[RFC net-next 1/2] ipv4: Honor prohibit when oif specified

[liamsmith827 <liamsmith827@grapheneos.org>]

From: liamsmith827 <liamsmith827@proton.me>

When flowi4_oif is set (SO_BINDTODEVICE, IP_PKTINFO, IP_UNICAST_IF,
etc), prohibit rules and routes cause fib_lookup() to return -EACCES,
but still allow the packet (and any necessary ARP) to be transmitted.
This is documented as the expected behavior in the tests, but is
confusing for route and rule maintainers. Specifically, Android uses
prohibit rules as the basis for its VPN "kill switch", with the
expectation that any packet encountering such a rule will not be allowed
out. Due to this interface binding exemption, apps can trivially bypass
the kill switch. This is most serious on cellular networks, where a
connection to an arbitrary IPv4 address can be established without
requiring ARP resolution.

Preserve -EACCES from fib_lookup() instead of constructing an on-link
route when an output interface is specified. This honors prohibit rules
and routes while retaining the existing fallback for other lookup
errors.

Signed-off-by: liamsmith827 <liamsmith827@proton.me>
---
 net/ipv4/route.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 595a3b7f1783..616c20299334 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2853,7 +2853,7 @@ struct rtable *ip_route_output_key_hash_rcu(struct net *net, struct flowi4 *fl4,
 	if (err) {
 		res->fi = NULL;
 		res->table = NULL;
-		if (fl4->flowi4_oif &&
+		if (fl4->flowi4_oif && err != -EACCES &&
 		    (ipv4_is_multicast(fl4->daddr) || !fl4->flowi4_l3mdev)) {
 			/* Apparently, routing tables are wrong. Assume,
 			 * that the destination is on link.
@@ -2864,13 +2864,14 @@ struct rtable *ip_route_output_key_hash_rcu(struct net *net, struct flowi4 *fl4,
 			 * addresses. When oif is specified, routing
 			 * tables are looked up with only one purpose:
 			 * to catch if destination is gatewayed, rather than
-			 * direct. Moreover, if MSG_DONTROUTE is set,
-			 * we send packet, ignoring both routing tables
-			 * and ifaddr state. --ANK
-			 *
+			 * direct.
 			 *
 			 * We could make it even if oif is unknown,
 			 * likely IPv6, but we do not.
+			 *
+			 * Additionally, when oif is specified, routing lookup
+			 * allows us to check if destination is prohibited
+			 * (-EACCES). LS.
 			 */
 
 			if (fl4->saddr == 0)
-- 
2.47.3