From cae023143d25c877d04e05c986311507e75d4167 Mon Sep 17 00:00:00 2001 From: Lorenzo Bianconi Date: Sun, 11 Oct 2026 23:59:41 +0200 Subject: [PATCH] netfilter: flowtable: set inner protocol when popping tunnel header Pop the outer tunnel header and set skb->protocol to the inner protocol derived from ctx->tun.inner_proto in nf_flow_ip_tunnel_pop(), instead of bailing out unless the tunnel carries IP-in-IP or IPv6-in-IPv6. This is a preliminary patch to support IPv4 over IPv6 and SIT tunnel flowtable offload. Signed-off-by: Lorenzo Bianconi Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_flow_table_ip.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index c8c29a9a1684..29d1a9f4a362 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -372,6 +372,11 @@ static void nf_flow_ip_tunnel_pop(struct nf_flowtable_ctx *ctx, skb_pull(skb, ctx->tun.hdr_size); skb_reset_network_header(skb); + + if (ctx->tun.inner_proto == IPPROTO_IPIP) + skb->protocol = htons(ETH_P_IP); + else + skb->protocol = htons(ETH_P_IPV6); } static bool nf_flow_skb_encap_protocol(struct nf_flowtable_ctx *ctx,