debian: Fix build with old versions of dpkg-buildflags.

dpkg-buildflags has not always supported --export=configure, but commit
6c2d4c8780 (debian: Apply hardening options to build.) used it
unconditionally, causing the build to fail on old Debian distributions.
This fixes the problem.

Signed-off-by: Ben Pfaff <blp@nicira.com>
flow: Rename skb_mark to pkt_mark.

The skb_mark field is currently only available with the Linux datapath
and is only used internally. However, it is desirable to expose this
through OpenFlow and when it is exposed ideally it would not be system-
specific. In preparation for this, skb_mark is rename to pkt_mark in
internal data structures for consistency.

This does not rename the Linux interfaces because doing so would break
the API. It would not necessarily be desirable to do anyways since in
Linux-specific code it is clearer to use the actual name rather than a
generic one. This can lead to confusion in some places, however, because
we do not always strictly separate generic and platform dependent code
(one example is actions). This seems inevitable though at this point if
the lower and upper layers have different names (as they must given the
above requirements).

Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Andy Zhou <azhou@nicira.com>
tunnel: Consolidate action code for tunnel port receive.

There are a couple of operations that are related to receiving a
packet on a tunnel port but that affect the actions and therefore
need to be performed on the output path. This adds a new hook to
do this and consolidates the existing code there.

Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Andy Zhou <azhou@nicira.com>
tunnel: Clear IPSEC_MARK on input rather than output.

Currently we remove the IPSEC_MARK flag from all packets that are
egressing on non-tunnel ports. However, this behavior is confusing
if we allow OpenFlow controllers to match and set the pkt_mark field
because the tunnel behavior applies even on non-tunnel ports.

This instead clears the mark on tunnel input which should have the
same effect for tunnel ports. However, on non-tunnel traffic (or
even for traffic entering on a tunnel port but leaving on a non-
tunnel port) it allows the mark to pass through without change.

Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Andy Zhou <azhou@nicira.com>
flow: Enable matching on new field 'pkt_mark'.

The Linux kernel datapath enables matching and setting the skb mark
but this functionality is currently used only internally by
ovs-vswitchd. This exposes it through NXM to enable external
controllers to interact with other kernel subsystems. Although this
is simply exporting the skb mark, the intention is that this is a
platform independent mechanism to access some system metadata and
therefore may have different implementations on various systems.

Bug #17855

Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Andy Zhou <azhou@nicira.com>
gitignore: Add ovsdbmonitor.

Signed-off-by: Gurucharan Shetty <gshetty@nicira.com>
ofproto-dpif: Destroy bundle after moving its last port out.

When the ofp_port argument to bundle_add_port() refers to an ofport_dpif
that already belongs to some other bundle, bundle_add_port() removed
the port from the other bundle, correctly, with bundle_del_port().
If the other bundle now contained no ports, however, this violated the
invariant that a bundle always contains at least one port.

Normally, this would get fixed up when the other bundle was processed
later during reconfiguration.  I haven't quite zeroed in on the exact
case where this is not true, but segfaults have happened here in
production, in particular when port adds and deletes happen simultaneously
and the new port reuses the OpenFlow port number of one of the deleted
ports.  It seems that the duplicate port number allows some port to rip
away the new port from its bundle without destroying that bundle.  I
suspect, therefore, that there is still a more subtle bug here, but I
hope that this will fix the segfault.

Bug #18967.
Signed-off-by: Ben Pfaff <blp@nicira.com>
bfd: Fix check_tnl_key error.

This commit fixes the bug introduced by commit 26131299fa5 (bfd: Make the
BFD module thread safe.). The bug caused the opposite of the intended
behaviour.

Unit test is added for the 'check_tnl_key' feature.

Signed-off-by: Alex Wang <alexw@nicira.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
bfd: Increase configuration efficiency.

Currently, when there are multiple bfd configuration changes,
the bfd_poll() will only update one change at a time with the
other side. This commit moves the call to bfd_poll() at the
end of configuration processing function, so that bfd_poll()
will update all configuration changes together.

Signed-off-by: Alex Wang <alexw@nicira.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
netdev-bsd: implement netdev_arp_lookup for NetBSD

Signed-off-by: YAMAMOTO Takashi <yamt@mwd.biglobe.ne.jp>
Signed-off-by: Ben Pfaff <blp@nicira.com>
datapath: tunnel: Do not use inner ip-header-id for tunnel ip-header-id.

Using inner-id for tunnel id is not safe in some rare cases.
E.g. packets coming from multiple sources entering same tunnel
can have same id. Therefore on tunnel packet receive we
could have packets from two different stream but with same
source and dst IP with same ip-id which could confuse ip packet
reassembly.

CC: Jarno Rajahalme <jrajahalme@nicira.com>
CC: Ansis Atteka <aatteka@nicira.com>
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Acked-by: Jesse Gross <jesse@nicira.com>
datapath: tunnel: Fix gre64 tunnel when key not specified.

User is allowed to create tunnel without any keys.  In this
case userspace set tunnel action does not set tun-key flag
which was confusing gre64 vport header calculations.  Following
patch fixes it by always assuming TUNNEL_KEY parameter as we
do it with tun-seq.

Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Acked-by: Jesse Gross <jesse@nicira.com>
Bug #19121
datapath: move tunnel-init function to flow.h

This makes ovs-module more in-sync with upstream ovs-module.

Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Acked-by: Jesse Gross <jesse@nicira.com>
datapath: Move find_route() to compat.h

Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Acked-by: Jesse Gross <jesse@nicira.com>
datapath: Move generic tunnel functions to lisp module.

Generic tunnel rcv and send function are only used by lisp tunneling
module, so It make sense to move them to lisp module.

CC: Lori Jakab <lojakab@cisco.com>
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Acked-by: Lorand Jakab <lojakab@cisco.com>
Acked-by: Jesse Gross <jesse@nicira.com>
datapath: Fix RHEL compat for netdev_rx_handler_register

Andrei Andone reported an oops on CentOS 6.4 when adding a device to an
ovs instance.  The problem is easy to reproduce and generates the
following stack trace:

kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
BUG: unable to handle kernel paging request at ffff88033afa49c0
IP: [<ffff88033afa49c0>] 0xffff88033afa49c0
...
Call Trace:
 <IRQ>
 [<ffffffff814487ba>] ? __netif_receive_skb+0x60a/0x750
 [<ffffffff81055f96>] ? enqueue_task+0x66/0x80
 [<ffffffff8144aa38>] netif_receive_skb+0x58/0x60
 [<ffffffff8144ab40>] napi_skb_finish+0x50/0x70
 [<ffffffff8144d0e9>] napi_gro_receive+0x39/0x50
 [<ffffffffa025f46c>] igb_poll+0x7ec/0xc70 [igb]
 [<ffffffff810e6881>] ? cpu_quiet_msk+0xc1/0x130
...

As you can see, we jumped to data rather than code.  This is caused by
a mistake in the compat code for netdev_rx_handler_register which sets
the handler to rx_handler_data rather than rx_handler.  This was
introduced by commit "3e35fe3 datapath: rhel: Move RHEL OVS hook
registration to netdev_rx_handler_register() backport".

Reported-by: Andrei Andone <andrei.andone@softvision.ro>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Cc: Thomas Graf <tgraf@redhat.com>
Cc: Pravin Shelar <pshelar@nicira.com>
Acked-by: Kyle Mestery <kmestery@cisco.com>
Reviewed-by: Thomas Graf <tgraf@redhat.com>
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
ofproto-dpif: move per-backer wait calls from wait to type_wait

move per-backer wait calls (dpif_wait/udpif_wait) from ofproto_wait
to ofproto_type_wait.

This eliminates excessive poll slot consumption when there is more
than one bridge.

Signed-off-by: YAMAMOTO Takashi <yamt@mwd.biglobe.ne.jp>
Signed-off-by: Ben Pfaff <blp@nicira.com>
ofproto: Make number of packet handler threads runtime configurable.

This commit adds a new column "n-handler-threads" to the Open_vSwitch
table. This is used to set the number of upcall handler threads created by
the ofproto-dpif-upcall module.

Signed-off-by: Alex Wang <alexw@nicira.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
ofproto: Avoid extra O(N) work in common case on flow addition.

The OpenFlow OFPFF_CHECK_OVERLAP flag requires us to check whether the flow
being inserted overlaps with any existing flows.  That isn't efficiently
implemented and typically requires us to compare the new flow against most
or all of the existing flows.  We don't have to do that work if
OFPFF_CHECK_OVERLAP is not requested, but commit 0b4f207828c (classifier:
Make use of the classifier thread safe.) inadvertently made us do it
anyway.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Ethan Jackson <ethan@nicira.com>
ofproto-dpif: Fix bad pointer dereference when deleting a bridge.

The 'pins' list contains packet-ins, not flow-mods.

Introduced by commit ada3a58d1f8 (ofproto-dpif: Make packet_ins thread
safe.).

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Ethan Jackson <ethan@nicira.com>