Merge pull request #1039 from kernelkit/verify-ieee-group-fwd

Verify ieee group fwd

Author: axkar

doc/ChangeLog.md

@@ -12,6 +12,10 @@ All notable changes to the project are documented in this file.
 - Upgrade netopeer2 (NETCONF) to 2.4.1
 - Add documentation on Infix upgrading and downgrading, issue #1009
 - Add HDMI and USB support for iMX8MP-evk
+- Enforced strict format for LLDP destination MAC address:
+  - Only accepts colon-separated format: `01:80:C2:00:00:0E`
+- Add `show lldp` command to show discovered neighbors per interface.
+- Add configuration support for per-interface LLDP administrative status
 
 ### Fixes
 - Fix containers with multiple mounts
@@ -128,6 +132,7 @@ All notable changes to the project are documented in this file.
  - Add support for GRE/GRETAP tunnels
  - Add support for STP/RSTP on bridges
  - Add support for VXLAN tunnels
+ - Add support for configuring global LLDP `message-tx-interval`
 
 ### Fixes
 

doc/discovery.md

@@ -46,7 +46,7 @@ admin@infix-c0-ff-ee:~$
 
 ## LLDP
 
-Infix supports LLDP (IEEE 802.1AB).  For a device with factory default
+Infix supports LLDP (IEEE 802.1AB). For a device with factory default
 settings, the link-local IPv6 address can be read from the Management
 Address TLV using *tcpdump* or other sniffing tools[^1]:
 
@@ -131,6 +131,10 @@ tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144
 linux-pc:#
 ```
 
+The following capabilities are available via NETCONF/RESTCONF or the Infix CLI.
+
+### LLDP Enable/Disable
+
 The LLDP service can be disabled using the following commands.
 
