Re: [PATCH v12 nf-next 2/2] netfilter: nft_chain_filter: Add bridge double vlan and pppoe

Eric Woudstra [off-list ref] wrote:

-	return nft_do_chain(&pkt, priv);
+	ret = nft_do_chain(&pkt, priv);
+
+	if (offset) {
+		__skb_push(skb, offset);
+		skb_reset_network_header(skb);
+		skb->protocol = outer_proto;
+	}

I don't think its a good idea to do this.

nft_do_chain() can mangle packet in arbitrary ways,
including making a duplicate, sending icmp/tcp resets in response
to packet. forwarding the packet to another interface, dropping
the packet, etc.

Wouldn't it be enough to set the skb network header if its not
set yet, without pull (and a need to push later)?