-
Notifications
You must be signed in to change notification settings - Fork 273
/
Copy pathNEWS
2001 lines (1930 loc) · 104 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Post v25.03.0
-------------
- STT tunnels are no longer supported in ovn-encap-type.
** WARNING ** Existing setups must be fully reconfigured to use Geneve
or VxLAN before upgrading. To avoid potential database conversion issues
all OVN databases should be manually compacted after the reconfiguration.
For instructions see:
https://docs.openvswitch.org/en/latest/ref/ovsdb.7/#compacting-databases
- Added support for "ovn-cleanup-on-exit" config option in Open_vSwitch
external-ids, this option allows to specify if ovn-controller should
perform cleanup when exiting. The "--restart" exit always has priority
to keep the backward compatibility.
- Add additional protocol support for options:activation-strategy. The new
supported protocols are gARP and NA. The option now supports a comma
separated to specify selected group of protocols.
- Add CoPP support for DHCP relay.
- SSL/TLS:
* Support for deprecated TLSv1 and TLSv1.1 protocols on OpenFlow and
database connections is now removed.
- Introduce exclude-router-ips-from-garp in logical_switch_port column
so that the router port IPs are not advertised in the GARPs.
OVN v25.03.0 - 07 Mar 2025
--------------------------
- Added support to choose selection methods - dp_hash or
hash (with specified hash fields) for ECMP routes
while choosing nexthop.
- ovn-ic: Add support for route tag to prevent route learning.
- Support for STT tunnels in ovn-encap-type is deprecated and will be
removed in the next release.
- The LRP option 'centralize_routing' has been removed. The behavior is now
enabled in all cases where it is needed.
- ovn-nb: Changed schema of ovn-nb to make networks optional within Logical
Router Ports.
- Added support for Spine-Leaf topology of logical switches by adding
a new LSP type 'switch' that can directly connect two logical switches.
Supported for both distributed and transit switches.
- Bump python version required for building OVN to 3.7.
- SSL/TLS:
* TLSv1 and TLSv1.1 protocols are deprecated and disabled by default
on OpenFlow and database connections. Use --ssl-protocols to turn
them back on. Support will be fully removed in the next release.
* OpenSSL 1.1.1 or newer is now required for SSL/TLS support.
* The protocol list in --ssl-protocols or corresponding database column
now supports specifying simple protocol ranges like:
- "TLSv1-TLSv1.2" to enable all protocols between TLSv1 and TLSv1.2.
- "TLSv1.2+" to enable protocol TLSv1.2 and later.
The value must be a list of protocols or exactly one protocol range.
* Added explicit support for TLSv1.3. It can now be enabled via
--ssl-protocols (TLSv1.3 was supported in earlier versions only when
this option was not set). TLS ciphersuites for TLSv1.3 and later can
be configured via --ssl-ciphersuites (--ssl-ciphers only applies to
TLSv1.2 and earlier).
- Add "arp-nd-max-timeout-sec" config option to vswitchd external-ids to
configure the interval (in seconds) between ovn-controller originated
ARP/ND packets used for tracking ECMP next hop MAC addresses.
- Auto flush ECMP symmetric reply connection states when an ECMP route is
removed by the CMS. This behavior is controlled by the
"ecmp_nexthop_monitor_enable" config option in the NB_Global table.
Disabled by default.
- Improved handling of IPv6 traffic by enabling address prefix tracking
in OVS for both IPv4 and IPv6 addresses, whenever possible, reducing
the amount of IPv6 datapath flows.
- Add concept of Transit Routers, users are now allowed to specify
options:requested-chassis for router ports; if the chassis is remote
then the router port will behave as a remote port.
- Added a new ACL option "persist-established" that allows for
established connections to bypass ACL matching. This way, if an ACL
match changes, traffic on the established connection can still pass.
- Logical router policies can now be arranged in chains. Using the new
"jump" action, combined with new "chain" and "jump_chain" columns,
allows for policies to be chained together.
- Reduce the max number of local datapath to 1024 when OVN is using VXLAN
encapsulation type in OVN-interconnect mode.
- Added vxlan_mode parameter in IC_NB_GLOBAL option column to enable or
disable VXLAN encapsulation type in OVN-interconnect mode.
- Dynamic Routing:
* Add the option "dynamic-routing" to Logical Routers. If set to true
static and connected routes matching the filter below are shared to the
southbound "Advertised_Route" table for sharing outside of OVN.
The routes can further be configured by setting
`dynamic-routing-redistribute` on the LR or LRP. The LRP settings
overwrite the LR settings for all routes using this interface to
forward traffic on.
* Allow Logical Routers to dynamically learn routes from outside the
fabric. Routes entered into the "Learned_Route" table in the southbound
database will be learned by the respective LR. They are included in the
route table with a lower priority than static routes.
* Add the option value "connected-as-host" to the
"dynamic-routing-redistribute" LR and LRP option. If set then connected
routes are announced as individual host routes.
* Add the option "dynamic-routing-maintain-vrf" to LRPs. If set the
ovn-controller will create a vrf named "ovnvrf" + datapath id that
includes all advertised and learned routes.
The vrf name can be overwritten with the "dynamic-routing-vrf-name"
setting.
* Add the option "dynamic-routing-port-name" to LRPs. If set only routes
learned from a linux interfaces that is locally bound to the referenced
LSP will be learned. Additionally support local overwrites for arbitrary
interface names using "dynamic-routing-port-mapping".
* The logical router port options "routing-protocol-redirect" and
"routing-protocols" are now also usable on distributed gateway ports.
* Logical router port options "routing-protocol-redirect" and
"routing-protocols" are now considered stable. Their "experimental" tag
was removed.
- Add "options:ct-commit-all" to LR, that enables commit of all traffic
to DNAT and SNAT zone when LR is stateful.
OVN v24.09.0 - 13 Sep 2024
--------------------------
- Added a new logical switch port option "pkt_clone_type".
If the value is set to "mc_unknown", packets destined to the port gets
cloned to all unknown ports connected to the same Logical Switch.
- Added a new logical switch port option "disable_arp_nd_rsp" to
disable adding the ARP responder flows if set to true.
- IGMP_Group has new "protocol" column that displays the the group
protocol version.
