Accepting request 1244140 from network

OBS-URL: https://build.opensuse.org/request/show/1244140 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openvswitch?expand=0&rev=79
- Update openvswitch to 3.3.2. For a list of changes, check
2025-02-09 19:00:19 +00:00 · 2025-02-07 12:30:08 +00:00 · 2025-01-02 18:19:30 +00:00 · 2025-01-01 12:36:09 +00:00 · 2024-09-04 11:22:02 +00:00 · 2024-08-05 15:20:17 +00:00
13 changed files with 28 additions and 1030 deletions
--- a/CVE-2023-1668.patch
+++ b/CVE-2023-1668.patch
@ -1,517 +0,0 @@
-commit 9d840923d32124fe427de76e8234c49d64e4bb77
-Author: Aaron Conole <aconole@redhat.com>
-Date:   Fri Mar 31 17:17:27 2023 -0400
-
-    ofproto-dpif-xlate: Always mask ip proto field.
-     
-    The ofproto layer currently treats nw_proto field as overloaded to mean
-    both that a proper nw layer exists, as well as the value contained in
-    the header for the nw proto.  However, this is incorrect behavior as
-    relevant standards permit that any value, including '0' should be treated
-    as a valid value. 
-    
-    Because of this overload, when the ofproto layer builds action list for
-    a packet with nw_proto of 0, it won't build the complete action list that
-    we expect to be built for the packet.  That will cause a bad behavior
-    where all packets passing the datapath will fall into an incomplete
-    action set.
-     
-    The fix here is to unwildcard nw_proto, allowing us to preserve setting
-    actions for protocols which we know have support for the actions we
-    program.  This means that a traffic which contains nw_proto == 0 cannot
-    cause connectivity breakage with other traffic on the link.
-    
-    Reported-by: David Marchand <dmarchand@redhat.com>
-    Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=2134873
-    Acked-by: Ilya Maximets <i.maximets@ovn.org>
-    Signed-off-by: Aaron Conole <aconole@redhat.com>
-    Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
-
-
-diff --git a/include/openvswitch/meta-flow.h b/include/openvswitch/meta-flow.h
-index 045dce8f5..3b0220aaa 100644
--- a/include/openvswitch/meta-flow.h
-+++ b/include/openvswitch/meta-flow.h
-@@ -2366,6 +2366,10 @@ void mf_format_subvalue(const union mf_subvalue *subvalue, struct ds *s);
- void field_array_set(enum mf_field_id id, const union mf_value *,
-                      struct field_array *);
- 
-+/* Mask the required l3 prerequisites if a 'set' action occurs. */
-+void mf_set_mask_l3_prereqs(const struct mf_field *, const struct flow *,
-+                            struct flow_wildcards *);
-+
- #ifdef __cplusplus
- }
- #endif
-diff --git a/lib/meta-flow.c b/lib/meta-flow.c
-index c576ae620..474344194 100644
--- a/lib/meta-flow.c
-+++ b/lib/meta-flow.c
-@@ -3676,3 +3676,28 @@ mf_bitmap_not(struct mf_bitmap x)
-     bitmap_not(x.bm, MFF_N_IDS);
-     return x;
- }
-+
-+void
-+mf_set_mask_l3_prereqs(const struct mf_field *mf, const struct flow *fl,
-+                       struct flow_wildcards *wc)
-+{
-+    if (is_ip_any(fl) &&
-+        ((mf->id == MFF_IPV4_SRC) ||
-+         (mf->id == MFF_IPV4_DST) ||
-+         (mf->id == MFF_IPV6_SRC) ||
-+         (mf->id == MFF_IPV6_DST) ||
-+         (mf->id == MFF_IPV6_LABEL) ||
-+         (mf->id == MFF_IP_DSCP) ||
-+         (mf->id == MFF_IP_ECN) ||
-+         (mf->id == MFF_IP_TTL))) {
-+        WC_MASK_FIELD(wc, nw_proto);
-+    } else if ((fl->dl_type == htons(ETH_TYPE_ARP)) &&
-+               ((mf->id == MFF_ARP_OP) ||
-+                (mf->id == MFF_ARP_SHA) ||
-+                (mf->id == MFF_ARP_THA) ||
-+                (mf->id == MFF_ARP_SPA) ||
-+                (mf->id == MFF_ARP_TPA))) {
-+        /* mask only the lower 8 bits. */
-+        wc->masks.nw_proto = 0xff;
-+    }
-+}
-diff --git a/ofproto/ofproto-dpif-xlate.c b/ofproto/ofproto-dpif-xlate.c
-index a9cf3cbee..cffd733c5 100644
--- a/ofproto/ofproto-dpif-xlate.c
-+++ b/ofproto/ofproto-dpif-xlate.c
-@@ -5211,6 +5211,7 @@ compose_dec_ttl(struct xlate_ctx *ctx, struct ofpact_cnt_ids *ids)
-     }
- 
-     ctx->wc->masks.nw_ttl = 0xff;
-+    WC_MASK_FIELD(ctx->wc, nw_proto);
-     if (flow->nw_ttl > 1) {
-         flow->nw_ttl--;
-         return false;
-@@ -7128,6 +7129,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
-         case OFPACT_SET_IPV4_SRC:
-             if (flow->dl_type == htons(ETH_TYPE_IP)) {
-                 memset(&wc->masks.nw_src, 0xff, sizeof wc->masks.nw_src);
-+                WC_MASK_FIELD(wc, nw_proto);
-                 flow->nw_src = ofpact_get_SET_IPV4_SRC(a)->ipv4;
-             }
-             break;
-@@ -7135,12 +7137,14 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
-         case OFPACT_SET_IPV4_DST:
-             if (flow->dl_type == htons(ETH_TYPE_IP)) {
-                 memset(&wc->masks.nw_dst, 0xff, sizeof wc->masks.nw_dst);
-+                WC_MASK_FIELD(wc, nw_proto);
-                 flow->nw_dst = ofpact_get_SET_IPV4_DST(a)->ipv4;
-             }
-             break;
- 
-         case OFPACT_SET_IP_DSCP:
-             if (is_ip_any(flow)) {
-+                WC_MASK_FIELD(wc, nw_proto);
-                 wc->masks.nw_tos |= IP_DSCP_MASK;
-                 flow->nw_tos &= ~IP_DSCP_MASK;
-                 flow->nw_tos |= ofpact_get_SET_IP_DSCP(a)->dscp;
-@@ -7149,6 +7153,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
- 
-         case OFPACT_SET_IP_ECN:
-             if (is_ip_any(flow)) {
-+                WC_MASK_FIELD(wc, nw_proto);
-                 wc->masks.nw_tos |= IP_ECN_MASK;
-                 flow->nw_tos &= ~IP_ECN_MASK;
-                 flow->nw_tos |= ofpact_get_SET_IP_ECN(a)->ecn;
-@@ -7157,6 +7162,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
- 
-         case OFPACT_SET_IP_TTL:
-             if (is_ip_any(flow)) {
-+                WC_MASK_FIELD(wc, nw_proto);
-                 wc->masks.nw_ttl = 0xff;
-                 flow->nw_ttl = ofpact_get_SET_IP_TTL(a)->ttl;
-             }
-@@ -7224,6 +7230,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
- 
-             /* Set the field only if the packet actually has it. */
-             if (mf_are_prereqs_ok(mf, flow, wc)) {
-+                mf_set_mask_l3_prereqs(mf, flow, wc);
-                 mf_mask_field_masked(mf, ofpact_set_field_mask(set_field), wc);
-                 mf_set_flow_value_masked(mf, set_field->value,
-                                          ofpact_set_field_mask(set_field),
-@@ -7280,6 +7287,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
- 
-         case OFPACT_DEC_TTL:
-             wc->masks.nw_ttl = 0xff;
-+            WC_MASK_FIELD(wc, nw_proto);
-             if (compose_dec_ttl(ctx, ofpact_get_DEC_TTL(a))) {
-                 return;
-             }
-diff --git a/tests/ofproto-dpif.at b/tests/ofproto-dpif.at
-index fa6111c1e..62291de4a 100644
--- a/tests/ofproto-dpif.at
-+++ b/tests/ofproto-dpif.at
-@@ -849,7 +849,7 @@ table=2 ip actions=set_field:192.168.3.91->ip_src,output(11)
- AT_CHECK([ovs-ofctl -O OpenFlow12 add-flows br0 flows.txt])
- AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=1,nw_tos=0,nw_ttl=128,nw_frag=no,icmp_type=8,icmp_code=0'], [0], [stdout])
- AT_CHECK([tail -2 stdout], [0],
-  [Megaflow: recirc_id=0,eth,ip,in_port=1,nw_src=192.168.0.1,nw_frag=no
-+  [Megaflow: recirc_id=0,eth,icmp,in_port=1,nw_src=192.168.0.1,nw_frag=no
- Datapath actions: 10,set(ipv4(src=192.168.3.91)),11,set(ipv4(src=192.168.3.90)),13
- ])
- OVS_VSWITCHD_STOP
-@@ -912,7 +912,7 @@ AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_ds
- # Must match on the source address to be able to restore it's value for
- # the second bucket
- AT_CHECK([tail -2 stdout], [0],
-  [Megaflow: recirc_id=0,eth,ip,in_port=1,nw_src=192.168.0.1,nw_frag=no
-+  [Megaflow: recirc_id=0,eth,icmp,in_port=1,nw_src=192.168.0.1,nw_frag=no
- Datapath actions: set(ipv4(src=192.168.3.90)),10,set(ipv4(src=192.168.0.1)),11
- ])
- OVS_VSWITCHD_STOP
-@@ -944,7 +944,7 @@ done
