table traversal

table traversal

[William Olbrys]

I have a question about table traversal.

Suppose I have two chains, in this order in a table.

iptables -A FORWARD -s 10.1.2.3 -j ACCEPT
iptables -A FORWARD -s 10.1.2.0/255.255.255.0 -j DROP

Under this scenario a packet from 10.1.2.3 would fall under both rules.
But would the packets be dropped or allowed to go through? Once it has
found a match for a packet will it traverse the rest of the table or
simply pass to the next one?

Will





 E2-O: The presence of this footer indicates the message has been scanned for viruses by the WebShield e500.

Re: table traversal

[Maciej Soltysiak]

> iptables -A FORWARD -s 10.1.2.3 -j ACCEPT
> iptables -A FORWARD -s 10.1.2.0/255.255.255.0 -j DROP
>
> Under this scenario a packet from 10.1.2.3 would fall under both rules.
> But would the packets be dropped or allowed to go through?
It will be allowed because ACCEPT/DROP are nonreturning rules and the
decision is final.
Note that there are returning targets, like: LOG, TOS, etc. After matching
these the traversal continues.

Regards,
Maciej

Re: table traversal

[Cedric Blancher]

Le ven 28/02/2003 à 14:09, William Olbrys a écrit :
> I have a question about table traversal.
> Suppose I have two chains, in this order in a table.
> 
> iptables -A FORWARD -s 10.1.2.3 -j ACCEPT
> iptables -A FORWARD -s 10.1.2.0/255.255.255.0 -j DROP
> 
> Under this scenario a packet from 10.1.2.3 would fall under both rules.
> But would the packets be dropped or allowed to go through? Once it has
> found a match for a packet will it traverse the rest of the table or
> simply pass to the next one?

Rules evaluation is sequential, meaning that the first matching rule's
target applies.

In the exemple you give, packet will be allowed and is sent to next
table attached to the actual hook. In this cas, there's no more table to
evaluate, so packet is sent to NF_IP_POSTROUTING, and will be evaluate
in all table that have a chain attached to this hook.

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
Consultant en sécurité des systèmes et réseaux  - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE