ovn/controller/lflow.c

   1 /* Copyright (c) 2015, 2016 Nicira, Inc.
   2  *
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15
  16 #include <config.h>
  17 #include "lflow.h"
  18 #include "lport.h"
  19 #include "ofctrl.h"
  20 #include "openvswitch/dynamic-string.h"
  21 #include "openvswitch/ofp-actions.h"
  22 #include "openvswitch/ofpbuf.h"
  23 #include "openvswitch/vlog.h"
  24 #include "ovn-controller.h"
  25 #include "ovn/lib/actions.h"
  26 #include "ovn/lib/expr.h"
  27 #include "ovn/lib/ovn-dhcp.h"
  28 #include "ovn/lib/ovn-sb-idl.h"
  29 #include "packets.h"
  30 #include "physical.h"
  31 #include "simap.h"
  32 #include "sset.h"
  33
  34 VLOG_DEFINE_THIS_MODULE(lflow);
  35 \f
  36 /* Symbol table. */
  37
  38 /* Contains "struct expr_symbol"s for fields supported by OVN lflows. */
  39 static struct shash symtab;
  40
  41 /* Contains an internal expr datastructure that represents an address set. */
  42 static struct shash expr_address_sets;
  43
  44 static bool full_flow_processing = false;
  45 static bool full_logical_flow_processing = false;
  46 static bool full_neighbor_flow_processing = false;
  47
  48 void
  49 lflow_reset_processing(void)
  50 {
  51     full_flow_processing = true;
  52     physical_reset_processing();
  53 }
  54
  55 static void
  56 add_logical_register(struct shash *symtab, enum mf_field_id id)
  57 {
  58     char name[8];
  59
  60     snprintf(name, sizeof name, "reg%d", id - MFF_REG0);
  61     expr_symtab_add_field(symtab, name, id, NULL, false);
  62 }
  63
  64 void
  65 lflow_init(void)
  66 {
  67     shash_init(&symtab);
  68     shash_init(&expr_address_sets);
  69
  70     /* Reserve a pair of registers for the logical inport and outport.  A full
  71      * 32-bit register each is bigger than we need, but the expression code
  72      * doesn't yet support string fields that occupy less than a full OXM. */
  73     expr_symtab_add_string(&symtab, "inport", MFF_LOG_INPORT, NULL);
  74     expr_symtab_add_string(&symtab, "outport", MFF_LOG_OUTPORT, NULL);
  75
  76     /* Logical registers. */
  77 #define MFF_LOG_REG(ID) add_logical_register(&symtab, ID);
  78     MFF_LOG_REGS;
  79 #undef MFF_LOG_REG
  80
  81     expr_symtab_add_field(&symtab, "xxreg0", MFF_XXREG0, NULL, false);
  82     expr_symtab_add_field(&symtab, "xxreg1", MFF_XXREG1, NULL, false);
  83
  84     /* Connection tracking state. */
  85     expr_symtab_add_field(&symtab, "ct_mark", MFF_CT_MARK, NULL, false);
  86     expr_symtab_add_field(&symtab, "ct_label", MFF_CT_LABEL, NULL, false);
  87     expr_symtab_add_field(&symtab, "ct_state", MFF_CT_STATE, NULL, false);
  88     char ct_state_str[16];
  89     snprintf(ct_state_str, sizeof ct_state_str, "ct_state[%d]", CS_TRACKED_BIT);
  90     expr_symtab_add_predicate(&symtab, "ct.trk", ct_state_str);
  91     snprintf(ct_state_str, sizeof ct_state_str, "ct_state[%d]", CS_NEW_BIT);
  92     expr_symtab_add_subfield(&symtab, "ct.new", "ct.trk", ct_state_str);
  93     snprintf(ct_state_str, sizeof ct_state_str, "ct_state[%d]", CS_ESTABLISHED_BIT);
  94     expr_symtab_add_subfield(&symtab, "ct.est", "ct.trk", ct_state_str);
  95     snprintf(ct_state_str, sizeof ct_state_str, "ct_state[%d]", CS_RELATED_BIT);
  96     expr_symtab_add_subfield(&symtab, "ct.rel", "ct.trk", ct_state_str);
  97     snprintf(ct_state_str, sizeof ct_state_str, "ct_state[%d]", CS_REPLY_DIR_BIT);
  98     expr_symtab_add_subfield(&symtab, "ct.rpl", "ct.trk", ct_state_str);
  99     snprintf(ct_state_str, sizeof ct_state_str, "ct_state[%d]", CS_INVALID_BIT);
 100     expr_symtab_add_subfield(&symtab, "ct.inv", "ct.trk", ct_state_str);
