All of lore.kernel.org
 help / color / mirror / Atom feed
From: Florian Westphal <fw@strlen.de>
To: Lorenzo Colitti <lorenzo@google.com>
Cc: Florian Westphal <fw@strlen.de>,
	Matt Bennett <Matt.Bennett@alliedtelesis.co.nz>,
	"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
	Luuk Paulussen <Luuk.Paulussen@alliedtelesis.co.nz>,
	Kyeong Yoo <Kyeong.Yoo@alliedtelesis.co.nz>
Subject: Re: Increasing skb->mark size
Date: Mon, 30 Nov 2015 03:24:59 +0100	[thread overview]
Message-ID: <20151130022459.GC29878@breakpoint.cc> (raw)
In-Reply-To: <CAKD1Yr2vWpKsibNY6ShYZiKLMFSD_2gxRVa=DyXx5jkEs25AZw@mail.gmail.com>

Lorenzo Colitti <lorenzo@google.com> wrote:
> On Mon, Nov 30, 2015 at 11:08 AM, Florian Westphal <fw@strlen.de> wrote:
> > We have ctnetlink which allows direct setting of ctmark/ctlabels.
> 
> Can those labels be set early enough in the stack to affect the source
> address chosen for outgoing connections?

No, same restrictions as connmarks or skb marks apply.

Furthermore, since its stored in the conntrack area, the conntrack isn't
created until after the first packet hits NF output hook, and its not
visible until after POSTROUTING hook.

There was an out of tree patch to allow to use ipsets to select
source addresses instead of mark+fwmark:

https://lkml.org/lkml/2012/12/3/93

I think thats something we shouldn't really go for this.

However, if fwmark is too limiting (and given these hacks exist),
maybe we should start thinking for alternatives?

  reply	other threads:[~2015-11-30  2:25 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-11-24 20:32 Increasing skb->mark size Matt Bennett
2015-11-24 20:36 ` Florian Westphal
2015-11-24 20:56   ` Matt Bennett
2015-11-26  4:44     ` Luuk Paulussen
2015-11-30  2:08     ` Florian Westphal
2015-11-30  2:10       ` Lorenzo Colitti
2015-11-30  2:24         ` Florian Westphal [this message]
2015-11-29  8:37 ` Lorenzo Colitti
2015-11-30  1:58   ` David Miller
2015-11-30  4:10     ` Luuk Paulussen
2015-11-30  4:49       ` David Miller
2015-12-01  0:12         ` Luuk Paulussen
2015-12-01  3:55           ` David Miller
2015-12-01  4:57             ` Luuk Paulussen
2015-12-01 19:13   ` Andi Kleen
2015-12-01 22:09     ` Daniel Borkmann
2015-12-02  2:58       ` Andi Kleen
2015-12-02  5:42         ` David Ahern
2015-12-02 17:29           ` David Miller
2015-12-02  3:57     ` Lorenzo Colitti

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20151130022459.GC29878@breakpoint.cc \
    --to=fw@strlen.de \
    --cc=Kyeong.Yoo@alliedtelesis.co.nz \
    --cc=Luuk.Paulussen@alliedtelesis.co.nz \
    --cc=Matt.Bennett@alliedtelesis.co.nz \
    --cc=lorenzo@google.com \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.