<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:markinholiveira@gmail.com" title="Marcos de Oliveira <markinholiveira@gmail.com>"> <span class="fn">Marcos de Oliveira</span></a>
</span> changed
<a class="bz_bug_link
bz_status_NEW "
title="NEW - Rules in first chain same hook ignored if second chain has policy drop"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1305">bug 1305</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>markinholiveira@gmail.com
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Rules in first chain same hook ignored if second chain has policy drop"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1305#c7">Comment # 7</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Rules in first chain same hook ignored if second chain has policy drop"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1305">bug 1305</a>
from <span class="vcard"><a class="email" href="mailto:markinholiveira@gmail.com" title="Marcos de Oliveira <markinholiveira@gmail.com>"> <span class="fn">Marcos de Oliveira</span></a>
</span></b>
<pre>(In reply to Egbert S from <a href="show_bug.cgi?id=1305#c5">comment #5</a>)
<span class="quote">> > I have following hooks:
> >
> > filter input prio 0
> >
> > nat prerouting prio -500
>
> The priority values only works within the same hook.</span >
True, but that's not so useful, as later chains can't have a drop policy.
If you accept a packet in a chain, it will continue evaluating against other
chains of higher priority in the same hook. So if other chains have a policy of
drop, your accepted packet gona get dropped.
That's something hard to change, as it would break lots of users's
implementations. But, we could get new options added to implement better logic,
as I suggested in #1471.
As currently we have an "drop" verdict, which is applied immediately, and an
"accept", which continue evaluating in same hook against other chains's rules,
I suggested "quick-accept" which would act as current's drop and stop
evaluating other chains in current hook, and a "delayed-drop", which will drop
packet only at the end of current hook. This way, no user implementation would
break.
Apart from being two new verdicts, it could also be implemented as two keywords
instead (quick and delay), so you could use it interchangeably (delay accept,
quick drop, with proper policy actions).</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>