diff --git a/SOURCES/openvswitch-2.17.0.patch b/SOURCES/openvswitch-2.17.0.patch
index 85b36d9..0b77caf 100644
--- a/SOURCES/openvswitch-2.17.0.patch
+++ b/SOURCES/openvswitch-2.17.0.patch
@@ -60692,7 +60692,7 @@ index 114aff8ea3..0fc6d2ea60 100644
enum xc_type type;
union {
diff --git a/ofproto/ofproto-dpif-xlate.c b/ofproto/ofproto-dpif-xlate.c
-index 578cbfe581..a212cd3698 100644
+index 578cbfe581..4b4d5c7a76 100644
--- a/ofproto/ofproto-dpif-xlate.c
+++ b/ofproto/ofproto-dpif-xlate.c
@@ -66,6 +66,7 @@
@@ -61050,7 +61050,124 @@ index 578cbfe581..a212cd3698 100644
/* If ofp_port in flow sample action is equel to ofp_port,
* this sample action is a input port action. */
-@@ -7027,6 +7100,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
+@@ -6887,6 +6960,107 @@ xlate_ofpact_unroll_xlate(struct xlate_ctx *ctx,
+ "cookie=%#"PRIx64, a->rule_table_id, a->rule_cookie);
+ }
+
++/* Reset the mirror context if we modify the packet and would like to mirror
++ * the new copy. */
++static void
++reset_mirror_ctx(struct xlate_ctx *ctx, const struct flow *flow,
++ const struct ofpact *a)
++{
++ switch (a->type) {
++ case OFPACT_STRIP_VLAN:
++ case OFPACT_PUSH_VLAN:
++ case OFPACT_SET_ETH_SRC:
++ case OFPACT_SET_ETH_DST:
++ case OFPACT_PUSH_MPLS:
++ case OFPACT_POP_MPLS:
++ case OFPACT_SET_MPLS_LABEL:
++ case OFPACT_SET_MPLS_TC:
++ case OFPACT_SET_MPLS_TTL:
++ case OFPACT_DEC_MPLS_TTL:
++ case OFPACT_DEC_NSH_TTL:
++ case OFPACT_DEC_TTL:
++ case OFPACT_SET_VLAN_VID:
++ case OFPACT_SET_VLAN_PCP:
++ case OFPACT_ENCAP:
++ case OFPACT_DECAP:
++ case OFPACT_NAT:
++ ctx->mirrors = 0;
++ return;
++
++ case OFPACT_SET_FIELD: {
++ const struct ofpact_set_field *set_field;
++ const struct mf_field *mf;
++
++ set_field = ofpact_get_SET_FIELD(a);
++ mf = set_field->field;
++ if (mf_are_prereqs_ok(mf, flow, NULL)) {
++ ctx->mirrors = 0;
++ }
++ return;
++ }
++
++ case OFPACT_SET_IPV4_SRC:
++ case OFPACT_SET_IPV4_DST:
++ if (flow->dl_type == htons(ETH_TYPE_IP)) {
++ ctx->mirrors = 0;
++ }
++ return;
++
++ case OFPACT_SET_IP_DSCP:
++ case OFPACT_SET_IP_ECN:
++ case OFPACT_SET_IP_TTL:
++ if (is_ip_any(flow)) {
++ ctx->mirrors = 0;
++ }
++ return;
++
++ case OFPACT_SET_L4_SRC_PORT:
++ case OFPACT_SET_L4_DST_PORT:
++ if (is_ip_any(flow) && !(flow->nw_frag & FLOW_NW_FRAG_LATER)) {
++ ctx->mirrors = 0;
++ }
++ return;
++
++ case OFPACT_OUTPUT_REG:
++ case OFPACT_OUTPUT_TRUNC:
++ case OFPACT_GROUP:
++ case OFPACT_OUTPUT:
++ case OFPACT_CONTROLLER:
++ case OFPACT_RESUBMIT:
++ case OFPACT_GOTO_TABLE:
++ case OFPACT_WRITE_METADATA:
++ case OFPACT_SET_TUNNEL:
++ case OFPACT_REG_MOVE:
++ case OFPACT_STACK_PUSH:
++ case OFPACT_STACK_POP:
++ case OFPACT_LEARN:
++ case OFPACT_ENQUEUE:
++ case OFPACT_SET_QUEUE:
++ case OFPACT_POP_QUEUE:
++ case OFPACT_MULTIPATH:
++ case OFPACT_BUNDLE:
++ case OFPACT_EXIT:
++ case OFPACT_UNROLL_XLATE:
++ case OFPACT_FIN_TIMEOUT:
++ case OFPACT_CLEAR_ACTIONS:
++ case OFPACT_WRITE_ACTIONS:
++ case OFPACT_METER:
++ case OFPACT_SAMPLE:
++ case OFPACT_CLONE:
++ case OFPACT_DEBUG_RECIRC:
++ case OFPACT_DEBUG_SLOW:
++ case OFPACT_CT:
++ case OFPACT_CT_CLEAR:
++ case OFPACT_CHECK_PKT_LARGER:
++ case OFPACT_DELETE_FIELD:
++ case OFPACT_NOTE:
++ case OFPACT_CONJUNCTION:
++ return;
++ }
++
++ OVS_NOT_REACHED();
++}
++
+ static void
+ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
+ struct xlate_ctx *ctx, bool is_last_action,
+@@ -6928,6 +7102,8 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
