Re: [PATCH v17 nf-next 0/4] conntrack: bridge: add double vlan, pppoe and pppoe-in-q

[Eric Woudstra <ericwouds@gmail.com>]

On 11/9/25 8:24 PM, Eric Woudstra wrote:
> Conntrack bridge only tracks untagged and 802.1q.
> 
> To make the bridge-fastpath experience more similar to the
> forward-fastpath experience, introduce patches for double vlan,
> pppoe and pppoe-in-q tagged packets to bridge conntrack and to
> bridge filter chain.
> 
> Changes in v17:
> 
> - Add patch for nft_set_pktinfo_ipv4/6_validate() adding nhoff argument.
> - Stopped using skb_set_network_header() in nft_set_bridge_pktinfo,
>    using the new offset for nft_set_pktinfo_ipv4/6_validate instead.
> - When pskb_may_pull() fails in nft_set_bridge_pktinfo() set proto to 0,
>    resulting in pktinfo unspecified.
> 
> Changes in v16:
> 
> - Changed nft_chain_filter patch: Only help populating pktinfo offsets,
>    call nft_do_chain() with original network_offset.
> - Changed commit messages.
> - Removed kernel-doc comments.
> 
> Changes in v15:
> 
> - Do not munge skb->protocol.
> - Introduce nft_set_bridge_pktinfo() helper.
> - Introduce nf_ct_bridge_pre_inner() helper.
> - nf_ct_bridge_pre(): Don't trim on ph->hdr.length, only compare to what
>    ip header claims and return NF_ACCEPT if it does not match.
> - nf_ct_bridge_pre(): Renamed u32 data_len to pppoe_len.
> - nf_ct_bridge_pre(): Reset network_header only when ret == NF_ACCEPT.
> - nf_checksum(_partial)(): Use of skb_network_offset().
> - nf_checksum(_partial)(): Use 'if (WARN_ON()) return 0' instead.
> - nf_checksum(_partial)(): Added comments
> 
> Changes in v14:
> 
> - nf_checksum(_patial): Use DEBUG_NET_WARN_ON_ONCE(
>    !skb_pointer_if_linear()) instead of pskb_may_pull().
> - nft_do_chain_bridge: Added default case ph->proto is neither
>    ipv4 nor ipv6.
> - nft_do_chain_bridge: only reset network header when ret == NF_ACCEPT.
> 
> Changes in v13:
> 
> - Do not use pull/push before/after calling nf_conntrack_in() or
>    nft_do_chain().
> - Add patch to correct calculating checksum when skb->data !=
>    skb_network_header(skb).
> 
> Changes in v12:
> 
> - Only allow tracking this traffic when a conntrack zone is set.
> - nf_ct_bridge_pre(): skb pull/push without touching the checksum,
>    because the pull is always restored with push.
> - nft_do_chain_bridge(): handle the extra header similar to
>    nf_ct_bridge_pre(), using pull/push.
> 
> Changes in v11:
> 
> - nft_do_chain_bridge(): Proper readout of encapsulated proto.
> - nft_do_chain_bridge(): Use skb_set_network_header() instead of thoff.
> - removed test script, it is now in separate patch.
> 
> v10 split from patch-set: bridge-fastpath and related improvements v9
> 
> Eric Woudstra (4):
>   netfilter: utils: nf_checksum(_partial) correct data!=networkheader
>   netfilter: bridge: Add conntrack double vlan and pppoe
>   netfilter: nft_set_pktinfo_ipv4/6_validate: Add nhoff argument
>   netfilter: nft_chain_filter: Add bridge double vlan and pppoe
> 
>  include/net/netfilter/nf_tables_ipv4.h     | 21 +++--
>  include/net/netfilter/nf_tables_ipv6.h     | 21 +++--
>  net/bridge/netfilter/nf_conntrack_bridge.c | 92 ++++++++++++++++++----
>  net/netfilter/nft_chain_filter.c           | 59 ++++++++++++--
>  net/netfilter/utils.c                      | 28 +++++--
>  5 files changed, 176 insertions(+), 45 deletions(-)
> 

Can I kindly ask, what is the status of this patch-set?

Regards,

Eric