Re: iptables & new CONNMARK 32bit marks

[Deti Fliegl <deti@fliegl.de>]

Harald Welte wrote:
>>when using kernel 2.6.14rc5 the mark values have become 32bit but
>>latest iptables code still uses 64bit values. 
> 
> 
> It sends a 64bit value to the kernel, there's nothing wrong with that.
> The kernel is able to parse that.
> 
> 
>>This causes the kernel module to say "CONNMARK: Only supports 32bit
>>mark" 
> 
> 
> This should only happen if you actually specify a mark that is bigger
> than 0xffffffff.  
Yes you are right but if you are on a 64bit platform you might run into 
trouble with these initializations in libipt_connmark.c:

markinfo->mask = ~0UL or if(mask != ~0UL)

This will evaluate to 0xffffffffffffffff on a long variable. You should 
netter should use 0xffffffff than the hack above.

Further a #ifdef KERNEL_64_USERSPACE_32 version of the code does not 
make sense to me as 32bit will always be 32bit even on 64bit platforms :)

> Please post the specific rules in case of any doubt.
iptables -t mangle -A PREROUTING --proto tcp -j CONNMARK --restore-mark

Deti