Re[3]: bidirectional CONNMARK?

[Wang Jian <lark@linux.net.cn>]

Hi,

Again.

The script works, but another issue arises.

I use CONNMARK's 32 bits to store two 16 bits number, the MSB of each is
used as flag to test if set.

The problem here is that TC use too simple hash to process the nfmark

static __inline__ int fw_hash(u32 handle)
{
        return handle&0xFF;
}

The hash will be futile for hi-word case.

It seems that I should write an extended CONNMARK like target.


Jesse: can you post your code here?


On Wed, 09 Mar 2005 17:54:51 +0800, Wang Jian <lark@linux.net.cn> wrote:

> Hi Henrik Nordstrom,
> 
> Below is a test script, which uses mark/mask to do bi-directional
> control. I just craft it and haven't test it yet. (Need to compile a new
> iptables in the test bed, later)
> 
> Jesse <jesse@deansoft.com.tw> tells me off-list that he has a CTDIRMARK
> target based on CONNMARK. Looking forward to his code for easier use.
> 
> 
> --snip--
> #!/bin/sh
> 
> CLEAR="iptables -F PREROUTING -t mangle"
> IPT="iptables -A PREROUTING -t mangle"
> IPTIN="iptables -A INBOUND -t mangle"
> IPTOUT="iptables -A OUTBOUND -t mangle"
> 
> $CLEAR
> 
> iptables -N INBOUND -t mangle
> iptables -N OUTBOUND -t mangle
> 
> # Start
> $IPT -i eth1 -m connmark --mark 0x80000000/0x80000000 \
>         -j CONNMARK --restore-mark --mask 0x7FFF0000
> $IPT -i eth1 -m connmark --mark 0x80000000/0x80000000 -j RETURN
> 
> $IPT -i eth0 -m connmark --mark 0x00008000/0x00008000 \
>         -j CONNMARK --restore-mark --mark 0x00007FFF
> $IPT -i eth0 -m connmark --mark 0x00008000/0x00008000 -j RETURN
> 
> # End with default to prevent rule traversal
> $IPT -i eth1 -j INBOUND
> $IPT -i eth1 -m connmark --mark ! 0x80000000/0x80000000 \
>         -j CONNMARK --set-mark  0x80000000/0x8FFF0000
> $IPT -i eth1 -j RETURN
> 
> $IPT -i eth0 -j OUTBOUND
> $IPT -i eth0 -m connmark --mark ! 0x00008000/0x00008000 \
>         -j CONNMARK --set-mark  0x00008000/0x00008FFF
> $IPT -i eth0 -j RETURN
> 
> # Classes
> $IPTOUT -p tcp --sport 80 -j CONNMARK --set-mark 0x80030000/0xFFFF0000
> $IPTOUT -p tcp --sport 80 -j RETURN
> 
> 
> 
> On Wed, 9 Mar 2005 10:24:50 +0100 (CET), Henrik Nordstrom <hno@marasystems.com> wrote:
> 
> > On Wed, 9 Mar 2005, Wang Jian wrote:
> > 
> > > What is the CONNMARK's purpose?
> > 
> > To act as a decision memory on the connection. What you use this memory 
> > for is up to you.
> > 
> > > I think it is to reduce rule traversal,
> > 
> > This is one of many applications.
> > 
> > The --save-mark/--restore-mark options to CONNMARK should be seen as a 
> > bonus. It is not the main purpose of CONNMARK. The main purpose of 
> > CONNMARK is to act as a connection oriented state memory, allowing you to 
> > remember an earlier decision about something on later packets in the same 
> > session.
> > 
> > > But an issue occurs, when we want to set 2 different marks for a single
> > > session in two directions.
> > 
> > Then you need to structure the use of CONNMARK differently, and depending 
> > on the direction set different marks.
> > 
> > > When doing QoS control as an router between two or more interfaces,
> > > bi-directional control is neccessary. Since nfmark is the most
> > > convenient way to classify packet, should we extend CONNMARK to support
> > > two marks?
> > 
> > If it helps you in reducing your ruleset, why not? Adjusting the tools to 
> > your needs is one of the cornerstones of using Open Source software.
> > 
> > But I don't think it is generally suitable for CONNMARK.
> > 
> > Regards
> > Henrik
> 
> 
> 
> -- 
>   lark
> 



-- 
  lark