Re: [PATCH nf-next 0/2] netfilter: bridge: refragment packets with a vlan tag moved by the bridge

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

On Mon, Nov 09, 2026 at 11:18:40AM -0800, Laveesh Bansal wrote:
> Fragmented packets are dropped on a vlan filtering bridge with bridge
> conntrack when the protocol of their vlan tag differs from the bridge's
> vlan_protocol, an 802.1Q tag on an 802.1ad bridge for instance. Patch 1
> handles the tag when refragmenting. Patch 2 adds a selftest.
> 
> As discussed with Pablo in the first posting
> (https://lore.kernel.org/r/atck-NoWvemxIsF6@chamomile), the
> DEBUG_NET_WARN_ON_ONCE() change went to nf on its own and is now in the net
> tree as 683ff28ab18a. This series is based on that commit and is meant
> for nf-next, which does not have it yet.
> 
> Changes since the first posting
> (https://lore.kernel.org/r/20261020000308.37362-1-laveeshb@laveeshbansal.com):
> patch 1 keeps the tag together with the ethernet header instead of in
> separate fields, and the selftest runs its checks even if the kernel had
> warned before.
> 
> I used an LLM tool for the analysis, the code and the test runs.

Do you have a usecase for this?

> I tested the series on arm64 and x86_64, with and without KASAN, lockdep
> and kmemleak. The selftest fails without patch 1.
> 
> Laveesh Bansal (2):
>   netfilter: bridge: refragment packets with a vlan tag moved by the
>     bridge
>   selftests: netfilter: add bridge conntrack test for vlan protocol
>     mismatch
> 
>  include/linux/netfilter_bridge.h              |   4 +-
>  net/bridge/netfilter/nf_conntrack_bridge.c    |  46 +++-
>  .../testing/selftests/net/netfilter/Makefile  |   1 +
>  .../net/netfilter/bridge_ct_vlan_proto.sh     | 198 ++++++++++++++++++
>  tools/testing/selftests/net/netfilter/config  |   1 +
>  5 files changed, 241 insertions(+), 9 deletions(-)
>  create mode 100755 tools/testing/selftests/net/netfilter/bridge_ct_vlan_proto.sh
> 
> 
> base-commit: 683ff28ab18accb25268741a724645eee839d41a
> -- 
> 2.43.0
>