gluon-mesh-batman-adv-brmldproxy: add package #2995

T-X · 2023-09-23T20:45:21Z

Now that we have general support for routable IPv6 multicast address in Gluon master thanks to the newer Linux (bridge) and batman-adv versions it becomes more interesting to also support layer 3 IPv6 multicast routers.

So far this was also not possible with the default settings in Gluon due to filtering MLD into the mesh. This now adds support for brmldproxy, a daemon which proxies MLD reports between bridge ports.

For the Gluon scenario this package adds brmldproxy proxying configuration for the mesh side bat0 bridge port.

The configuration is tuned in a way to enable the usage of layer 3 IPv6 multicast routers for routable IPv6 multicast address ranges. But with a lot smaller MLD overhead compared to the filter_membership_reports=false site.conf option.

If a node has no multicast listener for a routable IPv6 multicast address then this node will emit no MLD report into the mesh. Furthermore, if a node has multiple multicast listening hosts for routable IPv6 multicast addresses then the node will act in deputy and respond with combined, aggregated MLD reports on behalf.

This package is currently incompatible with a
filter_membership_reports=true site.conf option.

This pull-request requires: freifunk-gluon/packages#264

T-X · 2023-09-23T23:12:14Z

Changelog v2:

added necessary firewall rules for the brmldp0 interface through package/gluon-mesh-batman-adv-brmldproxy/luasrc/lib/gluon/upgrade/400-brmldproxy-firewall (not much, as the tc rules that are set up by brmldproxy are applied before iptables)

T-X · 2023-09-26T17:26:30Z

Changelog v3:

Added a patch / config option to batman-adv to forward MLD reports only to multicast routers instead of always flooding MLD reports, to further reduce overhead.
- That way, when installing this package it makes no difference in overhead, still no MLD reports in the mesh then if no multicast router is present (as I assume no one has installed any multicast routers yet). On the other hand the batman-adv patch should be inactive / make no difference when gluon-mesh-batman-adv-brmldproxy is not installed.

ecsv · 2023-10-24T16:30:23Z

Regarding the batman-adv patch: I think this a patch which could be integrated in upstream when the real world effects are verified/tested in actual setups.

T-X · 2023-11-30T14:20:56Z

As discussed during the Gluon meeting back then it would be great to gather a bit of real world experiences with it.

I've now prepared some packages with all the upcoming batman-adv / Gluon multicast features integrated into Gluon package feeds. So far tested on VMs only, but real hardware tests coming up next. It should be enough to just add it to your site/modules file and update all nodes with it. Should compile+run for Gluon v2021.1.x, Gluon v2023.1 and Gluon master: https://github.com/T-X/gluon-batman-adv-next/

If any community would be interested in testing IPv6 multicast routing between communities (on their own Gluon domains), let me know.

T-X · 2024-02-14T23:39:02Z

With the last firmware update at Freifunk Lübeck the latest gluon-batman-adv-next package feed was rolled out, with brmldproxy integration and the latest batman-adv release (v2024.0). So far we didn't notice any issues/regressions.

Haven't found a second community to test an IPv6 multicast router (pim6sd) on a Gluon based network with, but with using mrdisc (https://github.com/troglobit/mrdisc) on one wifi client I can see the MLD reports for (mostly) routable multicast addresses arriving on the local Gluon node from other nodes in tcpdump. And when stopping mrdisc, I don't see these MLD reports anymore.

So to me seems to work as expected/intended on a real setup.

ecsv · 2024-02-23T16:41:48Z

package/gluon-mesh-batman-adv-brmldproxy/Makefile

+	This package is currently incompatible with a
+	filter_membership_reports=true site.conf option.


docs/package/gluon-mesh-batman-adv-brmldproxy.rst says differently.

will fix this, thanks!

T-X · 2024-02-23T17:22:17Z

Two more notes / observations thanks to @ecsv :

When "filter_membership_reports=true" if we were adding brmldproxy by default, I wanted people to think/check what they actually want: I wanted to avoid that people will see MLD reports over their mesh without expecting it.

