When Open vSwitch is configured to use a controller, but is unable to
connect to it, Open vSwitch will setup flows to allow all traffic, if
the failure mode is not configured, or set to standalone.
As this might be a security hazard, it is also possible to configure
Open vSwitch in a secure failure mode. Enabling this mode causes Open
vSwitch to drop all traffic if it is unable to connect to the
controller.
Redirect stderr of the command to /dev/null as it does not support the
--if-exists option.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Add a UCI config option to set the OpenFlow datapath description. This
allows setting a human readable description of the bridge, e.g.
"Building x, Floor y, AP z", which makes it easier to recognize the AP.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Open vSwitch supports SSL to connect to an OpenFlow controller. This is
recommended for security. Expand the UCI ovs config section to allow
configuring SSL CA, certificate and private key.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
By default, Open vSwitch will generate the OpenFlow datapath ID of a
bridge based on the MAC address of one of its ports. Due to this, it's
possible that the datapath ID changes when new ports are added. When the
datapath ID changes, Open vSwitch disconnects from the controller, as
there is no way to notify the controller that the datapath ID has
changed.
Add an option to set the datapath ID so that the above situation can be
avoided. The option takes either exactly 16 hex characters, or when
prefixed with 0x, between 1 and 16 hex characters.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
The current way to add ports to an Open vSwitch bridge does not allow
complex port configurations. Use a dedicated uci config section per port
instead of the current port:type syntax. This way we can easily support
more features like setting the VLAN tag or the OpenFlow port number.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
This new config section in package openvswitch
supports creating a named bridge, and setting
its' OpenFlow controller end-point.
An example config is included in /rom/etc/config/openvswitch
Signed-off-by: Simon Kinane <skinane@fb.com>
Open vSwitch 2.10 introduces meters support to the kernel datapath. In
upstream Linux, the feature is only available since 4.15
This is mainly for make the newly introduced meter features in linux
kernel datapath more easily available
root@OpenWrt:/# ovs-ofctl -OOpenFlow13 meter-features br0
OFPST_METER_FEATURES reply (OF1.3) (xid=0x2):
max_meter:4294967295 max_bands:1 max_color:0
band_types: drop
capabilities: kbps pktps burst stats
root@OpenWrt:/#
Size comparison between in-tree and upstreamed modules are attached
2800 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-geneve-intree/lib/modules/4.14.67/vport-geneve.ko
2736 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-geneve/lib/modules/4.14.67/vport-geneve.ko
2596 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-gre-intree/lib/modules/4.14.67/vport-gre.ko
2536 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-gre/lib/modules/4.14.67/vport-gre.ko
288320 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-intree/lib/modules/4.14.67/openvswitch.ko
118984 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch/lib/modules/4.14.67/openvswitch.ko
2792 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-lisp-intree/lib/modules/4.14.67/vport-lisp.ko
2788 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-stt-intree/lib/modules/4.14.67/vport-stt.ko
3668 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-vxlan-intree/lib/modules/4.14.67/vport-vxlan.ko
3400 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-vxlan/lib/modules/4.14.67/vport-vxlan.ko
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
New scheme mainly provides three packages: openvswitch,
openvswitch-ovn-north, openvswitch-ovn-controller. These should fit
most usage scenarios. Other subpackages like openvswitch-libXXX
etc. are there for dependency management and are hidden from the
menu.
Many python and shell scripts are removed in this revision. Most of
them cannot run out of box at all for lack of dependencies. Others
being legacy ones are not that useful now. Add them back at later time
when real need appears
Below are a simple listing of additions
- initscript now incorporate also ovn north and controller support
- ovn-ctl and ovs-ctl can be invoked directly from within $PATH
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Stijn Tintel
Simon Kinane
Yousong Zhou