Add document for IFLA_BRPORT enum so we can use it in Documentation/networking/bridge.rst.
Showing the changes to include/uapi (1 of 1 file). Show all
Unified · Split
| @@ -802,11 +802,252 @@ struct ifla_bridge_id { · 801 unmodified lines | ||
| 802 | 802 | __u8 addr[6]; /* ETH_ALEN */ |
| 803 | 803 | }; |
| 804 | 804 | |
| 805 | +/** | |
| 806 | + * DOC: Bridge mode enum definition | |
| 807 | + * | |
| 808 | + * @BRIDGE_MODE_HAIRPIN | |
| 809 | + * Controls whether traffic may be sent back out of the port on which it | |
| 810 | + * was received. This option is also called reflective relay mode, and is | |
| 811 | + * used to support basic VEPA (Virtual Ethernet Port Aggregator) | |
| 812 | + * capabilities. By default, this flag is turned off and the bridge will | |
| 813 | + * not forward traffic back out of the receiving port. | |
| 814 | + */ | |
| 805 | 815 | enum { |
| 806 | 816 | BRIDGE_MODE_UNSPEC, |
| 807 | 817 | BRIDGE_MODE_HAIRPIN, |
| 808 | 818 | }; |
| 809 | 819 | |
| 820 | +/** | |
| 821 | + * DOC: Bridge port enum definition | |
| 822 | + * | |
| 823 | + * @IFLA_BRPORT_STATE | |
| 824 | + * The operation state of the port. Here are the valid values. | |
| 825 | + * | |
| 826 | + * * 0 - port is in STP *DISABLED* state. Make this port completely | |
| 827 | + * inactive for STP. This is also called BPDU filter and could be used | |
| 828 | + * to disable STP on an untrusted port, like a leaf virtual device. | |
| 829 | + * The traffic forwarding is also stopped on this port. | |
| 830 | + * * 1 - port is in STP *LISTENING* state. Only valid if STP is enabled | |
| 831 | + * on the bridge. In this state the port listens for STP BPDUs and | |
| 832 | + * drops all other traffic frames. | |
| 833 | + * * 2 - port is in STP *LEARNING* state. Only valid if STP is enabled on | |
| 834 | + * the bridge. In this state the port will accept traffic only for the | |
| 835 | + * purpose of updating MAC address tables. | |
| 836 | + * * 3 - port is in STP *FORWARDING* state. Port is fully active. | |
| 837 | + * * 4 - port is in STP *BLOCKING* state. Only valid if STP is enabled on | |
| 838 | + * the bridge. This state is used during the STP election process. | |
| 839 | + * In this state, port will only process STP BPDUs. | |
| 840 | + * | |
| 841 | + * @IFLA_BRPORT_PRIORITY | |
| 842 | + * The STP port priority. The valid values are between 0 and 255. | |
| 843 | + * | |
| 844 | + * @IFLA_BRPORT_COST | |
| 845 | + * The STP path cost of the port. The valid values are between 1 and 65535. | |
| 846 | + * | |
| 847 | + * @IFLA_BRPORT_MODE | |
| 848 | + * Set the bridge port mode. See *BRIDGE_MODE_HAIRPIN* for more details. | |
| 849 | + * | |
| 850 | + * @IFLA_BRPORT_GUARD | |
| 851 | + * Controls whether STP BPDUs will be processed by the bridge port. By | |
| 852 | + * default, the flag is turned off to allow BPDU processing. Turning this | |
| 853 | + * flag on will disable the bridge port if a STP BPDU packet is received. | |
| 854 | + * | |
| 855 | + * If the bridge has Spanning Tree enabled, hostile devices on the network | |
| 856 | + * may send BPDU on a port and cause network failure. Setting *guard on* | |
| 857 | + * will detect and stop this by disabling the port. The port will be | |
| 858 | + * restarted if the link is brought down, or removed and reattached. | |
| 859 | + * | |
| 860 | + * @IFLA_BRPORT_PROTECT | |
