From: Hans Schultz <schultz.hans@gmail.com> To: davem@davemloft.net, kuba@kernel.org Cc: netdev@vger.kernel.org, Hans Schultz <schultz.hans+netdev@gmail.com>, Andrew Lunn <andrew@lunn.ch>, Vivien Didelot <vivien.didelot@gmail.com>, Florian Fainelli <f.fainelli@gmail.com>, Vladimir Oltean <olteanv@gmail.com>, Roopa Prabhu <roopa@nvidia.com>, Nikolay Aleksandrov <nikolay@nvidia.com>, Shuah Khan <shuah@kernel.org>, Stephen Suryaputra <ssuryaextr@gmail.com>, David Ahern <dsahern@kernel.org>, Ido Schimmel <idosch@nvidia.com>, Petr Machata <petrm@nvidia.com>, Amit Cohen <amcohen@nvidia.com>, Po-Hsu Lin <po-hsu.lin@canonical.com>, Baowen Zheng <baowen.zheng@corigine.com>, linux-kernel@vger.kernel.org, bridge@lists.linux-foundation.org, linux-kselftest@vger.kernel.org Subject: [PATCH net-next v4 0/5] Add support for locked bridge ports (for 802.1X) Date: Tue, 22 Feb 2022 14:28:13 +0100 [thread overview] Message-ID: <20220222132818.1180786-1-schultz.hans+netdev@gmail.com> (raw) This series starts by adding support for SA filtering to the bridge, which is then allowed to be offloaded to switchdev devices. Furthermore an offloading implementation is supplied for the mv88e6xxx driver. Public Local Area Networks are often deployed such that there is a risk of unauthorized or unattended clients getting access to the LAN. To prevent such access we introduce SA filtering, such that ports designated as secure ports are set in locked mode, so that only authorized source MAC addresses are given access by adding them to the bridges forwarding database. Incoming packets with source MAC addresses that are not in the forwarding database of the bridge are discarded. It is then the task of user space daemons to populate the bridge's forwarding database with static entries of authorized entities. The most common approach is to use the IEEE 802.1X protocol to take care of the authorization of allowed users to gain access by opening for the source address of the authorized host. With the current use of the bridge parameter in hostapd, there is a limitation in using this for IEEE 802.1X port authentication. It depends on hostapd attaching the port on which it has a successful authentication to the bridge, but that only allows for a single authentication per port. This patch set allows for the use of IEEE 802.1X port authentication in a more general network context with multiple 802.1X aware hosts behind a single port as depicted, which is a commonly used commercial use-case, as it is only the number of available entries in the forwarding database that limits the number of authenticated clients. +--------------------------------+ | | | Bridge/Authenticator | | | +-------------+------------------+ 802.1X port | | | +------+-------+ | | | Hub/Switch | | | +-+----------+-+ | | +--+--+ +--+--+ | | | | Hosts | a | | b | . . . | | | | +-----+ +-----+ The 802.1X standard involves three different components, a Supplicant (Host), an Authenticator (Network Access Point) and an Authentication Server which is typically a Radius server. This patch set thus enables the bridge module together with an authenticator application to serve as an Authenticator on designated ports. For the bridge to become an IEEE 802.1X Authenticator, a solution using hostapd with the bridge driver can be found at https://github.com/westermo/hostapd/tree/bridge_driver . The relevant components work transparently in relation to if it is the bridge module or the offloaded switchcore case that is in use. Hans Schultz (5): net: bridge: Add support for bridge port in locked mode net: bridge: Add support for offloading of locked port flag net: dsa: Include BR_PORT_LOCKED in the list of synced brport flags net: dsa: mv88e6xxx: Add support for