usually i prefer CIDR prefixes over prefixlen, but since the same mask applies to both networks, i think prefixlen is better here.

remove ctld, since after D50625 it's no longer optional

a better fix for this would be to check in bridge_input if the frame has a tag and there's a vlan trunk, and if so immediately return it to ether_input. however this change is intended to preserve the existing behaviour (prior to member_ifaddrs) so it can be MFC'd to stable/14 with less risk of breaking something else.

• remove some redundant code in ifconfig
• use bitset(9) for ifbvlan_set_t instead of rolling our own

use DOT1Q_VID_* constants consistently, now they're available to userland.

In D50576#1154631, @kp wrote:

We do use it in vlan_clone_create_nl() during validation, presumably to ensure we only create valid VLANs. That's a user-visible change, but it's a bug fix so I don't think that should stop us.

rebase on top of D50576. this moves the DOT1Q_VID_MAX fix to a separate commit so it can be MFC'd.

In D50570#1154418, @kib wrote:

There should be tab, and not space, between '#define' and the starting char of the symbol.

add some comments.

specifically, i want to use these in ifconfig(8) for D50503.

update

update for new vlan filtering behaviour

update for new vlan filtering behaviour

update for new vlan filtering behaviour

update to new behaviour, per previous comment

based on feedback (here and in the original PR on GitHub) i am going to rework the syntax a bit for this feature.

In D50558#1154277, @zlei wrote:

@ivy Any details which parts have the same problem ?

i've checked all of these and there do not appear to be any more instances of the problem in D50557, i.e. everything that depends on one of these scripts also depends on something else as well. it wouldn't hurt for someone else to check that again in case i missed something.

for pkgbase we probably need a way to indicate an optional dependency, or we're almost certainly going to run into more of these. this looks fine for now, though.

In D50500#1153457, @kp wrote:

This looks good, but I'd like us to land the entire series at once, so we don't keep tweaking the bridge/vlan behaviour.

In D50285#1153581, @emaste wrote:

What's the reason for using Makefile.inc instead of just PACKAGE=smbutils in share/examples/smbfs/print/Makefile?

• code cleanup and style fixes
• users and groups can now be specified as numeric ids
• be more explicit about locale when we're talking to the kernel

mention "*" in mdo.conf.5

minor bug fixes

cleanup and style fixes, and add an mdo.conf(5) manual page

add an rc.d script

improve manpage formatting

i don't want to make significant changes to the existing reviews if possible, so i'll add this as a new review in the stack and tag you as reviewer.

In D49993#1152822, @p.mousavizadeh_protonmail.com wrote:

With your changes, without VLAN filtering, can I assume that all interfaces in a bridge are treated as trunk ports?

i've updated the diff summary to include the current commit message from my local branch.

an alternative would be to not land this at all (at least until the kernel issue is fixed) and instead rely on D50477 to fix the specific problem described in the commit message. the upside is this doesn't add 180s to the execution time for if_bridge_test. the downside is it also doesn't actually fix the problem in all cases, e.g. if a user has some ifconfig_epair* options in rc.conf.

my preference would be to land this and D50499 sooner rather than later, i.e. your “C1” option (and then do whatever the ‘better’ fix is in a followup commit) since currently if_bridge_test is broken for anyone with $ipv6_activate_all_interfaces enabled. however this issue doesn't affect ci.freebsd.org Jenkins as that option doesn't seem to be enabled there.

don't work around the test timeout here, we'll fix it in kyua

tests for adding an aip that already exists and removing an aip that doesn't exist would be nice.

leave ifbrq::pad alone, and bump __FreeBSD_version instead.

that will require an exp-run before landing then, right?

remove DES from rpc_soc, and remove the Xr to rpc_secure since the two manpages
now have nothing in common.