All of lore.kernel.org
 help / color / mirror / Atom feed
From: Ingo Oeser <netdev@axxeo.de>
To: Patrick McHardy <kaber@trash.net>
Cc: Balazs Scheidler <bazsi@balabit.hu>,
	netdev@vger.kernel.org, netfilter-devel@lists.netfilter.org,
	KOVACS Krisztian <hidden@balabit.hu>
Subject: Re: [PATCH/RFC 01/10] Implement local diversion of IPv4 skbs
Date: Wed, 10 Jan 2007 14:27:31 +0100	[thread overview]
Message-ID: <200701101427.32243.netdev@axxeo.de> (raw)
In-Reply-To: <45A4DCD8.2080103@trash.net>

Patrick McHardy schrieb:
> We support bitwise use of the mark everywhere in current kernels, so
> that shouldn't be a problem anymore.

For firewall mark based policy routing to work, one must still disable 
rp_filter, because this lookup doesn't take the mark into account[1].

So this statement is not quite true, although I believe you are probably right 
for this case.

BTW: This rp_filter=0 requirement isn't even officially documented 
	(e.g. in the LARTC).


Regards

Ingo Oeser

[1] But does take TOS into account for historic (???) reasons.

  reply	other threads:[~2007-01-10 13:27 UTC|newest]

Thread overview: 47+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2007-01-03 16:33 [PATCH/RFC 00/10] Transparent proxying patches version 4 KOVACS Krisztian
2007-01-03 16:34 ` [PATCH/RFC 01/10] Implement local diversion of IPv4 skbs KOVACS Krisztian
2007-01-10  6:46   ` Patrick McHardy
2007-01-10  9:31     ` Balazs Scheidler
2007-01-10 12:32       ` Patrick McHardy
2007-01-10 13:27         ` Ingo Oeser [this message]
2007-01-10 13:42           ` Patrick McHardy
2007-01-11 14:05         ` KOVACS Krisztian
2007-01-10 10:17     ` KOVACS Krisztian
2007-01-10 12:19       ` Patrick McHardy
2007-01-16 12:49         ` KOVACS Krisztian
2007-01-16 13:19           ` Patrick McHardy
2007-01-03 16:34 ` [PATCH/RFC 02/10] Port redirection support for TCP KOVACS Krisztian
2007-01-03 16:35 ` [PATCH/RFC 03/10] Don't do the TCP socket lookup if we already have one attached KOVACS Krisztian
2007-01-03 16:35 ` [PATCH/RFC 04/10] Don't do the UDP " KOVACS Krisztian
2007-01-03 16:36 ` [PATCH/RFC 05/10] Remove local address check on IP output KOVACS Krisztian
2007-01-10  6:47   ` Patrick McHardy
2007-01-10 10:01     ` KOVACS Krisztian
2007-02-06 14:36     ` IP_FREEBIND and CAP_NET_ADMIN (was: Re: [PATCH/RFC 05/10] Remove local address check on IP output) KOVACS Krisztian
2007-02-06 19:46       ` IP_FREEBIND and CAP_NET_ADMIN David Miller
2007-02-06 20:53         ` [PATCH] tg3 : avoid an expensive divide Eric Dumazet
2007-02-06 21:19           ` David Miller
2007-02-06 22:09             ` Michael Chan
2007-02-06 21:27               ` David Miller
2007-02-07  9:54             ` Andi Kleen
2007-02-07  9:45               ` David Miller
2007-02-07  9:56               ` Eric Dumazet
2007-02-07 10:27                 ` Andi Kleen
2007-02-06 22:05           ` Michael Chan
2007-02-06 21:25             ` David Miller
2007-02-06 21:35             ` Eric Dumazet
2007-02-06 22:17           ` David Miller
2007-01-03 16:36 ` [PATCH/RFC 06/10] Create a tproxy flag in struct sk_buff KOVACS Krisztian
2007-01-03 16:37 ` [PATCH/RFC 07/10] Export UDP socket lookup function KOVACS Krisztian
2007-01-03 16:37 ` [PATCH/RFC 08/10] iptables tproxy table KOVACS Krisztian
2007-01-10 12:40   ` Patrick McHardy
2007-01-03 16:38 ` [PATCH/RFC 09/10] iptables TPROXY target KOVACS Krisztian
2007-01-10 12:45   ` Patrick McHardy
2007-01-03 16:38 ` [PATCH/RFC 10/10] iptables tproxy match KOVACS Krisztian
2007-01-03 17:23 ` [PATCH/RFC 00/10] Transparent proxying patches version 4 Evgeniy Polyakov
2007-01-08 20:30   ` KOVACS Krisztian
2007-01-03 19:33 ` Lennert Buytenhek
2007-01-04 12:13   ` KOVACS Krisztian
2007-01-04 12:16     ` Lennert Buytenhek
2007-01-07 14:11 ` Harald Welte
2007-01-07 16:11   ` Lennert Buytenhek
2007-01-07 23:58     ` Harald Welte

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=200701101427.32243.netdev@axxeo.de \
    --to=netdev@axxeo.de \
    --cc=bazsi@balabit.hu \
    --cc=hidden@balabit.hu \
    --cc=kaber@trash.net \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@lists.netfilter.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.