From patchwork Fri Aug 26 11:45:38 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hans Schultz X-Patchwork-Id: 12955940 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E09CBECAAD4 for ; Fri, 26 Aug 2022 12:14:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=yMi1FFQxuh2LKu8YA2HCdSIxkFJ/KJMZ3lMqSJbMzNk=; b=YkL4k52uBs9+qp ewQrraybWrbuPEmdtH3r4oP2lrlx0iHg4c9q/7GFseRXQMEJ1LbPixh6qKWb76AR3oGC9CdrIP9Gg sVYZDFrFEZCwVxUJ/HWfuvl8J7bmIfSiHa9xDsRhRjEWJd6qr64OeHD7U9lBOKKriyTkwz0kFQGvQ g71N3bMRHsPjCapSOG0O7T3bh/6X2WC4bJW9RzHxRmxmtxOUcdcbPAHgRrRL6elbcSztU/TpiwJMA hRDIjJ/iy8VIbSRjmKeA0V252zDrha1TZev33M3Lk/yr8aN2BOv1JXA6Vbem3hkASWyqiLSnRKRKj T+Tn+p4KirnVjAjqqybA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1oRYDW-002TIs-4W; Fri, 26 Aug 2022 12:13:42 +0000 Received: from mailout-taastrup.gigahost.dk ([46.183.139.199]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1oRYDS-002TBx-FH for linux-arm-kernel@lists.infradead.org; Fri, 26 Aug 2022 12:13:40 +0000 Received: from mailout.gigahost.dk (mailout.gigahost.dk [89.186.169.112]) by mailout-taastrup.gigahost.dk (Postfix) with ESMTP id 83A1F1888676; Fri, 26 Aug 2022 12:02:30 +0000 (UTC) Received: from smtp.gigahost.dk (smtp.gigahost.dk [89.186.169.109]) by mailout.gigahost.dk (Postfix) with ESMTP id 7AA6425032BD; Fri, 26 Aug 2022 12:02:30 +0000 (UTC) Received: by smtp.gigahost.dk (Postfix, from userid 1000) id 21D369EC0004; Fri, 26 Aug 2022 11:46:14 +0000 (UTC) X-Screener-Id: 413d8c6ce5bf6eab4824d0abaab02863e8e3f662 Received: from wse-c0127.beijerelectronics.com (unknown [208.127.141.28]) by smtp.gigahost.dk (Postfix) with ESMTPSA id DB2899EC0009; Fri, 26 Aug 2022 11:46:11 +0000 (UTC) From: Hans Schultz To: davem@davemloft.net, kuba@kernel.org Cc: netdev@vger.kernel.org, Hans Schultz , Florian Fainelli , Andrew Lunn , Vivien Didelot , Vladimir Oltean , Eric Dumazet , Paolo Abeni , Kurt Kanzenbach , Hauke Mehrtens , Woojung Huh , UNGLinuxDriver@microchip.com, Sean Wang , Landen Chao , DENG Qingfang , Matthias Brugger , Claudiu Manoil , Alexandre Belloni , Jiri Pirko , Ivan Vecera , Roopa Prabhu , Nikolay Aleksandrov , Shuah Khan , Christian Marangi , Daniel Borkmann , Yuwei Wang , Ido Schimmel , linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, bridge@lists.linux-foundation.org, linux-kselftest@vger.kernel.org Subject: [PATCH v5 net-next 6/6] selftests: forwarding: add test of MAC-Auth Bypass to locked port tests Date: Fri, 26 Aug 2022 13:45:38 +0200 Message-Id: <20220826114538.705433-7-netdev@kapio-technology.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20220826114538.705433-1-netdev@kapio-technology.com> References: <20220826114538.705433-1-netdev@kapio-technology.com> MIME-Version: 1.0 Organization: Westermo Network Technologies AB X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220826_051338_677778_D069B62F X-CRM114-Status: GOOD ( 13.88 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Verify that the MAC-Auth mechanism works by adding a FDB entry with the locked flag set, denying access until the FDB entry is replaced with a FDB entry without the locked flag set. Also add a test that verifies that sticky FDB entries cannot roam. Signed-off-by: Hans Schultz --- .../net/forwarding/bridge_locked_port.sh | 107 +++++++++++++++++- .../net/forwarding/bridge_sticky_fdb.sh | 21 +++- 2 files changed, 126 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/net/forwarding/bridge_locked_port.sh b/tools/testing/selftests/net/forwarding/bridge_locked_port.sh index 5b02b6b60ce7..b763b3b9fdf0 100755 --- a/tools/testing/selftests/net/forwarding/bridge_locked_port.sh +++ b/tools/testing/selftests/net/forwarding/bridge_locked_port.sh @@ -1,7 +1,15 @@ #!