53 lines
1.8 KiB
Diff
53 lines
1.8 KiB
Diff
From 94a7ba900e7ea7da14a796edc10401a700d3b894 Mon Sep 17 00:00:00 2001
|
|
From: Florian Westphal <fwestpha@redhat.com>
|
|
Date: Wed, 13 May 2026 17:16:43 +0200
|
|
Subject: [PATCH] netfilter: nf_tables: reject immediate NF_QUEUE verdict
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-168848
|
|
Upstream Status: commit da107398cbd4
|
|
|
|
commit da107398cbd4bbdb6bffecb2ce86d5c9384f4cec
|
|
Author: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Date: Tue Mar 31 23:08:02 2026 +0200
|
|
|
|
netfilter: nf_tables: reject immediate NF_QUEUE verdict
|
|
|
|
nft_queue is always used from userspace nftables to deliver the NF_QUEUE
|
|
verdict. Immediately emitting an NF_QUEUE verdict is never used by the
|
|
userspace nft tools, so reject immediate NF_QUEUE verdicts.
|
|
|
|
The arp family does not provide queue support, but such an immediate
|
|
verdict is still reachable. Globally reject NF_QUEUE immediate verdicts
|
|
to address this issue.
|
|
|
|
Fixes: f342de4e2f33 ("netfilter: nf_tables: reject QUEUE/DROP verdict parameters")
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
Signed-off-by: Florian Westphal <fwestpha@redhat.com>
|
|
|
|
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
|
|
index 81164ad..7cc4163 100644
|
|
--- a/net/netfilter/nf_tables_api.c
|
|
+++ b/net/netfilter/nf_tables_api.c
|
|
@@ -11804,8 +11804,6 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
|
|
switch (data->verdict.code) {
|
|
case NF_ACCEPT:
|
|
case NF_DROP:
|
|
- case NF_QUEUE:
|
|
- break;
|
|
case NFT_CONTINUE:
|
|
case NFT_BREAK:
|
|
case NFT_RETURN:
|
|
@@ -11840,6 +11838,11 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
|
|
|
|
data->verdict.chain = chain;
|
|
break;
|
|
+ case NF_QUEUE:
|
|
+ /* The nft_queue expression is used for this purpose, an
|
|
+ * immediate NF_QUEUE verdict should not ever be seen here.
|
|
+ */
|
|
+ fallthrough;
|
|
default:
|
|
return -EINVAL;
|
|
}
|