stop recommending allow-ovs, see bug #989720

See merge request openstack-team/third-party/openvswitch!10

    - 1036: ofproto-dpif - select group with weights FAILED (ofproto-dpif.at:787)
    - 1072: ofproto-dpif - controller action without megaflows FAILED (ofproto-dpif.at:2145)

    patch (Closes: #991308).

  [ Felix Moessbauer ]
  * Also use slave update-alternative for libofproto.

fix ABI incompatibility that crashes OVS when enabling LLDP

See merge request openstack-team/third-party/openvswitch!9

This fix ensures that the libofproto is also placed in the
update-alternatives to ensure that the library is build with the same
defines (e.g. NETDEV_DPDK) as the ovs-vswitchd binary.

Previously, even the ovs-vswitchd build with DPDK used the libofproto without
DPDK support.

closes: #992406

    many arch.

Add source package

See merge request openstack-team/third-party/openvswitch!8

    arch, and then the package FTBFS.

    - CVE-2020-27827
    - CVE-2020-35498

Open vSwitch version 2.15.0.

Acked-by: Ian Stokes <ian.stokes@intel.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

At present the log displays the auto load balance state
everytime it is changed.

There are some cases where the user will try to enable
auto load balance, but it cannot be enabled because not
enough PMDs or RxQs. As the state does not change, there
is no new log of the state.

While the the last log report of state is still correct,
it is better to log the state again at this point so the
user can explicitly confirm the outcome of their request.

Signed-off-by: Kevin Traynor <ktraynor@redhat.com>
Signed-off-by: Ian Stokes <ian.stokes@intel.com>

Signed-off-by: Ian Stokes <ian.stokes@intel.com>

Indicate that OVS 2.15 uses DPDK 20.11.

Signed-off-by: Hariprasad Govindharajan <hariprasad.govindharajan@intel.com>
Acked-by: Kevin Traynor <ktraynor@redhat.com>
Signed-off-by: Ian Stokes <ian.stokes@intel.com>

Update the docs to remove the previously hardcoded values
and mention the load and improvement thresholds when
describing the operation of auto load balance.

Fixes: 62ab5594

 ("dpif-netdev: Add parameters to configure PMD auto load balance.")
Signed-off-by: Kevin Traynor <ktraynor@redhat.com>
Acked-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: Ian Stokes <ian.stokes@intel.com>

    flow: Support extra padding length.patch (Closes: #982493).

FreeBSD 12.1 reached EOL and our builds are failing on Cirrus CI.
Updating to 12.2 - current production release.

Acked-by: Flavio Leitner <fbl@sysclose.org>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

Although not required, padding can be optionally added until
the packet length is MTU bytes. A packet with extra padding
currently fails sanity checks.

Vulnerability: CVE-2020-35498
Fixes: fa8d9001

 ("miniflow_extract: Properly handle small IP packets.")
Reported-by: Joakim Hindersson <joakim.hindersson@elastx.se>
Acked-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: Flavio Leitner <fbl@sysclose.org>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

Now OvS supports building with dpdk 20.11, and uses
the '--with-dpdk=shared' option in fedora.spec. Then
change version of dpdk 17.05.1 to 20.11.

Note that dpdk-devel-20.11.x is not released in fedora
distro, but use '20.11' is fine.

Fixes: 252e1e57

 ("dpdk: Update to use DPDK v20.11.")
Signed-off-by: Tonghao Zhang <xiangxia.m.yue@gmail.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

TC flower doesn't support some ct state flags such as
INVALID/SNAT/DNAT/REPLY. So it is better to reject this rule.

Fixes: 576126a9

 ("netdev-offload-tc: Add conntrack support")
Signed-off-by: wenxu <wenxu@ucloud.cn>
Reviewed-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

Some manpages are generated from rST, but these are not included
in 'dist-docs' make target.

Fixes: fd0837a7

 ("doc: Convert ovs-vlan-test to rST")
Acked-by: Ben Pfaff <blp@ovn.org>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

Fix the reported back value of the bos mask used by the revalidator
threads.

Fixes: 34b16955

 ("lib/tc: add single mpls match offload support")
Reported-by: Marcelo Leitner <mleitner@redhat.com>
Signed-off-by: Eelco Chaudron <echaudro@redhat.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

With DPDK 20.11, meson and pkgconfig are used instead of the old
Makefile-based system and so --with-dpdk option is changed to only
accept shared or static instead of the directory.

This commit uses --with-dpdk=shared since Fedora and RHEL ship shared
libraries of DPDK.

Fixes: 252e1e57

 ("dpdk: Update to use DPDK v20.11.")
Signed-off-by: Timothy Redaelli <tredaelli@redhat.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

The stop_daemon no longer takes second argument after
commit f3e24610 ("Remove OVN.").

Fixes: f3e24610

 ("Remove OVN.")
Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

shinfo is used to store reference counter and free callback
of an external buffer, but it is stored in mbuf if the mbuf
has tailroom for it.

This is wrong because the mbuf (and its data) can be freed
before the external buffer, for example:

  pkt2 = rte_pktmbuf_alloc(mp);
  rte_pktmbuf_attach(pkt2, pkt);
  rte_pktmbuf_free(pkt);

After this, pkt is freed, but it still contains shinfo, which
is referenced by pkt2.

This sequence of operations is possible inside DPDK e.g., while
performing TSO operations for 'net_tap' PMD.

Fix this by always storing shinfo at the tail of external buffer.

Fixes: 29cf9c1b

 ("userspace: Add TCP Segmentation Offload support")
Co-authored-by: Olivier Matz <olivier.matz@6wind.com>
Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
Signed-off-by: Yi Yang <yangyi01@inspur.com>
Acked-by: Flavio Leitner <fbl@sysclose.org>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

Some repositories that are enabled in GHA are not stable and lead
to 'apt update' failures:

  E: The repository
     'https://apt.postgresql.org/pub/repos/apt bionic-pgdg Release'
     no longer has a Release file.

This causes the job failure.
In most cases we don't really need any packages from these failed
repositories, so we could try to continue the job.

Previously this kind of failures happened on older branches with
ubuntu 16.04 base image, so we have this workaround already there.
Now it started to fail on bionic images, so fixing there too.

Fixes: 02f76fb4

 ("github: Fix Ubuntu package installation.")
Acked-by: Aaron Conole <aconole@redhat.com>
Acked-by: David Marchand <david.marchand@redhat.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

'ovs-monitor-ipsec' does not support 'ip6gre' tunnels.

Fixes: 22c5eafb

 ("ipsec: reintroduce IPsec support for tunneling")
Signed-off-by: Mark Gray <mark.d.gray@redhat.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>