- AT_CHECK([ovs-appctl dpctl/dump-flows | sed 's/dp_hash(.*\/0xf)/dp_hash(0xXXXX\/0xf)/' |  sed 's/packets.*actions:/actions:/' | strip_ufid | strip_used | sort], [0], [dnl
- flow-dump from the main thread:
- recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(frag=no), actions:hash(sym_l4(0)),recirc(0x1)
-recirc_id(0x1),dp_hash(0xXXXX/0xf),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(src=192.168.0.1,frag=no), actions:set(ipv4(src=192.168.3.90)),10,set(ipv4(src=192.168.0.1)),10
-+recirc_id(0x1),dp_hash(0xXXXX/0xf),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(src=192.168.0.1,proto=1,frag=no), actions:set(ipv4(src=192.168.3.90)),10,set(ipv4(src=192.168.0.1)),10
- ])
- 
- OVS_VSWITCHD_STOP
-@@ -959,7 +959,7 @@ AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_ds
- # Must match on the source address to be able to restore it's value for
- # the third bucket
- AT_CHECK([tail -2 stdout], [0],
-  [Megaflow: recirc_id=0,eth,ip,in_port=1,nw_src=192.168.0.1,nw_frag=no
-+  [Megaflow: recirc_id=0,eth,icmp,in_port=1,nw_src=192.168.0.1,nw_frag=no
- Datapath actions: set(ipv4(src=192.168.3.90)),10,set(ipv4(src=192.168.0.1)),11
- ])
- OVS_VSWITCHD_STOP
-@@ -1536,17 +1536,17 @@ AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
- AT_CHECK([ovs-appctl ofproto/trace ovs-dummy 'in_port(1),eth(src=50:54:00:00:00:05,dst=50:54:00:00:00:07),eth_type(0x0800),ipv4(src=192.168.0.1,dst=192.168.0.2,proto=111,tos=0,ttl=2,frag=no)' -generate], [0], [stdout])
- AT_CHECK([tail -4 stdout], [0], [
- Final flow: ip,in_port=1,vlan_tci=0x0000,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=111,nw_tos=0,nw_ecn=0,nw_ttl=1,nw_frag=no
-Megaflow: recirc_id=0,eth,ip,in_port=1,nw_ttl=2,nw_frag=no
-+Megaflow: recirc_id=0,eth,ip,in_port=1,nw_proto=111,nw_ttl=2,nw_frag=no
- Datapath actions: set(ipv4(ttl=1)),2,userspace(pid=0,controller(reason=2,dont_send=0,continuation=0,recirc_id=1,rule_cookie=0,controller_id=0,max_len=65535)),4
- ])
- AT_CHECK([ovs-appctl ofproto/trace ovs-dummy 'in_port(1),eth(src=50:54:00:00:00:05,dst=50:54:00:00:00:07),eth_type(0x0800),ipv4(src=192.168.0.1,dst=192.168.0.2,proto=111,tos=0,ttl=3,frag=no)'], [0], [stdout])
- AT_CHECK([tail -2 stdout], [0],
-  [Megaflow: recirc_id=0,eth,ip,in_port=1,nw_ttl=3,nw_frag=no
-+  [Megaflow: recirc_id=0,eth,ip,in_port=1,nw_proto=111,nw_ttl=3,nw_frag=no
- Datapath actions: set(ipv4(ttl=2)),2,set(ipv4(ttl=1)),3,4
- ])
- AT_CHECK([ovs-appctl ofproto/trace ovs-dummy 'in_port(1),eth(src=50:54:00:00:00:05,dst=50:54:00:00:00:07),eth_type(0x86dd),ipv6(src=::1,dst=::2,label=0,proto=10,tclass=0x70,hlimit=128,frag=no)'], [0], [stdout])
- AT_CHECK([tail -2 stdout], [0],
-  [Megaflow: recirc_id=0,eth,ipv6,in_port=1,nw_ttl=128,nw_frag=no
-+  [Megaflow: recirc_id=0,eth,ipv6,in_port=1,nw_proto=10,nw_ttl=128,nw_frag=no
- Datapath actions: set(ipv6(hlimit=127)),2,set(ipv6(hlimit=126)),3,4
- ])
- 
-@@ -1656,7 +1656,7 @@ AT_CHECK([ovs-vsctl -- \
-         --id=@q2 create Queue dscp=2], [0], [ignore])
- AT_CHECK([ovs-appctl ofproto/trace ovs-dummy 'in_port(9),eth(src=50:54:00:00:00:05,dst=50:54:00:00:00:07),eth_type(0x0800),ipv4(src=1.1.1.1,dst=2.2.2.2,proto=1,tos=0xff,ttl=128,frag=no),icmp(type=8,code=0)'], [0], [stdout])
- AT_CHECK([tail -2 stdout], [0],
-  [Megaflow: recirc_id=0,skb_priority=0,eth,ip,in_port=9,nw_tos=252,nw_frag=no
-+  [Megaflow: recirc_id=0,skb_priority=0,eth,icmp,in_port=9,nw_tos=252,nw_frag=no
- Datapath actions: dnl
- 100,dnl
- set(ipv4(tos=0x4/0xfc)),set(skb_priority(0x1)),1,dnl
-@@ -8777,12 +8777,12 @@ recirc_id(0),in_port(3),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(frag=no), p
- ])
- 
- AT_CHECK([ovs-appctl dpif/dump-flows -m br0 | strip_ufid | strip_used | sort], [0], [dnl
-skb_priority(0/0),skb_mark(0/0),ct_state(0/0),ct_zone(0/0),ct_mark(0/0),ct_label(0/0),recirc_id(0),dp_hash(0/0),in_port(p1),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:05/00:00:00:00:00:00,dst=50:54:00:00:00:07/00:00:00:00:00:00),eth_type(0x0800),ipv4(src=192.168.0.1/0.0.0.0,dst=192.168.0.2/0.0.0.0,proto=1/0,tos=0/0,ttl=64/0,frag=no),icmp(type=8/0,code=0/0), packets:0, bytes:0, used:never, actions:drop
-skb_priority(0/0),skb_mark(0/0),ct_state(0/0),ct_zone(0/0),ct_mark(0/0),ct_label(0/0),recirc_id(0),dp_hash(0/0),in_port(p2),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:07/00:00:00:00:00:00,dst=50:54:00:00:00:05/00:00:00:00:00:00),eth_type(0x0800),ipv4(src=192.168.0.2/0.0.0.0,dst=192.168.0.1/0.0.0.0,proto=1/0,tos=0/0,ttl=64/0,frag=no),icmp(type=0/0,code=0/0), packets:0, bytes:0, used:never, actions:drop
-+recirc_id(0),dp_hash(0/0),skb_priority(0/0),in_port(p1),skb_mark(0/0),ct_state(0/0),ct_zone(0/0),ct_mark(0/0),ct_label(0/0),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:05/00:00:00:00:00:00,dst=50:54:00:00:00:07/00:00:00:00:00:00),eth_type(0x0800),ipv4(src=192.168.0.1/0.0.0.0,dst=192.168.0.2/0.0.0.0,proto=1/0,tos=0/0,ttl=64/0,frag=no),icmp(type=8/0,code=0/0), packets:0, bytes:0, used:never, actions:drop
-+recirc_id(0),dp_hash(0/0),skb_priority(0/0),in_port(p2),skb_mark(0/0),ct_state(0/0),ct_zone(0/0),ct_mark(0/0),ct_label(0/0),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:07/00:00:00:00:00:00,dst=50:54:00:00:00:05/00:00:00:00:00:00),eth_type(0x0800),ipv4(src=192.168.0.2/0.0.0.0,dst=192.168.0.1/0.0.0.0,proto=1/0,tos=0/0,ttl=64/0,frag=no),icmp(type=0/0,code=0/0), packets:0, bytes:0, used:never, actions:drop
- ])
- 
- AT_CHECK([ovs-appctl dpif/dump-flows -m br1 | strip_ufid | strip_used | sort], [0], [dnl
-skb_priority(0/0),skb_mark(0/0),ct_state(0/0),ct_zone(0/0),ct_mark(0/0),ct_label(0/0),recirc_id(0),dp_hash(0/0),in_port(p3),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:09/00:00:00:00:00:00,dst=50:54:00:00:00:0a/00:00:00:00:00:00),eth_type(0x0800),ipv4(src=10.0.0.2/0.0.0.0,dst=10.0.0.1/0.0.0.0,proto=1/0,tos=0/0,ttl=64/0,frag=no),icmp(type=8/0,code=0/0), packets:0, bytes:0, used:never, actions:drop
-+recirc_id(0),dp_hash(0/0),skb_priority(0/0),in_port(p3),skb_mark(0/0),ct_state(0/0),ct_zone(0/0),ct_mark(0/0),ct_label(0/0),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:09/00:00:00:00:00:00,dst=50:54:00:00:00:0a/00:00:00:00:00:00),eth_type(0x0800),ipv4(src=10.0.0.2/0.0.0.0,dst=10.0.0.1/0.0.0.0,proto=1/0,tos=0/0,ttl=64/0,frag=no),icmp(type=8/0,code=0/0), packets:0, bytes:0, used:never, actions:drop
- ])
- 
- OVS_VSWITCHD_STOP
-@@ -8942,10 +8942,10 @@ recirc_id(0),in_port(101),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(frag=no),
- ])
- 
- AT_CHECK([grep -e 'in_port(100).*packets:9' ovs-vswitchd.log | strip_ufid | filter_flow_dump], [0], [dnl
-skb_priority(0/0),skb_mark(0/0),ct_state(0/0),ct_zone(0/0),ct_mark(0/0),ct_label(0/0),recirc_id(0),dp_hash(0/0),in_port(100),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:05/00:00:00:00:00:00,dst=50:54:00:00:00:07/00:00:00:00:00:00),eth_type(0x0800),ipv4(src=192.168.0.1/0.0.0.0,dst=192.168.0.2/0.0.0.0,proto=1/0,tos=0/0,ttl=64/0,frag=no),icmp(type=8/0,code=0/0), packets:9, bytes:954, used:0.0s, actions:101,3,2
-+recirc_id(0),dp_hash(0/0),skb_priority(0/0),in_port(100),skb_mark(0/0),ct_state(0/0),ct_zone(0/0),ct_mark(0/0),ct_label(0/0),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:05/00:00:00:00:00:00,dst=50:54:00:00:00:07/00:00:00:00:00:00),eth_type(0x0800),ipv4(src=192.168.0.1/0.0.0.0,dst=192.168.0.2/0.0.0.0,proto=1/0,tos=0/0,ttl=64/0,frag=no),icmp(type=8/0,code=0/0), packets:9, bytes:954, used:0.0s, actions:101,3,2
- ])
- AT_CHECK([grep -e 'in_port(101).*packets:4' ovs-vswitchd.log | strip_ufid | filter_flow_dump], [0], [dnl
-skb_priority(0/0),skb_mark(0/0),ct_state(0/0),ct_zone(0/0),ct_mark(0/0),ct_label(0/0),recirc_id(0),dp_hash(0/0),in_port(101),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:07/00:00:00:00:00:00,dst=50:54:00:00:00:05/00:00:00:00:00:00),eth_type(0x0800),ipv4(src=192.168.0.2/0.0.0.0,dst=192.168.0.1/0.0.0.0,proto=1/0,tos=0/0,ttl=64/0,frag=no),icmp(type=8/0,code=0/0), packets:4, bytes:424, used:0.0s, actions:100,2,3
