Add limit to the CT zone DB table with ovs-vsctl
helper methods. The limit has two special values
besides any number, 0 is unlimited and empty limit
is to leave the value untouched in the datapath.
This is preparation step and the value is not yet
propagated to the datapath.
Signed-off-by: Ales Musil <amu...@redhat.com>
---
v4: Rebase on top of current master.
Address comments from Ilya:
- Make sure that the NEWS is clear on what has been added.
- Make the usage of --may-exist and --if-exists more intuitive for the new
commands.
- Some cosmetics.
Add command and column for default limit.
---
NEWS | 8 ++
tests/ovs-vsctl.at | 92 ++++++++++++++++++++
utilities/ovs-vsctl.8.in | 45 ++++++++--
utilities/ovs-vsctl.c | 171 ++++++++++++++++++++++++++++++++++++-
vswitchd/vswitch.ovsschema | 14 ++-
vswitchd/vswitch.xml | 11 +++
6 files changed, 331 insertions(+), 10 deletions(-)
diff --git a/NEWS b/NEWS
index df98e75a0..c0d96b894 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,14 @@ Post-v3.2.0
- ovs-dpctl:
* Support removal of default CT zone limit via ovs-dpctl, e.g.
"ovs-appctl dpctl/ct-del-limits default"
+ - ovs-vsctl:
+ * New commands 'add-zone-limit', 'del-zone-limit' and 'list-zone-limit'
+ to manage the maximum number of connections in conntrack zones via
+ a new 'limit' column in the 'CT_Zone' database table.
+ * New command 'set-zone-default-limit' and 'del-zone-default-limit' to
+ manage the maximum number of connections in conntrack zones that are
+ not explicitly defined otherwise via new 'ct_zone_default_limit' column
+ in the 'Datapath' table.
v3.2.0 - 17 Aug 2023
diff --git a/tests/ovs-vsctl.at b/tests/ovs-vsctl.at
index a368bff6e..0d2fa68fb 100644
--- a/tests/ovs-vsctl.at
+++ b/tests/ovs-vsctl.at
@@ -975,6 +975,67 @@ AT_CHECK(
[0], [stdout])
AT_CHECK([RUN_OVS_VSCTL([list-zone-tp netdev])], [0], [Zone:10, Timeout
Policies: system default
])
+AT_CHECK([RUN_OVS_VSCTL([--if-exists del-zone-tp netdev zone=10])])
+
+AT_CHECK([RUN_OVS_VSCTL([list-zone-limit netdev])])
+
+AT_CHECK([RUN_OVS_VSCTL([add-zone-limit netdev zone=1 limit=1])])
+AT_CHECK([RUN_OVS_VSCTL([list-zone-limit netdev])], [0], [dnl
+Zone: 1, Limit: 1
+])
+
+AT_CHECK([RUN_OVS_VSCTL([--may-exist add-zone-limit netdev zone=1 limit=5])])
+AT_CHECK([RUN_OVS_VSCTL([list-zone-limit netdev])], [0], [dnl
+Zone: 1, Limit: 5
+])
+
+AT_CHECK([RUN_OVS_VSCTL([del-zone-limit netdev zone=1])])
+AT_CHECK([RUN_OVS_VSCTL([list-zone-limit netdev])])
+
+AT_CHECK([RUN_OVS_VSCTL([add-zone-limit netdev zone=10 limit=5])])
+AT_CHECK([RUN_OVS_VSCTL([list-zone-limit netdev])], [0], [dnl
+Zone: 10, Limit: 5
+])
+
+AT_CHECK([RUN_OVS_VSCTL([add-zone-tp netdev zone=10 icmp_first=1
icmp_reply=2])])
+AT_CHECK([RUN_OVS_VSCTL([list-zone-tp netdev])], [0], [dnl
+Zone:10, Timeout Policies: icmp_first=1 icmp_reply=2
+])
+
+AT_CHECK([RUN_OVS_VSCTL([del-zone-limit netdev zone=10])])
+AT_CHECK([RUN_OVS_VSCTL([list-zone-limit netdev])])
+AT_CHECK([RUN_OVS_VSCTL([list-zone-tp netdev])], [0], [dnl
+Zone:10, Timeout Policies: icmp_first=1 icmp_reply=2
+])
+
+AT_CHECK([RUN_OVS_VSCTL([add-zone-limit netdev zone=10 limit=5])])
