19 .TH ovs\-vswitchd.conf 5 "April 2009" "Open vSwitch" "OpenVSwitch Manual"
22 ovs\-vswitchd.conf \- configuration file for \fBovs\-vswitchd\fR
25 This manual page describes the syntax for the configuration file used
26 by \fBovs\-vswitchd\fR(8), the virtual switch daemon.
28 The configuration file is based on key-value pairs, which are given
29 one per line in the form \fIkey\fB=\fIvalue\fR. Each \fIkey\fR
30 consists of one or more parts separated by dots,
31 e.g. \fIpart1\fB.\fIpart2\fB.\fIpart3\fR. Each \fIpart\fR may consist
32 only of the English letters, digits, and the special characters
33 \fB_-@$:+\fR. White space within \fIvalue\fR and at the beginning of a
34 line is significant, but is otherwise ignored.
36 If a single key is specified more than once, that key has multiple
37 values, one value for each time the key is specified. The ordering of
38 key-value pairs, and the ordering of multiple values for a single key,
39 within a configuration file is not significant.
41 Blank lines, lines that consist only of white space, and lines that
42 begin with \fB#\fR (optionally preceded by white space) are ignored.
43 Keep in mind that programs that modify the configuration file, such as
44 \fBovs\-brcompatd\fR and \fBovs-cfg-mod\fR, may alter the order of
46 strip comments and blank lines.
48 The following subsections describe how key-value pairs are used to
49 configure \fBovs\-vswitchd\fR.
50 .SS "Bridge Configuration"
51 A bridge (switch) with a given \fIname\fR is configured by specifying
52 the names of its network devices as values for key
53 \fBbridge.\fIname\fB.port\fR. (The specified \fIname\fR may not begin
54 with \fBdp\fR or \fBnl:\fR followed by a digit.)
56 The names given on \fBbridge.\fIname\fB.port\fR must be the names of
57 existing network devices, except for ``internal ports.'' An internal
58 port is a simulated network device that receives traffic only
59 through the virtual switch and switches any traffic sent it through
60 virtual switch. An internal port may configured with an IP address,
61 etc. using the usual system tools (e.g. \fBifconfig\fR, \fBip\fR). To
62 designate network device \fInetdev\fR as an internal port, add
63 \fBiface.\fInetdev\fB.internal=true\fR to the configuration file.
64 \fBovs\-vswitchd\fR will honor this configuration setting by automatically
65 creating the named internal port.
67 A bridge with a given \fIname\fR always has an internal port with the
68 same \fIname\fR, called the ``local port.'' This network device may
70 in the bridge, by specifying it as one of the values for key
71 \fBbridge.\fIname\fB.port\fR, or it may be omitted. If it is
72 included, then its MAC address is by default the lowest-numbered MAC
73 address among the other bridge ports, ignoring other internal ports
74 and bridge ports that are
75 used as port mirroring destinations (see \fBPort Mirroring\fR, below). To
76 use a specific MAC address instead, set \fBbridge.\fIname\fB.mac\fR to
77 a MAC address in the format
78 \fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fR, where each
79 \fIx\fR is a hex digit. If no valid MAC address can be determined
80 either of these ways, then a MAC address is randomly generated.
82 The following syntax defines a bridge named \fBmybr\fR, configured
83 with network devices \fBeth0\fR, \fBeth1\fR, and \fBeth2\fR:
93 .SS "802.1Q VLAN support"
94 A bridge port may be configured either as a trunk port or as belonging
95 to a single, untagged VLAN. These two options are mutually exclusive,
96 and a port must be configured in one way or the other.
98 By default, bridge ports are trunk ports that carry all VLANs. To
99 limit the VLANs that a trunk port carries, define
100 \fBvlan.\fIport\fB.trunks\fR to one or more integers between 0 and
101 4095 designating VLANs. Only frames that have an 802.1Q header with
102 one of the listed VLANs are accepted on a trunk port. If 0 is
103 included in the list, then frames without an 802.1Q header are also
104 accepted. Other frames are discarded.
