[PATCH iproute2-next 0/3] bridge: Support mcast_n_groups, mcast_max_groups

[PATCH iproute2-next 0/3] bridge: Support mcast_n_groups, mcast_max_groups

[Petr Machata]

In the Linux kernel commit cb3086cee656 ("Merge branch
'bridge-mdb-limit'"), the bridge driver gained support for limiting number
of MDB entries that a given port or port-VLAN is a member of. Support these
new attributes in iproute2's bridge tool.

After syncing the two relevant headers in patch #1, patch #2 introduces the
meat of the support, and patch #3 the man page coverage.

An example command line session is shown in patch #2.

Petr Machata (3):
  uapi: Update if_bridge, if_link
  bridge: Add support for mcast_n_groups, mcast_max_groups
  man: man8: bridge: Describe mcast_max_groups

 bridge/link.c                  | 21 +++++++++++++++++++++
 bridge/vlan.c                  | 20 ++++++++++++++++++++
 include/uapi/linux/if_bridge.h |  2 ++
 include/uapi/linux/if_link.h   |  5 +++++
 man/man8/bridge.8              | 22 ++++++++++++++++++++++
 5 files changed, 70 insertions(+)

-- 
2.39.0

[PATCH iproute2-next 1/3] uapi: Update if_bridge, if_link

[Petr Machata]

Signed-off-by: Petr Machata <petrm@nvidia.com>
---
 include/uapi/linux/if_bridge.h | 2 ++
 include/uapi/linux/if_link.h   | 5 +++++
 2 files changed, 7 insertions(+)

diff --git a/include/uapi/linux/if_bridge.h b/include/uapi/linux/if_bridge.h
index 4a887cf43774..921b212d9cd0 100644
--- a/include/uapi/linux/if_bridge.h
+++ b/include/uapi/linux/if_bridge.h
@@ -523,6 +523,8 @@ enum {
 	BRIDGE_VLANDB_ENTRY_TUNNEL_INFO,
 	BRIDGE_VLANDB_ENTRY_STATS,
 	BRIDGE_VLANDB_ENTRY_MCAST_ROUTER,
+	BRIDGE_VLANDB_ENTRY_MCAST_N_GROUPS,
+	BRIDGE_VLANDB_ENTRY_MCAST_MAX_GROUPS,
 	__BRIDGE_VLANDB_ENTRY_MAX,
 };
 #define BRIDGE_VLANDB_ENTRY_MAX (__BRIDGE_VLANDB_ENTRY_MAX - 1)
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index 147ad0a39d3b..d61bd32deedb 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -374,6 +374,9 @@ enum {
 
 	IFLA_DEVLINK_PORT,
 
+	IFLA_GSO_IPV4_MAX_SIZE,
+	IFLA_GRO_IPV4_MAX_SIZE,
+
 	__IFLA_MAX
 };
 
@@ -562,6 +565,8 @@ enum {
 	IFLA_BRPORT_MCAST_EHT_HOSTS_CNT,
 	IFLA_BRPORT_LOCKED,
 	IFLA_BRPORT_MAB,
+	IFLA_BRPORT_MCAST_N_GROUPS,
+	IFLA_BRPORT_MCAST_MAX_GROUPS,
 	__IFLA_BRPORT_MAX
 };
 #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)
-- 
2.39.0

[PATCH iproute2-next 2/3] bridge: Add support for mcast_n_groups, mcast_max_groups

[Petr Machata]

A total of four new bridge attributes are being added to the kernel:
mcast_n_groups and mcast_max_groups, as link and vlan attributes. Add
to the bridge tool the support code to enable setting and querying
these attributes. Example usage:

 # ip link add name br up type bridge vlan_filtering 1 mcast_snooping 1 \
                                      mcast_vlan_snooping 1 mcast_querier 1
 # ip link set dev v1 master br
 # bridge vlan add dev v1 vid 2

 # bridge vlan set dev v1 vid 1 mcast_max_groups 1
 # bridge mdb add dev br port v1 grp 230.1.2.3 temp vid 1
 # bridge mdb add dev br port v1 grp 230.1.2.4 temp vid 1
 Error: bridge: Port-VLAN is already in 1 groups, and mcast_max_groups=1.

 # bridge link set dev v1 mcast_max_groups 1
 # bridge mdb add dev br port v1 grp 230.1.2.3 temp vid 2
 Error: bridge: Port is already in 1 groups, and mcast_max_groups=1.

