13 files changed, 735 insertions, 95 deletions

diff --git a/net/openvswitch/Kconfig b/net/openvswitch/Kconfig
index d143aa9f6654..ce947292ae77 100644
--- a/net/openvswitch/Kconfig
+++ b/net/openvswitch/Kconfig
@@ -6,10 +6,14 @@ config OPENVSWITCH
         tristate "Open vSwitch"
         depends on INET
         depends on !NF_CONNTRACK || \
-                   (NF_CONNTRACK && (!NF_DEFRAG_IPV6 || NF_DEFRAG_IPV6))
+                   (NF_CONNTRACK && ((!NF_DEFRAG_IPV6 || NF_DEFRAG_IPV6) && \
+                                     (!NF_NAT || NF_NAT) && \
+                                     (!NF_NAT_IPV4 || NF_NAT_IPV4) && \
+                                     (!NF_NAT_IPV6 || NF_NAT_IPV6)))
         select LIBCRC32C
         select MPLS
         select NET_MPLS_GSO
+        select DST_CACHE
         ---help---
           Open vSwitch is a multilayer Ethernet switch targeted at virtualized
           environments.  In addition to supporting a variety of features
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 2d59df521915..879185fe183f 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -158,9 +158,7 @@ static int push_mpls(struct sk_buff *skb, struct sw_flow_key *key,
         new_mpls_lse = (__be32 *)skb_mpls_header(skb);
         *new_mpls_lse = mpls->mpls_lse;
 
-        if (skb->ip_summed == CHECKSUM_COMPLETE)
-                skb->csum = csum_add(skb->csum, csum_partial(new_mpls_lse,
-                                                             MPLS_HLEN, 0));
+        skb_postpush_rcsum(skb, new_mpls_lse, MPLS_HLEN);
 
         hdr = eth_hdr(skb);
         hdr->h_proto = mpls->mpls_ethertype;
@@ -280,7 +278,7 @@ static int set_eth_addr(struct sk_buff *skb, struct sw_flow_key *flow_key,
         ether_addr_copy_masked(eth_hdr(skb)->h_dest, key->eth_dst,
                                mask->eth_dst);
 
-        ovs_skb_postpush_rcsum(skb, eth_hdr(skb), ETH_ALEN * 2);
+        skb_postpush_rcsum(skb, eth_hdr(skb), ETH_ALEN * 2);
 
         ether_addr_copy(flow_key->eth.src, eth_hdr(skb)->h_source);
         ether_addr_copy(flow_key->eth.dst, eth_hdr(skb)->h_dest);
@@ -463,7 +461,7 @@ static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key,
                 mask_ipv6_addr(saddr, key->ipv6_src, mask->ipv6_src, masked);
 
                 if (unlikely(memcmp(saddr, masked, sizeof(masked)))) {
-                        set_ipv6_addr(skb, key->ipv6_proto, saddr, masked,
+                        set_ipv6_addr(skb, flow_key->ip.proto, saddr, masked,
                                       true);
                         memcpy(&flow_key->ipv6.addr.src, masked,
                                sizeof(flow_key->ipv6.addr.src));
@@ -485,7 +483,7 @@ static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key,
                                                              NULL, &flags)
                                                != NEXTHDR_ROUTING);
 
-                        set_ipv6_addr(skb, key->ipv6_proto, daddr, masked,
+                        set_ipv6_addr(skb, flow_key->ip.proto, daddr, masked,
                                       recalc_csum);
                         memcpy(&flow_key->ipv6.addr.dst, masked,
                                sizeof(flow_key->ipv6.addr.dst));
@@ -639,7 +637,7 @@ static int ovs_vport_output(struct net *net, struct sock *sk, struct sk_buff *sk
         /* Reconstruct the MAC header.  */
         skb_push(skb, data->l2_len);
         memcpy(skb->data, &data->l2_data, data->l2_len);
-        ovs_skb_postpush_rcsum(skb, skb->data, data->l2_len);
+        skb_postpush_rcsum(skb, skb->data, data->l2_len);
         skb_reset_mac_header(skb);
 
         ovs_vport_send(vport, skb);
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index ee6ff8ffc12d..b5fea1101faa 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -13,21 +13,31 @@
 
 #include <linux/module.h>
 #include <linux/openvswitch.h>
+#include <linux/tcp.h>
+#include <linux/udp.h>
+#include <linux/sctp.h>
 #include <net/ip.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_labels.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 
+#ifdef CONFIG_NF_NAT_NEEDED
+#include <linux/netfilter/nf_nat.h>
+#include <net/netfilter/nf_nat_core.h>
+#include <net/netfilter/nf_nat_l3proto.h>
+#endif
+
 #include "datapath.h"
 #include "conntrack.h"
 #include "flow.h"
 #include "flow_netlink.h"
 
 struct ovs_ct_len_tbl {
-        size_t maxlen;
-        size_t minlen;
+        int maxlen;
+        int minlen;
 };
 
 /* Metadata mark for masked write to conntrack mark */
@@ -42,15 +52,25 @@ struct md_labels {
         struct ovs_key_ct_labels mask;
 };
 
+enum ovs_ct_nat {
+        OVS_CT_NAT = 1 << 0,     /* NAT for committed connections only. */
+        OVS_CT_SRC_NAT = 1 << 1, /* Source NAT for NEW connections. */
+        OVS_CT_DST_NAT = 1 << 2, /* Destination NAT for NEW connections. */
+};
+
 /* Conntrack action context for execution. */
 struct ovs_conntrack_info {
         struct nf_conntrack_helper *helper;
         struct nf_conntrack_zone zone;
         struct nf_conn *ct;
         u8 commit : 1;
+        u8 nat : 3;                 /* enum ovs_ct_nat */
         u16 family;
         struct md_mark mark;
         struct md_labels labels;
+#ifdef CONFIG_NF_NAT_NEEDED
+        struct nf_nat_range range;  /* Only present for SRC NAT and DST NAT. */
+#endif
 };
 
 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info);
@@ -75,7 +95,6 @@ static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo)
         switch (ctinfo) {
         case IP_CT_ESTABLISHED_REPLY:
         case IP_CT_RELATED_REPLY:
-        case IP_CT_NEW_REPLY:
                 ct_state |= OVS_CS_F_REPLY_DIR;
                 break;
         default:
@@ -92,7 +111,6 @@ static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo)
                 ct_state |= OVS_CS_F_RELATED;
                 break;
         case IP_CT_NEW:
-        case IP_CT_NEW_REPLY:
                 ct_state |= OVS_CS_F_NEW;
                 break;
         default:
@@ -139,12 +157,15 @@ static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state,
         ovs_ct_get_labels(ct, &key->ct.labels);
 }
 