Unfortunately, with the current need_value(in_site({'mesh', 'filter_membership_reports'}), true, false) in need_value(in_site({'mesh', 'filter_membership_reports'}), true, false) the error message is actually inverted:

need_value(in_site({'mesh', 'filter_membership_reports'}), true, false)

(Not quite sure how to fix that. Would I need to implement a new need_value() variant?)

When "filter_membership_reports=false" I would interpret this as people wanting MLD reports of all listeners over the mesh. And if brmldproxy were added by default and not unselected via -brmldproxy expclicitly, that brmldproxy would still proxy all these reports, to reduce their overhead.

However I forgot to implement to dynamically generate gluon-mesh-batman-adv-brmldproxy/files/etc/config/brmldproxy then from the Gluon Lua update scripts, with "list excludefilter 'ff02::/ff0f::'" removed in that "filter_membership_reports=false" case. Will fix that.

With "filter_membership_reports" not set in a site.conf I'd assume that people want to have the behaviour which Gluon maintainers would suggest for most cases. Which in my opinion would be, and what is currently implemented, to have brmldproxy installed by default. With MLD reports only forwarded if a client listening to routeable multicast addresses and an IPv6 multicast router is present.

T-X · 2024-03-26T22:03:45Z

Changelog v4:

rebased to current master
added option to also use filter_membership_reports=false
for this removed the static bpfcountd UCI config file and generate it via a Gluon upgrade Lua script instead
for that renamed /lib/gluon/upgrade/400-brmldproxy-firewall to /lib/gluon/upgrade/400-brmldproxy
absence of filter_membership_reports now defaults to "true" for gluon-mesh-batman-adv-brmldproxy
updated Makefile+docs description
moved "batctl multicast_mld_rtr_only 1" call addition from netifd gluon_bat0.sh to a separate hotplug.d script
added patch: "gluon-ebtables: don't filter incoming MLD Reports via ebtables"
added patch: "gluon-mesh-batman-adv-brmldproxy: add to mesh-batman-adv-15 by default"

The bpfcountd concept has now also successfully been tested between Freifunk Lübeck and a domain at Freifunk Vogtland. With pim6sd and bpfcountd multicast audio could be transmitted on one and listened to in the other Gluon site/domain.

neocturne · 2024-04-10T16:39:07Z

package/features

@@ -38,6 +38,7 @@ when(_'web-advanced' and _'autoupdater', {

 when(_'mesh-batman-adv-15', {
 	'gluon-ebtables-limit-arp',
+	'gluon-mesh-batman-adv-brmldproxy',


I don't think the feature should be included by default.

neocturne · 2024-04-10T16:43:04Z

...uon-mesh-batman-adv-brmldproxy/files/etc/hotplug.d/iface/50-gluon-mesh-batman-adv-brmldproxy

+
+[ "$(gluon-show-site | jsonfilter -e "@.mesh.filter_membership_reports")" = "false" ] && exit 0
+
+[ -x /etc/init.d/brmldproxy ] && /etc/init.d/brmldproxy enabled && \


There is no need to check for the executability, gluon-mesh-batman-adv-brmldproxy depends on brmldproxy

There is no need to check for the enabled status (on Gluon, all installed services are always enabled; disabling is not preserved on ugprades, so it is not supported). If disabling should be possible, a /etc/config/gluon flag must be introduced.

neocturne · 2024-04-10T16:44:37Z

...uon-mesh-batman-adv-brmldproxy/files/etc/hotplug.d/iface/50-gluon-mesh-batman-adv-brmldproxy

+
+([ "$INTERFACE" != "bat0" ] || [ "$ACTION" != "ifup" ]) && exit 0
+
+[ "$(gluon-show-site | jsonfilter -e "@.mesh.filter_membership_reports")" = "false" ] && exit 0