 # bridge -d link show
 5: v1@v2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master br [...]
     [...] mcast_n_groups 1 mcast_max_groups 1

 # bridge -d vlan show
 port              vlan-id
 br                1 PVID Egress Untagged
                     state forwarding mcast_router 1
 v1                1 PVID Egress Untagged
                     [...] mcast_n_groups 1 mcast_max_groups 1
                   2
                     [...] mcast_n_groups 0 mcast_max_groups 0

This is how the JSON dump looks like:

 # bridge -j -d link show dev v1 | jq
 [
   {
     "ifindex": 4,
     "link": "v2",
     "ifname": "v1",
     "flags": [
       "BROADCAST",
       "MULTICAST"
     ],
     "mtu": 1500,
     "master": "br",
     "state": "disabled",
     "priority": 32,
     "cost": 2,
     "hairpin": false,
     "guard": false,
     "root_block": false,
     "fastleave": false,
     "learning": true,
     "flood": true,
     "mcast_flood": true,
     "bcast_flood": true,
     "mcast_router": 1,
     "mcast_to_unicast": false,
     "neigh_suppress": false,
     "vlan_tunnel": false,
     "isolated": false,
     "locked": false,
     "mab": false,
     "mcast_n_groups": 0,
     "mcast_max_groups": 0
   }
 ]

 # bridge -j -d vlan show dev v1 | jq
 [
   {
     "ifname": "v1",
     "vlans": [
       {
         "vlan": 1,
         "flags": [
           "PVID",
           "Egress Untagged"
         ],
         "state": "forwarding",
         "mcast_router": 1,
         "mcast_n_groups": 0,
         "mcast_max_groups": 1
       }
     ]
   }
 ]

