Skip to contentSkip to conversation

connmark problem

DISCUSSION Krystian 2 participants 2 messages Dec 13, 2004

Subsystems (2)
Networking netfilter
lore
Share & tools
lore

Krystian

author
#0 lore raw

hi

I have a stock 2.6.9 kernel + iptables 1.2.11 + patch-o-matic-ng and i'm trying to apply CONNMARK patch. I cant patch it becouse it gest rejected while trying to apply it using POM.

Any clues?

Thanks
Krystian

#1 lore raw
Quoted 12 lines · Krystian

hi

I have a stock 2.6.9 kernel + iptables 1.2.11 + patch-o-matic-ng and i'm trying to apply CONNMARK patch. I cant patch it becouse it gest rejected while trying to apply it using POM.

Any clues?

Thanks
Krystian

Try this patch.

Signature · 1 line
PGP-ID 0xF8EAF138
include/linux/netfilter_ipv4/ip_conntrack.h +4 -0
diff -Nru --exclude-from=/sunbeam/home/laforge/scripts/dontdiff linux-2.6.9-test/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.6.9-connmark/include/linux/netfilter_ipv4/ip_conntrack.h
@@ -212,6 +212,10 @@
 	} nat;
 #endif /* CONFIG_IP_NF_NAT_NEEDED */
 
+#if defined(CONFIG_IP_NF_CONNTRACK_MARK)
+	unsigned long mark;
+#endif
+
 	/* Traversed often, so hopefully in different cacheline to top */
 	/* These are my tuples; original and reply */
 	struct ip_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX];
include/linux/netfilter_ipv4/ipt_CONNMARK.h +25 -0
diff -Nru --exclude-from=/sunbeam/home/laforge/scripts/dontdiff linux-2.6.9-test/include/linux/netfilter_ipv4/ipt_CONNMARK.h linux-2.6.9-connmark/include/linux/netfilter_ipv4/ipt_CONNMARK.h
@@ -0,0 +1,25 @@
+#ifndef _IPT_CONNMARK_H_target
+#define _IPT_CONNMARK_H_target
+
+/* Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>>
+ * by Henrik Nordstrom <[email protected]>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+enum {
+	IPT_CONNMARK_SET = 0,
+	IPT_CONNMARK_SAVE,
+	IPT_CONNMARK_RESTORE
+};
+
+struct ipt_connmark_target_info {
+	unsigned long mark;
+	unsigned long mask;
+	u_int8_t mode;
+};
+
+#endif /*_IPT_CONNMARK_H_target*/
include/linux/netfilter_ipv4/ipt_connmark.h +18 -0
diff -Nru --exclude-from=/sunbeam/home/laforge/scripts/dontdiff linux-2.6.9-test/include/linux/netfilter_ipv4/ipt_connmark.h linux-2.6.9-connmark/include/linux/netfilter_ipv4/ipt_connmark.h
@@ -0,0 +1,18 @@
+#ifndef _IPT_CONNMARK_H
+#define _IPT_CONNMARK_H
+
+/* Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>>
+ * by Henrik Nordstrom <[email protected]>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+struct ipt_connmark_info {
+	unsigned long mark, mask;
+	u_int8_t invert;
+};
+
+#endif /*_IPT_CONNMARK_H*/
net/ipv4/netfilter/Kconfig +31 -0
diff -Nru --exclude-from=/sunbeam/home/laforge/scripts/dontdiff linux-2.6.9-test/net/ipv4/netfilter/Kconfig linux-2.6.9-connmark/net/ipv4/netfilter/Kconfig
@@ -32,6 +32,14 @@
 
 	  If unsure, say `N'.
 
+config IP_NF_CONNTRACK_MARK
+	bool  'Connection mark tracking support'
+	help
+	  This option enables support for connection marks, used by the
+	  `CONNMARK' target and `connmark' match. Similar to the mark value
+	  of packets, but this mark value is kept in the conntrack session
+	  instead of the individual packets.
+	
 config IP_NF_CT_PROTO_SCTP
 	tristate  'SCTP protocol connection tracking support (EXPERIMENTAL)'
 	depends on IP_NF_CONNTRACK && EXPERIMENTAL

@@ -342,6 +350,17 @@
 	  If you want to compile it as a module, say M here and read
 	  Documentation/modules.txt.  If unsure, say `N'.
 
