Raymond P. Burkholder - Things I Do - Open vSwitch

Programmatic Open vSwitch

nospam@example.com (Raymond P. Burkholder) — Wed, 12 Feb 2020 17:20:50 +0000

Quite some ago, there was a discussion around [ovs-dev] Creating a libopenvswitch-dev package, back in 2016. Since then libraries have been updated for C++ inclusion, plus other improvements.

From somewhere, I don't have the reference, maybe my own blog, but since I have this in a note on my desktop, I'll include it here:

Build a string formatted as the “ovs-ofctl” command would do, for example “table=1,cookie=0xdeadbeef,in_port=1,actions=resubmit(,2)”
Pass this to parser_ofp_flow_mod_str(). The parser will magically parse the string in to a rich struct.
Pass the struct to ofputil_encode_flow_mod(). This returns a struct with a serialized OpenFlow message buffer.
Send this buffer on the wire either via a socket you manage yourself or let OpenVswitch do it for you.

open vSwitch Commands

nospam@example.com (Raymond P. Burkholder) — Thu, 15 Nov 2018 00:50:18 +0000

Because ovsdb is a generic database tool, some one may have build other schemas. But for a native open vswitch install, this is the default state:

# ovsdb-client list-dbs
Open_vSwitch
_Server

It is possible to add a tcp connection to gain access to the database:

# ovs-appctl -t ovsdb-server ovsdb-server/add-remote ptcp:6640
# netstat -antp |grep ovs
tcp        0      0 0.0.0.0:6640            0.0.0.0:*               LISTEN      746/ovsdb-server
tcp        0      0 127.0.0.1:57424         127.0.0.1:6633          ESTABLISHED 397/ovs-vswitchd

But on linux, there is an existing linux stream available:

# lsof|grep ovsdb|grep STREAM
ovsdb-ser   746                   root    5u     unix 0x000000001740f722        0t0   59425581 /var/run/openvswitch/db.sock type=STREAM
ovsdb-ser   746                   root   16u     unix 0x0000000021edd23e        0t0      12914 /var/run/openvswitch/db.sock type=STREAM
ovsdb-ser   746                   root   19u     unix 0x000000001b392a81        0t0      20287 /var/run/openvswitch/ovsdb-server.746.ctl type=STREAM

# ovs-vsctl list open_vswitch
_uuid               : 8cfeb1c0-34ca-4f91-a162-7e9aef141344
bridges             : [e65f5e97-36ec-45e3-b83e-64129dae61d3]
cur_cfg             : 65
datapath_types      : [netdev, system]
db_version          : "7.16.1"
dpdk_initialized    : false
dpdk_version        : none
external_ids        : {hostname="nuc8i7hvk01.burkholder.net", rundir="/var/run/openvswitch", system-id="02700cd5-96f5-4b4e-90b4-5e67fe06abf7"}
iface_types         : [erspan, geneve, gre, internal, "ip6erspan", "ip6gre", lisp, patch, stt, system, tap, vxlan]
manager_options     : []
next_cfg            : 65
other_config        : {}
ovs_version         : "2.10.1"
ssl                 : []
statistics          : {}
system_type         : debian
system_version      : []

# ovs-appctl dpif/show
system@ovs-system: hit:50661581 missed:207452
  ovsbr0:
    eno1 5/3: (system)
    enp5s0 2/1: (system)
    ovsbr0 65534/2: (internal)
    veth-nvpn-v90 6/6: (system)
    vlan110 4/5: (internal)
    vlan90 3/4: (internal)