106 The following syntax makes network device \fBeth0\fR a trunk port that
107 carries VLANs 1, 2, and 3:
118 .ST "Untagged VLAN Ports"
119 A bridge port may be configured with an implicit, untagged VLAN.
121 \fBvlan.\fIport\fB.tag\fR to an integer value \fIvid\fR between 0 and
122 4095, inclusive, to designate the named \fIport\fR as a member
123 of 802.1Q VLAN \fIvid\fR. When \fIport\fR is assigned a VLAN tag this
124 way, frames arriving on trunk ports will be forwarded to \fIport\fR
125 only if they are tagged with VLAN \fIvid\fR, and frames arriving on
126 other VLAN ports will be forwarded to \fIport\fR only if their
127 \fIvid\fR values are equal. Frames forwarded to \fIport\fR will not
128 have an 802.1Q header.
130 When \fIvid\fR is 0, frames arriving on trunk ports without an 802.1Q
131 VLAN header will also be forwarded to \fIport\fR.
133 When a frame with a 802.1Q header that indicates a nonzero VLAN is
134 received on an implicit VLAN port, it is discarded.
136 The following syntax makes network device \fBeth0\fR a member of VLAN
146 .SS "Network Device Bonding"
147 Bonding allows multiple ``slave'' network devices to be treated as if
148 they were a single virtual ``bonded'' network device. It is useful for
149 load balancing and fail-over.
151 \fBovs\-vswitchd\fR supports ``source load balancing'' (SLB) bonding, which
152 assigns flows to slaves based on source MAC address, with periodic
153 rebalancing as traffic patterns change. This form of bonding does not
154 require 802.3ad or other special support from the upstream switch to
155 which the slave devices are connected.
157 To configure bonding, create a virtual bonding device by specifying
158 the slave network device names as values for
159 \fBbonding.\fIname\fB.slave\fR, then specify \fIname\fR as a bridge
160 port. The chosen \fIname\fR should not be the name of any real
161 network device on the host system.
163 By default, bonding interfaces are enabled or disabled immediately
164 when a carrier is detected or dropped on the underlying network
165 device. To insert a delay when carrier comes up or goes down before
166 enabling or disabling an interface, set the value of
167 \fBbonding.\fIname\fB.updelay\fR or
168 \fBbonding.\fIname\fB.downdelay\fR, respectively, to a positive
169 integer, interpreted in milliseconds.
170 The \fBupdelay\fR setting is honored only when at least one bonded
171 interface is already enabled. When no interfaces are enabled, then
172 the first bond interface to come up is enabled immediately. The
173 \fBdowndelay\fR setting is always honored.
175 The following syntax bonds \fBeth0\fR and \fBeth1\fR into a bonding
176 device named \fBbond0\fR, which is added to bridge \fBmybr\fR along
177 with physical network devices \fBeth2\fR and \fBeth3\fR:
182 bridge.mybr.port=bond0
183 bridge.mybr.port=eth2
184 bridge.mybr.port=eth3
186 bonding.bond0.slave=eth0
187 bonding.bond0.slave=eth1
191 .SS "Port Mirroring (SPAN and RSPAN)"
192 \fBovs\-vswitchd\fR may be configured to send selected frames to special
193 ``mirrored'' ports, in addition to their normal destinations. Mirroring
194 traffic may also be referred to as SPAN or RSPAN, depending on the
195 mechanism used for delivery.
197 Up to 32 instances of port mirroring may be configured on a given
198 bridge. Each must be given a name that is unique within the bridge.
199 The keys associated with port mirroring instance \fIpmname\fR for
200 bridge \fIbrname\fR begin with \fBmirror.\fIbrname\fB.\fIpmname\fR.
202 The selection of the frames to mirror and the form in which they
203 should be output is configured separately for each port mirroring
204 instances, through a subsection of
205 \fBmirror.\fIbrname\fB.\fIpmname\fR, named \fBselect\fR, and
206 \fBoutput\fR, respectively.
207 .ST "Selecting Frames to Mirror"
208 The values for the following keys, if specified, limit the frames that
209 are chosen for mirroring. If none of these keys is specified, then
210 all frames received by the bridge are mirrored. If more than one of
211 these keys is specified, then a frame must meet all specified criteria
214 \fBmirror.\fIbrname\fB.\fIpmname\fB.select.src-port=\fIport\fR
216 \fBmirror.\fIbrname\fB.\fIpmname\fB.select.dst-port=\fIport\fR
218 \fBmirror.\fIbrname\fB.\fIpmname\fB.select.port=\fIport\fR
219 Frame received on \fIport\fR, output to \fIport\fR, or either received
220 on or output to \fIport\fR, respectively. \fIport\fR must be part of
221 the bridge \fIbrname\fR; that is, it must be listed on
222 \fBbridge.\fIbrname\fB.port\fR.
