compose_dsts() was updating the VLAN of packets sent to VLAN mirrors
before it changed the VLAN value, but of course it's the final VLAN value
that actually matters.
Thanks to Reid for his good work tracking this one down.
Bug #1898.
This bug was introduced in the merge from the citrix branch in commit
8fef8c71 "Merge citrix into master."
Thanks to Reid for characterizing the problem.
Bug #1907.
NetBSD defines NTOHL and NTOHS macros that are used differently than how
they are defined in the test-classifier.c. This commit renames the local
definition so there's no conflict.
OpenFlow has a maximum messages size of 65536 bytes, but management
messages can be greater than that. The management protocol's Extended
Data message is used to get around that limitation. This commit cleans
up some problems with our implementation and adds some additional
sanity-checking to received messages.
Related to vNetManager Bug #1843.
Under heavy VM network load, we have observed that ovs-vswitchd can be
starved for CPU time, which prevents flows from being set up. This can
in turn cause connections to XAPI in Dom0 to time out (among other issues).
It is probably not necessary to renice netback all the way to priority 0
as done in this commit. That is simply the value that we have tested. QA
has not reported any ill side-effects of this choice of value (yet). One
reasonable alternative, should any problems be noticed, would be to leave
netback at its default -5 priority and simply boost ovs-vswitchd's priority
to say -6 or -7.
Bug #1656.
Bug NIC-19, which reported that "brctl show" did not format its output in
the way expected by Citrix QA scripts, was believed fixed by commit
35c979bff4 "vswitchd: Support creating fake bond device interfaces."
Unfortunately, this commit was not tested on a XenServer before it was
committed. Due to differences in the actual test environment and the
XenServer environment, which have different versions of the bridge-utils
package that contains brctl, that commit did not fix the problem observed
by Citrix QA. In particular, the XenServer brctl uses sysfs to obtain
the information displayed by "brctl show", but the previous commit only
fixed up the information output by the bridge ioctls.
The natural way to fix this problem would be to fix up the sysfs support
as well. I started out along that path, but became bogged down in all
the details of the kernel sysfs.
This commit takes an alternate approach, by introducing a wrapper around
the system brctl binary that implements "brctl show" itself and delegates
all other functionality to the original binary (in a different location).
This will not fix tools that do not call into brctl, but to the best of
my knowledge there are no such tools used in the Citrix QA process.
Thanks to Justin and Reid for much feedback.
Bug NIC-19.
Commit 2bb451b69 "xenserver: Rename network devices to match MAC addresses
of physical PIFs" started renaming network devices so that they match
the MAC address that we expect them to have. This worked OK at the time.
Commit 35c979bff "vswitchd: Support creating fake bond device interfaces"
later started creating fake bond devices to make the Citrix QA scripts
happier.
Unfortunately these commits interact badly: the bond devices created by
the latter commit are sometimes chosen as the physical devices to be
renamed over the physical PIF device names. This is because we do allow
datapath internal ports to be chosen as "physical devices" as a last
resort. This commit reverses this decision, eliminating that possibility.
This probably won't become a problem unless somehow we encounter a physical
Ethernet card driver that lacks a queue, but that is unlikely since the
performance would be awful.
Commit c874dc6d6b "secchan: Fix behavior when a network device is renamed."
fixed a crash in the datapath when network devices within a datapath were
renamed. However, this missed the case where the device that was renamed
was a datapath's internal port: these devices have their br_port members
set to NULL, so we have to determine that they belong to a datapath another
way. This commit does so.
This commit also changes the initialization order in dp_dev_create().
Otherwise, dp_device_event() will dereference null when it is called via
register_netdevice(), because the newly created device is a datapath device
but its members are not yet initialized.
This was a somewhat difficult merge since there was a fair amount of
superficially divergent development on the two branches, especially in the
datapath.
This has been build-tested against XenServer 5.5.0 and XenServer 5.7.0
build 15122. It has been booted and connected to XenCenter on 5.5.0.
The merge revealed a couple of outstanding bugs, which will be fixed on
citrix and then merged back into master.
This allows the Citrix host installer to also write the dbcache on upgrade
which enables the management interface to come up on a slave after upgrade.
CP-1148.
Drop records for PIFs,bonds,VLANs etc for other hosts at the point at
which we fetch the records from xapi rather than filtering everytime
we iterate through the lists.
CP-1148.
Currently interface-reconfigure stores a copy of the XAPI database using
python's pickling functionality. Since the XenServer host installer also needs
to write this file (so it is present after slave upgrade) we would like to
switch to something more explicitly under our control.
Begin by factoring out XAPI interactions.
The PCRE_INFO_OKPARTIAL feature used by ovs-switchui was only introduced
in PCRE 7.2, so we need to check for that version or later, instead of
just for PCRE.
Thanks to Ian Campbell <Ian.Campbell@citrix.com> for reporting the problem.
For newer kernels the checksum setup is done at the point the skb is
received in netback or netfront so there is no more need to sprinkle
skb_checksum_setup calls throughout the kernel.
The interface-reconfigure script may add the 'fake-iface' configuration
option to the ovs-vswitchd.conf, but neglects to mention the interface.
This resulted in a "bonding.%s.fake-iface=true" line, which is clearly
wrong. This commit corrects that behavior.
When ovs-pki is used for CA cert generation, it generates certificates
that are identical except for the public key. If multiple controllers are
their own certificate authorities, the switch will receive multiple CA
certs that are identical other than their key. Unfortunately, OpenSSL
cannot distinguish between them. This is an excerpt of the
SSL_CTX_load_verify_locations function used by vconn-ssl:
Certificate matching is done based on the subject name, the key
identifier (if present), and the serial number as taken from the
certificate to be verified. If these data do not match, the next
certificate will be tried. If a first certificate matching the
parameters is found, the verification process will be performed; no
other certificates for the same parameters will be searched in case of
failure.
To work around this, we add a bit of uniqueness to each certificate. In
this commit, we add the generation time to the subject name. Please note
that the CN field is limited to 64 bytes, so a bit of name compression
needed to take place in order to fit the time.
Bug #1782
When ovs-pki is used for CA cert generation, it generates certificates
that are identical except for the public key. If multiple controllers are
their own certificate authorities, the switch will receive multiple CA
certs that are identical other than their key. Unfortunately, OpenSSL
cannot distinguish between them. This is an excerpt of the
SSL_CTX_load_verify_locations function used by vconn-ssl:
Certificate matching is done based on the subject name, the key
identifier (if present), and the serial number as taken from the
certificate to be verified. If these data do not match, the next
certificate will be tried. If a first certificate matching the
parameters is found, the verification process will be performed; no
other certificates for the same parameters will be searched in case of
failure.
To work around this, we add a bit of uniqueness to each certificate. In
this commit, we add the generation time to the subject name. Please note
that the CN field is limited to 64 bytes, so a bit of name compression
needed to take place in order to fit the time.
Bug #1782
If ovs-vswitchd.conf is locally modified, but ovs-vswitchd is not told
to reload it, updates from the controller will be refused. This is
because we attempt to lock the file with SHA-1 snapshot of the config
file. Since the hashes will not match, we will never be able to lock
the file, and all remote updates will fail. There is not much that can
be done about this, since we don't want to presume the current state of
the file is correct, since it could be in the process of being updated.
With this commit, we attempt to detect this problem and log a message
describing how to rectify it.
Bug #1516
In commit e10dfcf357 "rconn: Be pickier about what constitutes a
successful connection", the criteria for determining a successful
OpenFlow connection was tightened. When rconn connects at a socket
level, it prints messages stating that it "connected" and the switch is
taken out of fail-open mode. If it is determined that it is not a
"successful" OpenFlow connection, then the connection is closed and
fail-open is re-enabled. When this occurs, fail-open logs the following
potentially confusing message:
Could not connect to controller for XXX seconds, failing open
Where XXX is the number of seconds since the last "succesful" connection
rather than simple socket-level connection. This commit changes the
message to:
Could not establish OpenFlow channel to controller for XXX
seconds, failing open
Bug #1163
Open vSwitch allows up to 256 datapaths to be created. Each one
requires a few file descriptors. By default, XenServer limits each
process to 1024 file descriptors, which causes us to run out with roughly
140 datapaths. This change raises the limit to 4096, so we've got
additional wiggle room.
Feature #1820
Our version of interface-reconfigure was pulling the Ethtool, MTU,
and static route configuration for the local port from the PIF for the
local port, but these settings need to come from the network record
instead.
Bug #1798.
interface-reconfigure needs to configure MTU and Ethtool settings not just
on the local port, as it currently does, but on the physical devices as
well. This commit factors out the code for this so that it can be called
from multiple places.
This commit adds "get_" prefixes to the physdev_names and physdev_pifs
functions' names, because I want to use those names as variable names,
and then renames variables appropriately.
If DHCP is in use, then the physical devices have to be up before we
configure the local port, otherwise the DHCP request will never hit the
wire and we have no hope of getting an IP address.
This problem has been here for a long time, but it was masked until
commit c170afc1 "xenserver: Really take devices down in
interface-reconfigure." actually caused devices to go down and stay down.
Fixes bug #1809 "vswitch upgrade broke the xenserver".
We previously required that brcompat_mod be loaded before any datapaths
were created, because creation and destruction of datapaths and ports
differed when brcompat_mod was loaded, but the latter is no longer the
case so there is no reason for the former anymore.
Citrix QA scripts expect that "brctl show" shows a bond interface for each
bond that is added to a bridge. The only way to do that without modifying
brctl itself is to create an actual network device by that name, so this
commit adds a new bonding configuration key that causes an internal
device by the name of the bond to be created.
This feature is also necessary, but not sufficient, to allow XenCenter to
accurately show the link status and statistics of bridges (bug #1363).
This new configuration key is intentionally undocumented, because I don't
want anyone to use it.
Bug NIC-19.
The Citrix QA scripts assume that "brctl show" will show a topology as if
the Linux bridge were still in use; that is, as if there were one bridge
per VLAN and as if bonds were network devices of their own instead of
separate devices. However, we were showing the datapath topology, i.e.
all VLANs and bond devices lumped together into a single datapath. This
commit fixes the VLAN end of the problem, by moving the implementation of
the ioctls that brctl uses into userspace in ovs-brcompatd and putting the
necessary translation logic into ovs-brcompatd.
By itself, this commit does not fix the problem for bonds: the port name
for a bond does not (normally) under Open vSwitch exist as an actual
Linux network device, and thus it has no ifindex, and so ovs-brcompatd
can't pass it back to the kernel to report to brctl. This fix will have
to wait for another commit.
Bug NIC-19.
handle_fdb_query_cmd() should return an error when an error occurs, but
in this case it was always returning 0, because error is known to have
value 0 at this point.
Nothing really uses the return value here, and so eventually it would make
sense to just change the return type here and in the rest of the
handle_*() functions to void.
Upcoming commits will require sending Netlink messages to the kernel that
have additional attributes. Instead of adding more arguments to
send_reply() to handle these, it's cleaner to break up send_reply() into
two functions and let the caller add those attributes itself.
