Add BuildRequires to RHEL specfile

Added a build-time dependency on openssl-devel, so you can easily build
a source RPM and then pass it into mock for building in a clean build
environment (without manually having to install the buildrequires).

Signed-off-by: Jasper Capel <jasper@capel.tv>
Enable OpenFlow 1.0, 1.1, 1.2, and 1.3 by default.

The Open vSwitch software switch now supports all the required features of
OpenFlow 1.0 through 1.3, with one known trivial exception[*].  Enable them
by default in ovs-vswitchd.

For now, ovs-ofctl only enables OpenFlow 1.0 by default.  This is
because ovs-ofctl implements command such as "add-flow" as raw
OpenFlow requests, but those requests have subtly different semantics
in different OpenFlow versions.  For example:

    - In OpenFlow 1.0, a "mod-flow" operation that does not find any
      existing flow to modify adds a new flow.

    - In OpenFlow 1.1, a "mod-flow" operation that does not find any
      existing flow to modify adds a new flow, but only if the
      mod-flow did not match on the flow cookie.

    - In OpenFlow 1.2 and a later, a "mod-flow" operation never adds a
      new flow.

[*] OpenFlow 1.1, but not any earlier or later version of OpenFlow,
    requires support for VLANs introduced by Ethertype 0x88a8, but Open
    vSwitch does not support this Ethertype.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Reviewed-by: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
datapath: Remove unnecessary flow variable.

Patch fixes following warning:
datapath/linux/flow_table.c:580:40: warning: symbol 'flow' shadows an earlier one
datapath/linux/flow_table.c:558:24: originally declared here

Reported-by: Ben Pfaff <blp@nicira.com>
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Acked-by: Jesse Gross <jesse@nicira.com>
ofproto-dpif: Close race between processing packet_ins and checking seqno.

If a packet-in were to be queued, and the sequence number changed, after
grabbing the list of packet-ins, then the existing code could have gone to
sleep until something happened.  By grabbing the sequence number before
the list of packet-ins, we avoid this race.

Found by inspection.

Signed-off-by: Ben Pfaff <blp@nicira.com>
lib/classifier: Use a prefix tree to optimize ports wildcarding.

Using a prefix tree (aka 'trie') for transport ports matching produces
less specific (more wildcarded) datapath megaflows.

Each subtable that matches on transport ports has it's own ports trie.
This trie is consulted only after a failing lookup to determine the
number of bits that need to be unwildcarded to guarantee that any
packet that should match on any of the other rules will not match this
megaflow.

Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ethan Jackson <ethan@nicira.com>
bridge: Remove traces of flow-eviction-threshold.

This configuration option was shifted in 2.0, then removed in 2.1.
Remove the misleading log message.

Signed-off-by: Joe Stringer <joestringer@nicira.com>
Acked-by: Ethan Jackson <ethan@nicira.com>
cfm: Require ccm received in demand mode.

This commit adds a new requirement that cfm session must receive
at least one ccm every 100 * cfm_interval amount of time in demand
mode.  Otherwise, even if the data packets are received on the
monitored interface, the cfm session still reports "[recv]" fault.

Since the datapath flow is not purged when the userspace Open Vswitch
crashes, data packet can still be forwarded through the tunnel and
fool the remote CFM session in demand mode.  Thus, this commit can
prevent the remote CFM session from falsely declaring tunnel liveness
in this situation.

Signed-off-by: Alex Wang <alexw@nicira.com>
Acked-by: Ethan Jackson <ethan@nicira.com>
bfd: Require bfd control packet received in forwarding_if_rx mode.

This commit adds a requirement that bfd session must receive at least
one bfd control packet every 100 * bfd->cfg_min_rx amount of time in
forwarding_if_rx mode.  Otherwise, even if the data packets are received
on the monitored interface, the bfd->forwarding is still false.

Since the datapath flow is not purged when the userspace Open Vswitch
crashes, data packet can still be forwarded through the tunnel and
fool the remote BFD session in forwarding_if_rx mode.  Thus, this commit
can prevent the remote BFD session from falsely declaring tunnel liveness
in this situation.

