Clarification of terse ip-rule statement

Clarification of terse ip-rule statement

[Leroy Tennison]

Im1hbiBpcC1ydWxlIiBzdGF0ZXM6IFRoZSBSUERCIGlzIHNjYW5uZWQgaW4gb3JkZXIgb2YgZGVj
cmVhc2luZyBwcmlvcml0eS4NCg0KQW0gSSB1bmRlcnN0YW5kaW5nIHRoYXQgY29ycmVjdGx5IHRv
IG1lYW46IEZvciBldmVyeSBzZWxlY3RvciBpbiB0aGUgaXAgcnVsZSBsaXN0IHdoaWNoIG1hdGNo
ZXMsIGlmIGEgdGFibGUgaXMgYXNzb2NpYXRlZCB3aXRoIHRoYXQgcnVsZSBpdCB3aWxsIGJlIGV4
YW1pbmVkIGJlZm9yZSB0YWJsZSBtYWluIGFuZCwgaWYgYSByb3V0ZSBlbnRyeSAoZWl0aGVyIHNw
ZWNpZmljIG9yIGRlZmF1bHQpIGlzIGZvdW5kIGl0IHdpbGwgYmUgdXNlZCwgbm8gZnVydGhlciBz
ZWxlY3RvciBwcm9jZXNzaW5nIHdpbGwgYmUgZG9uZS4gIElmIG5vdGhpbmcgaXMgZm91bmQgdGhl
biBydWxlIGxpc3QgcHJvY2Vzc2luZyB3aWxsIGNvbnRpbnVlIChwb3NzaWJseSB3aXRoIG90aGVy
IHNlbGVjdG9yIG1hdGNoZXM/DQoNClRoZSByZWFzb24gSSBhc2sgaXMgSSBoYWQgYSBzaXR1YXRp
b24gd2hlcmUgYSByZXNwb25zZSB0byBhIHBhY2tldCB3YXMgdGFraW5nIHRoZSBkZWZhdWx0IHJv
dXRlIHJhdGhlciB0aGFuIHRoZSBzcGVjaWZpYyByb3V0ZSBmb3IgdGhhdCBzaXR1YXRpb24gYXMg
ZGVmaW5lZCBpbiBtYWluLiAgVGhlIHJlc3BvbnNlIG1hdGNoZWQgYSBzZWxlY3RvciBhbmQgaXQn
cyBhc3NvY2lhdGVkIHRhYmxlIGhhZCB0aGUgc2FtZSBkZWZhdWx0IHJvdXRlIGFzIG1haW4gYnV0
IG5vIHNwZWNpZmljIG1hdGNoLiAgV2hlbiBpIGFkZGVkIHRoZSBzcGVjaWZpYyBtYXRjaCB0byB0
aGF0IHRhYmxlIHRoZSByZXNwb25zZSBwYWNrZXQgcm91dGVkIGNvcnJlY3RseS4NCg0KDQpMZXJv
eSBUZW5uaXNvbg0KTmV0d29yayBJbmZvcm1hdGlvbi9DeWJlciBTZWN1cml0eSBTcGVjaWFsaXN0
DQpFOiBsZXJveUBkYXRhdm9pY2VpbnQuY29tDQoyMjIwIEJ1c2ggRHINCk1jS2lubmV5LCBUZXhh
cw0KNzUwNzANCnd3dy5kYXRhdm9pY2VpbnQuY29tDQpUaGlzIG1lc3NhZ2UgaGFzIGJlZW4gc2Vu
dCBvbiBiZWhhbGYNCm9mIGEgY29tcGFueSB0aGF0IGlzIHBhcnQgb2YgdGhlIEhhcnJpcyBPcGVy
YXRpbmcgR3JvdXAgb2YNCkNvbnN0ZWxsYXRpb24gU29mdHdhcmUgSW5jLiBUaGVzZSBjb21wYW5p
ZXMgYXJlIGxpc3RlZA0KaGVyZQ0KLg0KSWYgeW91IHByZWZlciBub3QgdG8gYmUgY29udGFjdGVk
IGJ5IEhhcnJpcw0KT3BlcmF0aW5nIEdyb3VwDQpwbGVhc2Ugbm90aWZ5IHVzDQouDQpUaGlzIG1l
c3NhZ2UgaXMgaW50ZW5kZWQgZXhjbHVzaXZlbHkgZm9yIHRoZQ0KaW5kaXZpZHVhbCBvciBlbnRp
dHkgdG8gd2hpY2ggaXQgaXMgYWRkcmVzc2VkLiBUaGlzIGNvbW11bmljYXRpb24NCm1heSBjb250
YWluIGluZm9ybWF0aW9uIHRoYXQgaXMgcHJvcHJpZXRhcnksIHByaXZpbGVnZWQgb3INCmNvbmZp
ZGVudGlhbCBvciBvdGhlcndpc2UgbGVnYWxseSBleGVtcHQgZnJvbSBkaXNjbG9zdXJlLiBJZiB5
b3UgYXJlDQpub3QgdGhlIG5hbWVkIGFkZHJlc3NlZSwgeW91IGFyZSBub3QgYXV0aG9yaXplZCB0
byByZWFkLCBwcmludCwNCnJldGFpbiwgY29weSBvciBkaXNzZW1pbmF0ZSB0aGlzIG1lc3NhZ2Ug
b3IgYW55IHBhcnQgb2YgaXQuIElmIHlvdQ0KaGF2ZSByZWNlaXZlZCB0aGlzIG1lc3NhZ2UgaW4g
ZXJyb3IsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlcg0KaW1tZWRpYXRlbHkgYnkgZS1tYWlsIGFu
ZCBkZWxldGUgYWxsIGNvcGllcyBvZiB0aGUNCm1lc3NhZ2UuDQoNCg=

Re: Clarification of terse ip-rule statement

[Grant Taylor]

[-- Attachment #1: Type: text/plain, Size: 1023 bytes --]

On 02/21/2019 01:23 PM, Leroy Tennison wrote:
> The reason I ask is I had a situation where a response to a packet 
> was taking the default route rather than the specific route for that 
> situation as defined in main.  The response matched a selector and it's 
> associated table had the same default route as main but no specific match. 
> When i added the specific match to that table the response packet routed 
> correctly.

This matches my understanding and experience.

I like to think of it this way:

the RPDB (ip rules) specify which routing table(s) should be traversed. 
Without any criteria otherwise, the Linux kernel will search each of the 
routing table(s) in RPDB order looking for a match.  The first match wins.

So if you had an unqualified rule to search an alternate routing table 
that had a higher (?) priority than the main routing table and that 
alternate routing table had a default route, then that's the route that 
would be used.



-- 
Grant. . . .
unix || die


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4008 bytes --]