diff mbox series

[net-next,v3] net: openvswitch: IPv6: Add IPv6 extension header support

Message ID 20210903205332.707905-1-cpp.code.lv@gmail.com
State New
Headers show
Series [net-next,v3] net: openvswitch: IPv6: Add IPv6 extension header support | expand

Commit Message

Toms Atteka Sept. 3, 2021, 8:53 p.m. UTC
This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
packets can be filtered using ipv6_ext flag.

Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com>
---
 include/uapi/linux/openvswitch.h |  12 +++
 net/openvswitch/flow.c           | 139 +++++++++++++++++++++++++++++++
 net/openvswitch/flow.h           |  14 ++++
 net/openvswitch/flow_netlink.c   |  24 +++++-
 4 files changed, 188 insertions(+), 1 deletion(-)

Comments

Jakub Kicinski Sept. 3, 2021, 11:25 p.m. UTC | #1
On Fri,  3 Sep 2021 13:53:32 -0700 Toms Atteka wrote:
> This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
> packets can be filtered using ipv6_ext flag.
> 
> Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com>

net/openvswitch/flow.c:268:6: warning: no previous prototype for ‘get_ipv6_ext_hdrs’ [-Wmissing-prototypes]
  268 | void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh, u16 *ext_hdrs)
      |      ^~~~~~~~~~~~~~~~~
net/openvswitch/flow.c:268:6: warning: symbol 'get_ipv6_ext_hdrs' was not declared. Should it be static?
net/openvswitch/flow.c:243: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
 * Parses packet and sets IPv6 extension header flags.


Also please CC appropriate maintainers on your submissions
(scripts/get_maintainers is a good guide) and besides that:


# Form letter - net-next is closed

We have already sent the networking pull request for 5.15
and therefore net-next is closed for new drivers, features,
code refactoring and optimizations. We are currently accepting
bug fixes only.

Please repost when net-next reopens after 5.15-rc1 is cut.

Look out for the announcement on the mailing list or check:
http://vger.kernel.org/~davem/net-next.html

RFC patches sent for review only are obviously welcome at any time.
kernel test robot Sept. 4, 2021, 12:39 a.m. UTC | #2
Hi Toms,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on net-next/master]

url:    https://github.com/0day-ci/linux/commits/Toms-Atteka/net-openvswitch-IPv6-Add-IPv6-extension-header-support/20210904-045602
base:   https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 29ce8f9701072fc221d9c38ad952de1a9578f95c
config: m68k-randconfig-r023-20210904 (attached as .config)
compiler: m68k-linux-gcc (GCC) 11.2.0
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/dbd8852a931c7418829a31dcd51d8b2245f27f79
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Toms-Atteka/net-openvswitch-IPv6-Add-IPv6-extension-header-support/20210904-045602
        git checkout dbd8852a931c7418829a31dcd51d8b2245f27f79
        # save the attached .config to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross ARCH=m68k 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All warnings (new ones prefixed by >>):

>> net/openvswitch/flow.c:268:6: warning: no previous prototype for 'get_ipv6_ext_hdrs' [-Wmissing-prototypes]

     268 | void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh, u16 *ext_hdrs)
         |      ^~~~~~~~~~~~~~~~~


vim +/get_ipv6_ext_hdrs +268 net/openvswitch/flow.c

   241	
   242	/**
   243	 * Parses packet and sets IPv6 extension header flags.
   244	 *
   245	 * skb          buffer where extension header data starts in packet
   246	 * nh           ipv6 header
   247	 * ext_hdrs     flags are stored here
   248	 *
   249	 * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
   250	 * is unexpectedly encountered. (Two destination options headers may be
   251	 * expected and would not cause this bit to be set.)
   252	 *
   253	 * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
   254	 * preferred (but not required) by RFC 2460:
   255	 *
   256	 * When more than one extension header is used in the same packet, it is
   257	 * recommended that those headers appear in the following order:
   258	 *      IPv6 header
   259	 *      Hop-by-Hop Options header
   260	 *      Destination Options header
   261	 *      Routing header
   262	 *      Fragment header
   263	 *      Authentication header
   264	 *      Encapsulating Security Payload header
   265	 *      Destination Options header
   266	 *      upper-layer header
   267	 */
 > 268	void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh, u16 *ext_hdrs)

