ovs-ofctl.8: Improve description of dec_ttl action.

Signed-off-by: Justin Pettit <jpettit@ovn.org>
Acked-by: Ben Pfaff <blp@ovn.org>

ovs-thread: Fix memory leak in thread exit.

'n' is the number of keys, which are grouped into blocks of L2_SIZE
indexes.  Even if only one key in a block is allocated, the whole block has
a pointer to it that must be freed.  Thus, we need to round up instead of
down.

Reported-at: https://github.com/openvswitch/ovs/pull/87
Signed-off-by: Ben Pfaff <blp@ovn.org>
Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>

tunneling: extend tnl_match with ipv6

[cascardo: use IPv4-mapped IPv6 addresses]

Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com>
Co-authored-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com>
Signed-off-by: Ben Pfaff <blp@ovn.org>

tnl-arp-cache: Include tnl-arp-cache.h as first header.

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com>
Signed-off-by: Ben Pfaff <blp@ovn.org>

tnl-arp-cache: fix log error when using tnl/arp/set with IPv6

lookup_ip will emit an error when used with an IPv6 address, like below.

2015-10-20T18:48:22.357Z|00036|socket_util|ERR|"2001:cafe::92" is not a valid IP address

Verify if address looks like IPv6 before giving it to either lookup_ip or
lookup_ipv6.

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com>
Signed-off-by: Ben Pfaff <blp@ovn.org>

lib: add ipv6 helper functions for tnl_config

These functions will be used by the next patches.

Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com>
Signed-off-by: Ben Pfaff <blp@ovn.org>

ovn-northd: Support pinging logical router ports.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Russell Bryant <rbryant@redhat.com>

vswitchd: Allow modifying ICMP type and code.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Flavio Leitner <fbl@sysclose.org>

packets: Add support for modifying ICMP type and code.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Flavio Leitner <fbl@sysclose.org>

ovn: Change printed stage names.

The stage names were getting long and throwing off the formatting when
dumping the logical flows.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Russell Bryant <rbryant@redhat.com>

ovn: Use "ip.ttl--" instead of "ip4.ttl--".

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Russell Bryant <rbryant@redhat.com>

ovn-sb: Fix "ip.ttl--" lower limit description.

To decrement the IP TTL, the existing TTL can't be less than two.  The
field is not bit-maskable, though, so "ip.ttl < 2" will not work.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Russell Bryant <rbryant@redhat.com>

ovn-northd.8: Correct description of sending out inport.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Russell Bryant <rbryant@redhat.com>

AUTHORS: Update my email address.

Signed-off-by: Ben Pfaff <blp@ovn.org>
Acked-by: Justin Pettit <jpettit@ovn.org>

TODO.md: Remove old item.

The patchwork instance has been recreated, so this doesn't point any
place valid.

Signed-off-by: Justin Pettit <jpettit@ovn.org>
Acked-by: Russell Bryant <rbryant@redhat.com>
Acked-by: Ben Pfaff <blp@ovn.org>

AUTHORS: Update Justin Pettit's email address.

Signed-off-by: Justin Pettit <jpettit@ovn.org>
Acked-by: Russell Bryant <rbryant@redhat.com>
Acked-by: Ben Pfaff <blp@ovn.org>

INSTALL.DPDK: Mention issue with QEMU v2.4.0 & dpdkvhostuser

Currently when using QEMU v2.4.0+, two (or more) dpdkvhostuser ports cannot
be unbound from the kernel driver in the guest without causing the
ovs-vswitchd process to crash. Document this limitation and potential
workarounds.

Signed-off-by: Ciara Loftus <ciara.loftus@intel.com>
Acked-by: Acked-by: Daniele Di Proietto <diproiettod@vmware.com>

upcall: Check for recirc_id in ukey_create_from_dpif_flow()

Filter out not only flows with recirculation actions, but also flows
with non-zero recirculation id in flow key when creating ukeys from
datapath flows, as such flows also depend on the recirculation
context, which have been lost after a restart.

Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Joe Stringer <joestringer@nicira.com>

ofp-actions: Fix conntrack action usable_protocols handling.

Restrictions from embedded actions should be folded in rather than
discarded.

Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Joe Stringer <joestringer@nicira.com>

upcall: Eliminate dead code.

Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Joe Stringer <joestringer@nicira.com>

tests: Strip more variable output from conntrack output.

'conntrack' output format varies depending on the system
configuration, i.e., conntrack accounting or timestamping is enabled.
Modify the FORMAT_CT() macro to hide these differences.

Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Joe Stringer <joestringer@nicira.com>

ovn-tutorial: Add a section on ACLs.

Add a section that gives a quick introduction to applying ACLs.  It
discusses how the ACLs are translated into OVN logical flows. It doesn't
get down to the OpenFlow level because that's not supported in
ovs-sandbox yet.  Instead, it provides a reference to an OpenStack
related blog post that talks about how OVN ACLs are used there and gives
examples of the resulting OpenFlow flows.

In theory, once we have a userspace conntrack implementation available,
we'll be able to provide better suppot for it in ovs-sandbox.

Signed-off-by: Russell Bryant <rbryant@redhat.com>
Acked-by: Kyle Mestery <mestery@mestery.com>

ofp-parse: Fix parsing, formatting of multiple fields in NTR extension.

Until now, the only way to specify multiple fields in the "fields"
parameter for the Netronome groups extension, was to specify "fields"
more than once, e.g. fields=eth_dst,fields=ip_dst

However, this wasn't documented and the code in ofp-print didn't use it,
generating output that couldn't be parsed.

This commit fixes the situation by introducing a more straightforward
syntax, e.g. fields(eth_dst,ip_dst), documents it, and adjusts ofp-print
code to use it when there is more than one field (it retains the previous
format for backward compatibility when there is exactly one field)

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Simon Horman <simon.horman@netronome.com>

dpctl: Fix jump through wild pointer in "dpctl/help".

dpctl_unixctl_handler() didn't fully initialize the dpctl_params structure
it passed to the handler, which meant that dpctl_help() could see a nonnull
(indeterminate) 'usage' pointer and jump through it, causes a crash.
This commit fixes the crash by fully initializing the structure.

The dpctl/help command wasn't going to do anything useful anyway, so this
commit also stops registering it.

Reported-by: Murali R <muralirdev@gmail.com>
Reported-at: http://openvswitch.org/pipermail/discuss/2015-October/019135.html
Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Daniele Di Proietto <diproiettod@vmware.com>

tests: add documentation for OVS_WAIT_UNTIL and OVS_WAIT_WHILE macros

It is very easy to misuse these macros, because when the COMMAND
returns exit code "0" it is actually considered as if condition
evaluated to "true" and not "false" as some might think.

This patch ensures that this is clearly reflected in documentation.

Acked-by: Ben Pfaff <blp@nicira.com>
Signed-off-by: Ansis Atteka <aatteka@nicira.com>

ovn-northd: Fix table ID in a comment.

This changed from 2 to 3 when ACLs got implemented, as it turned out
ACLs needed two tables (1 and 2).

While we're at it, do a bit of OCD formatting cleanup by fixing the
alignment of '\' at the end of each line in the logical flow table
defininitions.

Signed-off-by: Russell Bryant <rbryant@redhat.com>
Acked-by: Ben Pfaff <blp@nicira.com>

ovn: Remove duplicate versions from schemas.

Since commit 5935835968c9d36ffe306863f0c8079d3b670e2a, the OVN nb and sb
schema definitions have included duplicate version entries.  In the nb
case, the version has since been updated to 2.0.0, but only in one
place.  Remove the duplicate version entries that were at the bottom of
the files.

Signed-off-by: Russell Bryant <rbryant@redhat.com>
Acked-by: Ben Pfaff <blp@nicira.com>

ovn: Fix check on existing encap row.

This code does some checking to validate the existing encaps for a
chassis to see if they need to be updated.  This typo resulted in
ovn-controller re-creating its encap(s) every time this code ran, making
ovn-controller and ovsdb-server eat up a CPU in my testing.

Signed-off-by: Russell Bryant <rbryant@redhat.com>
Acked-by: Ben Pfaff <blp@nicira.com>

datapath-windows: STT - Offload inner checksum calculation

Offload the inner checksum computation to NDIS in OvsDecapStt function.

Signed-off-by: Sairam Venugopal <vsairam@vmware.com>
Acked-by: Nithin Raju <nithin@vmware.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>

bfd: improve ovs-vswitchd.conf.db(5) manpage

Use the wording from RFC 5880 to describe the "diagnostic" and
"remote_diagnostic" fields.

Reported-by: Justin Pettit <jpettit@nicira.com>
Signed-off-by: Andy Zhou <azhou@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

datapath-windows: Report correctly when trying to add tunnel types

Report invalid parameter to the userspace if the user tries to add a vport
tunnel type which is not supported by the kernel extension.

Signed-off-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com>
Acked-by: Sairam Venugopal <vsairam@vmware.com>
Acked-by: Nithin Raju <nithin@vmware.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>

datapath-windows: Updating an External Adapter causes flow lookup failure

This patch fixes an issue with updating the propeties of an external
adapter in Windows. The issue causes flow lookups to fail until the
kernel is reinstalled.

Reported-at: https://github.com/openvswitch/ovs-issues/issues/102
Signed-off-by: Sairam Venugopal <vsairam@vmware.com>
Acked-by: Nithin Raju <nithin@vmware.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>

debian: place kernel module to satisfy depmod search.

On Ubuntu depmod's search priority is configured in /etc/depmod to be
updates and then the kernel built-in directory.
$ cat /etc/depmod.d/ubuntu.conf
search updates ubuntu built-in

Thus change the placement of openvswitch.ko under updates/ not kernel/updates.

Acked-by: Ansis Atteka <aatteka@nicira.com>
Signed-off-by: Saurabh Mohan <saurabh@cplanenetworks.com>

travis: Update target kernel list.

Update the kernel list to sync with stable kernels from kernel.org

Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Acked-by: Joe Stringer <joestringer@nicira.com>

test: Make test independent of the recirc_id

Commit 8ae8176fd0d8ed919e3301cc961dcf02b65ff49d (tests: Make test
independent of the hash function) improves the test "ofprot-dpif
- balance-tcp bonding, different recirc flow" to not dependent on
the values of dp-hash, but it still depends on the value of recirc_id,
which can be a different value based on runs, specifically, it depends
which one of the two bonds allocates recirc id first.

Since both dp_hash and recirc_id values are runtime dependent,
consolidate the masking scripts into ofctl_strip.

Bug-report: http://openvswitch.org/pipermail/discuss/2015-October/019269.html
Reported-by: Gerhrd Stenzel <gstenzel@linux.vnet.ibm.com>
Signed-off-by: Andy Zhou <azhou@nicira.com>
Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>

AUTHORS: use actual address for emaste@freebsd.org

Signed-off-by: Ed Maste <emaste@freebsd.org>
Signed-off-by: Russell Bryant <rbryant@redhat.com>

INSTALL.DPDK.md: Fix small documentation error in ovs with DPDK installation

The openvswitch directory does not exist anymore, boot.sh and configure are
located at $(OVS_DIR).

Signed-off-by: Mauricio Vasquez B <mauricio.vasquezbernal@studenti.polito.it>
Acked-by: Daniele Di Proietto <diproiettod@vmware.com>

datapath-windows: STT - Enable support for TCP Segmentation offloads

Add support to STT - Encap and Decap functions to reassemble the packet
fragments. Also add support to offload the packet to NDIS.

Signed-off-by: Sairam Venugopal <vsairam@vmware.com>
Acked-by: Nithin Raju <nithin@vmware.com>
Signed-off-by: Gurucharan Shetty <gshetty@nicira.com>

datapath-windows: STT - Add support for TCP Segmentation Offload

Create and initialize the background thread and buffer that
assists in defragmenting and completing a TSO packet.

Signed-off-by: Sairam Venugopal <vsairam@vmware.com>
Acked-by: Nithin Raju <nithin@vmware.com>
Signed-off-by: Gurucharan Shetty <gshetty@nicira.com>

datapath-windows: Move OvsAllocateNBLFromBuffer to BufferMgmt

Move the functionality around creating an NBL from Buffer to
Buffermanagement. This function will be used for converting the buffer
from user-space to NBL and also by STT - reassembly logic.

