forked from ovn-org/ovn
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathNEWS
1838 lines (1769 loc) · 94.3 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Post v24.03.0
-------------
- Added a new logical switch port option "pkt_clone_type".
If the value is set to "mc_unknown", packets destined to the port gets
cloned to all unknown ports connected to the same Logical Switch.
- Added a new logical switch port option "disable_arp_nd_rsp" to
disable adding the ARP responder flows if set to true.
- IGMP_Group has new "protocol" column that displays the the group
protocol version.
- Add ovn-debug tool containing two commands.
"lflow-stage-to-ltable STAGE_NAME" that converts stage name into logical
flow table id.
"lflow-stage-to-oftable STAGE_NAME" that converts stage name into OpenFlow
table id.
- Rename the ovs-sandbox script to ovn-sandbox.
- Remove "ovn-set-local-ip" config option from vswitchd
external-ids, the option is no longer needed as it became effectively
"true" for all scenarios.
- Added DHCPv4 relay support.
OVN v24.03.0 - 01 Mar 2024
--------------------------
- DNS now have an "options" column for configuration of extra options.
- A new DNS option "ovn-owned" has been added to allow defining domains
that are owned only by ovn, queries for that domain will not be processed
externally.
- Disable OpenFlow inactivity probing between ovn-controller and OVS.
OF connection is established over unix socket, which is a reliable
connection method and doesn't require additional probing.
external_ids:ovn-openflow-probe-interval configuration option for
ovn-controller no longer matters and is ignored.
- Support CIDR based MAC binding aging threshold. See ovn-nb(5) for
'mac_binding_age_threshold' for more details.
- ovn-northd-ddlog has been removed.
- A new LSP option "enable_router_port_acl" has been added to enable
conntrack for the router port whose peer is l3dgw_port if set it true.
- Enable PMTU discovery on geneve/vxlan tunnels for E/W traffic.
- Support selecting encapsulation IP based on the source/destination VIF's
settting. See ovn-controller(8) 'external_ids:ovn-encap-ip' for more
details.
- Introduce next-hop BFD availability check for OVN reroute policies.
- Add the capability to mark (through pkt.mark) incoming/outgoing packets
in the logical switch datapath according to user configured QoS rule.
- OVN Interconnection:
* INB provides basic feedback to the CMS about the ISB changes
handling status.
* IC_NB_Global now have "nb_ic_cfg" and "sb_ic_cfg" columns for
for ISB informational status.
* IC_SB_Global now have "nb_ic_cfg" column for ISB informational status.
* Availability_Zone now have "nb_ic_cfg" column for local AZ
informational status.
OVN v23.09.0 - 15 Sep 2023
--------------------------
- Added FDB aging mechanism, that is disabled by default.
It can be enabled per logical switch with other_config
"fdb_age_threshold".
- Add DHCPv6 "fqdn" (39) option, that works similarly to
DHCPv4 "hostname" (12) option.
- Support to create/update MAC_Binding when GARP received from VTEP (RAMP)
switch on l3dgw port.
- To allow optimizing ovn-controller's monitor conditions for the regular
VIF case, ovn-controller now unconditionally monitors all sub-ports
(ports with parent_port set).
- ECMP routes use L4_SYM dp-hash by default if the datapath supports it.
Existing sessions might get re-hashed to a different ECMP path when
OVN detects the algorithm support in the datapath during an upgrade
or restart of ovn-controller.
- Add "northd-backoff-interval-ms" config option to delay northd engine
runs capped at the set value.
- Add "garp-max-timeout-sec" config option to vswitchd external-ids to
cap the time between when ovn-controller sends gARP packets.
- Introduce support for binding remote ports in ovn-northd if the CMS sets
requested-chassis option for a remote logical switch port.
- Added support to reply success for DHCPv6 Release messages.
OVN v23.06.0 - 01 Jun 2023
--------------------------
- Enhance LSP.options:arp_proxy to support IPv6, configurable MAC
addresses and CIDRs.
- CT entries are not flushed by default anymore whenever a load balancer
backend is removed. A new, per-LB, option 'ct_flush' can be used to
restore the previous behavior. Disabled by default.
- Add support to configure OVSDB inactivity probe interval for ovn-ic and
ovn-controller-vtep.
- Add LS.other_config:broadcast-arps-to-all-routers. If false then arp
requests are only send to Logical Routers on that Logical Switch if the
target mac address matches. Arp requests matching no Logical Router will
only be forwarded to non-router ports. Default is true which keeps the
existing behaviour of flooding these arp requests to all attached Ports.
- Always allow IPv6 Router Discovery, Neighbor Discovery, and Multicast
Listener Discovery protocols, regardless of ACLs defined.
- Add IPv6 iPXE support introducing "bootfile_name" (59) and
"bootfile_name_alt" (254) options to ovn dhcpv6 server.
- Support using local OVS port as port-mirroring target, and also support
'both' directions for the 'filter' field.
- Increased ovn-{ic-,}{n,s}bctl default OVSDB inactivity probe interval from
5000 ms to 120000 ms to give the ability to connect to large databases
(mainly, OVN_Southbound). Also, for daemon mode it is possible to
configure inactivity probe interval via OVN_Northbound and OVN_Southbound
databases for ovn-nbctl and ovn-sbctl respectively. See man ovn-nb and
man ovn-sb for 'nbctl_probe_interval' and 'sbctl_probe_interval'
options for more details.
- Rework OVN egress QoS implementation in order to rely on OvS interface
instead of directly running tc from OVN. Get rid of traffic shaping on the
tunnel interfaces. Now for LSPs running on a LogicalSwitch with a localnet
port is possible to define QoS rules to apply to the local egress localnet
port. Please note now the QoS will be applied just to the local localnet
port and not to all localnet port marked with ovn-egress iface.
- Support for tiered ACLs has been added. This allows for ACLs to be layered
into separate tiers of priority. For more information, please see the
ovn-nb and ovn-northd manpages.
- Send ICMP Fragmentation Needed packets back to offending ports when
communicating with multichassis ports using frames that don't fit through a
tunnel. This is done only for logical switches that are attached to a
physical network via a localnet port, in which case multichassis ports may
have an effective MTU different from regular ports and hence may need this
mechanism to maintain connectivity with other peers in the network.
OVN v23.03.0 - 03 Mar 2023
--------------------------
- ovn-controller: Experimental support for co-hosting multiple controller
instances on the same host.
- Add ovn-ctl commands for (re)starting/stopping OVSDB relay for OVN SB DB.
- Add new [email protected] systemd unit to run ovsdb-servers in separate
systemd units.
OVN v22.12.0 - 16 Dec 2022
--------------------------
- Add load balancer "affinity_timeout" option to configure load balancing
of traffic from a particular client to the same backend for a given
period of time.
- ovn-northd: Add configuration knobs to enable drop sampling using OVS's
per-flow IPFIX sampling.
- Add support for component templates within logical flows and load
balancers.
- Add support for remote port mirroring (Experimental).
- Add new OVN IC Route table index. This index ensures no duplicate routes
can be advertized. When upgrading to this version user must ensure that
all ovn-ic daemons in all availability zones are upgraded before ovn-ic SB
database schema is converted.
OVN v22.09.0 - 16 Sep 2022
--------------------------
- ovn-controller: Add configuration knob, through OVS external-id
"ovn-encap-df_default" to enable or disable tunnel DF flag.
- Add option "localnet_learn_fdb" to LSP that will allow localnet
ports to learn MAC addresses and store them in FDB table.
- northd: introduce the capability to automatically deploy a load-balancer
on each logical-switch connected to a logical router where the
load-balancer has been installed by the CMS. In order to enable the
feature the CMS has to set install_ls_lb_from_router to true in option
column of NB_Global table.
- Added nb_global IPsec options ipsec_encapsulation=true (libreswan)
and ipsec_forceencaps=true (strongswan) to unconditionally enforce
NAT-T UDP encapsulation. Requires OVS support for IPsec custom tunnel
options (which is available in OVS 3.0).
- Removed possibility of disabling logical datapath groups.
- Removed the copying of SB's Chassis other_config into external_ids.
- Added MAC binding aging mechanism, that is disabled by default.
It can be enabled per logical router with option
"mac_binding_age_threshold".
- If it is needed to create Load Balancer within LR with VIP, which matches
any of LR's LRP IP, there is no need to create SNAT entry. Now such
traffic destined to LRP IP is not dropped.
- Bump python version required for building OVN to 3.6.
OVN v22.06.0 - 03 Jun 2022
--------------------------
- Support IGMP and MLD snooping on transit logical switches that connect
different OVN Interconnection availability zones.
- Replaced the usage of masked ct_label by ct_mark in most cases to work
better with hardware-offloading.
- Support NAT for logical routers with multiple distributed gateway ports.
- Add global option (NB_Global.options:default_acl_drop) to enable
implicit drop behavior on logical switches with ACLs applied.
- Support (LSP.options:qos_min_rate) to guarantee minimal bandwidth available
for a logical port.
- Add NB.Load_Balancer.options:neighbor_responder to allow the CMS to
explicitly request routers to reply to any ARP/ND request for a VIP
(when set to "all") and only for reachable VIPs (when set to "reachable"
or by default).
- Changed the way to enable northd parallelization.
Removed support for:
- use_parallel_build in NBDB.
- --dummy-numa in northd cmdline.
Added support for:
- --n-threads=<N> in northd cmdline.
- set-n-threads/get-n-threads unixctls.
- --ovn-northd-n-threads command line argument in ovn-ctl
- Added support for setting the Next server IP in the DHCP header
using the private DHCP option - 253 in native OVN DHCPv4 responder.
- Support list of chassis for Logical_Switch_Port:options:requested-chassis.
- Support Logical_Switch_Port:options:activation-strategy for live migration
scenarios.
OVN v22.03.0 - 11 Mar 2022
--------------------------
- Refactor CoPP commands introducing a unique name index in CoPP NB table.
Add following new CoPP commands to manage CoPP table:
- ovn-nbctl copp-add <name> <proto> <meter>
- ovn-nbctl copp-del <name> <proto>
- ovn-nbctl copp-list <name>
- ovn-nbctl ls-copp-add <name> <switch>
- ovn-nbctl lr-copp-add <name> <router>
- Support version pinning between ovn-northd and ovn-controller-vtep as an
option. If the option is enabled and the versions don't match,
ovn-controller-vtep will not process any DB changes.
- When configured to log packtes matching ACLs, log the direction (logical
pipeline) too.
- Introduce exclude-lb-vips-from-garp in logical_switch_port column in order
to not advertise lbs VIPs in GARPs sent by the logical router.
- ACLs now have an "options" column for configuration of extra options.
- A new ACL option, "log-related" has been added that allows for reply and
related traffic to be logged for an ACL in addition to the traffic that
directly matches the ACL.
OVN v21.12.0 - 22 Dec 2021
--------------------------
- Set ignore_lsp_down to true as default, so that ARP responder flows are
installed together with other flows when a logical switch port is created,
without having to wait for the port to be UP. CMS should set it to false
if not desired.
- Added Load_Balancer_Group support, which simplifies large scale
configurations of load balancers.
- Introduced infrastructure for VIF plug providers. When OVN is linked with
an appropriate VIF plug provider CMS can request OVN to plug lports. This
is particularly useful in topologies where the ovn-controller process is
running on SmartNIC control plane CPUs. Please refer to
Documentation/topics/vif-plug-providers/vif-plug-providers.rst for more
information.
- Added Logical_Router_Port "gateway_mtu_bypass" option.
- Added new "inc-engine/recompute" command to all incremental processing
engine clients (ovn-northd and ovn-controller).
- ovn-controller: Add configuration knob, through OVS external-id
"ovn-trim-timeout-ms" to allow specifiying an lflow cache inactivity
timeout after which ovn-controller should trim memory.
OVN v21.09.0 - 01 Oct 2021
--------------------------
- Added Control Plane Protection support (control plane traffic metering).
- Added path MTU discovery for ingress traffic originated outside of the
cluster.
- Introduced a new "label" field for "allow" and "allow-related" ACLs
which helps in debugging/backtracking the ACL which allowed a particular
connection.
- Allow static routes without nexthops.
- Enabled logical dp groups as a default. CMS should disable it if not
desired.
- Added support for multiple routing tables in Logical Router Static Routes
and LRPs. OVN Interconnection supports routes' route tables as well.
This requires to update schemas for OVN_Northdbound and OVN_IC_Southbound
DBs.
OVN v21.06.0 - 18 Jun 2021
-------------------------
- ovn-northd-ddlog: New implementation of northd, based on DDlog. This
implementation is incremental, meaning that it only recalculates what is
needed for the southbound database when northbound changes occur. It is
expected to scale better than the C implementation, for large deployments.
(This may take testing and tuning to be effective.) This version of OVN
requires DDLog 0.38.
- Introduce ovn-controller incremental processing engine statistics
- Introduced parallel processing in ovn-northd with the NB_Global config option
'use_parallel_build' to enable it. It is disabled by default.
- Support vlan-passthru mode for tag=0 localnet ports.
- Support custom 802.11ad EthType for localnet ports.
- Add a new NB Global option - use_ct_inv_match with the default value of
true. If this is set to false, then the logical field - "ct.inv" will not
be used in the logical flow matches. CMS can consider setting this to
false, if they want to use smart NICs which don't support offloading
datapath flows with this field used.
- Introduce a new "allow-stateless" ACL verb to always bypass connection
tracking. The existing "allow" verb behavior is left intact.
- Added support in native DNS to respond to PTR request types.
- ovn-nbctl daemon mode is no longer considered experimental.
- Utilities:
* ovn-nbctl daemon mode is no longer considered experimental.
* ovn-sbctl now also supports daemon mode.
- Added support in native DNS to respond to PTR request types.
- New --dry-run option for ovn-northd and ovn-northd-ddlog.
- ovn-controller: Add configuration knobs, through OVS external-id
"ovn-trim-limit-lflow-cache" and "ovn-trim-wmark-perc-lflow-cache", to
allow enforcing a lflow cache size limit and high watermark percentage
for which automatic memory trimming is performed.
- Support multiple distributed gateway ports on a single logical router.
(NAT and load-balancer are not supported yet when there are multiple
distributed gateway ports).
OVN v21.03.0 - 12 Mar 2021
-------------------------
- Support ECMP multiple nexthops for reroute router policies.
- BFD protocol support according to RFC880 [0]. Introduce next-hop BFD
availability check for OVN static routes.
[0] https://tools.ietf.org/html/rfc5880)
- Change the semantic of the "Logical_Switch_Port.up" field such that it is
set to "true" only when all corresponding OVS openflow operations have
been processed. This also introduces a new "OVS.Interface.external-id",
"ovn-installed". This external-id is set by ovn-controller only after all
openflow operations corresponding to the OVS interface being added have
been processed.
- ovn-ctl: Added new command line argument '--ovsdb-disable-file-column-diff'
to support ovsdb-server upgrades from version 2.14 and earlier to
2.15 and later. See ovsdb(7) for more details.
- Add a new option to Load_Balancer.options, "hairpin_snat_ip", to allow
users to explicitly select which source IP should be used for load
balancer hairpin traffic.
- ovn-controller: Add configuration knobs, through OVS external-id
"ovn-limit-lflow-cache" and "ovn-memlimit-lflow-cache-kb", to allow
enforcing a limit for the size of the logical flow cache based on
maximum number of entries and/or memory usage.
- ovn-controller: Add lflow cache related memory reports.
OVN v20.12.0 - 18 Dec 2020
--------------------------
- The "datapath" argument to ovn-trace is now optional, since the
datapath can be inferred from the inport (which is required).
- The obsolete "redirect-chassis" way to configure gateways has been
removed. See ovn-nb(5) for advice on how to update your config if needed.
- Add IPv4 iPXE support introducing "bootfile_name_alt" option to ovn dhcp
server.
- Support other_config:vlan-passthru=true to allow VLAN tagged incoming
traffic.
- Propagate currently processed SB_Global.nb_cfg in ovn-controller to the
local OVS DB integration bridge external_ids:ovn-nb-cfg.
- Support version pinning between ovn-northd and ovn-controller as an
option. If the option is enabled and the versions don't match,
ovn-controller will not process any DB changes.
- Add "fair" column in Meter table to allow multiple ACL logs to use the
same Meter while being rate-limited independently.
- New configuration option for northd 'options:use_logical_dp_groups=true'
to enable combining of logical flows by logical datapath. This should
significantly decrease size of a Southbound DB. However, in some cases,
it could have performance penalty for ovn-controller. Disabled by
default.
OVN v20.09.0 - 28 Sep 2020
--------------------------
- Added packet marking support for traffic routed with
a routing policy.
- Added DHCPINFORM and DHCPRELEASE support in native
OVN DHCPv4 responder.
- Added support for DHCP domain search option (119) in native
OVN DHCPv4 responder.
- The nb_cfg column from the Chassis table in the OVN Southbound
database has been deprecated and is no longer updated. A new table
called Chassis_Private now contains the nb_cfg column which is updated
by incrementing the value in the NB_Global table, CMSes relying on
this mechanism should update their code to use this new table.
- Added support for external ip based NAT. Now, besides the logical ip,
external ips will also decide if a packet will be NATed or not.
- Added support for VXLAN encapsulation (not just for ramp/VTEP switches).
OVN v20.06.0
--------------------------
- Added support for external_port_range in NAT table.
- ovn-controller no longer monitor the external_ids column from
the Chassis table. This was done to avoid having to do a flow
recalculation every time external systems wrote to this column. The
chassis configuration has now being moved to a new column called
"other_config". As a note, the configurations are still be written to
the external_ids column (but no longer triggers an alert) to
keep the backward compatibility with current systems that may be
reading it from that column but, this behavior will be removed
in the future.
- Added IPv6 Prefix Delegation support in OVN.
- OVN now uses OpenFlow 1.5.
- Added support to choose selection methods - dp_hash or
hash (with specified hash fields) for OVN load balancer
backend selection. This is incompatible with older versions.
Care should be taken while upgrading as the existing
load balancer traffic will be affected if ovn-controllers
are not stopped before uprading northd services.
