X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=vswitchd%2Fvswitch.xml;h=b3f00752a52c9f4e5bf4dc66ced7a15290ee8f8b;hb=0ae60917fcc827f69c6e12c2f1afd170178f5668;hp=979fd5dfeac555559fb97d1b879ed49e7d950411;hpb=e61070c32030d6d00e2eeae213d219320a7cbd10;p=sliver-openvswitch.git diff --git a/vswitchd/vswitch.xml b/vswitchd/vswitch.xml index 979fd5dfe..b3f00752a 100644 --- a/vswitchd/vswitch.xml +++ b/vswitchd/vswitch.xml @@ -1,3 +1,4 @@ +

A database with this schema holds the configuration for one Open vSwitch daemon. The root of the configuration for the daemon is @@ -15,11 +16,6 @@ Set of bridges managed by the daemon. - - Remote database clients to which the Open vSwitch's database server - should connect or to which it should listen. - - SSL used globally by the daemon. @@ -32,12 +28,6 @@ choose key names that are likely to be unique. The currently defined common key-value pairs are:

-
system-type
-
An identifier for the switch type, such as - XenServer or KVM.
-
system-version
-
The version of the switch software, such as - 5.6.0 on XenServer.
system-id
A unique identifier for the Open vSwitch's physical host. The form of the identifier depends on the type of the host. @@ -74,24 +64,231 @@

- Key-value pairs that report statistics about a running Open_vSwitch - daemon. The current implementation updates these counters - periodically. In the future, we plan to, instead, update them only - when they are queried (e.g. using an OVSDB select - operation) and perhaps at other times, but not on any regular - periodic basis.

-

- The currently defined key-value pairs are listed below. Some Open - vSwitch implementations may not support some statistics, in which - case those key-value pairs are omitted.

+ Key-value pairs that report statistics about a system running an Open + vSwitch. These are updated periodically (currently, every 5 + seconds). Key-value pairs that cannot be determined or that do not + apply to a platform are omitted. +

+
-
load-average
+
cpu
+
+

+ Number of CPU processors, threads, or cores currently online and + available to the operating system on which Open vSwitch is + running, as an integer. This may be less than the number + installed, if some are not online or if they are not available to + the operating system. +

+

+ Open vSwitch userspace processes are not multithreaded, but the + Linux kernel-based datapath is. +

+
+ +
load_average
+
+

+ A comma-separated list of three floating-point numbers, + representing the system load average over the last 1, 5, and 15 + minutes, respectively. +

+
+ +
memory
+
+

+ A comma-separated list of integers, each of which represents a + quantity of memory in kilobytes that describes the operating + system on which Open vSwitch is running. In respective order, + these values are: +

+ +
    +
  1. Total amount of RAM allocated to the OS.
    2. +
  2. RAM allocated to the OS that is in use.
    3. +
  3. RAM that can be flushed out to disk or otherwise discarded + if that space is needed for another purpose. This number is + necessarily less than or equal to the previous value.
    4. +
  4. Total disk space allocated for swap.
    5. +
  5. Swap space currently in use.
    6. +
+ +

+ On Linux, all five values can be determined and are included. On + other operating systems, only the first two values can be + determined, so the list will only have two values. +

+
+ +
process_name
+
+

+ One such key-value pair will exist for each running Open vSwitch + daemon process, with name replaced by the daemon's + name (e.g. process_ovs-vswitchd). The value is a + comma-separated list of integers. The integers represent the + following, with memory measured in kilobytes and durations in + milliseconds: +

+ +
    +
  1. The process's virtual memory size.
    2. +
  2. The process's resident set size.
    3. +
  3. The amount of user and system CPU time consumed by the + process.
    4. +
  4. The number of times that the process has crashed and been + automatically restarted by the monitor.
    5. +
  5. The duration since the process was started.
    6. +
  6. The duration for which the process has been running.
    7. +
+ +

+ The interpretation of some of these values depends on whether the + process was started with the . If it + was not, then the crash count will always be 0 and the two + durations will always be the same. If + was given, then the crash count may be positive; if it is, the + latter duration is the amount of time since the most recent crash + and restart. +

