X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/1c79356b52d46aa6b508fb032f5ae709b1f2897b..813fb2f63a553c957e917ede5f119b021d6ce391:/bsd/netinet6/ip6_fw.c diff --git a/bsd/netinet6/ip6_fw.c b/bsd/netinet6/ip6_fw.c index 7777c4c6b..dfa12ff11 100644 --- a/bsd/netinet6/ip6_fw.c +++ b/bsd/netinet6/ip6_fw.c @@ -1,4 +1,62 @@ -/* $KAME: ip6_fw.c,v 1.11 2000/03/10 04:22:18 k-sugyou Exp $ */ +/* + * Copyright (c) 2003-2012 Apple Inc. All rights reserved. + * + * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ + * + * This file contains Original Code and/or Modifications of Original Code + * as defined in and that are subject to the Apple Public Source License + * Version 2.0 (the 'License'). You may not use this file except in + * compliance with the License. The rights granted to you under the License + * may not be used to create, or enable the creation or redistribution of, + * unlawful or unlicensed copies of an Apple operating system, or to + * circumvent, violate, or enable the circumvention or violation of, any + * terms of an Apple operating system software license agreement. + * + * Please obtain a copy of the License at + * http://www.opensource.apple.com/apsl/ and read it before using this file. + * + * The Original Code and all software distributed under the License are + * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER + * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, + * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. + * Please see the License for the specific language governing rights and + * limitations under the License. + * + * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ + */ + +/* $FreeBSD: src/sys/netinet6/ip6_fw.c,v 1.2.2.9 2002/04/28 05:40:27 suz Exp $ */ +/* $KAME: ip6_fw.c,v 1.21 2001/01/24 01:25:32 itojun Exp $ */ + +/* + * Copyright (C) 1998, 1999, 2000 and 2001 WIDE Project. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of the project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ /* * Copyright (c) 1993 Daniel Boulet @@ -13,39 +71,36 @@ * but requiring it would be too onerous. * * This software is provided ``AS IS'' without any warranties of any kind. - * - * $Id: ip6_fw.c,v 1.2 2000/09/14 20:35:14 lindak Exp $ */ /* * Implement IPv6 packet firewall */ -#ifdef __FreeBSD__ -#include "opt_ip6fw.h" -#if __FreeBSD__ >= 3 -#include "opt_inet.h" -#endif -#endif -#if IP6DIVERT +#ifdef IP6DIVERT #error "NOT SUPPORTED IPV6 DIVERT" #endif -#if IP6FW_DIVERT_RESTART +#ifdef IP6FW_DIVERT_RESTART #error "NOT SUPPORTED IPV6 DIVERT" #endif +#include +#include + #include #include #include #include -#include +#include #include #include -#if defined(__FreeBSD__) && __FreeBSD__ >= 3 || defined (__APPLE__) #include -#endif +#include +#include #include +#include + #include #include #include @@ -60,11 +115,6 @@ #include #include -#if TCP6 -#include -#include -#include -#endif #include #include #include @@ -72,30 +122,19 @@ #include #include -#if defined(__NetBSD__) || defined(__OpenBSD__) -#include -#endif -#if __FreeBSD__ || defined (__APPLE__) #include -#endif #include -#if defined(__FreeBSD__) && __FreeBSD__ >= 3 MALLOC_DEFINE(M_IP6FW, "Ip6Fw/Ip6Acct", "Ip6Fw/Ip6Acct chain's"); -#else -#ifndef M_IP6FW -#define M_IP6FW M_TEMP -#endif -#endif -static int fw6_debug = 1; -#if IPV6FIREWALL_VERBOSE +static int fw6_debug = 0; +#ifdef IPV6FIREWALL_VERBOSE static int fw6_verbose = 1; #else static int fw6_verbose = 0; #endif -#if IPV6FIREWALL_VERBOSE_LIMIT +#ifdef IPV6FIREWALL_VERBOSE_LIMIT static int fw6_verbose_limit = IPV6FIREWALL_VERBOSE_LIMIT; #else static int fw6_verbose_limit = 0; @@ -103,23 +142,47 @@ static int fw6_verbose_limit = 0; LIST_HEAD (ip6_fw_head, ip6_fw_chain) ip6_fw_chain; +static void ip6fw_kev_post_msg(u_int32_t ); + +#ifdef SYSCTL_NODE +static int ip6fw_sysctl SYSCTL_HANDLER_ARGS; + SYSCTL_DECL(_net_inet6_ip6); -SYSCTL_NODE(_net_inet6_ip6, OID_AUTO, fw, CTLFLAG_RW, 0, "Firewall"); -SYSCTL_INT(_net_inet6_ip6_fw, IP6FWCTL_DEBUG, debug, CTLFLAG_RW, &fw6_debug, 0, ""); -SYSCTL_INT(_net_inet6_ip6_fw, IP6FWCTL_VERBOSE, verbose, CTLFLAG_RW, &fw6_verbose, 