]> git.proxmox.com Git - mirror_ovs.git/blobdiff - utilities/ovs-ofctl.c
ovs-ofctl: Free leaked minimatch
[mirror_ovs.git] / utilities / ovs-ofctl.c
index 6fbf361f3c81b0548f781bf40e9b8746a7e5fd89..06289d29657338b8856be8c11fab097f57f2a2e1 100644 (file)
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016 Nicira, Inc.
+ * Copyright (c) 2008-2017, 2019 Nicira, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
 #include "colors.h"
 #include "compiler.h"
 #include "dirs.h"
-#include "openvswitch/dynamic-string.h"
+#include "dp-packet.h"
 #include "fatal-signal.h"
 #include "nx-match.h"
 #include "odp-util.h"
-#include "ofp-actions.h"
-#include "ofp-msgs.h"
-#include "ofp-print.h"
-#include "ofp-util.h"
 #include "ofp-version-opt.h"
-#include "openvswitch/ofpbuf.h"
 #include "ofproto/ofproto.h"
 #include "openflow/nicira-ext.h"
 #include "openflow/openflow.h"
-#include "dp-packet.h"
+#include "openvswitch/dynamic-string.h"
+#include "openvswitch/meta-flow.h"
+#include "openvswitch/ofp-actions.h"
+#include "openvswitch/ofp-bundle.h"
+#include "openvswitch/ofp-errors.h"
+#include "openvswitch/ofp-group.h"
+#include "openvswitch/ofp-match.h"
+#include "openvswitch/ofp-meter.h"
+#include "openvswitch/ofp-msgs.h"
+#include "openvswitch/ofp-monitor.h"
+#include "openvswitch/ofp-port.h"
+#include "openvswitch/ofp-print.h"
+#include "openvswitch/ofp-util.h"
+#include "openvswitch/ofp-parse.h"
+#include "openvswitch/ofp-queue.h"
+#include "openvswitch/ofp-switch.h"
+#include "openvswitch/ofp-table.h"
+#include "openvswitch/ofpbuf.h"
+#include "openvswitch/shash.h"
+#include "openvswitch/vconn.h"
+#include "openvswitch/vlog.h"
 #include "packets.h"
 #include "pcap-file.h"
-#include "poll-loop.h"
+#include "openvswitch/poll-loop.h"
 #include "random.h"
+#include "sort.h"
 #include "stream-ssl.h"
 #include "socket-util.h"
 #include "timeval.h"
 #include "unixctl.h"
 #include "util.h"
-#include "openvswitch/ofp-errors.h"
-#include "openvswitch/ofp-parse.h"
-#include "openvswitch/vconn.h"
-#include "openvswitch/vlog.h"
-#include "meta-flow.h"
-#include "sort.h"
 
 VLOG_DEFINE_THIS_MODULE(ofctl);
 
@@ -79,11 +89,18 @@ static bool bundle = false;
 /* --color: Use color markers. */
 static bool enable_color;
 
+/* --read-only: Do not execute read only commands. */
+static bool read_only;
+
 /* --strict: Use strict matching for flow mod commands?  Additionally governs
  * use of nx_pull_match() instead of nx_pull_match_loose() in parse-nx-match.
  */
 static bool strict;
 
+/* --may-create: If true, the mod-group command creates a group that does not
+ * yet exist; otherwise, such a command has no effect. */
+static bool may_create;
+
 /* --readd: If true, on replace-flows, re-add even flows that have not changed
  * (to reset flow counters). */
 static bool readd;
@@ -117,15 +134,33 @@ struct sort_criterion {
 static struct sort_criterion *criteria;
 static size_t n_criteria, allocated_criteria;
 
+/* --names, --no-names: Show port and table names in output and accept them in
+ * input.  (When neither is specified, the default is to accept port names but,
+ * for backward compatibility, not to show them unless this is an interactive
+ * console session.)  */
+static int use_names = -1;
+static const struct ofputil_port_map *ports_to_accept(const char *vconn_name);
+static const struct ofputil_port_map *ports_to_show(const char *vconn_name);
+static const struct ofputil_table_map *tables_to_accept(
+    const char *vconn_name);
+static const struct ofputil_table_map *tables_to_show(const char *vconn_name);
+static bool should_accept_names(void);
+static bool should_show_names(void);
+
+/* --stats, --no-stats: Show statistics in flow dumps? */
+static int show_stats = 1;
+
+/* --pcap: Makes "compose-packet" print a pcap on stdout. */
+static int print_pcap = 0;
+
+/* --raw: Makes "ofp-print" read binary data from stdin. */
+static int raw = 0;
+
 static const struct ovs_cmdl_command *get_all_commands(void);
 
 OVS_NO_RETURN static void usage(void);
 static void parse_options(int argc, char *argv[]);
 
-static bool recv_flow_stats_reply(struct vconn *, ovs_be32 send_xid,
-                                  struct ofpbuf **replyp,
-                                  struct ofputil_flow_stats *,
-                                  struct ofpbuf *ofpacts);
 int
 main(int argc, char *argv[])
 {
@@ -138,7 +173,11 @@ main(int argc, char *argv[])
     ctx.argv = argv + optind;
 
     daemon_become_new_user(false);
-    ovs_cmdl_run_command(&ctx, get_all_commands());
+    if (read_only) {
+        ovs_cmdl_run_command_read_only(&ctx, get_all_commands());
+    } else {
+        ovs_cmdl_run_command(&ctx, get_all_commands());
+    }
     return 0;
 }
 
@@ -175,9 +214,12 @@ parse_options(int argc, char *argv[])
         OPT_UNIXCTL,
         OPT_BUNDLE,
         OPT_COLOR,
+        OPT_MAY_CREATE,
+        OPT_READ_ONLY,
         DAEMON_OPTION_ENUMS,
         OFP_VERSION_OPTION_ENUMS,
-        VLOG_OPTION_ENUMS
+        VLOG_OPTION_ENUMS,
+        SSL_OPTION_ENUMS,
     };
     static const struct option long_options[] = {
         {"timeout", required_argument, NULL, 't'},
@@ -189,11 +231,19 @@ parse_options(int argc, char *argv[])
         {"timestamp", no_argument, NULL, OPT_TIMESTAMP},
         {"sort", optional_argument, NULL, OPT_SORT},
         {"rsort", optional_argument, NULL, OPT_RSORT},
+        {"names", no_argument, &use_names, 1},
+        {"no-names", no_argument, &use_names, 0},
+        {"stats", no_argument, &show_stats, 1},
+        {"no-stats", no_argument, &show_stats, 0},
         {"unixctl",     required_argument, NULL, OPT_UNIXCTL},
         {"help", no_argument, NULL, 'h'},
         {"option", no_argument, NULL, 'o'},
         {"bundle", no_argument, NULL, OPT_BUNDLE},
         {"color", optional_argument, NULL, OPT_COLOR},
+        {"may-create", no_argument, NULL, OPT_MAY_CREATE},
+        {"pcap", no_argument, &print_pcap, 1},
+        {"raw", no_argument, &raw, 1},
+        {"read-only", no_argument, NULL, OPT_READ_ONLY},
         DAEMON_LONG_OPTIONS,
         OFP_VERSION_LONG_OPTIONS,
         VLOG_LONG_OPTIONS,
@@ -203,6 +253,7 @@ parse_options(int argc, char *argv[])
     char *short_options = ovs_cmdl_long_options_to_short_options(long_options);
     uint32_t versions;
     enum ofputil_protocol version_protocols;
+    unsigned int timeout = 0;
 
     /* For now, ovs-ofctl only enables OpenFlow 1.0 by default.  This is
      * because ovs-ofctl implements command such as "add-flow" as raw OpenFlow
@@ -222,7 +273,6 @@ parse_options(int argc, char *argv[])
     set_allowed_ofp_versions("OpenFlow10");
 
     for (;;) {
-        unsigned long int timeout;
         int c;
 
         c = getopt_long(argc, argv, short_options, long_options, NULL);
@@ -232,12 +282,8 @@ parse_options(int argc, char *argv[])
 
         switch (c) {
         case 't':
-            timeout = strtoul(optarg, NULL, 10);
-            if (timeout <= 0) {
-                ovs_fatal(0, "value %s on -t or --timeout is not at least 1",
-                          optarg);
-            } else {
-                time_alarm(timeout);
+            if (!str_to_uint(optarg, 10, &timeout) || !timeout) {
+                ovs_fatal(0, "value %s on -t or --timeout is invalid", optarg);
             }
             break;
 
@@ -275,6 +321,10 @@ parse_options(int argc, char *argv[])
             strict = true;
             break;
 
+        case OPT_READ_ONLY:
+            read_only = true;
+            break;
+
         case OPT_READD:
             readd = true;
             break;
@@ -319,6 +369,10 @@ parse_options(int argc, char *argv[])
             }
         break;
 
+        case OPT_MAY_CREATE:
+            may_create = true;
+            break;
+
         DAEMON_OPTION_HANDLERS
         OFP_VERSION_OPTION_HANDLERS
         VLOG_OPTION_HANDLERS
@@ -327,11 +381,16 @@ parse_options(int argc, char *argv[])
         case '?':
             exit(EXIT_FAILURE);
 
+        case 0:
+            break;
+
         default:
             abort();
         }
     }
 
+    ctl_timeout_setup(timeout);
+
     if (n_criteria) {
         /* Always do a final sort pass based on priority. */
         add_sort_criterion(SORT_DESC, "priority");
@@ -406,7 +465,7 @@ usage(void)
            "  snoop SWITCH                snoop on SWITCH and its controller\n"
            "  add-group SWITCH GROUP      add group described by GROUP\n"
            "  add-groups SWITCH FILE      add group from FILE\n"
-           "  mod-group SWITCH GROUP      modify specific group\n"
+           "  [--may-create] mod-group SWITCH GROUP   modify specific group\n"
            "  del-groups SWITCH [GROUP]   delete matching GROUPs\n"
            "  insert-buckets SWITCH [GROUP] add buckets to GROUP\n"
            "  remove-buckets SWITCH [GROUP] remove buckets from GROUP\n"
@@ -416,15 +475,16 @@ usage(void)
            "  queue-get-config SWITCH [PORT]  print queue config for PORT\n"
            "  add-meter SWITCH METER      add meter described by METER\n"
            "  mod-meter SWITCH METER      modify specific METER\n"
-           "  del-meter SWITCH METER      delete METER\n"
-           "  del-meters SWITCH           delete all meters\n"
-           "  dump-meter SWITCH METER     print METER configuration\n"
-           "  dump-meters SWITCH          print all meter configuration\n"
+           "  del-meters SWITCH [METER]   delete meters matching METER\n"
+           "  dump-meters SWITCH [METER]  print METER configuration\n"
            "  meter-stats SWITCH [METER]  print meter statistics\n"
            "  meter-features SWITCH       print meter features\n"
            "  add-tlv-map SWITCH MAP      add TLV option MAPpings\n"
            "  del-tlv-map SWITCH [MAP] delete TLV option MAPpings\n"
            "  dump-tlv-map SWITCH      print TLV option mappings\n"
+           "  dump-ipfix-bridge SWITCH    print ipfix stats of bridge\n"
+           "  dump-ipfix-flow SWITCH      print flow ipfix of a bridge\n"
+           "  ct-flush-zone SWITCH ZONE   flush conntrack entries in ZONE\n"
            "\nFor OpenFlow switches and controllers:\n"
            "  probe TARGET                probe whether TARGET is up\n"
            "  ping TARGET [N]             latency of N-byte echos\n"
@@ -440,6 +500,7 @@ usage(void)
     vlog_usage();
     printf("\nOther options:\n"
            "  --strict                    use strict match for flow commands\n"
+           "  --read-only                 do not execute read/write commands\n"
            "  --readd                     replace flows that haven't changed\n"
            "  -F, --flow-format=FORMAT    force particular flow format\n"
            "  -P, --packet-in-format=FRMT force particular packet in format\n"
@@ -448,6 +509,8 @@ usage(void)
            "  -t, --timeout=SECS          give up after SECS seconds\n"
            "  --sort[=field]              sort in ascending order\n"
            "  --rsort[=field]             sort in descending order\n"
+           "  --names                     show port names instead of numbers\n"
+           "  --no-names                  show port numbers, but not names\n"
            "  --unixctl=SOCKET            set control socket name\n"
            "  --color[=always|never|auto] control use of color in output\n"
            "  -h, --help                  display this help message\n"
@@ -538,7 +601,7 @@ open_vconn__(const char *name, enum open_target target,
     free(socket_name);
 
     VLOG_DBG("connecting to %s", vconn_get_name(*vconnp));
-    error = vconn_connect_block(*vconnp);
+    error = vconn_connect_block(*vconnp, -1);
     if (error) {
         ovs_fatal(0, "%s: failed to connect to socket (%s)", name,
                   ovs_strerror(error));
@@ -587,19 +650,25 @@ dump_transaction(struct vconn *vconn, struct ofpbuf *request)
                 "OpenFlow packet receive failed");
             recv_xid = ((struct ofp_header *) reply->data)->xid;
             if (send_xid == recv_xid) {
-                enum ofpraw raw;
+                enum ofpraw ofpraw;
 
-                ofp_print(stdout, reply->data, reply->size, verbosity + 1);
+                ofp_print(stdout, reply->data, reply->size,
+                          ports_to_show(vconn_get_name(vconn)),
+                          tables_to_show(vconn_get_name(vconn)),
+                          verbosity + 1);
 
-                ofpraw_decode(&raw, reply->data);
-                if (ofptype_from_ofpraw(raw) == OFPTYPE_ERROR) {
+                ofpraw_decode(&ofpraw, reply->data);
+                if (ofptype_from_ofpraw(ofpraw) == OFPTYPE_ERROR) {
                     done = true;
-                } else if (raw == reply_raw) {
+                } else if (ofpraw == reply_raw) {
                     done = !ofpmp_more(reply->data);
                 } else {
                     ovs_fatal(0, "received bad reply: %s",
-                              ofp_to_string(reply->data, reply->size,
-                                            verbosity + 1));
+                              ofp_to_string(
+                                  reply->data, reply->size,
+                                  ports_to_show(vconn_get_name(vconn)),
+                                  tables_to_show(vconn_get_name(vconn)),
+                                  verbosity + 1));
                 }
             } else {
                 VLOG_DBG("received reply with xid %08"PRIx32" "
@@ -612,19 +681,22 @@ dump_transaction(struct vconn *vconn, struct ofpbuf *request)
 
         run(vconn_transact(vconn, request, &reply), "talking to %s",
             vconn_get_name(vconn));
-        ofp_print(stdout, reply->data, reply->size, verbosity + 1);
+        ofp_print(stdout, reply->data, reply->size,
+                  ports_to_show(vconn_get_name(vconn)),
+                  tables_to_show(vconn_get_name(vconn)),
+                  verbosity + 1);
         ofpbuf_delete(reply);
     }
 }
 
 static void
-dump_trivial_transaction(const char *vconn_name, enum ofpraw raw)
+dump_trivial_transaction(const char *vconn_name, enum ofpraw ofpraw)
 {
     struct ofpbuf *request;
     struct vconn *vconn;
 
     open_vconn(vconn_name, &vconn);
-    request = ofpraw_alloc(raw, vconn_get_version(vconn), 0);
+    request = ofpraw_alloc(ofpraw, vconn_get_version(vconn), 0);
     dump_transaction(vconn, request);
     vconn_close(vconn);
 }
@@ -642,24 +714,74 @@ transact_multiple_noreply(struct vconn *vconn, struct ovs_list *requests)
     run(vconn_transact_multiple_noreply(vconn, requests, &reply),
         "talking to %s", vconn_get_name(vconn));
     if (reply) {
-        ofp_print(stderr, reply->data, reply->size, verbosity + 2);
+        ofp_print(stderr, reply->data, reply->size,
+                  ports_to_show(vconn_get_name(vconn)),
+                  tables_to_show(vconn_get_name(vconn)),
+                  verbosity + 2);
         exit(1);
     }
     ofpbuf_delete(reply);
 }
 
+/* Frees the error messages as they are printed. */
 static void
-bundle_error_reporter(const struct ofp_header *oh)
+bundle_print_errors(struct ovs_list *errors, struct ovs_list *requests,
+                    const char *vconn_name)
 {
-    ofp_print(stderr, oh, ntohs(oh->length), verbosity + 1);
+    struct ofpbuf *error, *next;
+    struct ofpbuf *bmsg;
+
+    INIT_CONTAINER(bmsg, requests, list_node);
+
+    LIST_FOR_EACH_SAFE (error, next, list_node, errors) {
+        const struct ofp_header *error_oh = error->data;
+        ovs_be32 error_xid = error_oh->xid;
+        enum ofperr ofperr;
+        struct ofpbuf payload;
+
+        ofperr = ofperr_decode_msg(error_oh, &payload);
+        if (!ofperr) {
+            fprintf(stderr, "***decode error***");
+        } else {
+            /* Default to the likely truncated message. */
+            const struct ofp_header *ofp_msg = payload.data;
+            size_t msg_len = payload.size;
+
+            /* Find the failing message from the requests list to be able to
+             * dump the whole message.  We assume the errors are returned in
+             * the same order as in which the messages are sent to get O(n)
+             * rather than O(n^2) processing here.  If this heuristics fails we
+             * may print the truncated hexdumps instead. */
+            LIST_FOR_EACH_CONTINUE (bmsg, list_node, requests) {
+                const struct ofp_header *oh = bmsg->data;
+
+                if (oh->xid == error_xid) {
+                    ofp_msg = oh;
+                    msg_len = bmsg->size;
+                    break;
+                }
+            }
+            fprintf(stderr, "Error %s for: ", ofperr_get_name(ofperr));
+            ofp_print(stderr, ofp_msg, msg_len, ports_to_show(vconn_name),
+                      tables_to_show(vconn_name), verbosity + 1);
+        }
+        ofpbuf_uninit(&payload);
+        ofpbuf_delete(error);
+    }
     fflush(stderr);
 }
 
 static void
 bundle_transact(struct vconn *vconn, struct ovs_list *requests, uint16_t flags)
 {
-    run(vconn_bundle_transact(vconn, requests, flags, bundle_error_reporter),
-        "talking to %s", vconn_get_name(vconn));
+    struct ovs_list errors;
+    int retval = vconn_bundle_transact(vconn, requests, flags, &errors);
+
+    bundle_print_errors(&errors, requests, vconn_get_name(vconn));
+
+    if (retval) {
+        ovs_fatal(retval, "talking to %s", vconn_get_name(vconn));
+    }
 }
 
 /* Sends 'request', which should be a request that only has a reply if an error
@@ -721,7 +843,7 @@ ofctl_show(struct ovs_cmdl_context *ctx)
     run(vconn_transact(vconn, request, &reply), "talking to %s", vconn_name);
 
     has_ports = ofputil_switch_features_has_ports(reply);
-    ofp_print(stdout, reply->data, reply->size, verbosity + 1);
+    ofp_print(stdout, reply->data, reply->size, NULL, NULL, verbosity + 1);
     ofpbuf_delete(reply);
 
     if (!has_ports) {
@@ -766,6 +888,8 @@ ofctl_dump_table_features(struct ovs_cmdl_context *ctx)
     bool done = false;
 
     struct ofputil_table_features prev;
+    int first_ditto = -1, last_ditto = -1;
+    struct ds s = DS_EMPTY_INITIALIZER;
     int n = 0;
 
     send_openflow_buffer(vconn, request);
@@ -782,15 +906,16 @@ ofctl_dump_table_features(struct ovs_cmdl_context *ctx)
             if (error) {
                 ovs_fatal(0, "decode error: %s", ofperr_get_name(error));
             } else if (type == OFPTYPE_ERROR) {
-                ofp_print(stdout, reply->data, reply->size, verbosity + 1);
+                ofp_print(stdout, reply->data, reply->size, NULL, NULL,
+                          verbosity + 1);
                 done = true;
             } else if (type == OFPTYPE_TABLE_FEATURES_STATS_REPLY) {
                 done = !ofpmp_more(reply->data);
                 for (;;) {
                     struct ofputil_table_features tf;
-                    int retval;
-
-                    retval = ofputil_decode_table_features(reply, &tf, true);
+                    struct ofpbuf raw_properties;
+                    int retval = ofputil_decode_table_features(
+                        reply, &tf, &raw_properties);
                     if (retval) {
                         if (retval != EOF) {
                             ovs_fatal(0, "decode error: %s",
@@ -799,11 +924,9 @@ ofctl_dump_table_features(struct ovs_cmdl_context *ctx)
                         break;
                     }
 
-                    struct ds s = DS_EMPTY_INITIALIZER;
-                    ofp_print_table_features(&s, &tf, n ? &prev : NULL,
-                                             NULL, NULL);
-                    puts(ds_cstr(&s));
-                    ds_destroy(&s);
+                    ofputil_table_features_format(
+                        &s, &tf, n ? &prev : NULL, NULL, NULL,
+                        &first_ditto, &last_ditto);
 
                     prev = tf;
                     n++;
@@ -811,6 +934,8 @@ ofctl_dump_table_features(struct ovs_cmdl_context *ctx)
             } else {
                 ovs_fatal(0, "received bad reply: %s",
                           ofp_to_string(reply->data, reply->size,
+                                        ports_to_show(ctx->argv[1]),
+                                        tables_to_show(ctx->argv[1]),
                                         verbosity + 1));
             }
         } else {
@@ -820,6 +945,11 @@ ofctl_dump_table_features(struct ovs_cmdl_context *ctx)
         ofpbuf_delete(reply);
     }
 
+    ofputil_table_features_format_finish(&s, first_ditto, last_ditto);
+    const char *p = ds_cstr(&s);
+    puts(p + (*p == '\n'));
+    ds_destroy(&s);
+
     vconn_close(vconn);
 }
 
@@ -940,7 +1070,7 @@ port_iterator_next(struct port_iterator *pi, struct ofputil_phy_port *pp)
             } else if (retval != EOF) {
                 ovs_fatal(0, "received bad reply: %s",
                           ofp_to_string(pi->reply->data, pi->reply->size,
-                                        verbosity + 1));
+                                        NULL, NULL, verbosity + 1));
             }
         }
 
@@ -961,8 +1091,8 @@ port_iterator_next(struct port_iterator *pi, struct ofputil_phy_port *pp)
         if (ofptype_pull(&type, pi->reply)
             || type != OFPTYPE_PORT_DESC_STATS_REPLY) {
             ovs_fatal(0, "received bad reply: %s",
-                      ofp_to_string(pi->reply->data, pi->reply->size,
-                                    verbosity + 1));
+                      ofp_to_string(pi->reply->data, pi->reply->size, NULL,
+                                    NULL, verbosity + 1));
         }
 
         pi->more = (ofpmp_flags(oh) & OFPSF_REPLY_MORE) != 0;
@@ -1021,21 +1151,242 @@ fetch_ofputil_phy_port(const char *vconn_name, const char *port_name,
     }
 }
 
+static const struct ofputil_port_map *
+get_port_map(const char *vconn_name)
+{
+    static struct shash port_maps = SHASH_INITIALIZER(&port_maps);
+    struct ofputil_port_map *map = shash_find_data(&port_maps, vconn_name);
+    if (!map) {
+        map = xmalloc(sizeof *map);
+        ofputil_port_map_init(map);
+        shash_add(&port_maps, vconn_name, map);
+
+        if (!strchr(vconn_name, ':') || !vconn_verify_name(vconn_name)) {
+            /* For an active vconn (which includes a vconn constructed from a
+             * bridge name), connect to it and pull down the port name-number
+             * mapping. */
+            struct vconn *vconn;
+            open_vconn(vconn_name, &vconn);
+
+            struct port_iterator pi;
+            struct ofputil_phy_port pp;
+            for (port_iterator_init(&pi, vconn);
+                 port_iterator_next(&pi, &pp); ) {
+                ofputil_port_map_put(map, pp.port_no, pp.name);
+            }
+            port_iterator_destroy(&pi);
+
+            vconn_close(vconn);
+        } else {
+            /* Don't bother with passive vconns, since it could take a long
+             * time for the remote to try to connect to us.  Don't bother with
+             * invalid vconn names either. */
+        }
+    }
+    return map;
+}
+
+static const struct ofputil_port_map *
+ports_to_accept(const char *vconn_name)
+{
+    return should_accept_names() ? get_port_map(vconn_name) : NULL;
+}
+
+static const struct ofputil_port_map *
+ports_to_show(const char *vconn_name)
+{
+    return should_show_names() ? get_port_map(vconn_name) : NULL;
+}
+
+struct table_iterator {
+    struct vconn *vconn;
+
+    enum { TI_STATS, TI_FEATURES } variant;
+    struct ofpbuf *reply;
+    ovs_be32 send_xid;
+    bool more;
+
+    struct ofputil_table_features features;
+    struct ofpbuf raw_properties;
+};
+
+/* Initializes 'ti' to prepare for iterating through all of the tables on the
+ * OpenFlow switch to which 'vconn' is connected.
+ *
+ * During iteration, the client should not make other use of 'vconn', because
+ * that can cause other messages to be interleaved with the replies used by the
+ * iterator and thus some tables may be missed or a hang can occur. */
+static void
+table_iterator_init(struct table_iterator *ti, struct vconn *vconn)
+{
+    memset(ti, 0, sizeof *ti);
+    ti->vconn = vconn;
+    ti->variant = (vconn_get_version(vconn) < OFP13_VERSION
+                   ? TI_STATS : TI_FEATURES);
+    ti->more = true;
+
+    enum ofpraw ofpraw = (ti->variant == TI_STATS
+                          ? OFPRAW_OFPST_TABLE_REQUEST
+                          : OFPRAW_OFPST13_TABLE_FEATURES_REQUEST);
+    struct ofpbuf *rq = ofpraw_alloc(ofpraw, vconn_get_version(vconn), 0);
+    ti->send_xid = ((struct ofp_header *) rq->data)->xid;
+    send_openflow_buffer(ti->vconn, rq);
+}
+
+/* Obtains the next table from 'ti'.  On success, returns the next table's
+ * features; on failure, returns NULL.  */
+static const struct ofputil_table_features *
+table_iterator_next(struct table_iterator *ti)
+{
+    for (;;) {
+        if (ti->reply) {
+            int retval;
+            if (ti->variant == TI_STATS) {
+                struct ofputil_table_stats ts;
+                retval = ofputil_decode_table_stats_reply(ti->reply,
+                                                          &ts, &ti->features);
+            } else {
+                ovs_assert(ti->variant == TI_FEATURES);
+                retval = ofputil_decode_table_features(ti->reply,
+                                                       &ti->features,
+                                                       &ti->raw_properties);
+            }
+            if (!retval) {
+                return &ti->features;
+            } else if (retval != EOF) {
+                ovs_fatal(0, "received bad reply: %s",
+                          ofp_to_string(ti->reply->data, ti->reply->size,
+                                        NULL, NULL, verbosity + 1));
+            }
+        }
+
+        if (!ti->more) {
+            return NULL;
+        }
+
+        ovs_be32 recv_xid;
+        do {
+            ofpbuf_delete(ti->reply);
+            run(vconn_recv_block(ti->vconn, &ti->reply),
+                "OpenFlow receive failed");
+            recv_xid = ((struct ofp_header *) ti->reply->data)->xid;
+        } while (ti->send_xid != recv_xid);
+
+        struct ofp_header *oh = ti->reply->data;
+        enum ofptype type;
+        if (ofptype_pull(&type, ti->reply)
+            || type != (ti->variant == TI_STATS
+                        ? OFPTYPE_TABLE_STATS_REPLY
+                        : OFPTYPE_TABLE_FEATURES_STATS_REPLY)) {
+            ovs_fatal(0, "received bad reply: %s",
+                      ofp_to_string(ti->reply->data, ti->reply->size, NULL,
+                                    NULL, verbosity + 1));
+        }
+
+        ti->more = (ofpmp_flags(oh) & OFPSF_REPLY_MORE) != 0;
+    }
+}
+
+/* Destroys iterator 'ti'. */
+static void
+table_iterator_destroy(struct table_iterator *ti)
+{
+    if (ti) {
+        while (ti->more) {
+            /* Drain vconn's queue of any other replies for this request. */
+            table_iterator_next(ti);
+        }
+
+        ofpbuf_delete(ti->reply);
+    }
+}
+
+static const struct ofputil_table_map *
+get_table_map(const char *vconn_name)
+{
+    static struct shash table_maps = SHASH_INITIALIZER(&table_maps);
+    struct ofputil_table_map *map = shash_find_data(&table_maps, vconn_name);
+    if (!map) {
+        map = xmalloc(sizeof *map);
+        ofputil_table_map_init(map);
+        shash_add(&table_maps, vconn_name, map);
+
+        if (!strchr(vconn_name, ':') || !vconn_verify_name(vconn_name)) {
+            /* For an active vconn (which includes a vconn constructed from a
+             * bridge name), connect to it and pull down the port name-number
+             * mapping. */
+            struct vconn *vconn;
+            open_vconn(vconn_name, &vconn);
+
+            struct table_iterator ti;
+            table_iterator_init(&ti, vconn);
+            for (;;) {
+                const struct ofputil_table_features *tf
+                    = table_iterator_next(&ti);
+                if (!tf) {
+                    break;
+                }
+                if (tf->name[0]) {
+                    ofputil_table_map_put(map, tf->table_id, tf->name);
+                }
+            }
+            table_iterator_destroy(&ti);
+
+            vconn_close(vconn);
+        } else {
+            /* Don't bother with passive vconns, since it could take a long
+             * time for the remote to try to connect to us.  Don't bother with
+             * invalid vconn names either. */
+        }
+    }
+    return map;
+}
+
+static const struct ofputil_table_map *
+tables_to_accept(const char *vconn_name)
+{
+    return should_accept_names() ? get_table_map(vconn_name) : NULL;
+}
+
+static const struct ofputil_table_map *
+tables_to_show(const char *vconn_name)
+{
+    return should_show_names() ? get_table_map(vconn_name) : NULL;
+}
+
+/* We accept port and table names unless the feature is turned off
+ * explicitly. */
+static bool
+should_accept_names(void)
+{
+    return use_names != 0;
+}
+
+/* We show port and table names only if the feature is turned on explicitly, or
+ * if we're interacting with a user on the console. */
+static bool
+should_show_names(void)
+{
+    static int interactive = -1;
+    if (interactive == -1) {
+        interactive = isatty(STDOUT_FILENO);
+    }
+
+    return use_names > 0 || (use_names == -1 && interactive);
+}
+
 /* Returns the port number corresponding to 'port_name' (which may be a port
  * name or number) within the switch 'vconn_name'. */
 static ofp_port_t
 str_to_port_no(const char *vconn_name, const char *port_name)
 {
     ofp_port_t port_no;
-
-    if (ofputil_port_from_string(port_name, &port_no)) {
+    if (ofputil_port_from_string(port_name, NULL, &port_no) ||
+        ofputil_port_from_string(port_name, ports_to_accept(vconn_name),
+                                 &port_no)) {
         return port_no;
-    } else {
-        struct ofputil_phy_port pp;
-
-        fetch_ofputil_phy_port(vconn_name, port_name, &pp);
-        return pp.port_no;
     }
+    ovs_fatal(0, "%s: unknown port `%s'", vconn_name, port_name);
 }
 
 static bool
@@ -1054,7 +1405,7 @@ try_set_protocol(struct vconn *vconn, enum ofputil_protocol want,
         run(vconn_transact_noreply(vconn, request, &reply),
             "talking to %s", vconn_get_name(vconn));
         if (reply) {
-            char *s = ofp_to_string(reply->data, reply->size, 2);
+            char *s = ofp_to_string(reply->data, reply->size, NULL, NULL, 2);
             VLOG_DBG("%s: failed to set protocol, switch replied: %s",
                      vconn_get_name(vconn), s);
             free(s);
@@ -1086,7 +1437,7 @@ set_protocol_for_flow_dump(struct vconn *vconn,
     if (usable_protocols & allowed_protocols) {
         ovs_fatal(0, "switch does not support any of the usable flow "
                   "formats (%s)", usable_s);
-    } else {
+} else {
         char *allowed_s = ofputil_protocols_to_string(allowed_protocols);
         ovs_fatal(0, "none of the usable flow formats (%s) is among the "
                   "allowed flow formats (%s)", usable_s, allowed_s);
@@ -1095,37 +1446,63 @@ set_protocol_for_flow_dump(struct vconn *vconn,
 
 static struct vconn *
 prepare_dump_flows(int argc, char *argv[], bool aggregate,
-                   struct ofpbuf **requestp)
+                   struct ofputil_flow_stats_request *fsr,
+                   enum ofputil_protocol *protocolp)
 {
+    const char *vconn_name = argv[1];
     enum ofputil_protocol usable_protocols, protocol;
-    struct ofputil_flow_stats_request fsr;
     struct vconn *vconn;
     char *error;
 
