When a new OpenFlow kernel module package is installed, restart the switch.

[sliver-openvswitch.git] / debian / openflow-switch.default

diff --git a/debian/openflow-switch.default b/debian/openflow-switch.default
index 6088581..f8c3159 100644 (file)
--- a/debian/openflow-switch.default
+++ b/debian/openflow-switch.default
@@ -4,8 +4,8 @@
 # uncomment them.  Afterward, the secure channel will come up
 # automatically at boot time.  It can be started immediately with
 #       /etc/init.d/openflow-switch start
-# Alternatively, use the ofp-switch-setup program to do everything
-# automatically.
+# Alternatively, use the ofp-switch-setup program (from the
+# openflow-switch-config package) to do everything automatically.
 
 # NETDEVS: Which network devices should the OpenFlow switch include?
 #
@@ -48,7 +48,8 @@ MODE=discovery
 # configured statically or dynamically:
 # 
 # * For static configuration, specify the switch's IP address as a
-#   string.
+#   string.  In this case you may also set SWITCH_NETMASK and
+#   SWITCH_GATEWAY appropriately.
 # 
 # * For dynamic configuration with DHCP (the most common case),
 #   specify "dhcp".  Configuration with DHCP will only work reliably
@@ -57,6 +58,8 @@ MODE=discovery
 #
 # This setting has no effect unless MODE is set to 'in-band'.
 SWITCH_IP=dhcp
+#SWITCH_NETMASK=255.255.255.0
+#SWITCH_GATEWAY=192.168.1.1
 
 # CONTROLLER: Location of controller.
 # One of the following formats:
@@ -78,6 +81,20 @@ SWITCH_IP=dhcp
 # Required if SSL enabled.
 #CACERT=/etc/openflow-switch/cacert.pem
 
+# CACERT_MODE: Two modes are available:
+#
+# * secure: The controller CA certificate named in CACERT above must exist.
+#   (You must copy it manually from the PKI server or another trusted source.)
+#
+# * bootstrap: If the controller CA certificate named in CACERT above does
+#   not exist, the switch will obtain it from the controller the first time
+#   it connects and save a copy to the file named in CACERT.  This is insecure,
+#   in the same way that initial connections with ssh are insecure, but
+#   it is convenient.
+# 
+# Set CACERT_MODE to 'secure' or 'bootstrap' for these respective cases.
+#CACERT_MODE=secure
+
 # MGMT_VCONNS: List of vconns (space-separated) on which secchan
 # should listen for management connections from dpctl, etc.
 # openflow-switchmon by default connects to
@@ -85,5 +102,12 @@ SWITCH_IP=dhcp
 # use openflow-switchmon.
 MGMT_VCONNS="punix:/var/run/secchan.socket"
 
+# COMMANDS: Access control list for the commands that can be executed
+# remotely over the OpenFlow protocol, as a comma-separated list of
+# shell glob patterns.  Negative patterns (beginning with !) act as a
+# blacklist.  To be executable, a command name must match one positive
+# pattern and not match any negative patterns.
+#COMMANDS="reboot,update"
+
 # DAEMON_OPTS: Additional options to pass to secchan, e.g. "--fail=open"
 DAEMON_OPTS=""