[multicast] Narrow to admin-local Omicron underlay & match Omicron updates to mcast lifecycle by zeeshanlakhani · Pull Request #162 · oxidecomputer/dendrite

zeeshanlakhani · 2025-12-01T03:45:45Z

This PR aligns with the implicit lifecycle work that was recently merged into Omicron: oxidecomputer/omicron#9450.

Previously, internal/underlay multicast groups accepted admin-configured addresses, including admin-local (ff04), site-local (ff05), and org-local (ff08). This narrows the scope to only admin-local (ff04::/16), with ff04::/64 reserved for Omicron's internal underlay allocation.

The first set of key changes included:

Remove IPV6_SITE_LOCAL_PATTERN and IPV6_ORG_SCOPE_PATTERN from P4
- Update P4 table entries to only match admin-local (size 4→2) Omicron-focused underlay
Update to from oxnet v0.1.4
Bump to API versions from 2->3 and 3->4.
Only ff04::/64 is reserved for Omicron's internal underlay multicast allocation
- Customers can use other admin-local /64s (e.g., ff04:0:0:1::/64) for external groups
validate_not_underlay_subnet() blocks ff04::/64 for external group creation
validate_nat_target() requires NAT IPs be within ff04::/64
P4 mcast_tag_check matches only ff04::/64 (removed dead ULA entry)
Update README with OpenAPI generation instructions
Use new multicast subnet constants from omicron-common for validation

After the Omicron work finally landed, which this PR relied on, we also addressed ASM groups with sources and explicit tagging:

ASM source filtering: Source filters are now allowed on ASM addresses (previously SSM-only). IpSrc::Subnet was replaced with IpSrc::Any for any-source matching.
P4 source filter changes: The source filter tables changed from exact to lpm matching on IPv6, and the multicast check was broadened from SSM-only ranges (232.0.0.0/8, ff3x::/16) to all multicast (224.0.0.0/4, ff00::/8).
Tag ownership: Multicast groups now require tag-based validation for mutations (delete/update) in API v4 (current). Tags are assigned at creation (user-provided or auto-generated as {uuid}:{group_ip}). Tags cannot be changed post-creation and must match for mutations; this is enforced by requiring the existing tag, not by rejecting tag-change requests. This prevents accidental modification or deletion of groups associated with other components, and better works with Omicron's retry model.

The API structure is now modeled as:

v4 = TAG_OWNERSHIP: required tags for delete/update as query params, IpSrc::Any,
underlay subnet restricted to ff04::/64 (not all of ff04::/16)
v3 = SOURCE_FILTER_ANY: optional tags, IpSrc::Any
v2 = DUAL_STACK_NAT_WORKFLOW: optional tags, IpSrc::Subnet (from main)
v1 = INITIAL (from main)

This PR is a precursor to a follow-up PR that leverages updated code in `omicron-common`. This gets dendrite in line with Omicron `main`, capturing an upstream type change that we needed to accomodate.

Previously, internal multicast groups accepted admin-scoped addresses including admin-local (ff04), site-local (ff05), and org-local (ff08). This narrows the scope to only admin-local (ff04::/16), which is what Omicron *now* dictates. - [ ] This should be merged after oxidecomputer/omicron#9450 is reviewed and merged into Omicron. We now make Dendrite/Dpd match Omicron consistently for validation. Key changes: - Remove IPV6_SITE_LOCAL_PATTERN and IPV6_ORG_SCOPE_PATTERN from P4 - Update P4 table entries to only match admin-local (size 4→2) - Add ADMIN_LOCAL_PREFIX const to dpd-types with RFC doc links - Update validation to use `is_admin_local_multicast()` from oxnet v0.1.4 - Bump to API version 2 for doc changes (only) - Update README with OpenAPI generation instructions - Use new multicast subnet constants from `omicron-common` for validation

zeeshanlakhani · 2025-12-15T06:22:09Z

@rcgoodfellow updated for your review.

FelixMcFelix

Thanks Zeeshan, the updates to the allowed IP families all make sense. Just some questions on the expanded comments on the decapsualtion bitmaps in the dataplane.

zeeshanlakhani · 2025-12-16T01:19:18Z

Thanks Zeeshan, the updates to the allowed IP families all make sense. Just some questions on the expanded comments on the decapsualtion bitmaps in the dataplane.

Yep. No questions, just my bad in context. Fixed.

FelixMcFelix

Thanks for fixing up those comments!

zeeshanlakhani · 2025-12-17T01:08:11Z

@rcgoodfellow, let me know if you'd like another look at this. I'll be doing a follow-up PR as well on some ssm/asm updates.

rcgoodfellow · 2026-01-01T20:03:17Z

 //
 // Copyright 2025 Oxide Computer Company

+// Port Bitmap Check Table


Thanks for adding this.

This diffset handles our move toward ASM groups being able to have source IPs. Includes: - Replace IpSrc::Subnet with IpSrc::Any for any-source multicast filtering - Add source filter normalization: when Any is present, collapse to single /0 entry; empty sources treated as allow-any - API versioning - Add tag ownership validation for group updates and deletes (v4 API) - Add v2/v3 API version adapters for backward compatibility - Fix test_service_ipv4_unknown_address to set NAT-only on correct port - #172 - I had to fix this here, as it was failing consistently locally.

zeeshanlakhani · 2026-01-14T03:58:21Z

+
+# Workaround for omicron's bootstore transitive dependency on pq-sys
+[env]
+DEP_PQ_LIBDIRS = "1"


Sadly, this is now always necessary, having updated to a new Omicron commit. It's on maghemite too: https://github.com/oxidecomputer/maghemite/blob/main/.cargo/config.toml#L13.

zeeshanlakhani · 2026-01-14T21:28:07Z

@FelixMcFelix @rcgoodfellow I had to rework the API mgmt here, but this is now ready for another look.

zeeshanlakhani · 2026-01-15T02:41:19Z

PR description updated btw to capture everything here.

…4::/16 As per Omicron, customers can use admin-local IPv6 multicast addresses (ff04::/16) for external groups, except for the reserved underlay subnet (ff04::/64) which is used for internal underlay multicast allocation. Changes: - switch external-group validation from validate_not_admin_local_ipv6() to validate_not_underlay_subnet() - validate_not_underlay_subnet() now only rejects ff04::/64 - validate_nat_target() now requires NAT IPs in UNDERLAY_MULTICAST_SUBNET - VLAN tagging logic uses UNDERLAY_MULTICAST_SUBNET, removed dead is_unique_local() check (multicast IPs can't be ULA) - removed unused IPV6_SCOPE_MASK, IPV6_ULA_MASK/PATTERN from P4 - removed dead ULA entry from mcast_tag_check table (const size = 1) - Updated integration test assertions, added unit tests

API v4 (MCAST_STRICT_UNDERLAY) changes: - Renamed AdminScopedIpv6 to UnderlayMulticastIpv6 to better reflect its purpose as the underlay multicast subnet type - Tightened validation from ff04::/16 (admin-local scope) to ff04::/64 to match Omicron's UNDERLAY_MULTICAST_SUBNET allocation - Tag validation now required for update/delete operations (as before) API v3 backward compatibility: - Added v3::AdminScopedIpv6 type that accepts the broader ff04::/16 range - v3 endpoints use v3::MulticastUnderlayGroupIpParam and convert to the v4 type with appropriate error handling for out-of-range addresses

…ion via dropshot Path try_map Includes: - delegate a versioned endpoint in lib.rs from api-server.rs - Cargo.lock updated for new dropshot/omicron

…gation We follow API guidelines recently posted in https://github.com/oxidecomputer/dropshot-api-manager/blob/main/guides/new-version.md

zeeshanlakhani · 2026-01-21T07:38:44Z

Same thing here. I'll get to the API updates when ready, but it'd be good to get re-review here @FelixMcFelix @rcgoodfellow.

Created using jj-spr 0.1.0

zeeshanlakhani · 2026-01-22T07:35:13Z

Going to close and re-open, due to so many merge commits.

…tering Re-opening this from #162, as that PR was getting pretty gnarly with a saturation of merge commits. This one deserves a re-review after some added changes to match the Omicron mcast-lifecycle work in oxidecomputer/omicron#9450. Underlay changes: - Restrict internal multicast from admin/site/org scoped (ff04, ff05, ff08) to just Omicron's reserved subnet (ff04::/64). These underlay addresses are made unique in Omicron. - Rename `AdminScopedIpv6` to `UnderlayMulticastIpv6`. - Simplify P4 to only match ff04::/64. - Use omicron-common multicast constants for validation. Source filtering changes: - Replace IpSrc::Subnet with IpSrc::Any for any-source matching. - Change IPv6 source filter from exact to LPM match. - Allow source filters on ASM groups (previously SSM-only). API changes: - API v5 adds IpSrc::Any for ASM source filtering. - API v6 enforces strict underlay subnet validation. Reviewers: FelixMcFelix, Nieuwejaar, rcgoodfellow Pull Request: #189

zeeshanlakhani · 2025-12-01T03:45:45Z

This PR aligns with the implicit lifecycle work that was recently merged into Omicron: oxidecomputer/omicron#9450.

Previously, internal/underlay multicast groups accepted admin-configured addresses, including admin-local (ff04), site-local (ff05), and org-local (ff08). This narrows the scope to only admin-local (ff04::/16), with ff04::/64 reserved for Omicron's internal underlay allocation.

The first set of key changes included:

Remove IPV6_SITE_LOCAL_PATTERN and IPV6_ORG_SCOPE_PATTERN from P4
- Update P4 table entries to only match admin-local (size 4→2) Omicron-focused underlay
Update to from oxnet v0.1.4
Bump to API versions from 2->3 and 3->4.
Only ff04::/64 is reserved for Omicron's internal underlay multicast allocation
- Customers can use other admin-local /64s (e.g., ff04:0:0:1::/64) for external groups
validate_not_underlay_subnet() blocks ff04::/64 for external group creation
validate_nat_target() requires NAT IPs be within ff04::/64
P4 mcast_tag_check matches only ff04::/64 (removed dead ULA entry)
Update README with OpenAPI generation instructions
Use new multicast subnet constants from omicron-common for validation

After the Omicron work finally landed, which this PR relied on, we also addressed ASM groups with sources and explicit tagging:

ASM source filtering: Source filters are now allowed on ASM addresses (previously SSM-only). IpSrc::Subnet was replaced with IpSrc::Any for any-source matching.
P4 source filter changes: The source filter tables changed from exact to lpm matching on IPv6, and the multicast check was broadened from SSM-only ranges (232.0.0.0/8, ff3x::/16) to all multicast (224.0.0.0/4, ff00::/8).
Tag ownership: Multicast groups now require tag-based validation for mutations (delete/update) in API v4 (current). Tags are assigned at creation (user-provided or auto-generated as {uuid}:{group_ip}). Tags cannot be changed post-creation and must match for mutations; this is enforced by requiring the existing tag, not by rejecting tag-change requests. This prevents accidental modification or deletion of groups associated with other components, and better works with Omicron's retry model.

The API structure is now modeled as:

v4 = TAG_OWNERSHIP: required tags for delete/update as query params, IpSrc::Any,
underlay subnet restricted to ff04::/64 (not all of ff04::/16)
v3 = SOURCE_FILTER_ANY: optional tags, IpSrc::Any
v2 = DUAL_STACK_NAT_WORKFLOW: optional tags, IpSrc::Subnet (from main)
v1 = INITIAL (from main)

This PR is a precursor to a follow-up PR that leverages updated code in `omicron-common`. This gets dendrite in line with Omicron `main`, capturing an upstream type change that we needed to accomodate.

Previously, internal multicast groups accepted admin-scoped addresses including admin-local (ff04), site-local (ff05), and org-local (ff08). This narrows the scope to only admin-local (ff04::/16), which is what Omicron *now* dictates. - [ ] This should be merged after oxidecomputer/omicron#9450 is reviewed and merged into Omicron. We now make Dendrite/Dpd match Omicron consistently for validation. Key changes: - Remove IPV6_SITE_LOCAL_PATTERN and IPV6_ORG_SCOPE_PATTERN from P4 - Update P4 table entries to only match admin-local (size 4→2) - Add ADMIN_LOCAL_PREFIX const to dpd-types with RFC doc links - Update validation to use `is_admin_local_multicast()` from oxnet v0.1.4 - Bump to API version 2 for doc changes (only) - Update README with OpenAPI generation instructions - Use new multicast subnet constants from `omicron-common` for validation

zeeshanlakhani · 2025-12-15T06:22:09Z

@rcgoodfellow updated for your review.

FelixMcFelix

Thanks Zeeshan, the updates to the allowed IP families all make sense. Just some questions on the expanded comments on the decapsualtion bitmaps in the dataplane.

zeeshanlakhani · 2025-12-16T01:19:18Z

Thanks Zeeshan, the updates to the allowed IP families all make sense. Just some questions on the expanded comments on the decapsualtion bitmaps in the dataplane.

Yep. No questions, just my bad in context. Fixed.

FelixMcFelix

Thanks for fixing up those comments!

zeeshanlakhani · 2025-12-17T01:08:11Z

@rcgoodfellow, let me know if you'd like another look at this. I'll be doing a follow-up PR as well on some ssm/asm updates.

rcgoodfellow · 2026-01-01T20:03:17Z

 //
 // Copyright 2025 Oxide Computer Company

+// Port Bitmap Check Table


Thanks for adding this.

