On Fri, Jan 16, 2009 at 12:15 AM, Jan Engelhardt <jengelh@xxxxxxxxxx> wrote: >>> Are there perhaps other targets besides MARK whose table restriction >>> should be relaxed? >> >> I can think of CONNMARK, CLASSIFY, TCPOPTSTRIP for consistency with >> TCPMSS and possibly CONNSECMARK (after consulting with James Morris). >> > connmark is already relaxed, as is connsecmark. secmark and connsecmark don't specifiy the table in their xt_target structure, but they do restrict to either the mangle or security table in their tg_check functions. connmark appears to work in other tables. A quick grep shows that the following targets are restricted to the mangle table in some fashion: ipt_TTL ipt_ECN ip6t_HL (maybe we could merge this together with TTL?) CLASSIFY DSCP SECMARK CONNSECMARK MARK CONNMARK TPROXY TCPOPTSTRIP Also, REJECT is restricted to the filter table, although I'm not sure it would be useful elsewhere. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
