ipsec: prepare IPsec for flow based tunneling

This patch removes unused TNL_F_IPSEC flag.

Issue: 14870
Signed-off-by: Ansis Atteka <aatteka@nicira.com>
Acked-by: Jesse Gross <jesse@nicira.com>
datapath: use skb_mark for route lookups

If IPsec policy uses skb mark, then we have to do route look up
with skb mark as well.

Issue: 14870
Signed-off-by: Ansis Atteka <aatteka@nicira.com>
Acked-by: Jesse Gross <jesse@nicira.com>
tunnel: set skb mark for IPsec tunnel packets

The new ovs-monitor-ipsec implementation will use skb marks in
IPsec policies. This patch will configure datapath to use these
skb marks for IPsec tunnel packets.

Issue: 14870
Signed-off-by: Ansis Atteka <aatteka@nicira.com>
Acked-by: Jesse Gross <jesse@nicira.com>
match: Only print tp_src and tp_dst for TCP and UDP.

When printing a match, we would print "tp_src" and "tp_dst" if the
packet wasn't ICMPv4 or ICMPv6.  Unfortunately, this doesn't cover ARP.
This changes the check to only print those keys if the network protocol
is TCP or UDP.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Revert "match: Only print tp_src and tp_dst for TCP and UDP."

This reverts commit 9a9a690cc0bc07bb2a0fa01221492cdab61673e3.

This commit broke some unit tests, and I want to think about how to
address them.  I also noticed other fields we should also not print.

Signed-off-by: Justin Pettit <jpettit@nicira.com>
ofproto-dpif: Look at the flow's ofproto when handling flow misses.

When handling flow misses, an attempt is made to group identical packets
together.  Before the single datapath, each OpenFlow port number was
unique, so the flow_equal() function was sufficient to check whether
packets are identical.  With the single datapath, the OpenFlow port
numbers are shared across bridges, so packets that arrive at the same
time and are identical other than their ingress port were being serviced
by the same ofproto instance.  This commit changes the duplicate flow
finding function to take the ofproto into account.

Bug #14934

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Ethan Jackson <ethan@nicira.com>
datapath: Increase maximum allocation size of action list.

The switch to flow based tunneling increased the size of each output
action in the flow action list.  In extreme cases, this can result
in the action list exceeding the maximum buffer size.

This doubles the maximum buffer size to compensate for the increase
in action size.  In the common case, most allocations will be
less than a page and those uses kmalloc.  Therefore, for the majority
of situations, this will have no impact.

Bug #15203
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Acked-by: Jesse Gross <jesse@nicira.com>
datapath: fix the calculation of checksum for vlan header

In vlan_insert_tag(), we insert a 4-byte VLAN header _after_
mac header:

        memmove(skb->data, skb->data + VLAN_HLEN, 2 * ETH_ALEN);
        ...
        veth->h_vlan_proto = htons(ETH_P_8021Q);
        ...
        veth->h_vlan_TCI = htons(vlan_tci);

so after it, we should recompute the checksum to include these 4 bytes.
skb->data still points to the mac header, therefore VLAN header is at
(2 * ETH_ALEN = 12) bytes after it, not (ETH_HLEN = 14) bytes.

This can also be observed via tcpdump:

         0x0000:  ffff ffff ffff 5254 005d 6f6e 8100 000a
         0x0010:  0806 0001 0800 0604 0001 5254 005d 6f6e
         0x0020:  c0a8 026e 0000 0000 0000 c0a8 0282

Similar for __pop_vlan_tci(), the vlan header we remove is the one
overwritten in:

	memmove(skb->data + VLAN_HLEN, skb->data, 2 * ETH_ALEN);

Therefore the VLAN_HLEN = 4 bytes after 2 * ETH_ALEN is the part
we want to sub from checksum.

Cc: David S. Miller <davem@davemloft.net>
Cc: Jesse Gross <jesse@nicira.com>
Signed-off-by: Cong Wang <amwang@redhat.com>
Signed-off-by: Jesse Gross <jesse@nicira.com>
vxlan: new draft revision

The VXLAN draft just got updated from -02 to -03, with no major changes.
Update documentation to reflect the change.

Signed-off-by: Lorand Jakab <lojakab@cisco.com>
Acked-by: Kyle Mestery <kmestery@cisco.com>
Signed-off-by: Jesse Gross <jesse@nicira.com>
FAQ: Clarify that "--all" was added in version 1.8.

Reported-by: David Palma <palma@onesource.pt>
Signed-off-by: Ben Pfaff <blp@nicira.com>
ovsdb: Fix typo in comment ("millseconds").

Signed-off-by: Ben Pfaff <blp@nicira.com>
in-band: Use "internal" netdev type for local ports.

A bridge's local port always has type "internal", so opening it
with type "system" can't be correct.  This was causing upgrade
problems.  Specifically, in certain bridge topologies, if there was
a manager set force-reload-kmod would fail.  This is because the
local port netdev would open in the in-band code with type
"system", confusing the more important netdev_open() in
iface_create().

Bug #15067.
Signed-off-by: Ethan Jackson <ethan@nicira.com>
debian: Remove openvswitch-ipsec dependency from dbg package.

The openvswitch-dbg package does not have any binaries from
openvswitch-ipsec package. So remove the dependency.

While trying to install a openvswitch-dbg package currently,
we are forced to install racoon and openvswitch-ipsec package
which is not really necessary.

Signed-off-by: Gurucharan Shetty <gshetty@nicira.com>
Add binary option for command outputs collected by ovs-bugtool

Current ovs-bugtool collects command outputs as text strings.
Thus it reads the output by lines. For commands that generate
huge binary data, it becomes very inefficient to read the output.

The change here is to use a 1MB buffer to read binary data
instead of reading them by lines.

Signed-off-by: Shih-Hao Li <shihli@vmware.com>
Signed-off-by: Gurucharan Shetty <gshetty@nicira.com>
ofp-util: Remove prototype for unimplemented, misspelled function.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Ethan Jackson <ethan@nicira.com>
ovs-bugtool: Ability to collect number of logs through plugins.

A new option "--log-days" recently added lets us to control the
number of rotated logs included in the debug bundle. This option
only works on log files defined inside the ovs-bugtool code.

This patch lets us to do the same with logs collected through plugins.

The example format inside a plugin is:
<files type="logs">
    /var/log/one
</files>

This will collect one, one.[1-x], one.[1-x].gz. Where 'x' is 20
by default and can be controlled by the option '--log-days' passed
to ovs-bugtool.

Signed-off-by: Gurucharan Shetty <gshetty@nicira.com>
Add support for LISP tunneling

LISP is an experimental layer 3 tunneling protocol, described in RFC
6830.  This patch adds support for LISP tunneling.  Since LISP
encapsulated packets do not carry an Ethernet header, it is removed
before encapsulation, and added with hardcoded source and destination
MAC addresses after decapsulation.  The harcoded MAC chosen for this
purpose is the locally administered address 02:00:00:00:00:00.  Flow
actions can be used to rewrite this MAC for correct reception.  As such,
this patch is intended to be used for static network configurations, or
with a LISP capable controller.

Signed-off-by: Lorand Jakab <lojakab@cisco.com>
Signed-off-by: Kyle Mestery <kmestery@cisco.com>
Signed-off-by: Jesse Gross <jesse@nicira.com>