Add document for IFLA_BRPORT enum so we can use it in Documentation/networking/bridge.rst.
Showing the changes to include/uapi (1 of 1 file). Show all
Unified · Split
| @@ -802,11 +802,252 @@ struct ifla_bridge_id { · 801 unmodified lines | |||
| 802 | __u8 addr[6]; /* ETH_ALEN */ | 802 | __u8 addr[6]; /* ETH_ALEN */ |
| 803 | }; | 803 | }; |
| 804 | 804 | ||
| 805 | /** | ||
| 806 | * DOC: Bridge mode enum definition | ||
| 807 | * | ||
| 808 | * @BRIDGE_MODE_HAIRPIN | ||
| 809 | * Controls whether traffic may be sent back out of the port on which it | ||
| 810 | * was received. This option is also called reflective relay mode, and is | ||
| 811 | * used to support basic VEPA (Virtual Ethernet Port Aggregator) | ||
| 812 | * capabilities. By default, this flag is turned off and the bridge will | ||
| 813 | * not forward traffic back out of the receiving port. | ||
| 814 | */ | ||
| 805 | enum { | 815 | enum { |
| 806 | BRIDGE_MODE_UNSPEC, | 816 | BRIDGE_MODE_UNSPEC, |
| 807 | BRIDGE_MODE_HAIRPIN, | 817 | BRIDGE_MODE_HAIRPIN, |
| 808 | }; | 818 | }; |
| 809 | 819 | ||
| 820 | /** | ||
| 821 | * DOC: Bridge port enum definition | ||
| 822 | * | ||
| 823 | * @IFLA_BRPORT_STATE | ||
| 824 | * The operation state of the port. Here are the valid values. | ||
| 825 | * | ||
| 826 | * * 0 - port is in STP *DISABLED* state. Make this port completely | ||
| 827 | * inactive for STP. This is also called BPDU filter and could be used | ||
| 828 | * to disable STP on an untrusted port, like a leaf virtual device. | ||
| 829 | * The traffic forwarding is also stopped on this port. | ||
| 830 | * * 1 - port is in STP *LISTENING* state. Only valid if STP is enabled | ||
| 831 | * on the bridge. In this state the port listens for STP BPDUs and | ||
| 832 | * drops all other traffic frames. | ||
| 833 | * * 2 - port is in STP *LEARNING* state. Only valid if STP is enabled on | ||
| 834 | * the bridge. In this state the port will accept traffic only for the | ||
| 835 | * purpose of updating MAC address tables. | ||
| 836 | * * 3 - port is in STP *FORWARDING* state. Port is fully active. | ||
| 837 | * * 4 - port is in STP *BLOCKING* state. Only valid if STP is enabled on | ||
| 838 | * the bridge. This state is used during the STP election process. | ||
| 839 | * In this state, port will only process STP BPDUs. | ||
| 840 | * | ||
| 841 | * @IFLA_BRPORT_PRIORITY | ||
| 842 | * The STP port priority. The valid values are between 0 and 255. | ||
| 843 | * | ||
| 844 | * @IFLA_BRPORT_COST | ||
| 845 | * The STP path cost of the port. The valid values are between 1 and 65535. | ||
| 846 | * | ||
| 847 | * @IFLA_BRPORT_MODE | ||
| 848 | * Set the bridge port mode. See *BRIDGE_MODE_HAIRPIN* for more details. | ||
| 849 | * | ||
| 850 | * @IFLA_BRPORT_GUARD | ||
| 851 | * Controls whether STP BPDUs will be processed by the bridge port. By | ||
| 852 | * default, the flag is turned off to allow BPDU processing. Turning this | ||
| 853 | * flag on will disable the bridge port if a STP BPDU packet is received. | ||
| 854 | * | ||
| 855 | * If the bridge has Spanning Tree enabled, hostile devices on the network | ||
| 856 | * may send BPDU on a port and cause network failure. Setting *guard on* | ||
| 857 | * will detect and stop this by disabling the port. The port will be | ||
| 858 | * restarted if the link is brought down, or removed and reattached. | ||
| 859 | * | ||
