Hi Pablo, Can you give some advice? Thanks. Best Regards, Huajian -----邮件原件----- 发件人: Florian Westphal [mailto:fw@xxxxxxxxx] 发送时间: 2025年4月17日 22:12 收件人: Yang Huajian（杨华健） <huajianyang@xxxxxxxxxxxx> 抄送: pablo@xxxxxxxxxxxxx; kadlec@xxxxxxxxxxxxx; razor@xxxxxxxxxxxxx; idosch@xxxxxxxxxx; davem@xxxxxxxxxxxxx; dsahern@xxxxxxxxxx; edumazet@xxxxxxxxxx; kuba@xxxxxxxxxx; pabeni@xxxxxxxxxx; horms@xxxxxxxxxx; netfilter-devel@xxxxxxxxxxxxxxx; coreteam@xxxxxxxxxxxxx; bridge@xxxxxxxxxxxxxxx; netdev@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx 主题: Re: [PATCH] net: Move specific fragmented packet to slow_path instead of dropping it Huajian Yang <huajianyang@xxxxxxxxxxxx> wrote: > The config NF_CONNTRACK_BRIDGE will change the bridge forwarding for > fragmented packets. > > The original bridge does not know that it is a fragmented packet and > forwards it directly, after NF_CONNTRACK_BRIDGE is enabled, function > nf_br_ip_fragment and br_ip6_fragment will check the headroom. > > In original br_forward, insufficient headroom of skb may indeed exist, > but there's still a way to save the skb in the device driver after > dev_queue_xmit.So droping the skb will change the original bridge > forwarding in some cases. Fixes: 3c171f496ef5 ("netfilter: bridge: add connection tracking system") Reviewed-by: Florian Westphal <fw@xxxxxxxxx> This should probably be routed via Pablo. Pablo, feel free to route this via nf-next if you think its not an urgent fix, its been like this since bridge conntrack was added.