+ +

+ There will be one key-value pair for each file in Open vSwitch's + ``run directory'' (usually /var/run/openvswitch) + whose name ends in .pid, whose contents are a + process ID, and which is locked by a running process. The + name is taken from the pidfile's name. +

+ +

+ Currently Open vSwitch is only able to obtain all of the above + detail on Linux systems. On other systems, the same key-value + pairs will be present but the values will always be the empty + string. +

+
+ +
file_systems
- System load average multiplied by 100 and rounded to the nearest - integer.
+

+ A space-separated list of information on local, writable file + systems. Each item in the list describes one file system and + consists in turn of a comma-separated list of the following: +

+ +
    +
  1. Mount point, e.g. / or /var/log. + Any spaces or commas in the mount point are replaced by + underscores.
    2. +
  2. Total size, in kilobytes, as an integer.
    3. +
  3. Amount of storage in use, in kilobytes, as an integer.
    4. +
+ +

+ This key-value pair is omitted if there are no local, writable + file systems or if Open vSwitch cannot obtain the needed + information. +

+
+ + +

+ These columns report the types and versions of the hardware and + software running Open vSwitch. We recommend in general that software + should test whether specific features are supported instead of relying + on version number checks. These values are primarily intended for + reporting to human administrators. +

+ + + The Open vSwitch version number, e.g. 1.1.0pre2. + If Open vSwitch was configured with a build number, then it is + also included, e.g. 1.1.0pre2+build4948. + + + +

+ The database schema version number in the form + major.minor.tweak, + e.g. 1.2.3. Whenever the database schema is changed in + a non-backward compatible way (e.g. deleting a column or a table), + major is incremented. When the database schema is changed + in a backward compatible way (e.g. adding a new column), + minor is incremented. When the database schema is changed + cosmetically (e.g. reindenting its syntax), tweak is + incremented. +

+ +

+ The schema version is part of the database schema, so it can also be + retrieved by fetching the schema using the Open vSwitch database + protocol. +

+ + + +

+ An identifier for the type of system on top of which Open vSwitch + runs, e.g. XenServer or KVM. +

+

+ System integrators are responsible for choosing and setting an + appropriate value for this column. +

+ + + +

+ The version of the system identified by , + e.g. 5.5.0-24648p on XenServer 5.5.0 build 24648. +

+

+ System integrators are responsible for choosing and setting an + appropriate value for this column. +

+ + + + + +

+ These columns primarily configure the Open vSwitch database + (ovsdb-server), not the Open vSwitch switch + (ovs-vswitchd). The OVSDB database also uses the settings. +

+ +

+ The Open vSwitch switch does read the database configuration to + determine remote IP addresses to which in-band control should apply. +

+ + + Database clients to which the Open vSwitch database server should + connect or to which it should listen, along with options for how these + connection should be configured. See the table + for more information. + + + +

+ Remote database clients to which the Open vSwitch's database server + should connect or to which it should listen. Adding an OVSDB target + to this set is equivalent to adding it to with all of the default options. +

+ +

+ Use of this column is deprecated and may be removed sometime in the + future. New applications should use and set instead. +

+ + @@ -170,7 +367,7 @@

If this value is unset, the default is implementation-specific.

-

When more than one controller is configured, +

When more than one controller is configured, is considered only when none of the configured controllers can be contacted.

@@ -199,7 +396,7 @@ defined key-value pairs are:
bridge-id
-
A unique identifier of the bridge. On Citrix XenServer this +
A unique identifier of the bridge. On Citrix XenServer this will commonly be the same as xs-network-uuids.
xs-network-uuids
Semicolon-delimited set of universally unique identifier(s) for @@ -216,12 +413,23 @@
datapath-id
Exactly 16 hex digits to set the OpenFlow datapath ID to a specific - value.
+ value. May not be all-zero. +
disable-in-band
+
If set to true, disable in-band control on + the bridge regardless of controller and manager settings.
hwaddr
An Ethernet address in the form xx:xx:xx:xx:xx:xx to set the hardware address of the local port and influence the datapath ID.
+
in-band-queue
+
+ A queue ID as a nonnegative integer. This sets the OpenFlow queue + ID that will be used by flows set up by in-band control on this + bridge. If unset, or if the port used by an in-band control flow + does not have QoS configured, or if the port does not have a queue + with the specified ID, the default queue is used instead. +
@@ -302,11 +510,10 @@

A port that has more than one interface is a ``bonded port.'' Bonding allows for load balancing and fail-over. Open vSwitch supports ``source load balancing'' (SLB) bonding, which - assigns flows to slaves based on source MAC address, with - periodic rebalancing as traffic patterns change. This form of - bonding does not require 802.3ad or other special support from - the upstream switch to which the slave devices are - connected.

+ assigns flows to slaves based on source MAC address and output VLAN, + with periodic rebalancing as traffic patterns change. This form of + bonding does not require 802.3ad or other special support from the + upstream switch to which the slave devices are connected.

These columns apply only to bonded ports. Their values are otherwise ignored.

@@ -337,7 +544,7 @@ Quality of Service configuration for this port. - + The MAC address to use for this port for the purpose of choosing the bridge's MAC address. This column does not necessarily reflect the @@ -426,7 +633,7 @@

Open vSwitch populates this column when the port number becomes known. If the interface is successfully added, will be set to a number between 1 and 65535 - (generally either in the range 1 to 65280, exclusive, or 65534, the + (generally either in the range 1 to 65279, inclusive, or 65534, the port number for the OpenFlow ``local port''). If the interface cannot be added then Open vSwitch sets this column to -1.

@@ -460,7 +667,7 @@ the same except one has an optional identifier and the other does not, the more specific one is matched first. in_key is considered more specific than local_ip if a port - defines one and another port defines the other. The following + defines one and another port defines the other. The following options may be specified in the column:
remote_ip
@@ -539,6 +746,19 @@ compliance with the IEEE 802.1D specification for bridges. Default is enabled, set to false to disable.
+
+
header_cache
+
Optional. Enable caching of tunnel headers and the output + path. This can lead to a significant performance increase + without changing behavior. In general it should not be + necessary to adjust this setting. However, the caching can + bypass certain components of the IP stack (such as IP tables) + and it may be useful to disable it if these features are + required or as a debugging measure. Default is enabled, set to + false to disable. If IPsec is enabled through the + parameters, header caching will be + automatically disabled.
+
capwap
Ethernet tunneling over the UDP transport portion of CAPWAP @@ -594,6 +814,17 @@ compliance with the IEEE 802.1D specification for bridges. Default is enabled, set to false to disable.
+
+
header_cache
+
Optional. Enable caching of tunnel headers and the output + path. This can lead to a significant performance increase + without changing behavior. In general it should not be + necessary to adjust this setting. However, the caching can + bypass certain components of the IP stack (such as IP tables) + and it may be useful to disable it if these features are + required or as a debugging measure. Default is enabled, set to + false to disable.
+
patch
@@ -637,28 +868,87 @@ +

+ These settings control ingress policing for packets received on this + interface. On a physical interface, this limits the rate at which + traffic is allowed into the system from the outside; on a virtual + interface (one connected to a virtual machine), this limits the rate at + which the VM is able to transmit. +

+

+ Policing is a simple form of quality-of-service that simply drops + packets received in excess of the configured rate. Due to its + simplicity, policing is usually less accurate and less effective than + egress QoS (which is configured using the and tables). +

+

+ Policing is currently implemented only on Linux. The Linux + implementation uses a simple ``token bucket'' approach: +

+
    +
  • + The size of the bucket corresponds to . Initially the bucket is full. +
    • +
  • + Whenever a packet is received, its size (converted to tokens) is + compared to the number of tokens currently in the bucket. If the + required number of tokens are available, they are removed and the + packet is forwarded. Otherwise, the packet is dropped. +
    • +
  • + Whenever it is not full, the bucket is refilled with tokens at the + rate specified by . +
    • +
+

+ Policing interacts badly with some network protocols, and especially + with fragmented IP packets. Suppose that there is enough network + activity to keep the bucket nearly empty all the time. Then this token + bucket algorithm will forward a single packet every so often, with the + period depending on packet size and on the configured rate. All of the + fragments of an IP packets are normally transmitted back-to-back, as a + group. In such a situation, therefore, only one of these fragments + will be forwarded and the rest will be dropped. IP does not provide + any way for the intended recipient to ask for only the remaining + fragments. In such a case there are two likely possibilities for what + will happen next: either all of the fragments will eventually be + retransmitted (as TCP will do), in which case the same problem will + recur, or the sender will not realize that its packet has been dropped + and data will simply be lost (as some UDP-based protocols will do). + Either way, it is possible that no forward progress will ever occur. +

+ +

+ Maximum rate for data received on this interface, in kbps. Data + received faster than this rate is dropped. Set to 0 + (the default) to disable policing. +

+ +

Maximum burst size for data received on this interface, in kb. The default burst size if set to 0 is 1000 kb. This value has no effect if is 0.

