xref: /freebsd/sys/netpfil/pf/pf_syncookies.c (revision bc5304a006238115291e7568583632889dffbab9)
1 /*	$OpenBSD: pf_syncookies.c,v 1.7 2018/09/10 15:54:28 henning Exp $ */
2 
3 /* Copyright (c) 2016,2017 Henning Brauer <henning@openbsd.org>
4  * Copyright (c) 2016 Alexandr Nedvedicky <sashan@openbsd.org>
5  *
6  * syncookie parts based on FreeBSD sys/netinet/tcp_syncache.c
7  *
8  * Copyright (c) 2001 McAfee, Inc.
9  * Copyright (c) 2006,2013 Andre Oppermann, Internet Business Solutions AG
10  * All rights reserved.
11  *
12  * This software was developed for the FreeBSD Project by Jonathan Lemon
13  * and McAfee Research, the Security Research Division of McAfee, Inc. under
14  * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
15  * DARPA CHATS research program. [2001 McAfee, Inc.]
16  *
17  * Redistribution and use in source and binary forms, with or without
18  * modification, are permitted provided that the following conditions
19  * are met:
20  * 1. Redistributions of source code must retain the above copyright
21  *    notice, this list of conditions and the following disclaimer.
22  * 2. Redistributions in binary form must reproduce the above copyright
23  *    notice, this list of conditions and the following disclaimer in the
24  *    documentation and/or other materials provided with the distribution.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  */
38 
39 /*
40  * when we're under synflood, we use syncookies to prevent state table
41  * exhaustion. Trigger for the synflood mode is the number of half-open
42  * connections in the state table.
43  * We leave synflood mode when the number of half-open states - including
44  * in-flight syncookies - drops far enough again
45  */
46 
47 /*
48  * syncookie enabled Initial Sequence Number:
49  *  24 bit MAC
50  *   3 bit WSCALE index
51  *   3 bit MSS index
52  *   1 bit SACK permitted
53  *   1 bit odd/even secret
54  *
55  * References:
56  *  RFC4987 TCP SYN Flooding Attacks and Common Mitigations
57  *  http://cr.yp.to/syncookies.html    (overview)
58  *  http://cr.yp.to/syncookies/archive (details)
59  */
60 
61 //#include "pflog.h"
62 
63 #include <sys/param.h>
64 #include <sys/systm.h>
65 #include <sys/mbuf.h>
66 #include <sys/filio.h>
67 #include <sys/socket.h>
68 #include <sys/socketvar.h>
69 #include <sys/kernel.h>
70 #include <sys/time.h>
71 #include <sys/proc.h>
72 #include <sys/rwlock.h>
73 #include <sys/syslog.h>
74 
75 #include <crypto/siphash/siphash.h>
76 
77 #include <net/if.h>
78 #include <net/if_var.h>
79 #include <net/if_types.h>
80 #include <net/route.h>
81 
82 #include <netinet/in.h>
83 #include <netinet/ip.h>
84 #include <netinet/tcp.h>
85 #include <netinet/tcp_var.h>
86 
87 #include <net/pfvar.h>
88 
89 #define	DPFPRINTF(n, x)	if (V_pf_status.debug >= (n)) printf x
90 
91 union pf_syncookie {
92 	uint8_t		cookie;
93 	struct {
94 		uint8_t	oddeven:1,
95 			sack_ok:1,
96 			wscale_idx:3,
97 			mss_idx:3;
98 	} flags;
