[PATCH net 2/3] bpf: don't redirect decrypted skbs from egress to ingress

[Todd Freed <toddfreed@meta.com>]

On transmit, skb->decrypted means that the device must encrypt the
packet, e.g. a packet of a kTLS or PSP device offload socket.

On receive, skb->decrypted means that the device decrypted the packet,
and kTLS device offload trusts it as such (tls_device_decrypted()).

bpf_redirect() and bpf_clone_redirect() with BPF_F_INGRESS send the
packet to a device's receive path with the bit still set, where it claims
to have been decrypted by the device, although it was never encrypted.

In addition, the redirect drops the metadata dst (skb_scrub_packet()),
which will hold the Tx association for socket-less PSP offload in the
net-next series "psp: introduce socket-less associations".

Drop decrypted skbs which bpf redirects from egress to ingress, as mirred
does since the previous patch.

Fixes: 414776621d10 ("net/tls: prevent skb_orphan() from leaking TLS plain text with offload")
Signed-off-by: Todd Freed <toddfreed@meta.com>
---
 net/core/filter.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index 946b07a17fce..defbef3a9f75 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2226,6 +2226,16 @@ static int __bpf_redirect_common(struct sk_buff *skb, struct net_device *dev,
 static int __bpf_redirect(struct sk_buff *skb, struct net_device *dev,
 			  u32 flags)
 {
+	/*
+	 * On transmit, decrypted asks the device to encrypt the packet. Sent
+	 * to ingress, the packet would read as decrypted by the device.
+	 */
+	if (unlikely((flags & BPF_F_INGRESS) && !skb_at_tc_ingress(skb) &&
+		     skb_is_decrypted(skb))) {
+		kfree_skb(skb);
+		return -EINVAL;
+	}
+
 	if (dev_is_mac_header_xmit(dev))
 		return __bpf_redirect_common(skb, dev, flags);
 	else
-- 
2.53.1-Meta