0, ""); -SYSCTL_INT(_net_inet6_ip6_fw, IP6FWCTL_VERBLIMIT, verbose_limit, CTLFLAG_RW, &fw6_verbose_limit, 0, ""); +SYSCTL_NODE(_net_inet6_ip6, OID_AUTO, fw, CTLFLAG_RW|CTLFLAG_LOCKED, 0, "Firewall"); +SYSCTL_PROC(_net_inet6_ip6_fw, OID_AUTO, enable, + CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED, + &ip6_fw_enable, 0, ip6fw_sysctl, "I", "Enable ip6fw"); +SYSCTL_INT(_net_inet6_ip6_fw, OID_AUTO, debug, CTLFLAG_RW | CTLFLAG_LOCKED, &fw6_debug, 0, ""); +SYSCTL_INT(_net_inet6_ip6_fw, OID_AUTO, verbose, CTLFLAG_RW | CTLFLAG_LOCKED, &fw6_verbose, 0, ""); +SYSCTL_INT(_net_inet6_ip6_fw, OID_AUTO, verbose_limit, CTLFLAG_RW | CTLFLAG_LOCKED, &fw6_verbose_limit, 0, ""); -#define dprintf(a) if (!fw6_debug); else printf a +static int +ip6fw_sysctl SYSCTL_HANDLER_ARGS +{ +#pragma unused(arg1, arg2) + int error; + + error = sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2, req); + if (error || !req->newptr) + return (error); + + ip6fw_kev_post_msg(KEV_IP6FW_ENABLE); + + return error; +} -#define print_ip6(a) printf("[%s]", ip6_sprintf(a)) +#endif -#define dprint_ip6(a) if (!fw6_debug); else print_ip6(a) +#define dprintf(a) do { \ + if (fw6_debug) \ + printf a; \ + } while (0) +#define SNPARGS(buf, len) buf + len, sizeof(buf) > len ? sizeof(buf) - len : 0 static int add_entry6 __P((struct ip6_fw_head *chainptr, struct ip6_fw *frwl)); static int del_entry6 __P((struct ip6_fw_head *chainptr, u_short number)); -static int zero_entry6 __P((struct mbuf *m)); +static int zero_entry6 __P((struct ip6_fw *frwl)); static struct ip6_fw *check_ip6fw_struct __P((struct ip6_fw *m)); -static struct ip6_fw *check_ip6fw_mbuf __P((struct mbuf *fw)); static int ip6opts_match __P((struct ip6_hdr **ip6, struct ip6_fw *f, struct mbuf **m, int *off, int *nxt, u_short *offset)); @@ -132,7 +195,11 @@ static void ip6fw_report __P((struct ip6_fw *f, struct ip6_hdr *ip6, static int ip6_fw_chk __P((struct ip6_hdr **pip6, struct ifnet *oif, u_int16_t *cookie, struct mbuf **m)); -static int ip6_fw_ctl __P((int stage, struct mbuf **mm)); +static int ip6_fw_ctl __P((struct sockopt *)); +static void cp_to_user_64( struct ip6_fw_64 *userrule_64, struct ip6_fw *rule); +static void cp_from_user_64( struct ip6_fw_64 *userrule_64, struct ip6_fw *rule); +static void cp_to_user_32( struct ip6_fw_32 *userrule_32, struct ip6_fw *rule); +static void cp_from_user_32( struct ip6_fw_32 *userrule_32, struct ip6_fw *rule); static char err_prefix[] = "ip6_fw_ctl:"; @@ -140,12 +207,7 @@ static char err_prefix[] = "ip6_fw_ctl:"; * Returns 1 if the port is matched by the vector, 0 otherwise */ static -#if defined(__FreeBSD__) && __FreeBSD__ >= 3 -__inline -#else -inline -#endif -int +__inline int port_match6(u_short *portptr, int nports, u_short port, int range_flag) { if (!nports) @@ -170,9 +232,15 @@ tcp6flg_match(struct tcphdr *tcp6, struct ip6_fw *f) { u_char flg_set, flg_clr; - if ((f->fw_tcpf & IPV6_FW_TCPF_ESTAB) && - (tcp6->th_flags & (IPV6_FW_TCPF_RST | IPV6_FW_TCPF_ACK))) - return 1; + /* + * If an established connection is required, reject packets that + * have only SYN of RST|ACK|SYN set. Otherwise, fall through to + * other flag requirements. + */ + if ((f->fw_ipflg & IPV6_FW_IF_TCPEST) && + ((tcp6->th_flags & (IPV6_FW_TCPF_RST | IPV6_FW_TCPF_ACK | + IPV6_FW_TCPF_SYN)) == IPV6_FW_TCPF_SYN)) + return 0; flg_set = tcp6->th_flags & f->fw_tcpf; flg_clr = tcp6->th_flags & f->fw_tcpnf; @@ -245,11 +313,11 @@ ip6opts_match(struct ip6_hdr **pip6, struct ip6_fw *f, struct mbuf **m, switch(*nxt) { case IPPROTO_FRAGMENT: - if ((*m)->m_len < *off + sizeof(struct ip6_frag)) { + if ((*m)->m_len >= *off + sizeof(struct ip6_frag)) { struct ip6_frag *ip6f; ip6f = (struct ip6_frag *) ((caddr_t)ip6 + *off); - *offset = ip6f->ip6f_offlg | IP6F_OFF_MASK; + *offset = ip6f->ip6f_offlg & IP6F_OFF_MASK; } opts &= ~IPV6_FW_IP6OPT_FRAG; nopts &= ~IPV6_FW_IP6OPT_FRAG; @@ -304,54 +372,42 @@ ip6opts_match(struct ip6_hdr **pip6, struct ip6_fw *f, struct mbuf **m, } static -#if defined(__FreeBSD__) && __FreeBSD__ >= 3 -__inline -#else -inline -#endif -int +__inline int iface_match(struct ifnet *ifp, union ip6_fw_if *ifu, int byname) { /* Check by name or by IP address */ if (byname) { -#if __NetBSD__ - { - char xname[IFNAMSIZ]; - snprintf(xname, sizeof(xname), "%s%d", ifu->fu_via_if.name, - ifu->fu_via_if.unit); - if (strcmp(ifp->if_xname, xname)) - return(0); - } -#else /* Check unit number (-1 is wildcard) */ if (ifu->fu_via_if.unit != -1 && ifp->if_unit != ifu->fu_via_if.unit) return(0); /* Check name */ - if (strncmp(ifp->if_name, ifu->fu_via_if.name, FW_IFNLEN)) + if (strncmp(ifp->if_name, ifu->fu_via_if.name, IP6FW_IFNLEN)) return(0); -#endif return(1); } else if (!IN6_IS_ADDR_UNSPECIFIED(&ifu->fu_via_ip6)) { /* Zero == wildcard */ struct ifaddr *ia; -#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3) - for (ia = ifp->if_addrlist; ia; ia = ia->ifa_next) -#else - for (ia = ifp->if_addrlist.tqh_first; ia; ia = ia->ifa_list.tqe_next) -#endif + ifnet_lock_shared(ifp); + for (ia = ifp->if_addrlist.tqh_first; ia; + ia = ia->ifa_list.tqe_next) { - - if (ia->ifa_addr == NULL) - continue; - if (ia->ifa_addr->sa_family != AF_INET6) + IFA_LOCK_SPIN(ia); + if (ia->ifa_addr->sa_family != AF_INET6) { + IFA_UNLOCK(ia); continue; + } if (!IN6_ARE_ADDR_EQUAL(&ifu->fu_via_ip6, &(((struct sockaddr_in6 *) - (ia->ifa_addr))->sin6_addr))) + (ia->ifa_addr))->sin6_addr))) { + IFA_UNLOCK(ia); continue; + } + IFA_UNLOCK(ia); + ifnet_lock_done(ifp); return(1); } + ifnet_lock_done(ifp); return(0); } return(1); @@ -366,93 +422,114 @@ ip6fw_report(struct ip6_fw *f, struct ip6_hdr *ip6, struct udphdr *const udp = (struct udphdr *) ((caddr_t) ip6+ off); struct icmp6_hdr *const icmp6 = (struct icmp6_hdr *) ((caddr_t) ip6+ off); int count; + const char *action; + char action2[32], proto[102], name[18]; + int len; count = f ? f->fw_pcnt : ++counter; if (fw6_verbose_limit != 0 && count > fw6_verbose_limit) return; /* Print command name */ - printf("ip6fw: %d ", f ? f->fw_number : -1); + snprintf(SNPARGS(name, 0), "ip6fw: %d", f ? f->fw_number : -1); + + action = action2; if (!f) - printf("Refuse"); - else + action = "Refuse"; + else { switch (f->fw_flg & IPV6_FW_F_COMMAND) { case IPV6_FW_F_DENY: - printf("Deny"); + action = "Deny"; break; case IPV6_FW_F_REJECT: if (f->fw_reject_code == IPV6_FW_REJECT_RST) - printf("Reset"); + action = "Reset"; else - printf("Unreach"); + action = "Unreach"; break; case IPV6_FW_F_ACCEPT: - printf("Accept"); + action = "Accept"; break; case IPV6_FW_F_COUNT: - printf("Count"); + action = "Count"; break; case IPV6_FW_F_DIVERT: - printf("Divert %d", f->fw_divert_port); + snprintf(SNPARGS(action2, 0), "Divert %d", + f->fw_divert_port); break; case IPV6_FW_F_TEE: - printf("Tee %d", f->fw_divert_port); + snprintf(SNPARGS(action2, 0), "Tee %d", + f->fw_divert_port); break; case IPV6_FW_F_SKIPTO: - printf("SkipTo %d", f->fw_skipto_rule); + snprintf(SNPARGS(action2, 0), "SkipTo %d", + f->fw_skipto_rule); break; default: - printf("UNKNOWN"); + action = "UNKNOWN"; break; } - printf(" "); + } switch (nxt) { case IPPROTO_TCP: - printf("TCP "); - print_ip6(&ip6->ip6_src); + len = snprintf(SNPARGS(proto, 0), "TCP [%s]", + ip6_sprintf(&ip6->ip6_src)); if (off > 0) - printf(":%d ", ntohs(tcp6->th_sport)); + len += snprintf(SNPARGS(proto, len), ":%d ", + ntohs(tcp6->th_sport)); else - printf(" "); - print_ip6(&ip6->ip6_dst); + len += snprintf(SNPARGS(proto, len), " "); + len += snprintf(SNPARGS(proto, len), "[%s]", + ip6_sprintf(&ip6->ip6_dst)); if (off > 0) - printf(":%d", ntohs(tcp6->th_dport)); + snprintf(SNPARGS(proto, len), ":%d", + ntohs(tcp6->th_dport)); break; case IPPROTO_UDP: - printf("UDP "); - print_ip6(&ip6->ip6_src); + len = snprintf(SNPARGS(proto, 0), "UDP [%s]", + ip6_sprintf(&ip6->ip6_src)); if (off > 0) - printf(":%d ", ntohs(udp->uh_sport)); + len += snprintf(SNPARGS(proto, len), ":%d ", + ntohs(udp->uh_sport)); else - printf(" "); - print_ip6(&ip6->ip6_dst); + len += snprintf(SNPARGS(proto, len), " "); + len += snprintf(SNPARGS(proto, len), "[%s]", + ip6_sprintf(&ip6->ip6_dst)); if (off > 0) - printf(":%d", ntohs(udp->uh_dport)); + snprintf(SNPARGS(proto, len), ":%d", + ntohs(udp->uh_dport)); break; case IPPROTO_ICMPV6: if (off > 0) - printf("IPV6-ICMP:%u.