This diffset handles our move toward ASM groups being able to have source IPs. Includes: - Replace IpSrc::Subnet with IpSrc::Any for any-source multicast filtering - Add source filter normalization: when Any is present, collapse to single /0 entry; empty sources treated as allow-any - API versioning - Add tag ownership validation for group updates and deletes (v4 API) - Add v2/v3 API version adapters for backward compatibility - Fix test_service_ipv4_unknown_address to set NAT-only on correct port - #172 - I had to fix this here, as it was failing consistently locally.

zeeshanlakhani · 2026-01-14T03:58:21Z

+
+# Workaround for omicron's bootstore transitive dependency on pq-sys
+[env]
+DEP_PQ_LIBDIRS = "1"


Sadly, this is now always necessary, having updated to a new Omicron commit. It's on maghemite too: https://github.com/oxidecomputer/maghemite/blob/main/.cargo/config.toml#L13.

zeeshanlakhani · 2026-01-14T21:28:07Z

@FelixMcFelix @rcgoodfellow I had to rework the API mgmt here, but this is now ready for another look.

zeeshanlakhani · 2026-01-15T02:41:19Z

PR description updated btw to capture everything here.

…4::/16 As per Omicron, customers can use admin-local IPv6 multicast addresses (ff04::/16) for external groups, except for the reserved underlay subnet (ff04::/64) which is used for internal underlay multicast allocation. Changes: - switch external-group validation from validate_not_admin_local_ipv6() to validate_not_underlay_subnet() - validate_not_underlay_subnet() now only rejects ff04::/64 - validate_nat_target() now requires NAT IPs in UNDERLAY_MULTICAST_SUBNET - VLAN tagging logic uses UNDERLAY_MULTICAST_SUBNET, removed dead is_unique_local() check (multicast IPs can't be ULA) - removed unused IPV6_SCOPE_MASK, IPV6_ULA_MASK/PATTERN from P4 - removed dead ULA entry from mcast_tag_check table (const size = 1) - Updated integration test assertions, added unit tests

API v4 (MCAST_STRICT_UNDERLAY) changes: - Renamed AdminScopedIpv6 to UnderlayMulticastIpv6 to better reflect its purpose as the underlay multicast subnet type - Tightened validation from ff04::/16 (admin-local scope) to ff04::/64 to match Omicron's UNDERLAY_MULTICAST_SUBNET allocation - Tag validation now required for update/delete operations (as before) API v3 backward compatibility: - Added v3::AdminScopedIpv6 type that accepts the broader ff04::/16 range - v3 endpoints use v3::MulticastUnderlayGroupIpParam and convert to the v4 type with appropriate error handling for out-of-range addresses

…ion via dropshot Path try_map Includes: - delegate a versioned endpoint in lib.rs from api-server.rs - Cargo.lock updated for new dropshot/omicron

…gation We follow API guidelines recently posted in https://github.com/oxidecomputer/dropshot-api-manager/blob/main/guides/new-version.md

zeeshanlakhani · 2026-01-21T07:38:44Z

Same thing here. I'll get to the API updates when ready, but it'd be good to get re-review here @FelixMcFelix @rcgoodfellow.

Created using jj-spr 0.1.0

zeeshanlakhani · 2026-01-22T07:35:13Z

Going to close and re-open, due to so many merge commits.

…tering Re-opening this from #162, as that PR was getting pretty gnarly with a saturation of merge commits. This one deserves a re-review after some added changes to match the Omicron mcast-lifecycle work in oxidecomputer/omicron#9450. Underlay changes: - Restrict internal multicast from admin/site/org scoped (ff04, ff05, ff08) to just Omicron's reserved subnet (ff04::/64). These underlay addresses are made unique in Omicron. - Rename `AdminScopedIpv6` to `UnderlayMulticastIpv6`. - Simplify P4 to only match ff04::/64. - Use omicron-common multicast constants for validation. Source filtering changes: - Replace IpSrc::Subnet with IpSrc::Any for any-source matching. - Change IPv6 source filter from exact to LPM match. - Allow source filters on ASM groups (previously SSM-only). API changes: - API v5 adds IpSrc::Any for ASM source filtering. - API v6 enforces strict underlay subnet validation. Reviewers: FelixMcFelix, Nieuwejaar, rcgoodfellow Pull Request: #189

zeeshanlakhani · 2025-12-01T03:45:45Z

This PR aligns with the implicit lifecycle work that was recently merged into Omicron: oxidecomputer/omicron#9450.

Previously, internal/underlay multicast groups accepted admin-configured addresses, including admin-local (ff04), site-local (ff05), and org-local (ff08). This narrows the scope to only admin-local (ff04::/16), with ff04::/64 reserved for Omicron's internal underlay allocation.

The first set of key changes included:

Remove IPV6_SITE_LOCAL_PATTERN and IPV6_ORG_SCOPE_PATTERN from P4
- Update P4 table entries to only match admin-local (size 4→2) Omicron-focused underlay
Update to from oxnet v0.1.4
Bump to API versions from 2->3 and 3->4.
Only ff04::/64 is reserved for Omicron's internal underlay multicast allocation
- Customers can use other admin-local /64s (e.g., ff04:0:0:1::/64) for external groups
validate_not_underlay_subnet() blocks ff04::/64 for external group creation
validate_nat_target() requires NAT IPs be within ff04::/64
P4 mcast_tag_check matches only ff04::/64 (removed dead ULA entry)
Update README with OpenAPI generation instructions
Use new multicast subnet constants from omicron-common for validation

After the Omicron work finally landed, which this PR relied on, we also addressed ASM groups with sources and explicit tagging:

ASM source filtering: Source filters are now allowed on ASM addresses (previously SSM-only). IpSrc::Subnet was replaced with IpSrc::Any for any-source matching.
P4 source filter changes: The source filter tables changed from exact to lpm matching on IPv6, and the multicast check was broadened from SSM-only ranges (232.0.0.0/8, ff3x::/16) to all multicast (224.0.0.0/4, ff00::/8).
Tag ownership: Multicast groups now require tag-based validation for mutations (delete/update) in API v4 (current). Tags are assigned at creation (user-provided or auto-generated as {uuid}:{group_ip}). Tags cannot be changed post-creation and must match for mutations; this is enforced by requiring the existing tag, not by rejecting tag-change requests. This prevents accidental modification or deletion of groups associated with other components, and better works with Omicron's retry model.

The API structure is now modeled as:

v4 = TAG_OWNERSHIP: required tags for delete/update as query params, IpSrc::Any,
underlay subnet restricted to ff04::/64 (not all of ff04::/16)
v3 = SOURCE_FILTER_ANY: optional tags, IpSrc::Any
v2 = DUAL_STACK_NAT_WORKFLOW: optional tags, IpSrc::Subnet (from main)
v1 = INITIAL (from main)

This PR is a precursor to a follow-up PR that leverages updated code in `omicron-common`. This gets dendrite in line with Omicron `main`, capturing an upstream type change that we needed to accomodate.

Previously, internal multicast groups accepted admin-scoped addresses including admin-local (ff04), site-local (ff05), and org-local (ff08). This narrows the scope to only admin-local (ff04::/16), which is what Omicron *now* dictates. - [ ] This should be merged after oxidecomputer/omicron#9450 is reviewed and merged into Omicron. We now make Dendrite/Dpd match Omicron consistently for validation. Key changes: - Remove IPV6_SITE_LOCAL_PATTERN and IPV6_ORG_SCOPE_PATTERN from P4 - Update P4 table entries to only match admin-local (size 4→2) - Add ADMIN_LOCAL_PREFIX const to dpd-types with RFC doc links - Update validation to use `is_admin_local_multicast()` from oxnet v0.1.4 - Bump to API version 2 for doc changes (only) - Update README with OpenAPI generation instructions - Use new multicast subnet constants from `omicron-common` for validation

zeeshanlakhani · 2025-12-15T06:22:09Z

@rcgoodfellow updated for your review.

FelixMcFelix

Thanks Zeeshan, the updates to the allowed IP families all make sense. Just some questions on the expanded comments on the decapsualtion bitmaps in the dataplane.

zeeshanlakhani · 2025-12-16T01:19:18Z

Thanks Zeeshan, the updates to the allowed IP families all make sense. Just some questions on the expanded comments on the decapsualtion bitmaps in the dataplane.

Yep. No questions, just my bad in context. Fixed.

FelixMcFelix

Thanks for fixing up those comments!

zeeshanlakhani · 2025-12-17T01:08:11Z

@rcgoodfellow, let me know if you'd like another look at this. I'll be doing a follow-up PR as well on some ssm/asm updates.

rcgoodfellow · 2026-01-01T20:03:17Z

 //
 // Copyright 2025 Oxide Computer Company

+// Port Bitmap Check Table


Thanks for adding this.

This diffset handles our move toward ASM groups being able to have source IPs. Includes: - Replace IpSrc::Subnet with IpSrc::Any for any-source multicast filtering - Add source filter normalization: when Any is present, collapse to single /0 entry; empty sources treated as allow-any - API versioning - Add tag ownership validation for group updates and deletes (v4 API) - Add v2/v3 API version adapters for backward compatibility - Fix test_service_ipv4_unknown_address to set NAT-only on correct port - #172 - I had to fix this here, as it was failing consistently locally.

zeeshanlakhani · 2026-01-14T03:58:21Z

+
+# Workaround for omicron's bootstore transitive dependency on pq-sys
+[env]
+DEP_PQ_LIBDIRS = "1"


Sadly, this is now always necessary, having updated to a new Omicron commit. It's on maghemite too: https://github.com/oxidecomputer/maghemite/blob/main/.cargo/config.toml#L13.

zeeshanlakhani · 2026-01-14T21:28:07Z

@FelixMcFelix @rcgoodfellow I had to rework the API mgmt here, but this is now ready for another look.

zeeshanlakhani · 2026-01-15T02:41:19Z

PR description updated btw to capture everything here.

…4::/16 As per Omicron, customers can use admin-local IPv6 multicast addresses (ff04::/16) for external groups, except for the reserved underlay subnet (ff04::/64) which is used for internal underlay multicast allocation. Changes: - switch external-group validation from validate_not_admin_local_ipv6() to validate_not_underlay_subnet() - validate_not_underlay_subnet() now only rejects ff04::/64 - validate_nat_target() now requires NAT IPs in UNDERLAY_MULTICAST_SUBNET - VLAN tagging logic uses UNDERLAY_MULTICAST_SUBNET, removed dead is_unique_local() check (multicast IPs can't be ULA) - removed unused IPV6_SCOPE_MASK, IPV6_ULA_MASK/PATTERN from P4 - removed dead ULA entry from mcast_tag_check table (const size = 1) - Updated integration test assertions, added unit tests

API v4 (MCAST_STRICT_UNDERLAY) changes: - Renamed AdminScopedIpv6 to UnderlayMulticastIpv6 to better reflect its purpose as the underlay multicast subnet type - Tightened validation from ff04::/16 (admin-local scope) to ff04::/64 to match Omicron's UNDERLAY_MULTICAST_SUBNET allocation - Tag validation now required for update/delete operations (as before) API v3 backward compatibility: - Added v3::AdminScopedIpv6 type that accepts the broader ff04::/16 range - v3 endpoints use v3::MulticastUnderlayGroupIpParam and convert to the v4 type with appropriate error handling for out-of-range addresses

…ion via dropshot Path try_map Includes: - delegate a versioned endpoint in lib.rs from api-server.rs - Cargo.lock updated for new dropshot/omicron

…gation We follow API guidelines recently posted in https://github.com/oxidecomputer/dropshot-api-manager/blob/main/guides/new-version.md

zeeshanlakhani · 2026-01-21T07:38:44Z

Same thing here. I'll get to the API updates when ready, but it'd be good to get re-review here @FelixMcFelix @rcgoodfellow.

Created using jj-spr 0.1.0

zeeshanlakhani · 2026-01-22T07:35:13Z

Going to close and re-open, due to so many merge commits.

…tering Re-opening this from #162, as that PR was getting pretty gnarly with a saturation of merge commits. This one deserves a re-review after some added changes to match the Omicron mcast-lifecycle work in oxidecomputer/omicron#9450. Underlay changes: - Restrict internal multicast from admin/site/org scoped (ff04, ff05, ff08) to just Omicron's reserved subnet (ff04::/64). These underlay addresses are made unique in Omicron. - Rename `AdminScopedIpv6` to `UnderlayMulticastIpv6`. - Simplify P4 to only match ff04::/64. - Use omicron-common multicast constants for validation. Source filtering changes: - Replace IpSrc::Subnet with IpSrc::Any for any-source matching. - Change IPv6 source filter from exact to LPM match. - Allow source filters on ASM groups (previously SSM-only). API changes: - API v5 adds IpSrc::Any for ASM source filtering. - API v6 enforces strict underlay subnet validation. Reviewers: FelixMcFelix, Nieuwejaar, rcgoodfellow Pull Request: #189

zeeshanlakhani · 2025-12-01T03:45:45Z

This PR aligns with the implicit lifecycle work that was recently merged into Omicron: oxidecomputer/omicron#9450.

Previously, internal/underlay multicast groups accepted admin-configured addresses, including admin-local (ff04), site-local (ff05), and org-local (ff08). This narrows the scope to only admin-local (ff04::/16), with ff04::/64 reserved for Omicron's internal underlay allocation.

