/* Create connection to database. */
idl = ovsdb_idl_create(remote, &ovsrec_idl_class);
+ ovsdb_idl_set_write_only(idl, &ovsrec_open_vswitch_col_cur_cfg);
+ ovsdb_idl_set_write_only(idl, &ovsrec_open_vswitch_col_statistics);
+ ovsdb_idl_omit(idl, &ovsrec_open_vswitch_col_external_ids);
+
+ ovsdb_idl_omit(idl, &ovsrec_bridge_col_external_ids);
+
+ ovsdb_idl_omit(idl, &ovsrec_port_col_external_ids);
+ ovsdb_idl_omit(idl, &ovsrec_port_col_fake_bridge);
+
+ ovsdb_idl_set_write_only(idl, &ovsrec_interface_col_ofport);
+ ovsdb_idl_set_write_only(idl, &ovsrec_interface_col_statistics);
+ ovsdb_idl_omit(idl, &ovsrec_interface_col_external_ids);
+
/* Register unixctl commands. */
unixctl_command_register("fdb/show", bridge_unixctl_fdb_show, NULL);
unixctl_command_register("bridge/dump-flows", bridge_unixctl_dump_flows,
LIST_FOR_EACH (br, struct bridge, node, &all_bridges) {
ofproto_wait(br->ofproto);
- if (ofproto_has_controller(br->ofproto)) {
+ if (ofproto_has_primary_controller(br->ofproto)) {
continue;
}
bridge_reconfigure_one(struct bridge *br)
{
struct shash old_ports, new_ports;
- struct svec listeners, old_listeners;
struct svec snoops, old_snoops;
struct shash_node *node;
enum ofproto_fail_mode fail_mode;
|| !strcmp(br->cfg->fail_mode, "standalone")
? OFPROTO_FAIL_STANDALONE
: OFPROTO_FAIL_SECURE;
- if ((ofproto_get_fail_mode(br->ofproto) != fail_mode)
- && !ofproto_has_controller(br->ofproto)) {
+ if (ofproto_get_fail_mode(br->ofproto) != fail_mode
+ && !ofproto_has_primary_controller(br->ofproto)) {
ofproto_flush_flows(br->ofproto);
}
ofproto_set_fail_mode(br->ofproto, fail_mode);
* versa. (XXX Should we delete all flows if we are switching from one
* controller to another?) */
- /* Configure OpenFlow management listener. */
- svec_init(&listeners);
- svec_add_nocopy(&listeners, xasprintf("punix:%s/%s.mgmt",
- ovs_rundir, br->name));
- svec_init(&old_listeners);
- ofproto_get_listeners(br->ofproto, &old_listeners);
- if (!svec_equal(&listeners, &old_listeners)) {
- ofproto_set_listeners(br->ofproto, &listeners);
- }
- svec_destroy(&listeners);
- svec_destroy(&old_listeners);
-
/* Configure OpenFlow controller connection snooping. */
svec_init(&snoops);
svec_add_nocopy(&snoops, xasprintf("punix:%s/%s.snoop",
mirror_reconfigure(br);
}
+/* Initializes 'oc' appropriately as a management service controller for
+ * 'br'.
+ *
+ * The caller must free oc->target when it is no longer needed. */
+static void
+bridge_ofproto_controller_for_mgmt(const struct bridge *br,
+ struct ofproto_controller *oc)
+{
+ oc->target = xasprintf("punix:%s/%s.mgmt", ovs_rundir, br->name);
+ oc->max_backoff = 0;
+ oc->probe_interval = 60;
+ oc->band = OFPROTO_OUT_OF_BAND;
+ oc->accept_re = NULL;
+ oc->update_resolv_conf = false;
+ oc->rate_limit = 0;
+ oc->burst_limit = 0;
+}
+
+/* Converts ovsrec_controller 'c' into an ofproto_controller in 'oc'. */
+static void
+bridge_ofproto_controller_from_ovsrec(const struct ovsrec_controller *c,
+ struct ofproto_controller *oc)
+{
+ oc->target = c->target;
+ oc->max_backoff = c->max_backoff ? *c->max_backoff / 1000 : 8;
+ oc->probe_interval = c->inactivity_probe ? *c->inactivity_probe / 1000 : 5;
+ oc->band = (!c->connection_mode || !strcmp(c->connection_mode, "in-band")
+ ? OFPROTO_IN_BAND : OFPROTO_OUT_OF_BAND);
+ oc->accept_re = c->discover_accept_regex;
+ oc->update_resolv_conf = c->discover_update_resolv_conf;
+ oc->rate_limit = c->controller_rate_limit ? *c->controller_rate_limit : 0;
+ oc->burst_limit = (c->controller_burst_limit
+ ? *c->controller_burst_limit : 0);
+}
+
+/* Configures the IP stack for 'br''s local interface properly according to the
+ * configuration in 'c'. */
+static void
+bridge_configure_local_iface_netdev(struct bridge *br,
+ struct ovsrec_controller *c)
+{
+ struct netdev *netdev;
+ struct in_addr mask, gateway;
+
+ struct iface *local_iface;
