bridge: add groupFwdMask support for multicast forwarding

[VaishnavSreekumar]

Overview

This PR adds support for configuring the groupFwdMask attribute in the bridge CNI plugin.

The Linux bridge supports controlling forwarding of link-local multicast traffic via:

/sys/class/net/<bridge>/bridge/group_fwd_mask

However, this functionality is currently not exposed through the CNI bridge plugin. This PR introduces an optional configuration field to enable this behavior.

Why this is needed

By default, Linux bridges drop certain link-local multicast frames (e.g., LLDP, PTP, LACP).

This becomes a limitation in environments that require precise multicast forwarding, such as:

• PTP (IEEE 1588) – clock synchronization
• Telecom networks (e.g., G.8275.1 profiles)
• Network control protocols (LLDP, LACP)

This change enables users to explicitly configure forwarding behavior when needed.

Changes

• New config field
• Added optional groupFwdMask field to bridge NetConf
• Validation
• Ensures value is within valid range: 0–65535
• Implementation

Writes mask to:

/sys/class/net/<bridge>/bridge/group_fwd_mask

• Safely ignores if not supported by the kernel

Security

• Sanitizes bridge name using filepath.Base
• Prevents invalid path traversal inputs

Behavior

• If groupFwdMask is not specified → no change (default kernel behavior)
• If set to 0 → no-op (preserves default behavior)
• If set to a valid value → applied to bridge
• If invalid value → CNI ADD fails with validation error

Example Configuration

{
  "type": "bridge",
  "bridge": "cni0",
  "groupFwdMask": 16384,
  "ipam": {
    "type": "host-local",
    "subnet": "10.10.0.0/16"
  }
}

Testing

• Added tests in bridge_test.go following existing patterns

Verified:

• Successful application of valid values
• Failure for invalid values (e.g., -1, >65535)
• Default behavior when value is 0
• Tests validate actual sysfs value when supported

Backward Compatibility

• Fully backward compatible
• No behavior change when groupFwdMask is not provided

Related

• Fixes: multicast forwarding limitation discussed in PTP(Precision Time Protocol) message is silently DROPPED by CNI plugin bridge #1045