bridge: add groupFwdMask support for multicast forwarding

golangci/golangci-lint-2.12.1-windows-amd64/README.md

@@ -0,0 +1,70 @@
+<p align="center">
+  <img alt="golangci-lint logo" src="assets/go.png" height="150" />
+  <h3 align="center">golangci-lint</h3>
+  <p align="center">Fast linters runner for Go</p>
+</p>
+
+---
+
+`golangci-lint` is a fast Go linters runner.
+
+It runs linters in parallel, uses caching, supports YAML configuration,
+integrates with all major IDEs, and includes over a hundred linters.
+
+## Install `golangci-lint`
+
+- [On my machine](https://golangci-lint.run/docs/welcome/install/local);
+- [On CI/CD systems](https://golangci-lint.run/docs/welcome/install/ci).
+
+## Documentation
+
+Documentation is hosted at https://golangci-lint.run.
+
+## Social Networks
+
+[![Join Slack](https://img.shields.io/badge/Slack-4285F4?logo=slack&logoColor=white)](https://gophers.slack.com/archives/CS0TBRKPC)
+[![Follow on Mastodon](https://img.shields.io/badge/Mastodon-6364FF?logo=mastodon&logoColor=white)](https://fosstodon.org/@golangcilint)
+[![Follow on Bluesky](https://img.shields.io/badge/Bluesky-0a7aff?logo=bluesky&logoColor=white)](https://bsky.app/profile/golangci-lint.run)
+[![Follow on Twitter](https://img.shields.io/badge/Twitter-1DA1F2?logo=x&logoColor=white)](https://twitter.com/golangci)
+
+## Support Us
+
+`golangci-lint` is a free and open-source project built by volunteers.
+
+If you value it, consider supporting us, we appreciate it! :heart:
+
+[![Golangci-lint](https://img.shields.io/badge/Support-golangci_lint-blue?style=for-the-badge)](https://donate.golangci.org)
+[![Linter Authors](https://img.shields.io/badge/Support-Linter_Authors-blue?style=for-the-badge)](https://golangci-lint.run/docs/product/thanks/)
+
+## Badges
+
+![Build Status](https://github.com/golangci/golangci-lint/workflows/CI/badge.svg)
+[![License](https://img.shields.io/github/license/golangci/golangci-lint)](/LICENSE)
+[![Release](https://img.shields.io/github/release/golangci/golangci-lint.svg)](https://github.com/golangci/golangci-lint/releases/latest)
+[![Docker](https://img.shields.io/docker/pulls/golangci/golangci-lint)](https://hub.docker.com/r/golangci/golangci-lint)
+[![GitHub Releases Stats of golangci-lint](https://img.shields.io/github/downloads/golangci/golangci-lint/total.svg?logo=github)](https://somsubhra.github.io/github-release-stats/?username=golangci&repository=golangci-lint)
+
+## Contributors
+
+This project exists thanks to all the people who contribute. [How to contribute](https://golangci-lint.run/docs/contributing/).
+
+<a href="https://github.com/golangci/golangci-lint/graphs/contributors">
+  <img src="https://opencollective.com/golangci-lint/contributors.svg?width=890&button=false&skip=golangcidev,CLAassistant,renovate,fossabot,golangcibot,kortschak,golangci-releaser,dependabot%5Bbot%5D" />
+</a>
+
+## Sponsors
+
+<p>&nbsp;</p>
+<p float="left">
+  <a href="https://www.jetbrains.com/go/?utm_source=OSS&utm_medium=referral&utm_campaign=golangci" target="_blank">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="assets/goland-white.svg">
+      <source media="(prefers-color-scheme: light)" srcset="assets/goland.svg">
+      <img alt="The complete IDE crafted for professional Go developers." src="assets/goland.svg" width="150" />
+    </picture>
+  </a>
+</p>
+
+## Stargazers over time
+
+[![Stargazers over time](https://starchart.cc/golangci/golangci-lint.svg?variant=adaptive)](https://starchart.cc/golangci/golangci-lint)

plugins/main/bridge/bridge.go

@@ -22,6 +22,7 @@ import (
 	"os"
 	"runtime"
 	"sort"
+	"strings"
 	"syscall"
 	"time"
 
@@ -40,6 +41,10 @@ import (
 	"github.com/containernetworking/plugins/pkg/utils/sysctl"
 )
 
