[PATCH 1/1] Re: dangerous? Setting mark in nat table

[Amin Azez <azez@ufomechanic.net>]

[-- Attachment #1: Type: text/plain, Size: 776 bytes --]

* Henrik Nordstrom wrote, On 14/03/07 12:43:
> ons 2007-03-14 klockan 12:02 +0100 skrev Patrick McHardy:
>
>   
>> Thats true, routing by nfmark in the OUTPUT chain needs the rerouting
>> done by the mangle table, but nowadays there are other uses for nfmark,
>> so if someone feels motivated to send a patch to get rid of this pretty
>> arbitary restriction I think I would take it.
>>     
>
> If you do, please remove the same restriction from CONNMARK restore
>   
Let it at least be said that some of my patches are used :-)

(Henrick, are you interested in my per-flow patch for connmark, so that
each side of the flow can have a seperate mark? Also dumped thus out of
/proc/net/ip-conntrack and libnfnetlink)

Signed-off-by: Sam Liddicott <azez@ufomechanic.net>

Sam



[-- Attachment #2: mark-mangle.patch --]
[-- Type: text/x-patch, Size: 2052 bytes --]

Index: linux-2.6.17.1/net/netfilter/xt_CONNMARK.c
===================================================================
--- linux-2.6.17.1.orig/net/netfilter/xt_CONNMARK.c
+++ linux-2.6.17.1/net/netfilter/xt_CONNMARK.c
@@ -133,13 +133,6 @@ checkentry(const char *tablename,
 {
        struct xt_connmark_target_info *matchinfo = targinfo;
 
-       if (matchinfo->mode == XT_CONNMARK_RESTORE) {
-           if (strcmp(tablename, "mangle") != 0) {
-                   printk(KERN_WARNING "CONNMARK: restore can only be called from \"mangle\" table, not \"%s\"\n", tablename);
-                   return 0;
-           }
-       }
-
        if (matchinfo->mark > 0xffffffff || matchinfo->mask > 0xffffffff) {
                printk(KERN_WARNING "CONNMARK: Only supports 32bit mark\n");
                return 0;
Index: linux-2.6.17.1/net/netfilter/xt_MARK.c
===================================================================
--- linux-2.6.17.1.orig/net/netfilter/xt_MARK.c
+++ linux-2.6.17.1/net/netfilter/xt_MARK.c
@@ -116,7 +116,6 @@ static struct xt_target ipt_mark_reg_v0 
        .name           = "MARK",
        .target         = target_v0,
        .targetsize     = sizeof(struct xt_mark_target_info),
-       .table          = "mangle",
        .checkentry     = checkentry_v0,
        .me             = THIS_MODULE,
        .family         = AF_INET,
@@ -127,7 +126,6 @@ static struct xt_target ipt_mark_reg_v1 
        .name           = "MARK",
        .target         = target_v1,
        .targetsize     = sizeof(struct xt_mark_target_info_v1),
-       .table          = "mangle",
        .checkentry     = checkentry_v1,
        .me             = THIS_MODULE,
        .family         = AF_INET,
@@ -138,7 +136,6 @@ static struct xt_target ip6t_mark_reg_v0
        .name           = "MARK",
        .target         = target_v0,
        .targetsize     = sizeof(struct xt_mark_target_info),
-       .table          = "mangle",
        .checkentry     = checkentry_v0,
        .me             = THIS_MODULE,
        .family         = AF_INET6,