Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 585598 - Feature request: update bridging/vlan support to use iproute2 features in net-misc/netifrc
Summary: Feature request: update bridging/vlan support to use iproute2 features in ne...
Alias: None
Product: Gentoo Hosted Projects
Classification: Unclassified
Component: netifrc (show other bugs)
Hardware: All Linux
: Normal enhancement (vote)
Assignee: netifrc Team
Whiteboard: netifrc:bridge
Depends on:
Reported: 2016-06-11 15:43 UTC by Nikita S. Kipriyanov
Modified: 2016-10-24 20:54 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Nikita S. Kipriyanov 2016-06-11 15:43:41 UTC
Bridging support is done in Linux with "brctl" utility for a long, long time. Also was "vconfig" utility to configure vlans, "ifenslave" to make bonds, "iptunnel" to create tunnels, "ifconfig" to configure IP addresses and some features, "route" to modify routing tables, etc. Many of them are from "sys-apps/net-tools" package, while others are from their dedicated packages. They all use "ioctl" interface to the kernel, which is now considered deprecated and doesn't get updated with the introduction of new features into Linux kernel.

After introduction of iproute2 package these utilites are gradually replaced with "ip" (and some others). iproute2 package allows to use modern and mode advanced features of Linux, such as policy routing, traffic control, network namespaces and so on, which is impossible to do with plain old net-tools. iproute2 utilites use modern netlink kernel interface, as do modern versions of iptables and ip6tables and many others.

Gentoo networking looks much more advanced that other distributions, because this modular structure is very flexible. Many network settings are already done with ip utility, while there are still rudiments which use old ones. For example, ip addresses, routes, vlan subinterfaces, tunnels, bonding are all using iproute2's ip, while bridging still uses bridge-utils's brctl.

In 2013 there was an important update to the Linux kernel, which added vlan filtering to the standard linux bridge (it supports even QinQ since then).
This makes bridge-utils obsolete, because brctl was not updated and could not be updated to use this and other features.

This could make many complex network configurations much simpler. To bridge VMs and containers and spread them into 5 different vlans we used to create 5 subinterfaces and 5 bridges. With new kernel feature, we don't need any subinterfaces on physical side and only one featureful bridge. Example:

ip link add name br0 type bridge vlan_filtering 1
(i suspect a bug in ip, which doesn't actually set vlan filtering even if we introduced this argument. It could still be set afterwards with "echo 1 > /sys/class/net/br0/bridge/vlan_filtering", but better is to fix the utility)
ip link set dev eth0 master br0
bridge vlan add vid 10 dev eth0
bridge vlan add vid 20 dev eth0
(i assume veth100i0 is "host" side of veth pair; other side is in container)
bridge vlan add vid 10 dev veth100i0 untagged pvid
(now everything what enters eth0 with tag 10 will reach container untagged, everything which comes from container will be send away with pvid tag 10).
ip link set dev veth200i0 master br0
bridge vlan add vid 20 dev veth100i0 untagged pvid
(same for other container and other tag)
(this is how management vlan with tag 255 could be implemented)
bridge vlan add vid 255 dev eth0
bridge del vlan 1 dev br0
(vlan 1 is default vlan and always added to each new interface as untagged pvid by default)
bridge add vlan 255 dev br0 untagged pvid
ip link set dev veth100i0 master br0
ip addr add dev br0

This looks really like managing an L2 switch.

The idea for now is to keep configuration syntax, but to evaluate it with the new interface, "ip" and "bridge". To do what is now done with brctl, "ip" is sufficient; "bridge" utility could be used to set up said vlan filtering. This way we could at least remove bridge-utils dependency. Then, syntax could be extended to use new features.

These bridges are same that are done with brctl, but have new features. One can create bridge with brctl and then add vlans with bridge, for example. But why use brctl anymore?

I am going to try to implement this by myself, but I want at least to know if this is 

  * man bridge, man ip, man ip-link
Comment 1 Nikita S. Kipriyanov 2016-06-11 15:45:08 UTC
... if community will be interested in this, and will Gentoo development team help me with advices and suggestions.
Comment 2 Nikita S. Kipriyanov 2016-06-11 15:53:05 UTC
I messed things slightly in example, sorry. Interface veth100i0 should be enslaved first, then vlans could be configured. 

ip link set dev veth100i0 master br0

and only then

bridge vlan add vid 10 dev veth100i0 untagged pvid
Comment 3 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2016-06-11 16:02:23 UTC
Have you read net/ in netifrc?

It already supports setup using iproute2 instead of brctl, and advises users to migrate their configuration:

Further, all of the VLAN pieces you describe here would seem to be functionally identical to setting up the bridge device, then setting up vlan devices on top of that.

Eg, this adds an interface on VLAN10 on top of the bridge.
ip link add link br0 name br0.10 type vlan id 10
Comment 4 Nikita S. Kipriyanov 2016-06-11 17:46:12 UTC
Yes, I had read, but stable one. There is still only brctl. That is why I opened this bug. Sorry.

What is strange, I searched web a lot when investigated this new feature and hadn't found that page.

This one is resolved, but now interesting see how things are in other packages, namely lxc, which makes extensive use of bridges.