From 44d993b41f4a9e995b2ff76938f23413bfed4652 Mon Sep 17 00:00:00 2001

From: Numan Siddique <numans@ovn.org>

Date: Mon, 28 Sep 2020 17:31:32 +0530

Subject: [PATCH 4/5] ovn-northd: Optimize logical flow generation for reject

 ACLs.

ovn-northd adds below lflows for a reject ACL with a match - M

match = (ip4 && tcp && 'M') action = tcp_reject{}

match = (ip6 && tcp && 'M') action = tcp_reject{}

match = (ip4 && 'M') action = icmp4{}

match = (ip6 && 'M') action = icmp6{}

This approach has a couple of problems:

   - ovn-controller can reject the lflows if there are invalid matches.

     Eg. If match 'M' is - 'ip4 && udp'.

   - In a large scale deployment, this could result in lot of invalid

     logical flows and increase the size of the SB DB.

This patch addresses this problem by using newly added reject OVN action.

With this patch, there will be just one lflow for each reject ACL.

Acked-by: Mark Michelson <mmichels@redhat.com>

Acked-by: Dumitru Ceara <dceara@redhat.com>

Signed-off-by: Numan Siddique <numans@ovn.org>

(cherry-picked from upstream master commit 4e19493b3d4eb549fc52d6fb3cf004847b64d2de)

Change-Id: I540247929b4939bd5696a2edcb15a4bf7dc4af77

---

 northd/ovn-northd.c |  50 +----------

 tests/ovn-northd.at | 214 +++++++-------------------------------------

 tests/system-ovn.at |  46 +++++++++-

 3 files changed, 81 insertions(+), 229 deletions(-)

diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c

index b099f705b..3a71d0ee8 100644

--- a/northd/ovn-northd.c

+++ b/northd/ovn-northd.c

@@ -5385,61 +5385,19 @@ build_reject_acl_rules(struct ovn_datapath *od, struct hmap *lflows,

                   ingress ? ovn_stage_get_table(S_SWITCH_OUT_QOS_MARK)

                           : ovn_stage_get_table(S_SWITCH_IN_L2_LKUP));

-    /* TCP */

     build_acl_log(&actions, acl);

     if (extra_match->length > 0) {

         ds_put_format(&match, "(%s) && ", extra_match->string);

     }

-    ds_put_format(&match, "ip4 && tcp && (%s)", acl->match);

-    ds_put_format(&actions, "reg0 = 0; "

-                  "eth.dst <-> eth.src; ip4.dst <-> ip4.src; "

-                  "tcp_reset { outport <-> inport; %s };", next_action);

-    ovn_lflow_add_with_hint(lflows, od, stage,

-                            acl->priority + OVN_ACL_PRI_OFFSET + 10,

-                            ds_cstr(&match), ds_cstr(&actions), stage_hint);

-    ds_clear(&match);

-    ds_clear(&actions);

-    build_acl_log(&actions, acl);

-    if (extra_match->length > 0) {

-        ds_put_format(&match, "(%s) && ", extra_match->string);

-    }

-    ds_put_format(&match, "ip6 && tcp && (%s)", acl->match);

-    ds_put_format(&actions, "reg0 = 0; "

-                  "eth.dst <-> eth.src; ip6.dst <-> ip6.src; "

-                  "tcp_reset { outport <-> inport; %s };", next_action);

-    ovn_lflow_add_with_hint(lflows, od, stage,

-                            acl->priority + OVN_ACL_PRI_OFFSET + 10,

-                            ds_cstr(&match), ds_cstr(&actions), stage_hint);

+    ds_put_cstr(&match, acl->match);

-    /* IP traffic */

-    ds_clear(&match);

-    ds_clear(&actions);

-    build_acl_log(&actions, acl);

-    if (extra_match->length > 0) {

-        ds_put_format(&match, "(%s) && ", extra_match->string);

-    }

-    ds_put_format(&match, "ip4 && (%s)", acl->match);

     if (extra_actions->length > 0) {

         ds_put_format(&actions, "%s ", extra_actions->string);

