1/*
2 * Copyright (c) 2007-2016 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29/* $apfw: pf_ruleset.c,v 1.2 2007/08/10 03:00:16 jhw Exp $ */
30/* $OpenBSD: pf_ruleset.c,v 1.1 2006/10/27 13:56:51 mcbride Exp $ */
31
32/*
33 * Copyright (c) 2001 Daniel Hartmeier
34 * Copyright (c) 2002,2003 Henning Brauer
35 * NAT64 - Copyright (c) 2010 Viagenie Inc. (http://www.viagenie.ca)
36 * All rights reserved.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 *
42 * - Redistributions of source code must retain the above copyright
43 * notice, this list of conditions and the following disclaimer.
44 * - Redistributions in binary form must reproduce the above
45 * copyright notice, this list of conditions and the following
46 * disclaimer in the documentation and/or other materials provided
47 * with the distribution.
48 *
49 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
50 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
51 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
52 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
53 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
54 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
55 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
56 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
57 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
58 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
59 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
60 * POSSIBILITY OF SUCH DAMAGE.
61 *
62 * Effort sponsored in part by the Defense Advanced Research Projects
63 * Agency (DARPA) and Air Force Research Laboratory, Air Force
64 * Materiel Command, USAF, under agreement number F30602-01-2-0537.
65 *
66 */
67
68#include <sys/param.h>
69#include <sys/socket.h>
70#ifdef KERNEL
71#include <sys/systm.h>
72#include <sys/malloc.h>
73#include <libkern/libkern.h>
74#endif /* KERNEL */
75#include <sys/mbuf.h>
76
77#include <netinet/ip_dummynet.h>
78#include <netinet/in.h>
79#include <netinet/in_systm.h>
80#include <netinet/ip.h>
81#include <netinet/tcp.h>
82
83#include <net/if.h>
84#include <net/pfvar.h>
85
86#if INET6
87#include <netinet/ip6.h>
88#endif /* INET6 */
89
90
91#ifdef KERNEL
92#define DPFPRINTF(format, x...) \
93 if (pf_status.debug >= PF_DEBUG_NOISY) \
94 printf(format, ##x)
95#define rs_malloc(x) _MALLOC(x, M_TEMP, M_WAITOK)
96#define rs_free(x) _FREE(x, M_TEMP)
97#define strrchr _strrchr
98
99static char *
100_strrchr(const char *c, int ch)
101{
102 char *p = (char *)(size_t)c, *save;
103
104 for (save = NULL; ; ++p) {
105 if (*p == ch)
106 save = (char *)p;
107 if (*p == '\0')
108 return (save);
109 }
110 /* NOTREACHED */
111}
112
113#else
114/* Userland equivalents so we can lend code to pfctl et al. */
115
116#include <arpa/inet.h>
117#include <errno.h>
118#include <stdio.h>
119#include <stdlib.h>
120#include <string.h>
121#define rs_malloc(x) malloc(x)
122#define rs_free(x) free(x)
123
124#ifdef PFDEBUG
125#include <sys/stdarg.h>
126#define DPFPRINTF(format, x...) fprintf(stderr, format, ##x)
127#else
128#define DPFPRINTF(format, x...) ((void)0)
129#endif /* PFDEBUG */
130#endif /* KERNEL */
131
132
