On Thu, Jan 15, 2009 at 8:44 AM, Jan Engelhardt <jengelh@xxxxxxxxxx> wrote: > > On Thursday 2009-01-15 14:47, Patrick McHardy wrote: >>>> Namely that MARK.2 is available for all tables. It looks like an error, >>>> given that the previous ones were all limited to the mangle table. >>>> But, I would have to ask - what do we gain from limiting it to mangle? >>>>[...] >>>> I could imagine it having to do with routing (nfmark can be used as >>>> a routing key, as can TOS/DSCP): >>>>[...] >>>> What do others think? >> >> Agreed, it doesn't make sense to restrict it to mangle only. >> > Are there perhaps other targets besides MARK whose table restriction > should be relaxed? Could TOS/DSCP just call ip_route_me_harder() directly when necessary instead of relying on the mangle hook to do so? This would allow it to be used everywhere. Also, I would have thought TTL to be a considered field when determining if a reroute is needed, but it looks like only mark, iph, saddr, daddr, and tos are checked currently, so there doesn't seem to be an obvious benefit to restricting that target to mangle. With those targets available everywhere, it might allow for future collapse of the tables, since mangle would become somewhat redundant. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
