many arch.

Add source package

See merge request openstack-team/third-party/openvswitch!8

    arch, and then the package FTBFS.

    - CVE-2020-27827
    - CVE-2020-35498

Open vSwitch version 2.15.0.

Acked-by: Ian Stokes <ian.stokes@intel.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

At present the log displays the auto load balance state
everytime it is changed.

There are some cases where the user will try to enable
auto load balance, but it cannot be enabled because not
enough PMDs or RxQs. As the state does not change, there
is no new log of the state.

While the the last log report of state is still correct,
it is better to log the state again at this point so the
user can explicitly confirm the outcome of their request.

Signed-off-by: Kevin Traynor <ktraynor@redhat.com>
Signed-off-by: Ian Stokes <ian.stokes@intel.com>

Signed-off-by: Ian Stokes <ian.stokes@intel.com>

Indicate that OVS 2.15 uses DPDK 20.11.

Signed-off-by: Hariprasad Govindharajan <hariprasad.govindharajan@intel.com>
Acked-by: Kevin Traynor <ktraynor@redhat.com>
Signed-off-by: Ian Stokes <ian.stokes@intel.com>

Update the docs to remove the previously hardcoded values
and mention the load and improvement thresholds when
describing the operation of auto load balance.

Fixes: 62ab5594

 ("dpif-netdev: Add parameters to configure PMD auto load balance.")
Signed-off-by: Kevin Traynor <ktraynor@redhat.com>
Acked-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: Ian Stokes <ian.stokes@intel.com>

    flow: Support extra padding length.patch (Closes: #982493).

FreeBSD 12.1 reached EOL and our builds are failing on Cirrus CI.
Updating to 12.2 - current production release.

Acked-by: Flavio Leitner <fbl@sysclose.org>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

Although not required, padding can be optionally added until
the packet length is MTU bytes. A packet with extra padding
currently fails sanity checks.

Vulnerability: CVE-2020-35498
Fixes: fa8d9001

 ("miniflow_extract: Properly handle small IP packets.")
Reported-by: Joakim Hindersson <joakim.hindersson@elastx.se>
Acked-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: Flavio Leitner <fbl@sysclose.org>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

Now OvS supports building with dpdk 20.11, and uses
the '--with-dpdk=shared' option in fedora.spec. Then
change version of dpdk 17.05.1 to 20.11.

Note that dpdk-devel-20.11.x is not released in fedora
distro, but use '20.11' is fine.

Fixes: 252e1e57

 ("dpdk: Update to use DPDK v20.11.")
Signed-off-by: Tonghao Zhang <xiangxia.m.yue@gmail.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

TC flower doesn't support some ct state flags such as
INVALID/SNAT/DNAT/REPLY. So it is better to reject this rule.

Fixes: 576126a9

 ("netdev-offload-tc: Add conntrack support")
Signed-off-by: wenxu <wenxu@ucloud.cn>
Reviewed-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

Some manpages are generated from rST, but these are not included
in 'dist-docs' make target.

Fixes: fd0837a7

 ("doc: Convert ovs-vlan-test to rST")
Acked-by: Ben Pfaff <blp@ovn.org>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

Fix the reported back value of the bos mask used by the revalidator
threads.

Fixes: 34b16955

 ("lib/tc: add single mpls match offload support")
Reported-by: Marcelo Leitner <mleitner@redhat.com>
Signed-off-by: Eelco Chaudron <echaudro@redhat.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

With DPDK 20.11, meson and pkgconfig are used instead of the old
Makefile-based system and so --with-dpdk option is changed to only
accept shared or static instead of the directory.

This commit uses --with-dpdk=shared since Fedora and RHEL ship shared
libraries of DPDK.

Fixes: 252e1e57

 ("dpdk: Update to use DPDK v20.11.")
Signed-off-by: Timothy Redaelli <tredaelli@redhat.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

The stop_daemon no longer takes second argument after
commit f3e24610 ("Remove OVN.").

Fixes: f3e24610

 ("Remove OVN.")
Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

shinfo is used to store reference counter and free callback
of an external buffer, but it is stored in mbuf if the mbuf
has tailroom for it.

This is wrong because the mbuf (and its data) can be freed
before the external buffer, for example:

  pkt2 = rte_pktmbuf_alloc(mp);
  rte_pktmbuf_attach(pkt2, pkt);
  rte_pktmbuf_free(pkt);

After this, pkt is freed, but it still contains shinfo, which
is referenced by pkt2.

This sequence of operations is possible inside DPDK e.g., while
performing TSO operations for 'net_tap' PMD.

Fix this by always storing shinfo at the tail of external buffer.

Fixes: 29cf9c1b

 ("userspace: Add TCP Segmentation Offload support")
Co-authored-by: Olivier Matz <olivier.matz@6wind.com>
Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
Signed-off-by: Yi Yang <yangyi01@inspur.com>
Acked-by: Flavio Leitner <fbl@sysclose.org>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

Some repositories that are enabled in GHA are not stable and lead
to 'apt update' failures:

  E: The repository
     'https://apt.postgresql.org/pub/repos/apt bionic-pgdg Release'
     no longer has a Release file.

This causes the job failure.
In most cases we don't really need any packages from these failed
repositories, so we could try to continue the job.

Previously this kind of failures happened on older branches with
ubuntu 16.04 base image, so we have this workaround already there.
Now it started to fail on bionic images, so fixing there too.

Fixes: 02f76fb4

 ("github: Fix Ubuntu package installation.")
Acked-by: Aaron Conole <aconole@redhat.com>
Acked-by: David Marchand <david.marchand@redhat.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

'ovs-monitor-ipsec' does not support 'ip6gre' tunnels.

Fixes: 22c5eafb

 ("ipsec: reintroduce IPsec support for tunneling")
Signed-off-by: Mark Gray <mark.d.gray@redhat.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

The default DPDK library used before this patch in case pkg-config
fails to find libdpdk is only valid for make based DPDK builds.
Hence remove them.

As a consequence, now this error message [1] is thrown when pkg-config
cannot find libdpdk instead of proceeding to check for a faulty
pkg-config and reporting incorrect error message [2].

Also, update the documentation to export PKG_CONFIG_PATH since on some
systems, the default install path for DPDK libraries is not present in
the default search path of pkg-config.
Ex: for Fedora 32 default pkg-config search path:
  /usr/lib64/pkgconfig:/usr/share/pkgconfig

while by default Meson installs DPDK libraries at:
  /usr/local/lib64/pkgconfig

[1] Package libdpdk was not found in the pkg-config search path.
    Perhaps you should add the directory containing `libdpdk.pc'
    to the PKG_CONFIG_PATH environment variable
    Package 'libdpdk', required by 'virtual:world', not found

[2] checking for DPDK... no
    check...

ovsdb-doc includes python code that requires dirs.py to exist.
This change fixes broken 'make manpage-check' target:

  # make manpage-check
  Traceback (most recent call last):
  File "./ovsdb/ovsdb-doc", line 25, in <module>
    import ovs.db.schema
  File "/root/ovs/python/ovs/db/schema.py", line 19, in <module>
    import ovs.db.types
  File "/root/ovs/python/ovs/db/types.py", line 18, in <module>
    import ovs.db.data
  File "/root/ovs/python/ovs/db/data.py", line 22, in <module>
    import ovs.jsonrpc
  File "/root/ovs/python/ovs/jsonrpc.py", line 21, in <module>
    import ovs.poller
  File "/root/ovs/python/ovs/poller.py", line 23, in <module>
    import ovs.vlog
  File "/root/ovs/python/ovs/vlog.py", line 25, in <module>
    import ovs.dirs
  ModuleNotFoundError: No module named 'ovs.dirs'

Fixes: 943c4a32

 ("python: set ovs.dirs variables with build system values")
Acked-by: Mark Gray <mark.d.gray@redhat.com>
Signed-off-by: Ilya Maximets <i.maximet...

Testpmd has been renamed to dpdk-testpmd as of DPDK 20.11.
This commit resolves this issue and fixes these tests.

Signed-off-by: Emma Finn <emma.finn@intel.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

Fix the following error:

  $ ovs-appctl dpctl/dump-conntrack -m -s system@ovs-system zone=0
  "dpctl/dump-conntrack" command takes at most 2 arguments
  ovs-appctl: ovs-vswitchd: server returned an error

  $ ovs-appctl dpctl/dump-flows -m --names system@ovs-system filter=in_port\(2\) type=ovs
  "dpctl/dump-flows" command takes at most 4 arguments
  ovs-appctl: ovs-vswitchd: server returned an error

Signed-off-by: Mao YingMing <maoyingming@baidu.com>
Acked-by: Mark Gray <mark.d.gray@redhat.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

The same icmp packet may traverse conntrack module more than once.
Or same icmp packets traverse contranck module in orderly.

Don't change state to CS_ESTABLISHED before receiving reply or related packets.

Fixes: a867c010

 ("conntrack: Fix conntrack new state")
Signed-off-by: Tonghao Zhang <xiangxia.m.yue@gmail.com>
Acked-by: Yi-Hung Wei <yihung.wei@gmail.com>
Acked-by: Aaron Conole <aconole@redhat.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

This change breaks the IDL into two layers: the IDL proper, whose
interface to its client is unchanged, and a low-level library called
the OVSDB "client synchronization" (CS) library.  There are two
reasons for this change.  First, the IDL is big and complicated and
I think that this change factors out some of that complication into
a simpler lower layer.  Second, the OVN northd implementation based
on DDlog can benefit from the client synchronization library even
though it would actually be made increasingly complicated by the IDL.

Signed-off-by: Ben Pfaff <blp@ovn.org>

This new module has a single direct user now.  In the future, it
will also be used by OVN.

Signed-off-by: Ben Pfaff <blp@ovn.org>
Acked-by: Ilya Maximets <i.maximets@ovn.org>

Until now, "test-ovsdb idl" has printed the steps that it goes through
to stdout.  This commit also makes it log the same information.  This
makes it easier to match up the steps with the rest of the log (in
particular with the jsonrpc logging).

Signed-off-by: Ben Pfaff <blp@ovn.org>
Acked-by: Ilya Maximets <i.maximets@ovn.org>

OVS should not exit if it cannot format NSH actions for the user.
It should just report the error like the other formatting functions do.

Credit to OSS-Fuzz.

Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21509
Fixes: 1fc11c59

 ("Generic encap and decap support for NSH")
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Acked-by: Mark Gray <mark.d.gray@redhat.com>

Acked-by: Flavio Leitner <fbl@sysclose.org>
Acked-by: Aaron Conole <aconole@redhat.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

Building the Linux kernel module from the Open vSwitch source tree
is deprecated.  Emit a warning when the '--with-linux' configure
parameter is supplied to remind the user.

Signed-off-by: Greg Rose <gvrose8192@gmail.com>
Acked-by: Flavio Leitner <fbl@sysclose.org>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>