1ovsdb-client(1)               Open vSwitch Manual              ovsdb-client(1)
2
3
4

NAME

6       ovsdb-client - command-line interface to ovsdb-server(1)
7

SYNOPSIS

9       Server-Level Commands:
10              ovsdb-client [options] list-dbs [server]
11
12       Database Schema Commands:
13              ovsdb-client [options] get-schema [server] [database]
14              ovsdb-client [options] list-tables [server] [database]
15              ovsdb-client [options] list-columns [server] [database] [table]
16
17       Database Version Management Commands:
18              ovsdb-client [options] convert [server] schema
19              ovsdb-client [options] needs-conversion [server] schema
20              ovsdb-client [options] get-schema-version [server] [database]
21
22       Data Management Commands:
23              ovsdb-client [options] transact [server] transaction
24              ovsdb-client [options] query [server] transaction
25              ovsdb-client  [options]  dump  [server]  [database] [table [col‐
26              umn...]]
27              ovsdb-client [options] backup [server] [database] > snapshot
28              ovsdb-client [options] [--force] restore [server]  [database]  <
29              snapshot
30              ovsdb-client  [options]  monitor [server] [database] table [col‐
31              umn[,column]...]...
32              ovsdb-client [options] monitor [server] [database] ALL
33              ovsdb-client [options] monitor-cond [server]  [database]  condi‐
34              tions table [column[,column]...]...
35              ovsdb-client [options] wait [server] database state
36
37       Testing Commands:
38              ovsdb-client [options] lock [server] lock
39              ovsdb-client [options] steal [server] lock
40              ovsdb-client [options] unlock [server] lock
41
42       Other Commands:
43              ovsdb-client help
44
45       Cluster Options:
46              [--no-leader-only]
47
48       Output formatting options:
49              [--format=format]   [--data=format]  [--no-headings]  [--pretty]
50              [--bare] [--timestamp]
51
52       Daemon options:
53              [--pidfile[=pidfile]]      [--overwrite-pidfile]      [--detach]
54              [--no-chdir] [--no-self-confinement]
55
56       Logging options:
57              [-v[module[:destination[:level]]]]...
58              [--verbose[=module[:destination[:level]]]]...
59              [--log-file[=file]]
60
61       Public key infrastructure options:
62              [--private-key=privkey.pem]
63              [--certificate=cert.pem]
64              [--ca-cert=cacert.pem]
65              [--bootstrap-ca-cert=cacert.pem]
66
67       SSL connection options:
68              [--ssl-protocols=protocols]
69              [--ssl-ciphers=ciphers]
70
71       Common options:
72              [-h | --help] [-V | --version]
73
74

DESCRIPTION

76       The  ovsdb-client program is a command-line client for interacting with
77       a running ovsdb-server process.  Each command connects to the specified
78       OVSDB  server,  which  may  be  an  OVSDB  active or passive connection
79       method,  as   described   in   ovsdb(7).    The   default   server   is
80       unix:/var/run/openvswitch/db.sock   and   the   default   database   is
81       Open_vSwitch.
82
83       ovsdb-client supports the method1,method2,...,methodN syntax  described
84       in  ovsdb(7)  for  connecting  to a cluster.  When this syntax is used,
85       ovsdb-client tries the cluster members in random order until  it  finds
86       the  cluster  leader.   Specify  the --no-leader-only option to instead
87       accept any server that is connected to the cluster.
88
89       For an introduction to OVSDB and its implementation  in  Open  vSwitch,
90       see ovsdb(7).
91
92       The  following  sections  describe  the commands that ovsdb-client sup‐
93       ports.
94
95   Server-Level Commands
96       Most ovsdb-client commands work with an individual database, but  these
97       commands apply to an entire database server.
98
99       list-dbs [server]
100              Connects  to  server, retrieves the list of known databases, and
101              prints them one per line.  These database  names  are  the  ones
102              that other commands may use for database.
103
104   Database Schema Commands
105       These  commands  obtain the schema from a database and print it or part
106       of it.
107
108       get-schema [server] [database]
109              Connects to server,  retrieves  the  schema  for  database,  and
110              prints it in JSON format.