+ break;
+ }
+
++ reset_mirror_ctx(ctx, flow, a);
++
+ if (OVS_UNLIKELY(ctx->xin->trace)) {
+ struct ds s = DS_EMPTY_INITIALIZER;
+ struct ofpact_format_params fp = { .s = &s };
+@@ -7027,6 +7203,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
case OFPACT_SET_IPV4_SRC:
if (flow->dl_type == htons(ETH_TYPE_IP)) {
memset(&wc->masks.nw_src, 0xff, sizeof wc->masks.nw_src);
@@ -61058,7 +61175,7 @@ index 578cbfe581..a212cd3698 100644
flow->nw_src = ofpact_get_SET_IPV4_SRC(a)->ipv4;
}
break;
-@@ -7034,12 +7108,14 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
+@@ -7034,12 +7211,14 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
case OFPACT_SET_IPV4_DST:
if (flow->dl_type == htons(ETH_TYPE_IP)) {
memset(&wc->masks.nw_dst, 0xff, sizeof wc->masks.nw_dst);
@@ -61073,7 +61190,7 @@ index 578cbfe581..a212cd3698 100644
wc->masks.nw_tos |= IP_DSCP_MASK;
flow->nw_tos &= ~IP_DSCP_MASK;
flow->nw_tos |= ofpact_get_SET_IP_DSCP(a)->dscp;
-@@ -7048,6 +7124,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
+@@ -7048,6 +7227,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
case OFPACT_SET_IP_ECN:
if (is_ip_any(flow)) {
@@ -61081,7 +61198,7 @@ index 578cbfe581..a212cd3698 100644
wc->masks.nw_tos |= IP_ECN_MASK;
flow->nw_tos &= ~IP_ECN_MASK;
flow->nw_tos |= ofpact_get_SET_IP_ECN(a)->ecn;
-@@ -7056,6 +7133,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
+@@ -7056,6 +7236,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
case OFPACT_SET_IP_TTL:
if (is_ip_any(flow)) {
@@ -61089,7 +61206,7 @@ index 578cbfe581..a212cd3698 100644
wc->masks.nw_ttl = 0xff;
flow->nw_ttl = ofpact_get_SET_IP_TTL(a)->ttl;
}
-@@ -7123,6 +7201,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
+@@ -7123,6 +7304,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
/* Set the field only if the packet actually has it. */
if (mf_are_prereqs_ok(mf, flow, wc)) {
@@ -61097,7 +61214,7 @@ index 578cbfe581..a212cd3698 100644
mf_mask_field_masked(mf, ofpact_set_field_mask(set_field), wc);
mf_set_flow_value_masked(mf, set_field->value,
ofpact_set_field_mask(set_field),
-@@ -7179,6 +7258,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
+@@ -7179,6 +7361,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
case OFPACT_DEC_TTL:
wc->masks.nw_ttl = 0xff;
@@ -61105,7 +61222,7 @@ index 578cbfe581..a212cd3698 100644
if (compose_dec_ttl(ctx, ofpact_get_DEC_TTL(a))) {
return;
}
-@@ -7609,6 +7689,43 @@ xlate_wc_finish(struct xlate_ctx *ctx)
+@@ -7609,6 +7792,43 @@ xlate_wc_finish(struct xlate_ctx *ctx)
ctx->wc->masks.vlans[i].tci = 0;
}
}
@@ -61149,7 +61266,7 @@ index 578cbfe581..a212cd3698 100644
}
/* Translates the flow, actions, or rule in 'xin' into datapath actions in
-@@ -7784,6 +7901,12 @@ xlate_actions(struct xlate_in *xin, struct xlate_out *xout)
+@@ -7784,6 +8004,12 @@ xlate_actions(struct xlate_in *xin, struct xlate_out *xout)
goto exit;
}
@@ -61162,7 +61279,7 @@ index 578cbfe581..a212cd3698 100644
/* Tunnel metadata in udpif format must be normalized before translation. */
if (flow->tunnel.flags & FLOW_TNL_F_UDPIF) {
const struct tun_table *tun_tab = ofproto_get_tun_tab(
-@@ -8030,6 +8153,10 @@ exit:
+@@ -8030,6 +8256,10 @@ exit:
if (xin->odp_actions) {
ofpbuf_clear(xin->odp_actions);
}
@@ -65721,7 +65838,7 @@ index 2c7e163bd6..7be6628c34 100644
AT_CLEANUP
diff --git a/tests/ofproto-dpif.at b/tests/ofproto-dpif.at
-index 7c2edeb9d4..b91fe9e41c 100644
+index 7c2edeb9d4..fc125eac32 100644
