From patchwork Fri Feb 18 15:51:44 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hans S X-Patchwork-Id: 544130 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4FC99C433EF for ; Fri, 18 Feb 2022 15:52:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236172AbiBRPxJ (ORCPT ); Fri, 18 Feb 2022 10:53:09 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:44138 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234411AbiBRPxI (ORCPT ); Fri, 18 Feb 2022 10:53:08 -0500 Received: from mail-lj1-x22b.google.com (mail-lj1-x22b.google.com [IPv6:2a00:1450:4864:20::22b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 508F3254A40; Fri, 18 Feb 2022 07:52:51 -0800 (PST) Received: by mail-lj1-x22b.google.com with SMTP id e17so4941906ljk.5; Fri, 18 Feb 2022 07:52:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:organization:content-transfer-encoding; bh=Rcw7NVVt+xRbTVt1okgnvV9SIVxrg6UkjeCztqi7ITU=; b=KswQTuqsXHsf71yw2us6jf45qIUFVvmq5HJ70pvj+MnUib22LlFiRJpb9QzRlcm0uM v/dweD4d/yJM3pPeovi7nbuXwzEpMETVAi4YoAsWKdAKLiS1cjpAAaoyMbCEWfsBX6mJ fIp8AVm49GQQav/mFdJUKUZtMf3hI9Jt+wrKb9cXySLciQdT9gKKQh1ZbnZDiC8u7X+0 kTjopeRSndk4qxKHWxRAhrSY7SR6V6awvqIEXUD/gFxnJeKwytOqzRPJeXFJtAtXZdAI jCuJf5hXXV2WV0cUG+QoXNFQZRb1t2lzDXP9mBKpBhlzM6OVDVH0pEYs4gCLWP7qnUeI /RUA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:organization:content-transfer-encoding; bh=Rcw7NVVt+xRbTVt1okgnvV9SIVxrg6UkjeCztqi7ITU=; b=0kltfcWqXKVvkEhMwPfIQDMuLnH4iYyJLNP98kvL0O7YcGeVHZNK9mnM23jm8E4B+a k/oIFOWqmxdWRYC+m/ZgLHVKwPz328NWkGoPjRUl8BiipKoK2uTCWxdQVLnJZ+O9EgH+ A7Zodwzwngj0sVheo6+8jAAbwnFEJ7eRyDEzEaoU8gNKHg1NjjikYg4fZVrLsTGPUgn5 Ry7yYWPM8943AxoHiXd8BzfkLTXn8HyQr7sFq/CxZsgYRGmjc+vwU9pfZNdkDFzk1wBw EP/P1J4JIbSFKKAAc1W8YWVrdeQ1t5XiN0QH4XBTn2b0lI9qCxvCzJj98NifqmKHcok3 RAVQ== X-Gm-Message-State: AOAM533Q7sxSiA00qKLt2QbcE7ygY/Upzi1CNMsY/1pSbIw3s2k8Q0nw ZW9CDvciPwxwKAks7bjfqK4= X-Google-Smtp-Source: ABdhPJxryYPsXz9kvcRMAoXstAX3zms+hQSPwRHTw0l1sNmRhX0nUzolDBUK/pzrGY+R5tNY352NGw== X-Received: by 2002:a05:651c:90b:b0:244:c4a4:d5d8 with SMTP id e11-20020a05651c090b00b00244c4a4d5d8mr5928922ljq.97.1645199569692; Fri, 18 Feb 2022 07:52:49 -0800 (PST) Received: from wse-c0127.beijerelectronics.com ([208.127.141.29]) by smtp.gmail.com with ESMTPSA id v11sm295453lfr.3.2022.02.18.07.52.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 18 Feb 2022 07:52:49 -0800 (PST) From: Hans Schultz X-Google-Original-From: Hans Schultz To: davem@davemloft.net, kuba@kernel.org Cc: netdev@vger.kernel.org, Hans Schultz , Andrew Lunn , Vivien Didelot , Florian Fainelli , Vladimir Oltean , Roopa Prabhu , Nikolay Aleksandrov , Shuah Khan , Stephen Suryaputra , David Ahern , Ido Schimmel , Petr Machata , Amit Cohen , Po-Hsu Lin , Baowen Zheng , linux-kernel@vger.kernel.org, bridge@lists.linux-foundation.org, linux-kselftest@vger.kernel.org Subject: [PATCH net-next v3 1/5] net: bridge: Add support for bridge port in locked mode Date: Fri, 18 Feb 2022 16:51:44 +0100 Message-Id: <20220218155148.2329797-2-schultz.hans+netdev@gmail.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20220218155148.2329797-1-schultz.hans+netdev@gmail.com> References: <20220218155148.2329797-1-schultz.hans+netdev@gmail.com> MIME-Version: 1.0 Organization: Westermo Network Technologies AB Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org In a 802.1X scenario, clients connected to a bridge port shall not be allowed to have traffic forwarded until fully authenticated. A static fdb entry of the clients MAC address for the bridge port unlocks the client and allows bidirectional communication. This scenario is facilitated with setting the bridge port in locked mode, which is also supported by various switchcore chipsets. Signed-off-by: Hans Schultz Reviewed-by: Ido Schimmel --- include/linux/if_bridge.h | 1 + include/uapi/linux/if_link.h | 1 + net/bridge/br_input.c | 10 +++++++++- net/bridge/br_netlink.c | 6 +++++- 4 files changed, 16 insertions(+), 2 