ofproto-dpif: Avoid figuring out sFlow and IPFIX actions twice.

Not only is it easier to re-use the actions we already have, this avoids
potential problems due to the state that add_sflow_action() and
add_ipfix_action() look at having possibly been changed by
do_xlate_actions().  Currently those functions appear to look only at
the flow's 'in_port', which currently can't change.  However, an upcoming
commit will make it possible for actions to change the flow's 'in_port',
and in addition, with this change, one doesn't have to wonder whether these
functions might look at other state that translation might change.

Signed-off-by: Ben Pfaff <blp@nicira.com>
meta-flow: Make 'in_port' field writable.

OpenFlow says that an "output" action to a flow's input port is ordinarily
dropped, unless the flow explicitly outputs to OFPP_IN_PORT.  We've
occasionally been asked to implement some way to avoid this behavior in
cases where it is not easily known in advance whether a given port is the
input port (so that OFPP_IN_PORT is not easy to use).

This commit implements such a feature.  With this commit, one may write:
    actions=load:0->NXM_OF_IN_PORT[],output:123
which will output to port 123 regardless of whether it is the input port.
If the input port is important, then one may save and restore it on the
stack:
    actions=push:NXM_OF_IN_PORT[],load:0->NXM_OF_IN_PORT[],output:123,
            pop:NXM_OF_IN_PORT[]

(Sometimes I am asked whether "resubmit" changes the in_port and would
therefore interact badly with this feature.  It does not.   "resubmit" only
(optionally) changes the in_port used for the resubmit's flow table lookup.
It does not otherwise have any effect on in_port.)

Bug #14091.
CC: Jarno Rajahalme <jarno.rajahalme@nsn.com>
CC: Ronghua Zhang <rzhang@nicira.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
ovs-pki: Reduce CA certificate validity to 10 years to fix 32-bit OpenSSL.

Before I applied this commit, when I generated CA certificate with OpenSSL
0.9.8o on my 32-bit Debian system, I got a certificate that expired
sometime in 1977.  This made all SSL-based tests fail with an invalid
certificate.

32-bit time_t only extends to 2038, so this must be a bug in OpenSSL.
This commit works around the problem by reducing the validity period of
certificates to 10 years.

CC: Gurucharan Shetty <gshetty@nicira.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
Check actions prerequisites in parse_ofp_str()

Add a call to ofpacts_check() in parse_ofp_str() to check pre-requisites.
This is in preparation for removing special-case pre-requisite checking
of learn actions which is useful for the test-suite.

This patch also fixes two tests which this change revealed to be incorrect.

1. Open Flow 1.0 action which sets NXM_NX_IPV6_SRC
   without any pre-requisites

   This is not valid because there should be an IPv6 pre-requisite.

   This portion of the test has been removed as IPv6 pre-requisites are
   only valid when using OXM or NXM, however the test appears
   to be a (non-NXM) Open Flow 1.0 test.

   It has been replaced with a similar test of an action
   that sets the IPv4 source address.

2. Open Flow 1.2 action which sets NXM_NX_IPV6_SRC
   without any pre-requisites.

   This is not valid because there should be an IPv6 pre-requisite.

   This test has been corrected by adding IPv6 as a pre-requisite,
   which is valid for Open Flow 1.2 as it uses OXM.

Use of ofpacts_check() in parse_ofp_str() suggested by Ben Pfaff.

Cc: Ben Pfaff <blp@nicira.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Ben Pfaff <blp@nicira.com>
Do not perform validation in learn_parse();

I believe this is consistent with the handling of all other action
parsing called from parse_named_action().

Verification of all actions, including learn actions, occurs separately
in ofpact_check__(). It also occurs via in a call to ofpacts_check()
in parse_ofp_str(),

This patch is larger than might otherwise be expected as the flow argument
of learn_parse() is now unused and thus removed.  This propagates up the
call-chain some way.

This implementation was suggested by Jesse Gross in response to an
enhancement I made to the validation performed during parsing learn actions
to allow it to correctly account for changes to the dl_type due to MPLS
push and pop actions.