Signed-off-by: Sairam Venugopal <vsairam@vmware.com>
Acked-by: Nithin Raju <nithin@vmware.com>
Signed-off-by: Gurucharan Shetty <gshetty@nicira.com>

Revert "datapath-windows: Support attribute OVS_KEY_ATTR_TCP_FLAGS"

This reverts commit a26b2023ce33fed1ef962012dc2c03765d2e92cb.

This patch punishes performance without the implementation of
megaflows on Windows.

Once megaflows is implemented in the flow logic this patch will be
revisited.

Signed-off-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com>
Acked-by: Sairam Venugopal <vsairam@vmware.com>
Signed-off-by: Gurucharan Shetty <gshetty@nicira.com>

tests: Enable debugging in pyftpdlib.

Helps diagnosing problems.

Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Joe Stringer <joestringer@nicira.com>

odp-util: Fix CT action formating.

Comma was missing after "label" attribute.

Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Joe Stringer <joestringer@nicira.com>

datapath-windows: Support attribute OVS_KEY_ATTR_TCP_FLAGS

This patch adds OVS_KEY_ATTR_TCP_FLAGS to our flow mechanism.

Also clean unecesarry parts of code.

Signed-off-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com>
Co-authored-by: Sorin Vinturis <svinturis@cloudbasesolutions.com>
Signed-off-by: Sorin Vinturis <svinturis@cloudbasesolutions.com>
Acked-by: Nithin Raju <nithin@vmware.com>
Signed-off-by: Gurucharan Shetty <gshetty@nicira.com>

bfd: always export remote_state and remote_diagnostic to OVSDB

RFC 5880 specified bfd.RemoteSessionState as one of the state
variables.  In OVS implementation, this value is exported to OVSDB's
BFD status column of the interface table, as one of the map elements,
with the key of 'remote_state'.

It can be surprising when the 'remote_state' map element disappears
when BFD is in the 'DOWN' state, but otherwise always exported.
Change to always exporting it, to make it more predictable for
applications that monitors the BFD status column.

While at it, make the same change to 'remote_diagnostic', so that it
is also always exported to OVSDB for consistency.

VMWare-BZ: 1535979
Reported-by: Mihir Gangar <gangarm@vmware.com>
Signed-off-by: Andy Zhou <azhou@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ofproto-dpif-xlate: Fix small typo.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Andy Zhou <azhou@nicira.com>

ovn-nbctl: Fix memory leak in option processing.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Andy Zhou <azhou@nicira.com>

test-ovn: Fix memory leak in option processing.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Andy Zhou <azhou@nicira.com>

ovsdb: Fix outdated comment for function description.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Andy Zhou <azhou@nicira.com>

ovsdb: Destroy allocated hmap.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Andy Zhou <azhou@nicira.com>

ovsdb-server: Destroy allocated shash.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Andy Zhou <azhou@nicira.com>

tnl-ports: Free "ip_dev" on error.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Andy Zhou <azhou@nicira.com>

vtep-ctl: Exit if database connection fails.

Before this commit vtep-ctl hung forever if it didn't manage to reach
the database.

This caused the testcase "ovn -- 3 HVs, 1 VIFs/HV, 1 GW, 1 LS" to hang
occasionally, because ovsdb-server could be killed before ovs-vtep
called vtep-ctl.

This mimics the behaviour of ovs-vsctl, ovn-nbctl and ovn-sbctl.

Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn-northd: Fix memory leak in ARP reply flows.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>

netdev-dpdk: Clean-up after vHost User port delete

Unregister and delete the socket associated with a vhost-user
port when the port is deleted and/or the switch is brought down.
Do not delete the socket if the vhost-user device is still attached
to the guest.

Signed-off-by: Ciara Loftus <ciara.loftus@intel.com>
Acked-by: Daniele Di Proietto <diproiettod@vmware.com>

netdev-dpdk: Fix comment about vhost cuse/user vswitchd arguments

Signed-off-by: Ciara Loftus <ciara.loftus@intel.com>
Acked-by: Daniele Di Proietto <diproiettod@vmware.com>

ovn-northd: Fix memory leak in logical router flow generation.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Russell Bryant <rbryant@redhat.com>

datapath-windows: fix NULL check in OvsGetExtInfoIoctl()

End result is that "mac_in_use" column gets populated in
OVSDB for internal and external NICs.