   269	{
   270		u8 next_type = nh->nexthdr;
   271		unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
   272		int dest_options_header_count = 0;
   273	
   274		*ext_hdrs = 0;
   275	
   276		while (ipv6_ext_hdr(next_type)) {
   277			struct ipv6_opt_hdr _hdr, *hp;
   278	
   279			switch (next_type) {
   280			case IPPROTO_NONE:
   281				*ext_hdrs |= OFPIEH12_NONEXT;
   282				/* stop parsing */
   283				return;
   284	
   285			case IPPROTO_ESP:
   286				if (*ext_hdrs & OFPIEH12_ESP)
   287					*ext_hdrs |= OFPIEH12_UNREP;
   288				if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
   289						   OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
   290						   OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
   291				    dest_options_header_count >= 2) {
   292					*ext_hdrs |= OFPIEH12_UNSEQ;
   293				}
   294				*ext_hdrs |= OFPIEH12_ESP;
   295				break;
   296	
   297			case IPPROTO_AH:
   298				if (*ext_hdrs & OFPIEH12_AUTH)
   299					*ext_hdrs |= OFPIEH12_UNREP;
   300				if ((*ext_hdrs &
   301				     ~(OFPIEH12_HOP | OFPIEH12_DEST | OFPIEH12_ROUTER |
   302				       IPPROTO_FRAGMENT | OFPIEH12_UNREP)) ||
   303				    dest_options_header_count >= 2) {
   304					*ext_hdrs |= OFPIEH12_UNSEQ;
   305				}
   306				*ext_hdrs |= OFPIEH12_AUTH;
   307				break;
   308	
   309			case IPPROTO_DSTOPTS:
   310				if (dest_options_header_count == 0) {
   311					if (*ext_hdrs &
   312					    ~(OFPIEH12_HOP | OFPIEH12_UNREP))
   313						*ext_hdrs |= OFPIEH12_UNSEQ;
   314					*ext_hdrs |= OFPIEH12_DEST;
   315				} else if (dest_options_header_count == 1) {
   316					if (*ext_hdrs &
   317					    ~(OFPIEH12_HOP | OFPIEH12_DEST |
   318					      OFPIEH12_ROUTER | OFPIEH12_FRAG |
   319					      OFPIEH12_AUTH | OFPIEH12_ESP |
   320					      OFPIEH12_UNREP)) {
   321						*ext_hdrs |= OFPIEH12_UNSEQ;
   322					}
   323				} else {
   324					*ext_hdrs |= OFPIEH12_UNREP;
   325				}
   326				dest_options_header_count++;
   327				break;
   328	
   329			case IPPROTO_FRAGMENT:
   330				if (*ext_hdrs & OFPIEH12_FRAG)
   331					*ext_hdrs |= OFPIEH12_UNREP;
   332				if ((*ext_hdrs & ~(OFPIEH12_HOP |
   333						   OFPIEH12_DEST |
   334						   OFPIEH12_ROUTER |
   335						   OFPIEH12_UNREP)) ||
   336				    dest_options_header_count >= 2) {
   337					*ext_hdrs |= OFPIEH12_UNSEQ;
   338				}
   339				*ext_hdrs |= OFPIEH12_FRAG;
   340				break;
   341	
   342			case IPPROTO_ROUTING:
   343				if (*ext_hdrs & OFPIEH12_ROUTER)
   344					*ext_hdrs |= OFPIEH12_UNREP;
   345				if ((*ext_hdrs & ~(OFPIEH12_HOP |
   346						   OFPIEH12_DEST |
   347						   OFPIEH12_UNREP)) ||
   348				    dest_options_header_count >= 2) {
   349					*ext_hdrs |= OFPIEH12_UNSEQ;
   350				}
   351				*ext_hdrs |= OFPIEH12_ROUTER;
   352				break;
   353	
   354			case IPPROTO_HOPOPTS:
   355				if (*ext_hdrs & OFPIEH12_HOP)
   356					*ext_hdrs |= OFPIEH12_UNREP;
   357				/* OFPIEH12_HOP is set to 1 if a hop-by-hop IPv6
   358				 * extension header is present as the first
   359				 * extension header in the packet.
   360				 */
   361				if (*ext_hdrs == 0)
   362					*ext_hdrs |= OFPIEH12_HOP;
   363				else
   364					*ext_hdrs |= OFPIEH12_UNSEQ;
   365				break;
   366	
   367			default:
   368				return;
   369			}
   370	
   371			hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
   372			if (!hp)
   373				break;
   374			next_type = hp->nexthdr;
   375			start += ipv6_optlen(hp);
   376		};
   377	}
   378	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
kernel test robot Sept. 4, 2021, 2:18 a.m. UTC | #3
Hi Toms,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on net-next/master]