# ovs-appctl dpctl/show -s
system@ovs-system:
  lookups: hit:50661616 missed:207458 lost:0
  flows: 6
  masks: hit:211426886 total:10 hit/pkt:4.16
  port 0: ovs-system (internal)
    RX packets:0 errors:0 dropped:0 overruns:0 frame:0
    TX packets:1428 errors:0 dropped:0 aborted:0 carrier:0
    collisions:0
    RX bytes:0  TX bytes:177489 (173.3 KiB)
  port 1: enp5s0
    RX packets:19439356 errors:0 dropped:0 overruns:0 frame:0
    TX packets:30374161 errors:0 dropped:0 aborted:0 carrier:0
    collisions:0
    RX bytes:10608677166 (9.9 GiB)  TX bytes:29950322693 (27.9 GiB)
  port 2: ovsbr0 (internal)
    RX packets:333032 errors:0 dropped:29829 overruns:0 frame:0
    TX packets:1428 errors:0 dropped:0 aborted:0 carrier:0
    collisions:0
    RX bytes:23060625 (22.0 MiB)  TX bytes:177489 (173.3 KiB)
  port 3: eno1
    RX packets:6037565 errors:0 dropped:0 overruns:0 frame:0
    TX packets:5719808 errors:0 dropped:0 aborted:0 carrier:0
    collisions:0
    RX bytes:4726094728 (4.4 GiB)  TX bytes:3277870100 (3.1 GiB)
  port 4: vlan90 (internal)
    RX packets:0 errors:0 dropped:274558 overruns:0 frame:0
    TX packets:0 errors:0 dropped:0 aborted:0 carrier:0
    collisions:0
    RX bytes:0  TX bytes:0
  port 5: vlan110 (internal)
    RX packets:0 errors:0 dropped:274101 overruns:0 frame:0
    TX packets:0 errors:0 dropped:0 aborted:0 carrier:0
    collisions:0
    RX bytes:0  TX bytes:0
  port 6: veth-nvpn-v90
    RX packets:5000388 errors:0 dropped:0 overruns:0 frame:0
    TX packets:5788139 errors:0 dropped:0 aborted:0 carrier:0
    collisions:0
    RX bytes:3055006377 (2.8 GiB)  TX bytes:4647166781 (4.3 GiB)

More Open vSwitch Commands ...

nospam@example.com (Raymond P. Burkholder) — Tue, 24 Apr 2018 22:55:22 +0000

... from the mailing list:

//You can verify that OVS supports deletion by cookie specification by checking these tests:

 932: ofproto.at:1746    ofproto - del flows based on cookie
 933: ofproto.at:1767    ofproto - del flows based on cookie mask

// Run the tests using “make check” like this:
sudo make check TESTSUITEFLAGS='932-933' -C _gcc

//Look at what is being tested here:
tests/ofproto.at

and

Maybe you want to check what Ryu is sending the switch

http://www.openvswitch.org//support/dist-docs/ovs-ofctl.8.pdf

“OpenFlow Switch Monitoring Commands:
monitor switch [miss-len] [invalid_ttl] [watch:[spec...]]
Connects to switch and prints to the console all OpenFlow messages received. Usually, switch
should specify the name of a bridge in the ovs−vswitchd database.“

eg) ovs-ofctl monitor br0 65534 invalid_ttl --detach --no-chdir --pidfile 2> ofctl_monitor.log

libvirt, ovs, and vlans

nospam@example.com (Raymond P. Burkholder) — Mon, 13 Nov 2017 22:18:39 +0000

Since I plan on using this similar combination in some upcoming configurations, I'll keep the reference here, and hopefully add details once I've worked through them.

Using VLANs with OVS and libvirt by Scott Lowe back in 2012, referenced in an Replace Linux Bridge with Openvswitch on Ubuntu (an OVS mailing list entry).

Capacity/Quota in ovs/openflow

nospam@example.com (Raymond P. Burkholder) — Tue, 07 Nov 2017 00:34:26 +0000

The question:

What is the best way to model quota through ovs? Right now the best thing we could come up with is to periodically poll a flow stat and install a drop flow when the flow stat goes past the quota.

