Re: [PATCH nf] netfilter: nf_tables: reject immediate NF_QUEUE verdict

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Mar 31, 2026 at 11:41:45PM +0200, Pablo Neira Ayuso wrote:
> nft_queue is always used from userspace nftables to deliver the NF_QUEUE
> verdict, reject immediate NF_QUEUE verdict.

Actually, a bit terse description, maybe this version is better:

    netfilter: nf_tables: reject immediate NF_QUEUE verdict
    
    nft_queue is always used from userspace nftables to deliver the NF_QUEUE
    verdict. Immediately emitting an NF_QUEUE verdict is never used by the
    userspace nft tools, so reject immediate NF_QUEUE verdicts.
    
    The arp family does not provide queue support, but such an immediate
    verdict is still reachable. Globally reject NF_QUEUE immediate verdicts
    to address this issue.

> Fixes: f342de4e2f33 ("netfilter: nf_tables: reject QUEUE/DROP verdict parameters")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
>  net/netfilter/nf_tables_api.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index 3922cff1bb3d..8c42247a176c 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -11667,8 +11667,6 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
>  	switch (data->verdict.code) {
>  	case NF_ACCEPT:
>  	case NF_DROP:
> -	case NF_QUEUE:
> -		break;
>  	case NFT_CONTINUE:
>  	case NFT_BREAK:
>  	case NFT_RETURN:
> @@ -11703,6 +11701,11 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
>  
>  		data->verdict.chain = chain;
>  		break;
> +	case NF_QUEUE:
> +		/* The nft_queue expression is used for this purpose, an
> +		 * immediate NF_QUEUE verdict should not ever be seen here.
> +		 */
> +		fallthrough;
>  	default:
>  		return -EINVAL;
>  	}
> -- 
> 2.47.3
> 
>