| 861 | + * Controls whether a given port is allowed to become a root port or not. | |
| 862 | + * Only used when STP is enabled on the bridge. By default the flag is off. | |
| 863 | + * | |
| 864 | + * This feature is also called root port guard. If BPDU is received from a | |
| 865 | + * leaf (edge) port, it should not be elected as root port. This could | |
| 866 | + * be used if using STP on a bridge and the downstream bridges are not fully | |
| 867 | + * trusted; this prevents a hostile guest from rerouting traffic. | |
| 868 | + * | |
| 869 | + * @IFLA_BRPORT_FAST_LEAVE | |
| 870 | + * This flag allows the bridge to immediately stop multicast traffic | |
| 871 | + * forwarding on a port that receives an IGMP Leave message. It is only used | |
| 872 | + * when IGMP snooping is enabled on the bridge. By default the flag is off. | |
| 873 | + * | |
| 874 | + * @IFLA_BRPORT_LEARNING | |
| 875 | + * Controls whether a given port will learn *source* MAC addresses from | |
| 876 | + * received traffic or not. Also controls whether dynamic FDB entries | |
| 877 | + * (which can also be added by software) will be refreshed by incoming | |
| 878 | + * traffic. By default this flag is on. | |
| 879 | + * | |
| 880 | + * @IFLA_BRPORT_UNICAST_FLOOD | |
| 881 | + * Controls whether unicast traffic for which there is no FDB entry will | |
| 882 | + * be flooded towards this port. By default this flag is on. | |
| 883 | + * | |
| 884 | + * @IFLA_BRPORT_PROXYARP | |
| 885 | + * Enable proxy ARP on this port. | |
| 886 | + * | |
| 887 | + * @IFLA_BRPORT_LEARNING_SYNC | |
| 888 | + * Controls whether a given port will sync MAC addresses learned on device | |
| 889 | + * port to bridge FDB. | |
| 890 | + * | |
| 891 | + * @IFLA_BRPORT_PROXYARP_WIFI | |
| 892 | + * Enable proxy ARP on this port which meets extended requirements by | |
| 893 | + * IEEE 802.11 and Hotspot 2.0 specifications. | |
| 894 | + * | |
| 895 | + * @IFLA_BRPORT_ROOT_ID | |
| 896 | + * | |
| 897 | + * @IFLA_BRPORT_BRIDGE_ID | |
| 898 | + * | |
| 899 | + * @IFLA_BRPORT_DESIGNATED_PORT | |
| 900 | + * | |
| 901 | + * @IFLA_BRPORT_DESIGNATED_COST | |
| 902 | + * | |
| 903 | + * @IFLA_BRPORT_ID | |
| 904 | + * | |
| 905 | + * @IFLA_BRPORT_NO | |
| 906 | + * | |
| 907 | + * @IFLA_BRPORT_TOPOLOGY_CHANGE_ACK | |
| 908 | + * | |
| 909 | + * @IFLA_BRPORT_CONFIG_PENDING | |
| 910 | + * | |
| 911 | + * @IFLA_BRPORT_MESSAGE_AGE_TIMER | |
| 912 | + * | |
| 913 | + * @IFLA_BRPORT_FORWARD_DELAY_TIMER | |
| 914 | + * | |
| 915 | + * @IFLA_BRPORT_HOLD_TIMER | |
| 916 | + * | |
| 917 | + * @IFLA_BRPORT_FLUSH | |
| 918 | + * Flush bridge ports' fdb dynamic entries. | |
| 919 | + * | |
| 920 | + * @IFLA_BRPORT_MULTICAST_ROUTER | |
| 921 | + * Configure the port's multicast router presence. A port with | |
| 922 | + * a multicast router will receive all multicast traffic. | |
| 923 | + * The valid values are: | |
| 924 | + * | |
| 925 | + * * 0 disable multicast routers on this port | |
| 926 | + * * 1 let the system detect the presence of routers (default) | |
| 927 | + * * 2 permanently enable multicast traffic forwarding on this port | |
| 928 | + * * 3 enable multicast routers temporarily on this port, not depending | |
| 929 | + * on incoming queries. | |
| 930 | + * | |
| 931 | + * @IFLA_BRPORT_PAD | |
| 932 | + * | |
| 933 | + * @IFLA_BRPORT_MCAST_FLOOD | |
| 934 | + * Controls whether a given port will flood multicast traffic for which | |
