From nobody Wed Feb 12 10:24:05 2025 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YtDtt08pFz5mXCn; Wed, 12 Feb 2025 10:24:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YtDts6WL1z3Zs4; Wed, 12 Feb 2025 10:24:05 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1739355845; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=N+QST/g8t9caDO8ZIsNh3Z3oIi7p0KJxh9ogDfBPSK8=; b=PZBZ7KpT92ZgWme2jAwt6RhNiZUXi+jW3MyN2t7sE+5RpMe9uIDsID64RC5uKNmYEadZGd wat7bHHlcg2zrt7AhufKyYh3Ak0fnAjj1oyMhnNcJAHZZ9/nYskLUWI9uz7e+e1DTyGCWW OaXh5SJI95Pzoc5fFOXFetv5hcUOn4qnLNzL1aSnskpighbfCTS+WRbK8qPtcST3aagEKA 2M1HaK+UA8cpHepZuUUzxQ7byzLyGWAwfe7OTS8V16ziUSAy0jJKRp2YLgn7P9dTAK/gRv mCwZT9l3F5G474gMU9oGhOzmbMCb2YuYzxOuPGCx3i+vzxO2CWRAVLVSWBQ67Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1739355845; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=N+QST/g8t9caDO8ZIsNh3Z3oIi7p0KJxh9ogDfBPSK8=; b=Fk85EQHccXcZ1xBPO4m+wtzuuo4I0AeKQKFtso8e2eBc9toDx5G8DI25uOGzJ5kPkiwVBD RlUbAu9rzeH4yWiuGUO61V3S0clg8pXuLStlzQYIJ+5bAd5yLUz/DAmxEb9u4CBsvKNhMv DrOPVJIuJPyiDQYNYOMeGtW/8GfZ0yUAdZmGHTYedLxOI+mMgr4vmZ7mTrNiCUhJ0B52wb PGydT3l0FnzIuXdQGYXsCvCZKMS3UOa6ztRaKkcwREmJ8t1R3DhIKAhQE7gLaCKFglUrWF xnPFNNVEqFn2QmzOy/btiqvCduJDw9E1aPjkeJHzbOnna5Lzku5BDHwKdJJknQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1739355845; a=rsa-sha256; cv=none; b=JzfEhpPFdsgdmpzKNEFqirQh6rLuDaZWIQUoBWZHsGJxblG0CHzvtfCVJJscZgE/GjYhhv EvnrxS8PU+2nzmkq51tSdF5vg8eaWBvyYwuqYB+yZ+T+MPDU1ENfUoU7hVMrf7+HquZJrX Do37RLmzjTEol32lBXUItmEmMwIZGgG8dWQ5R+Wxv+Ek0yPBOUSPQlNSvf3irOChfZ2WAM 6nrWdaZTIsYby0pDVCefX8EeRHS9C1A7WZVYVnGvhiI2O+CrCisWtzZWMQfY+VWOtzemep rE8cLWwhSif6fwfHn9NDoOSlm889aFMRlGTee5P5KA+f/9G34UZXKnte41XdAg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YtDts65nVzvXK; Wed, 12 Feb 2025 10:24:05 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 51CAO5dA029852; Wed, 12 Feb 2025 10:24:05 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 51CAO56d029849; Wed, 12 Feb 2025 10:24:05 GMT (envelope-from git) Date: Wed, 12 Feb 2025 10:24:05 GMT Message-Id: <202502121024.51CAO56d029849@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Michael Tuexen Subject: git: 18058544c65b - stable/13 - icmp: improve ICMP limit jitter List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: tuexen X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 18058544c65b83fffca9556d6d082e823585ef3d Auto-Submitted: auto-generated The branch stable/13 has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=18058544c65b83fffca9556d6d082e823585ef3d commit 18058544c65b83fffca9556d6d082e823585ef3d Author: Gleb Smirnoff AuthorDate: 2024-03-24 16:13:23 +0000 Commit: Michael Tuexen CommitDate: 2025-02-12 10:23:36 +0000 icmp: improve ICMP limit jitter Instead of fixing up invalid values set by a user in badport_bandlim() which is a fast path function, provide a sysctl handler sysctl_icmplim_and_jitter(), that will check that jitter is less than the limit. Provide jitter initilization function icmplim_new_jitter() used at boot, in the sysctl handler and when we actually hit the limit. This also fixes no jitter on a fresh booted system until first limit hit. Instead of CVE number provide link the the actual paper that explains what and why we are doing here. The CVE number isn't very informative, it will just tell you what RedHat version you need to upgrade to. Reviewed by: kp, tuexen, zlei Differential Revision: https://reviews.freebsd.org/D44478 (cherry picked from commit ac44739fd834f51cacb26485a4140fd482e20150) --- sys/netinet/ip_icmp.c | 81 +++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 59 insertions(+), 22 deletions(-) diff --git a/sys/netinet/ip_icmp.c b/sys/netinet/ip_icmp.c index 