On Thu, Jan 15, 2009 at 12:06 AM, Jan Engelhardt <jengelh@xxxxxxxxxx> wrote: > Namely that MARK.2 is available for all tables. It looks like an error, > given that the previous ones were all limited to the mangle table. > But, I would have to ask - what do we gain from limiting it to mangle? > All other *MARK targets are available for all tables too, so what was > the original reason for the table limit? > > I could imagine it having to do with routing (nfmark can be used as > a routing key, as can TOS/DSCP): > >>target TOS 1 mangle IPv4 * * 2 >>target TOS 0 mangle IPv4 * * 1 >>target DSCP 0 mangle IPv4 * * 1 > > then again, MARK has more uses than just for routing; it can, for example, > serve as a way to reduce the number of rules by remembering some previous > result. > What do others think? The only place I can see in the mangle table where nfmark has any special consideration is in ipt_local_hook(), in case the local output packet needs to be rerouted, but it seems a bit heavy handed to restrict MARK there based on that one edge case. It might be useful to have it available elsewhere, for example to be able to refine the mark as it passes through the different tables, especially now that the mark is maskable. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
