bsd/netinet/kpi_ipfilter.c

   1 /*
   2  * Copyright (c) 2004-2018 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #include <sys/param.h>  /* for definition of NULL */
  30 #include <sys/errno.h>
  31 #include <sys/malloc.h>
  32 #include <sys/socket.h>
  33 #include <sys/mbuf.h>
  34 #include <sys/systm.h>
  35 #include <libkern/OSAtomic.h>
  36
  37 #include <machine/endian.h>
  38
  39 #define _IP_VHL
  40 #include <net/if_var.h>
  41 #include <net/route.h>
  42 #include <net/kpi_protocol.h>
  43 #include <net/net_api_stats.h>
  44
  45 #include <netinet/in_systm.h>
  46 #include <netinet/in.h>
  47 #include <netinet/in_var.h>
  48 #include <netinet6/in6_var.h>
  49 #include <netinet/ip.h>
  50 #include <netinet/ip6.h>
  51 #include <netinet/ip_var.h>
  52 #include <netinet6/ip6_var.h>
  53 #include <netinet/kpi_ipfilter_var.h>
  54
  55 #include <stdbool.h>
  56
  57 /*
  58  * kipf_lock and kipf_ref protect the linkage of the list of IP filters
  59  * An IP filter can be removed only when kipf_ref is zero
  60  * If an IP filter cannot be removed because kipf_ref is not null, then
  61  * the IP filter is marjed and kipf_delayed_remove is set so that when
  62  * kipf_ref eventually goes down to zero, the IP filter is removed
  63  */
  64 decl_lck_mtx_data(static, kipf_lock_data);
  65 static lck_mtx_t *kipf_lock = &kipf_lock_data;
  66 static u_int32_t kipf_ref = 0;
  67 static u_int32_t kipf_delayed_remove = 0;
  68 u_int32_t kipf_count = 0;
  69
  70 __private_extern__ struct ipfilter_list ipv4_filters = TAILQ_HEAD_INITIALIZER(ipv4_filters);
  71 __private_extern__ struct ipfilter_list ipv6_filters = TAILQ_HEAD_INITIALIZER(ipv6_filters);
  72 __private_extern__ struct ipfilter_list tbr_filters = TAILQ_HEAD_INITIALIZER(tbr_filters);
  73
  74 #undef ipf_addv4
  75 #undef ipf_addv6
  76 extern errno_t ipf_addv4(const struct ipf_filter *filter,
  77     ipfilter_t *filter_ref);
  78 extern errno_t ipf_addv6(const struct ipf_filter *filter,
  79     ipfilter_t *filter_ref);
  80
  81 static errno_t ipf_add(const struct ipf_filter *filter,
  82     ipfilter_t *filter_ref, struct ipfilter_list *head, bool is_internal);
  83
  84 __private_extern__ void
  85 ipf_ref(void)
  86 {
  87         lck_mtx_lock(kipf_lock);
  88         kipf_ref++;
  89         lck_mtx_unlock(kipf_lock);
  90 }
  91
  92 __private_extern__ void
  93 ipf_unref(void)
  94 {
  95         lck_mtx_lock(kipf_lock);
  96
  97         if (kipf_ref == 0)
  98                 panic("ipf_unref: kipf_ref == 0\n");
  99
 100         kipf_ref--;
 101         if (kipf_ref == 0 && kipf_delayed_remove != 0) {
 102                 struct ipfilter *filter;
 103
 104                 while ((filter = TAILQ_FIRST(&tbr_filters))) {
 105                         VERIFY(OSDecrementAtomic64(&net_api_stats.nas_ipf_add_count) > 0);
 106
 107                         ipf_detach_func ipf_detach = filter->ipf_filter.ipf_detach;
 108                         void* cookie = filter->ipf_filter.cookie;
 109
 110                         TAILQ_REMOVE(filter->ipf_head, filter, ipf_link);
 111                         TAILQ_REMOVE(&tbr_filters, filter, ipf_tbr);
 112                         kipf_delayed_remove--;
 113
 114                         if (ipf_detach) {
 115                                 lck_mtx_unlock(kipf_lock);
 116                                 ipf_detach(cookie);
 117                                 lck_mtx_lock(kipf_lock);
 118                                 /* In case some filter got to run while we released the lock */
 119                                 if (kipf_ref != 0)
 120                                         break;
 121                         }
 122                 }
 123         }
 124         lck_mtx_unlock(kipf_lock);
 125 }
 126
 127 static errno_t