The answer given (which provides some food for thought on better mechanisms):

Open vSwitch includes sFlow / NetFlow instrumentation. Using flow data to drive your quota controller reduces the complexity of the OpenFlow rules since you no longer need granular rules to provide the traffic measurements.
The following article describes building a quota controller using sFlow:
Real Time Visibility and Control

open vswitch newsgroup notes

nospam@example.com (Raymond P. Burkholder) — Sun, 29 Oct 2017 13:22:46 +0000

Bypassing OpenFlow controller and injecting flow table entries via a code call:

> Can someone refer to the code where a  new flow is inserted to
> openflow tables in the OVS, as a consequence action of a received
> message from a controller?

handle_flow_mod() in ofproto.c

Another similar request:

> My project was previously calling system commands like ‘ovs-ofctl add-flow’ directly from C, 
> but we would like to do this programmatically now, by calling into the openvswitch library. 
> After looking at this for a bit and what methods I would have to call, I’ve realized this is 
> non trivial, and I can’t find any easily exposed methods to add and delete flows. 
> Does anyone have an example anywhere of calling into openvswitch methods 
> directly to add/remove flows? So far the best way I can find is calling into 
> ovn/controller/ofctrl.h:ofctrl_add_flow(…), but this will require quite a bit of legwork.

One way:

There are plenty of controllers out there, including a couple in C - libfluid

Another way:

Here’s how I do it.  It’s essentially the same as what the ‘ovs-ofctl add-flow’ command does under the hood.

1. Build a string formatted as the “ovs-ofctl” command would do, 
         for example “table=1,cookie=0xdeadbeef,in_port=1,actions=resubmit(,2)”
2. Pass this to parser_ofp_flow_mod_str().  The parser will magically parse the string in to a rich struct.
3. Pass the struct to ofputil_encode_flow_mod().  This returns a struct with a serialized OpenFlow message buffer.
4. Send this buffer on the wire either via a socket you manage yourself or let OpenVswitch do it for you.

Added 2017/11/13, the second link shows a terrific example usage for ovs-dpctl

> I have a problem that when i use the ovs-dpctl to add a flow into datapath, 
> it occurs "ovs-dpctl: parsing flow key (Invalid argument)"
>
>     example:
>    root@jlt:~# ovs-dpctl add-flow system@myDP "in_port(1),eth_type(0x800),ipv4
> (src=172.31.110.4,dst=172.31.110.5)" 2
> ovs-dpctl: parsing flow key (Invalid argument)

You may be able to use 'dmesg' to see which key is missing.

See the talk by Joe Stringer:
Youtube

And the blogpost (shameless plug for myself):
Direct Kernel OVS Flow Programming

A follow up from Ben indicated though:

I believe that this particular error comes from the userspace parser, not the kernel.

Another addition on 2017/11/13:

> For us, newbies, examples are extremely valuable, more than a thousand
> words.
> If some kind soul has an example on how to insert a new interface (s1-eth3)
> in a single switch (s1) with two interfaces (s1-eth2 and s1-eth3) please
> share with me.

If you run something like this:
        ovs-vsctl -vjsonrpc -- add-bond s1 s1-eth3 s1-eth2 s1-eth3
then you will see what ovs-vsctl does to insert such a bond, logged as
the jsonrpc module.

2017/11/25 Addition 1:

ovs-save is a shell script, using `ovs-ofctl dump-flows br` to write flows
into a file, and then use `ovs-ofctl add-flows br FILE` to add them.

2017/11/25 Addition 2:

The OpenFlow Spec does not directly provide the mechanism for the multi-path load balancing and also Ryu does not provide it. I guess it is depending on your application design...
But for the beginning, how about using the Group action(the "select" type)? The selection algorithm is depending on your switch though, it provides an easy way to do load balancing.
Please refer to the section "5.6.1 Group Types" in the OpenFlow Spec 1.3.5 for the details: https://www.opennetworking.org/wp-content/uploads/2014/10/openflow-switch-v1.3.5.pdf

2017/12/07 dpctl: Support flush conntrack by 5-tuple

With this patch, "flush-conntrack" in ovs-dpctl and ovs-appctl accept a conntrack 5-tuple to delete the conntrack entry specified by the 5-tuple. For example, user can use the following command to flush a conntrack entry in zone 5.