-/* Update 'key' based on skb->nfct. If 'post_ct' is true, then OVS has
- * previously sent the packet to conntrack via the ct action.
+/* Update 'key' based on skb->nfct.  If 'post_ct' is true, then OVS has
+ * previously sent the packet to conntrack via the ct action.  If
+ * 'keep_nat_flags' is true, the existing NAT flags retained, else they are
+ * initialized from the connection status.
  */
 static void ovs_ct_update_key(const struct sk_buff *skb,
                               const struct ovs_conntrack_info *info,
-                              struct sw_flow_key *key, bool post_ct)
+                              struct sw_flow_key *key, bool post_ct,
+                              bool keep_nat_flags)
 {
         const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
         enum ip_conntrack_info ctinfo;
@@ -154,10 +175,22 @@ static void ovs_ct_update_key(const struct sk_buff *skb,
         ct = nf_ct_get(skb, &ctinfo);
         if (ct) {
                 state = ovs_ct_get_state(ctinfo);
+                /* All unconfirmed entries are NEW connections. */
                 if (!nf_ct_is_confirmed(ct))
                         state |= OVS_CS_F_NEW;
+                /* OVS persists the related flag for the duration of the
+                 * connection.
+                 */
                 if (ct->master)
                         state |= OVS_CS_F_RELATED;
+                if (keep_nat_flags) {
+                        state |= key->ct.state & OVS_CS_F_NAT_MASK;
+                } else {
+                        if (ct->status & IPS_SRC_NAT)
+                                state |= OVS_CS_F_SRC_NAT;
+                        if (ct->status & IPS_DST_NAT)
+                                state |= OVS_CS_F_DST_NAT;
+                }
                 zone = nf_ct_zone(ct);
         } else if (post_ct) {
                 state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID;
@@ -167,9 +200,12 @@ static void ovs_ct_update_key(const struct sk_buff *skb,
         __ovs_ct_update_key(key, state, zone, ct);
 }
 
+/* This is called to initialize CT key fields possibly coming in from the local
+ * stack.
+ */
 void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key)
 {
-        ovs_ct_update_key(skb, NULL, key, false);
+        ovs_ct_update_key(skb, NULL, key, false, false);
 }
 
 int ovs_ct_put_key(const struct sw_flow_key *key, struct sk_buff *skb)
@@ -201,7 +237,6 @@ static int ovs_ct_set_mark(struct sk_buff *skb, struct sw_flow_key *key,
         struct nf_conn *ct;
         u32 new_mark;
 
-
         /* The connection could be invalid, in which case set_mark is no-op. */
         ct = nf_ct_get(skb, &ctinfo);
         if (!ct)
@@ -259,6 +294,7 @@ static int ovs_ct_helper(struct sk_buff *skb, u16 proto)
         enum ip_conntrack_info ctinfo;
         unsigned int protoff;
         struct nf_conn *ct;
+        int err;
 
         ct = nf_ct_get(skb, &ctinfo);
         if (!ct || ctinfo == IP_CT_RELATED_REPLY)
@@ -295,7 +331,18 @@ static int ovs_ct_helper(struct sk_buff *skb, u16 proto)
                 return NF_DROP;
         }
 
-        return helper->help(skb, protoff, ct, ctinfo);
+        err = helper->help(skb, protoff, ct, ctinfo);
+        if (err != NF_ACCEPT)
+                return err;
+
+        /* Adjust seqs after helper.  This is needed due to some helpers (e.g.,
+         * FTP with NAT) adusting the TCP payload size when mangling IP
+         * addresses and/or port numbers in the text-based control connection.
+         */
+        if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
+            !nf_ct_seq_adjust(skb, ct, ctinfo, protoff))
+                return NF_DROP;
+        return NF_ACCEPT;
 }
 
 /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
@@ -320,6 +367,7 @@ static int handle_fragments(struct net *net, struct sw_flow_key *key,
         } else if (key->eth.type == htons(ETH_P_IPV6)) {
                 enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone;
 
+                skb_orphan(skb);
                 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
                 err = nf_ct_frag6_gather(net, skb, user);
                 if (err)
@@ -352,14 +400,101 @@ ovs_ct_expect_find(struct net *net, const struct nf_conntrack_zone *zone,
         return __nf_ct_expect_find(net, zone, &tuple);
 }
 
+/* This replicates logic from nf_conntrack_core.c that is not exported. */
+static enum ip_conntrack_info
+ovs_ct_get_info(const struct nf_conntrack_tuple_hash *h)
+{
+        const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
+
+        if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
+                return IP_CT_ESTABLISHED_REPLY;
+        /* Once we've had two way comms, always ESTABLISHED. */
+        if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status))
+                return IP_CT_ESTABLISHED;
+        if (test_bit(IPS_EXPECTED_BIT, &ct->status))
+                return IP_CT_RELATED;
+        return IP_CT_NEW;
+}
+
+/* Find an existing connection which this packet belongs to without
+ * re-attributing statistics or modifying the connection state.  This allows an
+ * skb->nfct lost due to an upcall to be recovered during actions execution.
+ *
+ * Must be called with rcu_read_lock.
+ *
+ * On success, populates skb->nfct and skb->nfctinfo, and returns the
+ * connection.  Returns NULL if there is no existing entry.
+ */
+static struct nf_conn *
+ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone,
+                     u8 l3num, struct sk_buff *skb)
+{
+        struct nf_conntrack_l3proto *l3proto;
+        struct nf_conntrack_l4proto *l4proto;
+        struct nf_conntrack_tuple tuple;
+        struct nf_conntrack_tuple_hash *h;
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct;
+        unsigned int dataoff;
+        u8 protonum;
+
+        l3proto = __nf_ct_l3proto_find(l3num);
+        if (!l3proto) {
+                pr_debug("ovs_ct_find_existing: Can't get l3proto\n");
+                return NULL;
+        }
+        if (l3proto->get_l4proto(skb, skb_network_offset(skb), &dataoff,
+                                 &protonum) <= 0) {
+                pr_debug("ovs_ct_find_existing: Can't get protonum\n");
+                return NULL;
+        }
+        l4proto = __nf_ct_l4proto_find(l3num, protonum);
+        if (!l4proto) {
+                pr_debug("ovs_ct_find_existing: Can't get l4proto\n");
+                return NULL;
+        }
+        if (!nf_ct_get_tuple(skb, skb_network_offset(skb), dataoff, l3num,
+                             protonum, net, &tuple, l3proto, l4proto)) {
+                pr_debug("ovs_ct_find_existing: Can't get tuple\n");
+                return NULL;
+        }
+
+        /* look for tuple match */
+        h = nf_conntrack_find_get(net, zone, &tuple);
+        if (!h)
+                return NULL;   /* Not found. */
+
+        ct = nf_ct_tuplehash_to_ctrack(h);
+
+        ctinfo = ovs_ct_get_info(h);
+        if (ctinfo == IP_CT_NEW) {
+                /* This should not happen. */
+                WARN_ONCE(1, "ovs_ct_find_existing: new packet for %p\n", ct);
+        }
+        skb->nfct = &ct->ct_general;
+        skb->nfctinfo = ctinfo;
+        return ct;
+}
+
 /* Determine whether skb->nfct is equal to the result of conntrack lookup. */
-static bool skb_nfct_cached(const struct net *net, const struct sk_buff *skb,
-                            const struct ovs_conntrack_info *info)
+static bool skb_nfct_cached(struct net *net,
+                            const struct sw_flow_key *key,
+                            const struct ovs_conntrack_info *info,
+                            struct sk_buff *skb)
 {
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct;
 
         ct = nf_ct_get(skb, &ctinfo);
+        /* If no ct, check if we have evidence that an existing conntrack entry
+         * might be found for this skb.  This happens when we lose a skb->nfct
+         * due to an upcall.  If the connection was not confirmed, it is not
+         * cached and needs to be run through conntrack again.
+         */
+        if (!ct && key->ct.state & OVS_CS_F_TRACKED &&
+            !(key->ct.state & OVS_CS_F_INVALID) &&
+            key->ct.zone == info->zone.id)
+                ct = ovs_ct_find_existing(net, &info->zone, info->family, skb);
         if (!ct)
                 return false;
         if (!net_eq(net, read_pnet(&ct->ct_net)))
@@ -377,6 +512,207 @@ static bool skb_nfct_cached(const struct net *net, const struct sk_buff *skb,
         return true;
 }
 
+#ifdef CONFIG_NF_NAT_NEEDED
+/* Modelled after nf_nat_ipv[46]_fn().
+ * range is only used for new, uninitialized NAT state.
+ * Returns either NF_ACCEPT or NF_DROP.
+ */
+static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
+                              enum ip_conntrack_info ctinfo,
+                              const struct nf_nat_range *range,
+                              enum nf_nat_manip_type maniptype)
+{
+        int hooknum, nh_off, err = NF_ACCEPT;
+
+        nh_off = skb_network_offset(skb);
+        skb_pull(skb, nh_off);
+
+        /* See HOOK2MANIP(). */
+        if (maniptype == NF_NAT_MANIP_SRC)
+                hooknum = NF_INET_LOCAL_IN; /* Source NAT */
+        else
+                hooknum = NF_INET_LOCAL_OUT; /* Destination NAT */
+
+        switch (ctinfo) {
+        case IP_CT_RELATED:
+        case IP_CT_RELATED_REPLY:
+                if (IS_ENABLED(CONFIG_NF_NAT_IPV4) &&
+                    skb->protocol == htons(ETH_P_IP) &&
+                    ip_hdr(skb)->protocol == IPPROTO_ICMP) {
+                        if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
+                                                           hooknum))
+                                err = NF_DROP;
+                        goto push;
+                } else if (IS_ENABLED(CONFIG_NF_NAT_IPV6) &&
+                           skb->protocol == htons(ETH_P_IPV6)) {
+                        __be16 frag_off;
+                        u8 nexthdr = ipv6_hdr(skb)->nexthdr;
+                        int hdrlen = ipv6_skip_exthdr(skb,
+                                                      sizeof(struct ipv6hdr),
+                                                      &nexthdr, &frag_off);
+
+                        if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) {
+                                if (!nf_nat_icmpv6_reply_translation(skb, ct,
+                                                                     ctinfo,
+                                                                     hooknum,
+                                                                     hdrlen))
+                                        err = NF_DROP;
+                                goto push;
+                        }
+                }
+                /* Non-ICMP, fall thru to initialize if needed. */
+        case IP_CT_NEW:
+                /* Seen it before?  This can happen for loopback, retrans,
+                 * or local packets.
+                 */
+                if (!nf_nat_initialized(ct, maniptype)) {
+                        /* Initialize according to the NAT action. */
+                        err = (range && range->flags & NF_NAT_RANGE_MAP_IPS)
+                                /* Action is set up to establish a new
+                                 * mapping.
+                                 */
+                                ? nf_nat_setup_info(ct, range, maniptype)
+                                : nf_nat_alloc_null_binding(ct, hooknum);
+                        if (err != NF_ACCEPT)
+                                goto push;
+                }
+                break;
+
+        case IP_CT_ESTABLISHED:
+        case IP_CT_ESTABLISHED_REPLY:
+                break;
+
+        default:
+                err = NF_DROP;
+                goto push;
+        }
+
+        err = nf_nat_packet(ct, ctinfo, hooknum, skb);
+push:
+        skb_push(skb, nh_off);
+
+        return err;
+}
+
+static void ovs_nat_update_key(struct sw_flow_key *key,
+                               const struct sk_buff *skb,
+                               enum nf_nat_manip_type maniptype)
+{
+        if (maniptype == NF_NAT_MANIP_SRC) {
+                __be16 src;
+
+                key->ct.state |= OVS_CS_F_SRC_NAT;
+                if (key->eth.type == htons(ETH_P_IP))
+                        key->ipv4.addr.src = ip_hdr(skb)->saddr;
+                else if (key->eth.type == htons(ETH_P_IPV6))
+                        memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr,
+                               sizeof(key->ipv6.addr.src));
+                else
+                        return;
+
+                if (key->ip.proto == IPPROTO_UDP)
+                        src = udp_hdr(skb)->source;
+                else if (key->ip.proto == IPPROTO_TCP)
+                        src = tcp_hdr(skb)->source;
+                else if (key->ip.proto == IPPROTO_SCTP)
+                        src = sctp_hdr(skb)->source;
+                else
+                        return;
+
+                key->tp.src = src;
+        } else {
+                __be16 dst;
+
+                key->ct.state |= OVS_CS_F_DST_NAT;
+                if (key->eth.type == htons(ETH_P_IP))
+                        key->ipv4.addr.dst = ip_hdr(skb)->daddr;
+                else if (key->eth.type == htons(ETH_P_IPV6))
+                        memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr,
+                               sizeof(key->ipv6.addr.dst));
+                else
+                        return;
+
+                if (key->ip.proto == IPPROTO_UDP)
+                        dst = udp_hdr(skb)->dest;
+                else if (key->ip.proto == IPPROTO_TCP)
+                        dst = tcp_hdr(skb)->dest;
+                else if (key->ip.proto == IPPROTO_SCTP)
+                        dst = sctp_hdr(skb)->dest;
+                else
+                        return;
+
+                key->tp.dst = dst;
+        }
+}
+
+/* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */
+static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
+                      const struct ovs_conntrack_info *info,
+                      struct sk_buff *skb, struct nf_conn *ct,
+                      enum ip_conntrack_info ctinfo)
+{
+        enum nf_nat_manip_type maniptype;
+        int err;
+
+        if (nf_ct_is_untracked(ct)) {
+                /* A NAT action may only be performed on tracked packets. */
+                return NF_ACCEPT;
+        }
+
+        /* Add NAT extension if not confirmed yet. */
+        if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct))
+                return NF_ACCEPT;   /* Can't NAT. */
+
+        /* Determine NAT type.
+         * Check if the NAT type can be deduced from the tracked connection.
+         * Make sure new expected connections (IP_CT_RELATED) are NATted only
+         * when committing.
+         */
+        if (info->nat & OVS_CT_NAT && ctinfo != IP_CT_NEW &&
+            ct->status & IPS_NAT_MASK &&
+            (ctinfo != IP_CT_RELATED || info->commit)) {
+                /* NAT an established or related connection like before. */
+                if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY)
+                        /* This is the REPLY direction for a connection
+                         * for which NAT was applied in the forward
+                         * direction.  Do the reverse NAT.
+                         */
+                        maniptype = ct->status & IPS_SRC_NAT
+                                ? NF_NAT_MANIP_DST : NF_NAT_MANIP_SRC;
+                else
+                        maniptype = ct->status & IPS_SRC_NAT
+                                ? NF_NAT_MANIP_SRC : NF_NAT_MANIP_DST;
+        } else if (info->nat & OVS_CT_SRC_NAT) {
+                maniptype = NF_NAT_MANIP_SRC;
+        } else if (info->nat & OVS_CT_DST_NAT) {
+                maniptype = NF_NAT_MANIP_DST;
+        } else {
+                return NF_ACCEPT; /* Connection is not NATed. */
+        }
+        err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype);
+
+        /* Mark NAT done if successful and update the flow key. */
+        if (err == NF_ACCEPT)
+                ovs_nat_update_key(key, skb, maniptype);
+
+        return err;
+}
+#else /* !CONFIG_NF_NAT_NEEDED */
+static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
+                      const struct ovs_conntrack_info *info,
+                      struct sk_buff *skb, struct nf_conn *ct,
+                      enum ip_conntrack_info ctinfo)
+{
+        return NF_ACCEPT;
+}
+#endif
+
+/* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if
+ * not done already.  Update key with new CT state after passing the packet
+ * through conntrack.
+ * Note that if the packet is deemed invalid by conntrack, skb->nfct will be
+ * set to NULL and 0 will be returned.
+ */
 static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
                            const struct ovs_conntrack_info *info,
                            struct sk_buff *skb)
@@ -386,8 +722,13 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
          * actually run the packet through conntrack twice unless it's for a
          * different zone.
          */
-        if (!skb_nfct_cached(net, skb, info)) {
+        bool cached = skb_nfct_cached(net, key, info, skb);
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct;
+
+        if (!cached) {
                 struct nf_conn *tmpl = info->ct;
+                int err;
 