| 935 | + * there is no MDB entry. By default this flag is on. | |
| 936 | + * | |
| 937 | + * @IFLA_BRPORT_MCAST_TO_UCAST | |
| 938 | + * Controls whether a given port will replicate packets using unicast | |
| 939 | + * instead of multicast. By default this flag is off. | |
| 940 | + * | |
| 941 | + * This is done by copying the packet per host and changing the multicast | |
| 942 | + * destination MAC to a unicast one accordingly. | |
| 943 | + * | |
| 944 | + * *mcast_to_unicast* works on top of the multicast snooping feature of the | |
| 945 | + * bridge. Which means unicast copies are only delivered to hosts which | |
| 946 | + * are interested in unicast and signaled this via IGMP/MLD reports previously. | |
| 947 | + * | |
| 948 | + * This feature is intended for interface types which have a more reliable | |
| 949 | + * and/or efficient way to deliver unicast packets than broadcast ones | |
| 950 | + * (e.g. WiFi). | |
| 951 | + * | |
| 952 | + * However, it should only be enabled on interfaces where no IGMPv2/MLDv1 | |
| 953 | + * report suppression takes place. IGMP/MLD report suppression issue is | |
| 954 | + * usually overcome by the network daemon (supplicant) enabling AP isolation | |
| 955 | + * and by that separating all STAs. | |
| 956 | + * | |
| 957 | + * Delivery of STA-to-STA IP multicast is made possible again by enabling | |
| 958 | + * and utilizing the bridge hairpin mode, which considers the incoming port | |
| 959 | + * as a potential outgoing port, too (see *BRIDGE_MODE_HAIRPIN* option). | |
| 960 | + * Hairpin mode is performed after multicast snooping, therefore leading | |
| 961 | + * to only deliver reports to STAs running a multicast router. | |
| 962 | + * | |
| 963 | + * @IFLA_BRPORT_VLAN_TUNNEL | |
| 964 | + * Controls whether vlan to tunnel mapping is enabled on the port. | |
| 965 | + * By default this flag is off. | |
| 966 | + * | |
| 967 | + * @IFLA_BRPORT_BCAST_FLOOD | |
| 968 | + * Controls flooding of broadcast traffic on the given port. By default | |
| 969 | + * this flag is on. | |
| 970 | + * | |
| 971 | + * @IFLA_BRPORT_GROUP_FWD_MASK | |
| 972 | + * Set the group forward mask. This is a bitmask that is applied to | |
| 973 | + * decide whether to forward incoming frames destined to link-local | |
| 974 | + * addresses. The addresses of the form are 01:80:C2:00:00:0X (defaults | |
| 975 | + * to 0, which means the bridge does not forward any link-local frames | |
| 976 | + * coming on this port). | |
| 977 | + * | |
| 978 | + * @IFLA_BRPORT_NEIGH_SUPPRESS | |
| 979 | + * Controls whether neighbor discovery (arp and nd) proxy and suppression | |
| 980 | + * is enabled on the port. By default this flag is off. | |
| 981 | + * | |
| 982 | + * @IFLA_BRPORT_ISOLATED | |
| 983 | + * Controls whether a given port will be isolated, which means it will be | |
| 984 | + * able to communicate with non-isolated ports only. By default this | |
| 985 | + * flag is off. | |
| 986 | + * | |
| 987 | + * @IFLA_BRPORT_BACKUP_PORT | |
| 988 | + * Set a backup port. If the port loses carrier all traffic will be | |
| 989 | + * redirected to the configured backup port. Set the value to 0 to disable | |
| 990 | + * it. | |
| 991 | + * | |
| 992 | + * @IFLA_BRPORT_MRP_RING_OPEN | |
| 993 | + * | |
| 994 | + * @IFLA_BRPORT_MRP_IN_OPEN | |
| 995 | + * | |
| 996 | + * @IFLA_BRPORT_MCAST_EHT_HOSTS_LIMIT | |
| 997 | + * The number of per-port EHT hosts limit. The default value is 512. | |