The first set of key changes included:

Remove IPV6_SITE_LOCAL_PATTERN and IPV6_ORG_SCOPE_PATTERN from P4
- Update P4 table entries to only match admin-local (size 4→2) Omicron-focused underlay
Update to from oxnet v0.1.4
Bump to API versions from 2->3 and 3->4.
Only ff04::/64 is reserved for Omicron's internal underlay multicast allocation
- Customers can use other admin-local /64s (e.g., ff04:0:0:1::/64) for external groups
validate_not_underlay_subnet() blocks ff04::/64 for external group creation
validate_nat_target() requires NAT IPs be within ff04::/64
P4 mcast_tag_check matches only ff04::/64 (removed dead ULA entry)
Update README with OpenAPI generation instructions
Use new multicast subnet constants from omicron-common for validation

After the Omicron work finally landed, which this PR relied on, we also addressed ASM groups with sources and explicit tagging:

ASM source filtering: Source filters are now allowed on ASM addresses (previously SSM-only). IpSrc::Subnet was replaced with IpSrc::Any for any-source matching.
P4 source filter changes: The source filter tables changed from exact to lpm matching on IPv6, and the multicast check was broadened from SSM-only ranges (232.0.0.0/8, ff3x::/16) to all multicast (224.0.0.0/4, ff00::/8).
Tag ownership: Multicast groups now require tag-based validation for mutations (delete/update) in API v4 (current). Tags are assigned at creation (user-provided or auto-generated as {uuid}:{group_ip}). Tags cannot be changed post-creation and must match for mutations; this is enforced by requiring the existing tag, not by rejecting tag-change requests. This prevents accidental modification or deletion of groups associated with other components, and better works with Omicron's retry model.

The API structure is now modeled as:

v4 = TAG_OWNERSHIP: required tags for delete/update as query params, IpSrc::Any,
underlay subnet restricted to ff04::/64 (not all of ff04::/16)
v3 = SOURCE_FILTER_ANY: optional tags, IpSrc::Any
v2 = DUAL_STACK_NAT_WORKFLOW: optional tags, IpSrc::Subnet (from main)
v1 = INITIAL (from main)

This PR is a precursor to a follow-up PR that leverages updated code in `omicron-common`. This gets dendrite in line with Omicron `main`, capturing an upstream type change that we needed to accomodate.

Previously, internal multicast groups accepted admin-scoped addresses including admin-local (ff04), site-local (ff05), and org-local (ff08). This narrows the scope to only admin-local (ff04::/16), which is what Omicron *now* dictates. - [ ] This should be merged after oxidecomputer/omicron#9450 is reviewed and merged into Omicron. We now make Dendrite/Dpd match Omicron consistently for validation. Key changes: - Remove IPV6_SITE_LOCAL_PATTERN and IPV6_ORG_SCOPE_PATTERN from P4 - Update P4 table entries to only match admin-local (size 4→2) - Add ADMIN_LOCAL_PREFIX const to dpd-types with RFC doc links - Update validation to use `is_admin_local_multicast()` from oxnet v0.1.4 - Bump to API version 2 for doc changes (only) - Update README with OpenAPI generation instructions - Use new multicast subnet constants from `omicron-common` for validation

zeeshanlakhani · 2025-12-15T06:22:09Z

@rcgoodfellow updated for your review.

FelixMcFelix

Thanks Zeeshan, the updates to the allowed IP families all make sense. Just some questions on the expanded comments on the decapsualtion bitmaps in the dataplane.

zeeshanlakhani · 2025-12-16T01:19:18Z

Thanks Zeeshan, the updates to the allowed IP families all make sense. Just some questions on the expanded comments on the decapsualtion bitmaps in the dataplane.

Yep. No questions, just my bad in context. Fixed.

FelixMcFelix

Thanks for fixing up those comments!

zeeshanlakhani · 2025-12-17T01:08:11Z

@rcgoodfellow, let me know if you'd like another look at this. I'll be doing a follow-up PR as well on some ssm/asm updates.

rcgoodfellow · 2026-01-01T20:03:17Z

 //
 // Copyright 2025 Oxide Computer Company

+// Port Bitmap Check Table


Thanks for adding this.

This diffset handles our move toward ASM groups being able to have source IPs. Includes: - Replace IpSrc::Subnet with IpSrc::Any for any-source multicast filtering - Add source filter normalization: when Any is present, collapse to single /0 entry; empty sources treated as allow-any - API versioning - Add tag ownership validation for group updates and deletes (v4 API) - Add v2/v3 API version adapters for backward compatibility - Fix test_service_ipv4_unknown_address to set NAT-only on correct port - #172 - I had to fix this here, as it was failing consistently locally.

zeeshanlakhani · 2026-01-14T03:58:21Z

+
+# Workaround for omicron's bootstore transitive dependency on pq-sys
+[env]
+DEP_PQ_LIBDIRS = "1"


Sadly, this is now always necessary, having updated to a new Omicron commit. It's on maghemite too: https://github.com/oxidecomputer/maghemite/blob/main/.cargo/config.toml#L13.

zeeshanlakhani · 2026-01-14T21:28:07Z

@FelixMcFelix @rcgoodfellow I had to rework the API mgmt here, but this is now ready for another look.

zeeshanlakhani · 2026-01-15T02:41:19Z

PR description updated btw to capture everything here.

…4::/16 As per Omicron, customers can use admin-local IPv6 multicast addresses (ff04::/16) for external groups, except for the reserved underlay subnet (ff04::/64) which is used for internal underlay multicast allocation. Changes: - switch external-group validation from validate_not_admin_local_ipv6() to validate_not_underlay_subnet() - validate_not_underlay_subnet() now only rejects ff04::/64 - validate_nat_target() now requires NAT IPs in UNDERLAY_MULTICAST_SUBNET - VLAN tagging logic uses UNDERLAY_MULTICAST_SUBNET, removed dead is_unique_local() check (multicast IPs can't be ULA) - removed unused IPV6_SCOPE_MASK, IPV6_ULA_MASK/PATTERN from P4 - removed dead ULA entry from mcast_tag_check table (const size = 1) - Updated integration test assertions, added unit tests

API v4 (MCAST_STRICT_UNDERLAY) changes: - Renamed AdminScopedIpv6 to UnderlayMulticastIpv6 to better reflect its purpose as the underlay multicast subnet type - Tightened validation from ff04::/16 (admin-local scope) to ff04::/64 to match Omicron's UNDERLAY_MULTICAST_SUBNET allocation - Tag validation now required for update/delete operations (as before) API v3 backward compatibility: - Added v3::AdminScopedIpv6 type that accepts the broader ff04::/16 range - v3 endpoints use v3::MulticastUnderlayGroupIpParam and convert to the v4 type with appropriate error handling for out-of-range addresses

…ion via dropshot Path try_map Includes: - delegate a versioned endpoint in lib.rs from api-server.rs - Cargo.lock updated for new dropshot/omicron

…gation We follow API guidelines recently posted in https://github.com/oxidecomputer/dropshot-api-manager/blob/main/guides/new-version.md

zeeshanlakhani · 2026-01-21T07:38:44Z

Same thing here. I'll get to the API updates when ready, but it'd be good to get re-review here @FelixMcFelix @rcgoodfellow.

Created using jj-spr 0.1.0

zeeshanlakhani · 2026-01-22T07:35:13Z

Going to close and re-open, due to so many merge commits.

…tering Re-opening this from #162, as that PR was getting pretty gnarly with a saturation of merge commits. This one deserves a re-review after some added changes to match the Omicron mcast-lifecycle work in oxidecomputer/omicron#9450. Underlay changes: - Restrict internal multicast from admin/site/org scoped (ff04, ff05, ff08) to just Omicron's reserved subnet (ff04::/64). These underlay addresses are made unique in Omicron. - Rename `AdminScopedIpv6` to `UnderlayMulticastIpv6`. - Simplify P4 to only match ff04::/64. - Use omicron-common multicast constants for validation. Source filtering changes: - Replace IpSrc::Subnet with IpSrc::Any for any-source matching. - Change IPv6 source filter from exact to LPM match. - Allow source filters on ASM groups (previously SSM-only). API changes: - API v5 adds IpSrc::Any for ASM source filtering. - API v6 enforces strict underlay subnet validation. Reviewers: FelixMcFelix, Nieuwejaar, rcgoodfellow Pull Request: #189

zeeshanlakhani · 2025-12-01T03:45:45Z

This PR aligns with the implicit lifecycle work that was recently merged into Omicron: oxidecomputer/omicron#9450.

Previously, internal/underlay multicast groups accepted admin-configured addresses, including admin-local (ff04), site-local (ff05), and org-local (ff08). This narrows the scope to only admin-local (ff04::/16), with ff04::/64 reserved for Omicron's internal underlay allocation.

The first set of key changes included:

Remove IPV6_SITE_LOCAL_PATTERN and IPV6_ORG_SCOPE_PATTERN from P4
- Update P4 table entries to only match admin-local (size 4→2) Omicron-focused underlay
Update to from oxnet v0.1.4
Bump to API versions from 2->3 and 3->4.
Only ff04::/64 is reserved for Omicron's internal underlay multicast allocation
- Customers can use other admin-local /64s (e.g., ff04:0:0:1::/64) for external groups
validate_not_underlay_subnet() blocks ff04::/64 for external group creation
validate_nat_target() requires NAT IPs be within ff04::/64
P4 mcast_tag_check matches only ff04::/64 (removed dead ULA entry)
Update README with OpenAPI generation instructions
Use new multicast subnet constants from omicron-common for validation

After the Omicron work finally landed, which this PR relied on, we also addressed ASM groups with sources and explicit tagging:

ASM source filtering: Source filters are now allowed on ASM addresses (previously SSM-only). IpSrc::Subnet was replaced with IpSrc::Any for any-source matching.
P4 source filter changes: The source filter tables changed from exact to lpm matching on IPv6, and the multicast check was broadened from SSM-only ranges (232.0.0.0/8, ff3x::/16) to all multicast (224.0.0.0/4, ff00::/8).
Tag ownership: Multicast groups now require tag-based validation for mutations (delete/update) in API v4 (current). Tags are assigned at creation (user-provided or auto-generated as {uuid}:{group_ip}). Tags cannot be changed post-creation and must match for mutations; this is enforced by requiring the existing tag, not by rejecting tag-change requests. This prevents accidental modification or deletion of groups associated with other components, and better works with Omicron's retry model.

The API structure is now modeled as:

v4 = TAG_OWNERSHIP: required tags for delete/update as query params, IpSrc::Any,
underlay subnet restricted to ff04::/64 (not all of ff04::/16)
v3 = SOURCE_FILTER_ANY: optional tags, IpSrc::Any
v2 = DUAL_STACK_NAT_WORKFLOW: optional tags, IpSrc::Subnet (from main)
v1 = INITIAL (from main)

This PR is a precursor to a follow-up PR that leverages updated code in `omicron-common`. This gets dendrite in line with Omicron `main`, capturing an upstream type change that we needed to accomodate.

Previously, internal multicast groups accepted admin-scoped addresses including admin-local (ff04), site-local (ff05), and org-local (ff08). This narrows the scope to only admin-local (ff04::/16), which is what Omicron *now* dictates. - [ ] This should be merged after oxidecomputer/omicron#9450 is reviewed and merged into Omicron. We now make Dendrite/Dpd match Omicron consistently for validation. Key changes: - Remove IPV6_SITE_LOCAL_PATTERN and IPV6_ORG_SCOPE_PATTERN from P4 - Update P4 table entries to only match admin-local (size 4→2) - Add ADMIN_LOCAL_PREFIX const to dpd-types with RFC doc links - Update validation to use `is_admin_local_multicast()` from oxnet v0.1.4 - Bump to API version 2 for doc changes (only) - Update README with OpenAPI generation instructions - Use new multicast subnet constants from `omicron-common` for validation

zeeshanlakhani · 2025-12-15T06:22:09Z

@rcgoodfellow updated for your review.

FelixMcFelix

Thanks Zeeshan, the updates to the allowed IP families all make sense. Just some questions on the expanded comments on the decapsualtion bitmaps in the dataplane.

zeeshanlakhani · 2025-12-16T01:19:18Z

Thanks Zeeshan, the updates to the allowed IP families all make sense. Just some questions on the expanded comments on the decapsualtion bitmaps in the dataplane.

Yep. No questions, just my bad in context. Fixed.

FelixMcFelix

Thanks for fixing up those comments!

zeeshanlakhani · 2025-12-17T01:08:11Z

@rcgoodfellow, let me know if you'd like another look at this. I'll be doing a follow-up PR as well on some ssm/asm updates.

rcgoodfellow · 2026-01-01T20:03:17Z

 //
 // Copyright 2025 Oxide Computer Company

+// Port Bitmap Check Table


Thanks for adding this.

This diffset handles our move toward ASM groups being able to have source IPs. Includes: - Replace IpSrc::Subnet with IpSrc::Any for any-source multicast filtering - Add source filter normalization: when Any is present, collapse to single /0 entry; empty sources treated as allow-any - API versioning - Add tag ownership validation for group updates and deletes (v4 API) - Add v2/v3 API version adapters for backward compatibility - Fix test_service_ipv4_unknown_address to set NAT-only on correct port - #172 - I had to fix this here, as it was failing consistently locally.

zeeshanlakhani · 2026-01-14T03:58:21Z

+
+# Workaround for omicron's bootstore transitive dependency on pq-sys
+[env]
+DEP_PQ_LIBDIRS = "1"


Sadly, this is now always necessary, having updated to a new Omicron commit. It's on maghemite too: https://github.com/oxidecomputer/maghemite/blob/main/.cargo/config.toml#L13.

zeeshanlakhani · 2026-01-14T21:28:07Z

@FelixMcFelix @rcgoodfellow I had to rework the API mgmt here, but this is now ready for another look.

zeeshanlakhani · 2026-01-15T02:41:19Z

PR description updated btw to capture everything here.

