code: func invokeFWMarker(path string, vip net.IP, fwMark uint32, ingressPorts []*PortConfig, eIP *net.IPNet, isDelete bool, lbMode string) error {
  	var ingressPortsFile string
  
  	if len(ingressPorts) != 0 {
  		var err error
  		ingressPortsFile, err = writePortsToFile(ingressPorts)
  		if err != nil {
  			return err
  		}
  
  		defer os.Remove(ingressPortsFile)
  	}
  
  	addDelOpt := "-A"
  	if isDelete {
  		addDelOpt = "-D"
  	}
  
  	cmd := &exec.Cmd{
  		Path:   reexec.Self(),
  		Args:   append([]string{"fwmarker"}, path, vip.String(), fmt.Sprintf("%d", fwMark), addDelOpt, ingressPortsFile, eIP.String(), lbMode),
  		Stdout: os.Stdout,
  		Stderr: os.Stderr,
  	}
  
  	if err := cmd.Run(); err != nil {
  		return fmt.Errorf("reexec failed: %v", err)
  	}
  
  	return nil
  }
docs: // Invoke fwmarker reexec routine to mark vip destined packets with
  // the passed firewall mark.