1 /* $NetBSD: npf_state_tcp.c,v 1.16 2014/07/25 20:07:32 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2010-2012 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF TCP state engine for connection tracking. 34 */ 35 36 #include <sys/cdefs.h> 37 __KERNEL_RCSID(0, "$NetBSD: npf_state_tcp.c,v 1.16 2014/07/25 20:07:32 rmind Exp $"); 38 39 #include <sys/param.h> 40 #include <sys/types.h> 41 42 #include <netinet/in.h> 43 #include <netinet/tcp.h> 44 #include <netinet/tcp_seq.h> 45 46 #include "npf_impl.h" 47 48 /* 49 * NPF TCP states. Note: these states are different from the TCP FSM 50 * states of RFC 793. The packet filter is a man-in-the-middle. 51 */ 52 #define NPF_TCPS_OK 255 53 #define NPF_TCPS_CLOSED 0 54 #define NPF_TCPS_SYN_SENT 1 55 #define NPF_TCPS_SIMSYN_SENT 2 56 #define NPF_TCPS_SYN_RECEIVED 3 57 #define NPF_TCPS_ESTABLISHED 4 58 #define NPF_TCPS_FIN_SENT 5 59 #define NPF_TCPS_FIN_RECEIVED 6 60 #define NPF_TCPS_CLOSE_WAIT 7 61 #define NPF_TCPS_FIN_WAIT 8 62 #define NPF_TCPS_CLOSING 9 63 #define NPF_TCPS_LAST_ACK 10 64 #define NPF_TCPS_TIME_WAIT 11 65 66 #define NPF_TCP_NSTATES 12 67 68 /* 69 * TCP connection timeout table (in seconds). 70 */ 71 static u_int npf_tcp_timeouts[] __read_mostly = { 72 /* Closed, timeout nearly immediately. */ 73 [NPF_TCPS_CLOSED] = 10, 74 /* Unsynchronised states. */ 75 [NPF_TCPS_SYN_SENT] = 30, 76 [NPF_TCPS_SIMSYN_SENT] = 30, 77 [NPF_TCPS_SYN_RECEIVED] = 60, 78 /* Established: 24 hours. */ 79 [NPF_TCPS_ESTABLISHED] = 60 * 60 * 24, 80 /* FIN seen: 4 minutes (2 * MSL). */ 81 [NPF_TCPS_FIN_SENT] = 60 * 2 * 2, 82 [NPF_TCPS_FIN_RECEIVED] = 60 * 2 * 2, 83 /* Half-closed cases: 6 hours. */ 84 [NPF_TCPS_CLOSE_WAIT] = 60 * 60 * 6, 85 [NPF_TCPS_FIN_WAIT] = 60 * 60 * 6, 86 /* Full close cases: 30 sec and 2 * MSL. */ 87 [NPF_TCPS_CLOSING] = 30, 88 [NPF_TCPS_LAST_ACK] = 30, 89 [NPF_TCPS_TIME_WAIT] = 60 * 2 * 2, 90 }; 91 92 static bool npf_strict_order_rst __read_mostly = true; 93 94 #define NPF_TCP_MAXACKWIN 66000 95 96 /* 97 * List of TCP flag cases and conversion of flags to a case (index). 98 */ 99 100 #define TCPFC_INVALID 0 101 #define TCPFC_SYN 1 102 #define TCPFC_SYNACK 2 103 #define TCPFC_ACK 3 104 #define TCPFC_FIN 4 105 #define TCPFC_COUNT 5 106 107 static inline u_int 108 npf_tcpfl2case(const u_int tcpfl) 109 { 110 u_int i, c; 111 112 CTASSERT(TH_FIN == 0x01); 113 CTASSERT(TH_SYN == 0x02); 114 CTASSERT(TH_ACK == 0x10); 115 116 /* 117 * Flags are shifted to use three least significant bits, thus each 118 * flag combination has a unique number ranging from 0 to 7, e.g. 119 * TH_SYN | TH_ACK has number 6, since (0x02 | (0x10 >> 2)) == 6. 