…4::/16 As per Omicron, customers can use admin-local IPv6 multicast addresses (ff04::/16) for external groups, except for the reserved underlay subnet (ff04::/64) which is used for internal underlay multicast allocation. Changes: - switch external-group validation from validate_not_admin_local_ipv6() to validate_not_underlay_subnet() - validate_not_underlay_subnet() now only rejects ff04::/64 - validate_nat_target() now requires NAT IPs in UNDERLAY_MULTICAST_SUBNET - VLAN tagging logic uses UNDERLAY_MULTICAST_SUBNET, removed dead is_unique_local() check (multicast IPs can't be ULA) - removed unused IPV6_SCOPE_MASK, IPV6_ULA_MASK/PATTERN from P4 - removed dead ULA entry from mcast_tag_check table (const size = 1) - Updated integration test assertions, added unit tests

API v4 (MCAST_STRICT_UNDERLAY) changes: - Renamed AdminScopedIpv6 to UnderlayMulticastIpv6 to better reflect its purpose as the underlay multicast subnet type - Tightened validation from ff04::/16 (admin-local scope) to ff04::/64 to match Omicron's UNDERLAY_MULTICAST_SUBNET allocation - Tag validation now required for update/delete operations (as before) API v3 backward compatibility: - Added v3::AdminScopedIpv6 type that accepts the broader ff04::/16 range - v3 endpoints use v3::MulticastUnderlayGroupIpParam and convert to the v4 type with appropriate error handling for out-of-range addresses

…ion via dropshot Path try_map Includes: - delegate a versioned endpoint in lib.rs from api-server.rs - Cargo.lock updated for new dropshot/omicron

…gation We follow API guidelines recently posted in https://github.com/oxidecomputer/dropshot-api-manager/blob/main/guides/new-version.md

zeeshanlakhani · 2026-01-21T07:38:44Z

Same thing here. I'll get to the API updates when ready, but it'd be good to get re-review here @FelixMcFelix @rcgoodfellow.

Created using jj-spr 0.1.0

zeeshanlakhani · 2026-01-22T07:35:13Z

Going to close and re-open, due to so many merge commits.

…tering Re-opening this from #162, as that PR was getting pretty gnarly with a saturation of merge commits. This one deserves a re-review after some added changes to match the Omicron mcast-lifecycle work in oxidecomputer/omicron#9450. Underlay changes: - Restrict internal multicast from admin/site/org scoped (ff04, ff05, ff08) to just Omicron's reserved subnet (ff04::/64). These underlay addresses are made unique in Omicron. - Rename `AdminScopedIpv6` to `UnderlayMulticastIpv6`. - Simplify P4 to only match ff04::/64. - Use omicron-common multicast constants for validation. Source filtering changes: - Replace IpSrc::Subnet with IpSrc::Any for any-source matching. - Change IPv6 source filter from exact to LPM match. - Allow source filters on ASM groups (previously SSM-only). API changes: - API v5 adds IpSrc::Any for ASM source filtering. - API v6 enforces strict underlay subnet validation. Reviewers: FelixMcFelix, Nieuwejaar, rcgoodfellow Pull Request: #189

zeeshanlakhani · 2025-12-01T03:45:45Z

This PR aligns with the implicit lifecycle work that was recently merged into Omicron: oxidecomputer/omicron#9450.

Previously, internal/underlay multicast groups accepted admin-configured addresses, including admin-local (ff04), site-local (ff05), and org-local (ff08). This narrows the scope to only admin-local (ff04::/16), with ff04::/64 reserved for Omicron's internal underlay allocation.

The first set of key changes included:

Remove IPV6_SITE_LOCAL_PATTERN and IPV6_ORG_SCOPE_PATTERN from P4
- Update P4 table entries to only match admin-local (size 4→2) Omicron-focused underlay
Update to from oxnet v0.1.4
Bump to API versions from 2->3 and 3->4.
Only ff04::/64 is reserved for Omicron's internal underlay multicast allocation
- Customers can use other admin-local /64s (e.g., ff04:0:0:1::/64) for external groups
validate_not_underlay_subnet() blocks ff04::/64 for external group creation
validate_nat_target() requires NAT IPs be within ff04::/64
P4 mcast_tag_check matches only ff04::/64 (removed dead ULA entry)
Update README with OpenAPI generation instructions
Use new multicast subnet constants from omicron-common for validation

After the Omicron work finally landed, which this PR relied on, we also addressed ASM groups with sources and explicit tagging:

ASM source filtering: Source filters are now allowed on ASM addresses (previously SSM-only). IpSrc::Subnet was replaced with IpSrc::Any for any-source matching.
P4 source filter changes: The source filter tables changed from exact to lpm matching on IPv6, and the multicast check was broadened from SSM-only ranges (232.0.0.0/8, ff3x::/16) to all multicast (224.0.0.0/4, ff00::/8).
Tag ownership: Multicast groups now require tag-based validation for mutations (delete/update) in API v4 (current). Tags are assigned at creation (user-provided or auto-generated as {uuid}:{group_ip}). Tags cannot be changed post-creation and must match for mutations; this is enforced by requiring the existing tag, not by rejecting tag-change requests. This prevents accidental modification or deletion of groups associated with other components, and better works with Omicron's retry model.

The API structure is now modeled as:

v4 = TAG_OWNERSHIP: required tags for delete/update as query params, IpSrc::Any,
underlay subnet restricted to ff04::/64 (not all of ff04::/16)
v3 = SOURCE_FILTER_ANY: optional tags, IpSrc::Any
v2 = DUAL_STACK_NAT_WORKFLOW: optional tags, IpSrc::Subnet (from main)
v1 = INITIAL (from main)

This PR is a precursor to a follow-up PR that leverages updated code in `omicron-common`. This gets dendrite in line with Omicron `main`, capturing an upstream type change that we needed to accomodate.

Previously, internal multicast groups accepted admin-scoped addresses including admin-local (ff04), site-local (ff05), and org-local (ff08). This narrows the scope to only admin-local (ff04::/16), which is what Omicron *now* dictates. - [ ] This should be merged after oxidecomputer/omicron#9450 is reviewed and merged into Omicron. We now make Dendrite/Dpd match Omicron consistently for validation. Key changes: - Remove IPV6_SITE_LOCAL_PATTERN and IPV6_ORG_SCOPE_PATTERN from P4 - Update P4 table entries to only match admin-local (size 4→2) - Add ADMIN_LOCAL_PREFIX const to dpd-types with RFC doc links - Update validation to use `is_admin_local_multicast()` from oxnet v0.1.4 - Bump to API version 2 for doc changes (only) - Update README with OpenAPI generation instructions - Use new multicast subnet constants from `omicron-common` for validation

zeeshanlakhani · 2025-12-15T06:22:09Z

@rcgoodfellow updated for your review.

FelixMcFelix

Thanks Zeeshan, the updates to the allowed IP families all make sense. Just some questions on the expanded comments on the decapsualtion bitmaps in the dataplane.

zeeshanlakhani · 2025-12-16T01:19:18Z

Thanks Zeeshan, the updates to the allowed IP families all make sense. Just some questions on the expanded comments on the decapsualtion bitmaps in the dataplane.

Yep. No questions, just my bad in context. Fixed.

FelixMcFelix

Thanks for fixing up those comments!

zeeshanlakhani · 2025-12-17T01:08:11Z

@rcgoodfellow, let me know if you'd like another look at this. I'll be doing a follow-up PR as well on some ssm/asm updates.

rcgoodfellow · 2026-01-01T20:03:17Z

 //
 // Copyright 2025 Oxide Computer Company

+// Port Bitmap Check Table


Thanks for adding this.

This diffset handles our move toward ASM groups being able to have source IPs. Includes: - Replace IpSrc::Subnet with IpSrc::Any for any-source multicast filtering - Add source filter normalization: when Any is present, collapse to single /0 entry; empty sources treated as allow-any - API versioning - Add tag ownership validation for group updates and deletes (v4 API) - Add v2/v3 API version adapters for backward compatibility - Fix test_service_ipv4_unknown_address to set NAT-only on correct port - #172 - I had to fix this here, as it was failing consistently locally.

zeeshanlakhani · 2026-01-14T03:58:21Z

+
+# Workaround for omicron's bootstore transitive dependency on pq-sys
+[env]
+DEP_PQ_LIBDIRS = "1"


Sadly, this is now always necessary, having updated to a new Omicron commit. It's on maghemite too: https://github.com/oxidecomputer/maghemite/blob/main/.cargo/config.toml#L13.

zeeshanlakhani · 2026-01-14T21:28:07Z

@FelixMcFelix @rcgoodfellow I had to rework the API mgmt here, but this is now ready for another look.

zeeshanlakhani · 2026-01-15T02:41:19Z

PR description updated btw to capture everything here.

…4::/16 As per Omicron, customers can use admin-local IPv6 multicast addresses (ff04::/16) for external groups, except for the reserved underlay subnet (ff04::/64) which is used for internal underlay multicast allocation. Changes: - switch external-group validation from validate_not_admin_local_ipv6() to validate_not_underlay_subnet() - validate_not_underlay_subnet() now only rejects ff04::/64 - validate_nat_target() now requires NAT IPs in UNDERLAY_MULTICAST_SUBNET - VLAN tagging logic uses UNDERLAY_MULTICAST_SUBNET, removed dead is_unique_local() check (multicast IPs can't be ULA) - removed unused IPV6_SCOPE_MASK, IPV6_ULA_MASK/PATTERN from P4 - removed dead ULA entry from mcast_tag_check table (const size = 1) - Updated integration test assertions, added unit tests

API v4 (MCAST_STRICT_UNDERLAY) changes: - Renamed AdminScopedIpv6 to UnderlayMulticastIpv6 to better reflect its purpose as the underlay multicast subnet type - Tightened validation from ff04::/16 (admin-local scope) to ff04::/64 to match Omicron's UNDERLAY_MULTICAST_SUBNET allocation - Tag validation now required for update/delete operations (as before) API v3 backward compatibility: - Added v3::AdminScopedIpv6 type that accepts the broader ff04::/16 range - v3 endpoints use v3::MulticastUnderlayGroupIpParam and convert to the v4 type with appropriate error handling for out-of-range addresses

…ion via dropshot Path try_map Includes: - delegate a versioned endpoint in lib.rs from api-server.rs - Cargo.lock updated for new dropshot/omicron

…gation We follow API guidelines recently posted in https://github.com/oxidecomputer/dropshot-api-manager/blob/main/guides/new-version.md

zeeshanlakhani · 2026-01-21T07:38:44Z

Same thing here. I'll get to the API updates when ready, but it'd be good to get re-review here @FelixMcFelix @rcgoodfellow.

Created using jj-spr 0.1.0

zeeshanlakhani · 2026-01-22T07:35:13Z

Going to close and re-open, due to so many merge commits.

…tering Re-opening this from #162, as that PR was getting pretty gnarly with a saturation of merge commits. This one deserves a re-review after some added changes to match the Omicron mcast-lifecycle work in oxidecomputer/omicron#9450. Underlay changes: - Restrict internal multicast from admin/site/org scoped (ff04, ff05, ff08) to just Omicron's reserved subnet (ff04::/64). These underlay addresses are made unique in Omicron. - Rename `AdminScopedIpv6` to `UnderlayMulticastIpv6`. - Simplify P4 to only match ff04::/64. - Use omicron-common multicast constants for validation. Source filtering changes: - Replace IpSrc::Subnet with IpSrc::Any for any-source matching. - Change IPv6 source filter from exact to LPM match. - Allow source filters on ASM groups (previously SSM-only). API changes: - API v5 adds IpSrc::Any for ASM source filtering. - API v6 enforces strict underlay subnet validation. Reviewers: FelixMcFelix, Nieuwejaar, rcgoodfellow Pull Request: #189

zeeshanlakhani · 2025-12-01T03:45:45Z

This PR aligns with the implicit lifecycle work that was recently merged into Omicron: oxidecomputer/omicron#9450.

Previously, internal/underlay multicast groups accepted admin-configured addresses, including admin-local (ff04), site-local (ff05), and org-local (ff08). This narrows the scope to only admin-local (ff04::/16), with ff04::/64 reserved for Omicron's internal underlay allocation.

The first set of key changes included:

Remove IPV6_SITE_LOCAL_PATTERN and IPV6_ORG_SCOPE_PATTERN from P4
- Update P4 table entries to only match admin-local (size 4→2) Omicron-focused underlay
Update to from oxnet v0.1.4
Bump to API versions from 2->3 and 3->4.
Only ff04::/64 is reserved for Omicron's internal underlay multicast allocation
- Customers can use other admin-local /64s (e.g., ff04:0:0:1::/64) for external groups
validate_not_underlay_subnet() blocks ff04::/64 for external group creation
validate_nat_target() requires NAT IPs be within ff04::/64
P4 mcast_tag_check matches only ff04::/64 (removed dead ULA entry)
Update README with OpenAPI generation instructions
Use new multicast subnet constants from omicron-common for validation

After the Omicron work finally landed, which this PR relied on, we also addressed ASM groups with sources and explicit tagging:

ASM source filtering: Source filters are now allowed on ASM addresses (previously SSM-only). IpSrc::Subnet was replaced with IpSrc::Any for any-source matching.
P4 source filter changes: The source filter tables changed from exact to lpm matching on IPv6, and the multicast check was broadened from SSM-only ranges (232.0.0.0/8, ff3x::/16) to all multicast (224.0.0.0/4, ff00::/8).
Tag ownership: Multicast groups now require tag-based validation for mutations (delete/update) in API v4 (current). Tags are assigned at creation (user-provided or auto-generated as {uuid}:{group_ip}). Tags cannot be changed post-creation and must match for mutations; this is enforced by requiring the existing tag, not by rejecting tag-change requests. This prevents accidental modification or deletion of groups associated with other components, and better works with Omicron's retry model.