-    error = parse_ofp_flow_stats_request_str(&fsr, aggregate,
-                                             argc > 2 ? argv[2] : "",
+    const char *match = argc > 2 ? argv[2] : "";
+    const struct ofputil_port_map *port_map
+        = *match ? ports_to_accept(vconn_name) : NULL;
+    const struct ofputil_table_map *table_map
+        = *match ? tables_to_accept(vconn_name) : NULL;
+    error = parse_ofp_flow_stats_request_str(fsr, aggregate, match,
+                                             port_map, table_map,
                                              &usable_protocols);
     if (error) {
         ovs_fatal(0, "%s", error);
     }
 
-    protocol = open_vconn(argv[1], &vconn);
-    protocol = set_protocol_for_flow_dump(vconn, protocol, usable_protocols);
-    *requestp = ofputil_encode_flow_stats_request(&fsr, protocol);
+    protocol = open_vconn(vconn_name, &vconn);
+    *protocolp = set_protocol_for_flow_dump(vconn, protocol, usable_protocols);
     return vconn;
 }
 
 static void
 ofctl_dump_flows__(int argc, char *argv[], bool aggregate)
 {
-    struct ofpbuf *request;
+    struct ofputil_flow_stats_request fsr;
+    enum ofputil_protocol protocol;
     struct vconn *vconn;
 
-    vconn = prepare_dump_flows(argc, argv, aggregate, &request);
-    dump_transaction(vconn, request);
+    vconn = prepare_dump_flows(argc, argv, aggregate, &fsr, &protocol);
+    dump_transaction(vconn, ofputil_encode_flow_stats_request(&fsr, protocol));
     vconn_close(vconn);
 }
 
+static void
+get_match_field(const struct mf_field *field, const struct match *match,
+                union mf_value *value)
+{
+    if (!match->tun_md.valid || (field->id < MFF_TUN_METADATA0 ||
+                                 field->id >= MFF_TUN_METADATA0 +
+                                              TUN_METADATA_NUM_OPTS)) {
+        mf_get_value(field, &match->flow, value);
+    } else {
+        const struct tun_metadata_loc *loc = &match->tun_md.entry[field->id -
+                                                         MFF_TUN_METADATA0].loc;
+
+        /* Since we don't have a tunnel mapping table, extract the value
+         * from the locally allocated location in the match. */
+        memset(value, 0, field->n_bytes - loc->len);
+        memcpy(value->tun_metadata + field->n_bytes - loc->len,
+               match->flow.tunnel.metadata.opts.u8 + loc->c.offset, loc->len);
+    }
+}
+
 static int
 compare_flows(const void *afs_, const void *bfs_)
 {
@@ -1146,8 +1523,10 @@ compare_flows(const void *afs_, const void *bfs_)
         } else {
             bool ina, inb;
 
-            ina = mf_are_prereqs_ok(f, &a->flow) && !mf_is_all_wild(f, &a->wc);
-            inb = mf_are_prereqs_ok(f, &b->flow) && !mf_is_all_wild(f, &b->wc);
+            ina = mf_are_prereqs_ok(f, &a->flow, NULL)
+                && !mf_is_all_wild(f, &a->wc);
+            inb = mf_are_prereqs_ok(f, &b->flow, NULL)
+                && !mf_is_all_wild(f, &b->wc);
             if (ina != inb) {
                 /* Skip the test for sc->order, so that missing fields always
                  * sort to the end whether we're sorting in ascending or
@@ -1156,8 +1535,8 @@ compare_flows(const void *afs_, const void *bfs_)
             } else {
                 union mf_value aval, bval;
 
-                mf_get_value(f, &a->flow, &aval);
-                mf_get_value(f, &b->flow, &bval);
+                get_match_field(f, a, &aval);
+                get_match_field(f, b, &bval);
                 ret = memcmp(&aval, &bval, f->n_bytes);
             }
         }
@@ -1167,62 +1546,44 @@ compare_flows(const void *afs_, const void *bfs_)
         }
     }
 
-    return 0;
+    return a < b ? -1 : 1;
 }
 
 static void
 ofctl_dump_flows(struct ovs_cmdl_context *ctx)
 {
-    if (!n_criteria) {
+    if (!n_criteria && !should_show_names() && show_stats) {
         ofctl_dump_flows__(ctx->argc, ctx->argv, false);
         return;
     } else {
-        struct ofputil_flow_stats *fses;
-        size_t n_fses, allocated_fses;
-        struct ofpbuf *request;
-        struct ofpbuf ofpacts;
-        struct ofpbuf *reply;
+        struct ofputil_flow_stats_request fsr;
+        enum ofputil_protocol protocol;
         struct vconn *vconn;
-        ovs_be32 send_xid;
-        struct ds s;
-        size_t i;
-
-        vconn = prepare_dump_flows(ctx->argc, ctx->argv, false, &request);
-        send_xid = ((struct ofp_header *) request->data)->xid;
-        send_openflow_buffer(vconn, request);
 
-        fses = NULL;
-        n_fses = allocated_fses = 0;
-        reply = NULL;
-        ofpbuf_init(&ofpacts, 0);
-        for (;;) {
-            struct ofputil_flow_stats *fs;
+        vconn = prepare_dump_flows(ctx->argc, ctx->argv, false,
+                                   &fsr, &protocol);
 
-            if (n_fses >= allocated_fses) {
-                fses = x2nrealloc(fses, &allocated_fses, sizeof *fses);
-            }
+        struct ofputil_flow_stats *fses;
+        size_t n_fses;
+        run(vconn_dump_flows(vconn, &fsr, protocol, &fses, &n_fses),
+            "dump flows");
 
-            fs = &fses[n_fses];
-            if (!recv_flow_stats_reply(vconn, send_xid, &reply, fs,
-                                       &ofpacts)) {
-                break;
-            }
-            fs->ofpacts = xmemdup(fs->ofpacts, fs->ofpacts_len);
-            n_fses++;
+        if (n_criteria) {
+            qsort(fses, n_fses, sizeof *fses, compare_flows);
         }
-        ofpbuf_uninit(&ofpacts);
-
-        qsort(fses, n_fses, sizeof *fses, compare_flows);
 
-        ds_init(&s);
-        for (i = 0; i < n_fses; i++) {
+        struct ds s = DS_EMPTY_INITIALIZER;
+        for (size_t i = 0; i < n_fses; i++) {
             ds_clear(&s);
-            ofp_print_flow_stats(&s, &fses[i]);
-            puts(ds_cstr(&s));
+            ofputil_flow_stats_format(&s, &fses[i],
+                                      ports_to_show(ctx->argv[1]),
+                                      tables_to_show(ctx->argv[1]),
+                                      show_stats);
+            printf(" %s\n", ds_cstr(&s));
         }
         ds_destroy(&s);
 
-        for (i = 0; i < n_fses; i++) {
+        for (size_t i = 0; i < n_fses; i++) {
             free(CONST_CAST(struct ofpact *, fses[i].ofpacts));
         }
         free(fses);
@@ -1363,6 +1724,7 @@ bundle_flow_mod__(const char *remote, struct ofputil_flow_mod *fms,
 
         ovs_list_push_back(&requests, &request->list_node);
         free(CONST_CAST(struct ofpact *, fm->ofpacts));
+        minimatch_destroy(&fm->match);
     }
 
     bundle_transact(vconn, &requests, OFPBF_ORDERED | OFPBF_ATOMIC);
@@ -1390,6 +1752,7 @@ ofctl_flow_mod__(const char *remote, struct ofputil_flow_mod *fms,
 
         transact_noreply(vconn, ofputil_encode_flow_mod(fm, protocol));
         free(CONST_CAST(struct ofpact *, fm->ofpacts));
+        minimatch_destroy(&fm->match);
     }
     vconn_close(vconn);
 }
@@ -1408,8 +1771,9 @@ ofctl_flow_mod_file(int argc OVS_UNUSED, char *argv[], int command)
          * this is backwards compatible. */
         command = -2;
     }
-    error = parse_ofp_flow_mod_file(argv[2], command, &fms, &n_fms,
-                                    &usable_protocols);
+    error = parse_ofp_flow_mod_file(argv[2], ports_to_accept(argv[1]),
+                                    tables_to_accept(argv[1]), command,
+                                    &fms, &n_fms, &usable_protocols);
     if (error) {
         ovs_fatal(0, "%s", error);
     }
@@ -1427,7 +1791,9 @@ ofctl_flow_mod(int argc, char *argv[], uint16_t command)
         char *error;
         enum ofputil_protocol usable_protocols;
 
-        error = parse_ofp_flow_mod_str(&fm, argc > 2 ? argv[2] : "", command,
+        error = parse_ofp_flow_mod_str(&fm, argc > 2 ? argv[2] : "",
+                                       ports_to_accept(argv[1]),
+                                       tables_to_accept(argv[1]), command,
                                        &usable_protocols);
         if (error) {
             ovs_fatal(0, "%s", error);
@@ -1462,13 +1828,13 @@ ofctl_del_flows(struct ovs_cmdl_context *ctx)
 
 static bool
 set_packet_in_format(struct vconn *vconn,
-                     enum nx_packet_in_format packet_in_format,
+                     enum ofputil_packet_in_format packet_in_format,
                      bool must_succeed)
 {
     struct ofpbuf *spif;
 
-    spif = ofputil_make_set_packet_in_format(vconn_get_version(vconn),
-                                             packet_in_format);
+    spif = ofputil_encode_set_packet_in_format(vconn_get_version(vconn),
+                                               packet_in_format);
     if (must_succeed) {
         transact_noreply(vconn, spif);
     } else {
@@ -1477,7 +1843,7 @@ set_packet_in_format(struct vconn *vconn,
         run(vconn_transact_noreply(vconn, spif, &reply),
             "talking to %s", vconn_get_name(vconn));
         if (reply) {
-            char *s = ofp_to_string(reply->data, reply->size, 2);
+            char *s = ofp_to_string(reply->data, reply->size, NULL, NULL, 2);
             VLOG_DBG("%s: failed to set packet in format to nx_packet_in, "
                      "controller replied: %s.",
                      vconn_get_name(vconn), s);
@@ -1572,7 +1938,9 @@ ofctl_send(struct unixctl_conn *conn, int argc,
         }
 
         fprintf(stderr, "send: ");
-        ofp_print(stderr, msg->data, msg->size, verbosity);
+        ofp_print(stderr, msg->data, msg->size,
+                  ports_to_show(vconn_get_name(vconn)),
+                  tables_to_show(vconn_get_name(vconn)), verbosity);
 
         error = vconn_send_block(vconn, msg);
         if (error) {
@@ -1592,6 +1960,62 @@ ofctl_send(struct unixctl_conn *conn, int argc,
     ds_destroy(&reply);
 }
 
+static void
+unixctl_packet_out(struct unixctl_conn *conn, int OVS_UNUSED argc,
+                   const char *argv[], void *vconn_)
+{
+    struct vconn *vconn = vconn_;
+    enum ofputil_protocol protocol
+        = ofputil_protocol_from_ofp_version(vconn_get_version(vconn));
+    struct ds reply = DS_EMPTY_INITIALIZER;
+    bool ok = true;
+
+    enum ofputil_protocol usable_protocols;
+    struct ofputil_packet_out po;
+    char *error_msg;
+
+    error_msg = parse_ofp_packet_out_str(
+        &po, argv[1], ports_to_accept(vconn_get_name(vconn)),
+        tables_to_accept(vconn_get_name(vconn)), &usable_protocols);
+    if (error_msg) {
+        ds_put_format(&reply, "%s\n", error_msg);
+        free(error_msg);
+        ok = false;
+    }
+
+    if (ok && !(usable_protocols & protocol)) {
+        ds_put_format(&reply, "PACKET_OUT actions are incompatible with the OpenFlow connection.\n");
+        ok = false;
+    }
+
+    if (ok) {
+        struct ofpbuf *msg = ofputil_encode_packet_out(&po, protocol);
+
+        ofp_print(stderr, msg->data, msg->size,
+                  ports_to_show(vconn_get_name(vconn)),
+                  tables_to_show(vconn_get_name(vconn)), verbosity);
+
+        int error = vconn_send_block(vconn, msg);
+        if (error) {
+            ofpbuf_delete(msg);
+            ds_put_format(&reply, "%s\n", ovs_strerror(error));
+            ok = false;
+        }
+    }
+
+    if (ok) {
+        unixctl_command_reply(conn, ds_cstr(&reply));
+    } else {
+        unixctl_command_reply_error(conn, ds_cstr(&reply));
+    }
+    ds_destroy(&reply);
+
+    if (!error_msg) {
+        free(CONST_CAST(void *, po.packet));
+        free(po.ofpacts);
+    }
+}
+
 struct barrier_aux {
     struct vconn *vconn;        /* OpenFlow connection for sending barrier. */
     struct unixctl_conn *conn;  /* Connection waiting for barrier response. */
@@ -1666,7 +2090,7 @@ ofctl_unblock(struct unixctl_conn *conn, int argc OVS_UNUSED,
     }
 }
 
-/* Prints to stdout all of the messages received on 'vconn'.
+/* Prints to stderr all of the messages received on 'vconn'.
  *
  * Iff 'reply_to_echo_requests' is true, sends a reply to any echo request
  * received on 'vconn'.
@@ -1692,6 +2116,8 @@ monitor_vconn(struct vconn *vconn, bool reply_to_echo_requests,
     unixctl_command_register("exit", "", 0, 0, ofctl_exit, &exiting);
     unixctl_command_register("ofctl/send", "OFMSG...", 1, INT_MAX,
                              ofctl_send, vconn);
+    unixctl_command_register("ofctl/packet-out", "\"in_port=<port> packet=<hex data> actions=...\"", 1, 1,
+                             unixctl_packet_out, vconn);
     unixctl_command_register("ofctl/barrier", "", 0, 0,
                              ofctl_barrier, &barrier_aux);
     unixctl_command_register("ofctl/set-output-file", "FILE", 1, 1,
@@ -1730,7 +2156,9 @@ monitor_vconn(struct vconn *vconn, bool reply_to_echo_requests,
             }
 
             ofptype_decode(&type, b->data);
-            ofp_print(stderr, b->data, b->size, verbosity + 2);
+            ofp_print(stderr, b->data, b->size,
+                      ports_to_show(vconn_get_name(vconn)),
+                      tables_to_show(vconn_get_name(vconn)), verbosity + 2);
             fflush(stderr);
 
             switch ((int) type) {
@@ -1745,7 +2173,7 @@ monitor_vconn(struct vconn *vconn, bool reply_to_echo_requests,
                 if (reply_to_echo_requests) {
                     struct ofpbuf *reply;
 
-                    reply = make_echo_reply(b->data);
+                    reply = ofputil_encode_echo_reply(b->data);
                     retval = vconn_send_block(vconn, reply);
                     if (retval) {
                         ovs_fatal(retval, "failed to send echo reply");
@@ -1758,8 +2186,8 @@ monitor_vconn(struct vconn *vconn, bool reply_to_echo_requests,
                     struct ofputil_packet_in pin;
                     struct ofpbuf continuation;
 
-                    error = ofputil_decode_packet_in(b->data, true, &pin,
-                                                     NULL, NULL,
+                    error = ofputil_decode_packet_in(b->data, true, NULL, NULL,
+                                                     &pin, NULL, NULL,
                                                      &continuation);
                     if (error) {
                         fprintf(stderr, "decoding packet-in failed: %s",
@@ -1772,6 +2200,8 @@ monitor_vconn(struct vconn *vconn, bool reply_to_echo_requests,
 
                         fprintf(stderr, "send: ");
                         ofp_print(stderr, reply->data, reply->size,
+                                  ports_to_show(vconn_get_name(vconn)),
+                                  tables_to_show(vconn_get_name(vconn)),
                                   verbosity + 2);
                         fflush(stderr);
 
@@ -1850,6 +2280,8 @@ ofctl_monitor(struct ovs_cmdl_context *ctx)
             char *error;
 
             error = parse_flow_monitor_request(&fmr, arg + 6,
+                                               ports_to_accept(ctx->argv[1]),
+                                               tables_to_accept(ctx->argv[1]),
                                                &usable_protocols);
             if (error) {
                 ovs_fatal(0, "%s", error);
@@ -1879,13 +2311,13 @@ ofctl_monitor(struct ovs_cmdl_context *ctx)
         set_packet_in_format(vconn, preferred_packet_in_format, true);
     } else {
         /* Otherwise, we always prefer NXT_PACKET_IN2. */
-        if (!set_packet_in_format(vconn, NXPIF_NXT_PACKET_IN2, false)) {
+        if (!set_packet_in_format(vconn, OFPUTIL_PACKET_IN_NXT2, false)) {
             /* We can't get NXT_PACKET_IN2.  For OpenFlow 1.0 only, request
              * NXT_PACKET_IN.  (Before 2.6, Open vSwitch will accept a request
              * for NXT_PACKET_IN with OF1.1+, but even after that it still
              * sends packet-ins in the OpenFlow native format.) */
             if (vconn_get_version(vconn) == OFP10_VERSION) {
-                set_packet_in_format(vconn, NXPIF_NXT_PACKET_IN, false);
+                set_packet_in_format(vconn, OFPUTIL_PACKET_IN_NXT, false);
             }
         }
     }
@@ -1898,6 +2330,11 @@ ofctl_snoop(struct ovs_cmdl_context *ctx)
 {
     struct vconn *vconn;
 
