Re: iptables breakage WAS(Re: dummy as IMQ replacement

[Andy Furniss <andy.furniss@dsl.pipex.com>]

jamal wrote:

> I gotta give it to you - you have helped isolate more bugs in this one
> session than all others in the past summed up.

LOL - there may be more to come, though I haven't used CONNMARK before 
and may be missing something about it - and maybe there is a tc way to 
look at connmark anyway?

Works as I expect -

iptables -A POSTROUTING -t mangle -j CONNMARK --set-mark 1
iptables -A INPUT -t mangle -m mark --mark 1
iptables -A PREROUTING -t mangle -j CONNMARK --restore-mark

I ping a lan pc and I get matches for the marked incoming packets in INPUT.

If I do

iptables -A POSTROUTING -t mangle -j CONNMARK --set-mark 1
iptables -A INPUT -t mangle -m mark --mark 1
tc qdisc add dev eth0 ingress
tc filter add dev eth0 parent ffff: protocol ip prio 6 u32 match ip src 
0/0 flowid 1:1 action ipt -j CONNMARK --restore-mark

It doesn't mark the packets.

3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.355/0.415/0.529/0.081 ms
[root@amd /home/andy/Qos]# tc -s filter ls dev eth0 parent ffff:
filter protocol ip pref 6 u32
filter protocol ip pref 6 u32 fh 800: ht divisor 1
filter protocol ip pref 6 u32 fh 800::800 order 2048 key ht 800 bkt 0 
flowid 1:1  (rule hit 3 success 3)
   match 00000000/00000000 at 12 (success 3 )
         action order 1: tablename: mangle  hook: NF_IP_PRE_ROUTING
         target CONNMARK restore
         index 2 ref 1 bind 1 installed 44 sec used 31 sec
         Action statistics:
         Sent 252 bytes 3 pkt (dropped 0, overlimits 0 requeues 0)
         rate 0bit 0pps backlog 0b 0p requeues 0

[root@amd /home/andy/Qos]# iptables -L -t mangle -v
Chain PREROUTING (policy ACCEPT 364 packets, 401K bytes)
  pkts bytes target     prot opt in     out     source 
destination

Chain INPUT (policy ACCEPT 364 packets, 401K bytes)
  pkts bytes target     prot opt in     out     source 
destination
     0     0            all  --  any    any     anywhere 
anywhere            MARK match 0x1

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
  pkts bytes target     prot opt in     out     source 
destination

Chain OUTPUT (policy ACCEPT 300 packets, 19702 bytes)
  pkts bytes target     prot opt in     out     source 
destination

Chain POSTROUTING (policy ACCEPT 300 packets, 19702 bytes)
  pkts bytes target     prot opt in     out     source 
destination
     3   252 CONNMARK   all  --  any    any     anywhere 
anywhere            CONNMARK set 0x1

Andy.