netdev - Re: query on EAPOL multicast packet with linux bridge interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aAjSCwwuRpI8GdB7@shredder>
Date: Wed, 23 Apr 2025 14:42:03 +0300
From: Ido Schimmel <idosch@...sch.org>
To: SIMON BABY <simonkbaby@...il.com>
Cc: netdev@...r.kernel.org
Subject: Re: query on EAPOL multicast packet with linux bridge interface

On Tue, Apr 22, 2025 at 06:42:58PM -0700, SIMON BABY wrote:
> Hello,
> 
> I have a difficulty with making EAPOL packet forwarding with the Linux
> bridge interface.
> 
>  I have configured the group_fwd_mask parameter with the below value.
> 
>  echo 8 > /sys/class/net/br0/bridge/group_fwd_mask
> 
> I still could not see the EAPOL packets being forwarded  from the
> linux bridge interface . However I can see the EAPOL packets are
> forwarded if I use it as a regular interface.
> 
> Do we have any more settings?

What do you mean by "linux bridge interface"? The bridge device itself
or a bridge port? Also, what is "regular interface"?

The following script [1] seems to work fine for me:

EAPOL packets on h2 without group_fwd_mask: 0
EAPOL packets on h2 with group_fwd_mask: 1

Can you adjust it to show the problem you are referring to?

Thanks

[1]
#!/bin/bash

# Setup
#
for ns in h1 h2 br; do
	ip netns add $ns
	ip -n $ns link set dev lo up
done

ip -n h1 link add name veth0 type veth peer name veth1 netns br
ip -n h2 link add name veth2 type veth peer name veth3 netns br

ip -n h1 link set dev veth0 up
ip -n h2 link set dev veth2 up

ip -n br link add name br0 up type bridge
ip -n br link set dev veth1 up master br0
ip -n br link set dev veth3 up master br0

tc -n h2 qdisc add dev veth2 clsact
tc -n h2 filter add dev veth2 ingress pref 1 proto all \
	flower dst_mac 01:80:c2:00:00:03 action pass

# Without group_fwd_mask
#
ip netns exec h1 mausezahn veth0 -a own -b 01:80:c2:00:00:03 -c 1 -q
sleep 1
pkt=$(tc -n h2 -s -j -p filter show dev veth2 ingress | \
	jq ".[] | select(.options.handle == 1) | .options.actions[0].stats.packets")

echo "EAPOL packets on h2 without group_fwd_mask: $pkt"

# With group_fwd_mask
#
ip -n br link set dev br0 type bridge group_fwd_mask 0x0008
ip netns exec h1 mausezahn veth0 -a own -b 01:80:c2:00:00:03 -c 1 -q
sleep 1
pkt=$(tc -n h2 -s -j -p filter show dev veth2 ingress | \
	jq ".[] | select(.options.handle == 1) | .options.actions[0].stats.packets")
echo "EAPOL packets on h2 with group_fwd_mask: $pkt"

# Cleanup
#
for ns in h1 h2 br; do
	ip netns del $ns
done