url:    https://github.com/0day-ci/linux/commits/Toms-Atteka/net-openvswitch-IPv6-Add-IPv6-extension-header-support/20210904-045602
base:   https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 29ce8f9701072fc221d9c38ad952de1a9578f95c
config: i386-randconfig-a012-20210904 (attached as .config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 1104e3258b5064e7110cc297e2cec60ac9acfc0a)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/dbd8852a931c7418829a31dcd51d8b2245f27f79
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Toms-Atteka/net-openvswitch-IPv6-Add-IPv6-extension-header-support/20210904-045602
        git checkout dbd8852a931c7418829a31dcd51d8b2245f27f79
        # save the attached .config to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=i386 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All warnings (new ones prefixed by >>):

>> net/openvswitch/flow.c:268:6: warning: no previous prototype for function 'get_ipv6_ext_hdrs' [-Wmissing-prototypes]

   void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh, u16 *ext_hdrs)
        ^
   net/openvswitch/flow.c:268:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
   void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh, u16 *ext_hdrs)
   ^
   static 
   1 warning generated.


vim +/get_ipv6_ext_hdrs +268 net/openvswitch/flow.c

   241	
   242	/**
   243	 * Parses packet and sets IPv6 extension header flags.
   244	 *
   245	 * skb          buffer where extension header data starts in packet
   246	 * nh           ipv6 header
   247	 * ext_hdrs     flags are stored here
   248	 *
   249	 * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
   250	 * is unexpectedly encountered. (Two destination options headers may be
   251	 * expected and would not cause this bit to be set.)
   252	 *
   253	 * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
   254	 * preferred (but not required) by RFC 2460:
   255	 *
   256	 * When more than one extension header is used in the same packet, it is
   257	 * recommended that those headers appear in the following order:
   258	 *      IPv6 header
   259	 *      Hop-by-Hop Options header
   260	 *      Destination Options header
   261	 *      Routing header
   262	 *      Fragment header
   263	 *      Authentication header
   264	 *      Encapsulating Security Payload header
   265	 *      Destination Options header
   266	 *      upper-layer header
   267	 */
 > 268	void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh, u16 *ext_hdrs)

   269	{
   270		u8 next_type = nh->nexthdr;
   271		unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
   272		int dest_options_header_count = 0;
   273	
   274		*ext_hdrs = 0;
   275	
   276		while (ipv6_ext_hdr(next_type)) {
   277			struct ipv6_opt_hdr _hdr, *hp;
   278	
   279			switch (next_type) {
   280			case IPPROTO_NONE:
   281				*ext_hdrs |= OFPIEH12_NONEXT;
   282				/* stop parsing */
   283				return;
   284	
   285			case IPPROTO_ESP:
   286				if (*ext_hdrs & OFPIEH12_ESP)
   287					*ext_hdrs |= OFPIEH12_UNREP;
   288				if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
   289						   OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
   290						   OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
   291				    dest_options_header_count >= 2) {
   292					*ext_hdrs |= OFPIEH12_UNSEQ;
   293				}
   294				*ext_hdrs |= OFPIEH12_ESP;
   295				break;
   296	
   297			case IPPROTO_AH:
   298				if (*ext_hdrs & OFPIEH12_AUTH)
   299					*ext_hdrs |= OFPIEH12_UNREP;
   300				if ((*ext_hdrs &
   301				     ~(OFPIEH12_HOP | OFPIEH12_DEST | OFPIEH12_ROUTER |
   302				       IPPROTO_FRAGMENT | OFPIEH12_UNREP)) ||
   303				    dest_options_header_count >= 2) {
   304					*ext_hdrs |= OFPIEH12_UNSEQ;
   305				}
   306				*ext_hdrs |= OFPIEH12_AUTH;
   307				break;
   308	
   309			case IPPROTO_DSTOPTS:
   310				if (dest_options_header_count == 0) {
   311					if (*ext_hdrs &
   312					    ~(OFPIEH12_HOP | OFPIEH12_UNREP))
   313						*ext_hdrs |= OFPIEH12_UNSEQ;
   314					*ext_hdrs |= OFPIEH12_DEST;
   315				} else if (dest_options_header_count == 1) {
   316					if (*ext_hdrs &
   317					    ~(OFPIEH12_HOP | OFPIEH12_DEST |
   318					      OFPIEH12_ROUTER | OFPIEH12_FRAG |
   319					      OFPIEH12_AUTH | OFPIEH12_ESP |
   320					      OFPIEH12_UNREP)) {
   321						*ext_hdrs |= OFPIEH12_UNSEQ;
   322					}
   323				} else {
   324					*ext_hdrs |= OFPIEH12_UNREP;
   325				}
   326				dest_options_header_count++;
   327				break;
   328	
   329			case IPPROTO_FRAGMENT:
   330				if (*ext_hdrs & OFPIEH12_FRAG)
   331					*ext_hdrs |= OFPIEH12_UNREP;
   332				if ((*ext_hdrs & ~(OFPIEH12_HOP |
   333						   OFPIEH12_DEST |
   334						   OFPIEH12_ROUTER |
   335						   OFPIEH12_UNREP)) ||
   336				    dest_options_header_count >= 2) {
   337					*ext_hdrs |= OFPIEH12_UNSEQ;
   338				}
   339				*ext_hdrs |= OFPIEH12_FRAG;
   340				break;
   341	
   342			case IPPROTO_ROUTING:
   343				if (*ext_hdrs & OFPIEH12_ROUTER)
   344					*ext_hdrs |= OFPIEH12_UNREP;
   345				if ((*ext_hdrs & ~(OFPIEH12_HOP |
   346						   OFPIEH12_DEST |
   347						   OFPIEH12_UNREP)) ||
   348				    dest_options_header_count >= 2) {
   349					*ext_hdrs |= OFPIEH12_UNSEQ;
   350				}
   351				*ext_hdrs |= OFPIEH12_ROUTER;
   352				break;
   353	
   354			case IPPROTO_HOPOPTS:
   355				if (*ext_hdrs & OFPIEH12_HOP)
   356					*ext_hdrs |= OFPIEH12_UNREP;
   357				/* OFPIEH12_HOP is set to 1 if a hop-by-hop IPv6
   358				 * extension header is present as the first
   359				 * extension header in the packet.
   360				 */
   361				if (*ext_hdrs == 0)
   362					*ext_hdrs |= OFPIEH12_HOP;
   363				else
   364					*ext_hdrs |= OFPIEH12_UNSEQ;
   365				break;
   366	
   367			default:
   368				return;
   369			}
   370	
   371			hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
   372			if (!hp)
   373				break;
   374			next_type = hp->nexthdr;
   375			start += ipv6_optlen(hp);
   376		};
   377	}
   378	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
kernel test robot Sept. 4, 2021, 12:35 p.m. UTC | #4
Hi Toms,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on net-next/master]

url:    https://github.com/0day-ci/linux/commits/Toms-Atteka/net-openvswitch-IPv6-Add-IPv6-extension-header-support/20210904-045602
base:   https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 29ce8f9701072fc221d9c38ad952de1a9578f95c
config: x86_64-rhel-8.3-kselftests (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
reproduce:
        # apt-get install sparse
        # sparse version: v0.6.4-rc1-dirty
        # https://github.com/0day-ci/linux/commit/dbd8852a931c7418829a31dcd51d8b2245f27f79
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Toms-Atteka/net-openvswitch-IPv6-Add-IPv6-extension-header-support/20210904-045602
        git checkout dbd8852a931c7418829a31dcd51d8b2245f27f79
        # save the attached .config to linux build tree
        make W=1 C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__' O=build_dir ARCH=x86_64 SHELL=/bin/bash

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>


sparse warnings: (new ones prefixed by >>)
>> net/openvswitch/flow.c:268:6: sparse: sparse: symbol 'get_ipv6_ext_hdrs' was not declared. Should it be static?


