bsd/netinet/kpi_ipfilter.c

   1 /*
   2  * Copyright (c) 2004-2020 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #include <sys/param.h>  /* for definition of NULL */
  30 #include <sys/errno.h>
  31 #include <sys/malloc.h>
  32 #include <sys/socket.h>
  33 #include <sys/mbuf.h>
  34 #include <sys/systm.h>
  35 #include <libkern/OSAtomic.h>
  36
  37 #include <machine/endian.h>
  38
  39 #define _IP_VHL
  40 #include <net/if_var.h>
  41 #include <net/route.h>
  42 #include <net/kpi_protocol.h>
  43 #include <net/net_api_stats.h>
  44
  45 #include <netinet/in_systm.h>
  46 #include <netinet/in.h>
  47 #include <netinet/in_var.h>
  48 #include <netinet6/in6_var.h>
  49 #include <netinet/ip.h>
  50 #include <netinet/ip6.h>
  51 #include <netinet/ip_var.h>
  52 #include <netinet6/ip6_var.h>
  53 #include <netinet/kpi_ipfilter_var.h>
  54
  55 #include <stdbool.h>
  56
  57 /*
  58  * kipf_lock and kipf_ref protect the linkage of the list of IP filters
  59  * An IP filter can be removed only when kipf_ref is zero
  60  * If an IP filter cannot be removed because kipf_ref is not null, then
  61  * the IP filter is marjed and kipf_delayed_remove is set so that when
  62  * kipf_ref eventually goes down to zero, the IP filter is removed
  63  */
  64 decl_lck_mtx_data(static, kipf_lock_data);
  65 static lck_mtx_t *kipf_lock = &kipf_lock_data;
  66 static u_int32_t kipf_ref = 0;
  67 static u_int32_t kipf_delayed_remove = 0;
  68 u_int32_t kipf_count = 0;
  69
  70 __private_extern__ struct ipfilter_list ipv4_filters = TAILQ_HEAD_INITIALIZER(ipv4_filters);
  71 __private_extern__ struct ipfilter_list ipv6_filters = TAILQ_HEAD_INITIALIZER(ipv6_filters);
  72 __private_extern__ struct ipfilter_list tbr_filters = TAILQ_HEAD_INITIALIZER(tbr_filters);
  73
  74 #undef ipf_addv4
  75 #undef ipf_addv6
  76 extern errno_t ipf_addv4(const struct ipf_filter *filter,
  77     ipfilter_t *filter_ref);
  78 extern errno_t ipf_addv6(const struct ipf_filter *filter,
  79     ipfilter_t *filter_ref);
  80
  81 static errno_t ipf_add(const struct ipf_filter *filter,
  82     ipfilter_t *filter_ref, struct ipfilter_list *head, bool is_internal);
  83
  84 __private_extern__ void
  85 ipf_ref(void)
  86 {
  87         lck_mtx_lock(kipf_lock);
  88         if (os_inc_overflow(&kipf_ref)) {
  89                 panic("kipf_ref overflow");
  90         }
  91         lck_mtx_unlock(kipf_lock);
  92 }
  93
  94 __private_extern__ void
  95 ipf_unref(void)
  96 {
  97         lck_mtx_lock(kipf_lock);
  98
  99         if (os_dec_overflow(&kipf_ref)) {
 100                 panic("kipf_ref underflow");
 101         }
 102
 103         if (kipf_ref == 0 && kipf_delayed_remove != 0) {
 104                 struct ipfilter *filter;
 105
 106                 while ((filter = TAILQ_FIRST(&tbr_filters))) {
 107                         VERIFY(OSDecrementAtomic64(&net_api_stats.nas_ipf_add_count) > 0);
 108
 109                         ipf_detach_func ipf_detach = filter->ipf_filter.ipf_detach;
 110                         void* cookie = filter->ipf_filter.cookie;
 111
 112                         TAILQ_REMOVE(filter->ipf_head, filter, ipf_link);
 113                         TAILQ_REMOVE(&tbr_filters, filter, ipf_tbr);
 114                         kipf_delayed_remove--;
 115
 116                         if (ipf_detach) {
 117                                 lck_mtx_unlock(kipf_lock);
 118                                 ipf_detach(cookie);
 119                                 lck_mtx_lock(kipf_lock);
 120                                 /* In case some filter got to run while we released the lock */
 121                                 if (kipf_ref != 0) {
 122                                         break;
 123                                 }
 124                         }
 125                 }
 126         }
 127         lck_mtx_unlock(kipf_lock);
 128 }
