gluon-mesh-batman-adv-brmldproxy: add package #2995

T-X · 2023-09-23T20:45:21Z

Now that we have general support for routable IPv6 multicast address in Gluon main thanks to the newer Linux (bridge) and batman-adv versions it becomes more interesting to also support layer 3 IPv6 multicast routers.

So far this was also not possible with the default settings in Gluon due to filtering MLD into the mesh. This now adds support for brmldproxy, a daemon which proxies MLD reports between bridge ports.

For the Gluon scenario this package adds brmldproxy proxying configuration for the mesh side bat0 bridge port.

The configuration is tuned in a way to enable the usage of layer 3 IPv6 multicast routers for routable IPv6 multicast address ranges. But with a lot smaller MLD overhead compared to the filter_membership_reports=false site.conf option.

If a node has no multicast listener for a routable IPv6 multicast address then this node will emit no MLD report into the mesh. Furthermore, if a node has multiple multicast listening hosts for routable IPv6 multicast addresses then the node will act in deputy and respond with combined, aggregated MLD reports on behalf.

This package is currently incompatible with a
filter_membership_reports=true site.conf option.

This pull-request requires: freifunk-gluon/packages#264

T-X · 2023-09-23T23:12:14Z

Changelog v2:

added necessary firewall rules for the brmldp0 interface through package/gluon-mesh-batman-adv-brmldproxy/luasrc/lib/gluon/upgrade/400-brmldproxy-firewall (not much, as the tc rules that are set up by brmldproxy are applied before iptables)

T-X · 2023-09-26T17:26:30Z

Changelog v3:

Added a patch / config option to batman-adv to forward MLD reports only to multicast routers instead of always flooding MLD reports, to further reduce overhead.
- That way, when installing this package it makes no difference in overhead, still no MLD reports in the mesh then if no multicast router is present (as I assume no one has installed any multicast routers yet). On the other hand the batman-adv patch should be inactive / make no difference when gluon-mesh-batman-adv-brmldproxy is not installed.

ecsv · 2023-10-24T16:30:23Z

Regarding the batman-adv patch: I think this a patch which could be integrated in upstream when the real world effects are verified/tested in actual setups.

T-X · 2023-11-30T14:20:56Z

As discussed during the Gluon meeting back then it would be great to gather a bit of real world experiences with it.

I've now prepared some packages with all the upcoming batman-adv / Gluon multicast features integrated into Gluon package feeds. So far tested on VMs only, but real hardware tests coming up next. It should be enough to just add it to your site/modules file and update all nodes with it. Should compile+run for Gluon v2021.1.x, Gluon v2023.1 and Gluon master: https://github.com/T-X/gluon-batman-adv-next/

If any community would be interested in testing IPv6 multicast routing between communities (on their own Gluon domains), let me know.

T-X · 2024-02-14T23:39:02Z

With the last firmware update at Freifunk Lübeck the latest gluon-batman-adv-next package feed was rolled out, with brmldproxy integration and the latest batman-adv release (v2024.0). So far we didn't notice any issues/regressions.

Haven't found a second community to test an IPv6 multicast router (pim6sd) on a Gluon based network with, but with using mrdisc (https://github.com/troglobit/mrdisc) on one wifi client I can see the MLD reports for (mostly) routable multicast addresses arriving on the local Gluon node from other nodes in tcpdump. And when stopping mrdisc, I don't see these MLD reports anymore.

So to me seems to work as expected/intended on a real setup.

package/gluon-mesh-batman-adv-brmldproxy/Makefile

T-X · 2024-02-23T17:22:17Z

Two more notes / observations thanks to @ecsv :

When "filter_membership_reports=true" if we were adding brmldproxy by default, I wanted people to think/check what they actually want: I wanted to avoid that people will see MLD reports over their mesh without expecting it.

Unfortunately, with the current need_value(in_site({'mesh', 'filter_membership_reports'}), true, false) in need_value(in_site({'mesh', 'filter_membership_reports'}), true, false) the error message is actually inverted:

need_value(in_site({'mesh', 'filter_membership_reports'}), true, false)

(Not quite sure how to fix that. Would I need to implement a new need_value() variant?)

When "filter_membership_reports=false" I would interpret this as people wanting MLD reports of all listeners over the mesh. And if brmldproxy were added by default and not unselected via -brmldproxy expclicitly, that brmldproxy would still proxy all these reports, to reduce their overhead.

However I forgot to implement to dynamically generate gluon-mesh-batman-adv-brmldproxy/files/etc/config/brmldproxy then from the Gluon Lua update scripts, with "list excludefilter 'ff02::/ff0f::'" removed in that "filter_membership_reports=false" case. Will fix that.

With "filter_membership_reports" not set in a site.conf I'd assume that people want to have the behaviour which Gluon maintainers would suggest for most cases. Which in my opinion would be, and what is currently implemented, to have brmldproxy installed by default. With MLD reports only forwarded if a client listening to routeable multicast addresses and an IPv6 multicast router is present.

T-X · 2024-03-26T22:03:45Z

Changelog v4:

rebased to current master
added option to also use filter_membership_reports=false
for this removed the static bpfcountd UCI config file and generate it via a Gluon upgrade Lua script instead
for that renamed /lib/gluon/upgrade/400-brmldproxy-firewall to /lib/gluon/upgrade/400-brmldproxy
absence of filter_membership_reports now defaults to "true" for gluon-mesh-batman-adv-brmldproxy
updated Makefile+docs description
moved "batctl multicast_mld_rtr_only 1" call addition from netifd gluon_bat0.sh to a separate hotplug.d script
added patch: "gluon-ebtables: don't filter incoming MLD Reports via ebtables"
added patch: "gluon-mesh-batman-adv-brmldproxy: add to mesh-batman-adv-15 by default"

The bpfcountd concept has now also successfully been tested between Freifunk Lübeck and a domain at Freifunk Vogtland. With pim6sd and bpfcountd multicast audio could be transmitted on one and listened to in the other Gluon site/domain.

package/features

...uon-mesh-batman-adv-brmldproxy/files/etc/hotplug.d/iface/50-gluon-mesh-batman-adv-brmldproxy

package/gluon-ebtables/luasrc/lib/gluon/ebtables/105-mcast-drop-igmp-mld

T-X · 2024-04-17T00:49:03Z

Changelog v5:

rebased to current master (no conflicts)
removed the patch "gluon-mesh-batman-adv-brmldproxy: add to mesh-batman-adv-15 by default" to not add brmldproxy by default with batman-adv
/etc/hotplug.d/iface/50-gluon-mesh-batman-adv-brmldproxy:
- removed executable/enabled checks on /etc/init.d/brmldproxy, as not required due to dependencies and we don't allow manually disabling it for now
- use Lua JSON filtering/checking instead of piping the full site through the jsonfilter process
only remove incoming MLD report ebtables filters if using brmldproxy, to avoid any functional changes to any setups without brmldproxy

rotanid · 2024-07-28T15:22:38Z

@T-X have you seen the comments by neocturne? these are without answers, at least as far as i can see

T-X · 2024-12-16T08:29:49Z

Changelog v6:

rebased to current main branch (no conflicts)
replaced the batman-adv mld-rtr-only configuration option with additional tc-DNAT'ing for now, to be able to use brmldproxy with low MLD report overhead even without any changes to batman-adv
- note: we have to temporarily change the ICMPv6 type from MLD report to something else, here "100 - Private experimentation", to avoid that batman-adv always floods it
simplified the "don't filter incoming MLD Reports" patch by moving the change from gluon-ebtables to gluon-mesh-batman-adv-brmldproxy
- these two changes allow to use gluon-mesh-batman-adv-brmldproxy with both a vanilla Gluon and vanilla batman-adv now, making it suitable for any external feed as is
replaced ( [ ... ] || [ ... ] ) && ... in gluon-mesh-batman-adv-brmldproxy with { [ ... ] || [ ...]; } && ... to avoid a sub-shell invocation, to make the linter happy

T-X · 2024-12-16T08:31:22Z

@rotanid thanks for the comment, but I think all of @neocturne 's previous remarks were addressed in v5 already

