Repository navigation
[multicast] check inner TTL on decap - #400
Open
zeeshanlakhani wants to merge 6 commits into
Open
zeeshanlakhani wants to merge 6 commits into
zeeshanlakhani wants to merge 6 commits into
Conversation
The parser's TTL/hop limit checks cover only the outer header thus far. A zero inner TTL could wrap to 255 on decap, while on bifurcated egress, we could forward TTL 1 as 0. This work drops expired multicast packets before decrementing the TTL/hop limit, occurring both at ingress for external-only groups and at egress for bifurcated (replicated) groups. Underlay replicas do retain their inner packet. Drop counting now adds a `multicast_ttl_exceeded` reason to account for expiry. Also, this includes: - zero TTL/hop limit on unicast NAT egress now goes to Time Exceeded, along with TTL=1 (it used to wrap to 255) - no ICMP error requests for multicast route misses or expiry (RFC 1812 §4.3.2.7, RFC 4443 §2.4[e.3]) - `sc_egress` is set to a constant 0 on the sidecar paths that read `ucast_egress_port` before anything actually sets it (see P4-16 §8.25, unspecified value) - the mcast MAC rewrite table no longer runs on replicas we're dropping due to TTL (its direct counter had been counting them) - fix spelling: `nat_engress_blocked` -> `nat_egress_blocked` on the drop reason label (typo from #197)
Ry flagged this on oxidecomputer/sidecar-lite#152 (its handling of ff02 reject was emulating this sidecar). Ever since #14, the parser dropped ttl/hl (hop-limit) 0 before `services` was involved, which meant that a unicast packet headed to a switch address and `ff02::/16` headed to the scrimlet would both be dropped. RFC 1812 §4.2.2.9 and RFC 8200 §3 mention that the destination should still accept it, while the forwarding pass still has to drop (per RFC 1812 §5.3.1). This work updates the sidecar parser to record the reason via meta and then continue parsing. For unicast and IPv6 link-local multicast, the drop has been moved to the forwarding side. Note: some of the arrangement here is to make this change while operating at our 20-stage max. Includes: - mcast packets at ttl/hl 1 now get counted as `multicast_ttl_exceeded` - Geneve encapped packets headed to a switch address with an outer hop limit of 0 get decapped again, as it was before #14
zeeshanlakhani
force-pushed
the
zl/mcast-inner-ttl-guard
branch
from
October 19, 2026 16:30
8622fe4 to
7e10cfb
Compare
zeeshanlakhani
removed this pull request from stack #401
October 21, 2026 01:55
zeeshanlakhani
added this pull request to stack #410
October 21, 2026 01:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The parser's TTL/hop limit checks cover only the outer header thus far. A zero inner TTL could wrap to 255 on decap, while on bifurcated egress, we could forward TTL 1 as 0.
This work drops expired multicast packets before decrementing the TTL/hop limit, occurring both at ingress for external-only groups and at egress for bifurcated (replicated) groups. Underlay replicas do retain their inner packet. Drop counting now adds a
multicast_ttl_exceededreason to account for expiry.Also, this includes:
sc_egressis set to a constant 0 on the sidecar paths that readucast_egress_portbefore anything actually sets it (see P4-16 §8.25, unspecified value)nat_engress_blocked->nat_egress_blockedon the drop reason label (typo from prevent guest traffic from accessing the backplane network #197)