netfilter buglog - Feb 2019 - [Bug 1322] New: Accepting in an nfqueue breaks multi-chain processing

https://bugzilla.netfilter.org/show_bug.cgi?id=1322

            Bug ID: 1322
           Summary: Accepting in an nfqueue breaks multi-chain processing
           Product: nftables
           Version: unspecified
          Hardware: All
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: kernel
          Assignee: pablo at netfilter.org
          Reporter: niconorsk at gmail.com

Created attachment 553
  --> https://bugzilla.netfilter.org/attachment.cgi?id=553&action=edit
Packet trace examples

I am trying to make NAT decisions in an nfqueue, but given this is not
supported as a verdict in queues, what I am doing is this:
- Accept and set a packet mark in the nfqueue
- In a lower priority base chain, apply the dnat rule if the packet has the
apprpriate mark

Thing is the marked packet from the nfqueue never hits the second base chain.

If I accept with a simple rule, I can see it hit the next base chain as
expected

Oddly I have done something similar in inet filter forward chains and there it
works just fine.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20190213/901f6762/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1322

Nicolai Moore <niconorsk at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Hardware|All                         |x86_64
                 OS|All                         |RedHat Linux

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20190213/d475f5af/attachment.html>