bsd/netinet/kpi_ipfilter.c

   1 /*
   2  * Copyright (c) 2006 Apple Computer, Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_OSREFERENCE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License.  The rights granted to you under the
  10  * License may not be used to create, or enable the creation or
  11  * redistribution of, unlawful or unlicensed copies of an Apple operating
  12  * system, or to circumvent, violate, or enable the circumvention or
  13  * violation of, any terms of an Apple operating system software license
  14  * agreement.
  15  *
  16  * Please obtain a copy of the License at
  17  * http://www.opensource.apple.com/apsl/ and read it before using this
  18  * file.
  19  *
  20  * The Original Code and all software distributed under the License are
  21  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  22  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  23  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  24  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  25  * Please see the License for the specific language governing rights and
  26  * limitations under the License.
  27  *
  28  * @APPLE_LICENSE_OSREFERENCE_HEADER_END@
  29  */
  30
  31 #include <sys/param.h>  /* for definition of NULL */
  32 #include <sys/errno.h>
  33 #include <sys/malloc.h>
  34 #include <sys/socket.h>
  35 #include <sys/mbuf.h>
  36 #include <sys/systm.h>
  37
  38 #define _IP_VHL
  39 #include <net/if_var.h>
  40 #include <net/route.h>
  41 #include <net/kpi_protocol.h>
  42
  43 #include <netinet/in_systm.h>
  44 #include <netinet/in.h>
  45 #include <netinet/in_var.h>
  46 #include <netinet6/in6_var.h>
  47 #include <netinet/ip.h>
  48 #include <netinet/ip6.h>
  49 #include <netinet/ip_var.h>
  50 #include <netinet6/ip6_var.h>
  51 #include <netinet/kpi_ipfilter_var.h>
  52
  53 /*
  54  * kipf_lock and kipf_ref protect the linkage of the list of IP filters
  55  * An IP filter can be removed only when kipf_ref is zero
  56  * If an IP filter cannot be removed because kipf_ref is not null, then
  57  * the IP filter is marjed and kipf_delayed_remove is set so that when
  58  * kipf_ref eventually goes down to zero, the IP filter is removed
  59  */
  60 static lck_mtx_t *kipf_lock = 0;
  61 static unsigned long kipf_ref = 0;
  62 static unsigned long kipf_delayed_remove = 0;
  63
  64 __private_extern__ struct ipfilter_list ipv4_filters = TAILQ_HEAD_INITIALIZER(ipv4_filters);
  65 __private_extern__ struct ipfilter_list ipv6_filters = TAILQ_HEAD_INITIALIZER(ipv6_filters);
  66 __private_extern__ struct ipfilter_list tbr_filters = TAILQ_HEAD_INITIALIZER(tbr_filters);
  67
  68 __private_extern__ void
  69 ipf_ref(void)
  70 {
  71         lck_mtx_lock(kipf_lock);
  72     kipf_ref++;
  73         lck_mtx_unlock(kipf_lock);
  74 }
  75
  76 __private_extern__ void
  77 ipf_unref(void)
  78 {
  79         lck_mtx_lock(kipf_lock);
  80
  81     if (kipf_ref == 0)
  82         panic("ipf_unref: kipf_ref == 0\n");
  83
  84     kipf_ref--;
  85     if (kipf_ref == 0 && kipf_delayed_remove != 0) {
  86         struct ipfilter *filter;
  87
  88                 while ((filter = TAILQ_FIRST(&tbr_filters))) {
  89                         ipf_detach_func ipf_detach = filter->ipf_filter.ipf_detach;
  90                         void* cookie = filter->ipf_filter.cookie;
  91
  92                         TAILQ_REMOVE(filter->ipf_head, filter, ipf_link);
  93                         TAILQ_REMOVE(&tbr_filters, filter, ipf_tbr);
  94                         kipf_delayed_remove--;
  95
  96                         if (ipf_detach) {
  97                                 lck_mtx_unlock(kipf_lock);
  98                                 ipf_detach(cookie);
  99                                 lck_mtx_lock(kipf_lock);
 100                                 /* In case some filter got to run while we released the lock */
 101                                 if (kipf_ref != 0)
 102                                         break;
 103                         }
 104                 }
 105         }
 106         lck_mtx_unlock(kipf_lock);
 107 }
 108
 109 static errno_t
 110 ipf_add(
 111         const struct ipf_filter* filter,
 112         ipfilter_t *filter_ref,
 113         struct ipfilter_list *head)
 114 {
 115         struct ipfilter *new_filter;
 116         if (filter->name == NULL || (filter->ipf_input == NULL && filter->ipf_output == NULL))
 117                 return EINVAL;
 118
 119         MALLOC(new_filter, struct ipfilter*, sizeof(*new_filter), M_IFADDR, M_WAITOK);
 120         if (new_filter == NULL)
 121                 return ENOMEM;
 122
 123         lck_mtx_lock(kipf_lock);
 124         new_filter->ipf_filter = *filter;
 125         new_filter->ipf_head = head;
 126
 127         /*
 128          * 3957298
 129          * Make sure third parties have a chance to filter packets before
 130          * SharedIP. Always SharedIP at the end of the list.
