You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by da...@apache.org on 2014/05/12 09:43:01 UTC
[1/3] git commit: updated refs/heads/4.4 to 2fa15a0
Repository: cloudstack
Updated Branches:
refs/heads/4.4 55398ee18 -> 2fa15a044
CLOUDSTACK-6608:OVS distributed firewall: default ACL rule is not
getting applied when a tier in VPC is created.
fix ensures, VpcRoutingPolicyUpdate is send when network rules are
programmed when network tier in VPC is created
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/0ba00ec2
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/0ba00ec2
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/0ba00ec2
Branch: refs/heads/4.4
Commit: 0ba00ec24dab00702b09ad9c3cdb407b68b8901f
Parents: 55398ee
Author: Murali Reddy <mu...@gmail.com>
Authored: Thu May 8 15:41:21 2014 +0530
Committer: Daan Hoogland <da...@onecht.net>
Committed: Mon May 12 09:40:36 2014 +0200
----------------------------------------------------------------------
server/src/com/cloud/network/vpc/NetworkACLManagerImpl.java | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/0ba00ec2/server/src/com/cloud/network/vpc/NetworkACLManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/network/vpc/NetworkACLManagerImpl.java b/server/src/com/cloud/network/vpc/NetworkACLManagerImpl.java
index ad47df1..d808c3f 100644
--- a/server/src/com/cloud/network/vpc/NetworkACLManagerImpl.java
+++ b/server/src/com/cloud/network/vpc/NetworkACLManagerImpl.java
@@ -491,8 +491,12 @@ public class NetworkACLManagerImpl extends ManagerBase implements NetworkACLMana
foundProvider = true;
s_logger.debug("Applying NetworkACL for network: " + network.getId() + " with Network ACL service provider");
handled = element.applyNetworkACLs(network, rules);
- if (handled)
+ if (handled) {
+ // publish message on message bus, so that network elements implementing distributed routing
+ // capability can act on the event
+ _messageBus.publish(_name, "Network_ACL_Replaced", PublishScope.LOCAL, network);
break;
+ }
}
if (!foundProvider) {
s_logger.debug("Unable to find NetworkACL service provider for network: " + network.getId());
[3/3] git commit: updated refs/heads/4.4 to 2fa15a0
Posted by da...@apache.org.
CLOUDSTACK-6609: OVS distributed routing: ensure tunnels are created if
not created already when OvsVpcPhysicalTopologyConfigCommand update is
recived
Currently if the tunnel creation fails, there is no retry logic. Fix
ensures OvsVpcPhysicalTopologyConfigCommand updates as an opputiunity to ensure
proper tunnels are established between the hosts.
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/2fa15a04
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/2fa15a04
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/2fa15a04
Branch: refs/heads/4.4
Commit: 2fa15a044a08159f4430265aaa5e4e1e394970c8
Parents: 0adf892
Author: Murali Reddy <mu...@gmail.com>
Authored: Thu May 8 15:48:22 2014 +0530
Committer: Daan Hoogland <da...@onecht.net>
Committed: Mon May 12 09:42:36 2014 +0200
----------------------------------------------------------------------
.../cloud/network/ovs/OvsTunnelManagerImpl.java | 32 +++-
.../ovs/dao/VpcDistributedRouterSeqNoVO.java | 23 ++-
.../xenserver/cloudstack_pluginlib.py | 155 +++++++++++++++++--
scripts/vm/hypervisor/xenserver/ovstunnel | 139 ++---------------
setup/db/db/schema-430to440.sql | 3 +-
5 files changed, 203 insertions(+), 149 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/2fa15a04/plugins/network-elements/ovs/src/com/cloud/network/ovs/OvsTunnelManagerImpl.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/ovs/src/com/cloud/network/ovs/OvsTunnelManagerImpl.java b/plugins/network-elements/ovs/src/com/cloud/network/ovs/OvsTunnelManagerImpl.java
index 6fd7d6d..2405f87 100644
--- a/plugins/network-elements/ovs/src/com/cloud/network/ovs/OvsTunnelManagerImpl.java
+++ b/plugins/network-elements/ovs/src/com/cloud/network/ovs/OvsTunnelManagerImpl.java
@@ -710,7 +710,7 @@ public class OvsTunnelManagerImpl extends ManagerBase implements OvsTunnelManage
String bridgeName=generateBridgeNameForVpc(vpcId);
OvsVpcPhysicalTopologyConfigCommand topologyConfigCommand = prepareVpcTopologyUpdate(vpcId);
- topologyConfigCommand.setSequenceNumber(getNextSequenceNumber(vpcId));
+ topologyConfigCommand.setSequenceNumber(getNextTopologyUpdateSequenceNumber(vpcId));
// send topology change update to VPC spanned hosts
for (Long id: vpcSpannedHostIds) {
@@ -820,7 +820,7 @@ public class OvsTunnelManagerImpl extends ManagerBase implements OvsTunnelManage
if (network.getVpcId() != null && isVpcEnabledForDistributedRouter(network.getVpcId())) {
long vpcId = network.getVpcId();
OvsVpcRoutingPolicyConfigCommand cmd = prepareVpcRoutingPolicyUpdate(vpcId);
- cmd.setSequenceNumber(getNextSequenceNumber(vpcId));
+ cmd.setSequenceNumber(getNextRoutingPolicyUpdateSequenceNumber(vpcId));
// get the list of hosts on which VPC spans (i.e hosts that need to be aware of VPC
// network ACL update)
@@ -901,7 +901,7 @@ public class OvsTunnelManagerImpl extends ManagerBase implements OvsTunnelManage
}
}
- private long getNextSequenceNumber(final long vpcId) {
+ private long getNextTopologyUpdateSequenceNumber(final long vpcId) {
try {
return Transaction.execute(new TransactionCallback<Long>() {
@@ -913,9 +913,31 @@ public class OvsTunnelManagerImpl extends ManagerBase implements OvsTunnelManage
_vpcDrSeqNoDao.persist(seqVo);
}
seqVo = _vpcDrSeqNoDao.lockRow(seqVo.getId(), true);
- seqVo.incrSequenceNo();
+ seqVo.incrTopologyUpdateSequenceNo();
_vpcDrSeqNoDao.update(seqVo.getId(), seqVo);
- return seqVo.getSequenceNo();
+ return seqVo.getTopologyUpdateSequenceNo();
+ }
+ });
+ } finally {
+
+ }
+ }
+
+ private long getNextRoutingPolicyUpdateSequenceNumber(final long vpcId) {
+
+ try {
+ return Transaction.execute(new TransactionCallback<Long>() {
+ @Override
+ public Long doInTransaction(TransactionStatus status) {
+ VpcDistributedRouterSeqNoVO seqVo = _vpcDrSeqNoDao.findByVpcId(vpcId);
+ if (seqVo == null) {
+ seqVo = new VpcDistributedRouterSeqNoVO(vpcId);
+ _vpcDrSeqNoDao.persist(seqVo);
+ }
+ seqVo = _vpcDrSeqNoDao.lockRow(seqVo.getId(), true);
+ seqVo.incrPolicyUpdateSequenceNo();
+ _vpcDrSeqNoDao.update(seqVo.getId(), seqVo);
+ return seqVo.getPolicyUpdateSequenceNo();
}
});
} finally {
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/2fa15a04/plugins/network-elements/ovs/src/com/cloud/network/ovs/dao/VpcDistributedRouterSeqNoVO.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/ovs/src/com/cloud/network/ovs/dao/VpcDistributedRouterSeqNoVO.java b/plugins/network-elements/ovs/src/com/cloud/network/ovs/dao/VpcDistributedRouterSeqNoVO.java
index d87a2c4..613af81 100644
--- a/plugins/network-elements/ovs/src/com/cloud/network/ovs/dao/VpcDistributedRouterSeqNoVO.java
+++ b/plugins/network-elements/ovs/src/com/cloud/network/ovs/dao/VpcDistributedRouterSeqNoVO.java
@@ -37,8 +37,11 @@ public class VpcDistributedRouterSeqNoVO implements InternalIdentity {