$ ovs-dpctl flush-conntrack zone=5 \
    'ct_nw_src=10.1.1.2,ct_nw_dst=10.1.1.1,ct_nw_proto=17,ct_tp_src=2,ct_tp_dst=1'
$ ovs-appctl dpctl/flush-conntrack zone=5 \
    'ct_nw_src=10.1.1.2,ct_nw_dst=10.1.1.1,ct_nw_proto=17,ct_tp_src=2,ct_tp_dst=1'

2018/06/11: "I suggest using ofproto/trace to figure out what's going on. See ovs-vswitchd(8) if you're not already familiar with it."

2018/06/11: "You can see the history of the configuration database by running "ovsdb-tool -mm show-log" on it. This might reveal what is happening, too."

"ovs-vsctl --may-exist add-port {{ info.ovs_bridge }} {{ interface }} {{ info.ovs_options }} -- set interface {{ interface }} type=internal"

2018/11/25 - ovs-testcontroller

Open vSwitch Commands

nospam@example.com (Raymond P. Burkholder) — Sat, 14 Oct 2017 14:23:49 +0000

port number with port name:

# ovs-ofctl dump-ports-desc <ovs bridge>

dump flows:

# ovs-ofctl dump-flows <ovs bridge>

Dump OVSDB table:

# ovsdb-client dump

Obtain schema of OVSDB:

# ovsdb-client get-schema --pretty

Some background info on OVSDB from Brent Salisbury's Blog: Getting Started with OVSDB As Introduction to Open vSwitch says:

Like OSPF, OpenFlow directly influences the forwarding behavior of a networking devices (albeit way differently than OSPF) but isn’t able to actually change the configuration of that device. OSPF cannot disable a router’s interface, or create a GRE tunnel, for instance. For that, we need a management plane protocol.
In the world of OVS, this role is filled by OVSDB. This allows us to use well-understood wire protocols (namely JSON-RPC) to send commands to an OVS instance to do things like create tunnels, turn on/off certain features, get configuration data, and more.

I have wondered about the 'tcp' vs 'ptcp' syntax. Well the answer:

“Manager” refers to an OVSDB client. The “ptcp::" syntax means that OVS is passively listening on that port and local address for incoming JSON-RPC data.
“Controller” refers to an OpenFlow controller. The “tcp:" syntax means that OVS proactively reaches out to a controller at that address to establish the relationship. (Standard port of 6633)

2018/01/20:


ovs-vsctl get Interface <iface> status

2018/03/29

ovsdb-client -f list dump

2018/06/11

# ovs-appctl dpctl/show
system@ovs-system:
        lookups: hit:393756304 missed:4746333 lost:0
        flows: 31
        masks: hit:1365293746 total:4 hit/pkt:3.43
        port 0: ovs-system (internal)
        port 1: ovsbr0 (internal)
        port 2: enp5s0
        port 3: vlan20 (internal)
        port 4: enp1s0
        port 5: enp2s0
        port 6: enp3s0
        port 7: vlan30 (internal)
        port 8: wlp4s0
        port 9: vlan40 (internal)
        port 10: vlan50 (internal)

