Re: [PATCH] netfilter: br_netfilter: reject unsafe neighbour devices for DNAT

[Florian Westphal <fw@strlen.de>]

Kyle Zeng <kylebot@openai.com> wrote:
> On Sat, Nov 07, 2026 at 08:25:41AM +0100, Florian Westphal wrote:
> > > +			struct net_device *dev = neigh->dev;
> > > +
> > > +			/* The neighbour queue must keep skb->dev alive. A VLAN
> > > +			 * device also holds a reference to its real device.
> > > +			 */
> > > +			if (is_vlan_dev(dev))
> > > +				dev = vlan_dev_real_dev(dev);
> > > +			if (dev != skb->dev) {
> > > +				neigh_release(neigh);
> > > +				goto free_skb;
> > > +			}
> > > +
[..]
> 
> The VLAN check is intended to preserve existing VLAN DNAT behavior.
> 
> bridge-nf-filter-vlan-tagged=1, bridge-nf-pass-vlan-input-dev=1, and br0.100, the earlier test can pass with
> dst->dev == dev == br0.100. The continuation then changes skb->dev to br0, so the strict comparison would
> drop that valid packet.

Then please consider sending a v2 that explains this.

/* The neighbour queue must keep skb->dev alive. dst->dev is either
 * the bridge or a vlan on top of bridge
 * (bridge-nf-pass-vlan-input-dev=1).
 */

might just be enough.  Thanks.