 128 ipf_add(
 129         const struct ipf_filter *filter,
 130         ipfilter_t *filter_ref,
 131         struct ipfilter_list *head,
 132         bool is_internal)
 133 {
 134         struct ipfilter *new_filter;
 135         if (filter->name == NULL || (filter->ipf_input == NULL && filter->ipf_output == NULL))
 136                 return (EINVAL);
 137
 138         MALLOC(new_filter, struct ipfilter *, sizeof(*new_filter), M_IFADDR, M_WAITOK);
 139         if (new_filter == NULL)
 140                 return (ENOMEM);
 141
 142         lck_mtx_lock(kipf_lock);
 143         new_filter->ipf_filter = *filter;
 144         new_filter->ipf_head = head;
 145
 146         TAILQ_INSERT_HEAD(head, new_filter, ipf_link);
 147
 148         OSIncrementAtomic64(&net_api_stats.nas_ipf_add_count);
 149         INC_ATOMIC_INT64_LIM(net_api_stats.nas_ipf_add_total);
 150         if (is_internal) {
 151                 INC_ATOMIC_INT64_LIM(net_api_stats.nas_ipf_add_os_total);
 152         }
 153
 154         lck_mtx_unlock(kipf_lock);
 155
 156         *filter_ref = (ipfilter_t)new_filter;
 157
 158         /* This will force TCP to re-evaluate its use of TSO */
 159         OSAddAtomic(1, &kipf_count);
 160         routegenid_update();
 161
 162         return (0);
 163 }
 164
 165 errno_t
 166 ipf_addv4_internal(
 167         const struct ipf_filter *filter,
 168         ipfilter_t *filter_ref)
 169 {
 170         return (ipf_add(filter, filter_ref, &ipv4_filters, true));
 171 }
 172
 173 errno_t
 174 ipf_addv4(
 175         const struct ipf_filter *filter,
 176         ipfilter_t *filter_ref)
 177 {
 178         return (ipf_add(filter, filter_ref, &ipv4_filters, false));
 179 }
 180
 181 errno_t
 182 ipf_addv6_internal(
 183         const struct ipf_filter *filter,
 184         ipfilter_t *filter_ref)
 185 {
 186         return (ipf_add(filter, filter_ref, &ipv6_filters, true));
 187 }
 188
 189 errno_t
 190 ipf_addv6(
 191         const struct ipf_filter *filter,
 192         ipfilter_t *filter_ref)
 193 {
 194         return (ipf_add(filter, filter_ref, &ipv6_filters, false));
 195 }
 196
 197 static errno_t
 198 ipf_input_detached(void *cookie, mbuf_t *data, int offset, u_int8_t protocol)
 199 {
 200 #pragma unused(cookie, data, offset, protocol)
 201
 202 #if DEBUG
 203         printf("ipf_input_detached\n");
 204 #endif /* DEBUG */
 205
 206         return (0);
 207 }
 208
 209 static errno_t
 210 ipf_output_detached(void *cookie, mbuf_t *data, ipf_pktopts_t options)
 211 {
 212 #pragma unused(cookie, data, options)
 213
 214 #if DEBUG
 215         printf("ipf_output_detached\n");
 216 #endif /* DEBUG */
 217
 218         return (0);
 219 }
 220
 221 errno_t
 222 ipf_remove(
 223         ipfilter_t filter_ref)
 224 {
 225         struct ipfilter *match = (struct ipfilter *)filter_ref;
 226         struct ipfilter_list *head;
 227
 228         if (match == 0 || (match->ipf_head != &ipv4_filters && match->ipf_head != &ipv6_filters))
 229                 return (EINVAL);
 230
 231         head = match->ipf_head;
 232
 233         lck_mtx_lock(kipf_lock);
 234         TAILQ_FOREACH(match, head, ipf_link) {
 235                 if (match == (struct ipfilter *)filter_ref) {
 236                         ipf_detach_func ipf_detach = match->ipf_filter.ipf_detach;
 237                         void* cookie = match->ipf_filter.cookie;
 238
 239                         /*
 240                          * Cannot detach when they are filters running
 241                          */
 242                         if (kipf_ref) {
 243                                 kipf_delayed_remove++;
 244                                 TAILQ_INSERT_TAIL(&tbr_filters, match, ipf_tbr);
 245                                 match->ipf_filter.ipf_input = ipf_input_detached;
