From ea764b7c03c610c4a3d77d1e50a2b8d214d8b223 Mon Sep 17 00:00:00 2001
From: Antonin Bas <abas@vmware.com>
Date: Tue, 11 Jul 2023 09:55:18 -0700
Subject: [PATCH] Upgrade OVS to 2.17.7 (#5225)

This is the latest patch version available for OVS 2.17.

We also fix a bug in the Dockerfile which installs OVS using .deb
packages built from source. The command that was used would try to
upgrade the openvswitch-* packages if a more recent version was
available in upstream repos, which would cause the installation to
fail. For now, we prefer to use the packages that we build from source,
as we have more granular control over which version gets installed. This
issue is fixed by using apt instead of dpkg to install the .deb packages
(this is supported in "recent" apt versions).

Thanks @Dyanngg for reporting the issue.

Signed-off-by: Antonin Bas <abas@vmware.com>
---
 build/images/deps/ovs-version     | 2 +-
 build/images/ovs/Dockerfile       | 6 +++++-
 build/images/ovs/apply-patches.sh | 4 ++--
 docs/troubleshooting.md           | 2 +-
 4 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/build/images/deps/ovs-version b/build/images/deps/ovs-version
index 728789a535a..17bbe1e98f5 100644
--- a/build/images/deps/ovs-version
+++ b/build/images/deps/ovs-version
@@ -1 +1 @@
-2.17.6
+2.17.7
diff --git a/build/images/ovs/Dockerfile b/build/images/ovs/Dockerfile
index 789603c3ba9..4e6e7aaadd3 100644
--- a/build/images/ovs/Dockerfile
+++ b/build/images/ovs/Dockerfile
@@ -53,7 +53,11 @@ COPY charon-logging.conf /tmp
 # final image.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends iptables logrotate libstrongswan-standard-plugins && \
-    (dpkg -i /tmp/ovs-debs/*.deb || apt-get -f -y --no-install-recommends install) && \
+    # -f / --fix-broken will take care of installing all missing dependencies
+    apt-get -f -y --no-install-recommends install /tmp/ovs-debs/*.deb && \
+    # make sure that openvswitch packages will not be upgraded by mistake
+    # in practice, the packages should not be upgraded anyway since they were installed using a .deb
+    apt-mark hold *openvswitch* && \
     rm -rf /var/cache/apt/* /var/lib/apt/lists/* && \
     sed -i "/rotate /a\    #size 100M" /etc/logrotate.d/openvswitch-switch && \
     sed -i "/^.*filelog.*{/r /tmp/charon-logging.conf" /etc/strongswan.d/charon-logging.conf && \
diff --git a/build/images/ovs/apply-patches.sh b/build/images/ovs/apply-patches.sh
index 1c0355cde18..03fc8d8d0ec 100755
--- a/build/images/ovs/apply-patches.sh
+++ b/build/images/ovs/apply-patches.sh
@@ -42,8 +42,8 @@ function apply_patch() {
         git apply "$@"
 }
 
-if version_lt "$OVS_VERSION" "2.13.0" || version_gt "$OVS_VERSION" "2.17.6"; then
-    echoerr "OVS_VERSION $OVS_VERSION is not supported (must be >= 2.13.0 and <= 2.17.6)"
+if version_lt "$OVS_VERSION" "2.13.0" || version_gt "$OVS_VERSION" "2.17.7"; then
+    echoerr "OVS_VERSION $OVS_VERSION is not supported (must be >= 2.13.0 and <= 2.17.7)"
     exit 1
 fi
 
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index 3550b6ca4b6..9121fb8738b 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -257,7 +257,7 @@ f06768ee-17ec-4abb-a971-b3b76abc8cda
         Port antrea-gw0
             Interface antrea-gw0
             type: internal
-    ovs_version: "2.17.6"
+    ovs_version: "2.17.7"
 ```
 
 - `ovs-ofctl show br-int`: show OpenFlow information of the OVS bridge.