/bin/bash # SPDX-License-Identifier: GPL-2.0 -ALL_TESTS="locked_port_ipv4 locked_port_ipv6 locked_port_vlan" +ALL_TESTS=" + locked_port_ipv4 + locked_port_ipv6 + locked_port_vlan + locked_port_mab + locked_port_station_move + locked_port_mab_station_move +" + NUM_NETIFS=4 CHECK_TC="no" source lib.sh @@ -166,6 +174,103 @@ locked_port_ipv6() log_test "Locked port ipv6" } +locked_port_mab() +{ + RET=0 + check_locked_port_support || return 0 + + ping_do $h1 192.0.2.2 + check_err $? "MAB: Ping did not work before locking port" + + bridge link set dev $swp1 locked on + bridge link set dev $swp1 learning on + if ! bridge link set dev $swp1 mab on 2>/dev/null; then + echo "SKIP: iproute2 too old; MacAuth feature not supported." + return $ksft_skip + fi + + ping_do $h1 192.0.2.2 + check_fail $? "MAB: Ping worked on locked port without FDB entry" + + bridge fdb show | grep `mac_get $h1` | grep -q "locked" + check_err $? "MAB: No locked fdb entry after ping on locked port" + + bridge fdb replace `mac_get $h1` dev $swp1 master static + + ping_do $h1 192.0.2.2 + check_err $? "MAB: Ping did not work with fdb entry without locked flag" + + bridge fdb del `mac_get $h1` dev $swp1 master + bridge link set dev $swp1 learning off + bridge link set dev $swp1 locked off + + log_test "Locked port MAB" +} + +# No roaming allowed to a simple locked port +locked_port_station_move() +{ + local mac=a0:b0:c0:c0:b0:a0 + + RET=0 + check_locked_port_support || return 0 + + bridge link set dev $swp1 locked on + bridge link set dev $swp1 learning on + + $MZ $h1 -q -t udp -a $mac -b rand + bridge fdb show dev $swp1 | grep -q "$mac vlan 1 master br0" + check_fail $? "Locked port station move: FDB entry on first injection" + + $MZ $h2 -q -t udp -a $mac -b rand + bridge fdb show dev $swp2 | grep -q "$mac vlan 1 master br0" + check_err $? "Locked port station move: Entry not found on unlocked port" + + $MZ $h1 -q -t udp -a $mac -b rand + bridge fdb show dev $swp1 | grep -q "$mac vlan 1 master br0" + check_fail $? "Locked port station move: entry roamed to locked port" + + log_test "Locked port station move" +} + +# Roaming to and from a MAB enabled port should work if sticky flag is not set +locked_port_mab_station_move() +{ + local mac=10:20:30:30:20:10 + + RET=0 + check_locked_port_support || return 0 + + bridge link set dev $swp1 locked on + bridge link set dev $swp1 learning on + if ! bridge link set dev $swp1 mab on 2>/dev/null; then + echo "SKIP: iproute2 too old; MacAuth feature not supported." + return $ksft_skip + fi + + $MZ $h1 -q -t udp -a $mac -b rand + if bridge fdb show dev $swp1 | grep -q "$mac vlan 1 master br0" | grep -q sticky; then + echo "SKIP: Roaming not possible with sticky flag, run sticky flag roaming test" + return $ksft_skip + fi + + bridge fdb show dev $swp1 | grep -q "$mac vlan 1 master br0 locked" + check_err $? "MAB station move: no locked entry on first injection" + + $MZ $h2 -q -t udp -a $mac -b rand + bridge fdb show dev $swp1 | grep -q "$mac vlan 1 master br0 locked" + check_fail $? "MAB station move: locked entry did not move" + + bridge fdb show dev $swp2 | grep -q "$mac vlan 1 master br0" + check_err $? "MAB station move: roamed entry not found" + + $MZ $h1 -q -t udp -a $mac -b rand + bridge fdb show dev $swp1 | grep -q "$mac vlan 1 master br0 locked" + check_err $? "MAB station move: entry did not roam back to locked port" + + log_test "Locked port MAB station move" +} + trap cleanup EXIT setup_prepare diff --git a/tools/testing/selftests/net/forwarding/bridge_sticky_fdb.sh b/tools/testing/selftests/net/forwarding/bridge_sticky_fdb.sh index 1f8ef0eff862..bca77bc3fe09 100755 --- a/tools/testing/selftests/net/forwarding/bridge_sticky_fdb.sh +++ b/tools/testing/selftests/net/forwarding/bridge_sticky_fdb.sh @@ -1,7 +1,7 @@ #!/bin/bash # SPDX-License-Identifier: GPL-2.0 -ALL_TESTS="sticky" +ALL_TESTS="sticky sticky_no_roaming" NUM_NETIFS=4 TEST_MAC=de:ad:be:ef:13:37 source lib.sh @@ -59,6 +59,25 @@ sticky() log_test "Sticky fdb entry" } +# No roaming allowed with the sticky flag set +sticky_no_roaming() +{ + local mac=a8:b4:c2:c2:b4:a8 + + RET=0 + + bridge link set dev $swp2 learning on + bridge fdb add $mac dev $swp1 master static sticky + bridge fdb show dev $swp1 | grep "$mac master br0" | grep -q sticky + check_err $? "Sticky no roaming: No sticky FDB entry found after adding" + + $MZ $h2 -q -t udp -c 10 -d 100msec -a $mac -b rand + bridge fdb show dev $swp2 | grep "$mac master br0" | grep -q sticky + check_fail $? "Sticky no roaming: Sticky entry roamed" + + log_test "Sticky no roaming" +} + trap cleanup EXIT setup_prepare