+ struct in_addr ip;
+
+ /* Controller discovery does its own TCP/IP configuration later. */
+ if (strcmp(c->target, "discover")) {
+ return;
+ }
+
+ /* If there's no local interface or no IP address, give up. */
+ local_iface = bridge_get_local_iface(br);
+ if (!local_iface || !c->local_ip || !inet_aton(c->local_ip, &ip)) {
+ return;
+ }
+
+ /* Bring up the local interface. */
+ netdev = local_iface->netdev;
+ netdev_turn_flags_on(netdev, NETDEV_UP, true);
+
+ /* Configure the IP address and netmask. */
+ if (!c->local_netmask
+ || !inet_aton(c->local_netmask, &mask)
+ || !mask.s_addr) {
+ mask.s_addr = guess_netmask(ip.s_addr);
+ }
+ if (!netdev_set_in4(netdev, ip, mask)) {
+ VLOG_INFO("bridge %s: configured IP address "IP_FMT", netmask "IP_FMT,
+ br->name, IP_ARGS(&ip.s_addr), IP_ARGS(&mask.s_addr));
+ }
+
+ /* Configure the default gateway. */
+ if (c->local_gateway
+ && inet_aton(c->local_gateway, &gateway)
+ && gateway.s_addr) {
+ if (!netdev_add_router(netdev, gateway)) {
+ VLOG_INFO("bridge %s: configured gateway "IP_FMT,
+ br->name, IP_ARGS(&gateway.s_addr));
+ }
+ }
+}
+
static void
bridge_reconfigure_remotes(struct bridge *br,
const struct sockaddr_in *managers,
{
struct ovsrec_controller **controllers;
size_t n_controllers;
+ bool had_primary;
+
+ struct ofproto_controller *ocs;
+ size_t n_ocs;
+ size_t i;
ofproto_set_extra_in_band_remotes(br->ofproto, managers, n_managers);
+ had_primary = ofproto_has_primary_controller(br->ofproto);
n_controllers = bridge_get_controllers(br, &controllers);
- if (ofproto_has_controller(br->ofproto) != (n_controllers != 0)) {
- ofproto_flush_flows(br->ofproto);
- }
- if (!n_controllers) {
- union ofp_action action;
- flow_t flow;
+ ocs = xmalloc((n_controllers + 1) * sizeof *ocs);
+ n_ocs = 0;
- /* Clear out controllers. */
- ofproto_set_controllers(br->ofproto, NULL, 0);
-
- /* If there are no controllers and the bridge is in standalone
- * mode, set up a flow that matches every packet and directs
- * them to OFPP_NORMAL (which goes to us). Otherwise, the
- * switch is in secure mode and we won't pass any traffic until
- * a controller has been defined and it tells us to do so. */
- if (ofproto_get_fail_mode(br->ofproto) == OFPROTO_FAIL_STANDALONE) {
- memset(&action, 0, sizeof action);
- action.type = htons(OFPAT_OUTPUT);
- action.output.len = htons(sizeof action);
- action.output.port = htons(OFPP_NORMAL);
- memset(&flow, 0, sizeof flow);
- ofproto_add_flow(br->ofproto, &flow, OVSFW_ALL, 0, &action, 1, 0);
- }
- } else {
- struct ofproto_controller *ocs;
- size_t i;
+ bridge_ofproto_controller_for_mgmt(br, &ocs[n_ocs++]);
+ for (i = 0; i < n_controllers; i++) {
+ struct ovsrec_controller *c = controllers[i];
- ocs = xmalloc(n_controllers * sizeof *ocs);
- for (i = 0; i < n_controllers; i++) {
- struct ovsrec_controller *c = controllers[i];
- struct ofproto_controller *oc = &ocs[i];
+ if (!strncmp(c->target, "punix:", 6)
+ || !strncmp(c->target, "unix:", 5)) {
+ static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 5);
- if (strcmp(c->target, "discover")) {
- struct iface *local_iface;
- struct in_addr ip;
+ /* Prevent remote ovsdb-server users from accessing arbitrary Unix
+ * domain sockets and overwriting arbitrary local files. */
+ VLOG_ERR_RL(&rl, "%s: not adding Unix domain socket controller "
+ "\"%s\" due to possibility for remote exploit",
+ dpif_name(br->dpif), c->target);
+ continue;
+ }
- local_iface = bridge_get_local_iface(br);
- if (local_iface && c->local_ip
- && inet_aton(c->local_ip, &ip)) {
- struct netdev *netdev = local_iface->netdev;
- struct in_addr mask, gateway;
+ bridge_configure_local_iface_netdev(br, c);
+ bridge_ofproto_controller_from_ovsrec(c, &ocs[n_ocs++]);
+ }
- if (!c->local_netmask
- || !inet_aton(c->local_netmask, &mask)) {
- mask.s_addr = 0;
- }
- if (!c->local_gateway