# ovs-ofctl show ovsbr0
OFPT_FEATURES_REPLY (xid=0x2): dpid:0000000ec4d20451
n_tables:254, n_buffers:0
capabilities: FLOW_STATS TABLE_STATS PORT_STATS QUEUE_STATS ARP_MATCH_IP
actions: output enqueue set_vlan_vid set_vlan_pcp strip_vlan mod_dl_src mod_dl_dst mod_nw_src mod_nw_dst mod_nw_tos mod_tp_src mod_tp_dst
 1(enp5s0): addr:00:0e:c4:d2:04:54
     config:     0
     state:      0
     current:    100MB-FD COPPER AUTO_NEG
     advertised: 10MB-HD 10MB-FD 100MB-HD 100MB-FD 1GB-FD COPPER AUTO_NEG AUTO_PAUSE
     supported:  10MB-HD 10MB-FD 100MB-HD 100MB-FD 1GB-FD COPPER AUTO_NEG AUTO_PAUSE
     speed: 100 Mbps now, 1000 Mbps max
 2(vlan20): addr:a2:58:96:ce:5c:40
     config:     0
     state:      0
     speed: 0 Mbps now, 0 Mbps max
 3(enp1s0): addr:00:0e:c4:d2:04:51
     config:     0
     state:      0
     current:    100MB-FD COPPER AUTO_NEG
     advertised: 10MB-HD 10MB-FD 100MB-HD 100MB-FD 1GB-FD COPPER AUTO_NEG AUTO_PAUSE
     supported:  10MB-HD 10MB-FD 100MB-HD 100MB-FD 1GB-FD COPPER AUTO_NEG AUTO_PAUSE
     speed: 100 Mbps now, 1000 Mbps max
....
....

2018/06/21

# ovs-appctl dpif/dump-flows ovsbr0
recirc_id(0),in_port(9),eth(src=e6:64:dc:6f:7d:87,dst=44:80:eb:1c:1b:69),eth_type(0x0800),ipv4(frag=no), packets:1, bytes:54, used:8.756s, flags:R., actions:8
recirc_id(0),in_port(13),eth(src=0a:00:40:50:00:ce,dst=b6:4d:8d:6b:37:5a),eth_type(0x0806), packets:0, bytes:0, used:never, actions:10
recirc_id(0),in_port(2),eth(src=84:2b:2b:47:2e:4f,dst=ff:ff:ff:ff:ff:ff),eth_type(0x0806),arp(sip=199.68.195.98,tip=199.68.195.107,op=1/0xff), packets:2, bytes:120, used:0.836s, actions:push_vlan(vid=20,pcp=0),1,pop_vlan,3
recirc_id(0),in_port(7),eth(src=7e:00:6a:f3:12:91,dst=80:fa:5b:43:c6:db),eth_type(0x0800),ipv4(frag=no), packets:2341, bytes:1954768, used:0.008s, flags:SFPR., actions:5
recirc_id(0),in_port(5),eth(src=80:fa:5b:43:c6:db,dst=7e:00:6a:f3:12:91),eth_type(0x0806), packets:0, bytes:0, used:never, actions:7
....

OVS and QinQ (aka 802.1ad)

nospam@example.com (Raymond P. Burkholder) — Mon, 09 Oct 2017 02:13:43 +0000

Redhat has an excellent entry on Open vSwitch: Overview of 802.1ad (QinQ) Support.

A key point raised is:

Enabling QinQ support in OVS is a simple configuration change. You must set the vlan-limit option to a value of 0 (unlimited) or 2. By default vlan-limit has a value of 1, which means only one VLAN tag will be inspected. This preserves backward compatibility with older OVS releases.
$ ovs-vsctl set Open_vSwitch . other_config:vlan-limit=2

The article continues with ovs-ofctl and ovs-vsctl examples.

Open vSwitch (OVS) Things To Remember

nospam@example.com (Raymond P. Burkholder) — Sun, 08 Oct 2017 21:02:31 +0000

I've been writing some OpenFlow Controller code to get a feel on how OpenFlow works. As I get into it, I've been wondering if what I want to do is quite correct. Open vSwitch has various extensions available, which may or may not be available via the OpenFlow standards. So writing code conforming to something like OF 1.4.1, will I be able to gain access to those extensions, or will I need to access Open vSwitch differently? Not sure. More research is needed. These links track some of that research.

First off, there are libraries in OVS for tracking BFD by watching a vswitch table. Also, there is an lldp encoder/decoder.

From an OpenFlow perspective, there is a tutorial called Open vSwitch Advanced Features, which shows, via the command line tools, how to use multiple flow tables to build a simple learning switch. That documentation makes reference to some extension files:

include/openvswitch/meta-flow.h
include/openflow/nicira-ext.h

So, the question is, how to make use of those extensions via an API? Support for that question may start at the Integration Guide for Centralized Control.

