netdev - Re: [RFD] iptables: mangle table obsoletes filter table

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <470EFA94.2090706@trash.net>
Date:	Fri, 12 Oct 2007 06:39:48 +0200
From:	Patrick McHardy <kaber@...sh.net>
To:	Al Boldi <a1426z@...ab.com>
CC:	netfilter-devel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [RFD] iptables:  mangle table obsoletes filter table

Patrick McHardy wrote:
> Please send mails discussing netfilter to netfilter-devel.

Correct address CCed and unrelated lists removed .. stupid
auto-completion :)

> Al Boldi wrote:
> 
>>With the existence of the mangle table, how useful is the filter table?
>>
>>Other than requiring the REJECT target to be ported to the mangle table, is 
>>the filter table faster than the mangle table?
> 
> 
> There are some minor differences in ordering (mangle comes before
> DNAT, filter afterwards), but for most rulesets thats completely
> irrelevant. The only difference that really matters is that mangle
> performs rerouting in LOCAL_OUT for packets that had their routing
> key changed, so its really a superset of the filter table. If you
> want to use REJECT in the mangle table, you just need to remove the
> restriction to filter, it works fine. I would prefer to also remove
> the restriction of MARK, CONNMARK etc. to mangle, they're used for
> more than just routing today so that restriction also doesn't make
> much sense. Patches for this are welcome.
> 
> 
>>If not, then shouldn't the filter table be obsoleted to avoid confusion?
> 
> 
> That would probably confuse people. Just don't use it if you don't
> need to.
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html