Skip to content

Commit

Permalink
ovn-nb: remote connection management in nb db
Browse files Browse the repository at this point in the history 
Add support for managing remote connections, including
SSL configuration, to northbound db schema, and add necessary
commands to ovn-nbctl.

Signed-off-by: Lance Richardson <[email protected]>
Signed-off-by: Ben Pfaff <[email protected]>
  • Loading branch information
@hlrichardson @blp
hlrichardson authored and blp committed Dec 21, 2016
1 parent 265fb85 commit 821302c
Show file tree
Hide file tree
Showing 6 changed files with 634 additions and 5 deletions.
2 changes: 2 additions & 0 deletions NEWS
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ Post-v2.6.0
* IPAM now supports fixed MAC addresses.
* Support for source IP address based routing.
* ovn-trace can now trace put_dhcp_opts and put_dhcp_optsv6 actions.
* Support for managing SSL and remote connection configuration in
northbound database.
- Fixed regression in table stats maintenance introduced in OVS
2.3.0, wherein the number of OpenFlow table hits and misses was
not accurate.
Expand Down
53 changes: 48 additions & 5 deletions ovn/ovn-nb.ovsschema
View file
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"name": "OVN_Northbound",
"version": "5.4.1",
"cksum": "3773248894 11490",
"cksum": "3485560318 13777",
"tables": {
"NB_Global": {
"columns": {
Expand All @@ -10,7 +10,16 @@
"hv_cfg": {"type": {"key": "integer"}},
"external_ids": {
"type": {"key": "string", "value": "string",
"min": 0, "max": "unlimited"}}},
"min": 0, "max": "unlimited"}},
"connections": {
"type": {"key": {"type": "uuid",
"refTable": "Connection"},
"min": 0,
"max": "unlimited"}},
"ssl": {
"type": {"key": {"type": "uuid",
"refTable": "SSL"},
"min": 0, "max": 1}}},
"maxRows": 1,
"isRoot": true},
"Logical_Switch": {
Expand Down Expand Up @@ -221,6 +230,40 @@
"external_ids": {
"type": {"key": "string", "value": "string",
"min": 0, "max": "unlimited"}}},
"isRoot": true}
}
}
"isRoot": true},
"Connection": {
"columns": {
"target": {"type": "string"},
"max_backoff": {"type": {"key": {"type": "integer",
"minInteger": 1000},
"min": 0,
"max": 1}},
"inactivity_probe": {"type": {"key": "integer",
"min": 0,
"max": 1}},
"other_config": {"type": {"key": "string",
"value": "string",
"min": 0,
"max": "unlimited"}},
"external_ids": {"type": {"key": "string",
"value": "string",
"min": 0,
"max": "unlimited"}},
"is_connected": {"type": "boolean", "ephemeral": true},
"status": {"type": {"key": "string",
"value": "string",
"min": 0,
"max": "unlimited"},
"ephemeral": true}},
"indexes": [["target"]]},
"SSL": {
"columns": {
"private_key": {"type": "string"},
"certificate": {"type": "string"},
"ca_cert": {"type": "string"},
"bootstrap_ca_cert": {"type": "boolean"},
"external_ids": {"type": {"key": "string",
"value": "string",
"min": 0,
"max": "unlimited"}}},
"maxRows": 1}}}
288 changes: 288 additions & 0 deletions ovn/ovn-nb.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,17 @@
See <em>External IDs</em> at the beginning of this document.
</column>
</group>
<group title="Connection Options">
<column name="connections">
Database clients to which the Open vSwitch database server should
connect or on which it should listen, along with options for how these
connections should be configured. See the <ref table="Connection"/>
table for more information.
</column>
<column name="ssl">
Global SSL configuration.
</column>
</group>
</table>

<table name="Logical_Switch" title="L2 logical switch">
Expand Down Expand Up @@ -1503,4 +1514,281 @@
</column>
</group>
</table>

<table name="Connection" title="OVSDB client connections.">
<p>
Configuration for a database connection to an Open vSwitch database
(OVSDB) client.
</p>

<p>
This table primarily configures the Open vSwitch database server
(<code>ovsdb-server</code>).
</p>

<p>
The Open vSwitch database server can initiate and maintain active
connections to remote clients. It can also listen for database
connections.
</p>