-+recirc_id(0),dp_hash(0/0),skb_priority(0/0),in_port(101),skb_mark(0/0),ct_state(0/0),ct_zone(0/0),ct_mark(0/0),ct_label(0/0),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:07/00:00:00:00:00:00,dst=50:54:00:00:00:05/00:00:00:00:00:00),eth_type(0x0800),ipv4(src=192.168.0.2/0.0.0.0,dst=192.168.0.1/0.0.0.0,proto=1/0,tos=0/0,ttl=64/0,frag=no),icmp(type=8/0,code=0/0), packets:4, bytes:424, used:0.0s, actions:100,2,3
- ])
- 
- AT_CHECK([ovs-ofctl dump-ports br0 pbr0], [0], [dnl
-@@ -9637,12 +9637,12 @@ table=0 in_port=1,ip,nw_dst=10.0.0.3 actions=drop
-    done
-    sleep 1
-    AT_CHECK([strip_ufid < ovs-vswitchd.log | filter_flow_install | strip_used], [0], [dnl
-skb_priority(0),skb_mark(0),ct_state(-new-est-rel-rpl-inv-trk-snat-dnat),ct_zone(0),ct_mark(0),ct_label(0),recirc_id(0),dp_hash(0),in_port(1),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.0.0.2,dst=10.0.0.1,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0), actions:2
-skb_priority(0),skb_mark(0),ct_state(-new-est-rel-rpl-inv-trk-snat-dnat),ct_zone(0),ct_mark(0),ct_label(0),recirc_id(0),dp_hash(0),in_port(1),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=10.0.0.4,dst=10.0.0.3,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0), actions:drop
-+recirc_id(0),dp_hash(0),skb_priority(0),in_port(1),skb_mark(0),ct_state(-new-est-rel-rpl-inv-trk-snat-dnat),ct_zone(0),ct_mark(0),ct_label(0),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.0.0.2,dst=10.0.0.1,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0), actions:2
-+recirc_id(0),dp_hash(0),skb_priority(0),in_port(1),skb_mark(0),ct_state(-new-est-rel-rpl-inv-trk-snat-dnat),ct_zone(0),ct_mark(0),ct_label(0),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=10.0.0.4,dst=10.0.0.3,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0), actions:drop
- ])
-    AT_CHECK([strip_ufid < ovs-vswitchd.log | filter_flow_dump | grep 'packets:3'], [0], [dnl
-skb_priority(0),skb_mark(0),ct_state(0/0xff),ct_zone(0),ct_mark(0),ct_label(0),recirc_id(0),dp_hash(0),in_port(1),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.0.0.2,dst=10.0.0.1,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0), packets:3, bytes:318, used:0.0s, actions:2
-skb_priority(0),skb_mark(0),ct_state(0/0xff),ct_zone(0),ct_mark(0),ct_label(0),recirc_id(0),dp_hash(0),in_port(1),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=10.0.0.4,dst=10.0.0.3,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0), packets:3, bytes:318, used:0.0s, actions:drop
-+recirc_id(0),dp_hash(0),skb_priority(0),in_port(1),skb_mark(0),ct_state(0/0xff),ct_zone(0),ct_mark(0),ct_label(0),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.0.0.2,dst=10.0.0.1,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0), packets:3, bytes:318, used:0.0s, actions:2
-+recirc_id(0),dp_hash(0),skb_priority(0),in_port(1),skb_mark(0),ct_state(0/0xff),ct_zone(0),ct_mark(0),ct_label(0),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=10.0.0.4,dst=10.0.0.3,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0), packets:3, bytes:318, used:0.0s, actions:drop
- ])
-    OVS_VSWITCHD_STOP
-    AT_CLEANUP])
-@@ -10344,7 +10344,7 @@ recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x1234), packets:5, byte
- ])
- 
- AT_CHECK([grep 'modify' ovs-vswitchd.log | strip_ufid ], [0], [dnl
-dpif|DBG|dummy@ovs-dummy: put[[modify]] skb_priority(0/0),skb_mark(0/0),ct_state(0/0),ct_zone(0/0),ct_mark(0/0),ct_label(0/0),recirc_id(0),dp_hash(0/0),in_port(1),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:09/00:00:00:00:00:00,dst=50:54:00:00:00:0a/00:00:00:00:00:00),eth_type(0x1234), actions:push_vlan(vid=4,pcp=0),100
-+dpif|DBG|dummy@ovs-dummy: put[[modify]] recirc_id(0),dp_hash(0/0),skb_priority(0/0),in_port(1),skb_mark(0/0),ct_state(0/0),ct_zone(0/0),ct_mark(0/0),ct_label(0/0),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:09/00:00:00:00:00:00,dst=50:54:00:00:00:0a/00:00:00:00:00:00),eth_type(0x1234), actions:push_vlan(vid=4,pcp=0),100
- ])
- OVS_VSWITCHD_STOP
- AT_CLEANUP
-@@ -10425,8 +10425,8 @@ recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x8100),vlan(vid=99,pcp=
- # are wildcarded.
- AT_CHECK([grep '\(modify\)\|\(flow_add\)' ovs-vswitchd.log | strip_ufid ], [0], [dnl
- dpif_netdev|DBG|flow_add: recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x1234), actions:100
-dpif|DBG|dummy@ovs-dummy: put[[modify]] skb_priority(0/0),skb_mark(0/0),ct_state(0/0),ct_zone(0/0),ct_mark(0/0),ct_label(0/0),recirc_id(0),dp_hash(0/0),in_port(1),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:09/00:00:00:00:00:00,dst=50:54:00:00:00:0a/00:00:00:00:00:00),eth_type(0x1234), actions:drop
-dpif|DBG|dummy@ovs-dummy: put[[modify]] skb_priority(0/0),skb_mark(0/0),ct_state(0/0),ct_zone(0/0),ct_mark(0/0),ct_label(0/0),recirc_id(0),dp_hash(0/0),in_port(1),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:09/00:00:00:00:00:00,dst=50:54:00:00:00:0a/00:00:00:00:00:00),eth_type(0x1234), actions:100
-+dpif|DBG|dummy@ovs-dummy: put[[modify]] recirc_id(0),dp_hash(0/0),skb_priority(0/0),in_port(1),skb_mark(0/0),ct_state(0/0),ct_zone(0/0),ct_mark(0/0),ct_label(0/0),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:09/00:00:00:00:00:00,dst=50:54:00:00:00:0a/00:00:00:00:00:00),eth_type(0x1234), actions:drop
-+dpif|DBG|dummy@ovs-dummy: put[[modify]] recirc_id(0),dp_hash(0/0),skb_priority(0/0),in_port(1),skb_mark(0/0),ct_state(0/0),ct_zone(0/0),ct_mark(0/0),ct_label(0/0),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:09/00:00:00:00:00:00,dst=50:54:00:00:00:0a/00:00:00:00:00:00),eth_type(0x1234), actions:100
- dpif_netdev|DBG|flow_add: recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x8100),vlan(vid=99,pcp=7/0x0),encap(eth_type(0x1234)), actions:drop
- ])
- OVS_VSWITCHD_STOP
-@@ -10752,10 +10752,10 @@ AT_CHECK([ovs-appctl netdev-dummy/receive p2 'in_port(2),eth(src=50:54:00:00:00:
- 
- 
- AT_CHECK([cat ovs-vswitchd.log | strip_ufid | filter_flow_install], [0], [dnl
-ct_state(+new-est+trk),recirc_id(0x1),in_port(2),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(frag=no), actions:drop
-ct_state(-new+est+trk),recirc_id(0x1),in_port(2),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(proto=17,frag=no), actions:1
- recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(proto=17,frag=no), actions:ct(commit),2
- recirc_id(0),in_port(2),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(proto=17,frag=no), actions:ct,recirc(0x1)
-+recirc_id(0x1),in_port(2),ct_state(+new-est+trk),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(frag=no), actions:drop
-+recirc_id(0x1),in_port(2),ct_state(-new+est+trk),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(proto=17,frag=no), actions:1
- ])
- 
- OVS_VSWITCHD_STOP
-@@ -11161,9 +11161,9 @@ AT_CHECK([ovs-appctl netdev-dummy/receive p2 'in_port(2),eth(src=50:54:00:00:00:
- ovs-appctl revalidator/wait
- 
- AT_CHECK([cat ovs-vswitchd.log | strip_ufid | filter_flow_install], [0], [dnl
-ct_state(+rpl+trk),ct_label(0x1),recirc_id(0x1),in_port(2),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(frag=no), actions:1
- recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(proto=17,frag=no),udp(src=1), actions:ct(commit,label=0x1),2
- recirc_id(0),in_port(2),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(frag=no), actions:ct,recirc(0x1)
-+recirc_id(0x1),in_port(2),ct_state(+rpl+trk),ct_label(0x1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(frag=no), actions:1
- ])
- 
- OVS_VSWITCHD_STOP
-@@ -11884,7 +11884,7 @@ ovs-ofctl dump-flows br0
- 
- AT_CHECK([ovs-appctl ofproto/trace ovs-dummy 'in_port(1),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.10.10.2,dst=10.10.10.1,proto=1,tos=1,ttl=128,frag=no),icmp(type=8,code=0)'], [0], [stdout])
- AT_CHECK([tail -3 stdout], [0], [dnl
-Megaflow: recirc_id=0,eth,ip,reg0=0/0x1,in_port=1,nw_src=10.10.10.2,nw_frag=no
-+Megaflow: recirc_id=0,eth,icmp,reg0=0/0x1,in_port=1,nw_src=10.10.10.2,nw_frag=no
- Datapath actions: drop
- Translation failed (Recursion too deep), packet is dropped.