 129
 130 static errno_t
 131 ipf_add(
 132         const struct ipf_filter *filter,
 133         ipfilter_t *filter_ref,
 134         struct ipfilter_list *head,
 135         bool is_internal)
 136 {
 137         struct ipfilter *new_filter;
 138         if (filter->name == NULL || (filter->ipf_input == NULL && filter->ipf_output == NULL)) {
 139                 return EINVAL;
 140         }
 141
 142         MALLOC(new_filter, struct ipfilter *, sizeof(*new_filter), M_IFADDR, M_WAITOK);
 143         if (new_filter == NULL) {
 144                 return ENOMEM;
 145         }
 146
 147         lck_mtx_lock(kipf_lock);
 148         new_filter->ipf_filter = *filter;
 149         new_filter->ipf_head = head;
 150
 151         TAILQ_INSERT_HEAD(head, new_filter, ipf_link);
 152
 153         OSIncrementAtomic64(&net_api_stats.nas_ipf_add_count);
 154         INC_ATOMIC_INT64_LIM(net_api_stats.nas_ipf_add_total);
 155         if (is_internal) {
 156                 INC_ATOMIC_INT64_LIM(net_api_stats.nas_ipf_add_os_total);
 157         }
 158
 159         lck_mtx_unlock(kipf_lock);
 160
 161         *filter_ref = (ipfilter_t)new_filter;
 162
 163         /* This will force TCP to re-evaluate its use of TSO */
 164         OSAddAtomic(1, &kipf_count);
 165         routegenid_update();
 166
 167         return 0;
 168 }
 169
 170 errno_t
 171 ipf_addv4_internal(
 172         const struct ipf_filter *filter,
 173         ipfilter_t *filter_ref)
 174 {
 175         return ipf_add(filter, filter_ref, &ipv4_filters, true);
 176 }
 177
 178 errno_t
 179 ipf_addv4(
 180         const struct ipf_filter *filter,
 181         ipfilter_t *filter_ref)
 182 {
 183         return ipf_add(filter, filter_ref, &ipv4_filters, false);
 184 }
 185
 186 errno_t
 187 ipf_addv6_internal(
 188         const struct ipf_filter *filter,
 189         ipfilter_t *filter_ref)
 190 {
 191         return ipf_add(filter, filter_ref, &ipv6_filters, true);
 192 }
 193
 194 errno_t
 195 ipf_addv6(
 196         const struct ipf_filter *filter,
 197         ipfilter_t *filter_ref)
 198 {
 199         return ipf_add(filter, filter_ref, &ipv6_filters, false);
 200 }
 201
 202 static errno_t
 203 ipf_input_detached(void *cookie, mbuf_t *data, int offset, u_int8_t protocol)
 204 {
 205 #pragma unused(cookie, data, offset, protocol)
 206
 207 #if DEBUG
 208         printf("ipf_input_detached\n");
 209 #endif /* DEBUG */
 210
 211         return 0;
 212 }
 213
 214 static errno_t
 215 ipf_output_detached(void *cookie, mbuf_t *data, ipf_pktopts_t options)
 216 {
 217 #pragma unused(cookie, data, options)
 218
 219 #if DEBUG
 220         printf("ipf_output_detached\n");
 221 #endif /* DEBUG */
 222
 223         return 0;
 224 }
 225
 226 errno_t
 227 ipf_remove(
 228         ipfilter_t filter_ref)
 229 {
 230         struct ipfilter *match = (struct ipfilter *)filter_ref;
 231         struct ipfilter_list *head;
 232
 233         if (match == 0 || (match->ipf_head != &ipv4_filters && match->ipf_head != &ipv6_filters)) {
 234                 return EINVAL;
 235         }
 236
 237         head = match->ipf_head;
 238
 239         lck_mtx_lock(kipf_lock);
 240         TAILQ_FOREACH(match, head, ipf_link) {
 241                 if (match == (struct ipfilter *)filter_ref) {
 242                         ipf_detach_func ipf_detach = match->ipf_filter.ipf_detach;
 243                         void* cookie = match->ipf_filter.cookie;
 244
 245                         /*
 246                          * Cannot detach when they are filters running
 247                          */
 248                         if (kipf_ref) {
 249                                 kipf_delayed_remove++;
 250                                 TAILQ_INSERT_TAIL(&tbr_filters, match, ipf_tbr);
 251                                 match->ipf_filter.ipf_input = ipf_input_detached;
