X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/3903760236c30e3b5ace7a4eefac3a269d68957c..a991bd8d3e7fe02dbca0644054bab73c5b75324a:/bsd/netinet/ip_encap.c

diff --git a/bsd/netinet/ip_encap.c b/bsd/netinet/ip_encap.c
index 5276504a9..294b98752 100644
--- a/bsd/netinet/ip_encap.c
+++ b/bsd/netinet/ip_encap.c
@@ -76,7 +76,7 @@
  * Well, what can I say.  They impose different en/decapsulation mechanism
  * from each other, so they need separate protocol handler.  The only one
  * we can easily determine by protocol # is IPsec, which always has
- * AH/ESP/IPComp header right after outer IP header.
+ * AH/ESP header right after outer IP header.
  *
  * So, clearly good old protosw does not work for protocol #4 and #41.
  * The code will let you match protocol via src/dst address pair.
@@ -103,12 +103,9 @@
 #include <netinet/ip_var.h>
 #include <netinet/ip_encap.h>
 
-#if INET6
 #include <netinet/ip6.h>
 #include <netinet6/ip6_var.h>
 #include <netinet6/ip6protosw.h>
-#endif
-
 
 #include <net/net_osdep.h>
 
@@ -119,10 +116,10 @@ MALLOC_DEFINE(M_NETADDR, "Export Host", "Export host address structure");
 #endif
 
 static void encap_init(struct protosw *, struct domain *);
-static void encap_add(struct encaptab *);
+static void encap_add_locked(struct encaptab *);
 static int mask_match(const struct encaptab *, const struct sockaddr *,
-		const struct sockaddr *);
-static void encap_fillarg(struct mbuf *, const struct encaptab *);
+    const struct sockaddr *);
+static void encap_fillarg(struct mbuf *, void *arg);
 
 #ifndef LIST_HEAD_INITIALIZER
 /* rely upon BSS initialization */
@@ -131,17 +128,34 @@ LIST_HEAD(, encaptab) encaptab;
 LIST_HEAD(, encaptab) encaptab = LIST_HEAD_INITIALIZER(&encaptab);
 #endif
 
+decl_lck_rw_data(static, encaptab_lock);
+
 static void
 encap_init(struct protosw *pp, struct domain *dp)
 {
 #pragma unused(dp)
 	static int encap_initialized = 0;
+	lck_grp_attr_t *encaptab_grp_attrib = NULL;
+	lck_attr_t *encaptab_lck_attrib = NULL;
+	lck_grp_t *encaptab_lck_group = NULL;
 
-	VERIFY((pp->pr_flags & (PR_INITIALIZED|PR_ATTACHED)) == PR_ATTACHED);
+	VERIFY((pp->pr_flags & (PR_INITIALIZED | PR_ATTACHED)) == PR_ATTACHED);
 
 	/* This gets called by more than one protocols, so initialize once */
-	if (encap_initialized)
+	if (encap_initialized) {
 		return;
+	}
+
+	encaptab_grp_attrib = lck_grp_attr_alloc_init();
+	encaptab_lck_group = lck_grp_alloc_init("encaptab lock", encaptab_grp_attrib);
+	lck_grp_attr_free(encaptab_grp_attrib);
+
+	encaptab_lck_attrib = lck_attr_alloc_init();
+	lck_rw_init(&encaptab_lock, encaptab_lck_group, encaptab_lck_attrib);
+
+	lck_grp_free(encaptab_lck_group);
+	lck_attr_free(encaptab_lck_attrib);
+
 	encap_initialized = 1;
 #if 0
 	/*
@@ -177,6 +191,7 @@ encap4_input(struct mbuf *m, int off)
 	const struct protosw *psw;
 	struct encaptab *ep, *match;
 	int prio, matchprio;
+	void *match_arg = NULL;
 
