On 11/9/25 8:24 PM, Eric Woudstra wrote:
> Conntrack bridge only tracks untagged and 802.1q.
>
> To make the bridge-fastpath experience more similar to the
> forward-fastpath experience, introduce patches for double vlan,
> pppoe and pppoe-in-q tagged packets to bridge conntrack and to
> bridge filter chain.
>
> Changes in v17:
>
> - Add patch for nft_set_pktinfo_ipv4/6_validate() adding nhoff argument.
> - Stopped using skb_set_network_header() in nft_set_bridge_pktinfo,
> using the new offset for nft_set_pktinfo_ipv4/6_validate instead.
> - When pskb_may_pull() fails in nft_set_bridge_pktinfo() set proto to 0,
> resulting in pktinfo unspecified.
>
> Changes in v16:
>
> - Changed nft_chain_filter patch: Only help populating pktinfo offsets,
> call nft_do_chain() with original network_offset.
> - Changed commit messages.
> - Removed kernel-doc comments.
>
> Changes in v15:
>
> - Do not munge skb->protocol.
> - Introduce nft_set_bridge_pktinfo() helper.
> - Introduce nf_ct_bridge_pre_inner() helper.
> - nf_ct_bridge_pre(): Don't trim on ph->hdr.length, only compare to what
> ip header claims and return NF_ACCEPT if it does not match.
> - nf_ct_bridge_pre(): Renamed u32 data_len to pppoe_len.
> - nf_ct_bridge_pre(): Reset network_header only when ret == NF_ACCEPT.
> - nf_checksum(_partial)(): Use of skb_network_offset().
> - nf_checksum(_partial)(): Use 'if (WARN_ON()) return 0' instead.
> - nf_checksum(_partial)(): Added comments
>
> Changes in v14:
>
> - nf_checksum(_patial): Use DEBUG_NET_WARN_ON_ONCE(
> !skb_pointer_if_linear()) instead of pskb_may_pull().
> - nft_do_chain_bridge: Added default case ph->proto is neither
> ipv4 nor ipv6.
> - nft_do_chain_bridge: only reset network header when ret == NF_ACCEPT.
>
> Changes in v13:
>
> - Do not use pull/push before/after calling nf_conntrack_in() or
> nft_do_chain().
> - Add patch to correct calculating checksum when skb->data !=
> skb_network_header(skb).
>
> Changes in v12:
>
> - Only allow tracking this traffic when a conntrack zone is set.
> - nf_ct_bridge_pre(): skb pull/push without touching the checksum,
> because the pull is always restored with push.
> - nft_do_chain_bridge(): handle the extra header similar to
> nf_ct_bridge_pre(), using pull/push.
>
> Changes in v11:
>
> - nft_do_chain_bridge(): Proper readout of encapsulated proto.
> - nft_do_chain_bridge(): Use skb_set_network_header() instead of thoff.
> - removed test script, it is now in separate patch.
>
> v10 split from patch-set: bridge-fastpath and related improvements v9
>
> Eric Woudstra (4):
> netfilter: utils: nf_checksum(_partial) correct data!=networkheader
> netfilter: bridge: Add conntrack double vlan and pppoe
> netfilter: nft_set_pktinfo_ipv4/6_validate: Add nhoff argument
> netfilter: nft_chain_filter: Add bridge double vlan and pppoe
>
> include/net/netfilter/nf_tables_ipv4.h | 21 +++--
> include/net/netfilter/nf_tables_ipv6.h | 21 +++--
> net/bridge/netfilter/nf_conntrack_bridge.c | 92 ++++++++++++++++++----
> net/netfilter/nft_chain_filter.c | 59 ++++++++++++--
> net/netfilter/utils.c | 28 +++++--
> 5 files changed, 176 insertions(+), 45 deletions(-)
>
Can I kindly ask, what is the status of this patch-set?
Regards,
Eric