The API structure is now modeled as:

v4 = TAG_OWNERSHIP: required tags for delete/update as query params, IpSrc::Any,
underlay subnet restricted to ff04::/64 (not all of ff04::/16)
v3 = SOURCE_FILTER_ANY: optional tags, IpSrc::Any
v2 = DUAL_STACK_NAT_WORKFLOW: optional tags, IpSrc::Subnet (from main)
v1 = INITIAL (from main)

This PR is a precursor to a follow-up PR that leverages updated code in `omicron-common`. This gets dendrite in line with Omicron `main`, capturing an upstream type change that we needed to accomodate.

Previously, internal multicast groups accepted admin-scoped addresses including admin-local (ff04), site-local (ff05), and org-local (ff08). This narrows the scope to only admin-local (ff04::/16), which is what Omicron *now* dictates. - [ ] This should be merged after oxidecomputer/omicron#9450 is reviewed and merged into Omicron. We now make Dendrite/Dpd match Omicron consistently for validation. Key changes: - Remove IPV6_SITE_LOCAL_PATTERN and IPV6_ORG_SCOPE_PATTERN from P4 - Update P4 table entries to only match admin-local (size 4→2) - Add ADMIN_LOCAL_PREFIX const to dpd-types with RFC doc links - Update validation to use `is_admin_local_multicast()` from oxnet v0.1.4 - Bump to API version 2 for doc changes (only) - Update README with OpenAPI generation instructions - Use new multicast subnet constants from `omicron-common` for validation

zeeshanlakhani · 2025-12-15T06:22:09Z

@rcgoodfellow updated for your review.

FelixMcFelix

Thanks Zeeshan, the updates to the allowed IP families all make sense. Just some questions on the expanded comments on the decapsualtion bitmaps in the dataplane.

zeeshanlakhani · 2025-12-16T01:19:18Z

Thanks Zeeshan, the updates to the allowed IP families all make sense. Just some questions on the expanded comments on the decapsualtion bitmaps in the dataplane.

Yep. No questions, just my bad in context. Fixed.

FelixMcFelix

Thanks for fixing up those comments!

zeeshanlakhani · 2025-12-17T01:08:11Z

@rcgoodfellow, let me know if you'd like another look at this. I'll be doing a follow-up PR as well on some ssm/asm updates.

rcgoodfellow · 2026-01-01T20:03:17Z

 //
 // Copyright 2025 Oxide Computer Company

+// Port Bitmap Check Table


Thanks for adding this.

This diffset handles our move toward ASM groups being able to have source IPs. Includes: - Replace IpSrc::Subnet with IpSrc::Any for any-source multicast filtering - Add source filter normalization: when Any is present, collapse to single /0 entry; empty sources treated as allow-any - API versioning - Add tag ownership validation for group updates and deletes (v4 API) - Add v2/v3 API version adapters for backward compatibility - Fix test_service_ipv4_unknown_address to set NAT-only on correct port - #172 - I had to fix this here, as it was failing consistently locally.

zeeshanlakhani · 2026-01-14T03:58:21Z

+
+# Workaround for omicron's bootstore transitive dependency on pq-sys
+[env]
+DEP_PQ_LIBDIRS = "1"


Sadly, this is now always necessary, having updated to a new Omicron commit. It's on maghemite too: https://github.com/oxidecomputer/maghemite/blob/main/.cargo/config.toml#L13.

zeeshanlakhani · 2026-01-14T21:28:07Z

@FelixMcFelix @rcgoodfellow I had to rework the API mgmt here, but this is now ready for another look.

zeeshanlakhani · 2026-01-15T02:41:19Z

PR description updated btw to capture everything here.

…4::/16 As per Omicron, customers can use admin-local IPv6 multicast addresses (ff04::/16) for external groups, except for the reserved underlay subnet (ff04::/64) which is used for internal underlay multicast allocation. Changes: - switch external-group validation from validate_not_admin_local_ipv6() to validate_not_underlay_subnet() - validate_not_underlay_subnet() now only rejects ff04::/64 - validate_nat_target() now requires NAT IPs in UNDERLAY_MULTICAST_SUBNET - VLAN tagging logic uses UNDERLAY_MULTICAST_SUBNET, removed dead is_unique_local() check (multicast IPs can't be ULA) - removed unused IPV6_SCOPE_MASK, IPV6_ULA_MASK/PATTERN from P4 - removed dead ULA entry from mcast_tag_check table (const size = 1) - Updated integration test assertions, added unit tests

API v4 (MCAST_STRICT_UNDERLAY) changes: - Renamed AdminScopedIpv6 to UnderlayMulticastIpv6 to better reflect its purpose as the underlay multicast subnet type - Tightened validation from ff04::/16 (admin-local scope) to ff04::/64 to match Omicron's UNDERLAY_MULTICAST_SUBNET allocation - Tag validation now required for update/delete operations (as before) API v3 backward compatibility: - Added v3::AdminScopedIpv6 type that accepts the broader ff04::/16 range - v3 endpoints use v3::MulticastUnderlayGroupIpParam and convert to the v4 type with appropriate error handling for out-of-range addresses

…ion via dropshot Path try_map Includes: - delegate a versioned endpoint in lib.rs from api-server.rs - Cargo.lock updated for new dropshot/omicron

…gation We follow API guidelines recently posted in https://github.com/oxidecomputer/dropshot-api-manager/blob/main/guides/new-version.md

zeeshanlakhani · 2026-01-21T07:38:44Z

Same thing here. I'll get to the API updates when ready, but it'd be good to get re-review here @FelixMcFelix @rcgoodfellow.

Created using jj-spr 0.1.0

zeeshanlakhani · 2026-01-22T07:35:13Z

Going to close and re-open, due to so many merge commits.

…tering Re-opening this from #162, as that PR was getting pretty gnarly with a saturation of merge commits. This one deserves a re-review after some added changes to match the Omicron mcast-lifecycle work in oxidecomputer/omicron#9450. Underlay changes: - Restrict internal multicast from admin/site/org scoped (ff04, ff05, ff08) to just Omicron's reserved subnet (ff04::/64). These underlay addresses are made unique in Omicron. - Rename `AdminScopedIpv6` to `UnderlayMulticastIpv6`. - Simplify P4 to only match ff04::/64. - Use omicron-common multicast constants for validation. Source filtering changes: - Replace IpSrc::Subnet with IpSrc::Any for any-source matching. - Change IPv6 source filter from exact to LPM match. - Allow source filters on ASM groups (previously SSM-only). API changes: - API v5 adds IpSrc::Any for ASM source filtering. - API v6 enforces strict underlay subnet validation. Reviewers: FelixMcFelix, Nieuwejaar, rcgoodfellow Pull Request: #189

zeeshanlakhani · 2025-12-01T03:45:45Z

This PR aligns with the implicit lifecycle work that was recently merged into Omicron: oxidecomputer/omicron#9450.

Previously, internal/underlay multicast groups accepted admin-configured addresses, including admin-local (ff04), site-local (ff05), and org-local (ff08). This narrows the scope to only admin-local (ff04::/16), with ff04::/64 reserved for Omicron's internal underlay allocation.

The first set of key changes included:

Remove IPV6_SITE_LOCAL_PATTERN and IPV6_ORG_SCOPE_PATTERN from P4
- Update P4 table entries to only match admin-local (size 4→2) Omicron-focused underlay
Update to from oxnet v0.1.4
Bump to API versions from 2->3 and 3->4.
Only ff04::/64 is reserved for Omicron's internal underlay multicast allocation
- Customers can use other admin-local /64s (e.g., ff04:0:0:1::/64) for external groups
validate_not_underlay_subnet() blocks ff04::/64 for external group creation
validate_nat_target() requires NAT IPs be within ff04::/64
P4 mcast_tag_check matches only ff04::/64 (removed dead ULA entry)
Update README with OpenAPI generation instructions
Use new multicast subnet constants from omicron-common for validation

After the Omicron work finally landed, which this PR relied on, we also addressed ASM groups with sources and explicit tagging:

ASM source filtering: Source filters are now allowed on ASM addresses (previously SSM-only). IpSrc::Subnet was replaced with IpSrc::Any for any-source matching.
P4 source filter changes: The source filter tables changed from exact to lpm matching on IPv6, and the multicast check was broadened from SSM-only ranges (232.0.0.0/8, ff3x::/16) to all multicast (224.0.0.0/4, ff00::/8).
Tag ownership: Multicast groups now require tag-based validation for mutations (delete/update) in API v4 (current). Tags are assigned at creation (user-provided or auto-generated as {uuid}:{group_ip}). Tags cannot be changed post-creation and must match for mutations; this is enforced by requiring the existing tag, not by rejecting tag-change requests. This prevents accidental modification or deletion of groups associated with other components, and better works with Omicron's retry model.

The API structure is now modeled as:

v4 = TAG_OWNERSHIP: required tags for delete/update as query params, IpSrc::Any,
underlay subnet restricted to ff04::/64 (not all of ff04::/16)
v3 = SOURCE_FILTER_ANY: optional tags, IpSrc::Any
v2 = DUAL_STACK_NAT_WORKFLOW: optional tags, IpSrc::Subnet (from main)
v1 = INITIAL (from main)

This PR is a precursor to a follow-up PR that leverages updated code in `omicron-common`. This gets dendrite in line with Omicron `main`, capturing an upstream type change that we needed to accomodate.

Previously, internal multicast groups accepted admin-scoped addresses including admin-local (ff04), site-local (ff05), and org-local (ff08). This narrows the scope to only admin-local (ff04::/16), which is what Omicron *now* dictates. - [ ] This should be merged after oxidecomputer/omicron#9450 is reviewed and merged into Omicron. We now make Dendrite/Dpd match Omicron consistently for validation. Key changes: - Remove IPV6_SITE_LOCAL_PATTERN and IPV6_ORG_SCOPE_PATTERN from P4 - Update P4 table entries to only match admin-local (size 4→2) - Add ADMIN_LOCAL_PREFIX const to dpd-types with RFC doc links - Update validation to use `is_admin_local_multicast()` from oxnet v0.1.4 - Bump to API version 2 for doc changes (only) - Update README with OpenAPI generation instructions - Use new multicast subnet constants from `omicron-common` for validation

zeeshanlakhani · 2025-12-15T06:22:09Z

@rcgoodfellow updated for your review.

FelixMcFelix

Thanks Zeeshan, the updates to the allowed IP families all make sense. Just some questions on the expanded comments on the decapsualtion bitmaps in the dataplane.

zeeshanlakhani · 2025-12-16T01:19:18Z

Thanks Zeeshan, the updates to the allowed IP families all make sense. Just some questions on the expanded comments on the decapsualtion bitmaps in the dataplane.

Yep. No questions, just my bad in context. Fixed.

FelixMcFelix

Thanks for fixing up those comments!

zeeshanlakhani · 2025-12-17T01:08:11Z

@rcgoodfellow, let me know if you'd like another look at this. I'll be doing a follow-up PR as well on some ssm/asm updates.

rcgoodfellow · 2026-01-01T20:03:17Z

 //
 // Copyright 2025 Oxide Computer Company

+// Port Bitmap Check Table


Thanks for adding this.

This diffset handles our move toward ASM groups being able to have source IPs. Includes: - Replace IpSrc::Subnet with IpSrc::Any for any-source multicast filtering - Add source filter normalization: when Any is present, collapse to single /0 entry; empty sources treated as allow-any - API versioning - Add tag ownership validation for group updates and deletes (v4 API) - Add v2/v3 API version adapters for backward compatibility - Fix test_service_ipv4_unknown_address to set NAT-only on correct port - #172 - I had to fix this here, as it was failing consistently locally.

zeeshanlakhani · 2026-01-14T03:58:21Z

+
+# Workaround for omicron's bootstore transitive dependency on pq-sys
+[env]
+DEP_PQ_LIBDIRS = "1"


Sadly, this is now always necessary, having updated to a new Omicron commit. It's on maghemite too: https://github.com/oxidecomputer/maghemite/blob/main/.cargo/config.toml#L13.

zeeshanlakhani · 2026-01-14T21:28:07Z

@FelixMcFelix @rcgoodfellow I had to rework the API mgmt here, but this is now ready for another look.

zeeshanlakhani · 2026-01-15T02:41:19Z

PR description updated btw to capture everything here.

…4::/16 As per Omicron, customers can use admin-local IPv6 multicast addresses (ff04::/16) for external groups, except for the reserved underlay subnet (ff04::/64) which is used for internal underlay multicast allocation. Changes: - switch external-group validation from validate_not_admin_local_ipv6() to validate_not_underlay_subnet() - validate_not_underlay_subnet() now only rejects ff04::/64 - validate_nat_target() now requires NAT IPs in UNDERLAY_MULTICAST_SUBNET - VLAN tagging logic uses UNDERLAY_MULTICAST_SUBNET, removed dead is_unique_local() check (multicast IPs can't be ULA) - removed unused IPV6_SCOPE_MASK, IPV6_ULA_MASK/PATTERN from P4 - removed dead ULA entry from mcast_tag_check table (const size = 1) - Updated integration test assertions, added unit tests

API v4 (MCAST_STRICT_UNDERLAY) changes: - Renamed AdminScopedIpv6 to UnderlayMulticastIpv6 to better reflect its purpose as the underlay multicast subnet type - Tightened validation from ff04::/16 (admin-local scope) to ff04::/64 to match Omicron's UNDERLAY_MULTICAST_SUBNET allocation - Tag validation now required for update/delete operations (as before) API v3 backward compatibility: - Added v3::AdminScopedIpv6 type that accepts the broader ff04::/16 range - v3 endpoints use v3::MulticastUnderlayGroupIpParam and convert to the v4 type with appropriate error handling for out-of-range addresses

…ion via dropshot Path try_map Includes: - delegate a versioned endpoint in lib.rs from api-server.rs - Cargo.lock updated for new dropshot/omicron

…gation We follow API guidelines recently posted in https://github.com/oxidecomputer/dropshot-api-manager/blob/main/guides/new-version.md

zeeshanlakhani · 2026-01-21T07:38:44Z

Same thing here. I'll get to the API updates when ready, but it'd be good to get re-review here @FelixMcFelix @rcgoodfellow.

Created using jj-spr 0.1.0

zeeshanlakhani · 2026-01-22T07:35:13Z

Going to close and re-open, due to so many merge commits.

…tering Re-opening this from #162, as that PR was getting pretty gnarly with a saturation of merge commits. This one deserves a re-review after some added changes to match the Omicron mcast-lifecycle work in oxidecomputer/omicron#9450. Underlay changes: - Restrict internal multicast from admin/site/org scoped (ff04, ff05, ff08) to just Omicron's reserved subnet (ff04::/64). These underlay addresses are made unique in Omicron. - Rename `AdminScopedIpv6` to `UnderlayMulticastIpv6`. - Simplify P4 to only match ff04::/64. - Use omicron-common multicast constants for validation. Source filtering changes: - Replace IpSrc::Subnet with IpSrc::Any for any-source matching. - Change IPv6 source filter from exact to LPM match. - Allow source filters on ASM groups (previously SSM-only). API changes: - API v5 adds IpSrc::Any for ASM source filtering. - API v6 enforces strict underlay subnet validation. Reviewers: FelixMcFelix, Nieuwejaar, rcgoodfellow Pull Request: #189

[deps] Update Omicron main related deps to 64b40cb
0aef4d5
This PR is a precursor to a follow-up PR that leverages updated code in `omicron-common`. This gets dendrite in line with Omicron `main`, capturing an upstream type change that we needed to accomodate.

zeeshanlakhani commented Dec 1, 2025
View reviewed changes

Comment threadCargo.toml Outdated

zeeshanlakhani mentioned this pull request Dec 1, 2025
[multicast] implicit group lifecycle with IP pool integration oxidecomputer/omicron#9450
Merged
4 tasks

zeeshanlakhani force-pushed the zl/admin-scope-oxnet branch from 6f00b19 to 94e91caCompare December 1, 2025 05:55

zeeshanlakhani requested review from FelixMcFelix, Nieuwejaar and rcgoodfellow December 1, 2025 06:23

Base automatically changed from zl/omicron-changes-from-main to mainDecember 11, 2025 03:06

zeeshanlakhani added 3 commits December 11, 2025 05:01

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
405d60f

[merge] fixes
622fe62

[review] document port_bitmap used in multicastegress
793b443

FelixMcFelix reviewed Dec 15, 2025
View reviewed changes

Comment threaddpd/p4/port_bitmap_check.p4 Outdated
Comment threaddpd/p4/sidecar.p4 Outdated

[review] fix direction, not being dumb
87dd7f4

zeeshanlakhani requested a review from FelixMcFelix December 16, 2025 01:18

FelixMcFelix approved these changes Dec 16, 2025
View reviewed changes

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
745346a

zeeshanlakhani added 2 commits December 17, 2025 05:14

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
8d949e2

[post-merge] updates
c76f78c

rcgoodfellow approved these changes Jan 1, 2026
View reviewed changes

zeeshanlakhaniand others added 2 commits January 13, 2026 22:21

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
8e83b88

zeeshanlakhani commented Jan 14, 2026
View reviewed changes

Comment threaddpd-client/tests/integration_tests/service.rs Outdated

[fix] update for apis test and copyrights!
db21e50

zeeshanlakhani requested review from FelixMcFelix and rcgoodfellow January 14, 2026 04:30

zeeshanlakhani force-pushed the zl/admin-scope-oxnet branch from 6b8ba63 to a253044Compare January 14, 2026 21:01

zeeshanlakhani changed the title ~~[multicast] Narrow admin-scoped to admin-local only & match Omicron updates to mcast lifecycle~~[multicast] Narrow to admin-local only & match Omicron updates to mcast lifecycleJan 14, 2026

[fmt,2026]
ac8fefb

zeeshanlakhani changed the title ~~[multicast] Narrow to admin-local only & match Omicron updates to mcast lifecycle~~[multicast] Narrow to admin-local Omicron underlay & match Omicron updates to mcast lifecycleJan 15, 2026

zeeshanlakhaniand others added 2 commits January 15, 2026 01:04

zeeshanlakhani mentioned this pull request Jan 15, 2026
[multicast] prevent VLAN translation via match key enforcement #185
Closed
1 task

zeeshanlakhaniand others added 8 commits January 15, 2026 06:39

[validation,api] Move validation to types via FromStr, update delegat…
602dcc5
…ion via dropshot Path try_map Includes: - delegate a versioned endpoint in lib.rs from api-server.rs - Cargo.lock updated for new dropshot/omicron

[fmt,2026,api]
9e0f2d7

[api,multicast] Use v3 type for create underlay endpoint, proper dele…
7402987
…gation We follow API guidelines recently posted in https://github.com/oxidecomputer/dropshot-api-manager/blob/main/guides/new-version.md

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
5dded7a

[openapi] update
85a9876

[test] update size
c7d2f4c

[api] conversoin cleanup / conciseness
c3c1aa1

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
dfbcc39

zeeshanlakhani self-assigned this Jan 20, 2026

zeeshanlakhani added 4 commits January 21, 2026 18:23

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
306ebdc

[post-merge] Update API(s) to match versioning guidelines
3b67dc2

table test
c6c9e65

merge admin-scope-oxnet
656610a
Created using jj-spr 0.1.0

zeeshanlakhani changed the base branch from main to zl/main.multicast-narrow-to-admin-local-omicron-underlay-match-omicron-updates-to-mcast-lifecycleJanuary 22, 2026 07:25

zeeshanlakhani deleted the branch zl/main.multicast-narrow-to-admin-local-omicron-underlay-match-omicron-updates-to-mcast-lifecycleJanuary 22, 2026 07:26

zeeshanlakhani closed this Jan 22, 2026

zeeshanlakhani mentioned this pull request Jan 22, 2026
[multicast] Narrow underlay scope to ff04::/64 and add ASM source filtering #189
Merged

[deps] Update Omicron main related deps to 64b40cb
0aef4d5
This PR is a precursor to a follow-up PR that leverages updated code in `omicron-common`. This gets dendrite in line with Omicron `main`, capturing an upstream type change that we needed to accomodate.

zeeshanlakhani commented Dec 1, 2025
View reviewed changes

Comment threadCargo.toml Outdated

zeeshanlakhani mentioned this pull request Dec 1, 2025
[multicast] implicit group lifecycle with IP pool integration oxidecomputer/omicron#9450
Merged
4 tasks

zeeshanlakhani force-pushed the zl/admin-scope-oxnet branch from 6f00b19 to 94e91caCompare December 1, 2025 05:55

zeeshanlakhani requested review from FelixMcFelix, Nieuwejaar and rcgoodfellow December 1, 2025 06:23

Base automatically changed from zl/omicron-changes-from-main to mainDecember 11, 2025 03:06

zeeshanlakhani added 3 commits December 11, 2025 05:01

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
405d60f

[merge] fixes
622fe62

[review] document port_bitmap used in multicastegress
793b443

FelixMcFelix reviewed Dec 15, 2025
View reviewed changes

Comment threaddpd/p4/port_bitmap_check.p4 Outdated
Comment threaddpd/p4/sidecar.p4 Outdated

[review] fix direction, not being dumb
87dd7f4

zeeshanlakhani requested a review from FelixMcFelix December 16, 2025 01:18

FelixMcFelix approved these changes Dec 16, 2025
View reviewed changes

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
745346a

zeeshanlakhani added 2 commits December 17, 2025 05:14

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
8d949e2

[post-merge] updates
c76f78c

rcgoodfellow approved these changes Jan 1, 2026
View reviewed changes

zeeshanlakhaniand others added 2 commits January 13, 2026 22:21

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
8e83b88

zeeshanlakhani commented Jan 14, 2026
View reviewed changes

Comment threaddpd-client/tests/integration_tests/service.rs Outdated

[fix] update for apis test and copyrights!
db21e50

zeeshanlakhani requested review from FelixMcFelix and rcgoodfellow January 14, 2026 04:30

zeeshanlakhani force-pushed the zl/admin-scope-oxnet branch from 6b8ba63 to a253044Compare January 14, 2026 21:01

zeeshanlakhani changed the title ~~[multicast] Narrow admin-scoped to admin-local only & match Omicron updates to mcast lifecycle~~[multicast] Narrow to admin-local only & match Omicron updates to mcast lifecycleJan 14, 2026

[fmt,2026]
ac8fefb

zeeshanlakhani changed the title ~~[multicast] Narrow to admin-local only & match Omicron updates to mcast lifecycle~~[multicast] Narrow to admin-local Omicron underlay & match Omicron updates to mcast lifecycleJan 15, 2026

zeeshanlakhaniand others added 2 commits January 15, 2026 01:04

zeeshanlakhani mentioned this pull request Jan 15, 2026
[multicast] prevent VLAN translation via match key enforcement #185
Closed
1 task

zeeshanlakhaniand others added 8 commits January 15, 2026 06:39

[validation,api] Move validation to types via FromStr, update delegat…
602dcc5
…ion via dropshot Path try_map Includes: - delegate a versioned endpoint in lib.rs from api-server.rs - Cargo.lock updated for new dropshot/omicron

[fmt,2026,api]
9e0f2d7

[api,multicast] Use v3 type for create underlay endpoint, proper dele…
7402987
…gation We follow API guidelines recently posted in https://github.com/oxidecomputer/dropshot-api-manager/blob/main/guides/new-version.md

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
5dded7a

[openapi] update
85a9876

[test] update size
c7d2f4c

[api] conversoin cleanup / conciseness
c3c1aa1

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
dfbcc39

zeeshanlakhani self-assigned this Jan 20, 2026

zeeshanlakhani added 4 commits January 21, 2026 18:23

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
306ebdc

[post-merge] Update API(s) to match versioning guidelines
3b67dc2

table test
c6c9e65

merge admin-scope-oxnet
656610a
Created using jj-spr 0.1.0

zeeshanlakhani changed the base branch from main to zl/main.multicast-narrow-to-admin-local-omicron-underlay-match-omicron-updates-to-mcast-lifecycleJanuary 22, 2026 07:25

zeeshanlakhani deleted the branch zl/main.multicast-narrow-to-admin-local-omicron-underlay-match-omicron-updates-to-mcast-lifecycleJanuary 22, 2026 07:26

zeeshanlakhani closed this Jan 22, 2026

zeeshanlakhani mentioned this pull request Jan 22, 2026
[multicast] Narrow underlay scope to ff04::/64 and add ASM source filtering #189
Merged

[deps] Update Omicron main related deps to 64b40cb
0aef4d5
This PR is a precursor to a follow-up PR that leverages updated code in `omicron-common`. This gets dendrite in line with Omicron `main`, capturing an upstream type change that we needed to accomodate.

zeeshanlakhani commented Dec 1, 2025
View reviewed changes

Comment threadCargo.toml Outdated

zeeshanlakhani mentioned this pull request Dec 1, 2025
[multicast] implicit group lifecycle with IP pool integration oxidecomputer/omicron#9450
Merged
4 tasks

zeeshanlakhani force-pushed the zl/admin-scope-oxnet branch from 6f00b19 to 94e91caCompare December 1, 2025 05:55

zeeshanlakhani requested review from FelixMcFelix, Nieuwejaar and rcgoodfellow December 1, 2025 06:23

Base automatically changed from zl/omicron-changes-from-main to mainDecember 11, 2025 03:06

zeeshanlakhani added 3 commits December 11, 2025 05:01

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
405d60f

[merge] fixes
622fe62

[review] document port_bitmap used in multicastegress
793b443

FelixMcFelix reviewed Dec 15, 2025
View reviewed changes

Comment threaddpd/p4/port_bitmap_check.p4 Outdated
Comment threaddpd/p4/sidecar.p4 Outdated

[review] fix direction, not being dumb
87dd7f4

zeeshanlakhani requested a review from FelixMcFelix December 16, 2025 01:18

FelixMcFelix approved these changes Dec 16, 2025
View reviewed changes

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
745346a

zeeshanlakhani added 2 commits December 17, 2025 05:14

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
8d949e2

[post-merge] updates
c76f78c

rcgoodfellow approved these changes Jan 1, 2026
View reviewed changes

zeeshanlakhaniand others added 2 commits January 13, 2026 22:21

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
8e83b88

zeeshanlakhani commented Jan 14, 2026
View reviewed changes

Comment threaddpd-client/tests/integration_tests/service.rs Outdated

[fix] update for apis test and copyrights!
db21e50

zeeshanlakhani requested review from FelixMcFelix and rcgoodfellow January 14, 2026 04:30

zeeshanlakhani force-pushed the zl/admin-scope-oxnet branch from 6b8ba63 to a253044Compare January 14, 2026 21:01

zeeshanlakhani changed the title ~~[multicast] Narrow admin-scoped to admin-local only & match Omicron updates to mcast lifecycle~~[multicast] Narrow to admin-local only & match Omicron updates to mcast lifecycleJan 14, 2026

[fmt,2026]
ac8fefb

zeeshanlakhani changed the title ~~[multicast] Narrow to admin-local only & match Omicron updates to mcast lifecycle~~[multicast] Narrow to admin-local Omicron underlay & match Omicron updates to mcast lifecycleJan 15, 2026

zeeshanlakhaniand others added 2 commits January 15, 2026 01:04

zeeshanlakhani mentioned this pull request Jan 15, 2026
[multicast] prevent VLAN translation via match key enforcement #185
Closed
1 task

zeeshanlakhaniand others added 8 commits January 15, 2026 06:39

[validation,api] Move validation to types via FromStr, update delegat…
602dcc5
…ion via dropshot Path try_map Includes: - delegate a versioned endpoint in lib.rs from api-server.rs - Cargo.lock updated for new dropshot/omicron

[fmt,2026,api]
9e0f2d7

[api,multicast] Use v3 type for create underlay endpoint, proper dele…
7402987
…gation We follow API guidelines recently posted in https://github.com/oxidecomputer/dropshot-api-manager/blob/main/guides/new-version.md

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
5dded7a

[openapi] update
85a9876

[test] update size
c7d2f4c

[api] conversoin cleanup / conciseness
c3c1aa1

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
dfbcc39

zeeshanlakhani self-assigned this Jan 20, 2026

zeeshanlakhani added 4 commits January 21, 2026 18:23

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
306ebdc

[post-merge] Update API(s) to match versioning guidelines
3b67dc2

table test
c6c9e65

merge admin-scope-oxnet
656610a
Created using jj-spr 0.1.0

zeeshanlakhani changed the base branch from main to zl/main.multicast-narrow-to-admin-local-omicron-underlay-match-omicron-updates-to-mcast-lifecycleJanuary 22, 2026 07:25

zeeshanlakhani deleted the branch zl/main.multicast-narrow-to-admin-local-omicron-underlay-match-omicron-updates-to-mcast-lifecycleJanuary 22, 2026 07:26

zeeshanlakhani closed this Jan 22, 2026

zeeshanlakhani mentioned this pull request Jan 22, 2026
[multicast] Narrow underlay scope to ff04::/64 and add ASM source filtering #189
Merged

[deps] Update Omicron main related deps to 64b40cb
0aef4d5
This PR is a precursor to a follow-up PR that leverages updated code in `omicron-common`. This gets dendrite in line with Omicron `main`, capturing an upstream type change that we needed to accomodate.

zeeshanlakhani commented Dec 1, 2025
View reviewed changes

Comment threadCargo.toml Outdated

zeeshanlakhani mentioned this pull request Dec 1, 2025
[multicast] implicit group lifecycle with IP pool integration oxidecomputer/omicron#9450
Merged
4 tasks

zeeshanlakhani force-pushed the zl/admin-scope-oxnet branch from 6f00b19 to 94e91caCompare December 1, 2025 05:55

zeeshanlakhani requested review from FelixMcFelix, Nieuwejaar and rcgoodfellow December 1, 2025 06:23

Base automatically changed from zl/omicron-changes-from-main to mainDecember 11, 2025 03:06

zeeshanlakhani added 3 commits December 11, 2025 05:01

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
405d60f

[merge] fixes
622fe62

[review] document port_bitmap used in multicastegress
793b443

FelixMcFelix reviewed Dec 15, 2025
View reviewed changes

Comment threaddpd/p4/port_bitmap_check.p4 Outdated
Comment threaddpd/p4/sidecar.p4 Outdated

[review] fix direction, not being dumb
87dd7f4

zeeshanlakhani requested a review from FelixMcFelix December 16, 2025 01:18

FelixMcFelix approved these changes Dec 16, 2025
View reviewed changes

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
745346a

zeeshanlakhani added 2 commits December 17, 2025 05:14

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
8d949e2

[post-merge] updates
c76f78c

rcgoodfellow approved these changes Jan 1, 2026
View reviewed changes

zeeshanlakhaniand others added 2 commits January 13, 2026 22:21

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
8e83b88

zeeshanlakhani commented Jan 14, 2026
View reviewed changes

Comment threaddpd-client/tests/integration_tests/service.rs Outdated

[fix] update for apis test and copyrights!
db21e50

zeeshanlakhani requested review from FelixMcFelix and rcgoodfellow January 14, 2026 04:30

zeeshanlakhani force-pushed the zl/admin-scope-oxnet branch from 6b8ba63 to a253044Compare January 14, 2026 21:01

zeeshanlakhani changed the title ~~[multicast] Narrow admin-scoped to admin-local only & match Omicron updates to mcast lifecycle~~[multicast] Narrow to admin-local only & match Omicron updates to mcast lifecycleJan 14, 2026

[fmt,2026]
ac8fefb

zeeshanlakhani changed the title ~~[multicast] Narrow to admin-local only & match Omicron updates to mcast lifecycle~~[multicast] Narrow to admin-local Omicron underlay & match Omicron updates to mcast lifecycleJan 15, 2026

zeeshanlakhaniand others added 2 commits January 15, 2026 01:04

zeeshanlakhani mentioned this pull request Jan 15, 2026
[multicast] prevent VLAN translation via match key enforcement #185
Closed
1 task

zeeshanlakhaniand others added 8 commits January 15, 2026 06:39

[validation,api] Move validation to types via FromStr, update delegat…
602dcc5
…ion via dropshot Path try_map Includes: - delegate a versioned endpoint in lib.rs from api-server.rs - Cargo.lock updated for new dropshot/omicron

[fmt,2026,api]
9e0f2d7

[api,multicast] Use v3 type for create underlay endpoint, proper dele…
7402987
…gation We follow API guidelines recently posted in https://github.com/oxidecomputer/dropshot-api-manager/blob/main/guides/new-version.md

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
5dded7a

[openapi] update
85a9876

[test] update size
c7d2f4c

[api] conversoin cleanup / conciseness
c3c1aa1

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
dfbcc39

zeeshanlakhani self-assigned this Jan 20, 2026

zeeshanlakhani added 4 commits January 21, 2026 18:23

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
306ebdc

[post-merge] Update API(s) to match versioning guidelines
3b67dc2

table test
c6c9e65

merge admin-scope-oxnet
656610a
Created using jj-spr 0.1.0

zeeshanlakhani changed the base branch from main to zl/main.multicast-narrow-to-admin-local-omicron-underlay-match-omicron-updates-to-mcast-lifecycleJanuary 22, 2026 07:25

zeeshanlakhani deleted the branch zl/main.multicast-narrow-to-admin-local-omicron-underlay-match-omicron-updates-to-mcast-lifecycleJanuary 22, 2026 07:26

zeeshanlakhani closed this Jan 22, 2026

zeeshanlakhani mentioned this pull request Jan 22, 2026
[multicast] Narrow underlay scope to ff04::/64 and add ASM source filtering #189
Merged

[deps] Update Omicron main related deps to 64b40cb
0aef4d5
This PR is a precursor to a follow-up PR that leverages updated code in `omicron-common`. This gets dendrite in line with Omicron `main`, capturing an upstream type change that we needed to accomodate.

zeeshanlakhani commented Dec 1, 2025
View reviewed changes

Comment threadCargo.toml Outdated

zeeshanlakhani mentioned this pull request Dec 1, 2025
[multicast] implicit group lifecycle with IP pool integration oxidecomputer/omicron#9450
Merged
4 tasks

zeeshanlakhani force-pushed the zl/admin-scope-oxnet branch from 6f00b19 to 94e91caCompare December 1, 2025 05:55

zeeshanlakhani requested review from FelixMcFelix, Nieuwejaar and rcgoodfellow December 1, 2025 06:23

Base automatically changed from zl/omicron-changes-from-main to mainDecember 11, 2025 03:06

zeeshanlakhani added 3 commits December 11, 2025 05:01

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
405d60f

[merge] fixes
622fe62

[review] document port_bitmap used in multicastegress
793b443

FelixMcFelix reviewed Dec 15, 2025
View reviewed changes

Comment threaddpd/p4/port_bitmap_check.p4 Outdated
Comment threaddpd/p4/sidecar.p4 Outdated

[review] fix direction, not being dumb
87dd7f4

zeeshanlakhani requested a review from FelixMcFelix December 16, 2025 01:18

FelixMcFelix approved these changes Dec 16, 2025
View reviewed changes

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
745346a

zeeshanlakhani added 2 commits December 17, 2025 05:14

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
8d949e2

[post-merge] updates
c76f78c

rcgoodfellow approved these changes Jan 1, 2026
View reviewed changes

zeeshanlakhaniand others added 2 commits January 13, 2026 22:21

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
8e83b88

zeeshanlakhani commented Jan 14, 2026
View reviewed changes

Comment threaddpd-client/tests/integration_tests/service.rs Outdated

[fix] update for apis test and copyrights!
db21e50

zeeshanlakhani requested review from FelixMcFelix and rcgoodfellow January 14, 2026 04:30

zeeshanlakhani force-pushed the zl/admin-scope-oxnet branch from 6b8ba63 to a253044Compare January 14, 2026 21:01

zeeshanlakhani changed the title ~~[multicast] Narrow admin-scoped to admin-local only & match Omicron updates to mcast lifecycle~~[multicast] Narrow to admin-local only & match Omicron updates to mcast lifecycleJan 14, 2026

[fmt,2026]
ac8fefb

zeeshanlakhani changed the title ~~[multicast] Narrow to admin-local only & match Omicron updates to mcast lifecycle~~[multicast] Narrow to admin-local Omicron underlay & match Omicron updates to mcast lifecycleJan 15, 2026

zeeshanlakhaniand others added 2 commits January 15, 2026 01:04

zeeshanlakhani mentioned this pull request Jan 15, 2026
[multicast] prevent VLAN translation via match key enforcement #185
Closed
1 task

zeeshanlakhaniand others added 8 commits January 15, 2026 06:39

[validation,api] Move validation to types via FromStr, update delegat…
602dcc5
…ion via dropshot Path try_map Includes: - delegate a versioned endpoint in lib.rs from api-server.rs - Cargo.lock updated for new dropshot/omicron

[fmt,2026,api]
9e0f2d7

[api,multicast] Use v3 type for create underlay endpoint, proper dele…
7402987
…gation We follow API guidelines recently posted in https://github.com/oxidecomputer/dropshot-api-manager/blob/main/guides/new-version.md

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
5dded7a

[openapi] update
85a9876

[test] update size
c7d2f4c

[api] conversoin cleanup / conciseness
c3c1aa1

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
dfbcc39

zeeshanlakhani self-assigned this Jan 20, 2026

zeeshanlakhani added 4 commits January 21, 2026 18:23

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
306ebdc

[post-merge] Update API(s) to match versioning guidelines
3b67dc2

table test
c6c9e65

merge admin-scope-oxnet
656610a
Created using jj-spr 0.1.0

zeeshanlakhani changed the base branch from main to zl/main.multicast-narrow-to-admin-local-omicron-underlay-match-omicron-updates-to-mcast-lifecycleJanuary 22, 2026 07:25

zeeshanlakhani deleted the branch zl/main.multicast-narrow-to-admin-local-omicron-underlay-match-omicron-updates-to-mcast-lifecycleJanuary 22, 2026 07:26

zeeshanlakhani closed this Jan 22, 2026

zeeshanlakhani mentioned this pull request Jan 22, 2026
[multicast] Narrow underlay scope to ff04::/64 and add ASM source filtering #189
Merged

[deps] Update Omicron main related deps to 64b40cb
0aef4d5
This PR is a precursor to a follow-up PR that leverages updated code in `omicron-common`. This gets dendrite in line with Omicron `main`, capturing an upstream type change that we needed to accomodate.

zeeshanlakhani commented Dec 1, 2025
View reviewed changes

Comment threadCargo.toml Outdated

zeeshanlakhani mentioned this pull request Dec 1, 2025
[multicast] implicit group lifecycle with IP pool integration oxidecomputer/omicron#9450
Merged
4 tasks

zeeshanlakhani force-pushed the zl/admin-scope-oxnet branch from 6f00b19 to 94e91caCompare December 1, 2025 05:55

zeeshanlakhani requested review from FelixMcFelix, Nieuwejaar and rcgoodfellow December 1, 2025 06:23

Base automatically changed from zl/omicron-changes-from-main to mainDecember 11, 2025 03:06

zeeshanlakhani added 3 commits December 11, 2025 05:01

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
405d60f

[merge] fixes
622fe62

[review] document port_bitmap used in multicastegress
793b443

FelixMcFelix reviewed Dec 15, 2025
View reviewed changes

Comment threaddpd/p4/port_bitmap_check.p4 Outdated
Comment threaddpd/p4/sidecar.p4 Outdated

[review] fix direction, not being dumb
87dd7f4

zeeshanlakhani requested a review from FelixMcFelix December 16, 2025 01:18

FelixMcFelix approved these changes Dec 16, 2025
View reviewed changes

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
745346a

zeeshanlakhani added 2 commits December 17, 2025 05:14

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
8d949e2

[post-merge] updates
c76f78c

rcgoodfellow approved these changes Jan 1, 2026
View reviewed changes

zeeshanlakhaniand others added 2 commits January 13, 2026 22:21

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
8e83b88

zeeshanlakhani commented Jan 14, 2026
View reviewed changes

Comment threaddpd-client/tests/integration_tests/service.rs Outdated

[fix] update for apis test and copyrights!
db21e50

zeeshanlakhani requested review from FelixMcFelix and rcgoodfellow January 14, 2026 04:30

zeeshanlakhani force-pushed the zl/admin-scope-oxnet branch from 6b8ba63 to a253044Compare January 14, 2026 21:01

zeeshanlakhani changed the title ~~[multicast] Narrow admin-scoped to admin-local only & match Omicron updates to mcast lifecycle~~[multicast] Narrow to admin-local only & match Omicron updates to mcast lifecycleJan 14, 2026