@Column(name = "vpc_id", updatable = false, nullable = false)
private Long vpcId;
- @Column(name = "sequence_no")
- long sequenceNo = 0;
+ @Column(name = "topology_update_sequence_no")
+ long topologyUpdateSequenceNo = 0;
+
+ @Column(name = "routing_policy__update_sequence_no")
+ long policyUpdateSequenceNo = 0;
protected VpcDistributedRouterSeqNoVO() {
@@ -62,11 +65,19 @@ public class VpcDistributedRouterSeqNoVO implements InternalIdentity {
this.vpcId = vpcId;
}
- public long getSequenceNo() {
- return sequenceNo;
+ public long getTopologyUpdateSequenceNo() {
+ return topologyUpdateSequenceNo;
+ }
+
+ public void incrTopologyUpdateSequenceNo() {
+ topologyUpdateSequenceNo++;
+ }
+
+ public long getPolicyUpdateSequenceNo() {
+ return policyUpdateSequenceNo;
}
- public void incrSequenceNo() {
- sequenceNo++;
+ public void incrPolicyUpdateSequenceNo() {
+ policyUpdateSequenceNo++;
}
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/2fa15a04/scripts/vm/hypervisor/xenserver/cloudstack_pluginlib.py
----------------------------------------------------------------------
diff --git a/scripts/vm/hypervisor/xenserver/cloudstack_pluginlib.py b/scripts/vm/hypervisor/xenserver/cloudstack_pluginlib.py
index fb28cae..b93f87b 100644
--- a/scripts/vm/hypervisor/xenserver/cloudstack_pluginlib.py
+++ b/scripts/vm/hypervisor/xenserver/cloudstack_pluginlib.py
@@ -344,8 +344,139 @@ def get_acl(vpcconfig, required_acl_id):
return acl
return None
-# Configures the bridge created for a VPC enabled for distributed routing. Management server sends VPC physical topology
-# details. Based on the VPC physical topology L2 lookup table and L3 lookup tables are updated by this function.
+def check_tunnel_exists(bridge, tunnel_name):
+ res = do_cmd([VSCTL_PATH, "port-to-br", tunnel_name])
+ return res == bridge
+
+def create_tunnel(bridge, remote_ip, gre_key, src_host, dst_host, network_uuid):
+
+ logging.debug("Creating tunnel from host %s" %src_host + " to host %s" %dst_host + " with GRE key %s" %gre_key)
+
+ res = check_switch()
+ if res != "SUCCESS":
+ logging.debug("Openvswitch running: NO")
+ return "FAILURE:%s" % res
+
+ # We need to keep the name below 14 characters
+ # src and target are enough - consider a fixed length hash
+ name = "t%s-%s-%s" % (gre_key, src_host, dst_host)
+
+ # Verify the xapi bridge to be created
+ # NOTE: Timeout should not be necessary anymore
+ wait = [VSCTL_PATH, "--timeout=30", "wait-until", "bridge",
+ bridge, "--", "get", "bridge", bridge, "name"]
+ res = do_cmd(wait)
+ if bridge not in res:
+ logging.debug("WARNING:Can't find bridge %s for creating " +
+ "tunnel!" % bridge)
+ return "FAILURE:NO_BRIDGE"
+ logging.debug("bridge %s for creating tunnel - VERIFIED" % bridge)
+ tunnel_setup = False
+ drop_flow_setup = False
+ try:
+ # Create a port and configure the tunnel interface for it
+ add_tunnel = [VSCTL_PATH, "add-port", bridge,
+ name, "--", "set", "interface",
+ name, "type=gre", "options:key=%s" % gre_key,
+ "options:remote_ip=%s" % remote_ip]
+ do_cmd(add_tunnel)
+ tunnel_setup = True
+ # verify port
+ verify_port = [VSCTL_PATH, "get", "port", name, "interfaces"]
+ res = do_cmd(verify_port)
+ # Expecting python-style list as output
+ iface_list = []
+ if len(res) > 2:
+ iface_list = res.strip()[1:-1].split(',')
+ if len(iface_list) != 1:
+ logging.debug("WARNING: Unexpected output while verifying " +
+ "port %s on bridge %s" % (name, bridge))
+ return "FAILURE:VERIFY_PORT_FAILED"
+
+ # verify interface
+ iface_uuid = iface_list[0]
+ verify_interface_key = [VSCTL_PATH, "get", "interface",
+ iface_uuid, "options:key"]
+ verify_interface_ip = [VSCTL_PATH, "get", "interface",
+ iface_uuid, "options:remote_ip"]
+
+ key_validation = do_cmd(verify_interface_key)
+ ip_validation = do_cmd(verify_interface_ip)
+
+ if not gre_key in key_validation or not remote_ip in ip_validation:
+ logging.debug("WARNING: Unexpected output while verifying " +
+ "interface %s on bridge %s" % (name, bridge))
+ return "FAILURE:VERIFY_INTERFACE_FAILED"
+ logging.debug("Tunnel interface validated:%s" % verify_interface_ip)
+ cmd_tun_ofport = [VSCTL_PATH, "get", "interface",
+ iface_uuid, "ofport"]
+ tun_ofport = do_cmd(cmd_tun_ofport)
+ # Ensure no trailing LF
+ if tun_ofport.endswith('\n'):
+ tun_ofport = tun_ofport[:-1]
+ # find xs network for this bridge, verify is used for ovs tunnel network
+ xs_nw_uuid = do_cmd([XE_PATH, "network-list",
+ "bridge=%s" % bridge, "--minimal"])
+ ovs_tunnel_network = False
+ try:
+ ovs_tunnel_network = do_cmd([XE_PATH,"network-param-get",
+ "uuid=%s" % xs_nw_uuid,
+ "param-name=other-config",
+ "param-key=is-ovs-tun-network", "--minimal"])
+ except:
+ pass
+
+ ovs_vpc_distributed_vr_network = False
+ try:
+ ovs_vpc_distributed_vr_network = do_cmd([XE_PATH,"network-param-get",
+ "uuid=%s" % xs_nw_uuid,
+ "param-name=other-config",
+ "param-key=is-ovs-vpc-distributed-vr-network", "--minimal"])
+ except:
+ pass
+
+ if ovs_tunnel_network == 'True':
+ # add flow entryies for dropping broadcast coming in from gre tunnel
+ add_flow(bridge, priority=1000, in_port=tun_ofport,
+ dl_dst='ff:ff:ff:ff:ff:ff', actions='drop')
+ add_flow(bridge, priority=1000, in_port=tun_ofport,
+ nw_dst='224.0.0.0/24', actions='drop')
+ drop_flow_setup = True
+ logging.debug("Broadcast drop rules added")
+
+ if ovs_vpc_distributed_vr_network == 'True':
+ # add flow rules for dropping broadcast coming in from tunnel ports
+ add_flow(bridge, priority=1000, in_port=tun_ofport, table=0,
+ dl_dst='ff:ff:ff:ff:ff:ff', actions='drop')
+ add_flow(bridge, priority=1000, in_port=tun_ofport, table=0,
+ nw_dst='224.0.0.0/24', actions='drop')
+
+ # add flow rule to send the traffic from tunnel ports to L2 switching table only
+ add_flow(bridge, priority=1100, in_port=tun_ofport, table=0, actions='resubmit(,1)')
+
+ # mark tunnel interface with network id for which this tunnel was created
+ do_cmd([VSCTL_PATH, "set", "interface", name, "options:cloudstack-network-id=%s" % network_uuid])
+ update_flooding_rules_on_port_plug_unplug(bridge, name, 'online', network_uuid)
+
+ logging.debug("Successfully created tunnel from host %s" %src_host + " to host %s" %dst_host +
+ " with GRE key %s" %gre_key)
+ return "SUCCESS:%s creation succeeded" % name
+ except:
+ logging.debug("An unexpected error occured. Rolling back")
+ if tunnel_setup:
+ logging.debug("Deleting GRE interface")
+ # Destroy GRE port and interface
+ del_port(bridge, name)
+ if drop_flow_setup:
+ # Delete flows
+ logging.debug("Deleting flow entries from GRE interface")
+ del_flows(bridge, in_port=tun_ofport)
+ # This will not cancel the original exception
+ raise
+
+# Configures the bridge created for a VPC that is enabled for distributed routing. Management server sends VPC
+# physical topology details (which VM from which tier running on which host etc). Based on the VPC physical topology L2
+# lookup table and L3 lookup tables are updated by this function.
def configure_vpc_bridge_for_network_topology(bridge, this_host_id, json_config, sequence_no):
vpconfig = jsonLoader(json.loads(json_config)).vpc
@@ -412,8 +543,13 @@ def configure_vpc_bridge_for_network_topology(bridge, this_host_id, json_config,
network = get_network_details(vpconfig, nic.networkuuid)
gre_key = network.grekey
- # generate tunnel name as per the tunnel naming convention and get the OF port
+ # generate tunnel name as per the tunnel naming convention
tunnel_name = "t%s-%s-%s" % (gre_key, this_host_id, host.hostid)
+
+ # check if tunnel exists already, if not create a tunnel from this host to remote host
+ if not check_tunnel_exists(bridge, tunnel_name):
+ create_tunnel(bridge, host.ipaddress, gre_key, this_host_id, host.hostid, network.networkuuid)
+
of_port = get_ofport_for_vif(tunnel_name)
# Add flow rule in L2 look up table, if packet's destination mac matches MAC of the VM's nic
@@ -441,10 +577,10 @@ def configure_vpc_bridge_for_network_topology(bridge, this_host_id, json_config,
del_flows(bridge, table=L3_LOOKUP_TABLE)
ofspec.seek(0)
- logging.debug("Adding below flows rules L2 & L3 lookup tables:\n" + ofspec.read())
+ logging.debug("Adding below flows rules in L2 & L3 lookup tables:\n" + ofspec.read())
+ ofspec.close()
# update bridge with the flow-rules for L2 lookup and L3 lookup in the file in one attempt
- ofspec.close()
do_cmd([OFCTL_PATH, 'add-flows', bridge, ofspec_filename])
# now that we updated the bridge with flow rules close and delete the file.
@@ -460,8 +596,9 @@ def configure_vpc_bridge_for_network_topology(bridge, this_host_id, json_config,
os.remove(ofspec_filename)
raise error_message
-# Configures the bridge created for a VPC enabled for distributed firewall. Management server sends VPC routing policies
-# details. Based on the VPC routing policies ingress ACL table and egress ACL tables are updated by this function.
+# Configures the bridge created for a VPC that is enabled for distributed firewall. Management server sends VPC routing
+# policy (network ACL applied on the tiers etc) details. Based on the VPC routing policies ingress ACL table and
+# egress ACL tables are updated by this function.
def configure_vpc_bridge_for_routing_policies(bridge, json_config, sequence_no):
vpconfig = jsonLoader(json.loads(json_config)).vpc
@@ -564,9 +701,9 @@ def configure_vpc_bridge_for_routing_policies(bridge, json_config, sequence_no):
ofspec.seek(0)
logging.debug("Adding below flows rules Ingress & Egress ACL tables:\n" + ofspec.read())
+ ofspec.close()
# update bridge with the flow-rules for ingress and egress ACL's added in the file in one attempt
- ofspec.close()
do_cmd([OFCTL_PATH, 'add-flows', bridge, ofspec_filename])
# now that we updated the bridge with flow rules delete the file.
@@ -658,9 +795,9 @@ def update_flooding_rules_on_port_plug_unplug(bridge, interface, command, if_net
ofspec.seek(0)
logging.debug("Adding below flows rules L2 flooding table: \n" + ofspec.read())
+ ofspec.close()
# update bridge with the flow-rules for broadcast rules added in the file in one attempt
- ofspec.close()
do_cmd([OFCTL_PATH, 'add-flows', bridge, ofspec_filename])
# now that we updated the bridge with flow rules delete the file.
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/2fa15a04/scripts/vm/hypervisor/xenserver/ovstunnel
----------------------------------------------------------------------
diff --git a/scripts/vm/hypervisor/xenserver/ovstunnel b/scripts/vm/hypervisor/xenserver/ovstunnel
index 358cd54..c95fc20 100755
--- a/scripts/vm/hypervisor/xenserver/ovstunnel
+++ b/scripts/vm/hypervisor/xenserver/ovstunnel
@@ -193,7 +193,8 @@ def setup_ovs_bridge_for_distributed_routing(session, args):
lib.add_flow(bridge, priority=0, table=lib.INGRESS_ACL_TABLE, actions='drop')
# initialize the sequence number for the bridge
- lib.do_cmd([lib.VSCTL_PATH, "set", "bridge", bridge, "other-config:sequence-number=0"])
+ lib.do_cmd([lib.VSCTL_PATH, "set", "bridge", bridge, "other-config:topology-update-sequence-number=0"])
+ lib.do_cmd([lib.VSCTL_PATH, "set", "bridge", bridge, "other-config:route-policy-update-sequence-number=0"])
result = "SUCCESS: successfully setup bridge with flow rules"
@@ -232,128 +233,7 @@ def create_tunnel(session, args):
dst_host = args.pop("to")
network_uuid = args.pop("cloudstack-network-id")
- logging.debug("Entering create_tunnel")
-
- res = lib.check_switch()
- if res != "SUCCESS":
- logging.debug("Openvswitch running: NO")
- return "FAILURE:%s" % res
-
- # We need to keep the name below 14 characters
- # src and target are enough - consider a fixed length hash
- name = "t%s-%s-%s" % (gre_key, src_host, dst_host)
-
- # Verify the xapi bridge to be created
- # NOTE: Timeout should not be necessary anymore
- wait = [lib.VSCTL_PATH, "--timeout=30", "wait-until", "bridge",
- bridge, "--", "get", "bridge", bridge, "name"]
- res = lib.do_cmd(wait)
- if bridge not in res:
- logging.debug("WARNING:Can't find bridge %s for creating " +
- "tunnel!" % bridge)
- return "FAILURE:NO_BRIDGE"
- logging.debug("bridge %s for creating tunnel - VERIFIED" % bridge)
- tunnel_setup = False
- drop_flow_setup = False
- try:
- # Create a port and configure the tunnel interface for it
- add_tunnel = [lib.VSCTL_PATH, "add-port", bridge,
- name, "--", "set", "interface",
- name, "type=gre", "options:key=%s" % gre_key,
- "options:remote_ip=%s" % remote_ip]
- lib.do_cmd(add_tunnel)
- tunnel_setup = True
- # verify port
- verify_port = [lib.VSCTL_PATH, "get", "port", name, "interfaces"]
- res = lib.do_cmd(verify_port)
- # Expecting python-style list as output
- iface_list = []
- if len(res) > 2:
- iface_list = res.strip()[1:-1].split(',')
- if len(iface_list) != 1:
- logging.debug("WARNING: Unexpected output while verifying " +
- "port %s on bridge %s" % (name, bridge))
- return "FAILURE:VERIFY_PORT_FAILED"
-
- # verify interface
- iface_uuid = iface_list[0]
- verify_interface_key = [lib.VSCTL_PATH, "get", "interface",
- iface_uuid, "options:key"]
- verify_interface_ip = [lib.VSCTL_PATH, "get", "interface",
- iface_uuid, "options:remote_ip"]
-
- key_validation = lib.do_cmd(verify_interface_key)
- ip_validation = lib.do_cmd(verify_interface_ip)
-
- if not gre_key in key_validation or not remote_ip in ip_validation:
- logging.debug("WARNING: Unexpected output while verifying " +
- "interface %s on bridge %s" % (name, bridge))
- return "FAILURE:VERIFY_INTERFACE_FAILED"
- logging.debug("Tunnel interface validated:%s" % verify_interface_ip)
- cmd_tun_ofport = [lib.VSCTL_PATH, "get", "interface",
- iface_uuid, "ofport"]
- tun_ofport = lib.do_cmd(cmd_tun_ofport)
- # Ensure no trailing LF
- if tun_ofport.endswith('\n'):
- tun_ofport = tun_ofport[:-1]
- # find xs network for this bridge, verify is used for ovs tunnel network
- xs_nw_uuid = lib.do_cmd([lib.XE_PATH, "network-list",
- "bridge=%s" % bridge, "--minimal"])
- ovs_tunnel_network = False
- try:
- ovs_tunnel_network = lib.do_cmd([lib.XE_PATH,"network-param-get",
- "uuid=%s" % xs_nw_uuid,
- "param-name=other-config",
- "param-key=is-ovs-tun-network", "--minimal"])
- except:
- pass
-
- ovs_vpc_distributed_vr_network = False
- try:
- ovs_vpc_distributed_vr_network = lib.do_cmd([lib.XE_PATH,"network-param-get",
- "uuid=%s" % xs_nw_uuid,
- "param-name=other-config",
- "param-key=is-ovs-vpc-distributed-vr-network", "--minimal"])
- except:
- pass
-
- if ovs_tunnel_network == 'True':
- # add flow entryies for dropping broadcast coming in from gre tunnel
- lib.add_flow(bridge, priority=1000, in_port=tun_ofport,
- dl_dst='ff:ff:ff:ff:ff:ff', actions='drop')
- lib.add_flow(bridge, priority=1000, in_port=tun_ofport,
- nw_dst='224.0.0.0/24', actions='drop')
- drop_flow_setup = True
- logging.debug("Broadcast drop rules added")
-
- if ovs_vpc_distributed_vr_network == 'True':
- # add flow rules for dropping broadcast coming in from tunnel ports
- lib.add_flow(bridge, priority=1000, in_port=tun_ofport, table=0,
- dl_dst='ff:ff:ff:ff:ff:ff', actions='drop')
- lib.add_flow(bridge, priority=1000, in_port=tun_ofport, table=0,
- nw_dst='224.0.0.0/24', actions='drop')
-
- # add flow rule to send the traffic from tunnel ports to L2 switching table only
- lib.add_flow(bridge, priority=1100, in_port=tun_ofport, table=0, actions='resubmit(,1)')
-
- # mark tunnel interface with network id for which this tunnel was created
- lib.do_cmd([lib.VSCTL_PATH, "set", "interface", name, "options:cloudstack-network-id=%s" % network_uuid])
- lib.update_flooding_rules_on_port_plug_unplug(bridge, name, 'online', network_uuid)
-
- return "SUCCESS:%s" % name
- except:
- logging.debug("An unexpected error occured. Rolling back")
- if tunnel_setup:
- logging.debug("Deleting GRE interface")
- # Destroy GRE port and interface
- lib.del_port(bridge, name)
- if drop_flow_setup:
- # Delete flows
- logging.debug("Deleting flow entries from GRE interface")
- lib.del_flows(bridge, in_port=tun_ofport)
- # This will not cancel the original exception
- raise
-
+ return lib.create_tunnel(bridge, remote_ip, gre_key, src_host, dst_host, network_uuid)
@echo
def destroy_tunnel(session, args):
@@ -414,10 +294,11 @@ def configure_ovs_bridge_for_network_topology(session, args):
sequence_no = args.pop("seq-no")
# get the last update sequence number
- last_seq_no = lib.do_cmd([lib.VSCTL_PATH, "get", "bridge", bridge, "other-config:sequence-number"])
+ last_seq_no = lib.do_cmd([lib.VSCTL_PATH, "get", "bridge", bridge, "other-config:topology-update-sequence-number"])
last_seq_no = last_seq_no[1:-1]
if long(sequence_no) > long(last_seq_no):
- lib.do_cmd([lib.VSCTL_PATH, "set", "bridge", bridge, "other-config:sequence-number=%s"%sequence_no])
+ lib.do_cmd([lib.VSCTL_PATH, "set", "bridge", bridge,
+ "other-config:topology-update-sequence-number=%s"%sequence_no])
return lib.configure_vpc_bridge_for_network_topology(bridge, this_host_id, json_config, sequence_no)
else:
return "SUCCESS: Ignoring the update with the sequence number %s" %sequence_no + " as there is already recent" \
@@ -430,10 +311,12 @@ def configure_ovs_bridge_for_routing_policies(session, args):
sequence_no = args.pop("seq-no")
# get the last update sequence number
- last_seq_no = lib.do_cmd([lib.VSCTL_PATH, "get", "bridge", bridge, "other-config:sequence-number"])
+ last_seq_no = lib.do_cmd([lib.VSCTL_PATH, "get", "bridge", bridge,
+ "other-config:route-policy-update-sequence-number"])
last_seq_no = last_seq_no[1:-1]
if long(sequence_no) > long(last_seq_no):
- lib.do_cmd([lib.VSCTL_PATH, "set", "bridge", bridge, "other-config:sequence-number=%s"%sequence_no])
+ lib.do_cmd([lib.VSCTL_PATH, "set", "bridge", bridge,
+ "other-config:route-policy-update-sequence-number=%s"%sequence_no])
return lib.configure_vpc_bridge_for_routing_policies(bridge, json_config, sequence_no)
else:
return "SUCCESS: Ignoring the update with the sequence number %s" %sequence_no + " as there is already recent" \
@@ -448,4 +331,4 @@ if __name__ == "__main__":
"getLabel": getLabel,
"setup_ovs_bridge_for_distributed_routing": setup_ovs_bridge_for_distributed_routing,
"configure_ovs_bridge_for_network_topology": configure_ovs_bridge_for_network_topology,
- "configure_ovs_bridge_for_routing_policies": configure_ovs_bridge_for_routing_policies})
+ "configure_ovs_bridge_for_routing_policies": configure_ovs_bridge_for_routing_policies})
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/2fa15a04/setup/db/db/schema-430to440.sql
----------------------------------------------------------------------
diff --git a/setup/db/db/schema-430to440.sql b/setup/db/db/schema-430to440.sql
index cca6e1f..8cb8221 100644
--- a/setup/db/db/schema-430to440.sql
+++ b/setup/db/db/schema-430to440.sql
@@ -1647,7 +1647,8 @@ INSERT INTO `cloud`.`configuration`(category, instance, component, name, value,
CREATE TABLE `cloud`.`op_vpc_distributed_router_sequence_no` (
`id` bigint unsigned UNIQUE NOT NULL AUTO_INCREMENT COMMENT 'id',
`vpc_id` bigint unsigned NOT NULL COMMENT 'vpc id.',
- `sequence_no` bigint unsigned COMMENT 'seq number to be sent to agent, uniquely identifies topology or routing policy updates',
+ `topology_update_sequence_no` bigint unsigned COMMENT 'sequence number to be sent to hypervisor, uniquely identifies a VPC topology update',
+ `routing_policy__update_sequence_no` bigint unsigned COMMENT 'sequence number to be sent to hypervisor, uniquely identifies a routing policy update',
PRIMARY KEY (`id`),
UNIQUE `u_op_vpc_distributed_router_sequence_no_vpc_id`(`vpc_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
[2/3] git commit: updated refs/heads/4.4 to 2fa15a0
Posted by da...@apache.org.
CLOUDSTACK-6592: OVS distributed routing: make populate flooding rules
transactional
creats a file with all openflow rules updates and using ovs-ofctl file
option updates the brige in one go
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/0adf8924
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/0adf8924
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/0adf8924
Branch: refs/heads/4.4
Commit: 0adf8924e28dc9bc1af5a2e04d5146d97e60fced
Parents: 0ba00ec
Author: Murali Reddy <mu...@gmail.com>
Authored: Wed May 7 19:29:45 2014 +0530
Committer: Daan Hoogland <da...@onecht.net>
Committed: Mon May 12 09:42:18 2014 +0200
----------------------------------------------------------------------
.../xenserver/cloudstack_pluginlib.py | 270 ++++++++++---------
scripts/vm/hypervisor/xenserver/ovstunnel | 6 +-
2 files changed, 150 insertions(+), 126 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/0adf8924/scripts/vm/hypervisor/xenserver/cloudstack_pluginlib.py
----------------------------------------------------------------------
diff --git a/scripts/vm/hypervisor/xenserver/cloudstack_pluginlib.py b/scripts/vm/hypervisor/xenserver/cloudstack_pluginlib.py
index bccb7ae..fb28cae 100644
--- a/scripts/vm/hypervisor/xenserver/cloudstack_pluginlib.py
+++ b/scripts/vm/hypervisor/xenserver/cloudstack_pluginlib.py
@@ -243,7 +243,9 @@ def del_port(bridge, port):
def get_network_id_for_vif(vif_name):
domain_id, device_id = vif_name[3:len(vif_name)].split(".")
- dom_uuid = do_cmd([XE_PATH, "vm-list", "dom-id=%s" % domain_id, "--minimal"])
+ hostname = do_cmd(["/bin/bash", "-c", "hostname"])
+ this_host_uuid = do_cmd([XE_PATH, "host-list", "hostname=%s" % hostname, "--minimal"])
+ dom_uuid = do_cmd([XE_PATH, "vm-list", "dom-id=%s" % domain_id, "resident-on=%s" %this_host_uuid, "--minimal"])
vif_uuid = do_cmd([XE_PATH, "vif-list", "vm-uuid=%s" % dom_uuid, "device=%s" % device_id, "--minimal"])
vnet = do_cmd([XE_PATH, "vif-param-get", "uuid=%s" % vif_uuid, "param-name=other-config",
"param-key=cloudstack-network-id"])
@@ -344,7 +346,7 @@ def get_acl(vpcconfig, required_acl_id):
# Configures the bridge created for a VPC enabled for distributed routing. Management server sends VPC physical topology
# details. Based on the VPC physical topology L2 lookup table and L3 lookup tables are updated by this function.
-def configure_bridge_for_network_topology(bridge, this_host_id, json_config, sequence_no):
+def configure_vpc_bridge_for_network_topology(bridge, this_host_id, json_config, sequence_no):
vpconfig = jsonLoader(json.loads(json_config)).vpc
if vpconfig is None:
@@ -357,7 +359,7 @@ def configure_bridge_for_network_topology(bridge, this_host_id, json_config, seq
# create a temporary file to store OpenFlow rules corresponding to L2 and L3 lookup table updates
ofspec_filename = "/var/run/cloud/" + bridge + sequence_no + ".ofspec"
- ofspec = open(ofspec_filename, 'w')
+ ofspec = open(ofspec_filename, 'w+')
# get the list of VM's in all the tiers of VPC running in this host from the JSON config
this_host_vms = get_vpc_vms_on_host(vpconfig, this_host_id)
@@ -372,7 +374,7 @@ def configure_bridge_for_network_topology(bridge, this_host_id, json_config, seq
# Add OF rule in L2 look up table, if packet's destination mac matches MAC of the VM's nic
# then send packet on the found OFPORT
- ofspec.write(" table=%s" %L2_LOOKUP_TABLE + " priority=1100 dl_dst=%s " %mac_addr +
+ ofspec.write("table=%s" %L2_LOOKUP_TABLE + " priority=1100 dl_dst=%s " %mac_addr +
" actions=output:%s" %of_port + "\n")
# Add OF rule in L3 look up table: if packet's destination IP matches VM's IP then modify the packet
@@ -380,16 +382,16 @@ def configure_bridge_for_network_topology(bridge, this_host_id, json_config, seq