...uon-mesh-batman-adv-brmldproxy/files/etc/hotplug.d/iface/51-gluon-mesh-batman-adv-brmldproxy

package/gluon-mesh-batman-adv-brmldproxy/files/usr/sbin/gluon-brmldproxy-router-check

T-X · 2025-01-06T09:18:21Z

Changelog v7:

rebased to current Gluon main (no changes)
51-gluon-mesh-batman-adv-brmldproxy hotplug script:
- added "set -e"
- replaced "{ [ ... ] } && exit 0" patterns with if/else oneliners
- added helper functions for tc calls to avoid repetitions
gluon-brmldproxy-router-check:
- calculated a Gluon multicast router multicast address from domain seed and used a unicast prefix based multicast address
- added a small comment for the RFC origin of its format
to ease overall configuration added a patch to auto-enable a mesh-side MLD querier (candidate) if that node's client port features a multicast router

Could not use JSON for the "batctl mcast_flags" check though as the own flags in the reader are not printed in batctl's JSON mode output.

T-X · 2025-01-06T12:33:32Z

Changelog v8:

make linter happy about missing quotes

T-X · 2025-01-09T17:22:14Z

Changelog v9:

use/check the JSON output from "batctl mj" instead of regex'ing from "batctl mcast_flags" output (wasn't aware until a minute ago that the former existed and outputs the own batman-adv multicast flags in JSON format :D)
- this should now have addressed all of @neocturne's previous remarks and suggestions

This is a copy of #2995 for the main Gluon repository: -> freifunk-gluon/gluon#2995

rotanid · 2025-03-11T00:20:54Z

currently, further development happens over at freifunk-gluon/community-packages#151 because more people can help with shellcheck issues.
at a later point, it might be possible to copy it to here, but currently it is NOT 100% the same thing unlike claimed.

This is a copy of #2995 for the main Gluon repository: -> freifunk-gluon/gluon#2995

Now that we have general support for routable IPv6 multicast address in Gluon master thanks to the newer Linux (bridge) and batman-adv versions it becomes more interesting to also support layer 3 IPv6 multicast routers. So far this was also not possible with the default settings in Gluon due to filtering MLD into the mesh. This now adds support for brmldproxy, a daemon which proxies MLD reports between bridge ports. For the Gluon scenario this package adds brmldproxy proxying configuration for the mesh side bat0 bridge port. The configuration is tuned in a way to enable the usage of layer 3 IPv6 multicast routers for routable IPv6 multicast address ranges. But with a lot smaller MLD overhead compared to the filter_membership_reports=false site.conf option. If a node has no multicast listener for a routable IPv6 multicast address then this node will emit no MLD report into the mesh. Furthermore, if a node has multiple multicast listening hosts for routable IPv6 multicast addresses then the node will act in deputy and respond with combined, aggregated MLD reports on behalf. Signed-off-by: Linus Lüssing <[email protected]>

So far batman-adv flooded all MLD reports. However in our use-case, with the limitations we already have (*) it is safe to send MLD reports to detected multicast routers only. This reduces MLD report overhead even further than brmldproxy alone already does. And in particular results in no MLD reports in the mesh if no multicast router is present. This should, after some more testing from others, potentially make the gluon-mesh-batman-adv-brmldproxy package suitable for being included by default. As overhead downsides should then be negligible. (*): non-Gluon nodes still need to manually set multicast_router=2 on the bat0 bridge port. Signed-off-by: Linus Lüssing <[email protected]>

If there is no multicast router behind a bridge port then the Linux bridge multicast snooping code itself will refrain from forwarding a report, as recommended/required by RFC4541 ("Considerations for Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Snooping Switches). So these rules are in most cases redundant. On the other hand, removing them allows to actually run an IPv6 multicast router behind a Gluon node. Since OpenWrt 23.05 it will allow detecting multicast routers via Multicast Router Discovery (RFC4286). And removing these ebtables rules will allow a layer 3 multicast router to then receive MLD reports from the mesh properly and by that to learn about others listeners in the mesh. These incoming MLD report filtering rules are only removed when gluon-mesh-batman-adv-brmldproxy is installed, to avoid any other functional changes otherwise. Signed-off-by: Linus Lüssing <[email protected]>

The whole MLD report proxying only works if there is an MLD querier somewhere on the mesh side that actually polls for MLD reports. So far in our tests we configured gateway nodes for the MLD querier job. To ease the MLD querier setup, to avoid needing to enable an MLD querier manually on some gateway(s) this makes use of the new adjustments in brmldproxy that added a bridge interface on top of the proxy dummy interface: If batman-adv detected a multicast router behind one of its local client bridge ports (MRD advertisements are sufficient and recommended) then enable a potential MLD querier candidate, eligible for MLD querier election, automatically on this node towards the mesh side. Signed-off-by: Linus Lüssing <[email protected]>

T-X · 2025-05-03T19:53:41Z

Changelog v10:

rebased to current main branch (no changes)
synced to state in gluon-community packages:
- linting/style fixes
- used $(PKG_NAME) in Makefile

neocturne · 2025-05-20T11:07:28Z

package/gluon-mesh-batman-adv-brmldproxy/Makefile

+
+include $(TOPDIR)/../package/gluon.mk
+
+define Package/$(PKG_NAME)


OpenWrt's convention is never to use $(PKG_NAME) like this, and Gluon follows this convention.

neocturne · 2025-05-20T11:08:05Z

package/gluon-mesh-batman-adv-brmldproxy/Makefile

+
+PKG_NAME:=gluon-mesh-batman-adv-brmldproxy
+
+include $(TOPDIR)/../package/gluon.mk


Suggested change

include $(TOPDIR)/../package/gluon.mk

include ../gluon.mk

neocturne · 2025-05-20T11:09:26Z

...uon-mesh-batman-adv-brmldproxy/files/etc/hotplug.d/iface/51-gluon-mesh-batman-adv-brmldproxy

+#!/bin/sh
+set -e
+
+if [ "$INTERFACE" != "client" ] || [ "$ACTION" != "ifup" ]; then exit 0; fi


What happens when the client interface is taken down and up again repeatedly?

neocturne · 2025-06-10T18:04:09Z

...uon-mesh-batman-adv-brmldproxy/files/etc/hotplug.d/iface/51-gluon-mesh-batman-adv-brmldproxy

+
+if [ "$(lookup_site 'mesh.filter_membership_reports' 'true')" = "false" ]; then exit 0; fi
+
+wait_for_qdisc "fffe:"


What is this waiting for? Is something else creating these qdiscs?

github-actions bot added 3. topic: docs Topic: Documentation 3. topic: package Topic: Gluon Packages 3. topic: batman-adv labels Sep 23, 2023

T-X force-pushed the pr-gluon-mesh-batman-adv-brmldproxy branch from f8c26e7 to f1ff246 Compare September 23, 2023 23:08

github-actions bot added the 3. topic: firewall label Sep 23, 2023

ecsv reviewed Feb 23, 2024

View reviewed changes

package/gluon-mesh-batman-adv-brmldproxy/Makefile Outdated Show resolved Hide resolved

T-X force-pushed the pr-gluon-mesh-batman-adv-brmldproxy branch from c8d3fcc to 0858812 Compare March 26, 2024 21:50

github-actions bot removed the 3. topic: firewall label Mar 26, 2024

T-X force-pushed the pr-gluon-mesh-batman-adv-brmldproxy branch from 0858812 to cf37b5d Compare March 26, 2024 21:58

neocturne requested changes Apr 10, 2024

View reviewed changes

T-X force-pushed the pr-gluon-mesh-batman-adv-brmldproxy branch from cf37b5d to 3895867 Compare April 17, 2024 00:40

T-X force-pushed the pr-gluon-mesh-batman-adv-brmldproxy branch 3 times, most recently from 16c7ac7 to 8245234 Compare December 16, 2024 08:14

neocturne requested changes Dec 19, 2024

View reviewed changes

T-X force-pushed the pr-gluon-mesh-batman-adv-brmldproxy branch from 8245234 to 19da4c6 Compare January 6, 2025 08:37

T-X force-pushed the pr-gluon-mesh-batman-adv-brmldproxy branch 2 times, most recently from bc4be6d to 64d7ade Compare January 6, 2025 12:28