- Add ovn-debug tool containing two commands.
"lflow-stage-to-ltable STAGE_NAME" that converts stage name into logical
flow table id.
"lflow-stage-to-oftable STAGE_NAME" that converts stage name into OpenFlow
table id.
- Rename the ovs-sandbox script to ovn-sandbox.
- Remove "ovn-set-local-ip" config option from vswitchd
external-ids, the option is no longer needed as it became effectively
"true" for all scenarios.
- Added DHCPv4 relay support.
- A new LSP option "force_fdb_lookup" has been added to ensure the additional
MAC addresses configured on the LSP with "unknown", are learnt via the
OVN native FDB.
- Add support for ovsdb-server `--config-file` option in ovn-ctl.
- Add "ovn-bridge-remote" config option to vswitchd external-ids,
that allows to specify connection method to management bridge for
ovn-controller, defaulting to the unix socket.
- Add "ovn-bridge-remote-probe-interval" config option to vswitchd
external-ids, that sets probe interval for integration bridge connection,
disabled by default.
- The "options:ic-route-blacklist" option in the Northbound NB_Global table
has been renamed to "options:ic-route-denylist" in order to comply with
inclusive language guidelines. The previous name is still recognized to
aid with backwards compatibility.
- NATs can now be given an arbitrary match condition and priority. This
allows for conditional NATs to be configured. See the ovn-nb(5) man
page for more information.
- Added new global config option NB_Global:options:vxlan_mode to support
ability to disable "VXLAN mode" to extend available tunnel IDs space for
datapaths from 4095 to 16711680. For more details see man ovn-nb(5) for
mentioned option.
- Added new global config option NB_Global:options:always_tunnel. If set to
true, the traffic destined to a logical port of a provider logical switch
(having a localnet port) will be tunnelled instead of sending it via the
localnet port.
- Added support to define boundaries (min and max values) for selected ct
zones.
- Add support for CT zone limit that can be specified per LR
(options:ct-zone-limit), LS (other_config:ct-zone-limit) or LSP
(options:ct-zone-limit).
- A new LSP option "disable_garp_rarp" has been added to prevent OVN from
sending GARP or RARP announcements when a VIF is created on a bridged
logical switch.
- A new LRP option 'centralize_routing' has been added to a
distributed gateway port to centralize routing if the logical
switch of its peer doesn't have a localnet port.
- The NB_Global.debug_drop_domain_id configured value is now overridden by
the ID associated with the Sampling_App record created for drop sampling
(Sampling_App.type configured as "drop").
- Add support for ACL sampling through the new Sample_Collector and Sample
tables. Sampling is supported for both traffic that creates new
connections and for traffic that is part of an existing connection.
- Add "external_ids:ovn-encap-ip-default" config for ovn-controller to
determine the default encap IP when there are multiple encap IPs
configured.
- Added a new column in the southbound database "flow_desc" to provide
human readable context to flows.
- Added two new experimental logical router port options,
"routing-protocol-redirect" and "routing-protocols", that allow
redirection of routing protocol traffic received by a router port
to a different logical switch port.
- Allow Static Routes where the address families of ip_prefix and nexthop
diverge (e.g. IPv4 packets over IPv6 links). This is currently limited to
nexthops that have their mac addresses prepopulated (so
dynamic_neigh_routers must be false).
OVN v24.03.0 - 01 Mar 2024
--------------------------
- DNS now have an "options" column for configuration of extra options.
- A new DNS option "ovn-owned" has been added to allow defining domains
that are owned only by ovn, queries for that domain will not be processed
externally.
- Disable OpenFlow inactivity probing between ovn-controller and OVS.
OF connection is established over unix socket, which is a reliable
connection method and doesn't require additional probing.
external_ids:ovn-openflow-probe-interval configuration option for
ovn-controller no longer matters and is ignored.
- Support CIDR based MAC binding aging threshold. See ovn-nb(5) for
'mac_binding_age_threshold' for more details.
- ovn-northd-ddlog has been removed.
- A new LSP option "enable_router_port_acl" has been added to enable
conntrack for the router port whose peer is l3dgw_port if set it true.
- Enable PMTU discovery on geneve/vxlan tunnels for E/W traffic.
- Support selecting encapsulation IP based on the source/destination VIF's
settting. See ovn-controller(8) 'external_ids:ovn-encap-ip' for more
details.
- Introduce next-hop BFD availability check for OVN reroute policies.
- Add the capability to mark (through pkt.mark) incoming/outgoing packets
in the logical switch datapath according to user configured QoS rule.
- OVN Interconnection:
* INB provides basic feedback to the CMS about the ISB changes
handling status.
* IC_NB_Global now have "nb_ic_cfg" and "sb_ic_cfg" columns for
for ISB informational status.
* IC_SB_Global now have "nb_ic_cfg" column for ISB informational status.
* Availability_Zone now have "nb_ic_cfg" column for local AZ
informational status.
OVN v23.09.0 - 15 Sep 2023
--------------------------
- Added FDB aging mechanism, that is disabled by default.
It can be enabled per logical switch with other_config
"fdb_age_threshold".
- Add DHCPv6 "fqdn" (39) option, that works similarly to
DHCPv4 "hostname" (12) option.
- Support to create/update MAC_Binding when GARP received from VTEP (RAMP)
switch on l3dgw port.
- To allow optimizing ovn-controller's monitor conditions for the regular
VIF case, ovn-controller now unconditionally monitors all sub-ports
(ports with parent_port set).
- ECMP routes use L4_SYM dp-hash by default if the datapath supports it.
Existing sessions might get re-hashed to a different ECMP path when
OVN detects the algorithm support in the datapath during an upgrade
or restart of ovn-controller.
- Add "northd-backoff-interval-ms" config option to delay northd engine
runs capped at the set value.
- Add "garp-max-timeout-sec" config option to vswitchd external-ids to
cap the time between when ovn-controller sends gARP packets.
- Introduce support for binding remote ports in ovn-northd if the CMS sets
requested-chassis option for a remote logical switch port.
- Added support to reply success for DHCPv6 Release messages.
OVN v23.06.0 - 01 Jun 2023
--------------------------
- Enhance LSP.options:arp_proxy to support IPv6, configurable MAC
addresses and CIDRs.