 246                                 match->ipf_filter.ipf_output = ipf_output_detached;
 247                                 lck_mtx_unlock(kipf_lock);
 248                         } else {
 249                                 VERIFY(OSDecrementAtomic64(&net_api_stats.nas_ipf_add_count) > 0);
 250
 251                                 TAILQ_REMOVE(head, match, ipf_link);
 252                                 lck_mtx_unlock(kipf_lock);
 253
 254                                 if (ipf_detach)
 255                                         ipf_detach(cookie);
 256                                 FREE(match, M_IFADDR);
 257
 258                                 /* This will force TCP to re-evaluate its use of TSO */
 259                                 OSAddAtomic(-1, &kipf_count);
 260                                 routegenid_update();
 261
 262                         }
 263                         return (0);
 264                 }
 265         }
 266         lck_mtx_unlock(kipf_lock);
 267
 268         return (ENOENT);
 269 }
 270
 271 int log_for_en1 = 0;
 272
 273 errno_t
 274 ipf_inject_input(
 275         mbuf_t data,
 276         ipfilter_t filter_ref)
 277 {
 278         struct mbuf *m = (struct mbuf *)data;
 279         struct m_tag *mtag = 0;
 280         struct ip *ip = mtod(m, struct ip *);
 281         struct ip6_hdr *ip6;
 282         u_int8_t        vers;
 283         int hlen;
 284         errno_t error = 0;
 285         protocol_family_t proto;
 286         struct in_ifaddr *ia = NULL;
 287         struct in_addr *pkt_dst = NULL;
 288         struct in6_ifaddr *ia6 = NULL;
 289         struct sockaddr_in6 pkt_dst6;
 290
 291         vers = IP_VHL_V(ip->ip_vhl);
 292
 293         switch (vers) {
 294                 case 4:
 295                         proto = PF_INET;
 296                         break;
 297                 case 6:
 298                         proto = PF_INET6;
 299                         break;
 300                 default:
 301                         error = ENOTSUP;
 302                         goto done;
 303         }
 304
 305         if (filter_ref == 0 && m->m_pkthdr.rcvif == 0) {
 306                 /*
 307                  * Search for interface with the local address
 308                  */
 309                 switch (proto) {
 310                         case PF_INET:
 311                                 pkt_dst = &ip->ip_dst;
 312                                 lck_rw_lock_shared(in_ifaddr_rwlock);
 313                                 TAILQ_FOREACH(ia, INADDR_HASH(pkt_dst->s_addr), ia_hash) {
 314                                         if (IA_SIN(ia)->sin_addr.s_addr == pkt_dst->s_addr) {
 315                                                 m->m_pkthdr.rcvif = ia->ia_ifp;
 316                                                 break;
 317                                         }
 318                                 }
 319                                 lck_rw_done(in_ifaddr_rwlock);
 320                                 break;
 321
 322                         case PF_INET6:
 323                                 ip6 = mtod(m, struct ip6_hdr *);
 324                                 pkt_dst6.sin6_addr = ip6->ip6_dst;
 325                                 lck_rw_lock_shared(&in6_ifaddr_rwlock);
 326                                 for (ia6 = in6_ifaddrs; ia6 != NULL; ia6 = ia6->ia_next) {
 327                                         if (IN6_ARE_ADDR_EQUAL(&ia6->ia_addr.sin6_addr, &pkt_dst6.sin6_addr)) {
 328                                                 m->m_pkthdr.rcvif = ia6->ia_ifp;
 329                                                 break;
 330                                         }
 331                                 }
 332                                 lck_rw_done(&in6_ifaddr_rwlock);