T-X force-pushed the pr-gluon-mesh-batman-adv-brmldproxy branch from 64d7ade to f770514 Compare January 9, 2025 17:16

T-X added a commit to T-X/community-packages that referenced this pull request Feb 5, 2025

Adding ffhl-gluon-mesh-batman-adv-brmldproxy

4807d92

This is a copy of #2995 for the main Gluon repository: -> freifunk-gluon/gluon#2995

T-X mentioned this pull request Feb 5, 2025

Adding ffhl-gluon-mesh-batman-adv-brmldproxy freifunk-gluon/community-packages#151

Open

rotanid pushed a commit to T-X/community-packages that referenced this pull request Mar 11, 2025

Adding ffhl-gluon-mesh-batman-adv-brmldproxy

374487e

This is a copy of #2995 for the main Gluon repository: -> freifunk-gluon/gluon#2995

rotanid added the 2. status: blocked Marked as blocked because it's waiting on something label Mar 11, 2025

T-X added a commit to T-X/community-packages that referenced this pull request Apr 7, 2025

Adding ffhl-gluon-mesh-batman-adv-brmldproxy

77e6368

This is a copy of #2995 for the main Gluon repository: -> freifunk-gluon/gluon#2995

T-X added a commit to T-X/community-packages that referenced this pull request Apr 10, 2025

Adding ffhl-gluon-mesh-batman-adv-brmldproxy

25fe483

This is a copy of #2995 for the main Gluon repository: -> freifunk-gluon/gluon#2995

neocturne added 2. status: waiting-on-author Waiting on some action from the author and removed 2. status: blocked Marked as blocked because it's waiting on something labels Apr 14, 2025

T-X added a commit to T-X/community-packages that referenced this pull request May 1, 2025

Adding ffhl-gluon-mesh-batman-adv-brmldproxy

f3cd2db

This is a copy of #2995 for the main Gluon repository: -> freifunk-gluon/gluon#2995

T-X added 4 commits May 3, 2025 20:29

T-X force-pushed the pr-gluon-mesh-batman-adv-brmldproxy branch from f770514 to d468554 Compare May 3, 2025 19:46

neocturne reviewed May 20, 2025

View reviewed changes

neocturne reviewed Jun 10, 2025

View reviewed changes


		include $(TOPDIR)/../package/gluon.mk

		define Package/$(PKG_NAME)


		PKG_NAME:=gluon-mesh-batman-adv-brmldproxy

		include $(TOPDIR)/../package/gluon.mk


		if [ "$(lookup_site 'mesh.filter_membership_reports' 'true')" = "false" ]; then exit 0; fi

		wait_for_qdisc "fffe:"

gluon-mesh-batman-adv-brmldproxy: add package #2995

Are you sure you want to change the base?

gluon-mesh-batman-adv-brmldproxy: add package #2995

Uh oh!

Conversation

T-X commented Sep 23, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

T-X commented Sep 23, 2023

Uh oh!

T-X commented Sep 26, 2023

Uh oh!

ecsv commented Oct 24, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

T-X commented Nov 30, 2023

Uh oh!

T-X commented Feb 14, 2024

Uh oh!

Uh oh!

T-X commented Feb 23, 2024

Uh oh!

T-X commented Mar 26, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

T-X commented Apr 17, 2024

Uh oh!

rotanid commented Jul 28, 2024

Uh oh!

T-X commented Dec 16, 2024

Uh oh!

T-X commented Dec 16, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

T-X commented Jan 6, 2025

Uh oh!

T-X commented Jan 6, 2025

Uh oh!

T-X commented Jan 9, 2025

Uh oh!

rotanid commented Mar 11, 2025

Uh oh!

T-X commented May 3, 2025

Uh oh!

neocturne May 20, 2025

Choose a reason for hiding this comment

Uh oh!

neocturne May 20, 2025

Choose a reason for hiding this comment

Uh oh!

neocturne May 20, 2025

Choose a reason for hiding this comment

Uh oh!

neocturne Jun 10, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

T-X commented Sep 23, 2023 •

edited

Loading

ecsv commented Oct 24, 2023 •

edited

Loading