111
112       list-tables [server] [database]
113              Connects  to  server,  retrieves  the  schema  for database, and
114              prints a table listing the name of each table within  the  data‐
115              base.
116
117       list-columns [server] [database] table
118              Connects  to  server,  retrieves  the  schema  for database, and
119              prints a table listing the name and type of each column.  If ta‐
120              ble  is specified, only columns in that table are listed; other‐
121              wise, the tables include columns in all tables.
122
123   Database Version Management Commands
124       An OVSDB schema has a schema version  number,  and  an  OVSDB  database
125       embeds  a particular version of an OVSDB schema.  These version numbers
126       take the form x.y.z, e.g. 1.2.3.  The  OVSDB  implementation  does  not
127       enforce  a  particular  version  numbering  scheme, but schemas managed
128       within the Open vSwitch project use the following  approach.   Whenever
129       the  database  schema is changed in a non-backward compatible way (e.g.
130       deleting a column or a table), x is incremented (and y and z are  reset
131       to  0).   When  the database schema is changed in a backward compatible
132       way (e.g. adding a new column), y is incremented (and z is reset to 0).
133       When  the database schema is changed cosmetically (e.g. reindenting its
134       syntax), z is incremented.
135
136       Some OVSDB databases and schemas, especially very old ones, do not have
137       a version number.
138
139       Schema  version  numbers  and Open vSwitch version numbers are indepen‐
140       dent.
141
142       These commands work with different versions of OVSDB schemas and  data‐
143       bases.
144
145       convert [server] schema
146              Reads  an OVSDB schema in JSON format, as specified in the OVSDB
147              specification, from schema, then connects to server and requests
148              the  server  to  convert the database whose name is specified in
149              schema to the schema also specified in schema.
150
151              The conversion is atomic,  consistent,  isolated,  and  durable.
152              Following  the  schema  change, the server notifies clients that
153              use the set_db_change_aware RPC introduced in Open  vSwitch  2.9
154              and  cancels  their  outstanding transactions and monitors.  The
155              server disconnects other clients, enabling them  to  notice  the
156              change when they reconnect.
157
158              This  command can do simple ``upgrades'' and ``downgrades'' on a
159              database's schema.  The data in the database must be valid  when
160              interpreted  under  schema,  with  only  one exception: data for
161              tables and columns that do not  exist  in  schema  are  ignored.
162              Columns  that exist in schema but not in the database are set to
163              their default values.  All  of  schema's  constraints  apply  in
164              full.
165
166              Some  uses  of  this  command can cause unrecoverable data loss.
167              For example, converting a database from  a  schema  that  has  a
168              given  column or table to one that does not will delete all data
169              in that column or table.  Back up critical databases before con‐
170              verting them.
171
172              This  command  works  with  clustered  and standalone databases.
173              Standalone  databases  may  also  be  converted  (offline)  with
174              ovsdb-tool's convert command.
175
176       needs-conversion [server] schema
177              Reads  the  schema  from  schema,  then  connects  to server and
178              requests the schema from the database whose name is specified in
179              schema.   If  the two schemas are the same, prints no on stdout;
180              if they differ, prints yes.
181
182       get-schema-version [server] [database]
183              Connects to server,  retrieves  the  schema  for  database,  and
184              prints  its  version  number on stdout.  If database was created
185              before schema versioning was introduced, then it will not have a
186              version number and this command will print a blank line.
187
188       get-schema-cksum [server] [database]
189              Connects  to  server,  retrieves  the  schema  for database, and
190              prints its checksum on stdout.  If database does not  include  a
191              checksum, prints a blank line.
192
193   Data Management Commands
194       These commands read or modify the data in a database.
195
196       transact [server] transaction
197              Connects  to  server,  sends it the specified transaction, which
198              must be a JSON array appropriate for use  as  the  params  to  a
199              JSON-RPC transact request, and prints the received reply on std‐
200              out.
201
202       query [server] transaction
203              This commands acts like a read-only  version  of  transact.   It
204              connects  to  server,  sends it the specified transaction, which
205              must be a JSON array appropriate for use  as  the  params  to  a
206              JSON-RPC transact request, and prints the received reply on std‐
207              out.  To ensure that the transaction does not modify  the  data‐
208              base,  this  command  appends  an  abort operation to the set of
209              operations included in transaction  before  sending  it  to  the
210              database,  and  then removes the abort result from the reply (if
211              it is present).
