Hosts that support 802.1X authentication are able to authenticate themselves by exchanging EAPOL frames with an authenticator (Ethernet bridge, in this case) and an authentication server. Access to the network is only granted by the authenticator to successfully authenticated hosts. The above is implemented in the bridge using the "locked" bridge port option. When enabled, link-local frames (e.g., EAPOL) can be locally received by the bridge, but all other frames are dropped unless the host is authenticated. That is, unless the user space control plane installed an FDB entry according to which the source address of the frame is located behind the locked ingress port. The entry can be dynamic, in which case learning needs to be enabled so that the entry will be refreshed by incoming traffic. There are deployments in which not all the devices connected to the authenticator (the bridge) support 802.1X. Such devices can include printers and cameras. One option to support such deployments is to unlock the bridge ports connecting these devices, but a slightly more secure option is to use MAB. When MAB is enabled, the MAC address of the connected device is used as the user name and password for the authentication. For MAB to work, the user space control plane needs to be notified about MAC addresses that are trying to gain access so that they will be compared against an allow list. This can be implemented via the regular learning process with the sole difference that learned FDB entries are installed with a new "locked" flag indicating that the entry cannot be used to authenticate the device. The flag cannot be set by user space, but user space can clear the flag by replacing the entry, thereby authenticating the device. Locked FDB entries implement the following semantics with regards to roaming, aging and forwarding: 1. Roaming: Locked FDB entries can roam to unlocked (authorized) ports, in which case the "locked" flag is cleared. FDB entries cannot roam to locked ports regardless of MAB being enabled or not. Therefore, locked FDB entries are only created if an FDB entry with the given {MAC, VID} does not already exist. This behavior prevents unauthenticated devices from disrupting traffic destined to already authenticated devices. 2. Aging: Locked FDB entries age and refresh by incoming traffic like regular entries. 3. Forwarding: Locked FDB entries forward traffic like regular entries. If user space detects an unauthorized MAC behind a locked port and wishes to prevent traffic with this MAC DA from reaching the host, it can do so using tc or a different mechanism. Enable the above behavior using a new bridge port option called "mab". It can only be enabled on a bridge port that is both locked and has learning enabled. Locked FDB entries are flushed from the port once MAB is disabled. A new option is added because there are pure 802.1X deployments that are not interested in notifications about locked FDB entries.
Showing the changes to include/uapi (2 of 8 files). Show all
Unified · Split
| @@ -561,6 +561,7 @@ enum { · 560 unmodified lines | |||
| 561 | IFLA_BRPORT_MCAST_EHT_HOSTS_LIMIT, | 561 | IFLA_BRPORT_MCAST_EHT_HOSTS_LIMIT, |
| 562 | IFLA_BRPORT_MCAST_EHT_HOSTS_CNT, | 562 | IFLA_BRPORT_MCAST_EHT_HOSTS_CNT, |
| 563 | IFLA_BRPORT_LOCKED, | 563 | IFLA_BRPORT_LOCKED, |
| 564 | IFLA_BRPORT_MAB, | ||
| 564 | __IFLA_BRPORT_MAX | 565 | __IFLA_BRPORT_MAX |
| 565 | }; | 566 | }; |
| 566 | #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1) | 567 | #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1) |
| @@ -52,7 +52,8 @@ enum { · 51 unmodified lines | |||
| 52 | #define NTF_STICKY (1 << 6) | 52 | #define NTF_STICKY (1 << 6) |
| 53 | #define NTF_ROUTER (1 << 7) | 53 | #define NTF_ROUTER (1 << 7) |
| 54 | /* Extended flags under NDA_FLAGS_EXT: */ | 54 | /* Extended flags under NDA_FLAGS_EXT: */ |
| 55 | #define NTF_EXT_MANAGED (1 << 0) | 55 | #define NTF_EXT_MANAGED (1 << 0) |
| 56 | #define NTF_EXT_LOCKED (1 << 1) | ||
| 56 | 57 | ||
| 57 | /* | 58 | /* |
| 58 | * Neighbor Cache Entry States. | 59 | * Neighbor Cache Entry States. |
| @@ -86,6 +87,11 @@ enum { · 27 unmodified lines | |||
| 86 | * NTF_EXT_MANAGED flagged neigbor entries are managed by the kernel on behalf | 87 | * NTF_EXT_MANAGED flagged neigbor entries are managed by the kernel on behalf |
| 87 | * of a user space control plane, and automatically refreshed so that (if | 88 | * of a user space control plane, and automatically refreshed so that (if |
| 88 | * possible) they remain in NUD_REACHABLE state. | 89 | * possible) they remain in NUD_REACHABLE state. |
| 90 | * | ||
| 91 | * NTF_EXT_LOCKED flagged bridge FDB entries are entries generated by the | ||
| 92 | * bridge in response to a host trying to communicate via a locked bridge port | ||
| 93 | * with MAB enabled. Their purpose is to notify user space that a host requires | ||
| 94 | * authentication. | ||
| 89 | */ | 95 | */ |
| 90 | 96 | ||
| 91 | struct nda_cacheinfo { | 97 | struct nda_cacheinfo { |