# emulates steps VPC virtual router would have done on the current host itself.
action_str = " mod_dl_src:%s"%network.gatewaymac + ",mod_dl_dst:%s" % mac_addr \
+ ",resubmit(,%s)"%INGRESS_ACL_TABLE
- action_str = " table=%s"%L3_LOOKUP_TABLE + " ip nw_dst=%s"%ip + " actions=%s" %action_str
+ action_str = "table=%s"%L3_LOOKUP_TABLE + " ip nw_dst=%s"%ip + " actions=%s" %action_str
ofspec.write(action_str + "\n")
# Add OF rule to send intra-tier traffic from this nic of the VM to L2 lookup path (L2 switching)
- action_str = " table=%s" %CLASSIFIER_TABLE + " priority=1200 in_port=%s " %of_port + \
+ action_str = "table=%s" %CLASSIFIER_TABLE + " priority=1200 in_port=%s " %of_port + \
" ip nw_dst=%s " %network.cidr + " actions=resubmit(,%s)" %L2_LOOKUP_TABLE
ofspec.write(action_str + "\n")
# Add OF rule to send inter-tier traffic from this nic of the VM to egress ACL table(L3 lookup path)
- action_str = " table=%s "%CLASSIFIER_TABLE + " priority=1100 in_port=%s " %of_port +\
+ action_str = "table=%s "%CLASSIFIER_TABLE + " priority=1100 in_port=%s " %of_port +\
" ip dl_dst=%s " %network.gatewaymac + " nw_dst=%s " %vpconfig.cidr + \
" actions=resubmit(,%s)" %EGRESS_ACL_TABLE
ofspec.write(action_str + "\n")
@@ -427,34 +429,40 @@ def configure_bridge_for_network_topology(bridge, this_host_id, json_config, seq
action_str = "table=%s"%L3_LOOKUP_TABLE + " ip nw_dst=%s"%ip + " actions=%s" %action_str
ofspec.write(action_str + "\n")
- action_str = "table=%s "%L2_LOOKUP_TABLE + " priority=0 " + " actions=resubmit(,%s)"%L2_FLOOD_TABLE
- ofspec.write(action_str + "\n")
- action_str = "table=%s "%L3_LOOKUP_TABLE + " priority=0 " + " actions=resubmit(,%s)"%L2_LOOKUP_TABLE
- ofspec.write(action_str + "\n")
+ # add a default rule in L2_LOOKUP_TABLE to send unknown mac address to L2 flooding table
+ ofspec.write("table=%s "%L2_LOOKUP_TABLE + " priority=0 " + " actions=resubmit(,%s)"%L2_FLOOD_TABLE + "\n")
+
+ # add a default rule in L3 lookup table to forward (unknown destination IP) packets to L2 lookup table. This
+ # is fallback option to send the packet to VPC VR, when routing can not be performed at the host
+ ofspec.write("table=%s "%L3_LOOKUP_TABLE + " priority=0 " + " actions=resubmit(,%s)"%L2_LOOKUP_TABLE + "\n")
+ # First flush current L2_LOOKUP_TABLE & L3_LOOKUP_TABLE before re-applying L2 & L3 lookup entries
del_flows(bridge, table=L2_LOOKUP_TABLE)
del_flows(bridge, table=L3_LOOKUP_TABLE)
- # update bridge with the flow-rules added in the file in one attempt
- do_cmd([OFCTL_PATH, 'add-flows', bridge, ofspec_filename])
+ ofspec.seek(0)
+ logging.debug("Adding below flows rules L2 & L3 lookup tables:\n" + ofspec.read())
+ # update bridge with the flow-rules for L2 lookup and L3 lookup in the file in one attempt
ofspec.close()
- return "SUCCESS: successfully configured bridge as per the VPC topology update with sequence no: %s"%sequence_no
+ do_cmd([OFCTL_PATH, 'add-flows', bridge, ofspec_filename])
- except:
- logging.debug("An unexpected error occurred while configuring bridge as per VPC topology "
- "update with sequence no: %s"%sequence_no)
- # now that we updated the bridge with flow rules delete the file.
+ # now that we updated the bridge with flow rules close and delete the file.
os.remove(ofspec_filename)
- raise
- else:
- # now that we updated the bridge with flow rules delete the file.
- os.remove(ofspec_filename)
+ return "SUCCESS: successfully configured bridge as per the VPC topology update with sequence no: %s"%sequence_no
+
+ except Exception,e:
+ error_message = "An unexpected error occurred while configuring bridge " + bridge + \
+ " as per latest VPC topology update with sequence no: %s" %sequence_no
+ logging.debug(error_message + " due to " + str(e))
+ if os.path.isfile(ofspec_filename):
+ os.remove(ofspec_filename)
+ raise error_message
# Configures the bridge created for a VPC enabled for distributed firewall. Management server sends VPC routing policies
# details. Based on the VPC routing policies ingress ACL table and egress ACL tables are updated by this function.
-def configure_ovs_bridge_for_routing_policies(bridge, json_config, sequence_no):
+def configure_vpc_bridge_for_routing_policies(bridge, json_config, sequence_no):
vpconfig = jsonLoader(json.loads(json_config)).vpc
if vpconfig is None:
@@ -468,10 +476,7 @@ def configure_ovs_bridge_for_routing_policies(bridge, json_config, sequence_no):
# create a temporary file to store OpenFlow rules corresponding to ingress and egress ACL table updates
ofspec_filename = "/var/run/cloud/" + bridge + sequence_no + ".ofspec"
- ofspec = open(ofspec_filename, 'w')
-
- egress_rules_added = False
- ingress_rules_added = False
+ ofspec = open(ofspec_filename, 'w+')
tiers = vpconfig.tiers
for tier in tiers:
@@ -486,6 +491,8 @@ def configure_ovs_bridge_for_routing_policies(bridge, json_config, sequence_no):
source_port_start = acl_item.sourceportstart
source_port_end = acl_item.sourceportend
protocol = acl_item.protocol
+ if protocol == "all":
+ protocol = "*"
source_cidrs = acl_item.sourcecidrs
acl_priority = 1000 + number
if direction == "ingress":
@@ -496,28 +503,27 @@ def configure_ovs_bridge_for_routing_policies(bridge, json_config, sequence_no):
resubmit_table = L3_LOOKUP_TABLE
for source_cidr in source_cidrs:
- ingress_rules_added = True
if source_port_start is None and source_port_end is None:
if source_cidr.startswith('0.0.0.0'):
if action == "deny":
- ofspec.write(" table=%s "%matching_table + " priority=%s " %acl_priority +
+ ofspec.write("table=%s "%matching_table + " priority=%s " %acl_priority + " ip " +
" nw_dst=%s " %tier_cidr + " nw_proto=%s " %protocol +
- " actions='drop'" + "\n")
+ " actions=drop" + "\n")
if action == "allow":
