Hi Pablo, Can you give some advice?
Thanks. Best Regards, Huajian -----邮件原件----- 发件人: Florian Westphal [mailto:f...@strlen.de] 发送时间: 2025年4月17日 22:12 收件人: Yang Huajian（杨华健） <huajiany...@asrmicro.com> 抄送: pa...@netfilter.org; kad...@netfilter.org; ra...@blackwall.org; ido...@nvidia.com; da...@davemloft.net; dsah...@kernel.org; eduma...@google.com; k...@kernel.org; pab...@redhat.com; ho...@kernel.org; netfilter-de...@vger.kernel.org; coret...@netfilter.org; bridge@lists.linux.dev; net...@vger.kernel.org; linux-ker...@vger.kernel.org 主题: Re: [PATCH] net: Move specific fragmented packet to slow_path instead of dropping it Huajian Yang <huajiany...@asrmicro.com> wrote: > The config NF_CONNTRACK_BRIDGE will change the bridge forwarding for > fragmented packets. > > The original bridge does not know that it is a fragmented packet and > forwards it directly, after NF_CONNTRACK_BRIDGE is enabled, function > nf_br_ip_fragment and br_ip6_fragment will check the headroom. > > In original br_forward, insufficient headroom of skb may indeed exist, > but there's still a way to save the skb in the device driver after > dev_queue_xmit.So droping the skb will change the original bridge > forwarding in some cases. Fixes: 3c171f496ef5 ("netfilter: bridge: add connection tracking system") Reviewed-by: Florian Westphal <f...@strlen.de> This should probably be routed via Pablo. Pablo, feel free to route this via nf-next if you think its not an urgent fix, its been like this since bridge conntrack was added.
