Re: Targets with "mangle" table limiting (Was: Re: Troubles with MARK target in 2.6.28)

["James King" <t.james.king@gmail.com>]

On Thu, Jan 15, 2009 at 12:06 AM, Jan Engelhardt <jengelh@medozas.de> wrote:
> Namely that MARK.2 is available for all tables. It looks like an error,
> given that the previous ones were all limited to the mangle table.
> But, I would have to ask - what do we gain from limiting it to mangle?
> All other *MARK targets are available for all tables too, so what was
> the original reason for the table limit?
>
> I could imagine it having to do with routing (nfmark can be used as
> a routing key, as can TOS/DSCP):
>
>>target TOS             1       mangle  IPv4    *       *            2
>>target TOS             0       mangle  IPv4    *       *            1
>>target DSCP            0       mangle  IPv4    *       *            1
>
> then again, MARK has more uses than just for routing; it can, for example,
> serve as a way to reduce the number of rules by remembering some previous
> result.
> What do others think?

The only place I can see in the mangle table where nfmark has any
special consideration is in ipt_local_hook(), in case the local output
packet needs to be rerouted, but it seems a bit heavy handed to
restrict MARK there based on that one edge case.  It might be useful
to have it available elsewhere, for example to be able to refine the
mark as it passes through the different tables, especially now that
the mark is maskable.