James King wrote:
On Thu, Jan 15, 2009 at 12:06 AM, Jan Engelhardt <jengelh@xxxxxxxxxx> wrote:
Namely that MARK.2 is available for all tables. It looks like an error,
given that the previous ones were all limited to the mangle table.
But, I would have to ask - what do we gain from limiting it to mangle?
All other *MARK targets are available for all tables too, so what was
the original reason for the table limit?
I could imagine it having to do with routing (nfmark can be used as
a routing key, as can TOS/DSCP):
target TOS 1 mangle IPv4 * * 2
target TOS 0 mangle IPv4 * * 1
target DSCP 0 mangle IPv4 * * 1
then again, MARK has more uses than just for routing; it can, for example,
serve as a way to reduce the number of rules by remembering some previous
result.
What do others think?
The only place I can see in the mangle table where nfmark has any
special consideration is in ipt_local_hook(), in case the local output
packet needs to be rerouted, but it seems a bit heavy handed to
restrict MARK there based on that one edge case. It might be useful
to have it available elsewhere, for example to be able to refine the
mark as it passes through the different tables, especially now that
the mark is maskable.
Agreed, it doesn't make sense to restrict it to mangle only.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
