add l2mcd docker for igmp snooping by jasper-hou-micas · Pull Request #24327 · sonic-net/sonic-buildimage

jasper-hou-micas · 2025-10-23T08:45:52Z

Why I did it

Work item tracking

Microsoft ADO (number only):

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Tested branch (Please provide the tested image version)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

mssonicbld · 2025-10-23T08:46:00Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2025-10-23T08:46:12Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2025-10-23T08:53:11Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2025-10-23T08:53:22Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2025-10-24T06:26:36Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2025-10-24T06:26:46Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2025-10-27T11:08:18Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2025-10-27T11:08:31Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2025-12-03T03:39:31Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2025-12-03T03:39:37Z

Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command.

mssonicbld · 2025-12-05T09:48:12Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2025-12-05T09:48:18Z

Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command.

mssonicbld · 2026-01-22T07:43:40Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-01-22T07:43:52Z

Azure Pipelines successfully started running 1 pipeline(s).

Signed-off-by: Jasper.Hou <[email protected]>

mssonicbld · 2026-01-22T07:45:35Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-01-22T07:45:47Z

Azure Pipelines successfully started running 1 pipeline(s).

Signed-off-by: Jasper.Hou <[email protected]>

mssonicbld · 2026-01-22T09:04:01Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-01-22T09:04:13Z

Azure Pipelines successfully started running 1 pipeline(s).

aidan-gallagher

This PR adds docker-l2mcd, systemd service, YANG models, CoPP traps, and build integration. The container is non-functional as shipped (all supervisorctl commands commented out). The PR also bundles several unrelated changes that affect all SONiC builds.

Critical	High	Medium	Low	Total
1	7	9	8	25

Additionally, the YANG model files in this PR (sonic-igmp-snooping.yang, sonic-mld-snooping.yang) have issues noted in the companion mgmt-common PR #185 review. Those findings are included inline below since the YANG files live in this PR.

Unrelated changes bundled: This PR includes changes to telemetry variables (docker-sonic-telemetry/telemetry_vars.j2), enables TRANSLIB_WRITE globally, adds default MGMT_PORT configuration (init_cfg.json.j2:24-29), and adds an x509 YANG leaf (sonic-device_metadata.yang). These affect all SONiC builds and are unrelated to IGMP snooping.

YANG model notes: Both YANG files have redundant leaves (out-intf key duplicated by port non-key, mrouter-intf key duplicated by mrouter_port), inconsistent naming (mrouter_port underscore vs hyphens elsewhere), and the IGMP model has L2MC_SUPPRESS container but MLD has no equivalent for IPv6 suppression. Timer leaves (query-interval, last-member-query-interval, query-max-response-time) are missing units statements -- the config guide clarifies they use seconds/milliseconds but this should be in the YANG source.

dockers/docker-l2mcd/start.sh

aidan-gallagher · 2026-02-20T11:01:48Z

rules/config

 INCLUDE_ICCPD = n

+# INCLUDE_L2MCD - build docker-l2mcd for IGMP Snooping
+INCLUDE_L2MCD = y


High: INCLUDE_L2MCD defaults to y. Other optional features (e.g., INCLUDE_ICCPD, INCLUDE_SYSTEM_TELEMETRY) default to n. A new feature that is currently non-functional (commented-out start commands, hardcoded amd64, libpython3.8) should not be enabled by default.

The INCLUDE-XXX changes are enabled by default to avoid potential feature loss due to missing build-time options. We’re open to your feedback on this approach.

rules/docker-l2mcd.mk

aidan-gallagher · 2026-02-20T11:01:48Z

rules/config

 # ENABLE_TRANSLIB_WRITE - Enable translib write/config operations via the gNMI interface.
 # Uncomment to enable:
-# ENABLE_TRANSLIB_WRITE = y
+ENABLE_TRANSLIB_WRITE = y


High: ENABLE_TRANSLIB_WRITE = y enables gNMI write access for all SONiC builds. This was intentionally left disabled by the community. Enabling it here is unrelated to L2MCD and has security implications (especially combined with the gnmi PR #527 which hardcodes admin roles).

dockers/docker-l2mcd/Dockerfile.j2

rules/l2mcd.mk

src/sonic-yang-models/yang-models/sonic-igmp-snooping.yang

dockers/docker-sonic-telemetry/telemetry_vars.j2

files/build_templates/per_namespace/l2mcd.service.j2

files/image_config/copp/copp_cfg.j2

aidan-gallagher · 2026-02-20T11:02:14Z

Documentation Review Notes

The vendor-provided documentation (configuration guide, YANG/API reference, test results) has the following notable gaps. These are not code issues but affect the ability to review and validate the feature.

Test Results

No IGMP snooping test results (Critical): All 14 documented test cases (IT-SONIC-MLD-SNP-BAS-001 through -014) are MLD snooping tests. Despite the PR suite being titled "IGMP Snooping" and IGMP being the primary feature, there are zero documented IGMP snooping test results.

No negative/boundary tests (High): All 14 tests are positive path only ("configure X, verify X works"). Missing: max multicast group limits, simultaneous IGMP+MLD on same VLAN (which the config guide says is unsupported), l2mcd crash recovery, malformed packets, and scale testing.

Configuration Guide

Silent multicast drop on enable (High): The guide states that when L2MC is enabled but optimised_multicast_flood is not, all unknown multicast is dropped at ingress. This means enabling IGMP snooping silently breaks all multicast traffic until the operator also enables flood optimization. Most IGMP snooping implementations flood unknown multicast by default. This should be prominently warned about.

IGMP/MLD mutual exclusion buried (Medium): The constraint that IGMP and MLD snooping cannot be enabled simultaneously on the same VLAN is only mentioned in the MLD section, not in the IGMP section.

YANG/API Reference

Redundant leaves unexplained (High): The YANG tree diagrams show L2MC_STATIC_MEMBER_LIST has both out-intf (key) and port (non-key) with identical types, and L2MC_MROUTER_LIST has both mrouter-intf (key) and mrouter_port. The document describes both individually but never explains why both exist or what a gNMI client should set.

jasper-hou-micas · 2026-02-24T09:24:00Z

Documentation Review Notes

The vendor-provided documentation (configuration guide, YANG/API reference, test results) has the following notable gaps. These are not code issues but affect the ability to review and validate the feature.

@aidan-gallagher
The IGMP test cases were provided in the first email, and the MLD test cases are included in the latest attachment, with the duplicate items removed.
Both MLD and IGMP can now be enabled simultaneously, and the latest SCG document has been updated accordingly.

Signed-off-by: Jasper.Hou <[email protected]>

mssonicbld · 2026-02-27T09:07:24Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-02-27T09:07:37Z

Azure Pipelines successfully started running 1 pipeline(s).

jasper-hou-micas mentioned this pull request Jan 21, 2026

add l2mc yang sonic-net/sonic-mgmt-common#185

Draft

jasper-hou-micas changed the base branch from master to 202511 January 22, 2026 07:33

jasper-hou-micas force-pushed the igmp-snp branch from 9c203aa to afef5b9 Compare January 22, 2026 07:43

jasper-hou-micas added 6 commits January 22, 2026 15:44

add l2mcd docker

bb832f2

Signed-off-by: Jasper.Hou <[email protected]>

fix gnmi and add l2mc yang

30d3df9

Signed-off-by: Jasper.Hou <[email protected]>

fix cpld for pmon

61df64b

Signed-off-by: Jasper.Hou <[email protected]>

rollback

afd04d4

Signed-off-by: Jasper.Hou <[email protected]>

support mld snooping yang and copp

d4f21d2

Signed-off-by: Jasper.Hou <[email protected]>

fix igmp snooping yang

2cbb1c1

Signed-off-by: Jasper.Hou <[email protected]>

jasper-hou-micas force-pushed the igmp-snp branch from afef5b9 to 2cbb1c1 Compare January 22, 2026 07:45

fix l2mcd group

4dd5e49

Signed-off-by: Jasper.Hou <[email protected]>

aidan-gallagher reviewed Feb 20, 2026

View reviewed changes

Fix issues from code review

2929959

Signed-off-by: Jasper.Hou <[email protected]>

Conversation

jasper-hou-micas commented Oct 23, 2025

Why I did it

Work item tracking

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Tested branch (Please provide the tested image version)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

Uh oh!

mssonicbld commented Oct 23, 2025

Uh oh!

azure-pipelines bot commented Oct 23, 2025

Uh oh!

mssonicbld commented Oct 23, 2025

Uh oh!

azure-pipelines bot commented Oct 23, 2025

Uh oh!

mssonicbld commented Oct 24, 2025

Uh oh!

azure-pipelines bot commented Oct 24, 2025

Uh oh!

mssonicbld commented Oct 27, 2025

Uh oh!

azure-pipelines bot commented Oct 27, 2025

Uh oh!

mssonicbld commented Dec 3, 2025

Uh oh!

azure-pipelines bot commented Dec 3, 2025

Uh oh!

mssonicbld commented Dec 5, 2025

Uh oh!

azure-pipelines bot commented Dec 5, 2025

Uh oh!

mssonicbld commented Jan 22, 2026

Uh oh!

azure-pipelines bot commented Jan 22, 2026

Uh oh!

mssonicbld commented Jan 22, 2026

Uh oh!

azure-pipelines bot commented Jan 22, 2026

Uh oh!

mssonicbld commented Jan 22, 2026

Uh oh!

azure-pipelines bot commented Jan 22, 2026

Uh oh!

aidan-gallagher left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

aidan-gallagher Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

jasper-hou-micas Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

aidan-gallagher Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aidan-gallagher commented Feb 20, 2026

Documentation Review Notes

Test Results

Configuration Guide

YANG/API Reference

Uh oh!

jasper-hou-micas commented Feb 24, 2026

Documentation Review Notes

Uh oh!

mssonicbld commented Feb 27, 2026

Uh oh!

azure-pipelines bot commented Feb 27, 2026