 #ifndef __APPLE__
 	va_start(ap, m);
@@ -204,14 +219,18 @@ encap4_input(struct mbuf *m, int off)
 
 	match = NULL;
 	matchprio = 0;
+
+	lck_rw_lock_shared(&encaptab_lock);
 	for (ep = LIST_FIRST(&encaptab); ep; ep = LIST_NEXT(ep, chain)) {
-		if (ep->af != AF_INET)
+		if (ep->af != AF_INET) {
 			continue;
-		if (ep->proto >= 0 && ep->proto != proto)
+		}
+		if (ep->proto >= 0 && ep->proto != proto) {
 			continue;
-		if (ep->func)
+		}
+		if (ep->func) {
 			prio = (*ep->func)(m, off, proto, ep->arg);
-		else {
+		} else {
 			/*
 			 * it's inbound traffic, we need to match in reverse
 			 * order
@@ -238,22 +257,26 @@ encap4_input(struct mbuf *m, int off)
 		 * to get the best match - the search takes O(n) for
 		 * n attachments (i.e. interfaces).
 		 */
-		if (prio <= 0)
+		if (prio <= 0) {
 			continue;
+		}
 		if (prio > matchprio) {
 			matchprio = prio;
 			match = ep;
+			psw = (const struct protosw *)match->psw;
+			match_arg = ep->arg;
 		}
 	}
+	lck_rw_unlock_shared(&encaptab_lock);
 
 	if (match) {
 		/* found a match, "match" has the best one */
-		psw = (const struct protosw *)match->psw;
 		if (psw && psw->pr_input) {
-			encap_fillarg(m, match);
+			encap_fillarg(m, match_arg);
 			(*psw->pr_input)(m, off);
-		} else
+		} else {
 			m_freem(m);
+		}
 		return;
 	}
 
@@ -262,7 +285,6 @@ encap4_input(struct mbuf *m, int off)
 }
 #endif
 
-#if INET6
 int
 encap6_input(struct mbuf **mp, int *offp, int proto)
 {
@@ -272,6 +294,7 @@ encap6_input(struct mbuf **mp, int *offp, int proto)
 	const struct ip6protosw *psw;
 	struct encaptab *ep, *match;
 	int prio, matchprio;
+	void *match_arg = NULL;
 
 	/* Expect 32-bit aligned data pointer on strict-align platforms */
 	MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
@@ -288,14 +311,18 @@ encap6_input(struct mbuf **mp, int *offp, int proto)
 
 	match = NULL;
 	matchprio = 0;
+
+	lck_rw_lock_shared(&encaptab_lock);
 	for (ep = LIST_FIRST(&encaptab); ep; ep = LIST_NEXT(ep, chain)) {
-		if (ep->af != AF_INET6)
+		if (ep->af != AF_INET6) {
 			continue;
-		if (ep->proto >= 0 && ep->proto != proto)
+		}
+		if (ep->proto >= 0 && ep->proto != proto) {
 			continue;
-		if (ep->func)
+		}
+		if (ep->func) {
 			prio = (*ep->func)(m, *offp, proto, ep->arg);
-		else {
+		} else {
 			/*
 			 * it's inbound traffic, we need to match in reverse
 			 * order
@@ -305,19 +332,22 @@ encap6_input(struct mbuf **mp, int *offp, int proto)
 		}
 
 		/* see encap4_input() for issues here */
-		if (prio <= 0)
+		if (prio <= 0) {
 			continue;
+		}
 		if (prio > matchprio) {
 			matchprio = prio;
 			match = ep;
+			psw = (const struct ip6protosw *)match->psw;
+			match_arg = ep->arg;
 		}
 	}
+	lck_rw_unlock_shared(&encaptab_lock);
 
 	if (match) {
 		/* found a match */
-		psw = (const struct ip6protosw *)match->psw;
 		if (psw && psw->pr_input) {
-			encap_fillarg(m, match);
+			encap_fillarg(m, match_arg);
 			return (*psw->pr_input)(mp, offp, proto);
 		} else {
 			m_freem(m);
@@ -328,11 +358,11 @@ encap6_input(struct mbuf **mp, int *offp, int proto)
 	/* last resort: inject to raw socket */
 	return rip6_input(mp, offp, proto);
 }
-#endif
 
 static void
-encap_add(struct encaptab *ep)
+encap_add_locked(struct encaptab *ep)
 {
+	LCK_RW_ASSERT(&encaptab_lock, LCK_RW_ASSERT_EXCLUSIVE);
 	LIST_INSERT_HEAD(&encaptab, ep, chain);
 }
 
@@ -343,14 +373,15 @@ encap_add(struct encaptab *ep)
  */
 const struct encaptab *
 encap_attach(int af, int proto, const struct sockaddr *sp,
-	const struct sockaddr *sm, const struct sockaddr *dp,
-	const struct sockaddr *dm, const struct protosw *psw, void *arg)
+    const struct sockaddr *sm, const struct sockaddr *dp,
+    const struct sockaddr *dm, const struct protosw *psw, void *arg)
 {
-	struct encaptab *ep;
+	struct encaptab *ep = NULL;
+	struct encaptab *new_ep = NULL;
 	int error;
 
 	/* sanity check on args */
-	if (sp->sa_len > sizeof(ep->src) || dp->sa_len > sizeof(ep->dst)) {
+	if (sp->sa_len > sizeof(new_ep->src) || dp->sa_len > sizeof(new_ep->dst)) {
 		error = EINVAL;
 		goto fail;
 	}
@@ -363,53 +394,64 @@ encap_attach(int af, int proto, const struct sockaddr *sp,
 		goto fail;
 	}
 
+	new_ep = _MALLOC(sizeof(*new_ep), M_NETADDR, M_WAITOK | M_ZERO);
+	if (new_ep == NULL) {
+		error = ENOBUFS;
+		goto fail;
+	}
+
 	/* check if anyone have already attached with exactly same config */
+	lck_rw_lock_exclusive(&encaptab_lock);
 	for (ep = LIST_FIRST(&encaptab); ep; ep = LIST_NEXT(ep, chain)) {
-		if (ep->af != af)
+		if (ep->af != af) {
 			continue;
-		if (ep->proto != proto)
+		}
+		if (ep->proto != proto) {
 			continue;
+		}
 		if (ep->src.ss_len != sp->sa_len ||
 		    bcmp(&ep->src, sp, sp->sa_len) != 0 ||
-		    bcmp(&ep->srcmask, sm, sp->sa_len) != 0)
+		    bcmp(&ep->srcmask, sm, sp->sa_len) != 0) {
 			continue;
+		}
 		if (ep->dst.ss_len != dp->sa_len ||
 		    bcmp(&ep->dst, dp, dp->sa_len) != 0 ||
-		    bcmp(&ep->dstmask, dm, dp->sa_len) != 0)
+		    bcmp(&ep->dstmask, dm, dp->sa_len) != 0) {
 			continue;
+		}
 
 		error = EEXIST;
-		goto fail;
+		goto fail_locked;
 	}
 
-	ep = _MALLOC(sizeof(*ep), M_NETADDR, M_WAITOK | M_ZERO); /* XXX */
-	if (ep == NULL) {
-		error = ENOBUFS;
-		goto fail;
-	}
+	new_ep->af = af;
+	new_ep->proto = proto;
+	bcopy(sp, &new_ep->src, sp->sa_len);
+	bcopy(sm, &new_ep->srcmask, sp->sa_len);
+	bcopy(dp, &new_ep->dst, dp->sa_len);
+	bcopy(dm, &new_ep->dstmask, dp->sa_len);
+	new_ep->psw = psw;
+	new_ep->arg = arg;
 
-	ep->af = af;
-	ep->proto = proto;
-	bcopy(sp, &ep->src, sp->sa_len);
-	bcopy(sm, &ep->srcmask, sp->sa_len);
-	bcopy(dp, &ep->dst, dp->sa_len);
-	bcopy(dm, &ep->dstmask, dp->sa_len);
-	ep->psw = psw;
-	ep->arg = arg;
-
-	encap_add(ep);
+	encap_add_locked(new_ep);
+	lck_rw_unlock_exclusive(&encaptab_lock);
 
 	error = 0;
-	return ep;
+	return new_ep;
 
+fail_locked:
+	lck_rw_unlock_exclusive(&encaptab_lock);
+	if (new_ep != NULL) {
+		_FREE(new_ep, M_NETADDR);
+	}
 fail:
 	return NULL;
 }
 
 const struct encaptab *
 encap_attach_func( int af, int proto,
-	int (*func)(const struct mbuf *, int, int, void *),
-	const struct protosw *psw, void *arg)
+    int (*func)(const struct mbuf *, int, int, void *),
+    const struct protosw *psw, void *arg)
 {
 	struct encaptab *ep;
 	int error;
@@ -432,7 +474,9 @@ encap_attach_func( int af, int proto,
 	ep->psw = psw;
 	ep->arg = arg;
 
-	encap_add(ep);
+	lck_rw_lock_exclusive(&encaptab_lock);
+	encap_add_locked(ep);
+	lck_rw_unlock_exclusive(&encaptab_lock);
 
 	error = 0;
 	return ep;
@@ -447,20 +491,23 @@ encap_detach(const struct encaptab *cookie)
 	const struct encaptab *ep = cookie;
 	struct encaptab *p;
 
