<html>
<head>
<base href="https://bugzilla.netfilter.org/">
</head>
<body><span class="vcard"><a class="email" href="mailto:marius@nuenneri.ch" title="marius@nuenneri.ch">marius@nuenneri.ch</a>
</span> changed
<a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED WONTFIX - Design flaw in chain traversal"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1758">bug 1758</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>marius@nuenneri.ch
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED WONTFIX - Design flaw in chain traversal"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1758#c2">Comment # 2</a>
on <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED WONTFIX - Design flaw in chain traversal"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1758">bug 1758</a>
from <span class="vcard"><a class="email" href="mailto:marius@nuenneri.ch" title="marius@nuenneri.ch">marius@nuenneri.ch</a>
</span></b>
<pre>I also found this behaviour quite confusing.
Before I discovered this, I assumed there are two types of packet filters:
1. Exectute the statement on the first matching rule (like FreeBSD's ipfw)
2. Execute the statement on the last matching rule (like OpenBSD's pf).
Now I see that there is a third way
3. Execute a drop on the first matching rule, but an accept on the last
matching rule.
OpenBSD's pf actually solves this by having a `quick` keyword, which makes a
rule terminate the rule evaluation and execute the statement.[1]
IMHO this makes a lot of sense for type 2 and 3 packet filters.
This matches the "really accept" that Phil is talking about, but I don't
think people have requests to override it, and this has been the case in
OpenBSD for at least two decades.
I conclude that it would make sense to add the quick keyword to nftables.
[1] <a href="https://www.openbsd.org/faq/pf/filter.html">https://www.openbsd.org/faq/pf/filter.html</a></pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>