From 7a871d7ee67e2ae89bbdefc9988ff6ebb8dc648e Mon Sep 17 00:00:00 2001
From: Open vSwitch CI <ovs-team@redhat.com>
Date: Feb 10 2025 18:17:24 +0000
Subject: Import openvswitch3.3-3.3.0-87 from Fast DataPath


---

diff --git a/SOURCES/openvswitch-3.3.0.patch b/SOURCES/openvswitch-3.3.0.patch
index 342dd61..1999ee6 100644
--- a/SOURCES/openvswitch-3.3.0.patch
+++ b/SOURCES/openvswitch-3.3.0.patch
@@ -3796,6 +3796,20 @@ index 921d523177..31f3726509 100644
          }
  
          if (key->nw_proto == IPPROTO_TCP) {
+diff --git a/lib/netdev-vport.c b/lib/netdev-vport.c
+index 60caa02fbb..78e43bd5c8 100644
+--- a/lib/netdev-vport.c
++++ b/lib/netdev-vport.c
+@@ -838,7 +838,8 @@ set_tunnel_config(struct netdev *dev_, const struct smap *args, char **errp)
+             }
+         } else if (!strcmp(node->key, "remote_cert") ||
+                    !strcmp(node->key, "remote_name") ||
+-                   !strcmp(node->key, "psk")) {
++                   !strcmp(node->key, "psk") ||
++                   !strncmp(node->key, "ipsec_", strlen("ipsec_"))) {
+             /* When configuring OVS for IPsec, these keys may be set in the
+                tunnel port's 'options' column. 'ovs-vswitchd' does not directly
+                use them, but they are read by 'ovs-monitor-ipsec'. In order to
 diff --git a/lib/netlink-notifier.c b/lib/netlink-notifier.c
 index dfecb97789..7ea5a41818 100644
 --- a/lib/netlink-notifier.c
@@ -4940,7 +4954,7 @@ index b5cbeed878..ff1d4b0028 100644
                      /* Clears 'recircs' if filled by revalidate_ukey(). */
                      reval_op_init(&ops[n_ops++], result, udpif, ukey, &recircs,
 diff --git a/ofproto/ofproto-dpif-xlate.c b/ofproto/ofproto-dpif-xlate.c
-index 1cf4d5f7c9..1b5ada8305 100644
+index 1cf4d5f7c9..19efe8b9f3 100644
 --- a/ofproto/ofproto-dpif-xlate.c
 +++ b/ofproto/ofproto-dpif-xlate.c
 @@ -677,6 +677,7 @@ static size_t count_skb_priorities(const struct xport *);
@@ -5086,7 +5100,17 @@ index 1cf4d5f7c9..1b5ada8305 100644
                                     ctx->pause->controller_id);
      } else {
          if (ctx->recirc_update_dp_hash) {
-@@ -7139,7 +7149,7 @@ reset_mirror_ctx(struct xlate_ctx *ctx, const struct flow *flow,
+@@ -6799,7 +6809,8 @@ rewrite_flow_push_nsh(struct xlate_ctx *ctx,
+                                "supported for packet type (%d,0x%x)",
+                                pt_ns(packet_type), pt_ns_type(packet_type));
+             ctx->error = XLATE_UNSUPPORTED_PACKET_TYPE;
+-            return buf;
++            ofpbuf_delete(buf);
++            return NULL;
+     }
+     /* Note that we have matched on packet_type! */
+     wc->masks.packet_type = OVS_BE32_MAX;
+@@ -7139,7 +7150,7 @@ reset_mirror_ctx(struct xlate_ctx *ctx, const struct flow *flow,
  
          set_field = ofpact_get_SET_FIELD(a);
          mf = set_field->field;
diff --git a/SPECS/openvswitch3.3.spec b/SPECS/openvswitch3.3.spec
index b2a21f7..b73b892 100644
--- a/SPECS/openvswitch3.3.spec
+++ b/SPECS/openvswitch3.3.spec
@@ -57,7 +57,7 @@ Summary: Open vSwitch
 Group: System Environment/Daemons daemon/database/utilities
 URL: http://www.openvswitch.org/
 Version: 3.3.0
-Release: 86%{?dist}
+Release: 87%{?dist}
 
 # Nearly all of openvswitch is ASL 2.0.  The bugtool is LGPLv2+, and the
 # lib/sflow*.[ch] files are SISSL
@@ -769,6 +769,13 @@ exit 0
 %endif
 
 %changelog
+* Mon Feb 10 2025 Open vSwitch CI <ovs-ci@redhat.com> - 3.3.0-87
+- Merging upstream branch-3.3 [RH git: f8bd44389c]
+    Commit list:
+    ccaa4f5efb netdev-vport: Ignore ipsec_ tunnel option prefix for all tunnels. (FDP-797)
+    e1251ddbfb ofproto-dpif-xlate: Fix memory leak in xlate_generic_encap_action().
+
+
 * Fri Feb 07 2025 Open vSwitch CI <ovs-ci@redhat.com> - 3.3.0-86
 - Merging upstream branch-3.3 [RH git: 0cc50885d7]
     Commit list: