diff options
| author | Serhey Popovych <serhe.popovych@gmail.com> | 2019-11-29 11:21:33 +0200 |
|---|---|---|
| committer | Jozsef Kadlecsik <kadlec@netfilter.org> | 2019-12-09 11:16:05 +0100 |
| commit | 55b1b5093c6bb1c0330699cdfdd1f6a8254eead7 (patch) | |
| tree | f00e03b0cb1751ae461755c8468d0b01e2b00cdd /kernel/net | |
| parent | a065f8ed355f08131c39787b4c7a41543ff643b3 (diff) | |
netfilter: xt_set: Do not restrict --map-set to the mangle table
While mangle table is primary place for packet modification setting
mark, traffic class priority or hardware NIC queue can be done in any
table with exception similar to using mark in policy-based routing
setups (configured with ip-rule(8)) should be done before routing
happens (i.e. in PREROUTING chain that usable in mangle or raw tables
only).
There is no such restriction in MARK target used to set packet mark and
CLASSIFY target used to set traffic class priority. Both are free to use
in any table. There is no known target that can modify hardware queue
for packet.
This helps in keeping filtering and packet modification rules together
in filter table.
Tested with rule in filter table with SET target using --map-prio and
HTB for scheduling packets at egress.
Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Diffstat (limited to 'kernel/net')
| -rw-r--r-- | kernel/net/netfilter/xt_set.c | 5 |
1 files changed, 0 insertions, 5 deletions
diff --git a/kernel/net/netfilter/xt_set.c b/kernel/net/netfilter/xt_set.c index 07ebf55..c2735c4 100644 --- a/kernel/net/netfilter/xt_set.c +++ b/kernel/net/netfilter/xt_set.c @@ -499,11 +499,6 @@ set_target_v3_checkentry(const struct xt_tgchk_param *par) } if (info->map_set.index != IPSET_INVALID_ID) { - if (strncmp(par->table, "mangle", 7)) { - pr_warn("--map-set only usable from mangle table\n"); - ret = -EINVAL; - goto cleanup_del; - } if (((info->flags & IPSET_FLAG_MAP_SKBPRIO) | (info->flags & IPSET_FLAG_MAP_SKBQUEUE)) && (par->hook_mask & ~(1 << NF_INET_FORWARD | |