224 \fBmirror.\fIbrname\fB.\fIpmname\fB.select.vlan=\fIvid\fR
226 \fIvid\fR must be an integer between 0 and 4095, inclusive. A nonzero
227 \fIvid\fR selects frames that belong to VLAN \fIvid\fR, that is,
228 frames that arrived on a trunk port tagged with VLAN \fIvid\fR or on a
229 port that is configured as part of VLAN \fIvid\fR (see \fB802.1Q VLAN
230 tagging\fR, above). A \fIvid\fR of zero selects frames that do not
231 belong to a VLAN, that is, frames that arrived on a trunk port without
232 a VLAN tag or tagged with VLAN 0.
234 The values of the following keys determine how frames selected for
235 mirroring are output. Only one of the keys may be specified.
237 \fBmirror.\fIbrname\fB.\fIpmname\fB.output.port=\fIport\fR
239 Causes the selected frames to be sent out \fIport\fR, which must be
240 part of the bridge \fIbrname\fR; that is, it must be listed on
241 \fBbridge.\fIbrname\fB.port\fR.
243 Specifying a \fIport\fR in this way reserves that port exclusively for
244 mirroring. No frames other than those selected for mirroring will be
245 forwarded to \fIport\fR, and any frames received on \fIport\fR will be
246 discarded. This type of mirroring may be referred to as SPAN.
248 \fBmirror.\fIbrname\fB.\fIpmname\fB.output.vlan=\fIvid\fR
250 Causes the selected frames to be sent on the VLAN numbered \fIvid\fR,
251 which must be an integer between 0 and 4095, inclusive. The frames
252 will be sent out all ports that trunk VLAN \fIvid\fR, as well as any
253 ports with implicit VLAN \fIvid\fR. When a mirrored frame is sent out
254 a trunk port, the frame's VLAN tag will be set to \fIvid\fR, replacing
255 any existing tag; when it is sent out an implicit VLAN port, the frame
256 will not be tagged. This type of mirroring may be referred to as
259 The following \fBovs\-vswitchd\fR configuration copies all frames received
260 on \fBeth1\fR or \fBeth2\fR to \fBeth3\fR.
265 bridge.mybr.port=eth1
266 bridge.mybr.port=eth2
267 bridge.mybr.port=eth3
269 mirror.mybr.a.select.src-port=eth1
270 mirror.mybr.a.select.src-port=eth2
271 mirror.mybr.a.output.port=eth3
275 .SS "Port Rate-Limiting"
276 Traffic policing and shaping are configured on physical ports. Policing
277 defines a hard limit at which traffic that exceeds the specified rate is
278 dropped. Shaping uses queues to delay packets so that egress traffic
279 leaves at the specified rate.
281 .ST "Ingress Policing"
282 The rate at which traffic is allowed to enter through a port may be
283 configured with ingress policing. Note that "ingress" is from the
284 perspective of \fBovs\-vswitchd\fR. If configured on a physical port,
285 then it limits the rate at which traffic is allowed into the system from
286 the outside. If configured on a virtual interface that is connected to
287 a virtual machine, then it limits the rate at which the guest is able to
290 The rate is specified in kilobits (1000 bits) per second with a maximum
291 burst size specified in kilobits (1000 bits). The burst size should be at
292 least the size of the interface's MTU.
294 A port may be configured to enforce ingress policing by defining the
295 key \fBport.\fIname\fB.ingress.policing-rate\fR with an integer
296 indicating the rate. The port \fIname\fR will only allow traffic to be
297 received at the rate specified in kilobits per second. If the rate is zero
298 or the key is not defined, then ingress policing is disabled.
300 If ingress policing is enabled, then the burst rate may be set by defining
301 the key \fBport.\fIname\fB.ingress.policing-burst\fR with an integer
302 indicating the burst rate in kilobits. If the key is not supplied or is
303 zero, then the default burst is 10 kilobits.