- ])
-diff --git a/tests/ofproto.at b/tests/ofproto.at
-index a666bebca..2fa8486a8 100644
--- a/tests/ofproto.at
-+++ b/tests/ofproto.at
-@@ -6538,3 +6538,185 @@ verify_deleted
- 
- OVS_VSWITCHD_STOP(["/<invalid/d"])
- AT_CLEANUP
-+
-+AT_SETUP([ofproto - implicit mask of ipv4 proto with invalid proto field])
-+OVS_VSWITCHD_START
-+add_of_ports br0 1 2
-+
-+AT_DATA([flows.txt], [dnl
-+table=0 in_port=1 priority=90,ip,nw_dst=192.168.1.20,actions=mod_nw_dst:192.168.20.20,output=2
-+table=0 in_port=1 priority=89,ip,nw_dst=192.168.1.21,actions=mod_nw_src:192.168.20.21,output=2
-+table=0 in_port=1 priority=88,ip,nw_dst=192.168.1.10,actions=dec_ttl,output=2
-+table=0 in_port=1 priority=87,ip,nw_dst=192.168.1.19,actions=mod_nw_ttl:8,output=2
-+table=0 in_port=1 priority=86,ip,nw_dst=192.168.1.18,actions=mod_nw_ecn:2,output=2
-+table=0 in_port=1 priority=85,ip,nw_dst=192.168.1.17,actions=mod_nw_tos:0x40,output=2
-+table=0 in_port=1 priority=84,ip,nw_dst=192.168.1.16,actions=set_field:192.168.20.26->nw_dst,output=2
-+table=0 in_port=1 priority=83,ip,nw_dst=192.168.1.15,actions=set_field:192.168.21.26->nw_src,output=2
-+table=0 in_port=1 priority=82,ip,nw_dst=192.168.1.14,actions=set_field:0x40->nw_tos,output=2
-+table=0 in_port=1 priority=0,actions=drop
-+])
-+AT_CHECK([ovs-ofctl del-flows br0])
-+AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
-+
-+dnl send a proto 0 packet to try and poison the DP flow path
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 \
-+ '5054000000075054000000050800450000548de140004000289fc0a801c4c0a8011408003bf60002001bbf080a640000000032ad010000000000101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323334353637'])
-+
-+AT_CHECK([ovs-appctl dpctl/dump-flows], [0], [dnl
-+flow-dump from the main thread:
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.20,proto=0,frag=no), packets:0, bytes:0, used:never, actions:2
-+])
-+
-+dnl Send ICMP for mod nw_src and mod nw_dst
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.21,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.20,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+
-+dnl send ICMP that will dec TTL
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.10,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+
-+dnl send ICMP that will mod TTL
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.19,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+
-+dnl send ICMP that will mod ECN
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.18,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+
-+dnl send ICMP that will mod TOS
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.17,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+
-+dnl send ICMP that will set DST
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.16,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+
-+dnl send ICMP that will set SRC
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.15,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+
-+dnl send ICMP that will set TOS
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.14,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+
-+AT_CHECK([ovs-appctl dpctl/dump-flows | sort], [0], [dnl
-+flow-dump from the main thread:
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.10,proto=1,ttl=64,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(ttl=63)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.14,proto=1,tos=0/0xfc,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(tos=0x40/0xfc)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.16,proto=1,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(dst=192.168.20.26)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.17,proto=1,tos=0/0xfc,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(tos=0x40/0xfc)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.18,proto=1,tos=0/0x3,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(tos=0x2/0x3)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.19,proto=1,ttl=64,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(ttl=8)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.20,proto=0,frag=no), packets:0, bytes:0, used:never, actions:2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.20,proto=1,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(dst=192.168.20.20)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.15,proto=1,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(src=192.168.21.26)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.21,proto=1,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(src=192.168.20.21)),2
-+])
-+
-+OVS_VSWITCHD_STOP
-+AT_CLEANUP
-+
-+AT_SETUP([ofproto - implicit mask of ipv6 proto with HOPOPT field])
-+OVS_VSWITCHD_START
-+add_of_ports br0 1 2
-+
-+AT_DATA([flows.txt], [dnl
-+table=0 in_port=1 priority=77,ip6,ipv6_dst=111:db8::3,actions=dec_ttl,output=2
-+table=0 in_port=1 priority=76,ip6,ipv6_dst=111:db8::4,actions=mod_nw_ttl:8,output=2
-+table=0 in_port=1 priority=75,ip6,ipv6_dst=111:db8::5,actions=mod_nw_ecn:2,output=2
-+table=0 in_port=1 priority=74,ip6,ipv6_dst=111:db8::6,actions=mod_nw_tos:0x40,output=2
-+table=0 in_port=1 priority=73,ip6,ipv6_dst=111:db8::7,actions=set_field:2112:db8::2->ipv6_dst,output=2
-+table=0 in_port=1 priority=72,ip6,ipv6_dst=111:db8::8,actions=set_field:2112:db8::3->ipv6_src,output=2
-+table=0 in_port=1 priority=72,ip6,ipv6_dst=111:db8::9,actions=set_field:44->ipv6_label,output=2
-+table=0 in_port=1 priority=0,actions=drop
-+])
-+AT_CHECK([ovs-ofctl del-flows br0])
-+AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
-+
-+dnl send a proto 0 packet to try and poison the DP flow path
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::3,proto=0,tclass=0,hlimit=64,frag=no)'])
-+
-+AT_CHECK([ovs-appctl dpctl/dump-flows], [0], [dnl
-+flow-dump from the main thread:
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(dst=111:db8::3,proto=0,hlimit=0,frag=no), packets:0, bytes:0, used:never, actions:userspace(pid=0,controller(reason=2,dont_send=0,continuation=0,recirc_id=1,rule_cookie=0,controller_id=0,max_len=65535))
-+])
-+
-+dnl Send ICMP for mod nw_src and mod nw_dst
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::3,proto=1,tclass=0,hlimit=64,frag=no),icmpv6(type=0,code=8)'])
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::4,proto=1,tclass=0,hlimit=64,frag=no),icmpv6(type=0,code=8)'])
-+
-+dnl send ICMP that will dec TTL
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::5,proto=1,tclass=0,hlimit=64,frag=no),icmpv6(type=0,code=8)'])
-+
-+dnl send ICMP that will mod TTL
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::6,proto=1,tclass=0,hlimit=64,frag=no),icmpv6(type=0,code=8)'])
-+
-+dnl send ICMP that will mod ECN
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::7,proto=1,tclass=0,hlimit=64,frag=no),icmpv6(type=0,code=8)'])
-+
-+dnl send ICMP that will mod TOS
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::8,proto=1,tclass=0,hlimit=64,frag=no),icmpv6(type=0,code=8)'])
-+
-+dnl send ICMP that will set LABEL
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::9,proto=1,tclass=0,hlimit=64,frag=no),icmpv6(type=0,code=8)'])
-+
-+AT_CHECK([ovs-appctl dpctl/dump-flows | sort], [0], [dnl
-+flow-dump from the main thread:
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(dst=111:db8::3,proto=0,hlimit=0,frag=no), packets:0, bytes:0, used:never, actions:userspace(pid=0,controller(reason=2,dont_send=0,continuation=0,recirc_id=1,rule_cookie=0,controller_id=0,max_len=65535))