-

The burst size should be at least the size of the interface's - MTU.

- - - -

Maximum rate for data received on this interface, in kbps. Data - received faster than this rate is dropped. Set to 0 to - disable policing.

-

The meaning of ``ingress'' is from Open vSwitch's perspective. If - configured on a physical interface, then it limits the rate at which - traffic is allowed into the system from the outside. If configured - on a virtual interface that is connected to a virtual machine, then - it limits the rate at which the guest is able to transmit.

+

+ Specifying a larger burst size lets the algorithm be more forgiving, + which is important for protocols like TCP that react severely to + dropped packets. The burst size should be at least the size of the + interface's MTU. Specifying a value that is numerically at least as + large as 10% of helps TCP come + closer to achieving the full rate. +

+ + + Connectivity monitor configuration for this interface. + + Key-value pairs for use by external frameworks that integrate with Open vSwitch, rather than by Open vSwitch itself. System @@ -675,7 +965,7 @@ For Citrix XenServer, this is the value of the MAC field in the VIF record for this interface.
iface-id
-
A system-unique identifier for the interface. On XenServer, +
A system-unique identifier for the interface. On XenServer, this will commonly be the same as xs-vif-uuid.

@@ -699,6 +989,27 @@ + + Key-value pairs for rarely used interface features. Currently, + the only keys are for configuring GRE-over-IPsec, which is only + available through the openvswitch-ipsec package for + Debian. The currently defined key-value pairs are: +

+
ipsec_local_ip
+
Required key for GRE-over-IPsec interfaces. Additionally, + the must be gre and the + ipsec_psk key must + be set. The in_key, out_key, and + key must not be + set.
+
ipsec_psk
+
Required key for GRE-over-IPsec interfaces. Specifies a + pre-shared key for authentication that must be identical on + both sides of the tunnel. Additionally, the + ipsec_local_ip key must also be set.
+
+ +

Key-value pairs that report interface statistics. The current @@ -775,7 +1086,20 @@ defined types are listed below:

linux-htb
-
Linux ``hierarchy token bucket'' classifier.
+
+ Linux ``hierarchy token bucket'' classifier. See tc-htb(8) (also at + http://linux.die.net/man/8/tc-htb) and the HTB manual + (http://luxik.cdi.cz/~devik/qos/htb/manual/userg.htm) + for information on how this classifier works and how to configure it. +
+
+
+
linux-hfsc
+
+ Linux "Hierarchical Fair Service Curve" classifier. + See http://linux-ip.net/articles/hfsc.en/ for + information on how this classifier works. +
@@ -791,8 +1115,8 @@

Key-value pairs for configuring QoS features that depend on .

-

The linux-htb class supports the following key-value - pairs:

+

The linux-htb and linux-hfsc classes support + the following key-value pairs:

max-rate
Maximum rate shared by all queued traffic, in bit/s. @@ -825,7 +1149,8 @@ column="type"/> of min-rate are:

min-rate
-
Minimum guaranteed bandwidth, in bit/s. Required.
+
Minimum guaranteed bandwidth, in bit/s. Required. The + floor value is 1500 bytes/s (12,000 bit/s).

