skip other iptables marking if packet is already marked

skip other iptables marking if packet is already marked

[Ming-Ching Tiew]

I have many iptables setmark commands, but as soon
as there is one match, I would like to skip all the rest.
How to do this.

-------not-working-not-mark-zero-is-not-accepted---------

iptables -t mangle -A PREROUTING ..... -j MARK --set-mark .....
iptables -t mangle -A PREROUTING -m MARK ! --mark 0 -j ACCEPT
iptables -t mangle -A PREROUTING ..... -j MARK --set-mark .....
iptables -t mangle -A PREROUTING -m MARK ! --mark 0 -j ACCEPT
iptables -t mangle -A PREROUTING ..... -j MARK --set-mark .....

--------------------end-----------------------------------

Since it is not working, I change it to :-

Assuming I have AND-ed all the mark together to obtain the MASK,

iptables -t mangle -A PREROUTING ..... -j MARK --set-mark .....
iptables -t mangle -A PREROUTING -m MARK ! --mark MASK/MARK -j ACCEPT
iptables -t mangle -A PREROUTING ..... -j MARK --set-mark .....
iptables -t mangle -A PREROUTING -m MARK ! --mark MASK/MARK -j ACCEPT
iptables -t mangle -A PREROUTING ..... -j MARK --set-mark .....

Wonder if it will work ? 
My next question is should I use -j ACCEPT or -j RETURN ?

Re: skip other iptables marking if packet is already marked

[Cedric Blancher]

Le lun 31/05/2004 à 09:24, Ming-Ching Tiew a écrit :
> I have many iptables setmark commands, but as soon
> as there is one match, I would like to skip all the rest.
> How to do this.
> -------not-working-not-mark-zero-is-not-accepted---------
> iptables -t mangle -A PREROUTING ..... -j MARK --set-mark .....
> iptables -t mangle -A PREROUTING -m MARK ! --mark 0 -j ACCEPT
> iptables -t mangle -A PREROUTING ..... -j MARK --set-mark .....
> iptables -t mangle -A PREROUTING -m MARK ! --mark 0 -j ACCEPT
> iptables -t mangle -A PREROUTING ..... -j MARK --set-mark .....
> --------------------end-----------------------------------

Why don't you just match the mark the packet has been given ?

iptables -t mangle -A PREROUTING ..... -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -m MARK --mark 1 -j ACCEPT
iptables -t mangle -A PREROUTING ..... -j MARK --set-mark 2
iptables -t mangle -A PREROUTING -m MARK --mark 2 -j ACCEPT
[...]

I think your ruleset does not work because a packet without a mark will
match your non-zero mark rule. I mean that no mark is different than 0,
so all packets will match the first "-m mark ! --mark 0" rule.

iptables -t mangle -A PREROUTING -j MARK --set-mark 0
iptables -t mangle -A PREROUTING ..... -j MARK --set-mark .....
iptables -t mangle -A PREROUTING -m MARK ! --mark 0 -j ACCEPT
iptables -t mangle -A PREROUTING ..... -j MARK --set-mark .....
iptables -t mangle -A PREROUTING -m MARK ! --mark 0 -j ACCEPT
[...]

> Since it is not working, I change it to :-
> Assuming I have AND-ed all the mark together to obtain the MASK,
[...]
> Wonder if it will work ? 

Well, it should work.

> My next question is should I use -j ACCEPT or -j RETURN ?

RETURN should not be use within builtin chains. Moreover, both have the
same effect if used in builtin chain.


-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: skip other iptables marking if packet is already marked

[Ming-Ching Tiew]

> 
> Why don't you just match the mark the packet has been given ?
> 
> iptables -t mangle -A PREROUTING ..... -j MARK --set-mark 1
> iptables -t mangle -A PREROUTING -m MARK --mark 1 -j ACCEPT
> iptables -t mangle -A PREROUTING ..... -j MARK --set-mark 2
> iptables -t mangle -A PREROUTING -m MARK --mark 2 -j ACCEPT

Understand, but what if I have something on top :-

iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark

I don't know what is the mark value, but i want to return as soon as the 
mark has been restored.

> 
> I think your ruleset does not work because a packet without a mark will
> match your non-zero mark rule. I mean that no mark is different than 0,
> so all packets will match the first "-m mark ! --mark 0" rule.
> 

No, it does not work because the syntax is rejected ! I tried with
"-m mark --mark ! 0" ,  it is alway rejected.

> 
> > My next question is should I use -j ACCEPT or -j RETURN ?
> 
> RETURN should not be use within builtin chains. Moreover, both have the
> same effect if used in builtin chain.
> 

Point taken.

Thanks.

Re: skip other iptables marking if packet is already marked

[Sheldon Hearn]

On Mon, 2004-05-31 at 10:16, Cedric Blancher wrote:

> I think your ruleset does not work because a packet without a mark will
> match your non-zero mark rule. I mean that no mark is different than 0,
> so all packets will match the first "-m mark ! --mark 0" rule.

Really?  No mark and mark 0 are different?

How do you distinguish an unmarked packet in a ruleset?

I ask because this relates to an as yet unanswered question of mine,
with Subject "CONNMARK restore-mark creates conntrack entry?"

Ciao,
Sheldon.

Re: skip other iptables marking if packet is already marked

[Cedric Blancher]

Le lun 31/05/2004 à 11:36, Sheldon Hearn a écrit :
> Really?  No mark and mark 0 are different?

Well, I though. I just check and I was wrong. Sorry, my fault.

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: skip other iptables marking if packet is already marked

[Sheldon Hearn]

On Mon, 2004-05-31 at 13:46, Cedric Blancher wrote:

> > Really?  No mark and mark 0 are different?
> 
> Well, I though. I just check and I was wrong. Sorry, my fault.

No worries;  it gave me an opportunity to promote the "CONNMARK
restore-mark creates conntrack entry?" thread, on which I'm pretty
desperate for feedback.

Oops, I did it again!  Britney Spears would be proud. ;-)

Ciao,
Sheldon.