SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

network: bridge: add support for IFLA_BRPORT_MAB

Browse Source 
Since linux commit a35ec8e38cdd1766f29924ca391a01de20163931 ("bridge:
Add MAC Authentication Bypass (MAB) support"), included since v6.2, it
is possible to enable MAC Authentication Bypass for bridge ports. In
this mode the locked port learns again, but the learned fdb entries are
locked, allowing user space to unlock hosts based seen MAC addresses.

This requires learning to be enabled on the port, and link-local
learning disabled for the bridge.

Add support to systemd-network for setting the new attribute for bridge
ports.
This commit is contained in:
Jonas Gorski
2025-01-28 12:22:26 +01:00
parent a434de6056
commit 08a26ecc47
8 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd.network.xml
+9
View File
@@ -4630,6 +4630,15 @@ ServerAddress=192.168.0.1/24</programlisting>
<para>Takes a boolean. Configures whether the port is "locked" and does not allow traffic forwarded
until fully authenticated, e.g. via 802.1x. When unset, the kernel's default will be used.</para>
<xi:include href="version-info.xml" xpointer="v258"/>
</listitem>
<term><varname>MACAuthenticationBypass=</varname></term>
<listitem>
<para>Takes a boolean. Configures whether a locked port has "MAC Authentication Bypass" enabled and
creates newly learned fdb entries in a "locked" state. User space can authenticate these entries by
clearing the locked flag. Requires Learning to be enabled. When unset, the kernel's default will be
used.</para>
<xi:include href="version-info.xml" xpointer="v258"/>
</listitem>
</varlistentry>