netdev - Re: iproute2 action/policer question

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4A367255.5050604@itcare.pl>
Date:	Mon, 15 Jun 2009 18:09:57 +0200
From:	Paweł Staszewski <pstaszewski@...are.pl>
To:	Jarek Poplawski <jarkao2@...il.com>
CC:	jamal <hadi@...erus.ca>,
	Linux Network Development list <netdev@...r.kernel.org>
Subject: Re: iproute2 action/policer question

Jarek Poplawski pisze:
> On Mon, Jun 15, 2009 at 09:32:08AM -0400, jamal wrote:
>   
>> On Mon, 2009-06-15 at 11:19 +0000, Jarek Poplawski wrote:
>>
>>     
>>>> This is only a sample but is not working
>>>>         
>> It does seem to be working!
>> How did you reach conclusion it wasnt working?
>>
>>     
>>>>         Action statistics:
>>>>         Sent 42351 bytes 110 pkt (dropped 0, overlimits 32 requeues 0)
>>>>         rate 0bit 0pps backlog 0b 0p requeues 0
>>>>         
>> 32 packets hit the policer - double check your parameters please to make
>> sure they are correct.
>>     
>
>   
Yes. packets hits policer but second action dont drop packets.

Second is that in policer there is action to "-j MARK" mark packet but 
where i can catch this mark ? in iptables mangle i make some rules to 
match mark and make LOG target like this:
but iptables rules catch nothing.

Chain PREROUTING (policy ACCEPT 19M packets, 19G bytes)
 pkts bytes target     prot opt in     out     source               
 destination
     0     0 LOG        all  --  *      *       0.0.0.0/0            
 0.0.0.0/0           mark match 0x1 LOG flags 0 level 4

Chain POSTROUTING (policy ACCEPT 11M packets, 17G bytes)
  pkts bytes target     prot opt in     out     source               
 destination
     0     0 LOG        all  --  *      *       0.0.0.0/0            
 0.0.0.0/0           mark match 0x1 LOG flags 0 level 4


version of tools:
iptables -V
iptables v1.4.2
tc -V
tc utility, iproute2-ss090324



> Actually, I wonder if these "dropped 0" are OK here if we expect
> dropping.
>
>   
>>> According to iproute2/doc/actions/actions_general mangle targets
>>> should work; and you could also try (if it doesn't work then probably
>>> it can't be used...;-)
>>>       
>> They should all be usable. If something crashes, there is a bug
>> somewhere.
>>
>>     
>>> But... I'm neither able to configure/compile it with the current
>>> iproute2/iptables, nor test it with distro's builds (Debian testing).
>>> After some checking I found iproute2 needs updating, because iptables
>>> changes API (xtables.h) virtually with every new version, so I don't
>>> even blame the ipt author or distro maintainer.
>>>
>>>       
>> We are hopefully getting stable there. Anything on debian lenny
>> should be working with iptables 1.4.3; i expect at most "one last
>> change" (famous last words) to break backward compat as iptables 
>> moves from version 1.4.3.
>>     
>
> I've tried debian squeeze (testing) with: iptables v1.4.3.2, iproute2
> -ss090324, and action ipt -j MARK doesn't work. AFAIK debian lenny
> (stable) uses 1.4.2. I've also tried debian rescue probably based on
> lenny (with iptables 1.4.2), and it seemed it didn't work yet (I'll
> re-check this). When you have something new I'd be glad for Cc.
>
> Thanks more than always Jamal,
> Jarek P.
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
>
>   

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html