+	lck_rw_lock_exclusive(&encaptab_lock);
 	for (p = LIST_FIRST(&encaptab); p; p = LIST_NEXT(p, chain)) {
 		if (p == ep) {
 			LIST_REMOVE(p, chain);
-			_FREE(p, M_NETADDR);	/*XXX*/
+			lck_rw_unlock_exclusive(&encaptab_lock);
+			_FREE(p, M_NETADDR);    /*XXX*/
 			return 0;
 		}
 	}
+	lck_rw_unlock_exclusive(&encaptab_lock);
 
 	return EINVAL;
 }
 
 static int
 mask_match(const struct encaptab *ep, const struct sockaddr *sp,
-	const struct sockaddr *dp)
+    const struct sockaddr *dp)
 {
 	struct sockaddr_storage s;
 	struct sockaddr_storage d;
@@ -469,19 +516,22 @@ mask_match(const struct encaptab *ep, const struct sockaddr *sp,
 	u_int8_t *r;
 	int matchlen;
 
-	if (sp->sa_len > sizeof(s) || dp->sa_len > sizeof(d))
+	if (sp->sa_len > sizeof(s) || dp->sa_len > sizeof(d)) {
 		return 0;
-	if (sp->sa_family != ep->af || dp->sa_family != ep->af)
+	}
+	if (sp->sa_family != ep->af || dp->sa_family != ep->af) {
 		return 0;
-	if (sp->sa_len != ep->src.ss_len || dp->sa_len != ep->dst.ss_len)
+	}
+	if (sp->sa_len != ep->src.ss_len || dp->sa_len != ep->dst.ss_len) {
 		return 0;
+	}
 
 	matchlen = 0;
 
 	p = (const u_int8_t *)sp;
 	q = (const u_int8_t *)&ep->srcmask;
 	r = (u_int8_t *)&s;
-	for (i = 0 ; i < sp->sa_len; i++) {
+	for (i = 0; i < sp->sa_len; i++) {
 		r[i] = p[i] & q[i];
 		/* XXX estimate */
 		matchlen += (q[i] ? 8 : 0);
@@ -490,7 +540,7 @@ mask_match(const struct encaptab *ep, const struct sockaddr *sp,
 	p = (const u_int8_t *)dp;
 	q = (const u_int8_t *)&ep->dstmask;
 	r = (u_int8_t *)&d;
-	for (i = 0 ; i < dp->sa_len; i++) {
+	for (i = 0; i < dp->sa_len; i++) {
 		r[i] = p[i] & q[i];
 		/* XXX rough estimate */
 		matchlen += (q[i] ? 8 : 0);
@@ -505,28 +555,29 @@ mask_match(const struct encaptab *ep, const struct sockaddr *sp,
 	if (bcmp(&s, &ep->src, ep->src.ss_len) == 0 &&
 	    bcmp(&d, &ep->dst, ep->dst.ss_len) == 0) {
 		return matchlen;
-	} else
+	} else {
 		return 0;
+	}
 }
 
 struct encaptabtag {
-	void*			*arg;
+	void*                   *arg;
 };
 
 static void
 encap_fillarg(
 	struct mbuf *m,
-	const struct encaptab *ep)
+	void *arg)
 {
-	struct m_tag	*tag;
+	struct m_tag    *tag;
 	struct encaptabtag *et;
-	
+
 	tag = m_tag_create(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_ENCAP,
-					  sizeof(struct encaptabtag), M_WAITOK, m);
-	
+	    sizeof(struct encaptabtag), M_WAITOK, m);
+
 	if (tag != NULL) {
 		et = (struct encaptabtag*)(tag + 1);
-		et->arg = ep->arg;
+		et->arg = arg;
 		m_tag_prepend(m, tag);
 	}
 }
@@ -534,16 +585,16 @@ encap_fillarg(
 void *
 encap_getarg(struct mbuf *m)
 {
-	struct m_tag	*tag;
+	struct m_tag    *tag;
 	struct encaptabtag *et;
 	void *p = NULL;
-	
+
 	tag = m_tag_locate(m, KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_ENCAP, NULL);
 	if (tag) {
 		et = (struct encaptabtag*)(tag + 1);
 		p = et->arg;
 		m_tag_delete(m, tag);
 	}
-	
+
 	return p;
 }