Re: ebtables '--mark-target' problems

Dnia czwartek, 9 lutego 2006 20:06, Bart De Schuymer napisał:

> It's not implemented, although it seems this functionality can be added
> while maintaining backwards compatibility. But you can easily circumvent
> this lack of functionality by doing something like this:

> ebtables -t nat -A HtbIn01 -d 00:EE:B1:05:0D:9A -j mark \
> --set-mark 0x10066 --mark-target CONTINUE
> ebtables -t nat -A HtbIn01 -d 00:EE:B1:05:0D:9A -j to_lan_local

Heh, seems easy now... However, this gives checking those 6 bytes twice.

I did it the other way: I moved MAC hashing to prerouting in both directions 
and do "selective overstamping" in filter table, which is parsed after 
prerouting and only for packets accepted in prerouting.

> > 2) What the hack is 'base chain' in the following error?
> >
> > ebtables -t nat -A HtbIn01 -d 00:EE:B1:05:0D:9A -j mark \
> >          --set-mark 0x10066 --mark-target RETURN
> > --mark-target RETURN not allowed on base chain.
>
> What ebtables version are you using? The RETURN target should be allowed
> in your user-defined chain.

ebtables v2.0.6 (November 2003) - this is userspace program from current 
stable Gentoo. Oh, God - is it THAT old? Kernel is 2.6.15-gentoo-r3 with 
ebtables.c,v 2.0, July, 2002

> You can only use the return target in a user-defined chain, for the
> obvious reason that a base chain hasn't got any chain to return to.

Seems reasonable.

-- 
 Pawel Kraszewski


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid3432&bid#0486&dat1642