From 44d993b41f4a9e995b2ff76938f23413bfed4652 Mon Sep 17 00:00:00 2001
From: Numan Siddique <numans@ovn.org>
Date: Mon, 28 Sep 2020 17:31:32 +0530
Subject: [PATCH 4/5] ovn-northd: Optimize logical flow generation for reject
 ACLs.

ovn-northd adds below lflows for a reject ACL with a match - M

match = (ip4 && tcp && 'M') action = tcp_reject{}
match = (ip6 && tcp && 'M') action = tcp_reject{}
match = (ip4 && 'M') action = icmp4{}
match = (ip6 && 'M') action = icmp6{}

This approach has a couple of problems:
   - ovn-controller can reject the lflows if there are invalid matches.
     Eg. If match 'M' is - 'ip4 && udp'.

   - In a large scale deployment, this could result in lot of invalid
     logical flows and increase the size of the SB DB.

This patch addresses this problem by using newly added reject OVN action.
With this patch, there will be just one lflow for each reject ACL.

Acked-by: Mark Michelson <mmichels@redhat.com>
Acked-by: Dumitru Ceara <dceara@redhat.com>
Signed-off-by: Numan Siddique <numans@ovn.org>

(cherry-picked from upstream master commit 4e19493b3d4eb549fc52d6fb3cf004847b64d2de)

Change-Id: I540247929b4939bd5696a2edcb15a4bf7dc4af77
---
 northd/ovn-northd.c |  50 +----------
 tests/ovn-northd.at | 214 +++++++-------------------------------------
 tests/system-ovn.at |  46 +++++++++-
 3 files changed, 81 insertions(+), 229 deletions(-)

diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c
index b099f705b..3a71d0ee8 100644
--- a/northd/ovn-northd.c
+++ b/northd/ovn-northd.c
@@ -5385,61 +5385,19 @@ build_reject_acl_rules(struct ovn_datapath *od, struct hmap *lflows,
                   ingress ? ovn_stage_get_table(S_SWITCH_OUT_QOS_MARK)
                           : ovn_stage_get_table(S_SWITCH_IN_L2_LKUP));
 
-    /* TCP */
     build_acl_log(&actions, acl);
     if (extra_match->length > 0) {
         ds_put_format(&match, "(%s) && ", extra_match->string);
     }
-    ds_put_format(&match, "ip4 && tcp && (%s)", acl->match);
-    ds_put_format(&actions, "reg0 = 0; "
-                  "eth.dst <-> eth.src; ip4.dst <-> ip4.src; "
-                  "tcp_reset { outport <-> inport; %s };", next_action);
-    ovn_lflow_add_with_hint(lflows, od, stage,
-                            acl->priority + OVN_ACL_PRI_OFFSET + 10,
-                            ds_cstr(&match), ds_cstr(&actions), stage_hint);
-    ds_clear(&match);
-    ds_clear(&actions);
-    build_acl_log(&actions, acl);
-    if (extra_match->length > 0) {
-        ds_put_format(&match, "(%s) && ", extra_match->string);
-    }
-    ds_put_format(&match, "ip6 && tcp && (%s)", acl->match);
-    ds_put_format(&actions, "reg0 = 0; "
-                  "eth.dst <-> eth.src; ip6.dst <-> ip6.src; "
-                  "tcp_reset { outport <-> inport; %s };", next_action);
-    ovn_lflow_add_with_hint(lflows, od, stage,
-                            acl->priority + OVN_ACL_PRI_OFFSET + 10,
-                            ds_cstr(&match), ds_cstr(&actions), stage_hint);
+    ds_put_cstr(&match, acl->match);
 