+    /* We can't use the snoop vconn to send table features request or port
+     * description request messages to show names, because ovs-vswitchd will
+     * not respond to these messages on snoop vconn. */
+    use_names = 0;
+
     open_vconn__(ctx->argv[1], SNOOP, &vconn);
     monitor_vconn(vconn, false, false);
 }
@@ -1939,7 +2376,7 @@ ofctl_probe(struct ovs_cmdl_context *ctx)
     struct ofpbuf *reply;
 
     open_vconn(ctx->argv[1], &vconn);
-    request = make_echo_request(vconn_get_version(vconn));
+    request = ofputil_encode_echo_request(vconn_get_version(vconn));
     run(vconn_transact(vconn, request, &reply), "talking to %s", ctx->argv[1]);
     if (reply->size != sizeof(struct ofp_header)) {
         ovs_fatal(0, "reply does not match request");
@@ -1951,44 +2388,75 @@ ofctl_probe(struct ovs_cmdl_context *ctx)
 static void
 ofctl_packet_out(struct ovs_cmdl_context *ctx)
 {
+    enum ofputil_protocol usable_protocols;
     enum ofputil_protocol protocol;
     struct ofputil_packet_out po;
-    struct ofpbuf ofpacts;
     struct vconn *vconn;
+    struct ofpbuf *opo;
     char *error;
-    int i;
-    enum ofputil_protocol usable_protocols; /* XXX: Use in proto selection */
 
-    ofpbuf_init(&ofpacts, 64);
-    error = ofpacts_parse_actions(ctx->argv[3], &ofpacts, &usable_protocols);
-    if (error) {
-        ovs_fatal(0, "%s", error);
-    }
+    match_init_catchall(&po.flow_metadata);
+    /* Use the old syntax when more than 4 arguments are given. */
+    if (ctx->argc > 4) {
+        struct ofpbuf ofpacts;
+        int i;
+
+        ofpbuf_init(&ofpacts, 64);
+        struct ofpact_parse_params pp = {
+            .port_map = ports_to_accept(ctx->argv[1]),
+            .table_map = tables_to_accept(ctx->argv[1]),
+            .ofpacts = &ofpacts,
+            .usable_protocols = &usable_protocols
+        };
+        error = ofpacts_parse_actions(ctx->argv[3], &pp);
+        if (error) {
+            ovs_fatal(0, "%s", error);
+        }
 
-    po.buffer_id = UINT32_MAX;
-    po.in_port = str_to_port_no(ctx->argv[1], ctx->argv[2]);
-    po.ofpacts = ofpacts.data;
-    po.ofpacts_len = ofpacts.size;
+        po.buffer_id = UINT32_MAX;
+        match_set_in_port(&po.flow_metadata,
+                          str_to_port_no(ctx->argv[1], ctx->argv[2]));
+        po.ofpacts = ofpacts.data;
+        po.ofpacts_len = ofpacts.size;
+        po.flow_metadata.flow.packet_type = htonl(PT_ETH);
 
-    protocol = open_vconn(ctx->argv[1], &vconn);
-    for (i = 4; i < ctx->argc; i++) {
-        struct dp_packet *packet;
-        struct ofpbuf *opo;
-        const char *error_msg;
+        protocol = open_vconn_for_flow_mod(ctx->argv[1], &vconn,
+                                           usable_protocols);
+        for (i = 4; i < ctx->argc; i++) {
+            struct dp_packet *packet;
+            const char *error_msg;
 
-        error_msg = eth_from_hex(ctx->argv[i], &packet);
-        if (error_msg) {
-            ovs_fatal(0, "%s", error_msg);
-        }
+            error_msg = eth_from_hex(ctx->argv[i], &packet);
+            if (error_msg) {
+                ovs_fatal(0, "%s", error_msg);
+            }
 
-        po.packet = dp_packet_data(packet);
-        po.packet_len = dp_packet_size(packet);
+            po.packet = dp_packet_data(packet);
+            po.packet_len = dp_packet_size(packet);
+            opo = ofputil_encode_packet_out(&po, protocol);
+            transact_noreply(vconn, opo);
+            dp_packet_delete(packet);
+        }
+        vconn_close(vconn);
+        ofpbuf_uninit(&ofpacts);
+    } else if (ctx->argc == 3) {
+        error = parse_ofp_packet_out_str(&po, ctx->argv[2],
+                                         ports_to_accept(ctx->argv[1]),
+                                         tables_to_accept(ctx->argv[1]),
+                                         &usable_protocols);
+        if (error) {
+            ovs_fatal(0, "%s", error);
+        }
+        protocol = open_vconn_for_flow_mod(ctx->argv[1], &vconn,
+                                           usable_protocols);
         opo = ofputil_encode_packet_out(&po, protocol);
         transact_noreply(vconn, opo);
-        dp_packet_delete(packet);
+        vconn_close(vconn);
+        free(CONST_CAST(void *, po.packet));
+        free(po.ofpacts);
+    } else {
+        ovs_fatal(0, "Too many arguments (%d)", ctx->argc);
     }
-    vconn_close(vconn);
-    ofpbuf_uninit(&ofpacts);
 }
 
 static void
@@ -2080,7 +2548,7 @@ fetch_table_desc(struct vconn *vconn, struct ofputil_table_mod *tm,
             if (ofptype_pull(&type, &b)
                 || type != OFPTYPE_TABLE_DESC_REPLY) {
                 ovs_fatal(0, "received bad reply: %s",
-                          ofp_to_string(reply->data, reply->size,
+                          ofp_to_string(reply->data, reply->size, NULL, NULL,
                                         verbosity + 1));
             }
             uint16_t flags = ofpmp_flags(oh);
@@ -2114,22 +2582,102 @@ fetch_table_desc(struct vconn *vconn, struct ofputil_table_mod *tm,
 }
 
 static void
-ofctl_mod_table(struct ovs_cmdl_context *ctx)
+change_table_name(struct vconn *vconn, uint8_t table_id, const char *new_name)
 {
-    uint32_t usable_versions;
-    struct ofputil_table_mod tm;
-    struct vconn *vconn;
-    char *error;
-    int i;
+    /* Get all tables' features and properties. */
+    struct table {
+        struct ofputil_table_features tf;
+        struct ofpbuf *raw_properties;
+    } *tables[256];
+    memset(tables, 0, sizeof tables);
 
-    error = parse_ofp_table_mod(&tm, ctx->argv[2], ctx->argv[3],
-                                &usable_versions);
-    if (error) {
-        ovs_fatal(0, "%s", error);
+    struct table_iterator ti;
+    table_iterator_init(&ti, vconn);
+    while (table_iterator_next(&ti)) {
+        struct table *t = tables[ti.features.table_id] = xmalloc(sizeof *t);
+        t->tf = ti.features;
+        t->raw_properties = ofpbuf_clone(&ti.raw_properties);
     }
+    table_iterator_destroy(&ti);
 
-    uint32_t allowed_versions = get_allowed_ofp_versions();
-    if (!(allowed_versions & usable_versions)) {
+    /* Change the name for table 'table_id'. */
+    struct table *t = tables[table_id];
+    if (!t) {
+        ovs_fatal(0, "switch does not have table %"PRIu8, table_id);
+    }
+    ovs_strlcpy(t->tf.name, new_name, OFP_MAX_TABLE_NAME_LEN);
+
+    /* Compose the transaction. */
+    enum ofp_version version = vconn_get_version(vconn);
+    struct ovs_list requests = OVS_LIST_INITIALIZER(&requests);
+    struct ofpbuf *tfr = ofputil_encode_table_features_request(version);
+    ovs_list_push_back(&requests, &tfr->list_node);
+    if (version >= OFP15_VERSION) {
+        /* For OpenFlow 1.5, we can use a single OFPTFC15_MODIFY without any
+         * properties. */
+        t->tf.command = OFPTFC15_MODIFY;
+        t->tf.any_properties = false;
+        ofputil_append_table_features(&t->tf, NULL, &requests);
+    } else {
+        /* For OpenFlow 1.3 and 1.4, we have to regurgitate all of the tables
+         * and their properties. */
+        for (size_t i = 0; i < 256; i++) {
+            if (tables[i]) {
+                ofputil_append_table_features(&tables[i]->tf,
+                                              tables[i]->raw_properties,
+                                              &requests);
+            }
+        }
+    }
+
+    /* Transact.
+     *
+     * The reply repeats the entire new configuration of the tables, so we
+     * don't bother printing it unless there's an error. */
+    struct ovs_list replies;
+    struct ofpbuf *reply;
+    vconn_transact_multipart(vconn, &requests, &replies);
+    LIST_FOR_EACH (reply, list_node, &replies) {
+        enum ofptype type;
+        enum ofperr error = ofptype_decode(&type, reply->data);
+        if (error) {
+            ovs_fatal(0, "decode error: %s", ofperr_get_name(error));
+        } else if (type == OFPTYPE_ERROR) {
+            ofp_print(stderr, reply->data, reply->size, NULL, NULL,
+                      verbosity + 1);
+            exit(1);
+        }
+    }
+    ofpbuf_list_delete(&replies);
+
+    /* Clean up. */
+    for (size_t i = 0; i < ARRAY_SIZE(tables); i++) {
+        if (tables[i]) {
+            ofpbuf_delete(tables[i]->raw_properties);
+            free(tables[i]);
+        }
+    }
+}
+
+static void
+ofctl_mod_table(struct ovs_cmdl_context *ctx)
+{
+    uint32_t usable_versions;
+    struct ofputil_table_mod tm;
+    const char *name;
+    struct vconn *vconn;
+    char *error;
+    int i;
+
+    error = parse_ofp_table_mod(&tm, &name, ctx->argv[2], ctx->argv[3],
+                                tables_to_accept(ctx->argv[1]),
+                                &usable_versions);
+    if (error) {
+        ovs_fatal(0, "%s", error);
+    }
+
+    uint32_t allowed_versions = get_allowed_ofp_versions();
+    if (!(allowed_versions & usable_versions)) {
         struct ds versions = DS_EMPTY_INITIALIZER;
         ofputil_format_version_bitmap_names(&versions, usable_versions);
         ovs_fatal(0, "table_mod '%s' requires one of the OpenFlow "
@@ -2139,27 +2687,32 @@ ofctl_mod_table(struct ovs_cmdl_context *ctx)
     mask_allowed_ofp_versions(usable_versions);
     enum ofputil_protocol protocol = open_vconn(ctx->argv[1], &vconn);
 
-    /* For OpenFlow 1.4+, ovs-ofctl mod-table should not affect table-config
-     * properties that the user didn't ask to change, so it is necessary to
-     * restore the current configuration of table-config parameters using
-     * OFPMP14_TABLE_DESC request. */
-    if ((allowed_versions & (1u << OFP14_VERSION)) ||
-        (allowed_versions & (1u << OFP15_VERSION))) {
-        struct ofputil_table_desc td;
-
-        if (tm.table_id == OFPTT_ALL) {
-            for (i = 0; i < OFPTT_MAX; i++) {
-                tm.table_id = i;
+    if (name) {
+        change_table_name(vconn, tm.table_id, name);
+    } else {
+        /* For OpenFlow 1.4+, ovs-ofctl mod-table should not affect
+         * table-config properties that the user didn't ask to change, so it is
+         * necessary to restore the current configuration of table-config
+         * parameters using OFPMP14_TABLE_DESC request. */
+        if (allowed_versions & ((1u << OFP14_VERSION) |
+                                (1u << OFP15_VERSION))) {
+            struct ofputil_table_desc td;
+
+            if (tm.table_id == OFPTT_ALL) {
+                for (i = 0; i < OFPTT_MAX; i++) {
+                    tm.table_id = i;
+                    fetch_table_desc(vconn, &tm, &td);
+                    transact_noreply(vconn,
+                                     ofputil_encode_table_mod(&tm, protocol));
+                }
+            } else {
                 fetch_table_desc(vconn, &tm, &td);
-                transact_noreply(vconn,
-                                 ofputil_encode_table_mod(&tm, protocol));
+                transact_noreply(vconn, ofputil_encode_table_mod(&tm,
+                                                                 protocol));
             }
         } else {
-            fetch_table_desc(vconn, &tm, &td);
             transact_noreply(vconn, ofputil_encode_table_mod(&tm, protocol));
         }
-    } else {
-        transact_noreply(vconn, ofputil_encode_table_mod(&tm, protocol));
     }
     vconn_close(vconn);
 }
@@ -2248,7 +2801,7 @@ ofctl_ofp_parse(struct ovs_cmdl_context *ctx)
             ovs_fatal(0, "%s: unexpected end of file mid-message", filename);
         }
 
-        ofp_print(stdout, b.data, b.size, verbosity + 2);
+        ofp_print(stdout, b.data, b.size, NULL, NULL, verbosity + 2);
     }
     ofpbuf_uninit(&b);
 
@@ -2279,12 +2832,12 @@ static void
 ofctl_ofp_parse_pcap(struct ovs_cmdl_context *ctx)
 {
     struct tcp_reader *reader;
-    FILE *file;
+    struct pcap_file *p_file;
     int error;
     bool first;
 
-    file = ovs_pcap_open(ctx->argv[1], "rb");
-    if (!file) {
+    p_file = ovs_pcap_open(ctx->argv[1], "rb");
+    if (!p_file) {
         ovs_fatal(errno, "%s: open failed", ctx->argv[1]);
     }
 
@@ -2295,7 +2848,7 @@ ofctl_ofp_parse_pcap(struct ovs_cmdl_context *ctx)
         long long int when;
         struct flow flow;
 
-        error = ovs_pcap_read(file, &packet, &when);
+        error = ovs_pcap_read(p_file, &packet, &when);
         if (error) {
             break;
         }
@@ -2317,7 +2870,8 @@ ofctl_ofp_parse_pcap(struct ovs_cmdl_context *ctx)
 
                     oh = dp_packet_data(payload);
                     length = ntohs(oh->length);
-                    if (dp_packet_size(payload) < length) {
+                    if (dp_packet_size(payload) < length
+                        || length < sizeof *oh) {
                         break;
                     }
 
@@ -2335,7 +2889,8 @@ ofctl_ofp_parse_pcap(struct ovs_cmdl_context *ctx)
                     printf(IP_FMT".%"PRIu16" > "IP_FMT".%"PRIu16":\n",
                            IP_ARGS(flow.nw_src), ntohs(flow.tp_src),
                            IP_ARGS(flow.nw_dst), ntohs(flow.tp_dst));
-                    ofp_print(stdout, dp_packet_data(payload), length, verbosity + 1);
+                    ofp_print(stdout, dp_packet_data(payload), length,
+                              NULL, NULL, verbosity + 1);
                     dp_packet_pull(payload, length);
                 }
             }
@@ -2343,6 +2898,7 @@ ofctl_ofp_parse_pcap(struct ovs_cmdl_context *ctx)
         dp_packet_delete(packet);
     }
     tcp_reader_close(reader);
+    ovs_pcap_close(p_file);
 }
 
 static void
@@ -2379,9 +2935,10 @@ ofctl_ping(struct ovs_cmdl_context *ctx)
             || reply->size != payload
             || memcmp(request->msg, reply->msg, payload)) {
             printf("Reply does not match request.  Request:\n");
-            ofp_print(stdout, request, request->size, verbosity + 2);
+            ofp_print(stdout, request, request->size, NULL, NULL,
+                      verbosity + 2);
             printf("Reply:\n");
-            ofp_print(stdout, reply, reply->size, verbosity + 2);
+            ofp_print(stdout, reply, reply->size, NULL, NULL, verbosity + 2);
         }
         printf("%"PRIu32" bytes from %s: xid=%08"PRIx32" time=%.1f ms\n",
                reply->size, ctx->argv[1], ntohl(rpy_hdr->xid),
@@ -2436,6 +2993,70 @@ ofctl_benchmark(struct ovs_cmdl_context *ctx)
            count * message_size / (duration / 1000.0));
 }
 