 101
 102     /* Data fields. */
 103     expr_symtab_add_field(&symtab, "eth.src", MFF_ETH_SRC, NULL, false);
 104     expr_symtab_add_field(&symtab, "eth.dst", MFF_ETH_DST, NULL, false);
 105     expr_symtab_add_field(&symtab, "eth.type", MFF_ETH_TYPE, NULL, true);
 106     expr_symtab_add_predicate(&symtab, "eth.bcast",
 107                               "eth.dst == ff:ff:ff:ff:ff:ff");
 108     expr_symtab_add_subfield(&symtab, "eth.mcast", NULL, "eth.dst[40]");
 109
 110     expr_symtab_add_field(&symtab, "vlan.tci", MFF_VLAN_TCI, NULL, false);
 111     expr_symtab_add_predicate(&symtab, "vlan.present", "vlan.tci[12]");
 112     expr_symtab_add_subfield(&symtab, "vlan.pcp", "vlan.present",
 113                              "vlan.tci[13..15]");
 114     expr_symtab_add_subfield(&symtab, "vlan.vid", "vlan.present",
 115                              "vlan.tci[0..11]");
 116
 117     expr_symtab_add_predicate(&symtab, "ip4", "eth.type == 0x800");
 118     expr_symtab_add_predicate(&symtab, "ip6", "eth.type == 0x86dd");
 119     expr_symtab_add_predicate(&symtab, "ip", "ip4 || ip6");
 120     expr_symtab_add_field(&symtab, "ip.proto", MFF_IP_PROTO, "ip", true);
 121     expr_symtab_add_field(&symtab, "ip.dscp", MFF_IP_DSCP, "ip", false);
 122     expr_symtab_add_field(&symtab, "ip.ecn", MFF_IP_ECN, "ip", false);
 123     expr_symtab_add_field(&symtab, "ip.ttl", MFF_IP_TTL, "ip", false);
 124
 125     expr_symtab_add_field(&symtab, "ip4.src", MFF_IPV4_SRC, "ip4", false);
 126     expr_symtab_add_field(&symtab, "ip4.dst", MFF_IPV4_DST, "ip4", false);
 127     expr_symtab_add_predicate(&symtab, "ip4.mcast", "ip4.dst[28..31] == 0xe");
 128
 129     expr_symtab_add_predicate(&symtab, "icmp4", "ip4 && ip.proto == 1");
 130     expr_symtab_add_field(&symtab, "icmp4.type", MFF_ICMPV4_TYPE, "icmp4",
 131               false);
 132     expr_symtab_add_field(&symtab, "icmp4.code", MFF_ICMPV4_CODE, "icmp4",
 133               false);
 134
 135     expr_symtab_add_field(&symtab, "ip6.src", MFF_IPV6_SRC, "ip6", false);
 136     expr_symtab_add_field(&symtab, "ip6.dst", MFF_IPV6_DST, "ip6", false);
 137     expr_symtab_add_field(&symtab, "ip6.label", MFF_IPV6_LABEL, "ip6", false);
 138
 139     expr_symtab_add_predicate(&symtab, "icmp6", "ip6 && ip.proto == 58");
 140     expr_symtab_add_field(&symtab, "icmp6.type", MFF_ICMPV6_TYPE, "icmp6",
 141                           true);
 142     expr_symtab_add_field(&symtab, "icmp6.code", MFF_ICMPV6_CODE, "icmp6",
 143                           true);
 144
 145     expr_symtab_add_predicate(&symtab, "icmp", "icmp4 || icmp6");
 146
 147     expr_symtab_add_field(&symtab, "ip.frag", MFF_IP_FRAG, "ip", false);
 148     expr_symtab_add_predicate(&symtab, "ip.is_frag", "ip.frag[0]");
 149     expr_symtab_add_predicate(&symtab, "ip.later_frag", "ip.frag[1]");
 150     expr_symtab_add_predicate(&symtab, "ip.first_frag",
 151                               "ip.is_frag && !ip.later_frag");
 152
 153     expr_symtab_add_predicate(&symtab, "arp", "eth.type == 0x806");
 154     expr_symtab_add_field(&symtab, "arp.op", MFF_ARP_OP, "arp", false);
 155     expr_symtab_add_field(&symtab, "arp.spa", MFF_ARP_SPA, "arp", false);
 156     expr_symtab_add_field(&symtab, "arp.sha", MFF_ARP_SHA, "arp", false);
 157     expr_symtab_add_field(&symtab, "arp.tpa", MFF_ARP_TPA, "arp", false);
 158     expr_symtab_add_field(&symtab, "arp.tha", MFF_ARP_THA, "arp", false);
 159
 160     expr_symtab_add_predicate(&symtab, "nd",
 161                               "icmp6.type == {135, 136} && icmp6.code == 0");
 162     expr_symtab_add_field(&symtab, "nd.target", MFF_ND_TARGET, "nd", false);
