diff options
| author | Lorenzo Colitti <lorenzo@google.com> | 2014-03-18 20:52:27 +0900 |
|---|---|---|
| committer | Simon Wilson <simonwilson@google.com> | 2014-09-04 17:41:23 -0700 |
| commit | 9d7897dfef08b9bef6136b2499988f31892fc1b7 (patch) | |
| tree | 3dd0bbae8b55caf97543718c82794808f2e22828 /net/ipv6/tcp_ipv6.c | |
| parent | 685921f1d655b68d2d66cf0a2bddedd4080cf2ef (diff) | |
| download | olio-linux-3.10-9d7897dfef08b9bef6136b2499988f31892fc1b7.tar.xz olio-linux-3.10-9d7897dfef08b9bef6136b2499988f31892fc1b7.zip | |
net: add a sysctl to reflect the fwmark on replies
Kernel-originated IP packets that have no user socket associated
with them (e.g., ICMP errors and echo replies, TCP RSTs, etc.)
are emitted with a mark of zero. Add a sysctl to make them have
the same mark as the packet they are replying to.
This allows an administrator that wishes to do so to use
mark-based routing, firewalling, etc. for these replies by
marking the original packets inbound.
Tested using user-mode linux:
- ICMP/ICMPv6 echo replies and errors.
- TCP RST packets (IPv4 and IPv6).
Change-Id: I6873d973196797bcf32e2e91976df647c7e8b85a
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Diffstat (limited to 'net/ipv6/tcp_ipv6.c')
| -rw-r--r-- | net/ipv6/tcp_ipv6.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 0a17ed9eaf3..71545cb17ab 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -791,6 +791,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win, fl6.flowi6_proto = IPPROTO_TCP; if (ipv6_addr_type(&fl6.daddr) & IPV6_ADDR_LINKLOCAL) fl6.flowi6_oif = inet6_iif(skb); + fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark); fl6.fl6_dport = t1->dest; fl6.fl6_sport = t1->source; security_skb_classify_flow(skb, flowi6_to_flowi(&fl6)); |