[RFC net-next 0/2] ipv4: Honor prohibit when oif specified

[liamsmith827 <liamsmith827@grapheneos.org>]

From: liamsmith827 <liamsmith827@proton.me>

This RFC proposes honoring prohibit rules and routes when an output
interface is specified.

When flowi4_oif is set (SO_BINDTODEVICE, IP_PKTINFO, IP_UNICAST_IF,
etc), prohibit rules and routes cause fib_lookup() to return -EACCES,
but still allow the packet (and any necessary ARP) to be transmitted.
This is documented as the expected behavior in the tests, but is
confusing for route and rule maintainers.

Android uses prohibit rules as the basis for its VPN "kill switch", with
the expectation that any packet encountering such a rule will not be
allowed out. Due to this interface binding exemption, apps can trivially
bypass the kill switch. This is most serious on cellular networks, where
a connection to an arbitrary IPv4 address can be established without
requiring ARP resolution.

The first patch preserves -EACCES from fib_lookup() instead of
constructing an on-link route when an output interface is specified.
This honors prohibit rules and routes while retaining the existing
fallback for other lookup errors.

The second patch enables the existing test that expects an
interface-bound ping to fail.

I would appreciate feedback on compatibility implications and whether
this change is acceptable given the longstanding behavior.

liamsmith827 (2):
  ipv4: Honor prohibit when oif specified
  selftests: net: Test prohibit when oif specified

 net/ipv4/route.c                          | 11 ++++++-----
 tools/testing/selftests/net/fcnal-test.sh |  7 +++----
 2 files changed, 9 insertions(+), 9 deletions(-)

-- 
2.47.3