deletions(-) diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h index 509e18c7e740..3aae023a9353 100644 --- a/include/linux/if_bridge.h +++ b/include/linux/if_bridge.h @@ -58,6 +58,7 @@ struct br_ip_list { #define BR_MRP_LOST_CONT BIT(18) #define BR_MRP_LOST_IN_CONT BIT(19) #define BR_TX_FWD_OFFLOAD BIT(20) +#define BR_PORT_LOCKED BIT(21) #define BR_DEFAULT_AGEING_TIME (300 * HZ) diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h index 6218f93f5c1a..a45cc0a1f415 100644 --- a/include/uapi/linux/if_link.h +++ b/include/uapi/linux/if_link.h @@ -537,6 +537,7 @@ enum { IFLA_BRPORT_MRP_IN_OPEN, IFLA_BRPORT_MCAST_EHT_HOSTS_LIMIT, IFLA_BRPORT_MCAST_EHT_HOSTS_CNT, + IFLA_BRPORT_LOCKED, __IFLA_BRPORT_MAX }; #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1) diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c index b50382f957c1..e99f635ff727 100644 --- a/net/bridge/br_input.c +++ b/net/bridge/br_input.c @@ -81,6 +81,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb if (!p || p->state == BR_STATE_DISABLED) goto drop; + br = p->br; brmctx = &p->br->multicast_ctx; pmctx = &p->multicast_ctx; state = p->state; @@ -88,10 +89,17 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb &state, &vlan)) goto out; + if (p->flags & BR_PORT_LOCKED) { + struct net_bridge_fdb_entry *fdb_src = + br_fdb_find_rcu(br, eth_hdr(skb)->h_source, vid); + if (!fdb_src || READ_ONCE(fdb_src->dst) != p || + test_bit(BR_FDB_LOCAL, &fdb_src->flags)) + goto drop; + } + nbp_switchdev_frame_mark(p, skb); /* insert into forwarding database after filtering to avoid spoofing */ - br = p->br; if (p->flags & BR_LEARNING) br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, 0); diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c index 2ff83d84230d..7d4432ca9a20 100644 --- a/net/bridge/br_netlink.c +++ b/net/bridge/br_netlink.c @@ -184,6 +184,7 @@ static inline size_t br_port_info_size(void) + nla_total_size(1) /* IFLA_BRPORT_VLAN_TUNNEL */ + nla_total_size(1) /* IFLA_BRPORT_NEIGH_SUPPRESS */ + nla_total_size(1) /* IFLA_BRPORT_ISOLATED */ + + nla_total_size(1) /* IFLA_BRPORT_LOCKED */ + nla_total_size(sizeof(struct ifla_bridge_id)) /* IFLA_BRPORT_ROOT_ID */ + nla_total_size(sizeof(struct ifla_bridge_id)) /* IFLA_BRPORT_BRIDGE_ID */ + nla_total_size(sizeof(u16)) /* IFLA_BRPORT_DESIGNATED_PORT */ @@ -269,7 +270,8 @@ static int br_port_fill_attrs(struct sk_buff *skb, BR_MRP_LOST_CONT)) || nla_put_u8(skb, IFLA_BRPORT_MRP_IN_OPEN, !!(p->flags & BR_MRP_LOST_IN_CONT)) || - nla_put_u8(skb, IFLA_BRPORT_ISOLATED, !!(p->flags & BR_ISOLATED))) + nla_put_u8(skb, IFLA_BRPORT_ISOLATED, !!(p->flags & BR_ISOLATED)) || + nla_put_u8(skb, IFLA_BRPORT_LOCKED, !!(p->flags & BR_PORT_LOCKED))) return -EMSGSIZE; timerval = br_timer_value(&p->message_age_timer); @@ -827,6 +829,7 @@ static const struct nla_policy br_port_policy[IFLA_BRPORT_MAX + 1] = { [IFLA_BRPORT_GROUP_FWD_MASK] = { .type = NLA_U16 }, [IFLA_BRPORT_NEIGH_SUPPRESS] = { .type = NLA_U8 }, [IFLA_BRPORT_ISOLATED] = { .type = NLA_U8 }, + [IFLA_BRPORT_LOCKED] = { .type = NLA_U8 }, [IFLA_BRPORT_BACKUP_PORT] = { .type = NLA_U32 }, [IFLA_BRPORT_MCAST_EHT_HOSTS_LIMIT] = { .type = NLA_U32 }, }; @@ -893,6 +896,7 @@ static int br_setport(struct net_bridge_port *p, struct nlattr *tb[], br_set_port_flag(p, tb, IFLA_BRPORT_VLAN_TUNNEL, BR_VLAN_TUNNEL); br_set_port_flag(p, tb, IFLA_BRPORT_NEIGH_SUPPRESS, BR_NEIGH_SUPPRESS); br_set_port_flag(p, tb, IFLA_BRPORT_ISOLATED, BR_ISOLATED); + br_set_port_flag(p, tb, IFLA_BRPORT_LOCKED, BR_PORT_LOCKED); changed_mask = old_flags ^ p->flags; From patchwork Fri Feb 18 15:51:45 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hans S X-Patchwork-Id: 543947 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A5115C433F5 for ; Fri, 18 Feb 2022 15:53:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237277AbiBRPxS (ORCPT ); Fri, 18 Feb 2022 10:53:18 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:44838 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237281AbiBRPxQ (ORCPT ); Fri, 18 Feb 2022 10:53:16 -0500 Received: from mail-lf1-x136.google.com (mail-lf1-x136.google.com [IPv6:2a00:1450:4864:20::136]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4FCA62B319A; Fri, 18 Feb 2022 07:52:58 -0800 (PST) Received: by mail-lf1-x136.google.com with SMTP id i11so6294968lfu.3; Fri, 18 Feb 2022 07:52:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:organization:content-transfer-encoding; bh=C074Ts6t1RuR/7tYyDWuvKC2BHBuBtLTBdnTVQAyV3k=; b=iwfCoLafgG9YVKvV7zo8I8SL8yF6TiOcM8BFJrMe1xkCw4BADvUTqPrpxBwb/uipbS o6MKYERLMZeEr1Q2SvSAg4Wcv0g/ma3fWCOa9IS/Be+/8LzmTrfFnv9hFVMkZB/DxHGT hRXi7MSSw14vn241aMy0fXph+8OwcZygLZ6WTabZWP4THo1j83Pj/Hpzai6goXcwe15u I1hl2KQNdzbFrfQgjZpGtWw7p4RwIPKyirv1BCmSsisKbh1Zu+8cQN5IT57459jAzh6u 1/osLqneFyc3ffWmmJKZmdnoOaguwG7Ad44FGamwS2PP9DHtHsFW55YAeGQ/Xb5fxSnj 7OcQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:organization:content-transfer-encoding; bh=C074Ts6t1RuR/7tYyDWuvKC2BHBuBtLTBdnTVQAyV3k=; b=1RpYkhpMmULR494SwkS3JBbzo0ZDc/nyQ7wfZxA/5YMt6Vp+NU/5RLf5WtAs2/AKwf sazlmIE6PNS5Uw8iSRdrK7K9DQUQ/xSRx/+iC551EwcZK/QWywvy4KQYhZBXyYaVDUhB c3FmXZv6UR1O4MktcL44FzWmeGrLDfMPIML3dsi6pYqFKl+giaG2aImXlFS17h3iiua+ +x2KZn2jSDs8wBOWuxe8fO3rRyIIELR4kn11xGJTJK9uFSfEyDEm1IyiOCBaQhLMinc7 7DTW8a2liXx2me8iIWYHMi0UwqR32QAJrl5ADuv/wJ0/5l9H1tI0VXeGEzcomIB0Xo9E N/ew== X-Gm-Message-State: AOAM532ocPcCTP/kQnR9oN/5DJ6Ojrx1zR4a4CK0DLK6DC/6fLtK9edI oAV5yy1UNrChT32jxX2QrcWmOjTlG50ogegRLak= X-Google-Smtp-Source: ABdhPJz4M8NgeOX3Pm7KGmB8ZCsSG+kHcEQK+VJJrpAaHwURKRhLlaxHlzEd735Go8HQL30Eq6v/Lw== X-Received: by 2002:a19:f009:0:b0:443:b0ee:8599 with SMTP id p9-20020a19f009000000b00443b0ee8599mr3589761lfc.34.1645199576681; Fri, 18 Feb 2022 07:52:56 -0800 (PST) Received: from wse-c0127.beijerelectronics.com ([208.127.141.29]) by smtp.gmail.com with ESMTPSA id v11sm295453lfr.3.2022.02.18.07.52.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 18 Feb 2022 07:52:56 -0800 (PST) From: Hans Schultz X-Google-Original-From: Hans Schultz To: davem@davemloft.net, kuba@kernel.org Cc: netdev@vger.kernel.org, Hans Schultz , Andrew Lunn , Vivien Didelot , Florian Fainelli , Vladimir Oltean , Roopa Prabhu , Nikolay Aleksandrov , Shuah Khan , Stephen Suryaputra , David Ahern , Ido Schimmel , Petr Machata , Amit Cohen , Po-Hsu Lin , Baowen Zheng , linux-kernel@vger.kernel.org, bridge@lists.linux-foundation.org, linux-kselftest@vger.kernel.org Subject: [PATCH net-next v3 2/5] net: bridge: Add support for offloading of locked port flag Date: Fri, 18 Feb 2022 16:51:45 +0100 Message-Id: <20220218155148.2329797-3-schultz.hans+netdev@gmail.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20220218155148.2329797-1-schultz.hans+netdev@gmail.com> References: <20220218155148.2329797-1-schultz.hans+netdev@gmail.com> MIME-Version: 1.0 Organization: Westermo Network Technologies AB Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org Various switchcores support setting ports in locked mode, so that clients behind locked ports cannot send traffic through the port unless a fdb entry is added with the clients MAC address. Signed-off-by: Hans Schultz Acked-by: Nikolay Aleksandrov Reviewed-by: Ido Schimmel --- net/bridge/br_switchdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/bridge/br_switchdev.c b/net/bridge/br_switchdev.c index f8fbaaa7c501..bf549fc22556 100644 --- a/net/bridge/br_switchdev.c +++ b/net/bridge/br_switchdev.c @@ -72,7 +72,7 @@ bool nbp_switchdev_allowed_egress(const struct net_bridge_port *p, /* Flags that can be offloaded to hardware */ #define BR_PORT_FLAGS_HW_OFFLOAD (BR_LEARNING | BR_FLOOD | \ - BR_MCAST_FLOOD | BR_BCAST_FLOOD) + BR_MCAST_FLOOD | BR_BCAST_FLOOD | BR_PORT_LOCKED) int br_switchdev_set_port_flag(struct net_bridge_port *p, unsigned long flags, From patchwork Fri Feb 18 15:51:46 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hans S X-Patchwork-Id: 544129 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C088FC433EF for ; Fri, 18 