%u ", icmp6->icmp6_type, icmp6->icmp6_code); + len = snprintf(SNPARGS(proto, 0), "IPV6-ICMP:%u.%u ", + icmp6->icmp6_type, icmp6->icmp6_code); else - printf("IPV6-ICMP "); - print_ip6(&ip6->ip6_src); - printf(" "); - print_ip6(&ip6->ip6_dst); + len = snprintf(SNPARGS(proto, 0), "IPV6-ICMP "); + len += snprintf(SNPARGS(proto, len), "[%s]", + ip6_sprintf(&ip6->ip6_src)); + snprintf(SNPARGS(proto, len), " [%s]", + ip6_sprintf(&ip6->ip6_dst)); break; default: - printf("P:%d ", nxt); - print_ip6(&ip6->ip6_src); - printf(" "); - print_ip6(&ip6->ip6_dst); + len = snprintf(SNPARGS(proto, 0), "P:%d [%s]", nxt, + ip6_sprintf(&ip6->ip6_src)); + snprintf(SNPARGS(proto, len), " [%s]", + ip6_sprintf(&ip6->ip6_dst)); break; } + if (oif) - printf(" out via %s", if_name(oif)); + log(LOG_AUTHPRIV | LOG_INFO, "%s %s %s out via %s\n", + name, action, proto, if_name(oif)); else if (rif) - printf(" in via %s", if_name(rif)); - printf("\n"); + log(LOG_AUTHPRIV | LOG_INFO, "%s %s %s in via %s\n", + name, action, proto, if_name(rif)); + else + log(LOG_AUTHPRIV | LOG_INFO, "%s %s %s", + name, action, proto); if (fw6_verbose_limit != 0 && count == fw6_verbose_limit) - printf("ip6fw: limit reached on rule #%d\n", + log(LOG_AUTHPRIV | LOG_INFO, "ip6fw: limit reached on entry %d\n", f ? f->fw_number : -1); } @@ -484,25 +561,29 @@ ip6_fw_chk(struct ip6_hdr **pip6, struct ip6_fw_chain *chain; struct ip6_fw *rule = NULL; struct ip6_hdr *ip6 = *pip6; - struct ifnet *const rif = (*m)->m_pkthdr.rcvif; + struct ifnet *const rif = ((*m)->m_flags & M_LOOP) ? lo_ifp : (*m)->m_pkthdr.rcvif; u_short offset = 0; int off = sizeof(struct ip6_hdr), nxt = ip6->ip6_nxt; u_short src_port, dst_port; -#if IP6FW_DIVERT_RESTART +#ifdef IP6FW_DIVERT_RESTART u_int16_t skipto = *cookie; #else u_int16_t ignport = ntohs(*cookie); #endif + struct timeval timenow; + struct tcp_respond_args tra; + + getmicrotime(&timenow); *cookie = 0; /* * Go down the chain, looking for enlightment - * #if IP6FW_DIVERT_RESTART + * #ifdef IP6FW_DIVERT_RESTART * If we've been asked to start at a given rule immediatly, do so. * #endif */ chain = LIST_FIRST(&ip6_fw_chain); -#if IP6FW_DIVERT_RESTART +#ifdef IP6FW_DIVERT_RESTART if (skipto) { if (skipto >= 65535) goto dropit; @@ -513,7 +594,7 @@ ip6_fw_chk(struct ip6_hdr **pip6, } #endif /* IP6FW_DIVERT_RESTART */ for (; chain; chain = LIST_NEXT(chain, chain)) { - register struct ip6_fw *const f = chain->rule; + struct ip6_fw *const f = chain->rule; if (oif) { /* Check direction outbound */ @@ -611,7 +692,9 @@ ip6_fw_chk(struct ip6_hdr **pip6, } PULLUP_TO(off + 14); tcp6 = (struct tcphdr *) ((caddr_t)ip6 + off); - if (f->fw_tcpf != f->fw_tcpnf && !tcp6flg_match(tcp6, f)) + if (((f->fw_tcpf != f->fw_tcpnf) || + (f->fw_ipflg & IPV6_FW_IF_TCPEST)) && + !tcp6flg_match(tcp6, f)) continue; src_port = ntohs(tcp6->th_sport); dst_port = ntohs(tcp6->th_dport); @@ -684,11 +767,7 @@ got_match: /* Update statistics */ f->fw_pcnt += 1; f->fw_bcnt += ntohs(ip6->ip6_plen); -#if defined(__FreeBSD__) && __FreeBSD__ >= 3 - f->timestamp = time_second; -#else - f->timestamp = time.tv_sec; -#endif + f->timestamp = timenow.tv_sec; /* Log to console if desired */ if ((f->fw_flg & IPV6_FW_F_PRN) && fw6_verbose) @@ -701,7 +780,7 @@ got_match: case IPV6_FW_F_COUNT: continue; case IPV6_FW_F_DIVERT: -#if IP6FW_DIVERT_RESTART +#ifdef IP6FW_DIVERT_RESTART *cookie = f->fw_number; #else *cookie = htons(f->fw_divert_port); @@ -718,7 +797,7 @@ got_match: */ continue; case IPV6_FW_F_SKIPTO: -#if DIAGNOSTIC +#ifdef DIAGNOSTIC while (chain->chain.le_next && chain->chain.le_next->rule->fw_number < f->fw_skipto_rule) @@ -735,7 +814,7 @@ got_match: break; } -#if DIAGNOSTIC +#ifdef DIAGNOSTIC /* Rule 65535 should always be there and should always match */ if (!chain) panic("ip6_fw: chain"); @@ -755,7 +834,6 @@ got_match: && !IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { switch (rule->fw_reject_code) { case