1 /* $OpenBSD: pf_syncookies.c,v 1.7 2018/09/10 15:54:28 henning Exp $ */
2
3 /* Copyright (c) 2016,2017 Henning Brauer <henning@openbsd.org>
4 * Copyright (c) 2016 Alexandr Nedvedicky <sashan@openbsd.org>
5 *
6 * syncookie parts based on FreeBSD sys/netinet/tcp_syncache.c
7 *
8 * Copyright (c) 2001 McAfee, Inc.
9 * Copyright (c) 2006,2013 Andre Oppermann, Internet Business Solutions AG
10 * All rights reserved.
11 *
12 * This software was developed for the FreeBSD Project by Jonathan Lemon
13 * and McAfee Research, the Security Research Division of McAfee, Inc. under
14 * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
15 * DARPA CHATS research program. [2001 McAfee, Inc.]
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions
19 * are met:
20 * 1. Redistributions of source code must retain the above copyright
21 * notice, this list of conditions and the following disclaimer.
22 * 2. Redistributions in binary form must reproduce the above copyright
23 * notice, this list of conditions and the following disclaimer in the
24 * documentation and/or other materials provided with the distribution.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 * SUCH DAMAGE.
37 */
38
39 /*
40 * when we're under synflood, we use syncookies to prevent state table
41 * exhaustion. Trigger for the synflood mode is the number of half-open
42 * connections in the state table.
43 * We leave synflood mode when the number of half-open states - including
44 * in-flight syncookies - drops far enough again
45 */
46
47 /*
48 * syncookie enabled Initial Sequence Number:
49 * 24 bit MAC
50 * 3 bit WSCALE index
51 * 3 bit MSS index
52 * 1 bit SACK permitted
53 * 1 bit odd/even secret
54 *
55 * References:
56 * RFC4987 TCP SYN Flooding Attacks and Common Mitigations
57 * http://cr.yp.to/syncookies.html (overview)
58 * http://cr.yp.to/syncookies/archive (details)
59 */
60
61 //#include "pflog.h"
62
63 #include "opt_inet.h"
64 #include "opt_inet6.h"
65
66 #include <sys/param.h>
67 #include <sys/systm.h>
68 #include <sys/mbuf.h>
69 #include <sys/filio.h>
70 #include <sys/socket.h>
71 #include <sys/socketvar.h>
72 #include <sys/kernel.h>
73 #include <sys/time.h>
74 #include <sys/proc.h>
75 #include <sys/rwlock.h>
76 #include <sys/syslog.h>
77
78 #include <crypto/siphash/siphash.h>
79
80 #include <net/if.h>
81 #include <net/if_var.h>
82 #include <net/if_types.h>
83 #include <net/route.h>
84
85 #include <netinet/in.h>
86 #include <netinet/in_var.h>
87 #include <netinet/in_pcb.h>
88 #include <netinet/ip.h>
89 #include <netinet/ip_var.h>
90 #include <netinet/tcp.h>
91 #include <netinet/tcp_var.h>
92
93 #include <netinet/ip6.h>
94 #include <netinet6/ip6_var.h>
95
96 #include <net/pfvar.h>
97 #include <netpfil/pf/pf_nv.h>
98
99 union pf_syncookie {
100 uint8_t cookie;
101 struct {
102 uint8_t oddeven:1,
103 sack_ok:1,
104 wscale_idx:3,
105 mss_idx:3;
106 } flags;
107 };
108
109 #define PF_SYNCOOKIE_SECRET_SIZE SIPHASH_KEY_LENGTH
110 #define PF_SYNCOOKIE_SECRET_LIFETIME 15 /* seconds */
111
112 /* Protected by PF_RULES_xLOCK. */
113 struct pf_syncookie_status {
114 struct callout keytimeout;
115 uint8_t oddeven;
116 uint8_t key[2][SIPHASH_KEY_LENGTH];
117 uint32_t hiwat; /* absolute; # of states */
118 uint32_t lowat;
119 };
120 VNET_DEFINE_STATIC(struct pf_syncookie_status, pf_syncookie_status);
121 #define V_pf_syncookie_status VNET(pf_syncookie_status)
122
123 static int pf_syncookies_setmode(u_int8_t);
124 void pf_syncookie_rotate(void *);
125 void pf_syncookie_newkey(void);
126 uint32_t pf_syncookie_mac(struct pf_pdesc *, union pf_syncookie,
127 uint32_t);
128 uint32_t pf_syncookie_generate(struct pf_pdesc *, uint16_t);
129
130 void
pf_syncookies_init(void)131 pf_syncookies_init(void)
132 {
133 callout_init(&V_pf_syncookie_status.keytimeout, 1);
134 PF_RULES_WLOCK();
135
136 V_pf_syncookie_status.hiwat = PF_SYNCOOKIES_HIWATPCT *
137 V_pf_limits[PF_LIMIT_STATES].limit / 100;
138 V_pf_syncookie_status.lowat = PF_SYNCOOKIES_LOWATPCT *
139 V_pf_limits[PF_LIMIT_STATES].limit / 100;
140 pf_syncookies_setmode(PF_SYNCOOKIES_ADAPTIVE);
141
142 PF_RULES_WUNLOCK();
143 }
144
145 void
pf_syncookies_cleanup(void)146 pf_syncookies_cleanup(void)
147 {
148 callout_stop(&V_pf_syncookie_status.keytimeout);
149 }
150
151 int
pf_get_syncookies(struct pfioc_nv * nv)152 pf_get_syncookies(struct pfioc_nv *nv)
153 {
154 nvlist_t *nvl = NULL;
155 void *nvlpacked = NULL;
156 int error;
157
158 #define ERROUT(x) ERROUT_FUNCTION(errout, x)
159
160 nvl = nvlist_create(0);
161 if (nvl == NULL)
162 ERROUT(ENOMEM);
163
164 nvlist_add_bool(nvl, "enabled",
165 V_pf_status.syncookies_mode != PF_SYNCOOKIES_NEVER);
166 nvlist_add_bool(nvl, "adaptive",
167 V_pf_status.syncookies_mode == PF_SYNCOOKIES_ADAPTIVE);
168 nvlist_add_number(nvl, "highwater", V_pf_syncookie_status.hiwat);
169 nvlist_add_number(nvl, "lowwater", V_pf_syncookie_status.lowat);
170 nvlist_add_number(nvl, "halfopen_states",
171 atomic_load_32(&V_pf_status.states_halfopen));
172
173 nvlpacked = nvlist_pack(nvl, &nv->len);
174 if (nvlpacked == NULL)
175 ERROUT(ENOMEM);
176
177 if (nv->size == 0) {
178 ERROUT(0);
179 } else if (nv->size < nv->len) {
180 ERROUT(ENOSPC);
181 }
182
183 error = copyout(nvlpacked, nv->data, nv->len);
184
185 #undef ERROUT
186 errout:
187 nvlist_destroy(nvl);
188 free(nvlpacked, M_NVLIST);
189
190 return (error);
191 }
192
193 int
pf_set_syncookies(struct pfioc_nv * nv)194 pf_set_syncookies(struct pfioc_nv *nv)
195 {
196 nvlist_t *nvl = NULL;
197 void *nvlpacked = NULL;
198 int error;
199 bool enabled, adaptive;
200 uint32_t hiwat, lowat;
201 uint8_t newmode;
202
203 #define ERROUT(x) ERROUT_FUNCTION(errout, x)
204
205 if (nv->len > pf_ioctl_maxcount)
206 return (ENOMEM);
207
208 nvlpacked = malloc(nv->len, M_NVLIST, M_WAITOK);
209 error = copyin(nv->data, nvlpacked, nv->len);
210 if (error)
211 ERROUT(error);
212
213 nvl = nvlist_unpack(nvlpacked, nv->len, 0);
214 if (nvl == NULL)
215 ERROUT(EBADMSG);
216
217 if (! nvlist_exists_bool(nvl, "enabled")
218 || ! nvlist_exists_bool(nvl, "adaptive"))
219 ERROUT(EBADMSG);
220
221 enabled = nvlist_get_bool(nvl, "enabled");
222 adaptive = nvlist_get_bool(nvl, "adaptive");
223 PFNV_CHK(pf_nvuint32_opt(nvl, "highwater", &hiwat,
224 V_pf_syncookie_status.hiwat));
225 PFNV_CHK(pf_nvuint32_opt(nvl, "lowwater", &lowat,
226 V_pf_syncookie_status.lowat));
227
228 if (lowat >= hiwat)
229 ERROUT(EINVAL);
230
231 newmode = PF_SYNCOOKIES_NEVER;
232 if (enabled)
233 newmode = adaptive ? PF_SYNCOOKIES_ADAPTIVE : PF_SYNCOOKIES_ALWAYS;
234
235 PF_RULES_WLOCK();
236 error = pf_syncookies_setmode(newmode);
237
238 V_pf_syncookie_status.lowat = lowat;
239 V_pf_syncookie_status.hiwat = hiwat;
240
241 PF_RULES_WUNLOCK();
242
243 #undef ERROUT
244 errout:
245 nvlist_destroy(nvl);
246 free(nvlpacked, M_NVLIST);
247
248 return (error);
249 }
250
251 static int
pf_syncookies_setmode(u_int8_t mode)252 pf_syncookies_setmode(u_int8_t mode)
253 {
254 if (mode > PF_SYNCOOKIES_MODE_MAX)
255 return (EINVAL);
256
257 if (V_pf_status.syncookies_mode == mode)
258 return (0);
259
260 V_pf_status.syncookies_mode = mode;
261 if (V_pf_status.syncookies_mode == PF_SYNCOOKIES_ALWAYS) {
262 pf_syncookie_newkey();
263 V_pf_status.syncookies_active = true;
264 }
265 return (0);
266 }
267
268 int
pf_synflood_check(struct pf_pdesc * pd)269 pf_synflood_check(struct pf_pdesc *pd)
270 {
271 MPASS(pd->proto == IPPROTO_TCP);
272 PF_RULES_RASSERT();
273
274 if (pd->pf_mtag && (pd->pf_mtag->flags & PF_MTAG_FLAG_SYNCOOKIE_RECREATED))
275 return (0);
276
277 if (V_pf_status.syncookies_mode != PF_SYNCOOKIES_ADAPTIVE)
278 return (V_pf_status.syncookies_mode);
279
280 if (!V_pf_status.syncookies_active &&
281 atomic_load_32(&V_pf_status.states_halfopen) >
282 V_pf_syncookie_status.hiwat) {
283 /* We'd want to 'pf_syncookie_newkey()' here, but that requires
284 * the rules write lock, which we can't get with the read lock
285 * held. */
286 callout_reset(&V_pf_syncookie_status.keytimeout, 0,
287 pf_syncookie_rotate, curvnet);
288 V_pf_status.syncookies_active = true;
289 DPFPRINTF(LOG_WARNING,
290 "synflood detected, enabling syncookies");
291 // XXXTODO V_pf_status.lcounters[LCNT_SYNFLOODS]++;
292 }
293
294 return (V_pf_status.syncookies_active);
295 }
296
297 void
pf_syncookie_send(struct pf_pdesc * pd,u_short * reason)298 pf_syncookie_send(struct pf_pdesc *pd, u_short *reason)
299 {
300 uint16_t mss;
301 uint32_t iss;
302 struct mbuf *m;
303
304 mss = max(V_tcp_mssdflt, pf_get_mss(pd));
305 iss = pf_syncookie_generate(pd, mss);
306
307 m = pf_build_tcp(NULL, pd->af, pd->dst, pd->src, *pd->dport, *pd->sport,
308 iss, ntohl(pd->hdr.tcp.th_seq) + 1, TH_SYN | TH_ACK, 0, mss, 0,
309 M_SKIP_FIREWALL | (pd->m->m_flags & M_LOOP), 0, 0, 0,
310 pd->act.rtableid, reason);
311 if (m == NULL)
312 return;
313 switch (pd->af) {
314 #ifdef INET
315 case AF_INET:
316 pf_send_ip_direct(m);
317 break;
318 #endif /* INET */
319 #ifdef INET6
320 case AF_INET6:
321 pf_send_ip6_direct(m);
322 break;
323 #endif /* INET6 */
324 default:
325 unhandled_af(pd->af);
326 }
327 counter_u64_add(V_pf_status.lcounters[KLCNT_SYNCOOKIES_SENT], 1);
328 /* XXX Maybe only in adaptive mode? */
329 atomic_add_64(&V_pf_status.syncookies_inflight[V_pf_syncookie_status.oddeven],
330 1);
331 }
332
333 bool
pf_syncookie_check(struct pf_pdesc * pd)334 pf_syncookie_check(struct pf_pdesc *pd)
335 {
336 uint32_t hash, ack, seq;
337 union pf_syncookie cookie;
338
339 MPASS(pd->proto == IPPROTO_TCP);
340 PF_RULES_RASSERT();
341
342 seq = ntohl(pd->hdr.tcp.th_seq) - 1;
343 ack = ntohl(pd->hdr.tcp.th_ack) - 1;
344 cookie.cookie = (ack & 0xff) ^ (ack >> 24);
345
346 /* we don't know oddeven before setting the cookie (union) */
347 if (atomic_load_64(&V_pf_status.syncookies_inflight[cookie.flags.oddeven])
348 == 0)
349 return (0);
350
351 hash = pf_syncookie_mac(pd, cookie, seq);
352 if ((ack & ~0xff) != (hash & ~0xff))
353 return (false);
354
355 return (true);
356 }
357
358 uint8_t
pf_syncookie_validate(struct pf_pdesc * pd)359 pf_syncookie_validate(struct pf_pdesc *pd)
360 {
361 uint32_t ack;
362 union pf_syncookie cookie;
363
364 if (! pf_syncookie_check(pd))
365 return (0);
366
367 ack = ntohl(pd->hdr.tcp.th_ack) - 1;
368 cookie.cookie = (ack & 0xff) ^ (ack >> 24);
369
370 counter_u64_add(V_pf_status.lcounters[KLCNT_SYNCOOKIES_VALID], 1);
371 atomic_add_64(&V_pf_status.syncookies_inflight[cookie.flags.oddeven], -1);
372
373 return (1);
374 }
375
376 /*
377 * all following functions private
378 */
379 void
pf_syncookie_rotate(void * arg)380 pf_syncookie_rotate(void *arg)
381 {
382 CURVNET_SET((struct vnet *)arg);
383
384 /* do we want to disable syncookies? */
385 if (V_pf_status.syncookies_active &&
386 ((V_pf_status.syncookies_mode == PF_SYNCOOKIES_ADAPTIVE &&
387 (atomic_load_32(&V_pf_status.states_halfopen) +
388 atomic_load_64(&V_pf_status.syncookies_inflight[0]) +
389 atomic_load_64(&V_pf_status.syncookies_inflight[1])) <
390 V_pf_syncookie_status.lowat) ||
391 V_pf_status.syncookies_mode == PF_SYNCOOKIES_NEVER)
392 ) {
393 V_pf_status.syncookies_active = false;
394 DPFPRINTF(PF_DEBUG_MISC, "syncookies disabled");
395 }
396
397 /* nothing in flight any more? delete keys and return */
398 if (!V_pf_status.syncookies_active &&
399 atomic_load_64(&V_pf_status.syncookies_inflight[0]) == 0 &&
400 atomic_load_64(&V_pf_status.syncookies_inflight[1]) == 0) {
401 memset(V_pf_syncookie_status.key[0], 0,
402 PF_SYNCOOKIE_SECRET_SIZE);
403 memset(V_pf_syncookie_status.key[1], 0,
404 PF_SYNCOOKIE_SECRET_SIZE);
405 CURVNET_RESTORE();
406 return;
407 }
408
409 PF_RULES_WLOCK();
410 /* new key, including timeout */
411 pf_syncookie_newkey();
412 PF_RULES_WUNLOCK();
413
414 CURVNET_RESTORE();
415 }
416
417 void
pf_syncookie_newkey(void)418 pf_syncookie_newkey(void)
419 {
420 PF_RULES_WASSERT();
421
422 MPASS(V_pf_syncookie_status.oddeven < 2);
423 V_pf_syncookie_status.oddeven = (V_pf_syncookie_status.oddeven + 1) & 0x1;
424 atomic_store_64(&V_pf_status.syncookies_inflight[V_pf_syncookie_status.oddeven], 0);
425 arc4random_buf(V_pf_syncookie_status.key[V_pf_syncookie_status.oddeven],
426 PF_SYNCOOKIE_SECRET_SIZE);
427 callout_reset(&V_pf_syncookie_status.keytimeout,
428 PF_SYNCOOKIE_SECRET_LIFETIME * hz, pf_syncookie_rotate, curvnet);
429 }
430
431 /*
432 * Distribution and probability of certain MSS values. Those in between are
433 * rounded down to the next lower one.
434 * [An Analysis of TCP Maximum Segment Sizes, S. Alcock and R. Nelson, 2011]
435 * .2% .3% 5% 7% 7% 20% 15% 45%
436 */
437 static int pf_syncookie_msstab[] =
438 { 216, 536, 1200, 1360, 1400, 1440, 1452, 1460 };
439
440 /*
441 * Distribution and probability of certain WSCALE values.
442 * The absence of the WSCALE option is encoded with index zero.
443 * [WSCALE values histograms, Allman, 2012]
444 * X 10 10 35 5 6 14 10% by host
445 * X 11 4 5 5 18 49 3% by connections
446 */
447 static int pf_syncookie_wstab[] = { 0, 0, 1, 2, 4, 6, 7, 8 };
448
449 uint32_t
pf_syncookie_mac(struct pf_pdesc * pd,union pf_syncookie cookie,uint32_t seq)450 pf_syncookie_mac(struct pf_pdesc *pd, union pf_syncookie cookie, uint32_t seq)
451 {
452 SIPHASH_CTX ctx;
453 uint32_t siphash[2];
454
455 PF_RULES_RASSERT();
456 MPASS(pd->proto == IPPROTO_TCP);
457
458 SipHash24_Init(&ctx);
459 SipHash_SetKey(&ctx, V_pf_syncookie_status.key[cookie.flags.oddeven]);
460
461 switch (pd->af) {
462 case AF_INET:
463 SipHash_Update(&ctx, pd->src, sizeof(pd->src->v4));
464 SipHash_Update(&ctx, pd->dst, sizeof(pd->dst->v4));
465 break;
466 case AF_INET6:
467 SipHash_Update(&ctx, pd->src, sizeof(pd->src->v6));
468 SipHash_Update(&ctx, pd->dst, sizeof(pd->dst->v6));
469 break;
470 default:
471 panic("unknown address family");
472 }
473
474 SipHash_Update(&ctx, pd->sport, sizeof(*pd->sport));
475 SipHash_Update(&ctx, pd->dport, sizeof(*pd->dport));
476 SipHash_Update(&ctx, &seq, sizeof(seq));
477 SipHash_Update(&ctx, &cookie, sizeof(cookie));
478 SipHash_Final((uint8_t *)&siphash, &ctx);
479
480 return (siphash[0] ^ siphash[1]);
481 }
482
483 uint32_t
pf_syncookie_generate(struct pf_pdesc * pd,uint16_t mss)484 pf_syncookie_generate(struct pf_pdesc *pd, uint16_t mss)
485 {
486 uint8_t i, wscale;
487 uint32_t iss, hash;
488 union pf_syncookie cookie;
489
490 PF_RULES_RASSERT();
491
492 cookie.cookie = 0;
493
494 /* map MSS */
495 for (i = nitems(pf_syncookie_msstab) - 1;
496 pf_syncookie_msstab[i] > mss && i > 0; i--)
497 /* nada */;
498 cookie.flags.mss_idx = i;
499
500 /* map WSCALE */
501 wscale = pf_get_wscale(pd);
502 for (i = nitems(pf_syncookie_wstab) - 1;
503 pf_syncookie_wstab[i] > wscale && i > 0; i--)
504 /* nada */;
505 cookie.flags.wscale_idx = i;
506 cookie.flags.sack_ok = 0; /* XXX */
507
508 cookie.flags.oddeven = V_pf_syncookie_status.oddeven;
509 hash = pf_syncookie_mac(pd, cookie, ntohl(pd->hdr.tcp.th_seq));
510
511 /*
512 * Put the flags into the hash and XOR them to get better ISS number
513 * variance. This doesn't enhance the cryptographic strength and is
514 * done to prevent the 8 cookie bits from showing up directly on the
515 * wire.
516 */
517 iss = hash & ~0xff;
518 iss |= cookie.cookie ^ (hash >> 24);
519
520 return (iss);
521 }
522
523 struct mbuf *
pf_syncookie_recreate_syn(struct pf_pdesc * pd,u_short * reason)524 pf_syncookie_recreate_syn(struct pf_pdesc *pd, u_short *reason)
525 {
526 uint8_t wscale;
527 uint16_t mss;
528 uint32_t ack, seq;
529 union pf_syncookie cookie;
530
531 seq = ntohl(pd->hdr.tcp.th_seq) - 1;
532 ack = ntohl(pd->hdr.tcp.th_ack) - 1;
533 cookie.cookie = (ack & 0xff) ^ (ack >> 24);
534
535 if (cookie.flags.mss_idx >= nitems(pf_syncookie_msstab) ||
536 cookie.flags.wscale_idx >= nitems(pf_syncookie_wstab))
537 return (NULL);
538
539 mss = pf_syncookie_msstab[cookie.flags.mss_idx];
540 wscale = pf_syncookie_wstab[cookie.flags.wscale_idx];
541
542 return (pf_build_tcp(NULL, pd->af, pd->src, pd->dst, *pd->sport,
543 *pd->dport, seq, 0, TH_SYN, wscale, mss, pd->ttl,
544 (pd->m->m_flags & M_LOOP), 0, PF_MTAG_FLAG_SYNCOOKIE_RECREATED,
545 cookie.flags.sack_ok, pd->act.rtableid, reason));
546 }
547