 163     expr_symtab_add_field(&symtab, "nd.sll", MFF_ND_SLL,
 164               "nd && icmp6.type == 135", false);
 165     expr_symtab_add_field(&symtab, "nd.tll", MFF_ND_TLL,
 166               "nd && icmp6.type == 136", false);
 167
 168     expr_symtab_add_predicate(&symtab, "tcp", "ip.proto == 6");
 169     expr_symtab_add_field(&symtab, "tcp.src", MFF_TCP_SRC, "tcp", false);
 170     expr_symtab_add_field(&symtab, "tcp.dst", MFF_TCP_DST, "tcp", false);
 171     expr_symtab_add_field(&symtab, "tcp.flags", MFF_TCP_FLAGS, "tcp", false);
 172
 173     expr_symtab_add_predicate(&symtab, "udp", "ip.proto == 17");
 174     expr_symtab_add_field(&symtab, "udp.src", MFF_UDP_SRC, "udp", false);
 175     expr_symtab_add_field(&symtab, "udp.dst", MFF_UDP_DST, "udp", false);
 176
 177     expr_symtab_add_predicate(&symtab, "sctp", "ip.proto == 132");
 178     expr_symtab_add_field(&symtab, "sctp.src", MFF_SCTP_SRC, "sctp", false);
 179     expr_symtab_add_field(&symtab, "sctp.dst", MFF_SCTP_DST, "sctp", false);
 180 }
 181
 182 /* Details of an address set currently in address_sets. We keep a cached
 183  * copy of sets still in their string form here to make it easier to compare
 184  * with the current values in the OVN_Southbound database. */
 185 struct address_set {
 186     char **addresses;
 187     size_t n_addresses;
 188 };
 189
 190 /* struct address_set instances for address sets currently in the symtab,
 191  * hashed on the address set name. */
 192 static struct shash local_address_sets = SHASH_INITIALIZER(&local_address_sets);
 193
 194 static int
 195 addr_cmp(const void *p1, const void *p2)
 196 {
 197     const char *s1 = p1;
 198     const char *s2 = p2;
 199     return strcmp(s1, s2);
 200 }
 201
 202 /* Return true if the address sets match, false otherwise. */
 203 static bool
 204 address_sets_match(const struct address_set *addr_set,
 205                    const struct sbrec_address_set *addr_set_rec)
 206 {
 207     char **addrs1;
 208     char **addrs2;
 209
 210     if (addr_set->n_addresses != addr_set_rec->n_addresses) {
 211         return false;
 212     }
 213     size_t n_addresses = addr_set->n_addresses;
 214
 215     addrs1 = xmemdup(addr_set->addresses,
 216                      n_addresses * sizeof addr_set->addresses[0]);
 217     addrs2 = xmemdup(addr_set_rec->addresses,
 218                      n_addresses * sizeof addr_set_rec->addresses[0]);
 219
 220     qsort(addrs1, n_addresses, sizeof *addrs1, addr_cmp);
 221     qsort(addrs2, n_addresses, sizeof *addrs2, addr_cmp);
 222
 223     bool res = true;
 224     size_t i;
 225     for (i = 0; i <  n_addresses; i++) {
 226         if (strcmp(addrs1[i], addrs2[i])) {
 227             res = false;
 228             break;
 229         }
 230     }
 231
 232     free(addrs1);
 233     free(addrs2);
 234
 235     return res;
 236 }
 237
 238 static void
 239 address_set_destroy(struct address_set *addr_set)
 240 {
 241     size_t i;
 242     for (i = 0; i < addr_set->n_addresses; i++) {
 243         free(addr_set->addresses[i]);
 244     }
 245     if (addr_set->n_addresses) {
 246         free(addr_set->addresses);
 247     }
 248     free(addr_set);
 249 }
 250
 251 static void
 252 update_address_sets(struct controller_ctx *ctx)
 253 {
 254     /* Remember the names of all address sets currently in expr_address_sets
 255      * so we can detect address sets that have been deleted. */
 256     struct sset cur_addr_set_names = SSET_INITIALIZER(&cur_addr_set_names);
 257
 258     struct shash_node *node;
 259     SHASH_FOR_EACH (node, &local_address_sets) {
 260         sset_add(&cur_addr_set_names, node->name);
 261     }
 262
 263     /* Iterate address sets in the southbound database.  Create and update the
 264      * corresponding symtab entries as necessary. */
 265     const struct sbrec_address_set *addr_set_rec;
 266     SBREC_ADDRESS_SET_FOR_EACH (addr_set_rec, ctx->ovnsb_idl) {
 267         struct address_set *addr_set =
 268             shash_find_data(&local_address_sets, addr_set_rec->name);
 269
 270         bool create_set = false;
 271         if (addr_set) {
 272             /* This address set has already been added.  We must determine
 273              * if the symtab entry needs to be updated due to a change. */
 274             sset_find_and_delete(&cur_addr_set_names, addr_set_rec->name);
 275             if (!address_sets_match(addr_set, addr_set_rec)) {
 276                 shash_find_and_delete(&local_address_sets, addr_set_rec->name);
 277                 expr_macros_remove(&expr_address_sets, addr_set_rec->name);
 278                 address_set_destroy(addr_set);
 279                 addr_set = NULL;
 280                 create_set = true;
 281             }
 282         } else {
 283             /* This address set is not yet in the symtab, so add it. */
 284             create_set = true;
 285         }
 286
 287         if (create_set) {
 288             /* The address set is either new or has changed.  Create a symbol
 289              * that resolves to the full set of addresses.  Store it in
 290              * address_sets to remember that we created this symbol. */
 291             addr_set = xzalloc(sizeof *addr_set);
 292             addr_set->n_addresses = addr_set_rec->n_addresses;
 293             if (addr_set_rec->n_addresses) {
 294                 addr_set->addresses = xmalloc(addr_set_rec->n_addresses
 295                                               * sizeof addr_set->addresses[0]);
 296                 size_t i;
 297                 for (i = 0; i < addr_set_rec->n_addresses; i++) {
 298                     addr_set->addresses[i] = xstrdup(addr_set_rec->addresses[i]);
 299                 }
 300             }
 301             shash_add(&local_address_sets, addr_set_rec->name, addr_set);
 302
 303             expr_macros_add(&expr_address_sets, addr_set_rec->name,
 304                             (const char * const *) addr_set->addresses,
 305                             addr_set->n_addresses);
 306         }
 307     }
 308
 309     /* Anything remaining in cur_addr_set_names refers to an address set that
 310      * has been deleted from the southbound database.  We should delete
 311      * the corresponding symtab entry. */
 312     const char *cur_node, *next_node;
 313     SSET_FOR_EACH_SAFE (cur_node, next_node, &cur_addr_set_names) {
 314         expr_macros_remove(&expr_address_sets, cur_node);
 315
 316         struct address_set *addr_set
 317             = shash_find_and_delete(&local_address_sets, cur_node);
 318         address_set_destroy(addr_set);
 319
 320         struct sset_node *sset_node = SSET_NODE_FROM_NAME(cur_node);
 321         sset_delete(&cur_addr_set_names, sset_node);
 322     }
 323
 324     sset_destroy(&cur_addr_set_names);
 325 }
 326 \f
 327 struct lookup_port_aux {
 328     const struct lport_index *lports;
 329     const struct mcgroup_index *mcgroups;
 330     const struct sbrec_datapath_binding *dp;
 331 };
 332
 333 static void consider_logical_flow(const struct lport_index *lports,
 334                                   const struct mcgroup_index *mcgroups,
 335                                   const struct sbrec_logical_flow *lflow,
 336                                   const struct hmap *local_datapaths,
