+/* ICMPv4 invert type for stateful ACL */
+static const u8 icmp4_invmap[] = {
+ [ICMP4_echo_reply] = ICMP4_echo_request + 1,
+ [ICMP4_timestamp_reply] = ICMP4_timestamp_request + 1,
+ [ICMP4_information_reply] = ICMP4_information_request + 1,
+ [ICMP4_address_mask_reply] = ICMP4_address_mask_request + 1
+};
+
+/* Supported ICMPv4 messages for session creation */
+static const u8 icmp4_valid_new[] = {
+ [ICMP4_echo_request] = 1,
+ [ICMP4_timestamp_request] = 1,
+ [ICMP4_information_request] = 1,
+ [ICMP4_address_mask_request] = 1
+};
+
+/* ICMPv6 invert type for stateful ACL */
+static const u8 icmp6_invmap[] = {
+ [ICMP6_echo_reply - 128] = ICMP6_echo_request + 1,
+ [ICMP6_node_information_response - 128] = ICMP6_node_information_request + 1
+};
+
+/* Supported ICMPv6 messages for session creation */
+static const u8 icmp6_valid_new[] = {
+ [ICMP6_echo_request - 128] = 1,
+ [ICMP6_node_information_request - 128] = 1
+};
+
+/* IP4 and IP6 protocol numbers of ICMP */
+static u8 icmp_protos[] = { IP_PROTOCOL_ICMP, IP_PROTOCOL_ICMP6 };
+
+static u8 *
+format_fa_5tuple (u8 * s, va_list * args)
+{
+ fa_5tuple_t *p5t = va_arg (*args, fa_5tuple_t *);
+
+ return format(s, "%s sw_if_index %d (lsb16 %d) l3 %s%s %U -> %U"
+ " l4 proto %d l4_valid %d port %d -> %d tcp flags (%s) %02x rsvd %x",
+ p5t->pkt.is_input ? "input" : "output",
+ p5t->pkt.sw_if_index, p5t->l4.lsb_of_sw_if_index, p5t->pkt.is_ip6 ? "ip6" : "ip4",
+ p5t->pkt.is_nonfirst_fragment ? " non-initial fragment" : "",
+ format_ip46_address, &p5t->addr[0], p5t->pkt.is_ip6 ? IP46_TYPE_IP6 : IP46_TYPE_IP4,
+ format_ip46_address, &p5t->addr[1], p5t->pkt.is_ip6 ? IP46_TYPE_IP6 : IP46_TYPE_IP4,
+ p5t->l4.proto, p5t->pkt.l4_valid,
+ p5t->l4.port[0], p5t->l4.port[1],
+ p5t->pkt.tcp_flags_valid ? "valid": "invalid",
+ p5t->pkt.tcp_flags,
+ p5t->pkt.flags_reserved);
+}
+
+u8 *
+format_acl_plugin_5tuple (u8 * s, va_list * args)
+{
+ return format_fa_5tuple(s, args);
+}
+