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(dst=111:db8::3,proto=1,hlimit=64,frag=no), packets:0, bytes:0, used:never, actions:set(ipv6(hlimit=63)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(dst=111:db8::4,proto=1,hlimit=64,frag=no), packets:0, bytes:0, used:never, actions:set(ipv6(hlimit=8)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(dst=111:db8::5,proto=1,tclass=0/0x3,frag=no), packets:0, bytes:0, used:never, actions:set(ipv6(tclass=0x2/0x3)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(dst=111:db8::6,proto=1,tclass=0/0xfc,frag=no), packets:0, bytes:0, used:never, actions:set(ipv6(tclass=0x40/0xfc)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(dst=111:db8::7,proto=1,frag=no), packets:0, bytes:0, used:never, actions:set(ipv6(dst=2112:db8::2)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(dst=111:db8::9,label=0,proto=1,frag=no), packets:0, bytes:0, used:never, actions:set(ipv6(label=0x2c)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::8,proto=1,frag=no), packets:0, bytes:0, used:never, actions:set(ipv6(src=2112:db8::3)),2
-+])
-+
-+OVS_VSWITCHD_STOP
-+AT_CLEANUP
-+
-+AT_SETUP([ofproto - implicit mask of ARP OPer field])
-+OVS_VSWITCHD_START
-+add_of_ports br0 1 2
-+
-+AT_DATA([flows.txt], [dnl
-+table=0 in_port=1 priority=77,arp,arp_sha=00:01:02:03:04:06,actions=set_field:0x1->arp_op,2
-+table=0 in_port=1 priority=76,arp,arp_sha=00:01:02:03:04:07,actions=set_field:00:02:03:04:05:06->arp_sha,2
-+table=0 in_port=1 priority=75,arp,arp_sha=00:01:02:03:04:08,actions=set_field:ff:00:00:00:00:ff->arp_tha,2
-+table=0 in_port=1 priority=74,arp,arp_sha=00:01:02:03:04:09,actions=set_field:172.31.110.26->arp_spa,2
-+table=0 in_port=1 priority=73,arp,arp_sha=00:01:02:03:04:0a,actions=set_field:172.31.110.10->arp_tpa,2
-+table=0 in_port=1 priority=1,actions=drop
-+])
-+
-+AT_CHECK([ovs-ofctl del-flows br0])
-+AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
-+
-+dnl Send op == 0 packet
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 \
-+ 'ffffffffffffaa55aa550000080600010800060400000001020304070c0a00010000000000000c0a0002'])
-+
-+AT_CHECK([ovs-appctl dpctl/dump-flows], [0], [dnl
-+flow-dump from the main thread:
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0806),arp(op=0,sha=00:01:02:03:04:07), packets:0, bytes:0, used:never, actions:2
-+])
-+
-+dnl Send op 2 -> set op
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0806),arp(sip=172.31.110.1,tip=172.31.110.25,op=2,sha=00:01:02:03:04:06,tha=ff:ff:ff:ff:ff:ff)'])
-+
-+dnl Send op 1 -> set SHA
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0806),arp(sip=172.31.110.1,tip=172.31.110.25,op=1,sha=00:01:02:03:04:07,tha=ff:ff:ff:ff:ff:ff)'])
-+
-+dnl Send op 1 -> set THA
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0806),arp(sip=172.31.110.1,tip=172.31.110.25,op=1,sha=00:01:02:03:04:08,tha=ff:ff:ff:ff:ff:ff)'])
-+
-+dnl Send op 1 -> set SIP
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0806),arp(sip=172.31.110.1,tip=172.31.110.25,op=1,sha=00:01:02:03:04:09,tha=ff:ff:ff:ff:ff:ff)'])
-+
-+dnl Send op 1 -> set TIP
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0806),arp(sip=172.31.110.1,tip=172.31.110.25,op=1,sha=00:01:02:03:04:0a,tha=ff:ff:ff:ff:ff:ff)'])
-+
-+AT_CHECK([ovs-appctl dpctl/dump-flows | sort], [0], [dnl
-+flow-dump from the main thread:
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0806),arp(op=0,sha=00:01:02:03:04:07), packets:0, bytes:0, used:never, actions:2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0806),arp(op=1,sha=00:01:02:03:04:07), packets:0, bytes:0, used:never, actions:userspace(pid=0,slow_path(action))
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0806),arp(op=1,sha=00:01:02:03:04:08,tha=ff:ff:ff:ff:ff:ff), packets:0, bytes:0, used:never, actions:userspace(pid=0,slow_path(action))
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0806),arp(op=2,sha=00:01:02:03:04:06), packets:0, bytes:0, used:never, actions:userspace(pid=0,slow_path(action))
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0806),arp(sip=172.31.110.1,op=1,sha=00:01:02:03:04:09), packets:0, bytes:0, used:never, actions:userspace(pid=0,slow_path(action))
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0806),arp(tip=172.31.110.25,op=1,sha=00:01:02:03:04:0a), packets:0, bytes:0, used:never, actions:userspace(pid=0,slow_path(action))
-+])
-+
-+OVS_VSWITCHD_STOP
-+AT_CLEANUP
-diff --git a/tests/packet-type-aware.at b/tests/packet-type-aware.at
-index 3b5c66fe5..d63528e69 100644
--- a/tests/packet-type-aware.at
-+++ b/tests/packet-type-aware.at
-@@ -1021,7 +1021,7 @@ AT_CHECK([
- ], [0], [flow-dump from the main thread:
- recirc_id(0),in_port(p0),packet_type(ns=0,id=0),eth(src=aa:bb:cc:00:00:02,dst=aa:bb:cc:00:00:01),eth_type(0x0800),ipv4(dst=20.0.0.1,proto=47,frag=no), packets:3, bytes:378, used:0.0s, actions:tnl_pop(gre_sys)
- tunnel(src=20.0.0.2,dst=20.0.0.1,flags(-df-csum)),recirc_id(0),in_port(gre_sys),packet_type(ns=1,id=0x8847),eth_type(0x8847),mpls(label=999/0x0,tc=0/0,ttl=64/0x0,bos=1/1), packets:3, bytes:264, used:0.0s, actions:push_eth(src=00:00:00:00:00:00,dst=00:00:00:00:00:00),pop_mpls(eth_type=0x800),recirc(0x1)
-tunnel(src=20.0.0.2,dst=20.0.0.1,flags(-df-csum)),recirc_id(0x1),in_port(gre_sys),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(ttl=64,frag=no), packets:3, bytes:294, used:0.0s, actions:set(ipv4(ttl=63)),int-br
-+tunnel(src=20.0.0.2,dst=20.0.0.1,flags(-df-csum)),recirc_id(0x1),in_port(gre_sys),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(proto=1,ttl=64,frag=no), packets:3, bytes:294, used:0.0s, actions:set(ipv4(ttl=63)),int-br
- ])
- 
- ovs-appctl time/warp 1000
--- a/CVE-2023-3152.patch
+++ b/CVE-2023-3152.patch
@ -1,121 +0,0 @@
-commit 9a3f7ed905e525ebdcb14541e775211cbb0203bd
-Author: Ales Musil <amusil@redhat.com>
-Date:   Wed Jul 12 07:12:29 2023 +0200
-
-    northd, controller: Add CoPP for SVC monitor
-    
-    The SVC monitor was exposed without any limitation.
-    Add CoPP for the SVC monitor flow, which adds a way
-    for CMSs to limit the traffic that this flow accepts.
-    
-    Signed-off-by: Ales Musil <amusil@redhat.com>
-
-diff --git a/lib/copp.c b/lib/copp.c
-index 603e3f5bf..11dd9029d 100644
--- a/lib/copp.c
-+++ b/lib/copp.c
-@@ -38,6 +38,7 @@ static char *copp_proto_names[COPP_PROTO_MAX] = {
-     [COPP_ND_RA_OPTS]    = "nd-ra-opts",
-     [COPP_TCP_RESET]     = "tcp-reset",
-     [COPP_REJECT]        = "reject",
-+    [COPP_SVC_MONITOR]   = "svc-monitor",
-     [COPP_BFD]           = "bfd",
- };
- 
-diff --git a/lib/copp.h b/lib/copp.h
-index f03004aa6..b99737220 100644
--- a/lib/copp.h
-+++ b/lib/copp.h
-@@ -37,6 +37,7 @@ enum copp_proto {
-     COPP_TCP_RESET,
-     COPP_BFD,
-     COPP_REJECT,
-+    COPP_SVC_MONITOR,
-     COPP_PROTO_MAX,
-     COPP_PROTO_INVALID = COPP_PROTO_MAX,
- };
-diff --git a/northd/northd.c b/northd/northd.c
-index 7ad4cdfad..1e05b8f22 100644
--- a/northd/northd.c
-+++ b/northd/northd.c
-@@ -8876,9 +8876,11 @@ build_lswitch_destination_lookup_bmcast(struct ovn_datapath *od,
- {
-     if (od->nbs) {
- 
-        ovn_lflow_add(lflows, od, S_SWITCH_IN_L2_LKUP, 110,
-                      "eth.dst == $svc_monitor_mac",
-                      "handle_svc_check(inport);");
-+        ovn_lflow_metered(lflows, od, S_SWITCH_IN_L2_LKUP, 110, "eth.dst == "
-+                          "$svc_monitor_mac && (tcp || icmp || icmp6)",
-+                          "handle_svc_check(inport);",
-+                          copp_meter_get(COPP_SVC_MONITOR, od->nbs->copp,
-+                                         meter_groups));
- 
-         struct mcast_switch_info *mcast_sw_info = &od->mcast_info.sw;
- 
-diff --git a/ovn-nb.xml b/ovn-nb.xml
-index 35acda107..59ac42dbd 100644
--- a/ovn-nb.xml
-+++ b/ovn-nb.xml
-@@ -466,6 +466,10 @@
-     <column name="meters" key="reject">
-       Rate limiting meter for packets that trigger a reject action
-     </column>
-+    <column name="meters" key="svc-monitor">
-+      Rate limiting meter for packets that are arriving to service
-+      monitor MAC address.
-+    </column>
-     <column name="external_ids">
-       See <em>External IDs</em> at the beginning of this document.
