[apple/xnu.git] / bsd / netinet / kpi_ipfilter.c

/*
 * Copyright (c) 2003 Apple Computer, Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 * 
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 * 
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 * 
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 * 
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */

#include <sys/param.h>	/* for definition of NULL */
#include <sys/errno.h>
#include <sys/malloc.h>
#include <sys/socket.h>
#include <sys/mbuf.h>
#include <sys/systm.h>

#define _IP_VHL
#include <net/if_var.h>
#include <net/route.h>
#include <net/kpi_protocol.h>

#include <netinet/in_systm.h>
#include <netinet/in.h>
#include <netinet/in_var.h>
#include <netinet6/in6_var.h>
#include <netinet/ip.h>
#include <netinet/ip6.h>
#include <netinet/ip_var.h>
#include <netinet6/ip6_var.h>
#include <netinet/kpi_ipfilter_var.h>

/*
 * kipf_lock and kipf_ref protect the linkage of the list of IP filters
 * An IP filter can be removed only when kipf_ref is zero
 * If an IP filter cannot be removed because kipf_ref is not null, then 
 * the IP filter is marjed and kipf_delayed_remove is set so that when 
 * kipf_ref eventually goes down to zero, the IP filter is removed
 */
static lck_mtx_t *kipf_lock = 0;
static unsigned long kipf_ref = 0;
static unsigned long kipf_delayed_remove = 0;

__private_extern__ struct ipfilter_list	ipv4_filters = TAILQ_HEAD_INITIALIZER(ipv4_filters);
__private_extern__ struct ipfilter_list	ipv6_filters = TAILQ_HEAD_INITIALIZER(ipv6_filters);
__private_extern__ struct ipfilter_list	tbr_filters = TAILQ_HEAD_INITIALIZER(tbr_filters);

__private_extern__ void
ipf_ref(void)
{
	lck_mtx_lock(kipf_lock);
    kipf_ref++;
	lck_mtx_unlock(kipf_lock);
}

__private_extern__ void
ipf_unref(void)
{
	lck_mtx_lock(kipf_lock);

    if (kipf_ref == 0)
    	panic("ipf_unref: kipf_ref == 0\n");
    	
    kipf_ref--;
    if (kipf_ref == 0 && kipf_delayed_remove != 0) {
    	struct ipfilter *filter;

		while ((filter = TAILQ_FIRST(&tbr_filters))) {
			ipf_detach_func ipf_detach = filter->ipf_filter.ipf_detach;
			void* cookie = filter->ipf_filter.cookie;
			
			TAILQ_REMOVE(filter->ipf_head, filter, ipf_link);
			TAILQ_REMOVE(&tbr_filters, filter, ipf_tbr);
			kipf_delayed_remove--;

			if (ipf_detach) {
				lck_mtx_unlock(kipf_lock);
				ipf_detach(cookie);
				lck_mtx_lock(kipf_lock);
				/* In case some filter got to run while we released the lock */
				if (kipf_ref != 0)
					break;
			}			
		}
   	} 
	lck_mtx_unlock(kipf_lock);
}

static errno_t
ipf_add(
	const struct ipf_filter* filter,
	ipfilter_t *filter_ref,
	struct ipfilter_list *head)
{
	struct ipfilter	*new_filter;
	if (filter->name == NULL || (filter->ipf_input == NULL && filter->ipf_output == NULL))
		return EINVAL;
	
	MALLOC(new_filter, struct ipfilter*, sizeof(*new_filter), M_IFADDR, M_WAITOK);
	if (new_filter == NULL)
		return ENOMEM;
	
	lck_mtx_lock(kipf_lock);
	new_filter->ipf_filter = *filter;
	new_filter->ipf_head = head;
	
	/*
	 * 3957298
	 * Make sure third parties have a chance to filter packets before
	 * SharedIP. Always SharedIP at the end of the list.
	 */
	if (filter->name != NULL &&
		strcmp(filter->name, "com.apple.nke.SharedIP") == 0) {
		TAILQ_INSERT_TAIL(head, new_filter, ipf_link);
	}
	else {
		TAILQ_INSERT_HEAD(head, new_filter, ipf_link);
	}
	
	lck_mtx_unlock(kipf_lock);
	
