network: bridge: add support for IFLA_BRPORT_MAB

Since linux commit a35ec8e38cdd1766f29924ca391a01de20163931 ("bridge:
Add MAC Authentication Bypass (MAB) support"), included since v6.2, it
is possible to enable MAC Authentication Bypass for bridge ports. In
this mode the locked port learns again, but the learned fdb entries are
locked, allowing user space to unlock hosts based seen MAC addresses.

This requires learning to be enabled on the port, and link-local
learning disabled for the bridge.

Add support to systemd-network for setting the new attribute for bridge
ports.
This commit is contained in:
Jonas Gorski
2025-01-28 12:22:26 +01:00
parent a434de6056
commit 08a26ecc47
8 changed files with 22 additions and 0 deletions
@@ -11,3 +11,4 @@ Bridge=bridge99
[Bridge]
Priority=0
Locked=true
MACAuthenticationBypass=true
@@ -5791,6 +5791,8 @@ class NetworkdBridgeTests(unittest.TestCase, Utilities):
print(output)
self.check_bridge_port_attr('bridge99', 'test1', 'priority', '0')
self.assertIn('locked on', output)
if ' mab ' in output: # This is new in kernel and iproute2 v6.2
self.assertIn('mab on', output)
def test_bridge_property(self):
copy_network_unit('11-dummy.netdev', '12-dummy.netdev', '26-bridge.netdev',