Feb 2022 15:53:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234545AbiBRPxc (ORCPT ); Fri, 18 Feb 2022 10:53:32 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:45904 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237288AbiBRPxa (ORCPT ); Fri, 18 Feb 2022 10:53:30 -0500 Received: from mail-lf1-x136.google.com (mail-lf1-x136.google.com [IPv6:2a00:1450:4864:20::136]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BB01F2B4D80; Fri, 18 Feb 2022 07:53:09 -0800 (PST) Received: by mail-lf1-x136.google.com with SMTP id bu29so6386249lfb.0; Fri, 18 Feb 2022 07:53:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:organization:content-transfer-encoding; bh=xsR/hKbVC0DUFloHcPTPuu9npcAFNkMVex8QVbhOYjs=; b=PgVAF2CFxXClr7XtfIleyOCx+Gi9xnzlboqeOO6fOXSA4GfJD2Ha0fAgYXYPdDHteC vVpqeRpulaJTSnmFzPLBnW61aOBN8o/IHCO1jXT5f+Dl4hdm0GITuRs6lSQLQoK2PC/g pIIRO1x/od0SMlwA9qsptKJvUIuTiHb5ffM7Q3KwGC6EpDsKd5SmiSTUCqfUN4cKVXzD CyL3Zbh+2JNub0wD9nXiGQtIYWWRQmbJfNpp/OfwYI9X8R6GLysRgcKKwAGrzcDbNCib eD0KcsEZSDdTLX5/zZb+U2TCtTLJz+1//jTSo2e7/4HBAK9JuKLsqvps2AB9GiceJPNl Ekjw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:organization:content-transfer-encoding; bh=xsR/hKbVC0DUFloHcPTPuu9npcAFNkMVex8QVbhOYjs=; b=JoMdjTMCyBsHuoQbgb8hpKXCOKY+V3Scgg2idV/vhfWK3++0msMwTOWAgt6ut2SBIE BTdt3wfI5WGVDZyLXi+WPNWrz8hs/6QsdSdZ078mTK1UXi4Yv0urWch28lbSvJlWSfL1 flbgvt/ZxfnoEElITyDnzHVv3uWHgBhxux9eg+dgAc5bZgsUjA8vCljeYzOD+zsoVWRU o9TI8O5ZS2OloN36xvG92g8uQWN/WXwtzpUHZc53nDmBEJthWAJbKAu+y/VPZMSWXCEL TUmtJmX9X3Qvjs1LYeE74bA/4C67Kr7N1ReFfFkI9qm8nsKmnXU/S5y6UFp7wmyYyyZv gH+g== X-Gm-Message-State: AOAM530J50PL1eEIIFJSTrlOkh8Fph/LgxP5MKqvzM3Lt+FTCZjShJ5l rT1U4tDdCx/+5ffIXyHo8GA= X-Google-Smtp-Source: ABdhPJxf1VgdE9FjUrG2Oi4IAPd+jiHT04vxuDLYzDhWK7uJvLNPkAjxOe6PtwjlzS+9t2RKS3e9vQ== X-Received: by 2002:a19:7605:0:b0:443:1126:3756 with SMTP id c5-20020a197605000000b0044311263756mr5774248lff.641.1645199588095; Fri, 18 Feb 2022 07:53:08 -0800 (PST) Received: from wse-c0127.beijerelectronics.com ([208.127.141.29]) by smtp.gmail.com with ESMTPSA id v11sm295453lfr.3.2022.02.18.07.53.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 18 Feb 2022 07:53:07 -0800 (PST) From: Hans Schultz X-Google-Original-From: Hans Schultz To: davem@davemloft.net, kuba@kernel.org Cc: netdev@vger.kernel.org, Hans Schultz , Andrew Lunn , Vivien Didelot , Florian Fainelli , Vladimir Oltean , Roopa Prabhu , Nikolay Aleksandrov , Shuah Khan , Stephen Suryaputra , David Ahern , Ido Schimmel , Petr Machata , Amit Cohen , Po-Hsu Lin , Baowen Zheng , linux-kernel@vger.kernel.org, bridge@lists.linux-foundation.org, linux-kselftest@vger.kernel.org Subject: [PATCH net-next v3 3/5] net: dsa: Add support for offloaded locked port flag Date: Fri, 18 Feb 2022 16:51:46 +0100 Message-Id: <20220218155148.2329797-4-schultz.hans+netdev@gmail.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20220218155148.2329797-1-schultz.hans+netdev@gmail.com> References: <20220218155148.2329797-1-schultz.hans+netdev@gmail.com> MIME-Version: 1.0 Organization: Westermo Network Technologies AB Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org Among the switchcores that support this feature is the Marvell mv88e6xxx family. Signed-off-by: Hans Schultz --- net/dsa/port.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/dsa/port.c b/net/dsa/port.c index bd78192e0e47..01ed22ed74a1 100644 --- a/net/dsa/port.c +++ b/net/dsa/port.c @@ -176,7 +176,7 @@ static int dsa_port_inherit_brport_flags(struct dsa_port *dp, struct netlink_ext_ack *extack) { const unsigned long mask = BR_LEARNING | BR_FLOOD | BR_MCAST_FLOOD | - BR_BCAST_FLOOD; + BR_BCAST_FLOOD | BR_PORT_LOCKED; struct net_device *brport_dev = dsa_port_to_bridge_port(dp); int flag, err; @@ -200,7 +200,7 @@ static void dsa_port_clear_brport_flags(struct dsa_port *dp) { const unsigned long val = BR_FLOOD | BR_MCAST_FLOOD | BR_BCAST_FLOOD; const unsigned long mask = BR_LEARNING | BR_FLOOD | BR_MCAST_FLOOD | - BR_BCAST_FLOOD; + BR_BCAST_FLOOD | BR_PORT_LOCKED; int flag, err; for_each_set_bit(flag, &mask, 32) { From patchwork Fri Feb 18 15:51:47 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hans S X-Patchwork-Id: 543946 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65059C433EF for ; Fri, 18 Feb 2022 15:53:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237316AbiBRPxo (ORCPT ); Fri, 18 Feb 2022 10:53:44 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:47114 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237273AbiBRPxm (ORCPT ); Fri, 18 Feb 2022 10:53:42 -0500 Received: from mail-lf1-x130.google.com (mail-lf1-x130.google.com [IPv6:2a00:1450:4864:20::130]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5C51A272D95; Fri, 18 Feb 2022 07:53:19 -0800 (PST) Received: by mail-lf1-x130.google.com with SMTP id b9so6272314lfv.7; Fri, 18 Feb 2022 07:53:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:organization:content-transfer-encoding; bh=pe7DtCHDCmLRwyE/qHTyP5z+rDV+SzCi98cUiAV5b/4=; b=Fv7QJcyGriYpIrAjds8vlp5zMhjOy9wVM+dvvFiid3g2j0XoAXnynXE+rJyOVPmo07 bYt1+BjUHRsiz5qZNIfS7G2IxWkmjmV4nbAlC+ao+/NJ0urGXNlCZofWgOgMNK7HmVih vKp0fceLxj+gk+xlc41FEm/lTkHk5Xn+ir07CApg2gMkD/SH3MLJYJhlZJKaRvmSiu53 dz84Ap35uW3CFJ1glbh1mETbpIzBbBY42JKfAENcIbe8RdIv+WtZIbBrYgXqDy53bQu+ DHL6zp6BhpTh9WXBs2tBFWQW5gIVRAU4vJXRDeibZTVqQS/54QHlIUmf6GsddjYHeW62 5kBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:organization:content-transfer-encoding; bh=pe7DtCHDCmLRwyE/qHTyP5z+rDV+SzCi98cUiAV5b/4=; b=k8MqILv5sSRC/IgPg9HrvVShkwdT5+wd8oQFEaz3QLciZZIu0FeykFcMTAKdcm/+FI KgzN4Ml7Tl59/Q+DIGDhpXyq+5tSS54adYoGserSC+VmqbAjYpcss8Fq4TntCTz+mpVY xAxcFXHYMudz+8b6qsuloiFnjHgV9i8jJxrmLUDgn1YPKBD0q8kqSFw83vp3MSgaFnGx GaBsHj+DIxx1t5vJa5MhFi3dNJkDD8Tp4bb5Pkq6qpaqd/ZPC+SZ8mdSZOyT8dUjjTnb YN4XRhOVHbaua25LRxr6XJOWUQaH1adIC2vNRBABdvIKgMDM8add5IMl8UMf1o3Dhsoe zJ1Q== X-Gm-Message-State: AOAM530olsRAEX10TjBot214KmxmZR6Pny8jiViS3ROAsD6Bdn4VFyyF MQhYp6A6VroTN+FqIAeMoA0= X-Google-Smtp-Source: ABdhPJzDS4V2syfnTKcCTFbVQOsoDsQ4wpiSbJ5RpmfK6xrg+H26ZXoNOGx2NsTx1GAoVoo+95qrjA== X-Received: by 2002:a05:6512:214e:b0:443:1469:c8b0 with SMTP id s14-20020a056512214e00b004431469c8b0mr5893383lfr.518.1645199597543; Fri, 18 Feb 2022 07:53:17 -0800 (PST) Received: from wse-c0127.beijerelectronics.com ([208.127.141.29]) by smtp.gmail.com with ESMTPSA id v11sm295453lfr.3.2022.02.18.07.53.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 18 Feb 2022 07:53:17 -0800 (PST) From: Hans Schultz X-Google-Original-From: Hans Schultz To: davem@davemloft.net, kuba@kernel.org Cc: netdev@vger.kernel.org, Hans Schultz , Andrew Lunn , Vivien Didelot , Florian Fainelli , Vladimir Oltean , Roopa Prabhu , Nikolay Aleksandrov , Shuah Khan , Stephen Suryaputra , David Ahern , Ido Schimmel , Petr Machata , Amit Cohen , Po-Hsu Lin , Baowen Zheng , linux-kernel@vger.kernel.org, bridge@lists.linux-foundation.org, linux-kselftest@vger.kernel.org Subject: [PATCH net-next v3 4/5] net: dsa: mv88e6xxx: Add support for bridge port locked mode Date: Fri, 18 Feb 2022 16:51:47 +0100 Message-Id: <20220218155148.2329797-5-schultz.hans+netdev@gmail.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20220218155148.2329797-1-schultz.hans+netdev@gmail.com> References: <20220218155148.2329797-1-schultz.hans+netdev@gmail.com> MIME-Version: 1.0 Organization: Westermo Network Technologies AB Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org Supporting bridge ports in locked mode using the drop on lock feature in Marvell mv88e6xxx switchcores is described in the '88E6096/88E6097/88E6097F Datasheet', sections 4.4.6, 4.4.7 and 5.1.2.1 (Drop on Lock). This feature is implemented here facilitated by the locked port flag. Signed-off-by: Hans Schultz --- drivers/net/dsa/mv88e6xxx/chip.c | 9 ++++++++- drivers/net/dsa/mv88e6xxx/port.c | 33 ++++++++++++++++++++++++++++++++ drivers/net/dsa/mv88e6xxx/port.h | 9 ++++++++- 3 files changed, 49 insertions(+), 2 deletions(-) diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c index 58ca684d73f7..eed3713b97ae 100644 --- a/drivers/net/dsa/mv88e6xxx/chip.c +++ b/drivers/net/dsa/mv88e6xxx/chip.c @@ -5881,7 +5881,7 @@ static int mv88e6xxx_port_pre_bridge_flags(struct dsa_switch *ds, int port, const struct mv88e6xxx_ops *ops; if (flags.mask & ~(BR_LEARNING | BR_FLOOD | BR_MCAST_FLOOD | - BR_BCAST_FLOOD)) + BR_BCAST_FLOOD | BR_PORT_LOCKED)) return -EINVAL; ops = chip->info->ops; @@ -5939,6 +5939,13 @@ static int mv88e6xxx_port_bridge_flags(struct dsa_switch *ds, int port, goto out; } + if (flags.mask & BR_PORT_LOCKED) { + bool locked = !!