Signed-off-by: Nithin Raju <nithin@vmware.com>
Acked-by: Sorin Vinturis <svinturis@cloudbasesolutions.com>
Acked-by: Sairam Venugopal <vsairam@vmware.com>
Signed-off-by: Gurucharan Shetty <gshetty@nicira.com>

ovn: Reduce range of ACL priorities.

To implement stateful ACLs, we've needed to reserve multiple logical
flow priorities in the ACL table.  Rather than continue to have a
strange range of ACL priorities, we'll make ACL priority range 0 to
32767 and then offset them by 1000 when inserting them into the logical
flow table.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>

ovs-ofctl: Fix OpenFlow versions with '--bundle'

While the presence of the '--bundle' option implicitly added the
OpenFlow 1.4 to the allowed protocols, it failed to remove OpenFlow
1.0 from the allowed protocols.  This is changed so that '--bundle'
option now also implicitly removes versions lesser than 1.4 from the
allowed protocols.  This has no behavioral difference when ovs-ofctl
is paired with OVS that supports OpenFlow 1.4, as the greatest common
version is negotiated, but prevents negotiation of OpenFlow 1.0 when
OVS does not support OpenFlow 1.4.

Found by inspection.

Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: YAMAMOTO Takashi <yamamoto@midokura.com>

ovs-ofctl: Fix replace-flows.

The replace-flows test cases tested for incorrect
behavior due to the missing initialization of the out_group member of
struct ofputil_flow_stats_request.  This patch fixes this by properly
initializing out_group to OFPG_ANY.

Note that replace-flows still does not support multiple tables, but
that will be fixed in a later patch in the series.

Reported-by: YAMAMOTO Takashi <yamamoto@midokura.com>
Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: YAMAMOTO Takashi <yamamoto@midokura.com>

ovn: Support multiple router ports per logical switch.

This allows multiple subnets to be routed directly to a logical switch.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn: Add test for logical router ARP replies.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

physical: Fix implementation of logical patch ports.

Logical patch ports do not have a physical location and effectively reside
on every hypervisor.  This is fine for unicast output to logical patch
ports.  However, when a logical patch port is part of a logical multicast
group, lumping them together with the other "local" ports in a multicast
group yields packet duplication, because every hypervisor to which the
packet is tunneled re-outputs it to the logical patch port.

This commit fixes the problem, by treating logical patch ports as remote
rather than local when they are part of a logical multicast group.  This
yields exactly-once semantics.

Found while testing implementation of ARP in OVN logical router.  The
following commit adds a test that fails without this fix.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn: Implement the ability to send a packet back out its input port.

Otherwise logical router ARP replies won't work as implemented.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

logical-fields: New header for logical field assignments.

The original concept for "expr" and "actions" was that they should not need
to know anything about the mapping between physical and logical fields,
that instead everything should be provided via the symbol table.  In
practice this has proven difficult because a couple of actions need to know
about logical fields.  For now, it seems reasonable to put the logical
field mapping into a header of its own.  Later, maybe we'll figure out
whether there's value in a less leaky abstraction.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

packets: Make ip_parse_masked() pickier about formatting.

It's happened a couple of times now that I've entered a typoed IP address,
e.g. "192.168.0.0$x", and ip_parse_masked() or its predecessor has accepted
it anyway, and it's been hard to track down the real problem.  This change
makes the parser pickier, by disallowing trailing garbage.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn: Implement basic logical L3 routing.

This implements basic logical L3 routing.  It has a lot of caveats,
including the following regarding testing:

   * Only single-router hops have been tested.  Chains or trees of
     logical routers may work but definitely need testing and may
     need a little extra code.

   * No testing of logical router ARP replies.

   * Not enough testing in general.

ovn/TODO describes a lot of other caveats in terms of the work needed
to fix them.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn-northd: Add stages for logical routers.

Until now, ovn-northd has only set up flows for logical switches.  With the
arrival of logical routers, it needs to set up flows for them too.  The
stages within logical routers are completely different from those for
logical switches, so this prepares for that by adding logic for identifying
those stages.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

packets: New function ip_parse_masked().

