From owner-freebsd-bugs@freebsd.org Sat Sep 12 09:38:32 2020 Return-Path: Delivered-To: freebsd-bugs@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 653313D1A43 for ; Sat, 12 Sep 2020 09:38:32 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mailman.nyi.freebsd.org (mailman.nyi.freebsd.org [IPv6:2610:1c1:1:606c::50:13]) by mx1.freebsd.org (Postfix) with ESMTP id 4BpSHD24rBz4dfB for ; Sat, 12 Sep 2020 09:38:32 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: by mailman.nyi.freebsd.org (Postfix) id 457F83D1A40; Sat, 12 Sep 2020 09:38:32 +0000 (UTC) Delivered-To: bugs@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 4546C3D1AAD for ; Sat, 12 Sep 2020 09:38:32 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4BpSHD16FZz4dl7 for ; Sat, 12 Sep 2020 09:38:32 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 0999912ACC for ; Sat, 12 Sep 2020 09:38:32 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 08C9cVkT074890 for ; Sat, 12 Sep 2020 09:38:31 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 08C9cVTf074889 for bugs@FreeBSD.org; Sat, 12 Sep 2020 09:38:31 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 249275] New netgraph nodetype: ng_antispoof Date: Sat, 12 Sep 2020 09:38:32 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 12.1-RELEASE X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: markus@stoffdv.at X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 12 Sep 2020 09:38:32 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D249275 Bug ID: 249275 Summary: New netgraph nodetype: ng_antispoof Product: Base System Version: 12.1-RELEASE Hardware: Any OS: Any Status: New Severity: Affects Only Me Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: markus@stoffdv.at Created attachment 217912 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D217912&action= =3Dedit New netgraph node type: ng_antispoof This introduces a new netgraph node type that prevents the upstream network from spoofing ethernet and IP addresses. It is called 'ng_antispoof' (name = is open for debate, of course). What it does: It validates the upstream address each packet against a set of rules. If at least one rule matches, the packet is passed through, otherwise it is block= ed. Each rule consists of a ethernet address and a IP or IPv6 address (in a simplified point of view). How it works: Each node provides three hooks: - 'filter': Where to connect the upstream node to be protected (e.g. a jail, a VM, ...). - 'downstream': Downstream node (e.g. a bridge device, the internet, ...). - 'nomatch': Useful for debugging with tcpdump. If connected, blocked traffic is forwarded on this hook instead of being discarded. This is output only, traffic arriving on this hook is immediately discarded. ___ +----------------+ __.( ).__ | | ( downstream )<------->| |=20=20=20=20=20=20=20=20=20 .._ ( ) _ _.. | | I=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3DI | ng_antispoof |<------->I filter I | | I=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3DI nomatch <-------------| |=20=20=20=20=20=20=20=20=20 | | +----------------+ Use Case: Prevent VNET jails from spoofing IP/MAC addresses while using pf(4) as the firewall on the host system. Example: Given a virtual network interface 'host_if' on the host system and 'jail_if= ' in a VNET enabled jail named 'malicious', restrict the jail to IP '192.168.1.4= 2' on the MAC '1a:00:de:ad:be:ef': # Create ng_antispoof node and wire everything together ngctl mkpeer jail_if: antispoof ether filter ngctl name jail_if:ether as ngctl connect as: host_if: downstream ether # Add filter rule ngctl msg as: addinet '{ ether=3D1a:00:de:ad:be:ef ip_addr=3D192.168.1.42= }' More Details: Currently filter rules for IP and IPv6 address types can be created. The maximum number of rules is 65535 (UINT16_MAX). # For IPv4, subnets can be provided in CIDR or netmask notation ngctl msg as: addinet '{ ether=3D0a:00:de:ad:be:ef ip_addr=3D192.168.1.42= }' ngctl msg as: addinet '{ ether=3D0a:00:de:ad:be:ef ip_addr=3D192.168.1.0/= 24 }' ngctl msg as: addinet '{ ether=3D0a:00:de:ad:be:ef ip_addr=3D192.168.1.0 ip_mask=3D255.255.255.0 }' # For IPv6, subnets can be provided in CIDR notation ngctl msg as: addinet6 '{ ether=3D0a:00:de:ad:be:ef ip6_addr=3D::1 }' ngctl msg as: addinet6 '{ ether=3D0a:00:de:ad:be:ef ip6_addr=3D1:2::/32 }' Open Questions: - Is it correct to add the IPv6 parsing type should be added to ng_parse? - Should the IPv4 and IPv6 prefix types for CIDR notation also go into ng_parse?=20 - What is the idiomatic way to provide tests for kernel modules? - Should VLAN tags be filtered as well (currently all VLAN tags are ignored= )? - Filtering only the outermost tag would probably be the sensible approach here? - Should a single rule filter a single VID, a range of VIDs or a list of (ranges) of VIDs? --=20 You are receiving this mail because: You are the assignee for the bug.=