LOCKED:
-            case TXN_ERROR:
-                break;
-
-            case TXN_UNCOMMITTED:
-            case TXN_INCOMPLETE:
-                OVS_NOT_REACHED();
+static void
+init_bridge_mappings(struct controller_ctx *ctx,
+                     const struct ovsrec_bridge *br_int)
+{
+    const char *mappings_cfg = "";
+    const struct ovsrec_open_vswitch *cfg;
+
+    cfg = ovsrec_open_vswitch_first(ctx->ovs_idl);
+    if (cfg) {
+        mappings_cfg = smap_get(&cfg->external_ids, "ovn-bridge-mappings");
+        if (!mappings_cfg) {
+            mappings_cfg = "";
+        }
+    }
+    parse_bridge_mappings(ctx, br_int, mappings_cfg);
+}
 
+/* Retrieves the OVN Southbound remote location from the
+ * "external-ids:ovn-remote" key in 'ovs_idl' and returns a copy of it.
+ *
+ * XXX ovn-controller does not support this changing mid-run, but that should
+ * be addressed later. */
+static char *
+get_ovnsb_remote(struct ovsdb_idl *ovs_idl)
+{
+    while (1) {
+        ovsdb_idl_run(ovs_idl);
+
+        const struct ovsrec_open_vswitch *cfg
+            = ovsrec_open_vswitch_first(ovs_idl);
+        if (cfg) {
+            const char *remote = smap_get(&cfg->external_ids, "ovn-remote");
+            if (remote) {
+                return xstrdup(remote);
             }
-            ovsdb_idl_txn_destroy(txn);
-            loop->committing_txn = NULL;
         }
-    }
 
-    ovsdb_idl_wait(loop->idl);
+        VLOG_INFO("OVN OVSDB remote not specified.  Waiting...");
+        ovsdb_idl_wait(ovs_idl);
+        poll_block();
+    }
 }
 
 int
 main(int argc, char *argv[])
 {
     struct unixctl_server *unixctl;
-    struct controller_ctx ctx = { .chassis_id = NULL };
     bool exiting;
     int retval;
 
     ovs_cmdl_proctitle_init(argc, argv);
     set_program_name(argv[0]);
+    service_start(&argc, &argv);
     parse_options(argc, argv);
     fatal_ignore_sigpipe();
 
-    daemonize_start();
+    daemonize_start(false);
 
     retval = unixctl_server_create(NULL, &unixctl);
     if (retval) {
@@ -256,56 +430,84 @@ main(int argc, char *argv[])
     sbrec_init();
 
     ofctrl_init();
+    lflow_init();
 
     /* Connect to OVS OVSDB instance.  We do not monitor all tables by
      * default, so modules must register their interest explicitly.  */
-    ctx.ovs_idl = ovsdb_idl_create(ovs_remote, &ovsrec_idl_class, false, true);
-
-    /* Register interest in "external_ids" column in "Open_vSwitch" table,
-     * since we'll need to get the OVN OVSDB remote. */
-    ovsdb_idl_add_table(ctx.ovs_idl, &ovsrec_table_open_vswitch);
-    ovsdb_idl_add_column(ctx.ovs_idl, &ovsrec_open_vswitch_col_external_ids);
-
-    chassis_init(&ctx);
-    binding_init(&ctx);
-    physical_init(&ctx);
-    pipeline_init();
-
-    get_initial_snapshot(ctx.ovs_idl);
-
-    char *br_int_name;
-    get_core_config(&ctx, &br_int_name);
-
-    ctx.ovnsb_idl = ovsdb_idl_create(ovnsb_remote, &sbrec_idl_class,
-                                     true, true);
-    get_initial_snapshot(ctx.ovnsb_idl);
-
-    struct idl_loop ovnsb_idl_loop = IDL_LOOP_INITIALIZER(ctx.ovnsb_idl);
-    struct idl_loop ovs_idl_loop = IDL_LOOP_INITIALIZER(ctx.ovs_idl);
+    struct ovsdb_idl_loop ovs_idl_loop = OVSDB_IDL_LOOP_INITIALIZER(
+        ovsdb_idl_create(ovs_remote, &ovsrec_idl_class, false, true));
+    ovsdb_idl_add_table(ovs_idl_loop.idl, &ovsrec_table_open_vswitch);
+    ovsdb_idl_add_column(ovs_idl_loop.idl,
+                         &ovsrec_open_vswitch_col_external_ids);
+    ovsdb_idl_add_column(ovs_idl_loop.idl, &ovsrec_open_vswitch_col_bridges);
+    ovsdb_idl_add_table(ovs_idl_loop.idl, &ovsrec_table_interface);
+    ovsdb_idl_add_column(ovs_idl_loop.idl, &ovsrec_interface_col_name);
+    ovsdb_idl_add_column(ovs_idl_loop.idl, &ovsrec_interface_col_type);
+    ovsdb_idl_add_column(ovs_idl_loop.idl, &ovsrec_interface_col_options);
+    ovsdb_idl_add_table(ovs_idl_loop.idl, &ovsrec_table_port);
+    ovsdb_idl_add_column(ovs_idl_loop.idl, &ovsrec_port_col_name);
+    ovsdb_idl_add_column(ovs_idl_loop.idl, &ovsrec_port_col_interfaces);
+    ovsdb_idl_add_column(ovs_idl_loop.idl, &ovsrec_port_col_external_ids);
+    ovsdb_idl_add_table(ovs_idl_loop.idl, &ovsrec_table_bridge);
+    ovsdb_idl_add_column(ovs_idl_loop.idl, &ovsrec_bridge_col_ports);
+    ovsdb_idl_add_column(ovs_idl_loop.idl, &ovsrec_bridge_col_name);
+    ovsdb_idl_add_column(ovs_idl_loop.idl, &ovsrec_bridge_col_fail_mode);
+    ovsdb_idl_add_column(ovs_idl_loop.idl, &ovsrec_bridge_col_other_config);
+    chassis_register_ovs_idl(ovs_idl_loop.idl);
+    encaps_register_ovs_idl(ovs_idl_loop.idl);
+    binding_register_ovs_idl(ovs_idl_loop.idl);
+    physical_register_ovs_idl(ovs_idl_loop.idl);
+    ovsdb_idl_get_initial_snapshot(ovs_idl_loop.idl);
+
+    /* Connect to OVN SB database. */
+    char *ovnsb_remote = get_ovnsb_remote(ovs_idl_loop.idl);
+    struct ovsdb_idl_loop ovnsb_idl_loop = OVSDB_IDL_LOOP_INITIALIZER(
+        ovsdb_idl_create(ovnsb_remote, &sbrec_idl_class, true, true));
+    ovsdb_idl_get_initial_snapshot(ovnsb_idl_loop.idl);
+
+    /* Initialize connection tracking zones. */
+    struct simap ct_zones = SIMAP_INITIALIZER(&ct_zones);
+    unsigned long ct_zone_bitmap[BITMAP_N_LONGS(MAX_CT_ZONES)];
+    bitmap_set1(ct_zone_bitmap, 0); /* Zone 0 is reserved. */
+    unixctl_command_register("ct-zone-list", "", 0, 0,
+                             ct_zone_list, &ct_zones);
 
     /* Main loop. */
     exiting = false;
     while (!exiting) {
-        ctx.ovnsb_idl_txn = idl_loop_run(&ovnsb_idl_loop);
-        ctx.ovs_idl_txn = idl_loop_run(&ovs_idl_loop);
-
-        /* xxx If run into any surprising changes, we exit.  We should
-         * xxx handle this more gracefully. */
-        const struct ovsrec_bridge *br_int = get_bridge(&ctx, br_int_name);
-        if (!br_int) {
-            VLOG_ERR("Integration bridge '%s' disappeared", br_int_name);
-            retval = EXIT_FAILURE;
-            goto exit;
+        struct controller_ctx ctx = {
+            .ovs_idl = ovs_idl_loop.idl,
+            .ovs_idl_txn = ovsdb_idl_loop_run(&ovs_idl_loop),
+            .ovnsb_idl = ovnsb_idl_loop.idl,
+            .ovnsb_idl_txn = ovsdb_idl_loop_run(&ovnsb_idl_loop),
+        };
+
+        const struct ovsrec_bridge *br_int = get_br_int(&ctx);
+        const char *chassis_id = get_chassis_id(ctx.ovs_idl);
+
+        /* Map bridges to local nets from ovn-bridge-mappings */
+        if (br_int) {
+            init_bridge_mappings(&ctx, br_int);
         }
 
-        chassis_run(&ctx, br_int);
-        binding_run(&ctx, br_int);
+        if (chassis_id) {
+            chassis_run(&ctx, chassis_id);
+            encaps_run(&ctx, br_int, chassis_id);
+            binding_run(&ctx, br_int, chassis_id, &ct_zones, ct_zone_bitmap);
+        }
 
-        struct hmap flow_table = HMAP_INITIALIZER(&flow_table);
-        pipeline_run(&ctx, &flow_table);
-        physical_run(&ctx, br_int, &flow_table);
-        ofctrl_run(br_int, &flow_table);
-        hmap_destroy(&flow_table);
+        if (br_int) {
+            enum mf_field_id mff_ovn_geneve = ofctrl_run(br_int);
+
+            struct hmap flow_table = HMAP_INITIALIZER(&flow_table);
+            lflow_run(&ctx, &flow_table, &ct_zones);
+            if (chassis_id) {
+                physical_run(&ctx, mff_ovn_geneve,
+                             br_int, chassis_id, &ct_zones, &flow_table);
+            }
+            ofctrl_put(&flow_table);
+            hmap_destroy(&flow_table);
+        }
 
         unixctl_server_run(unixctl);
 
@@ -314,53 +516,57 @@ main(int argc, char *argv[])
             poll_immediate_wake();
         }
 
-        idl_loop_commit_and_wait(&ovnsb_idl_loop);
-        idl_loop_commit_and_wait(&ovs_idl_loop);
+        ovsdb_idl_loop_commit_and_wait(&ovnsb_idl_loop);
+        ovsdb_idl_loop_commit_and_wait(&ovs_idl_loop);
 