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn-nb: Add "enabled" column to Logical_Router_Port.

This is just for symmetry with Logical_Port, since it seems that if users
want to be able to disable switch ports they might want to disable router
ports as well.

There is no "up" column because a logical router port doesn't have the same
concept.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn-nb: Change how router ports work.

This is for two reasons.  First, a router port is not really much of a
special case from a logical switch's point of view.  For switching
purposes, it works exactly the same as any other port.  Having a special
column for it just adds artificial special cases.

Second, the previous form of router ports specified that all of them use
the logical port name "ROUTER".  This seemed to make sense at the time but
now it is just adding more special cases.  Instead just giving them names
like any other port makes life easier.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn-nb.xml: Reorganize documentation for Logical_Port table.

This uses the column grouping feature and the ability to document an
individual key within a column to better, in my opinion, organize the
documentation for the Logical_Port table.

This will make it easier to document a new port type that a future commit
will add.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn-nb: Add support for IP+MAC binding pairs in Port_Binding 'address'.

When a logical router can statically obtain the IP+MAC pairs for its
attached logical switches, it can avoid expensive ARP resolution.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn-nb: Rename Port_Bindings 'macs' column to 'addresses'.

In an upcoming commit this column will also support IP+MAC pairs.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn-nb: Extend schema to support networks of routers.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn: Add new predicates for matching broadcast and multicast packets.

In my opinion, "eth.mcast" is a bit more readable than "eth.dst[40]", and
so on.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn: Implement logical patch ports.

This implementation is suboptimal for several reasons.  First, it
creates an OVS port for every OVN logical patch port, not just for the
ones that are actually useful on this hypervisor.  Second, it's
wasteful to create an OVS patch port per OVN logical patch port, when
really there's no benefit to them beyond a way to identify how a
packet ingressed into a logical datapath.

There are two obvious ways to improve the situation here, by modifying
OVS:

    1. Add a way to configure in OVS which fields are preserved on a
       hop across an OVS patch port.  If MFF_LOG_DATAPATH and
       MFF_LOG_INPORT were preserved, then only a single pair of OVS
       patch ports would be required regardless of the number of OVN
       logical patch ports.

    2. Add a new OpenFlow extension action modeled on "resubmit" that
       also saves and restores the packet data and metadata (the
       inability to do this is the only reason that "resubmit" can't
       be used already).  Or add OpenFlow extension actions to
       otherwise save and restore packet data and metadata.

We should probably choose one of those in the medium to long term, but
I don't know which one.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn-controller: Rename "ovn-patch-port" to "ovn-localnet-port".

An upcoming patch will introduce a different use for patch ports, so
ovn-patch-port would become an ambiguous name.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

patch: Allow client to determine port names.

Calculating the patch port names from the bridge names makes sense when
there's only one pair of patch ports between a pair of bridges, but that
won't be the case for an upcoming use of patch ports.

This changes makes it easy to check for existing patch ports in
create_patch_port(), instead of in its caller, and since that seems like a
more sensible place this change also moves it there.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

patch: Refactor to better support new kinds of patches.

Until now, the code here lumped together what was necessary to create and
destroy patch ports, with what was necessary to identify the patch ports
that were needed.  An upcoming patch will add new reasons to create patch
ports, so this commit more cleanly separates those two functions.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

patch: Bail out earlier if OVS IDL transactions cannot be executed.

The whole point of this module is side effects on the Open vSwitch
database, so the whole thing can be skipped if those are impossible.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn-controller: Factor patch port management into new "patch" module.

Upcoming patches will introduce new extensive use of patch ports and it
seems reasonable to put it into its own file.

This is mostly code motion.  Code changes are limited to those necessary
to make the separated code compile, except for renaming
init_bridge_mappings() to patch_run().

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn: Update TODO, ovn-northd flow table design, ovn-architecture for L3.

This is a proposed plan for logical L3 in OVN.  It is not entirely
complete but it includes many important details and I believe that it moves
planning forward.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn-sb: Document "ip.ttl--;" action.

This was implemented by commits a while back, but the documentation was
accidentally omitted.

Signed-off-by: Ben Pfaff <blp@nicira.com>

ofp-actions: Fix build on earlier GCC.