+AT_CHECK([RUN_OVS_VSCTL([del-zone-tp netdev zone=10])])
+AT_CHECK([RUN_OVS_VSCTL([list-zone-limit netdev])], [0], [dnl
+Zone: 10, Limit: 5
+])
+AT_CHECK([RUN_OVS_VSCTL([list-zone-tp netdev])], [0], [dnl
+Zone:10, Timeout Policies: system default
+])
+
+AT_CHECK([RUN_OVS_VSCTL([set-zone-default-limit netdev limit=5])])
+AT_CHECK([RUN_OVS_VSCTL([list-zone-limit netdev])], [0], [dnl
+Default limit: 5
+Zone: 10, Limit: 5
+])
+
+AT_CHECK([RUN_OVS_VSCTL([--may-exist set-zone-default-limit netdev limit=10])])
+AT_CHECK([RUN_OVS_VSCTL([list-zone-limit netdev])], [0], [dnl
+Default limit: 10
+Zone: 10, Limit: 5
+])
+
+AT_CHECK([RUN_OVS_VSCTL([del-zone-default-limit netdev])])
+AT_CHECK([RUN_OVS_VSCTL([list-zone-limit netdev])], [0], [dnl
+Zone: 10, Limit: 5
+])
+
+AT_CHECK([RUN_OVS_VSCTL([--if-exists del-zone-default-limit netdev])])
+
AT_CHECK([RUN_OVS_VSCTL([-- --id=@m create Datapath datapath_version=0
'capabilities={recirc=true}' -- set Open_vSwitch . datapaths:"system"=@m])],
[0], [stdout])
AT_CHECK([RUN_OVS_VSCTL([list-dp-cap system])], [0], [recirc=true
@@ -1123,6 +1184,37 @@ AT_CHECK([RUN_OVS_VSCTL([del-zone-tp netdev zone=11])],
AT_CHECK([RUN_OVS_VSCTL([list-zone-tp netdev])], [0], [Zone:2, Timeout
Policies: icmp_first=2 icmp_reply=3
])
+AT_CHECK([RUN_OVS_VSCTL([add-zone-limit netdevxx zone=5 limit=1])],
+ [1], [], [ovs-vsctl: datapath netdevxx does not exist
+])
+AT_CHECK([RUN_OVS_VSCTL([add-zone-limit netdev zone=88888 limit=1])],
+ [1], [], [ovs-vsctl: zone_id (88888) out of range
+])
+AT_CHECK([RUN_OVS_VSCTL([add-zone-limit netdev zone=5 limit=-1])],
+ [1], [], [ovs-vsctl: limit (-1) out of range
+])
+AT_CHECK([RUN_OVS_VSCTL([del-zone-limit netdev zone=10])],
+ [1], [], [ovs-vsctl: zone_id 10 does not have limit
+])
+AT_CHECK([RUN_OVS_VSCTL([add-zone-limit netdev zone=5 limit=1])])
+AT_CHECK([RUN_OVS_VSCTL([add-zone-limit netdev zone=5 limit=2])],
+ [1], [], [ovs-vsctl: zone_id 5 already has limit
+])
+
+AT_CHECK([RUN_OVS_VSCTL([set-zone-default-limit netdevxx limit=1])],
+ [1], [], [ovs-vsctl: datapath netdevxx does not exist
+])
+AT_CHECK([RUN_OVS_VSCTL([set-zone-default-limit netdev limit=-1])],
+ [1], [], [ovs-vsctl: limit (-1) out of range
+])
+AT_CHECK([RUN_OVS_VSCTL([del-zone-default-limit netdev])],
+ [1], [], [ovs-vsctl: datapath netdev does not have limit
+])
+AT_CHECK([RUN_OVS_VSCTL([set-zone-default-limit netdev limit=1])])
+AT_CHECK([RUN_OVS_VSCTL([set-zone-default-limit netdev limit=2])],
+ [1], [], [ovs-vsctl: datapath netdev already has limit
+])
+
AT_CHECK([RUN_OVS_VSCTL([-- --id=@m create Datapath datapath_version=0
'capabilities={recirc=true}' -- set Open_vSwitch . datapaths:"system"=@m])],
[0], [stdout])
AT_CHECK([RUN_OVS_VSCTL([list-dp-cap nosystem])],
[1], [], [ovs-vsctl: datapath "nosystem" record not found
diff --git a/utilities/ovs-vsctl.8.in b/utilities/ovs-vsctl.8.in
index 9e319aa1c..f8a04d707 100644
--- a/utilities/ovs-vsctl.8.in
+++ b/utilities/ovs-vsctl.8.in
@@ -354,7 +354,7 @@ Prints the name of the bridge that contains \fIiface\fR on
standard
output.
