2019-05-19 15:07:45 +03:00
# SPDX-License-Identifier: GPL-2.0-only
2011-10-26 06:26:31 +04:00
#
# Open vSwitch
#
config OPENVSWITCH
tristate "Open vSwitch"
2014-11-14 09:21:30 +03:00
depends on INET
2015-09-12 01:01:16 +03:00
depends on !NF_CONNTRACK || \
2016-03-10 21:54:23 +03:00
(NF_CONNTRACK && ((!NF_DEFRAG_IPV6 || NF_DEFRAG_IPV6) && \
2016-03-18 16:33:45 +03:00
(!NF_NAT || NF_NAT) && \
openvswitch: Support conntrack zone limit
Currently, nf_conntrack_max is used to limit the maximum number of
conntrack entries in the conntrack table for every network namespace.
For the VMs and containers that reside in the same namespace,
they share the same conntrack table, and the total # of conntrack entries
for all the VMs and containers are limited by nf_conntrack_max. In this
case, if one of the VM/container abuses the usage the conntrack entries,
it blocks the others from committing valid conntrack entries into the
conntrack table. Even if we can possibly put the VM in different network
namespace, the current nf_conntrack_max configuration is kind of rigid
that we cannot limit different VM/container to have different # conntrack
entries.
To address the aforementioned issue, this patch proposes to have a
fine-grained mechanism that could further limit the # of conntrack entries
per-zone. For example, we can designate different zone to different VM,
and set conntrack limit to each zone. By providing this isolation, a
mis-behaved VM only consumes the conntrack entries in its own zone, and
it will not influence other well-behaved VMs. Moreover, the users can
set various conntrack limit to different zone based on their preference.
The proposed implementation utilizes Netfilter's nf_conncount backend
to count the number of connections in a particular zone. If the number of
connection is above a configured limitation, ovs will return ENOMEM to the
userspace. If userspace does not configure the zone limit, the limit
defaults to zero that is no limitation, which is backward compatible to
the behavior without this patch.
The following high leve APIs are provided to the userspace:
- OVS_CT_LIMIT_CMD_SET:
* set default connection limit for all zones
* set the connection limit for a particular zone
- OVS_CT_LIMIT_CMD_DEL:
* remove the connection limit for a particular zone
- OVS_CT_LIMIT_CMD_GET:
* get the default connection limit for all zones
* get the connection limit for a particular zone
Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com>
Acked-by: Pravin B Shelar <pshelar@ovn.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-25 03:56:43 +03:00
(!NETFILTER_CONNCOUNT || NETFILTER_CONNCOUNT)))
2013-08-22 23:30:48 +04:00
select LIBCRC32C
2015-03-08 01:24:23 +03:00
select MPLS
2014-11-14 09:21:30 +03:00
select NET_MPLS_GSO
2016-02-12 17:43:57 +03:00
select DST_CACHE
2017-11-07 16:07:02 +03:00
select NET_NSH
2020-06-13 19:50:22 +03:00
help
2011-10-26 06:26:31 +04:00
Open vSwitch is a multilayer Ethernet switch targeted at virtualized
environments. In addition to supporting a variety of features
expected in a traditional hardware switch, it enables fine-grained
programmatic extension and flow-based control of the network. This
control is useful in a wide variety of applications but is
particularly important in multi-server virtualization deployments,
which are often characterized by highly dynamic endpoints and the
need to maintain logical abstractions for multiple tenants.
The Open vSwitch datapath provides an in-kernel fast path for packet
forwarding. It is complemented by a userspace daemon, ovs-vswitchd,
which is able to accept configuration from a variety of sources and
translate it into packet processing rules.
See http://openvswitch.org for more information and userspace
utilities.
To compile this code as a module, choose M here: the module will be
called openvswitch.
If unsure, say N.
2013-06-29 03:07:40 +04:00
config OPENVSWITCH_GRE
2014-10-22 19:29:06 +04:00
tristate "Open vSwitch GRE tunneling support"
2013-06-29 03:07:40 +04:00
depends on OPENVSWITCH
2015-08-08 09:51:47 +03:00
depends on NET_IPGRE
2014-10-22 19:29:06 +04:00
default OPENVSWITCH
2020-06-13 19:50:22 +03:00
help
2013-06-29 03:07:40 +04:00
If you say Y here, then the Open vSwitch will be able create GRE
vport.
Say N to exclude this support and reduce the binary size.
If unsure, say Y.
2013-08-19 22:23:34 +04:00
2015-07-29 14:52:06 +03:00
config OPENVSWITCH_VXLAN
tristate "Open vSwitch VXLAN tunneling support"
depends on OPENVSWITCH
depends on VXLAN
default OPENVSWITCH
2020-06-13 19:50:22 +03:00
help
2015-07-29 14:52:06 +03:00
If you say Y here, then the Open vSwitch will be able create vxlan vport.
Say N to exclude this support and reduce the binary size.
If unsure, say Y.
2014-10-04 02:35:33 +04:00
config OPENVSWITCH_GENEVE
2014-10-22 19:29:06 +04:00
tristate "Open vSwitch Geneve tunneling support"
2014-10-04 02:35:33 +04:00
depends on OPENVSWITCH
2015-08-27 09:46:53 +03:00
depends on GENEVE
2014-10-22 19:29:06 +04:00
default OPENVSWITCH
2020-06-13 19:50:22 +03:00
help
2014-10-04 02:35:33 +04:00
If you say Y here, then the Open vSwitch will be able create geneve vport.
Say N to exclude this support and reduce the binary size.