GCC4.4 gets confused by anonymous fields + flexible fields, complains:
lib/ofp-actions.h:510: error: flexible array member in otherwise empty
struct
lib/ofp-actions.h:512: error: bit-field ‘build_assert_failed’ width not
an integer constant
lib/ofp-actions.h:514: error: bit-field ‘build_assert_failed’ width not
an integer constant

Fix the problem by specifying the actions length as zero.

Reported-by: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: Joe Stringer <joestringer@nicira.com>
Acked-by: Pravin B Shelar <pshelar@nicira.com>

atlocal.in: Hide a harmless error on Windows.

Signed-off-by: Gurucharan Shetty <gshetty@nicira.com>
Acked-by: Joe Stringer <joestringer@nicira.com>

windefs: Redefine INET6_ADDRSTRLEN for Windows.

Windows has INET6_ADDRSTRLEN defined as 65 whereas
POSIX has it as 46. This difference causes a unit test
failure as the test 'tunnel_push_pop' was looking at o/p
format based on the length of INET6_ADDRSTRLEN.

Signed-off-by: Gurucharan Shetty <gshetty@nicira.com>
Acked-by: Joe Stringer <joestringer@nicira.com>

ofproto: Correct encoding and decoding of group desc properties.

* encode: if properties are present include their length in
          value of the length field of the group desc
* decode: use the value of the length field to calculate the length of
          properties rather than assuming that the rest of the message
          is properties. This assumption is not correct as a message
          may contain multiple group descs.

Fixes: 18ac06d3546e ("ofp-util: Encoding and decoding of (draft) OpenFlow 1.5 group messages.")
Signed-off-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>

ovn.at: Add test for gateway.

This test exposed a problem that ovn-controller-vtep doesn't properly
set up the "Mcast_Macs_Remote" table, which prevents broadcasts from
being sourced from the physical side of the VTEP.  That issue needs to
be resolved, and then the full set of gateway traffic patterns can run.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>

ovn-controller: Support multiple encaps simultaneously.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>

ovn-controller: Support VXLAN enapsulation.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>

ovn-sbctl: Add multiple encaps with "chassis-add".

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>

ovn-controller.8: Correct reference to "ovn-encap-type".

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>

ovn: Add stateful ACL support.

Add support for the "allow-related" ACL action.  This is dependent on
the OVS conntrack functionality, which is not available on all platforms
or kernel versions.

Here is a sample policy that will allow all tenants in logical switch
"ls0" to SSH to each other.  Anyone can make an HTTP request to "lp0".
All other IP traffic is dropped:

  ovn-nbctl acl-add ls0 from-lport 100 ip allow-related
  ovn-nbctl acl-add ls0 to-lport 100 tcp.dst==22 allow-related
  ovn-nbctl acl-add ls0 to-lport 100 "outport == \"lp0\" \
            && tcp.dst==80" allow-related
  ovn-nbctl acl-add ls0 to-lport 1 ip drop

Note: Kernel conntrack support is checked into the mainline Linux
kernel, but hasn't been backported to the main OVS repo yet.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>

ovn-controller: Un-inline get_chassis_by_name().

I don't know of any reason to inline this.

Also rename for consistency with get_bridge().

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

nx-match: Serialize match on IP TTL even when outputting OXM.

The 'oxm' parameter to nxm_put_ip() indicates whether NXM or OXM code
points should be used in cases where both exist.  It shouldn't cause
matches to be dropped entirely, since that changes the meaning, but that's
what was done here for matches on the IP (v4 or v6) TTL.  This commit
fixes the problem.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn-nbctl: Remove external-ids commands.

Users are served just as well through the general-purpose "set" and "get"
database commands, so avoid the additional code and documentation.

(ovs-vsctl does have special external-ids commands for bridges, but those
exist because of special handling for "fake bridges".)

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn: Change h1 titles to title case in documentation.

Manpage section titles are traditionally all-uppercase, but OVS's
XML-to-nroff translator takes care of that and there's no need to actually
provide them in all-caps (and it looks ugly).

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

ovn: Implement logical action to decrement IPv4 TTL.

This is necessary for IPv4 routing.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>