1 /* $OpenBSD: pf_syncookies.c,v 1.7 2018/09/10 15:54:28 henning Exp $ */ 2 3 /* Copyright (c) 2016,2017 Henning Brauer <henning@openbsd.org> 4 * Copyright (c) 2016 Alexandr Nedvedicky <sashan@openbsd.org> 5 * 6 * syncookie parts based on FreeBSD sys/netinet/tcp_syncache.c 7 * 8 * Copyright (c) 2001 McAfee, Inc. 9 * Copyright (c) 2006,2013 Andre Oppermann, Internet Business Solutions AG 10 * All rights reserved. 11 * 12 * This software was developed for the FreeBSD Project by Jonathan Lemon 13 * and McAfee Research, the Security Research Division of McAfee, Inc. under 14 * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the 15 * DARPA CHATS research program. [2001 McAfee, Inc.] 16 * 17 * Redistribution and use in source and binary forms, with or without 18 * modification, are permitted provided that the following conditions 19 * are met: 20 * 1. Redistributions of source code must retain the above copyright 21 * notice, this list of conditions and the following disclaimer. 22 * 2. Redistributions in binary form must reproduce the above copyright 23 * notice, this list of conditions and the following disclaimer in the 24 * documentation and/or other materials provided with the distribution. 25 * 26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 29 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36 * SUCH DAMAGE. 37 */ 38 39 /* 40 * when we're under synflood, we use syncookies to prevent state table 41 * exhaustion. Trigger for the synflood mode is the number of half-open 42 * connections in the state table. 43 * We leave synflood mode when the number of half-open states - including 44 * in-flight syncookies - drops far enough again 45 */ 46 47 /* 48 * syncookie enabled Initial Sequence Number: 49 * 24 bit MAC 50 * 3 bit WSCALE index 51 * 3 bit MSS index 52 * 1 bit SACK permitted 53 * 1 bit odd/even secret 54 * 55 * References: 56 * RFC4987 TCP SYN Flooding Attacks and Common Mitigations 57 * http://cr.yp.to/syncookies.html (overview) 58 * http://cr.yp.to/syncookies/archive (details) 59 */ 60 61 //#include "pflog.h" 62 63 #include <sys/param.h> 64 #include <sys/systm.h> 65 #include <sys/mbuf.h> 66 #include <sys/filio.h> 67 #include <sys/socket.h> 68 #include <sys/socketvar.h> 69 #include <sys/kernel.h> 70 #include <sys/time.h> 71 #include <sys/proc.h> 72 #include <sys/rwlock.h> 73 #include <sys/syslog.h> 74 75 #include <crypto/siphash/siphash.h> 76 77 #include <net/if.h> 78 #include <net/if_var.h> 79 #include <net/if_types.h> 80 #include <net/route.h> 81 82 #include <netinet/in.h> 83 #include <netinet/ip.h> 84 #include <netinet/tcp.h> 85 #include <netinet/tcp_var.h> 86 87 #include <net/pfvar.h> 88 89 #define DPFPRINTF(n, x) if (V_pf_status.debug >= (n)) printf x 90 91 union pf_syncookie { 92 uint8_t cookie; 93 struct { 94 uint8_t oddeven:1, 95 sack_ok:1, 96 wscale_idx:3, 97 mss_idx:3; 98 } flags; 99 }; 100 101 #define PF_SYNCOOKIE_SECRET_SIZE SIPHASH_KEY_LENGTH 102 #define PF_SYNCOOKIE_SECRET_LIFETIME 15 /* seconds */ 103 104 /* Protected