99 };
100 
101 #define	PF_SYNCOOKIE_SECRET_SIZE	SIPHASH_KEY_LENGTH
102 #define	PF_SYNCOOKIE_SECRET_LIFETIME	15 /* seconds */
103 
104 /* Protected by PF_RULES_xLOCK. */
105 struct pf_syncookie_status {
106 	struct callout	keytimeout;
107 	uint8_t		oddeven;
108 	uint8_t		key[2][SIPHASH_KEY_LENGTH];
109 };
110 VNET_DEFINE_STATIC(struct pf_syncookie_status, pf_syncookie_status);
111 #define V_pf_syncookie_status	VNET(pf_syncookie_status)
112 
113 static int	pf_syncookies_setmode(u_int8_t);
114 void		pf_syncookie_rotate(void *);
115 void		pf_syncookie_newkey(void);
116 uint32_t	pf_syncookie_mac(struct pf_pdesc *, union pf_syncookie,
117 		    uint32_t);
118 uint32_t	pf_syncookie_generate(struct mbuf *m, int off, struct pf_pdesc *,
119 		    uint16_t);
120 
121 void
122 pf_syncookies_init(void)
123 {
124 	callout_init(&V_pf_syncookie_status.keytimeout, 1);
125 	PF_RULES_WLOCK();
126 	pf_syncookies_setmode(PF_SYNCOOKIES_NEVER);
127 	PF_RULES_WUNLOCK();
128 }
129 
130 void
131 pf_syncookies_cleanup(void)
132 {
133 	callout_stop(&V_pf_syncookie_status.keytimeout);
134 }
135 
136 int
137 pf_get_syncookies(struct pfioc_nv *nv)
138 {
139 	nvlist_t	*nvl = NULL;
140 	void		*nvlpacked = NULL;
141 
142 	nvl = nvlist_create(0);
143 	if (nvl == NULL)
144 		return (ENOMEM);
145 
146 	nvlist_add_bool(nvl, "enabled",
147 	    V_pf_status.syncookies_mode != PF_SYNCOOKIES_NEVER);
148 	nvlist_add_bool(nvl, "adaptive", false);
149 
150 	nvlpacked = nvlist_pack(nvl, &nv->len);
151 	if (nvlpacked == NULL) {
152 		nvlist_destroy(nvl);
153 		return (ENOMEM);
154 	}
155 	if (nv->size == 0) {
156 		nvlist_destroy(nvl);
157 		free(nvlpacked, M_TEMP);
158 		return (0);
159 	} else if (nv->size < nv->len) {
160 		nvlist_destroy(nvl);
161 		free(nvlpacked, M_TEMP);
162 		return (ENOSPC);
163 	}
164 
165 	return (copyout(nvlpacked, nv->data, nv->len));
166 }
167 
168 int
169 pf_set_syncookies(struct pfioc_nv *nv)
170 {
171 	nvlist_t	*nvl = NULL;
172 	void		*nvlpacked = NULL;
173 	int		 error;
174 	bool		 enabled, adaptive;
175 
176 	if (nv->len > pf_ioctl_maxcount)
177 		return (ENOMEM);
178 
179 	nvlpacked = malloc(nv->len, M_TEMP, M_WAITOK);
180 	if (nvlpacked == NULL)
181 		return (ENOMEM);
182 
183 	error = copyin(nv->data, nvlpacked, nv->len);
184 	if (error) {
185 		free(nvlpacked, M_TEMP);
186 		return (error);
187 	}
188 
189 	nvl = nvlist_unpack(nvlpacked, nv->len, 0);
190 	if (nvl == NULL) {
191 		free(nvlpacked, M_TEMP);
192 		return (EBADMSG);
193 	}
194 
195 	if (! nvlist_exists_bool(nvl, "enabled")
196 	    || ! nvlist_exists_bool(nvl, "adaptive")) {
197 		nvlist_destroy(nvl);
198 		free(nvlpacked, M_TEMP);
199 		return (EBADMSG);
200 	}
201 
202 	enabled = nvlist_get_bool(nvl, "enabled");
203 	adaptive = nvlist_get_bool(nvl, "adaptive");
204 
205 	if (adaptive) {
206 		nvlist_destroy(nvl);
207 		free(nvlpacked, M_TEMP);
208 		return (ENOTSUP);
209 	}
210 
211 	PF_RULES_WLOCK();
212 	error = pf_syncookies_setmode(enabled ?
213 	    PF_SYNCOOKIES_ALWAYS : PF_SYNCOOKIES_NEVER);
214 	PF_RULES_WUNLOCK();
215 
216 	return (error);
217 }
218 
219 static int
220 pf_syncookies_setmode(u_int8_t mode)
221 {
222 	if (mode > PF_SYNCOOKIES_MODE_MAX)
223 		return (EINVAL);
224 
225 	if (V_pf_status.syncookies_mode == mode)
226 		return (0);
227 
228 	V_pf_status.syncookies_mode = mode;
229 	if (V_pf_status.syncookies_mode == PF_SYNCOOKIES_ALWAYS) {
230 		pf_syncookie_newkey();
231 		V_pf_status.syncookies_active = true;
232 	}
233 	return (0);
234 }
235 
236 int
237 pf_synflood_check(struct pf_pdesc *pd)
238 {
239 	MPASS(pd->proto == IPPROTO_TCP);
240 	PF_RULES_RASSERT();
241 
242 	if (pd->pf_mtag && (pd->pf_mtag->tag & PF_TAG_SYNCOOKIE_RECREATED))
243 		return (0);
244 
245 	return (V_pf_status.syncookies_mode);
246 }
247 
248 void
249 pf_syncookie_send(struct mbuf *m, int off, struct pf_pdesc *pd)
250 {
251 	uint16_t	mss;
252 	uint32_t	iss;
253 
254 	mss = max(V_tcp_mssdflt, pf_get_mss(m, off, pd->hdr.tcp.th_off, pd->af));
255 	iss = pf_syncookie_generate(m, off, pd, mss);
256 	pf_send_tcp(NULL, pd->af, pd->dst, pd->src, *pd->dport, *pd->sport,
257 	    iss, ntohl(pd->hdr.tcp.th_seq) + 1, TH_SYN|TH_ACK, 0, mss,
258 	    0, 1, 0);
259 }
260 
261 uint8_t
262 pf_syncookie_validate(struct pf_pdesc *pd)
263 {
264 	uint32_t		 hash, ack, seq;
265 	union pf_syncookie	 cookie;
266 
267 	MPASS(pd->proto == IPPROTO_TCP);
268 	PF_RULES_RASSERT();
269 
270 	seq = ntohl(pd->hdr.tcp.th_seq) - 1;
271 	ack = ntohl(pd->hdr.tcp.th_ack) - 1;
272 	cookie.cookie = (ack & 0xff) ^ (ack >> 24);
273 
274 	hash = pf_syncookie_mac(pd, cookie, seq);
275 	if ((ack & ~0xff) != (hash & ~0xff))
276 		return (0);
277 
278 	return (1);
279 }
280 
281 /*
282  * all following functions private
283  */
284 void
285 pf_syncookie_rotate(void *arg)
286 {
287 	CURVNET_SET((struct vnet *)arg);
288 
289 	/* do we want to disable syncookies? */
290 	if (V_pf_status.syncookies_active) {
291 		V_pf_status.syncookies_active = false;
292 		DPFPRINTF(PF_DEBUG_MISC, ("syncookies disabled"));
293 	}
294 
295 	/* nothing in flight any more? delete keys and return */
296 	if (!V_pf_status.syncookies_active) {
297 		memset(V_pf_syncookie_status.key[0], 0,
298 		    PF_SYNCOOKIE_SECRET_SIZE);
299 		memset(V_pf_syncookie_status.key[1], 0,
300 		    PF_SYNCOOKIE_SECRET_SIZE);
301 		CURVNET_RESTORE();
302 		return;
303 	}
304 
305 	/* new key, including timeout */
306 	pf_syncookie_newkey();
307 
308 	CURVNET_RESTORE();
309 }
310 
311 void
312 pf_syncookie_newkey(void)
313 {
314 	PF_RULES_WASSERT();
315 
316 	V_pf_syncookie_status.oddeven = (V_pf_syncookie_status.oddeven + 1) & 0x1;
317 	arc4random_buf(V_pf_syncookie_status.key[V_pf_syncookie_status.oddeven],
318 	    PF_SYNCOOKIE_SECRET_SIZE);
319 	callout_reset(&V_pf_syncookie_status.keytimeout,
320 	    PF_SYNCOOKIE_SECRET_LIFETIME, pf_syncookie_rotate, curvnet);
321 }
322 
323 /*
324  * Distribution and probability of certain MSS values.  Those in between are
325  * rounded down to the next lower one.
326  * [An Analysis of TCP Maximum Segment Sizes, S. Alcock and R. Nelson, 2011]
327  *   .2%  .3%   5%    7%    7%    20%   15%   45%
328  */
329 static int pf_syncookie_msstab[] =
330     { 216, 536, 1200, 1360, 1400, 1440, 1452, 1460 };
331 
332 /*
333  * Distribution and probability of certain WSCALE values.
334  * The absence of the WSCALE option is encoded with index zero.
