Re: [PATCH}: Make MARK target terminate (resend)

[Henrik Nordstrom <hno@marasystems.com>]

On Saturday 29 June 2002 11.46, Patrick McHardy wrote:

> A CONNMARK patch will follow but currently CONNMARK doesn't apply
> clean against 2.4.18/2.4.19-pre10 ..

Note: There is two versions of the CONNMARK patch. The one in extra 
applies if you are using the new_nat patch, the one on old_nat if 
not.

Your last posting did stir up some discussion on how to deal with 
this. Adding a "terminate" option to each and every of these 
psuedo-targets is clearly not the way to go, and only cover a very 
small subset of what is needed.

I proposed adding a new class of iptables things between matches and 
targets, being neither a match for filtering or a target that 
determines the ultimate fate of the packet. The names proposed for 
these in the discussion was modifiers or actions.

The implementation of these can be done without needing to change the 
kernel iptables API by simply piggying back on the match list in the 
table structure. The modifiers/actions need to register themselves as 
a match, and for compability with old rulesets and/or userspace tools 
as a target as well..

The userspace tools need to have a new option for calling a 
modifier/action. These should clearly be separated from matches.

So the question to the Netfilter core team is if it would be OK to add 
a new option and "module class" to the userspace tools, and have the 
existing IPT_CONTINUE targets dual-register as both a target and a 
match. I can try to whip something together if this is seen as 
something acceptable. Should be fully backwards/forward compatible 
with existing rulesets with only a minimal amount of code 
duplication. The only compability issue is that if you make use the 
new feature then you cannot go back to a older userspace or kernel..

Regards
Henrik