 252                                 match->ipf_filter.ipf_output = ipf_output_detached;
 253                                 lck_mtx_unlock(kipf_lock);
 254                         } else {
 255                                 VERIFY(OSDecrementAtomic64(&net_api_stats.nas_ipf_add_count) > 0);
 256
 257                                 TAILQ_REMOVE(head, match, ipf_link);
 258                                 lck_mtx_unlock(kipf_lock);
 259
 260                                 if (ipf_detach) {
 261                                         ipf_detach(cookie);
 262                                 }
 263                                 FREE(match, M_IFADDR);
 264
 265                                 /* This will force TCP to re-evaluate its use of TSO */
 266                                 OSAddAtomic(-1, &kipf_count);
 267                                 routegenid_update();
 268                         }
 269                         return 0;
 270                 }
 271         }
 272         lck_mtx_unlock(kipf_lock);
 273
 274         return ENOENT;
 275 }
 276
 277 int log_for_en1 = 0;
 278
 279 errno_t
 280 ipf_inject_input(
 281         mbuf_t data,
 282         ipfilter_t filter_ref)
 283 {
 284         struct mbuf *m = (struct mbuf *)data;
 285         struct m_tag *mtag = 0;
 286         struct ip *ip = mtod(m, struct ip *);
 287         struct ip6_hdr *ip6;
 288         u_int8_t        vers;
 289         int hlen;
 290         errno_t error = 0;
 291         protocol_family_t proto;
 292         struct in_ifaddr *ia = NULL;
 293         struct in_addr *pkt_dst = NULL;
 294         struct in6_ifaddr *ia6 = NULL;
 295         struct sockaddr_in6 pkt_dst6;
 296
 297         vers = IP_VHL_V(ip->ip_vhl);
 298
 299         switch (vers) {
 300         case 4:
 301                 proto = PF_INET;
 302                 break;
 303         case 6:
 304                 proto = PF_INET6;
 305                 break;
 306         default:
 307                 error = ENOTSUP;
 308                 goto done;
 309         }
 310
 311         if (filter_ref == 0 && m->m_pkthdr.rcvif == 0) {
 312                 /*
 313                  * Search for interface with the local address
 314                  */
 315                 switch (proto) {
 316                 case PF_INET:
 317                         pkt_dst = &ip->ip_dst;
 318                         lck_rw_lock_shared(in_ifaddr_rwlock);
 319                         TAILQ_FOREACH(ia, INADDR_HASH(pkt_dst->s_addr), ia_hash) {
 320                                 if (IA_SIN(ia)->sin_addr.s_addr == pkt_dst->s_addr) {
 321                                         m->m_pkthdr.rcvif = ia->ia_ifp;
 322                                         break;
 323                                 }
 324                         }
 325                         lck_rw_done(in_ifaddr_rwlock);
 326                         break;
 327
 328                 case PF_INET6:
 329                         ip6 = mtod(m, struct ip6_hdr *);
 330                         pkt_dst6.sin6_addr = ip6->ip6_dst;
 331                         lck_rw_lock_shared(&in6_ifaddr_rwlock);
 332                         TAILQ_FOREACH(ia6, IN6ADDR_HASH(&pkt_dst6.sin6_addr), ia6_hash) {
 333                                 if (IN6_ARE_ADDR_EQUAL(&ia6->ia_addr.sin6_addr, &pkt_dst6.sin6_addr)) {
 334                                         m->m_pkthdr.rcvif = ia6->ia_ifp;
 335                                         break;
 336                                 }
 337                         }
 338                         lck_rw_done(&in6_ifaddr_rwlock);
 339                         break;
 340
 341                 default:
 342                         break;
 343                 }
 344
 345                 /*
 346                  * If none found, fallback to loopback
 347                  */
 348                 if (m->m_pkthdr.rcvif == NULL) {
 349                         m->m_pkthdr.rcvif = lo_ifp;
