netdev - Re: [PATCH 1/1] iproute2: Add support for connmark action

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sat, 21 Feb 2015 16:51:34 -0800
From:	Stephen Hemminger <stephen@...workplumber.org>
To:	Jamal Hadi Salim <jhs@...atatu.com>
Cc:	nbd@...nwrt.org, netdev@...r.kernel.org
Subject: Re: [PATCH 1/1] iproute2: Add support for connmark action

On Sun, 15 Feb 2015 11:57:19 -0500
Jamal Hadi Salim <jhs@...atatu.com> wrote:

> From: Felix Fietkau <nbd@...nwrt.org>
> 
> Add ability to add the netfilter connmark support.
> 
> Typical usage:
> ...lets tag outgoing icmp with mark 0x10..
> iptables -tmangle -A PREROUTING -p icmp -j CONNMARK --set-mark 0x10
> ..add on ingress of $ETH an extractor for connmark...
> tc filter add dev $ETH parent ffff: prio 4 protocol ip \
> u32 match ip protocol 1 0xff \
> flowid 1:1 \
> action connmark continue
> ...if the connmark was 0x11, we police to a ridic rate of 10Kbps
> tc filter add dev $ETH parent ffff: prio 5 protocol ip \
> handle 0x11 fw flowid 1:1 \
> action police rate 10kbit burst 10k
> 
> Other ways to use the connmark is to supply the zone, index and
> branching choice. Refer to help.
> 
> Signed-off-by: Felix Fietkau <nbd@...nwrt.org>
> Signed-off-by: Jamal Hadi Salim <jhs@...atatu.com>

This depends on tc_connmark.h which is a kernel header.
it is in the right place in the kernel source (include/uapi/linux/tc_connmark.h)
but is not exported because there is no entry for the file in
include/uapi/linux/tc_act/Kbuild

Please fix upstream kernel, and the I will add this back to iproutew
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html