120 * However, the requirement is to have number 0 for invalid cases, 121 * such as TH_SYN | TH_FIN, and to have the same number for TH_FIN 122 * and TH_FIN|TH_ACK cases. Thus, we generate a mask assigning 3 123 * bits for each number, which contains the actual case numbers: 124 * 125 * TCPFC_SYNACK << (6 << 2) == 0x2000000 (6 - SYN,ACK) 126 * TCPFC_FIN << (5 << 2) == 0x0400000 (5 - FIN,ACK) 127 * ... 128 * 129 * Hence, OR'ed mask value is 0x2430140. 130 */ 131 i = (tcpfl & (TH_SYN | TH_FIN)) | ((tcpfl & TH_ACK) >> 2); 132 c = (0x2430140 >> (i << 2)) & 7; 133 134 KASSERT(c < TCPFC_COUNT); 135 return c; 136 } 137 138 /* 139 * NPF transition table of a tracked TCP connection. 140 * 141 * There is a single state, which is changed in the following way: 142 * 143 * new_state = npf_tcp_fsm[old_state][direction][npf_tcpfl2case(tcp_flags)]; 144 * 145 * Note that this state is different from the state in each end (host). 146 */ 147 148 static const uint8_t npf_tcp_fsm[NPF_TCP_NSTATES][2][TCPFC_COUNT] = { 149 [NPF_TCPS_CLOSED] = { 150 [NPF_FLOW_FORW] = { 151 /* Handshake (1): initial SYN. */ 152 [TCPFC_SYN] = NPF_TCPS_SYN_SENT, 153 }, 154 }, 155 [NPF_TCPS_SYN_SENT] = { 156 [NPF_FLOW_FORW] = { 157 /* SYN may be retransmitted. */ 158 [TCPFC_SYN] = NPF_TCPS_OK, 159 }, 160 [NPF_FLOW_BACK] = { 161 /* Handshake (2): SYN-ACK is expected. */ 162 [TCPFC_SYNACK] = NPF_TCPS_SYN_RECEIVED, 163 /* Simultaneous initiation - SYN. */ 164 [TCPFC_SYN] = NPF_TCPS_SIMSYN_SENT, 165 }, 166 }, 167 [NPF_TCPS_SIMSYN_SENT] = { 168 [NPF_FLOW_FORW] = { 169 /* Original SYN re-transmission. */ 170 [TCPFC_SYN] = NPF_TCPS_OK, 171 /* SYN-ACK response to simultaneous SYN. */ 172 [TCPFC_SYNACK] = NPF_TCPS_SYN_RECEIVED, 173 }, 174 [NPF_FLOW_BACK] = { 175 /* Simultaneous SYN re-transmission.*/ 176 [TCPFC_SYN] = NPF_TCPS_OK, 177 /* SYN-ACK response to original SYN. */ 178 [TCPFC_SYNACK] = NPF_TCPS_SYN_RECEIVED, 179 /* FIN may occur early. */ 180 [TCPFC_FIN] = NPF_TCPS_FIN_RECEIVED, 181 }, 182 }, 183 [NPF_TCPS_SYN_RECEIVED] = { 184 [NPF_FLOW_FORW] = { 185 /* Handshake (3): ACK is expected. */ 186 [TCPFC_ACK] = NPF_TCPS_ESTABLISHED, 187 /* FIN may be sent early. */ 188 [TCPFC_FIN] = NPF_TCPS_FIN_SENT, 189 }, 190 [NPF_FLOW_BACK] = { 191 /* SYN-ACK may be retransmitted. */ 192 [TCPFC_SYNACK] = NPF_TCPS_OK, 193 /* XXX: ACK of late SYN in simultaneous case? */ 194 [TCPFC_ACK] = NPF_TCPS_OK, 195 /* FIN may occur early. */ 196 [TCPFC_FIN] = NPF_TCPS_FIN_RECEIVED, 197 }, 198 }, 199 [NPF_TCPS_ESTABLISHED] = { 200 /* 201 * Regular ACKs (data exchange) or FIN. 202 * FIN packets may have ACK set. 203 */ 204 [NPF_FLOW_FORW] = { 205 [TCPFC_ACK] = NPF_TCPS_OK, 206 /* FIN by the sender. */ 207 [TCPFC_FIN] = NPF_TCPS_FIN_SENT, 208 }, 209 [NPF_FLOW_BACK] = { 210 [TCPFC_ACK] = NPF_TCPS_OK, 211 /* FIN by the receiver. */ 212 [TCPFC_FIN] = NPF_TCPS_FIN_RECEIVED, 213 }, 214 }, 215 [NPF_TCPS_FIN_SENT] = { 216 [NPF_FLOW_FORW] = { 217 /* FIN may be re-transmitted. Late ACK as well. */ 218 [TCPFC_ACK] = NPF_TCPS_OK, 219 [TCPFC_FIN] = NPF_TCPS_OK, 220 }, 221 [NPF_FLOW_BACK] = { 222 /* If ACK, connection is half-closed now. */ 223 [TCPFC_ACK] = NPF_TCPS_FIN_WAIT, 224 /* FIN or FIN-ACK race - immediate closing. */ 225 [TCPFC_FIN] = NPF_TCPS_CLOSING, 226 }, 227 }, 228 [NPF_TCPS_FIN_RECEIVED] = { 229 /* 230 * FIN was received. Equivalent scenario to sent FIN. 231 */ 232 [NPF_FLOW_FORW] = { 233 [TCPFC_ACK] = NPF_TCPS_CLOSE_WAIT, 234 [TCPFC_FIN] = NPF_TCPS_CLOSING, 235 }, 236 [NPF_FLOW_BACK] = { 237 [TCPFC_ACK] = NPF_TCPS_OK, 238 [TCPFC_FIN] = NPF_TCPS_OK, 239 }, 240 }, 241 [NPF_TCPS_CLOSE_WAIT] = { 242 /* Sender has sent the FIN and closed its end. */ 243 [NPF_FLOW_FORW] = { 244 [TCPFC_ACK] = NPF_TCPS_OK, 245 [TCPFC_FIN] = NPF_TCPS_LAST_ACK, 246 }, 247 [NPF_FLOW_BACK] = { 248 [TCPFC_ACK] = NPF_TCPS_OK, 249 [TCPFC_FIN] = NPF_TCPS_LAST_ACK, 250 }, 251 }, 252 [NPF_TCPS_FIN_WAIT] = { 253 /* Receiver has closed its end. */ 254 [NPF_FLOW_FORW] = { 255 [TCPFC_ACK] = NPF_TCPS_OK, 256 [TCPFC_FIN] = NPF_TCPS_LAST_ACK, 257 }, 258 [NPF_FLOW_BACK] = { 259 [TCPFC_ACK] = NPF_TCPS_OK, 260 [TCPFC_FIN] = NPF_TCPS_LAST_ACK, 261 }, 262 }, 263 [NPF_TCPS_CLOSING] = { 264 /* Race of FINs - expecting ACK. */ 265 [NPF_FLOW_FORW] = { 266 [TCPFC_ACK] = NPF_TCPS_LAST_ACK, 267 }, 268 [NPF_FLOW_BACK] = { 269 [TCPFC_ACK] = NPF_TCPS_LAST_ACK, 270 }, 271 }, 272 [NPF_TCPS_LAST_ACK] = { 273 /* FINs exchanged - expecting last ACK. */ 274 [NPF_FLOW_FORW] = { 275 [TCPFC_ACK] = NPF_TCPS_TIME_WAIT, 276 }, 277 [NPF_FLOW_BACK] = { 278 [TCPFC_ACK] = NPF_TCPS_TIME_WAIT, 279 }, 280 }, 281 [NPF_TCPS_TIME_WAIT] = { 282 /* May re-open the connection as per RFC 1122. */ 283 [NPF_FLOW_FORW] = { 284 [TCPFC_SYN] = NPF_TCPS_SYN_SENT, 285 }, 286 }, 287 }; 288 289 /* 290 * npf_tcp_inwindow: determine whether the packet is in the TCP window 291 * and thus part of the connection we are tracking. 292 */ 293 static bool 294 npf_tcp_inwindow(npf_cache_t *npc, npf_state_t *nst, const int di) 295 { 296 const struct tcphdr * const th = npc->npc_l4.tcp; 297 const int tcpfl = th->th_flags; 298 npf_tcpstate_t *fstate, *tstate; 299 int tcpdlen, ackskew; 300 tcp_seq seq, ack, end; 301 uint32_t win; 302 303 KASSERT(npf_iscached(npc, NPC_TCP)); 304 KASSERT(di == NPF_FLOW_FORW || di == NPF_FLOW_BACK); 305 306 /* 307 * Perform SEQ/ACK numbers check against boundaries. Reference: 308 * 309 * Rooij G., "Real stateful TCP packet filtering in IP Filter", 310 * 10th USENIX Security Symposium invited talk, Aug. 2001. 