133struct pf_anchor_global pf_anchors;
134struct pf_anchor pf_main_anchor;
135
136static __inline int pf_anchor_compare(struct pf_anchor *, struct pf_anchor *);
137
138RB_GENERATE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare);
139RB_GENERATE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare);
140
141static __inline int
142pf_anchor_compare(struct pf_anchor *a, struct pf_anchor *b)
143{
144 int c = strcmp(a->path, b->path);
145
146 return (c ? (c < 0 ? -1 : 1) : 0);
147}
148
149int
150pf_get_ruleset_number(u_int8_t action)
151{
152 switch (action) {
153 case PF_SCRUB:
154 case PF_NOSCRUB:
155 return (PF_RULESET_SCRUB);
156 case PF_PASS:
157 case PF_DROP:
158 return (PF_RULESET_FILTER);
159 case PF_NAT:
160 case PF_NONAT:
161 return (PF_RULESET_NAT);
162 case PF_BINAT:
163 case PF_NOBINAT:
164 return (PF_RULESET_BINAT);
165 case PF_RDR:
166 case PF_NORDR:
167 case PF_NAT64:
168 case PF_NONAT64:
169 return (PF_RULESET_RDR);
170#if DUMMYNET
171 case PF_DUMMYNET:
172 case PF_NODUMMYNET:
173 return (PF_RULESET_DUMMYNET);
174#endif /* DUMMYNET */
175 default:
176 return (PF_RULESET_MAX);
177 }
178}
179
180void
181pf_init_ruleset(struct pf_ruleset *ruleset)
182{
183 int i;
184
185 memset(ruleset, 0, sizeof (struct pf_ruleset));
186 for (i = 0; i < PF_RULESET_MAX; i++) {
187 TAILQ_INIT(&ruleset->rules[i].queues[0]);
188 TAILQ_INIT(&ruleset->rules[i].queues[1]);
189 ruleset->rules[i].active.ptr = &ruleset->rules[i].queues[0];
190 ruleset->rules[i].inactive.ptr = &ruleset->rules[i].queues[1];
191 }
192}
193
194struct pf_anchor *
195pf_find_anchor(const char *path)
196{
197 struct pf_anchor *key, *found;
198
199 key = (struct pf_anchor *)rs_malloc(sizeof (*key));
200 memset(key, 0, sizeof (*key));
201 strlcpy(key->path, path, sizeof (key->path));
202 found = RB_FIND(pf_anchor_global, &pf_anchors, key);
203 rs_free(key);
204 return (found);
205}
206
207struct pf_ruleset *
208pf_find_ruleset(const char *path)
209{
210 struct pf_anchor *anchor;
211
212 while (*path == '/')
213 path++;
214 if (!*path)
215 return (&pf_main_ruleset);
216 anchor = pf_find_anchor(path);
217 if (anchor == NULL)
218 return (NULL);
219 else
220 return (&anchor->ruleset);
221}
222
223struct pf_ruleset *
224pf_find_ruleset_with_owner(const char *path, const char *owner, int is_anchor,
225 int *error)
226{
227 struct pf_anchor *anchor;
228
229 while (*path == '/')
230 path++;
231 if (!*path)
232 return (&pf_main_ruleset);
233 anchor = pf_find_anchor(path);
234 if (anchor == NULL) {
235 *error = EINVAL;
236 return (NULL);
237 } else {
238 if ((owner && (!strcmp(owner, anchor->owner)))
239 || (is_anchor && !strcmp(anchor->owner, "")))
240 return (&anchor->ruleset);
241 *error = EPERM;
242 return NULL;
243 }
244}
245
246struct pf_ruleset *
247pf_find_or_create_ruleset(const char *path)
248{
249 char *p, *q = NULL, *r;
250 struct pf_ruleset *ruleset;
251 struct pf_anchor *anchor = 0, *dup, *parent = NULL;
252
253 if (path[0] == 0)
254 return (&pf_main_ruleset);
255 while (*path == '/')
256 path++;
257 ruleset = pf_find_ruleset(path);
258 if (ruleset != NULL)
259 return (ruleset);
260 p = (char *)rs_malloc(MAXPATHLEN);
261 bzero(p, MAXPATHLEN);
262 strlcpy(p, path, MAXPATHLEN);
263 while (parent == NULL && (q = strrchr(p, '/')) != NULL) {
264 *q = 0;
265 if ((ruleset = pf_find_ruleset(p)) != NULL) {
266 parent = ruleset->anchor;
267 break;
268 }
269 }
270 if (q == NULL)
271 q = p;
272 else
273 q++;
274 strlcpy(p, path, MAXPATHLEN);
275 if (!*q) {
276 rs_free(p);
277 return (NULL);
278 }
279 while ((r = strchr(q, '/')) != NULL || *q) {
280 if (r != NULL)
281 *r = 0;
282 if (!*q || strlen(q) >= PF_ANCHOR_NAME_SIZE ||
283 (parent != NULL && strlen(parent->path) >=
284 MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)) {
285 rs_free(p);
286 return (NULL);
287 }
288 anchor = (struct pf_anchor *)rs_malloc(sizeof (*anchor));
289 if (anchor == NULL) {
290 rs_free(p);
291 return (NULL);
292 }
293 memset(anchor, 0, sizeof (*anchor));
294 RB_INIT(&anchor->children);
295 strlcpy(anchor->name, q, sizeof (anchor->name));
296 if (parent != NULL) {
297 strlcpy(anchor->path, parent->path,
298 sizeof (anchor->path));
299 strlcat(anchor->path, "/", sizeof (anchor->path));
300 }
301 strlcat(anchor->path, anchor->name, sizeof (anchor->path));
302 if ((dup = RB_INSERT(pf_anchor_global, &pf_anchors, anchor)) !=
303 NULL) {
304 printf("pf_find_or_create_ruleset: RB_INSERT1 "
305 "'%s' '%s' collides with '%s' '%s'\n",
306 anchor->path, anchor->name, dup->path, dup->name);
307 rs_free(anchor);
308 rs_free(p);
309 return (NULL);
310 }
311 if (parent != NULL) {
312 anchor->parent = parent;
313 if ((dup = RB_INSERT(pf_anchor_node, &parent->children,
314 anchor)) != NULL) {
315 printf("pf_find_or_create_ruleset: "
316 "RB_INSERT2 '%s' '%s' collides with "
317 "'%s' '%s'\n", anchor->path, anchor->name,
318 dup->path, dup->name);
319 RB_REMOVE(pf_anchor_global, &pf_anchors,
320 anchor);
321 rs_free(anchor);
322 rs_free(p);
323 return (NULL);
324 }
325 }
326 pf_init_ruleset(&anchor->ruleset);
327 anchor->ruleset.anchor = anchor;
328 parent = anchor;
329 if (r != NULL)
330 q = r + 1;
331 else
332 *q = 0;
333#if DUMMYNET
334 if(strncmp("com.apple.nlc", anchor->name,
335 sizeof("com.apple.nlc")) == 0)
336 is_nlc_enabled_glb = TRUE;
337#endif
338 }
339 rs_free(p);
340 return (anchor ? &anchor->ruleset : 0);
341}
342
343void
344pf_remove_if_empty_ruleset(struct pf_ruleset *ruleset)
345{
346 struct pf_anchor *parent;
347 int i;
348
349 while (ruleset != NULL) {
350 if (ruleset == &pf_main_ruleset || ruleset->anchor == NULL ||
351 !RB_EMPTY(&ruleset->anchor->children) ||
352 ruleset->anchor->refcnt > 0 || ruleset->tables > 0 ||
353 ruleset->topen)
354 return;
355 for (i = 0; i < PF_RULESET_MAX; ++i)
356 if (!TAILQ_EMPTY(ruleset->rules[i].active.ptr) ||
357 !TAILQ_EMPTY(ruleset->rules[i].inactive.ptr) ||
358 ruleset->rules[i].inactive.open)
359 return;
360 RB_REMOVE(pf_anchor_global, &pf_anchors, ruleset->anchor);
361#if DUMMYNET
362 if(strncmp("com.apple.nlc", ruleset->anchor->name,
363 sizeof("com.apple.nlc")) == 0) {
364 struct dummynet_event dn_event;
365 bzero(&dn_event, sizeof(dn_event));
366 dn_event.dn_event_code = DUMMYNET_NLC_DISABLED;
367 dummynet_event_enqueue_nwk_wq_entry(&dn_event);
368 is_nlc_enabled_glb = FALSE;
369 }
370#endif
371 if ((parent = ruleset->anchor->parent) != NULL)
372 RB_REMOVE(pf_anchor_node, &parent->children,
373 ruleset->anchor);
374 rs_free(ruleset->anchor);
375 if (parent == NULL)
376 return;
377 ruleset = &parent->ruleset;
378 }
379}
380
381int
382pf_anchor_setup(struct pf_rule *r, const struct pf_ruleset *s,
383 const char *name)
384{
385 char *p, *path;
386 struct pf_ruleset *ruleset;
387
388 r->anchor = NULL;
389 r->anchor_relative = 0;
390 r->anchor_wildcard = 0;
391 if (!name[0])
392 return (0);
393 path = (char *)rs_malloc(MAXPATHLEN);
394 bzero(path, MAXPATHLEN);
395 if (name[0] == '/')
396 strlcpy(path, name + 1, MAXPATHLEN);
397 else {
398 /* relative path */
399 r->anchor_relative = 1;
400 if (s->anchor == NULL || !s->anchor->path[0])
401 path[0] = 0;
402 else
403 strlcpy(path, s->anchor->path, MAXPATHLEN);
404 while (name[0] == '.' && name[1] == '.' && name[2] == '/') {
405 if (!path[0]) {
406 printf("pf_anchor_setup: .. beyond root\n");
407 rs_free(path);
408 return (1);
409 }
410 if ((p = strrchr(path, '/')) != NULL)
411 *p = 0;
412 else
413 path[0] = 0;
414 r->anchor_relative++;
415 name += 3;
416 }
417 if (path[0])
418 strlcat(path, "/", MAXPATHLEN);
419 strlcat(path, name, MAXPATHLEN);
420 }
421 if ((p = strrchr(path, '/')) != NULL && strcmp(p, "/*") == 0) {
422 r->anchor_wildcard = 1;
423 *p = 0;
424 }
425 ruleset = pf_find_or_create_ruleset(path);
426 rs_free(path);
427 if (ruleset == NULL || ruleset->anchor == NULL) {
428 printf("pf_anchor_setup: ruleset\n");
429 return (1);
430 }
431 r->anchor = ruleset->anchor;
432 r->anchor->refcnt++;
433 return (0);
434}
435
436int
437pf_anchor_copyout(const struct pf_ruleset *rs, const struct pf_rule *r,
438 struct pfioc_rule *pr)
439{
440 pr->anchor_call[0] = 0;
441 if (r->anchor == NULL)
442 return (0);
443 if (!r->anchor_relative) {
444 strlcpy(pr->anchor_call, "/", sizeof (pr->anchor_call));
445 strlcat(pr->anchor_call, r->anchor->path,
446 sizeof (pr->anchor_call));
447 } else {
448 char *a, *p;
449 int i;
450
451 a = (char *)rs_malloc(MAXPATHLEN);
452 bzero(a, MAXPATHLEN);
453 if (rs->anchor == NULL)
454 a[0] = 0;
455 else
456 strlcpy(a, rs->anchor->path, MAXPATHLEN);
457 for (i = 1; i < r->anchor_relative; ++i) {
458 if ((p = strrchr(a, '/')) == NULL)
459 p = a;
460 *p = 0;
461 strlcat(pr->anchor_call, "../",
462 sizeof (pr->anchor_call));
463 }
464 if (strncmp(a, r->anchor->path, strlen(a))) {
465 printf("pf_anchor_copyout: '%s' '%s'\n", a,
466 r->anchor->path);
467 rs_free(a);
468 return (1);
469 }
470 if (strlen(r->anchor->path) > strlen(a))
471 strlcat(pr->anchor_call, r->anchor->path + (a[0] ?
472 strlen(a) + 1 : 0), sizeof (pr->anchor_call));
473 rs_free(a);
474 }
475 if (r->anchor_wildcard)
476 strlcat(pr->anchor_call, pr->anchor_call[0] ? "/*" : "*",
477 sizeof (pr->anchor_call));
478 return (0);
479}
480
481void
482pf_anchor_remove(struct pf_rule *r)
483{
484 if (r->anchor == NULL)
485 return;
486 if (r->anchor->refcnt <= 0) {
487 printf("pf_anchor_remove: broken refcount\n");
488 r->anchor = NULL;
489 return;
490 }
491 if (!--r->anchor->refcnt)
492 pf_remove_if_empty_ruleset(&r->anchor->ruleset);
493 r->anchor = NULL;
494}
495