Signed-off-by: Petr Machata <petrm@nvidia.com>
---
 bridge/link.c | 21 +++++++++++++++++++++
 bridge/vlan.c | 20 ++++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/bridge/link.c b/bridge/link.c
index 337731dff26b..9dd7475d6e4a 100644
--- a/bridge/link.c
+++ b/bridge/link.c
@@ -187,6 +187,18 @@ static void print_protinfo(FILE *fp, struct rtattr *attr)
 		if (prtb[IFLA_BRPORT_MAB])
 			print_on_off(PRINT_ANY, "mab", "mab %s ",
 				     rta_getattr_u8(prtb[IFLA_BRPORT_MAB]));
+		if (prtb[IFLA_BRPORT_MCAST_N_GROUPS]) {
+			struct rtattr *at = prtb[IFLA_BRPORT_MCAST_N_GROUPS];
+
+			print_uint(PRINT_ANY, "mcast_n_groups",
+				   "mcast_n_groups %u ", rta_getattr_u32(at));
+		}
+		if (prtb[IFLA_BRPORT_MCAST_MAX_GROUPS]) {
+			struct rtattr *at = prtb[IFLA_BRPORT_MCAST_MAX_GROUPS];
+
+			print_uint(PRINT_ANY, "mcast_max_groups",
+				   "mcast_max_groups %u ", rta_getattr_u32(at));
+		}
 	} else
 		print_stp_state(rta_getattr_u8(attr));
 }
@@ -282,6 +294,7 @@ static void usage(void)
 		"                               [ mcast_flood {on | off} ]\n"
 		"                               [ bcast_flood {on | off} ]\n"
 		"                               [ mcast_to_unicast {on | off} ]\n"
+		"                               [ mcast_max_groups MAX_GROUPS ]\n"
 		"                               [ neigh_suppress {on | off} ]\n"
 		"                               [ vlan_tunnel {on | off} ]\n"
 		"                               [ isolated {on | off} ]\n"
@@ -317,6 +330,7 @@ static int brlink_modify(int argc, char **argv)
 	__s8 mcast_flood = -1;
 	__s8 bcast_flood = -1;
 	__s8 mcast_to_unicast = -1;
+	__s32 max_groups = -1;
 	__s8 locked = -1;
 	__s8 macauth = -1;
 	__s8 isolated = -1;
@@ -389,6 +403,10 @@ static int brlink_modify(int argc, char **argv)
 			mcast_to_unicast = parse_on_off("mcast_to_unicast", *argv, &ret);
 			if (ret)
 				return ret;
+		} else if (strcmp(*argv, "mcast_max_groups") == 0) {
+			NEXT_ARG();
+			if (get_s32(&max_groups, *argv, 0))
+				invarg("invalid mcast_max_groups", *argv);
 		} else if (strcmp(*argv, "cost") == 0) {
 			NEXT_ARG();
 			cost = atoi(*argv);
@@ -505,6 +523,9 @@ static int brlink_modify(int argc, char **argv)
 	if (mcast_to_unicast >= 0)
 		addattr8(&req.n, sizeof(req), IFLA_BRPORT_MCAST_TO_UCAST,
 			 mcast_to_unicast);
+	if (max_groups >= 0)
+		addattr32(&req.n, sizeof(req), IFLA_BRPORT_MCAST_MAX_GROUPS,
+			  max_groups);
 	if (learning >= 0)
 		addattr8(&req.n, sizeof(req), IFLA_BRPORT_LEARNING, learning);
 	if (learning_sync >= 0)
diff --git a/bridge/vlan.c b/bridge/vlan.c
index 13df1e845ea5..44e1ba39f01d 100644
--- a/bridge/vlan.c
+++ b/bridge/vlan.c
@@ -37,6 +37,7 @@ static void usage(void)
 		"                                                     [ self ] [ master ]\n"
 		"       bridge vlan { set } vid VLAN_ID dev DEV [ state STP_STATE ]\n"
 		"                                               [ mcast_router MULTICAST_ROUTER ]\n"
+		"                                               [ mcast_max_groups MAX_GROUPS ]\n"
 		"       bridge vlan { show } [ dev DEV ] [ vid VLAN_ID ]\n"
 		"       bridge vlan { tunnelshow } [ dev DEV ] [ vid VLAN_ID ]\n"
 		"       bridge vlan global { set } vid VLAN_ID dev DEV\n"
@@ -344,6 +345,15 @@ static int vlan_option_set(int argc, char **argv)
 			addattr8(&req.n, sizeof(req),
 				 BRIDGE_VLANDB_ENTRY_MCAST_ROUTER,
 				 mcast_router);
+		} else if (strcmp(*argv, "mcast_max_groups") == 0) {
+			__u32 max_groups;
+
+			NEXT_ARG();
+			if (get_u32(&max_groups, *argv, 0))
+				invarg("invalid mcast_max_groups", *argv);
+			addattr32(&req.n, sizeof(req),
+				  BRIDGE_VLANDB_ENTRY_MCAST_MAX_GROUPS,
+				  max_groups);
 		} else {
 			if (matches(*argv, "help") == 0)
 				NEXT_ARG();
@@ -1021,6 +1031,16 @@ static void print_vlan_opts(struct rtattr *a, int ifindex)
 		print_uint(PRINT_ANY, "mcast_router", "mcast_router %u ",
 			   rta_getattr_u8(vattr));
 	}
+	if (vtb[BRIDGE_VLANDB_ENTRY_MCAST_N_GROUPS]) {
+		vattr = vtb[BRIDGE_VLANDB_ENTRY_MCAST_N_GROUPS];
+		print_uint(PRINT_ANY, "mcast_n_groups", "mcast_n_groups %u ",
+			   rta_getattr_u32(vattr));
+	}
+	if (vtb[BRIDGE_VLANDB_ENTRY_MCAST_MAX_GROUPS]) {
+		vattr = vtb[BRIDGE_VLANDB_ENTRY_MCAST_MAX_GROUPS];
+		print_uint(PRINT_ANY, "mcast_max_groups", "mcast_max_groups %u ",
+			   rta_getattr_u32(vattr));
+	}
 	print_nl();
 	if (show_stats)
 		__print_one_vlan_stats(&vstats);
-- 
2.39.0

Re: [PATCH iproute2-next 2/3] bridge: Add support for mcast_n_groups, mcast_max_groups

[Ido Schimmel]

On Mon, Feb 06, 2023 at 06:50:26PM +0100, Petr Machata wrote:
> A total of four new bridge attributes are being added to the kernel:
> mcast_n_groups and mcast_max_groups, as link and vlan attributes. Add
> to the bridge tool the support code to enable setting and querying
> these attributes. Example usage:

[...]

> 
> Signed-off-by: Petr Machata <petrm@nvidia.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

[PATCH iproute2-next 3/3] man: man8: bridge: Describe mcast_max_groups

[Petr Machata]

Add documentation for per-port and port-port-vlan option mcast_max_groups.