bridge port locked mode selftests: forwarding: tests of locked port feature drivers/net/dsa/mv88e6xxx/chip.c | 9 +- drivers/net/dsa/mv88e6xxx/port.c | 29 +++ drivers/net/dsa/mv88e6xxx/port.h | 9 +- include/linux/if_bridge.h | 1 + include/uapi/linux/if_link.h | 1 + net/bridge/br_input.c | 11 +- net/bridge/br_netlink.c | 6 +- net/bridge/br_switchdev.c | 2 +- net/dsa/port.c | 4 +- .../testing/selftests/net/forwarding/Makefile | 1 + .../net/forwarding/bridge_locked_port.sh | 180 ++++++++++++++++++ tools/testing/selftests/net/forwarding/lib.sh | 8 + 12 files changed, 254 insertions(+), 7 deletions(-) create mode 100755 tools/testing/selftests/net/forwarding/bridge_locked_port.sh -- 2.30.2
WARNING: multiple messages have this Message-ID (diff)
From: Hans Schultz <schultz.hans@gmail.com> To: davem@davemloft.net, kuba@kernel.org Cc: Petr Machata <petrm@nvidia.com>, Andrew Lunn <andrew@lunn.ch>, Baowen Zheng <baowen.zheng@corigine.com>, Florian Fainelli <f.fainelli@gmail.com>, Amit Cohen <amcohen@nvidia.com>, netdev@vger.kernel.org, David Ahern <dsahern@kernel.org>, bridge@lists.linux-foundation.org, linux-kernel@vger.kernel.org, Ido Schimmel <idosch@nvidia.com>, Stephen Suryaputra <ssuryaextr@gmail.com>, Hans Schultz <schultz.hans+netdev@gmail.com>, Po-Hsu Lin <po-hsu.lin@canonical.com>, Nikolay Aleksandrov <nikolay@nvidia.com>, linux-kselftest@vger.kernel.org, Roopa Prabhu <roopa@nvidia.com>, Vladimir Oltean <olteanv@gmail.com>, Shuah Khan <shuah@kernel.org>, Vivien Didelot <vivien.didelot@gmail.com> Subject: [Bridge] [PATCH net-next v4 0/5] Add support for locked bridge ports (for 802.1X) Date: Tue, 22 Feb 2022 14:28:13 +0100 [thread overview] Message-ID: <20220222132818.1180786-1-schultz.hans+netdev@gmail.com> (raw) This series starts by adding support for SA filtering to the bridge, which is then allowed to be offloaded to switchdev devices. Furthermore an offloading implementation is supplied for the mv88e6xxx driver. Public Local Area Networks are often deployed such that there is a risk of unauthorized or unattended clients getting access to the LAN. To prevent such access we introduce SA filtering, such that ports designated as secure ports are set in locked mode, so that only authorized source MAC addresses are given access by adding them to the bridges forwarding database. Incoming packets with source MAC addresses that are not in the forwarding database of the bridge are discarded. It is then the task of user space daemons to populate the bridge's forwarding database with static entries of authorized entities. The most common approach is to use the IEEE 802.1X protocol to take care of the authorization of allowed users to gain access by opening for the source address of the authorized host. With the current use of the bridge parameter in hostapd, there is a limitation in using this for IEEE 802.1X port authentication. It depends on hostapd attaching the port on which it has a successful authentication to the bridge, but that only allows for a single authentication per port. This patch set allows for the use of IEEE 802.1X port authentication in a more general network context with multiple 802.1X aware hosts behind a single port as depicted, which is a commonly used commercial use-case, as it is only the number of available entries in the forwarding database that limits the number of authenticated clients. +--------------------------------+ | | | Bridge/Authenticator | | | +-------------+------------------+ 802.1X port | | | +------+-------+ | | | Hub/Switch | | | +-+----------+-+ | | +--+--+ +--+--+ | | | | Hosts | a | | b | . . . | | | | +-----+ +-----+ The 802.1X standard involves three different components, a Supplicant (Host), an Authenticator (Network Access Point) and