- ofspec.write(" table=%s "%matching_table + " priority=%s " %acl_priority +
+ ofspec.write("table=%s "%matching_table + " priority=%s " %acl_priority + " ip " +
" nw_dst=%s " %tier_cidr + " nw_proto=%s " %protocol +
- " actions='resubmit(,%s)'"%resubmit_table + "\n")
+ " actions=resubmit(,%s)"%resubmit_table + "\n")
else:
if action == "deny":
- ofspec.write(" table=%s "%matching_table + " priority=%s " %acl_priority +
+ ofspec.write("table=%s "%matching_table + " priority=%s " %acl_priority + " ip " +
" nw_src=%s " %source_cidr + " nw_dst=%s " %tier_cidr +
- " nw_proto=%s " %protocol + " actions='drop'" + "\n")
+ " nw_proto=%s " %protocol + " actions=drop" + "\n")
if action == "allow":
- ofspec.write(" table=%s "%matching_table + " priority=%s " %acl_priority +
+ ofspec.write("table=%s "%matching_table + " priority=%s " %acl_priority + " ip " +
" nw_src=%s "%source_cidr + " nw_dst=%s " %tier_cidr +
" nw_proto=%s " %protocol +
- " actions='resubmit(,%s)'"%resubmit_table + "\n")
+ " actions=resubmit(,%s)"%resubmit_table + "\n")
continue
# add flow rule to do action (allow/deny) for flows where source IP of the packet is in
@@ -526,128 +532,146 @@ def configure_ovs_bridge_for_routing_policies(bridge, json_config, sequence_no):
while (port < source_port_end):
if source_cidr.startswith('0.0.0.0'):
if action == "deny":
- ofspec.write(" table=%s " %matching_table + " priority=%s " %acl_priority +
+ ofspec.write("table=%s " %matching_table + " priority=%s " %acl_priority + " ip " +
" tp_dst=%s " %port + " nw_dst=%s " %tier_cidr +
- " nw_proto=%s " %protocol + " actions='drop'" + "\n")
+ " nw_proto=%s " %protocol + " actions=drop" + "\n")
if action == "allow":
- ofspec.write(" table=%s "%matching_table + " priority=%s " %acl_priority +
+ ofspec.write("table=%s "%matching_table + " priority=%s " %acl_priority + " ip " +
" tp_dst=%s " %port + " nw_dst=%s " %tier_cidr +
" nw_proto=%s " %protocol +
- " actions='resubmit(,%s)'"%resubmit_table + "\n")
+ " actions=resubmit(,%s)"%resubmit_table + "\n")
else:
if action == "deny":
- ofspec.write(" table=%s " %matching_table + " priority=%s " %acl_priority +
+ ofspec.write("table=%s " %matching_table + " priority=%s " %acl_priority + " ip " +
" tp_dst=%s " %port + " nw_src=%s "%source_cidr + " nw_dst=%s "%tier_cidr +
- " nw_proto=%s " %protocol + " actions='drop'" + "\n")
+ " nw_proto=%s " %protocol + " actions=drop" + "\n")
if action == "allow":
- ofspec.write(" table=%s "%matching_table + " priority=%s " %acl_priority +
+ ofspec.write("table=%s "%matching_table + " priority=%s " %acl_priority + " ip " +
" tp_dst=%s " %port + " nw_src=%s "%source_cidr + " nw_dst=%s "%tier_cidr +
" nw_proto=%s " %protocol +
- " actions='resubmit(,%s)'"%resubmit_table + "\n")
+ " actions=resubmit(,%s)"%resubmit_table + "\n")
port = port + 1
# add a default rule in egress table to allow packets (so forward packet to L3 lookup table)
- ofspec.write(" table=%s " %EGRESS_ACL_TABLE + " priority=0 actions='resubmit(,%s)')"%L3_LOOKUP_TABLE + "\n")
+ ofspec.write("table=%s " %EGRESS_ACL_TABLE + " priority=0 actions=resubmit(,%s)" %L3_LOOKUP_TABLE + "\n")
- # add a default rule in ingress table drop packets
- ofspec.write(" table=%s " %INGRESS_ACL_TABLE + " priority=0 actions='drop'" + "\n")
+ # add a default rule in ingress table to drop packets
+ ofspec.write("table=%s " %INGRESS_ACL_TABLE + " priority=0 actions=drop" + "\n")
# First flush current ingress and egress ACL's before re-applying the ACL's
del_flows(bridge, table=EGRESS_ACL_TABLE)
del_flows(bridge, table=INGRESS_ACL_TABLE)
- # update bridge with the flow-rules for ingress and egress ACL's added in the file in one attempt
- do_cmd([OFCTL_PATH, 'add-flows', bridge, ofspec_filename])
+ ofspec.seek(0)
+ logging.debug("Adding below flows rules Ingress & Egress ACL tables:\n" + ofspec.read())
+ # update bridge with the flow-rules for ingress and egress ACL's added in the file in one attempt
ofspec.close()
- return "SUCCESS: successfully configured bridge as per the latest routing policies of the VPC"
+ do_cmd([OFCTL_PATH, 'add-flows', bridge, ofspec_filename])
- except:
- logging.debug("An unexpected error occurred while configuring bridge as per VPC's routing policies.")
# now that we updated the bridge with flow rules delete the file.
- ofspec.close()
os.remove(ofspec_filename)
- raise
- else:
- # now that we updated the bridge with flow rules delete the file.
- ofspec.close()
- os.remove(ofspec_filename)
+ return "SUCCESS: successfully configured bridge as per the latest routing policies update with " \
+ "sequence no: %s"%sequence_no
+
+ except Exception,e:
+ error_message = "An unexpected error occurred while configuring bridge " + bridge + \
+ " as per latest VPC's routing policy update with sequence number %s." %sequence_no
+ logging.debug(error_message + " due to " + str(e))
+ if os.path.isfile(ofspec_filename):
+ os.remove(ofspec_filename)
+ raise error_message
+# configures bridge L2 flooding rules stored in table=2. Single bridge is used for all the tiers of VPC. So controlled
+# flooding is required to restrict the broadcast to only to the ports (vifs and tunnel interfaces) in the tier. Also
+# packets arrived from the tunnel ports should not be flooded on the other tunnel ports.
def update_flooding_rules_on_port_plug_unplug(bridge, interface, command, if_network_id):
- vnet_vif_ofports = []
- vnet_tunnelif_ofports = []
- vnet_all_ofports = []
+ class tier_ports:
+ tier_vif_ofports = []
+ tier_tunnelif_ofports = []
+ tier_all_ofports = []
- logging.debug("Updating the flooding rules as interface %s" %interface + " is %s"%command + " now.")
+ logging.debug("Updating the flooding rules on bridge " + bridge + " as interface %s" %interface +
+ " is %s"%command + " now.")
