From nobody Sat May 25 08:30:55 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4VmZqh21P9z5L1T3; Sat, 25 May 2024 08:30:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4VmZqh042nz4dXy; Sat, 25 May 2024 08:30:56 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1716625856; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Zv5kUpnPcZVI9RP13B9Wl/WwuCAKILpVihHlihw583k=; b=y3M1nULVzA9fi6Hx7H5P6vdjyI81AFFtyZDisAIKkf/7vcp3NVbZ3bDsvBq4QYKphcxvlX vOThO7TgJVhZbCg9u+mRhxMJVwYfmZDvK5L2qXUmyfHTR7fYq228d+qkhrfwcRxRa4fDrI CLY+KryR7Dkw9EzCWqSQi7pPGzgpa+NbLxiVg4yo6hsmLhSFiQ8/g4YVTJUOXo+zYSgSoR I+/nYrO9QgtjJ3r+u3q16nHGwi3uxMxqiA0G8xXHuV8MVfjC58bpxYJ9SoZZJEfci9vuG9 ddv0bcRT8DtuOZDq1sjBcGKU4JAgC6lBqG6VgellUZ4n2oxfgymsj4Qd6UrlIw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1716625856; a=rsa-sha256; cv=none; b=X8cXg+t3FV/Oy0YTtNcKN9oSvSza89wR48DLuBw8I9x0svS+fIENuM1sA+qWlLnnoIYrBg nDfDBBa07culeHoKpPIu4LdQFskSJMYkYJUdjQNV1Hcomy9seIu4e6g+IQDPOMEiftD35D l8uLIdgtSXJFC6lhR87SJvZyIMnDgCfsz9GFwzkzM4TTqesa73iV1tjjdmIcQ+FtP5a8FZ pXOkSy+fU1h2gyNIZU6St2MFBrTaVWfSJvLFr05A5J7B1TkZzX6j3wRXaCLWtHhbmjAIb/ vVUM62p3gV3Jy5zY3dP+BzJnaRxyJqT1HYzXAmPaQZ2qP2/jqtScvpD/C78jzw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1716625856; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Zv5kUpnPcZVI9RP13B9Wl/WwuCAKILpVihHlihw583k=; b=JJRRuWqvPvaY9dB0UL8ysGLJu5vHvslargwj2vlg1GflPTt24M3nzAO0puyWQQaHqcbSS/ awQ1bS+aJQTSJYKM3aqwAdjkVAZTKQg3PascxNffYm/8d4hJXYouOEqW69PhRdIdo69sQf fJqxy1czBmh7PWTv5FhIRP96KObyYpJZ+O/LsZjhgXjNBP0jNLNKZqj+C33hET/dB6sXAf kryvDGlquB+WGSWsxJOU4whGVS5cJg9ULwaN3tVFjtWxO10Rww0dtOj4H2xIYR1F4KB+Wx 723nvPlmOf0PzBVbcEw7PxsawD7f1icqPthN0sOuw+0zsiCSgIQLEcGl1VUfUA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4VmZqg6nSgz18sf; Sat, 25 May 2024 08:30:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 44P8Utmc027663; Sat, 25 May 2024 08:30:55 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 44P8Utfg027660; Sat, 25 May 2024 08:30:55 GMT (envelope-from git) Date: Sat, 25 May 2024 08:30:55 GMT Message-Id: <202405250830.44P8Utfg027660@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Michael Tuexen Subject: git: 02d15215cef2 - main - tcp: improve blackhole support List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: tuexen X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 02d15215cef2a28f1865e6ad5b19f18af1398b8b Auto-Submitted: auto-generated The branch main has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=02d15215cef2a28f1865e6ad5b19f18af1398b8b commit 02d15215cef2a28f1865e6ad5b19f18af1398b8b Author: Michael Tuexen AuthorDate: 2024-05-24 04:59:13 +0000 Commit: Michael Tuexen CommitDate: 2024-05-24 04:59:13 +0000 tcp: improve blackhole support There are two improvements to the TCP blackhole support: (1) If net.inet.tcp.blackhole is set to 2, also sent no RST whenever a segment is received on an existing closed socket or if there is a port mismatch when using UDP encapsulation. (2) If net.inet.tcp.blackhole is set to 3, no RST segment is sent in response to incoming segments on closed sockets or in response to unexpected segments on listening sockets. Thanks to gallatin@ for suggesting such an improvement. Reviewed by: gallatin MFC after: 1 week Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D45304 --- share/man/man4/blackhole.4 | 10 +++++++--- sys/netinet/tcp_input.c | 43 +++++++++++++++++++------------------------ 2 files changed, 26 insertions(+), 27 deletions(-) diff --git a/share/man/man4/blackhole.4 b/share/man/man4/blackhole.4 index 090f330a6ed8..bb955fd4497d 100644 --- a/share/man/man4/blackhole.4 +++ b/share/man/man4/blackhole.4 @@ -10,7 +10,7 @@ .