1 /* $NetBSD: npf_state_tcp.c,v 1.18 2016/12/26 23:10:46 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2010-2012 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF TCP state engine for connection tracking. 34 */ 35 36 #ifdef _KERNEL 37 #include <sys/cdefs.h> 38 __KERNEL_RCSID(0, "$NetBSD: npf_state_tcp.c,v 1.18 2016/12/26 23:10:46 rmind Exp $"); 39 40 #include <sys/param.h> 41 #include <sys/types.h> 42 43 #include <netinet/in.h> 44 #include <netinet/tcp.h> 45 #endif 46 47 #include "npf_impl.h" 48 49 /* 50 * NPF TCP states. Note: these states are different from the TCP FSM 51 * states of RFC 793. The packet filter is a man-in-the-middle. 52 */ 53 #define NPF_TCPS_OK 255 54 #define NPF_TCPS_CLOSED 0 55 #define NPF_TCPS_SYN_SENT 1 56 #define NPF_TCPS_SIMSYN_SENT 2 57 #define NPF_TCPS_SYN_RECEIVED 3 58 #define NPF_TCPS_ESTABLISHED 4 59 #define NPF_TCPS_FIN_SENT 5 60 #define NPF_TCPS_FIN_RECEIVED 6 61 #define NPF_TCPS_CLOSE_WAIT 7 62 #define NPF_TCPS_FIN_WAIT 8 63 #define NPF_TCPS_CLOSING 9 64 #define NPF_TCPS_LAST_ACK 10 65 #define NPF_TCPS_TIME_WAIT 11 66 67 #define NPF_TCP_NSTATES 12 68 69 /* 70 * TCP connection timeout table (in seconds). 71 */ 72 static u_int npf_tcp_timeouts[] __read_mostly = { 73 /* Closed, timeout nearly immediately. */ 74 [NPF_TCPS_CLOSED] = 10, 75 /* Unsynchronised states. */ 76 [NPF_TCPS_SYN_SENT] = 30, 77 [NPF_TCPS_SIMSYN_SENT] = 30, 78 [NPF_TCPS_SYN_RECEIVED] = 60, 79 /* Established: 24 hours. */ 80 [NPF_TCPS_ESTABLISHED] = 60 * 60 * 24, 81 /* FIN seen: 4 minutes (2 * MSL). */ 82 [NPF_TCPS_FIN_SENT] = 60 * 2 * 2, 83 [NPF_TCPS_FIN_RECEIVED] = 60 * 2 * 2, 84 /* Half-closed cases: 6 hours. */ 85 [NPF_TCPS_CLOSE_WAIT] = 60 * 60 * 6, 86 [NPF_TCPS_FIN_WAIT] = 60 * 60 * 6, 87 /* Full close cases: 30 sec and 2 * MSL. */ 88 [NPF_TCPS_CLOSING] = 30, 89 [NPF_TCPS_LAST_ACK] = 30, 90 [NPF_TCPS_TIME_WAIT] = 60 * 2 * 2, 91 }; 92 93 static bool npf_strict_order_rst __read_mostly = true; 94 95 #define NPF_TCP_MAXACKWIN 66000 96 97 #define SEQ_LT(a,b) ((int)((a)-(b)) < 0) 98 #define SEQ_LEQ(a,b) ((int)((a)-(b)) <= 0) 99 #define SEQ_GT(a,b) ((int)((a)-(b)) > 0) 100 #define SEQ_GEQ(a,b) ((int)((a)-(b)) >= 0) 101 102 /* 103 * List of TCP flag cases and conversion of flags to a case (index). 104 */ 105 106 #define TCPFC_INVALID 0 107 #define TCPFC_SYN 1 108 #define TCPFC_SYNACK 2 109 #define TCPFC_ACK 3 110 #define TCPFC_FIN 4 111 #define TCPFC_COUNT 5 112 113 static inline u_int 114 npf_tcpfl2case(const u_int tcpfl) 115 { 116 u_int i, c; 117 118 CTASSERT(TH_FIN == 0x01); 119 CTASSERT(TH_SYN == 0x02); 120 CTASSERT(TH_ACK == 0x10); 121 122 /* 123 * Flags are shifted to use three least significant bits, thus each 124 * flag combination has a unique number ranging from 0 to 7, e.g. 125 * TH_SYN | TH_ACK has number 6, since (0x02 | (0x10 >> 2)) == 6. 