- Added limited support for logical switches with multiple localnet ports.
The feature requires that no chassis has two or more physical networks
with localnet ports that belong to the same logical switch mapped. Routing
between the ports to be implemented by fabric.
- OVN Interconnection:
* Support for L3 interconnection of multiple OVN deployments with tunnels
managed by OVN. See instructions in
Documentation/tutorials/ovn-interconnection.rst.
OVN v20.03.0 - 04 Feb 2020
--------------------------
- OVN was split out from the OVS repository and is now released
independently.
- Added IPv6 NAT support for OVN routers.
- Added Stateless Floating IP support in OVN.
- Added Forwarding Group support in OVN.
- Added support for MLD Snooping and MLD Querier.
- Added support for ECMP routes in OVN router.
v2.12.0 - 03 Sep 2019
---------------------
- DPDK:
* New option 'other_config:dpdk-socket-limit' to limit amount of
hugepage memory that can be used by DPDK.
* Add support for vHost Post-copy Live Migration (experimental).
* OVS validated with DPDK 18.11.2 which is the new minimal supported
version.
* DPDK 18.11.1 and lower is no longer supported.
* New option 'tx-retries-max' to set the maximum amount of vhost tx
retries that can be made.
- OpenFlow:
* All features required by OpenFlow 1.5 are now implemented, so
ovs-vswitchd now enables OpenFlow 1.5 by default (in addition to
OpenFlow 1.0 to 1.4).
* Removed support for OpenFlow 1.6 (draft), which ONF abandoned.
* New action "check_pkt_larger".
* Support for OpenFlow 1.5 "meter" action.
- Userspace datapath:
* ICMPv6 ND enhancements: support for match and set ND options type
and reserved fields.
* Add v4/v6 fragmentation support for conntrack.
* New ovs-appctl "dpctl/ipf-set-enabled" and "dpctl/ipf-set-disabled"
commands for userspace datapath conntrack fragmentation support.
* New "ovs-appctl dpctl/ipf-set-min-frag" command for userspace
datapath conntrack fragmentation support.
* New "ovs-appctl dpctl/ipf-set-max-nfrags" command for userspace datapath
conntrack fragmentation support.
* New "ovs-appctl dpctl/ipf-get-status" command for userspace datapath
conntrack fragmentation support.
* New action "check_pkt_len".
* Port configuration with "other-config:priority-tags" now has a mode
that retains the 802.1Q header even if VLAN and priority are both zero.
* 'ovs-appctl exit' now implies cleanup of non-internal ports in userspace
datapath regardless of '--cleanup' option. Use '--cleanup' to remove
internal ports too.
* Removed experimental tag for SMC cache.
* Datapath classifer code refactored to enable function pointers to select
the lookup implementation at runtime. This enables specialization of
specific subtables based on the miniflow attributes, enhancing the
performance of the subtable search.
* Add Linux AF_XDP support through a new experimental netdev type "afxdp".
- OVSDB:
* OVSDB clients can now resynchronize with clustered servers much more
quickly after a brief disconnection, saving bandwidth and CPU time.
See section 4.1.15 of ovsdb-server(7) for details of related OVSDB
protocol extension.
* Support to convert from cluster database to standalone database is now
available when clustered is down and cannot be revived using ovsdb-tool
. Check "Database Migration Commands" in ovsdb-tool man section.
- OVN:
* IPAM/MACAM:
- select IPAM mac_prefix in a random manner if not provided by the user
- add the capability to specify a static IPv4 and/or IPv6 address and
get the L2 one allocated dynamically using the following syntax:
ovn-nbctl lsp-set-addresses <port> "dynamic <IPv4 addr> <IPv6 addr>"
* Added the HA chassis group support.
* Added 'external' logical port support.
* Added Policy-based routing(PBR) support to create permit/deny/reroute
policies on the logical router. New table(Logical_Router_Policy) added in
OVN-NB schema. New "ovn-nbctl" commands to add/delete/list PBR policies.
* Support for Transport Zones, a way to separate chassis into
logical groups which results in tunnels only been formed between
members of the same transport zone(s).
* Support for IGMP Snooping and IGMP Querier.
- New QoS type "linux-netem" on Linux.
- Added support for TLS Server Name Indication (SNI).
- Linux datapath:
* Support for the kernel versions 4.19.x and 4.20.x.
* Support for the kernel version 5.0.x.
* Add support for conntrack zone-based timeout policy.
- 'ovs-dpctl dump-flows' is no longer suitable for dumping offloaded flows.
'ovs-appctl dpctl/dump-flows' should be used instead.
- Add L2 GRE tunnel over IPv6 support.
v2.11.0 - 19 Feb 2019
---------------------
- OpenFlow:
* OFPMP_TABLE_FEATURES_REQUEST can now modify table features.
- ovs-ofctl:
* "mod-table" command can now change OpenFlow table names.
- ovn:
* OVN-SB schema changed: duplicated IP with same Encapsulation type
is not allowed any more. Please refer to
Documentation/intro/install/ovn-upgrades.rst for the instructions
in case there are problems encountered when upgrading from an earlier
version.
* New support for IPSEC encrypted tunnels between hypervisors.
* ovn-ctl: allow passing user:group ids to the OVN daemons.
* IPAM/MACAM:
- add the capability to dynamically assign just L2 addresses
- add the capability to specify a static ip address and get the L2 one
allocated dynamically using the following syntax:
ovn-nbctl lsp-set-addresses <port> "dynamic <IP>"
- DPDK:
* Add support for DPDK 18.11
* Add support for port representors.
- Userspace datapath:
* Add option for simple round-robin based Rxq to PMD assignment.
It can be set with pmd-rxq-assign.
* Add support for Auto load balancing of PMDs (experimental)
* Added new per-port configurable option to manage EMC:
'other_config:emc-enable'.
- Add 'symmetric_l3' hash function.
- OVS now honors 'updelay' and 'downdelay' for bonds with LACP configured.
- ovs-vswitchd:
* New configuration option "offload-rebalance", that enables dynamic
rebalancing of offloaded flows.
- The environment variable OVS_SYSLOG_METHOD, if set, is now used
as the default syslog method.
- The environment variable OVS_CTL_TIMEOUT, if set, is now used
as the default timeout for control utilities.
- The environment variable OVS_RESOLV_CONF, if set, is now used
as the DNS server configuration file.
- RHEL packaging:
* OVN packages are split from OVS packages. A new spec
file - ovn-fedora.spec.in is added to generate OVN packages.
- Linux datapath:
* Support for the kernel versions 4.16.x, 4.17.x, and 4.18.x.
v2.10.0 - 18 Aug 2018
---------------------
- ovs-vswitchd and utilities now support DNS names in OpenFlow and
OVSDB remotes.
- ovs-vswitchd:
* New options --l7 and --l7-len to "ofproto/trace" command.
* Previous versions gave OpenFlow tables default names of the form
"table#". These are not helpful names for the purpose of accepting
and displaying table names, so now tables by default have no names.
* The "null" interface type, deprecated since 2013, has been removed.
* Add minimum network namespace support for Linux.
* New command "lacp/show-stats"
- ovs-ofctl:
* ovs-ofctl now accepts and display table names in place of numbers. By
default it always accepts names and in interactive use it displays them;
use --names or --no-names to override. See ovs-ofctl(8) for details.
- ovs-vsctl: New commands "add-bond-iface" and "del-bond-iface".
- ovs-dpctl:
* New commands "ct-set-limits", "ct-del-limits", and "ct-get-limits".
- OpenFlow:
* OFPT_ROLE_STATUS is now available in OpenFlow 1.3.
* OpenFlow 1.5 extensible statistics (OXS) now implemented.
* New OpenFlow 1.0 extensions for group support.
* Default selection method for select groups is now dp_hash with improved
accuracy.
- Linux datapath
* Add support for compiling OVS with the latest Linux 4.14 kernel.
* Added support for meters.
* Add support for conntrack zone limit.
- ovn:
* Implemented icmp4/icmp6/tcp_reset actions in order to drop the packet
and reply with a RST for TCP or ICMPv4/ICMPv6 unreachable message for
other IPv4/IPv6-based protocols whenever a reject ACL rule is hit.
* ACL match conditions can now match on Port_Groups as well as address
sets that are automatically generated by Port_Groups. ACLs can be
applied directly to Port_Groups as well.
* ovn-nbctl can now run as a daemon (long-lived, background process).
See ovn-nbctl(8) for details.
- DPDK:
* New 'check-dpdk' Makefile target to run a new system testsuite.
See Testing topic for the details.
* Add LSC interrupt support for DPDK physical devices.
* Allow init to fail and record DPDK status/version in OVS database.
* Add experimental flow hardware offload support
* Support both shared and per port mempools for DPDK devices.
- Userspace datapath:
* Commands ovs-appctl dpif-netdev/pmd-*-show can now work on a single PMD
* Detailed PMD performance metrics available with new command
ovs-appctl dpif-netdev/pmd-perf-show
* Supervision of PMD performance metrics and logging of suspicious
iterations
* Add signature match cache (SMC) as experimental feature. When turned on,
it improves throughput when traffic has many more flows than EMC size.
- ERSPAN:
* Implemented ERSPAN protocol (draft-foschiano-erspan-00.txt) for
both kernel datapath and userspace datapath.
* Added port-based and flow-based ERSPAN tunnel port support, added
OpenFlow rules matching ERSPAN fields. See ovs-fields(7).
- ovs-pki
* ovs-pki now generates x.509 version 3 certificate. The new format adds
subjectAltName field and sets its value the same as common name (CN).
v2.9.0 - 19 Feb 2018
--------------------
- NSH implementation now conforms to latest draft (draft-ietf-sfc-nsh-28).
* Add ttl field.
* Add a new action dec_nsh_ttl.
* Enable NSH support in kernel datapath.
- OVSDB has new, experimental support for database clustering:
* New high-level documentation in ovsdb(7).
* New file format documentation for developers in ovsdb(5).
* Protocol documentation moved from ovsdb-server(1) to ovsdb-server(7).
* ovsdb-server now supports online schema conversion via
"ovsdb-client convert".
* ovsdb-server now always hosts a built-in database named _Server. See
ovsdb-server(5) for more details.
* ovsdb-client: New "get-schema-cksum", "query", "backup", "restore",
and "wait" commands. New --timeout option.
* ovsdb-tool: New "create-cluster", "join-cluster", "db-cid", "db-sid",
"db-local-address", "db-is-clustered", "db-is-standalone", "db-name",
"schema-name", "compare-versions", and "check-cluster" commands.
* ovsdb-server: New ovs-appctl commands for managing clusters.
* ovs-sandbox: New support for clustered databases.
- ovs-vsctl and other commands that display data in tables now support a
--max-column-width option to limit column width.
- No longer slow-path traffic that sends to a controller. Applications,
such as OVN ACL logging, want to send a copy of a packet to a
controller while leaving the actual packet forwarding in the datapath.
- OVN:
* The "requested-chassis" option for a logical switch port now accepts a
chassis "hostname" in addition to a chassis "name".
* IPv6
- Added support to send IPv6 Router Advertisement packets in response to
the IPv6 Router Solicitation packets from the VIF ports.
- Added support to generate Neighbor Solicitation packets using the OVN
action 'nd_ns' to resolve unknown next hop MAC addresses for the
IPv6 packets.
* Add support for QoS bandwidth limit with DPDK.
* ovn-ctl: New commands run_nb_ovsdb and run_sb_ovsdb.
* ovn-sbctl, ovn-nbctl: New options --leader-only, --no-leader-only.
- OpenFlow:
* ct_clear action is now backed by kernel datapath. Support is probed for
when OVS starts.
- Linux kernel 4.13
* Add support for compiling OVS with the latest Linux 4.13 kernel
- ovs-dpctl and related ovs-appctl commands:
* "flush-conntrack" now accept a 5-tuple to delete a specific
connection tracking entry.
* New "ct-set-maxconns", "ct-get-maxconns", and "ct-get-nconns" commands
for userspace datapath.
- No longer send packets to the Linux TAP device if it's DOWN unless it is
in another networking namespace.