-    /* IP traffic */
-    ds_clear(&match);
-    ds_clear(&actions);
-    build_acl_log(&actions, acl);
-    if (extra_match->length > 0) {
-        ds_put_format(&match, "(%s) && ", extra_match->string);
-    }
-    ds_put_format(&match, "ip4 && (%s)", acl->match);
     if (extra_actions->length > 0) {
         ds_put_format(&actions, "%s ", extra_actions->string);
     }
+
     ds_put_format(&actions, "reg0 = 0; "
-                  "icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; "
-                  "outport <-> inport; %s };", next_action);
-    ovn_lflow_add_with_hint(lflows, od, stage,
-                            acl->priority + OVN_ACL_PRI_OFFSET,
-                            ds_cstr(&match), ds_cstr(&actions), stage_hint);
-    ds_clear(&match);
-    ds_clear(&actions);
-    build_acl_log(&actions, acl);
-    if (extra_match->length > 0) {
-        ds_put_format(&match, "(%s) && ", extra_match->string);
-    }
-    ds_put_format(&match, "ip6 && (%s)", acl->match);
-    if (extra_actions->length > 0) {
-        ds_put_format(&actions, "%s ", extra_actions->string);
-    }
-    ds_put_format(&actions, "reg0 = 0; icmp6 { "
-                  "eth.dst <-> eth.src; ip6.dst <-> ip6.src; "
+                  "reject { "
+                  "/* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ "
                   "outport <-> inport; %s };", next_action);
     ovn_lflow_add_with_hint(lflows, od, stage,
                             acl->priority + OVN_ACL_PRI_OFFSET,
diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at
index a6c32c115..94007fcac 100644
--- a/tests/ovn-northd.at
+++ b/tests/ovn-northd.at
@@ -2028,232 +2028,86 @@ ovn-nbctl --wait=hv sync
 
 AT_CHECK([ovn-sbctl lflow-list sw0 | grep "ls_in_acl" | grep pg0 | sort], [0], [dnl
   table=7 (ls_in_acl          ), priority=2002 , dnl
-match=(ip4 && (inport == @pg0 && ip4 && tcp && tcp.dst == 80)), dnl
-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=egress,table=6); };)
-  table=7 (ls_in_acl          ), priority=2002 , dnl
-match=(ip6 && (inport == @pg0 && ip4 && tcp && tcp.dst == 80)), dnl
-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=egress,table=6); };)
-  table=7 (ls_in_acl          ), priority=2012 , dnl
-match=(ip4 && tcp && (inport == @pg0 && ip4 && tcp && tcp.dst == 80)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=egress,table=6); };)
-  table=7 (ls_in_acl          ), priority=2012 , dnl
-match=(ip6 && tcp && (inport == @pg0 && ip4 && tcp && tcp.dst == 80)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=egress,table=6); };)
+match=(inport == @pg0 && ip4 && tcp && tcp.dst == 80), dnl
+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=egress,table=6); };)
 ])
 
 AT_CHECK([ovn-sbctl lflow-list sw1 | grep "ls_in_acl" | grep pg0 | sort], [0], [dnl
   table=7 (ls_in_acl          ), priority=2002 , dnl
-match=(ip4 && (inport == @pg0 && ip4 && tcp && tcp.dst == 80)), dnl
-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=egress,table=6); };)
-  table=7 (ls_in_acl          ), priority=2002 , dnl
-match=(ip6 && (inport == @pg0 && ip4 && tcp && tcp.dst == 80)), dnl
-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=egress,table=6); };)
-  table=7 (ls_in_acl          ), priority=2012 , dnl
-match=(ip4 && tcp && (inport == @pg0 && ip4 && tcp && tcp.dst == 80)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=egress,table=6); };)
-  table=7 (ls_in_acl          ), priority=2012 , dnl
-match=(ip6 && tcp && (inport == @pg0 && ip4 && tcp && tcp.dst == 80)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=egress,table=6); };)
+match=(inport == @pg0 && ip4 && tcp && tcp.dst == 80), dnl
+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=egress,table=6); };)
 ])
 
 AT_CHECK([ovn-sbctl lflow-list sw0 | grep "ls_out_acl" | grep pg0 | sort], [0], [dnl
   table=5 (ls_out_acl         ), priority=2003 , dnl
-match=(ip4 && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2003 , dnl
-match=(ip6 && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2013 , dnl
-match=(ip4 && tcp && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2013 , dnl
-match=(ip6 && tcp && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
+match=(outport == @pg0 && ip6 && udp), dnl
+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)
 ])
 