<group title="Core Features">
<column name="target">
<p>Connection methods for clients.</p>
<p>
The following connection methods are currently supported:
</p>
<dl>
<dt><code>ssl:<var>ip</var></code>[<code>:<var>port</var></code>]</dt>
<dd>
<p>
The specified SSL <var>port</var> on the host at the given
<var>ip</var>, which must be expressed as an IP address
(not a DNS name). A valid SSL configuration must be provided
when this form is used, this configuration can be specified
via command-line options or the <ref table="SSL"/> table.
</p>
<p>
If <var>port</var> is not specified, it defaults to 6640.
</p>
<p>
SSL support is an optional feature that is not always
built as part of Open vSwitch.
</p>
</dd>

<dt><code>tcp:<var>ip</var></code>[<code>:<var>port</var></code>]</dt>
<dd>
<p>
The specified TCP <var>port</var> on the host at the given
<var>ip</var>, which must be expressed as an IP address (not a
DNS name), where <var>ip</var> can be IPv4 or IPv6 address. If
<var>ip</var> is an IPv6 address, wrap it in square brackets,
e.g. <code>tcp:[::1]:6640</code>.
</p>
<p>
If <var>port</var> is not specified, it defaults to 6640.
</p>
</dd>
<dt><code>pssl:</code>[<var>port</var>][<code>:<var>ip</var></code>]</dt>
<dd>
<p>
Listens for SSL connections on the specified TCP <var>port</var>.
Specify 0 for <var>port</var> to have the kernel automatically
choose an available port. If <var>ip</var>, which must be
expressed as an IP address (not a DNS name), is specified, then
connections are restricted to the specified local IP address
(either IPv4 or IPv6 address). If <var>ip</var> is an IPv6
address, wrap in square brackets,
e.g. <code>pssl:6640:[::1]</code>. If <var>ip</var> is not
specified then it listens only on IPv4 (but not IPv6) addresses.
A valid SSL configuration must be provided when this form is used,
this can be specified either via command-line options or the
<ref table="SSL"/> table.
</p>
<p>
If <var>port</var> is not specified, it defaults to 6640.
</p>
<p>
SSL support is an optional feature that is not always built as
part of Open vSwitch.
</p>
</dd>
<dt><code>ptcp:</code>[<var>port</var>][<code>:<var>ip</var></code>]</dt>
<dd>
<p>
Listens for connections on the specified TCP <var>port</var>.
Specify 0 for <var>port</var> to have the kernel automatically
choose an available port. If <var>ip</var>, which must be
expressed as an IP address (not a DNS name), is specified, then
connections are restricted to the specified local IP address
(either IPv4 or IPv6 address). If <var>ip</var> is an IPv6
address, wrap it in square brackets,
e.g. <code>ptcp:6640:[::1]</code>. If <var>ip</var> is not
specified then it listens only on IPv4 addresses.
</p>
<p>
If <var>port</var> is not specified, it defaults to 6640.
</p>
</dd>
</dl>
<p>When multiple clients are configured, the <ref column="target"/>
values must be unique. Duplicate <ref column="target"/> values yield
unspecified results.</p>
</column>
</group>

<group title="Client Failure Detection and Handling">
<column name="max_backoff">
Maximum number of milliseconds to wait between connection attempts.
Default is implementation-specific.
</column>

<column name="inactivity_probe">
Maximum number of milliseconds of idle time on connection to the client
before sending an inactivity probe message. If Open vSwitch does not
communicate with the client for the specified number of seconds, it
will send a probe. If a response is not received for the same
additional amount of time, Open vSwitch assumes the connection has been
broken and attempts to reconnect. Default is implementation-specific.
A value of 0 disables inactivity probes.
</column>
</group>

<group title="Status">
<p>
Key-value pair of <ref column="is_connected"/> is always updated.
Other key-value pairs in the status columns may be updated depends
on the <ref column="target"/> type.
</p>

<p>
When <ref column="target"/> specifies a connection method that
listens for inbound connections (e.g. <code>ptcp:</code> or
<code>punix:</code>), both <ref column="n_connections"/> and
<ref column="is_connected"/> may also be updated while the
remaining key-value pairs are omitted.
</p>

<p>
On the other hand, when <ref column="target"/> specifies an
outbound connection, all key-value pairs may be updated, except
the above-mentioned two key-value pairs associated with inbound
connection targets. They are omitted.
</p>

