With in-band control, it can happen that the controller needs to send
out an ARP request to find out the MAC address of the switch. These
packets are sent as broadcasts, so the secure channel will attempt to
send them back to the controller as ofp_packet_in messages. Of course,
that won't work, because the controller won't be able to respond to
the ofp_packet_in (because it needs the MAC address of the switch to
do so).
This commit makes the secure channel recognize broadcast ARP packets
that originate from the controller and flood them without passing them
back up to the controller.
The secchan needs to handle ARP requests from the controller itself, so
it has to translate the controller's IP address into a MAC address to
allow it to match those packets on dl_src. (OpenFlow doesn't allow us
to look into ARP packets and match on the encapsulated IP addresses, so
this is the best we can do.)
Without this change, the secure channel announces that it is
entering or exiting fail-open mode only when an OpenFlow
message actually arrives from the local datapath. Thus,
when no packets arrive on any switch port, the secchan
never enters fail-open mode. Functionally, this makes no
difference, because there are no packets to switch anyhow
in that case, but it makes the log harder to interpret
since it's unclear whether the controller connection is
actually up.
With this change, the secure channel announcing that it is
entering or exiting fail-open mode is not tied to receiving
a packet on a switch port. Thus, the log is easier to
interpret.
It can happen that the secure channel thinks that it is connected
to the controller, but in fact the connection has dropped. For
example, a switch intermediate between the secure channel and the
controller could have a flow inserted, due to a malfunction, that
causes packets in one direction or the other to be dropped. When
this happens, the Linux kernel's TCP implementation will continue
retransmitting packets for somewhere between 13 and 30 minutes,
depending on the connection's retransmission timeout (according
to linux/Documentation/networking/ip-sysctl.txt) with the default
Linux settings.
We want to detect the lost connection and re-connect much faster
than that. We use OpenFlow echo request and reply messages: if
no message is received from the controller for N seconds, we
send out an echo request. If no reply (actually, any message at
all) is received for an additional N seconds, then we assume
that the connection has been lost, and reconnect.
The new OFPT_ECHO_REQUEST and OFPT_ECHO_REPLY OpenFlow messages
have the same functionality and are more general (in that they
are not Netlink-specific).
This makes the handling of defining and printing actions more consistent in
dpctl. The flow portion of the output of "dump-flows" can now be used as the
input of "add-flows". Flows can be added on the command line with the new
"add-flow" command.
Because of historical string munging during the kernel build process
if you named your hardware table hwtable-something, when it was built
the filename would look appropriate, but the actual module info would change
the internal name to be hwtable_something, thus after an insmod with the filename
you could not perform an rmmod with the same filename. As a result
the naming scheme has been changed to hwtable_NAME, NAME being the hardware
the table supports.
Further, include files in the hardware table should be prefixed with the
folder name, e.g. #include "hwtable_NAME/my_header.h".
Based on commits from David Erickson <derickso@stanford.edu>.
Before, in in-band mode, the secure channel would flood all flows
destined for the broadcast destination when not connected to a
controller. The rationale was that this allowed for ARP replies
to be forwarded to the local port, so that the secure channel
could obtain the Ethernet address of the controller. But this
is a false rationale: ARP replies are unicast to the requester,
not broadcast. (Frames unicast to the local port are always handled
by the secure channel.)
Also, even if it were a correct rationale, it would not help in
at least one case: if the controller's Ethernet address has expired
from the ARP cache, but the secure channel's TCP connection to
the controller is still connected, then the secure channel attempt
to ARP would fail, since the broadcast ARP reply would not be
handled by the secure channel (since the secure channel thought
that it was still connected).
This brings the user-space switch in-line with fixes that were previously
made to the kernel one. The main problem was that when wildcards are used
some of the fields that follow should also be wildcarded.
A number of errors were uncovered when we actually tried playing with VLAN tags on real traffic. This fixes endian, sk_buff, and other issues. Unrelated to VLAN tagging, this also protects some printk calls with net_ratelimit.
This message appeared in the normal course of OpenFlow usage when
a packet arrived on an OpenFlow interface and no secure channel
was running, or if packets arrived too fast for the secure channel
to process them. It confused more people than it assisted, so drop
it.
- More special port names.
- Allow fields to be comma-separated, for use on command line.
- Allow ANY as a synonym for *, to avoid globbing on command line.
The result of the memcmp that checks whether the OUI is all zeroes was the reverse of what it should have been. This checkin also removes the masking of the least signficant bit from SAP checks, since it's not need for checking SNAP.
Thanks to Masa and Brandon for catching this.
Ben Pfaff
Justin Pettit
David Erickson
Ben Pfaff