<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:fw@strlen.de" title="Florian Westphal <fw@strlen.de>"> <span class="fn">Florian Westphal</span></a>
</span> changed
<a class="bz_bug_link
bz_status_NEW "
title="NEW - Access decision from previous priority"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1295">bug 1295</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>fw@strlen.de
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Access decision from previous priority"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1295#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Access decision from previous priority"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1295">bug 1295</a>
from <span class="vcard"><a class="email" href="mailto:fw@strlen.de" title="Florian Westphal <fw@strlen.de>"> <span class="fn">Florian Westphal</span></a>
</span></b>
<pre>(In reply to Vincent from <a href="show_bug.cgi?id=1295#c0">comment #0</a>)
<span class="quote">> Hallo,
>
> <a href="https://wiki.nftables.org/wiki-nftables/index.php/">https://wiki.nftables.org/wiki-nftables/index.php/</a>
> Configuring_chains#Base_chain_priority describes that all the chains for a
> hook are executed in the order of the priority. The higher priority chains
> overrule the decision of the lower priority chains.</span >
Thats not true. I've fixed this paragraph. Drops are instant, the packet is
free'd, and no further rules or chains are evaluated.
<span class="quote">> The example from the
> wiki:
>
> table inet filter {
> # this chain is evaluated first due to priority
> chain ssh {
> type filter hook input priority 0; policy drop;
> # ssh packet accepted
> tcp dport ssh accept
> }
>
> # this chain is evaluated last due to priority
> chain input {
> type filter hook input priority 1; policy drop;
> # the same ssh packet is dropped here by means of default
> policy
> }
> }</span >
This example is correct, the later hook can still drop the packet.
<span class="quote">> Now my question: is it possible to access the previous decision in the
> current chain? Something like:</span >
Not at this time.
If verdict was drop, no re-evaluation occurs.
If verdict was accept, re-evaluation occurs.
So, if packet made it to a certain base chain, previous hooks (if any)
accepted the packet.
<span class="quote">> The source of this problem is: I want to use Docker in combination with my
> own firewall rules. Docker uses the chain ip/filter/FORWARD (and some
> DOCKER-*) at priority 0 to implement the network isolation. I don't want to
> change those chains because Docker will change them at runtime and relies on
> them. But I still want to control the forwarding of the packets.
>
> My idea was to create my own chain ip/filter/my-forward at priority -1. This
> will be executed before the docker chain. Docker provides a chain for user
> modifications DOCKER-USER. In that chain, I want to drop all the packets
> that were already droped by the previous (my-forward) chain.</span >
Thats not needed, anything that gets dropped in the -1 prio hook won't make it
to the 0-prio hooks.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>