ACL: Operation Improvements

Updated ACL to program "+trk+new" and "+trk+inv" DROP flows with lport tag
as metadata for each of the VM (Neutron port) being added to support drop
packet stats at port level.

Spec reference: https://git.opendaylight.org/gerrit/#/c/49086/

Change-Id: I9cf4934c7334d943c14c52d16a4b3d689c39e62d
Signed-off-by: Shashidhar Raja <shashidharr@altencalsoftlabs.com>

diff --git a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/StatefulEgressAclServiceImpl.java b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/StatefulEgressAclServiceImpl.java
index 39da8849cf56df2f28da770f1090a1389b595480..9c977068914e56c0657d1f2299c33a42a8d6cb4e 100644 (file)
--- a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/StatefulEgressAclServiceImpl.java
+++ b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/StatefulEgressAclServiceImpl.java
@@ -27,6 +27,7 @@ import org.opendaylight.netvirt.aclservice.api.AclServiceManager.Action;
 import org.opendaylight.netvirt.aclservice.api.AclServiceManager.MatchCriteria;
 import org.opendaylight.netvirt.aclservice.utils.AclConstants;
 import org.opendaylight.netvirt.aclservice.utils.AclDataUtil;
+import org.opendaylight.netvirt.aclservice.utils.AclServiceOFFlowBuilder;
 import org.opendaylight.netvirt.aclservice.utils.AclServiceUtils;
 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.Ace;
 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.yang.types.rev130715.MacAddress;
@@ -136,6 +137,45 @@ public class StatefulEgressAclServiceImpl extends AbstractEgressAclServiceImpl {
             int lportTag, String portId, Action action, int write) {
         programConntrackRecircRules(dpid, allowedAddresses, AclConstants.CT_STATE_UNTRACKED_PRIORITY,
             "Recirc", portId, write );
+        programEgressConntrackDropRules(dpid, lportTag, write);
         LOG.info("programEgressAclFixedConntrackRule :  default connection tracking rule are added.");
     }
+
+    /**
+     * Adds the rule to drop the unknown/invalid packets .
+     *
+     * @param dpId the dpId
+     * @param lportTag the lport tag
+     * @param priority the priority of the flow
+     * @param flowId the flowId
+     * @param conntrackState the conntrack state of the packets thats should be
+     *        send
+     * @param conntrackMask the conntrack mask
+     * @param tableId table id
+     * @param addOrRemove whether to add or remove the flow
+     */
+    private void programConntrackDropRule(BigInteger dpId, int lportTag, Integer priority, String flowId,
+            int conntrackState, int conntrackMask, int addOrRemove) {
+        List<MatchInfoBase> matches = AclServiceOFFlowBuilder.addLPortTagMatches(lportTag, conntrackState,
+                conntrackMask);
+        List<InstructionInfo> instructions = AclServiceOFFlowBuilder.getDropInstructionInfo();
+
+        flowId = "Egress_Fixed_Conntrk_Drop" + dpId + "_" + lportTag + "_" + flowId;
+        syncFlow(dpId, NwConstants.EGRESS_ACL_FILTER_TABLE, flowId, priority, "ACL", 0, 0,
+                AclConstants.COOKIE_ACL_DROP_FLOW, matches, instructions, addOrRemove);
+    }
+
+    /**
+     * Adds the rules to drop the unknown/invalid packets .
+     *
+     * @param dpId the dpId
+     * @param lportTag the lport tag
+     * @param addOrRemove whether to add or remove the flow
+     */
+    private void programEgressConntrackDropRules(BigInteger dpId, int lportTag, int addOrRemove) {
+        programConntrackDropRule(dpId, lportTag, AclConstants.CT_STATE_TRACKED_NEW_DROP_PRIORITY, "Tracked_New",
+                AclConstants.TRACKED_NEW_CT_STATE, AclConstants.TRACKED_NEW_CT_STATE_MASK, addOrRemove);
+        programConntrackDropRule(dpId, lportTag, AclConstants.CT_STATE_TRACKED_INVALID_PRIORITY, "Tracked_Invalid",
+                AclConstants.TRACKED_INV_CT_STATE, AclConstants.TRACKED_INV_CT_STATE_MASK, addOrRemove);
+    }
 }

diff --git a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/StatefulIngressAclServiceImpl.java b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/StatefulIngressAclServiceImpl.java
index 79bc64344fdbf6f5bdbbe20138f8b08d5621ea0d..5cc947940b3d62e5a4d195fda316427879b0cc92 100644 (file)
--- a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/StatefulIngressAclServiceImpl.java
+++ b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/StatefulIngressAclServiceImpl.java
@@ -28,6 +28,7 @@ import org.opendaylight.netvirt.aclservice.api.AclServiceManager.Action;
 import org.opendaylight.netvirt.aclservice.api.AclServiceManager.MatchCriteria;
 import org.opendaylight.netvirt.aclservice.utils.AclConstants;
 import org.opendaylight.netvirt.aclservice.utils.AclDataUtil;
+import org.opendaylight.netvirt.aclservice.utils.AclServiceOFFlowBuilder;
 import org.opendaylight.netvirt.aclservice.utils.AclServiceUtils;
 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.Ace;
 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.yang.types.rev130715.MacAddress;
@@ -75,7 +76,7 @@ public class StatefulIngressAclServiceImpl extends AbstractIngressAclServiceImpl
     @Override
     protected void programSpecificFixedRules(BigInteger dpid, String dhcpMacAddress,
             List<AllowedAddressPairs> allowedAddresses, int lportTag, String portId, Action action, int addOrRemove) {
-        programIngressAclFixedConntrackRule(dpid, allowedAddresses, portId, action, addOrRemove);
+        programIngressAclFixedConntrackRule(dpid, lportTag, allowedAddresses, portId, action, addOrRemove);
     }
 
     @Override
@@ -140,14 +141,54 @@ public class StatefulIngressAclServiceImpl extends AbstractIngressAclServiceImpl
      * Programs the default connection tracking rules.
      *
      * @param dpid the dp id
+     * @param lportTag the lport tag
      * @param allowedAddresses the allowed addresses
      * @param portId the portId
      * @param write whether to add or remove the flow.
      */
-    private void programIngressAclFixedConntrackRule(BigInteger dpid, List<AllowedAddressPairs> allowedAddresses,
-            String portId, Action action, int write) {
+    private void programIngressAclFixedConntrackRule(BigInteger dpid, int lportTag,
+            List<AllowedAddressPairs> allowedAddresses, String portId, Action action, int write) {
         programConntrackRecircRules(dpid, allowedAddresses, AclConstants.CT_STATE_UNTRACKED_PRIORITY,
             "Recirc",portId, write);
+        programIngressConntrackDropRules(dpid, lportTag, write);
         LOG.info("programIngressAclFixedConntrackRule :  default connection tracking rule are added.");
     }
+
+    /**
+     * Adds the rule to drop the unknown/invalid packets .
+     *
+     * @param dpId the dpId
+     * @param lportTag the lport tag
+     * @param priority the priority of the flow
+     * @param flowId the flowId
+     * @param conntrackState the conntrack state of the packets thats should be
+     *        send
+     * @param conntrackMask the conntrack mask
+     * @param tableId table id
+     * @param addOrRemove whether to add or remove the flow
+     */
+    private void programConntrackDropRule(BigInteger dpId, int lportTag, Integer priority, String flowId,
+            int conntrackState, int conntrackMask, int addOrRemove) {
+        List<MatchInfoBase> matches = AclServiceOFFlowBuilder.addLPortTagMatches(lportTag, conntrackState,
+                conntrackMask);
+        List<InstructionInfo> instructions = AclServiceOFFlowBuilder.getDropInstructionInfo();
+
+        flowId = "Ingress_Fixed_Conntrk_Drop" + dpId + "_" + lportTag + "_" + flowId;
+        syncFlow(dpId, NwConstants.INGRESS_ACL_FILTER_TABLE, flowId, priority, "ACL", 0, 0,
+                AclConstants.COOKIE_ACL_DROP_FLOW, matches, instructions, addOrRemove);
+    }
+
+    /**
+     * Adds the rules to drop the unknown/invalid packets .
+     *
+     * @param dpId the dpId
+     * @param lportTag the lport tag
+     * @param addOrRemove whether to add or remove the flow
+     */
+    private void programIngressConntrackDropRules(BigInteger dpId, int lportTag, int addOrRemove) {
+        programConntrackDropRule(dpId, lportTag, AclConstants.CT_STATE_TRACKED_NEW_DROP_PRIORITY, "Tracked_New",
+                AclConstants.TRACKED_NEW_CT_STATE, AclConstants.TRACKED_NEW_CT_STATE_MASK, addOrRemove);
+        programConntrackDropRule(dpId, lportTag, AclConstants.CT_STATE_TRACKED_INVALID_PRIORITY, "Tracked_Invalid",
+                AclConstants.TRACKED_INV_CT_STATE, AclConstants.TRACKED_INV_CT_STATE_MASK, addOrRemove);
+    }
 }

diff --git a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/listeners/AclNodeListener.java b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/listeners/AclNodeListener.java
index 48e0b53a23432b055c123e0ac7e32e1c36835060..06914db4e33e962fbea19226f997f991259219d6 100644 (file)
--- a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/listeners/AclNodeListener.java
+++ b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/listeners/AclNodeListener.java
@@ -453,11 +453,6 @@ public class AclNodeListener extends AsyncDataTreeChangeListenerBase<FlowCapable
             dispatcherTableId, tableId, write );
         programConntrackForwardRule(dpnId, AclConstants.CT_STATE_TRACKED_EXIST_PRIORITY,"Tracked_Related", AclConstants
             .TRACKED_REL_CT_STATE, AclConstants.TRACKED_REL_CT_STATE_MASK, dispatcherTableId, tableId, write );
-        programConntrackDropRule(dpnId, AclConstants.CT_STATE_NEW_PRIORITY_DROP,"Tracked_New",
-            AclConstants.TRACKED_NEW_CT_STATE, AclConstants.TRACKED_NEW_CT_STATE_MASK, tableId, write );
-        programConntrackDropRule(dpnId, AclConstants.CT_STATE_TRACKED_EXIST_PRIORITY, "Tracked_Invalid",
-            AclConstants.TRACKED_INV_CT_STATE, AclConstants.TRACKED_INV_CT_STATE_MASK, tableId, write );
-
     }
 
     /**
@@ -486,32 +481,6 @@ public class AclNodeListener extends AsyncDataTreeChangeListenerBase<FlowCapable
                 AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove);
     }
 
-    /**
-     * Adds the rule to drop the unknown/invalid packets .
-     *
-     * @param dpId the dpId
-     * @param priority the priority of the flow
-     * @param flowId the flowId
-     * @param conntrackState the conntrack state of the packets thats should be
-     *        send
-     * @param conntrackMask the conntrack mask
-     * @param tableId the table id
-     * @param addOrRemove whether to add or remove the flow
-     */
-    private void programConntrackDropRule(BigInteger dpId, Integer priority, String flowId,
-            int conntrackState, int conntrackMask, short tableId, int addOrRemove) {
-        List<MatchInfoBase> matches = new ArrayList<>();
-        matches.add(new NxMatchInfo(NxMatchFieldType.ct_state, new long[] {conntrackState, conntrackMask}));
-
-        List<InstructionInfo> instructions = new ArrayList<>();
-        List<ActionInfo> actionsInfos = new ArrayList<>();
-        actionsInfos.add(new ActionDrop());
-        instructions.add(new InstructionApplyActions(actionsInfos));
-        flowId = "Fixed_Conntrk_NewDrop_" + dpId + "_" + flowId + tableId;
-        syncFlow(dpId, tableId, flowId, priority, "ACL", 0, 0,
-                AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove);
-    }
-
     /**
      * Gets the dispatcher table resubmit instructions.
      *

diff --git a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/stats/AclLiveStatisticsHelper.java b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/stats/AclLiveStatisticsHelper.java
index 799fdc2fedcba98f90aeab820c07918842da651c..495cbb921ca99088c2c9be50dfdb8f9ced56233c 100644 (file)
--- a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/stats/AclLiveStatisticsHelper.java
+++ b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/stats/AclLiveStatisticsHelper.java
@@ -177,7 +177,7 @@ public final class AclLiveStatisticsHelper {
                     if (flowStats.getPriority().equals(AclConstants.CT_STATE_TRACKED_INVALID_PRIORITY)) {
                         portEgressBytesBuilder.setInvalidDropCount(flowStats.getByteCount().getValue());
                         portEgressPacketsBuilder.setInvalidDropCount(flowStats.getPacketCount().getValue());
-                    } else if (flowStats.getPriority().equals(AclConstants.CT_STATE_NEW_PRIORITY_DROP)) {
+                    } else if (flowStats.getPriority().equals(AclConstants.CT_STATE_TRACKED_NEW_DROP_PRIORITY)) {
                         portEgressBytesBuilder.setDropCount(flowStats.getByteCount().getValue());
                         portEgressPacketsBuilder.setDropCount(flowStats.getPacketCount().getValue());
                     }
@@ -187,7 +187,7 @@ public final class AclLiveStatisticsHelper {
                     if (flowStats.getPriority().equals(AclConstants.CT_STATE_TRACKED_INVALID_PRIORITY)) {
                         portIngressBytesBuilder.setInvalidDropCount(flowStats.getByteCount().getValue());
                         portIngressPacketsBuilder.setInvalidDropCount(flowStats.getPacketCount().getValue());
-                    } else if (flowStats.getPriority().equals(AclConstants.CT_STATE_NEW_PRIORITY_DROP)) {
+                    } else if (flowStats.getPriority().equals(AclConstants.CT_STATE_TRACKED_NEW_DROP_PRIORITY)) {
                         portIngressBytesBuilder.setDropCount(flowStats.getByteCount().getValue());
                         portIngressPacketsBuilder.setDropCount(flowStats.getPacketCount().getValue());
                     }

diff --git a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/utils/AclConstants.java b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/utils/AclConstants.java
index 2e3fed1c3f4c2b57fb1da2c0f5b8a3394ea6079f..81749d10d79028052d406d0ea5acc0cbd827ff6c 100644 (file)
--- a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/utils/AclConstants.java
+++ b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/utils/AclConstants.java
@@ -42,7 +42,7 @@ public final class AclConstants {
     public static final Integer CT_STATE_TRACKED_EXIST_PRIORITY = 62020;
     public static final Integer CT_STATE_TRACKED_INVALID_PRIORITY = 62015;
     public static final Integer CT_STATE_TRACKED_NEW_PRIORITY = 62010;
-    public static final Integer CT_STATE_NEW_PRIORITY_DROP = 50;
+    public static final Integer CT_STATE_TRACKED_NEW_DROP_PRIORITY = 50;
 
     public static final short DHCP_CLIENT_PORT_IPV4 = 68;
     public static final short DHCP_SERVER_PORT_IPV4 = 67;

diff --git a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/utils/AclServiceOFFlowBuilder.java b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/utils/AclServiceOFFlowBuilder.java
index 5be831a559eb86ae152ccf37b68d13c97537bf91..09a29deb7df8dfad450db785437948d3587aed71 100644 (file)
--- a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/utils/AclServiceOFFlowBuilder.java
+++ b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/utils/AclServiceOFFlowBuilder.java
@@ -13,10 +13,14 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
+import org.opendaylight.genius.mdsalutil.ActionInfo;
+import org.opendaylight.genius.mdsalutil.InstructionInfo;
 import org.opendaylight.genius.mdsalutil.MatchInfoBase;
 import org.opendaylight.genius.mdsalutil.NwConstants;
 import org.opendaylight.genius.mdsalutil.NxMatchFieldType;
 import org.opendaylight.genius.mdsalutil.NxMatchInfo;
+import org.opendaylight.genius.mdsalutil.actions.ActionDrop;
+import org.opendaylight.genius.mdsalutil.instructions.InstructionApplyActions;
 import org.opendaylight.genius.mdsalutil.matches.MatchEthernetType;
 import org.opendaylight.genius.mdsalutil.matches.MatchIcmpv4;
 import org.opendaylight.genius.mdsalutil.matches.MatchIcmpv6;
@@ -294,6 +298,30 @@ public class AclServiceOFFlowBuilder {
         return flowMatches;
     }
 
+    /** Adds LPort matches to the flow.
+     * @param lportTag lport tag
+     * @param conntrackState conntrack state to be used with matches
+     * @param conntrackMask conntrack mask to be used with matches
+     * @return list of matches
+     */
+    public static List<MatchInfoBase> addLPortTagMatches(int lportTag, int conntrackState, int conntrackMask) {
+        List<MatchInfoBase> matches = new ArrayList<>();
+        matches.add(AclServiceUtils.buildLPortTagMatch(lportTag));
+        matches.add(new NxMatchInfo(NxMatchFieldType.ct_state, new long[] {conntrackState, conntrackMask}));
+        return matches;
+    }
+
+    /** Returns drop instruction info.
+     * @return drop list of InstructionInfo objects
+     */
+    public static List<InstructionInfo> getDropInstructionInfo() {
+        List<InstructionInfo> instructions = new ArrayList<>();
+        List<ActionInfo> actionsInfos = new ArrayList<>();
+        actionsInfos.add(new ActionDrop());
+        instructions.add(new InstructionApplyActions(actionsInfos));
+        return instructions;
+    }
+
     /**
      * Converts port range into a set of masked port ranges.
      *

