From nobody Fri Nov 12 17:07:24 2021 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 1A360184BDDF; Fri, 12 Nov 2021 17:07:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4HrQ4Z324Qz3rQq; Fri, 12 Nov 2021 17:07:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 01D3723409; Fri, 12 Nov 2021 17:07:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 1ACH7OPk082597; Fri, 12 Nov 2021 17:07:24 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 1ACH7ORv082596; Fri, 12 Nov 2021 17:07:24 GMT (envelope-from git) Date: Fri, 12 Nov 2021 17:07:24 GMT Message-Id: <202111121707.1ACH7ORv082596@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Gleb Smirnoff Subject: git: 2ce85919bbba - main - Add net.inet.ip.source_address_validation List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: glebius X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 2ce85919bbba9e29ee85508abb4ba0c662c2b080 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by glebius: URL: https://cgit.FreeBSD.org/src/commit/?id=2ce85919bbba9e29ee85508abb4ba0c662c2b080 commit 2ce85919bbba9e29ee85508abb4ba0c662c2b080 Author: Gleb Smirnoff AuthorDate: 2021-11-12 17:00:33 +0000 Commit: Gleb Smirnoff CommitDate: 2021-11-12 17:00:33 +0000 Add net.inet.ip.source_address_validation Drop packets arriving from the network that have our source IP address. If maliciously crafted they can create evil effects like an RST exchange between two of our listening TCP ports. Such packets just can't be legitimate. Enable the tunable by default. Long time due for a modern Internet host. Reviewed by: donner, melifaro Differential revision: https://reviews.freebsd.org/D32914 --- share/man/man4/inet.4 | 8 ++++++++ sys/netinet/ip_input.c | 16 ++++++++++++++++ 2 files changed, 24 insertions(+) diff --git a/share/man/man4/inet.4 b/share/man/man4/inet.4 index 7a8a653dff25..dbab301302b1 100644 --- a/share/man/man4/inet.4 +++ b/share/man/man4/inet.4 @@ -219,6 +219,14 @@ or destination address rewriting .Xr pfil 4 filters may override and bypass this check. Disabled by default. +.It Va ip.source_address_validation +Boolean: perform source address validation for packets destined for the local +host. +Consider this as following Section 3.2 of RFC3704/BCP84, where we treat local +host as our own infrastructure. +This has no effect on packets to be forwarded, so don't consider it as +anti-spoof feature for a router. +Enabled by default. .It Va ip.rfc6864 Boolean: control IP IDs generation behaviour. True value enables RFC6864 support, which specifies that IP ID field of diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c index a678c15caad5..9db1f8c6f2e7 100644 --- a/sys/netinet/ip_input.c +++ b/sys/netinet/ip_input.c @@ -124,6 +124,12 @@ SYSCTL_BOOL(_net_inet_ip, OID_AUTO, rfc1122_strong_es, CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip_strong_es), false, "Packet's IP destination address must match address on arrival interface"); +VNET_DEFINE_STATIC(bool, ip_sav) = true; +#define V_ip_sav VNET(ip_sav) +SYSCTL_BOOL(_net_inet_ip, OID_AUTO, source_address_validation, + CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip_sav), true, + "Drop incoming packets with source address that is a local address"); + VNET_DEFINE(pfil_head_t, inet_pfil_head); /* Packet filter hooks */ static struct netisr_handler ip_nh = { @@ -683,6 +689,16 @@ passin: goto bad; } + /* + * net.inet.ip.source_address_validation: drop incoming + * packets that pretend to be ours. + */ + if (V_ip_sav && !(ifp->if_flags & IFF_LOOPBACK) && + __predict_false(in_localip_fib(ip->ip_src, ifp->if_fib))) { + IPSTAT_INC(ips_badaddr); + goto bad; + } + counter_u64_add(ia->ia_ifa.ifa_ipackets, 1); counter_u64_add(ia->ia_ifa.ifa_ibytes, m->m_pkthdr.len); goto ours;