netdev - Re: [PATCH net-next 2/2] selftests: forwarding: Add MAC Authentication Bypass (MAB) test cases

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b3d528d1-a7b7-9e8c-c7d0-3f658c0162c0@blackwall.org>
Date:   Wed, 2 Nov 2022 15:17:15 +0200
From:   Nikolay Aleksandrov <razor@...ckwall.org>
To:     Ido Schimmel <idosch@...dia.com>, netdev@...r.kernel.org,
        bridge@...ts.linux-foundation.org
Cc:     davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com,
        edumazet@...gle.com, roopa@...dia.com, netdev@...io-technology.com,
        vladimir.oltean@....com, mlxsw@...dia.com
Subject: Re: [PATCH net-next 2/2] selftests: forwarding: Add MAC
 Authentication Bypass (MAB) test cases

On 01/11/2022 21:39, Ido Schimmel wrote:
> From: "Hans J. Schultz" <netdev@...io-technology.com>
> 
> Add four test cases to verify MAB functionality:
> 
> * Verify that a locked FDB entry can be generated by the bridge,
>   preventing a host from communicating via the bridge. Test that user
>   space can clear the "locked" flag by replacing the entry, thereby
>   authenticating the host and allowing it to communicate via the bridge.
> 
> * Test that an entry cannot roam to a locked port, but that it can roam
>   to an unlocked port.
> 
> * Test that MAB can only be enabled on a port that is both locked and
>   has learning enabled.
> 
> * Test that locked FDB entries are flushed from a port when MAB is
>   disabled.
> 
> Signed-off-by: Hans J. Schultz <netdev@...io-technology.com>
> Signed-off-by: Ido Schimmel <idosch@...dia.com>
> ---
> 
> Notes:
>     v1:
>     * Adjust commit message.
>     * Add FDB flushing test case.
>     
>     Changes made by me:
>     * Reword commit message.
>     * Remove blackhole tests as they are not relevant for this series.
>     * Add configuration test case.
>     * Add a few additional test cases.
> 
>  .../net/forwarding/bridge_locked_port.sh      | 155 +++++++++++++++++-
>  tools/testing/selftests/net/forwarding/lib.sh |   8 +
>  2 files changed, 162 insertions(+), 1 deletion(-)
> 

Acked-by: Nikolay Aleksandrov <razor@...ckwall.org>