- CT entries are not flushed by default anymore whenever a load balancer
backend is removed. A new, per-LB, option 'ct_flush' can be used to
restore the previous behavior. Disabled by default.
- Add support to configure OVSDB inactivity probe interval for ovn-ic and
ovn-controller-vtep.
- Add LS.other_config:broadcast-arps-to-all-routers. If false then arp
requests are only send to Logical Routers on that Logical Switch if the
target mac address matches. Arp requests matching no Logical Router will
only be forwarded to non-router ports. Default is true which keeps the
existing behaviour of flooding these arp requests to all attached Ports.
- Always allow IPv6 Router Discovery, Neighbor Discovery, and Multicast
Listener Discovery protocols, regardless of ACLs defined.
- Add IPv6 iPXE support introducing "bootfile_name" (59) and
"bootfile_name_alt" (254) options to ovn dhcpv6 server.
- Support using local OVS port as port-mirroring target, and also support
'both' directions for the 'filter' field.
- Increased ovn-{ic-,}{n,s}bctl default OVSDB inactivity probe interval from
5000 ms to 120000 ms to give the ability to connect to large databases
(mainly, OVN_Southbound). Also, for daemon mode it is possible to
configure inactivity probe interval via OVN_Northbound and OVN_Southbound
databases for ovn-nbctl and ovn-sbctl respectively. See man ovn-nb and
man ovn-sb for 'nbctl_probe_interval' and 'sbctl_probe_interval'
options for more details.
- Rework OVN egress QoS implementation in order to rely on OvS interface
instead of directly running tc from OVN. Get rid of traffic shaping on the
tunnel interfaces. Now for LSPs running on a LogicalSwitch with a localnet
port is possible to define QoS rules to apply to the local egress localnet
port. Please note now the QoS will be applied just to the local localnet
port and not to all localnet port marked with ovn-egress iface.
- Support for tiered ACLs has been added. This allows for ACLs to be layered
into separate tiers of priority. For more information, please see the
ovn-nb and ovn-northd manpages.
- Send ICMP Fragmentation Needed packets back to offending ports when
communicating with multichassis ports using frames that don't fit through a
tunnel. This is done only for logical switches that are attached to a
physical network via a localnet port, in which case multichassis ports may
have an effective MTU different from regular ports and hence may need this
mechanism to maintain connectivity with other peers in the network.
OVN v23.03.0 - 03 Mar 2023
--------------------------
- ovn-controller: Experimental support for co-hosting multiple controller
instances on the same host.
- Add ovn-ctl commands for (re)starting/stopping OVSDB relay for OVN SB DB.
- Add new [email protected] systemd unit to run ovsdb-servers in separate
systemd units.
OVN v22.12.0 - 16 Dec 2022
--------------------------
- Add load balancer "affinity_timeout" option to configure load balancing
of traffic from a particular client to the same backend for a given
period of time.
- ovn-northd: Add configuration knobs to enable drop sampling using OVS's
per-flow IPFIX sampling.
- Add support for component templates within logical flows and load
balancers.
- Add support for remote port mirroring (Experimental).
- Add new OVN IC Route table index. This index ensures no duplicate routes
can be advertized. When upgrading to this version user must ensure that
all ovn-ic daemons in all availability zones are upgraded before ovn-ic SB
database schema is converted.
OVN v22.09.0 - 16 Sep 2022
--------------------------
- ovn-controller: Add configuration knob, through OVS external-id
"ovn-encap-df_default" to enable or disable tunnel DF flag.
- Add option "localnet_learn_fdb" to LSP that will allow localnet
ports to learn MAC addresses and store them in FDB table.
- northd: introduce the capability to automatically deploy a load-balancer
on each logical-switch connected to a logical router where the
load-balancer has been installed by the CMS. In order to enable the
feature the CMS has to set install_ls_lb_from_router to true in option
column of NB_Global table.
- Added nb_global IPsec options ipsec_encapsulation=true (libreswan)
and ipsec_forceencaps=true (strongswan) to unconditionally enforce
NAT-T UDP encapsulation. Requires OVS support for IPsec custom tunnel
options (which is available in OVS 3.0).
- Removed possibility of disabling logical datapath groups.
- Removed the copying of SB's Chassis other_config into external_ids.
- Added MAC binding aging mechanism, that is disabled by default.
It can be enabled per logical router with option
"mac_binding_age_threshold".
- If it is needed to create Load Balancer within LR with VIP, which matches
any of LR's LRP IP, there is no need to create SNAT entry. Now such
traffic destined to LRP IP is not dropped.
- Bump python version required for building OVN to 3.6.
OVN v22.06.0 - 03 Jun 2022
--------------------------
- Support IGMP and MLD snooping on transit logical switches that connect
different OVN Interconnection availability zones.
- Replaced the usage of masked ct_label by ct_mark in most cases to work
better with hardware-offloading.
- Support NAT for logical routers with multiple distributed gateway ports.
- Add global option (NB_Global.options:default_acl_drop) to enable
implicit drop behavior on logical switches with ACLs applied.
- Support (LSP.options:qos_min_rate) to guarantee minimal bandwidth available
for a logical port.
- Add NB.Load_Balancer.options:neighbor_responder to allow the CMS to
explicitly request routers to reply to any ARP/ND request for a VIP
(when set to "all") and only for reachable VIPs (when set to "reachable"
or by default).
- Changed the way to enable northd parallelization.
Removed support for:
- use_parallel_build in NBDB.
- --dummy-numa in northd cmdline.
Added support for:
- --n-threads=<N> in northd cmdline.
- set-n-threads/get-n-threads unixctls.
- --ovn-northd-n-threads command line argument in ovn-ctl
- Added support for setting the Next server IP in the DHCP header
using the private DHCP option - 253 in native OVN DHCPv4 responder.
- Support list of chassis for Logical_Switch_Port:options:requested-chassis.
- Support Logical_Switch_Port:options:activation-strategy for live migration
scenarios.
OVN v22.03.0 - 11 Mar 2022
--------------------------
- Refactor CoPP commands introducing a unique name index in CoPP NB table.
