netdev - Re: Question: DSA on Marvell 6390R switch dropping EAPOL packets with unicast MAC DA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20230309142103.dg4qfksz4k2itotd@skbuf>
Date:   Thu, 9 Mar 2023 16:21:03 +0200
From:   Vladimir Oltean <olteanv@...il.com>
To:     Qingtao Cao <qingtao.cao.au@...il.com>
Cc:     andrew@...n.ch, vivien.didelot@...il.com, f.fainelli@...il.com,
        netdev <netdev@...r.kernel.org>
Subject: Re: Question: DSA on Marvell 6390R switch dropping EAPOL packets
 with unicast MAC DA

On Thu, Mar 09, 2023 at 03:16:01PM +0200, Vladimir Oltean wrote:
> Speaking of bridging, is the net2p9 interface under any bridge during
> your testing, or does it operate as a standalone interface? If it's
> under a bridge, could you repeat the experiment with it as standalone?

Ah, I shouldn't have asked this, because the information you've provided:

> > if (trunk)
> >     skb->offload_fwd_mark = true;
> > else if (!trap)
> >     dsa_default_offload_fwd_mark(skb);
> > 
> > will set skb->offload_fwd_mark = 1.

is enough for me to determine that yes, net2p9 *is* under a bridge.
This is because of the implementation:

static inline void dsa_default_offload_fwd_mark(struct sk_buff *skb)
{
	struct dsa_port *dp = dsa_slave_to_port(skb->dev);

	skb->offload_fwd_mark = !!(dp->bridge);
}

if it wasn't under a bridge, then skb->offload_fwd_mark would have never
been 1.

Ok, so having this said, now I have a pretty strong suspicion as to what
the issue is.

The RX handler of the software bridge layer - br_handle_frame() - steals
packets from the bridge port interface (net2p9) before those packets
ever reach the PF_PACKET socket opened by wpa_supplicant. "Steals" means
"returns RX_HANDLER_CONSUMED and not RX_HANDLER_PASS".

There is a netfilter hook through which you can tell the bridge
"hey, don't steal this kind of traffic, leave it on the bridge port!"
The command, applied to EAPOL, would look something like this:

/sbin/ebtables --table broute --append BROUTING --protocol 0x888e --jump DROP

Would you mind giving this a try (and do the rest of the debugging later)?