-        ofctrl_wait();
+        if (br_int) {
+            ofctrl_wait();
+        }
         poll_block();
+        if (should_service_stop()) {
+            exiting = true;
+        }
     }
 
     /* It's time to exit.  Clean up the databases. */
     bool done = false;
     while (!done) {
-        ctx.ovnsb_idl_txn = idl_loop_run(&ovnsb_idl_loop);
-        ctx.ovs_idl_txn = idl_loop_run(&ovs_idl_loop);
-
-        /* xxx If run into any surprising changes, we exit.  We should
-         * xxx handle this more gracefully. */
-        const struct ovsrec_bridge *br_int = get_bridge(&ctx, br_int_name);
-        if (!br_int) {
-            VLOG_ERR("Integration bridge '%s' disappeared", br_int_name);
-            retval = EXIT_FAILURE;
-            goto exit;
-        }
-
-        /* Run both the binding and chassis cleanup, even if one of them
-         * returns false.  We're done if both return true. */
-        done = binding_cleanup(&ctx);
-        done = chassis_cleanup(&ctx, br_int) && done;
+        struct controller_ctx ctx = {
+            .ovs_idl = ovs_idl_loop.idl,
+            .ovs_idl_txn = ovsdb_idl_loop_run(&ovs_idl_loop),
+            .ovnsb_idl = ovnsb_idl_loop.idl,
+            .ovnsb_idl_txn = ovsdb_idl_loop_run(&ovnsb_idl_loop),
+        };
+
+        const struct ovsrec_bridge *br_int = get_br_int(&ctx);
+        const char *chassis_id = get_chassis_id(ctx.ovs_idl);
+
+        /* Run all of the cleanup functions, even if one of them returns false.
+         * We're done if all of them return true. */
+        done = binding_cleanup(&ctx, chassis_id);
+        done = chassis_cleanup(&ctx, chassis_id) && done;
+        done = encaps_cleanup(&ctx, br_int) && done;
         if (done) {
             poll_immediate_wake();
         }
 
-        idl_loop_commit_and_wait(&ovnsb_idl_loop);
-        idl_loop_commit_and_wait(&ovs_idl_loop);
+        ovsdb_idl_loop_commit_and_wait(&ovnsb_idl_loop);
+        ovsdb_idl_loop_commit_and_wait(&ovs_idl_loop);
         poll_block();
     }
 
-exit:
     unixctl_server_destroy(unixctl);
-    pipeline_destroy(&ctx);
+    lflow_destroy();
     ofctrl_destroy();
 
-    idl_loop_destroy(&ovs_idl_loop);
-    idl_loop_destroy(&ovnsb_idl_loop);
+    simap_destroy(&ct_zones);
+
+    ovsdb_idl_loop_destroy(&ovs_idl_loop);
+    ovsdb_idl_loop_destroy(&ovnsb_idl_loop);
 
-    free(br_int_name);
-    free(ctx.chassis_id);
     free(ovnsb_remote);
     free(ovs_remote);
+    service_stop();
 
     exit(retval);
 }
@@ -370,6 +576,7 @@ parse_options(int argc, char *argv[])
 {
     enum {
         OPT_PEER_CA_CERT = UCHAR_MAX + 1,
+        OPT_BOOTSTRAP_CA_CERT,
         VLOG_OPTION_ENUMS,
         DAEMON_OPTION_ENUMS
     };
@@ -381,6 +588,7 @@ parse_options(int argc, char *argv[])
         DAEMON_LONG_OPTIONS,
         STREAM_SSL_LONG_OPTIONS,
         {"peer-ca-cert", required_argument, NULL, OPT_PEER_CA_CERT},
+        {"bootstrap-ca-cert", required_argument, NULL, OPT_BOOTSTRAP_CA_CERT},
         {NULL, 0, NULL, 0}
     };
     char *short_options = ovs_cmdl_long_options_to_short_options(long_options);
@@ -409,6 +617,10 @@ parse_options(int argc, char *argv[])
             stream_ssl_set_peer_ca_cert_file(optarg);
             break;
 
+        case OPT_BOOTSTRAP_CA_CERT:
+            stream_ssl_set_ca_cert_file(optarg, true);
+            break;
+
         case '?':
             exit(EXIT_FAILURE);
 
@@ -456,3 +668,19 @@ ovn_controller_exit(struct unixctl_conn *conn, int argc OVS_UNUSED,
 
     unixctl_command_reply(conn, NULL);
 }
+
+static void
+ct_zone_list(struct unixctl_conn *conn, int argc OVS_UNUSED,
+             const char *argv[] OVS_UNUSED, void *ct_zones_)
+{
+    struct simap *ct_zones = ct_zones_;
+    struct ds ds = DS_EMPTY_INITIALIZER;
+    struct simap_node *zone;
+
+    SIMAP_FOR_EACH(zone, ct_zones) {
+        ds_put_format(&ds, "%s %d\n", zone->name, zone->data);
+    }
+
+    unixctl_command_reply(conn, ds_cstr(&ds));
+    ds_destroy(&ds);
+}