The key-value pairs defined for of linux-htb are:

@@ -850,6 +1175,17 @@ a queue with a larger value receives any. Specific priority values are unimportant; only relative ordering matters.
+

The key-value pairs defined for of linux-hfsc are:

+
+
min-rate
+
Minimum guaranteed bandwidth, in bit/s. Required.
+
max-rate
+
Maximum allowed bandwidth, in bit/s. Optional. If specified, the + queue's rate will not be allowed to exceed the specified value, even + if excess bandwidth is available. If unspecified, defaults to no + limit.
+
@@ -861,6 +1197,98 @@
+ +

+ A attaches to an to + implement 802.1ag Connectivity Fault Management (CFM). CFM allows a + group of Maintenance Points (MPs) called a Maintenance Association (MA) + to detect connectivity problems with each other. MPs within a MA should + have complete and exclusive interconnectivity. This is verified by + occasionally broadcasting Continuity Check Messages (CCMs) at a + configurable transmission interval. A is + responsible for collecting data about other MPs in its MA and + broadcasting CCMs. +

+ + + + A Maintenance Point ID (MPID) uniquely identifies each endpoint within + a Maintenance Association (see ). The MPID is + used to identify this to other endpoints in the + MA. + + + + A set of which this + should have connectivity to. If this + does not have connectivity to any MPs in this + set, or has connectivity to any MPs not in this set, a fault is + signaled. + + + + A Maintenance Association (MA) name pairs with a Maintenance Domain + (MD) name to uniquely identify a MA. A MA is a group of endpoints who + have complete and exclusive interconnectivity. Defaults to + ovs if unset. + + + + A Maintenance Domain name pairs with a Maintenance Association name to + uniquely identify a MA. Defaults to ovs if unset. + + + + The transmission interval of CCMs in milliseconds. Three missed CCMs + indicate a connectivity fault. Defaults to 1000ms. + + + + + + A set of MPIDs representing MPs to which this + has detected connectivity that are not in the + set. This should not + have connectivity to any MPs not listed in . + Thus, if this set is non-empty a fault is indicated. + + + + A set of MAIDs representing foreign Maintenance Associations (MAs) + which this has detected connectivity to. A + should not have connectivity to a Maintenance + Association other than its own. Thus, if this set is non-empty a fault + is indicated. + + + + Indicates a Connectivity Fault caused by a configuration error, a down + remote MP, or unexpected connectivity to a remote MAID or remote MP. + + +
+ + +

+ A represents a MP which a + has or should have connectivity to. +

+ + + + A Maintenance Point ID (MPID) uniquely identifies each endpoint within + a Maintenance Association. All MPs within a MA should have a unique + MPID. + + + + + + Indicates a connectivity fault. + + +
+

A port mirror within a .

A port mirror configures a bridge to send selected frames to special @@ -958,7 +1386,7 @@

Open vSwitch supports two kinds of OpenFlow controllers:

- +
Primary controllers
@@ -1083,34 +1511,34 @@ restricted to the specified local IP address.
-

When multiple controllers are configured for a single bridge, the - values must be unique. Duplicate - values yield unspecified results.

+

When multiple controllers are configured for a single bridge, the + values must be unique. Duplicate + values yield unspecified results.

-

If it is specified, this setting must be one of the following - strings that describes how Open vSwitch contacts this OpenFlow - controller over the network:

- -
-
in-band
-
In this mode, this controller's OpenFlow traffic travels over the - bridge associated with the controller. With this setting, Open - vSwitch allows traffic to and from the controller regardless of the - contents of the OpenFlow flow table. (Otherwise, Open vSwitch - would never be able to connect to the controller, because it did - not have a flow to enable it.) This is the most common connection - mode because it is not necessary to maintain two independent - networks.
-
out-of-band
-
In this mode, OpenFlow traffic uses a control network separate - from the bridge associated with this controller, that is, the - bridge does not use any of its own network devices to communicate - with the controller. The control network must be configured - separately, before or after ovs-vswitchd is started. -
-
+

If it is specified, this setting must be one of the following + strings that describes how Open vSwitch contacts this OpenFlow + controller over the network:

+ +
+
in-band
+
In this mode, this controller's OpenFlow traffic travels over the + bridge associated with the controller. With this setting, Open + vSwitch allows traffic to and from the controller regardless of the + contents of the OpenFlow flow table. (Otherwise, Open vSwitch + would never be able to connect to the controller, because it did + not have a flow to enable it.) This is the most common connection + mode because it is not necessary to maintain two independent + networks.
+
out-of-band
+
In this mode, OpenFlow traffic uses a control network separate + from the bridge associated with this controller, that is, the + bridge does not use any of its own network devices to communicate + with the controller. The control network must be configured + separately, before or after ovs-vswitchd is started. +
+

If not specified, the default is implementation-specific. If is discover, the connection mode @@ -1167,7 +1595,7 @@

These values are considered only when - is discover.