335  * [WSCALE values histograms, Allman, 2012]
336  *                                  X 10 10 35  5  6 14 10%   by host
337  *                                  X 11  4  5  5 18 49  3%   by connections
338  */
339 static int pf_syncookie_wstab[] = { 0, 0, 1, 2, 4, 6, 7, 8 };
340 
341 uint32_t
342 pf_syncookie_mac(struct pf_pdesc *pd, union pf_syncookie cookie, uint32_t seq)
343 {
344 	SIPHASH_CTX	ctx;
345 	uint32_t	siphash[2];
346 
347 	PF_RULES_RASSERT();
348 	MPASS(pd->proto == IPPROTO_TCP);
349 
350 	SipHash24_Init(&ctx);
351 	SipHash_SetKey(&ctx, V_pf_syncookie_status.key[cookie.flags.oddeven]);
352 
353 	switch (pd->af) {
354 	case AF_INET:
355 		SipHash_Update(&ctx, pd->src, sizeof(pd->src->v4));
356 		SipHash_Update(&ctx, pd->dst, sizeof(pd->dst->v4));
357 		break;
358 	case AF_INET6:
359 		SipHash_Update(&ctx, pd->src, sizeof(pd->src->v6));
360 		SipHash_Update(&ctx, pd->dst, sizeof(pd->dst->v6));
361 		break;
362 	default:
363 		panic("unknown address family");
364 	}
365 
366 	SipHash_Update(&ctx, pd->sport, sizeof(*pd->sport));
367 	SipHash_Update(&ctx, pd->dport, sizeof(*pd->dport));
368 	SipHash_Update(&ctx, &seq, sizeof(seq));
369 	SipHash_Update(&ctx, &cookie, sizeof(cookie));
370 	SipHash_Final((uint8_t *)&siphash, &ctx);
371 
372 	return (siphash[0] ^ siphash[1]);
373 }
374 
375 uint32_t
376 pf_syncookie_generate(struct mbuf *m, int off, struct pf_pdesc *pd,
377     uint16_t mss)
378 {
379 	uint8_t			 i, wscale;
380 	uint32_t		 iss, hash;
381 	union pf_syncookie	 cookie;
382 
383 	PF_RULES_RASSERT();
384 
385 	cookie.cookie = 0;
386 
387 	/* map MSS */
388 	for (i = nitems(pf_syncookie_msstab) - 1;
389 	    pf_syncookie_msstab[i] > mss && i > 0; i--)
390 		/* nada */;
391 	cookie.flags.mss_idx = i;
392 
393 	/* map WSCALE */
394 	wscale = pf_get_wscale(m, off, pd->hdr.tcp.th_off, pd->af);
395 	for (i = nitems(pf_syncookie_wstab) - 1;
396 	    pf_syncookie_wstab[i] > wscale && i > 0; i--)
397 		/* nada */;
398 	cookie.flags.wscale_idx = i;
399 	cookie.flags.sack_ok = 0;	/* XXX */
400 
401 	cookie.flags.oddeven = V_pf_syncookie_status.oddeven;
402 	hash = pf_syncookie_mac(pd, cookie, ntohl(pd->hdr.tcp.th_seq));
403 
404 	/*
405 	 * Put the flags into the hash and XOR them to get better ISS number
406 	 * variance.  This doesn't enhance the cryptographic strength and is
407 	 * done to prevent the 8 cookie bits from showing up directly on the
408 	 * wire.
409 	 */
410 	iss = hash & ~0xff;
411 	iss |= cookie.cookie ^ (hash >> 24);
412 
413 	return (iss);
414 }
415 
416 struct mbuf *
417 pf_syncookie_recreate_syn(uint8_t ttl, int off, struct pf_pdesc *pd)
418 {
419 	uint8_t			 wscale;
420 	uint16_t		 mss;
421 	uint32_t		 ack, seq;
422 	union pf_syncookie	 cookie;
423 
424 	seq = ntohl(pd->hdr.tcp.th_seq) - 1;
425 	ack = ntohl(pd->hdr.tcp.th_ack) - 1;
426 	cookie.cookie = (ack & 0xff) ^ (ack >> 24);
427 
428 	if (cookie.flags.mss_idx >= nitems(pf_syncookie_msstab) ||
429 	    cookie.flags.wscale_idx >= nitems(pf_syncookie_wstab))
430 		return (NULL);
431 
432 	mss = pf_syncookie_msstab[cookie.flags.mss_idx];
433 	wscale = pf_syncookie_wstab[cookie.flags.wscale_idx];
434 
435 	return (pf_build_tcp(NULL, pd->af, pd->src, pd->dst, *pd->sport,
436 	    *pd->dport, seq, 0, TH_SYN, wscale, mss, ttl, 0,
437 	    PF_TAG_SYNCOOKIE_RECREATED));
438 }
439