bsd/netinet/kpi_ipfilter.c

   1 /*
   2  * Copyright (c) 2004-2017 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #include <sys/param.h>  /* for definition of NULL */
  30 #include <sys/errno.h>
  31 #include <sys/malloc.h>
  32 #include <sys/socket.h>
  33 #include <sys/mbuf.h>
  34 #include <sys/systm.h>
  35 #include <libkern/OSAtomic.h>
  36
  37 #include <machine/endian.h>
  38
  39 #define _IP_VHL
  40 #include <net/if_var.h>
  41 #include <net/route.h>
  42 #include <net/kpi_protocol.h>
  43 #include <net/net_api_stats.h>
  44
  45 #include <netinet/in_systm.h>
  46 #include <netinet/in.h>
  47 #include <netinet/in_var.h>
  48 #include <netinet6/in6_var.h>
  49 #include <netinet/ip.h>
  50 #include <netinet/ip6.h>
  51 #include <netinet/ip_var.h>
  52 #include <netinet6/ip6_var.h>
  53 #include <netinet/kpi_ipfilter_var.h>
  54
  55 #include <stdbool.h>
  56
  57 /*
  58  * kipf_lock and kipf_ref protect the linkage of the list of IP filters
  59  * An IP filter can be removed only when kipf_ref is zero
  60  * If an IP filter cannot be removed because kipf_ref is not null, then
  61  * the IP filter is marjed and kipf_delayed_remove is set so that when
  62  * kipf_ref eventually goes down to zero, the IP filter is removed
  63  */
  64 decl_lck_mtx_data(static, kipf_lock_data);
  65 static lck_mtx_t *kipf_lock = &kipf_lock_data;
  66 static u_int32_t kipf_ref = 0;
  67 static u_int32_t kipf_delayed_remove = 0;
  68 u_int32_t kipf_count = 0;
  69
  70 __private_extern__ struct ipfilter_list ipv4_filters = TAILQ_HEAD_INITIALIZER(ipv4_filters);
  71 __private_extern__ struct ipfilter_list ipv6_filters = TAILQ_HEAD_INITIALIZER(ipv6_filters);
  72 __private_extern__ struct ipfilter_list tbr_filters = TAILQ_HEAD_INITIALIZER(tbr_filters);
  73
  74 #undef ipf_addv4
  75 #undef ipf_addv6
  76 extern errno_t ipf_addv4(const struct ipf_filter *filter,
  77     ipfilter_t *filter_ref);
  78 extern errno_t ipf_addv6(const struct ipf_filter *filter,
  79     ipfilter_t *filter_ref);
  80
  81 static errno_t ipf_add(const struct ipf_filter *filter,
  82     ipfilter_t *filter_ref, struct ipfilter_list *head, bool is_internal);
  83
  84 __private_extern__ void
  85 ipf_ref(void)
  86 {
  87         lck_mtx_lock(kipf_lock);
  88         kipf_ref++;
  89         lck_mtx_unlock(kipf_lock);
  90 }
  91
  92 __private_extern__ void
  93 ipf_unref(void)
  94 {
  95         lck_mtx_lock(kipf_lock);
  96
  97         if (kipf_ref == 0)
  98                 panic("ipf_unref: kipf_ref == 0\n");
  99
 100         kipf_ref--;
 101         if (kipf_ref == 0 && kipf_delayed_remove != 0) {
 102                 struct ipfilter *filter;
 103
 104                 while ((filter = TAILQ_FIRST(&tbr_filters))) {
 105                         VERIFY(OSDecrementAtomic64(&net_api_stats.nas_ipf_add_count) > 0);
 106
 107                         ipf_detach_func ipf_detach = filter->ipf_filter.ipf_detach;
 108                         void* cookie = filter->ipf_filter.cookie;
 109
 110                         TAILQ_REMOVE(filter->ipf_head, filter, ipf_link);
 111                         TAILQ_REMOVE(&tbr_filters, filter, ipf_tbr);
 112                         kipf_delayed_remove--;
 113
 114                         if (ipf_detach) {
 115                                 lck_mtx_unlock(kipf_lock);
 116                                 ipf_detach(cookie);
 117                                 lck_mtx_lock(kipf_lock);
 118                                 /* In case some filter got to run while we released the lock */
 119                                 if (kipf_ref != 0)
 120                                         break;
 121                         }
 122                 }
 123         }
 124         lck_mtx_unlock(kipf_lock);
 125 }
 126
 127 static errno_t
 128 ipf_add(
 129         const struct ipf_filter *filter,
 130         ipfilter_t *filter_ref,
 131         struct ipfilter_list *head,
 132         bool is_internal)
 133 {
 134         struct ipfilter *new_filter;
 135         if (filter->name == NULL || (filter->ipf_input == NULL && filter->ipf_output == NULL))