126 * However, the requirement is to have number 0 for invalid cases, 127 * such as TH_SYN | TH_FIN, and to have the same number for TH_FIN 128 * and TH_FIN|TH_ACK cases. Thus, we generate a mask assigning 3 129 * bits for each number, which contains the actual case numbers: 130 * 131 * TCPFC_SYNACK << (6 << 2) == 0x2000000 (6 - SYN,ACK) 132 * TCPFC_FIN << (5 << 2) == 0x0400000 (5 - FIN,ACK) 133 * ... 134 * 135 * Hence, OR'ed mask value is 0x2430140. 136 */ 137 i = (tcpfl & (TH_SYN | TH_FIN)) | ((tcpfl & TH_ACK) >> 2); 138 c = (0x2430140 >> (i << 2)) & 7; 139 140 KASSERT(c < TCPFC_COUNT); 141 return c; 142 } 143 144 /* 145 * NPF transition table of a tracked TCP connection. 146 * 147 * There is a single state, which is changed in the following way: 148 * 149 * new_state = npf_tcp_fsm[old_state][direction][npf_tcpfl2case(tcp_flags)]; 150 * 151 * Note that this state is different from the state in each end (host). 152 */ 153 154 static const uint8_t npf_tcp_fsm[NPF_TCP_NSTATES][2][TCPFC_COUNT] = { 155 [NPF_TCPS_CLOSED] = { 156 [NPF_FLOW_FORW] = { 157 /* Handshake (1): initial SYN. */ 158 [TCPFC_SYN] = NPF_TCPS_SYN_SENT, 159 }, 160 }, 161 [NPF_TCPS_SYN_SENT] = { 162 [NPF_FLOW_FORW] = { 163 /* SYN may be retransmitted. */ 164 [TCPFC_SYN] = NPF_TCPS_OK, 165 }, 166 [NPF_FLOW_BACK] = { 167 /* Handshake (2): SYN-ACK is expected. */ 168 [TCPFC_SYNACK] = NPF_TCPS_SYN_RECEIVED, 169 /* Simultaneous initiation - SYN. */ 170 [TCPFC_SYN] = NPF_TCPS_SIMSYN_SENT, 171 }, 172 }, 173 [NPF_TCPS_SIMSYN_SENT] = { 174 [NPF_FLOW_FORW] = { 175 /* Original SYN re-transmission. */ 176 [TCPFC_SYN] = NPF_TCPS_OK, 177 /* SYN-ACK response to simultaneous SYN. */ 178 [TCPFC_SYNACK] = NPF_TCPS_SYN_RECEIVED, 179 }, 180 [NPF_FLOW_BACK] = { 181 /* Simultaneous SYN re-transmission.*/ 182 [TCPFC_SYN] = NPF_TCPS_OK, 183 /* SYN-ACK response to original SYN. */ 184 [TCPFC_SYNACK] = NPF_TCPS_SYN_RECEIVED, 185 /* FIN may occur early. */ 186 [TCPFC_FIN] = NPF_TCPS_FIN_RECEIVED, 187 }, 188 }, 189 [NPF_TCPS_SYN_RECEIVED] = { 190 [NPF_FLOW_FORW] = { 191 /* Handshake (3): ACK is expected. */ 192 [TCPFC_ACK] = NPF_TCPS_ESTABLISHED, 193 /* FIN may be sent early. */ 194 [TCPFC_FIN] = NPF_TCPS_FIN_SENT, 195 /* Late SYN re-transmission. */ 196 [TCPFC_SYN] = NPF_TCPS_OK, 197 }, 198 [NPF_FLOW_BACK] = { 199 /* SYN-ACK may be retransmitted. */ 200 [TCPFC_SYNACK] = NPF_TCPS_OK, 201 /* XXX: ACK of late SYN in simultaneous case? */ 202 [TCPFC_ACK] = NPF_TCPS_OK, 203 /* FIN may occur early. */ 204 [TCPFC_FIN] = NPF_TCPS_FIN_RECEIVED, 205 }, 206 }, 207 [NPF_TCPS_ESTABLISHED] = { 208 /* 209 * Regular ACKs (data exchange) or FIN. 210 * FIN packets may have ACK set. 211 */ 212 [NPF_FLOW_FORW] = { 213 [TCPFC_ACK] = NPF_TCPS_OK, 214 /* FIN by the sender. */ 215 [TCPFC_FIN] = NPF_TCPS_FIN_SENT, 216 }, 217 [NPF_FLOW_BACK] = { 218 [TCPFC_ACK] = NPF_TCPS_OK, 219 /* FIN by the receiver. */ 220 [TCPFC_FIN] = NPF_TCPS_FIN_RECEIVED, 221 }, 222 }, 223 [NPF_TCPS_FIN_SENT] = { 224 [NPF_FLOW_FORW] = { 225 /* FIN may be re-transmitted. Late ACK as well. */ 226 [TCPFC_ACK] = NPF_TCPS_OK, 227 [TCPFC_FIN] = NPF_TCPS_OK, 228 }, 229 [NPF_FLOW_BACK] = { 230 /* If ACK, connection is half-closed now. */ 231 [TCPFC_ACK] = NPF_TCPS_FIN_WAIT, 232 /* FIN or FIN-ACK race - immediate closing. */ 233 [TCPFC_FIN] = NPF_TCPS_CLOSING, 234 }, 235 }, 236 [NPF_TCPS_FIN_RECEIVED] = { 237 /* 238 * FIN was received. Equivalent scenario to sent FIN. 239 */ 240 [NPF_FLOW_FORW] = { 241 [TCPFC_ACK] = NPF_TCPS_CLOSE_WAIT, 242 [TCPFC_FIN] = NPF_TCPS_CLOSING, 243 }, 244 [NPF_FLOW_BACK] = { 245 [TCPFC_ACK] = NPF_TCPS_OK, 246 [TCPFC_FIN] = NPF_TCPS_OK, 247 }, 248 }, 249 [NPF_TCPS_CLOSE_WAIT] = { 250 /* Sender has sent the FIN and closed its end. */ 251 [NPF_FLOW_FORW] = { 252 [TCPFC_ACK] = NPF_TCPS_OK, 253 [TCPFC_FIN] = NPF_TCPS_LAST_ACK, 254 }, 255 [NPF_FLOW_BACK] = { 256 [TCPFC_ACK] = NPF_TCPS_OK, 257 [TCPFC_FIN] = NPF_TCPS_LAST_ACK, 258 }, 259 }, 260 [NPF_TCPS_FIN_WAIT] = { 261 /* Receiver has closed its end. */ 262 [NPF_FLOW_FORW] = { 263 [TCPFC_ACK] = NPF_TCPS_OK, 264 [TCPFC_FIN] = NPF_TCPS_LAST_ACK, 265 }, 266 [NPF_FLOW_BACK] = { 267 [TCPFC_ACK] = NPF_TCPS_OK, 268 [TCPFC_FIN] = NPF_TCPS_LAST_ACK, 269 }, 270 }, 271 [NPF_TCPS_CLOSING] = { 272 /* Race of FINs - expecting ACK. */ 273 [NPF_FLOW_FORW] = { 274 [TCPFC_ACK] = NPF_TCPS_LAST_ACK, 275 }, 276 [NPF_FLOW_BACK] = { 277 [TCPFC_ACK] = NPF_TCPS_LAST_ACK, 278 }, 279 }, 280 [NPF_TCPS_LAST_ACK] = { 281 /* FINs exchanged - expecting last ACK. */ 282 [NPF_FLOW_FORW] = { 283 [TCPFC_ACK] = NPF_TCPS_TIME_WAIT, 284 }, 285 [NPF_FLOW_BACK] = { 286 [TCPFC_ACK] = NPF_TCPS_TIME_WAIT, 287 }, 288 }, 289 [NPF_TCPS_TIME_WAIT] = { 290 /* May re-open the connection as per RFC 1122. */ 291 [NPF_FLOW_FORW] = { 292 [TCPFC_SYN] = NPF_TCPS_SYN_SENT, 293 }, 294 }, 295 }; 296 297 /* 298 * npf_tcp_inwindow: determine whether the packet is in the TCP window 299 * and thus part of the connection we are tracking. 300 */ 301 static bool 302 npf_tcp_inwindow(npf_cache_t *npc, npf_state_t *nst, const int di) 303 { 304 const struct tcphdr * const th = npc->npc_l4.tcp; 305 const int tcpfl = th->th_flags; 306 npf_tcpstate_t *fstate, *tstate; 307 int tcpdlen, ackskew; 308 tcp_seq seq, ack, end; 309 uint32_t win; 310 311 KASSERT(npf_iscached(npc, NPC_TCP)); 312 KASSERT(di == NPF_FLOW_FORW || di == NPF_FLOW_BACK); 313 314 /* 315 * Perform SEQ/ACK numbers check against boundaries. Reference: 316 * 317 * Rooij G., "Real stateful TCP packet filtering in IP Filter", 318 * 10th USENIX Security Symposium invited talk, Aug. 2001. 319 * 320 * There are four boundaries defined as following: 321 * I) SEQ + LEN <= MAX { SND.ACK + MAX(SND.WIN, 1) } 322 * II) SEQ >= MAX { SND.SEQ + SND.LEN - MAX(RCV.WIN, 1) } 323 * III) ACK <= MAX { RCV.SEQ + RCV.LEN } 324 * IV) ACK >= MAX { RCV.SEQ + RCV.LEN } - MAXACKWIN 325 * 326 * Let these members of npf_tcpstate_t be the maximum seen values of: 327 * nst_end - SEQ + LEN 328 * nst_maxend - ACK + MAX(WIN, 1) 329 * nst_maxwin - MAX(WIN, 1) 330 */ 331 332 tcpdlen = npf_tcpsaw(__UNCONST(npc), &seq, &ack, &win); 333 end = seq + tcpdlen; 334 if (tcpfl & TH_SYN) { 335 end++; 336 } 337 if (tcpfl & TH_FIN) { 338 end++; 339 } 340 341 fstate = &nst->nst_tcpst[di]; 342 tstate = &nst->nst_tcpst[!di]; 343 win = win ? (win << fstate->nst_wscale) : 1; 344 345 /* 346 * Initialise if the first packet. 347 * Note: only case when nst_maxwin is zero. 348 */ 349 if (__predict_false(fstate->nst_maxwin == 0)) { 350 /* 351 * Normally, it should be the first SYN or a re-transmission 352 * of SYN. The state of the other side will get set with a 353 * SYN-ACK reply (see below). 354 */ 355 fstate->nst_end = end; 356 fstate->nst_maxend = end; 357 fstate->nst_maxwin = win; 358 tstate->nst_end = 0; 359 tstate->nst_maxend = 0; 360 tstate->nst_maxwin = 1; 361 362 /* 363 * Handle TCP Window Scaling (RFC 1323). Both sides may 364 * send this option in their SYN packets. 365 */ 366 fstate->nst_wscale = 0; 367 (void)npf_fetch_tcpopts(npc, NULL, &fstate->nst_wscale); 368 369 tstate->nst_wscale = 0; 370 371 /* Done. */ 372 return true; 373 } 374 375 if (fstate->nst_end == 0) { 376 /* 377 * Should be a SYN-ACK reply to SYN. If SYN is not set, 378 * then we are in the middle of connection and lost tracking. 379 */ 380 fstate->nst_end = end; 381 fstate->nst_maxend = end + 1; 382 fstate->nst_maxwin = win; 383 fstate->nst_wscale = 0; 384 385 /* Handle TCP Window Scaling (must be ignored if no SYN). */ 386 if (tcpfl & TH_SYN) { 387 (void)npf_fetch_tcpopts(npc, NULL, &fstate->nst_wscale); 388 } 389 } 390 391 if ((tcpfl & TH_ACK) == 0) { 392 /* Pretend that an ACK was sent. */ 393 ack = tstate->nst_end; 394 } else if ((tcpfl & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST) && ack == 0) { 395 /* Workaround for some TCP stacks. */ 396 ack = tstate->nst_end; 397 } 398 399 if (__predict_false(tcpfl & TH_RST)) { 400 /* RST to the initial SYN may have zero SEQ - fix it up. */ 401 if (seq == 0 && nst->nst_state == NPF_TCPS_SYN_SENT) { 402 end = fstate->nst_end; 403 seq = end; 404 } 405 406 /* Strict in-order sequence for RST packets (RFC 5961). */ 407 if (npf_strict_order_rst && (fstate->nst_end - seq) > 1) { 408 return false; 409 } 410 } 411 412 /* 413 * Determine whether the data is within previously noted window, 414 * that is, upper boundary for valid data (I). 