#include "command-line.h"
#include "compiler.h"
#include "daemon.h"
+#include "dirs.h"
#include "discovery.h"
+#include "executer.h"
#include "fail-open.h"
#include "fault.h"
#include "in-band.h"
#include "list.h"
#include "ofpbuf.h"
-#include "openflow.h"
+#include "openflow/openflow.h"
#include "packets.h"
#include "port-watcher.h"
#include "poll-loop.h"
#include "vlog.h"
#define THIS_MODULE VLM_secchan
+struct hook {
+ const struct hook_class *class;
+ void *aux;
+};
+
+struct secchan {
+ struct hook *hooks;
+ size_t n_hooks, allocated_hooks;
+};
+
static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(60, 60);
static void parse_options(int argc, char *argv[], struct settings *);
static void usage(void) NO_RETURN;
+static char *vconn_name_without_subscription(const char *);
static struct pvconn *open_passive_vconn(const char *name);
static struct vconn *accept_vconn(struct pvconn *pvconn);
-static struct relay *relay_create(struct rconn *local, struct rconn *remote,
- bool is_mgmt_conn);
+static struct relay *relay_create(struct rconn *async,
+ struct rconn *local, struct rconn *remote);
static struct relay *relay_accept(const struct settings *, struct pvconn *);
-static void relay_run(struct relay *, const struct hook[], size_t n_hooks);
+static void relay_run(struct relay *, struct secchan *);
static void relay_wait(struct relay *);
static void relay_destroy(struct relay *);
struct list relays = LIST_INITIALIZER(&relays);
- struct hook hooks[8];
- size_t n_hooks = 0;
+ struct secchan secchan;
struct pvconn *monitor;
struct pvconn *listeners[MAX_MGMT];
size_t n_listeners;
- struct rconn *local_rconn, *remote_rconn;
+ char *local_rconn_name;
+ struct rconn *async_rconn, *local_rconn, *remote_rconn;
struct relay *controller_relay;
struct discovery *discovery;
struct switch_status *switch_status;
parse_options(argc, argv, &s);
signal(SIGPIPE, SIG_IGN);
+ secchan.hooks = NULL;
+ secchan.n_hooks = 0;
+ secchan.allocated_hooks = 0;
+
/* Start listening for management and monitoring connections. */
n_listeners = 0;
for (i = 0; i < s.n_listeners; i++) {
monitor = s.monitor_name ? open_passive_vconn(s.monitor_name) : NULL;
/* Initialize switch status hook. */
- hooks[n_hooks++] = switch_status_hook_create(&s, &switch_status);
+ switch_status_start(&secchan, &s, &switch_status);
+
+ die_if_already_running();
+ daemonize();
/* Start listening for vlogconf requests. */
retval = vlog_server_listen(NULL, NULL);
ofp_fatal(retval, "Could not listen for vlog connections");
}
- die_if_already_running();
- daemonize();
-
- VLOG_WARN("OpenFlow reference implementation version %s", VERSION);
+ VLOG_WARN("OpenFlow reference implementation version %s", VERSION BUILDNR);
VLOG_WARN("OpenFlow protocol version 0x%02x", OFP_VERSION);
- /* Connect to datapath. */
+ /* Check datapath name, to try to catch command-line invocation errors. */
+ if (strncmp(s.dp_name, "nl:", 3) && strncmp(s.dp_name, "unix:", 5)
+ && !s.controller_name) {
+ VLOG_WARN("Controller not specified and datapath is not nl: or "
+ "unix:. (Did you forget to specify the datapath?)");
+ }
+
+ /* Connect to datapath with a subscription for asynchronous events. */
+ async_rconn = rconn_create(0, s.max_backoff);
+ rconn_connect(async_rconn, s.dp_name);
+ switch_status_register_category(switch_status, "async",
+ rconn_status_cb, async_rconn);
+
+ /* Connect to datapath without a subscription, for requests and replies. */
+ local_rconn_name = vconn_name_without_subscription(s.dp_name);
local_rconn = rconn_create(0, s.max_backoff);
- rconn_connect(local_rconn, s.dp_name);
+ rconn_connect(local_rconn, local_rconn_name);
+ free(local_rconn_name);
switch_status_register_category(switch_status, "local",
rconn_status_cb, local_rconn);
rconn_status_cb, remote_rconn);
/* Start relaying. */
- controller_relay = relay_create(local_rconn, remote_rconn, false);
