Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 30 Jun 2022 14:37:56 +0300
From:   Ido Schimmel <idosch@nvidia.com>
To:     Hans Schultz <hans@kapio-technology.com>
Cc:     davem@davemloft.net, kuba@kernel.org, netdev@vger.kernel.org,
        Andrew Lunn <andrew@lunn.ch>,
        Vivien Didelot <vivien.didelot@gmail.com>,
        Florian Fainelli <f.fainelli@gmail.com>,
        Vladimir Oltean <olteanv@gmail.com>,
        Eric Dumazet <edumazet@google.com>,
        Paolo Abeni <pabeni@redhat.com>, Jiri Pirko <jiri@resnulli.us>,
        Ivan Vecera <ivecera@redhat.com>,
        Roopa Prabhu <roopa@nvidia.com>,
        Nikolay Aleksandrov <razor@blackwall.org>,
        Shuah Khan <shuah@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Hans Schultz <schultz.hans+netdev@gmail.com>,
        linux-kernel@vger.kernel.org, bridge@lists.linux-foundation.org,
        linux-kselftest@vger.kernel.org
Subject: Re: [PATCH net-next v1 1/1] net: bridge: ensure that link-local
 traffic cannot unlock a locked port
Message-ID: <Yr2LFI1dx6Oc7QBo@shredder>
References: <20220630111634.610320-1-hans@kapio-technology.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20220630111634.610320-1-hans@kapio-technology.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?lWHcmdMz/IBOxaGM2iAVoKoyHNlyQYQAGrRph9shcOAHjCAZ5c3t8dH2yvkL?=
 =?us-ascii?Q?XRwmqVXs1kQphrWj1njPvE1j88O4In25E474Zac3KD2I8RFnkXXmnzfSxNTs?=
 =?us-ascii?Q?87aeGoE7pIQNl4EMjjC3vilgl9AWJwi8Elp04MYro0WeZWx4d1XkBo7JQ8Nm?=
 =?us-ascii?Q?x0MEceQmxGoMinnTQqLknln+TSVVZRnUenS4vXMRsxp8TnhVZm2vXQhiB+rF?=
 =?us-ascii?Q?lv7VHmd4frUoYGHVvvQNF2MohCtV0c1gjLnhdcFClsi9maBAmk/TcWIHd58r?=
 =?us-ascii?Q?jlWJwKIUzzOmdUmmTjaeB9VQj0OBBrj+XuN8CgAGHq6MEDrsuurJf/00Hr1l?=
 =?us-ascii?Q?bBnCDY/YysYpbZpijn4JFb6aujoQ5X/krrPv81QU6ckvyp+oXfuRUl4pLN7e?=
 =?us-ascii?Q?0GZv0ddctkER7bF/vOqsm73AW1oeIasWnMPojMz59bZ7k2AQC0dvmssu4ez2?=
 =?us-ascii?Q?/KUQSqJ4xMkJHTKQAXIJoB/VYP1sYgS2g1U6uptuO6bg0LcYMz+EXt/t4ifG?=
 =?us-ascii?Q?sZWOCqE1pBD3vdqOEV6lg82YBX4LJftz5VkwJqWlX/328jO6C8tQFbLsp2Yn?=
 =?us-ascii?Q?ovL772le4GxHTUSDG2v66hSKo0SkJapPU6paLj4gtjrDTGg03DouVQUDGFPe?=
 =?us-ascii?Q?qlT/Hd97wmmUQ83AiTSkH189i9E2S5cPuqKsmU2VV4bj1NjYUu4XTlZJ8qjc?=
 =?us-ascii?Q?fyAC+H+qFwJ6p6MJyPXsHN7NeTwf0rSdMAVyZ5fc6ZwnLlOb0YuYa0oeF8Xo?=
 =?us-ascii?Q?GkRv3IVbPy+CChPtqKTy+cce2UzJRQIosaSlUCyXWDyk5hL9rlHKQYQDGw6C?=
 =?us-ascii?Q?+wrZvvKkyVxb5CuzeE1Dl5LWCe1o2Lc9Ez0MEHjr0fpcom+hh3mFID/x/7H2?=
 =?us-ascii?Q?UP2nbmsvqP2ii9GssLtP/+2U2z1jGO39ON81yTTnG/uMiyFzXoqLjGGsG1bl?=