Design Decisions In Open vSwitch has various comments on: what a master sees vs a slave, talks about v1.4 bundles and transactions, clarification on vlan matching in the various versions, and talks extensively about in-band and out-band control.

The FAQ Using OpenFlow talks about: hidden flows and how to dump them, how to set out-of-band mode, how to get a list of port numbers as they associate to interface name, and how to adjust mtu on internal interfaces.

The General FAQ talks about the current standard ports as of OVS 2.4:

6653 (was 6633) - OpenFlow
6640 (was 6632) - OVSDB - which is what I need to investigate for the OVSDB protocol API

OVS with KVM talks about starting up a KVM guest and connecting it via a couple custom scripts to the network. libvirt can also play nicely with OVS.

Bash Completion is Available with

ovs-appctl-bashcomp.bash
ovs-vsctl-bashcomp.bash

Tracing explains how to test the series of flow table entries against a sample packet.

For each OpenFlow version, there is a separate header. The same directory has headers for extensions as well.

On the documentation page, some interesting entries:

ovs-vswtichd.conf.db - describes the OVSDB tables - can flows be inserted via the flow table?
ovs-vswitchd - desribes the primary service, and has detailed examples of related client commands ovs-ofctl, ovs-vsctl, ....
ovs-fields - is an important document describing match and action fields, whether they are openflow standard or ncira extensions, and some are just OVS based.
ovs-dbclient - can be used to dump tables in OVSDB - so use this to check flows once a controller has been activated

I found hints at Getting Started With OVSDB for getting JSON out of some of the command line utilities. It also alludes to an OVSDB method specification. It also talks about the ability to 'monitor', which is what I'm looking for from a BFD scenario (if I don't implement that myself from a packet_in / packet_out perspective).

I get closer by looking at All About the OVSDB Server by describing non OVS database uses.

That article references RFC 7047 which talks about the database generically. It says JSON is being used for the schema format and for the wire protocol format. So, by using looking into the tables and fields, it should be possible to come up with the appropriate JSON structures and commands to perform the necessary updates without the use of OpenFlow.

Understanding Hardware VTEPs shows some ways of composing and transmitting JSON via the command line to the database.

On the Presentations page, for troubleshooting, "OVS Deep Dive" and "Debugging OVS" are useful.

OVS-Cheat-Sheet has the following useful diagram:

+---------+ +-----------+                                                              
|ovs-ofctl| |sFlow Trend|                                                                         
+----^----+ +-----^-----+                                                                         
     |            |                                                                      Remote   
+-----------------------------------------------------------------------------------------------+   
     |            |                                                                               
     |      sFlow |                                                                               
     |            |  +---------+   +----------+             +---------+   +------------+          
     |            |  |ovs-dpctl|   |ovs-appctl|             |ovs-vsctl|   |ovsdb-client|          
     |            |  +----+----+   +------^---+             +-----+---+   +-------^----+          
     |            |       |     Command   |                       | Config        | DB operation  
     |            |  +----v---------------v--+ Unix socket   +----v---------------v-+             
     |            +--+                       +--------------->                      | 
     |OpenFlow       |    ovsdb-vswitchd     |               |     ovsdb-server     | +----------+
     +---------------+                       <---------------+                      | |ovsdb-tool|
                     +-----^------------+----+ Apply changes +------------^---------+ +----+-----+
                           |            |                                 |                |      
                           |            |                                 |                |      
                           |            |                           +-----v-----+          |      
            upcall(netlink)|            |netlink                    |   ovsdb   <----------+      
                           |            |                           +-----------+                 
+-----------------------------------------------------------------------------------------------+   
                           |            |                                           Kernel space      
                     +-----+------------v------+                                                  
                     |Openvswitch kernel module|                                                  
                     +-------------------------+

Open vSwitch Cheat Sheet has another useful cheatsheet of commands.