-     </column>
-diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at
-index b8376991b..70350a781 100644
--- a/tests/ovn-northd.at
-+++ b/tests/ovn-northd.at
-@@ -3544,7 +3544,7 @@ AT_CHECK([ovn-sbctl list logical_flow | grep trigger_event -A 2 | grep -q meter0
- 
- # let's try to add an usupported protocol "dhcp"
- AT_CHECK([ovn-nbctl --wait=hv copp-add copp5 dhcp meter1],[1],[],[dnl
-ovn-nbctl: Invalid control protocol. Allowed values: arp, arp-resolve, dhcpv4-opts, dhcpv6-opts, dns, event-elb, icmp4-error, icmp6-error, igmp, nd-na, nd-ns, nd-ns-resolve, nd-ra-opts, tcp-reset, bfd, reject.
-+ovn-nbctl: Invalid control protocol. Allowed values: arp, arp-resolve, dhcpv4-opts, dhcpv6-opts, dns, event-elb, icmp4-error, icmp6-error, igmp, nd-na, nd-ns, nd-ns-resolve, nd-ra-opts, tcp-reset, bfd, reject, svc-monitor.
- ])
- 
- #Let's try to add a valid protocol to an unknown datapath
-diff --git a/tests/system-ovn.at b/tests/system-ovn.at
-index f8131b90e..7c009e157 100644
--- a/tests/system-ovn.at
-+++ b/tests/system-ovn.at
-@@ -7282,6 +7282,23 @@ OVS_WAIT_UNTIL([
- ])
- kill $(pidof tcpdump)
- 
-+check ovn-nbctl set nb_global . options:svc_monitor_mac="33:33:33:33:33:33"
-+check ovn-nbctl meter-add svc-meter drop 1 pktps 0
-+check ovn-nbctl --wait=hv copp-add copp4 svc-monitor svc-meter
-+check ovn-nbctl --wait=hv ls-copp-add copp4 sw0
-+check ovn-appctl -t ovn-controller vlog/set vconn:dbg
-+AT_CHECK([ovn-nbctl copp-list copp4], [0], [dnl
-+svc-monitor: svc-meter
-+])
-+
-+ip netns exec sw01 scapy -H <<-EOF
-+p = Ether(dst="33:33:33:33:33:33", src="f0:00:00:01:02:03") /\
-+    IP(dst="192.168.1.100", src="192.168.1.2") / TCP(dport=1234, sport=1234)
-+sendp(p, iface='sw01', loop=0, verbose=0, count=20)
-+EOF
-+
-+OVS_WAIT_UNTIL([test "1" = "$(grep -c "dl_dst=33:33:33:33:33:33" ovn-controller.log)"])
-+
- kill $(pidof ovn-controller)
- 
- as ovn-sb
-@@ -7295,7 +7312,8 @@ OVS_APP_EXIT_AND_WAIT([NORTHD_TYPE])
- 
- as
- OVS_TRAFFIC_VSWITCHD_STOP(["/.*error receiving.*/d
-/.*terminating with signal 15.*/d"])
-+/.*terminating with signal 15.*/d
-+/.*Service monitor not found/d"])
- 
- AT_CLEANUP
- ])
--- a/CVE-2023-5366.patch
+++ b/CVE-2023-5366.patch
@ -1,227 +0,0 @@
-commit 322c15598a483ba80d2ba3ced9a62f9e7a9a14a9
-Author: Ilya Maximets <i.maximets@ovn.org>
-Date:   Fri Feb 17 21:09:59 2023 +0100
-
-    classifier: Fix missing masks on a final stage with ports trie.
-    
-    Flow lookup doesn't include masks of the final stage in a resulting
-    flow wildcards in case that stage had L4 ports match.  Only the result
-    of ports trie lookup is added to the mask.  It might be sufficient in
-    many cases, but it's not correct, because ports trie is not how we
-    decided that the packet didn't match in this subtable.  In fact, we
-    used a full subtable mask in order to determine that, so all the
-    subtable mask bits has to be added.
-    
-    Ports trie can still be used to adjust ports' mask, but it is not
-    sufficient to determine that the packet didn't match.
-    
-    Assuming we have following 2 OpenFlow rules on the bridge:
-    
-     table=0, priority=10,tcp,tp_dst=80,tcp_flags=+psh actions=drop
-     table=0, priority=0 actions=output(1)
-    
-    The first high priority rule supposed to drop all the TCP data traffic
-    sent on port 80.  The handshake, however, is allowed for forwarding.
-    
-    Both 'tcp_flags' and 'tp_dst' are on the final stage in the flow.
-    Since the stage mask from that stage is not incorporated into the flow
-    wildcards and only ports mask is getting updated, we have the following
-    megaflow for the SYN packet that has no match on 'tcp_flags':
-    
-     $ ovs-appctl ofproto/trace br0 "in_port=br0,tcp,tp_dst=80,tcp_flags=syn"
-    
-     Megaflow: recirc_id=0,eth,tcp,in_port=LOCAL,nw_frag=no,tp_dst=80
-     Datapath actions: 1
-    
-    If this flow is getting installed into datapath flow table, all the
-    packets for port 80, regardless of TCP flags, will be forwarded.
-    
-    Incorporating all the looked at bits from the final stage into the
-    stages map in order to get all the necessary wildcards.  Ports mask
-    has to be updated as a last step, because it doesn't cover the full
-    64-bit slot in the flowmap.
-    
-    With this change, in the example above, OVS is producing correct
-    flow wildcards including match on TCP flags:
-    
-     Megaflow: recirc_id=0,eth,tcp,in_port=LOCAL,nw_frag=no,tp_dst=80,tcp_flags=-psh
-     Datapath actions: 1
-    
-    This way only -psh packets will be forwarded, as expected.
-    
-    This issue affects all other fields on stage 4, not only TCP flags.
-    Tests included to cover tcp_flags, nd_target and ct_tp_src/dst.
-    First two are frequently used, ct ones are sharing the same flowmap
-    slot with L4 ports, so important to test.
-    
-    Before the pre-computation of stage masks, flow wildcards were updated
-    during lookup, so there was no issue.  The bits of the final stage was
-    lost with introduction of 'stages_map'.
-    
-    Recent adjustment of segment boundaries exposed 'tcp_flags' to the issue.
-    
-    Reported-at: https://github.com/openvswitch/ovs-issues/issues/272
-    Fixes: ca44218515f0 ("classifier: Adjust segment boundary to execute prerequisite processing.")
-    Fixes: fa2fdbf8d0c1 ("classifier: Pre-compute stage masks.")
-    Acked-by: Aaron Conole <aconole@redhat.com>
-    Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
-
-diff --git a/lib/classifier.c b/lib/classifier.c
-index c4790ee6b..f6a86b662 100644
--- a/lib/classifier.c
-+++ b/lib/classifier.c
-@@ -1695,6 +1695,8 @@ find_match_wc(const struct cls_subtable *subtable, ovs_version_t version,
-     const struct cls_match *rule = NULL;
-     struct flowmap stages_map = FLOWMAP_EMPTY_INITIALIZER;
-     unsigned int mask_offset = 0;
-+    bool adjust_ports_mask = false;
-+    ovs_be32 ports_mask;
-     int i;
- 
-     /* Try to finish early by checking fields in segments. */
-@@ -1722,6 +1724,9 @@ find_match_wc(const struct cls_subtable *subtable, ovs_version_t version,
-                     subtable->index_maps[i], flow, wc)) {
-         goto no_match;
-     }
-+    /* Accumulate the map used so far. */
-+    stages_map = flowmap_or(stages_map, subtable->index_maps[i]);
-+
-     hash = flow_hash_in_minimask_range(flow, &subtable->mask,
-                                        subtable->index_maps[i],
-                                        &mask_offset, &basis);
-@@ -1731,14 +1736,16 @@ find_match_wc(const struct cls_subtable *subtable, ovs_version_t version,
-          * unwildcarding all the ports bits, use the ports trie to figure out a
-          * smaller set of bits to unwildcard. */
-         unsigned int mbits;
-        ovs_be32 value, plens, mask;
-+        ovs_be32 value, plens;
- 
-        mask = miniflow_get_ports(&subtable->mask.masks);
-        value = ((OVS_FORCE ovs_be32 *)flow)[TP_PORTS_OFS32] & mask;
-+        ports_mask = miniflow_get_ports(&subtable->mask.masks);
-+        value = ((OVS_FORCE ovs_be32 *) flow)[TP_PORTS_OFS32] & ports_mask;
-         mbits = trie_lookup_value(&subtable->ports_trie, &value, &plens, 32);
- 
-        ((OVS_FORCE ovs_be32 *)&wc->masks)[TP_PORTS_OFS32] |=
-            mask & be32_prefix_mask(mbits);
-+        ports_mask &= be32_prefix_mask(mbits);
-+        ports_mask |= ((OVS_FORCE ovs_be32 *) &wc->masks)[TP_PORTS_OFS32];
-+
-+        adjust_ports_mask = true;
- 
-         goto no_match;
-     }
-@@ -1751,6 +1758,14 @@ no_match:
-     /* Unwildcard the bits in stages so far, as they were used in determining
-      * there is no match. */
-     flow_wildcards_fold_minimask_in_map(wc, &subtable->mask, stages_map);
-+    if (adjust_ports_mask) {
-+        /* This has to be done after updating flow wildcards to overwrite
-+         * the ports mask back.  We can't simply disable the corresponding bit
-+         * in the stages map, because it has 64-bit resolution, i.e. one
-+         * bit covers not only tp_src/dst, but also ct_tp_src/dst, which are
-+         * not covered by the trie. */
-+        ((OVS_FORCE ovs_be32 *) &wc->masks)[TP_PORTS_OFS32] = ports_mask;
-+    }
-     return NULL;
- }
- 
-diff --git a/tests/classifier.at b/tests/classifier.at
-index f652b5983..de2705653 100644
--- a/tests/classifier.at
-+++ b/tests/classifier.at
-@@ -65,6 +65,94 @@ Datapath actions: 2
- OVS_VSWITCHD_STOP
- AT_CLEANUP
- 
-+AT_SETUP([flow classifier - lookup segmentation - final stage])
-+OVS_VSWITCHD_START
-+add_of_ports br0 1 2 3
-+AT_DATA([flows.txt], [dnl
-+table=0 in_port=1 priority=33,tcp,tp_dst=80,tcp_flags=+psh,action=output(2)
-+table=0 in_port=1 priority=0,ip,action=drop
-+table=0 in_port=2 priority=16,icmp6,nw_ttl=255,icmp_type=135,icmp_code=0,nd_target=1000::1 ,action=output(1)
-+table=0 in_port=2 priority=0,ip,action=drop
-+table=0 in_port=3 action=resubmit(,1)
-+table=1 in_port=3 priority=45,ct_state=+trk+rpl,ct_nw_proto=6,ct_tp_src=3/0x1,tcp,tp_dst=80,tcp_flags=+psh,action=output(2)
-+table=1 in_port=3 priority=10,ip,action=drop
-+])
-+AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
-+
-+AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=6,nw_tos=0,nw_ttl=128,tp_src=8,tp_dst=80,tcp_flags=syn'], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+  [Megaflow: recirc_id=0,eth,tcp,in_port=1,nw_frag=no,tp_dst=80,tcp_flags=-psh
-+Datapath actions: drop
-+])
-+AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=6,nw_tos=0,nw_ttl=128,tp_src=8,tp_dst=80,tcp_flags=syn|ack'], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+  [Megaflow: recirc_id=0,eth,tcp,in_port=1,nw_frag=no,tp_dst=80,tcp_flags=-psh
-+Datapath actions: drop
-+])
-+AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=6,nw_tos=0,nw_ttl=128,tp_src=8,tp_dst=80,tcp_flags=ack|psh'], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+  [Megaflow: recirc_id=0,eth,tcp,in_port=1,nw_frag=no,tp_dst=80,tcp_flags=+psh
-+Datapath actions: 2
-+])
-+AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=6,nw_tos=0,nw_ttl=128,tp_src=8,tp_dst=80'], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+  [Megaflow: recirc_id=0,eth,tcp,in_port=1,nw_frag=no,tp_dst=80,tcp_flags=-psh
-+Datapath actions: drop
-+])
-+AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=6,nw_tos=0,nw_ttl=128,tp_src=8,tp_dst=79'], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+  [Megaflow: recirc_id=0,eth,tcp,in_port=1,nw_frag=no,tp_dst=0x40/0xfff0,tcp_flags=-psh
-+Datapath actions: drop
-+])
-+
-+dnl Having both the port and the tcp flags in the resulting megaflow below
-+dnl is redundant, but that is how ports trie logic is implemented.
