CONNMARK save-mark and restore-mark not working ?

CONNMARK save-mark and restore-mark not working ?

[Ian! D. Allen]

I think this pair (marking connections with "9"):

    iptables -t mangle -A OUTPUT -j MARK --set-mark 9
    iptables -t mangle -A OUTPUT -j CONNMARK --set-mark 9

should be equivalent to this pair:

    iptables -t mangle -A OUTPUT -j MARK --set-mark 9
    iptables -t mangle -A OUTPUT -j CONNMARK --save-mark

The first pair works - I get mark=9 entries in /proc/net/ip_conntrack .
The second pair does not - I get no marks at all in ip_conntrack.

I think this pair should set packet marks from the ip_conntrack marks:

    iptables -t mangle -A OUTPUT -j CONNMARK --set-mark 9
    iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark

It does not - the packets aren't marked:

Chain OUTPUT (policy ACCEPT 2989 packets, 395K bytes)
 pkts bytes target     prot opt in     out     source               destination         
 1695  178K CONNMARK   all  --  *      *       0.0.0.0/0            0.0.0.0/0           CONNMARK set 0x9 
 1695  178K CONNMARK   all  --  *      *       0.0.0.0/0            0.0.0.0/0           CONNMARK restore 
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           MARK match 0x9 LOG flags 1 level 7 prefix `IDAMARK ' 
 1695  178K            all  --  *      *       0.0.0.0/0            0.0.0.0/0           MARK match 0x0

What am I missing?

Linux elm 2.6.10-1mdk #2 Sat Jan 29 13:10:11 EST
2005 i686 AMD Athlon(tm) XP 3200+ unknown GNU/Linux

-- 
-IAN!  Ian! D. Allen   Ottawa, Ontario, Canada
       EMail: idallen@idallen.ca   WWW: http://www.idallen.com/
       College professor (Linux) via: http://teaching.idallen.com/
       Support free and open public digital rights:  http://eff.org/

Re: CONNMARK save-mark and restore-mark not working ?

[Omar Garcia]

And this?

    iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
    iptables -t mangle -A OUTPUT -m connmark ! --mark 0 -j ACCEPT
    iptables -t mangle -A OUTPUT -j MARK --set-mark 9
    iptables -t mangle -A OUTPUT -j CONNMARK --save-mark

----- Original Message ----- 
From: "Ian! D. Allen" <idallen@idallen.ca>
To: <netfilter@lists.netfilter.org>
Sent: Friday, February 18, 2005 9:40 AM
Subject: CONNMARK save-mark and restore-mark not working ?


> I think this pair (marking connections with "9"):
>
>     iptables -t mangle -A OUTPUT -j MARK --set-mark 9
>     iptables -t mangle -A OUTPUT -j CONNMARK --set-mark 9
>
> should be equivalent to this pair:
>
>     iptables -t mangle -A OUTPUT -j MARK --set-mark 9
>     iptables -t mangle -A OUTPUT -j CONNMARK --save-mark
>
> The first pair works - I get mark=9 entries in /proc/net/ip_conntrack .
> The second pair does not - I get no marks at all in ip_conntrack.
>
> I think this pair should set packet marks from the ip_conntrack marks:
>
>     iptables -t mangle -A OUTPUT -j CONNMARK --set-mark 9
>     iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
>
> It does not - the packets aren't marked:
>
> Chain OUTPUT (policy ACCEPT 2989 packets, 395K bytes)
>  pkts bytes target     prot opt in     out     source
destination
>  1695  178K CONNMARK   all  --  *      *       0.0.0.0/0
0.0.0.0/0           CONNMARK set 0x9
>  1695  178K CONNMARK   all  --  *      *       0.0.0.0/0
0.0.0.0/0           CONNMARK restore
>     0     0 LOG        all  --  *      *       0.0.0.0/0
0.0.0.0/0           MARK match 0x9 LOG flags 1 level 7 prefix `IDAMARK '
>  1695  178K            all  --  *      *       0.0.0.0/0
0.0.0.0/0           MARK match 0x0
>
> What am I missing?
>
> Linux elm 2.6.10-1mdk #2 Sat Jan 29 13:10:11 EST
> 2005 i686 AMD Athlon(tm) XP 3200+ unknown GNU/Linux
>
> -- 
> -IAN!  Ian! D. Allen   Ottawa, Ontario, Canada
>        EMail: idallen@idallen.ca   WWW: http://www.idallen.com/
>        College professor (Linux) via: http://teaching.idallen.com/
>        Support free and open public digital rights:  http://eff.org/
>
>

Re: CONNMARK save-mark and restore-mark not working ?

