Re: ip_conntrack_tuple and marks

[Martijn Lievaart <m@rtij.nl>]

Carl-Daniel Hailfinger wrote:

>Pablo Neira Ayuso wrote:
>  
>
>>Carl-Daniel Hailfinger wrote:
>>    
>>
>>>is it possible to add a nfmark field to ip_conntrack_tuple
>>>so that only packets with a certain mark set are matched to
>>>a connection? I'm trying to filter/nat multiple independent
>>>connections with same ip/proto/port tuples on both sides
>>>and the only distinguishing property of the different
>>>connections is their nfmark. Using NOTRACK doesn't help
>>>because it can only exclude packets from tracking, not
>>>match packets to different expectations.
>>>      
>>>
>>Could the connmark match/target be what you need?
>>    
>>
>
>Unfortunately, connmark does exactly the opposite of what
>I'm trying to achieve.
>
>connmark: get/set fwmark based on flow
>my problem: handle different flows with identical
>  srcip/dstip/sport/dport/proto tuples where the only
>  difference is the packet fwmark
>
>Example (what I hope to get working)
>SYN packet from 10.0.0.1:1024->10.0.0.2:80 fwmark 1 creates
>one connection.
>SYN packet from 10.0.0.1:1024->10.0.0.2:80 fwmark 2 creates
>another connection independent of the first. Current netfilter
>code considers both packets to belong to the same connection.
>
>  
>

Because they are the same connection! What on earth are you trying to 
achieve? What strange setup do you have where these packets do *not* 
belong to the same connection? Mind you, that's not only netfilter, the 
recieving box will also see these packets as belonging to the same 
connection.

HTH,
M4