Update the "lookup main" rule to include a fwmark clause.
If a packet is marked with a non-zero NetId, and doesn't find a route in its
per-network table, it will now not match the main table rule, and so will
fallthrough to the "unreachable" rule, resulting in ENETUNREACH, as desired.
If a packet has a zero NetId (e.g.: sent on an unconnected UDP socket), it will
find the "default network" rule first, which should have a default route, so it
will never need to fall through any further to the main table.
This makes the main table effectively unused for all normal routing lookups.
Only the kernel will still use this table, when trying to find a directly
connected route to validate the nexthop when a route is added anywhere.
(cherry picked from commit 4594dbba433dadba953c1c7b43fdd99e77fb1f2b)
Change-Id: Ib0784ff0848854be0575c64a59bbd0a4d3bf93e0
3 files changed