[Ian! D. Allen]

On Fri, Feb 18, 2005 at 11:56:29AM +0100, Omar Garcia wrote:
> And this?
>     iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
>     iptables -t mangle -A OUTPUT -m connmark ! --mark 0 -j ACCEPT
>     iptables -t mangle -A OUTPUT -j MARK --set-mark 9
>     iptables -t mangle -A OUTPUT -j CONNMARK --save-mark

That doesn't work because, as I posted, neither --save-mark nor
--restore-mark appear to work.

The --save-mark does not set and save the mark value in any line in
/proc/net/ip_conntrack.

The --restore-mark does not take the mark value from a line in
ip_conntrack and restore it into any packet.

See my original posting for examples of this.  I think my kernel must be
broken, unless I'm misunderstanding how these things are supposed to work.

-- 
-IAN!  Ian! D. Allen   Ottawa, Ontario, Canada
       EMail: idallen@idallen.ca   WWW: http://www.idallen.com/
       College professor (Linux) via: http://teaching.idallen.com/
       Support free and open public digital rights:  http://eff.org/

Re: CONNMARK save-mark and restore-mark not working ?

[Vinod Chandran]

Hi Ian,


>I think this pair (marking connections with "9"):
>
>    iptables -t mangle -A OUTPUT -j MARK --set-mark 9
>    iptables -t mangle -A OUTPUT -j CONNMARK --set-mark 9
>  
>
 >>>>> Here the mark value of the packet as well as the mark value of 
the connection tracking entry are set to 9.

>should be equivalent to this pair:
>
>    iptables -t mangle -A OUTPUT -j MARK --set-mark 9
>    iptables -t mangle -A OUTPUT -j CONNMARK --save-mark
>  
>
 >>>> Here the mark value of the packet is set to 9, which will be saved 
to be used as conntrack mark for all the packets coming after this. But 
this has to be >>>> restored
 >>>>Try this combination
iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
iptables -t mangle -A OUTPUT -j MARK --set-mark 9
iptables -t mangle -A OUTPUT -j CONNMARK --save-mark

>>>>>Aint sure, hope it works!!!




Regards,
Vinod C

Re: CONNMARK save-mark and restore-mark not working ?

[Ian! D. Allen]

Vinod Chandran wrote:
> >   iptables -t mangle -A OUTPUT -j MARK --set-mark 9
> >   iptables -t mangle -A OUTPUT -j CONNMARK --save-mark
> Here the mark value of the packet is set to 9, which will be saved 
> to be used as conntrack mark for all the packets coming after this.

It isn't being saved.  The --save-mark does nothing.  It changes
nothing in any of my ip_conntrack lines:

   # grep 'mark=9' /proc/net/ip_conntrack
   #

That sounds broken, right?

Linux elm 2.6.10-1mdk #2 Sat Jan 29 13:10:11 EST
2005 i686 AMD Athlon(tm) XP 3200+ unknown GNU/Linux

-- 
-IAN!  Ian! D. Allen   Ottawa, Ontario, Canada
       EMail: idallen@idallen.ca   WWW: http://www.idallen.com/
       College professor (Linux) via: http://teaching.idallen.com/
       Support free and open public digital rights:  http://eff.org/

Re: CONNMARK save-mark and restore-mark not working ?

[Ian! D. Allen]

Ian! D. Allen wrote:
>     iptables -t mangle -A OUTPUT -j MARK --set-mark 9
>     iptables -t mangle -A OUTPUT -j CONNMARK --save-mark
> I get no marks at all in ip_conntrack.

Kernel bug.  Neither --save-mark nor --restore-mark work in my Mandrake
kernel.  My bug report is here:

    http://qa.mandrakesoft.com/show_bug.cgi?id=13845

The work-around is in the bug report.

-- 
-IAN!  Ian! D. Allen   Ottawa, Ontario, Canada
       EMail: idallen@idallen.ca   WWW: http://www.idallen.com/
       College professor (Linux) via: http://teaching.idallen.com/
       Support free and open public digital rights:  http://eff.org/