.
.SS "Conntrack Zone Commands"
-These commands query and modify datapath CT zones and Timeout Policies.
+These commands query and modify datapath CT zones, Timeout Policies and Limits.
.
.IP "[\fB\-\-may\-exist\fR] \fBadd\-zone\-tp \fIdatapath \fBzone=\fIzone_id
\fIpolicies\fR"
Creates a conntrack zone timeout policy with \fIzone_id\fR in
@@ -365,20 +365,55 @@ packet and a 60-second policy for ICMP reply packets.
See the
\fBCT_Timeout_Policy\fR table in \fBovs-vswitchd.conf.db\fR(5) for the
supported keys.
.IP
-Without \fB\-\-may\-exist\fR, attempting to add a \fIzone_id\fR that
-already exists is an error. With \fB\-\-may\-exist\fR,
-this command does nothing if \fIzone_id\fR already exists.
+Without \fB\-\-may\-exist\fR, attempting to add a \fIpolicies\fR for
+\fIzone_id\fR that already exists is an error. With \fB\-\-may\-exist\fR,
+this command updates the \fIpolicies\fR if \fIzone_id\fR already exists.
.
.IP "[\fB\-\-if\-exists\fR] \fBdel\-zone\-tp \fIdatapath \fBzone=\fIzone_id\fR"
Delete the timeout policy associated with \fIzone_id\fR from \fIdatapath\fR.
.IP
-Without \fB\-\-if\-exists\fR, attempting to delete a zone that
+Without \fB\-\-if\-exists\fR, attempting to delete a policies for zone that
does not exist is an error. With \fB\-\-if\-exists\fR, attempting to
delete a zone that does not exist has no effect.
.
.IP "\fBlist\-zone\-tp \fIdatapath\fR"
Prints the timeout policies of all zones in \fIdatapath\fR.
.
+.IP "[\fB\-\-may\-exist\fR] \fBadd\-zone\-limit \fIdatapath \fBzone=\fIzone_id
\fBlimit=\fIzone_limit"
+Sets a conntrack zone limit with \fIzone_id\fR in
+\fIdatapath\fR. The \fIlimit\fR with value \fB0\fR means unlimited.
+.IP
+Without \fB\-\-may\-exist\fR, attempting to add a \fIlimit\fR for
+\fIzone_id\fR that already exists is an error. With \fB\-\-may\-exist\fR,
+this command updates the \fIlimit\fR if \fIzone_id\fR already exists.
+.
+.IP "[\fB\-\-if\-exists\fR] \fBdel\-zone\-limit \fIdatapath
\fBzone=\fIzone_id\fR"
+Delete the limit associated with \fIzone_id\fR from \fIdatapath\fR.
+.IP
+Without \fB\-\-if\-exists\fR, attempting to delete a limit for zone that
+does not exist is an error. With \fB\-\-if\-exists\fR, attempting to
+delete a zone that does not exist has no effect.
+.
+.IP "\fBlist\-zone\-limit \fIdatapath\fR"
+Prints the limits of all zones in \fIdatapath\fR.
+.
+.IP "[\fB\-\-may\-exist\fR] \fBset\-zone\-default\-limit \fIdatapath
\fBlimit=\fIdefault_limit"
+Sets a conntrack default zone limit in \fIdatapath\fR.
+The \fIlimit\fR with value \fB0\fR means unlimited.
