Re: tc ipt action

On Tuesday 2012-12-18 14:23, Jamal Hadi Salim wrote:

On 12-12-17 08:28 AM, Jan Engelhardt wrote:

quoted

With act_xt2 as drafted, it instead invokes a chain, which would

1. leave the construction of the target data and calling it
   to the subsystems they conceptually belong to - the packet filter
2. lets you do matches, jumps and all that.

I like #2. For #1 as long as it doesnt deviate from desire to have
one or more instances of targets, we should be fine.

Chains can store multiple targets, so no loss.

quoted

Good thing you ask. Chain names are unique within a netns, and this
act_xtables.c draft looks at the packet to get to know its netns, so
that seems fine.

My motivation for that question:
Is it possible to ignore the hook and tablename and just use the chain
name?

1. table

First, I think some targets need to relax their restrictions, such as
with xt_DSCP.

Then, only a handful of extensions remain: CT, <all NATs>,
TPROXY and REJECT. Would anyone want to call these from act_ipt?
I doubt it. :)

2. hooks

Extensions with hook limit: <NAT>, TPROXY, REJECT, CLASSIFY.
Again, I don't quite see the value of attempting to NAT from act_ipt.
CLASSIFY {c|sh?}ould be relaxed, unless I am missing something.