212
213       dump [server] [database] [table [column...]]
214              Connects to server, retrieves all of the data in  database,  and
215              prints  it  on  stdout as a series of tables. If table is speci‐
216              fied, only that table is retrieved.  If at least one  column  is
217              specified, only those columns are retrieved.
218
219       backup [server] [database] > snapshot
220              Connects  to server, retrieves a snapshot of the schema and data
221              in database, and prints it on stdout  in  the  format  used  for
222              OVSDB standalone and active-backup databases.  This is an appro‐
223              priate way to back up any remote database.  The  database  snap‐
224              shot  that  it  outputs  is suitable to be served up directly by
225              ovsdb-server or used as the input to ovsdb-client restore.
226
227              Another way to back up a standalone or active-backup database is
228              to  copy  its database file, e.g. with cp.  This is safe even if
229              the database is in use.
230
231              The output does not include ephemeral columns, which  by  design
232              do not survive across restarts of ovsdb-server.
233
234       [--force] restore [server] [database] < snapshot
235              Reads  snapshot,  which  must  be  a OVSDB standalone or active-
236              backup  database  (possibly  but  not  necessarily  created   by
237              ovsdb-client  backup).   Then, connects to server, verifies that
238              database and snapshot have the same schema, then deletes all  of
239              the  data in database and replaces it by snapshot.  The replace‐
240              ment happens atomically, in a single transaction.
241
242              UUIDs for rows in the restored database will differ  from  those
243              in  snapshot,  because the OVSDB protocol does not allow clients
244              to specify row UUIDs.  Another way to restore  a  standalone  or
245              active-backup database, which does also restore row UUIDs, is to
246              stop the server or servers, replace the  database  file  by  the
247              snapshot, then restart the database.  Either way, ephemeral col‐
248              umns are not restored, since  by  design  they  do  not  survive
249              across restarts of ovsdb-server.
250
251              Normally  restore  exits  with  a  failure  if  snapshot and the
252              server's database have different schemas.  In such a case, it is
253              a  good  idea  to  convert the database to the new schema before
254              restoring, e.g. with ovsdb-client convert.  Use --force to  pro‐
255              ceed  regardless  of  schema differences even though the restore
256              might fail with an error or succeed with surprising results.
257
258       monitor [server] [database] table [column[,column]...]...
259       monitor-cond  [server]  [database]   conditions   table   [column[,col‐
260       umn]...]...
261              Connects  to server and monitors the contents of rows that match
262              conditions in table in database. By default,  the  initial  con‐
263              tents  of  table  are  printed,  followed  by  each change as it
264              occurs.  If conditions empty, all rows will be monitored. If  at
265              least one column is specified, only those columns are monitored.
266              The following column names have special meanings:
267
268              !initial
269                     Do not print the initial contents of the  specified  col‐
270                     umns.
271
272              !insert
273                     Do not print newly inserted rows.
274
275              !delete
276                     Do not print deleted rows.
277
278              !modify
279                     Do not print modifications to existing rows.
280
281              Multiple  [column[,column]...]  groups may be specified as sepa‐
282              rate arguments, e.g. to apply different reporting parameters  to
283              each  group.   Whether multiple groups or only a single group is
284              specified, any given column may only be mentioned  once  on  the
285              command line.
286
287              conditions is a JSON array of <condition> as defined in RFC 7047
288              5.1 with the following change:  A  condition  can  be  either  a
289              3-element  JSON  array  as  deescribed  in  the RFC or a boolean
290              value..
291
292              If  --detach  is  used  with  monitor  or   monitor-cond,   then
293              ovsdb-client  detaches  after  it  has successfully received and
294              printed the initial contents of table.
295
296              The monitor command uses RFC 7047 "monitor"  method  to  open  a
297              monitor  session  with the server. The monitor-cond command uses
298              RFC 7047 extension "monitor_cond"  method.  See  ovsdb-server(1)
299              for details.
