James King wrote:
On Thu, Jan 15, 2009 at 8:44 AM, Jan Engelhardt <jengelh@xxxxxxxxxx> wrote:
On Thursday 2009-01-15 14:47, Patrick McHardy wrote:
Namely that MARK.2 is available for all tables. It looks like an error,
given that the previous ones were all limited to the mangle table.
But, I would have to ask - what do we gain from limiting it to mangle?
[...]
I could imagine it having to do with routing (nfmark can be used as
a routing key, as can TOS/DSCP):
[...]
What do others think?
Agreed, it doesn't make sense to restrict it to mangle only.
Are there perhaps other targets besides MARK whose table restriction
should be relaxed?
Could TOS/DSCP just call ip_route_me_harder() directly when necessary
instead of relying on the mangle hook to do so? This would allow it
to be used everywhere.
That doesn't seem like a good idea. Rerouting should be an optional
feature, available in the (misnamed) mangle table. There might be
completely different reasons for changing DSCP. So making them available
in other tables yes, making them responsible for rerouting no.
Also, I would have thought TTL to be a considered field when
determining if a reroute is needed, but it looks like only mark, iph,
saddr, daddr, and tos are checked currently, so there doesn't seem to
be an obvious benefit to restricting that target to mangle.
With those targets available everywhere, it might allow for future
collapse of the tables, since mangle would become somewhat redundant.
Yes, lets just remove all those silly restrictions and just keep
the few ones that actually have a technical reason.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