199b76aa9ad6..0d671033b67c 100644 --- a/sys/netinet/ip_icmp.c +++ b/sys/netinet/ip_icmp.c @@ -81,19 +81,22 @@ * routines to turnaround packets back to the originator, and * host table maintenance routines. */ -VNET_DEFINE_STATIC(int, icmplim) = 200; +static int sysctl_icmplim_and_jitter(SYSCTL_HANDLER_ARGS); +VNET_DEFINE_STATIC(u_int, icmplim) = 200; #define V_icmplim VNET(icmplim) -SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_VNET | CTLFLAG_RW, - &VNET_NAME(icmplim), 0, - "Maximum number of ICMP responses per second"); +SYSCTL_PROC(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLTYPE_UINT | + CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(icmplim), 0, + &sysctl_icmplim_and_jitter, "IU", + "Maximum number of ICMP responses per second"); VNET_DEFINE_STATIC(int, icmplim_curr_jitter) = 0; #define V_icmplim_curr_jitter VNET(icmplim_curr_jitter) -VNET_DEFINE_STATIC(int, icmplim_jitter) = 16; +VNET_DEFINE_STATIC(u_int, icmplim_jitter) = 16; #define V_icmplim_jitter VNET(icmplim_jitter) -SYSCTL_INT(_net_inet_icmp, OID_AUTO, icmplim_jitter, CTLFLAG_VNET | CTLFLAG_RW, - &VNET_NAME(icmplim_jitter), 0, - "Random icmplim jitter adjustment limit"); +SYSCTL_PROC(_net_inet_icmp, OID_AUTO, icmplim_jitter, CTLTYPE_UINT | + CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(icmplim_jitter), 0, + &sysctl_icmplim_and_jitter, "IU", + "Random icmplim jitter adjustment limit"); VNET_DEFINE_STATIC(int, icmplim_output) = 1; #define V_icmplim_output VNET(icmplim_output) @@ -1098,6 +1101,52 @@ static const char *icmp_rate_descrs[BANDLIM_MAX] = { [BANDLIM_SCTP_OOTB] = "sctp ootb", }; +static void +icmplim_new_jitter(void) +{ + /* + * Adjust limit +/- to jitter the measurement to deny a side-channel + * port scan as in https://dl.acm.org/doi/10.1145/3372297.3417280 + */ + if (V_icmplim_jitter > 0) + V_icmplim_curr_jitter = + arc4random_uniform(V_icmplim_jitter * 2 + 1) - + V_icmplim_jitter; +} + +static int +sysctl_icmplim_and_jitter(SYSCTL_HANDLER_ARGS) +{ + uint32_t new; + int error; + bool lim; + + MPASS(oidp->oid_arg1 == &VNET_NAME(icmplim) || + oidp->oid_arg1 == &VNET_NAME(icmplim_jitter)); + + lim = (oidp->oid_arg1 == &VNET_NAME(icmplim)); + new = lim ? V_icmplim : V_icmplim_jitter; + error = sysctl_handle_int(oidp, &new, 0, req); + if (error == 0 && req->newptr) { + if (lim) { + if (new <= V_icmplim_jitter) + error = EINVAL; + else + V_icmplim = new; + } else { + if (new >= V_icmplim) + error = EINVAL; + else { + V_icmplim_jitter = new; + icmplim_new_jitter(); + } + } + } + MPASS(V_icmplim + V_icmplim_curr_jitter > 0); + + return (error); +} + static void icmp_bandlimit_init(void) { @@ -1106,6 +1155,7 @@ icmp_bandlimit_init(void) V_icmp_rates[i].cr_rate = counter_u64_alloc(M_WAITOK); V_icmp_rates[i].cr_ticks = ticks; } + icmplim_new_jitter(); } VNET_SYSINIT(icmp_bandlimit, SI_SUB_PROTO_DOMAIN, SI_ORDER_ANY, icmp_bandlimit_init, NULL); @@ -1133,9 +1183,6 @@ badport_bandlim(int which) KASSERT(which >= 0 && which < BANDLIM_MAX, ("%s: which %d", __func__, which)); - if ((V_icmplim + V_icmplim_curr_jitter) <= 0) - V_icmplim_curr_jitter = -V_icmplim + 1; - pps = counter_ratecheck(&V_icmp_rates[which], V_icmplim + V_icmplim_curr_jitter); if (pps > 0) { @@ -1144,17 +1191,7 @@ badport_bandlim(int which) "Limiting %s response from %jd to %d packets/sec\n", icmp_rate_descrs[which], (intmax_t )pps, V_icmplim + V_icmplim_curr_jitter); - /* - * Adjust limit +/- to jitter the measurement to deny a - * side-channel port scan as in CVE-2020-25705 - */ - if (V_icmplim_jitter > 0) { - int32_t inc = - arc4random_uniform(V_icmplim_jitter * 2 +1) - - V_icmplim_jitter; - - V_icmplim_curr_jitter = inc; - } + icmplim_new_jitter(); } if (pps == -1) return (-1);