(flags.val & BR_PORT_LOCKED); + + err = mv88e6xxx_port_set_lock(chip, port, locked); + if (err) + goto out; + } out: mv88e6xxx_reg_unlock(chip); diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c index ab41619a809b..46b7381899a0 100644 --- a/drivers/net/dsa/mv88e6xxx/port.c +++ b/drivers/net/dsa/mv88e6xxx/port.c @@ -1234,6 +1234,39 @@ int mv88e6xxx_port_set_mirror(struct mv88e6xxx_chip *chip, int port, return err; } +int mv88e6xxx_port_set_lock(struct mv88e6xxx_chip *chip, int port, + bool locked) +{ + u16 reg; + int err; + + err = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_CTL0, ®); + if (err) + return err; + + reg &= ~MV88E6XXX_PORT_CTL0_SA_FILT_MASK; + if (locked) + reg |= MV88E6XXX_PORT_CTL0_SA_FILT_DROP_ON_LOCK; + + err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_CTL0, reg); + if (err) + return err; + + err = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_ASSOC_VECTOR, ®); + if (err) + return err; + + reg &= ~MV88E6XXX_PORT_ASSOC_VECTOR_LOCKED_PORT; + if (locked) + reg |= MV88E6XXX_PORT_ASSOC_VECTOR_LOCKED_PORT; + + err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_ASSOC_VECTOR, reg); + if (err) + return err; + + return 0; +} + int mv88e6xxx_port_set_8021q_mode(struct mv88e6xxx_chip *chip, int port, u16 mode) { diff --git a/drivers/net/dsa/mv88e6xxx/port.h b/drivers/net/dsa/mv88e6xxx/port.h index 03382b66f800..3f70557f0d48 100644 --- a/drivers/net/dsa/mv88e6xxx/port.h +++ b/drivers/net/dsa/mv88e6xxx/port.h @@ -142,7 +142,11 @@ /* Offset 0x04: Port Control Register */ #define MV88E6XXX_PORT_CTL0 0x04 #define MV88E6XXX_PORT_CTL0_USE_CORE_TAG 0x8000 -#define MV88E6XXX_PORT_CTL0_DROP_ON_LOCK 0x4000 +#define MV88E6XXX_PORT_CTL0_SA_FILT_MASK 0xc000 +#define MV88E6XXX_PORT_CTL0_SA_FILT_DISABLED 0x0000 +#define MV88E6XXX_PORT_CTL0_SA_FILT_DROP_ON_LOCK 0x4000 +#define MV88E6XXX_PORT_CTL0_SA_FILT_DROP_ON_UNLOCK 0x8000 +#define MV88E6XXX_PORT_CTL0_SA_FILT_DROP_ON_CPU 0xc000 #define MV88E6XXX_PORT_CTL0_EGRESS_MODE_MASK 0x3000 #define MV88E6XXX_PORT_CTL0_EGRESS_MODE_UNMODIFIED 0x0000 #define MV88E6XXX_PORT_CTL0_EGRESS_MODE_UNTAGGED 0x1000 @@ -365,6 +369,9 @@ int mv88e6xxx_port_set_fid(struct mv88e6xxx_chip *chip, int port, u16 fid); int mv88e6xxx_port_get_pvid(struct mv88e6xxx_chip *chip, int port, u16 *pvid); int mv88e6xxx_port_set_pvid(struct mv88e6xxx_chip *chip, int port, u16 pvid); +int mv88e6xxx_port_set_lock(struct mv88e6xxx_chip *chip, int port, + bool locked); + int mv88e6xxx_port_set_8021q_mode(struct mv88e6xxx_chip *chip, int port, u16 mode); int mv88e6095_port_tag_remap(struct mv88e6xxx_chip *chip, int port); From patchwork Fri Feb 18 15:51:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hans S X-Patchwork-Id: 544128 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 39C9BC433EF for ; Fri, 18 Feb 2022 15:53:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233519AbiBRPxw (ORCPT ); Fri, 18 Feb 2022 10:53:52 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:47896 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237287AbiBRPxu (ORCPT ); Fri, 18 Feb 2022 10:53:50 -0500 Received: from mail-lj1-x235.google.com (mail-lj1-x235.google.com [IPv6:2a00:1450:4864:20::235]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7160C2B31B5; Fri, 18 Feb 2022 07:53:30 -0800 (PST) Received: by mail-lj1-x235.google.com with SMTP id o9so4952806ljq.4; Fri, 18 Feb 2022 