| 860 | * @IFLA_BRPORT_PROTECT | ||
| 861 | * Controls whether a given port is allowed to become a root port or not. | ||
| 862 | * Only used when STP is enabled on the bridge. By default the flag is off. | ||
| 863 | * | ||
| 864 | * This feature is also called root port guard. If BPDU is received from a | ||
| 865 | * leaf (edge) port, it should not be elected as root port. This could | ||
| 866 | * be used if using STP on a bridge and the downstream bridges are not fully | ||
| 867 | * trusted; this prevents a hostile guest from rerouting traffic. | ||
| 868 | * | ||
| 869 | * @IFLA_BRPORT_FAST_LEAVE | ||
| 870 | * This flag allows the bridge to immediately stop multicast traffic | ||
| 871 | * forwarding on a port that receives an IGMP Leave message. It is only used | ||
| 872 | * when IGMP snooping is enabled on the bridge. By default the flag is off. | ||
| 873 | * | ||
| 874 | * @IFLA_BRPORT_LEARNING | ||
| 875 | * Controls whether a given port will learn *source* MAC addresses from | ||
| 876 | * received traffic or not. Also controls whether dynamic FDB entries | ||
| 877 | * (which can also be added by software) will be refreshed by incoming | ||
| 878 | * traffic. By default this flag is on. | ||
| 879 | * | ||
| 880 | * @IFLA_BRPORT_UNICAST_FLOOD | ||
| 881 | * Controls whether unicast traffic for which there is no FDB entry will | ||
| 882 | * be flooded towards this port. By default this flag is on. | ||
| 883 | * | ||
| 884 | * @IFLA_BRPORT_PROXYARP | ||
| 885 | * Enable proxy ARP on this port. | ||
| 886 | * | ||
| 887 | * @IFLA_BRPORT_LEARNING_SYNC | ||
| 888 | * Controls whether a given port will sync MAC addresses learned on device | ||
| 889 | * port to bridge FDB. | ||
| 890 | * | ||
| 891 | * @IFLA_BRPORT_PROXYARP_WIFI | ||
| 892 | * Enable proxy ARP on this port which meets extended requirements by | ||
| 893 | * IEEE 802.11 and Hotspot 2.0 specifications. | ||
| 894 | * | ||
| 895 | * @IFLA_BRPORT_ROOT_ID | ||
| 896 | * | ||
| 897 | * @IFLA_BRPORT_BRIDGE_ID | ||
| 898 | * | ||
| 899 | * @IFLA_BRPORT_DESIGNATED_PORT | ||
| 900 | * | ||
| 901 | * @IFLA_BRPORT_DESIGNATED_COST | ||
| 902 | * | ||
| 903 | * @IFLA_BRPORT_ID | ||
| 904 | * | ||
| 905 | * @IFLA_BRPORT_NO | ||
| 906 | * | ||
| 907 | * @IFLA_BRPORT_TOPOLOGY_CHANGE_ACK | ||
| 908 | * | ||
| 909 | * @IFLA_BRPORT_CONFIG_PENDING | ||
| 910 | * | ||
| 911 | * @IFLA_BRPORT_MESSAGE_AGE_TIMER | ||
| 912 | * | ||
| 913 | * @IFLA_BRPORT_FORWARD_DELAY_TIMER | ||
| 914 | * | ||
| 915 | * @IFLA_BRPORT_HOLD_TIMER | ||
| 916 | * | ||
| 917 | * @IFLA_BRPORT_FLUSH | ||
| 918 | * Flush bridge ports' fdb dynamic entries. | ||
| 919 | * | ||
| 920 | * @IFLA_BRPORT_MULTICAST_ROUTER | ||
| 921 | * Configure the port's multicast router presence. A port with | ||
| 922 | * a multicast router will receive all multicast traffic. | ||
| 923 | * The valid values are: | ||
| 924 | * | ||
| 925 | * * 0 disable multicast routers on this port | ||
| 926 | * * 1 let the system detect the presence of routers (default) | ||
| 927 | * * 2 permanently enable multicast traffic forwarding on this port | ||
| 928 | * * 3 enable multicast routers temporarily on this port, not depending | ||
| 929 | * on incoming queries. | ||
| 930 | * | ||
| 931 | * @IFLA_BRPORT_PAD | ||
| 932 | * | ||
| 933 | * @IFLA_BRPORT_MCAST_FLOOD | ||
| 934 | * Controls whether a given port will flood multicast traffic for which | ||
