Ryu BGP sets self-BGP ID as Peer BGP ID in BMP Message.
Signed-off-by: Yuji Oshima <yuji.oshima0x3fd@gmail.com>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Currently, when VLAN ID match field is specified,
ofctl_v1_[23] is compatible with only match combination 1) of
the following three match combinations.
This patch makes it possible to set the all three combinations.
Match combinations for VLAN ID :
1) To match only packets with VLAN tag and VID equal value
2) To match only packets without a VLAN tag
3) To match only packets with a VLAN tag regardless of its value
In order to set the match combinations 2) or 3), please describe
"dl_vlan" field as hexadecimal string value like as follows.
Before applying this patch:
{"dl_vlan": 3 } # int
After applying this patch:
{"dl_vlan": 3 } # int (same as before applying)
{"dl_vlan": "0x0000"} # hexadecimal string without mask
{"dl_vlan": "0x1000/0x1000"} # hexadecimal string with mask
NOTE: When "dl_vlan" field is described as decimal int value,
OFPVID_PRESENT(0x1000) bit is automatically applied.
OTOH, OFPVID_PRESENT(0x1000) bit is NOT automatically applied
to hexadecimal string value.
For curl command examples, please refer to the following page in Ryu-documentation.
http://ryu.readthedocs.org/en/latest/app/ofctl_rest.html#example-of-vlan-id-match-field
Signed-off-by: Minoru TAKAHASHI <takahashi.minoru7@gmail.com>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
I'm very sorry I didn't include rest_firewall.py and rest_qos.py in my patch.
I suggested for ofctl_rest.py only...
Here is the patch for rest_firewall.py and rest_qos.py.
---------------------------------------------------------------
Subject: [PATCH] fix security problem of some RESTful apps
It is not safe to use eval function because input data(request body) is not checked
For example, someone can send this data to remove all files in the directory
"import('os').system('rm -rf .')"
I suggest to use json.loads to parse the request body if the data is json format
or disable builtin functions like:
eval(req.body, {"__builtins__":None})
Signed-off-by: Takeshi <a86487817@gmail.com>
Signed-off-by: IWASE Yusuke <iwase.yusuke0@gmail.com>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
RyuBGP doesn't work properly becase of handling wrong nexthop address.
Therefore, in spite of receiving BGP UPDATE Message in the peering router,
the router fails to learn a new route entry from RyuBGP in BGP table.
(Memo: this issue has not occurred in Vpnv4/mpBGP environment.)
(1) register route entry as prefix_add(prefix='x,x,x,x', next_hop='y.y.y.y')
static eBGP
------- R1 ------------ RyuBGP ---------> Router
x.x.x.x y.y.y.y z.z.z.z => Drop UPDATE(Nexthop: y.y.y.y)
(2) receiving BGP UPDATE Message from iBGP session
iBGP eBGP
------- R1 -----------> RyuBGP ---------> Router
x.x.x.x y.y.y.y z.z.z.z => Drop UPDATE(Nexthop: y.y.y.y)
Signed-off-by: Toshiki Tsuboi <t.tsubo2000@gmail.com>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
The parameter buf is an instance of bytearray, but Ryu tries to convert it as string,
and outputs the error messages as a result.
This patch fixes this problem.
Signed-off-by: IWASE Yusuke <iwase.yusuke0@gmail.com>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
RyuBGP doesn't work well regarding the advertisement of BGP MED Attribute as follows.
(1) In spite of receiving BGP MED:"500" from iBGP(R2), RyuBGP can't advertise BGP MED:"100" to eBGP(R3).
R1 -------------> R2 -------------> RyuBGP -------------> R3
eBGP(MED:500) iBGP(MED:500) ^ eBGP(MED:500)
(MED:100)
(2) When RyuBGP has received BGP MED:"200" from eBGP(R3), RyuBGP has sended BGP with missing-MED to iBGP(R2).
As result, PolicyBaseRouting in R2(other RyuBGP) doesn't work properly becase of selecting wrong BestPath.
eBGP(MED:100)
R1 ------------------------------------>+
|
R3 -------------> RyuBGP -------------> R2(RyuBGP) => Wrong result [BestPath is "R3-R2"]
eBGP(MED:200) iBGP(MED:N/A)
Signed-off-by: Toshiki Tsuboi <t.tsubo2000@gmail.com>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
In ryu/app/ofctl_rest.py found some mistypes. Error gets when using
stats/groupdesc/<dpid> and /stats/groupfeatures/<dpid>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
It is not safe to use eval function because input data(request body)
is not checked For example, someone can send this data to remove all
files in the directory "import('os').system('rm -rf .')"
I suggest to use json.loads to parse the request body if the data is
json format or disable builtin functions like: eval(req.body,
{"__builtins__":None})
In this patch, ast.literal_eval() is used to evaluate REST body,
because ofctl_rest needs to be compatible with hexadecimal value
or ascii byte array (e.g. "\x00\x00\x00\x01" in Experimenter)
in order to keep usability.
Signed-off-by: Takeshi <a86487817@gmail.com>
Signed-off-by: IWASE Yusuke <iwase.yusuke0@gmail.com>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
three connect modes are supported
CONNECT_MODE_ACTIVE: try to connect from us. don't listen
CONNECT_MODE_PASSIVE: just listen
CONNECT_MODE_BOTH: try both methods
dynamic change of connect modes is also supported
Signed-off-by: ISHIDA Wataru <ishida.wataru@lab.ntt.co.jp>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
show neighbor sent-routes/received-routes commands used to show the
routes in local rib, but the right behavior is to show adjacency rib
in/out.
Signed-off-by: ISHIDA Wataru <ishida.wataru@lab.ntt.co.jp>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
This avoids to send two packets (FlowMod & PacketOut).
OF v1.3.1 (the specification most switch vendors implemented) mentions
in A.3.4.1 on page 65 that this is a valid way to avoid two packets.
Signed-off-by: Benny Eggerstedt <benjamin.eggerstedt@gmail.com>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Added a logging when running in --verbose as truncated packets in packet_in
have caused some confusion and this would hopefully help others
Signed-off-by: Benjamin Eggerstedt <benjamin.eggerstedt@gmail.com>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
BGPSpeaker is aware of "best_path_change_handler" in MPLS-VPN topology.
This feature is available in calculating Best Path Selection of VPNv4/6 prefixes.
Signed-off-by: Toshiki Tsuboi <t.tsubo2000@gmail.com>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
The match_to_str() function in ryu/lib/ofctl_v1_0.py does not convert
nw_tos correctly. As a result, we cannot obtain nw_tos value of any
flow entry by invoking get_flow_stats()
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Reported by Ian Y. Choi on ryu-devel.
Signed-off-by: IWASE Yusuke <iwase.yusuke0@gmail.com>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Note: It wasn't clear to me which NXM stands for "Extensible" or
"Extended". I chose the latter because it's in the primary
specification. (nicira-ext.h)
Signed-off-by: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
