[PATCH v2 0/2] Disable rp_filter for IPsec packets

[Michael Smith <msmith@cbnco.com>]

The reverse path filter interferes with IPsec subnet-to-subnet tunnels,
especially when the link to the IPsec peer is on an interface other than
the one hosting the default route.

IPsec provides a much stronger anti-spoofing policy than rp_filter, so
this patch disables the rp_filter for packets with a security path.

Patch is against net-next.

(old discussion here: http://patchwork.ozlabs.org/patch/86826/)

Michael Smith (2):
  fib_validate_source(): pass sk_buff instead of mark
  Disable rp_filter for IPsec packets

 include/net/ip_fib.h    |    6 +++---
 include/net/xfrm.h      |    9 +++++++++
 net/ipv4/fib_frontend.c |   16 +++++++++-------
 net/ipv4/route.c        |   16 ++++++++--------
 4 files changed, 29 insertions(+), 18 deletions(-)