 337                                   const struct hmap *patched_datapaths,
 338                                   struct group_table *group_table,
 339                                   const struct simap *ct_zones,
 340                                   struct hmap *dhcp_opts_p,
 341                                   uint32_t *conj_id_ofs_p);
 342
 343 static bool
 344 lookup_port_cb(const void *aux_, const char *port_name, unsigned int *portp)
 345 {
 346     const struct lookup_port_aux *aux = aux_;
 347
 348     const struct sbrec_port_binding *pb
 349         = lport_lookup_by_name(aux->lports, port_name);
 350     if (pb && pb->datapath == aux->dp) {
 351         *portp = pb->tunnel_key;
 352         return true;
 353     }
 354
 355     const struct sbrec_multicast_group *mg
 356         = mcgroup_lookup_by_dp_name(aux->mcgroups, aux->dp, port_name);
 357     if (mg) {
 358         *portp = mg->tunnel_key;
 359         return true;
 360     }
 361
 362     return false;
 363 }
 364
 365 static bool
 366 is_switch(const struct sbrec_datapath_binding *ldp)
 367 {
 368     return smap_get(&ldp->external_ids, "logical-switch") != NULL;
 369
 370 }
 371
 372 /* Adds the logical flows from the Logical_Flow table to flow tables. */
 373 static void
 374 add_logical_flows(struct controller_ctx *ctx, const struct lport_index *lports,
 375                   const struct mcgroup_index *mcgroups,
 376                   const struct hmap *local_datapaths,
 377                   const struct hmap *patched_datapaths,
 378                   struct group_table *group_table,
 379                   const struct simap *ct_zones)
 380 {
 381     uint32_t conj_id_ofs = 1;
 382     const struct sbrec_logical_flow *lflow;
 383
 384     if (full_flow_processing) {
 385         ovn_flow_table_clear();
 386         full_logical_flow_processing = true;
 387         full_neighbor_flow_processing = true;
 388         full_flow_processing = false;
 389         physical_reset_processing();
 390     }
 391
 392     struct hmap dhcp_opts = HMAP_INITIALIZER(&dhcp_opts);
 393     const struct sbrec_dhcp_options *dhcp_opt_row;
 394     SBREC_DHCP_OPTIONS_FOR_EACH(dhcp_opt_row, ctx->ovnsb_idl) {
 395         dhcp_opt_add(&dhcp_opts, dhcp_opt_row->name, dhcp_opt_row->code,
 396                      dhcp_opt_row->type);
 397     }
 398
 399     if (full_logical_flow_processing) {
 400         SBREC_LOGICAL_FLOW_FOR_EACH (lflow, ctx->ovnsb_idl) {
 401             consider_logical_flow(lports, mcgroups, lflow, local_datapaths,
 402                                   patched_datapaths, group_table, ct_zones,
 403                                   &dhcp_opts, &conj_id_ofs);
 404         }
 405         full_logical_flow_processing = false;
 406     } else {
 407         /* First, remove any flows that should be removed. */
 408         SBREC_LOGICAL_FLOW_FOR_EACH_TRACKED (lflow, ctx->ovnsb_idl) {
 409             if (sbrec_logical_flow_is_deleted(lflow)) {
 410                 ofctrl_remove_flows(&lflow->header_.uuid);
 411             }
 412         }
 413
 414         /* Now, add/modify existing flows. */
 415         SBREC_LOGICAL_FLOW_FOR_EACH_TRACKED (lflow, ctx->ovnsb_idl) {
 416             if (!sbrec_logical_flow_is_deleted(lflow)) {
 417                 /* if the logical flow is a modification, just remove
 418                  * the flows for this row, and then add new flows. */
 419                 if (!sbrec_logical_flow_is_new(lflow)) {
 420                     ofctrl_remove_flows(&lflow->header_.uuid);
 421                 }
 422                 consider_logical_flow(lports, mcgroups, lflow,
