2

I'm using iptables v1.4.21, which doesn't accept 64 bit mark targets. Is there a newer version that is supposed to support 64 bit marks?

Edit:

$ uname -a
Linux sindhu 3.19.0-28-generic #30-Ubuntu SMP Mon Aug 31 15:52:51 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

$ iptables -I INPUT -s 6.6.6.6 -j MARK --set-xmark 1234567812345678/0xffffffffffffffff
MARK: Could not determine whether revision 2 is supported, assuming it is.
MARK: Could not determine whether revision 2 is supported, assuming it is.
iptables v1.4.21: MARK: bad mark value for option "--set-xmark", or out of range.
1
  • Why do you think, that's not supported? - MARK target: lwn.net/Articles/89814 Use full 64bit mark on 64bit archs
    – A.B.
    Nov 26, 2015 at 10:30

1 Answer 1

2

Support for 64bit marks should be supported since iptables-1.2.10 on 64-bit machines. But it doesn't work, at least not in the latest version (1.4.21-2ubuntu2 and kernel 4.2.0-18).


From the Changelog

iptables v1.2.10 Changelog ====================================================================== This version requires kernel >= 2.4.4
This version recommends kernel >= 2.4.18

Bugs Fixed from 1.2.9:

  • physdev match: fix new structure layout for kernel > 2.6.0-test8 [ Bart De Schuymer ]

  • Better 64bit / 32bit split architecture detection

  • IPv6 LOG target: Fix compiler warnings on 64bit
  • LOG target: Fix compiler warnings on 64bit
  • IPv6 MARK target: Use full 64bit mark on 64bit archs
  • MARK target: Use full 64bit mark on 64bit archs
  • SAME target: Fix 64bit/32bit splitarch problems
  • ULOG target: Fix 64bit/32bit splitarch problems
  • conntrack match: Fix 64bit/32bit splitarch problem
  • IPv6 limit match: Fix 64bit/32bit splitarch problem
  • limit match: Fix 64bit/32bit splitarch problem
  • IPv6 mark match: Use full 64bit mark on 64bit archs
  • mark match: Use full 64bit mark on 64bit archs
  • owner match: Fix compiler warnings on 64bit [ Martin Jofsefsson ]

  • connbytes match: Fix signedness / unsigned issue [ Martin Josefsson ]

  • connlimit match: Fix '/0' netmask [ David Ahern ]

  • ipv6 owner match: fix possibly not zero terminated string

  • helper match: fix possibly not zero terminated string
  • recent match: fix possibly not zero terminated string [ Karsten Desler ]

  • ICMP match: fix '--icmp-type any' case [ Harald Welte ]

  • CONNMARK target: major update (add mark/mask matching) [ Henrik Nordstrom ]

  • DSCP target: Fix cosmetic help message problem [ Maciej Soltysiak ]

  • string match: Fix iptables-save/restore for ascii strings with spaces [ Michael Rash ]

  • ip(6)tables-restore: Make sure matches are used in the same order [ Martin Josefsson ]

  • ip(6)tables-restore: Fix '--verbose' option

  • ip(6)tables-restore: Add '--test' option
  • ip(6)tables-restore: Complain about missing 'COMMIT' [ Martin Josefsson ]

  • ip(6)tables-restore: Allow embedding of quote character in quoted strings [ Michael Rash ]

  • libipq: Protect against spoofed queue messages (check if sender is kernel) [ Harald Welte ]

1
  • I saw this site and thought it's supported. But my machine is 64 bit and I can't configure a 64 bit mark on it. Nov 26, 2015 at 14:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .