# ip dscp cs1
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 1 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x000000fc ) ^ 0x00000000 ]
  [ cmp eq reg 1 0x00000020 ]

# ip dscp != cs1
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 1 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x000000fc ) ^ 0x00000000 ]
  [ cmp neq reg 1 0x00000020 ]

# ip dscp 0x38
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 1 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x000000fc ) ^ 0x00000000 ]
  [ cmp eq reg 1 0x000000e0 ]

# ip dscp != 0x20
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 1 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x000000fc ) ^ 0x00000000 ]
  [ cmp neq reg 1 0x00000080 ]

# ip dscp {cs0, cs1, cs2, cs3, cs4, cs5, cs6, cs7, af11, af12, af13, af21, af22, af23, af31, af32, af33, af41, af42, af43, ef}
__set%d test-inet 3
__set%d test-inet 0
        element 00000020  : 0 [end]     element 00000040  : 0 [end]     element 00000060  : 0 [end]     element 00000080  : 0 [end]    element 000000a0  : 0 [end]      element 000000c0  : 0 [end]     element 000000e0  : 0 [end]     element 00000000  : 0 [end]     element 00000028  : 0 [end]     element 00000030  : 0 [end]     element 00000038  : 0 [end]     element 00000048  : 0 [end]     element 00000050  : 0 [end]     element 00000058  : 0 [end]     element 00000068  : 0 [end]     element 00000070  : 0 [end]     element 00000078  : 0 [end]     element 00000088  : 0 [end]     element 00000090  : 0 [end]     element 00000098  : 0 [end]     element 000000b8  : 0 [end]
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 1 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x000000fc ) ^ 0x00000000 ]
  [ lookup reg 1 set __set%d ]

# ip dscp != {cs0, cs3}
__set%d test-inet 3
__set%d test-inet 0
        element 00000000  : 0 [end]     element 00000060  : 0 [end]
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 1 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x000000fc ) ^ 0x00000000 ]
  [ lookup reg 1 set __set%d 0x1 ]

# ip dscp vmap { cs1 : continue , cs4 : accept } counter
__map%d test-inet b size 2
__map%d test-inet 0
	element 00000020  : continue 0 [end]	element 00000080  : accept 0 [end]
inet test-inet input 
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 1 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x000000fc ) ^ 0x00000000 ]
  [ lookup reg 1 set __map%d dreg 0 ]
  [ counter pkts 0 bytes 0 ]

# ip length 232
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 2 => reg 1 ]
  [ cmp eq reg 1 0x0000e800 ]

# ip length != 233
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 2 => reg 1 ]
  [ cmp neq reg 1 0x0000e900 ]

# ip length 333-435
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 2 => reg 1 ]
  [ cmp gte reg 1 0x00004d01 ]
  [ cmp lte reg 1 0x0000b301 ]

# ip length != 333-453
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 2 => reg 1 ]
  [ range neq reg 1 0x00004d01 0x0000c501 ]

# ip length { 333, 553, 673, 838}
__set%d test-inet 3
__set%d test-inet 0
	element 00004d01  : 0 [end]	element 00002902  : 0 [end]	element 0000a102  : 0 [end]	element 00004603  : 0 [end]
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 2 => reg 1 ]
  [ lookup reg 1 set __set%d ]

# ip length != { 333, 553, 673, 838}
__set%d test-inet 3
__set%d test-inet 0
	element 00004d01  : 0 [end]	element 00002902  : 0 [end]	element 0000a102  : 0 [end]	element 00004603  : 0 [end]
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 2 => reg 1 ]
  [ lookup reg 1 set __set%d 0x1 ]

# ip id 22
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 4 => reg 1 ]
  [ cmp eq reg 1 0x00001600 ]

# ip id != 233
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 4 => reg 1 ]
  [ cmp neq reg 1 0x0000e900 ]

# ip id 33-45
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 4 => reg 1 ]
  [ cmp gte reg 1 0x00002100 ]
  [ cmp lte reg 1 0x00002d00 ]

# ip id != 33-45
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 4 => reg 1 ]
  [ range neq reg 1 0x00002100 0x00002d00 ]

