From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 04BAEC433FE for ; Thu, 17 Mar 2022 14:57:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235449AbiCQO6n (ORCPT ); Thu, 17 Mar 2022 10:58:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47566 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233311AbiCQO6m (ORCPT ); Thu, 17 Mar 2022 10:58:42 -0400 Received: from out4-smtp.messagingengine.com (out4-smtp.messagingengine.com [66.111.4.28]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8D0B2203A70; Thu, 17 Mar 2022 07:57:23 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 033ED5C0164; Thu, 17 Mar 2022 10:57:21 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute1.internal (MEProxy); Thu, 17 Mar 2022 10:57:21 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=dn5WetjsAweDFdDrV E4l3jAwTI6fbXOJu2TtvBSryHA=; b=LPpPYa+uaec9c9tSWDa/a1qlX0DXYY3jS RzshbqmdO7dVF5xENoH4gUmkN1VmVq71AeGh5/2aKK3C3/wkIQ3ltbJ3zZ3ZNI0q RCzcsWxvFuG2hNRV9pgsfdRmzrFDnPUMZqmgKSF9/pD5PDg9Mc9rS7x5iCccEqFt RWORpzNXsgm1ZJuULqEpBFfmU6cjr7dYAHL8lNt5o7Ew26AISo6jHxUpdUYb2+Y7 kHivUhf54VhAKl40e7KSIMzPOlUsMHx9xNm2VB073ZQbUKxcIiI3QJoWjkCrQm8W V0fLprnZFEnyIdy86Tnd0+8u7nTPvEfOsHnBUgEctlov3U1h2LCYA== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvvddrudefgedgieelucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhepfffhvffukfhfgggtuggjsehttdertddttddvnecuhfhrohhmpefkughoucfu tghhihhmmhgvlhcuoehiughoshgthhesihguohhstghhrdhorhhgqeenucggtffrrghtth gvrhhnpedtffekkeefudffveegueejffejhfetgfeuuefgvedtieehudeuueekhfduheel teenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpehiug hoshgthhesihguohhstghhrdhorhhg X-ME-Proxy: Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 17 Mar 2022 10:57:19 -0400 (EDT) Date: Thu, 17 Mar 2022 16:57:15 +0200 From: Ido Schimmel To: Hans Schultz Cc: davem@davemloft.net, kuba@kernel.org, netdev@vger.kernel.org, Hans Schultz , Andrew Lunn , Vivien Didelot , Florian Fainelli , Vladimir Oltean , Jiri Pirko , Ivan Vecera , Roopa Prabhu , Nikolay Aleksandrov , Shuah Khan , Daniel Borkmann , Ido Schimmel , linux-kernel@vger.kernel.org, bridge@lists.linux-foundation.org, linux-kselftest@vger.kernel.org Subject: Re: [PATCH v2 net-next 4/4] selftests: forwarding: add test of MAC-Auth Bypass to locked port tests Message-ID: References: <20220317093902.1305816-1-schultz.hans+netdev@gmail.com> <20220317093902.1305816-5-schultz.hans+netdev@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20220317093902.1305816-5-schultz.hans+netdev@gmail.com> Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Thu, Mar 17, 2022 at 10:39:02AM +0100, Hans Schultz wrote: > Verify that the MAC-Auth mechanism works by adding a FDB entry with the > locked flag set. denying access until the FDB entry is replaced with a > FDB entry without the locked flag set. > > Signed-off-by: Hans Schultz > --- > .../net/forwarding/bridge_locked_port.sh | 29 ++++++++++++++++++- > 1 file changed, 28 insertions(+), 1 deletion(-) > > diff --git a/tools/testing/selftests/net/forwarding/bridge_locked_port.sh b/tools/testing/selftests/net/forwarding/bridge_locked_port.sh > index 6e98efa6d371..2f9519e814b6 100755 > --- a/tools/testing/selftests/net/forwarding/bridge_locked_port.sh > +++ b/tools/testing/selftests/net/forwarding/bridge_locked_port.sh > @@ -1,7 +1,7 @@ > #!/bin/bash > # SPDX-License-Identifier: GPL-2.0 > > -ALL_TESTS="locked_port_ipv4 locked_port_ipv6 locked_port_vlan" > +ALL_TESTS="locked_port_ipv4 locked_port_ipv6 locked_port_vlan locked_port_mab" > NUM_NETIFS=4 > CHECK_TC="no" > source lib.sh > @@ -170,6 +170,33 @@ locked_port_ipv6() > log_test "Locked port ipv6" > } > > +locked_port_mab() > +{ > + RET=0 > + check_locked_port_support || return 0 > + > + ping_do $h1 192.0.2.2 > + check_err $? "MAB: Ping did not work before locking port" > + > + bridge link set dev $swp1 locked on > + bridge link set dev $swp1 learning on > + > + ping_do $h1 192.0.2.2 > + check_fail $? "MAB: Ping worked on port just locked" > + > + if ! bridge fdb show | grep `mac_get $h1` | grep -q "locked"; then > + RET=1 > + retmsg="MAB: No locked fdb entry after ping on locked port" > + fi bridge fdb show | grep `mac_get $h1 | grep -q "locked" check_err $? "MAB: No locked fdb entry after ping on locked port" > + > + bridge fdb del `mac_get $h1` dev $swp1 master > + bridge fdb add `mac_get $h1` dev $swp1 master static bridge fdb replace `mac_get $h1` dev $swp1 master static > + > + ping_do $h1 192.0.2.2 > + check_err $? "MAB: Ping did not work with fdb entry without locked flag" > + > + log_test "Locked port MAB" Clean up after the test to revert to initial state: bridge fdb del `mac_get $h1` dev $swp1 master bridge link set dev $swp1 locked off > +} > trap cleanup EXIT > > setup_prepare > -- > 2.30.2 >