Commit e2a0412a authored Mar 26, 2014 by Lorenzo Colitti Committed by Ruchi Kandoi Feb 04, 2015

net: support marking accepting TCP sockets



When using mark-based routing, sockets returned from accept()
may need to be marked differently depending on the incoming
connection request.

This is the case, for example, if different socket marks identify
different networks: a listening socket may want to accept
connections from all networks, but each connection should be
marked with the network that the request came in on, so that
subsequent packets are sent on the correct network.

This patch adds a sysctl to mark TCP sockets based on the fwmark
of the incoming SYN packet. If enabled, and an unmarked socket
receives a SYN, then the SYN packet's fwmark is written to the
connection's inet_request_sock, and later written back to the
accepted socket when the connection is established.  If the
socket already has a nonzero mark, then the behaviour is the same
as it is today, i.e., the listening socket's fwmark is used.

Black-box tested using user-mode linux:

- IPv4/IPv6 SYN+ACK, FIN, etc. packets are routed based on the
  mark of the incoming SYN packet.
- The socket returned by accept() is marked with the mark of the
  incoming SYN packet.
- Tested with syncookies=1 and syncookies=2.

Change-Id: I26bc1eceefd2c588d73b921865ab70e4645ade57
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>

parent ba3d8d3f

Documentation/networking/ip-sysctl.txt

+10 −0

Original line number	Diff line number	Diff line
		@@ -518,6 +518,16 @@ tcp_fastopen - INTEGER

		See include/net/tcp.h and the code for more details.

		tcp_fwmark_accept - BOOLEAN
		If set, incoming connections to listening sockets that do not have a
		socket mark will set the mark of the accepting socket to the fwmark of
		the incoming SYN packet. This will cause all packets on that connection
		(starting from the first SYNACK) to be sent with that fwmark. The
		listening socket's mark is unchanged. Listening sockets that already
		have a fwmark set via setsockopt(SOL_SOCKET, SO_MARK, ...) are
		unaffected.
		Default: 0

		tcp_syn_retries - INTEGER
		Number of times initial SYNs for an active TCP connection attempt
		will be retransmitted. Should not be higher than 255. Default value