Adding dot1x support

serving/dot1x-bench/authenticator/setup-link.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# setup-link.sh <supplicant-nic> <uplink-nic>
+#
+# Prep one authenticator link before starting hostapd on it. The authenticator is
+# a 2-sided node: <supplicant-nic> faces the workstation (hostapd + MACsec runs
+# here), <uplink-nic> faces the serving VLAN (DHCP/NVMe/RADIUS). After MKA
+# succeeds hostapd creates a macsec iface over <supplicant-nic>; the DECRYPTED
+# traffic on that macsec iface must reach the serving network — we bridge it to
+# <uplink-nic>.
+#
+# Run as root on the authenticator node (VM or inline box). BENCH-VERIFY the
+# macsec iface name hostapd creates on your build (assumed "macsec0").
+set -euo pipefail
+
+SUP=${1:?usage: setup-link.sh <supplicant-nic> <uplink-nic>}
+UP=${2:?uplink nic required}
+MACSEC=${3:-macsec0}      # iface hostapd creates after MKA (override if different)
+BR=${BR:-br-auth}
+
+ip link set "$SUP" up
+ip link set "$UP"  up
+
+# Allow EAPOL through any bridge in the path (reserved PAE multicast is dropped
+# by default). The supplicant-facing side is a raw NIC for hostapd, so this is
+# mainly for the uplink bridge.
+ip link add name "$BR" type bridge 2>/dev/null || true
+echo 8 > "/sys/class/net/$BR/bridge/group_fwd_mask" 2>/dev/null || true
+ip link set "$UP" master "$BR"
+ip link set "$BR" up
+
+echo "Authenticator link ready:"
+echo "  supplicant NIC : $SUP   (start hostapd here)"
+echo "  uplink bridge  : $BR <- $UP   (serving VLAN)"
+echo
+echo "AFTER hostapd brings MKA up and creates '$MACSEC', bridge it to the uplink:"
+echo "  ip link set $MACSEC master $BR && ip link set $MACSEC up"
+echo "(Do this once $MACSEC exists; automate with a hostapd 'macsec' up-hook if"
+echo " your build supports one.)"