 136                 return (EINVAL);
 137
 138         MALLOC(new_filter, struct ipfilter *, sizeof(*new_filter), M_IFADDR, M_WAITOK);
 139         if (new_filter == NULL)
 140                 return (ENOMEM);
 141
 142         lck_mtx_lock(kipf_lock);
 143         new_filter->ipf_filter = *filter;
 144         new_filter->ipf_head = head;
 145
 146         TAILQ_INSERT_HEAD(head, new_filter, ipf_link);
 147
 148         OSIncrementAtomic64(&net_api_stats.nas_ipf_add_count);
 149         INC_ATOMIC_INT64_LIM(net_api_stats.nas_ipf_add_total);
 150         if (is_internal) {
 151                 INC_ATOMIC_INT64_LIM(net_api_stats.nas_ipf_add_os_total);
 152         }
 153
 154         lck_mtx_unlock(kipf_lock);
 155
 156         *filter_ref = (ipfilter_t)new_filter;
 157
 158         /* This will force TCP to re-evaluate its use of TSO */
 159         OSAddAtomic(1, &kipf_count);
 160         routegenid_update();
 161
 162         return (0);
 163 }
 164
 165 errno_t
 166 ipf_addv4_internal(
 167         const struct ipf_filter *filter,
 168         ipfilter_t *filter_ref)
 169 {
 170         return (ipf_add(filter, filter_ref, &ipv4_filters, true));
 171 }
 172
 173 errno_t
 174 ipf_addv4(
 175         const struct ipf_filter *filter,
 176         ipfilter_t *filter_ref)
 177 {
 178         return (ipf_add(filter, filter_ref, &ipv4_filters, false));
 179 }
 180
 181 errno_t
 182 ipf_addv6_internal(
 183         const struct ipf_filter *filter,
 184         ipfilter_t *filter_ref)
 185 {
 186         return (ipf_add(filter, filter_ref, &ipv6_filters, true));
 187 }
 188
 189 errno_t
 190 ipf_addv6(
 191         const struct ipf_filter *filter,
 192         ipfilter_t *filter_ref)
 193 {
 194         return (ipf_add(filter, filter_ref, &ipv6_filters, false));
 195 }
 196
 197 static errno_t
 198 ipf_input_detached(void *cookie, mbuf_t *data, int offset, u_int8_t protocol)
 199 {
 200 #pragma unused(cookie, data, offset, protocol)
 201
 202 #if DEBUG
 203         printf("ipf_input_detached\n");
 204 #endif /* DEBUG */
 205
 206         return (0);
 207 }
 208
 209 static errno_t
 210 ipf_output_detached(void *cookie, mbuf_t *data, ipf_pktopts_t options)
 211 {
 212 #pragma unused(cookie, data, options)
 213
 214 #if DEBUG
 215         printf("ipf_output_detached\n");
 216 #endif /* DEBUG */
 217
 218         return (0);
 219 }
 220
 221 errno_t
 222 ipf_remove(
 223         ipfilter_t filter_ref)
 224 {
 225         struct ipfilter *match = (struct ipfilter *)filter_ref;
 226         struct ipfilter_list *head;
 227
 228         if (match == 0 || (match->ipf_head != &ipv4_filters && match->ipf_head != &ipv6_filters))
 229                 return (EINVAL);
 230
 231         head = match->ipf_head;
 232
 233         lck_mtx_lock(kipf_lock);
 234         TAILQ_FOREACH(match, head, ipf_link) {
 235                 if (match == (struct ipfilter *)filter_ref) {
 236                         ipf_detach_func ipf_detach = match->ipf_filter.ipf_detach;
 237                         void* cookie = match->ipf_filter.cookie;
 238
 239                         /*
 240                          * Cannot detach when they are filters running
 241                          */
 242                         if (kipf_ref) {
 243                                 kipf_delayed_remove++;
 244                                 TAILQ_INSERT_TAIL(&tbr_filters, match, ipf_tbr);
 245                                 match->ipf_filter.ipf_input = ipf_input_detached;
 246                                 match->ipf_filter.ipf_output = ipf_output_detached;
 247                                 lck_mtx_unlock(kipf_lock);
 248                         } else {
 249                                 VERIFY(OSDecrementAtomic64(&net_api_stats.nas_ipf_add_count) > 0);
 250
 251                                 TAILQ_REMOVE(head, match, ipf_link);
 252                                 lck_mtx_unlock(kipf_lock);
 253
 254                                 if (ipf_detach)
 255                                         ipf_detach(cookie);
 256                                 FREE(match, M_IFADDR);
 257