07:53:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:organization:content-transfer-encoding; bh=+Mu8RvBnev8GXTejYsZPejfoz1EIMAndo1iFiCzGtfU=; b=Ne7ve291QC1Ba2C/uEJ1kQrM/HEA0BtP4jUbz3fW5Zi43QXrH90M4ADD9g/D9y1sq2 4nDJo9rkkksFdRJVWv6+MS2HY08pNJvc9HxJfrYhVvV9PPWrroL8CWUBq6hrSm38/rRm rV/i42qonsEW7yMLJAzRVLHwFn8/KWEk1RcnscyahJaWwLDDgXR9WLSVYhtPBdFyTxay AXHj/yWPjSKpxqLvNaSYskfyqH6a3zBZkYGujTNkKkfkcBIiWJe07mo7RUMo8RonwzyL 87F7hwllYfSa5jvOSIQAL1+CIwjUDVc+JFce5Bp+Oe2LWfap7oj2nhK9djtyVILWGtOa fYxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:organization:content-transfer-encoding; bh=+Mu8RvBnev8GXTejYsZPejfoz1EIMAndo1iFiCzGtfU=; b=wSaNkuxJIs4z/gP3R7vm6HkKCBHd10qiQmT2XOKpLRpNtRfa47ELq2cmRxm3+QznwV Tpokdf2zJqovkW2rOoQvb7TMsWlRUc3juf3OC/iRVtm+zBedkoK/lx2twdbBfStzVS5b zvH2JaM0SMv2rJaFiLDzJhKIvEVRhb9O0SPpwk7EDjLd28zkynmqUDuqiX5dA1c3SEL9 thzqpRagp1BeAOXkE8XQZS2v/PXcB5kLJdLyxJfIogw+3c9t6SDU/Zgjxl9nWFBq+vfp TM1mr0fSoTaINFyFUgWRrK2vpitd/nGHrqzu1WOlDeCrNlNAdj2Eu7au+oI3Vskx74UU vfqA== X-Gm-Message-State: AOAM531y0uW26vcMJwO8xiQjKrO+8UZ1V3nKTdoLEN/SwotKnhdYoft+ /rlODLTO5AIieS+yfPuQpLk= X-Google-Smtp-Source: ABdhPJxlzT3gBFdCoywzClFF8dDbeFMFzORMD607SdJ3lZizRUrVvz9NSMNSjqfnZ1Mc3OoijizKEw== X-Received: by 2002:a2e:90c9:0:b0:244:2f8a:7aca with SMTP id o9-20020a2e90c9000000b002442f8a7acamr6152453ljg.129.1645199608751; Fri, 18 Feb 2022 07:53:28 -0800 (PST) Received: from wse-c0127.beijerelectronics.com ([208.127.141.29]) by smtp.gmail.com with ESMTPSA id v11sm295453lfr.3.2022.02.18.07.53.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 18 Feb 2022 07:53:28 -0800 (PST) From: Hans Schultz X-Google-Original-From: Hans Schultz To: davem@davemloft.net, kuba@kernel.org Cc: netdev@vger.kernel.org, Hans Schultz , Andrew Lunn , Vivien Didelot , Florian Fainelli , Vladimir Oltean , Roopa Prabhu , Nikolay Aleksandrov , Shuah Khan , Stephen Suryaputra , David Ahern , Ido Schimmel , Petr Machata , Amit Cohen , Po-Hsu Lin , Baowen Zheng , linux-kernel@vger.kernel.org, bridge@lists.linux-foundation.org, linux-kselftest@vger.kernel.org Subject: [PATCH net-next v3 5/5] selftests: forwarding: tests of locked port feature Date: Fri, 18 Feb 2022 16:51:48 +0100 Message-Id: <20220218155148.2329797-6-schultz.hans+netdev@gmail.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20220218155148.2329797-1-schultz.hans+netdev@gmail.com> References: <20220218155148.2329797-1-schultz.hans+netdev@gmail.com> MIME-Version: 1.0 Organization: Westermo Network Technologies AB Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org These tests check that the basic locked port feature works, so that no 'host' can communicate (ping) through a locked port unless the MAC address of the 'host' interface is in the forwarding database of the bridge. Signed-off-by: Hans Schultz Reviewed-by: Shuah Khan --- .../testing/selftests/net/forwarding/Makefile | 1 + .../net/forwarding/bridge_locked_port.sh | 174 ++++++++++++++++++ tools/testing/selftests/net/forwarding/lib.sh | 16 ++ 3 files changed, 191 insertions(+) create mode 100755 tools/testing/selftests/net/forwarding/bridge_locked_port.sh diff --git a/tools/testing/selftests/net/forwarding/Makefile b/tools/testing/selftests/net/forwarding/Makefile index 72ee644d47bf..8fa97ae9af9e 100644 --- a/tools/testing/selftests/net/forwarding/Makefile +++ b/tools/testing/selftests/net/forwarding/Makefile @@ -1,6 +1,7 @@ # SPDX-License-Identifier: GPL-2.0+ OR MIT TEST_PROGS = bridge_igmp.sh \ + bridge_locked_port.sh \ bridge_port_isolation.sh \ bridge_sticky_fdb.sh \ bridge_vlan_aware.sh \ diff --git a/tools/testing/selftests/net/forwarding/bridge_locked_port.sh b/tools/testing/selftests/net/forwarding/bridge_locked_port.sh new file mode 100755 index 000000000000..d2805441b325 --- /dev/null +++ b/tools/testing/selftests/net/forwarding/bridge_locked_port.sh @@ -0,0 +1,174 @@ +#!/bin/bash +# SPDX-License-Identifier: GPL-2.0 + +ALL_TESTS="locked_port_ipv4 locked_port_ipv6 locked_port_vlan" +NUM_NETIFS=4 +CHECK_TC="no" +source lib.sh + +h1_create() +{ + simple_if_init $h1 192.0.2.1/24 2001:db8:1::1/64 + vrf_create "vrf-vlan-h1" + ip link set dev vrf-vlan-h1 up + vlan_create $h1 100 vrf-vlan-h1 192.0.3.1/24 2001:db8:3::1/64 +} + +h1_destroy() +{ + vlan_destroy $h1 100 + simple_if_fini $h1 192.0.2.1/24 2001:db8:1::1/64 +} + +h2_create() +{ + simple_if_init $h2 192.0.2.2/24 2001:db8:1::2/64 + vrf_create "vrf-vlan-h2" + ip link set dev vrf-vlan-h2 up + vlan_create $h2 100 vrf-vlan-h2 192.0.3.2/24 2001:db8:3::2/64 +} + +h2_destroy() +{ + vlan_destroy $h2 100 + simple_if_fini $h2 192.0.2.2/24 2001:db8:1::2/64 +} + +switch_create() +{ + ip link add dev br0 type bridge vlan_filtering 1 + + ip link set dev $swp1 master br0 + ip link set dev $swp2 master br0 + + ip link set dev br0 up + ip link set dev $swp1 up + ip link set dev $swp2 up + + bridge link set dev $swp1 learning off +} + +switch_destroy() +{ + ip link set dev $swp2 down + ip link set dev $swp1 down + + ip link del dev br0 +} + +setup_prepare() +{ + h1=${NETIFS[p1]} + swp1=${NETIFS[p2]} + + swp2=${NETIFS[p3]} + h2=${NETIFS[p4]} + + vrf_prepare + + h1_create + h2_create + + switch_create +} + +cleanup() +{ + pre_cleanup + + switch_destroy + + h2_destroy + h1_destroy + + vrf_cleanup +} + +ifaddr() +{ + ip -br link show dev "$1" | awk '{ print($3); }' +} + +locked_port_ipv4() +{ + RET=0 + + check_locked_port_support || return 0 + + ping_do $h1 192.0.2.2 + check_err $? "Ping didn't work when it should have" + + bridge link set dev $swp1 locked on + + ping_do $h1 192.0.2.2 + check_fail $? "Ping worked when it should not have" + + bridge fdb add `ifaddr $h1` dev $swp1 master static + + ping_do $h1 192.0.2.2 + check_err $? "Ping didn't work when it should have" + + bridge link set dev $swp1 locked off + bridge fdb del `ifaddr $h1` dev $swp1 master static + log_test "Locked port ipv4" +} + +locked_port_vlan() +{ + RET=0 + + check_locked_port_support || return 0 + check_vlan_filtering_support || return 0 + + bridge vlan add vid 100 dev $swp1 tagged + bridge vlan add vid 100 dev $swp2 tagged + + ping_do $h1.100 192.0.3.2 + check_err $? "Ping didn't work when it should have" + + bridge link set dev $swp1 locked on + ping_do $h1.100 192.0.3.2 + check_fail $? "Ping worked when it should not have" + + bridge fdb add `ifaddr $h1` dev $swp1 vlan 100 master static + + ping_do $h1.100 192.0.3.2 + check_err $? "Ping didn't work when it should have" + + bridge link set dev $swp1 locked off + bridge vlan del vid 100 dev $swp1 + bridge vlan del vid 100 dev $swp2 + bridge fdb del `ifaddr $h1` dev $swp1 vlan 100 master static + log_test "Locked port vlan" +} + +locked_port_ipv6() +{ + RET=0 + check_locked_port_support || return 0 + + ping6_do $h1 2001:db8:1::2 + check_err $? "Ping6 didn't work when it should have" + + bridge link set dev $swp1 locked on + + ping6_do $h1 2001:db8:1::2 + check_fail $? "Ping worked when it should not have" + + bridge fdb add `ifaddr $h1` dev $swp1 master static + ping6_do $h1 2001:db8:1::2 + check_err $? "Ping didn't work when it should have" + + bridge link set dev $swp1 locked off + bridge fdb del `ifaddr $h1` dev $swp1 master static + log_test "Locked port ipv6" +} + +trap cleanup EXIT + +setup_prepare +setup_wait + +tests_run + +exit $EXIT_STATUS diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh index 7da783d6f453..9ded90f17ead 100644 --- a/tools/testing/selftests/net/forwarding/lib.sh +++ b/tools/testing/selftests/net/forwarding/lib.sh @@ -125,6 +125,22 @@ check_ethtool_lanes_support() fi } +check_locked_port_support() +{ + if ! bridge -d link show | grep -q " locked"; then + echo "SKIP: iproute2 too old; Locked port feature not supported." + return $ksft_skip + fi +} + +check_vlan_filtering_support() +{ + if ! bridge -d vlan show | grep -q "state forwarding"; then + echo "SKIP: vlan filtering not supported." + return $ksft_skip + fi +} + if [[ "$(id -u)" -ne 0 ]]; then echo "SKIP: need root privileges" exit $ksft_skip