From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4DA28C433FE for ; Sun, 20 Mar 2022 07:52:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237855AbiCTHyF (ORCPT ); Sun, 20 Mar 2022 03:54:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55456 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231180AbiCTHyE (ORCPT ); Sun, 20 Mar 2022 03:54:04 -0400 Received: from out3-smtp.messagingengine.com (out3-smtp.messagingengine.com [66.111.4.27]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7929B1F0453; Sun, 20 Mar 2022 00:52:40 -0700 (PDT) Received: from compute2.internal (compute2.nyi.internal [10.202.2.46]) by mailout.nyi.internal (Postfix) with ESMTP id E8DB85C0116; Sun, 20 Mar 2022 03:52:37 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute2.internal (MEProxy); Sun, 20 Mar 2022 03:52:37 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=5S1Qz9qa8y5v6pn+6 hPiVyR9fbOW9nCX+ik34wPrsIw=; b=GR4U9PbXRmwKlG+92UM35IdYDLE1UnrK7 Ld0eXeTAX/uq+p5Fc/9ZoksjqPgGZiSpV6ROvs5hTVAqwg7Tr2+I9ClVUMIf1gw6 Nd4Q5VhefO0IaNXa2OzHrlr4va1hUuM+J6dmJMWx1rQk1pNLLoUPar4yqWHhGchI tDdBttofIPw+uIPGAhN4loJ50CoPyybCcFjoZ5qHUL9iFqXOQ643z7LP889vGkPq v+3Pmq2E7OXWZv0cSKl/f8Ffr1jVvO3a7Y/rbIHN0fDTkP7v58BS07KKMCkskUG7 rTPrp+jinp67KmciT0vJHFrcQsbAicJn7KXknDl2WEjI12WPUEW+Q== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvvddrudegtddgtdelucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhepfffhvffukfhfgggtuggjsehttdertddttddvnecuhfhrohhmpefkughoucfu tghhihhmmhgvlhcuoehiughoshgthhesihguohhstghhrdhorhhgqeenucggtffrrghtth gvrhhnpedtffekkeefudffveegueejffejhfetgfeuuefgvedtieehudeuueekhfduheel teenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpehiug hoshgthhesihguohhstghhrdhorhhg X-ME-Proxy: Received: by mail.messagingengine.com (Postfix) with ESMTPA; Sun, 20 Mar 2022 03:52:36 -0400 (EDT) Date: Sun, 20 Mar 2022 09:52:33 +0200 From: Ido Schimmel To: Hans Schultz Cc: davem@davemloft.net, kuba@kernel.org, netdev@vger.kernel.org, Andrew Lunn , Vivien Didelot , Florian Fainelli , Vladimir Oltean , Jiri Pirko , Ivan Vecera , Roopa Prabhu , Nikolay Aleksandrov , Shuah Khan , Daniel Borkmann , Ido Schimmel , linux-kernel@vger.kernel.org, bridge@lists.linux-foundation.org, linux-kselftest@vger.kernel.org Subject: Re: [PATCH v2 net-next 4/4] selftests: forwarding: add test of MAC-Auth Bypass to locked port tests Message-ID: References: <20220317093902.1305816-1-schultz.hans+netdev@gmail.com> <20220317093902.1305816-5-schultz.hans+netdev@gmail.com> <86mthnw9gr.fsf@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <86mthnw9gr.fsf@gmail.com> Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Fri, Mar 18, 2022 at 04:45:24PM +0100, Hans Schultz wrote: > On tor, mar 17, 2022 at 16:57, Ido Schimmel wrote: > > On Thu, Mar 17, 2022 at 10:39:02AM +0100, Hans Schultz wrote: > >> Verify that the MAC-Auth mechanism works by adding a FDB entry with the > >> locked flag set. denying access until the FDB entry is replaced with a > >> FDB entry without the locked flag set. > >> > >> Signed-off-by: Hans Schultz > >> --- > >> .../net/forwarding/bridge_locked_port.sh | 29 ++++++++++++++++++- > >> 1 file changed, 28 insertions(+), 1 deletion(-) > >> > >> diff --git a/tools/testing/selftests/net/forwarding/bridge_locked_port.sh b/tools/testing/selftests/net/forwarding/bridge_locked_port.sh > >> index 6e98efa6d371..2f9519e814b6 100755 > >> --- a/tools/testing/selftests/net/forwarding/bridge_locked_port.sh > >> +++ b/tools/testing/selftests/net/forwarding/bridge_locked_port.sh > >> @@ -1,7 +1,7 @@ > >> #!/bin/bash > >> # SPDX-License-Identifier: GPL-2.0 > >> > >> -ALL_TESTS="locked_port_ipv4 locked_port_ipv6 locked_port_vlan" > >> +ALL_TESTS="locked_port_ipv4 locked_port_ipv6 locked_port_vlan locked_port_mab" > >> NUM_NETIFS=4 > >> CHECK_TC="no" > >> source lib.sh > >> @@ -170,6 +170,33 @@ locked_port_ipv6() > >> log_test "Locked port ipv6" > >> } > >> > >> +locked_port_mab() > >> +{ > >> + RET=0 > >> + check_locked_port_support || return 0 > >> + > >> + ping_do $h1 192.0.2.2 > >> + check_err $? "MAB: Ping did not work before locking port" > >> + > >> + bridge link set dev $swp1 locked on > >> + bridge link set dev $swp1 learning on > >> + > >> + ping_do $h1 192.0.2.2 > >> + check_fail $? "MAB: Ping worked on port just locked" > >> + > >> + if ! bridge fdb show | grep `mac_get $h1` | grep -q "locked"; then > >> + RET=1 > >> + retmsg="MAB: No locked fdb entry after ping on locked port" > >> + fi > > > > bridge fdb show | grep `mac_get $h1 | grep -q "locked" > > check_err $? "MAB: No locked fdb entry after ping on locked port" > > > >> + > >> + bridge fdb del `mac_get $h1` dev $swp1 master > >> + bridge fdb add `mac_get $h1` dev $swp1 master static > > > > bridge fdb replace `mac_get $h1` dev $swp1 master static > > > Unfortunately for some reason 'replace' does not work in several of the > tests, while when replaced with 'del+add', they work. Is it because the 'locked' flag is not removed following the replace? At least I don't see where it's handled in fdb_add_entry(). If so, please fix it and use "bridge fdb replace" in the test. > > >> + > >> + ping_do $h1 192.0.2.2 > >> + check_err $? "MAB: Ping did not work with fdb entry without locked flag" > >> + > >> + log_test "Locked port MAB" > > > > Clean up after the test to revert to initial state: > > > > bridge fdb del `mac_get $h1` dev $swp1 master > > bridge link set dev $swp1 locked off > > > > > >> +} > >> trap cleanup EXIT > >> > >> setup_prepare > >> -- > >> 2.30.2 > >>