	*filter_ref = (ipfilter_t)new_filter;
	return 0;
}

errno_t
ipf_addv4(
	const struct ipf_filter* filter,
	ipfilter_t *filter_ref)
{
	return ipf_add(filter, filter_ref, &ipv4_filters);
}

errno_t
ipf_addv6(
	const struct ipf_filter* filter,
	ipfilter_t *filter_ref)
{
	return ipf_add(filter, filter_ref, &ipv6_filters);
}

errno_t
ipf_remove(
	ipfilter_t filter_ref)
{
	struct ipfilter	*match = (struct ipfilter*)filter_ref;
	struct ipfilter_list *head;
	
	if (match == 0 || (match->ipf_head != &ipv4_filters && match->ipf_head != &ipv6_filters))
		return EINVAL;
	
	head = match->ipf_head;
	
	lck_mtx_lock(kipf_lock);
	TAILQ_FOREACH(match, head, ipf_link) {
		if (match == (struct ipfilter*)filter_ref) {
			ipf_detach_func ipf_detach = match->ipf_filter.ipf_detach;
			void* cookie = match->ipf_filter.cookie;
			
			/*
			 * Cannot detach when they are filters running
			 */
			if (kipf_ref) {
				kipf_delayed_remove++;
				TAILQ_INSERT_TAIL(&tbr_filters, match, ipf_tbr);
				match->ipf_filter.ipf_input = 0;
				match->ipf_filter.ipf_output = 0;
				lck_mtx_unlock(kipf_lock);
			} else {
				TAILQ_REMOVE(head, match, ipf_link);
				lck_mtx_unlock(kipf_lock);
				if (ipf_detach)
					ipf_detach(cookie);
				FREE(match, M_IFADDR);
			}
			return 0;
		}
	}
	lck_mtx_unlock(kipf_lock);
	
	return ENOENT;
}

int log_for_en1 = 0;

errno_t
ipf_inject_input(
	mbuf_t data,
	ipfilter_t filter_ref)
{
	struct mbuf	*m = (struct mbuf*)data;
	struct m_tag *mtag = 0;
	struct ip *ip = mtod(m, struct ip *);
	u_int8_t	vers;
	int hlen;
	errno_t error = 0;
	protocol_family_t proto;

	vers = IP_VHL_V(ip->ip_vhl);
	
	switch (vers) {
		case 4:
			proto = PF_INET;
			break;
		case 6:
			proto = PF_INET6;
			break;
		default:
			error = ENOTSUP;
			goto done;
	}
	
	if (filter_ref == 0 && m->m_pkthdr.rcvif == 0) {
		m->m_pkthdr.rcvif = ifunit("lo0");
		m->m_pkthdr.csum_data = 0;
		m->m_pkthdr.csum_flags = 0;
		if (vers == 4) {
			hlen = IP_VHL_HL(ip->ip_vhl) << 2;
			ip->ip_sum = 0;
			ip->ip_sum = in_cksum(m, hlen);
		}
	}
	if (filter_ref != 0) {
		mtag = m_tag_alloc(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT,
					 	   sizeof (ipfilter_t), M_NOWAIT);
		if (mtag == NULL) {
			error = ENOMEM;
			goto done;
		}	
		*(ipfilter_t*)(mtag+1) = filter_ref;
		m_tag_prepend(m, mtag);
	}
	
	error = proto_inject(proto, data);

done:
	return error;
}

static errno_t
ipf_injectv4_out(
	mbuf_t data,
	ipfilter_t filter_ref,
	ipf_pktopts_t options)
{
	struct route ro;
	struct sockaddr_in	*sin = (struct sockaddr_in*)&ro.ro_dst;
	struct ip	*ip;
	struct mbuf	*m = (struct mbuf*)data;
	errno_t error = 0;
	struct m_tag *mtag = 0;
	struct ip_moptions *imo = 0, ip_moptions;
	
