[Bridge] Force IGMP membership

[Bridge] Force IGMP membership

[Corey Melanson]

Hello,

I'm trying to add a bridge port to a multicast group manually to work around the situation where VMs that are live migrated lose their IGMP membership. We have IGMP snooping enabled on the bridge, and during this example there were other VMs on the same bridge/vlan which are part of this multicast group address sending/receiving traffic. These systems are running Ubuntu 14.04 (kernel 3.13).

Prior to live migration, I see the IGMP group membership on the kvm hypervisor:
$ bridge -d mdb | grep vnet8
dev br.128 port vnet8 grp 239.236.15.150 temp

After the live migration, multicast traffic to 239.236.15.150 stops as expected. If I try to manually add the multicast group membership:
# bridge mdb add dev br.128 port vnet3 grp 239.236.15.150 temp     
# bridge mdb list | grep vnet3
dev onebr.128 port vnet3 grp 239.236.15.150 temp

The multicast traffic does not resume until the VM sends a IGMP membership report after receiving an IGMP query from the switch, which takes too long most of the time (over a minute). 

I haven't been able to find anyone online in this situation, so any help would be greatly appreciated.

Thank you,
Corey Melanson

Re: [Bridge] Force IGMP membership

[Linus Lüssing]

On Fri, Nov 04, 2016 at 08:44:48PM +0000, Corey Melanson wrote:
> After the live migration, multicast traffic to 239.236.15.150 stops as expected. If I try to manually add the multicast group membership:
> # bridge mdb add dev br.128 port vnet3 grp 239.236.15.150 temp     
> # bridge mdb list | grep vnet3
> dev onebr.128 port vnet3 grp 239.236.15.150 temp
> 
> The multicast traffic does not resume until the VM sends a IGMP membership report after receiving an IGMP query from the switch, which takes too long most of the time (over a minute). 

Hm, sounds weird. Have you verified with tcpdump that
on <brport-multicast-in> you see the according frame and on vnet3
it is missing then?

Does it make a difference when instead of adding a group
explicitly to mark the whole port as a router port?

($ echo 2 > /sys/class/net/vnet3/brport/multicast_router
- not a solution proposal but just to narrow things down)

Regards, Linus

Re: [Bridge] Force IGMP membership

[Corey Melanson]

> -----Original Message-----
> From: Linus Lüssing [mailto:linus.luessing@c0d3.blue]
> Sent: Saturday, November 12, 2016 6:52 AM
> To: Corey Melanson <cmelanson@blackberry.com>
> Cc: bridge@lists.linux-foundation.org
> Subject: Re: [Bridge] Force IGMP membership
> 
> On Fri, Nov 04, 2016 at 08:44:48PM +0000, Corey Melanson wrote:
> > After the live migration, multicast traffic to 239.236.15.150 stops as
> expected. If I try to manually add the multicast group membership:
> > # bridge mdb add dev br.128 port vnet3 grp 239.236.15.150 temp
> > # bridge mdb list | grep vnet3
> > dev onebr.128 port vnet3 grp 239.236.15.150 temp
> >
> > The multicast traffic does not resume until the VM sends a IGMP
> membership report after receiving an IGMP query from the switch, which
> takes too long most of the time (over a minute).
> 
> Hm, sounds weird. Have you verified with tcpdump that
> on <brport-multicast-in> you see the according frame and on vnet3
> it is missing then?
> 
> Does it make a difference when instead of adding a group
> explicitly to mark the whole port as a router port?
> 
> ($ echo 2 > /sys/class/net/vnet3/brport/multicast_router
> - not a solution proposal but just to narrow things down)
> 
> Regards, Linus

Hi Linus,

During these tests I have another VM on the same bridge/vlan joined to the same multicast group, and it is receiving/sending multicast traffic, so tcpdump shows that the upstream bond vlan interface sees the multicast group traffic. It seems the traffic is just is not being sent to the VM when it is manually joined via:
$ bridge mdb add dev onebr.128 port vnet3 grp 239.236.15.150 temp

When I set the vnet port as a router:
$ echo 2 > /sys/class/net/vnet3/brport/multicast_router
The VM starts receiving multicast traffic immediately.

Please let me know if there is any other information that would be helpful.

Thank you,
Corey

Re: [Bridge] Force IGMP membership

[Linus Lüssing]

On Wed, Nov 16, 2016 at 05:24:36PM +0000, Corey Melanson wrote:
> Please let me know if there is any other information that would be helpful.
> 
> Thank you,
> Corey

Hi Corey,

I tried to reproduce your issue in a similar VM setup, but was
unsuccessful so far. For me things seem to work with 4.9-rc3
kernels.


What I tried:
            
    [vm-s] -- [vm-br] == [vm-r]

vm-s and vm-br are connected via one interface pair. vm-br and
vm-r share two interfaces.

On vm-r's 1st interface there is socat running which joins
239.236.15.150 [1]. On vm-r's 2nd interface there is a tcpdump
listening for UDP packets.
-> vm-br with a "bridge mdb show dev br0" shows one entry for
   239.236.15.150 for the 1st interface towards vm-r

vm-s sends multicast traffic to 239.236.15.150 via socat [2].
-> Is received successfully in socat on vm-r,
   tcpdump on 2nd interface stays empty


Then I did not do the full interface hotplugging, but instead
typed your "bridge mdb add..." command on vm-br for the 2nd
interface towards vm-r.

Finally I redid the socat transmission on vm-s. And vm-r received
this packet successfully both in socat running on its 1st
interface and in tcpdump running on its 2nd one.


Could you retry with a recent kernel, too, Corey?

Regards, Linus


[1]: $ socat -u UDP4-RECV:1234,reuseaddr,ip-add-membership="239.236.15.150:ens3" -
[2]: $ socat - UDP4-DATAGRAM:"239.236.15.150:1234"