<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - consider quick accept verdict and delayed drop policy"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1471">1471</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>consider quick accept verdict and delayed drop policy
</td>
</tr>
<tr>
<th>Product</th>
<td>nftables
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>nft
</td>
</tr>
<tr>
<th>Assignee</th>
<td>pablo@netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>markinholiveira@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>Considering that nftables allows creation of multiple chains for the same hook,
it would be nice if we were able to make use of this feature in a more
practical way, for accepting and droping packets in different chains according
to its priorities.
So, we could write something like this for accepting a packet without going
through another chains of the same hook:
chain input {
type filter hook input priority 0; policy drop;
ip saddr 10.0.0.1 counter quick-accept;
}
As for delayed drop, we should have an option for dropping packets only after
the last chain of a hook gets processed. So accepted packets in other chains
only get dropped if explicitly match a rule in a chain of higher priority. This
is different from quick accept because packets can still be explicitly dropped.
Something like:
chain input {
type filter hook input priority 0; policy delayed-drop;
}
Then, packets not matching an accept or drop rule gets dropped immediately
after last input chain. Imo, this could be default and would lead to less
confusion, as seen in #1305.
Implementing something like this would allow for complex chaining to be
achieved easily while using just nftables, but if it was default, we could even
keep iptables for things that still uses it (like libvirt and lxd) and write
our custom rules in nft, knowing that packets allowed by iptables would be
honored by nftables.
For reference, I took the quick accept idea from OpenBSD PF's
(<a href="https://www.openbsd.org/faq/pf/filter.html#quick">https://www.openbsd.org/faq/pf/filter.html#quick</a>)</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>