| 998 | + * Setting to 0 is not allowed. | |
| 999 | + * | |
| 1000 | + * @IFLA_BRPORT_MCAST_EHT_HOSTS_CNT | |
| 1001 | + * The current number of tracked hosts, read only. | |
| 1002 | + * | |
| 1003 | + * @IFLA_BRPORT_LOCKED | |
| 1004 | + * Controls whether a port will be locked, meaning that hosts behind the | |
| 1005 | + * port will not be able to communicate through the port unless an FDB | |
| 1006 | + * entry with the unit's MAC address is in the FDB. The common use case is | |
| 1007 | + * that hosts are allowed access through authentication with the IEEE 802.1X | |
| 1008 | + * protocol or based on whitelists. By default this flag is off. | |
| 1009 | + * | |
| 1010 | + * Please note that secure 802.1X deployments should always use the | |
| 1011 | + * *BR_BOOLOPT_NO_LL_LEARN* flag, to not permit the bridge to populate its | |
| 1012 | + * FDB based on link-local (EAPOL) traffic received on the port. | |
| 1013 | + * | |
| 1014 | + * @IFLA_BRPORT_MAB | |
| 1015 | + * Controls whether a port will use MAC Authentication Bypass (MAB), a | |
| 1016 | + * technique through which select MAC addresses may be allowed on a locked | |
| 1017 | + * port, without using 802.1X authentication. Packets with an unknown source | |
| 1018 | + * MAC address generates a "locked" FDB entry on the incoming bridge port. | |
| 1019 | + * The common use case is for user space to react to these bridge FDB | |
| 1020 | + * notifications and optionally replace the locked FDB entry with a normal | |
| 1021 | + * one, allowing traffic to pass for whitelisted MAC addresses. | |
| 1022 | + * | |
| 1023 | + * Setting this flag also requires *IFLA_BRPORT_LOCKED* and | |
| 1024 | + * *IFLA_BRPORT_LEARNING*. *IFLA_BRPORT_LOCKED* ensures that unauthorized | |
| 1025 | + * data packets are dropped, and *IFLA_BRPORT_LEARNING* allows the dynamic | |
| 1026 | + * FDB entries installed by user space (as replacements for the locked FDB | |
| 1027 | + * entries) to be refreshed and/or aged out. | |
| 1028 | + * | |
| 1029 | + * @IFLA_BRPORT_MCAST_N_GROUPS | |
| 1030 | + * | |
| 1031 | + * @IFLA_BRPORT_MCAST_MAX_GROUPS | |
| 1032 | + * Sets the maximum number of MDB entries that can be registered for a | |
| 1033 | + * given port. Attempts to register more MDB entries at the port than this | |
| 1034 | + * limit allows will be rejected, whether they are done through netlink | |
| 1035 | + * (e.g. the bridge tool), or IGMP or MLD membership reports. Setting a | |
| 1036 | + * limit of 0 disables the limit. The default value is 0. | |
| 1037 | + * | |
| 1038 | + * @IFLA_BRPORT_NEIGH_VLAN_SUPPRESS | |
| 1039 | + * Controls whether neighbor discovery (arp and nd) proxy and suppression is | |
| 1040 | + * enabled for a given port. By default this flag is off. | |
| 1041 | + * | |
| 1042 | + * Note that this option only takes effect when *IFLA_BRPORT_NEIGH_SUPPRESS* | |
| 1043 | + * is enabled for a given port. | |
| 1044 | + * | |
| 1045 | + * @IFLA_BRPORT_BACKUP_NHID | |
| 1046 | + * The FDB nexthop object ID to attach to packets being redirected to a | |
| 1047 | + * backup port that has VLAN tunnel mapping enabled (via the | |
| 1048 | + * *IFLA_BRPORT_VLAN_TUNNEL* option). Setting a value of 0 (default) has | |
| 1049 | + * the effect of not attaching any ID. | |
| 1050 | + */ | |
| 810 | 1051 | enum { |
| 811 | 1052 | IFLA_BRPORT_UNSPEC, |
| 812 | 1053 | IFLA_BRPORT_STATE, /* Spanning tree state */ |