Date: Fri, 5 Jun 2009 15:54:04 +1000 (EST) From: Ian Smith <smithi@nimnet.asn.au> To: Freddie Cash <fjwcash@gmail.com> Cc: freebsd-ipfw@freebsd.org Subject: Re: Rules processing in ipfw: processing ends with rule 65535 or first match? Message-ID: <20090605152016.N38006@sola.nimnet.asn.au> In-Reply-To: <b269bc570906041523v2076ec83y90a9b8474199f457@mail.gmail.com> References: <b269bc570906041523v2076ec83y90a9b8474199f457@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, 4 Jun 2009, Freddie Cash wrote:
> Over the years, various how-tos and docs that I've read comparing ipfw
> to ipf and pf have categorised them as such:
>
> - ipf/pf compares the packet against every rule in the ruleset, and
> the last matching action is used once the end of the ruleset is
> reached (last-match-wins)
>
> - ipfw compares the packet against the rules, and stops processing
> the rulesset once a rule matches (first-match-wins)
That's true for terminal actions (allow, deny) but not for non-terminal
actions (esp. skipto), but also pipe, queue, divert, nat .. which may
continue rule processing, modulo net.inet.ip.fw.one_pass, until a match
with a terminal action occurs. worst case, rule 65535 always matches.
> And, if one wants to get the ipfw behaviour in ipf/pf, they can use
> the "quick" keyword, which stops processing of the ruleset as soon as
> one of those rules matches.
>
> IOW, for a ruleset with 1000 rules, ipf/pf will scan every single rule
> for every single packet; and ipfw will only scan the ruleset up to the
> first matching rule. In theory, the ipfw method would be a lot
> faster, and less intensive.
I can't comment on ipf or pf or their relative efficiencies.
> However, reading through the man page for ipfw(8) on FreeBSD 7.2, it
> lists the following (Description section):
> The packet passed to the firewall is compared against each
> of the rules in the firewall ruleset. When a match is found, the action
> corresponding to the matching rule is performed.
Yes, but noting the following para:
Depending on the action and certain system settings, packets can be rein-
jected into the firewall at some rule after the matching one for further
processing.
> And, later, in the Packet Flow section:
> Also note that each packet is always checked against the complete rule-
> set, irrespective of the place where the check occurs, or the source of
> the packet.
That's referring to where ipfw is invoked from on each pass, eg from
ip_input or ip_output at layer 3, or ether_demux or ether_output_frame
if filtering at layer 2 for routing, or bdg_forward if bridging. In
each such ipfw pass invoked on a packet, that indicates rule scanning
starts at the beginning of the ruleset and ends on a (terminal) match.
> These make it sound like ifpw processes the entire ruleset for every
> packet, regardless of when a match occurs.
>
> So, which is it? Is ipfw a first-match-wins and rule processing ends
> setup? Or does it check every single rule for every single packet?
First _terminal_ match terminates the search. Just saw Julian's post
arrive .. dynamic rules matching state indeed short-circuit the search
at the first encountered check-state or keep-state rule, though even in
that case the action may be a skipto rather than a terminal action.
cheers, Ian
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090605152016.N38006>