Re: [PATCH net-next 1/4] net: bridge: Add support for bridge port in locked mode

On mån, feb 07, 2022 at 14:53, Andrew Lunn [off-list ref] wrote:

quoted

quoted

+	if (p->flags & BR_PORT_LOCKED) {
+		fdb_entry = br_fdb_find_rcu(br, eth_hdr(skb)->h_source, vid);
+		if (!(fdb_entry && fdb_entry->dst == p))
+			goto drop;

I'm not familiar with 802.1X so I have some questions:

Me neither.

quoted

1. Do we need to differentiate between no FDB entry and an FDB entry
pointing to a different port than we expect?

And extending that question, a static vs a dynamic entry?

    Andrew

The question is - if there is an fdb entry or not - for the specific client
mac address behind the locked port in the bridge associated with the
respective locked port and vlan taken into consideration.
Normally you would have learning disabled, or from a fresh start if a port
is locked, it will not learn on incoming from that port, so you need to
add the fdb entry from user-space. In the common case you will want to
use static entries and remember the master flag for the entry to go to
the bridge module.