 131          */
 132         if (filter->name != NULL &&
 133                 strcmp(filter->name, "com.apple.nke.SharedIP") == 0) {
 134                 TAILQ_INSERT_TAIL(head, new_filter, ipf_link);
 135         }
 136         else {
 137                 TAILQ_INSERT_HEAD(head, new_filter, ipf_link);
 138         }
 139
 140         lck_mtx_unlock(kipf_lock);
 141
 142         *filter_ref = (ipfilter_t)new_filter;
 143         return 0;
 144 }
 145
 146 errno_t
 147 ipf_addv4(
 148         const struct ipf_filter* filter,
 149         ipfilter_t *filter_ref)
 150 {
 151         return ipf_add(filter, filter_ref, &ipv4_filters);
 152 }
 153
 154 errno_t
 155 ipf_addv6(
 156         const struct ipf_filter* filter,
 157         ipfilter_t *filter_ref)
 158 {
 159         return ipf_add(filter, filter_ref, &ipv6_filters);
 160 }
 161
 162 errno_t
 163 ipf_remove(
 164         ipfilter_t filter_ref)
 165 {
 166         struct ipfilter *match = (struct ipfilter*)filter_ref;
 167         struct ipfilter_list *head;
 168
 169         if (match == 0 || (match->ipf_head != &ipv4_filters && match->ipf_head != &ipv6_filters))
 170                 return EINVAL;
 171
 172         head = match->ipf_head;
 173
 174         lck_mtx_lock(kipf_lock);
 175         TAILQ_FOREACH(match, head, ipf_link) {
 176                 if (match == (struct ipfilter*)filter_ref) {
 177                         ipf_detach_func ipf_detach = match->ipf_filter.ipf_detach;
 178                         void* cookie = match->ipf_filter.cookie;
 179
 180                         /*
 181                          * Cannot detach when they are filters running
 182                          */
 183                         if (kipf_ref) {
 184                                 kipf_delayed_remove++;
 185                                 TAILQ_INSERT_TAIL(&tbr_filters, match, ipf_tbr);
 186                                 match->ipf_filter.ipf_input = 0;
 187                                 match->ipf_filter.ipf_output = 0;
 188                                 lck_mtx_unlock(kipf_lock);
 189                         } else {
 190                                 TAILQ_REMOVE(head, match, ipf_link);
 191                                 lck_mtx_unlock(kipf_lock);
 192                                 if (ipf_detach)
 193                                         ipf_detach(cookie);
 194                                 FREE(match, M_IFADDR);
 195                         }
 196                         return 0;
 197                 }
 198         }
 199         lck_mtx_unlock(kipf_lock);
 200
 201         return ENOENT;
 202 }
 203
 204 int log_for_en1 = 0;
 205
 206 errno_t
 207 ipf_inject_input(
 208         mbuf_t data,
 209         ipfilter_t filter_ref)
 210 {
 211         struct mbuf     *m = (struct mbuf*)data;
 212         struct m_tag *mtag = 0;
 213         struct ip *ip = mtod(m, struct ip *);
 214         u_int8_t        vers;
 215         int hlen;
 216         errno_t error = 0;
 217         protocol_family_t proto;
 218
 219         vers = IP_VHL_V(ip->ip_vhl);
 220
 221         switch (vers) {
 222                 case 4:
 223                         proto = PF_INET;
 224                         break;
 225                 case 6:
 226                         proto = PF_INET6;
 227                         break;
 228                 default:
 229                         error = ENOTSUP;
 230                         goto done;
 231         }
 232
 233         if (filter_ref == 0 && m->m_pkthdr.rcvif == 0) {
 234                 m->m_pkthdr.rcvif = ifunit("lo0");
 235                 m->m_pkthdr.csum_data = 0;
 236                 m->m_pkthdr.csum_flags = 0;
 237                 if (vers == 4) {
 238                         hlen = IP_VHL_HL(ip->ip_vhl) << 2;
 239                         ip->ip_sum = 0;
 240                         ip->ip_sum = in_cksum(m, hlen);
 241                 }
 242         }
 243         if (filter_ref != 0) {
 244                 mtag = m_tag_alloc(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT,
 245                                                    sizeof (ipfilter_t), M_NOWAIT);
 246                 if (mtag == NULL) {
 247                         error = ENOMEM;
 248                         goto done;
 249                 }
 250                 *(ipfilter_t*)(mtag+1) = filter_ref;
 251                 m_tag_prepend(m, mtag);
 252         }
 253
 254         error = proto_inject(proto, data);
 255
 256 done:
 257         return error;
 258 }
 259
 260 static errno_t
 261 ipf_injectv4_out(
 262         mbuf_t data,
 263         ipfilter_t filter_ref,
 264         ipf_pktopts_t options)
 265 {
 266         struct route ro;
 267         struct sockaddr_in      *sin = (struct sockaddr_in*)&ro.ro_dst;
 268         struct ip       *ip;
 269         struct mbuf     *m = (struct mbuf*)data;
 270         errno_t error = 0;
 271         struct m_tag *mtag = 0;
 272         struct ip_moptions *imo = 0, ip_moptions;
 273
 274         /* Make the IP header contiguous in the mbuf */
 275         if ((size_t)m->m_len < sizeof(struct ip)) {
 276                 m = m_pullup(m, sizeof(struct ip));
 277                 if (m == NULL) return ENOMEM;
 278         }
 279         ip = (struct ip*)m_mtod(m);
 280
 281         if (filter_ref != 0) {
 282                 mtag = m_tag_alloc(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT,
 283                                                    sizeof (ipfilter_t), M_NOWAIT);
 284                 if (mtag == NULL) {
 285                         m_freem(m);
 286                         return ENOMEM;
 287                 }
 288                 *(ipfilter_t*)(mtag+1) = filter_ref;
 289                 m_tag_prepend(m, mtag);
 290         }
 291
 292         if (options && (options->ippo_flags & IPPOF_MCAST_OPTS)) {
 293                 imo = &ip_moptions;
 294
 295                 bzero(imo, sizeof(struct ip6_moptions));
 296                 imo->imo_multicast_ifp = options->ippo_mcast_ifnet;
 297                 imo->imo_multicast_ttl = options->ippo_mcast_ttl;
 298                 imo->imo_multicast_loop = options->ippo_mcast_loop;
 299         }
 300
 301         /* Fill out a route structure and get a route */
 302         bzero(&ro, sizeof(struct route));
 303         sin->sin_len = sizeof(struct sockaddr_in);
 304         sin->sin_family = AF_INET;
 305         sin->sin_port = 0;
 306         sin->sin_addr = ip->ip_dst;
 307         rtalloc(&ro);
 308         if (ro.ro_rt == NULL) {
 309                 m_freem(m);
 310                 return ENETUNREACH;
 311         }
 312         /* Send  */
 313         error = ip_output(m, NULL, &ro, IP_ALLOWBROADCAST | IP_RAWOUTPUT, imo);
 314
 315         /* Release the route */
 316         if (ro.ro_rt)
 317                 rtfree(ro.ro_rt);
 318
 319         return error;
 320 }
 321
 322 static errno_t
 323 ipf_injectv6_out(
 324         mbuf_t data,
 325         ipfilter_t filter_ref,
 326         ipf_pktopts_t options)
 327 {
 328         struct route_in6 ro;
 329         struct sockaddr_in6     *sin6 = &ro.ro_dst;
 330         struct ip6_hdr  *ip6;
 331         struct mbuf     *m = (struct mbuf*)data;
 332         errno_t error = 0;
 333         struct m_tag *mtag = 0;
 334         struct ip6_moptions *im6o = 0, ip6_moptions;
 335
 336         /* Make the IP header contiguous in the mbuf */
 337         if ((size_t)m->m_len < sizeof(struct ip6_hdr)) {
 338                 m = m_pullup(m, sizeof(struct ip6_hdr));
 339                 if (m == NULL) return ENOMEM;
 340         }
 341         ip6 = (struct ip6_hdr*)m_mtod(m);
 342
 343         if (filter_ref != 0) {
 344                 mtag = m_tag_alloc(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT,
 345                                                    sizeof (ipfilter_t), M_NOWAIT);
 346                 if (mtag == NULL) {
 347                         m_freem(m);
 348                         return ENOMEM;
 349                 }
 350                 *(ipfilter_t*)(mtag+1) = filter_ref;
 351                 m_tag_prepend(m, mtag);
 352         }
 353
 354         if (options && (options->ippo_flags & IPPOF_MCAST_OPTS)) {
 355                 im6o = &ip6_moptions;
 356
 357                 bzero(im6o, sizeof(struct ip6_moptions));
 358                 im6o->im6o_multicast_ifp = options->ippo_mcast_ifnet;
 359                 im6o->im6o_multicast_hlim = options->ippo_mcast_ttl;
 360                 im6o->im6o_multicast_loop = options->ippo_mcast_loop;
 361         }
 362
 363
 364         /* Fill out a route structure and get a route */
 365         bzero(&ro, sizeof(struct route_in6));
 366         sin6->sin6_len = sizeof(struct sockaddr_in6);
 367         sin6->sin6_family = AF_INET6;
 368         sin6->sin6_addr = ip6->ip6_dst;
 369 #if 0
 370         /* This is breaks loopback multicast! */
