[multicast] prevent VLAN translation via match key enforcement

[zeeshanlakhani]

Fixes#107, which now properly passes.

Stacked on #189.

I'm tracking stacked PR's with https://github.com/LucioFranco/jj-spr/tree/main, hence the stacked naming.

This adds VLAN-aware NAT ingress matching to prevent cross-VLAN translation. Previously, a packet arriving with VLAN 100 destined to a multicast group configured for VLAN 200 would be NAT encapsulated and forwarded, effectively translating the packet to the wrong customer's network.

Includes:

NAT ingress table matching (mcast_nat.rs, mod.rs):

• Add Ipv4VlanMatchKey and Ipv6VlanMatchKey that match on destination address, VLAN header validity, and VLAN ID
• For groups with VLAN, install two entries: untagged (for decapsulated Geneve from underlay) and correctly tagged (for customer packets)
• Packets with the wrong VLAN miss both entries and are not NAT encapsulated

Multicast router VLAN handling (sidecar.p4):

• Strip incoming VLAN tag before routing lookup in MulticastRouter4/6
• forward_vlan action re-adds the group's configured VLAN on egress
• Prevents unintended VLAN translation at the routing stage

Rollback changes:

• Remove dead NAT rollback branches for internal groups (no NAT entries)
• Add rollback support for VLAN changes in NAT and route tables

Counter fix:

• The underlay multicast counter condition was unreachable for packets tagged MULTICAST_TAG_UNDERLAY_EXTERNAL that were not decapped. The check for == MULTICAST_TAG_UNDERLAY excluded these packets, causing them to fall through to the external counter.

[zeeshanlakhani]

Fixes#107, which now properly passes.

Stacked on #189.

I'm tracking stacked PR's with https://github.com/LucioFranco/jj-spr/tree/main, hence the stacked naming.

This adds VLAN-aware NAT ingress matching to prevent cross-VLAN translation. Previously, a packet arriving with VLAN 100 destined to a multicast group configured for VLAN 200 would be NAT encapsulated and forwarded, effectively translating the packet to the wrong customer's network.

Includes:

NAT ingress table matching (mcast_nat.rs, mod.rs):

• Add Ipv4VlanMatchKey and Ipv6VlanMatchKey that match on destination address, VLAN header validity, and VLAN ID
• For groups with VLAN, install two entries: untagged (for decapsulated Geneve from underlay) and correctly tagged (for customer packets)
• Packets with the wrong VLAN miss both entries and are not NAT encapsulated

Multicast router VLAN handling (sidecar.p4):

• Strip incoming VLAN tag before routing lookup in MulticastRouter4/6
• forward_vlan action re-adds the group's configured VLAN on egress
• Prevents unintended VLAN translation at the routing stage

Rollback changes:

• Remove dead NAT rollback branches for internal groups (no NAT entries)
• Add rollback support for VLAN changes in NAT and route tables

Counter fix:

• The underlay multicast counter condition was unreachable for packets tagged MULTICAST_TAG_UNDERLAY_EXTERNAL that were not decapped. The check for == MULTICAST_TAG_UNDERLAY excluded these packets, causing them to fall through to the external counter.

[zeeshanlakhani]

Fixes#107, which now properly passes.

Stacked on #189.

I'm tracking stacked PR's with https://github.com/LucioFranco/jj-spr/tree/main, hence the stacked naming.

This adds VLAN-aware NAT ingress matching to prevent cross-VLAN translation. Previously, a packet arriving with VLAN 100 destined to a multicast group configured for VLAN 200 would be NAT encapsulated and forwarded, effectively translating the packet to the wrong customer's network.

Includes:

NAT ingress table matching (mcast_nat.rs, mod.rs):

• Add Ipv4VlanMatchKey and Ipv6VlanMatchKey that match on destination address, VLAN header validity, and VLAN ID
• For groups with VLAN, install two entries: untagged (for decapsulated Geneve from underlay) and correctly tagged (for customer packets)
• Packets with the wrong VLAN miss both entries and are not NAT encapsulated

Multicast router VLAN handling (sidecar.p4):

• Strip incoming VLAN tag before routing lookup in MulticastRouter4/6
• forward_vlan action re-adds the group's configured VLAN on egress
• Prevents unintended VLAN translation at the routing stage

Rollback changes:

• Remove dead NAT rollback branches for internal groups (no NAT entries)
• Add rollback support for VLAN changes in NAT and route tables

Counter fix:

• The underlay multicast counter condition was unreachable for packets tagged MULTICAST_TAG_UNDERLAY_EXTERNAL that were not decapped. The check for == MULTICAST_TAG_UNDERLAY excluded these packets, causing them to fall through to the external counter.

[zeeshanlakhani]

Fixes#107, which now properly passes.

Stacked on #189.

I'm tracking stacked PR's with https://github.com/LucioFranco/jj-spr/tree/main, hence the stacked naming.

This adds VLAN-aware NAT ingress matching to prevent cross-VLAN translation. Previously, a packet arriving with VLAN 100 destined to a multicast group configured for VLAN 200 would be NAT encapsulated and forwarded, effectively translating the packet to the wrong customer's network.

Includes:

NAT ingress table matching (mcast_nat.rs, mod.rs):

• Add Ipv4VlanMatchKey and Ipv6VlanMatchKey that match on destination address, VLAN header validity, and VLAN ID
• For groups with VLAN, install two entries: untagged (for decapsulated Geneve from underlay) and correctly tagged (for customer packets)
• Packets with the wrong VLAN miss both entries and are not NAT encapsulated

Multicast router VLAN handling (sidecar.p4):

• Strip incoming VLAN tag before routing lookup in MulticastRouter4/6
• forward_vlan action re-adds the group's configured VLAN on egress
• Prevents unintended VLAN translation at the routing stage

Rollback changes:

• Remove dead NAT rollback branches for internal groups (no NAT entries)
• Add rollback support for VLAN changes in NAT and route tables

Counter fix:

• The underlay multicast counter condition was unreachable for packets tagged MULTICAST_TAG_UNDERLAY_EXTERNAL that were not decapped. The check for == MULTICAST_TAG_UNDERLAY excluded these packets, causing them to fall through to the external counter.

[zeeshanlakhani]

Fixes#107, which now properly passes.

Stacked on #189.

I'm tracking stacked PR's with https://github.com/LucioFranco/jj-spr/tree/main, hence the stacked naming.

This adds VLAN-aware NAT ingress matching to prevent cross-VLAN translation. Previously, a packet arriving with VLAN 100 destined to a multicast group configured for VLAN 200 would be NAT encapsulated and forwarded, effectively translating the packet to the wrong customer's network.

Includes:

NAT ingress table matching (mcast_nat.rs, mod.rs):

• Add Ipv4VlanMatchKey and Ipv6VlanMatchKey that match on destination address, VLAN header validity, and VLAN ID
• For groups with VLAN, install two entries: untagged (for decapsulated Geneve from underlay) and correctly tagged (for customer packets)
• Packets with the wrong VLAN miss both entries and are not NAT encapsulated

Multicast router VLAN handling (sidecar.p4):

• Strip incoming VLAN tag before routing lookup in MulticastRouter4/6
• forward_vlan action re-adds the group's configured VLAN on egress
• Prevents unintended VLAN translation at the routing stage

Rollback changes:

• Remove dead NAT rollback branches for internal groups (no NAT entries)
• Add rollback support for VLAN changes in NAT and route tables

Counter fix:

• The underlay multicast counter condition was unreachable for packets tagged MULTICAST_TAG_UNDERLAY_EXTERNAL that were not decapped. The check for == MULTICAST_TAG_UNDERLAY excluded these packets, causing them to fall through to the external counter.

[zeeshanlakhani]

Fixes#107, which now properly passes.

Stacked on #189.

I'm tracking stacked PR's with https://github.com/LucioFranco/jj-spr/tree/main, hence the stacked naming.

This adds VLAN-aware NAT ingress matching to prevent cross-VLAN translation. Previously, a packet arriving with VLAN 100 destined to a multicast group configured for VLAN 200 would be NAT encapsulated and forwarded, effectively translating the packet to the wrong customer's network.

Includes:

NAT ingress table matching (mcast_nat.rs, mod.rs):

• Add Ipv4VlanMatchKey and Ipv6VlanMatchKey that match on destination address, VLAN header validity, and VLAN ID
• For groups with VLAN, install two entries: untagged (for decapsulated Geneve from underlay) and correctly tagged (for customer packets)
• Packets with the wrong VLAN miss both entries and are not NAT encapsulated

Multicast router VLAN handling (sidecar.p4):

• Strip incoming VLAN tag before routing lookup in MulticastRouter4/6
• forward_vlan action re-adds the group's configured VLAN on egress
• Prevents unintended VLAN translation at the routing stage

Rollback changes:

• Remove dead NAT rollback branches for internal groups (no NAT entries)
• Add rollback support for VLAN changes in NAT and route tables

Counter fix:

• The underlay multicast counter condition was unreachable for packets tagged MULTICAST_TAG_UNDERLAY_EXTERNAL that were not decapped. The check for == MULTICAST_TAG_UNDERLAY excluded these packets, causing them to fall through to the external counter.

[zeeshanlakhani]

Fixes#107, which now properly passes.

Stacked on #189.

I'm tracking stacked PR's with https://github.com/LucioFranco/jj-spr/tree/main, hence the stacked naming.

This adds VLAN-aware NAT ingress matching to prevent cross-VLAN translation. Previously, a packet arriving with VLAN 100 destined to a multicast group configured for VLAN 200 would be NAT encapsulated and forwarded, effectively translating the packet to the wrong customer's network.

Includes:

NAT ingress table matching (mcast_nat.rs, mod.rs):

• Add Ipv4VlanMatchKey and Ipv6VlanMatchKey that match on destination address, VLAN header validity, and VLAN ID
• For groups with VLAN, install two entries: untagged (for decapsulated Geneve from underlay) and correctly tagged (for customer packets)
• Packets with the wrong VLAN miss both entries and are not NAT encapsulated

Multicast router VLAN handling (sidecar.p4):

• Strip incoming VLAN tag before routing lookup in MulticastRouter4/6
• forward_vlan action re-adds the group's configured VLAN on egress
• Prevents unintended VLAN translation at the routing stage

Rollback changes:

• Remove dead NAT rollback branches for internal groups (no NAT entries)
• Add rollback support for VLAN changes in NAT and route tables

Counter fix:

• The underlay multicast counter condition was unreachable for packets tagged MULTICAST_TAG_UNDERLAY_EXTERNAL that were not decapped. The check for == MULTICAST_TAG_UNDERLAY excluded these packets, causing them to fall through to the external counter.

[zeeshanlakhani]

Fixes#107, which now properly passes.

Stacked on #189.

I'm tracking stacked PR's with https://github.com/LucioFranco/jj-spr/tree/main, hence the stacked naming.

This adds VLAN-aware NAT ingress matching to prevent cross-VLAN translation. Previously, a packet arriving with VLAN 100 destined to a multicast group configured for VLAN 200 would be NAT encapsulated and forwarded, effectively translating the packet to the wrong customer's network.

Includes:

NAT ingress table matching (mcast_nat.rs, mod.rs):

• Add Ipv4VlanMatchKey and Ipv6VlanMatchKey that match on destination address, VLAN header validity, and VLAN ID
• For groups with VLAN, install two entries: untagged (for decapsulated Geneve from underlay) and correctly tagged (for customer packets)
• Packets with the wrong VLAN miss both entries and are not NAT encapsulated

Multicast router VLAN handling (sidecar.p4):

• Strip incoming VLAN tag before routing lookup in MulticastRouter4/6
• forward_vlan action re-adds the group's configured VLAN on egress
• Prevents unintended VLAN translation at the routing stage

Rollback changes:

• Remove dead NAT rollback branches for internal groups (no NAT entries)
• Add rollback support for VLAN changes in NAT and route tables

Counter fix:

• The underlay multicast counter condition was unreachable for packets tagged MULTICAST_TAG_UNDERLAY_EXTERNAL that were not decapped. The check for == MULTICAST_TAG_UNDERLAY excluded these packets, causing them to fall through to the external counter.