<column name="is_connected">
<code>true</code> if currently connected to this client,
<code>false</code> otherwise.
</column>

<column name="status" key="last_error">
A human-readable description of the last error on the connection
to the manager; i.e. <code>strerror(errno)</code>. This key
will exist only if an error has occurred.
</column>

<column name="status" key="state"
type='{"type": "string", "enum": ["set", ["VOID", "BACKOFF", "CONNECTING", "ACTIVE", "IDLE"]]}'>
<p>
The state of the connection to the manager:
</p>
<dl>
<dt><code>VOID</code></dt>
<dd>Connection is disabled.</dd>

<dt><code>BACKOFF</code></dt>
<dd>Attempting to reconnect at an increasing period.</dd>

<dt><code>CONNECTING</code></dt>
<dd>Attempting to connect.</dd>

<dt><code>ACTIVE</code></dt>
<dd>Connected, remote host responsive.</dd>

<dt><code>IDLE</code></dt>
<dd>Connection is idle. Waiting for response to keep-alive.</dd>
</dl>
<p>
These values may change in the future. They are provided only for
human consumption.
</p>
</column>

<column name="status" key="sec_since_connect"
type='{"type": "integer", "minInteger": 0}'>
The amount of time since this client last successfully connected
to the database (in seconds). Value is empty if client has never
successfully been connected.
</column>

<column name="status" key="sec_since_disconnect"
type='{"type": "integer", "minInteger": 0}'>
The amount of time since this client last disconnected from the
database (in seconds). Value is empty if client has never
disconnected.
</column>

<column name="status" key="locks_held">
Space-separated list of the names of OVSDB locks that the connection
holds. Omitted if the connection does not hold any locks.
</column>

<column name="status" key="locks_waiting">
Space-separated list of the names of OVSDB locks that the connection is
currently waiting to acquire. Omitted if the connection is not waiting
for any locks.
</column>

<column name="status" key="locks_lost">
Space-separated list of the names of OVSDB locks that the connection
has had stolen by another OVSDB client. Omitted if no locks have been
stolen from this connection.
</column>

<column name="status" key="n_connections"
type='{"type": "integer", "minInteger": 2}'>
When <ref column="target"/> specifies a connection method that
listens for inbound connections (e.g. <code>ptcp:</code> or
<code>pssl:</code>) and more than one connection is actually active,
the value is the number of active connections. Otherwise, this
key-value pair is omitted.
</column>

<column name="status" key="bound_port" type='{"type": "integer"}'>
When <ref column="target"/> is <code>ptcp:</code> or
<code>pssl:</code>, this is the TCP port on which the OVSDB server is
listening. (This is particularly useful when <ref
column="target"/> specifies a port of 0, allowing the kernel to
choose any available port.)
</column>
</group>

<group title="Common Columns">
The overall purpose of these columns is described under <code>Common
Columns</code> at the beginning of this document.

<column name="external_ids"/>
<column name="other_config"/>
</group>
</table>
<table name="SSL">
SSL configuration for ovn-nb database access.

<column name="private_key">
Name of a PEM file containing the private key used as the switch's
identity for SSL connections to the controller.
</column>

<column name="certificate">
Name of a PEM file containing a certificate, signed by the
certificate authority (CA) used by the controller and manager,
that certifies the switch's private key, identifying a trustworthy
switch.
</column>

<column name="ca_cert">
Name of a PEM file containing the CA certificate used to verify
that the switch is connected to a trustworthy controller.
</column>

<column name="bootstrap_ca_cert">
If set to <code>true</code>, then Open vSwitch will attempt to
obtain the CA certificate from the controller on its first SSL
connection and save it to the named PEM file. If it is successful,
it will immediately drop the connection and reconnect, and from then
on all SSL connections must be authenticated by a certificate signed
by the CA certificate thus obtained. <em>This option exposes the
SSL connection to a man-in-the-middle attack obtaining the initial
CA certificate.</em> It may still be useful for bootstrapping.
</column>

<group title="Common Columns">
The overall purpose of these columns is described under <code>Common
Columns</code> at the beginning of this document.

<column name="external_ids"/>
</group>
</table>

</database>
Loading

0 comments on commit 821302c

Please sign in to comment.