| 935 | * there is no MDB entry. By default this flag is on. | ||
| 936 | * | ||
| 937 | * @IFLA_BRPORT_MCAST_TO_UCAST | ||
| 938 | * Controls whether a given port will replicate packets using unicast | ||
| 939 | * instead of multicast. By default this flag is off. | ||
| 940 | * | ||
| 941 | * This is done by copying the packet per host and changing the multicast | ||
| 942 | * destination MAC to a unicast one accordingly. | ||
| 943 | * | ||
| 944 | * *mcast_to_unicast* works on top of the multicast snooping feature of the | ||
| 945 | * bridge. Which means unicast copies are only delivered to hosts which | ||
| 946 | * are interested in unicast and signaled this via IGMP/MLD reports previously. | ||
| 947 | * | ||
| 948 | * This feature is intended for interface types which have a more reliable | ||
| 949 | * and/or efficient way to deliver unicast packets than broadcast ones | ||
| 950 | * (e.g. WiFi). | ||
| 951 | * | ||
| 952 | * However, it should only be enabled on interfaces where no IGMPv2/MLDv1 | ||
| 953 | * report suppression takes place. IGMP/MLD report suppression issue is | ||
| 954 | * usually overcome by the network daemon (supplicant) enabling AP isolation | ||
| 955 | * and by that separating all STAs. | ||
| 956 | * | ||
| 957 | * Delivery of STA-to-STA IP multicast is made possible again by enabling | ||
| 958 | * and utilizing the bridge hairpin mode, which considers the incoming port | ||
| 959 | * as a potential outgoing port, too (see *BRIDGE_MODE_HAIRPIN* option). | ||
| 960 | * Hairpin mode is performed after multicast snooping, therefore leading | ||
| 961 | * to only deliver reports to STAs running a multicast router. | ||
| 962 | * | ||
| 963 | * @IFLA_BRPORT_VLAN_TUNNEL | ||
| 964 | * Controls whether vlan to tunnel mapping is enabled on the port. | ||
| 965 | * By default this flag is off. | ||
| 966 | * | ||
| 967 | * @IFLA_BRPORT_BCAST_FLOOD | ||
| 968 | * Controls flooding of broadcast traffic on the given port. By default | ||
| 969 | * this flag is on. | ||
| 970 | * | ||
| 971 | * @IFLA_BRPORT_GROUP_FWD_MASK | ||
| 972 | * Set the group forward mask. This is a bitmask that is applied to | ||
| 973 | * decide whether to forward incoming frames destined to link-local | ||
| 974 | * addresses. The addresses of the form are 01:80:C2:00:00:0X (defaults | ||
| 975 | * to 0, which means the bridge does not forward any link-local frames | ||
| 976 | * coming on this port). | ||
| 977 | * | ||
| 978 | * @IFLA_BRPORT_NEIGH_SUPPRESS | ||
| 979 | * Controls whether neighbor discovery (arp and nd) proxy and suppression | ||
| 980 | * is enabled on the port. By default this flag is off. | ||
| 981 | * | ||
| 982 | * @IFLA_BRPORT_ISOLATED | ||
| 983 | * Controls whether a given port will be isolated, which means it will be | ||
| 984 | * able to communicate with non-isolated ports only. By default this | ||
| 985 | * flag is off. | ||
| 986 | * | ||
| 987 | * @IFLA_BRPORT_BACKUP_PORT | ||
| 988 | * Set a backup port. If the port loses carrier all traffic will be | ||
| 989 | * redirected to the configured backup port. Set the value to 0 to disable | ||
| 990 | * it. | ||
| 991 | * | ||
| 992 | * @IFLA_BRPORT_MRP_RING_OPEN | ||
| 993 | * | ||
| 994 | * @IFLA_BRPORT_MRP_IN_OPEN | ||
| 995 | * | ||
| 996 | * @IFLA_BRPORT_MCAST_EHT_HOSTS_LIMIT | ||
| 997 | * The number of per-port EHT hosts limit. The default value is 512. | ||
| 998 | * Setting to 0 is not allowed. | ||