Signed-off-by: Petr Machata <petrm@nvidia.com>
---
 man/man8/bridge.8 | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/man/man8/bridge.8 b/man/man8/bridge.8
index f73e538a3536..7075eab283fa 100644
--- a/man/man8/bridge.8
+++ b/man/man8/bridge.8
@@ -47,6 +47,8 @@ bridge \- show / manipulate bridge addresses and devices
 .BR hwmode " { " vepa " | " veb " } ] [ "
 .BR bcast_flood " { " on " | " off " } ] [ "
 .BR mcast_flood " { " on " | " off " } ] [ "
+.BR mcast_max_groups
+.IR MAX_GROUPS " ] ["
 .BR mcast_router
 .IR MULTICAST_ROUTER " ] ["
 .BR mcast_to_unicast " { " on " | " off " } ] [ "
@@ -169,6 +171,8 @@ bridge \- show / manipulate bridge addresses and devices
 .IR VID " [ "
 .B state
 .IR STP_STATE " ] [ "
+.B mcast_max_groups
+.IR MAX_GROUPS " ] [ "
 .B mcast_router
 .IR MULTICAST_ROUTER " ]"
 
@@ -517,6 +521,15 @@ By default this flag is on.
 Controls whether multicast traffic for which there is no MDB entry will be
 flooded towards this given port. By default this flag is on.
 
+.TP
+.BI mcast_max_groups " MAX_GROUPS "
+Sets the maximum number of MDB entries that can be registered for a given
+port. Attempts to register more MDB entries at the port than this limit
+allows will be rejected, whether they are done through netlink (e.g. the
+\fBbridge\fR tool), or IGMP or MLD membership reports. Setting a limit to 0
+has the effect of disabling the limit. See also the \fBip link\fR option
+\fBmcast_hash_max\fR.
+
 .TP
 .BI mcast_router " MULTICAST_ROUTER "
 This flag is almost the same as the per-VLAN flag, see below, except its
@@ -1107,6 +1120,15 @@ is used during the STP election process. In this state, the vlan will only proce
 STP BPDUs.
 .sp
 
+.TP
+.BI mcast_max_groups " MAX_GROUPS "
+Sets the maximum number of MDB entries that can be registered for a given
+VLAN on a given port. A VLAN-specific equivalent of the per-port option of
+the same name, see above for details.
+
+Note that this option is only available when \fBip link\fR option
+\fBmcast_vlan_snooping\fR is enabled.
+
 .TP
 .BI mcast_router " MULTICAST_ROUTER "
 configure this vlan and interface's multicast router mode, note that only modes
-- 
2.39.0

Re: [PATCH iproute2-next 3/3] man: man8: bridge: Describe mcast_max_groups

[Nikolay Aleksandrov]

On 2/6/23 19:50, Petr Machata wrote:
> Add documentation for per-port and port-port-vlan option mcast_max_groups.
> 
> Signed-off-by: Petr Machata <petrm@nvidia.com>
> ---
>   man/man8/bridge.8 | 22 ++++++++++++++++++++++
>   1 file changed, 22 insertions(+)
> 
> diff --git a/man/man8/bridge.8 b/man/man8/bridge.8
> index f73e538a3536..7075eab283fa 100644
> --- a/man/man8/bridge.8
> +++ b/man/man8/bridge.8
> @@ -47,6 +47,8 @@ bridge \- show / manipulate bridge addresses and devices
>   .BR hwmode " { " vepa " | " veb " } ] [ "
>   .BR bcast_flood " { " on " | " off " } ] [ "
>   .BR mcast_flood " { " on " | " off " } ] [ "
> +.BR mcast_max_groups
> +.IR MAX_GROUPS " ] ["
>   .BR mcast_router
>   .IR MULTICAST_ROUTER " ] ["
>   .BR mcast_to_unicast " { " on " | " off " } ] [ "
> @@ -169,6 +171,8 @@ bridge \- show / manipulate bridge addresses and devices
>   .IR VID " [ "
>   .B state
>   .IR STP_STATE " ] [ "
> +.B mcast_max_groups
> +.IR MAX_GROUPS " ] [ "
>   .B mcast_router
>   .IR MULTICAST_ROUTER " ]"
>   
> @@ -517,6 +521,15 @@ By default this flag is on.
>   Controls whether multicast traffic for which there is no MDB entry will be
>   flooded towards this given port. By default this flag is on.
>   
> +.TP
> +.BI mcast_max_groups " MAX_GROUPS "
> +Sets the maximum number of MDB entries that can be registered for a given
> +port. Attempts to register more MDB entries at the port than this limit
> +allows will be rejected, whether they are done through netlink (e.g. the
> +\fBbridge\fR tool), or IGMP or MLD membership reports. Setting a limit to 0
> +has the effect of disabling the limit. See also the \fBip link\fR option
> +\fBmcast_hash_max\fR.
> +

I'd add that the default is 0 (no limit), otherwise looks good to me.

