Skip to content
  • Lorenzo Colitti's avatar
    net: add a sysctl to reflect the fwmark on replies · e110861f
    Lorenzo Colitti authored
    
    
    Kernel-originated IP packets that have no user socket associated
    with them (e.g., ICMP errors and echo replies, TCP RSTs, etc.)
    are emitted with a mark of zero. Add a sysctl to make them have
    the same mark as the packet they are replying to.
    
    This allows an administrator that wishes to do so to use
    mark-based routing, firewalling, etc. for these replies by
    marking the original packets inbound.
    
    Tested using user-mode linux:
     - ICMP/ICMPv6 echo replies and errors.
     - TCP RST packets (IPv4 and IPv6).
    
    Signed-off-by: default avatarLorenzo Colitti <lorenzo@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    e110861f