# ip id { 33, 55, 67, 88}
__set%d test-inet 3
__set%d test-inet 0
	element 00002100  : 0 [end]	element 00003700  : 0 [end]	element 00004300  : 0 [end]	element 00005800  : 0 [end]
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 4 => reg 1 ]
  [ lookup reg 1 set __set%d ]

# ip id != { 33, 55, 67, 88}
__set%d test-inet 3
__set%d test-inet 0
	element 00002100  : 0 [end]	element 00003700  : 0 [end]	element 00004300  : 0 [end]	element 00005800  : 0 [end]
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 4 => reg 1 ]
  [ lookup reg 1 set __set%d 0x1 ]

# ip frag-off 0xde accept
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 6 => reg 1 ]
  [ cmp eq reg 1 0x0000de00 ]
  [ immediate reg 0 accept ]

# ip frag-off != 0xe9
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 6 => reg 1 ]
  [ cmp neq reg 1 0x0000e900 ]

# ip frag-off 0x21-0x2d
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 6 => reg 1 ]
  [ cmp gte reg 1 0x00002100 ]
  [ cmp lte reg 1 0x00002d00 ]

# ip frag-off != 0x21-0x2d
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 6 => reg 1 ]
  [ range neq reg 1 0x00002100 0x00002d00 ]

# ip frag-off { 0x21, 0x37, 0x43, 0x58}
__set%d test-inet 3
__set%d test-inet 0
	element 00002100  : 0 [end]	element 00003700  : 0 [end]	element 00004300  : 0 [end]	element 00005800  : 0 [end]
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 6 => reg 1 ]
  [ lookup reg 1 set __set%d ]

# ip frag-off != { 0x21, 0x37, 0x43, 0x58}
__set%d test-inet 3
__set%d test-inet 0
	element 00002100  : 0 [end]	element 00003700  : 0 [end]	element 00004300  : 0 [end]	element 00005800  : 0 [end]
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 6 => reg 1 ]
  [ lookup reg 1 set __set%d 0x1 ]

# ip frag-off & 0x1fff != 0x0
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 6 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x0000ff1f ) ^ 0x00000000 ]
  [ cmp neq reg 1 0x00000000 ]

# ip frag-off & 0x2000 != 0x0
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 6 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x00000020 ) ^ 0x00000000 ]
  [ cmp neq reg 1 0x00000000 ]

# ip frag-off & 0x4000 != 0x0
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 6 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x00000040 ) ^ 0x00000000 ]
  [ cmp neq reg 1 0x00000000 ]

# ip ttl 0 drop
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 8 => reg 1 ]
  [ cmp eq reg 1 0x00000000 ]
  [ immediate reg 0 drop ]

# ip ttl 233
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 8 => reg 1 ]
  [ cmp eq reg 1 0x000000e9 ]

# ip ttl 33-55
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 8 => reg 1 ]
  [ cmp gte reg 1 0x00000021 ]
  [ cmp lte reg 1 0x00000037 ]

# ip ttl != 45-50
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 8 => reg 1 ]
  [ range neq reg 1 0x0000002d 0x00000032 ]

# ip ttl {43, 53, 45 }
__set%d test-inet 3
__set%d test-inet 0
	element 0000002b  : 0 [end]	element 00000035  : 0 [end]	element 0000002d  : 0 [end]
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 8 => reg 1 ]
  [ lookup reg 1 set __set%d ]

# ip ttl != {43, 53, 45 }
__set%d test-inet 3
__set%d test-inet 0
	element 0000002b  : 0 [end]	element 00000035  : 0 [end]	element 0000002d  : 0 [end]
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 8 => reg 1 ]
  [ lookup reg 1 set __set%d 0x1 ]