     }

+

     ds_put_format(&actions, "reg0 = 0; "

-                  "icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; "

-                  "outport <-> inport; %s };", next_action);

-    ovn_lflow_add_with_hint(lflows, od, stage,

-                            acl->priority + OVN_ACL_PRI_OFFSET,

-                            ds_cstr(&match), ds_cstr(&actions), stage_hint);

-    ds_clear(&match);

-    ds_clear(&actions);

-    build_acl_log(&actions, acl);

-    if (extra_match->length > 0) {

-        ds_put_format(&match, "(%s) && ", extra_match->string);

-    }

-    ds_put_format(&match, "ip6 && (%s)", acl->match);

-    if (extra_actions->length > 0) {

-        ds_put_format(&actions, "%s ", extra_actions->string);

-    }

-    ds_put_format(&actions, "reg0 = 0; icmp6 { "

-                  "eth.dst <-> eth.src; ip6.dst <-> ip6.src; "

+                  "reject { "

+                  "/* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ "

                   "outport <-> inport; %s };", next_action);

     ovn_lflow_add_with_hint(lflows, od, stage,

                             acl->priority + OVN_ACL_PRI_OFFSET,

diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at

index a6c32c115..94007fcac 100644

--- a/tests/ovn-northd.at

+++ b/tests/ovn-northd.at

@@ -2028,232 +2028,86 @@ ovn-nbctl --wait=hv sync

 AT_CHECK([ovn-sbctl lflow-list sw0 | grep "ls_in_acl" | grep pg0 | sort], [0], [dnl

   table=7 (ls_in_acl          ), priority=2002 , dnl

-match=(ip4 && (inport == @pg0 && ip4 && tcp && tcp.dst == 80)), dnl

-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=egress,table=6); };)

-  table=7 (ls_in_acl          ), priority=2002 , dnl

-match=(ip6 && (inport == @pg0 && ip4 && tcp && tcp.dst == 80)), dnl

-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=egress,table=6); };)

-  table=7 (ls_in_acl          ), priority=2012 , dnl

-match=(ip4 && tcp && (inport == @pg0 && ip4 && tcp && tcp.dst == 80)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=egress,table=6); };)

-  table=7 (ls_in_acl          ), priority=2012 , dnl

-match=(ip6 && tcp && (inport == @pg0 && ip4 && tcp && tcp.dst == 80)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=egress,table=6); };)

+match=(inport == @pg0 && ip4 && tcp && tcp.dst == 80), dnl

+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=egress,table=6); };)

 ])

 AT_CHECK([ovn-sbctl lflow-list sw1 | grep "ls_in_acl" | grep pg0 | sort], [0], [dnl

   table=7 (ls_in_acl          ), priority=2002 , dnl

-match=(ip4 && (inport == @pg0 && ip4 && tcp && tcp.dst == 80)), dnl

-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=egress,table=6); };)

-  table=7 (ls_in_acl          ), priority=2002 , dnl

-match=(ip6 && (inport == @pg0 && ip4 && tcp && tcp.dst == 80)), dnl

-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=egress,table=6); };)

-  table=7 (ls_in_acl          ), priority=2012 , dnl

-match=(ip4 && tcp && (inport == @pg0 && ip4 && tcp && tcp.dst == 80)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=egress,table=6); };)

-  table=7 (ls_in_acl          ), priority=2012 , dnl

-match=(ip6 && tcp && (inport == @pg0 && ip4 && tcp && tcp.dst == 80)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=egress,table=6); };)

+match=(inport == @pg0 && ip4 && tcp && tcp.dst == 80), dnl

+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=egress,table=6); };)

 ])

 AT_CHECK([ovn-sbctl lflow-list sw0 | grep "ls_out_acl" | grep pg0 | sort], [0], [dnl

   table=5 (ls_out_acl         ), priority=2003 , dnl

-match=(ip4 && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2003 , dnl

-match=(ip6 && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2013 , dnl

-match=(ip4 && tcp && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2013 , dnl

