Add net.inet6.ip6.source_address_validation

[glebius]

Summary

Drop packets arriving from the network that have our source IPv6
address. If maliciously crafted they can create evil effects
like an RST exchange between two of our listening TCP ports.
Such packets just can't be legitimate. Enable the tunable
by default. Long time due for a modern Internet host.

[melifaro]

sys/netinet6/ip6_input.c

825

How will it work with multiple fibs?

[glebius]

sys/netinet6/ip6_input.c

825

We chatted with Alexander on what kind of a setup could be broken by restriction that the change introduces. Here is an example that Alexander provided:

[glebius]

Use in6_localip_fib().