# ip protocol tcp
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 9 => reg 1 ]
  [ cmp eq reg 1 0x00000006 ]

# ip protocol != tcp
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 9 => reg 1 ]
  [ cmp neq reg 1 0x00000006 ]

# ip protocol { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept
__set%d test-inet 3
__set%d test-inet 0
	element 00000001  : 0 [end]	element 00000032  : 0 [end]	element 00000033  : 0 [end]	element 0000006c  : 0 [end]	element 00000011  : 0 [end]	element 00000088  : 0 [end]	element 00000006  : 0 [end]	element 00000021  : 0 [end]	element 00000084  : 0 [end]
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 9 => reg 1 ]
  [ lookup reg 1 set __set%d ]
  [ immediate reg 0 accept ]

# ip protocol != { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept
__set%d test-inet 3
__set%d test-inet 0
	element 00000001  : 0 [end]	element 00000032  : 0 [end]	element 00000033  : 0 [end]	element 0000006c  : 0 [end]	element 00000011  : 0 [end]	element 00000088  : 0 [end]	element 00000006  : 0 [end]	element 00000021  : 0 [end]	element 00000084  : 0 [end]
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 9 => reg 1 ]
  [ lookup reg 1 set __set%d 0x1 ]
  [ immediate reg 0 accept ]

# ip protocol 255
ip test-ip4 input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 9 => reg 1 ]
  [ cmp eq reg 1 0x000000ff ]

# ip checksum 13172 drop
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 10 => reg 1 ]
  [ cmp eq reg 1 0x00007433 ]
  [ immediate reg 0 drop ]

# ip checksum 22
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 10 => reg 1 ]
  [ cmp eq reg 1 0x00001600 ]

# ip checksum != 233
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 10 => reg 1 ]
  [ cmp neq reg 1 0x0000e900 ]

# ip checksum 33-45
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 10 => reg 1 ]
  [ cmp gte reg 1 0x00002100 ]
  [ cmp lte reg 1 0x00002d00 ]

# ip checksum != 33-45
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 10 => reg 1 ]
  [ range neq reg 1 0x00002100 0x00002d00 ]

# ip checksum { 33, 55, 67, 88}
__set%d test-inet 3
__set%d test-inet 0
	element 00002100  : 0 [end]	element 00003700  : 0 [end]	element 00004300  : 0 [end]	element 00005800  : 0 [end]
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 10 => reg 1 ]
  [ lookup reg 1 set __set%d ]

# ip checksum != { 33, 55, 67, 88}
__set%d test-inet 3
__set%d test-inet 0
	element 00002100  : 0 [end]	element 00003700  : 0 [end]	element 00004300  : 0 [end]	element 00005800  : 0 [end]
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 10 => reg 1 ]
  [ lookup reg 1 set __set%d 0x1 ]

# ip saddr 192.168.2.0/24
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 3b @ network header + 12 => reg 1 ]
  [ cmp eq reg 1 0x0002a8c0 ]

# ip saddr != 192.168.2.0/24
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 3b @ network header + 12 => reg 1 ]
  [ cmp neq reg 1 0x0002a8c0 ]

# ip saddr 192.168.3.1 ip daddr 192.168.3.100
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 12 => reg 1 ]
  [ cmp eq reg 1 0x0103a8c0 ]
  [ payload load 4b @ network header + 16 => reg 1 ]
  [ cmp eq reg 1 0x6403a8c0 ]

# ip saddr != 1.1.1.1
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 12 => reg 1 ]
  [ cmp neq reg 1 0x01010101 ]

# ip saddr 1.1.1.1
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 12 => reg 1 ]
  [ cmp eq reg 1 0x01010101 ]

# ip daddr 192.168.0.1-192.168.0.250
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 16 => reg 1 ]
  [ cmp gte reg 1 0x0100a8c0 ]
  [ cmp lte reg 1 0xfa00a8c0 ]

# ip daddr 10.0.0.0-10.255.255.255
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 16 => reg 1 ]
  [ cmp gte reg 1 0x0000000a ]
  [ cmp lte reg 1 0xffffff0a ]

# ip daddr 172.16.0.0-172.31.255.255
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 16 => reg 1 ]
  [ cmp gte reg 1 0x000010ac ]
  [ cmp lte reg 1 0xffff1fac ]

# ip daddr 192.168.3.1-192.168.4.250
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 16 => reg 1 ]
  [ cmp gte reg 1 0x0103a8c0 ]
  [ cmp lte reg 1 0xfa04a8c0 ]

