Skip to content

fix: enable mld listener queries, disable multicast snooping #11246

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
r-birkner merged 1 commit into from
Aug 21, 2026
Merged

fix: enable mld listener queries, disable multicast snooping #11246

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions ic-os/components/networking/nftables/hostos/nftables.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,7 @@ table ip6 filter {
nd-router-advert,
nd-neighbor-solicit,
nd-neighbor-advert,
mld-listener-query,
}

set rate_limit {
Expand Down
4 changes: 3 additions & 1 deletion rs/ic_os/config/tool/templates/ic.json5.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,6 +247,7 @@ table ip6 filter {\n\
nd-router-advert,\n\
nd-neighbor-solicit,\n\
nd-neighbor-advert,\n\
mld-listener-query,\n\
}\n\
\n\
set rate_limit {\n\
Expand Down Expand Up @@ -396,6 +397,7 @@ table ip6 filter {\n\
nd-router-advert,\n\
nd-neighbor-solicit,\n\
nd-neighbor-advert,\n\
mld-listener-query,\n\
}\n\
\n\
set rate_limit {\n\
Expand Down Expand Up @@ -569,7 +571,7 @@ table ip6 filter {\n\
# - The rule allows a maximum of <<MAX_SIMULTANEOUS_CONNECTIONS_PER_IP_ADDRESS>> persistent connections to any ip6 address.\n\
# - The rule drops all new connections that goes over the configured limit.\n\
ct state new add @connection_limit { ip6 saddr ct count over <<MAX_SIMULTANEOUS_CONNECTIONS_PER_IP_ADDRESS>> } counter name connection_limit_v6_counter drop\n\
icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, echo-reply, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept\n\
icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, echo-reply, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, mld-listener-query } accept\n\
ct state { invalid } drop\n\
ct state { established, related } accept\n\
ip6 saddr { {{ ipv6_prefix }} } ct state { new } tcp dport { 7070, 9091, 9100, 9324, 19531, 19100, 19522 } accept\n\
Expand Down
3 changes: 2 additions & 1 deletion rs/ic_os/networking/network/src/systemd.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,8 @@ Kind=bridge

[Bridge]
ForwardDelaySec=0
STP=false";
STP=false
MulticastSnooping=no";

fn generate_bridge6_network_content(
ipv6_address: &str,
Expand Down
1 change: 1 addition & 0 deletions rs/orchestrator/testdata/nftables_assigned_cloud_engine.conf.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ table ip6 filter {
nd-router-advert,
nd-neighbor-solicit,
nd-neighbor-advert,
mld-listener-query,
}

set rate_limit {
Expand Down
1 change: 1 addition & 0 deletions rs/orchestrator/testdata/nftables_assigned_replica.conf.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,7 @@ table ip6 filter {
nd-router-advert,
nd-neighbor-solicit,
nd-neighbor-advert,
mld-listener-query,
}

set rate_limit {
Expand Down
2 changes: 1 addition & 1 deletion rs/orchestrator/testdata/nftables_boundary_node_app_subnet.conf.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ table ip6 filter {
# - The rule allows a maximum of 400 persistent connections to any ip6 address.
# - The rule drops all new connections that goes over the configured limit.
ct state new add @connection_limit { ip6 saddr ct count over 400 } counter name connection_limit_v6_counter drop
icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, echo-reply, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept
icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, echo-reply, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, mld-listener-query } accept
ct state { invalid } drop
ct state { established, related } accept
ip6 saddr { ::/64 } ct state { new } tcp dport { 7070, 9091, 9100, 9324, 19531, 19100, 19522 } accept
Expand Down
2 changes: 1 addition & 1 deletion rs/orchestrator/testdata/nftables_boundary_node_system_subnet.conf.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ table ip6 filter {
# - The rule allows a maximum of 400 persistent connections to any ip6 address.
# - The rule drops all new connections that goes over the configured limit.
ct state new add @connection_limit { ip6 saddr ct count over 400 } counter name connection_limit_v6_counter drop
icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, echo-reply, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept
icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, echo-reply, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, mld-listener-query } accept
ct state { invalid } drop
ct state { established, related } accept
ip6 saddr { ::/64 } ct state { new } tcp dport { 7070, 9091, 9100, 9324, 19531, 19100, 19522 } accept
Expand Down
1 change: 1 addition & 0 deletions rs/orchestrator/testdata/nftables_unassigned_cloud_engine.conf.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,7 @@ table ip6 filter {
nd-router-advert,
nd-neighbor-solicit,
nd-neighbor-advert,
mld-listener-query,
}

set rate_limit {
Expand Down
1 change: 1 addition & 0 deletions rs/orchestrator/testdata/nftables_unassigned_replica.conf.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,7 @@ table ip6 filter {
nd-router-advert,
nd-neighbor-solicit,
nd-neighbor-advert,
mld-listener-query,
}

set rate_limit {
Expand Down
Loading