+config IP_NF_MATCH_CONNMARK
+	tristate  'Connection mark match support'
+	depends on IP_NF_CONNTRACK_MARK && IP_NF_IPTABLES
+	help
+	  This option adds a `connmark' match, which allows you to match the
+	  connection mark value previously set for the session by `CONNMARK'. 
+	
+	  If you want to compile it as a module, say M here and read
+	  Documentation/modules.txt.  The module will be called
+	  ipt_connmark.o.  If unsure, say `N'.
+
 # `filter', generic and specific targets
 config IP_NF_FILTER
 	tristate "Packet filtering"

@@ -597,6 +616,18 @@
 
 	  To compile it as a module, choose M here.  If unsure, say N.
 
+config IP_NF_TARGET_CONNMARK
+	tristate  'CONNMARK target support'
+	depends on IP_NF_CONNTRACK_MARK && IP_NF_MANGLE
+	help
+	  This option adds a `CONNMARK' target, which allows one to manipulate
+	  the connection mark value.  Similar to the MARK target, but
+	  affects the connection mark value rather than the packet mark value.
+	
+	  If you want to compile it as a module, say M here and read
+	  Documentation/modules.txt.  The module will be called
+	  ipt_CONNMARK.o.  If unsure, say `N'.
+
 # raw + specific targets
 config IP_NF_RAW
 	tristate  'raw table support (required for NOTRACK/TRACE)'
net/ipv4/netfilter/Makefile +2 -0
diff -Nru --exclude-from=/sunbeam/home/laforge/scripts/dontdiff linux-2.6.9-test/net/ipv4/netfilter/Makefile linux-2.6.9-connmark/net/ipv4/netfilter/Makefile
@@ -61,6 +61,7 @@
 obj-$(CONFIG_IP_NF_MATCH_LENGTH) += ipt_length.o
 obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
 obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o
+obj-$(CONFIG_IP_NF_MATCH_CONNMARK) += ipt_connmark.o
 obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
 obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
 obj-$(CONFIG_IP_NF_MATCH_REALM) += ipt_realm.o

@@ -81,6 +82,7 @@
 obj-$(CONFIG_IP_NF_TARGET_CLASSIFY) += ipt_CLASSIFY.o
 obj-$(CONFIG_IP_NF_NAT_SNMP_BASIC) += ip_nat_snmp_basic.o
 obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
+obj-$(CONFIG_IP_NF_TARGET_CONNMARK) += ipt_CONNMARK.o
 obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
 obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o
 obj-$(CONFIG_IP_NF_TARGET_NOTRACK) += ipt_NOTRACK.o
net/ipv4/netfilter/ip_conntrack_core.c +3 -0
diff -Nru --exclude-from=/sunbeam/home/laforge/scripts/dontdiff linux-2.6.9-test/net/ipv4/netfilter/ip_conntrack_core.c linux-2.6.9-connmark/net/ipv4/netfilter/ip_conntrack_core.c
@@ -595,6 +595,9 @@
 		__set_bit(IPS_EXPECTED_BIT, &conntrack->status);
 		conntrack->master = expected;
 		expected->sibling = conntrack;
+#if CONFIG_IP_NF_CONNTRACK_MARK
+		conntrack->mark = expected->expectant->mark;
+#endif
 		LIST_DELETE(&ip_conntrack_expect_list, expected);
 		expected->expectant->expecting--;
 		nf_conntrack_get(&master_ct(conntrack)->ct_general);
net/ipv4/netfilter/ip_conntrack_standalone.c +5 -0
diff -Nru --exclude-from=/sunbeam/home/laforge/scripts/dontdiff linux-2.6.9-test/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.6.9-connmark/net/ipv4/netfilter/ip_conntrack_standalone.c
@@ -146,6 +146,11 @@
 		if (seq_printf(s, "[ASSURED] "))
 			return 1;
 
+#if defined(CONFIG_IP_NF_CONNTRACK_MARK)
+	if (seq_printf(s, "mark=%ld ", conntrack->mark))
+		return 1;
+#endif
+
 	if (seq_printf(s, "use=%u\n", atomic_read(&conntrack->ct_general.use)))
 		return 1;
net/ipv4/netfilter/ipt_CONNMARK.c +118 -0

118 lines not on this page · raw message

net/ipv4/netfilter/ipt_connmark.c +81 -0

81 lines not on this page · raw message