300
301       monitor [server] [database] ALL
302              Connects  to  server  and monitors the contents of all tables in
303              database.  Prints initial values and all kinds of changes to all
304              columns   in   the   database.    The   --detach  option  causes
305              ovsdb-client to detach after it successfully receives and prints
306              the initial database contents.
307
308              The  monitor  command  uses  RFC 7047 "monitor" method to open a
309              monitor session with the server.
310
311       wait [server] database state
312              Waits for database on server to enter a desired state, which may
313              be one of:
314
315              added  Waits until a database with the given name has been added
316                     to server.
317
318              connected
319                     Waits until a database with the given name has been added
320                     to  server.  Then, if database is clustered, additionally
321                     waits until it has joined and connected to its cluster.
322
323              removed
324                     Waits until database has been removed from  the  database
325                     server.   This can also be used to wait for a database to
326                     complete  leaving  its  cluster,   because   ovsdb-server
327                     removes a database at that point.
328
329              database  is mandatory for this command because it is often used
330              to check for databases that have  not  yet  been  added  to  the
331              server,  so  that  the  ovsdb-client  semantics  of  acting on a
332              default database do not work.
333
334              This command acts on a particular  database  server,  not  on  a
335              cluster, so server must name a single server, not a comma-delim‐
336              ited list of servers.
337
338   Testing commands
339       These commands are mostly of interest for testing  the  correctness  of
340       the OVSDB server.
341
342       lock [server] lock
343       steal [server] lock
344       unlock [server] lock
345              Connects to server and issues corresponding RFC 7047 lock opera‐
346              tions on lock. Prints json reply or subsequent update  messages.
347              The  --detach option causes ovsdb-client to detach after it suc‐
348              cessfully receives and prints the initial reply.
349
350              When running with the --detach option, lock, steal,  unlock  and
351              exit  commands  can  be issued by using ovs-appctl. exit command
352              causes the ovsdb-client to  close  its  ovsdb-server  connection
353              before exit.  The lock, steal and unlock commands can be used to
354              issue additional lock operations over the same ovsdb-server con‐
355              nection.  All  above commands take a single lock argument, which
356              does not have to be the  same  as  the  lock  that  ovsdb-client
357              started with.
358

OPTIONS

360   Output Formatting Options
361       Much  of  the  output  from ovsdb-client is in the form of tables.  The
362       following options controlling output formatting:
363
364       -f format
365       --format=format
366              Sets the type of table formatting.  The following types of  for‐
367              mat are available:
368
369              table (default)
370                     2-D text tables with aligned columns.
371
372              list   A  list  with one column per line and rows separated by a
373                     blank line.
374
375              html   HTML tables.
376
377              csv    Comma-separated values as defined in RFC 4180.
378
379              json   JSON format as defined in RFC  4627.   The  output  is  a
380                     sequence  of  JSON  objects, each of which corresponds to
381                     one table.  Each JSON object has  the  following  members
382                     with the noted values:
383
384                     caption
385                            The  table's  caption.   This member is omitted if
386                            the table has no caption.
387
388                     headings
389                            An array with one element per table column.   Each
390                            array element is a string giving the corresponding
391                            column's heading.
392
393                     data   An array with one element  per  table  row.   Each
394                            element  is also an array with one element per ta‐
395                            ble column.  The  elements  of  this  second-level
396                            array  are  the  cells  that constitute the table.
397                            Cells that represent OVSDB data or data types  are
398                            expressed  in  the  format  described in the OVSDB
399                            specification; other cells are simply expressed as
400                            text strings.
401
402       -d format
403       --data=format
404              Sets  the  formatting  for cells within output tables unless the
405              table format is set to json, in which case  json  formatting  is
406              always  used when formatting cells.  The following types of for‐
407              mat are available:
408
409              string (default)
410                     The simple format described in the Database  Values  sec‐
411                     tion of ovs-vsctl(8).
412
413              bare   The  simple  format with punctuation stripped off: [] and
414                     {} are omitted around  sets,  maps,  and  empty  columns,
415                     items  within  sets  and  maps  are  space-separated, and
416                     strings are never quoted.  This format may be easier  for
417                     scripts to parse.