 AT_CHECK([ovn-sbctl lflow-list sw1 | grep "ls_out_acl" | grep pg0 | sort], [0], [dnl
   table=5 (ls_out_acl         ), priority=2003 , dnl
-match=(ip4 && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2003 , dnl
-match=(ip6 && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2013 , dnl
-match=(ip4 && tcp && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2013 , dnl
-match=(ip6 && tcp && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
+match=(outport == @pg0 && ip6 && udp), dnl
+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)
 ])
 
 ovn-nbctl acl-add pg0 to-lport 1002 "outport == @pg0 && ip4 && udp" reject
 
 AT_CHECK([ovn-sbctl lflow-list sw0 | grep "ls_out_acl" | grep pg0 | sort], [0], [dnl
   table=5 (ls_out_acl         ), priority=2002 , dnl
-match=(ip4 && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2002 , dnl
-match=(ip6 && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2003 , dnl
-match=(ip4 && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)
+match=(outport == @pg0 && ip4 && udp), dnl
+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)
   table=5 (ls_out_acl         ), priority=2003 , dnl
-match=(ip6 && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2012 , dnl
-match=(ip4 && tcp && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2012 , dnl
-match=(ip6 && tcp && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2013 , dnl
-match=(ip4 && tcp && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2013 , dnl
-match=(ip6 && tcp && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
+match=(outport == @pg0 && ip6 && udp), dnl
+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)
 ])
 
 AT_CHECK([ovn-sbctl lflow-list sw1 | grep "ls_out_acl" | grep pg0 | sort], [0], [dnl
   table=5 (ls_out_acl         ), priority=2002 , dnl
-match=(ip4 && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2002 , dnl
-match=(ip6 && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2003 , dnl
-match=(ip4 && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)
+match=(outport == @pg0 && ip4 && udp), dnl
+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)
   table=5 (ls_out_acl         ), priority=2003 , dnl
-match=(ip6 && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2012 , dnl
-match=(ip4 && tcp && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2012 , dnl
-match=(ip6 && tcp && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2013 , dnl
-match=(ip4 && tcp && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2013 , dnl
-match=(ip6 && tcp && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
+match=(outport == @pg0 && ip6 && udp), dnl
+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)
 ])
 
 ovn-nbctl --wait=sb acl-add pg0 to-lport 1001 "outport == @pg0 && ip" allow-related
 
 AT_CHECK([ovn-sbctl lflow-list sw0 | grep "ls_out_acl" | grep pg0 | sort], [0], [dnl
   table=5 (ls_out_acl         ), priority=2001 , dnl
-match=(reg0[[7]] == 1 && (outport == @pg0 && ip)), dnl
-action=(reg0[[1]] = 1; next;)
+match=(reg0[[7]] == 1 && (outport == @pg0 && ip)), action=(reg0[[1]] = 1; next;)
   table=5 (ls_out_acl         ), priority=2001 , dnl
 match=(reg0[[8]] == 1 && (outport == @pg0 && ip)), action=(next;)
   table=5 (ls_out_acl         ), priority=2002 , dnl
-match=((reg0[[10]] == 1) && ip4 && (outport == @pg0 && ip4 && udp)), dnl
-action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)
+match=((reg0[[10]] == 1) && outport == @pg0 && ip4 && udp), dnl
+action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)
   table=5 (ls_out_acl         ), priority=2002 , dnl
-match=((reg0[[10]] == 1) && ip6 && (outport == @pg0 && ip4 && udp)), dnl
-action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2002 , dnl
-match=((reg0[[9]] == 1) && ip4 && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2002 , dnl
-match=((reg0[[9]] == 1) && ip6 && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2003 , dnl
-match=((reg0[[10]] == 1) && ip4 && (outport == @pg0 && ip6 && udp)), dnl
-action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2003 , dnl
-match=((reg0[[10]] == 1) && ip6 && (outport == @pg0 && ip6 && udp)), dnl
-action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)
+match=((reg0[[9]] == 1) && outport == @pg0 && ip4 && udp), dnl
+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)
   table=5 (ls_out_acl         ), priority=2003 , dnl
-match=((reg0[[9]] == 1) && ip4 && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)
+match=((reg0[[10]] == 1) && outport == @pg0 && ip6 && udp), dnl
+action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)
   table=5 (ls_out_acl         ), priority=2003 , dnl
-match=((reg0[[9]] == 1) && ip6 && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2012 , dnl
-match=((reg0[[10]] == 1) && ip4 && tcp && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2012 , dnl
-match=((reg0[[10]] == 1) && ip6 && tcp && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2012 , dnl
-match=((reg0[[9]] == 1) && ip4 && tcp && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2012 , dnl
-match=((reg0[[9]] == 1) && ip6 && tcp && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2013 , dnl
-match=((reg0[[10]] == 1) && ip4 && tcp && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2013 , dnl
-match=((reg0[[10]] == 1) && ip6 && tcp && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2013 , dnl
-match=((reg0[[9]] == 1) && ip4 && tcp && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2013 , dnl
-match=((reg0[[9]] == 1) && ip6 && tcp && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
+match=((reg0[[9]] == 1) && outport == @pg0 && ip6 && udp), dnl
+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)
 ])
 