>   .TP
>   .BI mcast_router " MULTICAST_ROUTER "
>   This flag is almost the same as the per-VLAN flag, see below, except its
> @@ -1107,6 +1120,15 @@ is used during the STP election process. In this state, the vlan will only proce
>   STP BPDUs.
>   .sp
>   
> +.TP
> +.BI mcast_max_groups " MAX_GROUPS "
> +Sets the maximum number of MDB entries that can be registered for a given
> +VLAN on a given port. A VLAN-specific equivalent of the per-port option of
> +the same name, see above for details.
> +
> +Note that this option is only available when \fBip link\fR option
> +\fBmcast_vlan_snooping\fR is enabled.
> +
>   .TP
>   .BI mcast_router " MULTICAST_ROUTER "
>   configure this vlan and interface's multicast router mode, note that only modes

Re: [PATCH iproute2-next 3/3] man: man8: bridge: Describe mcast_max_groups

[Petr Machata]

Nikolay Aleksandrov <razor@blackwall.org> writes:

> On 2/6/23 19:50, Petr Machata wrote:
>> Add documentation for per-port and port-port-vlan option mcast_max_groups.
>> Signed-off-by: Petr Machata <petrm@nvidia.com>
>> ---
>>   man/man8/bridge.8 | 22 ++++++++++++++++++++++
>>   1 file changed, 22 insertions(+)
>> diff --git a/man/man8/bridge.8 b/man/man8/bridge.8
>> index f73e538a3536..7075eab283fa 100644
>> --- a/man/man8/bridge.8
>> +++ b/man/man8/bridge.8
>> @@ -47,6 +47,8 @@ bridge \- show / manipulate bridge addresses and devices
>>   .BR hwmode " { " vepa " | " veb " } ] [ "
>>   .BR bcast_flood " { " on " | " off " } ] [ "
>>   .BR mcast_flood " { " on " | " off " } ] [ "
>> +.BR mcast_max_groups
>> +.IR MAX_GROUPS " ] ["
>>   .BR mcast_router
>>   .IR MULTICAST_ROUTER " ] ["
>>   .BR mcast_to_unicast " { " on " | " off " } ] [ "
>> @@ -169,6 +171,8 @@ bridge \- show / manipulate bridge addresses and devices
>>   .IR VID " [ "
>>   .B state
>>   .IR STP_STATE " ] [ "
>> +.B mcast_max_groups
>> +.IR MAX_GROUPS " ] [ "
>>   .B mcast_router
>>   .IR MULTICAST_ROUTER " ]"
>>   @@ -517,6 +521,15 @@ By default this flag is on.
>>   Controls whether multicast traffic for which there is no MDB entry will be
>>   flooded towards this given port. By default this flag is on.
>>   +.TP
>> +.BI mcast_max_groups " MAX_GROUPS "
>> +Sets the maximum number of MDB entries that can be registered for a given
>> +port. Attempts to register more MDB entries at the port than this limit
>> +allows will be rejected, whether they are done through netlink (e.g. the
>> +\fBbridge\fR tool), or IGMP or MLD membership reports. Setting a limit to 0
>> +has the effect of disabling the limit. See also the \fBip link\fR option
>> +\fBmcast_hash_max\fR.
>> +
>
> I'd add that the default is 0 (no limit), otherwise looks good to me.

OK.

Re: [PATCH iproute2-next 3/3] man: man8: bridge: Describe mcast_max_groups

[Ido Schimmel]

On Mon, Feb 06, 2023 at 06:50:27PM +0100, Petr Machata wrote:
> Add documentation for per-port and port-port-vlan option mcast_max_groups.
> 
> Signed-off-by: Petr Machata <petrm@nvidia.com>

With Nik's comment fixed:

Reviewed-by: Ido Schimmel <idosch@nvidia.com>