Re: xfrm by MARK: tcp problems when mark for in and out differ

["Gerd v. Egidy" <lists@egidy.de>]

Hi Jamal,

> > -> incoming packets are without mark, outgoing packets are marked with 5
> 
> You could use tc ingress path to mark incoming packets. Example:

In my full setup I do exactly that. What I posted was a minimized setup to 
just show the problem.

I have a complex set of netfilter rules and routing tables to allow several 
ways of doing NAT on ipsec. The rules need different marks on packets coming 
from / going to the vpn to correctly distinguish packets in the forwarding 
case.

I did further testing, 2.6.36-rc7 has the problem too.

> When the SYN-ACK hits __xfrm_lookup, the value in fl->mark is 0 
> (more precisely: the mark value used in the incoming packet).

this is wrong, the value in fl->mark is always 0. I must have confused some 
data in my debug printks.

So it seems like the fl->mark is never initialized with the packet mark in the 
first place. What would be the correct stage in the kernel network stack to do 
that?

Kind regards,

Gerd

-- 
Address (better: trap) for people I really don't want to get mail from:
jonas@cactusamerica.com