 350                 }
 351
 352                 m->m_pkthdr.csum_data = 0;
 353                 m->m_pkthdr.csum_flags = 0;
 354                 if (vers == 4) {
 355                         hlen = IP_VHL_HL(ip->ip_vhl) << 2;
 356                         ip->ip_sum = 0;
 357                         ip->ip_sum = in_cksum(m, hlen);
 358                 }
 359         }
 360         if (filter_ref != 0) {
 361                 mtag = m_tag_create(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT,
 362                     sizeof(ipfilter_t), M_NOWAIT, m);
 363                 if (mtag == NULL) {
 364                         error = ENOMEM;
 365                         goto done;
 366                 }
 367                 *(ipfilter_t *)(mtag + 1) = filter_ref;
 368                 m_tag_prepend(m, mtag);
 369         }
 370
 371         error = proto_inject(proto, data);
 372
 373 done:
 374         return error;
 375 }
 376
 377 static errno_t
 378 ipf_injectv4_out(mbuf_t data, ipfilter_t filter_ref, ipf_pktopts_t options)
 379 {
 380         struct route ro;
 381         struct ip *ip;
 382         struct mbuf *m = (struct mbuf *)data;
 383         errno_t error = 0;
 384         struct m_tag *mtag = NULL;
 385         struct ip_moptions *imo = NULL;
 386         struct ip_out_args ipoa;
 387
 388         bzero(&ipoa, sizeof(ipoa));
 389         ipoa.ipoa_boundif = IFSCOPE_NONE;
 390         ipoa.ipoa_sotc = SO_TC_UNSPEC;
 391         ipoa.ipoa_netsvctype = _NET_SERVICE_TYPE_UNSPEC;
 392
 393         /* Make the IP header contiguous in the mbuf */
 394         if ((size_t)m->m_len < sizeof(struct ip)) {
 395                 m = m_pullup(m, sizeof(struct ip));
 396                 if (m == NULL) {
 397                         return ENOMEM;
 398                 }
 399         }
 400         ip = (struct ip *)m_mtod(m);
 401
 402         if (filter_ref != 0) {
 403                 mtag = m_tag_create(KERNEL_MODULE_TAG_ID,
 404                     KERNEL_TAG_TYPE_IPFILT, sizeof(ipfilter_t), M_NOWAIT, m);
 405                 if (mtag == NULL) {
 406                         m_freem(m);
 407                         return ENOMEM;
 408                 }
 409                 *(ipfilter_t *)(mtag + 1) = filter_ref;
 410                 m_tag_prepend(m, mtag);
 411         }
 412
 413         if (options != NULL && (options->ippo_flags & IPPOF_MCAST_OPTS) &&
 414             (imo = ip_allocmoptions(Z_NOWAIT)) != NULL) {
 415                 imo->imo_multicast_ifp = options->ippo_mcast_ifnet;
 416                 imo->imo_multicast_ttl = options->ippo_mcast_ttl;
 417                 imo->imo_multicast_loop = (u_char)options->ippo_mcast_loop;
 418         }
 419
 420         if (options != NULL) {
 421                 if (options->ippo_flags & IPPOF_SELECT_SRCIF) {
 422                         ipoa.ipoa_flags |= IPOAF_SELECT_SRCIF;
 423                 }
 424                 if (options->ippo_flags & IPPOF_BOUND_IF) {
 425                         ipoa.ipoa_flags |= IPOAF_BOUND_IF;
 426                         ipoa.ipoa_boundif = options->ippo_flags >>
 427                             IPPOF_SHIFT_IFSCOPE;
 428                 }
 429                 if (options->ippo_flags & IPPOF_NO_IFT_CELLULAR) {
 430                         ipoa.ipoa_flags |= IPOAF_NO_CELLULAR;
 431                 }
 432                 if (options->ippo_flags & IPPOF_BOUND_SRCADDR) {
 433                         ipoa.ipoa_flags |= IPOAF_BOUND_SRCADDR;
 434                 }
 435                 if (options->ippo_flags & IPPOF_NO_IFF_EXPENSIVE) {
 436                         ipoa.ipoa_flags |= IPOAF_NO_EXPENSIVE;
 437                 }
 438                 if (options->ippo_flags & IPPOF_NO_IFF_CONSTRAINED) {
 439                         ipoa.ipoa_flags |= IPOAF_NO_CONSTRAINED;
 440                 }
 441         }
 442
 443         bzero(&ro, sizeof(struct route));
 444
 445         /* Put ip_len and ip_off in host byte order, ip_output expects that */
 446
 447 #if BYTE_ORDER != BIG_ENDIAN
 448         NTOHS(ip->ip_len);
 449         NTOHS(ip->ip_off);
 450 #endif
 451
 452         /* Send; enforce source interface selection via IP_OUTARGS flag */
 453         error = ip_output(m, NULL, &ro,
 454             IP_ALLOWBROADCAST | IP_RAWOUTPUT | IP_OUTARGS, imo, &ipoa);
 455
 456         /* Release the route */
 457         ROUTE_RELEASE(&ro);
 458
 459         if (imo != NULL) {
 460                 IMO_REMREF(imo);
 461         }
 462
 463         return error;
 464 }
 465
 466 static errno_t
 467 ipf_injectv6_out(mbuf_t data, ipfilter_t filter_ref, ipf_pktopts_t options)
 468 {
 469         struct route_in6 ro;
 470         struct ip6_hdr *ip6;
 471         struct mbuf *m = (struct mbuf *)data;
 472         errno_t error = 0;
 473         struct m_tag *mtag = NULL;
 474         struct ip6_moptions *im6o = NULL;
 475         struct ip6_out_args ip6oa;
 476
 477         bzero(&ip6oa, sizeof(ip6oa));
 478         ip6oa.ip6oa_boundif = IFSCOPE_NONE;
 479         ip6oa.ip6oa_sotc = SO_TC_UNSPEC;
 480         ip6oa.ip6oa_netsvctype = _NET_SERVICE_TYPE_UNSPEC;
 481
 482         /* Make the IP header contiguous in the mbuf */
 483         if ((size_t)m->m_len < sizeof(struct ip6_hdr)) {
 484                 m = m_pullup(m, sizeof(struct ip6_hdr));
 485                 if (m == NULL) {
 486                         return ENOMEM;
 487                 }
 488         }
 489         ip6 = (struct ip6_hdr *)m_mtod(m);
 490
 491         if (filter_ref != 0) {
 492                 mtag = m_tag_create(KERNEL_MODULE_TAG_ID,
 493                     KERNEL_TAG_TYPE_IPFILT, sizeof(ipfilter_t), M_NOWAIT, m);
 494                 if (mtag == NULL) {
 495                         m_freem(m);
 496                         return ENOMEM;
 497                 }
 498                 *(ipfilter_t *)(mtag + 1) = filter_ref;
 499                 m_tag_prepend(m, mtag);
 500         }
 501
 502         if (options != NULL && (options->ippo_flags & IPPOF_MCAST_OPTS) &&
 503             (im6o = ip6_allocmoptions(Z_NOWAIT)) != NULL) {
 504                 im6o->im6o_multicast_ifp = options->ippo_mcast_ifnet;
 505                 im6o->im6o_multicast_hlim = options->ippo_mcast_ttl;
 506                 im6o->im6o_multicast_loop = (u_char)options->ippo_mcast_loop;
 507         }
 508
 509         if (options != NULL) {
 510                 if (options->ippo_flags & IPPOF_SELECT_SRCIF) {
 511                         ip6oa.ip6oa_flags |= IP6OAF_SELECT_SRCIF;
 512                 }
 513                 if (options->ippo_flags & IPPOF_BOUND_IF) {
 514                         ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF;
 515                         ip6oa.ip6oa_boundif = options->ippo_flags >>
 516                             IPPOF_SHIFT_IFSCOPE;
 517                 }
 518                 if (options->ippo_flags & IPPOF_NO_IFT_CELLULAR) {
 519                         ip6oa.ip6oa_flags |= IP6OAF_NO_CELLULAR;
 520                 }
 521                 if (options->ippo_flags & IPPOF_BOUND_SRCADDR) {
 522                         ip6oa.ip6oa_flags |= IP6OAF_BOUND_SRCADDR;
 523                 }
 524                 if (options->ippo_flags & IPPOF_NO_IFF_EXPENSIVE) {
 525                         ip6oa.ip6oa_flags |= IP6OAF_NO_EXPENSIVE;
 526                 }
 527                 if (options->ippo_flags & IPPOF_NO_IFF_CONSTRAINED) {
 528                         ip6oa.ip6oa_flags |= IP6OAF_NO_CONSTRAINED;
 529                 }
 530         }
 531
 532         bzero(&ro, sizeof(struct route_in6));
 533
 534         /*
 535          * Send  mbuf and ifscope information. Check for correctness
 536          * of ifscope information is done while searching for a route in
 537          * ip6_output.