- DPDK:
* Add support for DPDK v17.11
* Add support for vHost IOMMU
* New debug appctl command 'netdev-dpdk/get-mempool-info'.
* All the netdev-dpdk appctl commands described in ovs-vswitchd man page.
* Custom statistics:
- DPDK physical ports now return custom set of "dropped", "error" and
"management" statistics.
- ovs-ofctl dump-ports command now prints new of set custom statistics
if available (for OpenFlow 1.4+).
* Switch from round-robin allocation of rxq to pmd assignments to a
utilization-based allocation.
* New appctl command 'dpif-netdev/pmd-rxq-rebalance' to rebalance rxq to
pmd assignments.
* Add rxq utilization of pmd to appctl 'dpif-netdev/pmd-rxq-show'.
* Add support for vHost dequeue zero copy (experimental).
- Userspace datapath:
* Output packet batching support.
- vswitchd:
* Datapath IDs may now be specified as 0x1 (etc.) instead of 16 digits.
* Configuring a controller, or unconfiguring all controllers, now deletes
all groups and meters (as well as all flows).
- New --enable-sparse configure option enables "sparse" checking by default.
- Added additional information to vhost-user status.
v2.8.0 - 31 Aug 2017
--------------------
- ovs-ofctl:
* ovs-ofctl can now accept and display port names in place of numbers. By
default it always accepts names and in interactive use it displays them;
use --names or --no-names to override. See ovs-ofctl(8) for details.
* "ovs-ofctl dump-flows" now accepts --no-stats to omit flow statistics.
- New ovs-dpctl command "ct-stats-show" to show connection tracking stats.
- Tunnels:
* Added support to set packet mark for tunnel endpoint using
`egress_pkt_mark` OVSDB option.
* When using Linux kernel datapath tunnels may be created using rtnetlink.
This will allow us to take advantage of new tunnel features without
having to make changes to the vport modules.
- EMC insertion probability is reduced to 1% and is configurable via
the new 'other_config:emc-insert-inv-prob' option.
- DPDK:
* DPDK log messages redirected to OVS logging subsystem.
Log level can be changed in a usual OVS way using
'ovs-appctl vlog' commands for 'dpdk' module. Lower bound
still can be configured via extra arguments for DPDK EAL.
* dpdkvhostuser ports are marked as deprecated. They will be removed
in an upcoming release.
* Support for DPDK v17.05.1.
- IPFIX now provides additional counters:
* Total counters since metering process startup.
* Per-flow TCP flag counters.
* Multicast, broadcast, and unicast counters.
- New support for multiple VLANs (802.1ad or "QinQ"), including a new
"dot1q-tunnel" port VLAN mode.
- In ovn-vsctl and vtep-ctl, record UUIDs in commands may now be
abbreviated to 4 hex digits.
- Userspace Datapath:
* Added NAT support for userspace datapath.
* Added FTP and TFTP support with NAT for userspace datapath.
* Experimental NSH (Network Service Header) support in userspace datapath.
- OVN:
* New built-in DNS support.
* IPAM for IPv4 can now exclude user-defined addresses from assignment.
* IPAM can now assign IPv6 addresses.
* Make the DHCPv4 router setting optional.
* Gratuitous ARP for NAT addresses on a distributed logical router.
* Allow ovn-controller SSL configuration to be obtained from vswitchd
database.
* ovn-trace now has basic support for tracing distributed firewalls.
* In ovn-nbctl and ovn-sbctl, record UUIDs in commands may now be
abbreviated to 4 hex digits.
* "ovn-sbctl lflow-list" can now print OpenFlow flows that correspond
to logical flows.
* Now uses OVSDB RBAC support to reduce impact of compromised hypervisors.
* Multiple chassis may now be specified for L3 gateways. When more than
one chassis is specified, OVN will manage high availability for that
gateway.
* Add support for ACL logging.
* ovn-northd now has native support for active-standby high availability.
- Tracing with ofproto/trace now traces through recirculation.
- OVSDB:
* New support for role-based access control (see ovsdb-server(1)).
- New commands 'stp/show' and 'rstp/show' (see ovs-vswitchd(8)).
- OpenFlow:
* All features required by OpenFlow 1.4 are now implemented, so
ovs-vswitchd now enables OpenFlow 1.4 by default (in addition to
OpenFlow 1.0 to 1.3).
* Increased support for OpenFlow 1.6 (draft).
* Bundles now support hashing by just nw_src or nw_dst.
* The "learn" action now supports a "limit" option (see ovs-ofctl(8)).
* The port status bit OFPPS_LIVE now reflects link aliveness.
* OpenFlow 1.5 packet-out is now supported.
* Support for OpenFlow 1.5 field packet_type and packet-type-aware
pipeline (PTAP).
* Added generic encap and decap actions (EXT-382).
First supported use case is encap/decap for Ethernet.
* Added NSH (Network Service Header) support in userspace
Used generic encap and decap actions to implement encapsulation and
decapsulation of NSH header.
IETF NSH draft - https://datatracker.ietf.org/doc/draft-ietf-sfc-nsh/
* Conntrack state is only available to the processing path that
follows the "recirc_table" argument of the ct() action. Starting
in OVS 2.8, this state is now cleared for the current processing
path whenever ct() is called.
- Fedora Packaging:
* OVN services are no longer restarted automatically after upgrade.
* ovs-vswitchd and ovsdb-server run as non-root users by default.
- Add --cleanup option to command 'ovs-appctl exit' (see ovs-vswitchd(8)).
- L3 tunneling:
* Use new tunnel port option "packet_type" to configure L2 vs. L3.
* In conjunction with PTAP tunnel ports can handle a mix of L2 and L3
payload.
* New vxlan tunnel extension "gpe" to support VXLAN-GPE tunnels.
* New support for non-Ethernet (L3) payloads in GRE and VXLAN-GPE.
- The BFD detection multiplier is now user-configurable.
- Add experimental support for hardware offloading
* HW offloading is disabled by default.
* HW offloading is done through the TC interface.
- IPv6 link local addresses are now supported on Linux. Use % to designate
the scope device.
v2.7.0 - 21 Feb 2017
---------------------
- Utilities and daemons that support SSL now allow protocols and
ciphers to be configured with --ssl-protocols and --ssl-ciphers.
- OVN:
* QoS is now implemented via egress shaping rather than ingress policing.
* DSCP marking is now supported, via the new northbound QoS table.
* IPAM now supports fixed MAC addresses.
* Support for source IP address based routing.
* ovn-trace:
- New --ovs option to also print OpenFlow flows.
- put_dhcp_opts and put_dhcp_optsv6 actions may now be traced.
* Support for managing SSL and remote connection configuration in
northbound and southbound databases.
* TCP connections to northbound and southbound databases are no
longer enabled by default and must be explicitly configured.
See documentation for ovn-sbctl/ovn-nbctl "set-connection"
command or the ovn-ctl "--db-sb-create-insecure-remote" and
"--db-nb-create-insecure-remote" command-line options for
information regarding remote connection configuration.
* New appctl "inject-pkt" command in ovn-controller that allows
packets to be injected into the connected OVS instance.
* Distributed logical routers may now be connected directly to
logical switches with localnet ports, by specifying a
"redirect-chassis" on the distributed gateway port of the
logical router. NAT rules may be specified directly on the
distributed logical router, and are handled either centrally on
the "redirect-chassis", or in many cases are handled locally on
the hypervisor where the corresponding logical port resides.
Gratuitous ARP for NAT addresses on a distributed logical
router is not yet supported, but will be added in a future
version.
- Fixed regression in table stats maintenance introduced in OVS
2.3.0, wherein the number of OpenFlow table hits and misses was
not accurate.
- OpenFlow:
* OFPT_PACKET_OUT messages are now supported in bundles.
* A new "selection_method=dp_hash" type for OpenFlow select group
bucket selection that uses the datapath computed 5-tuple hash
without making datapath flows match the 5-tuple fields, which
is useful for more efficient load balancing, for example. This
uses the Netronome extension to OpenFlow 1.5+ that allows
control over the OpenFlow select groups selection method. See
"selection_method" and related options in ovs-ofctl(8) for
details.
* The "sample" action now supports "ingress" and "egress" options.
* The "ct" action now supports the TFTP ALG where support is available.
* New actions "clone" and "ct_clear".
* The "meter" action is now supported in the userspace datapath.
- ovs-ofctl:
* 'bundle' command now supports packet-out messages.
* New syntax for 'ovs-ofctl packet-out' command, which uses the
same string parser as the 'bundle' command. The old 'packet-out'
syntax is deprecated and will be removed in a later OVS
release.
* New unixctl "ofctl/packet-out" command, which can be used to
instruct a flow monitor to issue OpenFlow packet-out messages.
- ovsdb-server:
* Remote connections can now be made read-only (see ovsdb-server(1)).
- Tunnels:
* TLV mappings for protocols such as Geneve are now segregated on
a per-OpenFlow bridge basis rather than globally. (The interface
has not changed.)
* Removed support for IPsec tunnels.
- DPDK:
* New option 'n_rxq_desc' and 'n_txq_desc' fields for DPDK interfaces
which set the number of rx and tx descriptors to use for the given port.
* Support for DPDK v16.11.
* Support for rx checksum offload. Refer DPDK HOWTO for details.
* Port Hotplug is now supported.
* DPDK physical ports can now have arbitrary names. The PCI address of
the device must be set using the 'dpdk-devargs' option. Compatibility
with the old dpdk<portid> naming scheme is broken, and as such a
device will not be available for use until a valid dpdk-devargs is
specified.
* Virtual DPDK Poll Mode Driver (vdev PMD) support.
* Removed experimental tag.
- Fedora packaging:
* A package upgrade does not automatically restart OVS service.
- ovs-vswitchd/ovs-vsctl:
* Ports now have a "protected" flag. Protected ports can not forward
frames to other protected ports. Unprotected ports can receive and
forward frames to protected and other unprotected ports.
- ovs-vsctl, ovn-nbctl, ovn-sbctl, vtep-ctl:
* Database commands now accept integer ranges, e.g. "set port
eth0 trunks=1-10" to enable trunking VLANs 1 to 10.
v2.6.0 - 27 Sep 2016
---------------------
- First supported release of OVN. See ovn-architecture(7) for more
details.
- ovsdb-server:
* New "monitor_cond" "monitor_cond_update" and "update2" extensions to
RFC 7047.
- OpenFlow:
* OpenFlow 1.3+ bundles now expire after 10 seconds since the
last time the bundle was either opened, modified, or closed.
* OpenFlow 1.3 Extension 230, adding OpenFlow Bundles support, is
now implemented.
* OpenFlow 1.3+ bundles are now supported for group mods as well as
flow mods and port mods. Both 'atomic' and 'ordered' bundle
flags are supported for group mods as well as flow mods.
* Internal OpenFlow rule representation for load and set-field
actions is now much more memory efficient. For a complex flow
table this can reduce rule memory consumption by 40%.
* Bundles are now much more memory efficient than in OVS 2.5.
Together with memory efficiency improvements in OpenFlow rule
representation, the peak OVS resident memory use during a
bundle commit for large complex set of flow mods can be only
25% of that in OVS 2.5 (4x lower).
* OpenFlow 1.1+ OFPT_QUEUE_GET_CONFIG_REQUEST now supports OFPP_ANY.
* OpenFlow 1.4+ OFPMP_QUEUE_DESC is now supported.
* OpenFlow 1.4+ OFPT_TABLE_STATUS is now supported.
* New property-based packet-in message format NXT_PACKET_IN2 with support
for arbitrary user-provided data and for serializing flow table
traversal into a continuation for later resumption.
* New extension message NXT_SET_ASYNC_CONFIG2 to allow OpenFlow 1.4-like
control over asynchronous messages in earlier versions of OpenFlow.
* New OpenFlow extension NXM_NX_MPLS_TTL to provide access to MPLS TTL.
* New output option, output(port=N,max_len=M), to allow truncating a
packet to size M bytes when outputting to port N.
* New command OFPGC_ADD_OR_MOD for OFPT_GROUP_MOD message that adds a
new group or modifies an existing groups
* The optional OpenFlow packet buffering feature is deprecated in
this release, and will be removed in the next OVS release
(2.7). After the change OVS always sends the 'buffer_id' as
0xffffffff in packet-in messages and will send an error
response if any other value of this field is included in
packet-out and flow mod sent by a controller. Controllers are
already expected to work properly in cases where the switch can
not buffer packets, so this change should not affect existing
users.
* New OpenFlow extension NXT_CT_FLUSH_ZONE to flush conntrack zones.
- Improved OpenFlow version compatibility for actions:
* New OpenFlow extension to support the "group" action in OpenFlow 1.0.
* OpenFlow 1.0 "enqueue" action now properly translated to OpenFlow 1.1+.
* OpenFlow 1.1 "mod_nw_ecn" and OpenFlow 1.1+ "mod_nw_ttl" actions now
properly translated to OpenFlow 1.0.
- ovs-ofctl:
* queue-get-config command now allows a queue ID to be specified.
* '--bundle' option can now be used with OpenFlow 1.3 and with group mods.
* New "bundle" command allows executing a mixture of flow and group mods
as a single atomic transaction.
* New option "--color" to produce colorized output for some commands.
* New option '--may-create' to use OFPGC_ADD_OR_MOD in mod-group command.
- IPFIX:
* New "sampling_port" option for "sample" action to allow sampling
ingress and egress tunnel metadata with IPFIX.
* New ovs-ofctl commands "dump-ipfix-bridge" and "dump-ipfix-flow" to
dump bridge IPFIX statistics and flow based IPFIX statistics.
* New setting other-config:virtual_obs_id to add an arbitrary string
to IPFIX records.
- Linux:
* OVS Linux datapath now implements Conntrack NAT action with all
supported Linux kernels.
* Support for truncate action.
* New QoS type "linux-noop" that prevents Open vSwitch from trying to
manage QoS for a given port (useful when other software manages QoS).
- DPDK:
* New option "n_rxq" for PMD interfaces.
Old 'other_config:n-dpdk-rxqs' is no longer supported.
Not supported by vHost interfaces. For them number of rx and tx queues
is applied from connected virtio device.
* New 'other_config:pmd-rxq-affinity' field for PMD interfaces, that
allows to pin port's rx queues to desired cores.
* New appctl command 'dpif-netdev/pmd-rxq-show' to check the port/rxq
assignment.
* Type of log messages from PMD threads changed from INFO to DBG.
* QoS functionality with sample egress-policer implementation.
* The mechanism for configuring DPDK has changed to use database
* Sensible defaults have been introduced for many of the required
configuration options
* DB entries have been added for many of the DPDK EAL command line
arguments. Additional arguments can be passed via the dpdk-extra
entry.
* Add ingress policing functionality.
* PMD threads servicing vHost User ports can now come from the NUMA
node that device memory is located on if CONFIG_RTE_LIBRTE_VHOST_NUMA
is enabled in DPDK.
* Basic connection tracking for the userspace datapath (no ALG,
fragmentation or NAT support yet)
* Support for DPDK 16.07
* Optional support for DPDK pdump enabled.
* Jumbo frame support
* Remove dpdkvhostcuse port type.
* OVS client mode for vHost and vHost reconnect (Requires QEMU 2.7)
* 'dpdkvhostuserclient' port type.
- Increase number of registers to 16.
- ovs-benchmark: This utility has been removed due to lack of use and
bitrot.
- ovs-appctl:
* New "vlog/close" command.
- ovs-ctl:
* Added the ability to selectively start the forwarding and database
functions (ovs-vswitchd and ovsdb-server, respectively).
- ovsdb-server:
* Remove max number of sessions limit, to enable connection scaling
testing.
- python:
* Added support for Python 3.4+ in addition to existing support
for 2.7+.
- SELinux:
* Introduced SELinux policy package.
- Datapath Linux kernel compatibility.
* Dropped support for kernel older than 3.10.
* Removed VLAN splinters feature.
* Datapath supports kernel upto 4.7.
- Tunnels:
* Flow based tunnel match and action can be used for IPv6 address using
tun_ipv6_src, tun_ipv6_dst fields.
* Added support for IPv6 tunnels, for details checkout FAQ.
* Deprecated support for IPsec tunnels ports.
- A wrapper script, 'ovs-tcpdump', to easily port-mirror an OVS port and
watch with tcpdump
- Introduce --no-self-confinement flag that allows daemons to work with
sockets outside their run directory.
- ovs-pki: Changed message digest algorithm from SHA-1 to SHA-512 because
SHA-1 is no longer secure and some operating systems have started to
disable it in OpenSSL.
- Add 'mtu_request' column to the Interface table. It can be used to
configure the MTU of the ports.
Known issues:
- Using openvswitch module in conjunction with upstream Linux tunnels:
* When using the openvswitch module distributed with OVS against kernel
versions 4.4 to 4.6, the openvswitch module cannot be loaded or used at
the same time as "ip_gre".
- Conntrack FTP ALGs: When using the openvswitch module distributed with
OVS, particular Linux distribution kernels versions may provide diminished
functionality. This typically affects active FTP data connections when
using "actions=ct(alg=ftp),..." in flow tables. Specifically:
* Centos 7.1 kernels (3.10.0-2xx) kernels are unable to correctly set
up expectations for FTP data connections in multiple zones,
eg "actions=ct(zone=1,alg=ftp),ct(zone=2,alg=ftp),...". Executing the
"ct" action for subsequent data connections may fail to determine that
the data connection is "related" to an existing connection.
* Centos 7.2 kernels (3.10.0-3xx) kernels may not establish FTP ALG state
correctly for NATed connections. As a result, flows that perform NAT,
eg "actions=ct(nat,ftp=alg,table=1),..." may fail to NAT the packet,
and will populate the "ct_state=inv" bit in the flow.
v2.5.0 - 26 Feb 2016
---------------------
- Dropped support for Python older than version 2.7. As a consequence,
using Open vSwitch 2.5 or later on XenServer 6.5 or earlier (which
have Python 2.4) requires first installing Python 2.7.
- OpenFlow:
* Group chaining (where one OpenFlow group triggers another) is
now supported.