by PF_RULES_xLOCK. */ 105 struct pf_syncookie_status { 106 struct callout keytimeout; 107 uint8_t oddeven; 108 uint8_t key[2][SIPHASH_KEY_LENGTH]; 109 }; 110 VNET_DEFINE_STATIC(struct pf_syncookie_status, pf_syncookie_status); 111 #define V_pf_syncookie_status VNET(pf_syncookie_status) 112 113 static int pf_syncookies_setmode(u_int8_t); 114 void pf_syncookie_rotate(void *); 115 void pf_syncookie_newkey(void); 116 uint32_t pf_syncookie_mac(struct pf_pdesc *, union pf_syncookie, 117 uint32_t); 118 uint32_t pf_syncookie_generate(struct mbuf *m, int off, struct pf_pdesc *, 119 uint16_t); 120 121 void 122 pf_syncookies_init(void) 123 { 124 callout_init(&V_pf_syncookie_status.keytimeout, 1); 125 PF_RULES_WLOCK(); 126 pf_syncookies_setmode(PF_SYNCOOKIES_NEVER); 127 PF_RULES_WUNLOCK(); 128 } 129 130 void 131 pf_syncookies_cleanup(void) 132 { 133 callout_stop(&V_pf_syncookie_status.keytimeout); 134 } 135 136 int 137 pf_get_syncookies(struct pfioc_nv *nv) 138 { 139 nvlist_t *nvl = NULL; 140 void *nvlpacked = NULL; 141 142 nvl = nvlist_create(0); 143 if (nvl == NULL) 144 return (ENOMEM); 145 146 nvlist_add_bool(nvl, "enabled", 147 V_pf_status.syncookies_mode != PF_SYNCOOKIES_NEVER); 148 nvlist_add_bool(nvl, "adaptive", false); 149 150 nvlpacked = nvlist_pack(nvl, &nv->len); 151 if (nvlpacked == NULL) { 152 nvlist_destroy(nvl); 153 return (ENOMEM); 154 } 155 if (nv->size == 0) { 156 nvlist_destroy(nvl); 157 free(nvlpacked, M_TEMP); 158 return (0); 159 } else if (nv->size < nv->len) { 160 nvlist_destroy(nvl); 161 free(nvlpacked, M_TEMP); 162 return (ENOSPC); 163 } 164 165 return (copyout(nvlpacked, nv->data, nv->len)); 166 } 167 168 int 169 pf_set_syncookies(struct pfioc_nv *nv) 170 { 171 nvlist_t *nvl = NULL; 172 void *nvlpacked = NULL; 173 int error; 174 bool enabled, adaptive; 175 176 if (nv->len > pf_ioctl_maxcount) 177 return (ENOMEM); 178 179 nvlpacked = malloc(nv->len, M_TEMP, M_WAITOK); 180 if (nvlpacked == NULL) 181 return (ENOMEM); 182 183 error = copyin(nv->data, nvlpacked, nv->len); 184 if (error) { 185 free(nvlpacked, M_TEMP); 186 return (error); 187 } 188 189 nvl = nvlist_unpack(nvlpacked, nv->len, 0); 190 if (nvl == NULL) { 191 free(nvlpacked, M_TEMP); 192 return (EBADMSG); 193 } 194 195 if (! nvlist_exists_bool(nvl, "enabled") 196 || ! nvlist_exists_bool(nvl, "adaptive")) { 197 nvlist_destroy(nvl); 198 free(nvlpacked, M_TEMP); 199 return (EBADMSG); 200 } 201 202 enabled = nvlist_get_bool(nvl, "enabled"); 203 adaptive = nvlist_get_bool(nvl, "adaptive"); 204 205 if (adaptive) { 206 nvlist_destroy(nvl); 207 free(nvlpacked, M_TEMP); 208 return (ENOTSUP); 209 } 210 211 PF_RULES_WLOCK(); 212 error = pf_syncookies_setmode(enabled ? 