Add following new CoPP commands to manage CoPP table:
- ovn-nbctl copp-add <name> <proto> <meter>
- ovn-nbctl copp-del <name> <proto>
- ovn-nbctl copp-list <name>
- ovn-nbctl ls-copp-add <name> <switch>
- ovn-nbctl lr-copp-add <name> <router>
- Support version pinning between ovn-northd and ovn-controller-vtep as an
option. If the option is enabled and the versions don't match,
ovn-controller-vtep will not process any DB changes.
- When configured to log packtes matching ACLs, log the direction (logical
pipeline) too.
- Introduce exclude-lb-vips-from-garp in logical_switch_port column in order
to not advertise lbs VIPs in GARPs sent by the logical router.
- ACLs now have an "options" column for configuration of extra options.
- A new ACL option, "log-related" has been added that allows for reply and
related traffic to be logged for an ACL in addition to the traffic that
directly matches the ACL.
OVN v21.12.0 - 22 Dec 2021
--------------------------
- Set ignore_lsp_down to true as default, so that ARP responder flows are
installed together with other flows when a logical switch port is created,
without having to wait for the port to be UP. CMS should set it to false
if not desired.
- Added Load_Balancer_Group support, which simplifies large scale
configurations of load balancers.
- Introduced infrastructure for VIF plug providers. When OVN is linked with
an appropriate VIF plug provider CMS can request OVN to plug lports. This
is particularly useful in topologies where the ovn-controller process is
running on SmartNIC control plane CPUs. Please refer to
Documentation/topics/vif-plug-providers/vif-plug-providers.rst for more
information.
- Added Logical_Router_Port "gateway_mtu_bypass" option.
- Added new "inc-engine/recompute" command to all incremental processing
engine clients (ovn-northd and ovn-controller).
- ovn-controller: Add configuration knob, through OVS external-id
"ovn-trim-timeout-ms" to allow specifiying an lflow cache inactivity
timeout after which ovn-controller should trim memory.
OVN v21.09.0 - 01 Oct 2021
--------------------------
- Added Control Plane Protection support (control plane traffic metering).
- Added path MTU discovery for ingress traffic originated outside of the
cluster.
- Introduced a new "label" field for "allow" and "allow-related" ACLs
which helps in debugging/backtracking the ACL which allowed a particular
connection.
- Allow static routes without nexthops.
- Enabled logical dp groups as a default. CMS should disable it if not
desired.
- Added support for multiple routing tables in Logical Router Static Routes
and LRPs. OVN Interconnection supports routes' route tables as well.
This requires to update schemas for OVN_Northdbound and OVN_IC_Southbound
DBs.
OVN v21.06.0 - 18 Jun 2021
-------------------------
- ovn-northd-ddlog: New implementation of northd, based on DDlog. This
implementation is incremental, meaning that it only recalculates what is
needed for the southbound database when northbound changes occur. It is
expected to scale better than the C implementation, for large deployments.
(This may take testing and tuning to be effective.) This version of OVN
requires DDLog 0.38.
- Introduce ovn-controller incremental processing engine statistics
- Introduced parallel processing in ovn-northd with the NB_Global config option
'use_parallel_build' to enable it. It is disabled by default.
- Support vlan-passthru mode for tag=0 localnet ports.
- Support custom 802.11ad EthType for localnet ports.
- Add a new NB Global option - use_ct_inv_match with the default value of
true. If this is set to false, then the logical field - "ct.inv" will not
be used in the logical flow matches. CMS can consider setting this to
false, if they want to use smart NICs which don't support offloading
datapath flows with this field used.
- Introduce a new "allow-stateless" ACL verb to always bypass connection
tracking. The existing "allow" verb behavior is left intact.
- Added support in native DNS to respond to PTR request types.
- ovn-nbctl daemon mode is no longer considered experimental.
- Utilities:
* ovn-nbctl daemon mode is no longer considered experimental.
* ovn-sbctl now also supports daemon mode.
- Added support in native DNS to respond to PTR request types.
- New --dry-run option for ovn-northd and ovn-northd-ddlog.
- ovn-controller: Add configuration knobs, through OVS external-id
"ovn-trim-limit-lflow-cache" and "ovn-trim-wmark-perc-lflow-cache", to
allow enforcing a lflow cache size limit and high watermark percentage
for which automatic memory trimming is performed.
- Support multiple distributed gateway ports on a single logical router.
(NAT and load-balancer are not supported yet when there are multiple
distributed gateway ports).
OVN v21.03.0 - 12 Mar 2021
-------------------------
- Support ECMP multiple nexthops for reroute router policies.
- BFD protocol support according to RFC880 [0]. Introduce next-hop BFD
availability check for OVN static routes.
[0] https://tools.ietf.org/html/rfc5880)
- Change the semantic of the "Logical_Switch_Port.up" field such that it is
set to "true" only when all corresponding OVS openflow operations have
been processed. This also introduces a new "OVS.Interface.external-id",
"ovn-installed". This external-id is set by ovn-controller only after all
openflow operations corresponding to the OVS interface being added have
been processed.
- ovn-ctl: Added new command line argument '--ovsdb-disable-file-column-diff'
to support ovsdb-server upgrades from version 2.14 and earlier to
2.15 and later. See ovsdb(7) for more details.
- Add a new option to Load_Balancer.options, "hairpin_snat_ip", to allow
users to explicitly select which source IP should be used for load
balancer hairpin traffic.
- ovn-controller: Add configuration knobs, through OVS external-id
"ovn-limit-lflow-cache" and "ovn-memlimit-lflow-cache-kb", to allow
enforcing a limit for the size of the logical flow cache based on
maximum number of entries and/or memory usage.
- ovn-controller: Add lflow cache related memory reports.
OVN v20.12.0 - 18 Dec 2020
--------------------------
- The "datapath" argument to ovn-trace is now optional, since the
datapath can be inferred from the inport (which is required).
- The obsolete "redirect-chassis" way to configure gateways has been
removed. See ovn-nb(5) for advice on how to update your config if needed.
- Add IPv4 iPXE support introducing "bootfile_name_alt" option to ovn dhcp
server.
- Support other_config:vlan-passthru=true to allow VLAN tagged incoming
traffic.
