net: restore ip source validation

when using policy routing and the skb mark:
there are cases where a back path validation requires us
to use a different routing table for src ip validation than
the one used for mapping ingress dst ip.
One such a case is transparent proxying where we pretend to be
the destination system and therefore the local table
is used for incoming packets but possibly a main table would
be used on outbound.
Make the default behavior to allow the above and if users
need to turn on the symmetry via sysctl src_valid_mark

Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 3 insertions, 0 deletions

diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 5cdbc102a418..040c4f05b653 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1397,6 +1397,7 @@ static struct devinet_sysctl_table {
                 DEVINET_SYSCTL_RW_ENTRY(ACCEPT_SOURCE_ROUTE,
                                         "accept_source_route"),
                 DEVINET_SYSCTL_RW_ENTRY(ACCEPT_LOCAL, "accept_local"),
+                DEVINET_SYSCTL_RW_ENTRY(SRC_VMARK, "src_valid_mark"),
                 DEVINET_SYSCTL_RW_ENTRY(PROXY_ARP, "proxy_arp"),
                 DEVINET_SYSCTL_RW_ENTRY(MEDIUM_ID, "medium_id"),
                 DEVINET_SYSCTL_RW_ENTRY(BOOTP_RELAY, "bootp_relay"),
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 3323168ee52d..82dbf711d6d0 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -252,6 +252,8 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
                 no_addr = in_dev->ifa_list == NULL;
                 rpf = IN_DEV_RPFILTER(in_dev);
                 accept_local = IN_DEV_ACCEPT_LOCAL(in_dev);
+                if (mark && !IN_DEV_SRC_VMARK(in_dev))
+                        fl.mark = 0;
         }
         rcu_read_unlock();