net: add a sysctl to reflect the fwmark on replies
Kernel-originated IP packets that have no user socket associated with them (e.g., ICMP errors and echo replies, TCP RSTs, etc.) are emitted with a mark of zero. Add a sysctl to make them have the same mark as the packet they are replying to. This allows an administrator that wishes to do so to use mark-based routing, firewalling, etc. for these replies by marking the original packets inbound. Tested using user-mode linux: - ICMP/ICMPv6 echo replies and errors. - TCP RST packets (IPv4 and IPv6). Signed-off-by:Lorenzo Colitti <lorenzo@google.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
Showing
- include/net/ip.h 3 additions, 0 deletionsinclude/net/ip.h
- include/net/ipv6.h 3 additions, 0 deletionsinclude/net/ipv6.h
- include/net/netns/ipv4.h 2 additions, 0 deletionsinclude/net/netns/ipv4.h
- include/net/netns/ipv6.h 1 addition, 0 deletionsinclude/net/netns/ipv6.h
- net/ipv4/icmp.c 9 additions, 2 deletionsnet/ipv4/icmp.c
- net/ipv4/ip_output.c 2 additions, 1 deletionnet/ipv4/ip_output.c
- net/ipv4/sysctl_net_ipv4.c 7 additions, 0 deletionsnet/ipv4/sysctl_net_ipv4.c
- net/ipv6/icmp.c 6 additions, 0 deletionsnet/ipv6/icmp.c
- net/ipv6/sysctl_net_ipv6.c 7 additions, 0 deletionsnet/ipv6/sysctl_net_ipv6.c
- net/ipv6/tcp_ipv6.c 1 addition, 0 deletionsnet/ipv6/tcp_ipv6.c
Please register or sign in to comment