Re: [PATCH nf-next,v2] netfilter: nft_meta: add double-tagged vlan and pppoe support

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sun, Mar 22, 2026 at 11:51:47PM +0100, Pablo Neira Ayuso wrote:
> Currently:
> 
>   add rule netdev x y ip saddr 1.1.1.1
> 
> does not work with neither double-tagged vlan nor pppoe packets. This is
> because the network and transport header offset are not pointing to the
> IP and transport protocol headers in the stack.
> 
> This patch expands NFT_META_PROTOCOL and NFT_META_L4PROTO to parse
> double-tagged vlan and pppoe packets so matching network and transport
> header fields becomes possible with the existing userspace generated
> bytecode. Note that this parser only supports double-tagged vlan which
> is composed of vlan offload + vlan header in the skb payload area for
> simplicity.
> 
> NFT_META_PROTOCOL is used by bridge and netdev family as an implicit
> dependency in the bytecode to match on network header fields.
> Similarly, there is also NFT_META_L4PROTO, which is also used as an
> implicit dependency when matching on the transport protocol header
> fields.
> 
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
> v2: - Fix typo comment "packer" -> "packet".
>     - Add comment to clarify this support double-tagged vlan with
>       vlan offload + vlan header in skb data area.
>     - remove nft_meta_protocol_store() helper function.
>     Note: IPv6 still untested here.

PPPoE with IPv4 and IPv6 is working, but there is an issue with VLAN.

I will post a v3, apologies.