 258                                 /* This will force TCP to re-evaluate its use of TSO */
 259                                 OSAddAtomic(-1, &kipf_count);
 260                                 routegenid_update();
 261
 262                         }
 263                         return (0);
 264                 }
 265         }
 266         lck_mtx_unlock(kipf_lock);
 267
 268         return (ENOENT);
 269 }
 270
 271 int log_for_en1 = 0;
 272
 273 errno_t
 274 ipf_inject_input(
 275         mbuf_t data,
 276         ipfilter_t filter_ref)
 277 {
 278         struct mbuf *m = (struct mbuf *)data;
 279         struct m_tag *mtag = 0;
 280         struct ip *ip = mtod(m, struct ip *);
 281         u_int8_t        vers;
 282         int hlen;
 283         errno_t error = 0;
 284         protocol_family_t proto;
 285
 286         vers = IP_VHL_V(ip->ip_vhl);
 287
 288         switch (vers) {
 289                 case 4:
 290                         proto = PF_INET;
 291                         break;
 292                 case 6:
 293                         proto = PF_INET6;
 294                         break;
 295                 default:
 296                         error = ENOTSUP;
 297                         goto done;
 298         }
 299
 300         if (filter_ref == 0 && m->m_pkthdr.rcvif == 0) {
 301                 m->m_pkthdr.rcvif = lo_ifp;
 302                 m->m_pkthdr.csum_data = 0;
 303                 m->m_pkthdr.csum_flags = 0;
 304                 if (vers == 4) {
 305                         hlen = IP_VHL_HL(ip->ip_vhl) << 2;
 306                         ip->ip_sum = 0;
 307                         ip->ip_sum = in_cksum(m, hlen);
 308                 }
 309         }
 310         if (filter_ref != 0) {
 311                 mtag = m_tag_create(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT,
 312                     sizeof (ipfilter_t), M_NOWAIT, m);
 313                 if (mtag == NULL) {
 314                         error = ENOMEM;
 315                         goto done;
 316                 }
 317                 *(ipfilter_t *)(mtag+1) = filter_ref;
 318                 m_tag_prepend(m, mtag);
 319         }
 320
 321         error = proto_inject(proto, data);
 322
 323 done:
 324         return (error);
 325 }
 326
 327 static errno_t
 328 ipf_injectv4_out(mbuf_t data, ipfilter_t filter_ref, ipf_pktopts_t options)
 329 {
 330         struct route ro;
 331         struct ip *ip;
 332         struct mbuf *m = (struct mbuf *)data;
 333         errno_t error = 0;
 334         struct m_tag *mtag = NULL;
 335         struct ip_moptions *imo = NULL;
 336         struct ip_out_args ipoa = { IFSCOPE_NONE, { 0 }, 0, 0,
 337                 SO_TC_UNSPEC, _NET_SERVICE_TYPE_UNSPEC };
 338
 339         /* Make the IP header contiguous in the mbuf */
 340         if ((size_t)m->m_len < sizeof (struct ip)) {
 341                 m = m_pullup(m, sizeof (struct ip));
 342                 if (m == NULL)
 343                         return (ENOMEM);
 344         }
 345         ip = (struct ip *)m_mtod(m);
 346
 347         if (filter_ref != 0) {
 348                 mtag = m_tag_create(KERNEL_MODULE_TAG_ID,
 349                     KERNEL_TAG_TYPE_IPFILT, sizeof (ipfilter_t), M_NOWAIT, m);
 350                 if (mtag == NULL) {
 351                         m_freem(m);
 352                         return (ENOMEM);
 353                 }
 354                 *(ipfilter_t *)(mtag + 1) = filter_ref;
 355                 m_tag_prepend(m, mtag);
 356         }
 357
 358         if (options != NULL && (options->ippo_flags & IPPOF_MCAST_OPTS) &&
 359             (imo = ip_allocmoptions(M_DONTWAIT)) != NULL) {
 360                 imo->imo_multicast_ifp = options->ippo_mcast_ifnet;
 361                 imo->imo_multicast_ttl = options->ippo_mcast_ttl;
 362                 imo->imo_multicast_loop = options->ippo_mcast_loop;
 363         }
 364
 365         if (options != NULL) {
 366                 if (options->ippo_flags & IPPOF_SELECT_SRCIF)
 367                         ipoa.ipoa_flags |= IPOAF_SELECT_SRCIF;
 368                 if (options->ippo_flags & IPPOF_BOUND_IF) {