 AT_CHECK([ovn-sbctl lflow-list sw1 | grep "ls_out_acl" | grep pg0 | sort], [0], [dnl
   table=5 (ls_out_acl         ), priority=2001 , dnl
-match=(reg0[[7]] == 1 && (outport == @pg0 && ip)), dnl
-action=(reg0[[1]] = 1; next;)
+match=(reg0[[7]] == 1 && (outport == @pg0 && ip)), action=(reg0[[1]] = 1; next;)
   table=5 (ls_out_acl         ), priority=2001 , dnl
 match=(reg0[[8]] == 1 && (outport == @pg0 && ip)), action=(next;)
   table=5 (ls_out_acl         ), priority=2002 , dnl
-match=((reg0[[10]] == 1) && ip4 && (outport == @pg0 && ip4 && udp)), dnl
-action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)
+match=((reg0[[10]] == 1) && outport == @pg0 && ip4 && udp), dnl
+action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)
   table=5 (ls_out_acl         ), priority=2002 , dnl
-match=((reg0[[10]] == 1) && ip6 && (outport == @pg0 && ip4 && udp)), dnl
-action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2002 , dnl
-match=((reg0[[9]] == 1) && ip4 && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2002 , dnl
-match=((reg0[[9]] == 1) && ip6 && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2003 , dnl
-match=((reg0[[10]] == 1) && ip4 && (outport == @pg0 && ip6 && udp)), dnl
-action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2003 , dnl
-match=((reg0[[10]] == 1) && ip6 && (outport == @pg0 && ip6 && udp)), dnl
-action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)
+match=((reg0[[9]] == 1) && outport == @pg0 && ip4 && udp), dnl
+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)
   table=5 (ls_out_acl         ), priority=2003 , dnl
-match=((reg0[[9]] == 1) && ip4 && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; icmp4 { eth.dst <-> eth.src; ip4.dst <-> ip4.src; outport <-> inport; next(pipeline=ingress,table=20); };)
+match=((reg0[[10]] == 1) && outport == @pg0 && ip6 && udp), dnl
+action=(ct_commit { ct_label.blocked = 1; };  reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)
   table=5 (ls_out_acl         ), priority=2003 , dnl
-match=((reg0[[9]] == 1) && ip6 && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; icmp6 { eth.dst <-> eth.src; ip6.dst <-> ip6.src; outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2012 , dnl
-match=((reg0[[10]] == 1) && ip4 && tcp && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2012 , dnl
-match=((reg0[[10]] == 1) && ip6 && tcp && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2012 , dnl
-match=((reg0[[9]] == 1) && ip4 && tcp && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2012 , dnl
-match=((reg0[[9]] == 1) && ip6 && tcp && (outport == @pg0 && ip4 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2013 , dnl
-match=((reg0[[10]] == 1) && ip4 && tcp && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2013 , dnl
-match=((reg0[[10]] == 1) && ip6 && tcp && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2013 , dnl
-match=((reg0[[9]] == 1) && ip4 && tcp && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip4.dst <-> ip4.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
-  table=5 (ls_out_acl         ), priority=2013 , dnl
-match=((reg0[[9]] == 1) && ip6 && tcp && (outport == @pg0 && ip6 && udp)), dnl
-action=(reg0 = 0; eth.dst <-> eth.src; ip6.dst <-> ip6.src; tcp_reset { outport <-> inport; next(pipeline=ingress,table=20); };)
+match=((reg0[[9]] == 1) && outport == @pg0 && ip6 && udp), dnl
+action=(reg0 = 0; reject { /* eth.dst <-> eth.src; ip.dst <-> ip.src; is implicit. */ outport <-> inport; next(pipeline=ingress,table=20); };)
 ])
 
