Subject: Re: iptables breakage WAS(Re: dummy as IMQ replacement

From: Patrick McHardy <[email-masked]>
Date: Fri, 25 Mar 2005 21:18:20 +0100

jamal wrote:
> I dont think connmark will work - yet. Patrick? I think you need
> something attached on the skb that is derived off the netfilter
> contracking code for it to be usable.

Correct.

> Things will work once the  "action track" is in place; i.e you would
> then say:
> "match xxx .. \
>  action track \
>  action connmark"
> 
> If i was to prioritize my time for new actions - how important is this?
> I also wish someone else would start writting some of these actions ;->
> Wanna right the tracking one? I could help - wink.

Before this the ipt action needs to make sure the packets are in valid
state from the view of conntrack/ip_tables. Right now it doesn't even
check if its IP. Both assume the length checks in ip_rcv() have been
performed, it actually creates security problems in a few places if
they haven't - length calculations can underflow and bad things will
happen.

Regards
Patrick