How to calculate mask from TCP port range - tcp

Question

I'm trying to wrap my head around calculating a mask value which can denote L4 port range. Suppose the input range is 500-1000. Given the mask and lower value, how can the upper value be calculated?

Answer 1

Port masking typically follows the format: <port>/<mask>. An example of port masking can be found in the OvS ovs-ofctl manual:
https://www.openvswitch.org/support/dist-docs-2.5/ovs-ofctl.8.html
Excerpt:
...
tcp_src=port/mask
tcp_dst=port/mask
udp_src=port/mask
udp_dst=port/mask
sctp_src=port/mask
sctp_dst=port/mask
Bitwise match on TCP (or UDP or SCTP) source or destination
port. The port and mask are 16-bit numbers written in decimal
or in hexadecimal prefixed by 0x. Each 1-bit in mask requires
that the corresponding bit in port must match. Each 0-bit in
mask causes the corresponding bit to be ignored.
Bitwise matches on transport ports are rarely useful in isola‐
tion, but a group of them can be used to reduce the number of
flows required to match on a range of transport ports. For
example, suppose that the goal is to match TCP source ports 1000
to 1999, inclusive. One way is to insert 1000 flows, each of
which matches on a single source port. Another way is to look
at the binary representations of 1000 and 1999, as follows:
01111101000
11111001111
and then to transform those into a series of bitwise matches
that accomplish the same results:
01111101xxx
0111111xxxx
10xxxxxxxxx
110xxxxxxxx
1110xxxxxxx
11110xxxxxx
1111100xxxx
which become the following when written in the syntax required
by ovs-ofctl:
tcp,tcp_src=0x03e8/0xfff8
tcp,tcp_src=0x03f0/0xfff0
tcp,tcp_src=0x0400/0xfe00
tcp,tcp_src=0x0600/0xff00
tcp,tcp_src=0x0700/0xff80
tcp,tcp_src=0x0780/0xffc0
tcp,tcp_src=0x07c0/0xfff0
Only Open vSwitch 1.6 and later supports bitwise matching on
transport ports.
Like the exact-match forms described above, the bitwise match
forms apply only when dl_type and nw_proto specify TCP or UDP or
SCTP.
The following python3 mask_range function returns a list of port masks given a start and end port number.
# port_mask.py
LIMIT = 65535
def max_port(port, mask):
xid = LIMIT - mask
nid = port & mask
return nid + xid
def port_mask(port, end):
bit = 1
mask = LIMIT
test_mask = LIMIT
net = port & LIMIT
max_p = max_port(net, LIMIT)
while net and max_p < end:
net = port & test_mask
if net < port:
break
max_p = max_port(net, test_mask)
if max_p <= end:
mask = test_mask
test_mask -= bit
bit <<= 1
return mask
def mask_range(start, end):
port_masks = []
if end <= start or end > LIMIT:
exit(1)
port = start
while port <= end:
mask = port_mask(port, end)
port_masks.append(f'{hex(port)}/{hex(mask)}')
port = max_port(port, mask) + 1
return port_masks
Example:
# test.py
from port_mask import mask_range
if __name__ == '__main__':
masks = mask_range(1000, 1999)
print(f'1000-1999: {masks}')
Outputs:
1000-1999: ['0x3e8/0xfff8', '0x3f0/0xfff0', '0x400/0xfe00', '0x600/0xff00', '0x700/0xff80', '0x780/0xffc0', '0x7c0/0xfff0']