 423                                       local_datapaths, patched_datapaths,
 424                                       group_table, ct_zones,
 425                                       &dhcp_opts, &conj_id_ofs);
 426             }
 427         }
 428     }
 429
 430     dhcp_opts_destroy(&dhcp_opts);
 431 }
 432
 433 static void
 434 consider_logical_flow(const struct lport_index *lports,
 435                       const struct mcgroup_index *mcgroups,
 436                       const struct sbrec_logical_flow *lflow,
 437                       const struct hmap *local_datapaths,
 438                       const struct hmap *patched_datapaths,
 439                       struct group_table *group_table,
 440                       const struct simap *ct_zones,
 441                       struct hmap *dhcp_opts_p,
 442                       uint32_t *conj_id_ofs_p)
 443 {
 444     /* Determine translation of logical table IDs to physical table IDs. */
 445     bool ingress = !strcmp(lflow->pipeline, "ingress");
 446
 447     const struct sbrec_datapath_binding *ldp = lflow->logical_datapath;
 448     if (!ldp) {
 449         return;
 450     }
 451     if (is_switch(ldp)) {
 452         /* For a logical switch datapath, local_datapaths tells us if there
 453          * are any local ports for this datapath.  If not, we can skip
 454          * processing logical flows if that logical switch datapath is not
 455          * patched to any logical router.
 456          *
 457          * Otherwise, we still need both ingress and egress pipeline
 458          * because even if there are no local ports, we still may need to
 459          * execute the ingress pipeline after a packet leaves a logical
 460          * router and we need to do egress pipeline for a switch that
 461          * is connected to only routers.  Further optimization is possible,
 462          * but not based on what we know with local_datapaths right now.
 463          *
 464          * A better approach would be a kind of "flood fill" algorithm:
 465          *
 466          *   1. Initialize set S to the logical datapaths that have a port
 467          *      located on the hypervisor.
 468          *
 469          *   2. For each patch port P in a logical datapath in S, add the
 470          *      logical datapath of the remote end of P to S.  Iterate
 471          *      until S reaches a fixed point.
 472          *
 473          * This can be implemented in northd, which can generate the sets and
 474          * save it on each port-binding record in SB, and ovn-controller can
 475          * use the information directly. However, there can be update storms
 476          * when a pair of patch ports are added/removed to connect/disconnect
 477          * large lrouters and lswitches. This need to be studied further.
 478          */
 479
 480         if (!get_local_datapath(local_datapaths, ldp->tunnel_key)) {
 481             if (!get_patched_datapath(patched_datapaths,
 482                                       ldp->tunnel_key)) {
 483                 return;
 484             }
 485         }
 486     }
 487
 488     /* Determine translation of logical table IDs to physical table IDs. */
 489     uint8_t first_ptable = (ingress
 490                             ? OFTABLE_LOG_INGRESS_PIPELINE
 491                             : OFTABLE_LOG_EGRESS_PIPELINE);
 492     uint8_t ptable = first_ptable + lflow->table_id;
 493     uint8_t output_ptable = (ingress
 494                              ? OFTABLE_REMOTE_OUTPUT
 495                              : OFTABLE_LOG_TO_PHY);
 496
 497     /* Translate OVN actions into OpenFlow actions.