 333                                 break;
 334
 335                         default:
 336                                 break;
 337                 }
 338
 339                 /*
 340                  * If none found, fallback to loopback
 341                  */
 342                 if (m->m_pkthdr.rcvif == NULL) {
 343                         m->m_pkthdr.rcvif = lo_ifp;
 344                 }
 345
 346                 m->m_pkthdr.csum_data = 0;
 347                 m->m_pkthdr.csum_flags = 0;
 348                 if (vers == 4) {
 349                         hlen = IP_VHL_HL(ip->ip_vhl) << 2;
 350                         ip->ip_sum = 0;
 351                         ip->ip_sum = in_cksum(m, hlen);
 352                 }
 353         }
 354         if (filter_ref != 0) {
 355                 mtag = m_tag_create(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT,
 356                     sizeof (ipfilter_t), M_NOWAIT, m);
 357                 if (mtag == NULL) {
 358                         error = ENOMEM;
 359                         goto done;
 360                 }
 361                 *(ipfilter_t *)(mtag+1) = filter_ref;
 362                 m_tag_prepend(m, mtag);
 363         }
 364
 365         error = proto_inject(proto, data);
 366
 367 done:
 368         return (error);
 369 }
 370
 371 static errno_t
 372 ipf_injectv4_out(mbuf_t data, ipfilter_t filter_ref, ipf_pktopts_t options)
 373 {
 374         struct route ro;
 375         struct ip *ip;
 376         struct mbuf *m = (struct mbuf *)data;
 377         errno_t error = 0;
 378         struct m_tag *mtag = NULL;
 379         struct ip_moptions *imo = NULL;
 380         struct ip_out_args ipoa;
 381
 382         bzero(&ipoa, sizeof(ipoa));
 383         ipoa.ipoa_boundif = IFSCOPE_NONE;
 384         ipoa.ipoa_sotc = SO_TC_UNSPEC;
 385         ipoa.ipoa_netsvctype = _NET_SERVICE_TYPE_UNSPEC;
 386
 387         /* Make the IP header contiguous in the mbuf */
 388         if ((size_t)m->m_len < sizeof (struct ip)) {
 389                 m = m_pullup(m, sizeof (struct ip));
 390                 if (m == NULL)
 391                         return (ENOMEM);
 392         }
 393         ip = (struct ip *)m_mtod(m);
 394
 395         if (filter_ref != 0) {
 396                 mtag = m_tag_create(KERNEL_MODULE_TAG_ID,
 397                     KERNEL_TAG_TYPE_IPFILT, sizeof (ipfilter_t), M_NOWAIT, m);
 398                 if (mtag == NULL) {
 399                         m_freem(m);
 400                         return (ENOMEM);
 401                 }
 402                 *(ipfilter_t *)(mtag + 1) = filter_ref;
 403                 m_tag_prepend(m, mtag);
 404         }
 405
 406         if (options != NULL && (options->ippo_flags & IPPOF_MCAST_OPTS) &&
 407             (imo = ip_allocmoptions(M_DONTWAIT)) != NULL) {
 408                 imo->imo_multicast_ifp = options->ippo_mcast_ifnet;
 409                 imo->imo_multicast_ttl = options->ippo_mcast_ttl;
 410                 imo->imo_multicast_loop = options->ippo_mcast_loop;
 411         }
 412
 413         if (options != NULL) {
 414                 if (options->ippo_flags & IPPOF_SELECT_SRCIF)
 415                         ipoa.ipoa_flags |= IPOAF_SELECT_SRCIF;
 416                 if (options->ippo_flags & IPPOF_BOUND_IF) {
 417                         ipoa.ipoa_flags |= IPOAF_BOUND_IF;
 418                         ipoa.ipoa_boundif = options->ippo_flags >>
 419                             IPPOF_SHIFT_IFSCOPE;
 420                 }
 421                 if (options->ippo_flags & IPPOF_NO_IFT_CELLULAR)
 422                         ipoa.ipoa_flags |= IPOAF_NO_CELLULAR;
 423                 if (options->ippo_flags & IPPOF_BOUND_SRCADDR)
 424                         ipoa.ipoa_flags |= IPOAF_BOUND_SRCADDR;