- Propagate currently processed SB_Global.nb_cfg in ovn-controller to the
local OVS DB integration bridge external_ids:ovn-nb-cfg.
- Support version pinning between ovn-northd and ovn-controller as an
option. If the option is enabled and the versions don't match,
ovn-controller will not process any DB changes.
- Add "fair" column in Meter table to allow multiple ACL logs to use the
same Meter while being rate-limited independently.
- New configuration option for northd 'options:use_logical_dp_groups=true'
to enable combining of logical flows by logical datapath. This should
significantly decrease size of a Southbound DB. However, in some cases,
it could have performance penalty for ovn-controller. Disabled by
default.
OVN v20.09.0 - 28 Sep 2020
--------------------------
- Added packet marking support for traffic routed with
a routing policy.
- Added DHCPINFORM and DHCPRELEASE support in native
OVN DHCPv4 responder.
- Added support for DHCP domain search option (119) in native
OVN DHCPv4 responder.
- The nb_cfg column from the Chassis table in the OVN Southbound
database has been deprecated and is no longer updated. A new table
called Chassis_Private now contains the nb_cfg column which is updated
by incrementing the value in the NB_Global table, CMSes relying on
this mechanism should update their code to use this new table.
- Added support for external ip based NAT. Now, besides the logical ip,
external ips will also decide if a packet will be NATed or not.
- Added support for VXLAN encapsulation (not just for ramp/VTEP switches).
OVN v20.06.0
--------------------------
- Added support for external_port_range in NAT table.
- ovn-controller no longer monitor the external_ids column from
the Chassis table. This was done to avoid having to do a flow
recalculation every time external systems wrote to this column. The
chassis configuration has now being moved to a new column called
"other_config". As a note, the configurations are still be written to
the external_ids column (but no longer triggers an alert) to
keep the backward compatibility with current systems that may be
reading it from that column but, this behavior will be removed
in the future.
- Added IPv6 Prefix Delegation support in OVN.
- OVN now uses OpenFlow 1.5.
- Added support to choose selection methods - dp_hash or
hash (with specified hash fields) for OVN load balancer
backend selection. This is incompatible with older versions.
Care should be taken while upgrading as the existing
load balancer traffic will be affected if ovn-controllers
are not stopped before uprading northd services.
- Added limited support for logical switches with multiple localnet ports.
The feature requires that no chassis has two or more physical networks
with localnet ports that belong to the same logical switch mapped. Routing
between the ports to be implemented by fabric.
- OVN Interconnection:
* Support for L3 interconnection of multiple OVN deployments with tunnels
managed by OVN. See instructions in
Documentation/tutorials/ovn-interconnection.rst.
OVN v20.03.0 - 04 Feb 2020
--------------------------
- OVN was split out from the OVS repository and is now released
independently.
- Added IPv6 NAT support for OVN routers.
- Added Stateless Floating IP support in OVN.
- Added Forwarding Group support in OVN.
- Added support for MLD Snooping and MLD Querier.
- Added support for ECMP routes in OVN router.
v2.12.0 - 03 Sep 2019
---------------------
- DPDK:
* New option 'other_config:dpdk-socket-limit' to limit amount of
hugepage memory that can be used by DPDK.
* Add support for vHost Post-copy Live Migration (experimental).
* OVS validated with DPDK 18.11.2 which is the new minimal supported
version.
* DPDK 18.11.1 and lower is no longer supported.
* New option 'tx-retries-max' to set the maximum amount of vhost tx
retries that can be made.
- OpenFlow:
* All features required by OpenFlow 1.5 are now implemented, so
ovs-vswitchd now enables OpenFlow 1.5 by default (in addition to
OpenFlow 1.0 to 1.4).
* Removed support for OpenFlow 1.6 (draft), which ONF abandoned.
* New action "check_pkt_larger".
* Support for OpenFlow 1.5 "meter" action.
- Userspace datapath:
* ICMPv6 ND enhancements: support for match and set ND options type
and reserved fields.
* Add v4/v6 fragmentation support for conntrack.
* New ovs-appctl "dpctl/ipf-set-enabled" and "dpctl/ipf-set-disabled"
commands for userspace datapath conntrack fragmentation support.
* New "ovs-appctl dpctl/ipf-set-min-frag" command for userspace
datapath conntrack fragmentation support.
* New "ovs-appctl dpctl/ipf-set-max-nfrags" command for userspace datapath
conntrack fragmentation support.
* New "ovs-appctl dpctl/ipf-get-status" command for userspace datapath
conntrack fragmentation support.
* New action "check_pkt_len".
* Port configuration with "other-config:priority-tags" now has a mode
that retains the 802.1Q header even if VLAN and priority are both zero.
* 'ovs-appctl exit' now implies cleanup of non-internal ports in userspace
datapath regardless of '--cleanup' option. Use '--cleanup' to remove
internal ports too.
* Removed experimental tag for SMC cache.
* Datapath classifer code refactored to enable function pointers to select
the lookup implementation at runtime. This enables specialization of
specific subtables based on the miniflow attributes, enhancing the
performance of the subtable search.
* Add Linux AF_XDP support through a new experimental netdev type "afxdp".
- OVSDB:
* OVSDB clients can now resynchronize with clustered servers much more
quickly after a brief disconnection, saving bandwidth and CPU time.
See section 4.1.15 of ovsdb-server(7) for details of related OVSDB
protocol extension.
* Support to convert from cluster database to standalone database is now
available when clustered is down and cannot be revived using ovsdb-tool
. Check "Database Migration Commands" in ovsdb-tool man section.
- OVN:
* IPAM/MACAM:
- select IPAM mac_prefix in a random manner if not provided by the user
- add the capability to specify a static IPv4 and/or IPv6 address and
get the L2 one allocated dynamically using the following syntax:
ovn-nbctl lsp-set-addresses <port> "dynamic <IPv4 addr> <IPv6 addr>"
* Added the HA chassis group support.
* Added 'external' logical port support.
* Added Policy-based routing(PBR) support to create permit/deny/reroute
policies on the logical router. New table(Logical_Router_Policy) added in
OVN-NB schema. New "ovn-nbctl" commands to add/delete/list PBR policies.