 498      *
 499      * XXX Deny changes to 'outport' in egress pipeline. */
 500     uint64_t ofpacts_stub[64 / 8];
 501     struct ofpbuf ofpacts;
 502     struct expr *prereqs;
 503     char *error;
 504
 505     ofpbuf_use_stub(&ofpacts, ofpacts_stub, sizeof ofpacts_stub);
 506     struct lookup_port_aux aux = {
 507         .lports = lports,
 508         .mcgroups = mcgroups,
 509         .dp = lflow->logical_datapath
 510     };
 511     struct action_params ap = {
 512         .symtab = &symtab,
 513         .dhcp_opts = dhcp_opts_p,
 514         .lookup_port = lookup_port_cb,
 515         .aux = &aux,
 516         .ct_zones = ct_zones,
 517         .group_table = group_table,
 518
 519         .n_tables = LOG_PIPELINE_LEN,
 520         .first_ptable = first_ptable,
 521         .cur_ltable = lflow->table_id,
 522         .output_ptable = output_ptable,
 523         .arp_ptable = OFTABLE_MAC_BINDING,
 524     };
 525     error = actions_parse_string(lflow->actions, &ap, &ofpacts, &prereqs);
 526     if (error) {
 527         static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 1);
 528         VLOG_WARN_RL(&rl, "error parsing actions \"%s\": %s",
 529                      lflow->actions, error);
 530         free(error);
 531         return;
 532     }
 533
 534     /* Translate OVN match into table of OpenFlow matches. */
 535     struct hmap matches;
 536     struct expr *expr;
 537
 538     expr = expr_parse_string(lflow->match, &symtab,
 539                              &expr_address_sets, &error);
 540     if (!error) {
 541         if (prereqs) {
 542             expr = expr_combine(EXPR_T_AND, expr, prereqs);
 543             prereqs = NULL;
 544         }
 545         expr = expr_annotate(expr, &symtab, &error);
 546     }
 547     if (error) {
 548         static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 1);
 549         VLOG_WARN_RL(&rl, "error parsing match \"%s\": %s",
 550                      lflow->match, error);
 551         expr_destroy(prereqs);
 552         ofpbuf_uninit(&ofpacts);
 553         free(error);
 554         return;
 555     }
 556
 557     expr = expr_simplify(expr);
 558     expr = expr_normalize(expr);
 559     uint32_t n_conjs = expr_to_matches(expr, lookup_port_cb, &aux,
 560                                        &matches);
 561     expr_destroy(expr);
 562
 563     /* Prepare the OpenFlow matches for adding to the flow table. */
 564     struct expr_match *m;
 565     HMAP_FOR_EACH (m, hmap_node, &matches) {
 566         match_set_metadata(&m->match,
 567                            htonll(lflow->logical_datapath->tunnel_key));
 568         if (m->match.wc.masks.conj_id) {
 569             m->match.flow.conj_id += *conj_id_ofs_p;
 570         }
 571         if (!m->n) {
 572             ofctrl_add_flow(ptable, lflow->priority, &m->match, &ofpacts,
 573                             &lflow->header_.uuid);
 574         } else {
 575             uint64_t conj_stubs[64 / 8];
 576             struct ofpbuf conj;
 577
 578             ofpbuf_use_stub(&conj, conj_stubs, sizeof conj_stubs);
 579             for (int i = 0; i < m->n; i++) {
 580                 const struct cls_conjunction *src = &m->conjunctions[i];
 581                 struct ofpact_conjunction *dst;
 582
 583                 dst = ofpact_put_CONJUNCTION(&conj);
 584                 dst->id = src->id + *conj_id_ofs_p;
 585                 dst->clause = src->clause;
 586                 dst->n_clauses = src->n_clauses;
 587             }
 588             ofctrl_add_flow(ptable, lflow->priority, &m->match, &conj,
 589                             &lflow->header_.uuid);
 590                 ofpbuf_uninit(&conj);
 591             ofpbuf_uninit(&conj);
 592         }
 593     }
 594
 595     /* Clean up. */
 596     expr_matches_destroy(&matches);
 597     ofpbuf_uninit(&ofpacts);
 598     *conj_id_ofs_p += n_conjs;
 599 }
 600
 601 static void
 602 put_load(const uint8_t *data, size_t len,