 425                 if (options->ippo_flags & IPPOF_NO_IFF_EXPENSIVE)
 426                         ipoa.ipoa_flags |= IPOAF_NO_EXPENSIVE;
 427         }
 428
 429         bzero(&ro, sizeof(struct route));
 430
 431         /* Put ip_len and ip_off in host byte order, ip_output expects that */
 432
 433 #if BYTE_ORDER != BIG_ENDIAN
 434         NTOHS(ip->ip_len);
 435         NTOHS(ip->ip_off);
 436 #endif
 437
 438         /* Send; enforce source interface selection via IP_OUTARGS flag */
 439         error = ip_output(m, NULL, &ro,
 440             IP_ALLOWBROADCAST | IP_RAWOUTPUT | IP_OUTARGS, imo, &ipoa);
 441
 442         /* Release the route */
 443         ROUTE_RELEASE(&ro);
 444
 445         if (imo != NULL)
 446                 IMO_REMREF(imo);
 447
 448         return (error);
 449 }
 450
 451 #if INET6
 452 static errno_t
 453 ipf_injectv6_out(mbuf_t data, ipfilter_t filter_ref, ipf_pktopts_t options)
 454 {
 455         struct route_in6 ro;
 456         struct ip6_hdr *ip6;
 457         struct mbuf *m = (struct mbuf *)data;
 458         errno_t error = 0;
 459         struct m_tag *mtag = NULL;
 460         struct ip6_moptions *im6o = NULL;
 461         struct ip6_out_args ip6oa;
 462
 463         bzero(&ip6oa, sizeof(ip6oa));
 464         ip6oa.ip6oa_boundif = IFSCOPE_NONE;
 465         ip6oa.ip6oa_sotc = SO_TC_UNSPEC;
 466         ip6oa.ip6oa_netsvctype = _NET_SERVICE_TYPE_UNSPEC;
 467
 468         /* Make the IP header contiguous in the mbuf */
 469         if ((size_t)m->m_len < sizeof(struct ip6_hdr)) {
 470                 m = m_pullup(m, sizeof(struct ip6_hdr));
 471                 if (m == NULL)
 472                         return (ENOMEM);
 473         }
 474         ip6 = (struct ip6_hdr *)m_mtod(m);
 475
 476         if (filter_ref != 0) {
 477                 mtag = m_tag_create(KERNEL_MODULE_TAG_ID,
 478                     KERNEL_TAG_TYPE_IPFILT, sizeof (ipfilter_t), M_NOWAIT, m);
 479                 if (mtag == NULL) {
 480                         m_freem(m);
 481                         return (ENOMEM);
 482                 }
 483                 *(ipfilter_t *)(mtag + 1) = filter_ref;
 484                 m_tag_prepend(m, mtag);
 485         }
 486
 487         if (options != NULL && (options->ippo_flags & IPPOF_MCAST_OPTS) &&
 488             (im6o = ip6_allocmoptions(M_DONTWAIT)) != NULL) {
 489                 im6o->im6o_multicast_ifp = options->ippo_mcast_ifnet;
 490                 im6o->im6o_multicast_hlim = options->ippo_mcast_ttl;
 491                 im6o->im6o_multicast_loop = options->ippo_mcast_loop;
 492         }
 493
 494         if (options != NULL) {
 495                 if (options->ippo_flags & IPPOF_SELECT_SRCIF)
 496                         ip6oa.ip6oa_flags |= IP6OAF_SELECT_SRCIF;
 497                 if (options->ippo_flags & IPPOF_BOUND_IF) {
 498                         ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF;
 499                         ip6oa.ip6oa_boundif = options->ippo_flags >>
 500                             IPPOF_SHIFT_IFSCOPE;
 501                 }
 502                 if (options->ippo_flags & IPPOF_NO_IFT_CELLULAR)
 503                         ip6oa.ip6oa_flags |= IP6OAF_NO_CELLULAR;
 504                 if (options->ippo_flags & IPPOF_BOUND_SRCADDR)
 505                         ip6oa.ip6oa_flags |= IP6OAF_BOUND_SRCADDR;
 506                 if (options->ippo_flags & IPPOF_NO_IFF_EXPENSIVE)
 507                         ip6oa.ip6oa_flags |= IP6OAF_NO_EXPENSIVE;
 508         }
 509
 510         bzero(&ro, sizeof(struct route_in6));
 511
 512         /*
 513          * Send  mbuf and ifscope information. Check for correctness
 514          * of ifscope information is done while searching for a route in
 515          * ip6_output.