-+AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=6,nw_tos=0,nw_ttl=128,tp_src=8,tp_dst=81'], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+  [Megaflow: recirc_id=0,eth,tcp,in_port=1,nw_frag=no,tp_dst=81,tcp_flags=-psh
-+Datapath actions: drop
-+])
-+
-+dnl nd_target is redundant in the megaflow below and it is also not relevant
-+dnl for an icmp reply.  Datapath may discard that match, but it is OK as long
-+dnl as we have prerequisites (icmp_type) in the match as well.
-+AT_CHECK([ovs-appctl ofproto/trace br0 "in_port=2,eth_src=f6:d2:b0:19:5e:7b,eth_dst=d2:49:19:91:78:fe,dl_type=0x86dd,ipv6_src=1000::3,ipv6_dst=1000::4,nw_proto=58,nw_ttl=255,icmpv6_type=128,icmpv6_code=0"], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+  [Megaflow: recirc_id=0,eth,icmp6,in_port=2,nw_ttl=255,nw_frag=no,icmp_type=0x80/0xfc,nd_target=::
-+Datapath actions: drop
-+])
-+
-+AT_CHECK([ovs-appctl ofproto/trace br0 "in_port=2,eth_src=f6:d2:b0:19:5e:7b,eth_dst=d2:49:19:91:78:fe,dl_type=0x86dd,ipv6_src=1000::3,ipv6_dst=1000::4,nw_proto=58,nw_ttl=255,icmpv6_type=135,icmpv6_code=0"], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+  [Megaflow: recirc_id=0,eth,icmp6,in_port=2,nw_ttl=255,nw_frag=no,icmp_type=0x87/0xff,icmp_code=0x0/0xff,nd_target=::
-+Datapath actions: drop
-+])
-+AT_CHECK([ovs-appctl ofproto/trace br0 "in_port=2,eth_src=f6:d2:b0:19:5e:7b,eth_dst=d2:49:19:91:78:fe,dl_type=0x86dd,ipv6_src=1000::3,ipv6_dst=1000::4,nw_proto=58,nw_ttl=255,icmpv6_type=135,icmpv6_code=0,nd_target=1000::1"], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+  [Megaflow: recirc_id=0,eth,icmp6,in_port=2,nw_ttl=255,nw_frag=no,icmp_type=0x87/0xff,icmp_code=0x0/0xff,nd_target=1000::1
-+Datapath actions: 1
-+])
-+AT_CHECK([ovs-appctl ofproto/trace br0 "in_port=2,eth_src=f6:d2:b0:19:5e:7b,eth_dst=d2:49:19:91:78:fe,dl_type=0x86dd,ipv6_src=1000::3,ipv6_dst=1000::4,nw_proto=58,nw_ttl=255,icmpv6_type=135,icmpv6_code=0,nd_target=1000::2"], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+  [Megaflow: recirc_id=0,eth,icmp6,in_port=2,nw_ttl=255,nw_frag=no,icmp_type=0x87/0xff,icmp_code=0x0/0xff,nd_target=1000::2
-+Datapath actions: drop
-+])
-+
-+dnl Check that ports' mask doesn't affect ct ports.
-+AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=3,ct_state=trk|rpl,ct_nw_proto=6,ct_tp_src=3,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=6,nw_tos=0,nw_ttl=128,tp_src=8,tp_dst=80,tcp_flags=psh'], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+  [Megaflow: recirc_id=0,ct_state=+rpl+trk,ct_nw_proto=6,ct_tp_src=0x1/0x1,eth,tcp,in_port=3,nw_frag=no,tp_dst=80,tcp_flags=+psh
-+Datapath actions: 2
-+])
-+AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=3,ct_state=trk|rpl,ct_nw_proto=6,ct_tp_src=3,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=6,nw_tos=0,nw_ttl=128,tp_src=8,tp_dst=79,tcp_flags=psh'], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+  [Megaflow: recirc_id=0,ct_state=+rpl+trk,ct_nw_proto=6,ct_tp_src=0x1/0x1,eth,tcp,in_port=3,nw_frag=no,tp_dst=0x40/0xfff0,tcp_flags=+psh
-+Datapath actions: drop
-+])
-+
-+OVS_VSWITCHD_STOP
-+AT_CLEANUP
-+
- AT_BANNER([flow classifier prefix lookup])
- AT_SETUP([flow classifier - prefix lookup])
- OVS_VSWITCHD_START
--- a/openvswitch-2.17.8-gcc14-build-fix.patch
+++ b/openvswitch-2.17.8-gcc14-build-fix.patch
@ -1,38 +0,0 @@
-From 335a5deac3ff91448ca14651e92f39dfdd512fcf Mon Sep 17 00:00:00 2001
-From: Ilya Maximets <i.maximets@ovn.org>
-Date: Thu, 18 Jan 2024 15:59:05 +0100
-Subject: [PATCH] ovs-atomic: Fix inclusion of Clang header by GCC 14.
-
-GCC 14 started to advertise c_atomic extension, older versions didn't
-do that.  Add check for __clang__, so GCC doesn't include headers
-designed for Clang.
-
-Another option would be to prefer stdatomic implementation instead,
-but some older versions of Clang are not able to use stdatomic.h
-supplied by GCC as described in commit:
-  07ece367fb5f ("ovs-atomic: Prefer Clang intrinsics over <stdatomic.h>.")
-
-This change fixes OVS build with GCC on Fedora Rawhide (40).
