From mboxrd@z Thu Jan 1 00:00:00 1970 From: James King Subject: Re: Targets with "mangle" table limiting (Was: Re: Troubles with MARK target in 2.6.28) Date: Sat, 17 Jan 2009 23:08:28 -0800 Message-ID: <38bcb3ec0901172308j53b6e19ct47e968d4478bf7e7@mail.gmail.com> References: <86617ABF8F494F2A940C18251E3DC8D0@Hakkenden> <496AEEB0.3080905@trash.net> <38bcb3ec0901150408h39390a74s6fcc9f722094715d@mail.gmail.com> <496F3E5A.9050607@trash.net> <49703860.1020805@trash.net> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: Patrick McHardy , Netfilter Development Mailinglist To: Jan Engelhardt Return-path: Received: from mail-ew0-f12.google.com ([209.85.219.12]:52358 "EHLO mail-ew0-f12.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755851AbZARHIb (ORCPT ); Sun, 18 Jan 2009 02:08:31 -0500 Received: by ewy5 with SMTP id 5so463486ewy.13 for ; Sat, 17 Jan 2009 23:08:29 -0800 (PST) In-Reply-To: Sender: netfilter-devel-owner@vger.kernel.org List-ID: On Fri, Jan 16, 2009 at 12:15 AM, Jan Engelhardt wrote: >>> Are there perhaps other targets besides MARK whose table restriction >>> should be relaxed? >> >> I can think of CONNMARK, CLASSIFY, TCPOPTSTRIP for consistency with >> TCPMSS and possibly CONNSECMARK (after consulting with James Morris). >> > connmark is already relaxed, as is connsecmark. secmark and connsecmark don't specifiy the table in their xt_target structure, but they do restrict to either the mangle or security table in their tg_check functions. connmark appears to work in other tables. A quick grep shows that the following targets are restricted to the mangle table in some fashion: ipt_TTL ipt_ECN ip6t_HL (maybe we could merge this together with TTL?) CLASSIFY DSCP SECMARK CONNSECMARK MARK CONNMARK TPROXY TCPOPTSTRIP Also, REJECT is restricted to the filter table, although I'm not sure it would be useful elsewhere.