netdev - Re: [PATCH] net: reflect the fwmark for replies with no socket

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20140312.161737.1125059989320204564.davem@davemloft.net>
Date:	Wed, 12 Mar 2014 16:17:37 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	lorenzo@...gle.com
Cc:	netdev@...r.kernel.org
Subject: Re: [PATCH] net: reflect the fwmark for replies with no socket

From: Lorenzo Colitti <lorenzo@...gle.com>
Date: Tue, 11 Mar 2014 20:15:41 +0900

> Kernel-originated IP packets that have no user socket associated
> with them (e.g., ICMP errors and echo replies, TCP RSTs, etc.)
> are emitted with a mark of zero. Instead, make them have the
> same mark as the packet they are replying to.
> 
> This is consistent with TOS, which is also reflected from the
> incoming packet, and it allows the administrator to use
> mark-based routing, firewalling, etc. for these replies by
> marking the original packets inbound.
> 
> Also fix the IPv6 code to reflect the tclass in replies like the
> IPv4 code does.
> 
> Change-Id: Ifd8dd75016e60dc982e7860f720d45c27dcaf04c
> Signed-off-by: Lorenzo Colitti <lorenzo@...gle.com>

I don't think it's safe to change this behavior after all of this
time.

And incoming marks absolutely do not have any automatic relation
to what an administartor might want to use for output packets.

I'm not applying this, sorry.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html