netdev - Re: [PATCH] net: add a sysctl to reflect the fwmark on replies

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 3 Apr 2014 14:10:53 +0200
From:	Hannes Frederic Sowa <hannes@...essinduktion.org>
To:	Lorenzo Colitti <lorenzo@...gle.com>
Cc:	netdev@...r.kernel.org, davem@...emloft.net, ja@....bg
Subject: Re: [PATCH] net: add a sysctl to reflect the fwmark on replies

On Thu, Apr 03, 2014 at 06:00:01PM +0900, Lorenzo Colitti wrote:
> Kernel-originated IP packets that have no user socket associated
> with them (e.g., ICMP errors and echo replies, TCP RSTs, etc.)
> are emitted with a mark of zero. Add a sysctl to make them have
> the same mark as the packet they are replying to.
> 
> This allows an administrator that wishes to do so to use
> mark-based routing, firewalling, etc. for these replies by
> marking the original packets inbound.
> 
> Tested using user-mode linux:
>  - ICMP/ICMPv6 echo replies and errors.
>  - TCP RST packets (IPv4 and IPv6).

Hmm, maybe add two sysctls to distinguish between IPv4 and IPv6?

We share the sysctl namespace for tcp with ipv4, but otherwise the knobs
are isolated if they touch ip-only behaviour.

Also net-next is currently closed, so the patch would have to wait until it
opens back up in a few weeks(?).

Bye,

  Hannes
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html