Matt Oswalt has a couple of relevant OpenFlow related articles:

Storage Traffic Magic with OpenFlow where he talks about a now defunct storage company Coho Storage using OpenFlow to steer requests and responses in and out of appropriate nodes by appropropriate mac address mangling.
[SDN Protocols] Part 2 - OpenFlow Deep-Dive where he provides a good overview of OpenFlow tables, pipelines, write actions, action sets, as well as proactive vs reactive flow instantiation.

When getting into network discovery, Discovery in Software-Defined Networks talks about using LLDP (Link Layer Discovery Protocol) as well as BDDP (Broadcaset Domain Discovery Protocol) packets. BDDP packets can be used to discover non-LLDP responding switches, or switches not part of an SDN managed domain. The article suggests discovery packets on 5 second intervals.

From Today's ovs-discuss

nospam@example.com (Raymond P. Burkholder) — Mon, 04 Sep 2017 23:22:49 +0000

A confirmation that a bridge should be placed in the 'up' state in order to function properly.

This is (bridge) br0. Is it up or down? If it's down, the broadcasts for that port will be dropped and accounted.

A note on scaling networks (packet processing) in Linux:

In order to have multiple CPUs processing packets in parallel with the kernel datapath, you need multiple queues with their interrupts spread among all relevant CPUs. And in order to the NIC to spread the traffic to different queues, you need different streams (5-tuple). That is called RSS.
For example, stream A would go to queue#1 which is mapped to CPU#1 and stream B would go to queue#2 which is mapped to CPU#2 and so on.
That is how Linux kernel works in general (as standalone NIC, or using Linux bridge or OVS). Here is a doc explaining it in more details:
Linux Kernel Docs for Scaling -- with RSS (Receive Side Scaling), among other concepts, explained.

Open vSwitch 802.1q Tagged/Untagged VLANs

nospam@example.com (Raymond P. Burkholder) — Sun, 27 Aug 2017 17:56:34 +0000

This is an easy combination, but a quick google didn't surface a succinct entry, so for my own documentation, here is what I use:

Add a bridge:

ovs-vsctl add-br br0

Add a physical port to the bridge, which defaults to 802.1q trunk mode:

ovs-vsctl add-port br0 eno1

Allow and make use of a designated untagged VLAN:

ovs-vsctl set port eno1 vlan_mode=native-untagged

Designate which vlan is untagged:

ovs-vsctl set port eno1 tag=20

Specify which VLANs are trunked and allowed:

ovs-vsctl set port eno1 trunks=10,30,50,60

A short form diagnostic command:

# ovs-vsctl list port eno1
_uuid               : 579b2c91-ad26-4ba0-bdcc-172c18daae80
bond_active_slave   : []
bond_downdelay      : 0
bond_fake_iface     : false
bond_mode           : []
bond_updelay        : 0
external_ids        : {}
fake_bridge         : false
interfaces          : [bfec126c-375c-435e-9fae-3b71d513724b]
lacp                : []
mac                 : []
name                : "eno1"
other_config        : {}
qos                 : []
rstp_statistics     : {}
rstp_status         : {}
statistics          : {}
status              : {}
tag                 : 20
trunks              : [10, 30, 50, 60]
vlan_mode           : native-untagged


A longer form diagnostic command:

# ovs-vsctl list interface eno1
_uuid               : bfec126c-375c-435e-9fae-3b71d513724b
admin_state         : up
bfd                 : {}
bfd_status          : {}
cfm_fault           : []
cfm_fault_status    : []
cfm_flap_count      : []
cfm_health          : []
cfm_mpid            : []
cfm_remote_mpids    : []
cfm_remote_opstate  : []
duplex              : full
error               : []
external_ids        : {}
ifindex             : 2
ingress_policing_burst: 0
ingress_policing_rate: 0
lacp_current        : []
link_resets         : 1
link_speed          : 100000000
link_state          : up
lldp                : {}
mac                 : []
mac_in_use          : "4c:72:b9:4b:16:5c"
mtu                 : 1500
mtu_request         : []
name                : "eno1"
ofport              : 1
ofport_request      : []
options             : {}
other_config        : {}
statistics          : {collisions=0, rx_bytes=62197532, rx_crc_err=0, rx_dropped=0, rx_errors=0, rx_frame_err=0, rx_over_err=0, rx_packets=92875, tx_bytes=30437234, tx_dropped=0, tx_errors=0, tx_packets=86960}
status              : {driver_name="r8169", driver_version="2.3LK-NAPI", firmware_version=""}
type                : ""