                 /* Associate skb with specified zone. */
                 if (tmpl) {
@@ -398,17 +739,53 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
                         skb->nfctinfo = IP_CT_NEW;
                 }
 
-                if (nf_conntrack_in(net, info->family, NF_INET_PRE_ROUTING,
-                                    skb) != NF_ACCEPT)
+                /* Repeat if requested, see nf_iterate(). */
+                do {
+                        err = nf_conntrack_in(net, info->family,
+                                              NF_INET_PRE_ROUTING, skb);
+                } while (err == NF_REPEAT);
+
+                if (err != NF_ACCEPT)
                         return -ENOENT;
 
-                if (ovs_ct_helper(skb, info->family) != NF_ACCEPT) {
-                        WARN_ONCE(1, "helper rejected packet");
+                /* Clear CT state NAT flags to mark that we have not yet done
+                 * NAT after the nf_conntrack_in() call.  We can actually clear
+                 * the whole state, as it will be re-initialized below.
+                 */
+                key->ct.state = 0;
+
+                /* Update the key, but keep the NAT flags. */
+                ovs_ct_update_key(skb, info, key, true, true);
+        }
+
+        ct = nf_ct_get(skb, &ctinfo);
+        if (ct) {
+                /* Packets starting a new connection must be NATted before the
+                 * helper, so that the helper knows about the NAT.  We enforce
+                 * this by delaying both NAT and helper calls for unconfirmed
+                 * connections until the committing CT action.  For later
+                 * packets NAT and Helper may be called in either order.
+                 *
+                 * NAT will be done only if the CT action has NAT, and only
+                 * once per packet (per zone), as guarded by the NAT bits in
+                 * the key->ct.state.
+                 */
+                if (info->nat && !(key->ct.state & OVS_CS_F_NAT_MASK) &&
+                    (nf_ct_is_confirmed(ct) || info->commit) &&
+                    ovs_ct_nat(net, key, info, skb, ct, ctinfo) != NF_ACCEPT) {
                         return -EINVAL;
                 }
-        }
 
-        ovs_ct_update_key(skb, info, key, true);
+                /* Call the helper only if:
+                 * - nf_conntrack_in() was executed above ("!cached") for a
+                 *   confirmed connection, or
+                 * - When committing an unconfirmed connection.
+                 */
+                if ((nf_ct_is_confirmed(ct) ? !cached : info->commit) &&
+                    ovs_ct_helper(skb, info->family) != NF_ACCEPT) {
+                        return -EINVAL;
+                }
+        }
 
         return 0;
 }
@@ -420,19 +797,24 @@ static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
 {
         struct nf_conntrack_expect *exp;
 
+        /* If we pass an expected packet through nf_conntrack_in() the
+         * expectation is typically removed, but the packet could still be
+         * lost in upcall processing.  To prevent this from happening we
+         * perform an explicit expectation lookup.  Expected connections are
+         * always new, and will be passed through conntrack only when they are
+         * committed, as it is OK to remove the expectation at that time.
+         */
         exp = ovs_ct_expect_find(net, &info->zone, info->family, skb);
         if (exp) {
                 u8 state;
 
+                /* NOTE: New connections are NATted and Helped only when
+                 * committed, so we are not calling into NAT here.
+                 */
                 state = OVS_CS_F_TRACKED | OVS_CS_F_NEW | OVS_CS_F_RELATED;
                 __ovs_ct_update_key(key, state, &info->zone, exp->master);
-        } else {
-                int err;
-
-                err = __ovs_ct_lookup(net, key, info, skb);
-                if (err)
-                        return err;
-        }
+        } else
+                return __ovs_ct_lookup(net, key, info, skb);
 
         return 0;
 }
@@ -442,21 +824,12 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
                          const struct ovs_conntrack_info *info,
                          struct sk_buff *skb)
 {
-        u8 state;
         int err;
 
-        state = key->ct.state;
-        if (key->ct.zone == info->zone.id &&
-            ((state & OVS_CS_F_TRACKED) && !(state & OVS_CS_F_NEW))) {
-                /* Previous lookup has shown that this connection is already
-                 * tracked and committed. Skip committing.
-                 */
-                return 0;
-        }
-
         err = __ovs_ct_lookup(net, key, info, skb);
         if (err)
                 return err;
+        /* This is a no-op if the connection has already been confirmed. */
         if (nf_conntrack_confirm(skb) != NF_ACCEPT)
                 return -EINVAL;
 
@@ -541,6 +914,136 @@ static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name,
         return 0;
 }
 