	/* Make the IP header contiguous in the mbuf */
	if ((size_t)m->m_len < sizeof(struct ip)) {
		m = m_pullup(m, sizeof(struct ip));
		if (m == NULL) return ENOMEM;
	}
	ip = (struct ip*)m_mtod(m);
	
	if (filter_ref != 0) {
		mtag = m_tag_alloc(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT,
					 	   sizeof (ipfilter_t), M_NOWAIT);
		if (mtag == NULL) {
			m_freem(m);
			return ENOMEM;
		}
		*(ipfilter_t*)(mtag+1) = filter_ref;
		m_tag_prepend(m, mtag);
	}
	
	if (options && (options->ippo_flags & IPPOF_MCAST_OPTS)) {
		imo = &ip_moptions;
		
		bzero(imo, sizeof(struct ip6_moptions));
		imo->imo_multicast_ifp = options->ippo_mcast_ifnet;
		imo->imo_multicast_ttl = options->ippo_mcast_ttl;
		imo->imo_multicast_loop = options->ippo_mcast_loop;
	}
	
	/* Fill out a route structure and get a route */
	bzero(&ro, sizeof(struct route));
	sin->sin_len = sizeof(struct sockaddr_in);
	sin->sin_family = AF_INET;
	sin->sin_port = 0;
	sin->sin_addr = ip->ip_dst;
	rtalloc(&ro);
	if (ro.ro_rt == NULL) {
		m_freem(m);
		return ENETUNREACH;
	}
	
	/* Put ip_len and ip_off in host byte order, ip_output expects that */
	NTOHS(ip->ip_len);
	NTOHS(ip->ip_off);
	
	/* Send  */
	error = ip_output(m, NULL, &ro, IP_ALLOWBROADCAST | IP_RAWOUTPUT, imo, NULL);
	
	/* Release the route */
	if (ro.ro_rt)
		rtfree(ro.ro_rt);
	
	return error;
}

#if INET6
static errno_t
ipf_injectv6_out(
	mbuf_t data,
	ipfilter_t filter_ref,
	ipf_pktopts_t options)
{
	struct route_in6 ro;
	struct sockaddr_in6	*sin6 = &ro.ro_dst;
	struct ip6_hdr	*ip6;
	struct mbuf	*m = (struct mbuf*)data;
	errno_t error = 0;
	struct m_tag *mtag = 0;
	struct ip6_moptions *im6o = 0, ip6_moptions;
	
	/* Make the IP header contiguous in the mbuf */
	if ((size_t)m->m_len < sizeof(struct ip6_hdr)) {
		m = m_pullup(m, sizeof(struct ip6_hdr));
		if (m == NULL) return ENOMEM;
	}
	ip6 = (struct ip6_hdr*)m_mtod(m);

	if (filter_ref != 0) {
		mtag = m_tag_alloc(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT,
					 	   sizeof (ipfilter_t), M_NOWAIT);
		if (mtag == NULL) {
			m_freem(m);
			return ENOMEM;
		}
		*(ipfilter_t*)(mtag+1) = filter_ref;
		m_tag_prepend(m, mtag);
	}
	
	if (options && (options->ippo_flags & IPPOF_MCAST_OPTS)) {
		im6o = &ip6_moptions;
		
		bzero(im6o, sizeof(struct ip6_moptions));
		im6o->im6o_multicast_ifp = options->ippo_mcast_ifnet;
		im6o->im6o_multicast_hlim = options->ippo_mcast_ttl;
		im6o->im6o_multicast_loop = options->ippo_mcast_loop;
	}
	
	
	/* Fill out a route structure and get a route */
	bzero(&ro, sizeof(struct route_in6));
	sin6->sin6_len = sizeof(struct sockaddr_in6);
	sin6->sin6_family = AF_INET6;
	sin6->sin6_addr = ip6->ip6_dst;
#if 0
	/* This is breaks loopback multicast! */
	/* The scope ID should already at s6_addr16[1] */
	if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
		/* Hack, pull the scope_id out of the dest addr */
		sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]);
		ip6->ip6_dst.s6_addr16[1] = 0;
	} else
		sin6->sin6_scope_id = 0;
#endif
	rtalloc((struct route*)&ro);
	if (ro.ro_rt == NULL) {
		m_freem(m);
		return ENETUNREACH;
	}
	
	/* Send  */
	error = ip6_output(m, NULL, &ro, 0, im6o, NULL, 0);
	
	/* Release the route */
	if (ro.ro_rt)
		rtfree(ro.ro_rt);
	
	return error;
}
#endif /* INET6 */

errno_t
ipf_inject_output(
	mbuf_t data,
	ipfilter_t filter_ref,
	ipf_pktopts_t options)
{
	struct mbuf	*m = (struct mbuf*)data;
	u_int8_t	vers;
	errno_t		error = 0;

	/* Make one byte of the header contiguous in the mbuf */
	if (m->m_len < 1) {
		m = m_pullup(m, 1);
		if (m == NULL) 
			goto done;
	}
	
	vers = (*(u_int8_t*)m_mtod(m)) >> 4;
	switch (vers)
	{
		case 4:
			error = ipf_injectv4_out(data, filter_ref, options);
			break;
#if INET6
		case 6:
			error = ipf_injectv6_out(data, filter_ref, options);
			break;
#endif
		default:
			m_freem(m);
			error = ENOTSUP;
			break;
	}

done:	
	return error;
}

__private_extern__ ipfilter_t
ipf_get_inject_filter(struct mbuf *m)
{
	ipfilter_t filter_ref = 0;
	struct m_tag *mtag;
	
	mtag = m_tag_locate(m, KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT, NULL);
	if (mtag) {
		filter_ref = *(ipfilter_t *)(mtag+1);
		
		m_tag_delete(m, mtag);
	}
	return filter_ref;
}

__private_extern__ int
ipf_init(void)
{
	int error = 0;
	lck_grp_attr_t *grp_attributes = 0;
	lck_attr_t *lck_attributes = 0;
	lck_grp_t *lck_grp = 0;
	
	grp_attributes = lck_grp_attr_alloc_init();
	if (grp_attributes == 0) {
		printf("ipf_init: lck_grp_attr_alloc_init failed\n");
		error = ENOMEM;
		goto done;
	}
	
	lck_grp = lck_grp_alloc_init("IP Filter", grp_attributes);
	if (lck_grp == 0) {
		printf("ipf_init: lck_grp_alloc_init failed\n");
		error = ENOMEM;
		goto done;
	}
	
	lck_attributes = lck_attr_alloc_init();
	if (lck_attributes == 0) {
		printf("ipf_init: lck_attr_alloc_init failed\n");
		error = ENOMEM;
		goto done;
	}
	
	kipf_lock = lck_mtx_alloc_init(lck_grp, lck_attributes);
	if (kipf_lock == 0) {
		printf("ipf_init: lck_mtx_alloc_init failed\n");
		error = ENOMEM;
		goto done;
	}
	done:
	if (error != 0) {
		if (kipf_lock) {
			lck_mtx_free(kipf_lock, lck_grp);
			kipf_lock = 0;
		}
	}
	if (lck_grp) {
		lck_grp_free(lck_grp);
		lck_grp = 0;
	}
	if (grp_attributes) {
		lck_grp_attr_free(grp_attributes);
		grp_attributes = 0;
	}
	if (lck_attributes) {
		lck_attr_free(lck_attributes);
		lck_attributes = 0;
	}
	