306 The following syntax limits port \fBeth1\fR to receiving traffic at
307 \fB512\fR kilobits per second with a burst of \fB20\fR kilobits:
312 port.eth1.ingress.policing-rate=512
313 port.eth1.ingress.policing-burst=20
316 .SS "NetFlow v5 Flow Logging"
317 NetFlow is a protocol that exports a number of details about terminating
318 IP flows, such as the principals involved and duration. A bridge may be
319 configured to send NetFlow v5 records to NetFlow collectors when flows
320 end. To enable, define the key \fBnetflow.\fIbridge\fB.host\fR for each
321 collector in the form \fIip\fB:\fIport\fR. Records from \fIbridge\fR
322 will be sent to each \fIip\fR on UDP \fIport\fR. The \fIip\fR must
323 be specified numerically, not as a DNS name.
325 The NetFlow messages will use the datapath index for the engine type and id.
326 This can be overridden with the \fBnetflow.\fIbridge\fB.engine-type\fR and
327 \fBnetflow.\fIbridge\fB.engine-id\fR, respectively. Each takes a value
328 between 0 and 255, inclusive.
330 Many NetFlow collectors do not expect multiple virtual switches to be
331 sending messages from the same host, and they do not store the engine
332 information which could be used to disambiguate the traffic. To prevent
333 flows from multiple switches appearing as if they came on the interface,
334 add \fBnetflow.\fIbridge\fB.add-id-to-iface=true\fR to the configuration
335 file. This will place the least significant 7 bits of the engine id
336 into the most significant bits of the ingress and egress interface fields
337 of flow records. By default, this behavior is disabled.
339 The following syntax sends NetFlow records for \fBmybr\fR to the NetFlow
340 collector \fBnflow.example.com\fR on UDP port \fB9995\fR:
345 netflow.mybr.host=nflow.example.com:9995
349 .SS "Remote Management"
350 A \fBovs\-vswitchd\fR instance may be remotely managed by a controller that
351 supports the OpenFlow Management Protocol, such as NOX. This
352 functionality is enabled by setting the key \fBmgmt.controller\fR to one
353 of the following values:
355 .IP "\fBssl:\fIip\fR[\fB:\fIport\fR]"
356 The specified SSL \fIport\fR (default: 6633) on the host at the given
357 \fIip\fR, which must be expressed as an IP address (not a DNS name).
358 SSL must be configured when this form is used (see \fBSSL
359 Configuration\fR, below).
361 .IP "\fBtcp:\fIip\fR[\fB:\fIport\fR]"
362 The specified TCP \fIport\fR (default: 6633) on the host at the given
363 \fIip\fR, which must be expressed as an IP address (not a DNS name).
365 The maximum time between attempts to connect to the controller may be
366 specified in integral seconds with the \fBmgmt.max-backoff\fR key. The
367 default maximum backoff is 15 seconds, and the minimum value is 1
370 An inactivity probe may be configured with the \fBmgmt.inactivity-probe\fR
371 key. If \fBovs\-vswitchd\fR does not communicate with the controller for the
372 specified number of seconds, it will send a probe. If a response is not
373 received for an additional amount of that time, \fBovs\-vswitchd\fR assumes
374 the connection has been broken and attempts to reconnect. The default
375 is 15 seconds, and the minimum value is 5 seconds.
377 A management id may be specified with the \fBmgmt.id\fR key. It takes
378 an id in the form of exactly 12 hexadecimal digits. If one is not
379 specified, a random id is generated each time \fBovs\-vswitchd\fR is started.
382 .SS "OpenFlow Controller Connectivity"
383 \fBovs\-vswitchd\fR can perform all configured bridging and switching
384 locally, or it can be configured to connect a given bridge to an
385 external OpenFlow controller, such as NOX. Its behavior depends on
386 the \fBbridge.\fIname\fB.controller\fR setting:
389 \fI\[la]unset\[ra]\fR
390 When the key is not set, the behavior depends on whether remote
391 management is configured. If management is configured, then the switch
392 will connect to the controller specified on \fBmgmt.controller\fR. If
393 management is not configured, the switch will perform all configured
394 bridging and switching locally.
397 \fI\[la]empty\[ra]\fR
398 Setting an empty string value disables controller connectivity. The
399 switch will perform all configured bridging and switching locally.
403 Use controller discovery to find the local OpenFlow controller.
404 Refer to \fBsecchan\fR(8) for information on how to configure a DHCP
405 server to support controller discovery. The following additional
406 options control the discovery process:
410 \fBbridge.\fIname\fB.controller.accept-regex=\fIregex\fR
411 A POSIX extended regular expression against which the discovered
412 controller location is validated. Only controllers whose names match
413 the regular expression will be accepted.