 371         /* The scope ID should already at s6_addr16[1] */
 372         if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
 373                 /* Hack, pull the scope_id out of the dest addr */
 374                 sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]);
 375                 ip6->ip6_dst.s6_addr16[1] = 0;
 376         } else
 377                 sin6->sin6_scope_id = 0;
 378 #endif
 379         rtalloc((struct route*)&ro);
 380         if (ro.ro_rt == NULL) {
 381                 m_freem(m);
 382                 return ENETUNREACH;
 383         }
 384
 385         /* Send  */
 386         error = ip6_output(m, NULL, &ro, 0, im6o, NULL, 0);
 387
 388         /* Release the route */
 389         if (ro.ro_rt)
 390                 rtfree(ro.ro_rt);
 391
 392         return error;
 393 }
 394
 395 errno_t
 396 ipf_inject_output(
 397         mbuf_t data,
 398         ipfilter_t filter_ref,
 399         ipf_pktopts_t options)
 400 {
 401         struct mbuf     *m = (struct mbuf*)data;
 402         u_int8_t        vers;
 403         errno_t         error = 0;
 404
 405         /* Make one byte of the header contiguous in the mbuf */
 406         if (m->m_len < 1) {
 407                 m = m_pullup(m, 1);
 408                 if (m == NULL)
 409                         goto done;
 410         }
 411
 412         vers = (*(u_int8_t*)m_mtod(m)) >> 4;
 413         switch (vers)
 414         {
 415                 case 4:
 416                         error = ipf_injectv4_out(data, filter_ref, options);
 417                         break;
 418                 case 6:
 419                         error = ipf_injectv6_out(data, filter_ref, options);
 420                         break;
 421                 default:
 422                         m_freem(m);
 423                         error = ENOTSUP;
 424                         break;
 425         }
 426
 427 done:
 428         return error;
 429 }
 430
 431 __private_extern__ ipfilter_t
 432 ipf_get_inject_filter(struct mbuf *m)
 433 {
 434         ipfilter_t filter_ref = 0;
 435         struct m_tag *mtag;
 436
 437         mtag = m_tag_locate(m, KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT, NULL);
 438         if (mtag) {
 439                 filter_ref = *(ipfilter_t *)(mtag+1);
 440
 441                 m_tag_delete(m, mtag);
 442         }
 443         return filter_ref;
 444 }
 445
 446 __private_extern__ int
 447 ipf_init(void)
 448 {
 449         int error = 0;
 450         lck_grp_attr_t *grp_attributes = 0;
 451         lck_attr_t *lck_attributes = 0;
 452         lck_grp_t *lck_grp = 0;
 453
 454         grp_attributes = lck_grp_attr_alloc_init();
 455         if (grp_attributes == 0) {
 456                 printf("ipf_init: lck_grp_attr_alloc_init failed\n");
 457                 error = ENOMEM;
 458                 goto done;
 459         }
 460         lck_grp_attr_setdefault(grp_attributes);
 461
 462         lck_grp = lck_grp_alloc_init("IP Filter", grp_attributes);
 463         if (lck_grp == 0) {
 464                 printf("ipf_init: lck_grp_alloc_init failed\n");
 465                 error = ENOMEM;
 466                 goto done;
 467         }
 468
 469         lck_attributes = lck_attr_alloc_init();
 470         if (lck_attributes == 0) {
 471                 printf("ipf_init: lck_attr_alloc_init failed\n");
 472                 error = ENOMEM;
 473                 goto done;
 474         }
 475         lck_attr_setdefault(lck_attributes);
 476
 477         kipf_lock = lck_mtx_alloc_init(lck_grp, lck_attributes);
 478         if (kipf_lock == 0) {
 479                 printf("ipf_init: lck_mtx_alloc_init failed\n");
 480                 error = ENOMEM;
 481                 goto done;
 482         }
 483         done:
 484         if (error != 0) {
 485                 if (kipf_lock) {
 486                         lck_mtx_free(kipf_lock, lck_grp);
 487                         kipf_lock = 0;
 488                 }
 489         }
 490         if (lck_grp) {
 491                 lck_grp_free(lck_grp);
 492                 lck_grp = 0;
 493         }
 494         if (grp_attributes) {
 495                 lck_grp_attr_free(grp_attributes);
 496                 grp_attributes = 0;
 497         }
 498         if (lck_attributes) {
 499                 lck_attr_free(lck_attributes);
 500                 lck_attributes = 0;
 501         }
 502
 503         return error;
 504 }