+.IP
+Without \fB\-\-may\-exist\fR, attempting to add a default limit for
+datapath that already has default limit is an error.
+With \fB\-\-may\-exist\fR, this command updates the default limit if
+it is already set for specified datapath.
+.
+.IP "[\fB\-\-if\-exists\fR] \fBdel\-zone\-default\-limit \fIdatapath"
+Delete the default limit associated with \fIdatapath\fR.
+.IP
+Without \fB\-\-if\-exists\fR, attempting to delete a default limit for
+datapath that does not have default limit is an error.
+With \fB\-\-if\-exists\fR, attempting to delete a default limit that is not
+set has no effect.
+.
.SS "Datapath Capabilities Command"
The command query datapath capabilities.
.
diff --git a/utilities/ovs-vsctl.c b/utilities/ovs-vsctl.c
index 5e549df00..7e01deaec 100644
--- a/utilities/ovs-vsctl.c
+++ b/utilities/ovs-vsctl.c
@@ -1302,7 +1302,7 @@ cmd_add_zone_tp(struct ctl_context *ctx)
ctl_fatal("No timeout policy");
}
- if (zone && !may_exist) {
+ if (zone && zone->timeout_policy && !may_exist) {
ctl_fatal("zone id %"PRIu64" already exists", zone_id);
}
@@ -1332,11 +1332,20 @@ cmd_del_zone_tp(struct ctl_context *ctx)
}
struct ovsrec_ct_zone *zone = find_ct_zone(dp, zone_id);
- if (must_exist && !zone) {
+ if (must_exist && !(zone && zone->timeout_policy)) {
ctl_fatal("zone id %"PRIu64" does not exist", zone_id);
}
- if (zone) {
+ if (!zone) {
+ return;
+ }
+
+ if (zone->limit) {
+ if (zone->timeout_policy) {
+ ovsrec_ct_timeout_policy_delete(zone->timeout_policy);
+ }
+ ovsrec_ct_zone_set_timeout_policy(zone, NULL);
+ } else {
ovsrec_datapath_update_ct_zones_delkey(dp, zone_id);
}
}
@@ -1371,12 +1380,156 @@ cmd_list_zone_tp(struct ctl_context *ctx)
}
}
+static void
+cmd_add_zone_limit(struct ctl_context *ctx)
+{
+ struct vsctl_context *vsctl_ctx = vsctl_context_cast(ctx);
+ int64_t zone_id = -1;
+ int64_t limit = -1;
+
+ bool may_exist = shash_find(&ctx->options, "--may-exist") != NULL;
+ const char *dp_name = ctx->argv[1];
+
+ ovs_scan(ctx->argv[2], "zone=%"SCNi64, &zone_id);
+ ovs_scan(ctx->argv[3], "limit=%"SCNi64, &limit);
+
+ if (zone_id < 0 || zone_id > UINT16_MAX) {
+ ctl_fatal("zone_id (%"PRIi64") out of range", zone_id);
+ }
+
+ if (limit < 0 || limit > UINT32_MAX) {
+ ctl_fatal("limit (%"PRIi64") out of range", limit);
+ }
+
+ struct ovsrec_datapath *dp = find_datapath(vsctl_ctx, dp_name);
+ if (!dp) {
+ ctl_fatal("datapath %s does not exist", dp_name);
+ }
+
+ struct ovsrec_ct_zone *zone = find_ct_zone(dp, zone_id);
+ if (zone && zone->limit && !may_exist) {
+ ctl_fatal("zone_id %"PRIi64" already has limit", zone_id);
+ }
+
+ if (!zone) {
+ zone = ovsrec_ct_zone_insert(ctx->txn);
+ ovsrec_datapath_update_ct_zones_setkey(dp, zone_id, zone);
+ }
+
+ ovsrec_ct_zone_set_limit(zone, &limit, 1);
+}
+
+static void
+cmd_del_zone_limit(struct ctl_context *ctx)
+{
+ struct vsctl_context *vsctl_ctx = vsctl_context_cast(ctx);
+ int64_t zone_id;
+
+ bool must_exist = !shash_find(&ctx->options, "--if-exists");
+ const char *dp_name = ctx->argv[1];
+