+#ifdef CONFIG_NF_NAT_NEEDED
+static int parse_nat(const struct nlattr *attr,
+                     struct ovs_conntrack_info *info, bool log)
+{
+        struct nlattr *a;
+        int rem;
+        bool have_ip_max = false;
+        bool have_proto_max = false;
+        bool ip_vers = (info->family == NFPROTO_IPV6);
+
+        nla_for_each_nested(a, attr, rem) {
+                static const int ovs_nat_attr_lens[OVS_NAT_ATTR_MAX + 1][2] = {
+                        [OVS_NAT_ATTR_SRC] = {0, 0},
+                        [OVS_NAT_ATTR_DST] = {0, 0},
+                        [OVS_NAT_ATTR_IP_MIN] = {sizeof(struct in_addr),
+                                                 sizeof(struct in6_addr)},
+                        [OVS_NAT_ATTR_IP_MAX] = {sizeof(struct in_addr),
+                                                 sizeof(struct in6_addr)},
+                        [OVS_NAT_ATTR_PROTO_MIN] = {sizeof(u16), sizeof(u16)},
+                        [OVS_NAT_ATTR_PROTO_MAX] = {sizeof(u16), sizeof(u16)},
+                        [OVS_NAT_ATTR_PERSISTENT] = {0, 0},
+                        [OVS_NAT_ATTR_PROTO_HASH] = {0, 0},
+                        [OVS_NAT_ATTR_PROTO_RANDOM] = {0, 0},
+                };
+                int type = nla_type(a);
+
+                if (type > OVS_NAT_ATTR_MAX) {
+                        OVS_NLERR(log,
+                                  "Unknown NAT attribute (type=%d, max=%d).\n",
+                                  type, OVS_NAT_ATTR_MAX);
+                        return -EINVAL;
+                }
+
+                if (nla_len(a) != ovs_nat_attr_lens[type][ip_vers]) {
+                        OVS_NLERR(log,
+                                  "NAT attribute type %d has unexpected length (%d != %d).\n",
+                                  type, nla_len(a),
+                                  ovs_nat_attr_lens[type][ip_vers]);
+                        return -EINVAL;
+                }
+
+                switch (type) {
+                case OVS_NAT_ATTR_SRC:
+                case OVS_NAT_ATTR_DST:
+                        if (info->nat) {
+                                OVS_NLERR(log,
+                                          "Only one type of NAT may be specified.\n"
+                                          );
+                                return -ERANGE;
+                        }
+                        info->nat |= OVS_CT_NAT;
+                        info->nat |= ((type == OVS_NAT_ATTR_SRC)
+                                        ? OVS_CT_SRC_NAT : OVS_CT_DST_NAT);
+                        break;
+
+                case OVS_NAT_ATTR_IP_MIN:
+                        nla_memcpy(&info->range.min_addr, a,
+                                   sizeof(info->range.min_addr));
+                        info->range.flags |= NF_NAT_RANGE_MAP_IPS;
+                        break;
+
+                case OVS_NAT_ATTR_IP_MAX:
+                        have_ip_max = true;
+                        nla_memcpy(&info->range.max_addr, a,
+                                   sizeof(info->range.max_addr));
+                        info->range.flags |= NF_NAT_RANGE_MAP_IPS;
+                        break;
+
+                case OVS_NAT_ATTR_PROTO_MIN:
+                        info->range.min_proto.all = htons(nla_get_u16(a));
+                        info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
+                        break;
+
+                case OVS_NAT_ATTR_PROTO_MAX:
+                        have_proto_max = true;
+                        info->range.max_proto.all = htons(nla_get_u16(a));
+                        info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
+                        break;
+
+                case OVS_NAT_ATTR_PERSISTENT:
+                        info->range.flags |= NF_NAT_RANGE_PERSISTENT;
+                        break;
+
+                case OVS_NAT_ATTR_PROTO_HASH:
+                        info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM;
+                        break;
+
+                case OVS_NAT_ATTR_PROTO_RANDOM:
+                        info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY;
+                        break;
+
+                default:
+                        OVS_NLERR(log, "Unknown nat attribute (%d).\n", type);
+                        return -EINVAL;
+                }
+        }
+
+        if (rem > 0) {
+                OVS_NLERR(log, "NAT attribute has %d unknown bytes.\n", rem);
+                return -EINVAL;
+        }
+        if (!info->nat) {
+                /* Do not allow flags if no type is given. */
+                if (info->range.flags) {
+                        OVS_NLERR(log,
+                                  "NAT flags may be given only when NAT range (SRC or DST) is also specified.\n"
+                                  );
+                        return -EINVAL;
+                }
+                info->nat = OVS_CT_NAT;   /* NAT existing connections. */
+        } else if (!info->commit) {
+                OVS_NLERR(log,
+                          "NAT attributes may be specified only when CT COMMIT flag is also specified.\n"
+                          );
+                return -EINVAL;
+        }
+        /* Allow missing IP_MAX. */
+        if (info->range.flags & NF_NAT_RANGE_MAP_IPS && !have_ip_max) {
+                memcpy(&info->range.max_addr, &info->range.min_addr,
+                       sizeof(info->range.max_addr));
+        }
+        /* Allow missing PROTO_MAX. */
+        if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
+            !have_proto_max) {
+                info->range.max_proto.all = info->range.min_proto.all;
+        }
+        return 0;
+}
+#endif
+
 static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
         [OVS_CT_ATTR_COMMIT]    = { .minlen = 0, .maxlen = 0 },
         [OVS_CT_ATTR_ZONE]      = { .minlen = sizeof(u16),
@@ -550,7 +1053,11 @@ static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
         [OVS_CT_ATTR_LABELS]    = { .minlen = sizeof(struct md_labels),
                                     .maxlen = sizeof(struct md_labels) },
         [OVS_CT_ATTR_HELPER]    = { .minlen = 1,
-                                    .maxlen = NF_CT_HELPER_NAME_LEN }
+                                    .maxlen = NF_CT_HELPER_NAME_LEN },
+#ifdef CONFIG_NF_NAT_NEEDED
+        /* NAT length is checked when parsing the nested attributes. */
+        [OVS_CT_ATTR_NAT]       = { .minlen = 0, .maxlen = INT_MAX },
+#endif
 };
 
 static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
@@ -617,6 +1124,15 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
                                 return -EINVAL;
                         }
                         break;
+#ifdef CONFIG_NF_NAT_NEEDED
+                case OVS_CT_ATTR_NAT: {
+                        int err = parse_nat(a, info, log);
+
+                        if (err)
+                                return err;
+                        break;
+                }
+#endif
                 default:
                         OVS_NLERR(log, "Unknown conntrack attr (%d)",
                                   type);
@@ -704,6 +1220,74 @@ err_free_ct:
         return err;
 }
 
+#ifdef CONFIG_NF_NAT_NEEDED
+static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info,
+                               struct sk_buff *skb)
+{
+        struct nlattr *start;
+
+        start = nla_nest_start(skb, OVS_CT_ATTR_NAT);
+        if (!start)
+                return false;
+
+        if (info->nat & OVS_CT_SRC_NAT) {
+                if (nla_put_flag(skb, OVS_NAT_ATTR_SRC))
+                        return false;
+        } else if (info->nat & OVS_CT_DST_NAT) {
+                if (nla_put_flag(skb, OVS_NAT_ATTR_DST))
+                        return false;
+        } else {
+                goto out;
+        }
+
+        if (info->range.flags & NF_NAT_RANGE_MAP_IPS) {
+                if (IS_ENABLED(CONFIG_NF_NAT_IPV4) &&
+                    info->family == NFPROTO_IPV4) {
+                        if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN,
+                                            info->range.min_addr.ip) ||
+                            (info->range.max_addr.ip
+                             != info->range.min_addr.ip &&
+                             (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX,
+                                              info->range.max_addr.ip))))
+                                return false;
+                } else if (IS_ENABLED(CONFIG_NF_NAT_IPV6) &&
+                           info->family == NFPROTO_IPV6) {
+                        if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN,
+                                             &info->range.min_addr.in6) ||
+                            (memcmp(&info->range.max_addr.in6,
+                                    &info->range.min_addr.in6,
+                                    sizeof(info->range.max_addr.in6)) &&
+                             (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX,
+                                               &info->range.max_addr.in6))))
+                                return false;
+                } else {
+                        return false;
+                }
+        }
+        if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
+            (nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MIN,
+                         ntohs(info->range.min_proto.all)) ||
+             (info->range.max_proto.all != info->range.min_proto.all &&
+              nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MAX,
+                          ntohs(info->range.max_proto.all)))))
+                return false;
+
+        if (info->range.flags & NF_NAT_RANGE_PERSISTENT &&
+            nla_put_flag(skb, OVS_NAT_ATTR_PERSISTENT))
+                return false;
+        if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM &&
+            nla_put_flag(skb, OVS_NAT_ATTR_PROTO_HASH))
+                return false;
+        if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY &&
+            nla_put_flag(skb, OVS_NAT_ATTR_PROTO_RANDOM))
+                return false;
+out:
+        nla_nest_end(skb, start);
+
+        return true;
+}
+#endif
+
 int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
                           struct sk_buff *skb)
 {
@@ -732,7 +1316,10 @@ int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
                                    ct_info->helper->name))
                         return -EMSGSIZE;
         }
-
+#ifdef CONFIG_NF_NAT_NEEDED
+        if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb))
+                return -EMSGSIZE;
+#endif
         nla_nest_end(skb, start);
 
         return 0;
diff --git a/net/openvswitch/conntrack.h b/net/openvswitch/conntrack.h
index a7544f405c16..8f6230bd6183 100644
--- a/net/openvswitch/conntrack.h
+++ b/net/openvswitch/conntrack.h
@@ -37,7 +37,8 @@ void ovs_ct_free_action(const struct nlattr *a);
 
 #define CT_SUPPORTED_MASK (OVS_CS_F_NEW | OVS_CS_F_ESTABLISHED | \
                            OVS_CS_F_RELATED | OVS_CS_F_REPLY_DIR | \
-                           OVS_CS_F_INVALID | OVS_CS_F_TRACKED)
+                           OVS_CS_F_INVALID | OVS_CS_F_TRACKED | \
+                           OVS_CS_F_SRC_NAT | OVS_CS_F_DST_NAT)
 #else
 #include <linux/errno.h>
 
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index deadfdab1bc3..0cc66a4e492d 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -422,10 +422,6 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
         struct sk_buff *nskb = NULL;
         struct sk_buff *user_skb = NULL; /* to be queued to userspace */
         struct nlattr *nla;
-        struct genl_info info = {
-                .dst_sk = ovs_dp_get_net(dp)->genl_sock,
-                .snd_portid = upcall_info->portid,
-        };
         size_t len;
         unsigned int hlen;
         int err, dp_ifindex;
@@ -466,7 +462,7 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
                 hlen = skb->len;
 
         len = upcall_msg_size(upcall_info, hlen);
-        user_skb = genlmsg_new_unicast(len, &info, GFP_ATOMIC);
+        user_skb = genlmsg_new(len, GFP_ATOMIC);
         if (!user_skb) {
                 err = -ENOMEM;
                 goto out;
@@ -654,7 +650,7 @@ static const struct nla_policy packet_policy[OVS_PACKET_ATTR_MAX + 1] = {
 
 static const struct genl_ops dp_packet_genl_ops[] = {
         { .cmd = OVS_PACKET_CMD_EXECUTE,
-          .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
+          .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
           .policy = packet_policy,
           .doit = ovs_packet_cmd_execute
         }
@@ -876,7 +872,7 @@ static struct sk_buff *ovs_flow_cmd_alloc_info(const struct sw_flow_actions *act
                 return NULL;
 
         len = ovs_flow_cmd_msg_size(acts, sfid, ufid_flags);
-        skb = genlmsg_new_unicast(len, info, GFP_KERNEL);
+        skb = genlmsg_new(len, GFP_KERNEL);
         if (!skb)
                 return ERR_PTR(-ENOMEM);
 
@@ -1100,26 +1096,32 @@ static int ovs_flow_cmd_set(struct sk_buff *skb, struct genl_info *info)
         struct sw_flow_match match;
         struct sw_flow_id sfid;
         u32 ufid_flags = ovs_nla_get_ufid_flags(a[OVS_FLOW_ATTR_UFID_FLAGS]);
-        int error;
+        int error = 0;
         bool log = !a[OVS_FLOW_ATTR_PROBE];
         bool ufid_present;
 
-        /* Extract key. */
-        error = -EINVAL;
-        if (!a[OVS_FLOW_ATTR_KEY]) {
-                OVS_NLERR(log, "Flow key attribute not present in set flow.");
-                goto error;
-        }
-
         ufid_present = ovs_nla_get_ufid(&sfid, a[OVS_FLOW_ATTR_UFID], log);
-        ovs_match_init(&match, &key, &mask);
-        error = ovs_nla_get_match(net, &match, a[OVS_FLOW_ATTR_KEY],
-                                  a[OVS_FLOW_ATTR_MASK], log);
+        if (a[OVS_FLOW_ATTR_KEY]) {
+                ovs_match_init(&match, &key, &mask);
+                error = ovs_nla_get_match(net, &match, a[OVS_FLOW_ATTR_KEY],
+                                          a[OVS_FLOW_ATTR_MASK], log);
+        } else if (!ufid_present) {
+                OVS_NLERR(log,
+                          "Flow set message rejected, Key attribute missing.");
+                error = -EINVAL;
+        }
         if (error)
                 goto error;
 
         /* Validate actions. */
         if (a[OVS_FLOW_ATTR_ACTIONS]) {
+                if (!a[OVS_FLOW_ATTR_KEY]) {
+                        OVS_NLERR(log,
+                                  "Flow key attribute not present in set flow.");
+                        error = -EINVAL;
+                        goto error;
+                }
+
                 acts = get_flow_actions(net, a[OVS_FLOW_ATTR_ACTIONS], &key,
                                         &mask, log);
                 if (IS_ERR(acts)) {
@@ -1391,12 +1393,12 @@ static const struct nla_policy flow_policy[OVS_FLOW_ATTR_MAX + 1] = {
 
 static const struct genl_ops dp_flow_genl_ops[] = {
         { .cmd = OVS_FLOW_CMD_NEW,
-          .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
+          .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
           .policy = flow_policy,
           .doit = ovs_flow_cmd_new
         },
         { .cmd = OVS_FLOW_CMD_DEL,
-          .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
+          .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
           .policy = flow_policy,
           .doit = ovs_flow_cmd_del
         },
@@ -1407,7 +1409,7 @@ static const struct genl_ops dp_flow_genl_ops[] = {
           .dumpit = ovs_flow_cmd_dump
         },
         { .cmd = OVS_FLOW_CMD_SET,
-          .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
+          .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
           .policy = flow_policy,
           .doit = ovs_flow_cmd_set,
         },
@@ -1481,9 +1483,9 @@ error:
         return -EMSGSIZE;
 }
 