 369                         ipoa.ipoa_flags |= IPOAF_BOUND_IF;
 370                         ipoa.ipoa_boundif = options->ippo_flags >>
 371                             IPPOF_SHIFT_IFSCOPE;
 372                 }
 373                 if (options->ippo_flags & IPPOF_NO_IFT_CELLULAR)
 374                         ipoa.ipoa_flags |= IPOAF_NO_CELLULAR;
 375                 if (options->ippo_flags & IPPOF_BOUND_SRCADDR)
 376                         ipoa.ipoa_flags |= IPOAF_BOUND_SRCADDR;
 377                 if (options->ippo_flags & IPPOF_NO_IFF_EXPENSIVE)
 378                         ipoa.ipoa_flags |= IPOAF_NO_EXPENSIVE;
 379         }
 380
 381         bzero(&ro, sizeof(struct route));
 382
 383         /* Put ip_len and ip_off in host byte order, ip_output expects that */
 384
 385 #if BYTE_ORDER != BIG_ENDIAN
 386         NTOHS(ip->ip_len);
 387         NTOHS(ip->ip_off);
 388 #endif
 389
 390         /* Send; enforce source interface selection via IP_OUTARGS flag */
 391         error = ip_output(m, NULL, &ro,
 392             IP_ALLOWBROADCAST | IP_RAWOUTPUT | IP_OUTARGS, imo, &ipoa);
 393
 394         /* Release the route */
 395         ROUTE_RELEASE(&ro);
 396
 397         if (imo != NULL)
 398                 IMO_REMREF(imo);
 399
 400         return (error);
 401 }
 402
 403 #if INET6
 404 static errno_t
 405 ipf_injectv6_out(mbuf_t data, ipfilter_t filter_ref, ipf_pktopts_t options)
 406 {
 407         struct route_in6 ro;
 408         struct ip6_hdr *ip6;
 409         struct mbuf *m = (struct mbuf *)data;
 410         errno_t error = 0;
 411         struct m_tag *mtag = NULL;
 412         struct ip6_moptions *im6o = NULL;
 413         struct ip6_out_args ip6oa = { IFSCOPE_NONE, { 0 }, 0, 0,
 414                 SO_TC_UNSPEC, _NET_SERVICE_TYPE_UNSPEC };
 415
 416         /* Make the IP header contiguous in the mbuf */
 417         if ((size_t)m->m_len < sizeof(struct ip6_hdr)) {
 418                 m = m_pullup(m, sizeof(struct ip6_hdr));
 419                 if (m == NULL)
 420                         return (ENOMEM);
 421         }
 422         ip6 = (struct ip6_hdr *)m_mtod(m);
 423
 424         if (filter_ref != 0) {
 425                 mtag = m_tag_create(KERNEL_MODULE_TAG_ID,
 426                     KERNEL_TAG_TYPE_IPFILT, sizeof (ipfilter_t), M_NOWAIT, m);
 427                 if (mtag == NULL) {
 428                         m_freem(m);
 429                         return (ENOMEM);
 430                 }
 431                 *(ipfilter_t *)(mtag + 1) = filter_ref;
 432                 m_tag_prepend(m, mtag);
 433         }
 434
 435         if (options != NULL && (options->ippo_flags & IPPOF_MCAST_OPTS) &&
 436             (im6o = ip6_allocmoptions(M_DONTWAIT)) != NULL) {
 437                 im6o->im6o_multicast_ifp = options->ippo_mcast_ifnet;
 438                 im6o->im6o_multicast_hlim = options->ippo_mcast_ttl;
 439                 im6o->im6o_multicast_loop = options->ippo_mcast_loop;
 440         }
 441
 442         if (options != NULL) {
 443                 if (options->ippo_flags & IPPOF_SELECT_SRCIF)
 444                         ip6oa.ip6oa_flags |= IP6OAF_SELECT_SRCIF;
 445                 if (options->ippo_flags & IPPOF_BOUND_IF) {
 446                         ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF;
 447                         ip6oa.ip6oa_boundif = options->ippo_flags >>
 448                             IPPOF_SHIFT_IFSCOPE;
 449                 }
 450                 if (options->ippo_flags & IPPOF_NO_IFT_CELLULAR)
 451                         ip6oa.ip6oa_flags |= IP6OAF_NO_CELLULAR;
 452                 if (options->ippo_flags & IPPOF_BOUND_SRCADDR)
 453                         ip6oa.ip6oa_flags |= IP6OAF_BOUND_SRCADDR;
 454                 if (options->ippo_flags & IPPOF_NO_IFF_EXPENSIVE)
 455                         ip6oa.ip6oa_flags |= IP6OAF_NO_EXPENSIVE;
 456         }
 457
 458         bzero(&ro, sizeof(struct route_in6));
 459
 460         /*
 461          * Send  mbuf and ifscope information. Check for correctness
 462          * of ifscope information is done while searching for a route in
 463          * ip6_output.
 464          */
 465         error = ip6_output(m, NULL, &ro, IPV6_OUTARGS, im6o, NULL, &ip6oa);
 466
 467         /* Release the route */
 468         ROUTE_RELEASE(&ro);
 469
 470         if (im6o != NULL)
 471                 IM6O_REMREF(im6o);
 472
 473         return (error);
 474 }
 475 #endif /* INET6 */
 476
 477 errno_t
 478 ipf_inject_output(
 479         mbuf_t data,
 480         ipfilter_t filter_ref,
 481         ipf_pktopts_t options)
 482 {
 483         struct mbuf     *m = (struct mbuf *)data;
 484         u_int8_t        vers;
 485         errno_t         error = 0;
 486
 487         /* Make one byte of the header contiguous in the mbuf */
 488         if (m->m_len < 1) {
 489                 m = m_pullup(m, 1);
 490                 if (m == NULL)
 491                         goto done;
 492         }
 493
 494         vers = (*(u_int8_t *)m_mtod(m)) >> 4;
 495         switch (vers) {
 496                 case 4:
 497                         error = ipf_injectv4_out(data, filter_ref, options);
 498                         break;
 499 #if INET6
 500                 case 6:
 501                         error = ipf_injectv6_out(data, filter_ref, options);
 502                         break;
 503 #endif
 504                 default:
 505                         m_freem(m);
 506                         error = ENOTSUP;
 507                         break;
 508         }
 509
 510 done:
 511         return (error);
 512 }
 513
 514 __private_extern__ ipfilter_t
 515 ipf_get_inject_filter(struct mbuf *m)
 516 {
 517         ipfilter_t filter_ref = 0;
 518         struct m_tag *mtag;
 519
 520         mtag = m_tag_locate(m, KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT, NULL);
 521         if (mtag) {
 522                 filter_ref = *(ipfilter_t *)(mtag+1);
 523
 524                 m_tag_delete(m, mtag);
 525         }
 526         return (filter_ref);
 527 }
 528
 529 __private_extern__ int
 530 ipf_init(void)
 531 {
 532         int error = 0;
 533         lck_grp_attr_t *grp_attributes = 0;
 534         lck_attr_t *lck_attributes = 0;
 535         lck_grp_t *lck_grp = 0;
 536
 537         grp_attributes = lck_grp_attr_alloc_init();
 538         if (grp_attributes == 0) {
 539                 printf("ipf_init: lck_grp_attr_alloc_init failed\n");
 540                 error = ENOMEM;
 541                 goto done;
 542         }
 543
 544         lck_grp = lck_grp_alloc_init("IP Filter", grp_attributes);
 545         if (lck_grp == 0) {
 546                 printf("ipf_init: lck_grp_alloc_init failed\n");
 547                 error = ENOMEM;
 548                 goto done;
 549         }
 550
 551         lck_attributes = lck_attr_alloc_init();
 552         if (lck_attributes == 0) {
 553                 printf("ipf_init: lck_attr_alloc_init failed\n");
 554                 error = ENOMEM;
 555                 goto done;
 556         }
 557
 558         lck_mtx_init(kipf_lock, lck_grp, lck_attributes);
 559
 560         done:
 561         if (lck_grp) {
 562                 lck_grp_free(lck_grp);
 563                 lck_grp = 0;
 564         }
 565         if (grp_attributes) {
 566                 lck_grp_attr_free(grp_attributes);
 567                 grp_attributes = 0;
 568         }
 569         if (lck_attributes) {
 570                 lck_attr_free(lck_attributes);
 571                 lck_attributes = 0;
 572         }
 573
 574         return (error);
 575 }