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" -.Dd May 22, 2024 +.Dd May 25, 2024 .Dt BLACKHOLE 4 .Os .Sh NAME @@ -21,7 +21,7 @@ MIB for manipulating behaviour in respect of refused SCTP, TCP, or UDP connectio attempts .Sh SYNOPSIS .Cd sysctl net.inet.sctp.blackhole Ns Op = Ns Brq "0 | 1 | 2" -.Cd sysctl net.inet.tcp.blackhole Ns Op = Ns Brq "0 | 1 | 2" +.Cd sysctl net.inet.tcp.blackhole Ns Op = Ns Brq "0 | 1 | 2 | 3" .Cd sysctl net.inet.tcp.blackhole_local Ns Op = Ns Brq "0 | 1" .Cd sysctl net.inet.udp.blackhole Ns Op = Ns Brq "0 | 1" .Cd sysctl net.inet.udp.blackhole_local Ns Op = Ns Brq "0 | 1" @@ -30,7 +30,8 @@ The .Nm .Xr sysctl 8 MIB is used to control system behaviour when connection requests -are received on SCTP, TCP, or UDP ports where there is no socket listening. +are received on SCTP, TCP, or UDP ports where there is no socket listening +or unexpected packets are received on listening sockets. .Pp The blackhole behaviour is useful to slow down an attacker who is port-scanning a system in an attempt to detect vulnerable services. @@ -61,6 +62,9 @@ is merely dropped, and no RST is sent, making the system appear as a blackhole. By setting the MIB value to two, any segment arriving on a closed port is dropped without returning a RST. +Setting the MIB value to three, any segment arriving on a closed port +or an unexpected segment on a listening port is dropped without sending a +RST in reply. This provides some degree of protection against stealth port scans. .Ss UDP Enabling blackhole behaviour turns off the sending diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c index 56327bd99cd7..08ff84039c90 100644 --- a/sys/netinet/tcp_input.c +++ b/sys/netinet/tcp_input.c @@ -915,23 +915,6 @@ findpcb: log(LOG_INFO, "%s; %s: Connection attempt " "to closed port\n", s, __func__); } - /* - * When blackholing do not respond with a RST but - * completely ignore the segment and drop it. - */ - if (((V_blackhole == 1 && (thflags & TH_SYN)) || - V_blackhole == 2) && (V_blackhole_local || ( -#ifdef INET6 - isipv6 ? !in6_localaddr(&ip6->ip6_src) : -#endif -#ifdef INET - !in_localip(ip->ip_src) -#else - true -#endif - ))) - goto dropunlock; - rstreason = BANDLIM_RST_CLOSEDPORT; goto dropwithreset; } @@ -1410,15 +1393,27 @@ tfo_socket_result: return (IPPROTO_DONE); dropwithreset: + /* + * When blackholing do not respond with a RST but + * completely ignore the segment and drop it. + */ + if (((rstreason == BANDLIM_RST_OPENPORT && V_blackhole == 3) || + (rstreason == BANDLIM_RST_CLOSEDPORT && + ((V_blackhole == 1 && (thflags & TH_SYN)) || V_blackhole > 1))) && + (V_blackhole_local || ( +#ifdef INET6 + isipv6 ? !in6_localaddr(&ip6->ip6_src) : +#endif +#ifdef INET + !in_localip(ip->ip_src) +#else + true +#endif + ))) + goto dropunlock; TCP_PROBE5(receive, NULL, tp, m, tp, th); - - if (inp != NULL) { - tcp_dropwithreset(m, th, tp, tlen, rstreason); - INP_UNLOCK(inp); - } else - tcp_dropwithreset(m, th, NULL, tlen, rstreason); + tcp_dropwithreset(m, th, tp, tlen, rstreason); m = NULL; /* mbuf chain got consumed. */ - goto drop; dropunlock: if (m != NULL)