* Support for Transport Zones, a way to separate chassis into
logical groups which results in tunnels only been formed between
members of the same transport zone(s).
* Support for IGMP Snooping and IGMP Querier.
- New QoS type "linux-netem" on Linux.
- Added support for TLS Server Name Indication (SNI).
- Linux datapath:
* Support for the kernel versions 4.19.x and 4.20.x.
* Support for the kernel version 5.0.x.
* Add support for conntrack zone-based timeout policy.
- 'ovs-dpctl dump-flows' is no longer suitable for dumping offloaded flows.
'ovs-appctl dpctl/dump-flows' should be used instead.
- Add L2 GRE tunnel over IPv6 support.
v2.11.0 - 19 Feb 2019
---------------------
- OpenFlow:
* OFPMP_TABLE_FEATURES_REQUEST can now modify table features.
- ovs-ofctl:
* "mod-table" command can now change OpenFlow table names.
- ovn:
* OVN-SB schema changed: duplicated IP with same Encapsulation type
is not allowed any more. Please refer to
Documentation/intro/install/ovn-upgrades.rst for the instructions
in case there are problems encountered when upgrading from an earlier
version.
* New support for IPSEC encrypted tunnels between hypervisors.
* ovn-ctl: allow passing user:group ids to the OVN daemons.
* IPAM/MACAM:
- add the capability to dynamically assign just L2 addresses
- add the capability to specify a static ip address and get the L2 one
allocated dynamically using the following syntax:
ovn-nbctl lsp-set-addresses <port> "dynamic <IP>"
- DPDK:
* Add support for DPDK 18.11
* Add support for port representors.
- Userspace datapath:
* Add option for simple round-robin based Rxq to PMD assignment.
It can be set with pmd-rxq-assign.
* Add support for Auto load balancing of PMDs (experimental)
* Added new per-port configurable option to manage EMC:
'other_config:emc-enable'.
- Add 'symmetric_l3' hash function.
- OVS now honors 'updelay' and 'downdelay' for bonds with LACP configured.
- ovs-vswitchd:
* New configuration option "offload-rebalance", that enables dynamic
rebalancing of offloaded flows.
- The environment variable OVS_SYSLOG_METHOD, if set, is now used
as the default syslog method.
- The environment variable OVS_CTL_TIMEOUT, if set, is now used
as the default timeout for control utilities.
- The environment variable OVS_RESOLV_CONF, if set, is now used
as the DNS server configuration file.
- RHEL packaging:
* OVN packages are split from OVS packages. A new spec
file - ovn-fedora.spec.in is added to generate OVN packages.
- Linux datapath:
* Support for the kernel versions 4.16.x, 4.17.x, and 4.18.x.
v2.10.0 - 18 Aug 2018
---------------------
- ovs-vswitchd and utilities now support DNS names in OpenFlow and
OVSDB remotes.
- ovs-vswitchd:
* New options --l7 and --l7-len to "ofproto/trace" command.
* Previous versions gave OpenFlow tables default names of the form
"table#". These are not helpful names for the purpose of accepting
and displaying table names, so now tables by default have no names.
* The "null" interface type, deprecated since 2013, has been removed.
* Add minimum network namespace support for Linux.
* New command "lacp/show-stats"
- ovs-ofctl:
* ovs-ofctl now accepts and display table names in place of numbers. By
default it always accepts names and in interactive use it displays them;
use --names or --no-names to override. See ovs-ofctl(8) for details.
- ovs-vsctl: New commands "add-bond-iface" and "del-bond-iface".
- ovs-dpctl:
* New commands "ct-set-limits", "ct-del-limits", and "ct-get-limits".
- OpenFlow:
* OFPT_ROLE_STATUS is now available in OpenFlow 1.3.
* OpenFlow 1.5 extensible statistics (OXS) now implemented.
* New OpenFlow 1.0 extensions for group support.
* Default selection method for select groups is now dp_hash with improved
accuracy.
- Linux datapath
* Add support for compiling OVS with the latest Linux 4.14 kernel.
* Added support for meters.
* Add support for conntrack zone limit.
- ovn:
* Implemented icmp4/icmp6/tcp_reset actions in order to drop the packet
and reply with a RST for TCP or ICMPv4/ICMPv6 unreachable message for
other IPv4/IPv6-based protocols whenever a reject ACL rule is hit.
* ACL match conditions can now match on Port_Groups as well as address
sets that are automatically generated by Port_Groups. ACLs can be
applied directly to Port_Groups as well.
* ovn-nbctl can now run as a daemon (long-lived, background process).
See ovn-nbctl(8) for details.
- DPDK:
* New 'check-dpdk' Makefile target to run a new system testsuite.
See Testing topic for the details.
* Add LSC interrupt support for DPDK physical devices.
* Allow init to fail and record DPDK status/version in OVS database.
* Add experimental flow hardware offload support
* Support both shared and per port mempools for DPDK devices.
- Userspace datapath:
* Commands ovs-appctl dpif-netdev/pmd-*-show can now work on a single PMD
* Detailed PMD performance metrics available with new command
ovs-appctl dpif-netdev/pmd-perf-show
* Supervision of PMD performance metrics and logging of suspicious
iterations
* Add signature match cache (SMC) as experimental feature. When turned on,
it improves throughput when traffic has many more flows than EMC size.
- ERSPAN:
* Implemented ERSPAN protocol (draft-foschiano-erspan-00.txt) for
both kernel datapath and userspace datapath.
* Added port-based and flow-based ERSPAN tunnel port support, added
OpenFlow rules matching ERSPAN fields. See ovs-fields(7).
- ovs-pki
* ovs-pki now generates x.509 version 3 certificate. The new format adds
subjectAltName field and sets its value the same as common name (CN).
v2.9.0 - 19 Feb 2018
--------------------
- NSH implementation now conforms to latest draft (draft-ietf-sfc-nsh-28).
* Add ttl field.
* Add a new action dec_nsh_ttl.
* Enable NSH support in kernel datapath.
- OVSDB has new, experimental support for database clustering:
* New high-level documentation in ovsdb(7).
* New file format documentation for developers in ovsdb(5).
* Protocol documentation moved from ovsdb-server(1) to ovsdb-server(7).