+ is discover.

A POSIX @@ -1189,14 +1617,14 @@

These values are considered only in in-band control mode (see - ) and only when - is not discover. (For controller discovery, the network - configuration obtained via DHCP is used instead.)

+ ) and only when + is not discover. (For controller discovery, the network + configuration obtained via DHCP is used instead.)

When multiple controllers are configured on a single bridge, there - should be only one set of unique values in these columns. If different - values are set for these columns in different controllers, the effect - is unspecified.

+ should be only one set of unique values in these columns. If different + values are set for these columns in different controllers, the effect + is unspecified.

The IP address to configure on the local port, @@ -1230,6 +1658,145 @@
+ +

+ Configuration for a database connection to an Open vSwitch database + (OVSDB) client. +

+ +

+ This table primarily configures the Open vSwitch database + (ovsdb-server), not the Open vSwitch switch + (ovs-vswitchd). The switch does read the table to determine + what connections should be treated as in-band. +

+ +

+ The Open vSwitch database server can initiate and maintain active + connections to remote clients. It can also listen for database + connections. +

+ + + +

Connection method for managers.

+

+ The following connection methods are currently supported: +

+
+
ssl:ip[:port]
+
+

+ The specified SSL port (default: 6632) on the host at + the given ip, which must be expressed as an IP address + (not a DNS name). The + column in the table must point to a + valid SSL configuration when this form is used. +

+

+ SSL support is an optional feature that is not always built as + part of Open vSwitch. +

+
+ +
tcp:ip[:port]
+
+ The specified TCP port (default: 6632) on the host at + the given ip, which must be expressed as an IP address + (not a DNS name). +
+
pssl:[port][:ip]
+
+

+ Listens for SSL connections on the specified TCP port + (default: 6632). If ip, which must be expressed as an + IP address (not a DNS name), is specified, then connections are + restricted to the specified local IP address. +

+

+ The column in the table must point to a valid SSL + configuration when this form is used. +

+

+ SSL support is an optional feature that is not always built as + part of Open vSwitch. +

+
+
ptcp:[port][:ip]
+
+ Listens for connections on the specified TCP port + (default: 6632). If ip, which must be expressed as an + IP address (not a DNS name), is specified, then connections are + restricted to the specified local IP address. +
+
+

When multiple managers are configured, the + values must be unique. Duplicate values yield + unspecified results.

+ + + +

+ If it is specified, this setting must be one of the following strings + that describes how Open vSwitch contacts this OVSDB client over the + network: +

+ +
+
in-band
+
+ In this mode, this connection's traffic travels over a bridge + managed by Open vSwitch. With this setting, Open vSwitch allows + traffic to and from the client regardless of the contents of the + OpenFlow flow table. (Otherwise, Open vSwitch would never be able + to connect to the client, because it did not have a flow to enable + it.) This is the most common connection mode because it is not + necessary to maintain two independent networks. +
+
out-of-band
+
+ In this mode, the client's traffic uses a control network separate + from that managed by Open vSwitch, that is, Open vSwitch does not + use any of its own network devices to communicate with the client. + The control network must be configured separately, before or after + ovs-vswitchd is started. +
+
+ +

+ If not specified, the default is implementation-specific. +

+ + + + + + Maximum number of milliseconds to wait between connection attempts. + Default is implementation-specific. + + + + Maximum number of milliseconds of idle time on connection to the client + before sending an inactivity probe message. If Open vSwitch does not + communicate with the client for the specified number of seconds, it + will send a probe. If a response is not received for the same + additional amount of time, Open vSwitch assumes the connection has been + broken and attempts to reconnect. Default is implementation-specific. + + + + + + Key-value pairs for use by external frameworks that integrate with Open + vSwitch, rather than by Open vSwitch itself. System integrators should + either use the Open vSwitch development mailing list to coordinate on + common key-value definitions, or choose key names that are likely to be + unique. No common key-value pairs are currently defined. + + +
+ A NetFlow target. NetFlow is a protocol that exports a number of details about terminating IP flows, such as the principals involved