- || !inet_aton(c->local_gateway, &gateway)) {
- gateway.s_addr = 0;
- }
+ ofproto_set_controllers(br->ofproto, ocs, n_ocs);
+ free(ocs[0].target); /* From bridge_ofproto_controller_for_mgmt(). */
+ free(ocs);
- netdev_turn_flags_on(netdev, NETDEV_UP, true);
- if (!mask.s_addr) {
- mask.s_addr = guess_netmask(ip.s_addr);
- }
- if (!netdev_set_in4(netdev, ip, mask)) {
- VLOG_INFO("bridge %s: configured IP address "IP_FMT", "
- "netmask "IP_FMT,
- br->name, IP_ARGS(&ip.s_addr),
- IP_ARGS(&mask.s_addr));
- }
+ if (had_primary != ofproto_has_primary_controller(br->ofproto)) {
+ ofproto_flush_flows(br->ofproto);
+ }
- if (gateway.s_addr) {
- if (!netdev_add_router(netdev, gateway)) {
- VLOG_INFO("bridge %s: configured gateway "IP_FMT,
- br->name, IP_ARGS(&gateway.s_addr));
- }
- }
- }
- }
+ /* If there are no controllers and the bridge is in standalone
+ * mode, set up a flow that matches every packet and directs
+ * them to OFPP_NORMAL (which goes to us). Otherwise, the
+ * switch is in secure mode and we won't pass any traffic until
+ * a controller has been defined and it tells us to do so. */
+ if (!n_controllers
+ && ofproto_get_fail_mode(br->ofproto) == OFPROTO_FAIL_STANDALONE) {
+ union ofp_action action;
+ flow_t flow;
- oc->target = c->target;
- oc->max_backoff = c->max_backoff ? *c->max_backoff / 1000 : 8;
- oc->probe_interval = (c->inactivity_probe
- ? *c->inactivity_probe / 1000 : 5);
- oc->band = (!c->connection_mode
- || !strcmp(c->connection_mode, "in-band")
- ? OFPROTO_IN_BAND
- : OFPROTO_OUT_OF_BAND);
- oc->accept_re = c->discover_accept_regex;
- oc->update_resolv_conf = c->discover_update_resolv_conf;
- oc->rate_limit = (c->controller_rate_limit
- ? *c->controller_rate_limit : 0);
- oc->burst_limit = (c->controller_burst_limit
- ? *c->controller_burst_limit : 0);
- }
- ofproto_set_controllers(br->ofproto, ocs, n_controllers);
- free(ocs);
+ memset(&action, 0, sizeof action);
+ action.type = htons(OFPAT_OUTPUT);
+ action.output.len = htons(sizeof action);
+ action.output.port = htons(OFPP_NORMAL);
+ memset(&flow, 0, sizeof flow);
+ ofproto_add_flow(br->ofproto, &flow, OVSFW_ALL, 0, &action, 1, 0);
}
}
struct bridge *br = br_;
COVERAGE_INC(bridge_process_flow);
+
return process_flow(br, flow, packet, actions, tags, nf_output_iface);
}
static void
-bridge_account_flow_ofhook_cb(const flow_t *flow,
+bridge_account_flow_ofhook_cb(const flow_t *flow, tag_type tags,
const union odp_action *actions,
size_t n_actions, unsigned long long int n_bytes,
void *br_)
struct bridge *br = br_;
const union odp_action *a;
struct port *in_port;
- tag_type tags = 0;
+ tag_type dummy = 0;
int vlan;
- /* Feed information from the active flows back into the learning table
- * to ensure that table is always in sync with what is actually flowing
- * through the datapath. */
- if (is_admissible(br, flow, false, &tags, &vlan, &in_port)) {
+ /* Feed information from the active flows back into the learning table to
+ * ensure that table is always in sync with what is actually flowing
+ * through the datapath.
+ *
+ * We test that 'tags' is nonzero to ensure that only flows that include an
+ * OFPP_NORMAL action are used for learning. This works because
+ * bridge_normal_ofhook_cb() always sets a nonzero tag value. */
+ if (tags && is_admissible(br, flow, false, &dummy, &vlan, &in_port)) {
update_learning_table(br, flow, vlan, in_port);
}
+ /* Account for bond slave utilization. */
if (!br->has_bonded_ports) {
return;
}
-
for (a = actions; a < &actions[n_actions]; a++) {
if (a->type == ODPAT_OUTPUT) {
struct port *out_port = port_from_dp_ifidx(br, a->output.port);
if (port->updelay < 0) {
port->updelay = 0;
}
- port->updelay = cfg->bond_downdelay;
+ port->downdelay = cfg->bond_downdelay;
if (port->downdelay < 0) {
port->downdelay = 0;
}
git://git.onelab.eu / sliver-openvswitch.git / blobdiff