+ rule->wc.wildcards &= ~FWW_NW_PROTO;
+ rule->flow.nw_proto = nw_proto;
+}
+
+void
+cls_rule_set_nw_src(struct cls_rule *rule, ovs_be32 nw_src)
+{
+ rule->flow.nw_src = nw_src;
+ rule->wc.nw_src_mask = htonl(UINT32_MAX);
+}
+
+void
+cls_rule_set_nw_src_masked(struct cls_rule *rule,
+ ovs_be32 nw_src, ovs_be32 mask)
+{
+ rule->flow.nw_src = nw_src & mask;
+ rule->wc.nw_src_mask = mask;
+}
+
+void
+cls_rule_set_nw_dst(struct cls_rule *rule, ovs_be32 nw_dst)
+{
+ rule->flow.nw_dst = nw_dst;
+ rule->wc.nw_dst_mask = htonl(UINT32_MAX);
+}
+
+void
+cls_rule_set_nw_dst_masked(struct cls_rule *rule, ovs_be32 ip, ovs_be32 mask)
+{
+ rule->flow.nw_dst = ip & mask;
+ rule->wc.nw_dst_mask = mask;
+}
+
+void
+cls_rule_set_nw_dscp(struct cls_rule *rule, uint8_t nw_dscp)
+{
+ rule->wc.wildcards &= ~FWW_NW_DSCP;
+ rule->flow.nw_tos &= ~IP_DSCP_MASK;
+ rule->flow.nw_tos |= nw_dscp & IP_DSCP_MASK;
+}
+
+void
+cls_rule_set_nw_ecn(struct cls_rule *rule, uint8_t nw_ecn)
+{
+ rule->wc.wildcards &= ~FWW_NW_ECN;
+ rule->flow.nw_tos &= ~IP_ECN_MASK;
+ rule->flow.nw_tos |= nw_ecn & IP_ECN_MASK;
+}
+
+void
+cls_rule_set_nw_ttl(struct cls_rule *rule, uint8_t nw_ttl)
+{
+ rule->wc.wildcards &= ~FWW_NW_TTL;
+ rule->flow.nw_ttl = nw_ttl;
+}
+
+void
+cls_rule_set_nw_frag(struct cls_rule *rule, uint8_t nw_frag)
+{
+ rule->wc.nw_frag_mask |= FLOW_NW_FRAG_MASK;
+ rule->flow.nw_frag = nw_frag;
+}
+
+void
+cls_rule_set_nw_frag_masked(struct cls_rule *rule,
+ uint8_t nw_frag, uint8_t mask)
+{
+ rule->flow.nw_frag = nw_frag & mask;
+ rule->wc.nw_frag_mask = mask;
+}
+
+void
+cls_rule_set_icmp_type(struct cls_rule *rule, uint8_t icmp_type)
+{
+ cls_rule_set_tp_src(rule, htons(icmp_type));
+}
+
+void
+cls_rule_set_icmp_code(struct cls_rule *rule, uint8_t icmp_code)
+{
+ cls_rule_set_tp_dst(rule, htons(icmp_code));
+}
+
+void
+cls_rule_set_arp_sha(struct cls_rule *rule, const uint8_t sha[ETH_ADDR_LEN])
+{
+ rule->wc.wildcards &= ~FWW_ARP_SHA;
+ memcpy(rule->flow.arp_sha, sha, ETH_ADDR_LEN);
+}
+
+void
+cls_rule_set_arp_tha(struct cls_rule *rule, const uint8_t tha[ETH_ADDR_LEN])
+{
+ rule->wc.wildcards &= ~FWW_ARP_THA;
+ memcpy(rule->flow.arp_tha, tha, ETH_ADDR_LEN);
+}
+
+void
+cls_rule_set_ipv6_src(struct cls_rule *rule, const struct in6_addr *src)
+{
+ rule->flow.ipv6_src = *src;
+ rule->wc.ipv6_src_mask = in6addr_exact;
+}
+
+void
+cls_rule_set_ipv6_src_masked(struct cls_rule *rule, const struct in6_addr *src,
+ const struct in6_addr *mask)
+{
+ rule->flow.ipv6_src = ipv6_addr_bitand(src, mask);
+ rule->wc.ipv6_src_mask = *mask;
+}
+
+void
+cls_rule_set_ipv6_dst(struct cls_rule *rule, const struct in6_addr *dst)
+{
+ rule->flow.ipv6_dst = *dst;
+ rule->wc.ipv6_dst_mask = in6addr_exact;
+}
+
+void
+cls_rule_set_ipv6_dst_masked(struct cls_rule *rule, const struct in6_addr *dst,
+ const struct in6_addr *mask)
+{
+ rule->flow.ipv6_dst = ipv6_addr_bitand(dst, mask);
+ rule->wc.ipv6_dst_mask = *mask;
+}
+
+void
+cls_rule_set_ipv6_label(struct cls_rule *rule, ovs_be32 ipv6_label)
+{
+ cls_rule_set_ipv6_label_masked(rule, ipv6_label, htonl(UINT32_MAX));
+}
+
+void
+cls_rule_set_ipv6_label_masked(struct cls_rule *rule, ovs_be32 ipv6_label,
+ ovs_be32 mask)
+{
+ rule->flow.ipv6_label = ipv6_label & mask;
+ rule->wc.ipv6_label_mask = mask;
+}
+
+void
+cls_rule_set_nd_target(struct cls_rule *rule, const struct in6_addr *target)
+{
+ rule->flow.nd_target = *target;
+ rule->wc.nd_target_mask = in6addr_exact;
+}
+
+void
+cls_rule_set_nd_target_masked(struct cls_rule *rule,
+ const struct in6_addr *target,
+ const struct in6_addr *mask)
+{
+ rule->flow.nd_target = ipv6_addr_bitand(target, mask);
+ rule->wc.nd_target_mask = *mask;
+}
+
+/* Returns true if 'a' and 'b' have the same priority, wildcard the same
+ * fields, and have the same values for fixed fields, otherwise false. */
+bool
+cls_rule_equal(const struct cls_rule *a, const struct cls_rule *b)
+{
+ return (a->priority == b->priority
+ && flow_wildcards_equal(&a->wc, &b->wc)
+ && flow_equal(&a->flow, &b->flow));
+}
+
+/* Returns a hash value for the flow, wildcards, and priority in 'rule',
+ * starting from 'basis'. */
+uint32_t
+cls_rule_hash(const struct cls_rule *rule, uint32_t basis)
+{
+ uint32_t h0 = flow_hash(&rule->flow, basis);
+ uint32_t h1 = flow_wildcards_hash(&rule->wc, h0);
+ return hash_int(rule->priority, h1);
+}
+
+static void
+format_eth_masked(struct ds *s, const char *name, const uint8_t eth[6],
+ const uint8_t mask[6])
+{
+ if (!eth_addr_is_zero(mask)) {
+ ds_put_format(s, "%s=", name);
+ eth_format_masked(eth, mask, s);
+ ds_put_char(s, ',');
+ }
+}
+
+static void
+format_ip_netmask(struct ds *s, const char *name, ovs_be32 ip,
+ ovs_be32 netmask)
+{
+ if (netmask) {
+ ds_put_format(s, "%s=", name);
+ ip_format_masked(ip, netmask, s);
+ ds_put_char(s, ',');
+ }
+}
+
+static void
+format_ipv6_netmask(struct ds *s, const char *name,
+ const struct in6_addr *addr,
+ const struct in6_addr *netmask)
+{
+ if (!ipv6_mask_is_any(netmask)) {
+ ds_put_format(s, "%s=", name);
+ print_ipv6_masked(s, addr, netmask);
+ ds_put_char(s, ',');
+ }
+}
+
+
+static void
+format_be16_masked(struct ds *s, const char *name,
+ ovs_be16 value, ovs_be16 mask)
+{
+ if (mask != htons(0)) {
+ ds_put_format(s, "%s=", name);
+ if (mask == htons(UINT16_MAX)) {
+ ds_put_format(s, "%"PRIu16, ntohs(value));