+ ovs_scan(ctx->argv[2], "zone=%"SCNi64, &zone_id);
+
+ struct ovsrec_datapath *dp = find_datapath(vsctl_ctx, dp_name);
+ if (!dp) {
+ ctl_fatal("datapath %s does not exist", dp_name);
+ }
+
+ struct ovsrec_ct_zone *zone = find_ct_zone(dp, zone_id);
+ if (must_exist && !(zone && zone->limit)) {
+ ctl_fatal("zone_id %"PRIi64" does not have limit", zone_id);
+ }
+
+ if (!zone) {
+ return;
+ }
+
+ if (zone->timeout_policy) {
+ ovsrec_ct_zone_set_limit(zone, NULL, 0);
+ } else {
+ ovsrec_datapath_update_ct_zones_delkey(dp, zone_id);
+ }
+}
+
+static void
+cmd_list_zone_limit(struct ctl_context *ctx)
+{
+ struct vsctl_context *vsctl_ctx = vsctl_context_cast(ctx);
+
+ struct ovsrec_datapath *dp = find_datapath(vsctl_ctx, ctx->argv[1]);
+ if (!dp) {
+ ctl_fatal("datapath: %s record not found", ctx->argv[1]);
+ }
+
+ if (dp->ct_zone_default_limit) {
+ ds_put_format(&ctx->output, "Default limit: %"PRIu64"\n",
+ *dp->ct_zone_default_limit);
+ }
+
+ for (int i = 0; i < dp->n_ct_zones; i++) {
+ struct ovsrec_ct_zone *zone = dp->value_ct_zones[i];
+ if (zone->limit) {
+ ds_put_format(&ctx->output, "Zone: %"PRIu64", Limit: %"PRIu64"\n",
+ dp->key_ct_zones[i], *zone->limit);
+ }
+ }
+}
+
+static void
+cmd_set_zone_default_limit(struct ctl_context *ctx)
+{
+ struct vsctl_context *vsctl_ctx = vsctl_context_cast(ctx);
+ int64_t limit = -1;
+
+ bool may_exist = shash_find(&ctx->options, "--may-exist") != NULL;
+ const char *dp_name = ctx->argv[1];
+
+ ovs_scan(ctx->argv[2], "limit=%"SCNi64, &limit);
+
+ if (limit < 0 || limit > UINT32_MAX) {
+ ctl_fatal("limit (%"PRIi64") out of range", limit);
+ }
+
+ struct ovsrec_datapath *dp = find_datapath(vsctl_ctx, dp_name);
+ if (!dp) {
+ ctl_fatal("datapath %s does not exist", dp_name);
+ }
+
+ if (dp->ct_zone_default_limit && !may_exist) {
+ ctl_fatal("datapath %s already has limit", dp_name);
+ }
+
+ ovsrec_datapath_set_ct_zone_default_limit(dp, &limit, 1);
+}
+
+static void
+cmd_del_zone_default_limit(struct ctl_context *ctx)
+{
+ struct vsctl_context *vsctl_ctx = vsctl_context_cast(ctx);
+
+ bool must_exist = !shash_find(&ctx->options, "--if-exists");
+ const char *dp_name = ctx->argv[1];
+
+ struct ovsrec_datapath *dp = find_datapath(vsctl_ctx, dp_name);
+ if (!dp) {
+ ctl_fatal("datapath %s does not exist", dp_name);
+ }
+
+ if (must_exist && !dp->ct_zone_default_limit) {
+ ctl_fatal("datapath %s does not have limit", dp_name);
+ }
+
+ ovsrec_datapath_set_ct_zone_default_limit(dp, NULL, 0);
+}
+
static void
pre_get_zone(struct ctl_context *ctx)
{
ovsdb_idl_add_column(ctx->idl, &ovsrec_open_vswitch_col_datapaths);
ovsdb_idl_add_column(ctx->idl, &ovsrec_datapath_col_ct_zones);
+ ovsdb_idl_add_column(ctx->idl, &ovsrec_datapath_col_ct_zone_default_limit);
ovsdb_idl_add_column(ctx->idl, &ovsrec_ct_zone_col_timeout_policy);
+ ovsdb_idl_add_column(ctx->idl, &ovsrec_ct_zone_col_limit);
ovsdb_idl_add_column(ctx->idl, &ovsrec_ct_timeout_policy_col_timeouts);
}
@@ -3159,6 +3312,18 @@ static const struct ctl_command_syntax vsctl_commands[]
= {
/* Datapath capabilities. */
{"list-dp-cap", 1, 1, "", pre_get_dp_cap, cmd_list_dp_cap, NULL, "", RO},
+ /* CT zone limit. */
+ {"add-zone-limit", 3, 3, "", pre_get_zone, cmd_add_zone_limit, NULL,
+ "--may-exist", RW},
+ {"del-zone-limit", 2, 2, "", pre_get_zone, cmd_del_zone_limit, NULL,
+ "--if-exists", RW},
+ {"list-zone-limit", 1, 1, "", pre_get_zone, cmd_list_zone_limit, NULL,
+ "", RO},
+ {"set-zone-default-limit", 2, 2, "", pre_get_zone,
+ cmd_set_zone_default_limit, NULL, "--may-exist", RW},
+ {"del-zone-default-limit", 1, 1, "", pre_get_zone,
+ cmd_del_zone_default_limit, NULL, "--if-exists", RW},
+
{NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, RO},
};
diff --git a/vswitchd/vswitch.ovsschema b/vswitchd/vswitch.ovsschema
index 2d395ff95..e2d5e2e85 100644
--- a/vswitchd/vswitch.ovsschema
+++ b/vswitchd/vswitch.ovsschema
@@ -1,6 +1,6 @@
{"name": "Open_vSwitch",
- "version": "8.4.0",
- "cksum": "2738838700 27127",
+ "version": "8.5.0",
+ "cksum": "4040946650 27557",
"tables": {
"Open_vSwitch": {
"columns": {
@@ -670,6 +670,11 @@
"capabilities": {
"type": {"key": "string", "value": "string",
"min": 0, "max": "unlimited"}},
+ "ct_zone_default_limit": {
+ "type": { "key": {"type": "integer",
+ "minInteger": 0,
+ "maxInteger": 4294967295},
+ "min": 0, "max": 1}},
"external_ids": {
"type": {"key": "string", "value": "string",
"min": 0, "max": "unlimited"}}}},
@@ -679,6 +684,11 @@
"type": {"key": {"type": "uuid",
"refTable": "CT_Timeout_Policy"},
"min": 0, "max": 1}},
+ "limit": {
+ "type": { "key": {"type": "integer",
+ "minInteger": 0,
+ "maxInteger": 4294967295},
+ "min": 0, "max": 1}},
"external_ids": {
"type": {"key": "string", "value": "string",
"min": 0, "max": "unlimited"}}}},
diff --git a/vswitchd/vswitch.xml b/vswitchd/vswitch.xml
index cfcde34ff..84b514e01 100644
--- a/vswitchd/vswitch.xml
+++ b/vswitchd/vswitch.xml
@@ -6417,6 +6417,12 @@ ovs-vsctl add-port br0 p0 -- set Interface p0 type=patch
options:peer=p1 \
</column>
</group>
+ <column name="ct_zone_default_limit">
+ Default connection tracking zone limit that is applied to all zones
+ that didn't specify the limit explicitly. If the limit is unspecified
+ the datapath configuration is left intact. The value 0 means unlimited.
+ </column>
+
<group title="Common Columns">
The overall purpose of these columns is described under <code>Common
Columns</code> at the beginning of this document.
@@ -6433,6 +6439,11 @@ ovs-vsctl add-port br0 p0 -- set Interface p0 type=patch
options:peer=p1 \
is not specified, it defaults to the timeout policy in the system.
</column>
+ <column name="limit">
+ Connection tracking limit for this zone. If the limit is unspecified
+ the datapath configuration is left intact. The value 0 means unlimited.
+ </column>
+
<group title="Common Columns">
The overall purpose of these columns is described under <code>Common
Columns</code> at the beginning of this document.
--
2.41.0
_______________________________________________
dev mailing list
d...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