 AT_CLEANUP
diff --git a/tests/system-ovn.at b/tests/system-ovn.at
index 60bd20fd4..091b61f91 100644
--- a/tests/system-ovn.at
+++ b/tests/system-ovn.at
@@ -4473,9 +4473,6 @@ ovn-nbctl lsp-add sw0 sw0-p2-rej
 ovn-nbctl lsp-set-addresses sw0-p2-rej "50:54:00:00:00:04 10.0.0.4 aef0::4"
 ovn-nbctl lsp-set-port-security sw0-p2-rej "50:54:00:00:00:04 10.0.0.4 aef0::4"
 
-#ovn-nbctl --log acl-add sw0 from-lport 1000 "inport == \"sw0-p1\" && tcp && tcp.dst == 80" reject
-#ovn-nbctl --log acl-add sw0 from-lport 1000 "inport == \"sw0-p2\" && ip6 && tcp && tcp.dst == 80" reject
-
 # Create port group and ACLs for sw0 ports.
 ovn-nbctl pg-add pg0_drop sw0-p1-rej sw0-p2-rej
 ovn-nbctl acl-add pg0_drop from-lport 1001 "inport == @pg0_drop && ip" drop
@@ -4638,6 +4635,49 @@ aef0::3 udp port objcall" | uniq | wc -l)
     test $c -eq 1
 ])
 
+# Delete all the ACLs of pg0 and add the ACL with a generic match with reject action.
+ovn-nbctl pg-del pg0
+ovn-nbctl pg-add pg0 sw0-p1-rej sw0-p2-rej
+ovn-nbctl --log acl-add pg0 from-lport 1004 "inport == @pg0 && ip && (tcp || udp)" reject
+
+OVS_WAIT_UNTIL([
+    ip netns exec sw0-p1-rej nc  10.0.0.4 80 2> r
+    res=$(cat r)
+    echo "result = $res"
+    test "$res" = "Ncat: Connection refused."
+])
+
+OVS_WAIT_UNTIL([
+    ip netns exec sw0-p2-rej nc -6 aef0::3 80 2> r
+    res=$(cat r)
+    test "$res" = "Ncat: Connection refused."
+])
+
+rm -f *.pcap
+
+NS_CHECK_EXEC([sw0-p1-rej], [tcpdump -n -c 1 -i sw0-p1-rej icmp > sw0-p1-rej-icmp.pcap &], [0])
+
+printf '.%.0s' {1..100} > foo
+OVS_WAIT_UNTIL([
+    ip netns exec sw0-p1-rej nc -u 10.0.0.4 90 < foo
+    c=$(cat sw0-p1-rej-icmp.pcap | grep \
+"10.0.0.4 > 10.0.0.3: ICMP 10.0.0.4 udp port dnsix unreachable" | uniq | wc -l)
+    test $c -eq 1
+])
+
+rm -f *.pcap
+# Now test for IPv6 UDP.
+NS_CHECK_EXEC([sw0-p2-rej], [tcpdump -n -c 1 -i sw0-p2-rej icmp6 > sw0-p2-rej-icmp6.pcap &], [0])
+
+OVS_WAIT_UNTIL([
+    ip netns exec sw0-p2-rej nc -u -6 aef0::3 90 < foo
+    c=$(cat sw0-p2-rej-icmp6.pcap | grep \
+"IP6 aef0::3 > aef0::4: ICMP6, destination unreachable, unreachable port, \
+aef0::3 udp port dnsix" | uniq | wc -l)
+    test $c -eq 1
+])
+
+
 OVS_APP_EXIT_AND_WAIT([ovn-controller])
 
 as ovn-sb
-- 
2.26.2