feat(netwatch): allow setting SO_MARK on UdpSocket#179
Merged
Conversation
Threads an optional fwmark through UdpSocket::bind_full_with_mark down to SocketState::bind, stored in the socket state so it is reapplied on rebind. Applied via socket2 set_mark on Linux and Android, a no-op elsewhere. Lets a caller policy-route the socket's own egress, for example around a full-tunnel default route.
Contributor
Author
|
Downstream consumer that motivates this: n0-computer/iroh#4406 (draft, exposes it as |
flub
changed the title
flub
requested changes
Jul 13, 2026
flub
left a comment
flub
left a comment
Contributor
There was a problem hiding this comment.
Great feature to add, thanks for working on this! Only some cosmetic API changes needed I think.
This was referenced Jul 13, 2026
ifdario
added a commit
to rayfish/net-tools
that referenced
this pull request
Jul 16, 2026
…Options::set_mark A mark is a one-line configurator, so the dedicated option is redundant. Reverts the SO_MARK plumbing from n0-computer#179 (unreleased) in favor of the general hook.
This was referenced Jul 16, 2026
Closed
Kiesen
pushed a commit
to mira-mobility/net-tools
that referenced
this pull request
Jul 22, 2026
…ter#185) Reverts n0-computer#179 See n0-computer#182: this needs more design.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an optional fwmark to netwatch's UDP socket so a caller can policy-route the socket's own egress, for example around a full-tunnel default route so the tunnel does not swallow the packets carrying it.
What
UdpSocket::bind_full_with_mark(addr, Option<u32>). Existingbind_fulland the otherbind_*entrypoints are unchanged (they passNone).bind_rawintoSocketState::bindand is stored in bothSocketStatevariants, so it is reapplied on every rebind.socket2'sset_markundercfg(any(target_os = "linux", target_os = "android")); a no-op on other platforms.Why
I'm building a full-tunnel client on top of iroh where the endpoint's own underlay UDP packets must skip a
0.0.0.0/0default route (the standard WireGuard/Tailscale SO_MARK +ip ruleapproach). netwatch owns the socket and today exposes no way to set a socket option, so this adds a minimal, opt-in hook.Nonepreserves current behaviour exactly.Happy to adjust the API shape (e.g. a builder-style option) if you'd prefer.