linux/include/uapi
Harout Hedeshian 01555e74bd netfilter: xt_socket: add XT_SOCKET_RESTORESKMARK flag
xt_socket is useful for matching sockets with IP_TRANSPARENT and
taking some action on the matching packets. However, it lacks the
ability to match only a small subset of transparent sockets.

Suppose there are 2 applications, each with its own set of transparent
sockets. The first application wants all matching packets dropped,
while the second application wants them forwarded somewhere else.

Add the ability to retore the skb->mark from the sk_mark. The mark
is only restored if a matching socket is found and the transparent /
nowildcard conditions are satisfied.

Now the 2 hypothetical applications can differentiate their sockets
based on a mark value set with SO_MARK.

iptables -t mangle -I PREROUTING -m socket --transparent \
                                           --restore-skmark -j action
iptables -t mangle -A action -m mark --mark 10 -j action2
iptables -t mangle -A action -m mark --mark 11 -j action3

Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2015-06-18 13:05:09 +02:00
..
asm-generic errno.h: Improve ENOSYS's comment 2015-04-17 09:03:58 -04:00
drm drm/nouveau/gem: allow user-space to specify an object should be coherent 2015-04-14 17:00:46 +10:00
linux netfilter: xt_socket: add XT_SOCKET_RESTORESKMARK flag 2015-06-18 13:05:09 +02:00
misc cxl: Add documentation for userspace APIs 2014-10-08 20:16:19 +11:00
mtd
rdma RDMA/core: Enable the iWarp Port Mapper to provide the actual address of the connecting peer to its clients 2015-05-05 09:18:01 -04:00
scsi
sound ALSA: asound.h - use SNDRV_CTL_ELEM_ID_NAME_MAXLEN 2015-04-18 09:05:55 +02:00
video
xen
Kbuild cxl: Add userspace header file 2014-10-08 20:15:57 +11:00