Re: Question: DSA on Marvell 6390R switch dropping EAPOL packets with unicast MAC DA

[Vladimir Oltean <olteanv@gmail.com>]

On Thu, Mar 09, 2023 at 03:16:01PM +0200, Vladimir Oltean wrote:
> Speaking of bridging, is the net2p9 interface under any bridge during
> your testing, or does it operate as a standalone interface? If it's
> under a bridge, could you repeat the experiment with it as standalone?

Ah, I shouldn't have asked this, because the information you've provided:

> > if (trunk)
> >     skb->offload_fwd_mark = true;
> > else if (!trap)
> >     dsa_default_offload_fwd_mark(skb);
> > 
> > will set skb->offload_fwd_mark = 1.

is enough for me to determine that yes, net2p9 *is* under a bridge.
This is because of the implementation:

static inline void dsa_default_offload_fwd_mark(struct sk_buff *skb)
{
	struct dsa_port *dp = dsa_slave_to_port(skb->dev);

	skb->offload_fwd_mark = !!(dp->bridge);
}

if it wasn't under a bridge, then skb->offload_fwd_mark would have never
been 1.

Ok, so having this said, now I have a pretty strong suspicion as to what
the issue is.

The RX handler of the software bridge layer - br_handle_frame() - steals
packets from the bridge port interface (net2p9) before those packets
ever reach the PF_PACKET socket opened by wpa_supplicant. "Steals" means
"returns RX_HANDLER_CONSUMED and not RX_HANDLER_PASS".

There is a netfilter hook through which you can tell the bridge
"hey, don't steal this kind of traffic, leave it on the bridge port!"
The command, applied to EAPOL, would look something like this:

/sbin/ebtables --table broute --append BROUTING --protocol 0x888e --jump DROP

Would you mind giving this a try (and do the rest of the debugging later)?