[ovs-dev] [GIT PULL v2] Open vSwitch

[Jamal Hadi Salim]

On Mon, 2011-11-28 at 21:04 +0800, Herbert Xu wrote:

> You're right, a new classifier for the hash table would be the
> best option.
>  
> > I cant find one - you may. After staring at the code, I am also now
> > questioning if the existing bridge code couldnt have been re-used with
> > some small tweaks.
> 
> I wasn't able to find any functionality that could not be easily
> done with the existing classifier/action code.

Thanks for validating Herbert. 

> Whether we want to go down this route though is open to debate
> as someone would have to actually implement this :)

I empathize that effort has been invested in coding the way it was. 
But this is where an RFC to netdev would have been useful instead of
reinventing things. I dont see it as a huge effort really; the
refactoring should be mostly in user space.

Along the same lines:
Even for the integration with existing silicon I am worried that using
openvswitch as a proxy is not the right thing to do (the Intel approach
or the DSA approach where Linux is the proxy is the right thing to
do(TM).

> However, what's more worrying for me right now is the gaping
> DoS opportunities that exist in the patch as is.
> 
> In particular, the whole design principle of punting all new
> flows to user-space is an excellent way of attacking the system.

Indeed this is an issue with openflow in general.
The general solution is to rate limit how much goes to the controller
but even that is insufficient.

cheers,
jamal