| 999 | * | ||
| 1000 | * @IFLA_BRPORT_MCAST_EHT_HOSTS_CNT | ||
| 1001 | * The current number of tracked hosts, read only. | ||
| 1002 | * | ||
| 1003 | * @IFLA_BRPORT_LOCKED | ||
| 1004 | * Controls whether a port will be locked, meaning that hosts behind the | ||
| 1005 | * port will not be able to communicate through the port unless an FDB | ||
| 1006 | * entry with the unit's MAC address is in the FDB. The common use case is | ||
| 1007 | * that hosts are allowed access through authentication with the IEEE 802.1X | ||
| 1008 | * protocol or based on whitelists. By default this flag is off. | ||
| 1009 | * | ||
| 1010 | * Please note that secure 802.1X deployments should always use the | ||
| 1011 | * *BR_BOOLOPT_NO_LL_LEARN* flag, to not permit the bridge to populate its | ||
| 1012 | * FDB based on link-local (EAPOL) traffic received on the port. | ||
| 1013 | * | ||
| 1014 | * @IFLA_BRPORT_MAB | ||
| 1015 | * Controls whether a port will use MAC Authentication Bypass (MAB), a | ||
| 1016 | * technique through which select MAC addresses may be allowed on a locked | ||
| 1017 | * port, without using 802.1X authentication. Packets with an unknown source | ||
| 1018 | * MAC address generates a "locked" FDB entry on the incoming bridge port. | ||
| 1019 | * The common use case is for user space to react to these bridge FDB | ||
| 1020 | * notifications and optionally replace the locked FDB entry with a normal | ||
| 1021 | * one, allowing traffic to pass for whitelisted MAC addresses. | ||
| 1022 | * | ||
| 1023 | * Setting this flag also requires *IFLA_BRPORT_LOCKED* and | ||
| 1024 | * *IFLA_BRPORT_LEARNING*. *IFLA_BRPORT_LOCKED* ensures that unauthorized | ||
| 1025 | * data packets are dropped, and *IFLA_BRPORT_LEARNING* allows the dynamic | ||
| 1026 | * FDB entries installed by user space (as replacements for the locked FDB | ||
| 1027 | * entries) to be refreshed and/or aged out. | ||
| 1028 | * | ||
| 1029 | * @IFLA_BRPORT_MCAST_N_GROUPS | ||
| 1030 | * | ||
| 1031 | * @IFLA_BRPORT_MCAST_MAX_GROUPS | ||
| 1032 | * Sets the maximum number of MDB entries that can be registered for a | ||
| 1033 | * given port. Attempts to register more MDB entries at the port than this | ||
| 1034 | * limit allows will be rejected, whether they are done through netlink | ||
| 1035 | * (e.g. the bridge tool), or IGMP or MLD membership reports. Setting a | ||
| 1036 | * limit of 0 disables the limit. The default value is 0. | ||
| 1037 | * | ||
| 1038 | * @IFLA_BRPORT_NEIGH_VLAN_SUPPRESS | ||
| 1039 | * Controls whether neighbor discovery (arp and nd) proxy and suppression is | ||
| 1040 | * enabled for a given port. By default this flag is off. | ||
| 1041 | * | ||
| 1042 | * Note that this option only takes effect when *IFLA_BRPORT_NEIGH_SUPPRESS* | ||
| 1043 | * is enabled for a given port. | ||
| 1044 | * | ||
| 1045 | * @IFLA_BRPORT_BACKUP_NHID | ||
| 1046 | * The FDB nexthop object ID to attach to packets being redirected to a | ||
| 1047 | * backup port that has VLAN tunnel mapping enabled (via the | ||
| 1048 | * *IFLA_BRPORT_VLAN_TUNNEL* option). Setting a value of 0 (default) has | ||
| 1049 | * the effect of not attaching any ID. | ||
| 1050 | */ | ||
| 810 | enum { | 1051 | enum { |
| 811 | IFLA_BRPORT_UNSPEC, | 1052 | IFLA_BRPORT_UNSPEC, |
| 812 | IFLA_BRPORT_STATE, /* Spanning tree state */ | 1053 | IFLA_BRPORT_STATE, /* Spanning tree state */ |