ebtables '--mark-target' problems

Hello!

 First of all I am very happy with ebtables as marker for HTB traffic control.


My current packet flow is as follows:

*) in nat@prerouting redirect packets incoming from lan to chain 'from_lan'

   ebtables -t nat -A PREROUTING -i eth1 -j from_lan

*) in nat@postrouting redirect packets outgoing to lan to chain 'to_lan'

   ebtables -t nat -A POSTROUTING -o eth1 -j to_lan

*) in from_lan dispatch packets into 32 chains basing on the last 5 bits of   
   source MAC (the lan has 1500+ machines - linear search would be a kill)

ebtables -t nat -A to_lan -d 00:00:00:00:00:00/00:00:00:00:00:31 -j HtbOut00
ebtables -t nat -A to_lan -d 00:00:00:00:00:01/00:00:00:00:00:31 -j HtbOut01
...

*) in to_lan dispatch packets into 32 chains basing on the last 5 bits of   
   destination MAC.

ebtables -t nat -A from_lan -s 00:00:00:00:00:00/00:00:00:00:00:31 -j HtbIn00
ebtables -t nat -A from_lan -s 00:00:00:00:00:01/00:00:00:00:00:31 -j HtbIn01
...

*) For each client a pair of marks

ebtables -t nat -A HtbOut26 -d 00:EE:B1:05:0D:9A -j mark \
         --set-mark 0x10066 --mark-target ACCEPT
ebtables -t nat -A HtbIn26 -s 00:EE:B1:05:0D:9A -j mark \
         --set-mark 0x20066 --mark-target ACCEPT

*) Each Htb* chain ends with 

ebtables -t nat -A Htb(resp in/out+number) -j DROP

to kill alien flow od unknown MAC

The above works marvelous, but I have a few problems with more advanced 
things:

1) --mark-target does not accept user-defined chains. Is it by design? (in the 
folowing, chain to_lan_local of course exists)

ebtables -t nat -A HtbIn01 -d 00:EE:B1:05:0D:9A -j mark \
         --set-mark 0x10066 --mark-target to_lan_local
Illegal --mark-target target.

2) What the hack is 'base chain' in the following error? 

ebtables -t nat -A HtbIn01 -d 00:EE:B1:05:0D:9A -j mark \
         --set-mark 0x10066 --mark-target RETURN
--mark-target RETURN not allowed on base chain.


Either of those is necessary to "overmark" some packets with global mark, but 
_after_ it is accepted by ARP dispatcher.

-- 
 Pawel Kraszewski
 www.kraszewscy.net


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642