--- a/tests/ofproto-dpif.at
+++ b/tests/ofproto-dpif.at
@@ -29,6 +29,58 @@ AT_CHECK([ovs-appctl revalidator/wait])
@@ -66967,6 +67084,24 @@ index 7c2edeb9d4..b91fe9e41c 100644
AT_CHECK([ovs-appctl ofproto/trace br0 "$flow"], [0], [stdout])
AT_CHECK_UNQUOTED([tail -1 stdout], [0],
[Datapath actions: 1,2
+@@ -5102,7 +5220,7 @@ AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
+ flow="in_port(1),eth(src=50:54:00:00:00:05,dst=50:54:00:00:00:07),eth_type(0x0800),ipv4(src=192.168.0.1,dst=192.168.0.2,proto=1,tos=0,ttl=128,frag=no),icmp(type=8,code=0)"
+ AT_CHECK([ovs-appctl ofproto/trace ovs-dummy "$flow"], [0], [stdout])
+ AT_CHECK_UNQUOTED([tail -1 stdout], [0],
+- [Datapath actions: 3,push_vlan(vid=17,pcp=0),2
++ [Datapath actions: 3,push_vlan(vid=17,pcp=0),2,3
+ ])
+
+ flow="in_port(2),eth(src=50:54:00:00:00:05,dst=50:54:00:00:00:07),eth_type(0x0800),ipv4(src=192.168.0.1,dst=192.168.0.2,proto=1,tos=0,ttl=128,frag=no),icmp(type=8,code=0)"
+@@ -5141,7 +5259,7 @@ flow="in_port(2),eth(src=50:54:00:00:00:05,dst=50:54:00:00:00:07),eth_type(0x080
+ AT_CHECK([ovs-appctl ofproto/trace ovs-dummy "$flow"], [0], [stdout])
+ actual=`tail -1 stdout | sed 's/Datapath actions: //'`
+
+-expected="push_vlan(vid=17,pcp=0),1,pop_vlan,push_vlan(vid=12,pcp=0),1,2,100"
++expected="push_vlan(vid=12,pcp=0),100,2,1,pop_vlan,push_vlan(vid=17,pcp=0),1,pop_vlan,push_vlan(vid=12,pcp=0),100,2,1"
+ AT_CHECK([ovs-dpctl normalize-actions "$flow" "$expected"], [0], [stdout])
+ mv stdout expout
+ AT_CHECK([ovs-dpctl normalize-actions "$flow" "$actual"], [0], [expout])
@@ -5317,7 +5435,7 @@ ovs-vsctl \
AT_CHECK([ovs-ofctl add-flow br0 action=output:1])
@@ -66976,6 +67111,15 @@ index 7c2edeb9d4..b91fe9e41c 100644
AT_CHECK([ovs-appctl ofproto/trace br0 "$flow"], [0], [stdout])
AT_CHECK_UNQUOTED([tail -1 stdout], [0],
[Datapath actions: 1,trunc(100),2
+@@ -5409,7 +5527,7 @@ AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
+ flow="in_port(1),eth(src=50:54:00:00:00:05,dst=50:54:00:00:00:07),eth_type(0x0800),ipv4(src=192.168.0.1,dst=192.168.0.2,proto=1,tos=0,ttl=128,frag=no),icmp(type=8,code=0)"
+ AT_CHECK([ovs-appctl ofproto/trace ovs-dummy "$flow"], [0], [stdout])
+ AT_CHECK_UNQUOTED([tail -1 stdout], [0],
+- [Datapath actions: trunc(100),3,push_vlan(vid=17,pcp=0),2
++ [Datapath actions: trunc(100),3,push_vlan(vid=17,pcp=0),2,trunc(100),3
+ ])
+
+ flow="in_port(2),eth(src=50:54:00:00:00:05,dst=50:54:00:00:00:07),eth_type(0x0800),ipv4(src=192.168.0.1,dst=192.168.0.2,proto=1,tos=0,ttl=128,frag=no),icmp(type=8,code=0)"
@@ -5464,7 +5582,7 @@ ovs-vsctl \
flow="in_port=1"
diff --git a/SPECS/openvswitch2.17.spec b/SPECS/openvswitch2.17.spec
index 8ee5649..6519f57 100644
--- a/SPECS/openvswitch2.17.spec
+++ b/SPECS/openvswitch2.17.spec
@@ -57,7 +57,7 @@ Summary: Open vSwitch
Group: System Environment/Daemons daemon/database/utilities
URL: http://www.openvswitch.org/
Version: 2.17.0
-Release: 94%{?dist}
+Release: 95%{?dist}
# Nearly all of openvswitch is ASL 2.0. The bugtool is LGPLv2+, and the
# lib/sflow*.[ch] files are SISSL
@@ -751,6 +751,12 @@ exit 0
%endif
%changelog
+* Fri Jul 21 2023 Open vSwitch CI <ovs-ci@redhat.com> - 2.17.0-95
+- Merging upstream branch-2.17 [RH git: 99709cc365]
+ Commit list:
+ a1ca9e589f ofproto-dpif-upcall: Mirror packets that are modified. (#2155579)
+
+
* Tue Jul 18 2023 Open vSwitch CI <ovs-ci@redhat.com> - 2.17.0-94
- Merging upstream branch-2.17 [RH git: f484b9ed30]
Commit list: