bsd/net/pf_ruleset.c

   1 /*
   2  * Copyright (c) 2007-2016 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 /*      $apfw: pf_ruleset.c,v 1.2 2007/08/10 03:00:16 jhw Exp $ */
  30 /*      $OpenBSD: pf_ruleset.c,v 1.1 2006/10/27 13:56:51 mcbride Exp $ */
  31
  32 /*
  33  * Copyright (c) 2001 Daniel Hartmeier
  34  * Copyright (c) 2002,2003 Henning Brauer
  35  * NAT64 - Copyright (c) 2010 Viagenie Inc. (http://www.viagenie.ca)
  36  * All rights reserved.
  37  *
  38  * Redistribution and use in source and binary forms, with or without
  39  * modification, are permitted provided that the following conditions
  40  * are met:
  41  *
  42  *    - Redistributions of source code must retain the above copyright
  43  *      notice, this list of conditions and the following disclaimer.
  44  *    - Redistributions in binary form must reproduce the above
  45  *      copyright notice, this list of conditions and the following
  46  *      disclaimer in the documentation and/or other materials provided
  47  *      with the distribution.
  48  *
  49  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  50  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  51  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  52  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  53  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  54  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  55  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  56  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  57  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  58  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  59  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  60  * POSSIBILITY OF SUCH DAMAGE.
  61  *
  62  * Effort sponsored in part by the Defense Advanced Research Projects
  63  * Agency (DARPA) and Air Force Research Laboratory, Air Force
  64  * Materiel Command, USAF, under agreement number F30602-01-2-0537.
  65  *
  66  */
  67
  68 #include <sys/param.h>
  69 #include <sys/socket.h>
  70 #ifdef KERNEL
  71 #include <sys/systm.h>
  72 #include <sys/malloc.h>
  73 #include <libkern/libkern.h>
  74 #endif /* KERNEL */
  75 #include <sys/mbuf.h>
  76
  77 #include <netinet/ip_dummynet.h>
  78 #include <netinet/in.h>
  79 #include <netinet/in_systm.h>
  80 #include <netinet/ip.h>
  81 #include <netinet/tcp.h>
  82
  83 #include <net/if.h>
  84 #include <net/pfvar.h>
  85
  86 #if INET6
  87 #include <netinet/ip6.h>
  88 #endif /* INET6 */
  89
  90
  91 #ifdef KERNEL
  92 #define DPFPRINTF(format, x...)         \
  93         if (pf_status.debug >= PF_DEBUG_NOISY)  \
  94                 printf(format, ##x)
  95 #define rs_malloc(x)            _MALLOC(x, M_TEMP, M_WAITOK)
  96 #define rs_free(x)              _FREE(x, M_TEMP)
  97 #define strrchr                 _strrchr
  98
  99 static char *
 100 _strrchr(const char *c, int ch)
 101 {
 102         char *p = (char *)(size_t)c, *save;
 103
 104         for (save = NULL; ; ++p) {
 105                 if (*p == ch)
 106                         save = (char *)p;
 107                 if (*p == '\0')
 108                         return (save);
 109         }
 110         /* NOTREACHED */
 111 }
 112
 113 #else
 114 /* Userland equivalents so we can lend code to pfctl et al. */
 115
 116 #include <arpa/inet.h>
 117 #include <errno.h>
 118 #include <stdio.h>
 119 #include <stdlib.h>
 120 #include <string.h>
 121 #define rs_malloc(x)             malloc(x)
 122 #define rs_free(x)               free(x)
 123
 124 #ifdef PFDEBUG
 125 #include <sys/stdarg.h>
 126 #define DPFPRINTF(format, x...) fprintf(stderr, format, ##x)
 127 #else
 128 #define DPFPRINTF(format, x...) ((void)0)
 129 #endif /* PFDEBUG */
 130 #endif /* KERNEL */
 131
 132
 133 struct pf_anchor_global  pf_anchors;
 134 struct pf_anchor         pf_main_anchor;
 135
 136 static __inline int pf_anchor_compare(struct pf_anchor *, struct pf_anchor *);
 137
 138 RB_GENERATE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare);
 139 RB_GENERATE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare);
 140
 141 static __inline int
 142 pf_anchor_compare(struct pf_anchor *a, struct pf_anchor *b)
 143 {
 144         int c = strcmp(a->path, b->path);
 145
 146         return (c ? (c < 0 ? -1 : 1) : 0);
 147 }
 148
 149 int
 150 pf_get_ruleset_number(u_int8_t action)
 151 {
 152         switch (action) {
 153         case PF_SCRUB:
 154         case PF_NOSCRUB:
 155                 return (PF_RULESET_SCRUB);
 156         case PF_PASS:
 157         case PF_DROP:
 158                 return (PF_RULESET_FILTER);
 159         case PF_NAT:
 160         case PF_NONAT:
 161                 return (PF_RULESET_NAT);
 162         case PF_BINAT:
 163         case PF_NOBINAT:
 164                 return (PF_RULESET_BINAT);
 165         case PF_RDR:
 166         case PF_NORDR:
 167         case PF_NAT64:
 168         case PF_NONAT64:
 169                 return (PF_RULESET_RDR);
 170 #if DUMMYNET
 171         case PF_DUMMYNET:
 172         case PF_NODUMMYNET:
 173                 return (PF_RULESET_DUMMYNET);
 174 #endif /* DUMMYNET */
 175         default:
 176                 return (PF_RULESET_MAX);
 177         }
 178 }
 179
 180 void
 181 pf_init_ruleset(struct pf_ruleset *ruleset)
 182 {
 183         int     i;
 184
 185         memset(ruleset, 0, sizeof (struct pf_ruleset));
 186         for (i = 0; i < PF_RULESET_MAX; i++) {
 187                 TAILQ_INIT(&ruleset->rules[i].queues[0]);
 188                 TAILQ_INIT(&ruleset->rules[i].queues[1]);
 189                 ruleset->rules[i].active.ptr = &ruleset->rules[i].queues[0];
 190                 ruleset->rules[i].inactive.ptr = &ruleset->rules[i].queues[1];
 191         }
 192 }
 193
 194 struct pf_anchor *
 195 pf_find_anchor(const char *path)
 196 {
 197         struct pf_anchor        *key, *found;
 198
 199         key = (struct pf_anchor *)rs_malloc(sizeof (*key));
 200         memset(key, 0, sizeof (*key));
 201         strlcpy(key->path, path, sizeof (key->path));
 202         found = RB_FIND(pf_anchor_global, &pf_anchors, key);
 203         rs_free(key);
 204         return (found);
 205 }
 206
 207 struct pf_ruleset *
 208 pf_find_ruleset(const char *path)
 209 {
 210         struct pf_anchor        *anchor;
 211
 212         while (*path == '/')
 213                 path++;
 214         if (!*path)
 215                 return (&pf_main_ruleset);
 216         anchor = pf_find_anchor(path);
 217         if (anchor == NULL)
 218                 return (NULL);
 219         else
 220                 return (&anchor->ruleset);
 221 }
 222
 223 struct pf_ruleset *
 224 pf_find_ruleset_with_owner(const char *path, const char *owner, int is_anchor,
 225     int *error)
 226 {
 227         struct pf_anchor        *anchor;
 228
 229         while (*path == '/')
 230                 path++;
 231         if (!*path)
 232                 return (&pf_main_ruleset);
 233         anchor = pf_find_anchor(path);
 234         if (anchor == NULL) {
 235                 *error = EINVAL;
 236                 return (NULL);
 237         } else {
 238                 if ((owner && (!strcmp(owner, anchor->owner)))
 239                     || (is_anchor && !strcmp(anchor->owner, "")))
 240                         return (&anchor->ruleset);
 241                 *error = EPERM;
 242                 return NULL;
 243         }
 244 }
 245
 246 struct pf_ruleset *
 247 pf_find_or_create_ruleset(const char *path)
 248 {
 249         char                    *p, *q = NULL, *r;
 250         struct pf_ruleset       *ruleset;
 251         struct pf_anchor        *anchor = 0, *dup, *parent = NULL;
 252
 253         if (path[0] == 0)
 254                 return (&pf_main_ruleset);
 255         while (*path == '/')
 256                 path++;
 257         ruleset = pf_find_ruleset(path);
 258         if (ruleset != NULL)
 259                 return (ruleset);
 260         p = (char *)rs_malloc(MAXPATHLEN);
 261         bzero(p, MAXPATHLEN);
 262         strlcpy(p, path, MAXPATHLEN);
 263         while (parent == NULL && (q = strrchr(p, '/')) != NULL) {
 264                 *q = 0;
 265                 if ((ruleset = pf_find_ruleset(p)) != NULL) {
 266                         parent = ruleset->anchor;
 267                         break;
 268                 }
 269         }
 270         if (q == NULL)
 271                 q = p;
 272         else
 273                 q++;
 274         strlcpy(p, path, MAXPATHLEN);
 275         if (!*q) {
 276                 rs_free(p);
 277                 return (NULL);
 278         }
 279         while ((r = strchr(q, '/')) != NULL || *q) {
 280                 if (r != NULL)
 281                         *r = 0;
 282                 if (!*q || strlen(q) >= PF_ANCHOR_NAME_SIZE ||
 283                     (parent != NULL && strlen(parent->path) >=
 284                     MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)) {
 285                         rs_free(p);
 286                         return (NULL);
 287                 }
 288                 anchor = (struct pf_anchor *)rs_malloc(sizeof (*anchor));
 289                 if (anchor == NULL) {
 290                         rs_free(p);
 291                         return (NULL);
 292                 }
 293                 memset(anchor, 0, sizeof (*anchor));
 294                 RB_INIT(&anchor->children);
 295                 strlcpy(anchor->name, q, sizeof (anchor->name));
 296                 if (parent != NULL) {
 297                         strlcpy(anchor->path, parent->path,
 298                             sizeof (anchor->path));
 299                         strlcat(anchor->path, "/", sizeof (anchor->path));
 300                 }
 301                 strlcat(anchor->path, anchor->name, sizeof (anchor->path));
 302                 if ((dup = RB_INSERT(pf_anchor_global, &pf_anchors, anchor)) !=
 303                     NULL) {
 304                         printf("pf_find_or_create_ruleset: RB_INSERT1 "
 305                             "'%s' '%s' collides with '%s' '%s'\n",
 306                             anchor->path, anchor->name, dup->path, dup->name);
 307                         rs_free(anchor);
 308                         rs_free(p);
 309                         return (NULL);
 310                 }
 311                 if (parent != NULL) {
 312                         anchor->parent = parent;
 313                         if ((dup = RB_INSERT(pf_anchor_node, &parent->children,
 314                             anchor)) != NULL) {
 315                                 printf("pf_find_or_create_ruleset: "
 316                                     "RB_INSERT2 '%s' '%s' collides with "
 317                                     "'%s' '%s'\n", anchor->path, anchor->name,
 318                                     dup->path, dup->name);
 319                                 RB_REMOVE(pf_anchor_global, &pf_anchors,
 320                                     anchor);
 321                                 rs_free(anchor);
 322                                 rs_free(p);
 323                                 return (NULL);
 324                         }
 325                 }
 326                 pf_init_ruleset(&anchor->ruleset);
 327                 anchor->ruleset.anchor = anchor;
 328                 parent = anchor;
 329                 if (r != NULL)
 330                         q = r + 1;
 331                 else
 332                         *q = 0;
 333 #if DUMMYNET
 334                 if(strncmp("com.apple.nlc", anchor->name,
 335                     sizeof("com.apple.nlc")) == 0)
 336                         is_nlc_enabled_glb = TRUE;
 337 #endif
 338         }
 339         rs_free(p);
 340         return (anchor ? &anchor->ruleset : 0);
 341 }
 342
 343 void
 344 pf_remove_if_empty_ruleset(struct pf_ruleset *ruleset)
 345 {
 346         struct pf_anchor        *parent;
 347         int                      i;
 348
 349         while (ruleset != NULL) {
 350                 if (ruleset == &pf_main_ruleset || ruleset->anchor == NULL ||
 351                     !RB_EMPTY(&ruleset->anchor->children) ||
 352                     ruleset->anchor->refcnt > 0 || ruleset->tables > 0 ||
 353                     ruleset->topen)
 354                         return;
 355                 for (i = 0; i < PF_RULESET_MAX; ++i)
 356                         if (!TAILQ_EMPTY(ruleset->rules[i].active.ptr) ||
 357                             !TAILQ_EMPTY(ruleset->rules[i].inactive.ptr) ||
 358                             ruleset->rules[i].inactive.open)
 359                                 return;
 360                 RB_REMOVE(pf_anchor_global, &pf_anchors, ruleset->anchor);
 361 #if DUMMYNET
 362                 if(strncmp("com.apple.nlc", ruleset->anchor->name,
 363                     sizeof("com.apple.nlc")) == 0) {
 364                         struct dummynet_event dn_event;
 365                         bzero(&dn_event, sizeof(dn_event));
 366                         dn_event.dn_event_code = DUMMYNET_NLC_DISABLED;
 367                         dummynet_event_enqueue_nwk_wq_entry(&dn_event);
 368                         is_nlc_enabled_glb = FALSE;
 369                 }
 370 #endif
 371                 if ((parent = ruleset->anchor->parent) != NULL)
 372                         RB_REMOVE(pf_anchor_node, &parent->children,
 373                             ruleset->anchor);
 374                 rs_free(ruleset->anchor);
 375                 if (parent == NULL)
 376                         return;
 377                 ruleset = &parent->ruleset;
 378         }
 379 }
 380
 381 int
 382 pf_anchor_setup(struct pf_rule *r, const struct pf_ruleset *s,
 383     const char *name)
 384 {
 385         char                    *p, *path;
 386         struct pf_ruleset       *ruleset;
 387
 388         r->anchor = NULL;
 389         r->anchor_relative = 0;
 390         r->anchor_wildcard = 0;
 391         if (!name[0])
 392                 return (0);
 393         path = (char *)rs_malloc(MAXPATHLEN);
 394         bzero(path, MAXPATHLEN);
 395         if (name[0] == '/')
 396                 strlcpy(path, name + 1, MAXPATHLEN);
 397         else {
 398                 /* relative path */
 399                 r->anchor_relative = 1;
 400                 if (s->anchor == NULL || !s->anchor->path[0])
 401                         path[0] = 0;
 402                 else
 403                         strlcpy(path, s->anchor->path, MAXPATHLEN);
 404                 while (name[0] == '.' && name[1] == '.' && name[2] == '/') {
 405                         if (!path[0]) {
 406                                 printf("pf_anchor_setup: .. beyond root\n");
 407                                 rs_free(path);
 408                                 return (1);
 409                         }
 410                         if ((p = strrchr(path, '/')) != NULL)
 411                                 *p = 0;
 412                         else
 413                                 path[0] = 0;
 414                         r->anchor_relative++;
 415                         name += 3;
 416                 }
 417                 if (path[0])
 418                         strlcat(path, "/", MAXPATHLEN);
 419                 strlcat(path, name, MAXPATHLEN);
 420         }
 421         if ((p = strrchr(path, '/')) != NULL && strcmp(p, "/*") == 0) {
 422                 r->anchor_wildcard = 1;
 423                 *p = 0;
 424         }
 425         ruleset = pf_find_or_create_ruleset(path);
 426         rs_free(path);
 427         if (ruleset == NULL || ruleset->anchor == NULL) {
 428                 printf("pf_anchor_setup: ruleset\n");
 429                 return (1);
 430         }
 431         r->anchor = ruleset->anchor;
 432         r->anchor->refcnt++;
 433         return (0);
 434 }
 435
 436 int
 437 pf_anchor_copyout(const struct pf_ruleset *rs, const struct pf_rule *r,
 438     struct pfioc_rule *pr)
 439 {
 440         pr->anchor_call[0] = 0;
 441         if (r->anchor == NULL)
 442                 return (0);
 443         if (!r->anchor_relative) {
 444                 strlcpy(pr->anchor_call, "/", sizeof (pr->anchor_call));
 445                 strlcat(pr->anchor_call, r->anchor->path,
 446                     sizeof (pr->anchor_call));
 447         } else {
 448                 char    *a, *p;
 449                 int      i;
 450
 451                 a = (char *)rs_malloc(MAXPATHLEN);
 452                 bzero(a, MAXPATHLEN);
 453                 if (rs->anchor == NULL)
 454                         a[0] = 0;
 455                 else
 456                         strlcpy(a, rs->anchor->path, MAXPATHLEN);
 457                 for (i = 1; i < r->anchor_relative; ++i) {
 458                         if ((p = strrchr(a, '/')) == NULL)
 459                                 p = a;
 460                         *p = 0;
 461                         strlcat(pr->anchor_call, "../",
 462                             sizeof (pr->anchor_call));
 463                 }
 464                 if (strncmp(a, r->anchor->path, strlen(a))) {
 465                         printf("pf_anchor_copyout: '%s' '%s'\n", a,
 466                             r->anchor->path);
 467                         rs_free(a);
 468                         return (1);
 469                 }
 470                 if (strlen(r->anchor->path) > strlen(a))
 471                         strlcat(pr->anchor_call, r->anchor->path + (a[0] ?
 472                             strlen(a) + 1 : 0), sizeof (pr->anchor_call));
 473                 rs_free(a);
 474         }
 475         if (r->anchor_wildcard)
 476                 strlcat(pr->anchor_call, pr->anchor_call[0] ? "/*" : "*",
 477                     sizeof (pr->anchor_call));
 478         return (0);
 479 }
 480
 481 void
 482 pf_anchor_remove(struct pf_rule *r)
 483 {
 484         if (r->anchor == NULL)
 485                 return;
 486         if (r->anchor->refcnt <= 0) {
 487                 printf("pf_anchor_remove: broken refcount\n");
 488                 r->anchor = NULL;
 489                 return;
 490         }
 491         if (!--r->anchor->refcnt)
 492                 pf_remove_if_empty_ruleset(&r->anchor->ruleset);
 493         r->anchor = NULL;
 494 }