On Thu, Oct 20, 2022 at 10:20:50PM +0200, netdev@kapio-technology.com wrote:
In general locked ports block traffic from a host based on if there is a FDB entry or not. In the non-offloaded case, there is only CPU assisted learning, so the normal learning mechanism has to be disabled as any learned entry will open the port for the learned MAC,vlan.
Does it have to be that way? Why can't BR_LEARNING on a BR_PORT_LOCKED cause the learned FDB entries to have BR_FDB_LOCKED, and everything would be ok in that case (the port will not be opened for the learned MAC/VLAN)?
Thus learning is off for locked ports, which of course includes MAB.
So the 'learning' is based on authorizing MAC,vlan addresses, which is done by userspace daemons, e.g. hostapd or what could be called mabd.