-
-Reported-by: Jakob Meng <code@jakobmeng.de>
-Acked-by: Jakob Meng <jmeng@redhat.com>
-Acked-by: Eelco Chaudron <echaudro@redhat.com>
-Acked-by: Simon Horman <horms@ovn.org>
-Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
---
- lib/ovs-atomic.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/ovs-atomic.h b/lib/ovs-atomic.h
-index ab9ce6b2e0f..f140d25feba 100644
--- a/lib/ovs-atomic.h
-+++ b/lib/ovs-atomic.h
-@@ -328,7 +328,7 @@
-     #if __CHECKER__
-         /* sparse doesn't understand some GCC extensions we use. */
-         #include "ovs-atomic-pthreads.h"
-    #elif __has_extension(c_atomic)
-+    #elif __clang__ &&  __has_extension(c_atomic)
-         #include "ovs-atomic-clang.h"
-     #elif HAVE_ATOMIC && __cplusplus >= 201103L
-         #include "ovs-atomic-c++.h"
--- a/openvswitch-3.1.0.tar.gz
+++ b/openvswitch-3.1.0.tar.gz
--- a/openvswitch-3.3.1.tar.gz
+++ b/openvswitch-3.3.1.tar.gz
--- a/openvswitch-3.3.2.tar.gz
+++ b/openvswitch-3.3.2.tar.gz
@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:5a1b1ed0b8922cd0e995c7aec87c1758b4e757207615f3c3bc96684cf49ce6f8
+size 9036826
--- a/openvswitch-CVE-2023-3966.patch
+++ b/openvswitch-CVE-2023-3966.patch
@ -1,111 +0,0 @@
--- openvswitch-3.1.0.orig/lib/netdev-offload-tc.c	2024-02-13 11:52:45.356063229 +0530
-+++ openvswitch-3.1.0/lib/netdev-offload-tc.c	2024-02-13 12:09:48.472094452 +0530
-@@ -1719,12 +1719,12 @@ test_key_and_mask(struct match *match)
-     return 0;
- }
- 
-static void
-+static int
- flower_match_to_tun_opt(struct tc_flower *flower, const struct flow_tnl *tnl,
-                         struct flow_tnl *tnl_mask)
- {
-     struct geneve_opt *opt, *opt_mask;
-    int len, cnt = 0;
-+    int tot_opt_len, len, cnt = 0;
- 
-     /* 'flower' always has an exact match on tunnel metadata length, so having
-      * it in a wrong format is not acceptable unless it is empty. */
-@@ -1740,7 +1740,7 @@ flower_match_to_tun_opt(struct tc_flower
-             memset(&tnl_mask->metadata.present.map, 0,
-                    sizeof tnl_mask->metadata.present.map);
-         }
-        return;
-+        return 0;
-     }
- 
-     tnl_mask->flags &= ~FLOW_TNL_F_UDPIF;
-@@ -1754,7 +1754,7 @@ flower_match_to_tun_opt(struct tc_flower
-            sizeof tnl_mask->metadata.present.len);
- 
-     if (!tnl->metadata.present.len) {
-        return;
-+        return 0;
-     }
- 
-     memcpy(flower->key.tunnel.metadata.opts.gnv, tnl->metadata.opts.gnv,
-@@ -1768,7 +1768,16 @@ flower_match_to_tun_opt(struct tc_flower
-      * also not masks, but actual lengths in the 'flower' structure. */
-     len = flower->key.tunnel.metadata.present.len;
-     while (len) {
-+        if (len < sizeof *opt) {
-+            return EOPNOTSUPP;
-+        }
-+
-         opt = &flower->key.tunnel.metadata.opts.gnv[cnt];
-+        tot_opt_len = sizeof *opt + opt->length * 4;
-+        if (len < tot_opt_len) {
-+            return EOPNOTSUPP;
-+        }
-+
-         opt_mask = &flower->mask.tunnel.metadata.opts.gnv[cnt];
- 
-         opt_mask->length = opt->length;
-@@ -1776,6 +1785,7 @@ flower_match_to_tun_opt(struct tc_flower
-         cnt += sizeof(struct geneve_opt) / 4 + opt->length;
-         len -= sizeof(struct geneve_opt) + opt->length * 4;
-     }
-+    return 0;
- }
- 
- static void
-@@ -2213,7 +2223,11 @@ netdev_tc_flow_put(struct netdev *netdev
-         tnl_mask->flags &= ~(FLOW_TNL_F_DONT_FRAGMENT | FLOW_TNL_F_CSUM);
- 
-         if (!strcmp(netdev_get_type(netdev), "geneve")) {
-            flower_match_to_tun_opt(&flower, tnl, tnl_mask);
-+            err = flower_match_to_tun_opt(&flower, tnl, tnl_mask);
-+            if (err) {
-+                VLOG_WARN_RL(&warn_rl, "Unable to parse geneve options");
-+                return err;
-+            }
-         }
-         flower.tunnel = true;
-     } else {
--- openvswitch-3.1.0.orig/tests/system-offloads-traffic.at	2024-02-13 11:52:45.364063229 +0530
-+++ openvswitch-3.1.0/tests/system-offloads-traffic.at	2024-02-13 12:21:58.880116742 +0530
-@@ -742,3 +742,35 @@ recirc_id(<recirc>),in_port(3),eth_type(
- 
- OVS_TRAFFIC_VSWITCHD_STOP
- AT_CLEANUP
-+AT_SETUP([offloads - handling of geneve corrupted metadata - offloads enabled])
-+OVS_CHECK_GENEVE()
-+
-+OVS_TRAFFIC_VSWITCHD_START(
-+    [_ADD_BR([br-underlay]) -- \
-+     set bridge br0 other-config:hwaddr=f2:ff:00:00:00:01 -- \
-+     set bridge br-underlay other-config:hwaddr=f2:ff:00:00:00:02],
-+    [], [-- set Open_vSwitch . other_config:hw-offload=true])
-+
-+AT_CHECK([ovs-ofctl add-flow br0 "actions=normal"])
-+AT_CHECK([ovs-ofctl add-flow br-underlay "actions=normal"])
-+
-+ADD_NAMESPACES(at_ns0)
-+
-+dnl Set up underlay link from host into the namespace using veth pair.
-+ADD_VETH(p0, at_ns0, br-underlay, "172.31.1.1/24", f2:ff:00:00:00:03)
-+AT_CHECK([ip addr add dev br-underlay "172.31.1.100/24"])
-+AT_CHECK([ip link set dev br-underlay up])
-+
-+dnl Set up tunnel endpoints on OVS outside the namespace and with a native
-+dnl linux device inside the namespace.
-+ADD_OVS_TUNNEL([geneve], [br0], [at_gnv0], [172.31.1.1], [10.1.1.100/24])
-+ADD_NATIVE_TUNNEL([geneve], [ns_gnv0], [at_ns0], [172.31.1.100], [10.1.1.1/24],
-+                  [vni 0], [address f2:ff:00:00:00:04])
-+
-+NS_CHECK_EXEC([at_ns0], [$PYTHON3 $srcdir/sendpkt.py p0 f2 ff 00 00 00 02 f2 ff 00 00 00 03 08 00 45 00 00 52 00 01 00 00 40 11 1f f7 ac 1f 01 01 ac 1f 01 64 de c1 17 c1 00 3e 59 e9 01 00 65 58 00 00 00 00 00 03 00 02 f2 ff 00 00 00 01 f2 ff 00 00 00 04 08 00 45 00 00 1c 00 01 00 00 40 01 64 7a 0a 01 01 01 0a 01 01 64 08 00 f7 ff 00 00 00 00  > /dev/null])
-+
-+OVS_WAIT_UNTIL([grep -q 'Invalid Geneve tunnel metadata' ovs-vswitchd.log])
-+
-+OVS_TRAFFIC_VSWITCHD_STOP(["/Invalid Geneve tunnel metadata on bridge br0 while processing icmp,in_port=1,vlan_tci=0x0000,dl_src=f2:ff:00:00:00:04,dl_dst=f2:ff:00:00:00:01,nw_src=10.1.1.1,nw_dst=10.1.1.100,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,icmp_type=8,icmp_code=0/d
-+/Unable to parse geneve options/d"])
-+AT_CLEANUP
--- a/openvswitch.changes
+++ b/openvswitch.changes
@ -1,3 +1,20 @@
+-------------------------------------------------------------------
+Mon Jan 27 12:52:52 UTC 2025 - Clemens Famulla-Conrad <cfamullaconrad@suse.com>
+
+- Update openvswitch to 3.3.2. For a list of changes, check
+  https://github.com/openvswitch/ovs/blob/v3.3.2/NEWS
+- Update OVN to 24.03.5. For a list of changes, check
+  https://github.com/ovn-org/ovn/blob/v24.03.5/NEWS
+  - This update fix CVE-2025-0650 ovn: egress ACLs may be bypassed
+    via specially crafted UDP packet (bsc#1236353)
+
+-------------------------------------------------------------------
+Mon Dec 16 15:15:56 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org>
+
+- Add proper dependency on /usr/sbin/ipsec on openvswitch-ipsec:
+  without the binary present, the service crashes on startup
+  (boo#1234617).
+
 -------------------------------------------------------------------
 Wed Aug 28 05:18:36 UTC 2024 - Duraisankar P <Duraisankar.pitchumani@suse.com>

--- a/openvswitch.spec
+++ b/openvswitch.spec
@ -1,7 +1,7 @@
 #
 # spec file for package openvswitch
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@ -20,8 +20,8 @@
 %define skip_python2 1
 %define ovs_lname libopenvswitch-3_3-0
 %define ovn_lname libovn-24_03-0
-%define ovs_version 3.3.1
-%define ovn_version 24.03.3
+%define ovs_version 3.3.2
+%define ovn_version 24.03.5
 %define ovs_dir ovs-%{ovs_version}
 %define ovn_dir ovn-%{ovn_version}
 %define rpmstate %{_rundir}/openvswitch-rpm-state-
@ -80,8 +80,8 @@ Patch4:         install-ovsdb-tools.patch
 #OVN patches
 # PATCH-FIX-OPENSUSE: 0001-Run-ovn-as-openvswitch-openvswitch.patch
 Patch20:        0001-Run-ovn-as-openvswitch-openvswitch.patch
-BuildRequires:  autoconf
 BuildRequires:  %{python_module setuptools}
+BuildRequires:  autoconf
 BuildRequires:  automake
 BuildRequires:  fdupes
 BuildRequires:  graphviz
@ -238,6 +238,7 @@ Summary:        Open vSwitch IPsec tunneling support
 License:        Apache-2.0
 Group:          Productivity/Networking/System
 Requires:       %{name} = %{version}
+Requires:       /usr/sbin/ipsec
 Requires:       python3-ovs = %{version}
 Requires:       strongswan

--- a/ovn-23.03.0.tar.gz
+++ b/ovn-23.03.0.tar.gz
--- a/ovn-24.03.3.tar.gz
+++ b/ovn-24.03.3.tar.gz
--- a/ovn-24.03.5.tar.gz
+++ b/ovn-24.03.5.tar.gz
@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f679577e4e33587e3a0ccae8693c56b3531ce7b3dc259d7dee2ec4f21ea732c6
+size 2024279