IPV6_FW_REJECT_RST: -#if 1 /*not tested*/ { struct tcphdr *const tcp = (struct tcphdr *) ((caddr_t)ip6 + off); @@ -771,8 +849,8 @@ got_match: ti.ip6 = *ip6; ti.th = *tcp; - NTOHL(ti.th.th_seq); - NTOHL(ti.th.th_ack); + ti.th.th_seq = ntohl(ti.th.th_seq); + ti.th.th_ack = ntohl(ti.th.th_ack); ti.ip6.ip6_nxt = IPPROTO_TCP; if (ti.th.th_flags & TH_ACK) { ack = 0; @@ -795,22 +873,14 @@ got_match: flags = TH_RST|TH_ACK; } bcopy(&ti, ip6, sizeof(ti)); -#if TCP6 - tcp6_respond(NULL, ip6, (struct tcp6hdr *)(ip6 + 1), - *m, ack, seq, flags); -#elif defined(__NetBSD__) - tcp_respond(NULL, NULL, *m, (struct tcphdr *)(ip6 + 1), - ack, seq, flags); -#elif defined(__FreeBSD__) && __FreeBSD__ >= 3 || defined (__APPLE__) + bzero(&tra, sizeof(tra)); + tra.ifscope = IFSCOPE_NONE; + tra.awdl_unrestricted = 1; tcp_respond(NULL, ip6, (struct tcphdr *)(ip6 + 1), - *m, ack, seq, flags, 1); -#else - m_freem(*m); -#endif + *m, ack, seq, flags, &tra); *m = NULL; break; } -#endif default: /* Send an ICMP unreachable using code */ if (oif) (*m)->m_pkthdr.rcvif = oif; @@ -840,17 +910,17 @@ add_entry6(struct ip6_fw_head *chainptr, struct ip6_fw *frwl) u_short nbr = 0; int s; - fwc = _MALLOC(sizeof *fwc, M_IP6FW, M_DONTWAIT); - ftmp = _MALLOC(sizeof *ftmp, M_IP6FW, M_DONTWAIT); + fwc = _MALLOC(sizeof *fwc, M_IP6FW, M_WAITOK); + ftmp = _MALLOC(sizeof *ftmp, M_IP6FW, M_WAITOK); if (!fwc || !ftmp) { dprintf(("%s malloc said no\n", err_prefix)); - if (fwc) _FREE(fwc, M_IP6FW); - if (ftmp) _FREE(ftmp, M_IP6FW); + if (fwc) FREE(fwc, M_IP6FW); + if (ftmp) FREE(ftmp, M_IP6FW); return (ENOSPC); } bcopy(frwl, ftmp, sizeof(struct ip6_fw)); - ftmp->fw_in_if.fu_via_if.name[FW_IFNLEN - 1] = '\0'; + ftmp->fw_in_if.fu_via_if.name[IP6FW_IFNLEN - 1] = '\0'; ftmp->fw_pcnt = 0L; ftmp->fw_bcnt = 0L; fwc->rule = ftmp; @@ -862,8 +932,8 @@ add_entry6(struct ip6_fw_head *chainptr, struct ip6_fw *frwl) splx(s); return(0); } else if (ftmp->fw_number == (u_short)-1) { - if (fwc) _FREE(fwc, M_IP6FW); - if (ftmp) _FREE(ftmp, M_IP6FW); + if (fwc) FREE(fwc, M_IP6FW); + if (ftmp) FREE(ftmp, M_IP6FW); splx(s); dprintf(("%s bad rule number\n", err_prefix)); return (EINVAL); @@ -896,6 +966,7 @@ add_entry6(struct ip6_fw_head *chainptr, struct ip6_fw *frwl) } } + bcopy(ftmp, frwl, sizeof(struct ip6_fw)); splx(s); return (0); } @@ -914,8 +985,8 @@ del_entry6(struct ip6_fw_head *chainptr, u_short number) if (fcp->rule->fw_number == number) { LIST_REMOVE(fcp, chain); splx(s); - _FREE(fcp->rule, M_IP6FW); - _FREE(fcp, M_IP6FW); + FREE(fcp->rule, M_IP6FW); + FREE(fcp, M_IP6FW); return 0; } } @@ -926,20 +997,11 @@ del_entry6(struct ip6_fw_head *chainptr, u_short number) } static int -zero_entry6(struct mbuf *m) +zero_entry6(struct ip6_fw *frwl) { - struct ip6_fw *frwl; struct ip6_fw_chain *fcp; int s; - if (m) { - if (m->m_len != sizeof(struct ip6_fw)) - return(EINVAL); - frwl = mtod(m, struct ip6_fw *); - } - else - frwl = NULL; - /* * It's possible to insert multiple chain entries with the * same number, so we don't stop after finding the first @@ -947,7 +1009,7 @@ zero_entry6(struct mbuf *m) */ s = splnet(); for (fcp = ip6_fw_chain.lh_first; fcp; fcp = fcp->chain.le_next) - if (!frwl || frwl->fw_number == fcp->rule->fw_number) { + if (!frwl || frwl->fw_number == 0 || frwl->fw_number == fcp->rule->fw_number) { fcp->rule->fw_bcnt = fcp->rule->fw_pcnt = 0; fcp->rule->timestamp = 0; } @@ -955,26 +1017,16 @@ zero_entry6(struct mbuf *m) if (fw6_verbose) { if (frwl) - printf("ip6fw: Entry %d cleared.\n", frwl->fw_number); + log(LOG_AUTHPRIV | LOG_NOTICE, + "ip6fw: Entry %d cleared.\n", frwl->fw_number); else - printf("ip6fw: Accounting cleared.\n"); + log(LOG_AUTHPRIV | LOG_NOTICE, + "ip6fw: Accounting cleared.