9 files changed, 30 insertions, 5 deletions

diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index 1833c3f389ee..b1edf17bec01 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -90,6 +90,7 @@ struct inet_request_sock {
         kmemcheck_bitfield_end(flags);
         struct ip_options_rcu   *opt;
         struct sk_buff          *pktopts;
+        u32                     ir_mark;
 };
 
 static inline struct inet_request_sock *inet_rsk(const struct request_sock *sk)
@@ -97,6 +98,15 @@ static inline struct inet_request_sock *inet_rsk(const struct request_sock *sk)
         return (struct inet_request_sock *)sk;
 }
 
+static inline u32 inet_request_mark(struct sock *sk, struct sk_buff *skb)
+{
+        if (!sk->sk_mark && sock_net(sk)->ipv4.sysctl_tcp_fwmark_accept) {
+                return skb->mark;
+        } else {
+                return sk->sk_mark;
+        }
+}
+
 struct inet_cork {
         unsigned int            flags;
         __be32                  addr;
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index a32fc4d705da..2f0cfad66666 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -78,6 +78,7 @@ struct netns_ipv4 {
         int sysctl_ip_fwd_use_pmtu;
 
         int sysctl_fwmark_reflect;
+        int sysctl_tcp_fwmark_accept;
 
         struct ping_group_range ping_group_range;
 
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index a56b8e6e866a..12e502cbfdc7 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -408,7 +408,7 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
         struct net *net = sock_net(sk);
         int flags = inet_sk_flowi_flags(sk);
 
-        flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark,
+        flowi4_init_output(fl4, sk->sk_bound_dev_if, ireq->ir_mark,
                            RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
                            sk->sk_protocol,
                            flags,
@@ -445,7 +445,7 @@ struct dst_entry *inet_csk_route_child_sock(struct sock *sk,
 
         rcu_read_lock();
         opt = rcu_dereference(newinet->inet_opt);
-        flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark,
+        flowi4_init_output(fl4, sk->sk_bound_dev_if, inet_rsk(req)->ir_mark,
                            RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
                            sk->sk_protocol, inet_sk_flowi_flags(sk),
                            (opt && opt->opt.srr) ? opt->opt.faddr : ireq->ir_rmt_addr,
@@ -680,6 +680,8 @@ struct sock *inet_csk_clone_lock(const struct sock *sk,
                 inet_sk(newsk)->inet_sport = htons(inet_rsk(req)->ir_num);
                 newsk->sk_write_space = sk_stream_write_space;
 
+                newsk->sk_mark = inet_rsk(req)->ir_mark;
+
                 newicsk->icsk_retransmits = 0;
                 newicsk->icsk_backoff     = 0;
                 newicsk->icsk_probes_out  = 0;
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index f2ed13c2125f..c86624b36a62 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -303,6 +303,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         ireq->ir_rmt_port       = th->source;
         ireq->ir_loc_addr       = ip_hdr(skb)->daddr;
         ireq->ir_rmt_addr       = ip_hdr(skb)->saddr;
+        ireq->ir_mark           = inet_request_mark(sk, skb);
         ireq->ecn_ok            = ecn_ok;
         ireq->snd_wscale        = tcp_opt.snd_wscale;
         ireq->sack_ok           = tcp_opt.sack_ok;
@@ -339,7 +340,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
          * hasn't changed since we received the original syn, but I see
          * no easy way to do this.
          */
-        flowi4_init_output(&fl4, sk->sk_bound_dev_if, sk->sk_mark,
+        flowi4_init_output(&fl4, sk->sk_bound_dev_if, ireq->ir_mark,
                            RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, IPPROTO_TCP,
                            inet_sk_flowi_flags(sk),
                            (opt && opt->srr) ? opt->faddr : ireq->ir_rmt_addr,
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index f50d51850285..a33b9fbc1d80 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -845,6 +845,13 @@ static struct ctl_table ipv4_net_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
+        {
+                .procname       = "tcp_fwmark_accept",
+                .data           = &init_net.ipv4.sysctl_tcp_fwmark_accept,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
         { }
 };
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a2780e5334c9..77cccda1ad0c 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1318,6 +1318,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         ireq->ir_rmt_addr = saddr;
         ireq->no_srccheck = inet_sk(sk)->transparent;
         ireq->opt = tcp_v4_save_options(skb);
+        ireq->ir_mark = inet_request_mark(sk, skb);
 
         if (security_inet_conn_request(sk, skb, req))
                 goto drop_and_free;
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index d4ade34ab375..a245e5ddffbd 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -81,7 +81,7 @@ struct dst_entry *inet6_csk_route_req(struct sock *sk,
         final_p = fl6_update_dst(fl6, np->opt, &final);
         fl6->saddr = ireq->ir_v6_loc_addr;
         fl6->flowi6_oif = ireq->ir_iif;
-        fl6->flowi6_mark = sk->sk_mark;
+        fl6->flowi6_mark = ireq->ir_mark;
         fl6->fl6_dport = ireq->ir_rmt_port;
         fl6->fl6_sport = htons(ireq->ir_num);
         security_req_classify_flow(req, flowi6_to_flowi(fl6));
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index bb53a5e73c1a..a822b880689b 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -216,6 +216,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
                 ireq->ir_iif = inet6_iif(skb);
 
+        ireq->ir_mark = inet_request_mark(sk, skb);
+
         req->expires = 0UL;
         req->num_retrans = 0;
         ireq->ecn_ok            = ecn_ok;
@@ -242,7 +244,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                 final_p = fl6_update_dst(&fl6, np->opt, &final);
                 fl6.saddr = ireq->ir_v6_loc_addr;
                 fl6.flowi6_oif = sk->sk_bound_dev_if;
-                fl6.flowi6_mark = sk->sk_mark;
+                fl6.flowi6_mark = ireq->ir_mark;
                 fl6.fl6_dport = ireq->ir_rmt_port;
                 fl6.fl6_sport = inet_sk(sk)->inet_sport;
                 security_req_classify_flow(req, flowi6_to_flowi(&fl6));
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index c54976a44425..f07b2abba359 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1034,6 +1034,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                 TCP_ECN_create_request(req, skb, sock_net(sk));
 
         ireq->ir_iif = sk->sk_bound_dev_if;
+        ireq->ir_mark = inet_request_mark(sk, skb);
 
         /* So that link locals have meaning */
         if (!sk->sk_bound_dev_if &&