418
419              json   The RFC 4627 JSON format as described above.
420
421       --no-headings
422              This option suppresses the heading row that otherwise appears in
423              the first row of table output.
424
425       --pretty
426              By default, JSON in output is printed as compactly as  possible.
427              This  option causes JSON in output to be printed in a more read‐
428              able fashion.  Members of objects and  elements  of  arrays  are
429              printed one per line, with indentation.
430
431              This  option  does  not  affect  JSON in tables, which is always
432              printed compactly.
433
434       --bare Equivalent to --format=list --data=bare --no-headings.
435
436       --max-column-width=n
437              For table output only, limits the width of  any  column  in  the
438              output  to  n columns.  Longer cell data is truncated to fit, as
439              necessary.  Columns are always wide enough to display the column
440              names, if the heading row is printed.
441
442       --timestamp
443              For  the  monitor  and monitor-cond commands, add a timestamp to
444              each table update.  Most output formats add the timestamp  on  a
445              line  of  its  own just above the table.  The JSON output format
446              puts the timestamp in a member  of  the  top-level  JSON  object
447              named time.
448
449       -t
450       --timeout=secs
451              Limits  ovsdb-client  runtime to approximately secs seconds.  If
452              the timeout expires, ovsdb-client will exit with a SIGALRM  sig‐
453              nal.
454
455   Daemon Options
456       The daemon options apply only to the monitor and monitor-cond commands.
457       With any other command, they have no effect.
458
459       The following options are valid on POSIX based platforms.
460
461       --pidfile[=pidfile]
462              Causes a file (by default, ovsdb-client.pid) to be created indi‐
463              cating  the PID of the running process.  If the pidfile argument
464              is not specified, or if it does not begin with  /,  then  it  is
465              created in /var/run/openvswitch.
466
467              If --pidfile is not specified, no pidfile is created.
468
469       --overwrite-pidfile
470              By  default,  when --pidfile is specified and the specified pid‐
471              file  already  exists  and  is  locked  by  a  running  process,
472              ovsdb-client  refuses  to start.  Specify --overwrite-pidfile to
473              cause it to instead overwrite the pidfile.
474
475              When --pidfile is not specified, this option has no effect.
476
477       --detach
478              Runs ovsdb-client as a background process.  The  process  forks,
479              and  in  the  child it starts a new session, closes the standard
480              file descriptors (which has the side effect of disabling logging
481              to  the  console), and changes its current directory to the root
482              (unless --no-chdir is specified).  After the child completes its
483              initialization, the parent exits.
484
485       --monitor
486              Creates  an  additional process to monitor the ovsdb-client dae‐
487              mon.  If the daemon dies due to a signal that indicates  a  pro‐
488              gramming  error  (SIGABRT, SIGALRM, SIGBUS, SIGFPE, SIGILL, SIG‐
489              PIPE, SIGSEGV, SIGXCPU, or SIGXFSZ)  then  the  monitor  process
490              starts  a  new  copy  of  it.   If  the daemon dies or exits for
491              another reason, the monitor process exits.
492
493              This option is normally used with --detach, but  it  also  func‐
494              tions without it.
495
496       --no-chdir
497              By default, when --detach is specified, ovsdb-client changes its
498              current  working  directory  to  the  root  directory  after  it
499              detaches.   Otherwise,  invoking  ovsdb-client from a carelessly
500              chosen directory would prevent the administrator from unmounting
501              the file system that holds that directory.
502
503              Specifying   --no-chdir  suppresses  this  behavior,  preventing
504              ovsdb-client from changing its current working directory.   This
505              may  be  useful  for  collecting  core files, since it is common
506              behavior to write core dumps into the current working  directory
507              and the root directory is not a good directory to use.
508
509              This option has no effect when --detach is not specified.
510
511       --no-self-confinement
512              By  default  daemon will try to self-confine itself to work with
513              files under well-know, at  build-time  whitelisted  directories.
514              It  is better to stick with this default behavior and not to use
515              this flag unless some other Access Control is  used  to  confine
516              daemon.  Note that in contrast to other access control implemen‐
517              tations that are typically enforced from kernel-space (e.g.  DAC
518              or  MAC), self-confinement is imposed from the user-space daemon
519              itself and hence should not be considered as a full  confinement
520              strategy, but instead should be viewed as an additional layer of
521              security.