+ controller_relay = relay_create(async_rconn, local_rconn, remote_rconn);
list_push_back(&relays, &controller_relay->node);
/* Set up hooks. */
- hooks[n_hooks++] = port_watcher_create(local_rconn, remote_rconn, &pw);
+ port_watcher_start(&secchan, local_rconn, remote_rconn, &pw);
discovery = s.discovery ? discovery_init(&s, pw, switch_status) : NULL;
#ifdef SUPPORT_SNAT
- hooks[n_hooks++] = snat_hook_create(pw);
+ snat_start(&secchan, pw);
#endif
if (s.enable_stp) {
- hooks[n_hooks++] = stp_hook_create(&s, pw, local_rconn, remote_rconn);
+ stp_start(&secchan, &s, pw, local_rconn, remote_rconn);
}
if (s.in_band) {
- hooks[n_hooks++] = in_band_hook_create(&s, switch_status, pw,
- remote_rconn);
+ in_band_start(&secchan, &s, switch_status, pw, remote_rconn);
}
if (s.fail_mode == FAIL_OPEN) {
- hooks[n_hooks++] = fail_open_hook_create(&s, switch_status,
- local_rconn, remote_rconn);
+ fail_open_start(&secchan, &s, switch_status,
+ local_rconn, remote_rconn);
}
if (s.rate_limit) {
- hooks[n_hooks++] = rate_limit_hook_create(&s, switch_status,
- local_rconn, remote_rconn);
+ rate_limit_start(&secchan, &s, switch_status, remote_rconn);
+ }
+ if (s.command_acl[0]) {
+ executer_start(&secchan, &s);
}
- assert(n_hooks <= ARRAY_SIZE(hooks));
for (;;) {
struct relay *r, *n;
/* Do work. */
LIST_FOR_EACH_SAFE (r, n, struct relay, node, &relays) {
- relay_run(r, hooks, n_hooks);
+ relay_run(r, &secchan);
}
for (i = 0; i < n_listeners; i++) {
for (;;) {
if (monitor) {
struct vconn *new = accept_vconn(monitor);
if (new) {
+ /* XXX should monitor async_rconn too but rconn_add_monitor()
+ * takes ownership of the vconn passed in. */
rconn_add_monitor(local_rconn, new);
}
}
- for (i = 0; i < n_hooks; i++) {
- if (hooks[i].periodic_cb) {
- hooks[i].periodic_cb(hooks[i].aux);
+ for (i = 0; i < secchan.n_hooks; i++) {
+ if (secchan.hooks[i].class->periodic_cb) {
+ secchan.hooks[i].class->periodic_cb(secchan.hooks[i].aux);
}
}
if (s.discovery) {
if (monitor) {
pvconn_wait(monitor);
}
- for (i = 0; i < n_hooks; i++) {
- if (hooks[i].wait_cb) {
- hooks[i].wait_cb(hooks[i].aux);
+ for (i = 0; i < secchan.n_hooks; i++) {
+ if (secchan.hooks[i].class->wait_cb) {
+ secchan.hooks[i].class->wait_cb(secchan.hooks[i].aux);
}
}
if (discovery) {
return new;
}
-struct hook
-make_hook(bool (*local_packet_cb)(struct relay *, void *aux),
- bool (*remote_packet_cb)(struct relay *, void *aux),
- void (*periodic_cb)(void *aux),
- void (*wait_cb)(void *aux),
- void *aux)
+void
+add_hook(struct secchan *secchan, const struct hook_class *class, void *aux)
{
- struct hook h;
- h.packet_cb[HALF_LOCAL] = local_packet_cb;
- h.packet_cb[HALF_REMOTE] = remote_packet_cb;
- h.periodic_cb = periodic_cb;
- h.wait_cb = wait_cb;
- h.aux = aux;
- return h;
+ struct hook *hook;
+
+ if (secchan->n_hooks >= secchan->allocated_hooks) {
+ secchan->allocated_hooks = secchan->allocated_hooks * 2 + 1;
+ secchan->hooks = xrealloc(secchan->hooks,
+ (sizeof *secchan->hooks
+ * secchan->allocated_hooks));
+ }
+ hook = &secchan->hooks[secchan->n_hooks++];
+ hook->class = class;
+ hook->aux = aux;
}
struct ofp_packet_in *
\f
/* OpenFlow message relaying. */
-static struct relay *
-relay_accept(const struct settings *s, struct pvconn *pvconn)
+/* Returns a malloc'd string containing a copy of 'vconn_name' modified not to
+ * subscribe to asynchronous messages such as 'ofp_packet_in' events (if
+ * possible). */
+static char *
+vconn_name_without_subscription(const char *vconn_name)
{
- struct vconn *new_remote, *new_local;
- struct rconn *r1, *r2;
- char *vconn_name;
int nl_index;
- int retval;
-
- new_remote = accept_vconn(pvconn);
- if (!new_remote) {
- return NULL;
- }
-
- if (sscanf(s->dp_name, "nl:%d", &nl_index) == 1) {
+ if (sscanf(vconn_name, "nl:%d", &nl_index) == 1) {
/* nl:123 or nl:123:1 opens a netlink connection to local datapath 123.
