ovs-pki: Use SHA-1 instead of SHA-512 as message digest.

Commit 9ff33ca7 (ovs-pki: Use SHA-512 instead of MD5 as message
digest.) changes the message digest algorithm to SHA-512.  This
seems to break the unit tests on some xenserver 5.6/6.0 builds
causing the error: "SSL_connect: error:0D0C50A1:asn1 encoding
routines:ASN1_item_verify:unknown message digest algorithm".

As a solution, this commit changes the message digest algorithm
to SHA-1 which works for both the above xenserver builds and
centos 7.

VMware-BZ: #1319116

Signed-off-by: Alex Wang <alexw@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
datapath: Fix double free when ovs_nla_copy_actions() fails

ovs_nla_copy_actions() already frees the allocated actions buffers,
ovs_flow_cmd_new() will free it a second time when jumping to
err_kfree_acts.

Signed-off-by: Thomas Graf <tgraf@noironetworks.com>
datapath: Constify various function arguments

Help produce better code.

Signed-off-by: Thomas Graf <tgraf@noironetworks.com>
datapath: Use central function to free sw_flow_actions

Signed-off-by: Thomas Graf <tgraf@noironetworks.com>
RFC: Add support for connection tracking.

An RFC to get back early feedback on exposing Linux's kernel connection
tracker to OVS.  The code has a few rough spots that will be addressed
in the next version:

    - Need better interface than setting individual flags for the state.
    - Need support for IP frags.
    - Need support for zones.
    - Should have ability to match on "invalid" connection states.
    - Should only allow conntrack() if conn_state is 0x00 to prevent loops.

I'd be interested in hearing back suggestion on improvements other than
those mentioned above.

Here's a simple example flow table to allow outbound TCP traffic from
port 1; drop traffic from port 2 that was not initiated by port 1:

ovs-ofctl add-flow br0 \
    "in_port=1,conn_state=0x00/0x80,tcp,action=conntrack(zone=0),normal"
ovs-ofctl add-flow br0 \
    "in_port=2,conn_state=0x00/0x80,tcp,action=conntrack(flags=1,zone=0)"
ovs-ofctl add-flow br0 in_port=2,conn_state=0x82/0x83,tcp,action=1
ovs-ofctl add-flow br0 in_port=2,conn_state=0x81/0x83,tcp,action=drop
ovs-ofctl add-flow br0 priority=10,action=normal
datapath: Add zone support
datapath: Add stateful NAT action

WIP

Signed-off-by: Thomas Graf <tgraf@noironetworks.com>
odp: NAT action