an Authentication Server which is typically a Radius server. This patch set thus enables the bridge module together with an authenticator application to serve as an Authenticator on designated ports. For the bridge to become an IEEE 802.1X Authenticator, a solution using hostapd with the bridge driver can be found at https://github.com/westermo/hostapd/tree/bridge_driver . The relevant components work transparently in relation to if it is the bridge module or the offloaded switchcore case that is in use. Hans Schultz (5): net: bridge: Add support for bridge port in locked mode net: bridge: Add support for offloading of locked port flag net: dsa: Include BR_PORT_LOCKED in the list of synced brport flags net: dsa: mv88e6xxx: Add support for bridge port locked mode selftests: forwarding: tests of locked port feature drivers/net/dsa/mv88e6xxx/chip.c | 9 +- drivers/net/dsa/mv88e6xxx/port.c | 29 +++ drivers/net/dsa/mv88e6xxx/port.h | 9 +- include/linux/if_bridge.h | 1 + include/uapi/linux/if_link.h | 1 + net/bridge/br_input.c | 11 +- net/bridge/br_netlink.c | 6 +- net/bridge/br_switchdev.c | 2 +- net/dsa/port.c | 4 +- .../testing/selftests/net/forwarding/Makefile | 1 + .../net/forwarding/bridge_locked_port.sh | 180 ++++++++++++++++++ tools/testing/selftests/net/forwarding/lib.sh | 8 + 12 files changed, 254 insertions(+), 7 deletions(-) create mode 100755 tools/testing/selftests/net/forwarding/bridge_locked_port.sh -- 2.30.2
next reply other threads:[~2022-02-22 13:29 UTC|newest] Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-02-22 13:28 Hans Schultz [this message] 2022-02-22 13:28 ` [Bridge] [PATCH net-next v4 0/5] Add support for locked bridge ports (for 802.1X) Hans Schultz 2022-02-22 13:28 ` [PATCH net-next v4 1/5] net: bridge: Add support for bridge port in locked mode Hans Schultz 2022-02-22 13:28 ` [Bridge] " Hans Schultz 2022-02-22 13:28 ` [PATCH net-next v4 2/5] net: bridge: Add support for offloading of locked port flag Hans Schultz 2022-02-22 13:28 ` [Bridge] " Hans Schultz 2022-02-22 13:28 ` [PATCH net-next v4 3/5] net: dsa: Include BR_PORT_LOCKED in the list of synced brport flags Hans Schultz 2022-02-22 13:28 ` [Bridge] " Hans Schultz 2022-02-22 13:28 ` [PATCH net-next v4 4/5] net: dsa: mv88e6xxx: Add support for bridge port locked mode Hans Schultz 2022-02-22 13:28 ` [Bridge] " Hans Schultz 2022-02-22 13:28 ` [PATCH net-next v4 5/5] selftests: forwarding: tests of locked port feature Hans Schultz 2022-02-22 13:28 ` [Bridge] " Hans Schultz 2022-02-22 17:00 ` Ido Schimmel 2022-02-22 17:00 ` [Bridge] " Ido Schimmel 2022-02-23 7:59 ` Hans Schultz 2022-02-23 7:59 ` [Bridge] " Hans Schultz 2022-02-22 19:15 ` [PATCH net-next v4 0/5] Add support for locked bridge ports (for 802.1X) Jakub Kicinski 2022-02-22 19:15 ` [Bridge] " Jakub Kicinski 2022-02-23 8:40 ` Hans Schultz 2022-02-23 8:40 ` [Bridge] " Hans Schultz 2022-02-23 16:20 ` Jakub Kicinski 2022-02-23 16:20 ` [Bridge] " Jakub Kicinski
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20220222132818.1180786-1-schultz.hans+netdev@gmail.com \ --to=schultz.hans@gmail.com \ --cc=amcohen@nvidia.com \ --cc=andrew@lunn.ch \ --cc=baowen.zheng@corigine.com \ --cc=bridge@lists.linux-foundation.org \ --cc=davem@davemloft.net \ --cc=dsahern@kernel.org \ --cc=f.fainelli@gmail.com \ --cc=idosch@nvidia.com \ --cc=kuba@kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-kselftest@vger.kernel.org \ --cc=netdev@vger.kernel.org \ --cc=nikolay@nvidia.com \ --cc=olteanv@gmail.com \ --cc=petrm@nvidia.com \ --cc=po-hsu.lin@canonical.com \ --cc=roopa@nvidia.com \ --cc=schultz.hans+netdev@gmail.com \ --cc=shuah@kernel.org \ --cc=ssuryaextr@gmail.com \ --cc=vivien.didelot@gmail.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.