-match=(ip6 && tcp && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

+match=(outport == @pg0 && ip6 && udp), dnl

+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)

 ])

 AT_CHECK([ovn-sbctl lflow-list sw1 | grep "ls_out_acl" | grep pg0 | sort], [0], [dnl

   table=5 (ls_out_acl         ), priority=2003 , dnl

-match=(ip4 && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2003 , dnl

-match=(ip6 && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2013 , dnl

-match=(ip4 && tcp && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2013 , dnl

-match=(ip6 && tcp && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

+match=(outport == @pg0 && ip6 && udp), dnl

+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)

 ])

 ovn-nbctl acl-add pg0 to-lport 1002 "outport == @pg0 && ip4 && udp" reject

 AT_CHECK([ovn-sbctl lflow-list sw0 | grep "ls_out_acl" | grep pg0 | sort], [0], [dnl

   table=5 (ls_out_acl         ), priority=2002 , dnl

-match=(ip4 && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2002 , dnl

-match=(ip6 && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2003 , dnl

-match=(ip4 && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)

+match=(outport == @pg0 && ip4 && udp), dnl

+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)

   table=5 (ls_out_acl         ), priority=2003 , dnl

-match=(ip6 && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2012 , dnl

-match=(ip4 && tcp && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2012 , dnl

-match=(ip6 && tcp && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2013 , dnl

-match=(ip4 && tcp && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2013 , dnl

-match=(ip6 && tcp && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

+match=(outport == @pg0 && ip6 && udp), dnl

+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)

 ])

 AT_CHECK([ovn-sbctl lflow-list sw1 | grep "ls_out_acl" | grep pg0 | sort], [0], [dnl

   table=5 (ls_out_acl         ), priority=2002 , dnl

-match=(ip4 && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2002 , dnl

-match=(ip6 && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2003 , dnl

-match=(ip4 && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)

+match=(outport == @pg0 && ip4 && udp), dnl

+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)

   table=5 (ls_out_acl         ), priority=2003 , dnl

-match=(ip6 && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2012 , dnl

-match=(ip4 && tcp && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2012 , dnl

-match=(ip6 && tcp && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2013 , dnl

-match=(ip4 && tcp && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2013 , dnl

-match=(ip6 && tcp && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

+match=(outport == @pg0 && ip6 && udp), dnl

+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)

 ])

 ovn-nbctl --wait=sb acl-add pg0 to-lport 1001 "outport == @pg0 && ip" allow-related

 AT_CHECK([ovn-sbctl lflow-list sw0 | grep "ls_out_acl" | grep pg0 | sort], [0], [dnl

   table=5 (ls_out_acl         ), priority=2001 , dnl

-match=(reg0[[7]] == 1 && (outport == @pg0 && ip)), dnl

-action=(reg0[[1]] = 1; next;)

+match=(reg0[[7]] == 1 && (outport == @pg0 && ip)), action=(reg0[[1]] = 1; next;)

   table=5 (ls_out_acl         ), priority=2001 , dnl

 match=(reg0[[8]] == 1 && (outport == @pg0 && ip)), action=(next;)

   table=5 (ls_out_acl         ), priority=2002 , dnl

-match=((reg0[[10]] == 1) && ip4 && (outport == @pg0 && ip4 && udp)), dnl

-action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)

+match=((reg0[[10]] == 1) && outport == @pg0 && ip4 && udp), dnl

+action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)

   table=5 (ls_out_acl         ), priority=2002 , dnl

-match=((reg0[[10]] == 1) && ip6 && (outport == @pg0 && ip4 && udp)), dnl

-action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2002 , dnl

-match=((reg0[[9]] == 1) && ip4 && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2002 , dnl

-match=((reg0[[9]] == 1) && ip6 && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2003 , dnl

-match=((reg0[[10]] == 1) && ip4 && (outport == @pg0 && ip6 && udp)), dnl

-action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2003 , dnl

-match=((reg0[[10]] == 1) && ip6 && (outport == @pg0 && ip6 && udp)), dnl

-action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)