Please review and possibly fold the followup patch.

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
diff mbox series

Patch

diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index a87b44cd5590..dc6eb5f6399f 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -346,6 +346,13 @@  enum ovs_key_attr {
 #ifdef __KERNEL__
 	OVS_KEY_ATTR_TUNNEL_INFO,  /* struct ip_tunnel_info */
 #endif
+
+#ifndef __KERNEL__
+	PADDING,  /* Padding so kernel and non kernel field count would match */
+#endif
+
+	OVS_KEY_ATTR_IPV6_EXTHDRS,  /* struct ovs_key_ipv6_exthdr */
+
 	__OVS_KEY_ATTR_MAX
 };
 
@@ -421,6 +428,11 @@  struct ovs_key_ipv6 {
 	__u8   ipv6_frag;	/* One of OVS_FRAG_TYPE_*. */
 };
 
+/* separate structure to support backward compatibility with older user space */
+struct ovs_key_ipv6_exthdrs {
+	__u16  hdrs;
+};
+
 struct ovs_key_tcp {
 	__be16 tcp_src;
 	__be16 tcp_dst;
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 9d375e74b607..8bad54521343 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -239,6 +239,143 @@  static bool icmphdr_ok(struct sk_buff *skb)
 				  sizeof(struct icmphdr));
 }
 
+/**
+ * Parses packet and sets IPv6 extension header flags.
+ *
+ * skb          buffer where extension header data starts in packet
+ * nh           ipv6 header
+ * ext_hdrs     flags are stored here
+ *
+ * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
+ * is unexpectedly encountered. (Two destination options headers may be
+ * expected and would not cause this bit to be set.)
+ *
+ * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
+ * preferred (but not required) by RFC 2460:
+ *
+ * When more than one extension header is used in the same packet, it is
+ * recommended that those headers appear in the following order:
+ *      IPv6 header
+ *      Hop-by-Hop Options header
+ *      Destination Options header
+ *      Routing header
+ *      Fragment header
+ *      Authentication header
+ *      Encapsulating Security Payload header
+ *      Destination Options header
+ *      upper-layer header
+ */
+void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh, u16 *ext_hdrs)
+{
+	u8 next_type = nh->nexthdr;
+	unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
+	int dest_options_header_count = 0;
+
+	*ext_hdrs = 0;
+
+	while (ipv6_ext_hdr(next_type)) {
+		struct ipv6_opt_hdr _hdr, *hp;
+
+		switch (next_type) {
+		case IPPROTO_NONE:
+			*ext_hdrs |= OFPIEH12_NONEXT;
+			/* stop parsing */
+			return;
+
+		case IPPROTO_ESP:
+			if (*ext_hdrs & OFPIEH12_ESP)
+				*ext_hdrs |= OFPIEH12_UNREP;