Printing the whole site and then filtering it is inefficient. You can copy the lookup_site helper from package/gluon-mesh-batman-adv/files/lib/netifd/proto/gluon_bat0.sh.

neocturne · 2024-04-10T16:45:48Z

package/gluon-ebtables/luasrc/lib/gluon/ebtables/105-mcast-drop-igmp-mld

@@ -13,8 +13,4 @@ if site.mesh.filter_membership_reports(true) then
 	rule('MULTICAST_OUT_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 131 -j DROP') -- MLDv1 Report
 	rule('MULTICAST_OUT_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 132 -j DROP') -- MLDv1 Done
 	rule('MULTICAST_OUT_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 143 -j DROP') -- MLDv2 Report
-
-	rule('MULTICAST_IN_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 131 -j DROP', 'nat') -- MLDv1 Report


Should these be allowed unconditionally, or only when the feature is enabled?

Now that we have general support for routable IPv6 multicast address in Gluon master thanks to the newer Linux (bridge) and batman-adv versions it becomes more interesting to also support layer 3 IPv6 multicast routers. So far this was also not possible with the default settings in Gluon due to filtering MLD into the mesh. This now adds support for brmldproxy, a daemon which proxies MLD reports between bridge ports. For the Gluon scenario this package adds brmldproxy proxying configuration for the mesh side bat0 bridge port. The configuration is tuned in a way to enable the usage of layer 3 IPv6 multicast routers for routable IPv6 multicast address ranges. But with a lot smaller MLD overhead compared to the filter_membership_reports=false site.conf option. If a node has no multicast listener for a routable IPv6 multicast address then this node will emit no MLD report into the mesh. Furthermore, if a node has multiple multicast listening hosts for routable IPv6 multicast addresses then the node will act in deputy and respond with combined, aggregated MLD reports on behalf. Signed-off-by: Linus Lüssing <[email protected]>

So far batman-adv flooded all MLD reports. However in our use-case, with the limitations we already have (*) it is safe to send MLD reports to detected multicast routers only. This reduces MLD report overhead even further than brmldproxy alone already does. And in particular results in no MLD reports in the mesh if no multicast router is present. This should, after some more testing from others, potentially make the gluon-mesh-batman-adv-brmldproxy package suitable for being included by default. As overhead downsides should then be negligible. Note: This change to the MLD report forwarding behaviour is only applied if the gluon-mesh-batman-adv-brmldproxy is installed (and brmldproxy then not manually disabled). Otherwise these changes to batman-adv and batctl are unused. (*): non-Gluon nodes still need to manually set multicast_router=2 on the bat0 bridge port. Signed-off-by: Linus Lüssing <[email protected]>

If there is no multicast router behind a bridge port then the Linux bridge multicast snooping code itself will refrain from forwarding a report, as recommended/required by RFC4541 ("Considerations for Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Snooping Switches). So these rules are in most cases redundant. On the other hand, removing them allows to actually run an IPv6 multicast router behind a Gluon node. Since OpenWrt 23.05 it will allow detecting multicast routers via Multicast Router Discovery (RFC4286). And removing these ebtables rules will allow a layer 3 multicast router to then receive MLD reports from the mesh properly and by that to learn about others listeners in the mesh. These incoming MLD report filtering rules are only removed when gluon-mesh-batman-adv-brmldproxy is installed, to avoid any other functional changes otherwise. Signed-off-by: Linus Lüssing <[email protected]>

T-X · 2024-04-17T00:49:03Z

Changelog v5:

rebased to current master (no conflicts)
removed the patch "gluon-mesh-batman-adv-brmldproxy: add to mesh-batman-adv-15 by default" to not add brmldproxy by default with batman-adv
/etc/hotplug.d/iface/50-gluon-mesh-batman-adv-brmldproxy:
- removed executable/enabled checks on /etc/init.d/brmldproxy, as not required due to dependencies and we don't allow manually disabling it for now
- use Lua JSON filtering/checking instead of piping the full site through the jsonfilter process
only remove incoming MLD report ebtables filters if using brmldproxy, to avoid any functional changes to any setups without brmldproxy

rotanid · 2024-07-28T15:22:38Z

@T-X have you seen the comments by neocturne? these are without answers, at least as far as i can see

github-actions bot added 3. topic: docs Topic: Documentation 3. topic: package Topic: Gluon Packages 3. topic: batman-adv labels Sep 23, 2023

