Re: [PATCH 1/1] iproute2: Add support for connmark action

On Sun, 15 Feb 2015 11:57:19 -0500
Jamal Hadi Salim [off-list ref] wrote:

From: Felix Fietkau <redacted>

Add ability to add the netfilter connmark support.

Typical usage:
...lets tag outgoing icmp with mark 0x10..
iptables -tmangle -A PREROUTING -p icmp -j CONNMARK --set-mark 0x10
..add on ingress of $ETH an extractor for connmark...
tc filter add dev $ETH parent ffff: prio 4 protocol ip \
u32 match ip protocol 1 0xff \
flowid 1:1 \
action connmark continue
...if the connmark was 0x11, we police to a ridic rate of 10Kbps
tc filter add dev $ETH parent ffff: prio 5 protocol ip \
handle 0x11 fw flowid 1:1 \
action police rate 10kbit burst 10k

Other ways to use the connmark is to supply the zone, index and
branching choice. Refer to help.

Signed-off-by: Felix Fietkau <redacted>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>

This depends on tc_connmark.h which is a kernel header.
it is in the right place in the kernel source (include/uapi/linux/tc_connmark.h)
but is not exported because there is no entry for the file in
include/uapi/linux/tc_act/Kbuild

Please fix upstream kernel, and the I will add this back to iproutew