Signed-off-by: Alex Wang <alexw@nicira.com>
Acked-by: Ethan Jackson <ethan@nicira.com>
ofproto-dpif-xlate: Fix in_port=controller case for NORMAL action

The problem mentioned by Simon Horman in the following mail.
http://openvswitch.org/pipermail/dev/2014-April/039492.html

Cc: Simon Horman <horms@verge.net.au>
Acked-by: Ben Pfaff <blp@nicira.com>
Signed-off-by: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
ofproto-dpif: Move recirc members from struct xlate_out to struct xlate_ctx

There does not seem to be a reason to expose
recirc members in struct xlate_out to move them
to struct xlate_ctx.

Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Ben Pfaff <blp@nicira.com>
ofp-print: Enable printing OF1.4 version

Also fix some tests that can now properly print packets
with the new protocol version.

Signed-off-by: Alexandru Copot <alex.mihai.c@gmail.com>
Cc: Daniel Baluta <dbaluta@ixiacom.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
ofproto-dpif: Correct check_recirc comment

This is a proposed correction for what appears to be
an editing error.

Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Ben Pfaff <blp@nicira.com>
Merge pull request #1 from spil-jasper/master

Add BuildRequires to RHEL specfile
ovs-ctl: Install manpage.

It seems that it is useful to admins after all.

Reported-by: Brian Candler <b.candler@pobox.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
ovs-thread: Fix OVS_ADAPTIVE_MUTEX_INITIALIZER.

Commit 05bf6d3c62e1d (ovs-thread: Add checking for mutex and rwlock
initialization.) updated mutex and rwlock initializers to set the "where"
member to a nonnull value, but missed this one.  This commit fixes the
problem.

This does not cause real problems in practice because
OVS_ADAPTIVE_MUTEX_INITIALIZER has no existing users.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
ofproto-dpif: Make bonding balance test more robust

It is my observation that when sending 91 packets to a mode=balance
bond interface with three underlying ports in some cases not all ports
receive at least 7 packets. This causes the test to fail.

It may be that failure indicates that the bonding code
needs improvement. But it seems to me that its more likely to
be a valid behaviour.

I have found that by sending 256 packets instead of 91 the test passes
more reliably: I am yet to see it fail.

Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Andy Zhou <azhou@nicira.com>
ofproto: Fix potential leak during flow mods.

This code created a cls_rule without destroying it.  Found by
inspection.

Signed-off-by: Ethan Jackson <ethan@nicira.com>
Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
ofproto: Fix is_flow_deletion_pending() false positive.

If one tries to install a rule that's identical to another rule in
another OpenFlow table which is being deleted, it's possible that
is_flow_deletion_pending() might confuse them and block the
installation.  This is such an edge case I doubt it has ever actually
happened.

Found by inspection.

Signed-off-by: Ethan Jackson <ethan@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
datapath: handle recirculation loop detection

Current datapath limits the number of times same packet can loop
through action execution to avoid blowing out the kernel stack.
Recirculation also adds to action execution count, but does not use
the same amount of stack compare to other services, such as IPsec.

This patch introduces the concept of stack cost. Recirculation has a
stack cost of 1 while other services have stack cost of 4. Datapath
packet process can accommodate packets that need both services and
recirculation as long as the total stack cost does not exceed the max
stack cost. Packets exceed the limit will be treated as looped packets
and dropped.

The max stack cost is set to allow up to 4 regular services, plus up
to 3 recirculation. The behavior of packets do not recirculate does
not change.

Signed-off-by: Andy Zhou <azhou@nicira.com>
Acked-by: Jesse Gross <jesse@nicira.com>
ofproto-macros.at: Assert daemon commands creates pidfile before exiting

I observed that "ofproto-dpif - ofproto-dpif-monitor 2" test,
which merely accesses ovsdb, failed in OVS_VSWITCHD_STOP's
"ovs-appctl -t ovs-vswitchd exit".  This commit tries to catch
the problem earlier by sprinkling AT_CHECKs.