On Thu, Oct 20, 2022 at 04:57:35PM +0300, Ido Schimmel wrote: > > Right now this packet isn't generated, right? > > Right. We don't support BR_PORT_LOCKED so these checks are not currently > enabled in hardware. To be clear, only packets received via locked ports > are able to trigger the check. You mean BR_PORT_MAB, not BR_PORT_LOCKED, right? AFAIU, "locked" means drop unknown MAC SA, "mab" means "install BR_FDB_LOCKED entry on port" (and also maybe still drop, if "locked" is also set on port). Sad there isn't any good documentation about these flags in the patches that Hans is proposing.