415 The default regular expression is \fBssl:.*\fR, meaning that only SSL
416 controller connections will be accepted, when SSL is configured (see
417 \fBSSL Configuration\fR), and \fB.*\fR otherwise, meaning that any
418 controller will be accepted.
420 The regular expression is implicitly anchored at the beginning of the
421 controller location string, as if it begins with \fB^\fR.
423 \fBbridge.\fIname\fB.controller.update-resolv.conf=\fBtrue\fR|\fBfalse\fR
424 By default, or if this is set to \fBtrue\fR, \fBovs\-vswitchd\fR overwrites
425 the system's \fB/etc/resolv.conf\fR with domain information and DNS
426 servers obtained via DHCP. If this setting is \fBfalse\fR,
427 \fBovs\-vswitchd\fR will not modify \fB/etc/resolv.conf\fR.
429 \fBovs\-vswitchd\fR will only modify \fBresolv.conf\fR if the DHCP response
430 that it receives specifies one or more DNS servers.
434 \fBssl:\fIip\fR[\fB:\fIport\fR]
435 The specified SSL \fIport\fR (default: 6633) on the host at the given
436 \fIip\fR, which must be expressed as an IP address (not a DNS name).
437 SSL must be configured when this form is used (see \fBSSL
438 Configuration\fR, below).
441 \fBtcp:\fIip\fR[\fB:\fIport\fR]
442 The specified TCP \fIport\fR (default: 6633) on the host at the given
443 \fIip\fR, which must be expressed as an IP address (not a DNS name).
447 The Unix domain server socket named \fIfile\fR.
449 The datapath ID used by the bridge to identify itself to the remote
450 controller may be specified as \fBbridge.\fIname\fB.datapath-id\fR,
451 in the form of exactly 12 hexadecimal digits. If the datapath ID
452 is not specified, then it defaults to the bridge's MAC address (see
453 \fBBridge Configuration\fR, above, for information on how the bridge's
454 MAC address is chosen).
455 .ST "Local Port Network Configuration"
456 When an external controller is configured, but controller discovery is
457 not in use, the following additional settings are honored:
459 \fBbridge.\fIname\fB.controller.in-band=\fBtrue\fR|\fBfalse\fR
460 By default, or if this is set to \fBtrue\fR, \fBovs\-vswitchd\fR connects
461 to the controller in-band. If this is set to \fBfalse\fR,
462 \fBovs\-vswitchd\fR connects to the controller out-of-band. Refer to
463 \fBsecchan\fR(8) for a description of in-band and out-of-band control.
464 .IP "\fBbridge.\fIname\fB.controller.ip=\fIip\fR"
465 If specified, the IP address to configure on the bridge's local port.
466 .IP "\fBbridge.\fIname\fB.controller.netmask=\fInetmask\fR"
467 When an IP is specified, the corresponding netmask. The default is
468 255.255.255.0 for a Class C IP address, 255.255.0.0 for Class B, and
469 255.0.0.0 for Class A.
470 .IP "\fBbridge.\fIname\fB.controller.gateway=\fIip\fR"
471 When an IP is specified, the corresponding IP gateway. There is no
473 .ST "Controller Failure Settings"
474 The following additional settings take effect when any remote
475 controller is configured:
476 .IP "\fBbridge.\fIname\fB.controller.inactivity-probe=\fIsecs\fR"
477 This optional setting may be set to \fIsecs\fR, a number of seconds.
478 The minimum value of \fIsecs\fR is 5 seconds. The default is taken
479 from \fBmgmt.inactivity-probe\fR (see above).
481 When the virtual switch is connected to the controller, it waits for a
482 message to be received from the controller for \fIsecs\fR seconds
483 before it sends a inactivity probe to the controller. After sending
484 the inactivity probe, if no response is received for an additional
485 \fIsecs\fR seconds, the secure channel assumes that the connection has
486 been broken and attempts to reconnect.
488 Changing the inactivity probe interval also changes the interval
489 before entering standalone mode (see below).
