From: liamsmith827 <[email protected]> This RFC proposes honoring prohibit rules and routes when an output interface is specified.
When flowi4_oif is set (SO_BINDTODEVICE, IP_PKTINFO, IP_UNICAST_IF, etc), prohibit rules and routes cause fib_lookup() to return -EACCES, but still allow the packet (and any necessary ARP) to be transmitted. This is documented as the expected behavior in the tests, but is confusing for route and rule maintainers. Android uses prohibit rules as the basis for its VPN "kill switch", with the expectation that any packet encountering such a rule will not be allowed out. Due to this interface binding exemption, apps can trivially bypass the kill switch. This is most serious on cellular networks, where a connection to an arbitrary IPv4 address can be established without requiring ARP resolution. The first patch preserves -EACCES from fib_lookup() instead of constructing an on-link route when an output interface is specified. This honors prohibit rules and routes while retaining the existing fallback for other lookup errors. The second patch enables the existing test that expects an interface-bound ping to fail. I would appreciate feedback on compatibility implications and whether this change is acceptable given the longstanding behavior. liamsmith827 (2): ipv4: Honor prohibit when oif specified selftests: net: Test prohibit when oif specified net/ipv4/route.c | 11 ++++++----- tools/testing/selftests/net/fcnal-test.sh | 7 +++---- 2 files changed, 9 insertions(+), 9 deletions(-) -- 2.47.3