 538          */
 539         error = ip6_output(m, NULL, &ro, IPV6_OUTARGS, im6o, NULL, &ip6oa);
 540
 541         /* Release the route */
 542         ROUTE_RELEASE(&ro);
 543
 544         if (im6o != NULL) {
 545                 IM6O_REMREF(im6o);
 546         }
 547
 548         return error;
 549 }
 550
 551 errno_t
 552 ipf_inject_output(
 553         mbuf_t data,
 554         ipfilter_t filter_ref,
 555         ipf_pktopts_t options)
 556 {
 557         struct mbuf     *m = (struct mbuf *)data;
 558         u_int8_t        vers;
 559         errno_t         error = 0;
 560
 561         /* Make one byte of the header contiguous in the mbuf */
 562         if (m->m_len < 1) {
 563                 m = m_pullup(m, 1);
 564                 if (m == NULL) {
 565                         goto done;
 566                 }
 567         }
 568
 569         vers = (*(u_int8_t *)m_mtod(m)) >> 4;
 570         switch (vers) {
 571         case 4:
 572                 error = ipf_injectv4_out(data, filter_ref, options);
 573                 break;
 574         case 6:
 575                 error = ipf_injectv6_out(data, filter_ref, options);
 576                 break;
 577         default:
 578                 m_freem(m);
 579                 error = ENOTSUP;
 580                 break;
 581         }
 582
 583 done:
 584         return error;
 585 }
 586
 587 __private_extern__ ipfilter_t
 588 ipf_get_inject_filter(struct mbuf *m)
 589 {
 590         ipfilter_t filter_ref = 0;
 591         struct m_tag *mtag;
 592
 593         mtag = m_tag_locate(m, KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT, NULL);
 594         if (mtag) {
 595                 filter_ref = *(ipfilter_t *)(mtag + 1);
 596
 597                 m_tag_delete(m, mtag);
 598         }
 599         return filter_ref;
 600 }
 601
 602 __private_extern__ int
 603 ipf_init(void)
 604 {
 605         int error = 0;
 606         lck_grp_attr_t *grp_attributes = 0;
 607         lck_attr_t *lck_attributes = 0;
 608         lck_grp_t *lck_grp = 0;
 609
 610         grp_attributes = lck_grp_attr_alloc_init();
 611         if (grp_attributes == 0) {
 612                 printf("ipf_init: lck_grp_attr_alloc_init failed\n");
 613                 error = ENOMEM;
 614                 goto done;
 615         }
 616
 617         lck_grp = lck_grp_alloc_init("IP Filter", grp_attributes);
 618         if (lck_grp == 0) {
 619                 printf("ipf_init: lck_grp_alloc_init failed\n");
 620                 error = ENOMEM;
 621                 goto done;
 622         }
 623
 624         lck_attributes = lck_attr_alloc_init();
 625         if (lck_attributes == 0) {
 626                 printf("ipf_init: lck_attr_alloc_init failed\n");
 627                 error = ENOMEM;
 628                 goto done;
 629         }
 630
 631         lck_mtx_init(kipf_lock, lck_grp, lck_attributes);
 632
 633 done:
 634         if (lck_grp) {
 635                 lck_grp_free(lck_grp);
 636                 lck_grp = 0;
 637         }
 638         if (grp_attributes) {
 639                 lck_grp_attr_free(grp_attributes);
 640                 grp_attributes = 0;
 641         }
 642         if (lck_attributes) {
 643                 lck_attr_free(lck_attributes);
 644                 lck_attributes = 0;
 645         }
 646
 647         return error;
 648 }