490 .IP "\fBbridge.\fIname\fB.controller.fail-mode=\fBstandalone\fR|\fBsecure\fR"
491 .IQ "\fBmgmt.fail-mode=standalone\fR|\fBsecure\fR"
492 When a controller is configured, it is, ordinarily, responsible for
493 setting up all flows on the virtual switch. Thus, if the connection to
494 the controller fails, no new network connections can be set up. If
495 the connection to the controller stays down long enough, no packets
496 can pass through the switch at all.
498 The first of these that is set takes effect.
499 If the value is \fBstandalone\fR, \fBovs\-vswitchd\fR will take over
500 responsibility for setting up
501 flows when no message has been received from the controller for three
502 times the inactivity probe interval (see above). In this mode,
503 \fBovs\-vswitchd\fR causes the datapath to act like an ordinary
504 MAC-learning switch. \fBovs\-vswitchd\fR will continue to retry connecting
505 to the controller in the background and, when the connection succeeds,
506 it discontinues its standalone behavior.
508 If this option is set to \fBsecure\fR, or if neither of these settings
509 is set, \fBovs\-vswitchd\fR will not set up flows on its own when the
510 controller connection fails.
511 .IP "\fBbridge.\fIname\fB.controller.max-backoff=\fIsecs\fR"
512 Sets the maximum time between attempts to connect to the controller to
513 \fIsecs\fR, which must be at least 1. The actual interval between
514 connection attempts starts at 1 second and doubles on each failing
515 attempt until it reaches the maximum. The default maximum backoff
516 time is taken from \fBmgmt.max-backoff\fR.
517 .ST "Controller Rate-Limiting"
518 These settings configure how the virtual switch applies a ``token
519 bucket'' to limit the rate at which packets in unknown flows are
520 forwarded to the OpenFlow controller for flow-setup processing. This
521 feature prevents a single bridge from overwhelming a controller.
522 .IP "\fBbridge.\fIname\fB.controller.rate-limit=\fIrate\fR"
523 .IQ "\fBmgmt.rate-limit=\fIrate\fR"
524 Limits the maximum rate at which packets will be forwarded to the
525 OpenFlow controller to \fIrate\fR packets per second. A rate specified
526 explicitly for \fIname\fR overrides a value configured using the
527 \fBmgmt.rate-limit\fR key.
529 If neither one of these settings is set, then the bridge does not
530 limit the rate at which packets are forwarded to the controller.
531 .IP "\fBbridge.\fIname\fB.controller.burst-limit=\fIburst\fR"
532 .IQ "\fBmgmt.burst-limit=\fIburst\fR"
533 Sets the maximum number of unused packet credits that the bridge will
534 allow to accumulate during the time in which no packets are being
535 forwarded to the OpenFlow controller to \fIburst\fR (measured in
536 packets). The default \fIburst\fR is one-quarter of the \fIrate\fR
537 specified in the rate-limit setting.
539 A burst specified explicitly for \fIname\fR overrides a value configured
540 using the \fBmgmt.burst-limit\fR key. This option takes effect only
541 when a rate-limit is specified.
542 .ST "Remote Command Execution Settings"
543 These settings configure the commands that remote OpenFlow connections
544 are allowed to invoke using (e.g.) \fBovs\-ofctl execute\fR. To be
545 permitted, a command name must be whitelisted and must not be
546 blacklisted. When the whitelist and blacklist permit a command name,
547 \fBovs\-vswitchd\fR looks for a program with the same name as the command
548 in the commands directory (see below). Other directories are not
550 .IP "\fBbridge.\fIname\fB.controller.commands.acl=\fIglob\fR"
551 Whitelists commands whose names match shell glob pattern \fIglob\fR,
552 allowing those commands to be invoked by the remote controller.
554 By default, no commands are whitelisted, so this setting is mandatory
555 if any remote command execution is to be allowed.
556 .IP "\fBbridge.\fIname\fB.controller.commands.acl=\fB!\fR\fIglob\fR"
557 Blacklists commands whose names match shell glob pattern \fIglob\fR,
558 prohibiting those commands from being invoked by the remote
559 controller. Command names that include characters other than upper-
560 and lower-case English letters, digits, and the underscore and hyphen
561 characters are blacklisted unconditionally.
562 .IP "\fBbridge.\fIname\fB.controller.commands.dir=\fIdirectory\fR"
563 Sets the directory searched for remote command execution to
564 \fIdirectory\fR. The default directory is
565 \fB@pkgdatadir@/commands\fR.