+			if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
+					   OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
+					   OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
+			    dest_options_header_count >= 2) {
+				*ext_hdrs |= OFPIEH12_UNSEQ;
+			}
+			*ext_hdrs |= OFPIEH12_ESP;
+			break;
+
+		case IPPROTO_AH:
+			if (*ext_hdrs & OFPIEH12_AUTH)
+				*ext_hdrs |= OFPIEH12_UNREP;
+			if ((*ext_hdrs &
+			     ~(OFPIEH12_HOP | OFPIEH12_DEST | OFPIEH12_ROUTER |
+			       IPPROTO_FRAGMENT | OFPIEH12_UNREP)) ||
+			    dest_options_header_count >= 2) {
+				*ext_hdrs |= OFPIEH12_UNSEQ;
+			}
+			*ext_hdrs |= OFPIEH12_AUTH;
+			break;
+
+		case IPPROTO_DSTOPTS:
+			if (dest_options_header_count == 0) {
+				if (*ext_hdrs &
+				    ~(OFPIEH12_HOP | OFPIEH12_UNREP))
+					*ext_hdrs |= OFPIEH12_UNSEQ;
+				*ext_hdrs |= OFPIEH12_DEST;
+			} else if (dest_options_header_count == 1) {
+				if (*ext_hdrs &
+				    ~(OFPIEH12_HOP | OFPIEH12_DEST |
+				      OFPIEH12_ROUTER | OFPIEH12_FRAG |
+				      OFPIEH12_AUTH | OFPIEH12_ESP |
+				      OFPIEH12_UNREP)) {
+					*ext_hdrs |= OFPIEH12_UNSEQ;
+				}
+			} else {
+				*ext_hdrs |= OFPIEH12_UNREP;
+			}
+			dest_options_header_count++;
+			break;
+
+		case IPPROTO_FRAGMENT:
+			if (*ext_hdrs & OFPIEH12_FRAG)
+				*ext_hdrs |= OFPIEH12_UNREP;
+			if ((*ext_hdrs & ~(OFPIEH12_HOP |
+					   OFPIEH12_DEST |
+					   OFPIEH12_ROUTER |
+					   OFPIEH12_UNREP)) ||
+			    dest_options_header_count >= 2) {
+				*ext_hdrs |= OFPIEH12_UNSEQ;
+			}
+			*ext_hdrs |= OFPIEH12_FRAG;
+			break;
+
+		case IPPROTO_ROUTING:
+			if (*ext_hdrs & OFPIEH12_ROUTER)
+				*ext_hdrs |= OFPIEH12_UNREP;
+			if ((*ext_hdrs & ~(OFPIEH12_HOP |
+					   OFPIEH12_DEST |
+					   OFPIEH12_UNREP)) ||
+			    dest_options_header_count >= 2) {
+				*ext_hdrs |= OFPIEH12_UNSEQ;
+			}
+			*ext_hdrs |= OFPIEH12_ROUTER;
+			break;
+
+		case IPPROTO_HOPOPTS:
+			if (*ext_hdrs & OFPIEH12_HOP)
+				*ext_hdrs |= OFPIEH12_UNREP;
+			/* OFPIEH12_HOP is set to 1 if a hop-by-hop IPv6
+			 * extension header is present as the first
+			 * extension header in the packet.
+			 */
+			if (*ext_hdrs == 0)
+				*ext_hdrs |= OFPIEH12_HOP;
+			else
+				*ext_hdrs |= OFPIEH12_UNSEQ;
+			break;
+
+		default:
+			return;
+		}
+
+		hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
+		if (!hp)
+			break;
+		next_type = hp->nexthdr;
+		start += ipv6_optlen(hp);
+	};
+}
+
 static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key)
 {
 	unsigned short frag_off;
@@ -254,6 +391,8 @@  static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key)
 
