Re: Bridge netfilter defered hooks

[Patrick McHardy <kaber@trash.net>]

Martijn Lievaart wrote:
> Patrick McHardy wrote:
> 
>> It can see that it would be useful for complex setups, but I can't think
>> of an efficient implementation of this. You would have to carry a table
>> of handle identifiers -> mark ranges with every packet, wouldn't you?
>>  
>>
> 
> No, no! Just an API (which doesn't need to be coupled to iptables kernel
> part at all) where one can "reserve" some bits in the nfmark. That
> handle would refer to the same bit(s) everywhere, but you don't need to
> know which bits in the mark you are exactly using. So this implies
> ANDing as well. Something along these lines (error handling simplified):
> 
> # reserve 1 bit
> MYMARK=`iptables-mark --reserve mybits:1`
> # This would return some 'handle' (most probably the offset in the mark,
> prefixed with something)
> 
> # Use MYMARK to set just one bit in the mark
> iptables -A ..... -j MARK --set $MYMARK

It seems I misunderstood you, I thought you were talking about dynamic
reservations :) Sure, something like /etc/iproute/rt_realms would make
life easier for users. But it doesn't really solve the problem that its
sometimes really hard to get along with 32 bits.