[PATCH net-next v1 07/15] bpf: don't redirect decrypted skbs from egress to ingress

[Todd Freed <toddfreed@meta.com>]

on transmit, skb->decrypted means the device must encrypt the packet.
For example, a packet of a ktls or psp offload socket, or, with the tc
psp action added later in this series, one which psp encap attached a
tx association to.

on receive, skb->decrypted means the device decrypted the packet.

bpf_redirect() and bpf_clone_redirect() with BPF_F_INGRESS send the
packet to a device's receive path with the bit still set, where it
indicates the packet was decrypted by the device.

this is less of a problem with socket offloads, whose packets are by
definition generated locally; more of a problem with socket-less psp,
which can also apply to forwarded traffic.

in addition, the redirect drops the dst (skb_scrub_packet()), which for
socket-less psp carries the tx association.

drop decrypted skbs which bpf redirects from egress to ingress. this
matches the behavior of mirred, since the previous patch.

Signed-off-by: Todd Freed <toddfreed@meta.com>
---
 net/core/filter.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index aca8160b26a1..a178a9dd3007 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2226,6 +2226,15 @@ static int __bpf_redirect_common(struct sk_buff *skb, struct net_device *dev,
 static int __bpf_redirect(struct sk_buff *skb, struct net_device *dev,
 			  u32 flags)
 {
+	/* On transmit, decrypted asks the device to encrypt the packet. Sent
+	 * to ingress, the packet would read as decrypted by the device.
+	 */
+	if (unlikely((flags & BPF_F_INGRESS) && !skb_at_tc_ingress(skb) &&
+		     skb_is_decrypted(skb))) {
+		kfree_skb(skb);
+		return -EINVAL;
+	}
+
 	if (dev_is_mac_header_xmit(dev))
 		return __bpf_redirect_common(skb, dev, flags);
 	else
-- 
2.53.0-Meta