522
523       --user Causes ovsdb-client to run as  a  different  user  specified  in
524              "user:group",  thus  dropping most of the root privileges. Short
525              forms "user" and ":group" are also allowed, with current user or
526              group are assumed respectively. Only daemons started by the root
527              user accepts this argument.
528
529              On   Linux,   daemons   will   be   granted   CAP_IPC_LOCK   and
530              CAP_NET_BIND_SERVICES  before  dropping root privileges. Daemons
531              that interact with a datapath, such  as  ovs-vswitchd,  will  be
532              granted  three  additional  capabilities,  namely CAP_NET_ADMIN,
533              CAP_NET_BROADCAST and CAP_NET_RAW.  The capability  change  will
534              apply even if the new user is root.
535
536              On Windows, this option is not currently supported. For security
537              reasons, specifying this option will cause  the  daemon  process
538              not to start.
539
540   Logging Options
541       -v[spec]
542       --verbose=[spec]
543              Sets  logging  levels.  Without any spec, sets the log level for
544              every module and destination to dbg.  Otherwise, spec is a  list
545              of words separated by spaces or commas or colons, up to one from
546              each category below:
547
548              ·      A valid module name, as displayed by the  vlog/list  com‐
549                     mand on ovs-appctl(8), limits the log level change to the
550                     specified module.
551
552              ·      syslog, console, or file, to limit the log  level  change
553                     to  only to the system log, to the console, or to a file,
554                     respectively.  (If --detach  is  specified,  ovsdb-client
555                     closes  its  standard file descriptors, so logging to the
556                     console will have no effect.)
557
558                     On Windows platform, syslog is accepted as a word and  is
559                     only  useful  along  with the --syslog-target option (the
560                     word has no effect otherwise).
561
562              ·      off, emer, err, warn, info, or dbg, to  control  the  log
563                     level.   Messages of the given severity or higher will be
564                     logged, and messages of lower severity will  be  filtered
565                     out.   off  filters  out all messages.  See ovs-appctl(8)
566                     for a definition of each log level.
567
568              Case is not significant within spec.
569
570              Regardless of the log levels set for file,  logging  to  a  file
571              will  not  take  place  unless --log-file is also specified (see
572              below).
573
574              For compatibility with older versions of OVS, any is accepted as
575              a word but has no effect.
576
577       -v
578       --verbose
579              Sets  the  maximum logging verbosity level, equivalent to --ver‐
580              bose=dbg.
581
582       -vPATTERN:destination:pattern
583       --verbose=PATTERN:destination:pattern
584              Sets the log pattern  for  destination  to  pattern.   Refer  to
585              ovs-appctl(8) for a description of the valid syntax for pattern.
586
587       -vFACILITY:facility
588       --verbose=FACILITY:facility
589              Sets  the  RFC5424  facility of the log message. facility can be
590              one of kern, user, mail, daemon, auth, syslog, lpr, news,  uucp,
591              clock,  ftp,  ntp, audit, alert, clock2, local0, local1, local2,
592              local3, local4, local5, local6 or local7. If this option is  not
593              specified,  daemon  is  used as the default for the local system
594              syslog and local0 is used while sending a message to the  target
595              provided via the --syslog-target option.
596
597       --log-file[=file]
598              Enables  logging  to  a  file.  If file is specified, then it is
599              used as the exact name for the log file.  The default  log  file
600              name    used    if    file    is   omitted   is   /var/log/open‐
601              vswitch/ovsdb-client.log.
602
603       --syslog-target=host:port
604              Send syslog messages to UDP port on host,  in  addition  to  the
605              system  syslog.   The host must be a numerical IP address, not a
606              hostname.
607
608       --syslog-method=method
609              Specify method how syslog messages should be sent to syslog dae‐
610              mon.  Following forms are supported:
611
612              ·      libc,  use  libc  syslog() function.  This is the default
613                     behavior.  Downside of using this options  is  that  libc
614                     adds  fixed prefix to every message before it is actually
615                     sent to the  syslog  daemon  over  /dev/log  UNIX  domain
616                     socket.