 516          */
 517         error = ip6_output(m, NULL, &ro, IPV6_OUTARGS, im6o, NULL, &ip6oa);
 518
 519         /* Release the route */
 520         ROUTE_RELEASE(&ro);
 521
 522         if (im6o != NULL)
 523                 IM6O_REMREF(im6o);
 524
 525         return (error);
 526 }
 527 #endif /* INET6 */
 528
 529 errno_t
 530 ipf_inject_output(
 531         mbuf_t data,
 532         ipfilter_t filter_ref,
 533         ipf_pktopts_t options)
 534 {
 535         struct mbuf     *m = (struct mbuf *)data;
 536         u_int8_t        vers;
 537         errno_t         error = 0;
 538
 539         /* Make one byte of the header contiguous in the mbuf */
 540         if (m->m_len < 1) {
 541                 m = m_pullup(m, 1);
 542                 if (m == NULL)
 543                         goto done;
 544         }
 545
 546         vers = (*(u_int8_t *)m_mtod(m)) >> 4;
 547         switch (vers) {
 548                 case 4:
 549                         error = ipf_injectv4_out(data, filter_ref, options);
 550                         break;
 551 #if INET6
 552                 case 6:
 553                         error = ipf_injectv6_out(data, filter_ref, options);
 554                         break;
 555 #endif
 556                 default:
 557                         m_freem(m);
 558                         error = ENOTSUP;
 559                         break;
 560         }
 561
 562 done:
 563         return (error);
 564 }
 565
 566 __private_extern__ ipfilter_t
 567 ipf_get_inject_filter(struct mbuf *m)
 568 {
 569         ipfilter_t filter_ref = 0;
 570         struct m_tag *mtag;
 571
 572         mtag = m_tag_locate(m, KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT, NULL);
 573         if (mtag) {
 574                 filter_ref = *(ipfilter_t *)(mtag+1);
 575
 576                 m_tag_delete(m, mtag);
 577         }
 578         return (filter_ref);
 579 }
 580
 581 __private_extern__ int
 582 ipf_init(void)
 583 {
 584         int error = 0;
 585         lck_grp_attr_t *grp_attributes = 0;
 586         lck_attr_t *lck_attributes = 0;
 587         lck_grp_t *lck_grp = 0;
 588
 589         grp_attributes = lck_grp_attr_alloc_init();
 590         if (grp_attributes == 0) {
 591                 printf("ipf_init: lck_grp_attr_alloc_init failed\n");
 592                 error = ENOMEM;
 593                 goto done;
 594         }
 595
 596         lck_grp = lck_grp_alloc_init("IP Filter", grp_attributes);
 597         if (lck_grp == 0) {
 598                 printf("ipf_init: lck_grp_alloc_init failed\n");
 599                 error = ENOMEM;
 600                 goto done;
 601         }
 602
 603         lck_attributes = lck_attr_alloc_init();
 604         if (lck_attributes == 0) {
 605                 printf("ipf_init: lck_attr_alloc_init failed\n");
 606                 error = ENOMEM;
 607                 goto done;
 608         }
 609
 610         lck_mtx_init(kipf_lock, lck_grp, lck_attributes);
 611
 612         done:
 613         if (lck_grp) {
 614                 lck_grp_free(lck_grp);
 615                 lck_grp = 0;
 616         }
 617         if (grp_attributes) {
 618                 lck_grp_attr_free(grp_attributes);
 619                 grp_attributes = 0;
 620         }
 621         if (lck_attributes) {
 622                 lck_attr_free(lck_attributes);
 623                 lck_attributes = 0;
 624         }
 625
 626         return (error);
 627 }