* ovsdb-server now supports online schema conversion via
"ovsdb-client convert".
* ovsdb-server now always hosts a built-in database named _Server. See
ovsdb-server(5) for more details.
* ovsdb-client: New "get-schema-cksum", "query", "backup", "restore",
and "wait" commands. New --timeout option.
* ovsdb-tool: New "create-cluster", "join-cluster", "db-cid", "db-sid",
"db-local-address", "db-is-clustered", "db-is-standalone", "db-name",
"schema-name", "compare-versions", and "check-cluster" commands.
* ovsdb-server: New ovs-appctl commands for managing clusters.
* ovs-sandbox: New support for clustered databases.
- ovs-vsctl and other commands that display data in tables now support a
--max-column-width option to limit column width.
- No longer slow-path traffic that sends to a controller. Applications,
such as OVN ACL logging, want to send a copy of a packet to a
controller while leaving the actual packet forwarding in the datapath.
- OVN:
* The "requested-chassis" option for a logical switch port now accepts a
chassis "hostname" in addition to a chassis "name".
* IPv6
- Added support to send IPv6 Router Advertisement packets in response to
the IPv6 Router Solicitation packets from the VIF ports.
- Added support to generate Neighbor Solicitation packets using the OVN
action 'nd_ns' to resolve unknown next hop MAC addresses for the
IPv6 packets.
* Add support for QoS bandwidth limit with DPDK.
* ovn-ctl: New commands run_nb_ovsdb and run_sb_ovsdb.
* ovn-sbctl, ovn-nbctl: New options --leader-only, --no-leader-only.
- OpenFlow:
* ct_clear action is now backed by kernel datapath. Support is probed for
when OVS starts.
- Linux kernel 4.13
* Add support for compiling OVS with the latest Linux 4.13 kernel
- ovs-dpctl and related ovs-appctl commands:
* "flush-conntrack" now accept a 5-tuple to delete a specific
connection tracking entry.
* New "ct-set-maxconns", "ct-get-maxconns", and "ct-get-nconns" commands
for userspace datapath.
- No longer send packets to the Linux TAP device if it's DOWN unless it is
in another networking namespace.
- DPDK:
* Add support for DPDK v17.11
* Add support for vHost IOMMU
* New debug appctl command 'netdev-dpdk/get-mempool-info'.
* All the netdev-dpdk appctl commands described in ovs-vswitchd man page.
* Custom statistics:
- DPDK physical ports now return custom set of "dropped", "error" and
"management" statistics.
- ovs-ofctl dump-ports command now prints new of set custom statistics
if available (for OpenFlow 1.4+).
* Switch from round-robin allocation of rxq to pmd assignments to a
utilization-based allocation.
* New appctl command 'dpif-netdev/pmd-rxq-rebalance' to rebalance rxq to
pmd assignments.
* Add rxq utilization of pmd to appctl 'dpif-netdev/pmd-rxq-show'.
* Add support for vHost dequeue zero copy (experimental).
- Userspace datapath:
* Output packet batching support.
- vswitchd:
* Datapath IDs may now be specified as 0x1 (etc.) instead of 16 digits.
* Configuring a controller, or unconfiguring all controllers, now deletes
all groups and meters (as well as all flows).
- New --enable-sparse configure option enables "sparse" checking by default.
- Added additional information to vhost-user status.
v2.8.0 - 31 Aug 2017
--------------------
- ovs-ofctl:
* ovs-ofctl can now accept and display port names in place of numbers. By
default it always accepts names and in interactive use it displays them;
use --names or --no-names to override. See ovs-ofctl(8) for details.
* "ovs-ofctl dump-flows" now accepts --no-stats to omit flow statistics.
- New ovs-dpctl command "ct-stats-show" to show connection tracking stats.
- Tunnels:
* Added support to set packet mark for tunnel endpoint using
`egress_pkt_mark` OVSDB option.
* When using Linux kernel datapath tunnels may be created using rtnetlink.
This will allow us to take advantage of new tunnel features without
having to make changes to the vport modules.
- EMC insertion probability is reduced to 1% and is configurable via
the new 'other_config:emc-insert-inv-prob' option.
- DPDK:
* DPDK log messages redirected to OVS logging subsystem.
Log level can be changed in a usual OVS way using
'ovs-appctl vlog' commands for 'dpdk' module. Lower bound
still can be configured via extra arguments for DPDK EAL.
* dpdkvhostuser ports are marked as deprecated. They will be removed
in an upcoming release.
* Support for DPDK v17.05.1.
- IPFIX now provides additional counters:
* Total counters since metering process startup.
* Per-flow TCP flag counters.
* Multicast, broadcast, and unicast counters.
- New support for multiple VLANs (802.1ad or "QinQ"), including a new
"dot1q-tunnel" port VLAN mode.
- In ovn-vsctl and vtep-ctl, record UUIDs in commands may now be
abbreviated to 4 hex digits.
- Userspace Datapath:
* Added NAT support for userspace datapath.
* Added FTP and TFTP support with NAT for userspace datapath.
* Experimental NSH (Network Service Header) support in userspace datapath.
- OVN:
* New built-in DNS support.
* IPAM for IPv4 can now exclude user-defined addresses from assignment.
* IPAM can now assign IPv6 addresses.
* Make the DHCPv4 router setting optional.
* Gratuitous ARP for NAT addresses on a distributed logical router.
* Allow ovn-controller SSL configuration to be obtained from vswitchd
database.
* ovn-trace now has basic support for tracing distributed firewalls.
* In ovn-nbctl and ovn-sbctl, record UUIDs in commands may now be
abbreviated to 4 hex digits.
* "ovn-sbctl lflow-list" can now print OpenFlow flows that correspond
to logical flows.
* Now uses OVSDB RBAC support to reduce impact of compromised hypervisors.
* Multiple chassis may now be specified for L3 gateways. When more than
one chassis is specified, OVN will manage high availability for that
gateway.
* Add support for ACL logging.
* ovn-northd now has native support for active-standby high availability.
- Tracing with ofproto/trace now traces through recirculation.
- OVSDB:
* New support for role-based access control (see ovsdb-server(1)).
- New commands 'stp/show' and 'rstp/show' (see ovs-vswitchd(8)).