diff --git a/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/stats/TestOdlDirectStatisticsService.java b/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/stats/TestOdlDirectStatisticsService.java
index ea210cb37c16fa699a866938b09dd98d2b153c6a..89fbc644922b8bb9319edadcdbbef0fefb5fe48b 100644 (file)
--- a/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/stats/TestOdlDirectStatisticsService.java
+++ b/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/stats/TestOdlDirectStatisticsService.java
@@ -65,13 +65,13 @@ public abstract class TestOdlDirectStatisticsService implements OpendaylightDire
         LOG.info("getFlowStatistics rpc input = {}", input);
 
         List<FlowAndStatisticsMapList> flowStatsList = new ArrayList<>();
-        FlowAndStatisticsMapList portIngressFlowStats1 =
-                buildFlowStats(NwConstants.EGRESS_ACL_FILTER_TABLE, AclConstants.CT_STATE_NEW_PRIORITY_DROP, 1, 5, 5);
+        FlowAndStatisticsMapList portIngressFlowStats1 = buildFlowStats(NwConstants.EGRESS_ACL_FILTER_TABLE,
+                AclConstants.CT_STATE_TRACKED_NEW_DROP_PRIORITY, 1, 5, 5);
         FlowAndStatisticsMapList portIngressFlowStats2 = buildFlowStats(NwConstants.EGRESS_ACL_FILTER_TABLE,
                 AclConstants.CT_STATE_TRACKED_INVALID_PRIORITY, 1, 10, 10);
 
         FlowAndStatisticsMapList portEgressFlowStats1 = buildFlowStats(NwConstants.INGRESS_ACL_FILTER_TABLE,
-                AclConstants.CT_STATE_NEW_PRIORITY_DROP, 1, 15, 15);
+                AclConstants.CT_STATE_TRACKED_NEW_DROP_PRIORITY, 1, 15, 15);
         FlowAndStatisticsMapList portEgressFlowStats2 = buildFlowStats(NwConstants.INGRESS_ACL_FILTER_TABLE,
                 AclConstants.CT_STATE_TRACKED_INVALID_PRIORITY, 1, 20, 20);
 

diff --git a/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/tests/FlowEntryObjectsStateful.xtend b/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/tests/FlowEntryObjectsStateful.xtend
index c124de4bfd91ab4d6e5536e140c6248cde32eba4..e6c41aaf15eec6ffa4e4cf2acfec5fd05b0716a2 100644 (file)
--- a/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/tests/FlowEntryObjectsStateful.xtend
+++ b/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/tests/FlowEntryObjectsStateful.xtend
@@ -9,6 +9,7 @@ package org.opendaylight.netvirt.aclservice.tests
 
 import org.opendaylight.genius.mdsalutil.actions.ActionNxConntrack
 import org.opendaylight.genius.mdsalutil.actions.ActionNxResubmit
+import org.opendaylight.genius.mdsalutil.actions.ActionDrop
 import org.opendaylight.genius.mdsalutil.FlowEntity
 import org.opendaylight.genius.mdsalutil.instructions.InstructionApplyActions
 import org.opendaylight.genius.mdsalutil.matches.MatchArpSha
@@ -137,6 +138,50 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
                 ]
                 priority = 61010
                 tableId = 251 as short
+            ],
+            new FlowEntity(123bi) => [
+                cookie = 110100481bi
+                flowId = "Ingress_Fixed_Conntrk_Drop123_987_Tracked_New"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionDrop()
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchMetadata(1085217976614912bi, 1152920405095219200bi),
+                    new NxMatchInfoBuilder >> [
+                        matchField = NxMatchFieldType.ct_state
+                        matchValues = #[
+                            33L,
+                            33L
+                        ]
+                    ]
+                ]
+                priority = 50
+                tableId = 41 as short
+            ],
+            new FlowEntity(123bi) => [
+                cookie = 110100481bi
+                flowId = "Ingress_Fixed_Conntrk_Drop123_987_Tracked_Invalid"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionDrop()
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchMetadata(1085217976614912bi, 1152920405095219200bi),
+                    new NxMatchInfoBuilder >> [
+                        matchField = NxMatchFieldType.ct_state
+                        matchValues = #[
+                            48L,
+                            48L
+                        ]
+                    ]
+                ]
+                priority = 62015
+                tableId = 41 as short
             ]
         ]
     }
@@ -224,6 +269,50 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
                 ]
                 priority = 61010
                 tableId = 40 as short
+            ],
+            new FlowEntity(123bi) => [
+                cookie = 110100481bi
+                flowId = "Egress_Fixed_Conntrk_Drop123_987_Tracked_New"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionDrop()
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchMetadata(1085217976614912bi, 1152920405095219200bi),
+                    new NxMatchInfoBuilder >> [
+                        matchField = NxMatchFieldType.ct_state
+                        matchValues = #[
+                            33L,
+                            33L
+                        ]
+                    ]
+                ]
+                priority = 50
+                tableId = 252 as short
+            ],
+            new FlowEntity(123bi) => [
+                cookie = 110100481bi
+                flowId = "Egress_Fixed_Conntrk_Drop123_987_Tracked_Invalid"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionDrop()
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchMetadata(1085217976614912bi, 1152920405095219200bi),
+                    new NxMatchInfoBuilder >> [
+                        matchField = NxMatchFieldType.ct_state
+                        matchValues = #[
+                           48L,
+                           48L
+                        ]
+                    ]
+                ]
+                priority = 62015
+                tableId = 252 as short
             ]
         ]
     }
@@ -247,6 +336,50 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
                 ]
                 priority = 61010
                 tableId = 251 as short
+            ],
+            new FlowEntity(123bi) => [
+                cookie = 110100481bi
+                flowId = "Ingress_Fixed_Conntrk_Drop123_987_Tracked_New"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionDrop()
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchMetadata(1085217976614912bi, 1152920405095219200bi),
+                    new NxMatchInfoBuilder >> [
+                        matchField = NxMatchFieldType.ct_state
+                        matchValues = #[
+                            33L,
+                            33L
+                        ]
+                    ]
+                ]
+                priority = 50
+                tableId = 41 as short
+            ],
+            new FlowEntity(123bi) => [
+                cookie = 110100481bi
+                flowId = "Ingress_Fixed_Conntrk_Drop123_987_Tracked_Invalid"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionDrop()
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchMetadata(1085217976614912bi, 1152920405095219200bi),
+                    new NxMatchInfoBuilder >> [
+                        matchField = NxMatchFieldType.ct_state
+                        matchValues = #[
+                            48L,
+                            48L
+                        ]
+                    ]
+                ]
+                priority = 62015
+                tableId = 41 as short
             ]
         ]
     }
@@ -269,6 +402,50 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
                 ]
                 priority = 61010
                 tableId = 40 as short
+            ],
+            new FlowEntity(123bi) => [
+                cookie = 110100481bi
+                flowId = "Egress_Fixed_Conntrk_Drop123_987_Tracked_New"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionDrop()
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchMetadata(1085217976614912bi, 1152920405095219200bi),
+                    new NxMatchInfoBuilder >> [
+                        matchField = NxMatchFieldType.ct_state
+                        matchValues = #[
+                            33L,
+                            33L
+                        ]
+                    ]
+                ]
+                priority = 50
+                tableId = 252 as short
+            ],
+            new FlowEntity(123bi) => [
+                cookie = 110100481bi
+                flowId = "Egress_Fixed_Conntrk_Drop123_987_Tracked_Invalid"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionDrop()
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchMetadata(1085217976614912bi, 1152920405095219200bi),
+                    new NxMatchInfoBuilder >> [
+                        matchField = NxMatchFieldType.ct_state
+                        matchValues = #[
+                            48L,
+                            48L
+                        ]
+                    ]
+                ]
+                priority = 62015
+                tableId = 252 as short
             ]
         ]
     }
@@ -292,9 +469,52 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
                 ]
                 priority = 61010
                 tableId = 251 as short
+            ],
+            new FlowEntity(123bi) => [
+                cookie = 110100481bi
+                flowId = "Ingress_Fixed_Conntrk_Drop123_987_Tracked_New"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionDrop()
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchMetadata(1085217976614912bi, 1152920405095219200bi),
+                    new NxMatchInfoBuilder >> [
+                        matchField = NxMatchFieldType.ct_state
+                        matchValues = #[
+                            33L,
+                            33L
+                        ]
+                    ]
+                ]
+                priority = 50
+                tableId = 41 as short
+            ],
+            new FlowEntity(123bi) => [
+                cookie = 110100481bi
+                flowId = "Ingress_Fixed_Conntrk_Drop123_987_Tracked_Invalid"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionDrop()
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchMetadata(1085217976614912bi, 1152920405095219200bi),
+                    new NxMatchInfoBuilder >> [
+                        matchField = NxMatchFieldType.ct_state
+                        matchValues = #[
+                            48L,
+                            48L
+                        ]
+                    ]
+                ]
+                priority = 62015
+                tableId = 41 as short
             ]
         ]
-
     }
 
