debian: Apply hardening options to build.

Debian now encourages building every program with various GCC hardening
options.  This commit implements that recommendation for Open vSwitch.

See https://wiki.debian.org/Hardening for details.

Found by lintian.

Signed-off-by: Ben Pfaff <blp@nicira.com>
ovs-ofctl: Avoid groff warning due to too-long line.

Avoids these warnings from groff:

<standard input>:1037: warning [p 14, 6.0i]: cannot adjust line
<standard input>:1037: warning [p 14, 6.2i]: can't break line

Found by lintian.

Signed-off-by: Ben Pfaff <blp@nicira.com>
debian: Fix build with old versions of dpkg-buildflags.

dpkg-buildflags has not always supported --export=configure, but commit
6c2d4c8780 (debian: Apply hardening options to build.) used it
unconditionally, causing the build to fail on old Debian distributions.
This fixes the problem.

Signed-off-by: Ben Pfaff <blp@nicira.com>
ofproto-dpif: Destroy bundle after moving its last port out.

When the ofp_port argument to bundle_add_port() refers to an ofport_dpif
that already belongs to some other bundle, bundle_add_port() removed
the port from the other bundle, correctly, with bundle_del_port().
If the other bundle now contained no ports, however, this violated the
invariant that a bundle always contains at least one port.

Normally, this would get fixed up when the other bundle was processed
later during reconfiguration.  I haven't quite zeroed in on the exact
case where this is not true, but segfaults have happened here in
production, in particular when port adds and deletes happen simultaneously
and the new port reuses the OpenFlow port number of one of the deleted
ports.  It seems that the duplicate port number allows some port to rip
away the new port from its bundle without destroying that bundle.  I
suspect, therefore, that there is still a more subtle bug here, but I
hope that this will fix the segfault.

Bug #18967.
Signed-off-by: Ben Pfaff <blp@nicira.com>
ofproto: Remove obsolete comment and assertion.

At one time, the ofproto-dpif implementation of the 'rule_execute' member
function required, indirectly, at least struct(ofp10_packet_in) bytes of
headroom in the packet passed into it.  (This allowed constructing an
OFPT_PACKET_IN without allocating and copying a new ofpbuf.)  This
restriction has long been lifted, but rule_execute() had not yet caught
up.  This commit updates it.

Signed-off-by: Ben Pfaff <blp@nicira.com>
packets: Do not assume that IPv4, TCP, or ARP headers are 32-bit aligned.

Ethernet headers are 14 bytes long, so when the beginning of such a header
is 32-bit aligned, the following data is misaligned.  The usual trick to
fix that is to start the Ethernet header on an odd-numbered 16-bit
boundary.  That trick works OK for Open vSwitch, but there are two
problems:

   - OVS doesn't use that trick everywhere.  Maybe it should, but it's
     difficult to make sure that it does consistently because the CPUs
     most commonly used with OVS don't care about misalignment, so we
     only find problems when porting.

   - Some protocols (GRE, VXLAN) don't use that trick, so in such a case
     one can properly align the inner or outer L3/L4/L7 but not both.  (OVS
     userspace doesn't directly deal with such protocols yet, so this is
     just future-proofing.)

   - OpenFlow uses the alignment trick in a few places but not all of them.

This commit starts the adoption of what I hope will be a more robust way
to avoid misalignment problems and the resulting bus errors on RISC
architectures.  Instead of trying to ensure that 32-bit quantities are
always aligned, we always read them as if they were misaligned.  To ensure
that they are read this way, we change their types from 32-bit types to
pairs of 16-bit types.  (I don't know of any protocols that offset the
next header by an odd number of bytes, so a 16-bit alignment assumption
seems OK.)

The same would be necessary for 64-bit types in protocol headers, but we
don't yet have any protocol definitions with 64-bit types.

IPv6 protocol headers need the same treatment, but for those we rely on
structs provided by system headers, so I'll leave them for an upcoming
patch.

Signed-off-by: Ben Pfaff <blp@nicira.com>
packets: Introduce IPv6 headers not aligned on a 32-bit boundary.

This fixes the same problem for IPv6 headers treated for other headers in
the previous commit.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Declare the version as "1.9.3".

Signed-off-by: Justin Pettit <jpettit@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
ofproto: Convert units correctly in ofport_open().

netdev_features_to_bps() returns a speed in bps, but struct
ofputil_phy_port's curr_speed and max_speed are in kbps, so a conversion
is necessary.  This commit fixes the problem.

Reported-by: Benjamin Lunsky <benjamin.lunsky@netronome.com>
Tested-by: Benjamin Lunsky <benjamin.lunsky@netronome.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
vlan-splinter: Fix inverted logic bug.

When "other-config:enable-vlan-splinters=true" is set, the existing
vlans with ip address must be retained. The bug actually does the
opposite and retains the vlans without ip address. This commit fixes
it.

Reported-by: Roman Sokolkov <rsokolkov@gmail.com>
Signed-off-by: Alex Wang <alexw@nicira.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
datapath: Check for backported removal of HAVE_NET_DEVICE_OPS

The symbol HAVE_NET_DEVICE_OPS was removed in 3.1 even though these ops
still exist, so on newer kernels we define the symbol ourselves. However,
SLES 11 SP3 appears to have backported this symbol removal. This simply
defines the symbol on all kernels where it is relevant, unless it is
already defined.

Reported-by: Cristina Palomo Regidor <cristina.palomo.regidor@ericsson.com>
Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Pravin B Shelar <pshelar@nicira.com>
rhel: fix the exit status of the openvswitch init script.

This is a fix for a request to make sure that the openvswitch status command
in rhel based distros gives a useful exit status. That was fixed in

commit 5e0c05bc058c78a11be6747f62e6ad88e5d06b70
debian: Fix exit status of openvswitch-switch init script "status" command

Signed-off-by: Duffie Cooley <dcooley@nicira.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
ovs-controller: Avoid dereferencing NULL pointer when the switch acts as a hub

Starting ovs-controller with '-H' option will lead to a segment fault problem.
Add a check, and adjust the indentation of the following code.

Signed-off-by: ZhengLingyun <konghuarukhr@163.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
ofproto-dpif: Better tolerate running out of ports.

The dpif interface supports 65536 ports, but OpenFlow 1.0 supports fewer,
so ofproto-dpif needs to filter out port numbers larger than OF1.0 supports
and report an error to the caller.

Reported-by: Hiroshi Tanaka <htanaka@vmware.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>