- OpenFlow:
* All features required by OpenFlow 1.4 are now implemented, so
ovs-vswitchd now enables OpenFlow 1.4 by default (in addition to
OpenFlow 1.0 to 1.3).
* Increased support for OpenFlow 1.6 (draft).
* Bundles now support hashing by just nw_src or nw_dst.
* The "learn" action now supports a "limit" option (see ovs-ofctl(8)).
* The port status bit OFPPS_LIVE now reflects link aliveness.
* OpenFlow 1.5 packet-out is now supported.
* Support for OpenFlow 1.5 field packet_type and packet-type-aware
pipeline (PTAP).
* Added generic encap and decap actions (EXT-382).
First supported use case is encap/decap for Ethernet.
* Added NSH (Network Service Header) support in userspace
Used generic encap and decap actions to implement encapsulation and
decapsulation of NSH header.
IETF NSH draft - https://datatracker.ietf.org/doc/draft-ietf-sfc-nsh/
* Conntrack state is only available to the processing path that
follows the "recirc_table" argument of the ct() action. Starting
in OVS 2.8, this state is now cleared for the current processing
path whenever ct() is called.
- Fedora Packaging:
* OVN services are no longer restarted automatically after upgrade.
* ovs-vswitchd and ovsdb-server run as non-root users by default.
- Add --cleanup option to command 'ovs-appctl exit' (see ovs-vswitchd(8)).
- L3 tunneling:
* Use new tunnel port option "packet_type" to configure L2 vs. L3.
* In conjunction with PTAP tunnel ports can handle a mix of L2 and L3
payload.
* New vxlan tunnel extension "gpe" to support VXLAN-GPE tunnels.
* New support for non-Ethernet (L3) payloads in GRE and VXLAN-GPE.
- The BFD detection multiplier is now user-configurable.
- Add experimental support for hardware offloading
* HW offloading is disabled by default.
* HW offloading is done through the TC interface.
- IPv6 link local addresses are now supported on Linux. Use % to designate
the scope device.
v2.7.0 - 21 Feb 2017
---------------------
- Utilities and daemons that support SSL now allow protocols and
ciphers to be configured with --ssl-protocols and --ssl-ciphers.
- OVN:
* QoS is now implemented via egress shaping rather than ingress policing.
* DSCP marking is now supported, via the new northbound QoS table.
* IPAM now supports fixed MAC addresses.
* Support for source IP address based routing.
* ovn-trace:
- New --ovs option to also print OpenFlow flows.
- put_dhcp_opts and put_dhcp_optsv6 actions may now be traced.
* Support for managing SSL and remote connection configuration in
northbound and southbound databases.
* TCP connections to northbound and southbound databases are no
longer enabled by default and must be explicitly configured.
See documentation for ovn-sbctl/ovn-nbctl "set-connection"
command or the ovn-ctl "--db-sb-create-insecure-remote" and
"--db-nb-create-insecure-remote" command-line options for
information regarding remote connection configuration.
* New appctl "inject-pkt" command in ovn-controller that allows
packets to be injected into the connected OVS instance.
* Distributed logical routers may now be connected directly to
logical switches with localnet ports, by specifying a
"redirect-chassis" on the distributed gateway port of the
logical router. NAT rules may be specified directly on the
distributed logical router, and are handled either centrally on
the "redirect-chassis", or in many cases are handled locally on
the hypervisor where the corresponding logical port resides.
Gratuitous ARP for NAT addresses on a distributed logical
router is not yet supported, but will be added in a future
version.
- Fixed regression in table stats maintenance introduced in OVS
2.3.0, wherein the number of OpenFlow table hits and misses was
not accurate.
- OpenFlow:
* OFPT_PACKET_OUT messages are now supported in bundles.
* A new "selection_method=dp_hash" type for OpenFlow select group
bucket selection that uses the datapath computed 5-tuple hash
without making datapath flows match the 5-tuple fields, which
is useful for more efficient load balancing, for example. This
uses the Netronome extension to OpenFlow 1.5+ that allows
control over the OpenFlow select groups selection method. See
"selection_method" and related options in ovs-ofctl(8) for
details.
* The "sample" action now supports "ingress" and "egress" options.
* The "ct" action now supports the TFTP ALG where support is available.
* New actions "clone" and "ct_clear".
* The "meter" action is now supported in the userspace datapath.
- ovs-ofctl:
* 'bundle' command now supports packet-out messages.
* New syntax for 'ovs-ofctl packet-out' command, which uses the
same string parser as the 'bundle' command. The old 'packet-out'
syntax is deprecated and will be removed in a later OVS
release.
* New unixctl "ofctl/packet-out" command, which can be used to
instruct a flow monitor to issue OpenFlow packet-out messages.
- ovsdb-server:
* Remote connections can now be made read-only (see ovsdb-server(1)).
- Tunnels:
* TLV mappings for protocols such as Geneve are now segregated on
a per-OpenFlow bridge basis rather than globally. (The interface
has not changed.)
* Removed support for IPsec tunnels.
- DPDK:
* New option 'n_rxq_desc' and 'n_txq_desc' fields for DPDK interfaces
which set the number of rx and tx descriptors to use for the given port.
* Support for DPDK v16.11.
* Support for rx checksum offload. Refer DPDK HOWTO for details.
* Port Hotplug is now supported.
* DPDK physical ports can now have arbitrary names. The PCI address of
the device must be set using the 'dpdk-devargs' option. Compatibility
with the old dpdk<portid> naming scheme is broken, and as such a
device will not be available for use until a valid dpdk-devargs is
specified.
* Virtual DPDK Poll Mode Driver (vdev PMD) support.
* Removed experimental tag.
- Fedora packaging:
* A package upgrade does not automatically restart OVS service.
- ovs-vswitchd/ovs-vsctl:
* Ports now have a "protected" flag. Protected ports can not forward
frames to other protected ports. Unprotected ports can receive and
forward frames to protected and other unprotected ports.
- ovs-vsctl, ovn-nbctl, ovn-sbctl, vtep-ctl:
* Database commands now accept integer ranges, e.g. "set port
eth0 trunks=1-10" to enable trunking VLANs 1 to 10.