+static void
+ofctl_dump_ipfix_bridge(struct ovs_cmdl_context *ctx)
+{
+    dump_trivial_transaction(ctx->argv[1], OFPRAW_NXST_IPFIX_BRIDGE_REQUEST);
+}
+
+static void
+ofctl_ct_flush_zone(struct ovs_cmdl_context *ctx)
+{
+    uint16_t zone_id;
+    char *error = str_to_u16(ctx->argv[2], "zone_id", &zone_id);
+    if (error) {
+        ovs_fatal(0, "%s", error);
+    }
+
+    struct vconn *vconn;
+    open_vconn(ctx->argv[1], &vconn);
+    enum ofp_version version = vconn_get_version(vconn);
+
+    struct ofpbuf *msg = ofpraw_alloc(OFPRAW_NXT_CT_FLUSH_ZONE, version, 0);
+    struct nx_zone_id *nzi = ofpbuf_put_zeros(msg, sizeof *nzi);
+    nzi->zone_id = htons(zone_id);
+
+    transact_noreply(vconn, msg);
+    vconn_close(vconn);
+}
+
+static void
+ofctl_dump_ipfix_flow(struct ovs_cmdl_context *ctx)
+{
+    dump_trivial_transaction(ctx->argv[1], OFPRAW_NXST_IPFIX_FLOW_REQUEST);
+}
+
+static void
+bundle_group_mod__(const char *remote, struct ofputil_group_mod *gms,
+                   size_t n_gms, enum ofputil_protocol usable_protocols)
+{
+    enum ofputil_protocol protocol;
+    enum ofp_version version;
+    struct vconn *vconn;
+    struct ovs_list requests;
+    size_t i;
+
+    ovs_list_init(&requests);
+
+    /* Bundles need OpenFlow 1.3+. */
+    usable_protocols &= OFPUTIL_P_OF13_UP;
+    protocol = open_vconn_for_flow_mod(remote, &vconn, usable_protocols);
+    version = ofputil_protocol_to_ofp_version(protocol);
+
+    for (i = 0; i < n_gms; i++) {
+        struct ofputil_group_mod *gm = &gms[i];
+        struct ofpbuf *request = ofputil_encode_group_mod(version, gm,
+                                                          NULL, -1);
+
+        ovs_list_push_back(&requests, &request->list_node);
+        ofputil_uninit_group_mod(gm);
+    }
+
+    bundle_transact(vconn, &requests, OFPBF_ORDERED | OFPBF_ATOMIC);
+    ofpbuf_list_delete(&requests);
+    vconn_close(vconn);
+}
+
 static void
 ofctl_group_mod__(const char *remote, struct ofputil_group_mod *gms,
                   size_t n_gms, enum ofputil_protocol usable_protocols)
@@ -2448,40 +3069,45 @@ ofctl_group_mod__(const char *remote, struct ofputil_group_mod *gms,
     struct vconn *vconn;
     size_t i;
 
+    if (bundle) {
+        bundle_group_mod__(remote, gms, n_gms, usable_protocols);
+        return;
+    }
+
     protocol = open_vconn_for_flow_mod(remote, &vconn, usable_protocols);
     version = ofputil_protocol_to_ofp_version(protocol);
 
     for (i = 0; i < n_gms; i++) {
         gm = &gms[i];
-        request = ofputil_encode_group_mod(version, gm);
-        if (request) {
-            transact_noreply(vconn, request);
-        }
+        request = ofputil_encode_group_mod(version, gm, NULL, -1);
+        transact_noreply(vconn, request);
+        ofputil_uninit_group_mod(gm);
     }
 
     vconn_close(vconn);
-
 }
 
-
 static void
-ofctl_group_mod_file(int argc OVS_UNUSED, char *argv[], uint16_t command)
+ofctl_group_mod_file(int argc OVS_UNUSED, char *argv[], int command)
 {
     struct ofputil_group_mod *gms = NULL;
     enum ofputil_protocol usable_protocols;
     size_t n_gms = 0;
     char *error;
-    int i;
 
-    error = parse_ofp_group_mod_file(argv[2], command, &gms, &n_gms,
-                                     &usable_protocols);
+    if (command == OFPGC11_ADD) {
+        /* Allow the file to specify a mix of commands.  If none specified at
+         * the beginning of any given line, then the default is OFPGC11_ADD, so
+         * this is backwards compatible. */
+        command = -2;
+    }
+    error = parse_ofp_group_mod_file(argv[2], ports_to_accept(argv[1]),
+                                     tables_to_accept(argv[1]),
+                                     command, &gms, &n_gms, &usable_protocols);
     if (error) {
         ovs_fatal(0, "%s", error);
     }
     ofctl_group_mod__(argv[1], gms, n_gms, usable_protocols);
-    for (i = 0; i < n_gms; i++) {
-        ofputil_bucket_list_destroy(&gms[i].buckets);
-    }
     free(gms);
 }
 
@@ -2496,12 +3122,13 @@ ofctl_group_mod(int argc, char *argv[], uint16_t command)
         char *error;
 
         error = parse_ofp_group_mod_str(&gm, command, argc > 2 ? argv[2] : "",
+                                        ports_to_accept(argv[1]),
+                                        tables_to_accept(argv[1]),
                                         &usable_protocols);
         if (error) {
             ovs_fatal(0, "%s", error);
         }
         ofctl_group_mod__(argv[1], &gm, 1, usable_protocols);
-        ofputil_bucket_list_destroy(&gm.buckets);
     }
 }
 
@@ -2520,7 +3147,8 @@ ofctl_add_groups(struct ovs_cmdl_context *ctx)
 static void
 ofctl_mod_group(struct ovs_cmdl_context *ctx)
 {
-    ofctl_group_mod(ctx->argc, ctx->argv, OFPGC11_MODIFY);
+    ofctl_group_mod(ctx->argc, ctx->argv,
+                    may_create ? OFPGC11_ADD_OR_MOD : OFPGC11_MODIFY);
 }
 
 static void
@@ -2555,6 +3183,8 @@ ofctl_dump_group_stats(struct ovs_cmdl_context *ctx)
 
     error = parse_ofp_group_mod_str(&gm, OFPGC11_DELETE,
                                     ctx->argc > 2 ? ctx->argv[2] : "",
+                                    ports_to_accept(ctx->argv[1]),
+                                    tables_to_accept(ctx->argv[1]),
                                     &usable_protocols);
     if (error) {
         ovs_fatal(0, "%s", error);
@@ -2609,6 +3239,50 @@ ofctl_dump_group_features(struct ovs_cmdl_context *ctx)
     vconn_close(vconn);
 }
 
+static void
+ofctl_bundle(struct ovs_cmdl_context *ctx)
+{
+    enum ofputil_protocol protocol, usable_protocols;
+    struct ofputil_bundle_msg *bms;
+    struct ovs_list requests;
+    struct vconn *vconn;
+    size_t n_bms;
+    char *error;
+
+    error = parse_ofp_bundle_file(ctx->argv[2], ports_to_accept(ctx->argv[1]),
+                                  tables_to_accept(ctx->argv[1]),
+                                  &bms, &n_bms, &usable_protocols);
+    if (error) {
+        ovs_fatal(0, "%s", error);
+    }
+
+    /* Implicit OpenFlow 1.4. */
+    if (!(get_allowed_ofp_versions() &
+          ofputil_protocols_to_version_bitmap(OFPUTIL_P_OF13_UP))) {
+
+        /* Add implicit allowance for OpenFlow 1.4. */
+        add_allowed_ofp_versions(ofputil_protocols_to_version_bitmap(
+                                     OFPUTIL_P_OF14_OXM));
+        /* Remove all versions that do not support bundles. */
+        mask_allowed_ofp_versions(ofputil_protocols_to_version_bitmap(
+                                     OFPUTIL_P_OF13_UP));
+        allowed_protocols = ofputil_protocols_from_version_bitmap(
+                                     get_allowed_ofp_versions());
+    }
+
+    /* Bundles need OpenFlow 1.3+. */
+    usable_protocols &= OFPUTIL_P_OF13_UP;
+    protocol = open_vconn_for_flow_mod(ctx->argv[1], &vconn, usable_protocols);
+
+    ovs_list_init(&requests);
+    ofputil_encode_bundle_msgs(bms, n_bms, &requests, protocol);
+    ofputil_free_bundle_msgs(bms, n_bms);
+    bundle_transact(vconn, &requests, OFPBF_ORDERED | OFPBF_ATOMIC);
+    ofpbuf_list_delete(&requests);
+
+    vconn_close(vconn);
+}
+
 static void
 ofctl_tlv_mod(struct ovs_cmdl_context *ctx, uint16_t command)
 {
@@ -2728,6 +3402,34 @@ struct fte_version {
     uint8_t table_id;
 };
 
+/* A FTE entry that has been queued for later insertion after all
+ * flows have been scanned to correctly allocation tunnel metadata. */
+struct fte_pending {
+    struct minimatch match;
+    int priority;
+    struct fte_version *version;
+    int index;
+
+    struct ovs_list list_node;
+};
+
+/* Processing state during two stage processing of flow table entries.
+ * Tracks the maximum size seen for each tunnel metadata entry as well
+ * as a list of the pending FTE entries. */
+struct fte_state {
+    int tun_metadata_size[TUN_METADATA_NUM_OPTS];
+    struct ovs_list fte_pending_list;
+
+    /* The final metadata table that we have constructed. */
+    struct tun_table *tun_tab;
+
+    /* Port and table map.  There is only one of each, not one per source,
+     * because it only makes sense to display a single name for a given port
+     * or table number. */
+    const struct ofputil_port_map *port_map;
+    const struct ofputil_table_map *table_map;
+};
+
 /* Frees 'version' and the data that it owns. */
 static void
 fte_version_free(struct fte_version *version)
@@ -2750,14 +3452,15 @@ fte_version_equals(const struct fte_version *a, const struct fte_version *b)
             && a->hard_timeout == b->hard_timeout
             && a->importance == b->importance
             && a->table_id == b->table_id
-            && ofpacts_equal(a->ofpacts, a->ofpacts_len,
-                             b->ofpacts, b->ofpacts_len));
+            && ofpacts_equal_stringwise(a->ofpacts, a->ofpacts_len,
+                                        b->ofpacts, b->ofpacts_len));
 }
 
 /* Clears 's', then if 's' has a version 'index', formats 'fte' and version
  * 'index' into 's', followed by a new-line. */
 static void
-fte_version_format(const struct fte *fte, int index, struct ds *s)
+fte_version_format(const struct fte_state *fte_state, const struct fte *fte,
+                   int index, struct ds *s)
 {
     const struct fte_version *version = fte->versions[index];
 
@@ -2769,7 +3472,7 @@ fte_version_format(const struct fte *fte, int index, struct ds *s)
     if (version->table_id) {
         ds_put_format(s, "table=%"PRIu8" ", version->table_id);
     }
-    cls_rule_format(&fte->rule, s);
+    cls_rule_format(&fte->rule, fte_state->tun_tab, fte_state->port_map, s);
     if (version->cookie != htonll(0)) {
         ds_put_format(s, " cookie=0x%"PRIx64, ntohll(version->cookie));
     }
@@ -2784,7 +3487,11 @@ fte_version_format(const struct fte *fte, int index, struct ds *s)
     }
 
     ds_put_cstr(s, " actions=");
-    ofpacts_format(version->ofpacts, version->ofpacts_len, s);
+    struct ofpact_format_params fp = {
+        .port_map = fte_state->port_map,
+        .s = s,
+    };
+    ofpacts_format(version->ofpacts, version->ofpacts_len, &fp);
 
     ds_put_char(s, '\n');
 }
@@ -2818,7 +3525,7 @@ fte_free_all(struct flow_tables *tables)
 
         classifier_defer(cls);
         CLS_FOR_EACH (fte, rule, cls) {
-            classifier_remove(cls, &fte->rule);
+            classifier_remove_assert(cls, &fte->rule);
             ovsrcu_postpone(fte_free, fte);
         }
         classifier_destroy(cls);
@@ -2831,18 +3538,18 @@ fte_free_all(struct flow_tables *tables)
  *
  * Takes ownership of 'version'. */
 static void
-fte_insert(struct flow_tables *tables, const struct match *match,
+fte_insert(struct flow_tables *tables, const struct minimatch *match,
            int priority, struct fte_version *version, int index)
 {
     struct classifier *cls = &tables->tables[version->table_id];
     struct fte *old, *fte;
 
     fte = xzalloc(sizeof *fte);
-    cls_rule_init(&fte->rule, match, priority);
+    cls_rule_init_from_minimatch(&fte->rule, match, priority);
     fte->versions[index] = version;
 
     old = fte_from_cls_rule(classifier_replace(cls, &fte->rule,
-                                               CLS_MIN_VERSION, NULL, 0));
+                                               OVS_VERSION_MIN, NULL, 0));
     if (old) {
         fte->versions[!index] = old->versions[!index];
         old->versions[!index] = NULL;
@@ -2851,12 +3558,180 @@ fte_insert(struct flow_tables *tables, const struct match *match,
     }
 }
 