[fmt,2026]
ac8fefb

zeeshanlakhani changed the title ~~[multicast] Narrow to admin-local only & match Omicron updates to mcast lifecycle~~[multicast] Narrow to admin-local Omicron underlay & match Omicron updates to mcast lifecycleJan 15, 2026

zeeshanlakhaniand others added 2 commits January 15, 2026 01:04

zeeshanlakhani mentioned this pull request Jan 15, 2026
[multicast] prevent VLAN translation via match key enforcement #185
Closed
1 task

zeeshanlakhaniand others added 8 commits January 15, 2026 06:39

[validation,api] Move validation to types via FromStr, update delegat…
602dcc5
…ion via dropshot Path try_map Includes: - delegate a versioned endpoint in lib.rs from api-server.rs - Cargo.lock updated for new dropshot/omicron

[fmt,2026,api]
9e0f2d7

[api,multicast] Use v3 type for create underlay endpoint, proper dele…
7402987
…gation We follow API guidelines recently posted in https://github.com/oxidecomputer/dropshot-api-manager/blob/main/guides/new-version.md

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
5dded7a

[openapi] update
85a9876

[test] update size
c7d2f4c

[api] conversoin cleanup / conciseness
c3c1aa1

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
dfbcc39

zeeshanlakhani self-assigned this Jan 20, 2026

zeeshanlakhani added 4 commits January 21, 2026 18:23

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
306ebdc

[post-merge] Update API(s) to match versioning guidelines
3b67dc2

table test
c6c9e65

merge admin-scope-oxnet
656610a
Created using jj-spr 0.1.0

zeeshanlakhani changed the base branch from main to zl/main.multicast-narrow-to-admin-local-omicron-underlay-match-omicron-updates-to-mcast-lifecycleJanuary 22, 2026 07:25

zeeshanlakhani deleted the branch zl/main.multicast-narrow-to-admin-local-omicron-underlay-match-omicron-updates-to-mcast-lifecycleJanuary 22, 2026 07:26

zeeshanlakhani closed this Jan 22, 2026

zeeshanlakhani mentioned this pull request Jan 22, 2026
[multicast] Narrow underlay scope to ff04::/64 and add ASM source filtering #189
Merged

[deps] Update Omicron main related deps to 64b40cb
0aef4d5
This PR is a precursor to a follow-up PR that leverages updated code in `omicron-common`. This gets dendrite in line with Omicron `main`, capturing an upstream type change that we needed to accomodate.

zeeshanlakhani commented Dec 1, 2025
View reviewed changes

Comment threadCargo.toml Outdated

zeeshanlakhani mentioned this pull request Dec 1, 2025
[multicast] implicit group lifecycle with IP pool integration oxidecomputer/omicron#9450
Merged
4 tasks

zeeshanlakhani force-pushed the zl/admin-scope-oxnet branch from 6f00b19 to 94e91caCompare December 1, 2025 05:55

zeeshanlakhani requested review from FelixMcFelix, Nieuwejaar and rcgoodfellow December 1, 2025 06:23

Base automatically changed from zl/omicron-changes-from-main to mainDecember 11, 2025 03:06

zeeshanlakhani added 3 commits December 11, 2025 05:01

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
405d60f

[merge] fixes
622fe62

[review] document port_bitmap used in multicastegress
793b443

FelixMcFelix reviewed Dec 15, 2025
View reviewed changes

Comment threaddpd/p4/port_bitmap_check.p4 Outdated
Comment threaddpd/p4/sidecar.p4 Outdated

[review] fix direction, not being dumb
87dd7f4

zeeshanlakhani requested a review from FelixMcFelix December 16, 2025 01:18

FelixMcFelix approved these changes Dec 16, 2025
View reviewed changes

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
745346a

zeeshanlakhani added 2 commits December 17, 2025 05:14

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
8d949e2

[post-merge] updates
c76f78c

rcgoodfellow approved these changes Jan 1, 2026
View reviewed changes

zeeshanlakhaniand others added 2 commits January 13, 2026 22:21

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
8e83b88

zeeshanlakhani commented Jan 14, 2026
View reviewed changes

Comment threaddpd-client/tests/integration_tests/service.rs Outdated

[fix] update for apis test and copyrights!
db21e50

zeeshanlakhani requested review from FelixMcFelix and rcgoodfellow January 14, 2026 04:30

zeeshanlakhani force-pushed the zl/admin-scope-oxnet branch from 6b8ba63 to a253044Compare January 14, 2026 21:01

zeeshanlakhani changed the title ~~[multicast] Narrow admin-scoped to admin-local only & match Omicron updates to mcast lifecycle~~[multicast] Narrow to admin-local only & match Omicron updates to mcast lifecycleJan 14, 2026

[fmt,2026]
ac8fefb

zeeshanlakhani changed the title ~~[multicast] Narrow to admin-local only & match Omicron updates to mcast lifecycle~~[multicast] Narrow to admin-local Omicron underlay & match Omicron updates to mcast lifecycleJan 15, 2026

zeeshanlakhaniand others added 2 commits January 15, 2026 01:04

zeeshanlakhani mentioned this pull request Jan 15, 2026
[multicast] prevent VLAN translation via match key enforcement #185
Closed
1 task

zeeshanlakhaniand others added 8 commits January 15, 2026 06:39

[validation,api] Move validation to types via FromStr, update delegat…
602dcc5
…ion via dropshot Path try_map Includes: - delegate a versioned endpoint in lib.rs from api-server.rs - Cargo.lock updated for new dropshot/omicron

[fmt,2026,api]
9e0f2d7

[api,multicast] Use v3 type for create underlay endpoint, proper dele…
7402987
…gation We follow API guidelines recently posted in https://github.com/oxidecomputer/dropshot-api-manager/blob/main/guides/new-version.md

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
5dded7a

[openapi] update
85a9876

[test] update size
c7d2f4c

[api] conversoin cleanup / conciseness
c3c1aa1

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
dfbcc39

zeeshanlakhani self-assigned this Jan 20, 2026

zeeshanlakhani added 4 commits January 21, 2026 18:23

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
306ebdc

[post-merge] Update API(s) to match versioning guidelines
3b67dc2

table test
c6c9e65

merge admin-scope-oxnet
656610a
Created using jj-spr 0.1.0

zeeshanlakhani changed the base branch from main to zl/main.multicast-narrow-to-admin-local-omicron-underlay-match-omicron-updates-to-mcast-lifecycleJanuary 22, 2026 07:25

zeeshanlakhani deleted the branch zl/main.multicast-narrow-to-admin-local-omicron-underlay-match-omicron-updates-to-mcast-lifecycleJanuary 22, 2026 07:26

zeeshanlakhani closed this Jan 22, 2026

zeeshanlakhani mentioned this pull request Jan 22, 2026
[multicast] Narrow underlay scope to ff04::/64 and add ASM source filtering #189
Merged

[deps] Update Omicron main related deps to 64b40cb
0aef4d5
This PR is a precursor to a follow-up PR that leverages updated code in `omicron-common`. This gets dendrite in line with Omicron `main`, capturing an upstream type change that we needed to accomodate.

zeeshanlakhani commented Dec 1, 2025
View reviewed changes

Comment threadCargo.toml Outdated

zeeshanlakhani mentioned this pull request Dec 1, 2025
[multicast] implicit group lifecycle with IP pool integration oxidecomputer/omicron#9450
Merged
4 tasks

zeeshanlakhani force-pushed the zl/admin-scope-oxnet branch from 6f00b19 to 94e91caCompare December 1, 2025 05:55

zeeshanlakhani requested review from FelixMcFelix, Nieuwejaar and rcgoodfellow December 1, 2025 06:23

Base automatically changed from zl/omicron-changes-from-main to mainDecember 11, 2025 03:06

zeeshanlakhani added 3 commits December 11, 2025 05:01

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
405d60f

[merge] fixes
622fe62

[review] document port_bitmap used in multicastegress
793b443

FelixMcFelix reviewed Dec 15, 2025
View reviewed changes

Comment threaddpd/p4/port_bitmap_check.p4 Outdated
Comment threaddpd/p4/sidecar.p4 Outdated

[review] fix direction, not being dumb
87dd7f4

zeeshanlakhani requested a review from FelixMcFelix December 16, 2025 01:18

FelixMcFelix approved these changes Dec 16, 2025
View reviewed changes

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
745346a

zeeshanlakhani added 2 commits December 17, 2025 05:14

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
8d949e2

[post-merge] updates
c76f78c

rcgoodfellow approved these changes Jan 1, 2026
View reviewed changes

zeeshanlakhaniand others added 2 commits January 13, 2026 22:21

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
8e83b88

zeeshanlakhani commented Jan 14, 2026
View reviewed changes

Comment threaddpd-client/tests/integration_tests/service.rs Outdated

[fix] update for apis test and copyrights!
db21e50

zeeshanlakhani requested review from FelixMcFelix and rcgoodfellow January 14, 2026 04:30

zeeshanlakhani force-pushed the zl/admin-scope-oxnet branch from 6b8ba63 to a253044Compare January 14, 2026 21:01

zeeshanlakhani changed the title ~~[multicast] Narrow admin-scoped to admin-local only & match Omicron updates to mcast lifecycle~~[multicast] Narrow to admin-local only & match Omicron updates to mcast lifecycleJan 14, 2026

[fmt,2026]
ac8fefb

zeeshanlakhani changed the title ~~[multicast] Narrow to admin-local only & match Omicron updates to mcast lifecycle~~[multicast] Narrow to admin-local Omicron underlay & match Omicron updates to mcast lifecycleJan 15, 2026

zeeshanlakhaniand others added 2 commits January 15, 2026 01:04

zeeshanlakhani mentioned this pull request Jan 15, 2026
[multicast] prevent VLAN translation via match key enforcement #185
Closed
1 task

zeeshanlakhaniand others added 8 commits January 15, 2026 06:39

[validation,api] Move validation to types via FromStr, update delegat…
602dcc5
…ion via dropshot Path try_map Includes: - delegate a versioned endpoint in lib.rs from api-server.rs - Cargo.lock updated for new dropshot/omicron

[fmt,2026,api]
9e0f2d7

[api,multicast] Use v3 type for create underlay endpoint, proper dele…
7402987
…gation We follow API guidelines recently posted in https://github.com/oxidecomputer/dropshot-api-manager/blob/main/guides/new-version.md

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
5dded7a

[openapi] update
85a9876

[test] update size
c7d2f4c

[api] conversoin cleanup / conciseness
c3c1aa1

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
dfbcc39

zeeshanlakhani self-assigned this Jan 20, 2026

zeeshanlakhani added 4 commits January 21, 2026 18:23

Merge remote-tracking branch 'origin/main' into zl/admin-scope-oxnet
306ebdc

[post-merge] Update API(s) to match versioning guidelines
3b67dc2

table test
c6c9e65

merge admin-scope-oxnet
656610a
Created using jj-spr 0.1.0

zeeshanlakhani changed the base branch from main to zl/main.multicast-narrow-to-admin-local-omicron-underlay-match-omicron-updates-to-mcast-lifecycleJanuary 22, 2026 07:25

zeeshanlakhani deleted the branch zl/main.multicast-narrow-to-admin-local-omicron-underlay-match-omicron-updates-to-mcast-lifecycleJanuary 22, 2026 07:26

zeeshanlakhani closed this Jan 22, 2026

zeeshanlakhani mentioned this pull request Jan 22, 2026
[multicast] Narrow underlay scope to ff04::/64 and add ASM source filtering #189
Merged

Uh oh!

Conversation

zeeshanlakhani commented Dec 1, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

zeeshanlakhani commented Dec 15, 2025

Uh oh!

FelixMcFelix left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

zeeshanlakhani commented Dec 16, 2025

Uh oh!

FelixMcFelix left a comment

Choose a reason for hiding this comment

Uh oh!

zeeshanlakhani commented Dec 17, 2025

Uh oh!

rcgoodfellowJan 1, 2026

Choose a reason for hiding this comment

Uh oh!

zeeshanlakhaniJan 14, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

zeeshanlakhani commented Jan 14, 2026

Uh oh!

zeeshanlakhani commented Jan 15, 2026

Uh oh!

zeeshanlakhani commented Jan 21, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zeeshanlakhani commented Jan 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

zeeshanlakhani commented Dec 1, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

zeeshanlakhani commented Dec 15, 2025

Uh oh!

FelixMcFelix left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

zeeshanlakhani commented Dec 16, 2025

Uh oh!

FelixMcFelix left a comment

Choose a reason for hiding this comment

Uh oh!

zeeshanlakhani commented Dec 17, 2025

Uh oh!

rcgoodfellowJan 1, 2026

Choose a reason for hiding this comment

Uh oh!

zeeshanlakhaniJan 14, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

zeeshanlakhani commented Jan 14, 2026

Uh oh!

zeeshanlakhani commented Jan 15, 2026

Uh oh!

zeeshanlakhani commented Jan 21, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zeeshanlakhani commented Dec 1, 2025•
edited
Loading

zeeshanlakhaniJan 14, 2026•
edited
Loading

zeeshanlakhani commented Jan 21, 2026•
edited
Loading

zeeshanlakhani commented Dec 1, 2025•
edited
Loading

zeeshanlakhaniJan 14, 2026•
edited
Loading

zeeshanlakhani commented Jan 21, 2026•
edited
Loading

zeeshanlakhani commented Dec 1, 2025•
edited
Loading

zeeshanlakhaniJan 14, 2026•
edited
Loading

zeeshanlakhani commented Jan 21, 2026•
edited
Loading