213 PF_SYNCOOKIES_ALWAYS : PF_SYNCOOKIES_NEVER); 214 PF_RULES_WUNLOCK(); 215 216 return (error); 217 } 218 219 static int 220 pf_syncookies_setmode(u_int8_t mode) 221 { 222 if (mode > PF_SYNCOOKIES_MODE_MAX) 223 return (EINVAL); 224 225 if (V_pf_status.syncookies_mode == mode) 226 return (0); 227 228 V_pf_status.syncookies_mode = mode; 229 if (V_pf_status.syncookies_mode == PF_SYNCOOKIES_ALWAYS) { 230 pf_syncookie_newkey(); 231 V_pf_status.syncookies_active = true; 232 } 233 return (0); 234 } 235 236 int 237 pf_synflood_check(struct pf_pdesc *pd) 238 { 239 MPASS(pd->proto == IPPROTO_TCP); 240 PF_RULES_RASSERT(); 241 242 if (pd->pf_mtag && (pd->pf_mtag->tag & PF_TAG_SYNCOOKIE_RECREATED)) 243 return (0); 244 245 return (V_pf_status.syncookies_mode); 246 } 247 248 void 249 pf_syncookie_send(struct mbuf *m, int off, struct pf_pdesc *pd) 250 { 251 uint16_t mss; 252 uint32_t iss; 253 254 mss = max(V_tcp_mssdflt, pf_get_mss(m, off, pd->hdr.tcp.th_off, pd->af)); 255 iss = pf_syncookie_generate(m, off, pd, mss); 256 pf_send_tcp(NULL, pd->af, pd->dst, pd->src, *pd->dport, *pd->sport, 257 iss, ntohl(pd->hdr.tcp.th_seq) + 1, TH_SYN|TH_ACK, 0, mss, 258 0, 1, 0); 259 } 260 261 uint8_t 262 pf_syncookie_validate(struct pf_pdesc *pd) 263 { 264 uint32_t hash, ack, seq; 265 union pf_syncookie cookie; 266 267 MPASS(pd->proto == IPPROTO_TCP); 268 PF_RULES_RASSERT(); 269 270 seq = ntohl(pd->hdr.tcp.th_seq) - 1; 271 ack = ntohl(pd->hdr.tcp.th_ack) - 1; 272 cookie.cookie = (ack & 0xff) ^ (ack >> 24); 273 274 hash = pf_syncookie_mac(pd, cookie, seq); 275 if ((ack & ~0xff) != (hash & ~0xff)) 276 return (0); 277 278 return (1); 279 } 280 281 /* 282 * all following functions private 283 */ 284 void 285 pf_syncookie_rotate(void *arg) 286 { 287 CURVNET_SET((struct vnet *)arg); 288 289 /* do we want to disable syncookies? */ 290 if (V_pf_status.syncookies_active) { 291 V_pf_status.syncookies_active = false; 292 DPFPRINTF(PF_DEBUG_MISC, ("syncookies disabled")); 293 } 294 295 /* nothing in flight any more? delete keys and return */ 296 if (!V_pf_status.syncookies_active) { 297 memset(V_pf_syncookie_status.key[0], 0, 298 PF_SYNCOOKIE_SECRET_SIZE); 299 memset(V_pf_syncookie_status.key[1], 0, 300 PF_SYNCOOKIE_SECRET_SIZE); 301 CURVNET_RESTORE(); 302 return; 303 } 304 305 /* new key, including timeout */ 306 pf_syncookie_newkey(); 307 308 CURVNET_RESTORE(); 309 } 310 311 void 312 pf_syncookie_newkey(void) 313 { 314 PF_RULES_WASSERT(); 315 316 V_pf_syncookie_status.oddeven = (V_pf_syncookie_status.oddeven + 1) & 0x1; 317 arc4random_buf(V_pf_syncookie_status.key[V_pf_syncookie_status.oddeven], 318 PF_SYNCOOKIE_SECRET_SIZE); 319 callout_reset(&V_pf_syncookie_status.keytimeout, 320 PF_SYNCOOKIE_SECRET_LIFETIME, pf_syncookie_rotate, curvnet); 321 } 322 323 /* 324 * Distribution and probability of certain MSS values. Those in between are 325 * rounded down to the next lower one. 326 * [An Analysis of TCP Maximum Segment Sizes, S. Alcock and R. Nelson, 2011] 327 * .2% .3% 5% 7% 7% 20% 15% 45% 328 */ 329 static int pf_syncookie_msstab[] = 330 { 216, 536, 1200, 1360, 1400, 1440, 1452, 1460 }; 331 332 /* 333 * Distribution and probability of certain WSCALE values. 334 * The absence of the WSCALE option is encoded with index zero. 335 * [WSCALE values histograms, Allman, 2012] 336 * X 10 10 35 5 6 14 10% by host 337 * X 11 4 5 5 18 49 3% by connections 338 */ 339 static int pf_syncookie_wstab[] = { 0, 0, 1, 2, 4, 6, 7, 8 }; 340 341 uint32_t 342 pf_syncookie_mac(struct pf_pdesc *pd, union pf_syncookie cookie, uint32_t seq) 343 { 344 SIPHASH_CTX ctx; 345 uint32_t siphash[2]; 346 347 PF_RULES_RASSERT(); 348 MPASS(pd->proto == IPPROTO_TCP); 349 350 SipHash24_Init(&ctx); 351 SipHash_SetKey(&ctx, V_pf_syncookie_status.key[cookie.flags.oddeven]); 352 353 switch (pd->af) { 354 case AF_INET: 355 SipHash_Update(&ctx, pd->src, sizeof(pd->src->v4)); 356 SipHash_Update(&ctx, pd->dst, sizeof(pd->dst->v4)); 357 break; 358 case AF_INET6: 359 SipHash_Update(&ctx, pd->src, sizeof(pd->src->v6)); 360 SipHash_Update(&ctx, pd->dst, sizeof(pd->dst->v6)); 361 break; 362 default: 363 panic("unknown address family"); 364 } 365 366 SipHash_Update(&ctx, pd->sport, sizeof(*pd->sport)); 367 SipHash_Update(&ctx, pd->dport, sizeof(*pd->dport)); 368 SipHash_Update(&ctx, &seq, sizeof(seq)); 369 SipHash_Update(&ctx, &cookie, sizeof(cookie)); 370 SipHash_Final((uint8_t *)&siphash, &ctx); 371 372 return (siphash[0] ^ siphash[1]); 373 } 374 375 uint32_t 376 pf_syncookie_generate(struct mbuf *m, int off, struct pf_pdesc *pd, 377 uint16_t mss) 378 { 379 uint8_t i, wscale; 380 uint32_t iss, hash; 381 union pf_syncookie cookie; 382 383 PF_RULES_RASSERT(); 384 385 cookie.cookie = 0; 386 387 /* map MSS */ 388 for (i = nitems(pf_syncookie_msstab) - 1; 389 pf_syncookie_msstab[i] > mss && i > 0; i--) 390 /* nada */; 391 cookie.flags.mss_idx = i; 392 393 /* map WSCALE */ 394 wscale = pf_get_wscale(m, off, pd->hdr.tcp.th_off, pd->af); 395 for (i = nitems(pf_syncookie_wstab) - 1; 396 pf_syncookie_wstab[i] > wscale && i > 0; i--) 397 /* nada */; 398 cookie.flags.wscale_idx = i; 399 cookie.flags.sack_ok = 0; /* XXX */ 400 401 cookie.flags.oddeven = V_pf_syncookie_status.oddeven; 402 hash = pf_syncookie_mac(pd, cookie, ntohl(pd->hdr.tcp.th_seq)); 403 404 /* 405 * Put the flags into the hash and XOR them to get better ISS number 406 * variance. This doesn't enhance the cryptographic strength and is 407 * done to prevent the 8 cookie bits from showing up directly on the 408 * wire. 409 */ 410 iss = hash & ~0xff; 411 iss |= cookie.cookie ^ (hash >> 24); 412 413 return (iss); 414 } 415 416 struct mbuf * 417 pf_syncookie_recreate_syn(uint8_t ttl, int off, struct pf_pdesc *pd) 418 { 419 uint8_t wscale; 420 uint16_t mss; 421 uint32_t ack, seq; 422 union pf_syncookie cookie; 423 424 seq = ntohl(pd->hdr.tcp.th_seq) - 1; 425 ack = ntohl(pd->hdr.tcp.th_ack) - 1; 426 cookie.cookie = (ack & 0xff) ^ (ack >> 24); 427 428 if (cookie.flags.mss_idx >= nitems(pf_syncookie_msstab) || 429 cookie.flags.wscale_idx >= nitems(pf_syncookie_wstab)) 430 return (NULL); 431 432 mss = pf_syncookie_msstab[cookie.flags.mss_idx]; 433 wscale = pf_syncookie_wstab[cookie.flags.wscale_idx]; 434 435 return (pf_build_tcp(NULL, pd->af, pd->src, pd->dst, *pd->sport, 436 *pd->dport, seq, 0, TH_SYN, wscale, mss, ttl, 0, 437 PF_TAG_SYNCOOKIE_RECREATED)); 438 } 439