try:
+
+ if not os.path.exists('/var/run/cloud'):
+ os.makedirs('/var/run/cloud')
+
+ # create a temporary file to store OpenFlow rules corresponding L2 flooding table
+ ofspec_filename = "/var/run/cloud/" + bridge + "-" +interface + "-" + command + ".ofspec"
+ ofspec = open(ofspec_filename, 'w+')
+
+ all_tiers = dict()
+
vsctl_output = do_cmd([VSCTL_PATH, 'list-ports', bridge])
ports = vsctl_output.split('\n')
for port in ports:
+
if_ofport = do_cmd([VSCTL_PATH, 'get', 'Interface', port, 'ofport'])
+
if port.startswith('vif'):
- # check VIF is in same network as that of plugged vif
- if if_network_id != get_network_id_for_vif(port):
- continue
- vnet_vif_ofports.append(if_ofport)
- vnet_all_ofports.append(if_ofport)
+ network_id = get_network_id_for_vif(port)
+ if network_id not in all_tiers.keys():
+ all_tiers[network_id] = tier_ports()
+ tier_ports_info = all_tiers[network_id]
+ tier_ports_info.tier_vif_ofports.append(if_ofport)
+ tier_ports_info.tier_all_ofports.append(if_ofport)
+ all_tiers[network_id] = tier_ports_info
if port.startswith('t'):
- # check tunnel port is in same network as that of plugged vif
- if if_network_id != get_network_id_for_tunnel_port(port)[1:-1]:
- continue
- vnet_tunnelif_ofports.append(if_ofport)
- vnet_all_ofports.append(if_ofport)
-
- if command == 'online':
- if len(vnet_all_ofports) == 1 :
- return
-
- for port in vnet_all_ofports:
- clear_flooding_rules_for_port(bridge, port)
-
- # for a packet arrived from tunnel port, flood only on VIF ports
- for port in vnet_tunnelif_ofports:
- add_flooding_rules_for_port(bridge, port, vnet_vif_ofports)
-
- # for a packet arrived from VIF port send on all VIF and tunnel port excluding the port
- # on which packet arrived
- for port in vnet_vif_ofports:
- vnet_all_ofports_copy = copy.copy(vnet_all_ofports)
- vnet_all_ofports_copy.remove(port)
- add_flooding_rules_for_port(bridge, port, vnet_all_ofports_copy)
-
- this_if_ofport = do_cmd([VSCTL_PATH, 'get', 'Interface', interface, 'ofport'])
-
- #learn that MAC is reachable through the VIF port
- if interface.startswith('vif'):
- mac = get_macaddress_of_vif(interface)
- add_mac_lookup_table_entry(bridge, mac, this_if_ofport)
-
- if command == 'offline':
- for port in vnet_all_ofports:
- clear_flooding_rules_for_port(bridge, port)
-
- vnet_all_ofports.remove(this_if_ofport)
- vnet_vif_ofports.remove(this_if_ofport)
-
- # for a packet arrived from tunnel port, flood only on VIF ports
- for port in vnet_tunnelif_ofports:
- add_flooding_rules_for_port(bridge, port, vnet_vif_ofports)
-
- # for a packet from VIF port send on all VIF's and tunnel ports excluding the port on which packet arrived
- for port in vnet_vif_ofports:
- vnet_all_ofports_copy = copy.copy(vnet_all_ofports)
- vnet_all_ofports_copy.remove(port)
- add_flooding_rules_for_port(bridge, port, vnet_all_ofports_copy)
-
- # un-learn that MAC is reachable through the VIF port
- if interface.startswith('vif'):
- mac = get_macaddress_of_vif(interface)
- delete_mac_lookup_table_entry(bridge, mac)
- except:
- logging.debug("An unexpected error occurred while updating the flooding rules when interface "
- + " %s" %interface + " is %s"%command)
- raise
\ No newline at end of file
+ network_id = get_network_id_for_tunnel_port(port)[1:-1]
+ if network_id not in all_tiers.keys():
+ all_tiers[network_id] = tier_ports()
+ tier_ports_info = all_tiers[network_id]
+ tier_ports_info.tier_tunnelif_ofports.append(if_ofport)
+ tier_ports_info.tier_all_ofports.append(if_ofport)
+ all_tiers[network_id] = tier_ports_info
+
+ for network_id, tier_ports_info in all_tiers.items():
+ if len(tier_ports_info.tier_all_ofports) == 1 :
+ continue
+
+ # for a packet arrived from tunnel port, flood only on to VIF ports connected to bridge for this tier
+ for port in tier_ports_info.tier_tunnelif_ofports:
+ action = "".join("output:%s," %ofport for ofport in tier_ports_info.tier_vif_ofports)[:-1]
+ ofspec.write("table=%s " %L2_FLOOD_TABLE + " priority=1100 in_port=%s " %port +
+ "actions=%s " %action + "\n")
+
+ # for a packet arrived from VIF port send on all VIF and tunnel ports corresponding to the tier excluding
+ # the port on which packet arrived
+ for port in tier_ports_info.tier_vif_ofports:
+ tier_all_ofports_copy = copy.copy(tier_ports_info.tier_all_ofports)
+ tier_all_ofports_copy.remove(port)
+ action = "".join("output:%s," %ofport for ofport in tier_all_ofports_copy)[:-1]
+ ofspec.write("table=%s " %L2_FLOOD_TABLE + " priority=1100 in_port=%s " %port +
+ "actions=%s " %action + "\n")
+
+ # add a default rule in L2 flood table to drop packet
+ ofspec.write("table=%s " %L2_FLOOD_TABLE + " priority=0 actions=drop")
+
+ # First flush current L2 flooding table before re-populating the tables
+ del_flows(bridge, table=L2_FLOOD_TABLE)
+
+ ofspec.seek(0)
+ logging.debug("Adding below flows rules L2 flooding table: \n" + ofspec.read())
+
+ # update bridge with the flow-rules for broadcast rules added in the file in one attempt
+ ofspec.close()
+ do_cmd([OFCTL_PATH, 'add-flows', bridge, ofspec_filename])
+
+ # now that we updated the bridge with flow rules delete the file.
+ os.remove(ofspec_filename)
+
+ logging.debug("successfully configured bridge %s as per the latest flooding rules " %bridge)
+
+ except Exception,e:
+ if os.path.isfile(ofspec_filename):
+ os.remove(ofspec_filename)
+ error_message = "An unexpected error occurred while updating the flooding rules for the bridge " + \
+ bridge + " when interface " + " %s" %interface + " is %s" %command
+ logging.debug(error_message + " due to " + str(e))
+ raise error_message
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/0adf8924/scripts/vm/hypervisor/xenserver/ovstunnel
----------------------------------------------------------------------
diff --git a/scripts/vm/hypervisor/xenserver/ovstunnel b/scripts/vm/hypervisor/xenserver/ovstunnel
index 2d6105e..358cd54 100755
--- a/scripts/vm/hypervisor/xenserver/ovstunnel
+++ b/scripts/vm/hypervisor/xenserver/ovstunnel
@@ -418,23 +418,23 @@ def configure_ovs_bridge_for_network_topology(session, args):
last_seq_no = last_seq_no[1:-1]
if long(sequence_no) > long(last_seq_no):
lib.do_cmd([lib.VSCTL_PATH, "set", "bridge", bridge, "other-config:sequence-number=%s"%sequence_no])
- return lib.configure_bridge_for_network_topology(bridge, this_host_id, json_config, sequence_no)
+ return lib.configure_vpc_bridge_for_network_topology(bridge, this_host_id, json_config, sequence_no)
else:
return "SUCCESS: Ignoring the update with the sequence number %s" %sequence_no + " as there is already recent" \
" update received and applied with sequence number %s" %last_seq_no
-
@echo
def configure_ovs_bridge_for_routing_policies(session, args):
bridge = args.pop("bridge")
json_config = args.pop("config")
sequence_no = args.pop("seq-no")
+
# get the last update sequence number
last_seq_no = lib.do_cmd([lib.VSCTL_PATH, "get", "bridge", bridge, "other-config:sequence-number"])
last_seq_no = last_seq_no[1:-1]
if long(sequence_no) > long(last_seq_no):
lib.do_cmd([lib.VSCTL_PATH, "set", "bridge", bridge, "other-config:sequence-number=%s"%sequence_no])
- return lib.configure_ovs_bridge_for_routing_policies(bridge, json_config, sequence_no)
+ return lib.configure_vpc_bridge_for_routing_policies(bridge, json_config, sequence_no)
else:
return "SUCCESS: Ignoring the update with the sequence number %s" %sequence_no + " as there is already recent" \
" update received and applied with sequence number %s" %last_seq_no