Re: [PATCH 1/1] Re: dangerous? Setting mark in nat table

[Patrick McHardy <kaber@trash.net>]

Jozsef Kadlecsik wrote:
> On Wed, 14 Mar 2007, Jozsef Kadlecsik wrote:
> 
>> Sorry, but I disagree. The DSCP, ECN, TOS, TTL, HL targets modify the
>> packet itself and thus all belong to the mangle table alone.
> 
> 
> Umm, probably I was too terse in the sentence above...
> 
> Tecnically speaking, the targets could be "released" from the mangle
> table. However, all the tables have got a specific function. By breaking
> up the tie between the given targets ("mangle packet content thus and
> thus") and the table which carries the functionality ("mangle" table)
> just confuse the internal logic behind the system.

Well, my opinion is that the mangle table is misnamed. The only
functional difference to filter is rerouting in LOCAL_OUT if any
of the routing keys changes, so it would be better called route
table.

> The MARK/CONNMARK targets can be used to carry neutral information all
> around the netfilter framework (besides triggering routing). So I agree
> that let those be available in all tables.
> 
> Personally, I'm not so convinced about CLASSIFY, SECMARK and CONNSECMARK.
> The targets make possible to alter/modify the behaviour of external
> systems. Is there any functionality lost if the targets are restricted to
> the mangle table (taking into account the ctstate match)?

Not lost. but it requires people to duplicate rules in some cases for
no real reason.