* nl:123:0 opens a netlink connection to local datapath 123 without
* obtaining a subscription for ofp_packet_in or ofp_flow_expired
- * messages. That's what we want here; management connections should
- * not receive those messages, at least by default. */
- vconn_name = xasprintf("nl:%d:0", nl_index);
+ * messages. */
+ return xasprintf("nl:%d:0", nl_index);
} else {
/* We don't have a way to specify not to subscribe to those messages
* for other transports. (That's a defect: really this should be in
* the OpenFlow protocol, not the Netlink transport). */
VLOG_WARN_RL(&rl, "new management connection will receive "
"asynchronous messages");
- vconn_name = xstrdup(s->dp_name);
+ return xstrdup(vconn_name);
}
+}
+static struct relay *
+relay_accept(const struct settings *s, struct pvconn *pvconn)
+{
+ struct vconn *new_remote, *new_local;
+ struct rconn *r1, *r2;
+ char *vconn_name;
+ int retval;
+
+ new_remote = accept_vconn(pvconn);
+ if (!new_remote) {
+ return NULL;
+ }
+
+ vconn_name = vconn_name_without_subscription(s->dp_name);
retval = vconn_open(vconn_name, OFP_VERSION, &new_local);
if (retval) {
VLOG_ERR_RL(&rl, "could not connect to %s (%s)",
r2 = rconn_create(0, 0);
rconn_connect_unreliably(r2, "passive", new_remote);
- return relay_create(r1, r2, true);
+ return relay_create(NULL, r1, r2);
}
static struct relay *
-relay_create(struct rconn *local, struct rconn *remote, bool is_mgmt_conn)
+relay_create(struct rconn *async, struct rconn *local, struct rconn *remote)
{
struct relay *r = xcalloc(1, sizeof *r);
r->halves[HALF_LOCAL].rconn = local;
r->halves[HALF_REMOTE].rconn = remote;
- r->is_mgmt_conn = is_mgmt_conn;
+ r->is_mgmt_conn = async == NULL;
+ r->async_rconn = async;
return r;
}
+static bool
+call_local_packet_cbs(struct secchan *secchan, struct relay *r)
+{
+ const struct hook *h;
+ for (h = secchan->hooks; h < &secchan->hooks[secchan->n_hooks]; h++) {
+ bool (*cb)(struct relay *, void *aux) = h->class->local_packet_cb;
+ if (cb && (cb)(r, h->aux)) {
+ return true;
+ }
+ }
+ return false;
+}
+
+static bool
+call_remote_packet_cbs(struct secchan *secchan, struct relay *r)
+{
+ const struct hook *h;
+ for (h = secchan->hooks; h < &secchan->hooks[secchan->n_hooks]; h++) {
+ bool (*cb)(struct relay *, void *aux) = h->class->remote_packet_cb;
+ if (cb && (cb)(r, h->aux)) {
+ return true;
+ }
+ }
+ return false;
+}
+
static void
-relay_run(struct relay *r, const struct hook hooks[], size_t n_hooks)
+relay_run(struct relay *r, struct secchan *secchan)
{
int iteration;
int i;
+ if (r->async_rconn) {
+ rconn_run(r->async_rconn);
+ }
for (i = 0; i < 2; i++) {
rconn_run(r->halves[i].rconn);
}
if (!this->rxbuf) {
this->rxbuf = rconn_recv(this->rconn);
+ if (!this->rxbuf && i == HALF_LOCAL && r->async_rconn) {