+func getGroupFwdMaskPath(brName string) string {
+	return fmt.Sprintf("/sys/class/net/%s/bridge/group_fwd_mask", brName)
+}
+
 // For testcases to force an error after IPAM has been performed
 var debugPostIPAMError error
 
@@ -63,6 +68,7 @@ type NetConf struct {
 	EnableDad                 bool         `json:"enabledad,omitempty"`
 	DisableContainerInterface bool         `json:"disableContainerInterface,omitempty"`
 	PortIsolation             bool         `json:"portIsolation,omitempty"`
+	GroupFwdMask              int          `json:"groupFwdMask,omitempty"`
 
 	Args struct {
 		Cni BridgeArgs `json:"cni,omitempty"`
@@ -111,6 +117,9 @@ func loadNetConf(bytes []byte, envArgs string) (*NetConf, string, error) {
 	if err := json.Unmarshal(bytes, n); err != nil {
 		return nil, "", fmt.Errorf("failed to load netconf: %v", err)
 	}
+	if n.GroupFwdMask < 0 || n.GroupFwdMask > 0xFFFF {
+		return nil, "", fmt.Errorf("invalid groupFwdMask %d", n.GroupFwdMask)
+	}
 	if n.Vlan < 0 || n.Vlan > 4094 {
 		return nil, "", fmt.Errorf("invalid VLAN ID %d (must be between 0 and 4094)", n.Vlan)
 	}
@@ -329,7 +338,7 @@ func bridgeByName(name string) (*netlink.Bridge, error) {
 	return br, nil
 }
 
-func ensureBridge(brName string, mtu int, promiscMode, vlanFiltering bool) (*netlink.Bridge, error) {
+func ensureBridge(brName string, mtu int, promiscMode, vlanFiltering bool, groupFwdMask int) (*netlink.Bridge, error) {
 	linkAttrs := netlink.NewLinkAttrs()
 	linkAttrs.Name = brName
 	linkAttrs.MTU = mtu
@@ -340,9 +349,16 @@ func ensureBridge(brName string, mtu int, promiscMode, vlanFiltering bool) (*net
 		br.VlanFiltering = &vlanFiltering
 	}
 
+	// Track whether the bridge was newly created
+	created := false
+
 	err := netlink.LinkAdd(br)
-	if err != nil && err != syscall.EEXIST {
-		return nil, fmt.Errorf("could not add %q: %v", brName, err)
+	if err != nil {
+		if err != syscall.EEXIST {
+			return nil, fmt.Errorf("could not add %q: %v", brName, err)
+		}
+	} else {
+		created = true
 	}
 
 	if promiscMode {
@@ -358,6 +374,23 @@ func ensureBridge(brName string, mtu int, promiscMode, vlanFiltering bool) (*net
 		return nil, err
 	}
 
+	// Validate group_fwd_mask if bridge already existed
+	if !created && groupFwdMask != 0 {
+		path := getGroupFwdMaskPath(brName)
+		data, err := os.ReadFile(path)
+		if err == nil {
+			current := strings.TrimSpace(string(data))
+			expected := fmt.Sprintf("%d", groupFwdMask)
+
+			if current != expected && current != fmt.Sprintf("0x%x", groupFwdMask) {
+				return nil, fmt.Errorf(
+					"bridge %q already exists with different group_fwd_mask (current=%s, requested=%s)",
+					brName, current, expected,
+				)
+			}
+		}
+	}
+
 	// we want to own the routes for this interface
 	_, _ = sysctl.Sysctl(fmt.Sprintf("net/ipv6/conf/%s/accept_ra", brName), "0")
 
@@ -514,7 +547,7 @@ func calcGatewayIP(ipn *net.IPNet) net.IP {
 func setupBridge(n *NetConf) (*netlink.Bridge, *current.Interface, error) {
 	vlanFiltering := n.Vlan != 0 || n.VlanTrunk != nil
 	// create bridge if necessary
-	br, err := ensureBridge(n.BrName, n.MTU, n.PromiscMode, vlanFiltering)
+	br, err := ensureBridge(n.BrName, n.MTU, n.PromiscMode, vlanFiltering, n.GroupFwdMask)
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to create bridge %q: %v", n.BrName, err)
 	}