In a VLAN filtering bridge setup we want to be able to support an
external IGMP/MLD querier running from userspace, because the bridge
multicast code can only generate proxy/NULL querys per VLAN.
This patch is a refactor to allow just that. If a VLAN on the bridge
has an upper interface, matching the bridge name and VID, we generate
a profile for querierd and enable the service.
For all other cases we try to disable any running querierd. It is up
to the daemon to figure out if it has a usable IP address to use as
the query source IP or use 0.0.0.0.
Since the logic for selecting a proper IP address must be handled by
the daemon in the per-VLAN setup, we revert back to also use it for
the stand-alone unfiltered bridge case as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since Infix supports per-VLAN querier parameters, like query interval,
we currently need to run a separate querierd per VLAN interface. The
replacement, mcd, will handle this automatically in its .conf file.
Also, ensure we install the daemon configuration file as an example, and
thus creating the /etc/querierd/ directory for where .conf files for
each interface will be generated.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
An RFC conforming multicast snooping bridge should forward all unknown
multicast (IP & MAC) on ports where the mcast_flood flag is set. The
upstream kernel does not (yet) support this, but the KernelKit branch
of the kernel and iproute2 now support it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a forward-port of one of my bridge patches to handle RFC4541
style flooding of unknown multicast.
https://lore.kernel.org/netdev/20220411133837.318876-9-troglobit@gmail.com/
Changes since this thread: use inferred mctx (VLAN multicast context)
from br_handle_frame_finish() and br_dev_xmit(), which should fix the
per-VLAN multicast handling issue pointed out by Nikolay.
Todo before next patch series, add new option instead of breaking the
existing functionality for the current mcast_flood flag. E.g., add a
mcast_flood_always, since the current flag stops flooding when there is
a known querier on the LAN.
See the above thread for details.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A bridge port cannot communicate on layer-3 while acting as a bridge
port. Removing the port from the bridge re-enables the link-local
addresses, if any, from the configuration.
Fix#327
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Note, no VLAN id, or other VLAN specific information is contained in the
MDB entries, only forwarding information and per-port state.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With VLAN filtering on a bridge we cannot use the mcast_query_use_ifaddr
mechanism. This because even if the bridge may have an address it is
likely not on the same subnet as that of the VLAN, and the multicast
code in the kernel does not look at VLAN interfaecs on top of bridge
for a relevant adddress.
For these cases we have to use querierd, or a multicast router.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
in container: default-route-advertise
Obsolete leaf: enable
Add new leaf: enabled
enable is preferred if exist, else it use enabled.
Also update klish-plugin-sysrepo to not show the obsoleted node
in autocompletion.
This fixes#331
This reverts commit f5e37bba58 because it
causes a regression in setting up VLAN filtering bridges. The bridge
itself, e.g., br0 currently does not have a bridge-port context at the
same time as it being bridge. The model does not account for that and
thus srx_get_int() for the br0 PVID will always fail.
Reverting this commit allows br0 to be tagged member in all VLANs by
default, for now.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The srx_*() family of APIs are for some callbacks in confd used to check
if a setting exists or not. The root helper function srx_vaget() always
logged an error if sr_get_items() failed. This has now been fixed and
only the srx_enabled() function still triggers this, because it has no
way of determining an error condition -- otoh it should never fail.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the changes in 9847a8f we can keep the /etc/motd file with a proper
newline at EOF so that also Classic builds make sense.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Inspired by openconfig-system[1], except the infix-system type is binary
to allow encoding an entire file, with optional control characters.
The openconfig-system model also carries login-banner, which is displayed
before login. This could be added later to infix-system to let the user
set an OpenSSH login Banner.
[1]: https://openconfig.net/projects/models/schemadocs/yangdoc/openconfig-system.html
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This reverts commit 2bcb02d3ef and thus
reeneables classic builds again. Since we build on /mnt on the runner
there should be enough room also for them.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Calling strlen() returns a size that's one byte less than what's needed
to store the string, so when comparing with sizeof(), which returns the
number of available bytes, we must compare >= and not just >.
Found by GCC using 'make check'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
