Eric Woudstra <ericwouds@xxxxxxxxx> wrote:
> - return nft_do_chain(&pkt, priv);
> + ret = nft_do_chain(&pkt, priv);
> +
> + if (offset) {
> + __skb_push(skb, offset);
> + skb_reset_network_header(skb);
> + skb->protocol = outer_proto;
> + }
I don't think its a good idea to do this.
nft_do_chain() can mangle packet in arbitrary ways,
including making a duplicate, sending icmp/tcp resets in response
to packet. forwarding the packet to another interface, dropping
the packet, etc.
Wouldn't it be enough to set the skb network header if its not
set yet, without pull (and a need to push later)?