Tests have also been updated to check for the less specific messages
generated by the call to ofpacts_check() in parse_ofp_str() which at the
suggestion of Ben Pfaff was added by a prior patch for this purpose.

Cc: Jesse Gross <jesse@nicira.com>
Cc: Ben Pfaff <blp@nicira.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Ben Pfaff <blp@nicira.com>
Always check return value of strftime().

strftime() returns 0 and leaves the contents of the output buffer
unspecified if the output buffer is not big enough.  Thus, one should
check strftime()'s return value.  Until now, OVS has had a few invocations
of strftime() that did not check the return value.  This commit fixes
those.  I believe that the buffers were always large enough in each case,
but it's better to be safe.

Reported-by: Andy Zhou <azhou@nicira.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
NEWS: Modification of 'in_port' backported to 1.11.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Keep all of tunnel metadata in flow.

Do not clear tunnel metadata on tunnel input. This is used by a later patch.

Signed-off-by: Jarno Rajahalme <jarno.rajahalme@nsn.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
ofproto-dpif: Remove initial_vals.tunnel_ip_tos.

As tunnel metadata is no longer cleared on input, and the input
values are retained in 'ctx->flow' accross tunnel output actions,
there is no need to store the tunnel.ip_tos to initial_vals.

Signed-off-by: Jarno Rajahalme <jarno.rajahalme@nsn.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
ofproto-dpif: Keep perfect fitness on tunnel input.

As the flow is no longer modified (apart from the in_port) on tunnel
input, the perfect fitness can be retained.

Signed-off-by: Jarno Rajahalme <jarno.rajahalme@nsn.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
process: Fix indentation in header.

Signed-off-by: Ben Pfaff <blp@nicira.com>
ofproto-dpif: Make ofport_dpif_cast() internally consistent.

This function's assertion would dereference a null pointer given a null
'ofport' argument, but its return statement checked for a null pointer
argument.  This commit fixes the inconsistency in favor of supporting
null pointer arguments.  (I discovered this problem while writing a piece
of code that wanted support for a null pointer argument, otherwise I would
resolve the inconsistency in the other direction.)

Signed-off-by: Ben Pfaff <blp@nicira.com>
tunnel: Make tnl_port_receive() parameter 'const'.

This function no longer has much need to modify its argument, because the
caller can now easily do the modification itself, so this commit makes
that change.

Signed-off-by: Ben Pfaff <blp@nicira.com>
ofproto-dpif: Simplify ofproto_receive().

The tunnel and non-tunnel paths were pretty much the same anyway, so this
commit simplifies by merging them.

Signed-off-by: Ben Pfaff <blp@nicira.com>
ofproto-dpif: Remove ofproto_update_local_port_stats().

It's a bit odd, and not particularly useful.

Signed-off-by: Ethan Jackson <ethan@nicira.com>
ofproto-dpif: Simplify send_packet().

Before this patch, send_packet() manually constructed the required
datapath output actions.  This worked fine when these actions were
simple, however as outputting to tunnels and patch ports became
more complex, this required quite a bit of complex duplicated code.
This patch solves the problem by running through the standard
xlate_actions() code path instead.

Signed-off-by: Ethan Jackson <ethan@nicira.com>
ofproto-dpif: Update 'facet->rule' stats in facet_push_stats().

Before this patch, stats for 'facet->rule' were handled differently
than stats which 'facet' resubmitted into.  The former were
maintained in 'facet' until it was destroyed, while the latter were
pushed regularly in facet_push_stats().

This inconsistent behavior was not only confusing, it was often
incorrect.  In some circumstances, if a facet changed rules, it
could carry the statistics from the entirety of its lifetime from
the old rule to the new one.  This patch remedies the issue by
handling all rule stats in facet_push_stats().

Reported-by: Tmusic <Tmusic987@gmail.com>
Signed-off-by: Ethan Jackson <ethan@nicira.com>