On 2022-08-23 14:36, Ido Schimmel wrote:
On Tue, Aug 23, 2022 at 09:37:54AM +0200, netdev@kapio-technology.com wrote:
"learning on locked on" is really a misconfiguration, but it can also happen today and entries do not roam with the "locked" flag for the simple reason that it does not exist. I see two options:
- Do not clear / set "locked" flag during roaming. Given learning
should be disabled on locked ports, then the only half interesting case is roaming to an unlocked port. Keeping the "locked" flag basically means "if you were to lock the port, then the presence of this entry is not enough to let traffic with the SA be forwarded by the bridge". Unlikely that anyone will do that.
- Always set "locked" flag for learned entries (new & roamed) on
locked ports and clear it for learned entries on unlocked ports.
Both options are consistent in how they treat the "locked" flag (either always do nothing or always set/clear) and both do not impact the integrity of the solution when configured correctly (disabling learning on locked ports). I guess users will find option 2 easier to understand / work with.
Roaming to a locked port with an entry without the locked bit set would open the port for said MAC without necessary authorization. Thus I think that the only real option is the 2. case.