# ip daddr != 192.168.0.1-192.168.0.250
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 16 => reg 1 ]
  [ range neq reg 1 0x0100a8c0 0xfa00a8c0 ]

# ip daddr { 192.168.5.1, 192.168.5.2, 192.168.5.3 } accept
__set%d test-inet 3
__set%d test-inet 0
	element 0105a8c0  : 0 [end]	element 0205a8c0  : 0 [end]	element 0305a8c0  : 0 [end]
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 16 => reg 1 ]
  [ lookup reg 1 set __set%d ]
  [ immediate reg 0 accept ]

# ip daddr != { 192.168.5.1, 192.168.5.2, 192.168.5.3 } accept
__set%d test-inet 3
__set%d test-inet 0
	element 0105a8c0  : 0 [end]	element 0205a8c0  : 0 [end]	element 0305a8c0  : 0 [end]
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 16 => reg 1 ]
  [ lookup reg 1 set __set%d 0x1 ]
  [ immediate reg 0 accept ]

# ip daddr 192.168.1.2-192.168.1.55
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 16 => reg 1 ]
  [ cmp gte reg 1 0x0201a8c0 ]
  [ cmp lte reg 1 0x3701a8c0 ]

# ip daddr != 192.168.1.2-192.168.1.55
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 16 => reg 1 ]
  [ range neq reg 1 0x0201a8c0 0x3701a8c0 ]

# ip saddr 192.168.1.3-192.168.33.55
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 12 => reg 1 ]
  [ cmp gte reg 1 0x0301a8c0 ]
  [ cmp lte reg 1 0x3721a8c0 ]

# ip saddr != 192.168.1.3-192.168.33.55
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 12 => reg 1 ]
  [ range neq reg 1 0x0301a8c0 0x3721a8c0 ]

# ip daddr 192.168.0.1
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 16 => reg 1 ]
  [ cmp eq reg 1 0x0100a8c0 ]

# ip daddr 192.168.0.1 drop
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 16 => reg 1 ]
  [ cmp eq reg 1 0x0100a8c0 ]
  [ immediate reg 0 drop ]

# ip daddr 192.168.0.2
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 16 => reg 1 ]
  [ cmp eq reg 1 0x0200a8c0 ]

# ip saddr & 0xff == 1
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 12 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0xff000000 ) ^ 0x00000000 ]
  [ cmp eq reg 1 0x01000000 ]

# ip saddr & 0.0.0.255 < 0.0.0.127
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 12 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0xff000000 ) ^ 0x00000000 ]
  [ cmp lt reg 1 0x7f000000 ]

# ip saddr & 0xffff0000 == 0xffff0000
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 12 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x0000ffff ) ^ 0x00000000 ]
  [ cmp eq reg 1 0x0000ffff ]

# ip version 4 ip hdrlength 5
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 0 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x000000f0 ) ^ 0x00000000 ]
  [ cmp eq reg 1 0x00000040 ]
  [ payload load 1b @ network header + 0 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x0000000f ) ^ 0x00000000 ]
  [ cmp eq reg 1 0x00000005 ]

# ip hdrlength 0
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 0 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x0000000f ) ^ 0x00000000 ]
  [ cmp eq reg 1 0x00000000 ]

# ip hdrlength 15
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 0 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x0000000f ) ^ 0x00000000 ]
  [ cmp eq reg 1 0x0000000f ]

# ip hdrlength vmap { 0-4 : drop, 5 : accept, 6 : continue } counter
__map%d test-inet f size 4
__map%d test-inet 0
	element 00000000  : drop 0 [end]	element 00000005  : accept 0 [end]	element 00000006  : continue 0 [end]	element 00000007  : 1 [end]
inet test-inet input 
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 0 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x0000000f ) ^ 0x00000000 ]
  [ lookup reg 1 set __map%d dreg 0 ]
  [ counter pkts 0 bytes 0 ]