 603          enum mf_field_id dst, int ofs, int n_bits,
 604          struct ofpbuf *ofpacts)
 605 {
 606     struct ofpact_set_field *sf = ofpact_put_SET_FIELD(ofpacts);
 607     sf->field = mf_from_id(dst);
 608     sf->flow_has_vlan = false;
 609
 610     bitwise_copy(data, len, 0, &sf->value, sf->field->n_bytes, ofs, n_bits);
 611     bitwise_one(&sf->mask, sf->field->n_bytes, ofs, n_bits);
 612 }
 613
 614 static void
 615 consider_neighbor_flow(const struct lport_index *lports,
 616                        const struct sbrec_mac_binding *b,
 617                        struct ofpbuf *ofpacts_p,
 618                        struct match *match_p)
 619 {
 620     const struct sbrec_port_binding *pb
 621         = lport_lookup_by_name(lports, b->logical_port);
 622     if (!pb) {
 623         return;
 624     }
 625
 626     struct eth_addr mac;
 627     if (!eth_addr_from_string(b->mac, &mac)) {
 628         static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1);
 629         VLOG_WARN_RL(&rl, "bad 'mac' %s", b->mac);
 630         return;
 631     }
 632
 633     ovs_be32 ip;
 634     if (!ip_parse(b->ip, &ip)) {
 635         static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1);
 636         VLOG_WARN_RL(&rl, "bad 'ip' %s", b->ip);
 637         return;
 638     }
 639
 640     match_set_metadata(match_p, htonll(pb->datapath->tunnel_key));
 641     match_set_reg(match_p, MFF_LOG_OUTPORT - MFF_REG0, pb->tunnel_key);
 642     match_set_reg(match_p, 0, ntohl(ip));
 643
 644     ofpbuf_clear(ofpacts_p);
 645     put_load(mac.ea, sizeof mac.ea, MFF_ETH_DST, 0, 48, ofpacts_p);
 646
 647     ofctrl_add_flow(OFTABLE_MAC_BINDING, 100, match_p, ofpacts_p,
 648                     &b->header_.uuid);
 649 }
 650
 651 /* Adds an OpenFlow flow to flow tables for each MAC binding in the OVN
 652  * southbound database, using 'lports' to resolve logical port names to
 653  * numbers. */
 654 static void
 655 add_neighbor_flows(struct controller_ctx *ctx,
 656                    const struct lport_index *lports)
 657 {
 658     struct ofpbuf ofpacts;
 659     struct match match;
 660     match_init_catchall(&match);
 661     ofpbuf_init(&ofpacts, 0);
 662
 663     const struct sbrec_mac_binding *b;
 664     if (full_neighbor_flow_processing) {
 665         SBREC_MAC_BINDING_FOR_EACH (b, ctx->ovnsb_idl) {
 666             consider_neighbor_flow(lports, b, &ofpacts, &match);
 667         }
 668         full_neighbor_flow_processing = false;
 669     } else {
 670         SBREC_MAC_BINDING_FOR_EACH_TRACKED (b, ctx->ovnsb_idl) {
 671             if (sbrec_mac_binding_is_deleted(b)) {
 672                 ofctrl_remove_flows(&b->header_.uuid);
 673             } else {
 674                 if (!sbrec_mac_binding_is_new(b)) {
 675                     ofctrl_remove_flows(&b->header_.uuid);
 676                 }
 677                 consider_neighbor_flow(lports, b, &ofpacts, &match);
 678             }
 679         }
 680     }
 681
 682     ofpbuf_uninit(&ofpacts);
 683 }
 684 \f
 685 /* Translates logical flows in the Logical_Flow table in the OVN_SB database
 686  * into OpenFlow flows.  See ovn-architecture(7) for more information. */
 687 void
 688 lflow_run(struct controller_ctx *ctx, const struct lport_index *lports,
 689           const struct mcgroup_index *mcgroups,
 690           const struct hmap *local_datapaths,
 691           const struct hmap *patched_datapaths,
 692           struct group_table *group_table,
 693           const struct simap *ct_zones)
 694 {
 695     update_address_sets(ctx);
 696     add_logical_flows(ctx, lports, mcgroups, local_datapaths,
 697                       patched_datapaths, group_table, ct_zones);
 698     add_neighbor_flows(ctx, lports);
 699 }
 700
 701 void
 702 lflow_destroy(void)
 703 {
 704     expr_symtab_destroy(&symtab);
 705     shash_destroy(&symtab);
 706     expr_macros_destroy(&expr_address_sets);
 707     shash_destroy(&expr_address_sets);
 708 }