566 .SS "SSL Configuration"
567 When \fBovs\-vswitchd\fR is configured to connect over SSL for management or
568 for controller connectivity, the following settings are required:
570 \fBssl.private-key=\fIprivkey.pem\fR
571 Specifies a PEM file containing the private key used as the virtual
572 switch's identity for SSL connections to the controller.
574 \fBssl.certificate=\fIcert.pem\fR
575 Specifies a PEM file containing a certificate, signed by the
576 certificate authority (CA) used by the controller and manager, that
577 certifies the virtual switch's private key, identifying a trustworthy
580 \fBssl.ca-cert=\fIcacert.pem\fR
581 Specifies a PEM file containing the CA certificate used to verify that
582 the virtual switch is connected to a trustworthy controller.
584 These files are read only once, at \fBovs\-vswitchd\fR startup time. If
585 their contents change, \fBovs\-vswitchd\fR must be killed and restarted.
587 These SSL settings apply to all SSL connections made by the virtual
589 .ST "CA Certificate Bootstrap"
590 Ordinarily, all of the files named in the SSL configuration must exist
591 when \fBovs\-vswitchd\fR starts. However, if \fBssl.bootstrap-ca-cert\fR
592 is set to \fBtrue\fR, then \fBovs\-vswitchd\fR will attempt to obtain the
593 CA certificate from the controller on its first SSL connection and
594 save it to the named PEM file. If it is successful, it will
595 immediately drop the connection and reconnect, and from then on all
596 SSL connections must be authenticated by a certificate signed by the
597 CA certificate thus obtained.
599 \fBThis option exposes the SSL connection to a man-in-the-middle
600 attack obtaining the initial CA certificate\fR, but it may be useful
603 This option is only useful if the controller sends its CA certificate
604 as part of the SSL certificate chain. The SSL protocol does not
605 require the controller to send the CA certificate, but
606 \fBcontroller\fR(8) can be configured to do so with the
607 \fB--peer-ca-cert\fR option.
608 .SS "OpenFlow Management Connections"
609 By default, each bridge \fIname\fR listens for OpenFlow management
610 connections on a Unix domain socket named
611 \fB@RUNDIR@/\fIname\fB.mgmt\fR. This socket can be used to perform
612 local OpenFlow monitoring and administration, e.g., \fBovs\-ofctl dump-flows
613 unix:@RUNDIR@/\fIname\fB.mgmt\fR to display the flows currently set up
614 in bridge \fIname\fR.
616 If \fBbridge.\fIname\fB.openflow.listeners\fR is set to one or more
617 values, \fBovs\-vswitchd\fR instead listens on the specified connection
618 methods. Acceptable connection methods include:
620 .IP "\fBpunix:\fIfile\fR"
621 Listens for connections on the Unix domain server socket named \fIfile\fR.
622 .IP "\fBpssl:\fR[\fIport\fR]"
623 Listens for SSL connections on \fIport\fR (default: 6633). SSL must
624 be configured when this form is used (see \fBSSL Configuration\fR,
626 .IP "\fBptcp:\fR[\fIport\fR]"
627 Listens for TCP connections on \fIport\fR (default: 6633).
629 To entirely disable listening for management connections, set
630 \fBbridge.\fIname\fB.openflow.listeners\fR to the single value
633 .SS "OpenFlow Controller Connection Snooping"
634 By default, each bridge \fIname\fR listens for OpenFlow controller
635 connection snooping connections on a Unix domain socket named
636 \fB@RUNDIR@/\fIname\fB.snoop\fR. A client that connects to this
637 socket, e.g., \fBovs\-ofctl monitor unix:@RUNDIR@/\fIname\fB.snoop\fR, will
638 receive a copy of every OpenFlow message sent by the switch to the
639 controller, or vice versa, on the primary OpenFlow controller
642 If \fBbridge.\fIname\fB.openflow.snoops\fR is set to one or more
643 values, \fBovs\-vswitchd\fR instead listens on the specified connection
644 methods. The acceptable connection methods are the same as for
645 OpenFlow management connections (see above).
647 To entirely disable controller connection snooping, set
648 \fBbridge.\fIname\fB.openflow.snoops\fR to the single value
651 .BR ovs\-brcompatd (8),
652 .BR ovs\-cfg\-mod (8),
653 .BR ovs\-vswitchd (8)