# iif "lo" ip daddr set 127.0.0.1
inet test-inet input
  [ meta load iif => reg 1 ]
  [ cmp eq reg 1 0x00000001 ]
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ immediate reg 1 0x0100007f ]
  [ payload write reg 1 => 4b @ network header + 16 csum_type 1 csum_off 10 csum_flags 0x1 ]

# iif "lo" ip checksum set 0
inet test-inet input
  [ meta load iif => reg 1 ]
  [ cmp eq reg 1 0x00000001 ]
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ immediate reg 1 0x00000000 ]
  [ payload write reg 1 => 2b @ network header + 10 csum_type 1 csum_off 10 csum_flags 0x0 ]

# iif "lo" ip id set 0
inet test-inet input
  [ meta load iif => reg 1 ]
  [ cmp eq reg 1 0x00000001 ]
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ immediate reg 1 0x00000000 ]
  [ payload write reg 1 => 2b @ network header + 4 csum_type 1 csum_off 10 csum_flags 0x0 ]

# iif "lo" ip ecn set 1
inet test-inet input
  [ meta load iif => reg 1 ]
  [ cmp eq reg 1 0x00000001 ]
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 0 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x0000fcff ) ^ 0x00000100 ]
  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]

# iif "lo" ip ecn set ce
inet test-netdev ingress
  [ meta load iif => reg 1 ]
  [ cmp eq reg 1 0x00000001 ]
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 0 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x0000fcff ) ^ 0x00000300 ]
  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]

# iif "lo" ip dscp set af23
inet test-inet input
  [ meta load iif => reg 1 ]
  [ cmp eq reg 1 0x00000001 ]
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 0 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x000003ff ) ^ 0x00005800 ]
  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]

# iif "lo" ip dscp set cs0
inet test-inet input
  [ meta load iif => reg 1 ]
  [ cmp eq reg 1 0x00000001 ]
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 0 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x000003ff ) ^ 0x00000000 ]
  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]

# iif "lo" ip ttl set 23
inet test-inet input
  [ meta load iif => reg 1 ]
  [ cmp eq reg 1 0x00000001 ]
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 8 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x0000ff00 ) ^ 0x00000017 ]
  [ payload write reg 1 => 2b @ network header + 8 csum_type 1 csum_off 10 csum_flags 0x0 ]

# iif "lo" ip protocol set 1
inet test-inet input
  [ meta load iif => reg 1 ]
  [ cmp eq reg 1 0x00000001 ]
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 2b @ network header + 8 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x000000ff ) ^ 0x00000100 ]
  [ payload write reg 1 => 2b @ network header + 8 csum_type 1 csum_off 10 csum_flags 0x1 ]

# ip saddr . ip daddr { 192.0.2.1 . 10.0.0.1-10.0.0.2 }
__set%d test-inet 87 size 1
__set%d test-inet 0
        element 010200c0 0100000a  - 010200c0 0200000a  : 0 [end]
inet
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 12 => reg 1 ]
  [ payload load 4b @ network header + 16 => reg 9 ]
  [ lookup reg 1 set __set%d ]

# ip saddr . ip daddr vmap { 192.168.5.1-192.168.5.128 . 192.168.6.1-192.168.6.128 : accept }
__map%d test-inet 8f size 1
__map%d test-inet 0
        element 0105a8c0 0106a8c0  - 8005a8c0 8006a8c0  : accept 0 [end]
inet
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 12 => reg 1 ]
  [ payload load 4b @ network header + 16 => reg 9 ]
  [ lookup reg 1 set __map%d dreg 0 ]

# ip saddr 1.2.3.4 ip daddr 3.4.5.6
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 12 => reg 1 ]
  [ cmp eq reg 1 0x04030201 ]
  [ payload load 4b @ network header + 16 => reg 1 ]
  [ cmp eq reg 1 0x06050403 ]

# ip saddr 1.2.3.4 counter ip daddr 3.4.5.6
inet test-inet input
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 4b @ network header + 12 => reg 1 ]
  [ cmp eq reg 1 0x04030201 ]
  [ counter pkts 0 bytes 0 ]
  [ payload load 4b @ network header + 16 => reg 1 ]
  [ cmp eq reg 1 0x06050403 ]