Re: CLASSIFY target

[Patrick McHardy <kaber@trash.net>]

Chip Schweiss wrote:
> Is there a technical reason why the CLASSIFY target can only be called
> from the POSTROUTING chain of the mangle table?  
> 
> It seems rather wasteful to repeat all the logic necessary to classify a
> packet in the POSTROUTING chain that in most case will already be done
> in the filter table.

It can also be called in the FORWARD and OUTPUT chains, but thats not
the point of course. Technically there is no reason for this, its more
of a convention to do packet mangling in the mangle table. The only
case where it is really necessary is marking packets for routing by
fwmark in the output chain, since these packets need to be rerouted.

I guess we could remove this restriction.

> Besides, in my testing the overhead of classifying
> packets in the mangle table seems to be many magnitudes greater than in
> the filter table.

How did you test this? Please post numbers if you have any.

> Would it be possible to simply remove the checks if the rule is being
> added in the POSTROUTING chain of mangle table from the kernel &
> iptables sources and have the CLASSIFY target work from the filter
> table?

Feel free so send a patch, but please also do this for all other
targets restricted to the mangle table and update the manpage.