From mboxrd@z Thu Jan 1 00:00:00 1970 From: Patrick McHardy Subject: Re: iptables breakage WAS(Re: dummy as IMQ replacement Date: Fri, 25 Mar 2005 21:18:20 +0100 Message-ID: <4244720C.1040907@trash.net> References: <1107123123.8021.80.camel@jzny.localdomain> <1110453757.1108.87.camel@jzny.localdomain> <423B7BCB.10400@dsl.pipex.com> <1111410890.1092.195.camel@jzny.localdomain> <423F41AD.3010902@dsl.pipex.com> <1111444869.1072.51.camel@jzny.localdomain> <423F71C2.8040802@dsl.pipex.com> <1111462263.1109.6.camel@jzny.localdomain> <42408998.5000202@dsl.pipex.com> <1111550254.1089.21.camel@jzny.localdomain> <4241C478.5030309@dsl.pipex.com> <1111607112.1072.48.camel@jzny.localdomain> <4241D764.2030306@dsl.pipex.com> <1111612042.1072.53.camel@jzny.localdomain> <4241F1D2.9050202@dsl.pipex.com> <4241F7F0.2010403@dsl.pipex.com> <1111625608.1037.16.camel@jzny.localdomain> <424212F7.10106@dsl.pipex.com> <1111663947.1037.24.camel@jzny.localdomain> <1111665450.1037.27.camel@jzny.localdomain> <4242DFB5.9040802@dsl.pipex.com> <1111749220.1092.457.camel@jzny.localdomain> <42446DB2.9070 Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Cc: Andy Furniss , Harald Welte , Remus , netdev , Nguyen Dinh Nam , Andre Tomt , syrius.ml@no-log.org, Damion de Soto To: hadi@cyberus.ca In-Reply-To: <1111781443.1092.631.camel@jzny.localdomain> Sender: netdev-bounce@oss.sgi.com Errors-to: netdev-bounce@oss.sgi.com List-Id: netdev.vger.kernel.org jamal wrote: > I dont think connmark will work - yet. Patrick? I think you need > something attached on the skb that is derived off the netfilter > contracking code for it to be usable. Correct. > Things will work once the "action track" is in place; i.e you would > then say: > "match xxx .. \ > action track \ > action connmark" > > If i was to prioritize my time for new actions - how important is this? > I also wish someone else would start writting some of these actions ;-> > Wanna right the tracking one? I could help - wink. Before this the ipt action needs to make sure the packets are in valid state from the view of conntrack/ip_tables. Right now it doesn't even check if its IP. Both assume the length checks in ip_rcv() have been performed, it actually creates security problems in a few places if they haven't - length calculations can underflow and bad things will happen. Regards Patrick