commit b45a61bc3fde8f1fcd00bda1f12335fe65373990
author Maciej Żenczykowski <maze@google.com> Tue Mar 25 15:39:25 2025 -0700
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Tue Mar 25 15:39:25 2025 -0700
tree d6b510873ca23fa346ba50599e2de1cc64ecb81d
parent 45173f74d3a2381de5c9a6f987153d1b79b0e8f4
parent aa33013ba5397977b92284b15013bae182679236

Merge "clatd bpf: drop multicast" into main

bpf/progs/clatd.c

diff --git a/bpf/progs/clatd.c b/bpf/progs/clatd.c
index f4e4f3b..690a572 100644
--- a/bpf/progs/clatd.c
+++ b/bpf/progs/clatd.c
@@ -288,8 +288,8 @@
     // We cannot handle IP options, just standard 20 byte == 5 dword minimal IPv4 header
     if (ip4->ihl != 5) return TC_ACT_PIPE;
 
-    // Packet must not be multicast
-    if ((ip4->daddr & htonl(0xf0000000)) == htonl(0xe0000000)) return TC_ACT_PIPE;
+    // Packet must not be multicast, if it is just outright drop it.
+    if ((ip4->daddr & htonl(0xf0000000)) == htonl(0xe0000000)) return TC_ACT_SHOT;
 
     // Calculate the IPv4 one's complement checksum of the IPv4 header.
     __wsum sum4 = 0;