[multicast] check inner TTL on decap

dpd-client/tests/integration_tests/common.rs

@@ -690,10 +690,19 @@ impl Switch {
     }
 
     pub fn packet_test(
+        &self,
+        send: Vec<TestPacket>,
+        expect: Vec<TestPacket>,
+    ) -> TestResult {
+        self.packet_test_matched(send, expect)?;
+        Ok(())
+    }
+
+    pub fn packet_test_matched(
         &self,
         mut send: Vec<TestPacket>,
         mut expect: Vec<TestPacket>,
-    ) -> TestResult {
+    ) -> anyhow::Result<Vec<TestPacket>> {
         // NOTE: This timeout is critical.
         //
         // The tests are normally run against the Tofino simulator, a software
@@ -755,11 +764,12 @@ impl Switch {
         }
 
         // We should also see the packets we expected to see
+        let mut matched = Vec::with_capacity(expect.len());
         for (e, expected) in expect.iter().enumerate() {
             for (g, got) in captured.iter().enumerate() {
                 if expected == got {
                     found.push(e);
-                    captured.remove(g);
+                    matched.push(captured.remove(g));
                     break;
                 }
             }
@@ -802,7 +812,7 @@ impl Switch {
         if !errors.is_empty() {
             bail!("{}", errors.join(", "));
         }
-        Ok(())
+        Ok(matched)
     }
 
     /// If no client_name is given, this returns the number of packets dropped

dpd-client/tests/integration_tests/counters.rs

@@ -18,9 +18,11 @@ use crate::integration_tests::common;
 use crate::integration_tests::common::prelude::*;
 use crate::integration_tests::icmp_ipv4;
 use ::common::network::MacAddr;
+use ::common::network::Vni;
 use dpd_client::ClientInfo;
 use dpd_client::types::Ipv4Entry;
 use dpd_client::types::Ipv6Entry;
+use dpd_client::types::NatTarget;
 
 // Run a single drop test.  This sends a packet that we expect to be dropped,
 // and verifies that the expected drop counter is bumped by one.  If the test
@@ -181,6 +183,42 @@ async fn test_ipv4_ttl_invalid() -> TestResult {
     test_ipv4_ttl_test(0, "ipv4_ttl_invalid").await
 }
 
+#[tokio::test]
+#[ignore]
+async fn test_ipv4_ttl_invalid_nat_ingress() -> TestResult {
+    let switch = &*get_switch().await;
+    let ingress = PhysPort(14);
+    let nat_ip = "192.168.1.2";
+    let nat_port = 2000;
+
+    let tgt = NatTarget {
+        internal_ip: "fd00:1122:7788:0101::4".parse().unwrap(),
+        inner_mac: "04:01:01:01:01:01".parse::<MacAddr>()?.into(),
+        vni: Vni::new(7654).unwrap().into(),
+    };
+    switch
+        .client
+        .nat_ipv4_create(&nat_ip.parse().unwrap(), 1024, 2048, &tgt)
+        .await
+        .unwrap();
+
+    let mut packet = common::gen_udp_packet(
+        Endpoint::parse("02:aa:bb:cc:dd:ee", "10.10.10.32", 4444).unwrap(),
+        Endpoint::parse(
+            &switch.get_port_mac(ingress).unwrap().to_string(),
+            nat_ip,
+            nat_port,
+        )
+        .unwrap(),
+    );
+    packet.hdrs.ipv4_hdr.as_mut().unwrap().ipv4_ttl = 0;
+    packet::ipv4::Ipv4Hdr::update_checksum(&mut packet);
+
+    assert!(one_drop_test(switch, ingress, packet, "ipv4_ttl_invalid").await?);
+
+    Ok(())
+}
+
 /// Set a port to accept only inbound traffic with a corresponding NAT mapping.
 /// Send in a packet that has no corresponding NAT entry, and check the
 /// nat_ingress_miss counter.