415 */ 416 if (!SEQ_LEQ(end, fstate->nst_maxend)) { 417 npf_stats_inc(npc->npc_ctx, NPF_STAT_INVALID_STATE_TCP1); 418 return false; 419 } 420 421 /* Lower boundary (II), which is no more than one window back. */ 422 if (!SEQ_GEQ(seq, fstate->nst_end - tstate->nst_maxwin)) { 423 npf_stats_inc(npc->npc_ctx, NPF_STAT_INVALID_STATE_TCP2); 424 return false; 425 } 426 427 /* 428 * Boundaries for valid acknowledgments (III, IV) - one predicted 429 * window up or down, since packets may be fragmented. 430 */ 431 ackskew = tstate->nst_end - ack; 432 if (ackskew < -NPF_TCP_MAXACKWIN || 433 ackskew > (NPF_TCP_MAXACKWIN << fstate->nst_wscale)) { 434 npf_stats_inc(npc->npc_ctx, NPF_STAT_INVALID_STATE_TCP3); 435 return false; 436 } 437 438 /* 439 * Packet has been passed. 440 * 441 * Negative ackskew might be due to fragmented packets. Since the 442 * total length of the packet is unknown - bump the boundary. 443 */ 444 445 if (ackskew < 0) { 446 tstate->nst_end = ack; 447 } 448 /* Keep track of the maximum window seen. */ 449 if (fstate->nst_maxwin < win) { 450 fstate->nst_maxwin = win; 451 } 452 if (SEQ_GT(end, fstate->nst_end)) { 453 fstate->nst_end = end; 454 } 455 /* Note the window for upper boundary. */ 456 if (SEQ_GEQ(ack + win, tstate->nst_maxend)) { 457 tstate->nst_maxend = ack + win; 458 } 459 return true; 460 } 461 462 /* 463 * npf_state_tcp: inspect TCP segment, determine whether it belongs to 464 * the connection and track its state. 465 */ 466 bool 467 npf_state_tcp(npf_cache_t *npc, npf_state_t *nst, int di) 468 { 469 const struct tcphdr * const th = npc->npc_l4.tcp; 470 const u_int tcpfl = th->th_flags, state = nst->nst_state; 471 u_int nstate; 472 473 KASSERT(nst->nst_state < NPF_TCP_NSTATES); 474 475 /* Look for a transition to a new state. */ 476 if (__predict_true((tcpfl & TH_RST) == 0)) { 477 const u_int flagcase = npf_tcpfl2case(tcpfl); 478 nstate = npf_tcp_fsm[state][di][flagcase]; 479 } else if (state == NPF_TCPS_TIME_WAIT) { 480 /* Prevent TIME-WAIT assassination (RFC 1337). */ 481 nstate = NPF_TCPS_OK; 482 } else { 483 nstate = NPF_TCPS_CLOSED; 484 } 485 486 /* Determine whether TCP packet really belongs to this connection. */ 487 if (!npf_tcp_inwindow(npc, nst, di)) { 488 return false; 489 } 490 if (__predict_true(nstate == NPF_TCPS_OK)) { 491 return true; 492 } 493 494 nst->nst_state = nstate; 495 return true; 496 } 497 498 int 499 npf_state_tcp_timeout(const npf_state_t *nst) 500 { 501 const u_int state = nst->nst_state; 502 503 KASSERT(state < NPF_TCP_NSTATES); 504 return npf_tcp_timeouts[state]; 505 } 506