This makes it easier to install the headers, or to use them directly from
another software package with -I$(openflow)/include, without invading
the top-level include file namespace.
When action validation fails from a flow add, the flow would be leaked. This
caused the kmem cache (which handles allocating flow entries) to be unhappy
when we try to unload the OpenFlow module.
Thanks to Brandon Heller for catching this.
To enable SNAT, run configure with the "--enable-snat" flag. This has
only been tested with the 2.6.23 kernel...more diverse testing will follow.
Documentation and a cleaner build setup will also be in a future check-in.
When a buffer id is placed in a Flow Mod message, the actions are expected to
be executed against the referenced packet. The kernel implementation was
not setting the input device to what the controller was telling it to use.
Thanks to Natasha for catching this.
Allow vendors to define their own actions. Actions were originally fixed-
length, which was a bit constraining. Actions now contain a length field,
which gives them more flexibility.
Stripping VLANs is now done through the OFPAT_STRIP_VLAN action (i.e., you
don't specify a magic value in the generirc VLAN action). Also, it is now
possible to modify the priority bits associated with the VLAN tag through
the OFPAT_SET_VLAN_PCP action. The OFPAT_SET_DL_VLAN has been renamed to
OFPAT_SET_VLAN_VID.
This new OpenFlow message format provides a cleaner interface and greater
detail and control over ports. It is now possible to see what features
the switch's port is currently configured as having, what it's advertising,
and what it's capable of handling. It is also possible to return the
features advertised by the port's peer.
This cleans up the handling of modifying existing flows. There now exists
OFPFC_MODIFY and OFPFC_MODIFY_STRICT commands, which have the same matching
characteristics to their OFPFC_DELETE* counterparts. When adding a flow that
already exists, the counters and timers are now reset (ie, its treated as a
new flow). This commit also adds the "--strict" option to dpctl to allow
strict matching for "mod-flows" and "del-flows".
The original packet-out format allowed multiple actions to be specified for
buffered packets, but only a destination port for messages including data.
This change makes packet-out more consistent by allowing multiple actions
regardless of how the packet is stored.
This change also disallows sending packets through the incoming port without
explicitly using the OFPP_IN_PORT virtual port.
This updates the OpenFlow protocol version and changes the names of
structure members, so any software that uses OpenFlow will need to be
updated to match.
Freeing an skb that has a destructor may require interrupts to be enabled.
This can happen when netfilter is performing NAT, for example.
Discovered by Murphy McCauley.
A number of errors were uncovered when we actually tried playing with VLAN tags on real traffic. This fixes endian, sk_buff, and other issues. Unrelated to VLAN tagging, this also protects some printk calls with net_ratelimit.
Otherwise, we give the table implementations the opportunity to screw up
by distinguishing between two flows without wildcards but with apparently
different priorities that are required to be treated as the same priority.
Now the number of actions is limited, as a practical matter, to the size
of the buffer that the kernel provides for Netlink dumps, which is usually
4096 bytes. A flow statistics entry must fit in a single one of these
buffers. Actions are 8 bytes each, so this is about 500 actions
considering overhead.
This changes the kernel switch implementation to use the kernel Netlink
"dump" interface to allow flow stats that don't fit in the socket buffer
to be dumped gradually as the caller drains the socket buffer.
One of the changes here is a bug fix for nla_unreserve. Because Netlink
attributes' lengths are rounded up to a multiple of 4 bytes, reducing
the length of the payload by N bytes doesn't necessarily reduce the
length of the skb by N bytes. Instead, we need to know the original
length and final length of the attribute. This means that using 'len'
as a difference in bytes doesn't really make sense, so this changes
'len' to be the new length of the attribute payload and renames the
function to nla_shrink to (IMO) better reflect what it is now doing.
Since we have to release the RCU read lock between calls to the dump
function, we need table iterators that persist across RCU epochs. One
way to do this would be to add new "iterator_save" and "iterator_restore"
functions, but this seemed like overkill since there would then be a
total of 5 iterator functions that have only one user (flow stats dumping).
Instead, this patch refactors table iteration into a single "iterate"
function that takes a callback. This simplifies the table iteration code
significantly.
This change also modifies dpctl to understand the new format of flow
stats.
This has two notable omissions. First, only at most 4k of flow statistics
are reported. Second, aggregate statistics are not yet supported. Both
of these are fairly easily fixable, just not fixed yet.
We want to allow multiple OpenFlow connections to a switch, so that
dpctl and other management tools can also connect to a switch that
is connecte to the controller. These tools will want to fetch the
information in the data_hello message, but currently this can only
be done by sending a control_hello message, which changes the
switch configuration state. So breaking the hello messages up into
multiple different messages, only some of which affect configuration
state, cures the problem.
Also, clean up the kernel datapath a bit, by adding helper functions
for allocating and resizing Generic Netlink messages that encapsulate
OpenFlow messages.
- Removed BUG() call that could be maliciously/accidentally triggered by a faulty controller.
- Switched from __constant_htons to htons, which seems preferred.
Ben Pfaff
Justin Pettit
Ben Pfaff
Natasha Gude
Martin Casado