-static struct sk_buff *ovs_dp_cmd_alloc_info(struct genl_info *info)
+static struct sk_buff *ovs_dp_cmd_alloc_info(void)
 {
-        return genlmsg_new_unicast(ovs_dp_cmd_msg_size(), info, GFP_KERNEL);
+        return genlmsg_new(ovs_dp_cmd_msg_size(), GFP_KERNEL);
 }
 
 /* Called with rcu_read_lock or ovs_mutex. */
@@ -1536,7 +1538,7 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)
         if (!a[OVS_DP_ATTR_NAME] || !a[OVS_DP_ATTR_UPCALL_PID])
                 goto err;
 
-        reply = ovs_dp_cmd_alloc_info(info);
+        reply = ovs_dp_cmd_alloc_info();
         if (!reply)
                 return -ENOMEM;
 
@@ -1657,7 +1659,7 @@ static int ovs_dp_cmd_del(struct sk_buff *skb, struct genl_info *info)
         struct datapath *dp;
         int err;
 
-        reply = ovs_dp_cmd_alloc_info(info);
+        reply = ovs_dp_cmd_alloc_info();
         if (!reply)
                 return -ENOMEM;
 
@@ -1690,7 +1692,7 @@ static int ovs_dp_cmd_set(struct sk_buff *skb, struct genl_info *info)
         struct datapath *dp;
         int err;
 
-        reply = ovs_dp_cmd_alloc_info(info);
+        reply = ovs_dp_cmd_alloc_info();
         if (!reply)
                 return -ENOMEM;
 
@@ -1723,7 +1725,7 @@ static int ovs_dp_cmd_get(struct sk_buff *skb, struct genl_info *info)
         struct datapath *dp;
         int err;
 
-        reply = ovs_dp_cmd_alloc_info(info);
+        reply = ovs_dp_cmd_alloc_info();
         if (!reply)
                 return -ENOMEM;
 
@@ -1777,12 +1779,12 @@ static const struct nla_policy datapath_policy[OVS_DP_ATTR_MAX + 1] = {
 
 static const struct genl_ops dp_datapath_genl_ops[] = {
         { .cmd = OVS_DP_CMD_NEW,
-          .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
+          .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
           .policy = datapath_policy,
           .doit = ovs_dp_cmd_new
         },
         { .cmd = OVS_DP_CMD_DEL,
-          .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
+          .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
           .policy = datapath_policy,
           .doit = ovs_dp_cmd_del
         },
@@ -1793,7 +1795,7 @@ static const struct genl_ops dp_datapath_genl_ops[] = {
           .dumpit = ovs_dp_cmd_dump
         },
         { .cmd = OVS_DP_CMD_SET,
-          .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
+          .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
           .policy = datapath_policy,
           .doit = ovs_dp_cmd_set,
         },
@@ -1912,6 +1914,29 @@ static struct vport *lookup_vport(struct net *net,
                 return ERR_PTR(-EINVAL);
 }
 
+/* Called with ovs_mutex */
+static void update_headroom(struct datapath *dp)
+{
+        unsigned dev_headroom, max_headroom = 0;
+        struct net_device *dev;
+        struct vport *vport;
+        int i;
+
+        for (i = 0; i < DP_VPORT_HASH_BUCKETS; i++) {
+                hlist_for_each_entry_rcu(vport, &dp->ports[i], dp_hash_node) {
+                        dev = vport->dev;
+                        dev_headroom = netdev_get_fwd_headroom(dev);
+                        if (dev_headroom > max_headroom)
+                                max_headroom = dev_headroom;
+                }
+        }
+
+        dp->max_headroom = max_headroom;
+        for (i = 0; i < DP_VPORT_HASH_BUCKETS; i++)
+                hlist_for_each_entry_rcu(vport, &dp->ports[i], dp_hash_node)
+                        netdev_set_rx_headroom(vport->dev, max_headroom);
+}
+
 static int ovs_vport_cmd_new(struct sk_buff *skb, struct genl_info *info)
 {
         struct nlattr **a = info->attrs;
@@ -1977,6 +2002,12 @@ restart:
 
         err = ovs_vport_cmd_fill_info(vport, reply, info->snd_portid,
                                       info->snd_seq, 0, OVS_VPORT_CMD_NEW);
+
+        if (netdev_get_fwd_headroom(vport->dev) > dp->max_headroom)
+                update_headroom(dp);
+        else
+                netdev_set_rx_headroom(vport->dev, dp->max_headroom);
+
         BUG_ON(err < 0);
         ovs_unlock();
 
@@ -2043,8 +2074,10 @@ exit_unlock_free:
 
 static int ovs_vport_cmd_del(struct sk_buff *skb, struct genl_info *info)
 {
+        bool must_update_headroom = false;
         struct nlattr **a = info->attrs;
         struct sk_buff *reply;
+        struct datapath *dp;
         struct vport *vport;
         int err;
 
@@ -2066,7 +2099,16 @@ static int ovs_vport_cmd_del(struct sk_buff *skb, struct genl_info *info)
         err = ovs_vport_cmd_fill_info(vport, reply, info->snd_portid,
                                       info->snd_seq, 0, OVS_VPORT_CMD_DEL);
         BUG_ON(err < 0);
+
+        /* the vport deletion may trigger dp headroom update */
+        dp = vport->dp;
+        if (netdev_get_fwd_headroom(vport->dev) == dp->max_headroom)
+                must_update_headroom = true;
+        netdev_reset_rx_headroom(vport->dev);
         ovs_dp_detach_port(vport);
+
+        if (must_update_headroom)
+                update_headroom(dp);
         ovs_unlock();
 
         ovs_notify(&dp_vport_genl_family, reply, info);
@@ -2158,12 +2200,12 @@ static const struct nla_policy vport_policy[OVS_VPORT_ATTR_MAX + 1] = {
 
 static const struct genl_ops dp_vport_genl_ops[] = {
         { .cmd = OVS_VPORT_CMD_NEW,
-          .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
+          .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
           .policy = vport_policy,
           .doit = ovs_vport_cmd_new
         },
         { .cmd = OVS_VPORT_CMD_DEL,
-          .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
+          .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
           .policy = vport_policy,
           .doit = ovs_vport_cmd_del
         },
@@ -2174,7 +2216,7 @@ static const struct genl_ops dp_vport_genl_ops[] = {
           .dumpit = ovs_vport_cmd_dump
         },
         { .cmd = OVS_VPORT_CMD_SET,
-          .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
+          .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
           .policy = vport_policy,
           .doit = ovs_vport_cmd_set,
         },
diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h
index 67bdecd9fdc1..427e39a045cf 100644
--- a/net/openvswitch/datapath.h
+++ b/net/openvswitch/datapath.h
@@ -68,6 +68,8 @@ struct dp_stats_percpu {
  * ovs_mutex and RCU.
  * @stats_percpu: Per-CPU datapath statistics.
  * @net: Reference to net namespace.
+ * @max_headroom: the maximum headroom of all vports in this datapath; it will
+ * be used by all the internal vports in this dp.
  *
  * Context: See the comment on locking at the top of datapath.c for additional
  * locking information.
@@ -89,6 +91,8 @@ struct datapath {
         possible_net_t net;
 
         u32 user_features;
+
+        u32 max_headroom;
 };
 
 /**
diff --git a/net/openvswitch/flow.h b/net/openvswitch/flow.h
index 1d055c559eaf..03378e75a67c 100644
--- a/net/openvswitch/flow.h
+++ b/net/openvswitch/flow.h
@@ -55,7 +55,7 @@ struct ovs_tunnel_info {
         FIELD_SIZEOF(struct sw_flow_key, recirc_id))
 
 struct sw_flow_key {
-        u8 tun_opts[255];
+        u8 tun_opts[IP_TUNNEL_OPTS_MAX];
         u8 tun_opts_len;
         struct ip_tunnel_key tun_key;   /* Encapsulating tunnel key. */
         struct {
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index d1bd4a45ca2d..689c17264221 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -1959,6 +1959,12 @@ static int validate_and_copy_set_tun(const struct nlattr *attr,
         if (!tun_dst)
                 return -ENOMEM;
 
+        err = dst_cache_init(&tun_dst->u.tun_info.dst_cache, GFP_KERNEL);
+        if (err) {
+                dst_release((struct dst_entry *)tun_dst);
+                return err;
+        }
+
         a = __add_action(sfa, OVS_KEY_ATTR_TUNNEL_INFO, NULL,
                          sizeof(*ovs_tun), log);
         if (IS_ERR(a)) {
@@ -2038,9 +2044,6 @@ static int validate_set(const struct nlattr *a,
                 break;
 
         case OVS_KEY_ATTR_TUNNEL:
-                if (eth_p_mpls(eth_type))
-                        return -EINVAL;
-
                 if (masked)
                         return -EINVAL; /* Masked tunnel set not supported. */
 
diff --git a/net/openvswitch/vport-geneve.c b/net/openvswitch/vport-geneve.c
index 30ab8e127288..1a1fcec88695 100644
--- a/net/openvswitch/vport-geneve.c
+++ b/net/openvswitch/vport-geneve.c
@@ -132,6 +132,6 @@ static void __exit ovs_geneve_tnl_exit(void)
 module_init(ovs_geneve_tnl_init);
 module_exit(ovs_geneve_tnl_exit);
 
-MODULE_DESCRIPTION("OVS: Geneve swiching port");
+MODULE_DESCRIPTION("OVS: Geneve switching port");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("vport-type-5");
diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
index ec76398a792f..7c8b90bf0e54 100644
--- a/net/openvswitch/vport-internal_dev.c
+++ b/net/openvswitch/vport-internal_dev.c
@@ -138,6 +138,11 @@ internal_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats)
         return stats;
 }
 
+static void internal_set_rx_headroom(struct net_device *dev, int new_hr)
+{
+        dev->needed_headroom = new_hr;
+}
+
 static const struct net_device_ops internal_dev_netdev_ops = {
         .ndo_open = internal_dev_open,
         .ndo_stop = internal_dev_stop,
@@ -145,6 +150,7 @@ static const struct net_device_ops internal_dev_netdev_ops = {
         .ndo_set_mac_address = eth_mac_addr,
         .ndo_change_mtu = internal_dev_change_mtu,
         .ndo_get_stats64 = internal_get_stats,
+        .ndo_set_rx_headroom = internal_set_rx_headroom,
 };
 
 static struct rtnl_link_ops internal_dev_link_ops __read_mostly = {
@@ -158,7 +164,8 @@ static void do_setup(struct net_device *netdev)
         netdev->netdev_ops = &internal_dev_netdev_ops;
 
         netdev->priv_flags &= ~IFF_TX_SKB_SHARING;
-        netdev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_OPENVSWITCH;
+        netdev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_OPENVSWITCH |
+                              IFF_PHONY_HEADROOM;
         netdev->destructor = internal_dev_destructor;
         netdev->ethtool_ops = &internal_dev_ethtool_ops;
         netdev->rtnl_link_ops = &internal_dev_link_ops;
@@ -199,6 +206,7 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
                 err = -ENOMEM;
                 goto error_free_netdev;
         }
+        vport->dev->needed_headroom = vport->dp->max_headroom;
 
         dev_net_set(vport->dev, ovs_dp_get_net(vport->dp));
         internal_dev = internal_dev_priv(vport->dev);
diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c
index 6a6adf314363..4e3972344aa6 100644
--- a/net/openvswitch/vport-netdev.c
+++ b/net/openvswitch/vport-netdev.c
@@ -58,7 +58,7 @@ static void netdev_port_receive(struct sk_buff *skb)
                 return;
 
         skb_push(skb, ETH_HLEN);
-        ovs_skb_postpush_rcsum(skb, skb->data, ETH_HLEN);
+        skb_postpush_rcsum(skb, skb->data, ETH_HLEN);
         ovs_vport_receive(vport, skb, skb_tunnel_info(skb));
         return;
 error:
diff --git a/net/openvswitch/vport-vxlan.c b/net/openvswitch/vport-vxlan.c
index de9cb19efb6a..5eb7694348b5 100644
--- a/net/openvswitch/vport-vxlan.c
+++ b/net/openvswitch/vport-vxlan.c
@@ -90,7 +90,7 @@ static struct vport *vxlan_tnl_create(const struct vport_parms *parms)
         int err;
         struct vxlan_config conf = {
                 .no_share = true,
-                .flags = VXLAN_F_COLLECT_METADATA,
+                .flags = VXLAN_F_COLLECT_METADATA | VXLAN_F_UDP_ZERO_CSUM6_RX,
                 /* Don't restrict the packets that can be sent by MTU */
                 .mtu = IP_MAX_MTU,
         };
diff --git a/net/openvswitch/vport.h b/net/openvswitch/vport.h
index c10899cb9040..f01f28a567ad 100644
--- a/net/openvswitch/vport.h
+++ b/net/openvswitch/vport.h
@@ -185,13 +185,6 @@ static inline struct vport *vport_from_priv(void *priv)
 int ovs_vport_receive(struct vport *, struct sk_buff *,
                       const struct ip_tunnel_info *);
 
-static inline void ovs_skb_postpush_rcsum(struct sk_buff *skb,
-                                      const void *start, unsigned int len)
-{
-        if (skb->ip_summed == CHECKSUM_COMPLETE)
-                skb->csum = csum_add(skb->csum, csum_partial(start, len, 0));
-}
-
 static inline const char *ovs_vport_name(struct vport *vport)
 {
         return vport->dev->name;