311 * 312 * There are four boundaries defined as following: 313 * I) SEQ + LEN <= MAX { SND.ACK + MAX(SND.WIN, 1) } 314 * II) SEQ >= MAX { SND.SEQ + SND.LEN - MAX(RCV.WIN, 1) } 315 * III) ACK <= MAX { RCV.SEQ + RCV.LEN } 316 * IV) ACK >= MAX { RCV.SEQ + RCV.LEN } - MAXACKWIN 317 * 318 * Let these members of npf_tcpstate_t be the maximum seen values of: 319 * nst_end - SEQ + LEN 320 * nst_maxend - ACK + MAX(WIN, 1) 321 * nst_maxwin - MAX(WIN, 1) 322 */ 323 324 tcpdlen = npf_tcpsaw(__UNCONST(npc), &seq, &ack, &win); 325 end = seq + tcpdlen; 326 if (tcpfl & TH_SYN) { 327 end++; 328 } 329 if (tcpfl & TH_FIN) { 330 end++; 331 } 332 333 fstate = &nst->nst_tcpst[di]; 334 tstate = &nst->nst_tcpst[!di]; 335 win = win ? (win << fstate->nst_wscale) : 1; 336 337 /* 338 * Initialise if the first packet. 339 * Note: only case when nst_maxwin is zero. 340 */ 341 if (__predict_false(fstate->nst_maxwin == 0)) { 342 /* 343 * Normally, it should be the first SYN or a re-transmission 344 * of SYN. The state of the other side will get set with a 345 * SYN-ACK reply (see below). 346 */ 347 fstate->nst_end = end; 348 fstate->nst_maxend = end; 349 fstate->nst_maxwin = win; 350 tstate->nst_end = 0; 351 tstate->nst_maxend = 0; 352 tstate->nst_maxwin = 1; 353 354 /* 355 * Handle TCP Window Scaling (RFC 1323). Both sides may 356 * send this option in their SYN packets. 357 */ 358 fstate->nst_wscale = 0; 359 (void)npf_fetch_tcpopts(npc, NULL, &fstate->nst_wscale); 360 361 tstate->nst_wscale = 0; 362 363 /* Done. */ 364 return true; 365 } 366 367 if (fstate->nst_end == 0) { 368 /* 369 * Should be a SYN-ACK reply to SYN. If SYN is not set, 370 * then we are in the middle of connection and lost tracking. 371 */ 372 fstate->nst_end = end; 373 fstate->nst_maxend = end + 1; 374 fstate->nst_maxwin = win; 375 fstate->nst_wscale = 0; 376 377 /* Handle TCP Window Scaling (must be ignored if no SYN). */ 378 if (tcpfl & TH_SYN) { 379 (void)npf_fetch_tcpopts(npc, NULL, &fstate->nst_wscale); 380 } 381 } 382 383 if ((tcpfl & TH_ACK) == 0) { 384 /* Pretend that an ACK was sent. */ 385 ack = tstate->nst_end; 386 } else if ((tcpfl & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST) && ack == 0) { 387 /* Workaround for some TCP stacks. */ 388 ack = tstate->nst_end; 389 } 390 391 if (__predict_false(tcpfl & TH_RST)) { 392 /* RST to the initial SYN may have zero SEQ - fix it up. */ 393 if (seq == 0 && nst->nst_state == NPF_TCPS_SYN_SENT) { 394 end = fstate->nst_end; 395 seq = end; 396 } 397 398 /* Strict in-order sequence for RST packets (RFC 5961). */ 399 if (npf_strict_order_rst && (fstate->nst_end - seq) > 1) { 400 return false; 401 } 402 } 403 404 /* 405 * Determine whether the data is within previously noted window, 406 * that is, upper boundary for valid data (I). 