+ this->rxbuf = rconn_recv(r->async_rconn);
+ }
if (this->rxbuf && (i == HALF_REMOTE || !r->is_mgmt_conn)) {
- const struct hook *h;
- for (h = hooks; h < &hooks[n_hooks]; h++) {
- if (h->packet_cb[i] && h->packet_cb[i](r, h->aux)) {
- ofpbuf_delete(this->rxbuf);
- this->rxbuf = NULL;
- progress = true;
- break;
- }
+ if (i == HALF_LOCAL
+ ? call_local_packet_cbs(secchan, r)
+ : call_remote_packet_cbs(secchan, r))
+ {
+ ofpbuf_delete(this->rxbuf);
+ this->rxbuf = NULL;
+ progress = true;
+ break;
}
}
}
{
int i;
+ if (r->async_rconn) {
+ rconn_run_wait(r->async_rconn);
+ }
for (i = 0; i < 2; i++) {
struct half *this = &r->halves[i];
rconn_run_wait(this->rconn);
if (!this->rxbuf) {
rconn_recv_wait(this->rconn);
+ if (i == HALF_LOCAL && r->async_rconn) {
+ rconn_recv_wait(r->async_rconn);
+ }
}
}
}
int i;
list_remove(&r->node);
+ rconn_destroy(r->async_rconn);
for (i = 0; i < 2; i++) {
struct half *this = &r->halves[i];
rconn_destroy(this->rconn);
OPT_NO_STP,
OPT_OUT_OF_BAND,
OPT_IN_BAND,
+ OPT_COMMAND_ACL,
+ OPT_COMMAND_DIR,
VLOG_OPTION_ENUMS
};
static struct option long_options[] = {
{"no-stp", no_argument, 0, OPT_NO_STP},
{"out-of-band", no_argument, 0, OPT_OUT_OF_BAND},
{"in-band", no_argument, 0, OPT_IN_BAND},
+ {"command-acl", required_argument, 0, OPT_COMMAND_ACL},
+ {"command-dir", required_argument, 0, OPT_COMMAND_DIR},
{"verbose", optional_argument, 0, 'v'},
{"help", no_argument, 0, 'h'},
{"version", no_argument, 0, 'V'},
s->burst_limit = 0;
s->enable_stp = false;
s->in_band = true;
+ s->command_acl = "";
+ s->command_dir = xasprintf("%s/commands", ofp_pkgdatadir);
for (;;) {
int c;
s->in_band = true;
break;
+ case OPT_COMMAND_ACL:
+ s->command_acl = (s->command_acl[0]
+ ? xasprintf("%s,%s", s->command_acl, optarg)
+ : optarg);
+ break;
+
+ case OPT_COMMAND_DIR:
+ s->command_dir = optarg;
+ break;
+
case 'l':
if (s->n_listeners >= MAX_MGMT) {
ofp_fatal(0,
usage();
case 'V':
- printf("%s "VERSION" compiled "__DATE__" "__TIME__"\n", argv[0]);
+ printf("%s %s compiled "__DATE__" "__TIME__"\n",
+ program_name, VERSION BUILDNR);
exit(EXIT_SUCCESS);
DAEMON_OPTION_HANDLERS
" --no-stp disable 802.1D Spanning Tree Protocol\n"
"\nRate-limiting of \"packet-in\" messages to the controller:\n"
" --rate-limit[=PACKETS] max rate, in packets/s (default: 1000)\n"
- " --burst-limit=BURST limit on packet credit for idle time\n");
+ " --burst-limit=BURST limit on packet credit for idle time\n"
+ "\nRemote command execution options:\n"
+ " --command-acl=[!]GLOB[,[!]GLOB...] set allowed/denied commands\n"
+ " --command-dir=DIR set command dir (default: %s/commands)\n",
+ ofp_pkgdatadir);
daemon_usage();
vlog_usage();
printf("\nOther options:\n"
git://git.onelab.eu / sliver-openvswitch.git / blobdiff