> After not receiving a response for two weeks second try:
Sorry. Here we go:
> The attached patch adds a new option --terminate to the MARK target
> which lets the user choose if MARK should return IPT_CONTINUE
> (normal behaviour) or NF_ACCEPT (to terminate further rule processing).
[...]
> A CONNMARK patch will follow
Will you also add this to LOG, ULOG, and any other IPT_CONTINUE target
that may come up in the future? In my opinion, this is misguided, because
it leads to much code duplication in target modules.
There is already a flexible, but somewhat ugly, way to do what you want:
create a user defined chain that first MARKs then ACCEPTs (or does whatever
else one may want to be done after MARK). Obviously, this is a bit ugly
because you need one such chain per MARK value.
The good way to do it, in my opinion, would be to permit more than one
target per iptables rule. You could then write
iptables -A somewhere -m something -j MARK --mark 1 -j ACCEPT
Note that I do _not_ oppose adding your --terminate option to MARK, as a
stopgap measure. If that is helpful now, it should be done, IMHO.
However, I'd like to hear people's opinions on the multitarget approach.
best regards
Patrick