	return error;
}
Commit	Line	Data
91447636	1	/*
5d5c5d0d A	2	* Copyright (c) 2003 Apple Computer, Inc. All rights reserved.
5d5c5d0d A	3	*
2d21ac55	4	* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
91447636	5	*
2d21ac55 A	6	* This file contains Original Code and/or Modifications of Original Code
	7	* as defined in and that are subject to the Apple Public Source License
	8	* Version 2.0 (the 'License'). You may not use this file except in
	9	* compliance with the License. The rights granted to you under the License
	10	* may not be used to create, or enable the creation or redistribution of,
	11	* unlawful or unlicensed copies of an Apple operating system, or to
	12	* circumvent, violate, or enable the circumvention or violation of, any
	13	* terms of an Apple operating system software license agreement.
8f6c56a5	14	*
2d21ac55 A	15	* Please obtain a copy of the License at
	16	* http://www.opensource.apple.com/apsl/ and read it before using this file.
	17	*
	18	* The Original Code and all software distributed under the License are
	19	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
8f6c56a5 A	20	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
8f6c56a5 A	21	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
2d21ac55 A	22	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
	23	* Please see the License for the specific language governing rights and
	24	* limitations under the License.
8f6c56a5	25	*
2d21ac55	26	* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
91447636 A	27	*/
	28
	29	#include <sys/param.h> /* for definition of NULL */
	30	#include <sys/errno.h>
	31	#include <sys/malloc.h>
	32	#include <sys/socket.h>
	33	#include <sys/mbuf.h>
	34	#include <sys/systm.h>
	35
	36	#define _IP_VHL
	37	#include <net/if_var.h>
	38	#include <net/route.h>
	39	#include <net/kpi_protocol.h>
	40
	41	#include <netinet/in_systm.h>
	42	#include <netinet/in.h>
	43	#include <netinet/in_var.h>
	44	#include <netinet6/in6_var.h>
	45	#include <netinet/ip.h>
	46	#include <netinet/ip6.h>
	47	#include <netinet/ip_var.h>
	48	#include <netinet6/ip6_var.h>
	49	#include <netinet/kpi_ipfilter_var.h>
	50
	51	/*
	52	* kipf_lock and kipf_ref protect the linkage of the list of IP filters
	53	* An IP filter can be removed only when kipf_ref is zero
	54	* If an IP filter cannot be removed because kipf_ref is not null, then
	55	* the IP filter is marjed and kipf_delayed_remove is set so that when
	56	* kipf_ref eventually goes down to zero, the IP filter is removed
	57	*/
	58	static lck_mtx_t *kipf_lock = 0;
	59	static unsigned long kipf_ref = 0;
	60	static unsigned long kipf_delayed_remove = 0;
	61
	62	__private_extern__ struct ipfilter_list ipv4_filters = TAILQ_HEAD_INITIALIZER(ipv4_filters);
	63	__private_extern__ struct ipfilter_list ipv6_filters = TAILQ_HEAD_INITIALIZER(ipv6_filters);
	64	__private_extern__ struct ipfilter_list tbr_filters = TAILQ_HEAD_INITIALIZER(tbr_filters);
	65
	66	__private_extern__ void
	67	ipf_ref(void)
	68	{
	69	lck_mtx_lock(kipf_lock);
	70	kipf_ref++;
	71	lck_mtx_unlock(kipf_lock);
	72	}
	73
	74	__private_extern__ void
	75	ipf_unref(void)
	76	{
	77	lck_mtx_lock(kipf_lock);
	78
	79	if (kipf_ref == 0)
	80	panic("ipf_unref: kipf_ref == 0\n");
	81
	82	kipf_ref--;
	83	if (kipf_ref == 0 && kipf_delayed_remove != 0) {
	84	struct ipfilter *filter;
	85
	86	while ((filter = TAILQ_FIRST(&tbr_filters))) {
	87	ipf_detach_func ipf_detach = filter->ipf_filter.ipf_detach;
	88	void* cookie = filter->ipf_filter.cookie;
	89
	90	TAILQ_REMOVE(filter->ipf_head, filter, ipf_link);
91	TAILQ_REMOVE(&tbr_filters, filter, ipf_tbr);
92	kipf_delayed_remove--;
93
94	if (ipf_detach) {
95	lck_mtx_unlock(kipf_lock);
96	ipf_detach(cookie);
97	lck_mtx_lock(kipf_lock);
98	/* In case some filter got to run while we released the lock */
99	if (kipf_ref != 0)
100	break;
101	}
102	}
103	}
104	lck_mtx_unlock(kipf_lock);
105	}
106
107	static errno_t
108	ipf_add(
109	const struct ipf_filter* filter,
110	ipfilter_t *filter_ref,
111	struct ipfilter_list *head)
112	{
113	struct ipfilter *new_filter;
114	if (filter->name == NULL \|\| (filter->ipf_input == NULL && filter->ipf_output == NULL))
115	return EINVAL;
116
117	MALLOC(new_filter, struct ipfilter, sizeof(new_filter), M_IFADDR, M_WAITOK);
118	if (new_filter == NULL)
119	return ENOMEM;
120
121	lck_mtx_lock(kipf_lock);
122	new_filter->ipf_filter = *filter;
123	new_filter->ipf_head = head;
124
125	/*
126	* 3957298
127	* Make sure third parties have a chance to filter packets before
128	* SharedIP. Always SharedIP at the end of the list.
129	*/
130	if (filter->name != NULL &&
131	strcmp(filter->name, "com.apple.nke.SharedIP") == 0) {
132	TAILQ_INSERT_TAIL(head, new_filter, ipf_link);
133	}
134	else {
135	TAILQ_INSERT_HEAD(head, new_filter, ipf_link);
136	}
137
138	lck_mtx_unlock(kipf_lock);
139
140	*filter_ref = (ipfilter_t)new_filter;
141	return 0;
142	}
143
144	errno_t
145	ipf_addv4(
146	const struct ipf_filter* filter,
147	ipfilter_t *filter_ref)
148	{
149	return ipf_add(filter, filter_ref, &ipv4_filters);
150	}
151
152	errno_t
153	ipf_addv6(
154	const struct ipf_filter* filter,
155	ipfilter_t *filter_ref)
156	{
157	return ipf_add(filter, filter_ref, &ipv6_filters);
158	}
159
160	errno_t
161	ipf_remove(
162	ipfilter_t filter_ref)
163	{
164	struct ipfilter match = (struct ipfilter)filter_ref;
165	struct ipfilter_list *head;
166
167	if (match == 0 \|\| (match->ipf_head != &ipv4_filters && match->ipf_head != &ipv6_filters))
168	return EINVAL;
169
170	head = match->ipf_head;
171
172	lck_mtx_lock(kipf_lock);
173	TAILQ_FOREACH(match, head, ipf_link) {
174	if (match == (struct ipfilter*)filter_ref) {
175	ipf_detach_func ipf_detach = match->ipf_filter.ipf_detach;
176	void* cookie = match->ipf_filter.cookie;
177
178	/*
179	* Cannot detach when they are filters running
180	*/
181	if (kipf_ref) {
182	kipf_delayed_remove++;
183	TAILQ_INSERT_TAIL(&tbr_filters, match, ipf_tbr);
184	match->ipf_filter.ipf_input = 0;
185	match->ipf_filter.ipf_output = 0;
186	lck_mtx_unlock(kipf_lock);
187	} else {
188	TAILQ_REMOVE(head, match, ipf_link);
189	lck_mtx_unlock(kipf_lock);
190	if (ipf_detach)
191	ipf_detach(cookie);
192	FREE(match, M_IFADDR);
193	}
194	return 0;
195	}
196	}
197	lck_mtx_unlock(kipf_lock);
198
199	return ENOENT;
200	}
201
202	int log_for_en1 = 0;
203
204	errno_t
205	ipf_inject_input(
206	mbuf_t data,
207	ipfilter_t filter_ref)
208	{
209	struct mbuf m = (struct mbuf)data;
210	struct m_tag *mtag = 0;
211	struct ip ip = mtod(m, struct ip );
212	u_int8_t vers;
213	int hlen;
214	errno_t error = 0;
215	protocol_family_t proto;
216
217	vers = IP_VHL_V(ip->ip_vhl);
218
219	switch (vers) {
220	case 4:
221	proto = PF_INET;
222	break;
223	case 6:
224	proto = PF_INET6;
225	break;
226	default:
227	error = ENOTSUP;
228	goto done;
229	}
230
231	if (filter_ref == 0 && m->m_pkthdr.rcvif == 0) {
232	m->m_pkthdr.rcvif = ifunit("lo0");
233	m->m_pkthdr.csum_data = 0;
234	m->m_pkthdr.csum_flags = 0;
235	if (vers == 4) {
236	hlen = IP_VHL_HL(ip->ip_vhl) << 2;
237	ip->ip_sum = 0;
238	ip->ip_sum = in_cksum(m, hlen);
239	}
240	}
241	if (filter_ref != 0) {
242	mtag = m_tag_alloc(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT,
243	sizeof (ipfilter_t), M_NOWAIT);
244	if (mtag == NULL) {
245	error = ENOMEM;
246	goto done;
247	}
248	(ipfilter_t)(mtag+1) = filter_ref;
249	m_tag_prepend(m, mtag);
250	}
251
252	error = proto_inject(proto, data);
253
254	done:
255	return error;
256	}
257
258	static errno_t
259	ipf_injectv4_out(
260	mbuf_t data,
261	ipfilter_t filter_ref,
262	ipf_pktopts_t options)
263	{
264	struct route ro;
265	struct sockaddr_in sin = (struct sockaddr_in)&ro.ro_dst;
266	struct ip *ip;
267	struct mbuf m = (struct mbuf)data;
268	errno_t error = 0;
269	struct m_tag *mtag = 0;
270	struct ip_moptions *imo = 0, ip_moptions;
271
272	/* Make the IP header contiguous in the mbuf */
273	if ((size_t)m->m_len < sizeof(struct ip)) {
274	m = m_pullup(m, sizeof(struct ip));
275	if (m == NULL) return ENOMEM;
276	}
277	ip = (struct ip*)m_mtod(m);
278
279	if (filter_ref != 0) {
280	mtag = m_tag_alloc(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT,
281	sizeof (ipfilter_t), M_NOWAIT);
282	if (mtag == NULL) {
283	m_freem(m);
284	return ENOMEM;
285	}
286	(ipfilter_t)(mtag+1) = filter_ref;
287	m_tag_prepend(m, mtag);
288	}
289
290	if (options && (options->ippo_flags & IPPOF_MCAST_OPTS)) {
291	imo = &ip_moptions;
292
293	bzero(imo, sizeof(struct ip6_moptions));
294	imo->imo_multicast_ifp = options->ippo_mcast_ifnet;
295	imo->imo_multicast_ttl = options->ippo_mcast_ttl;
296	imo->imo_multicast_loop = options->ippo_mcast_loop;
297	}
298
299	/* Fill out a route structure and get a route */
300	bzero(&ro, sizeof(struct route));
301	sin->sin_len = sizeof(struct sockaddr_in);
302	sin->sin_family = AF_INET;
303	sin->sin_port = 0;
304	sin->sin_addr = ip->ip_dst;
305	rtalloc(&ro);
306	if (ro.ro_rt == NULL) {
307	m_freem(m);
308	return ENETUNREACH;
309	}
0c530ab8 A	310
	311	/* Put ip_len and ip_off in host byte order, ip_output expects that */
	312	NTOHS(ip->ip_len);
	313	NTOHS(ip->ip_off);
	314
91447636	315	/* Send */
2d21ac55	316	error = ip_output(m, NULL, &ro, IP_ALLOWBROADCAST \| IP_RAWOUTPUT, imo, NULL);
91447636 A	317
	318	/* Release the route */
	319	if (ro.ro_rt)
	320	rtfree(ro.ro_rt);
	321
	322	return error;
	323	}
	324
2d21ac55	325	#if INET6
91447636 A	326	static errno_t
	327	ipf_injectv6_out(
	328	mbuf_t data,
	329	ipfilter_t filter_ref,
	330	ipf_pktopts_t options)
	331	{
	332	struct route_in6 ro;
	333	struct sockaddr_in6 *sin6 = &ro.ro_dst;
	334	struct ip6_hdr *ip6;
	335	struct mbuf m = (struct mbuf)data;
	336	errno_t error = 0;
	337	struct m_tag *mtag = 0;
	338	struct ip6_moptions *im6o = 0, ip6_moptions;
	339
	340	/* Make the IP header contiguous in the mbuf */
	341	if ((size_t)m->m_len < sizeof(struct ip6_hdr)) {
	342	m = m_pullup(m, sizeof(struct ip6_hdr));
	343	if (m == NULL) return ENOMEM;
	344	}
	345	ip6 = (struct ip6_hdr*)m_mtod(m);
	346
	347	if (filter_ref != 0) {
	348	mtag = m_tag_alloc(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT,
	349	sizeof (ipfilter_t), M_NOWAIT);
	350	if (mtag == NULL) {
	351	m_freem(m);
	352	return ENOMEM;
	353	}
	354	(ipfilter_t)(mtag+1) = filter_ref;
	355	m_tag_prepend(m, mtag);
	356	}
	357
	358	if (options && (options->ippo_flags & IPPOF_MCAST_OPTS)) {
	359	im6o = &ip6_moptions;
	360
	361	bzero(im6o, sizeof(struct ip6_moptions));
	362	im6o->im6o_multicast_ifp = options->ippo_mcast_ifnet;
	363	im6o->im6o_multicast_hlim = options->ippo_mcast_ttl;
	364	im6o->im6o_multicast_loop = options->ippo_mcast_loop;
	365	}
	366
	367
	368	/* Fill out a route structure and get a route */
	369	bzero(&ro, sizeof(struct route_in6));
	370	sin6->sin6_len = sizeof(struct sockaddr_in6);
	371	sin6->sin6_family = AF_INET6;
	372	sin6->sin6_addr = ip6->ip6_dst;
	373	#if 0
	374	/* This is breaks loopback multicast! */
	375	/* The scope ID should already at s6_addr16[1] */
	376	if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
	377	/* Hack, pull the scope_id out of the dest addr */
	378	sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]);
	379	ip6->ip6_dst.s6_addr16[1] = 0;
	380	} else
	381	sin6->sin6_scope_id = 0;
	382	#endif
	383	rtalloc((struct route*)&ro);
	384	if (ro.ro_rt == NULL) {
	385	m_freem(m);
	386	return ENETUNREACH;
	387	}
	388
	389	/* Send */
390	error = ip6_output(m, NULL, &ro, 0, im6o, NULL, 0);
391
392	/* Release the route */
393	if (ro.ro_rt)
394	rtfree(ro.ro_rt);
395
396	return error;
397	}
2d21ac55	398	#endif /* INET6 */
91447636 A	399
	400	errno_t
	401	ipf_inject_output(
	402	mbuf_t data,
	403	ipfilter_t filter_ref,
	404	ipf_pktopts_t options)
	405	{
	406	struct mbuf m = (struct mbuf)data;
	407	u_int8_t vers;
	408	errno_t error = 0;
	409
	410	/* Make one byte of the header contiguous in the mbuf */
	411	if (m->m_len < 1) {
	412	m = m_pullup(m, 1);
	413	if (m == NULL)
	414	goto done;
	415	}
	416
	417	vers = ((u_int8_t)m_mtod(m)) >> 4;
	418	switch (vers)
	419	{
	420	case 4:
	421	error = ipf_injectv4_out(data, filter_ref, options);
	422	break;
2d21ac55	423	#if INET6
91447636 A	424	case 6:
	425	error = ipf_injectv6_out(data, filter_ref, options);
	426	break;
2d21ac55	427	#endif
91447636 A	428	default:
	429	m_freem(m);
	430	error = ENOTSUP;
	431	break;
	432	}
	433
	434	done:
	435	return error;
	436	}
	437
	438	__private_extern__ ipfilter_t
	439	ipf_get_inject_filter(struct mbuf *m)
	440	{
	441	ipfilter_t filter_ref = 0;
	442	struct m_tag *mtag;
	443
	444	mtag = m_tag_locate(m, KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT, NULL);
	445	if (mtag) {
	446	filter_ref = (ipfilter_t )(mtag+1);
	447
	448	m_tag_delete(m, mtag);
	449	}
	450	return filter_ref;
	451	}
	452
	453	__private_extern__ int
	454	ipf_init(void)
	455	{
	456	int error = 0;
	457	lck_grp_attr_t *grp_attributes = 0;
	458	lck_attr_t *lck_attributes = 0;
	459	lck_grp_t *lck_grp = 0;
	460
	461	grp_attributes = lck_grp_attr_alloc_init();
	462	if (grp_attributes == 0) {
	463	printf("ipf_init: lck_grp_attr_alloc_init failed\n");
	464	error = ENOMEM;
	465	goto done;
	466	}
91447636 A	467
	468	lck_grp = lck_grp_alloc_init("IP Filter", grp_attributes);
	469	if (lck_grp == 0) {
	470	printf("ipf_init: lck_grp_alloc_init failed\n");
	471	error = ENOMEM;
	472	goto done;
	473	}
	474
	475	lck_attributes = lck_attr_alloc_init();
	476	if (lck_attributes == 0) {
	477	printf("ipf_init: lck_attr_alloc_init failed\n");
	478	error = ENOMEM;
	479	goto done;
	480	}
91447636 A	481
	482	kipf_lock = lck_mtx_alloc_init(lck_grp, lck_attributes);
	483	if (kipf_lock == 0) {
	484	printf("ipf_init: lck_mtx_alloc_init failed\n");
	485	error = ENOMEM;
	486	goto done;
	487	}
	488	done:
	489	if (error != 0) {
	490	if (kipf_lock) {
	491	lck_mtx_free(kipf_lock, lck_grp);
	492	kipf_lock = 0;
	493	}
	494	}
	495	if (lck_grp) {
	496	lck_grp_free(lck_grp);
	497	lck_grp = 0;
	498	}
	499	if (grp_attributes) {
	500	lck_grp_attr_free(grp_attributes);
	501	grp_attributes = 0;
	502	}
	503	if (lck_attributes) {
	504	lck_attr_free(lck_attributes);
	505	lck_attributes = 0;
	506	}
	507
	508	return error;
	509	}