 ```
@@ -140,6 +144,59 @@ admin@infix-c0-ff-ee:/config/> leave
 admin@infix-c0-ff-ee:/> 
 ```
 
+To reenable it from the CLI config mode:
+
+```
+admin@test-00-01-00:/config/> set lldp enabled 
+admin@test-00-01-00:/config/> leave
+```
+
+### LLDP Message Transmission Interval
+
+By default, LLDP uses a `message-tx-interval` of 30 seconds, as defined
+by the IEEE standard. Infix allows this value to be customized.
+To change it using the CLI:
+
+```
+admin@test-00-01-00:/config/> set lldp message-tx-interval 1
+admin@test-00-01-00:/config/> leave
+```
+
+### LLDP Administrative Status per Interface
+
+Infix supports configuring the LLDP administrative status on a per-port
+basis. The default mode is `tx-and-rx`, but the following options are 
+also supported:
+
+- `rx-only` – Receive LLDP packets only
+- `tx-only` – Transmit LLDP packets only
+- `disabled` – Disable LLDP on the interface
+
+Example configuration:
+
+```
+admin@test-00-01-00:/config/> set lldp port e8 dest-mac-address 01:80:C2:00:00:0E admin-status disabled
+admin@test-00-01-00:/config/> set lldp port e5 dest-mac-address 01:80:C2:00:00:0E admin-status rx-only 
+admin@test-00-01-00:/config/> set lldp port e6 dest-mac-address 01:80:C2:00:00:0E admin-status tx-only
+admin@test-00-01-00:/config/> leave
+```
+
+> [!NOTE]
+> The destination MAC address must be the standard LLDP multicast 
+> address: `01:80:C2:00:00:0E`.
+
+###  Displaying LLDP Neighbor Information
+
+In CLI mode, Infix also provides a convenient `show lldp` command to
+list LLDP neighbors detected on each interface:
+
+```
+admin@test-00-01-00:/> show lldp 
+INTERFACE       REM-IDX   TIME        CHASSIS-ID          PORT-ID             
+e5              1         902         00:a0:85:00:04:01   00:a0:85:00:04:07   
+e6              3         897         00:a0:85:00:03:01   00:a0:85:00:03:07   
+e8              2         901         00:a0:85:00:02:01   00:a0:85:00:02:05
+```
 
 ## mDNS-SD
 

src/confd/yang/confd.inc

@@ -25,7 +25,7 @@ MODULES=(
 	"[email protected]"
 	"[email protected]"
 	"[email protected]"
-	"infix-lldp@2025-01-08.yang"
+	"infix-lldp@2025-05-05.yang"
 	"[email protected]"
 	"[email protected]"
 	"[email protected]"

src/confd/yang/confd/infix-lldp.yang

@@ -11,6 +11,13 @@ module infix-lldp {
   contact      "[email protected]";
   description  "Infix augments and deviations to ieee-dot1ab-lldp.";
 
+  revision 2025-05-05 {
+    description 
+      "Restrict 'dest-mac-address' to only allow the LLDP multicast MAC
+       address (01:80:C2:00:00:0E).";
+    reference "internal";
+  }
+
   revision 2025-01-08 {
     description "Enable std. /lldp:lldp/message-tx-interval";
   }
@@ -32,6 +39,22 @@ module infix-lldp {
     }
   }
 
+  deviation "/lldp:lldp/lldp:port/lldp:dest-mac-address" {
+    deviate replace {
+      type string {
+        pattern "([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}";
+      }
+    }
+  }
+
+  deviation "/lldp:lldp/lldp:port/lldp:dest-mac-address" {
+    deviate add {
+      must "translate(., 'abcdef', 'ABCDEF') = '01:80:C2:00:00:0E'" {
+        error-message "Only the LLDP Multicast MAC (01:80:C2:00:00:0E) is allowed.";
+      }
+    }
+  }
+
   deviation "/lldp:lldp/lldp:message-fast-tx" {
     deviate not-supported;
   }

…fd/yang/confd/[email protected] …fd/yang/confd/[email protected]src/confd/yang/confd/[email protected] renamed to src/confd/yang/confd/[email protected] src/confd/yang/confd/[email protected] renamed to src/confd/yang/confd/[email protected]

@@ -373,6 +373,12 @@
     </ACTION>
   </COMMAND>
 
+  <COMMAND name="lldp" help="Show LLDP neighbors">
+    <ACTION sym="script">
+      show lldp
+    </ACTION>
+  </COMMAND>
+
   <COMMAND name="hardware" help="Show hardware information">
     <ACTION sym="script" in="tty" out="tty" interrupt="true">
       show hardware |pager
@@ -471,22 +477,22 @@
     <ACTION sym="script">sysinfo</ACTION>
     </COMMAND>
   -->
-    <COMMAND name="version" help="Show software version">
-      <ACTION sym="script" in="tty" interrupt="true">cat /etc/version</ACTION>
-    </COMMAND>
+  <COMMAND name="version" help="Show software version">
+    <ACTION sym="script" in="tty" interrupt="true">cat /etc/version</ACTION>
+  </COMMAND>
 
-    <COMMAND name="factory-config" help="Show factory-config">
-      <ACTION sym="script" in="tty" out="tty" interrupt="true">jq -C . /etc/factory-config.cfg |pager</ACTION>
-    </COMMAND>
+  <COMMAND name="factory-config" help="Show factory-config">
+    <ACTION sym="script" in="tty" out="tty" interrupt="true">jq -C . /etc/factory-config.cfg |pager</ACTION>
+  </COMMAND>
 
-    <COMMAND name="running-config" help="Show running-config">
-      <ACTION sym="script" in="tty" out="tty" interrupt="true">sysrepocfg -X -f json | jq -C . |pager</ACTION>
-    </COMMAND>
+  <COMMAND name="running-config" help="Show running-config">
+    <ACTION sym="script" in="tty" out="tty" interrupt="true">sysrepocfg -X -f json | jq -C . |pager</ACTION>
+  </COMMAND>
 
-    <COMMAND name="startup-config" help="Show startup-config">
-      <ACTION sym="script" in="tty" out="tty" interrupt="true">jq -C . /cfg/startup-config.cfg |pager</ACTION>
-    </COMMAND>
+  <COMMAND name="startup-config" help="Show startup-config">
+    <ACTION sym="script" in="tty" out="tty" interrupt="true">jq -C . /cfg/startup-config.cfg |pager</ACTION>
   </COMMAND>
+
   <COMMAND name="factory-reset" help="Restore the system to factory default state">
     <ACTION sym="script" in="tty" out="tty" interrupt="true">
       /bin/yorn "This will restore the device to factory defaults"
@@ -581,6 +587,7 @@
     </ACTION>
   </COMMAND>
 
+</COMMAND>
 </VIEW>
 
 <VIEW name="config">

src/klish-plugin-infix/xml/infix.xml

@@ -154,6 +154,15 @@ def routes(args: List[str]):
         return
     cli_pretty(data, "show-routing-table", "-i", ip_version)
 
+def lldp(args: List[str]):
+    data = run_sysrepocfg("/ieee802-dot1ab-lldp:lldp")
+    if not data:
+        print("No lldp data retrieved.")
+        return
+    if RAW_OUTPUT:
+        print(json.dumps(data, indent=2))
+        return
+    cli_pretty(data, "show-lldp")
 
 def execute_command(command: str, args: List[str]):
     command_mapping = {
@@ -162,6 +171,7 @@ def execute_command(command: str, args: List[str]):
         'interface': interface,
         'ntp': ntp,
         'routes': routes,
+        'lldp': lldp,
         'software' : software,
         'stp': stp,
     }