 =?us-ascii?Q?X+DphnZftYHgEqhIAdpmJg8ChxM3tI46Ya2bocFz2lIO+wpw94ZcbkZQR9k2?=
 =?us-ascii?Q?w7qtzL7OBhwQBAy8r6DqgVo6poAi9TzjEiN6L7EoKol/wrDTrN5ykPwO7hz3?=
 =?us-ascii?Q?n9gj6cJcm9DAnr00cOh83Nag0L5kqmfjhPyQISr/PJgubFK3FgfSGiaTifBH?=
 =?us-ascii?Q?KPqCpbOorrOrY8ouByClFP7I6+13NLMwHffcEXxgPc6AGXEpntLxbHidT8wb?=
 =?us-ascii?Q?2/8BIcu7xWboptpUbKUVULDz9Q9PIXDMJ8J1KPLv5+yEk5ec+q1//IGhprqJ?=
 =?us-ascii?Q?vPZro2ptgw5I+mXjzqoCmI8sFnDkwJ8XvhxwSWGQEPKxtOtaEA7dpp6KKV7I?=
 =?us-ascii?Q?x9G0ZyVFNQxKuD7eR/7cxE+ixZm5dWQ4EBgDRvX9/yR/+S+Syaw8EDHynv4T?=
 =?us-ascii?Q?mH7IpHZ/A5I+fGtc+qdmTM2osb/gTEU2OoHRBtycQuOS/UgyC9HG6G0voyez?=
 =?us-ascii?Q?4sNrA+LB9ERbhpMvxg6asRzKgxWVpw00shZycfQDqDqSwnKXZ16wMBkwYNma?=
 =?us-ascii?Q?wO5bUT4f1RKQFxUwO8a0sB0lM/sb4dgZK0tfg+WFT65s38CiVnMCJkCbIpDt?=
 =?us-ascii?Q?Gp76T/mVrsZ5sMOGsdWBhWztD8R+dgzFeelJjY+2?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: e244c5ad-d3cc-42e2-c0b8-08da5a8cfd98
X-MS-Exchange-CrossTenant-AuthSource: CY5PR12MB6179.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Jun 2022 11:38:02.5257
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 1HzybaR9/ARgc9OYYyyGFvFXgGQckcRkqLL+IsKfer/ZHkDoPs2tDLhQTDO6F2XvQgBGJJTp4YKP7LRp7M+SyQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR12MB3894
X-Spam-Status: No, score=-1.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,
        RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, Jun 30, 2022 at 01:16:34PM +0200, Hans Schultz wrote:
> This patch is related to the patch set
> "Add support for locked bridge ports (for 802.1X)"
> Link: https://lore.kernel.org/netdev/20220223101650.1212814-1-schultz.hans+netdev@gmail.com/
> 
> This patch makes the locked port feature work with learning turned on,
> which is enabled with the command:
> 
> bridge link set dev DEV learning on
> 
> Without this patch, link local traffic (01:80:c2) like EAPOL packets will
> create a fdb entry when ingressing on a locked port with learning turned
> on, thus unintentionally opening up the port for traffic for the said MAC.
> 
> Some switchcore features like Mac-Auth and refreshing of FDB entries,
> require learning enables on some switchcores, f.ex. the mv88e6xxx family.
> Other features may apply too.
> 
> Since many switchcores trap or mirror various multicast packets to the
> CPU, link local traffic will unintentionally unlock the port for the
> SA mac in question unless prevented by this patch.

Why not just teach hostapd to do:

echo 1 > /sys/class/net/br0/bridge/no_linklocal_learn

?