2 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 4. Neither the name of the University nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 #include "opt_inet6.h"
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
37 #include <sys/param.h>
38 #include <sys/kernel.h>
39 #include <sys/libkern.h>
43 #include <sys/random.h>
44 #include <sys/socket.h>
45 #include <sys/socketvar.h>
46 #include <sys/systm.h>
48 #include <sys/vimage.h>
51 #include <net/if_types.h>
53 #include <net/route.h>
55 #include <netinet/in.h>
56 #include <netinet/in_var.h>
57 #include <netinet/in_systm.h>
58 #include <netinet/ip.h>
59 #include <netinet/ip_var.h>
60 #include <netinet/tcp.h>
61 #include <netinet/tcp_seq.h>
62 #include <netinet/udp.h>
63 #include <netinet/ip_icmp.h>
64 #include <netinet/in_pcb.h>
65 #include <netinet/tcp_timer.h>
66 #include <netinet/tcp_var.h>
67 #include <netinet/if_ether.h>
68 #include <netinet/vinet.h>
69 #include <net/pfvar.h>
72 * Following is where TCP initial sequence number generation occurs.
74 * There are two places where we must use initial sequence numbers:
75 * 1. In SYN-ACK packets.
78 * All ISNs for SYN-ACK packets are generated by the syncache. See
79 * tcp_syncache.c for details.
81 * The ISNs in SYN packets must be monotonic; TIME_WAIT recycling
82 * depends on this property. In addition, these ISNs should be
83 * unguessable so as to prevent connection hijacking. To satisfy
84 * the requirements of this situation, the algorithm outlined in
85 * RFC 1948 is used, with only small modifications.
87 * Implementation details:
89 * Time is based off the system timer, and is corrected so that it
90 * increases by one megabyte per second. This allows for proper
91 * recycling on high speed LANs while still leaving over an hour
94 * As reading the *exact* system time is too expensive to be done
95 * whenever setting up a TCP connection, we increment the time
96 * offset in two ways. First, a small random positive increment
97 * is added to isn_offset for each connection that is set up.
98 * Second, the function tcp_isn_tick fires once per clock tick
99 * and increments isn_offset as necessary so that sequence numbers
100 * are incremented at approximately ISN_BYTES_PER_SECOND. The
101 * random positive increments serve only to ensure that the same
102 * exact sequence number is never sent out twice (as could otherwise
103 * happen when a port is recycled in less than the system tick
106 * net.inet.tcp.isn_reseed_interval controls the number of seconds
107 * between seeding of isn_secret. This is normally set to zero,
108 * as reseeding should not be necessary.
110 * Locking of the global variables isn_secret, isn_last_reseed, isn_offset,
111 * isn_offset_old, and isn_ctx is performed using the TCP pcbinfo lock. In
112 * general, this means holding an exclusive (write) lock.
115 #define ISN_BYTES_PER_SECOND 1048576
116 #define ISN_STATIC_INCREMENT 4096
117 #define ISN_RANDOM_INCREMENT (4096 - 1)
119 static u_char pf_isn_secret[32];
120 static int pf_isn_last_reseed;
121 static u_int32_t pf_isn_offset;
124 pf_new_isn(struct pf_state *s)
127 u_int32_t md5_buffer[4];
129 struct pf_state_host *src, *dst;
131 /* Seed if this is the first use, reseed if requested. */
132 if (pf_isn_last_reseed == 0) {
133 read_random(&pf_isn_secret, sizeof(pf_isn_secret));
134 pf_isn_last_reseed = ticks;
137 if (s->direction == PF_IN) {
145 /* Compute the md5 hash and return the ISN. */
147 MD5Update(&isn_ctx, (u_char *) &dst->port, sizeof(u_short));
148 MD5Update(&isn_ctx, (u_char *) &src->port, sizeof(u_short));
150 if (s->af == AF_INET6) {
151 MD5Update(&isn_ctx, (u_char *) &dst->addr,
152 sizeof(struct in6_addr));
153 MD5Update(&isn_ctx, (u_char *) &src->addr,
154 sizeof(struct in6_addr));
158 MD5Update(&isn_ctx, (u_char *) &dst->addr,
159 sizeof(struct in_addr));
160 MD5Update(&isn_ctx, (u_char *) &src->addr,
161 sizeof(struct in_addr));
163 MD5Update(&isn_ctx, (u_char *) &pf_isn_secret, sizeof(pf_isn_secret));
164 MD5Final((u_char *) &md5_buffer, &isn_ctx);
165 new_isn = (tcp_seq) md5_buffer[0];
166 pf_isn_offset += ISN_STATIC_INCREMENT +
167 (arc4random() & ISN_RANDOM_INCREMENT);
168 new_isn += pf_isn_offset;