imds: turn off IPv4 reverse path filtering on IMDS links in locked mode

With `systemd.imds.network=locked`, imdsd cannot reach IMDS at all. Our
sysctl.d/50-default.conf enables IPv4 reverse path filtering for all
links. Locked mode adds a "prohibit" route for the IMDS address to the
main table. imdsd's marked sockets use their own table, so its
_requests_ get out. But IMDS's _replies_ carry no mark: the reverse path
filter checks their source against the main table, finds the prohibit
route, and drops them.

To fix this, turn off reverse path filtering on the configured links in
locked mode. The prohibit route still blocks direct access for everybody
else.

Caveat: This does not help where `net.ipv4.conf.all.rp_filter` is on, as
the kernel applies the maximum of that and the link's setting. Ubuntu
does that by default, so for now this only works out of the box on
Debian, Fedora, etc. Cover that case in the tests, and expect a
timeout/failure with `all.rp_filter > 0`.

Fixes #44602

Signed-off-by: Martin Pitt <martin@amutable.com>
(cherry picked from commit 9d7ae503d9)
(cherry picked from commit 69d45358bf)

man/systemd-imdsd@.service.xml

@@ -71,7 +71,10 @@
           access. Unless set to <literal>off</literal> early boot networking is enabled, ensuring that the
           IMDS endpoint can be reached. If set to <literal>locked</literal> direct access to
           the IMDS endpoint by regular unprivileged processes is disabled via a "prohibit" route, so that any
-          access must be done through <filename>systemd-imdsd@.service</filename> or its associated tools. If
+          access must be done through <filename>systemd-imdsd@.service</filename> or its associated tools.
+          This also turns off IPv4 reverse path filtering on all Ethernet links that the early boot networking
+          configures (see <varname>IPv4ReversePathFilter=</varname> in
+          <citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>). If
           set to <literal>unlocked</literal> (the default) this "prohibit" route is not created, and regular unprivileged
           processes can directly contact IMDS.</para>
 

src/imds/imdsd.c

@@ -1679,8 +1679,16 @@ static int setup_network(void) {
               "\n"
               "[Network]\n"
               "DHCP=yes\n"
-              "LinkLocalAddressing=ipv6\n"
-              "\n"
+              "LinkLocalAddressing=ipv6\n", f);
+
+        /* IMDS's replies to imdsd carry no firewall mark. Reverse path filtering would check their source
+         * address against the main table, find the prohibit route below, and drop them. IPv6 has no
+         * reverse path filter. */
+        if (arg_network_mode != IMDS_NETWORK_UNLOCKED && in4_addr_is_set(&arg_address_ipv4))
+                fputs("# Reverse path filtering would drop IMDS's replies due to the prohibit route\n"
+                      "IPv4ReversePathFilter=no\n", f);
+
+        fputs("\n"
               "[DHCP]\n"
               "UseTimezone=yes\n"
               "UseHostname=yes\n"

test/units/TEST-74-AUX-UTILS.imds.sh

@@ -15,6 +15,10 @@ fi
 at_exit() {
     set +e
     systemctl stop fake-imds systemd-imdsd.socket
+    # Unmanage the link before removing it, so that networkd also removes its prohibit route and rule
+    rm -rf /run/systemd/network/85-imds-early.network /run/systemd/network/85-imds-early.network.d \
+           /run/systemd/resolve/static.d/imds-endpoint.rr
+    networkctl reload
     ip link del veth-imds
     ip netns del imds
     rm -f /run/credstore/firstboot.hostname /run/credstore/acredtest /run/systemd/system/systemd-imdsd@.service.d/50-env.conf /run/fake-imds-flaky
@@ -156,3 +160,62 @@ systemctl daemon-reload
 (! /usr/lib/systemd/systemd-imds --import 2>"$WORK_DIR/import.err")
 cat "$WORK_DIR/import.err"
 grep -F "Failed to parse IP address 'piff'" "$WORK_DIR/import.err" >/dev/null
+
+# Lock down IMDS access to imdsd (systemd.imds.network=locked), with the networking which
+# "systemd-imdsd --setup-network" generates and networkd applies. This needs IMDS at its usual link-local
+# address, as the prohibit route covers only that.
+ip -n imds addr add 169.254.169.254/32 dev veth-imds-peer
+IMDSD_LOCKED=("${IMDSD[@]}" --data-url=http://169.254.169.254:8088 --address-ipv4=169.254.169.254)
+
+# Unlocked mode has no prohibit route, and keeps reverse path filtering
+SYSTEMD_PROC_CMDLINE=systemd.imds.network=unlocked "${IMDSD[@]}" --address-ipv4=169.254.169.254 --setup-network
+cat /run/systemd/network/85-imds-early.network
+(! grep -F -e "Type=prohibit" -e "IPv4ReversePathFilter=" /run/systemd/network/85-imds-early.network >/dev/null)
+
+SYSTEMD_PROC_CMDLINE=systemd.imds.network=locked "${IMDSD_LOCKED[@]}" --setup-network
+cat /run/systemd/network/85-imds-early.network
+grep -Fx "Type=prohibit" /run/systemd/network/85-imds-early.network >/dev/null
+grep -Fx "IPv4ReversePathFilter=no" /run/systemd/network/85-imds-early.network >/dev/null
+
+# The generated .network matches physical Ethernet links only, and asks for DHCP. Apply it to the veth
+# instead, with its static address.
+mkdir -p /run/systemd/network/85-imds-early.network.d
+cat >/run/systemd/network/85-imds-early.network.d/50-test.conf <<EOF
+[Match]
+Kind=
+Name=veth-imds
+
+[Network]
+DHCP=no
+Address=192.168.47.11/24
+EOF
+
+systemctl start systemd-networkd
+networkctl reload
+/usr/lib/systemd/systemd-networkd-wait-online --interface=veth-imds --timeout=30
+networkctl status veth-imds
+ip route show table all
+ip rule show
+sysctl net.ipv4.conf.all.rp_filter net.ipv4.conf.veth-imds.rp_filter
+assert_eq "$(sysctl -n net.ipv4.conf.veth-imds.rp_filter)" 0
+
+# imdsd marks its sockets, which routes them around the prohibit route. IMDS's replies carry no mark, so
+# this also needs reverse path filtering off, which the generated .network does on the link. But the kernel
+# applies the maximum of that and net.ipv4.conf.all.rp_filter, which some distributions turn on (e.g.
+# Ubuntu). Then the reverse path filter still drops the replies.
+if [[ "$(sysctl -n net.ipv4.conf.all.rp_filter)" == 0 ]]; then
+    assert_eq "$("${IMDSD_LOCKED[@]}" --interface=veth-imds /hostname)" "piff"
+else
+    echo "WARNING: net.ipv4.conf.all.rp_filter is on, imdsd cannot reach IMDS in locked mode"
+    # Do not wait for imdsd's overall 40s timeout (too annoying); instead, check that reverse path
+    # filtering drops the replies
+    rp_filter_drops() { nstat -asz TcpExtIPReversePathFilter | awk '/IPReversePathFilter/ { print $2 }'; }
+    DROPS="$(rp_filter_drops)"
+    assert_rc 124 timeout 5 "${IMDSD_LOCKED[@]}" --interface=veth-imds /hostname
+    (( "$(rp_filter_drops)" > DROPS ))
+fi
+
+# Everybody else gets blocked
+(! bash -c 'echo >/dev/tcp/169.254.169.254/8088' 2>"$WORK_DIR/connect.err")
+cat "$WORK_DIR/connect.err"
+grep -F "Permission denied" "$WORK_DIR/connect.err" >/dev/null