Commit 28f6aeea authored by Jamal Hadi Salim's avatar Jamal Hadi Salim Committed by David S. Miller
Browse files

net: restore ip source validation 



when using policy routing and the skb mark:
there are cases where a back path validation requires us
to use a different routing table for src ip validation than
the one used for mapping ingress dst ip.
One such a case is transparent proxying where we pretend to be
the destination system and therefore the local table
is used for incoming packets but possibly a main table would
be used on outbound.
Make the default behavior to allow the above and if users
need to turn on the symmetry via sysctl src_valid_mark

Signed-off-by: default avatarJamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4a6e47a4

include/linux/inetdevice.h

+1 −0
Original line number Diff line number Diff line
@@ -81,6 +81,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev) 
#define IN_DEV_FORWARD(in_dev)		IN_DEV_CONF_GET((in_dev), FORWARDING)

#define IN_DEV_MFORWARD(in_dev)		IN_DEV_ANDCONF((in_dev), MC_FORWARDING)

#define IN_DEV_RPFILTER(in_dev)		IN_DEV_MAXCONF((in_dev), RP_FILTER)

#define IN_DEV_SRC_VMARK(in_dev)    	IN_DEV_ORCONF((in_dev), SRC_VMARK)

#define IN_DEV_SOURCE_ROUTE(in_dev)	IN_DEV_ANDCONF((in_dev), \

						       ACCEPT_SOURCE_ROUTE)

#define IN_DEV_ACCEPT_LOCAL(in_dev)	IN_DEV_ORCONF((in_dev), ACCEPT_LOCAL)

include/linux/sysctl.h

+1 −0
Original line number Diff line number Diff line
@@ -482,6 +482,7 @@ enum 
	NET_IPV4_CONF_ARP_ACCEPT=21,

	NET_IPV4_CONF_ARP_NOTIFY=22,

	NET_IPV4_CONF_ACCEPT_LOCAL=23,

	NET_IPV4_CONF_SRC_VMARK=24,

	__NET_IPV4_CONF_MAX

};

net/ipv4/devinet.c

+1 −0
Original line number Diff line number Diff line
@@ -1397,6 +1397,7 @@ static struct devinet_sysctl_table { 
		DEVINET_SYSCTL_RW_ENTRY(ACCEPT_SOURCE_ROUTE,

					"accept_source_route"),

		DEVINET_SYSCTL_RW_ENTRY(ACCEPT_LOCAL, "accept_local"),

		DEVINET_SYSCTL_RW_ENTRY(SRC_VMARK, "src_valid_mark"),

		DEVINET_SYSCTL_RW_ENTRY(PROXY_ARP, "proxy_arp"),

		DEVINET_SYSCTL_RW_ENTRY(MEDIUM_ID, "medium_id"),

		DEVINET_SYSCTL_RW_ENTRY(BOOTP_RELAY, "bootp_relay"),

net/ipv4/fib_frontend.c

+2 −0
Original line number Diff line number Diff line
@@ -252,6 +252,8 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif, 
		no_addr = in_dev->ifa_list == NULL;

		rpf = IN_DEV_RPFILTER(in_dev);

		accept_local = IN_DEV_ACCEPT_LOCAL(in_dev);

		if (mark && !IN_DEV_SRC_VMARK(in_dev))

			fl.mark = 0;

	}

	rcu_read_unlock();

CRA Git | Maintained and supported by SUSTech CRA and CCSE