 	nh = ipv6_hdr(skb);
 
+	get_ipv6_ext_hdrs(skb, nh, &key->ipv6.exthdrs);
+
 	key->ip.proto = NEXTHDR_NONE;
 	key->ip.tos = ipv6_get_dsfield(nh);
 	key->ip.ttl = nh->hop_limit;
diff --git a/net/openvswitch/flow.h b/net/openvswitch/flow.h
index 758a8c77f736..073ab73ffeaa 100644
--- a/net/openvswitch/flow.h
+++ b/net/openvswitch/flow.h
@@ -32,6 +32,19 @@  enum sw_flow_mac_proto {
 #define SW_FLOW_KEY_INVALID	0x80
 #define MPLS_LABEL_DEPTH       3
 
+/* Bit definitions for IPv6 Extension Header pseudo-field. */
+enum ofp12_ipv6exthdr_flags {
+	OFPIEH12_NONEXT = 1 << 0,   /* "No next header" encountered. */
+	OFPIEH12_ESP    = 1 << 1,   /* Encrypted Sec Payload header present. */
+	OFPIEH12_AUTH   = 1 << 2,   /* Authentication header present. */
+	OFPIEH12_DEST   = 1 << 3,   /* 1 or 2 dest headers present. */
+	OFPIEH12_FRAG   = 1 << 4,   /* Fragment header present. */
+	OFPIEH12_ROUTER = 1 << 5,   /* Router header present. */
+	OFPIEH12_HOP    = 1 << 6,   /* Hop-by-hop header present. */
+	OFPIEH12_UNREP  = 1 << 7,   /* Unexpected repeats encountered. */
+	OFPIEH12_UNSEQ  = 1 << 8    /* Unexpected sequencing encountered. */
+};
+
 /* Store options at the end of the array if they are less than the
  * maximum size. This allows us to get the benefits of variable length
  * matching for small options.
@@ -121,6 +134,7 @@  struct sw_flow_key {
 				struct in6_addr dst;	/* IPv6 destination address. */
 			} addr;
 			__be32 label;			/* IPv6 flow label. */
+			u16 exthdrs;	/* IPv6 extension header flags */
 			union {
 				struct {
 					struct in6_addr src;
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 65c2e3458ff5..2fbf324fcfff 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -367,7 +367,8 @@  size_t ovs_key_attr_size(void)
 		+ nla_total_size(2)   /* OVS_KEY_ATTR_ETHERTYPE */
 		+ nla_total_size(40)  /* OVS_KEY_ATTR_IPV6 */
 		+ nla_total_size(2)   /* OVS_KEY_ATTR_ICMPV6 */
-		+ nla_total_size(28); /* OVS_KEY_ATTR_ND */
+		+ nla_total_size(28)  /* OVS_KEY_ATTR_ND */
+		+ nla_total_size(2);  /* OVS_KEY_ATTR_IPV6_EXTHDRS */
 }
 
 static const struct ovs_len_tbl ovs_vxlan_ext_key_lens[OVS_VXLAN_EXT_MAX + 1] = {
@@ -435,6 +436,8 @@  static const struct ovs_len_tbl ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = {
 		.len = sizeof(struct ovs_key_ct_tuple_ipv6) },
 	[OVS_KEY_ATTR_NSH]       = { .len = OVS_ATTR_NESTED,
 				     .next = ovs_nsh_key_attr_lens, },
+	[OVS_KEY_ATTR_IPV6_EXTHDRS] = {
+		.len = sizeof(struct ovs_key_ipv6_exthdrs) },
 };
 
 static bool check_attr_len(unsigned int attr_len, unsigned int expected_len)
@@ -1595,6 +1598,17 @@  static int ovs_key_from_nlattrs(struct net *net, struct sw_flow_match *match,
 		attrs &= ~(1 << OVS_KEY_ATTR_IPV6);
 	}
 
+	if (attrs & (1ULL << OVS_KEY_ATTR_IPV6_EXTHDRS)) {
+		const struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key;
+
+		ipv6_exthdrs_key = nla_data(a[OVS_KEY_ATTR_IPV6_EXTHDRS]);
+
+		SW_FLOW_KEY_PUT(match, ipv6.exthdrs,
+				ipv6_exthdrs_key->hdrs, is_mask);
+
+		attrs &= ~(1ULL << OVS_KEY_ATTR_IPV6_EXTHDRS);
+	}
+
 	if (attrs & (1 << OVS_KEY_ATTR_ARP)) {
 		const struct ovs_key_arp *arp_key;
 
@@ -2097,6 +2111,7 @@  static int __ovs_nla_put_key(const struct sw_flow_key *swkey,
 		ipv4_key->ipv4_frag = output->ip.frag;
 	} else if (swkey->eth.type == htons(ETH_P_IPV6)) {
 		struct ovs_key_ipv6 *ipv6_key;
+		struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key;
 
 		nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6, sizeof(*ipv6_key));
 		if (!nla)
@@ -2111,6 +2126,13 @@  static int __ovs_nla_put_key(const struct sw_flow_key *swkey,
 		ipv6_key->ipv6_tclass = output->ip.tos;
 		ipv6_key->ipv6_hlimit = output->ip.ttl;
 		ipv6_key->ipv6_frag = output->ip.frag;
+
+		nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6_EXTHDRS,
+				  sizeof(*ipv6_exthdrs_key));
+		if (!nla)
+			goto nla_put_failure;
+		ipv6_exthdrs_key = nla_data(nla);
+		ipv6_exthdrs_key->hdrs = output->ipv6.exthdrs;
 	} else if (swkey->eth.type == htons(ETH_P_NSH)) {
 		if (nsh_key_to_nlattr(&output->nsh, is_mask, skb))
 			goto nla_put_failure;