     static def fixedConntrackEgressFlowsPort3() {
@@ -315,6 +535,50 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
                 ]
                 priority = 61010
                 tableId = 40 as short
+            ],
+            new FlowEntity(123bi) => [
+                cookie = 110100481bi
+                flowId = "Egress_Fixed_Conntrk_Drop123_987_Tracked_New"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionDrop()
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchMetadata(1085217976614912bi, 1152920405095219200bi),
+                    new NxMatchInfoBuilder >> [
+                        matchField = NxMatchFieldType.ct_state
+                        matchValues = #[
+                            33L,
+                            33L
+                        ]
+                    ]
+                ]
+                priority = 50
+                tableId = 252 as short
+            ],
+            new FlowEntity(123bi) => [
+                cookie = 110100481bi
+                flowId = "Egress_Fixed_Conntrk_Drop123_987_Tracked_Invalid"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionDrop()
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchMetadata(1085217976614912bi, 1152920405095219200bi),
+                    new NxMatchInfoBuilder >> [
+                        matchField = NxMatchFieldType.ct_state
+                        matchValues = #[
+                            48L,
+                            48L
+                        ]
+                    ]
+                ]
+                priority = 62015
+                tableId = 252 as short
             ]
         ]
     }
@@ -1581,6 +1845,50 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
                 priority = 63010
                 tableId = 251 as short
             ],
+            new FlowEntity(123bi) => [
+                cookie = 110100481bi
+                flowId = "Ingress_Fixed_Conntrk_Drop123_987_Tracked_New"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionDrop()
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchMetadata(1085217976614912bi, 1152920405095219200bi),
+                    new NxMatchInfoBuilder >> [
+                        matchField = NxMatchFieldType.ct_state
+                        matchValues = #[
+                            33L,
+                            33L
+                        ]
+                    ]
+                ]
+                priority = 50
+                tableId = 41 as short
+            ],
+            new FlowEntity(123bi) => [
+                cookie = 110100481bi
+                flowId = "Ingress_Fixed_Conntrk_Drop123_987_Tracked_Invalid"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionDrop()
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchMetadata(1085217976614912bi, 1152920405095219200bi),
+                    new NxMatchInfoBuilder >> [
+                        matchField = NxMatchFieldType.ct_state
+                        matchValues = #[
+                            48L,
+                            48L
+                        ]
+                    ]
+                ]
+                priority = 62015
+                tableId = 41 as short
+            ],
             new FlowEntity(123bi) => [
                 cookie = 110100480bi
                 flowId = "Egress_DHCP_Client_v4123_987__Permit_"
@@ -1719,6 +2027,50 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
                 ]
                 priority = 63010
                 tableId = 40 as short
+            ],
+            new FlowEntity(123bi) => [
+                cookie = 110100481bi
+                flowId = "Egress_Fixed_Conntrk_Drop123_987_Tracked_New"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionDrop()
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchMetadata(1085217976614912bi, 1152920405095219200bi),
+                    new NxMatchInfoBuilder >> [
+                        matchField = NxMatchFieldType.ct_state
+                        matchValues = #[
+                            33L,
+                            33L
+                        ]
+                    ]
+                ]
+                priority = 50
+                tableId = 252 as short
+            ],
+            new FlowEntity(123bi) => [
+                cookie = 110100481bi
+                flowId = "Egress_Fixed_Conntrk_Drop123_987_Tracked_Invalid"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionDrop()
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchMetadata(1085217976614912bi, 1152920405095219200bi),
+                    new NxMatchInfoBuilder >> [
+                        matchField = NxMatchFieldType.ct_state
+                        matchValues = #[
+                            48L,
+                            48L
+                        ]
+                    ]
+                ]
+                priority = 62015
+                tableId = 252 as short
             ]
         ]
     }