T-X force-pushed the pr-gluon-mesh-batman-adv-brmldproxy branch from f8c26e7 to f1ff246 Compare September 23, 2023 23:08

github-actions bot added the 3. topic: firewall label Sep 23, 2023

ecsv reviewed Feb 23, 2024

View reviewed changes

T-X force-pushed the pr-gluon-mesh-batman-adv-brmldproxy branch from c8d3fcc to 0858812 Compare March 26, 2024 21:50

github-actions bot removed the 3. topic: firewall label Mar 26, 2024

T-X force-pushed the pr-gluon-mesh-batman-adv-brmldproxy branch from 0858812 to cf37b5d Compare March 26, 2024 21:58

neocturne requested changes Apr 10, 2024

View reviewed changes

T-X added 3 commits April 16, 2024 20:38

T-X force-pushed the pr-gluon-mesh-batman-adv-brmldproxy branch from cf37b5d to 3895867 Compare April 17, 2024 00:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

gluon-mesh-batman-adv-brmldproxy: add package #2995

gluon-mesh-batman-adv-brmldproxy: add package #2995

T-X commented Sep 23, 2023

T-X commented Sep 23, 2023

T-X commented Sep 26, 2023

ecsv commented Oct 24, 2023 •

edited

Loading

T-X commented Nov 30, 2023

T-X commented Feb 14, 2024

ecsv Feb 23, 2024

T-X Feb 23, 2024

T-X commented Feb 23, 2024

T-X commented Mar 26, 2024

neocturne Apr 10, 2024

neocturne Apr 10, 2024

neocturne Apr 10, 2024 •

edited

Loading

neocturne Apr 10, 2024

T-X commented Apr 17, 2024

rotanid commented Jul 28, 2024

		This package is currently incompatible with a
		filter_membership_reports=true site.conf option.


		[ "$(gluon-show-site \| jsonfilter -e "@.mesh.filter_membership_reports")" = "false" ] && exit 0

		[ -x /etc/init.d/brmldproxy ] && /etc/init.d/brmldproxy enabled && \


		([ "$INTERFACE" != "bat0" ] \|\| [ "$ACTION" != "ifup" ]) && exit 0

		[ "$(gluon-show-site \| jsonfilter -e "@.mesh.filter_membership_reports")" = "false" ] && exit 0

gluon-mesh-batman-adv-brmldproxy: add package #2995

Are you sure you want to change the base?

gluon-mesh-batman-adv-brmldproxy: add package #2995

Conversation

T-X commented Sep 23, 2023

T-X commented Sep 23, 2023

T-X commented Sep 26, 2023

ecsv commented Oct 24, 2023 • edited Loading

T-X commented Nov 30, 2023

T-X commented Feb 14, 2024

ecsv Feb 23, 2024

Choose a reason for hiding this comment

T-X Feb 23, 2024

Choose a reason for hiding this comment

T-X commented Feb 23, 2024

T-X commented Mar 26, 2024

neocturne Apr 10, 2024

Choose a reason for hiding this comment

neocturne Apr 10, 2024

Choose a reason for hiding this comment

neocturne Apr 10, 2024 • edited Loading

Choose a reason for hiding this comment

neocturne Apr 10, 2024

Choose a reason for hiding this comment

T-X commented Apr 17, 2024

rotanid commented Jul 28, 2024

ecsv commented Oct 24, 2023 •

edited

Loading

neocturne Apr 10, 2024 •

edited

Loading