netdev - IFB network driver problems and questions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Mon, 19 Aug 2013 09:35:40 -0500
From:	Brad Johnson <bjohnson@...ssa.com>
To:	netdev@...r.kernel.org
Subject: IFB network driver problems and questions

We are trying to use the IFB driver for ingress QoS and are having some 
problems getting it to work for us. Even though I have seen it described 
as a replacement for IMQ, it appears that it hooks the packets before 
netfilter and so marks set with iptables are not seen by tc filters on 
the ifb device. This makes it difficult, and in some cases impossible, 
to do any kind of complex filtering, such as port ranges and many other 
matches that are easy to do with iptables. So my questions are:
1. Is there any way to set marks with iptables and have them seen in the 
IFB device?
2. Is there any way to use IFB as an iptables target the same way you 
can do a "-j IMQ" target?
3. If the previous answers are 'no', then are there any plans to 
implement those features?

Thanks

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html