Re: [PATCH net-next 12/15] netfilter: flowtable: set inner protocol when popping tunnel header

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Oct 19, 2026 at 01:21:28AM +0000, netdev-bot+sashiko@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found more severe
> issue(s) in other patches of this series. This mail is only an FYI, in case
> you want to address the nit picks below when you respin.
> 
> Low priority / nit picks for your consideration:
> 
> - [Low] The commit message says the patch makes nf_flow_ip_tunnel_pop()
>   pop the outer header and set skb->protocol "instead of bailing out…
> 
> Pre-existing issues:
> - [Medium] This problem wasn't introduced by this patch, but
>   nf_flow_ip_tunnel_pop() strips the outer tunnel header with plain…
> 
> --
> 
> netfilter: flowtable: set inner protocol when popping tunnel header
> 
> This commit makes nf_flow_ip_tunnel_pop() set skb->protocol from
> ctx->tun.inner_proto after it pulls the outer tunnel header. The commit
> message calls it a preliminary patch for IPv4 over IPv6 and SIT tunnel
> flowtable offload.
> 
> > Pop the outer tunnel header and set skb->protocol to the inner protocol
> > derived from ctx->tun.inner_proto in nf_flow_ip_tunnel_pop(), instead of
> > bailing out unless the tunnel carries IP-in-IP or IPv6-in-IPv6.
> 
> [Severity: Low]
> Is this description accurate?

I think description is good enough, this is pedantic.