Re: Bridge netfilter defered hooks

[Martijn Lievaart <m@rtij.nl>]

Patrick McHardy wrote:

>Martijn Lievaart wrote:
>  
>
>>Patrick McHardy wrote:
>>
>>    
>>
>>Something I've been thinking about. Currently it is impossible to write
>>any kind of generic tool that uses the mark and plays nice with other
>>generic tools. Maybe we need some kind of API that allocates bits in the
>>mark. Something like "give me two bits", that returns some handle to the
>>bits. That handle could then be used for identifying the bits in the mark.
>>    
>>
>
>It can see that it would be useful for complex setups, but I can't think
>of an efficient implementation of this. You would have to carry a table
>of handle identifiers -> mark ranges with every packet, wouldn't you?
>  
>

No, no! Just an API (which doesn't need to be coupled to iptables kernel 
part at all) where one can "reserve" some bits in the nfmark. That 
handle would refer to the same bit(s) everywhere, but you don't need to 
know which bits in the mark you are exactly using. So this implies 
ANDing as well. Something along these lines (error handling simplified):

# reserve 1 bit
MYMARK=`iptables-mark --reserve mybits:1`
# This would return some 'handle' (most probably the offset in the mark, 
prefixed with something)

# Use MYMARK to set just one bit in the mark
iptables -A ..... -j MARK --set $MYMARK

M4