From: Florian Westphal <fw@strlen.de>
To: Eric Woudstra <ericwouds@gmail.com>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>,
Jozsef Kadlecsik <kadlec@netfilter.org>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>,
Nikolay Aleksandrov <razor@blackwall.org>,
Ido Schimmel <idosch@nvidia.com>,
netfilter-devel@vger.kernel.org, netdev@vger.kernel.org,
bridge@lists.linux.dev
Subject: Re: [PATCH v15 nf-next 3/3] netfilter: nft_chain_filter: Add bridge double vlan and pppoe
Date: Fri, 31 Oct 2025 00:14:24 +0100 [thread overview]
Message-ID: <aQPxULsaFi0uIV8u@strlen.de> (raw)
In-Reply-To: <a4a3dce4-0f2c-4153-abbe-81e5d2715bbe@gmail.com>
Eric Woudstra <ericwouds@gmail.com> wrote:
> > I also vaguely remember I commented that this changes (breaks?) existing
> > behaviour for a rule like "tcp dport 22 accept" which may now match e.g.
> > a PPPoE packet.
> >
> > Pablo, whats your take on this? Do we need a new NFPROTO_BRIDGE
> > expression that can munge (populate) nft_pktinfo with the l4 data?
> >
> > That would move this off to user policy (config) land.
> >
> > (or extend nft_meta_bridge, doesn't absolutely require a brand new expression).
> >
> Did you get any answer on this somewhere? I think that answer may affect
> this commit, so I'll wait before sending the next version for now.
Sorry for dropping the ball on this. No, I did not.
First step is to write up a summary of the current behaviour,
then decide on a how-do-we-want-this-to-work and then on
an how-to-get-there.
I think for the second part (how-do-we-want-this-to-work)
the 'greedy' approach proposed by Antoine (ip saddr 1.2.3.4
matches regardless of l2 encap) makes sense but it will be hard
to get there.
I will try to cook up a proposal/rfc sometime next week.
prev parent reply other threads:[~2025-10-30 23:14 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-25 18:30 [PATCH v15 nf-next 0/3] conntrack: bridge: add double vlan, pppoe and pppoe-in-q Eric Woudstra
2025-09-25 18:30 ` [PATCH v15 nf-next 1/3] netfilter: utils: nf_checksum(_partial) correct data!=networkheader Eric Woudstra
2025-09-25 18:30 ` [PATCH v15 nf-next 2/3] netfilter: bridge: Add conntrack double vlan and pppoe Eric Woudstra
2025-09-26 14:10 ` Simon Horman
2025-10-02 8:11 ` Florian Westphal
2025-09-25 18:30 ` [PATCH v15 nf-next 3/3] netfilter: nft_chain_filter: Add bridge " Eric Woudstra
2025-10-02 8:25 ` Florian Westphal
2025-10-28 11:43 ` Eric Woudstra
2025-10-30 23:14 ` Florian Westphal [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aQPxULsaFi0uIV8u@strlen.de \
--to=fw@strlen.de \
--cc=bridge@lists.linux.dev \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=ericwouds@gmail.com \
--cc=horms@kernel.org \
--cc=idosch@nvidia.com \
--cc=kadlec@netfilter.org \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
--cc=razor@blackwall.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.