+/* Given a list of the field sizes for each tunnel metadata entry, install
+ * a mapping table for later operations. */
+static void
+generate_tun_metadata(struct fte_state *state)
+{
+    struct ofputil_tlv_table_mod ttm;
+    int i;
+
+    ttm.command = NXTTMC_ADD;
+    ovs_list_init(&ttm.mappings);
+
+    for (i = 0; i < TUN_METADATA_NUM_OPTS; i++) {
+        if (state->tun_metadata_size[i] != -1) {
+            struct ofputil_tlv_map *map = xmalloc(sizeof *map);
+
+            ovs_list_push_back(&ttm.mappings, &map->list_node);
+
+            /* We don't care about the actual option class and type since there
+             * won't be any lookup. We just need to make them unique. */
+            map->option_class = i / UINT8_MAX;
+            map->option_type = i;
+            map->option_len = ROUND_UP(state->tun_metadata_size[i], 4);
+            map->index = i;
+        }
+    }
+
+    tun_metadata_table_mod(&ttm, NULL, &state->tun_tab);
+    ofputil_uninit_tlv_table(&ttm.mappings);
+}
+
+/* Once we have created a tunnel mapping table with a consistent overall
+ * allocation, we need to remap each flow to use this table from its own
+ * allocation. Since the mapping table has already been installed, we
+ * can just read the data from the match and rewrite it. On rewrite, it
+ * will use the new table. */
+static void
+remap_match(struct fte_state *state, struct minimatch *minimatch)
+{
+    int i;
+
+    if (!minimatch->tun_md || !minimatch->tun_md->valid) {
+        return;
+    }
+
+    struct match match;
+    minimatch_expand(minimatch, &match);
+
+    struct tun_metadata flow = match.flow.tunnel.metadata;
+    struct tun_metadata flow_mask = match.wc.masks.tunnel.metadata;
+    memset(&match.flow.tunnel.metadata, 0, sizeof match.flow.tunnel.metadata);
+    memset(&match.wc.masks.tunnel.metadata, 0,
+           sizeof match.wc.masks.tunnel.metadata);
+    match.tun_md.valid = false;
+
+    match.flow.tunnel.metadata.tab = state->tun_tab;
+    match.wc.masks.tunnel.metadata.tab = match.flow.tunnel.metadata.tab;
+
+    ULLONG_FOR_EACH_1 (i, flow_mask.present.map) {
+        const struct mf_field *field = mf_from_id(MFF_TUN_METADATA0 + i);
+        int offset = match.tun_md.entry[i].loc.c.offset;
+        int len = match.tun_md.entry[i].loc.len;
+        union mf_value value, mask;
+
+        memset(&value, 0, field->n_bytes - len);
+        memset(&mask, match.tun_md.entry[i].masked ? 0 : 0xff,
+               field->n_bytes - len);
+
+        memcpy(value.tun_metadata + field->n_bytes - len,
+               flow.opts.u8 + offset, len);
+        memcpy(mask.tun_metadata + field->n_bytes - len,
+               flow_mask.opts.u8 + offset, len);
+        mf_set(field, &value, &mask, &match, NULL);
+    }
+    minimatch_destroy(minimatch);
+    minimatch_init(minimatch, &match);
+}
+
+/* In order to correctly handle tunnel metadata, we need to have
+ * two passes over the flows. This happens because tunnel metadata
+ * doesn't have fixed locations in a flow entry but is instead dynamically
+ * allocated space. In the case of flows coming from a file, we don't
+ * even know the size of each field when we need to do the allocation.
+ * When the flows come in, each flow has an individual allocation based
+ * on its own fields. However, this allocation is not the same across
+ * different flows and therefore fields are not directly comparable.
+ *
+ * In the first pass, we record the maximum size of each tunnel metadata
+ * field as well as queue FTE entries for later processing.
+ *
+ * In the second pass, we use the metadata size information to create a
+ * tunnel mapping table and set that through the tunnel metadata processing
+ * code. We then remap all individual flows to use this common allocation
+ * scheme. Finally, we load the queued entries into the classifier for
+ * comparison.
+ *
+ * fte_state_init() should be called before processing any flows. */
+static void
+fte_state_init(struct fte_state *state)
+{
+    int i;
+
+    for (i = 0; i < TUN_METADATA_NUM_OPTS; i++) {
+        state->tun_metadata_size[i] = -1;
+    }
+
+    ovs_list_init(&state->fte_pending_list);
+    state->tun_tab = NULL;
+    state->port_map = NULL;
+    state->table_map = NULL;
+}
+
+static void
+fte_state_destroy(struct fte_state *state)
+{
+    tun_metadata_free(state->tun_tab);
+}
+
+/* The first pass of the processing described in the comment about
+ * fte_state_init(). fte_queue() is the first pass to be called as each
+ * flow is read from its source. */
+static void
+fte_queue(struct fte_state *state, const struct minimatch *match,
+          int priority, struct fte_version *version, int index)
+{
+    struct fte_pending *pending = xmalloc(sizeof *pending);
+    int i;
+
+    minimatch_clone(&pending->match, match);
+    pending->priority = priority;
+    pending->version = version;
+    pending->index = index;
+    ovs_list_push_back(&state->fte_pending_list, &pending->list_node);
+
+    if (!match->tun_md || !match->tun_md->valid) {
+        return;
+    }
+
+    uint64_t map = miniflow_get_tun_metadata_present_map(&match->mask->masks);
+    ULLONG_FOR_EACH_1 (i, map) {
+        if (match->tun_md->entry[i].loc.len > state->tun_metadata_size[i]) {
+            state->tun_metadata_size[i] = match->tun_md->entry[i].loc.len;
+        }
+    }
+}
+
+/* The second pass of the processing described in the comment about
+ * fte_state_init(). This should be called once all flows (from both
+ * sides of the comparison) have been added through fte_queue(). */
+static void
+fte_fill(struct fte_state *state, struct flow_tables *tables)
+{
+    struct fte_pending *pending;
+
+    generate_tun_metadata(state);
+
+    flow_tables_init(tables);
+    flow_tables_defer(tables);
+
+    LIST_FOR_EACH_POP(pending, list_node, &state->fte_pending_list) {
+        remap_match(state, &pending->match);
+        fte_insert(tables, &pending->match, pending->priority,
+                   pending->version, pending->index);
+        minimatch_destroy(&pending->match);
+        free(pending);
+    }
+
+    flow_tables_publish(tables);
+}
+
 /* Reads the flows in 'filename' as flow table entries in 'tables' for the
  * version with the specified 'index'.  Returns the flow formats able to
  * represent the flows that were read. */
 static enum ofputil_protocol
-read_flows_from_file(const char *filename, struct flow_tables *tables,
-                     int index)
+read_flows_from_file(const char *filename, struct fte_state *state, int index)
 {
     enum ofputil_protocol usable_protocols;
     int line_number;
@@ -2871,14 +3746,14 @@ read_flows_from_file(const char *filename, struct flow_tables *tables,
     ds_init(&s);
     usable_protocols = OFPUTIL_P_ANY;
     line_number = 0;
-    flow_tables_defer(tables);
     while (!ds_get_preprocessed_line(&s, file, &line_number)) {
         struct fte_version *version;
         struct ofputil_flow_mod fm;
         char *error;
         enum ofputil_protocol usable;
 
-        error = parse_ofp_str(&fm, OFPFC_ADD, ds_cstr(&s), &usable);
+        error = parse_ofp_str(&fm, OFPFC_ADD, ds_cstr(&s), state->port_map,
+                              state->table_map, &usable);
         if (error) {
             ovs_fatal(0, "%s:%d: %s", filename, line_number, error);
         }
@@ -2895,9 +3770,10 @@ read_flows_from_file(const char *filename, struct flow_tables *tables,
         version->ofpacts_len = fm.ofpacts_len;
         version->table_id = fm.table_id != OFPTT_ALL ? fm.table_id : 0;
 
-        fte_insert(tables, &fm.match, fm.priority, version, index);
+        fte_queue(state, &fm.match, fm.priority, version, index);
+
+        minimatch_destroy(&fm.match);
     }
-    flow_tables_publish(tables);
     ds_destroy(&s);
 
     if (file != stdin) {
@@ -2907,73 +3783,15 @@ read_flows_from_file(const char *filename, struct flow_tables *tables,
     return usable_protocols;
 }
 
-static bool
-recv_flow_stats_reply(struct vconn *vconn, ovs_be32 send_xid,
-                      struct ofpbuf **replyp,
-                      struct ofputil_flow_stats *fs, struct ofpbuf *ofpacts)
-{
-    struct ofpbuf *reply = *replyp;
-
-    for (;;) {
-        int retval;
-        bool more;
-
-        /* Get a flow stats reply message, if we don't already have one. */
-        if (!reply) {
-            enum ofptype type;
-            enum ofperr error;
-
-            do {
-                run(vconn_recv_block(vconn, &reply),
-                    "OpenFlow packet receive failed");
-            } while (((struct ofp_header *) reply->data)->xid != send_xid);
-
-            error = ofptype_decode(&type, reply->data);
-            if (error || type != OFPTYPE_FLOW_STATS_REPLY) {
-                ovs_fatal(0, "received bad reply: %s",
-                          ofp_to_string(reply->data, reply->size,
-                                        verbosity + 1));
-            }
-        }
-
-        /* Pull an individual flow stats reply out of the message. */
-        retval = ofputil_decode_flow_stats_reply(fs, reply, false, ofpacts);
-        switch (retval) {
-        case 0:
-            *replyp = reply;
-            return true;
-
-        case EOF:
-            more = ofpmp_more(reply->header);
-            ofpbuf_delete(reply);
-            reply = NULL;
-            if (!more) {
-                *replyp = NULL;
-                return false;
-            }
-            break;
-
-        default:
-            ovs_fatal(0, "parse error in reply (%s)",
-                      ofperr_to_string(retval));
-        }
-    }
-}
-
 /* Reads the OpenFlow flow table from 'vconn', which has currently active flow
  * format 'protocol', and adds them as flow table entries in 'tables' for the
  * version with the specified 'index'. */
 static void
 read_flows_from_switch(struct vconn *vconn,
                        enum ofputil_protocol protocol,
-                       struct flow_tables *tables, int index)
+                       struct fte_state *state, int index)
 {
     struct ofputil_flow_stats_request fsr;
-    struct ofputil_flow_stats fs;
-    struct ofpbuf *request;
-    struct ofpbuf ofpacts;
-    struct ofpbuf *reply;
-    ovs_be32 send_xid;
 
     fsr.aggregate = false;
     match_init_catchall(&fsr.match);
@@ -2981,30 +3799,35 @@ read_flows_from_switch(struct vconn *vconn,
     fsr.out_group = OFPG_ANY;
     fsr.table_id = 0xff;
     fsr.cookie = fsr.cookie_mask = htonll(0);
-    request = ofputil_encode_flow_stats_request(&fsr, protocol);
-    send_xid = ((struct ofp_header *) request->data)->xid;
-    send_openflow_buffer(vconn, request);
 
-    reply = NULL;
-    ofpbuf_init(&ofpacts, 0);
-    flow_tables_defer(tables);
-    while (recv_flow_stats_reply(vconn, send_xid, &reply, &fs, &ofpacts)) {
+    struct ofputil_flow_stats *fses;
+    size_t n_fses;
+    run(vconn_dump_flows(vconn, &fsr, protocol, &fses, &n_fses),
+        "dump flows");
+    for (size_t i = 0; i < n_fses; i++) {
+        const struct ofputil_flow_stats *fs = &fses[i];
         struct fte_version *version;
 
         version = xmalloc(sizeof *version);
-        version->cookie = fs.cookie;
-        version->idle_timeout = fs.idle_timeout;
-        version->hard_timeout = fs.hard_timeout;
-        version->importance = fs.importance;
+        version->cookie = fs->cookie;
+        version->idle_timeout = fs->idle_timeout;
+        version->hard_timeout = fs->hard_timeout;
+        version->importance = fs->importance;
         version->flags = 0;
-        version->ofpacts_len = fs.ofpacts_len;
-        version->ofpacts = xmemdup(fs.ofpacts, fs.ofpacts_len);
-        version->table_id = fs.table_id;
+        version->ofpacts_len = fs->ofpacts_len;
+        version->ofpacts = xmemdup(fs->ofpacts, fs->ofpacts_len);
+        version->table_id = fs->table_id;
 
-        fte_insert(tables, &fs.match, fs.priority, version, index);
+        struct minimatch match;
+        minimatch_init(&match, &fs->match);
+        fte_queue(state, &match, fs->priority, version, index);
+        minimatch_destroy(&match);
     }
-    flow_tables_publish(tables);
-    ofpbuf_uninit(&ofpacts);
+
+    for (size_t i = 0; i < n_fses; i++) {
+        free(CONST_CAST(struct ofpact *, fses[i].ofpacts));
+    }
+    free(fses);
 }
 
 static void
@@ -3027,9 +3850,8 @@ fte_make_flow_mod(const struct fte *fte, int index, uint16_t command,
         .out_port = OFPP_ANY,
         .out_group = OFPG_ANY,
         .flags = version->flags,
-        .delete_reason = OFPRR_DELETE,
     };
-    minimatch_expand(&fte->rule.match, &fm.match);
+    minimatch_clone(&fm.match, &fte->rule.match);
     if (command == OFPFC_ADD || command == OFPFC_MODIFY ||
         command == OFPFC_MODIFY_STRICT) {
         fm.ofpacts = version->ofpacts;
@@ -3038,29 +3860,35 @@ fte_make_flow_mod(const struct fte *fte, int index, uint16_t command,
         fm.ofpacts = NULL;
         fm.ofpacts_len = 0;
     }
-
     ofm = ofputil_encode_flow_mod(&fm, protocol);
+    minimatch_destroy(&fm.match);
+
     ovs_list_push_back(packets, &ofm->list_node);
 }
 
 static void
 ofctl_replace_flows(struct ovs_cmdl_context *ctx)
 {
-    enum { FILE_IDX = 0, SWITCH_IDX = 1 };
+    enum { FILE_IDX = 0,  SWITCH_IDX = 1 };
     enum ofputil_protocol usable_protocols, protocol;
+    struct fte_state fte_state;
     struct flow_tables tables;
     struct classifier *cls;
     struct ovs_list requests;
     struct vconn *vconn;
     struct fte *fte;
 
-    flow_tables_init(&tables);
-    usable_protocols = read_flows_from_file(ctx->argv[2], &tables, FILE_IDX);
+    fte_state_init(&fte_state);
+    fte_state.port_map = ports_to_accept(ctx->argv[1]);
+    fte_state.table_map = tables_to_accept(ctx->argv[1]);
+    usable_protocols = read_flows_from_file(ctx->argv[2], &fte_state, FILE_IDX);
 
     protocol = open_vconn(ctx->argv[1], &vconn);
     protocol = set_protocol_for_flow_dump(vconn, protocol, usable_protocols);
 
-    read_flows_from_switch(vconn, protocol, &tables, SWITCH_IDX);
+    read_flows_from_switch(vconn, protocol, &fte_state, SWITCH_IDX);
+
+    fte_fill(&fte_state, &tables);
 
     ovs_list_init(&requests);
 
@@ -3099,25 +3927,29 @@ ofctl_replace_flows(struct ovs_cmdl_context *ctx)
     vconn_close(vconn);
 
     fte_free_all(&tables);
+    fte_state_destroy(&fte_state);
 }
 
 static void
-read_flows_from_source(const char *source, struct flow_tables *tables,
-                       int index)
+read_flows_from_source(const char *source, struct fte_state *state, int index)
 {
     struct stat s;
 
     if (source[0] == '/' || source[0] == '.'
         || (!strchr(source, ':') && !stat(source, &s))) {
-        read_flows_from_file(source, tables, index);
+        read_flows_from_file(source, state, index);
     } else {
         enum ofputil_protocol protocol;
         struct vconn *vconn;
 
         protocol = open_vconn(source, &vconn);
         protocol = set_protocol_for_flow_dump(vconn, protocol, OFPUTIL_P_ANY);
-        read_flows_from_switch(vconn, protocol, tables, index);
+        read_flows_from_switch(vconn, protocol, state, index);
         vconn_close(vconn);
+
+        if (!state->port_map) {
+            state->port_map = ports_to_show(source);
+        }
     }
 }
 
@@ -3125,14 +3957,16 @@ static void
 ofctl_diff_flows(struct ovs_cmdl_context *ctx)
 {
     bool differences = false;
+    struct fte_state fte_state;
     struct flow_tables tables;
     struct classifier *cls;
     struct ds a_s, b_s;
     struct fte *fte;
 
-    flow_tables_init(&tables);
-    read_flows_from_source(ctx->argv[1], &tables, 0);
-    read_flows_from_source(ctx->argv[2], &tables, 1);
+    fte_state_init(&fte_state);
+    read_flows_from_source(ctx->argv[1], &fte_state, 0);
+    read_flows_from_source(ctx->argv[2], &fte_state, 1);
+    fte_fill(&fte_state, &tables);
 
     ds_init(&a_s);
     ds_init(&b_s);
@@ -3143,17 +3977,15 @@ ofctl_diff_flows(struct ovs_cmdl_context *ctx)
             struct fte_version *b = fte->versions[1];
 
             if (!a || !b || !fte_version_equals(a, b)) {
-                fte_version_format(fte, 0, &a_s);
-                fte_version_format(fte, 1, &b_s);
-                if (strcmp(ds_cstr(&a_s), ds_cstr(&b_s))) {
-                    if (a_s.length) {
-                        printf("-%s", ds_cstr(&a_s));
-                    }
-                    if (b_s.length) {
-                        printf("+%s", ds_cstr(&b_s));
-                    }
-                    differences = true;
+                fte_version_format(&fte_state, fte, 0, &a_s);
+                fte_version_format(&fte_state, fte, 1, &b_s);
+                if (a_s.length) {
+                    printf("-%s", ds_cstr(&a_s));
+                }
+                if (b_s.length) {
+                    printf("+%s", ds_cstr(&b_s));
                 }
+                differences = true;
             }
         }
     }
@@ -3162,6 +3994,7 @@ ofctl_diff_flows(struct ovs_cmdl_context *ctx)
     ds_destroy(&b_s);
 
     fte_free_all(&tables);
+    fte_state_destroy(&fte_state);
 
     if (differences) {
         exit(2);
@@ -3187,11 +4020,13 @@ ofctl_meter_mod__(const char *bridge, const char *str, int command)
         usable_protocols = OFPUTIL_P_OF13_UP;
         mm.command = command;
         mm.meter.meter_id = OFPM13_ALL;
+        mm.meter.bands = NULL;
     }
 
     protocol = open_vconn_for_flow_mod(bridge, &vconn, usable_protocols);
     version = ofputil_protocol_to_ofp_version(protocol);
     transact_noreply(vconn, ofputil_encode_meter_mod(version, &mm));
+    free(mm.meter.bands);
     vconn_close(vconn);
 }
 
@@ -3214,12 +4049,14 @@ ofctl_meter_request__(const char *bridge, const char *str,
     } else {
         usable_protocols = OFPUTIL_P_OF13_UP;
         mm.meter.meter_id = OFPM13_ALL;
+        mm.meter.bands = NULL;
     }
 
     protocol = open_vconn_for_flow_mod(bridge, &vconn, usable_protocols);
     version = ofputil_protocol_to_ofp_version(protocol);
     dump_transaction(vconn, ofputil_encode_meter_request(version, type,
                                                          mm.meter.meter_id));
+    free(mm.meter.bands);
     vconn_close(vconn);
 }
 
@@ -3295,10 +4132,11 @@ ofctl_parse_flows__(struct ofputil_flow_mod *fms, size_t n_fms,
         struct ofpbuf *msg;
 
         msg = ofputil_encode_flow_mod(fm, protocol);
-        ofp_print(stdout, msg->data, msg->size, verbosity);
+        ofp_print(stdout, msg->data, msg->size, NULL, NULL, verbosity);
         ofpbuf_delete(msg);
 
         free(CONST_CAST(struct ofpact *, fm->ofpacts));
+        minimatch_destroy(&fm->match);
     }
 }
 
@@ -3311,7 +4149,8 @@ ofctl_parse_flow(struct ovs_cmdl_context *ctx)
     struct ofputil_flow_mod fm;
     char *error;
 
-    error = parse_ofp_flow_mod_str(&fm, ctx->argv[1], OFPFC_ADD, &usable_protocols);
+    error = parse_ofp_flow_mod_str(&fm, ctx->argv[1], NULL, NULL,
+                                   OFPFC_ADD, &usable_protocols);
     if (error) {
         ovs_fatal(0, "%s", error);
     }
@@ -3328,8 +4167,8 @@ ofctl_parse_flows(struct ovs_cmdl_context *ctx)
     size_t n_fms = 0;
     char *error;
 
-    error = parse_ofp_flow_mod_file(ctx->argv[1], OFPFC_ADD, &fms, &n_fms,
-                                    &usable_protocols);
+    error = parse_ofp_flow_mod_file(ctx->argv[1], NULL, NULL, OFPFC_ADD,
+                                    &fms, &n_fms, &usable_protocols);
     if (error) {
         ovs_fatal(0, "%s", error);
     }
@@ -3337,6 +4176,44 @@ ofctl_parse_flows(struct ovs_cmdl_context *ctx)
     free(fms);
 }
 
+/* "parse-group GROUP": parses the argument as a group (like add-group) and
+ * prints it back to stdout.  */
+static void
+ofctl_parse_group(struct ovs_cmdl_context *ctx)
+{
+    enum ofputil_protocol usable_protocols;
+    struct ofputil_group_mod gm;
+    char *error = parse_ofp_group_mod_str(&gm, OFPGC11_ADD, ctx->argv[1], NULL,
+                                          NULL, &usable_protocols);
+    if (error) {
+        ovs_fatal(0, "%s", error);
+    }
+
+    char *usable_s = ofputil_protocols_to_string(usable_protocols);
+    printf("usable protocols: %s\n", usable_s);
+    free(usable_s);
+
+    if (!(usable_protocols & allowed_protocols)) {
+        ovs_fatal(0, "no usable protocol");
+    }
+    enum ofputil_protocol protocol = 0;
+    for (int i = 0; i < sizeof(enum ofputil_protocol) * CHAR_BIT; i++) {
+        protocol = 1 << i;
+        if (protocol & usable_protocols & allowed_protocols) {
+            break;
+        }
+    }
+
+    enum ofp_version version = ofputil_protocol_to_ofp_version(protocol);
+    printf("chosen version: %s\n", ofputil_version_to_string(version));
+
+    struct ofpbuf *msg = ofputil_encode_group_mod(version, &gm, NULL, false);
+    ofp_print(stdout, msg->data, msg->size, NULL, NULL, verbosity);
+    ofpbuf_delete(msg);
+
+    ofputil_uninit_group_mod(&gm);
+}
+
 static void
 ofctl_parse_nxm__(bool oxm, enum ofp_version version)
 {
@@ -3361,17 +4238,18 @@ ofctl_parse_nxm__(bool oxm, enum ofp_version version)
         /* Convert nx_match to match. */
         if (strict) {
             if (oxm) {
-                error = oxm_pull_match(&nx_match, &match);
+                error = oxm_pull_match(&nx_match, false, NULL, NULL, &match);
             } else {
-                error = nx_pull_match(&nx_match, match_len, &match,
-                                      &cookie, &cookie_mask);
+                error = nx_pull_match(&nx_match, match_len, &match, &cookie,
+                                      &cookie_mask, false, NULL, NULL);
             }
         } else {
             if (oxm) {
-                error = oxm_pull_match_loose(&nx_match, &match);
+                error = oxm_pull_match_loose(&nx_match, false, NULL, &match);
             } else {
                 error = nx_pull_match_loose(&nx_match, match_len, &match,
-                                            &cookie, &cookie_mask);
+                                            &cookie, &cookie_mask, false,
+                                            NULL);
             }
         }
 
@@ -3496,18 +4374,19 @@ ofctl_parse_actions__(const char *version_s, bool instructions)
         error = (instructions
                  ? ofpacts_pull_openflow_instructions
                  : ofpacts_pull_openflow_actions)(
-                     &of_in, of_in.size, version, &ofpacts);
+                     &of_in, of_in.size, version, NULL, NULL, &ofpacts);
         if (!error && instructions) {
             /* Verify actions, enforce consistency. */
-            enum ofputil_protocol protocol;
-            struct flow flow;
-
-            memset(&flow, 0, sizeof flow);
-            protocol = ofputil_protocols_from_ofp_version(version);
-            error = ofpacts_check_consistency(ofpacts.data, ofpacts.size,
-                                              &flow, OFPP_MAX,
-                                              table_id ? atoi(table_id) : 0,
-                                              OFPTT_MAX + 1, protocol);
+            struct match match = MATCH_CATCHALL_INITIALIZER;
+            struct ofpact_check_params cp = {
+                .match = &match,
+                .max_ports = OFPP_MAX,
+                .table_id = table_id ? atoi(table_id) : 0,
+                .n_tables = OFPTT_MAX + 1,
+            };
+            error = ofpacts_check_consistency(
+                ofpacts.data, ofpacts.size,
+                ofputil_protocols_from_ofp_version(version), &cp);
         }
         if (error) {
             printf("bad %s %s: %s\n\n",
@@ -3522,7 +4401,8 @@ ofctl_parse_actions__(const char *version_s, bool instructions)
         /* Print cls_rule. */
         ds_init(&s);
         ds_put_cstr(&s, "actions=");
-        ofpacts_format(ofpacts.data, ofpacts.size, &s);
+        struct ofpact_format_params fp = { .s = &s };
+        ofpacts_format(ofpacts.data, ofpacts.size, &fp);
         puts(ds_cstr(&s));
         ds_destroy(&s);
 
@@ -3625,7 +4505,7 @@ ofctl_parse_ofp10_match(struct ovs_cmdl_context *ctx OVS_UNUSED)
 
         /* Convert to cls_rule and print. */
         ofputil_match_from_ofp10_match(match_in.data, &match);
-        match_print(&match);
+        match_print(&match, NULL);
 
         /* Convert back to ofp10_match and print differences from input. */
         ofputil_match_to_ofp10_match(&match, &match_out);
@@ -3681,7 +4561,7 @@ ofctl_parse_ofp11_match(struct ovs_cmdl_context *ctx OVS_UNUSED)
         }
 
         /* Print match. */
-        match_print(&match);
+        match_print(&match, NULL);
 
         /* Convert back to ofp11_match and print differences from input. */
         ofputil_match_to_ofp11_match(&match, &match_out);
@@ -3703,7 +4583,7 @@ ofctl_parse_pcap(struct ovs_cmdl_context *ctx)
     int error = 0;
     for (int i = 1; i < ctx->argc; i++) {
         const char *filename = ctx->argv[i];
-        FILE *pcap = ovs_pcap_open(filename, "rb");
+        struct pcap_file *pcap = ovs_pcap_open(filename, "rb");
         if (!pcap) {
             error = errno;
             ovs_error(error, "%s: open failed", filename);
@@ -3721,15 +4601,16 @@ ofctl_parse_pcap(struct ovs_cmdl_context *ctx)
             } else if (retval) {
                 error = retval;
                 ovs_error(error, "%s: read failed", filename);
+                break;
             }
 
-            pkt_metadata_init(&packet->md, ODPP_NONE);
+            pkt_metadata_init(&packet->md, u32_to_odp(ofp_to_u16(OFPP_ANY)));
             flow_extract(packet, &flow);
-            flow_print(stdout, &flow);
+            flow_print(stdout, &flow, NULL);
             putchar('\n');
             dp_packet_delete(packet);
         }
-        fclose(pcap);
+        ovs_pcap_close(pcap);
     }
     exit(error);
 }
@@ -3761,34 +4642,38 @@ ofctl_check_vlan(struct ovs_cmdl_context *ctx)
     enum ofputil_protocol usable_protocols; /* Unused for now. */
 
     match_init_catchall(&match);
-    match.flow.vlan_tci = htons(strtoul(ctx->argv[1], NULL, 16));
-    match.wc.masks.vlan_tci = htons(strtoul(ctx->argv[2], NULL, 16));
+    match.flow.vlans[0].tci = htons(strtoul(ctx->argv[1], NULL, 16));
+    match.wc.masks.vlans[0].tci = htons(strtoul(ctx->argv[2], NULL, 16));
 
     /* Convert to and from string. */
-    string_s = match_to_string(&match, OFP_DEFAULT_PRIORITY);
+    string_s = match_to_string(&match, NULL, OFP_DEFAULT_PRIORITY);
     printf("%s -> ", string_s);
     fflush(stdout);
-    error_s = parse_ofp_str(&fm, -1, string_s, &usable_protocols);
+    error_s = parse_ofp_str(&fm, -1, string_s, NULL, NULL, &usable_protocols);
     if (error_s) {
         ovs_fatal(0, "%s", error_s);
     }
+    struct match fm_match;
+    minimatch_expand(&fm.match, &fm_match);
     printf("%04"PRIx16"/%04"PRIx16"\n",
-           ntohs(fm.match.flow.vlan_tci),
-           ntohs(fm.match.wc.masks.vlan_tci));
+           ntohs(fm_match.flow.vlans[0].tci),
+           ntohs(fm_match.wc.masks.vlans[0].tci));
     free(string_s);
+    minimatch_destroy(&fm.match);
 
     /* Convert to and from NXM. */
     ofpbuf_init(&nxm, 0);
     nxm_match_len = nx_put_match(&nxm, &match, htonll(0), htonll(0));
     nxm_s = nx_match_to_string(nxm.data, nxm_match_len);
-    error = nx_pull_match(&nxm, nxm_match_len, &nxm_match, NULL, NULL);
+    error = nx_pull_match(&nxm, nxm_match_len, &nxm_match, NULL, NULL, false,
+                          NULL, NULL);
     printf("NXM: %s -> ", nxm_s);
     if (error) {
         printf("%s\n", ofperr_to_string(error));
     } else {
         printf("%04"PRIx16"/%04"PRIx16"\n",
-               ntohs(nxm_match.flow.vlan_tci),
-               ntohs(nxm_match.wc.masks.vlan_tci));
+               ntohs(nxm_match.flow.vlans[0].tci),
+               ntohs(nxm_match.wc.masks.vlans[0].tci));
     }
     free(nxm_s);
     ofpbuf_uninit(&nxm);
@@ -3797,19 +4682,19 @@ ofctl_check_vlan(struct ovs_cmdl_context *ctx)
     ofpbuf_init(&nxm, 0);
     nxm_match_len = oxm_put_match(&nxm, &match, OFP12_VERSION);
     nxm_s = oxm_match_to_string(&nxm, nxm_match_len);
-    error = oxm_pull_match(&nxm, &nxm_match);
+    error = oxm_pull_match(&nxm, false, NULL, NULL, &nxm_match);
     printf("OXM: %s -> ", nxm_s);
     if (error) {
         printf("%s\n", ofperr_to_string(error));
     } else {
-        uint16_t vid = ntohs(nxm_match.flow.vlan_tci) &
+        uint16_t vid = ntohs(nxm_match.flow.vlans[0].tci) &
             (VLAN_VID_MASK | VLAN_CFI);
-        uint16_t mask = ntohs(nxm_match.wc.masks.vlan_tci) &
+        uint16_t mask = ntohs(nxm_match.wc.masks.vlans[0].tci) &
             (VLAN_VID_MASK | VLAN_CFI);
 
         printf("%04"PRIx16"/%04"PRIx16",", vid, mask);
-        if (vid && vlan_tci_to_pcp(nxm_match.wc.masks.vlan_tci)) {
-            printf("%02"PRIx8"\n", vlan_tci_to_pcp(nxm_match.flow.vlan_tci));
+        if (vid && vlan_tci_to_pcp(nxm_match.wc.masks.vlans[0].tci)) {
+            printf("%02d\n", vlan_tci_to_pcp(nxm_match.flow.vlans[0].tci));
         } else {
             printf("--\n");
         }
@@ -3825,8 +4710,8 @@ ofctl_check_vlan(struct ovs_cmdl_context *ctx)
            (of10_raw.wildcards & htonl(OFPFW10_DL_VLAN)) != 0,
            of10_raw.dl_vlan_pcp,
            (of10_raw.wildcards & htonl(OFPFW10_DL_VLAN_PCP)) != 0,
-           ntohs(of10_match.flow.vlan_tci),
-           ntohs(of10_match.wc.masks.vlan_tci));
+           ntohs(of10_match.flow.vlans[0].tci),
+           ntohs(of10_match.wc.masks.vlans[0].tci));
 
     /* Convert to and from OpenFlow 1.1. */
     ofputil_match_to_ofp11_match(&match, &of11_raw);
@@ -3836,8 +4721,8 @@ ofctl_check_vlan(struct ovs_cmdl_context *ctx)
            (of11_raw.wildcards & htonl(OFPFW11_DL_VLAN)) != 0,
            of11_raw.dl_vlan_pcp,
            (of11_raw.wildcards & htonl(OFPFW11_DL_VLAN_PCP)) != 0,
-           ntohs(of11_match.flow.vlan_tci),
-           ntohs(of11_match.wc.masks.vlan_tci));
+           ntohs(of11_match.flow.vlans[0].tci),
+           ntohs(of11_match.wc.masks.vlans[0].tci));
 }
 
 /* "print-error ENUM": Prints the type and code of ENUM for every OpenFlow
@@ -3902,43 +4787,49 @@ ofctl_encode_error_reply(struct ovs_cmdl_context *ctx)
     ofpbuf_delete(reply);
 }
 
-/* "ofp-print HEXSTRING [VERBOSITY]": Converts the hex digits in HEXSTRING into
- * binary data, interpreting them as an OpenFlow message, and prints the
- * OpenFlow message on stdout, at VERBOSITY (level 2 by default).
+/* Usage:
+ *    ofp-print HEXSTRING [VERBOSITY]
+ *    ofp-print - [VERBOSITY] < HEXSTRING_FILE
+ *    ofp-print --raw - [VERBOSITY] < RAW_FILE
  *
- * Alternative usage: "ofp-print [VERBOSITY] - < HEXSTRING_FILE", where
- * HEXSTRING_FILE contains the HEXSTRING. */
+ * Converts the hex digits in HEXSTRING into binary data, interpreting them as
+ * an OpenFlow message, and prints the OpenFlow message on stdout, at VERBOSITY
+ * (level 2 by default).  With -, hex data is read from HEXSTRING_FILE, and
+ * with --raw -, raw binary data is read from RAW_FILE. */
 static void
 ofctl_ofp_print(struct ovs_cmdl_context *ctx)
 {
-    struct ofpbuf packet;
-    char *buffer;
-    int verbosity = 2;
-    struct ds line;
+    int verbosity_ = ctx->argc > 2 ? atoi(ctx->argv[2]) : 2;
 
-    ds_init(&line);
-
-    if (!strcmp(ctx->argv[ctx->argc-1], "-")) {
-        if (ds_get_line(&line, stdin)) {
-           VLOG_FATAL("Failed to read stdin");
+    struct ofpbuf packet;
+    ofpbuf_init(&packet, 0);
+
+    char *buffer = NULL;
+    if (!strcmp(ctx->argv[1], "-")) {
+        if (raw) {
+            for (;;) {
+                int c = getchar();
+                if (c == EOF) {
+                    break;
+                }
+                ofpbuf_put(&packet, &c, 1);
+            }
+        } else {
+            struct ds line = DS_EMPTY_INITIALIZER;
+            if (ds_get_line(&line, stdin)) {
+                VLOG_FATAL("Failed to read stdin");
+            }
+            buffer = ds_steal_cstr(&line);
         }
-
-        buffer = line.string;
-        verbosity = ctx->argc > 2 ? atoi(ctx->argv[1]) : verbosity;
-    } else if (ctx->argc > 2) {
-        buffer = ctx->argv[1];
-        verbosity = atoi(ctx->argv[2]);
-    } else {
-        buffer = ctx->argv[1];
+    } else  {
+        buffer = xstrdup(ctx->argv[1]);
     }
-
-    ofpbuf_init(&packet, strlen(buffer) / 2);
-    if (ofpbuf_put_hex(&packet, buffer, NULL)[0] != '\0') {
+    if (buffer && ofpbuf_put_hex(&packet, buffer, NULL)[0] != '\0') {
         ovs_fatal(0, "trailing garbage following hex bytes");
     }
-    ofp_print(stdout, packet.data, packet.size, verbosity);
+    free(buffer);
+    ofp_print(stdout, packet.data, packet.size, NULL, NULL, verbosity_);
     ofpbuf_uninit(&packet);
-    ds_destroy(&line);
 }
 
 /* "encode-hello BITMAP...": Encodes each BITMAP as an OpenFlow hello message
@@ -3951,132 +4842,255 @@ ofctl_encode_hello(struct ovs_cmdl_context *ctx)
 
     hello = ofputil_encode_hello(bitmap);
     ovs_hex_dump(stdout, hello->data, hello->size, 0, false);
-    ofp_print(stdout, hello->data, hello->size, verbosity);
+    ofp_print(stdout, hello->data, hello->size, NULL, NULL, verbosity);
     ofpbuf_delete(hello);
 }
 
+static void
+ofctl_parse_key_value(struct ovs_cmdl_context *ctx)
+{
+    for (size_t i = 1; i < ctx->argc; i++) {
+        char *s = ctx->argv[i];
+        char *key, *value;
+        int j = 0;
+        while (ofputil_parse_key_value(&s, &key, &value)) {
+            if (j++) {
+                fputs(", ", stdout);
+            }
+            fputs(key, stdout);
+            if (value[0]) {
+                printf("=%s", value);
+            }
+        }
+        putchar('\n');
+    }
+}
+
+/* "compose-packet [--pcap] FLOW [L7]": Converts the OpenFlow flow
+ * specification FLOW to a packet with flow_compose() and prints the hex bytes
+ * in the packet on stdout.  Also verifies that the flow extracted from that
+ * packet matches the original FLOW.
+ *
+ * With --pcap, prints the packet to stdout instead as a pcap file, so that you
+ * can do something like "ovs-ofctl --pcap compose-packet udp | tcpdump -vvvv
+ * -r-" to use another tool to dump the packet contents.
+ *
+ * If L7 is specified, draws the L7 payload data from it, otherwise defaults to
+ * 64 bytes of payload. */
+static void
+ofctl_compose_packet(struct ovs_cmdl_context *ctx)
+{
+    if (print_pcap && isatty(STDOUT_FILENO)) {
+        ovs_fatal(1, "not writing pcap data to stdout; redirect to a file "
+                  "or pipe to tcpdump instead");
+    }
+
+    struct flow flow1;
+    char *error = parse_ofp_exact_flow(&flow1, NULL, NULL, ctx->argv[1], NULL);
+    if (error) {
+        ovs_fatal(0, "%s", error);
+    }
+
+    struct dp_packet p;
+    memset(&p, 0, sizeof p);
+    dp_packet_init(&p, 0);
+
+    void *l7 = NULL;
+    size_t l7_len = 64;
+    if (ctx->argc > 2) {
+        struct dp_packet payload;
+        memset(&payload, 0, sizeof payload);
+        dp_packet_init(&payload, 0);
+        if (dp_packet_put_hex(&payload, ctx->argv[2], NULL)[0] != '\0') {
+            ovs_fatal(0, "%s: trailing garbage in packet data", ctx->argv[2]);
+        }
+        l7_len = dp_packet_size(&payload);
+        l7 = dp_packet_steal_data(&payload);
+    }
+    flow_compose(&p, &flow1, l7, l7_len);
+    free(l7);
+
+    if (print_pcap) {
+        struct pcap_file *p_file = ovs_pcap_stdout();
+        ovs_pcap_write_header(p_file);
+        ovs_pcap_write(p_file, &p);
+        ovs_pcap_close(p_file);
+    } else {
+        ovs_hex_dump(stdout, dp_packet_data(&p), dp_packet_size(&p), 0, false);
+    }
+
+    struct flow flow2;
+    flow_extract(&p, &flow2);
+    flow2.in_port.ofp_port = OFPP_ANY;
+
+    dp_packet_uninit(&p);
+
+    if (!flow_equal(&flow1, &flow2)) {
+        fprintf(stderr, "specified and extracted flows differ:\n");
+        fputs("specified: ", stderr);
+        flow_print(stderr, &flow1, NULL);
+        fputs("\nextracted: ", stderr);
+        flow_print(stderr, &flow2, NULL);
+        exit(1);
+    }
+}
+
+/* "parse-packet" reads an Ethernet packet from stdin and prints it out its
+ * extracted flow fields. */
+static void
+ofctl_parse_packet(struct ovs_cmdl_context *ctx OVS_UNUSED)
+{
+    char packet[65535];
+    ssize_t size = read(STDIN_FILENO, packet, sizeof packet);
+    if (size < 0) {
+        ovs_fatal(errno, "failed to read packet from stdin");
+    }
+
+    /* Make a copy of the packet in allocated memory to better allow Valgrind
+     * and Address Sanitizer to catch out-of-range access. */
+    void *packet_copy = xmemdup(packet, size);
+    ofp_print_packet(stdout, packet_copy, size, 0);
+    free(packet_copy);
+}
+
 static const struct ovs_cmdl_command all_commands[] = {
     { "show", "switch",
-      1, 1, ofctl_show },
+      1, 1, ofctl_show, OVS_RO },
     { "monitor", "switch [misslen] [invalid_ttl] [watch:[...]]",
-      1, 3, ofctl_monitor },
+      1, 3, ofctl_monitor, OVS_RO },
     { "snoop", "switch",
-      1, 1, ofctl_snoop },
+      1, 1, ofctl_snoop, OVS_RO },
     { "dump-desc", "switch",
-      1, 1, ofctl_dump_desc },
+      1, 1, ofctl_dump_desc, OVS_RO },
     { "dump-tables", "switch",
-      1, 1, ofctl_dump_tables },
+      1, 1, ofctl_dump_tables, OVS_RO },
     { "dump-table-features", "switch",
-      1, 1, ofctl_dump_table_features },
+      1, 1, ofctl_dump_table_features, OVS_RO },
     { "dump-table-desc", "switch",
-      1, 1, ofctl_dump_table_desc },
+      1, 1, ofctl_dump_table_desc, OVS_RO },
     { "dump-flows", "switch",
-      1, 2, ofctl_dump_flows },
+      1, 2, ofctl_dump_flows, OVS_RO },
     { "dump-aggregate", "switch",
-      1, 2, ofctl_dump_aggregate },
+      1, 2, ofctl_dump_aggregate, OVS_RO },
     { "queue-stats", "switch [port [queue]]",
-      1, 3, ofctl_queue_stats },
+      1, 3, ofctl_queue_stats, OVS_RO },
     { "queue-get-config", "switch [port [queue]]",
-      1, 3, ofctl_queue_get_config },
+      1, 3, ofctl_queue_get_config, OVS_RO },
     { "add-flow", "switch flow",
-      2, 2, ofctl_add_flow },
+      2, 2, ofctl_add_flow, OVS_RW },
     { "add-flows", "switch file",
-      2, 2, ofctl_add_flows },
+      2, 2, ofctl_add_flows, OVS_RW },
     { "mod-flows", "switch flow",
-      2, 2, ofctl_mod_flows },
+      2, 2, ofctl_mod_flows, OVS_RW },
     { "del-flows", "switch [flow]",
-      1, 2, ofctl_del_flows },
+      1, 2, ofctl_del_flows, OVS_RW },
     { "replace-flows", "switch file",
-      2, 2, ofctl_replace_flows },
+      2, 2, ofctl_replace_flows, OVS_RW },
     { "diff-flows", "source1 source2",
-      2, 2, ofctl_diff_flows },
+      2, 2, ofctl_diff_flows, OVS_RW },
     { "add-meter", "switch meter",
-      2, 2, ofctl_add_meter },
+      2, 2, ofctl_add_meter, OVS_RW },
     { "mod-meter", "switch meter",
-      2, 2, ofctl_mod_meter },
+      2, 2, ofctl_mod_meter, OVS_RW },
     { "del-meter", "switch meter",
-      2, 2, ofctl_del_meters },
+      1, 2, ofctl_del_meters, OVS_RW },
     { "del-meters", "switch",
-      1, 1, ofctl_del_meters },
+      1, 2, ofctl_del_meters, OVS_RW },
     { "dump-meter", "switch meter",
-      2, 2, ofctl_dump_meters },
+      1, 2, ofctl_dump_meters, OVS_RO },
     { "dump-meters", "switch",
-      1, 1, ofctl_dump_meters },
+      1, 2, ofctl_dump_meters, OVS_RO },
     { "meter-stats", "switch [meter]",
-      1, 2, ofctl_meter_stats },
+      1, 2, ofctl_meter_stats, OVS_RO },
     { "meter-features", "switch",
-      1, 1, ofctl_meter_features },
-    { "packet-out", "switch in_port actions packet...",
-      4, INT_MAX, ofctl_packet_out },
+      1, 1, ofctl_meter_features, OVS_RO },
+    { "packet-out", "switch \"in_port=<port> packet=<hex data> actions=...\"",
+      2, INT_MAX, ofctl_packet_out, OVS_RW },
     { "dump-ports", "switch [port]",
-      1, 2, ofctl_dump_ports },
+      1, 2, ofctl_dump_ports, OVS_RO },
     { "dump-ports-desc", "switch [port]",
-      1, 2, ofctl_dump_ports_desc },
+      1, 2, ofctl_dump_ports_desc, OVS_RO },
     { "mod-port", "switch iface act",
-      3, 3, ofctl_mod_port },
+      3, 3, ofctl_mod_port, OVS_RW },
     { "mod-table", "switch mod",
-      3, 3, ofctl_mod_table },
+      3, 3, ofctl_mod_table, OVS_RW },
     { "get-frags", "switch",
-      1, 1, ofctl_get_frags },
+      1, 1, ofctl_get_frags, OVS_RO },
     { "set-frags", "switch frag_mode",
-      2, 2, ofctl_set_frags },
+      2, 2, ofctl_set_frags, OVS_RW },
     { "probe", "target",
-      1, 1, ofctl_probe },
+      1, 1, ofctl_probe, OVS_RO },
     { "ping", "target [n]",
-      1, 2, ofctl_ping },
+      1, 2, ofctl_ping, OVS_RO },
     { "benchmark", "target n count",
-      3, 3, ofctl_benchmark },
+      3, 3, ofctl_benchmark, OVS_RO },
+
+    { "dump-ipfix-bridge", "switch",
+      1, 1, ofctl_dump_ipfix_bridge, OVS_RO },
+    { "dump-ipfix-flow", "switch",
+      1, 1, ofctl_dump_ipfix_flow, OVS_RO },
+
+    { "ct-flush-zone", "switch zone",
+      2, 2, ofctl_ct_flush_zone, OVS_RO },
 
     { "ofp-parse", "file",
-      1, 1, ofctl_ofp_parse },
+      1, 1, ofctl_ofp_parse, OVS_RW },
     { "ofp-parse-pcap", "pcap",
-      1, INT_MAX, ofctl_ofp_parse_pcap },
+      1, INT_MAX, ofctl_ofp_parse_pcap, OVS_RW },
 
     { "add-group", "switch group",
-      1, 2, ofctl_add_group },
+      1, 2, ofctl_add_group, OVS_RW },
     { "add-groups", "switch file",
-      1, 2, ofctl_add_groups },
+      1, 2, ofctl_add_groups, OVS_RW },
     { "mod-group", "switch group",
-      1, 2, ofctl_mod_group },
+      1, 2, ofctl_mod_group, OVS_RW },
     { "del-groups", "switch [group]",
-      1, 2, ofctl_del_groups },
+      1, 2, ofctl_del_groups, OVS_RW },
     { "insert-buckets", "switch [group]",
-      1, 2, ofctl_insert_bucket },
+      1, 2, ofctl_insert_bucket, OVS_RW },
     { "remove-buckets", "switch [group]",
-      1, 2, ofctl_remove_bucket },
+      1, 2, ofctl_remove_bucket, OVS_RW },
     { "dump-groups", "switch [group]",
-      1, 2, ofctl_dump_group_desc },
+      1, 2, ofctl_dump_group_desc, OVS_RO },
     { "dump-group-stats", "switch [group]",
-      1, 2, ofctl_dump_group_stats },
+      1, 2, ofctl_dump_group_stats, OVS_RO },
     { "dump-group-features", "switch",
-      1, 1, ofctl_dump_group_features },
+      1, 1, ofctl_dump_group_features, OVS_RO },
+
+    { "bundle", "switch file",
+      2, 2, ofctl_bundle, OVS_RW },
+
     { "add-tlv-map", "switch map",
-      2, 2, ofctl_add_tlv_map },
+      2, 2, ofctl_add_tlv_map, OVS_RO },
     { "del-tlv-map", "switch [map]",
-      1, 2, ofctl_del_tlv_map },
+      1, 2, ofctl_del_tlv_map, OVS_RO },
     { "dump-tlv-map", "switch",
-      1, 1, ofctl_dump_tlv_map },
-    { "help", NULL, 0, INT_MAX, ofctl_help },
-    { "list-commands", NULL, 0, INT_MAX, ofctl_list_commands },
+      1, 1, ofctl_dump_tlv_map, OVS_RO },
+    { "help", NULL, 0, INT_MAX, ofctl_help, OVS_RO },
+    { "list-commands", NULL, 0, INT_MAX, ofctl_list_commands, OVS_RO },
 
     /* Undocumented commands for testing. */
-    { "parse-flow", NULL, 1, 1, ofctl_parse_flow },
-    { "parse-flows", NULL, 1, 1, ofctl_parse_flows },
-    { "parse-nx-match", NULL, 0, 0, ofctl_parse_nxm },
-    { "parse-nxm", NULL, 0, 0, ofctl_parse_nxm },
-    { "parse-oxm", NULL, 1, 1, ofctl_parse_oxm },
-    { "parse-actions", NULL, 1, 1, ofctl_parse_actions },
-    { "parse-instructions", NULL, 1, 1, ofctl_parse_instructions },
-    { "parse-ofp10-match", NULL, 0, 0, ofctl_parse_ofp10_match },
-    { "parse-ofp11-match", NULL, 0, 0, ofctl_parse_ofp11_match },
-    { "parse-pcap", NULL, 1, INT_MAX, ofctl_parse_pcap },
-    { "check-vlan", NULL, 2, 2, ofctl_check_vlan },
-    { "print-error", NULL, 1, 1, ofctl_print_error },
-    { "encode-error-reply", NULL, 2, 2, ofctl_encode_error_reply },
-    { "ofp-print", NULL, 1, 2, ofctl_ofp_print },
-    { "encode-hello", NULL, 1, 1, ofctl_encode_hello },
-
-    { NULL, NULL, 0, 0, NULL },
+    { "parse-flow", NULL, 1, 1, ofctl_parse_flow, OVS_RW },
+    { "parse-flows", NULL, 1, 1, ofctl_parse_flows, OVS_RW },
+    { "parse-group", NULL, 1, 1, ofctl_parse_group, OVS_RW },
+    { "parse-nx-match", NULL, 0, 0, ofctl_parse_nxm, OVS_RW },
+    { "parse-nxm", NULL, 0, 0, ofctl_parse_nxm, OVS_RW },
+    { "parse-oxm", NULL, 1, 1, ofctl_parse_oxm, OVS_RW },
+    { "parse-actions", NULL, 1, 1, ofctl_parse_actions, OVS_RW },
+    { "parse-instructions", NULL, 1, 1, ofctl_parse_instructions, OVS_RW },
+    { "parse-ofp10-match", NULL, 0, 0, ofctl_parse_ofp10_match, OVS_RW },
+    { "parse-ofp11-match", NULL, 0, 0, ofctl_parse_ofp11_match, OVS_RW },
+    { "parse-pcap", NULL, 1, INT_MAX, ofctl_parse_pcap, OVS_RW },
+    { "check-vlan", NULL, 2, 2, ofctl_check_vlan, OVS_RW },
+    { "print-error", NULL, 1, 1, ofctl_print_error, OVS_RW },
+    { "encode-error-reply", NULL, 2, 2, ofctl_encode_error_reply, OVS_RW },
+    { "ofp-print", NULL, 1, 2, ofctl_ofp_print, OVS_RW },
+    { "encode-hello", NULL, 1, 1, ofctl_encode_hello, OVS_RW },
+    { "parse-key-value", NULL, 1, INT_MAX, ofctl_parse_key_value, OVS_RW },
+    { "compose-packet", NULL, 1, 2, ofctl_compose_packet, OVS_RO },
+    { "parse-packet", NULL, 0, 0, ofctl_parse_packet, OVS_RO },
+
+    { NULL, NULL, 0, 0, NULL, OVS_RO },
 };
 
 static const struct ovs_cmdl_command *get_all_commands(void)