617
618              ·      unix:file, use UNIX domain socket directly.  It is possi‐
619                     ble to specify arbitrary message format with this option.
620                     However,  rsyslogd  8.9 and older versions use hard coded
621                     parser function anyway that  limits  UNIX  domain  socket
622                     use.   If  you  want to use arbitrary message format with
623                     older rsyslogd versions, then use UDP socket to localhost
624                     IP address instead.
625
626              ·      udp:ip:port, use UDP socket.  With this method it is pos‐
627                     sible to use arbitrary message  format  also  with  older
628                     rsyslogd.   When  sending syslog messages over UDP socket
629                     extra precaution needs to  be  taken  into  account,  for
630                     example,  syslog  daemon needs to be configured to listen
631                     on the specified  UDP  port,  accidental  iptables  rules
632                     could  be interfering with local syslog traffic and there
633                     are some security considerations that apply to UDP  sock‐
634                     ets, but do not apply to UNIX domain sockets.
635
636   Public Key Infrastructure Options
637       -p privkey.pem
638       --private-key=privkey.pem
639              Specifies  a  PEM  file  containing  the  private  key  used  as
640              ovsdb-client's identity for outgoing SSL connections.
641
642       -c cert.pem
643       --certificate=cert.pem
644              Specifies a PEM file containing a certificate that certifies the
645              private  key specified on -p or --private-key to be trustworthy.
646              The certificate must be signed by the certificate authority (CA)
647              that the peer in SSL connections will use to verify it.
648
649       -C cacert.pem
650       --ca-cert=cacert.pem
651              Specifies   a  PEM  file  containing  the  CA  certificate  that
652              ovsdb-client should use to verify certificates presented  to  it
653              by  SSL peers.  (This may be the same certificate that SSL peers
654              use to verify the certificate specified on -c or  --certificate,
655              or  it  may  be  a different one, depending on the PKI design in
656              use.)
657
658       -C none
659       --ca-cert=none
660              Disables verification of certificates presented  by  SSL  peers.
661              This  introduces a security risk, because it means that certifi‐
662              cates cannot be verified to be those of known trusted hosts.
663
664       --bootstrap-ca-cert=cacert.pem
665              When cacert.pem exists, this option has the same effect as -C or
666              --ca-cert.  If it does not exist, then ovsdb-client will attempt
667              to obtain the CA certificate from the SSL peer on its first  SSL
668              connection and save it to the named PEM file.  If it is success‐
669              ful, it will immediately drop the connection and reconnect,  and
670              from then on all SSL connections must be authenticated by a cer‐
671              tificate signed by the CA certificate thus obtained.
672
673              This option exposes the SSL connection  to  a  man-in-the-middle
674              attack  obtaining the initial CA certificate, but it may be use‐
675              ful for bootstrapping.
676
677              This option is only useful if the SSL peer sends its CA certifi‐
678              cate  as  part  of  the SSL certificate chain.  The SSL protocol
679              does not require the server to send the CA certificate.
680
681              This option is mutually exclusive with -C and --ca-cert.
682
683   SSL Connection Options
684       --ssl-protocols=protocols
685              Specifies, in a comma- or space-delimited list, the  SSL  proto‐
686              cols  ovsdb-client  will  enable for SSL connections.  Supported
687              protocols include TLSv1, TLSv1.1, and  TLSv1.2.   Regardless  of
688              order, the highest protocol supported by both sides will be cho‐
689              sen when making the connection.  The default when this option is
690              omitted is TLSv1,TLSv1.1,TLSv1.2.
691
692       --ssl-ciphers=ciphers
693              Specifies,   in   OpenSSL  cipher  string  format,  the  ciphers
694              ovsdb-client will support for SSL connections.  The default when
695              this option is omitted is HIGH:!aNULL:!MD5.
696
697   Other Options
698       -h
699       --help Prints a brief help message to the console.
700
701       -V
702       --version
703              Prints version information to the console.
704

SEE ALSO

706       ovsdb(7), ovsdb-server(1), ovsdb-client(1).
707
708
709
710Open vSwitch                        2.10.0                     ovsdb-client(1)
Impressum