Re: MARK targets all non-terminating

[Tom Eastep <teastep@shorewall.net>]

[-- Attachment #1: Type: text/plain, Size: 1056 bytes --]

Jan Engelhardt wrote:

> 
> This non-terminating behavior of [file list] is _NOT_ documented in the 
> iptables manpage. Is it even intended at all?
> 

A couple of observations:

a) This non-terminating behavior has been around since the MARK targets first
   appeared so existing tools and scripts depend on it. As an example, if
   "-j MARK" were suddenly terminating, most current uses of
   "-j CONNMARK --save-mark" would cease working since they typically
   follow matching "-j MARK" rules.
   
c) ebtables provides a nice solution which allows "-j mark" to be either
   terminating (the default), or non-terminating depending on the
   inclusion of a "--mark-target" phrase. That would be a nice addition
   to the iptables MARK targets, so long as the default was CONTINUE
   rather than ACCEPT.

-Tom 
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 252 bytes --]