tree ff61e3ab53f46ceca2ef280788982883b50cc669
parent 5c04c819a20af40adb7d282199f4e34e14fa05c5
author Michael Smith <msmith@cbnco.com> 1302151911 +0000
committer David S. Miller <davem@davemloft.net> 1302486659 -0700

Disable rp_filter for IPsec packets

The reverse path filter interferes with IPsec subnet-to-subnet tunnels,
especially when the link to the IPsec peer is on an interface other than
the one hosting the default route.

With dynamic routing, where the peer might be reachable through eth0
today and eth1 tomorrow, it's difficult to keep rp_filter enabled unless
fake routes to the remote subnets are configured on the interface
currently used to reach the peer.

IPsec provides a much stronger anti-spoofing policy than rp_filter, so
this patch disables the rp_filter for packets with a security path.

Signed-off-by: Michael Smith <msmith@cbnco.com>
Signed-off-by: David S. Miller <davem@davemloft.net>