A short, all-in-one lcommand for adding an internal access port:

ovs-vsctl add-port ovsbr0 vlan40 tag=40 -- set Interface vlan40 type=internal

openvswitch command line interfaces

nospam@example.com (Raymond P. Burkholder) — Fri, 11 Aug 2017 16:29:44 +0000

From demystifying openvswitch (with the slide deck showing some interesting edit shortcuts with virsh, and slide 13 may be incorrect as trunk is default):

ovs-vsctl: Set up, maintain, and inspect various openvswitch configurations. It provides a high level interface to the database to query and apply changes at run time. Operations are persistent across reboot. Example: ovs-vsctl --format=table --column=name,vlan_mode
ovs-ofctl, ovs-dpctl: Administer and monitor flow entries. Two kinds of flows: openflows (flows managed at control plane) and datapath (kernel flow, cached version of openflow). ovs-ofctl speaks to openflow module. ovs-dpctl talks to kernel module.
ovs-appctl: Sends commands to a running openvswitch to gather information which is not directly exposed to ovs-ofctl -- the Swiss Army knife of openflow troubleshooting. Example: ovs-appctl vlog/list, ovs-appctl vlog/set module(:facility(:level)) where level is emer, err, warn, info, dbg
ovsdb-client: query the ovs database. Example: ovsdb-lient list-tables, ovsdb-client list-columns , ovsdb-client monitor --detach
ovsdb-tool showlog

openvswitch deep dive on slide 14 and 15, shows relationship between commands and the daemons.

[ovs] libopenvswitch

nospam@example.com (Raymond P. Burkholder) — Sun, 30 Jul 2017 13:04:45 +0000

A couple of interesting email list articles regarding libopenvswitch. A recent one titled libopenvswitch in C++, which indicates there are some caveats: most of all the word 'public' used which is a c++ keyword.

That article put me onto a search of other libopenvswitch articles, and this one came up: creating a libopenvswitch-dev package. Which suggested there is quite a bit of work involved in producing a cohesive library.

In that article was a link to a detailed paper from 2011 by Intel called How to Write Shared LibrariesK. The paper covers the ELF structure, dynamic loader, the relocation process, as well as many C/C++ specific requirements. The biggest reason for this link is having to do with the ABI (Application Binary Interface) and it's stability.

2017/07/31 - Open source at work, things getting resolved quickly: a patch series

[ovs-discuss] Q: Using netfilter to classify packets in OVS

nospam@example.com (Raymond P. Burkholder) — Sun, 16 Jul 2017 23:10:48 +0000

Question:

I want to classify/match packets in OVS based on some TCP options, this is currently not supported by OVS but it is supported by netfilter. The support for ConnTrack left me wondering if I could use netfilter to match that field and then use the result of that in OVS.

Answer:

There's no native integration, but I could imagine that if Netfilter ran on the packets first then modified the skb mark field, then OVS ran later on that packet then plausibly you could match on the pkt_mark.

[ovs-discuss] remap double-tagged frame

nospam@example.com (Raymond P. Burkholder) — Sun, 16 Jul 2017 23:04:18 +0000

"You need to increase the vlan-limit to be able to match or pop multiple VLAN tags. Otherwise the second tag is parsed as the Ethertype."

e.g.

# ovs-vsctl set Open_vSwitch . other_config:vlan-limit=2

and specify vlan mode for your port:

ovs-vsctl set port vhu0fd9ab54-39 vlan_mode=dot1q-tunnel tag=5

github.com/openvswitch/ovs