407 */ 408 if (!SEQ_LEQ(end, fstate->nst_maxend)) { 409 npf_stats_inc(NPF_STAT_INVALID_STATE_TCP1); 410 return false; 411 } 412 413 /* Lower boundary (II), which is no more than one window back. */ 414 if (!SEQ_GEQ(seq, fstate->nst_end - tstate->nst_maxwin)) { 415 npf_stats_inc(NPF_STAT_INVALID_STATE_TCP2); 416 return false; 417 } 418 419 /* 420 * Boundaries for valid acknowledgments (III, IV) - one predicted 421 * window up or down, since packets may be fragmented. 422 */ 423 ackskew = tstate->nst_end - ack; 424 if (ackskew < -NPF_TCP_MAXACKWIN || 425 ackskew > (NPF_TCP_MAXACKWIN << fstate->nst_wscale)) { 426 npf_stats_inc(NPF_STAT_INVALID_STATE_TCP3); 427 return false; 428 } 429 430 /* 431 * Packet has been passed. 432 * 433 * Negative ackskew might be due to fragmented packets. Since the 434 * total length of the packet is unknown - bump the boundary. 435 */ 436 437 if (ackskew < 0) { 438 tstate->nst_end = ack; 439 } 440 /* Keep track of the maximum window seen. */ 441 if (fstate->nst_maxwin < win) { 442 fstate->nst_maxwin = win; 443 } 444 if (SEQ_GT(end, fstate->nst_end)) { 445 fstate->nst_end = end; 446 } 447 /* Note the window for upper boundary. */ 448 if (SEQ_GEQ(ack + win, tstate->nst_maxend)) { 449 tstate->nst_maxend = ack + win; 450 } 451 return true; 452 } 453 454 /* 455 * npf_state_tcp: inspect TCP segment, determine whether it belongs to 456 * the connection and track its state. 457 */ 458 bool 459 npf_state_tcp(npf_cache_t *npc, npf_state_t *nst, int di) 460 { 461 const struct tcphdr * const th = npc->npc_l4.tcp; 462 const u_int tcpfl = th->th_flags, state = nst->nst_state; 463 u_int nstate; 464 465 KASSERT(nst->nst_state < NPF_TCP_NSTATES); 466 467 /* Look for a transition to a new state. */ 468 if (__predict_true((tcpfl & TH_RST) == 0)) { 469 const u_int flagcase = npf_tcpfl2case(tcpfl); 470 nstate = npf_tcp_fsm[state][di][flagcase]; 471 } else if (state == NPF_TCPS_TIME_WAIT) { 472 /* Prevent TIME-WAIT assassination (RFC 1337). */ 473 nstate = NPF_TCPS_OK; 474 } else { 475 nstate = NPF_TCPS_CLOSED; 476 } 477 478 /* Determine whether TCP packet really belongs to this connection. */ 479 if (!npf_tcp_inwindow(npc, nst, di)) { 480 return false; 481 } 482 if (__predict_true(nstate == NPF_TCPS_OK)) { 483 return true; 484 } 485 486 nst->nst_state = nstate; 487 return true; 488 } 489 490 int 491 npf_state_tcp_timeout(const npf_state_t *nst) 492 { 493 const u_int state = nst->nst_state; 494 495 KASSERT(state < NPF_TCP_NSTATES); 496 return npf_tcp_timeouts[state]; 497 } 498