+match=((reg0[[9]] == 1) && outport == @pg0 && ip4 && udp), dnl

+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)

   table=5 (ls_out_acl         ), priority=2003 , dnl

-match=((reg0[[9]] == 1) && ip4 && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)

+match=((reg0[[10]] == 1) && outport == @pg0 && ip6 && udp), dnl

+action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)

   table=5 (ls_out_acl         ), priority=2003 , dnl

-match=((reg0[[9]] == 1) && ip6 && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2012 , dnl

-match=((reg0[[10]] == 1) && ip4 && tcp && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2012 , dnl

-match=((reg0[[10]] == 1) && ip6 && tcp && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2012 , dnl

-match=((reg0[[9]] == 1) && ip4 && tcp && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2012 , dnl

-match=((reg0[[9]] == 1) && ip6 && tcp && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2013 , dnl

-match=((reg0[[10]] == 1) && ip4 && tcp && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2013 , dnl

-match=((reg0[[10]] == 1) && ip6 && tcp && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2013 , dnl

-match=((reg0[[9]] == 1) && ip4 && tcp && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2013 , dnl

-match=((reg0[[9]] == 1) && ip6 && tcp && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

+match=((reg0[[9]] == 1) && outport == @pg0 && ip6 && udp), dnl

+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)

 ])

 AT_CHECK([ovn-sbctl lflow-list sw1 | grep "ls_out_acl" | grep pg0 | sort], [0], [dnl

   table=5 (ls_out_acl         ), priority=2001 , dnl

-match=(reg0[[7]] == 1 && (outport == @pg0 && ip)), dnl

-action=(reg0[[1]] = 1; next;)

+match=(reg0[[7]] == 1 && (outport == @pg0 && ip)), action=(reg0[[1]] = 1; next;)

   table=5 (ls_out_acl         ), priority=2001 , dnl

 match=(reg0[[8]] == 1 && (outport == @pg0 && ip)), action=(next;)

   table=5 (ls_out_acl         ), priority=2002 , dnl

-match=((reg0[[10]] == 1) && ip4 && (outport == @pg0 && ip4 && udp)), dnl

-action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)

+match=((reg0[[10]] == 1) && outport == @pg0 && ip4 && udp), dnl

+action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)

   table=5 (ls_out_acl         ), priority=2002 , dnl

-match=((reg0[[10]] == 1) && ip6 && (outport == @pg0 && ip4 && udp)), dnl

-action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2002 , dnl

-match=((reg0[[9]] == 1) && ip4 && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2002 , dnl

-match=((reg0[[9]] == 1) && ip6 && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2003 , dnl

-match=((reg0[[10]] == 1) && ip4 && (outport == @pg0 && ip6 && udp)), dnl

-action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2003 , dnl

-match=((reg0[[10]] == 1) && ip6 && (outport == @pg0 && ip6 && udp)), dnl

-action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)

+match=((reg0[[9]] == 1) && outport == @pg0 && ip4 && udp), dnl

+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)

   table=5 (ls_out_acl         ), priority=2003 , dnl

-match=((reg0[[9]] == 1) && ip4 && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)

+match=((reg0[[10]] == 1) && outport == @pg0 && ip6 && udp), dnl

+action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)

   table=5 (ls_out_acl         ), priority=2003 , dnl

-match=((reg0[[9]] == 1) && ip6 && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2012 , dnl

-match=((reg0[[10]] == 1) && ip4 && tcp && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2012 , dnl

-match=((reg0[[10]] == 1) && ip6 && tcp && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2012 , dnl

-match=((reg0[[9]] == 1) && ip4 && tcp && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2012 , dnl

-match=((reg0[[9]] == 1) && ip6 && tcp && (outport == @pg0 && ip4 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2013 , dnl

-match=((reg0[[10]] == 1) && ip4 && tcp && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2013 , dnl

-match=((reg0[[10]] == 1) && ip6 && tcp && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2013 , dnl

-match=((reg0[[9]] == 1) && ip4 && tcp && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

-  table=5 (ls_out_acl         ), priority=2013 , dnl

-match=((reg0[[9]] == 1) && ip6 && tcp && (outport == @pg0 && ip6 && udp)), dnl

-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)

+match=((reg0[[9]] == 1) && outport == @pg0 && ip6 && udp), dnl

+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)

 ])

 AT_CLEANUP

diff --git a/tests/system-ovn.at b/tests/system-ovn.at

index 60bd20fd4..091b61f91 100644

--- a/tests/system-ovn.at

+++ b/tests/system-ovn.at

@@ -4473,9 +4473,6 @@ ovn-nbctl lsp-add sw0 sw0-p2-rej

 ovn-nbctl lsp-set-addresses sw0-p2-rej "50:54:00:00:00:04 10.0.0.4 aef0::4"

 ovn-nbctl lsp-set-port-security sw0-p2-rej "50:54:00:00:00:04 10.0.0.4 aef0::4"

-#ovn-nbctl --log acl-add sw0 from-lport 1000 "inport == \"sw0-p1\" && tcp && tcp.dst == 80" reject

-#ovn-nbctl --log acl-add sw0 from-lport 1000 "inport == \"sw0-p2\" && ip6 && tcp && tcp.dst == 80" reject

-

 # Create port group and ACLs for sw0 ports.

 ovn-nbctl pg-add pg0_drop sw0-p1-rej sw0-p2-rej

 ovn-nbctl acl-add pg0_drop from-lport 1001 "inport == @pg0_drop && ip" drop

@@ -4638,6 +4635,49 @@ aef0::3 udp port objcall" | uniq | wc -l)

     test $c -eq 1

 ])

+# Delete all the ACLs of pg0 and add the ACL with a generic match with reject action.

+ovn-nbctl pg-del pg0

+ovn-nbctl pg-add pg0 sw0-p1-rej sw0-p2-rej

+ovn-nbctl --log acl-add pg0 from-lport 1004 "inport == @pg0 && ip && (tcp || udp)" reject

+

+OVS_WAIT_UNTIL([

+    ip netns exec sw0-p1-rej nc  10.0.0.4 80 2> r

+    res=$(cat r)

+    echo "result = $res"

+    test "$res" = "Ncat: Connection refused."

+])

+

+OVS_WAIT_UNTIL([

+    ip netns exec sw0-p2-rej nc -6 aef0::3 80 2> r

+    res=$(cat r)

+    test "$res" = "Ncat: Connection refused."

+])

+

+rm -f *.pcap

+

+NS_CHECK_EXEC([sw0-p1-rej], [tcpdump -n -c 1 -i sw0-p1-rej icmp > sw0-p1-rej-icmp.pcap &], [0])

+

+printf '.%.0s' {1..100} > foo

+OVS_WAIT_UNTIL([

+    ip netns exec sw0-p1-rej nc -u 10.0.0.4 90 < foo

+    c=$(cat sw0-p1-rej-icmp.pcap | grep \

+"10.0.0.4 > 10.0.0.3: ICMP 10.0.0.4 udp port dnsix unreachable" | uniq | wc -l)

+    test $c -eq 1

+])

+

+rm -f *.pcap

+# Now test for IPv6 UDP.

+NS_CHECK_EXEC([sw0-p2-rej], [tcpdump -n -c 1 -i sw0-p2-rej icmp6 > sw0-p2-rej-icmp6.pcap &], [0])

+

+OVS_WAIT_UNTIL([

+    ip netns exec sw0-p2-rej nc -u -6 aef0::3 90 < foo

+    c=$(cat sw0-p2-rej-icmp6.pcap | grep \

+"IP6 aef0::3 > aef0::4: ICMP6, destination unreachable, unreachable port, \

+aef0::3 udp port dnsix" | uniq | wc -l)

+    test $c -eq 1

+])

+

+

 OVS_APP_EXIT_AND_WAIT([ovn-controller])

 as ovn-sb

-- 

2.26.2