\n"); } return(0); } -static struct ip6_fw * -check_ip6fw_mbuf(struct mbuf *m) -{ - /* Check length */ - if (m->m_len != sizeof(struct ip6_fw)) { - dprintf(("%s len=%d, want %d\n", err_prefix, m->m_len, - sizeof(struct ip6_fw))); - return (NULL); - } - return(check_ip6fw_struct(mtod(m, struct ip6_fw *))); -} - static struct ip6_fw * check_ip6fw_struct(struct ip6_fw *frwl) { @@ -1094,127 +1146,297 @@ check_ip6fw_struct(struct ip6_fw *frwl) return frwl; } +static void +ip6fw_kev_post_msg(u_int32_t event_code) +{ + struct kev_msg ev_msg; + + bzero(&ev_msg, sizeof(struct kev_msg)); + + ev_msg.vendor_code = KEV_VENDOR_APPLE; + ev_msg.kev_class = KEV_FIREWALL_CLASS; + ev_msg.kev_subclass = KEV_IP6FW_SUBCLASS; + ev_msg.event_code = event_code; + + kev_post_msg(&ev_msg); + +} + + +static void +cp_to_user_64( struct ip6_fw_64 *userrule_64, struct ip6_fw *rule) +{ + userrule_64->version = rule->version; + userrule_64->context = CAST_USER_ADDR_T(rule->context); + userrule_64->fw_pcnt = rule->fw_pcnt; + userrule_64->fw_bcnt = rule->fw_bcnt; + userrule_64->fw_src = rule->fw_src; + userrule_64->fw_dst = rule->fw_dst; + userrule_64->fw_smsk = rule->fw_smsk; + userrule_64->fw_dmsk = rule->fw_dmsk; + userrule_64->fw_number = rule->fw_number; + userrule_64->fw_flg = rule->fw_flg; + userrule_64->fw_ipflg = rule->fw_ipflg; + bcopy( rule->fw_pts, userrule_64->fw_pts, IPV6_FW_MAX_PORTS); + userrule_64->fw_ip6opt= rule->fw_ip6opt; + userrule_64->fw_ip6nopt = rule->fw_ip6nopt; + userrule_64->fw_tcpf = rule->fw_tcpf; + userrule_64->fw_tcpnf = rule->fw_tcpnf; + bcopy( rule->fw_icmp6types, userrule_64->fw_icmp6types, sizeof(userrule_64->fw_icmp6types)); + userrule_64->fw_in_if = rule->fw_in_if; + userrule_64->fw_out_if = rule->fw_out_if; + userrule_64->timestamp = rule->timestamp; + userrule_64->fw_un.fu_divert_port = rule->fw_un.fu_divert_port; + userrule_64->fw_prot = rule->fw_prot; + userrule_64->fw_nports = rule->fw_nports; +} + + +static void +cp_from_user_64( struct ip6_fw_64 *userrule_64, struct ip6_fw *rule) +{ + rule->version = userrule_64->version; + rule->context = CAST_DOWN(void *, userrule_64->context); + rule->fw_pcnt = userrule_64->fw_pcnt; + rule->fw_bcnt = userrule_64->fw_bcnt; + rule->fw_src = userrule_64->fw_src; + rule->fw_dst = userrule_64->fw_dst; + rule->fw_smsk = userrule_64->fw_smsk; + rule->fw_dmsk = userrule_64->fw_dmsk; + rule->fw_number = userrule_64->fw_number; + rule->fw_flg = userrule_64->fw_flg; + rule->fw_ipflg = userrule_64->fw_ipflg; + bcopy( userrule_64->fw_pts, rule->fw_pts, IPV6_FW_MAX_PORTS); + rule->fw_ip6opt = userrule_64->fw_ip6opt; + rule->fw_ip6nopt = userrule_64->fw_ip6nopt; + rule->fw_tcpf = userrule_64->fw_tcpf; + rule->fw_tcpnf = userrule_64->fw_tcpnf; + bcopy( userrule_64->fw_icmp6types, rule->fw_icmp6types, sizeof(userrule_64->fw_icmp6types)); + rule->fw_in_if = userrule_64->fw_in_if; + rule->fw_out_if = userrule_64->fw_out_if; + rule->timestamp = CAST_DOWN( long, userrule_64->timestamp); + rule->fw_un.fu_divert_port = userrule_64->fw_un.fu_divert_port; + rule->fw_prot = userrule_64->fw_prot; + rule->fw_nports = userrule_64->fw_nports; +} + + +static void +cp_to_user_32( struct ip6_fw_32 *userrule_32, struct ip6_fw *rule) +{ + userrule_32->version = rule->version; + userrule_32->context = CAST_DOWN_EXPLICIT( user32_addr_t, rule->context); + userrule_32->fw_pcnt = rule->fw_pcnt; + userrule_32->fw_bcnt = rule->fw_bcnt; + userrule_32->fw_src = rule->fw_src; + userrule_32->fw_dst = rule->fw_dst; + userrule_32->fw_smsk = rule->fw_smsk; + userrule_32->fw_dmsk = rule->fw_dmsk; + userrule_32->fw_number = rule->fw_number; + userrule_32->fw_flg = rule->fw_flg; + userrule_32->fw_ipflg = rule->fw_ipflg; + bcopy( rule->fw_pts, userrule_32->fw_pts, IPV6_FW_MAX_PORTS); + userrule_32->fw_ip6opt = rule->fw_ip6opt ; + userrule_32->fw_ip6nopt = rule->fw_ip6nopt; + userrule_32->fw_tcpf = rule->fw_tcpf; + userrule_32->fw_tcpnf = rule->fw_tcpnf; + bcopy( rule->fw_icmp6types, userrule_32->fw_icmp6types, sizeof(rule->fw_icmp6types)); + userrule_32->fw_in_if = rule->fw_in_if; + userrule_32->fw_out_if = rule->fw_out_if; + userrule_32->timestamp = rule->timestamp; + userrule_32->fw_un.fu_divert_port = rule->fw_un.fu_divert_port; + userrule_32->fw_prot = rule->fw_prot; + userrule_32->fw_nports = rule->fw_nports; +} + + +static void +cp_from_user_32( struct ip6_fw_32 *userrule_32, struct ip6_fw *rule) +{ + rule->version = userrule_32->version; + rule->context = CAST_DOWN(void *, userrule_32->context); + rule->fw_pcnt = userrule_32->fw_pcnt; + rule->fw_bcnt = userrule_32->fw_bcnt; + rule->fw_src = userrule_32->fw_src; + rule->fw_dst = userrule_32->fw_dst; + rule->fw_smsk = userrule_32->fw_smsk; + rule->fw_dmsk = userrule_32->fw_dmsk; + rule->fw_number = userrule_32->fw_number; + rule->fw_flg = userrule_32->fw_flg; + rule->fw_ipflg = userrule_32->fw_ipflg; + bcopy( userrule_32->fw_pts, rule->fw_pts, IPV6_FW_MAX_PORTS); + rule->fw_ip6opt = userrule_32->fw_ip6opt; + rule->fw_ip6nopt = userrule_32->fw_ip6nopt; + rule->fw_tcpf = userrule_32->fw_tcpf; + rule->fw_tcpnf = userrule_32->fw_tcpnf; + bcopy( userrule_32->fw_icmp6types, rule->fw_icmp6types, sizeof(userrule_32->fw_icmp6types)); + rule->fw_in_if = userrule_32->fw_in_if; + rule->fw_out_if = userrule_32->fw_out_if; + rule->timestamp = CAST_DOWN(long, userrule_32->timestamp); + rule->fw_un.fu_divert_port = userrule_32->fw_un.fu_divert_port; + rule->fw_prot = userrule_32->fw_prot; + rule->fw_nports = userrule_32->fw_nports; +} + static int -ip6_fw_ctl(int stage, struct mbuf **mm) +ip6_fw_ctl(struct sockopt *sopt) { - int error; - struct mbuf *m; + int error = 0; + int spl; + int valsize; + struct ip6_fw rule; + int is64user=0; + size_t userrulesize; + + if (securelevel >= 3 && + (sopt->sopt_dir != SOPT_GET || sopt->sopt_name != IPV6_FW_GET)) + return (EPERM); + + if ( proc_is64bit(sopt->sopt_p) ){ + is64user = 1; + userrulesize = sizeof( struct ip6_fw_64 ); + } else + userrulesize = sizeof( struct ip6_fw_32 ); + + /* We ALWAYS expect the client to pass in a rule structure so that we can + * check the version of the API that they are using. In the case of a + * IPV6_FW_GET operation, the first rule of the output buffer passed to us + * must have the version set. */ + if (!sopt->sopt_val || sopt->sopt_valsize < userrulesize) return EINVAL; + + /* save sopt->sopt_valsize */ + valsize = sopt->sopt_valsize; + + if (is64user){ + struct ip6_fw_64 userrule_64; + + if ((error = sooptcopyin(sopt, &userrule_64, userrulesize, userrulesize))) + return error; + + cp_from_user_64( &userrule_64, &rule ); + } + else { + struct ip6_fw_32 userrule_32; + + if ((error = sooptcopyin(sopt, &userrule_32, userrulesize, userrulesize))) + return error; + + cp_from_user_32( &userrule_32, &rule ); + } + + if (rule.version != IPV6_FW_CURRENT_API_VERSION) return EINVAL; + rule.version = 0xFFFFFFFF; /* version is meaningless once rules "make it in the door". */ - if (stage == IPV6_FW_GET) { - struct ip6_fw_chain *fcp = ip6_fw_chain.lh_first; -#if defined(__FreeBSD__) && __FreeBSD__ >= 3 || defined (__APPLE__) - *mm = m = m_get(M_WAIT, MT_DATA); /* XXX */ -#else - *mm = m = m_get(M_WAIT, MT_SOOPTS); -#endif - if (!m) - return(ENOBUFS); - if (sizeof *(fcp->rule) > MLEN) { - MCLGET(m, M_WAIT); - if ((m->m_flags & M_EXT) == 0) { - m_free(m); - return(ENOBUFS); + switch (sopt->sopt_name) + { + case IPV6_FW_GET: + { + struct ip6_fw_chain *fcp; + struct ip6_fw *buf; + size_t size = 0; + size_t rulesize = 0; + + spl = splnet(); + + if ( is64user ) + rulesize = sizeof(struct ip6_fw_64 ); + else + rulesize = sizeof(struct ip6_fw_32 ); + + LIST_FOREACH(fcp, &ip6_fw_chain, chain) + size += rulesize; + + buf = _MALLOC(size, M_TEMP, M_WAITOK); + if (!buf) error = ENOBUFS; + else + { + //struct ip6_fw *bp = buf; + caddr_t bp = (caddr_t)buf; + + LIST_FOREACH(fcp, &ip6_fw_chain, chain) + { + //bcopy(fcp->rule, bp, sizeof *bp); + if ( is64user ){ + cp_to_user_64( (struct ip6_fw_64*)bp, fcp->rule); + } + else { + cp_to_user_32( (struct ip6_fw_32*)bp, fcp->rule); + } + + ( (struct ip6_fw*)bp)->version = IPV6_FW_CURRENT_API_VERSION; + //bp++; + bp += rulesize; + } + } + + splx(spl); + if (buf) + { + sopt->sopt_valsize = valsize; + error = sooptcopyout(sopt, buf, size); + FREE(buf, M_TEMP); } + + break; } - for (; fcp; fcp = fcp->chain.le_next) { - memcpy(m->m_data, fcp->rule, sizeof *(fcp->rule)); - m->m_len = sizeof *(fcp->rule); -#if defined(__FreeBSD__) && __FreeBSD__ >= 3 || defined (__APPLE__) - m->m_next = m_get(M_WAIT, MT_DATA); /* XXX */ -#else - m->m_next = m_get(M_WAIT, MT_SOOPTS); -#endif - if (!m->m_next) { - m_freem(*mm); - return(ENOBUFS); + + case IPV6_FW_FLUSH: + spl = splnet(); + while (ip6_fw_chain.lh_first && + ip6_fw_chain.lh_first->rule->fw_number != (u_short)-1) + { + struct ip6_fw_chain *fcp = ip6_fw_chain.lh_first; + LIST_REMOVE(ip6_fw_chain.lh_first, chain); + FREE(fcp->rule, M_IP6FW); + FREE(fcp, M_IP6FW); } - m = m->m_next; - if (sizeof *(fcp->rule) > MLEN) { - MCLGET(m, M_WAIT); - if ((m->m_flags & M_EXT) == 0) { - m_freem(*mm); - return(ENOBUFS); - } + splx(spl); + ip6fw_kev_post_msg(KEV_IP6FW_FLUSH); + break; + + case IPV6_FW_ZERO: + error = zero_entry6(&rule); + break; + + case IPV6_FW_ADD: + if (check_ip6fw_struct(&rule)) { + error = add_entry6(&ip6_fw_chain, &rule); + + ip6fw_kev_post_msg(KEV_IP6FW_ADD); + } else + error = EINVAL; + + if (is64user){ + struct ip6_fw_64 userrule_64; + cp_to_user_64( &userrule_64, &rule); + error = sooptcopyout(sopt, &userrule_64, userrulesize); } - m->m_len = 0; - } - return (0); - } - m = *mm; - /* only allow get calls if secure mode > 2 */ - if (securelevel > 2) { - if (m) { - (void)m_freem(m); - *mm = 0; - } - return(EPERM); - } - if (stage == IPV6_FW_FLUSH) { - while (ip6_fw_chain.lh_first != NULL && - ip6_fw_chain.lh_first->rule->fw_number != (u_short)-1) { - struct ip6_fw_chain *fcp = ip6_fw_chain.lh_first; - int s = splnet(); - LIST_REMOVE(ip6_fw_chain.lh_first, chain); - splx(s); - _FREE(fcp->rule, M_IP6FW); - _FREE(fcp, M_IP6FW); - } - if (m) { - (void)m_freem(m); - *mm = 0; - } - return (0); - } - if (stage == IPV6_FW_ZERO) { - error = zero_entry6(m); - if (m) { - (void)m_freem(m); - *mm = 0; - } - return (error); - } - if (m == NULL) { - printf("%s NULL mbuf ptr\n", err_prefix); - return (EINVAL); - } + else { + struct ip6_fw_32 userrule_32; + cp_to_user_32( &userrule_32, &rule); + error = sooptcopyout(sopt, &userrule_32, userrulesize); + } + break; - if (stage == IPV6_FW_ADD) { - struct ip6_fw *frwl = check_ip6fw_mbuf(m); + case IPV6_FW_DEL: + if (rule.fw_number == (u_short)-1) + { + dprintf(("%s can't delete rule 65535\n", err_prefix)); + error = EINVAL; + } + else { + error = del_entry6(&ip6_fw_chain, rule.fw_number); - if (!frwl) - error = EINVAL; - else - error = add_entry6(&ip6_fw_chain, frwl); - if (m) { - (void)m_freem(m); - *mm = 0; - } - return error; - } - if (stage == IPV6_FW_DEL) { - if (m->m_len != sizeof(struct ip6_fw)) { - dprintf(("%s len=%d, want %d\n", err_prefix, m->m_len, - sizeof(struct ip6_fw))); - error = EINVAL; - } else if (mtod(m, struct ip6_fw *)->fw_number == (u_short)-1) { - dprintf(("%s can't delete rule 65535\n", err_prefix)); + ip6fw_kev_post_msg(KEV_IP6FW_DEL); + } + break; + + default: + dprintf(("%s invalid option %d\n", err_prefix, sopt->sopt_name)); error = EINVAL; - } else - error = del_entry6(&ip6_fw_chain, - mtod(m, struct ip6_fw *)->fw_number); - if (m) { - (void)m_freem(m); - *mm = 0; - } - return error; } - dprintf(("%s unknown request %d\n", err_prefix, stage)); - if (m) { - (void)m_freem(m); - *mm = 0; - } - return (EINVAL); + return error; } void @@ -1229,7 +1451,7 @@ ip6_fw_init(void) bzero(&default_rule, sizeof default_rule); default_rule.fw_prot = IPPROTO_IPV6; default_rule.fw_number = (u_short)-1; -#if IPV6FIREWALL_DEFAULT_TO_ACCEPT +#ifdef IPV6FIREWALL_DEFAULT_TO_ACCEPT default_rule.fw_flg |= IPV6_FW_F_ACCEPT; #else default_rule.fw_flg |= IPV6_FW_F_DENY; @@ -1237,19 +1459,10 @@ ip6_fw_init(void) default_rule.fw_flg |= IPV6_FW_F_IN | IPV6_FW_F_OUT; if (check_ip6fw_struct(&default_rule) == NULL || add_entry6(&ip6_fw_chain, &default_rule)) - panic(__FUNCTION__); + panic("%s", __FUNCTION__); -#if 1 /* NOT SUPPORTED IPV6 DIVERT */ printf("IPv6 packet filtering initialized, "); -#else - printf("IPv6 packet filtering initialized, " -#if IP6DIVERT - "divert enabled, "); -#else - "divert disabled, "); -#endif -#endif -#if IPV6FIREWALL_DEFAULT_TO_ACCEPT +#ifdef IPV6FIREWALL_DEFAULT_TO_ACCEPT printf("default to accept, "); #endif #ifndef IPV6FIREWALL_VERBOSE @@ -1262,3 +1475,4 @@ ip6_fw_init(void) fw6_verbose_limit); #endif } +