add --mark option to set SO_MARK sockopt

Signed-off-by: Heiko Hund <heiko.hund@sophos.com>
Acked-by: David Sommerseth <davids@redhat.com>
Signed-off-by: David Sommerseth <davids@redhat.com>

diff --git a/init.c b/init.c
index 0530b10a75198e06e6033e8b786892fd13461c2d..e8c9aab36fafc80a3c59d2c169283d17651d67fd 100644 (file)
--- a/init.c
+++ b/init.c
@@ -2640,6 +2640,7 @@ do_init_socket_1 (struct context *c, const int mode)
                           c->options.mtu_discover_type,
                           c->options.rcvbuf,
                           c->options.sndbuf,
+                          c->options.mark,
                           sockflags);
 }
 

diff --git a/openvpn.8 b/openvpn.8
index dc7646428105f66942d9e4ceddb000b029451e3a..55a9b80c026c5282a2c1e65db570d6ddcc07ac3d 100644 (file)
--- a/openvpn.8
+++ b/openvpn.8
@@ -1371,6 +1371,12 @@ Set the TCP/UDP socket receive buffer size.
 Currently defaults to 65536 bytes.
 .\"*********************************************************
 .TP
+.B \-\-mark value
+Mark encrypted packets being sent with value. The mark value can be
+matched in policy routing and packetfilter rules. This option is
+only supported in Linux and does nothing on other operating systems.
+.\"*********************************************************
+.TP
 .B \-\-socket-flags flags...
 Apply the given flags to the OpenVPN transport socket.
 Currently, only

diff --git a/options.c b/options.c
index a6230de1a5100a4c78ae70a1cebf5d7f37896fc4..d410782ace4cc29e817426e4b07a4a76de19ad2b 100644 (file)
--- a/options.c
+++ b/options.c
@@ -280,6 +280,10 @@ static const char usage_message[] =
   "                  or --fragment max value, whichever is lower.\n"
   "--sndbuf size   : Set the TCP/UDP send buffer size.\n"
   "--rcvbuf size   : Set the TCP/UDP receive buffer size.\n"
+#ifdef TARGET_LINUX
+  "--mark value    : Mark encrypted packets being sent with value. The mark value\n"
+  "                  can be matched in policy routing and packetfilter rules.\n"
+#endif
   "--txqueuelen n  : Set the tun/tap TX queue length to n (Linux only).\n"
   "--mlock         : Disable Paging -- ensures key material and tunnel\n"
   "                  data will never be written to disk.\n"
@@ -1473,6 +1477,9 @@ show_settings (const struct options *o)
 #endif
   SHOW_INT (rcvbuf);
   SHOW_INT (sndbuf);
+#ifdef TARGET_LINUX
+  SHOW_INT (mark);
+#endif
   SHOW_INT (sockflags);
 
   SHOW_BOOL (fast_io);
@@ -4520,6 +4527,13 @@ add_option (struct options *options,
       VERIFY_PERMISSION (OPT_P_SOCKBUF);
       options->sndbuf = positive_atoi (p[1]);
     }
+  else if (streq (p[0], "mark") && p[1])
+    {
+#ifdef TARGET_LINUX
+      VERIFY_PERMISSION (OPT_P_GENERAL);
+      options->mark = atoi(p[1]);
+#endif
+    }
   else if (streq (p[0], "socket-flags"))
     {
       int j;

diff --git a/options.h b/options.h
index e723b6677192b004e2111736857a40148062e3f6..d79287217f787fe715b4c5807d03e1b110cb7b9b 100644 (file)
--- a/options.h
+++ b/options.h
@@ -342,6 +342,9 @@ struct options
   int rcvbuf;
   int sndbuf;
 
+  /* mark value */
+  int mark;
+
   /* socket flags */
   unsigned int sockflags;
 

diff --git a/socket.c b/socket.c
index 76c760cd7351a21f5ee8dc5317c2419d4c1fb822..a2f9511c1b2f0aaae940c5ab89382fcaed9b341a 100644 (file)
--- a/socket.c
+++ b/socket.c
@@ -779,6 +779,15 @@ socket_set_tcp_nodelay (int sd, int state)
 #endif
 }
 
+static void
+socket_set_mark (int sd, int mark)
+{
+#ifdef TARGET_LINUX
+  if (mark && setsockopt (sd, SOL_SOCKET, SO_MARK, &mark, sizeof (mark)) != 0)
+    msg (M_WARN, "NOTE: setsockopt SO_MARK=%d failed", mark);
+#endif
+}
+
 static bool
 socket_set_flags (int sd, unsigned int sockflags)
 {
@@ -1599,6 +1608,7 @@ link_socket_init_phase1 (struct link_socket *sock,
                         int mtu_discover_type,
                         int rcvbuf,
                         int sndbuf,
+                        int mark,
                         unsigned int sockflags)
 {
   ASSERT (sock);
@@ -1716,6 +1726,9 @@ link_socket_init_phase1 (struct link_socket *sock,
       /* set socket buffers based on --sndbuf and --rcvbuf options */
       socket_set_buffers (sock->sd, &sock->socket_buffer_sizes);
 
+      /* set socket to --mark packets with given value */
+      socket_set_mark (sock->sd, mark);
+
       resolve_bind_local (sock);
       resolve_remote (sock, 1, NULL, NULL);
     }

diff --git a/socket.h b/socket.h
index b385fb27afc3453088d849c7b2247c4ba368030f..a9a29c5ba3be60c83989e7fa6a5eefbc267faf55 100644 (file)
--- a/socket.h
+++ b/socket.h
@@ -324,6 +324,7 @@ link_socket_init_phase1 (struct link_socket *sock,
                         int mtu_discover_type,
                         int rcvbuf,
                         int sndbuf,
+                        int mark,
                         unsigned int sockflags);
 
 void link_socket_init_phase2 (struct link_socket *sock,