1/*
2 * Copyright (c) 2004-2018 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29#include <sys/param.h> /* for definition of NULL */
30#include <sys/errno.h>
31#include <sys/malloc.h>
32#include <sys/socket.h>
33#include <sys/mbuf.h>
34#include <sys/systm.h>
35#include <libkern/OSAtomic.h>
36
37#include <machine/endian.h>
38
39#define _IP_VHL
40#include <net/if_var.h>
41#include <net/route.h>
42#include <net/kpi_protocol.h>
43#include <net/net_api_stats.h>
44
45#include <netinet/in_systm.h>
46#include <netinet/in.h>
47#include <netinet/in_var.h>
48#include <netinet6/in6_var.h>
49#include <netinet/ip.h>
50#include <netinet/ip6.h>
51#include <netinet/ip_var.h>
52#include <netinet6/ip6_var.h>
53#include <netinet/kpi_ipfilter_var.h>
54
55#include <stdbool.h>
56
57/*
58 * kipf_lock and kipf_ref protect the linkage of the list of IP filters
59 * An IP filter can be removed only when kipf_ref is zero
60 * If an IP filter cannot be removed because kipf_ref is not null, then
61 * the IP filter is marjed and kipf_delayed_remove is set so that when
62 * kipf_ref eventually goes down to zero, the IP filter is removed
63 */
64decl_lck_mtx_data(static, kipf_lock_data);
65static lck_mtx_t *kipf_lock = &kipf_lock_data;
66static u_int32_t kipf_ref = 0;
67static u_int32_t kipf_delayed_remove = 0;
68u_int32_t kipf_count = 0;
69
70__private_extern__ struct ipfilter_list ipv4_filters = TAILQ_HEAD_INITIALIZER(ipv4_filters);
71__private_extern__ struct ipfilter_list ipv6_filters = TAILQ_HEAD_INITIALIZER(ipv6_filters);
72__private_extern__ struct ipfilter_list tbr_filters = TAILQ_HEAD_INITIALIZER(tbr_filters);
73
74#undef ipf_addv4
75#undef ipf_addv6
76extern errno_t ipf_addv4(const struct ipf_filter *filter,
77 ipfilter_t *filter_ref);
78extern errno_t ipf_addv6(const struct ipf_filter *filter,
79 ipfilter_t *filter_ref);
80
81static errno_t ipf_add(const struct ipf_filter *filter,
82 ipfilter_t *filter_ref, struct ipfilter_list *head, bool is_internal);
83
84__private_extern__ void
85ipf_ref(void)
86{
87 lck_mtx_lock(kipf_lock);
88 kipf_ref++;
89 lck_mtx_unlock(kipf_lock);
90}
91
92__private_extern__ void
93ipf_unref(void)
94{
95 lck_mtx_lock(kipf_lock);
96
97 if (kipf_ref == 0)
98 panic("ipf_unref: kipf_ref == 0\n");
99
100 kipf_ref--;
101 if (kipf_ref == 0 && kipf_delayed_remove != 0) {
102 struct ipfilter *filter;
103
104 while ((filter = TAILQ_FIRST(&tbr_filters))) {
105 VERIFY(OSDecrementAtomic64(&net_api_stats.nas_ipf_add_count) > 0);
106
107 ipf_detach_func ipf_detach = filter->ipf_filter.ipf_detach;
108 void* cookie = filter->ipf_filter.cookie;
109
110 TAILQ_REMOVE(filter->ipf_head, filter, ipf_link);
111 TAILQ_REMOVE(&tbr_filters, filter, ipf_tbr);
112 kipf_delayed_remove--;
113
114 if (ipf_detach) {
115 lck_mtx_unlock(kipf_lock);
116 ipf_detach(cookie);
117 lck_mtx_lock(kipf_lock);
118 /* In case some filter got to run while we released the lock */
119 if (kipf_ref != 0)
120 break;
121 }
122 }
123 }
124 lck_mtx_unlock(kipf_lock);
125}
126
127static errno_t
128ipf_add(
129 const struct ipf_filter *filter,
130 ipfilter_t *filter_ref,
131 struct ipfilter_list *head,
132 bool is_internal)
133{
134 struct ipfilter *new_filter;
135 if (filter->name == NULL || (filter->ipf_input == NULL && filter->ipf_output == NULL))
136 return (EINVAL);
137
138 MALLOC(new_filter, struct ipfilter *, sizeof(*new_filter), M_IFADDR, M_WAITOK);
139 if (new_filter == NULL)
140 return (ENOMEM);
141
142 lck_mtx_lock(kipf_lock);
143 new_filter->ipf_filter = *filter;
144 new_filter->ipf_head = head;
145
146 TAILQ_INSERT_HEAD(head, new_filter, ipf_link);
147
148 OSIncrementAtomic64(&net_api_stats.nas_ipf_add_count);
149 INC_ATOMIC_INT64_LIM(net_api_stats.nas_ipf_add_total);
150 if (is_internal) {
151 INC_ATOMIC_INT64_LIM(net_api_stats.nas_ipf_add_os_total);
152 }
153
154 lck_mtx_unlock(kipf_lock);
155
156 *filter_ref = (ipfilter_t)new_filter;
157
158 /* This will force TCP to re-evaluate its use of TSO */
159 OSAddAtomic(1, &kipf_count);
160 routegenid_update();
161
162 return (0);
163}
164
165errno_t
166ipf_addv4_internal(
167 const struct ipf_filter *filter,
168 ipfilter_t *filter_ref)
169{
170 return (ipf_add(filter, filter_ref, &ipv4_filters, true));
171}
172
173errno_t
174ipf_addv4(
175 const struct ipf_filter *filter,
176 ipfilter_t *filter_ref)
177{
178 return (ipf_add(filter, filter_ref, &ipv4_filters, false));
179}
180
181errno_t
182ipf_addv6_internal(
183 const struct ipf_filter *filter,
184 ipfilter_t *filter_ref)
185{
186 return (ipf_add(filter, filter_ref, &ipv6_filters, true));
187}
188
189errno_t
190ipf_addv6(
191 const struct ipf_filter *filter,
192 ipfilter_t *filter_ref)
193{
194 return (ipf_add(filter, filter_ref, &ipv6_filters, false));
195}
196
197static errno_t
198ipf_input_detached(void *cookie, mbuf_t *data, int offset, u_int8_t protocol)
199{
200#pragma unused(cookie, data, offset, protocol)
201
202#if DEBUG
203 printf("ipf_input_detached\n");
204#endif /* DEBUG */
205
206 return (0);
207}
208
209static errno_t
210ipf_output_detached(void *cookie, mbuf_t *data, ipf_pktopts_t options)
211{
212#pragma unused(cookie, data, options)
213
214#if DEBUG
215 printf("ipf_output_detached\n");
216#endif /* DEBUG */
217
218 return (0);
219}
220
221errno_t
222ipf_remove(
223 ipfilter_t filter_ref)
224{
225 struct ipfilter *match = (struct ipfilter *)filter_ref;
226 struct ipfilter_list *head;
227
228 if (match == 0 || (match->ipf_head != &ipv4_filters && match->ipf_head != &ipv6_filters))
229 return (EINVAL);
230
231 head = match->ipf_head;
232
233 lck_mtx_lock(kipf_lock);
234 TAILQ_FOREACH(match, head, ipf_link) {
235 if (match == (struct ipfilter *)filter_ref) {
236 ipf_detach_func ipf_detach = match->ipf_filter.ipf_detach;
237 void* cookie = match->ipf_filter.cookie;
238
239 /*
240 * Cannot detach when they are filters running
241 */
242 if (kipf_ref) {
243 kipf_delayed_remove++;
244 TAILQ_INSERT_TAIL(&tbr_filters, match, ipf_tbr);
245 match->ipf_filter.ipf_input = ipf_input_detached;
246 match->ipf_filter.ipf_output = ipf_output_detached;
247 lck_mtx_unlock(kipf_lock);
248 } else {
249 VERIFY(OSDecrementAtomic64(&net_api_stats.nas_ipf_add_count) > 0);
250
251 TAILQ_REMOVE(head, match, ipf_link);
252 lck_mtx_unlock(kipf_lock);
253
254 if (ipf_detach)
255 ipf_detach(cookie);
256 FREE(match, M_IFADDR);
257
258 /* This will force TCP to re-evaluate its use of TSO */
259 OSAddAtomic(-1, &kipf_count);
260 routegenid_update();
261
262 }
263 return (0);
264 }
265 }
266 lck_mtx_unlock(kipf_lock);
267
268 return (ENOENT);
269}
270
271int log_for_en1 = 0;
272
273errno_t
274ipf_inject_input(
275 mbuf_t data,
276 ipfilter_t filter_ref)
277{
278 struct mbuf *m = (struct mbuf *)data;
279 struct m_tag *mtag = 0;
280 struct ip *ip = mtod(m, struct ip *);
281 struct ip6_hdr *ip6;
282 u_int8_t vers;
283 int hlen;
284 errno_t error = 0;
285 protocol_family_t proto;
286 struct in_ifaddr *ia = NULL;
287 struct in_addr *pkt_dst = NULL;
288 struct in6_ifaddr *ia6 = NULL;
289 struct sockaddr_in6 pkt_dst6;
290
291 vers = IP_VHL_V(ip->ip_vhl);
292
293 switch (vers) {
294 case 4:
295 proto = PF_INET;
296 break;
297 case 6:
298 proto = PF_INET6;
299 break;
300 default:
301 error = ENOTSUP;
302 goto done;
303 }
304
305 if (filter_ref == 0 && m->m_pkthdr.rcvif == 0) {
306 /*
307 * Search for interface with the local address
308 */
309 switch (proto) {
310 case PF_INET:
311 pkt_dst = &ip->ip_dst;
312 lck_rw_lock_shared(in_ifaddr_rwlock);
313 TAILQ_FOREACH(ia, INADDR_HASH(pkt_dst->s_addr), ia_hash) {
314 if (IA_SIN(ia)->sin_addr.s_addr == pkt_dst->s_addr) {
315 m->m_pkthdr.rcvif = ia->ia_ifp;
316 break;
317 }
318 }
319 lck_rw_done(in_ifaddr_rwlock);
320 break;
321
322 case PF_INET6:
323 ip6 = mtod(m, struct ip6_hdr *);
324 pkt_dst6.sin6_addr = ip6->ip6_dst;
325 lck_rw_lock_shared(&in6_ifaddr_rwlock);
326 for (ia6 = in6_ifaddrs; ia6 != NULL; ia6 = ia6->ia_next) {
327 if (IN6_ARE_ADDR_EQUAL(&ia6->ia_addr.sin6_addr, &pkt_dst6.sin6_addr)) {
328 m->m_pkthdr.rcvif = ia6->ia_ifp;
329 break;
330 }
331 }
332 lck_rw_done(&in6_ifaddr_rwlock);
333 break;
334
335 default:
336 break;
337 }
338
339 /*
340 * If none found, fallback to loopback
341 */
342 if (m->m_pkthdr.rcvif == NULL) {
343 m->m_pkthdr.rcvif = lo_ifp;
344 }
345
346 m->m_pkthdr.csum_data = 0;
347 m->m_pkthdr.csum_flags = 0;
348 if (vers == 4) {
349 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
350 ip->ip_sum = 0;
351 ip->ip_sum = in_cksum(m, hlen);
352 }
353 }
354 if (filter_ref != 0) {
355 mtag = m_tag_create(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT,
356 sizeof (ipfilter_t), M_NOWAIT, m);
357 if (mtag == NULL) {
358 error = ENOMEM;
359 goto done;
360 }
361 *(ipfilter_t *)(mtag+1) = filter_ref;
362 m_tag_prepend(m, mtag);
363 }
364
365 error = proto_inject(proto, data);
366
367done:
368 return (error);
369}
370
371static errno_t
372ipf_injectv4_out(mbuf_t data, ipfilter_t filter_ref, ipf_pktopts_t options)
373{
374 struct route ro;
375 struct ip *ip;
376 struct mbuf *m = (struct mbuf *)data;
377 errno_t error = 0;
378 struct m_tag *mtag = NULL;
379 struct ip_moptions *imo = NULL;
380 struct ip_out_args ipoa;
381
382 bzero(&ipoa, sizeof(ipoa));
383 ipoa.ipoa_boundif = IFSCOPE_NONE;
384 ipoa.ipoa_sotc = SO_TC_UNSPEC;
385 ipoa.ipoa_netsvctype = _NET_SERVICE_TYPE_UNSPEC;
386
387 /* Make the IP header contiguous in the mbuf */
388 if ((size_t)m->m_len < sizeof (struct ip)) {
389 m = m_pullup(m, sizeof (struct ip));
390 if (m == NULL)
391 return (ENOMEM);
392 }
393 ip = (struct ip *)m_mtod(m);
394
395 if (filter_ref != 0) {
396 mtag = m_tag_create(KERNEL_MODULE_TAG_ID,
397 KERNEL_TAG_TYPE_IPFILT, sizeof (ipfilter_t), M_NOWAIT, m);
398 if (mtag == NULL) {
399 m_freem(m);
400 return (ENOMEM);
401 }
402 *(ipfilter_t *)(mtag + 1) = filter_ref;
403 m_tag_prepend(m, mtag);
404 }
405
406 if (options != NULL && (options->ippo_flags & IPPOF_MCAST_OPTS) &&
407 (imo = ip_allocmoptions(M_DONTWAIT)) != NULL) {
408 imo->imo_multicast_ifp = options->ippo_mcast_ifnet;
409 imo->imo_multicast_ttl = options->ippo_mcast_ttl;
410 imo->imo_multicast_loop = options->ippo_mcast_loop;
411 }
412
413 if (options != NULL) {
414 if (options->ippo_flags & IPPOF_SELECT_SRCIF)
415 ipoa.ipoa_flags |= IPOAF_SELECT_SRCIF;
416 if (options->ippo_flags & IPPOF_BOUND_IF) {
417 ipoa.ipoa_flags |= IPOAF_BOUND_IF;
418 ipoa.ipoa_boundif = options->ippo_flags >>
419 IPPOF_SHIFT_IFSCOPE;
420 }
421 if (options->ippo_flags & IPPOF_NO_IFT_CELLULAR)
422 ipoa.ipoa_flags |= IPOAF_NO_CELLULAR;
423 if (options->ippo_flags & IPPOF_BOUND_SRCADDR)
424 ipoa.ipoa_flags |= IPOAF_BOUND_SRCADDR;
425 if (options->ippo_flags & IPPOF_NO_IFF_EXPENSIVE)
426 ipoa.ipoa_flags |= IPOAF_NO_EXPENSIVE;
427 }
428
429 bzero(&ro, sizeof(struct route));
430
431 /* Put ip_len and ip_off in host byte order, ip_output expects that */
432
433#if BYTE_ORDER != BIG_ENDIAN
434 NTOHS(ip->ip_len);
435 NTOHS(ip->ip_off);
436#endif
437
438 /* Send; enforce source interface selection via IP_OUTARGS flag */
439 error = ip_output(m, NULL, &ro,
440 IP_ALLOWBROADCAST | IP_RAWOUTPUT | IP_OUTARGS, imo, &ipoa);
441
442 /* Release the route */
443 ROUTE_RELEASE(&ro);
444
445 if (imo != NULL)
446 IMO_REMREF(imo);
447
448 return (error);
449}
450
451#if INET6
452static errno_t
453ipf_injectv6_out(mbuf_t data, ipfilter_t filter_ref, ipf_pktopts_t options)
454{
455 struct route_in6 ro;
456 struct ip6_hdr *ip6;
457 struct mbuf *m = (struct mbuf *)data;
458 errno_t error = 0;
459 struct m_tag *mtag = NULL;
460 struct ip6_moptions *im6o = NULL;
461 struct ip6_out_args ip6oa;
462
463 bzero(&ip6oa, sizeof(ip6oa));
464 ip6oa.ip6oa_boundif = IFSCOPE_NONE;
465 ip6oa.ip6oa_sotc = SO_TC_UNSPEC;
466 ip6oa.ip6oa_netsvctype = _NET_SERVICE_TYPE_UNSPEC;
467
468 /* Make the IP header contiguous in the mbuf */
469 if ((size_t)m->m_len < sizeof(struct ip6_hdr)) {
470 m = m_pullup(m, sizeof(struct ip6_hdr));
471 if (m == NULL)
472 return (ENOMEM);
473 }
474 ip6 = (struct ip6_hdr *)m_mtod(m);
475
476 if (filter_ref != 0) {
477 mtag = m_tag_create(KERNEL_MODULE_TAG_ID,
478 KERNEL_TAG_TYPE_IPFILT, sizeof (ipfilter_t), M_NOWAIT, m);
479 if (mtag == NULL) {
480 m_freem(m);
481 return (ENOMEM);
482 }
483 *(ipfilter_t *)(mtag + 1) = filter_ref;
484 m_tag_prepend(m, mtag);
485 }
486
487 if (options != NULL && (options->ippo_flags & IPPOF_MCAST_OPTS) &&
488 (im6o = ip6_allocmoptions(M_DONTWAIT)) != NULL) {
489 im6o->im6o_multicast_ifp = options->ippo_mcast_ifnet;
490 im6o->im6o_multicast_hlim = options->ippo_mcast_ttl;
491 im6o->im6o_multicast_loop = options->ippo_mcast_loop;
492 }
493
494 if (options != NULL) {
495 if (options->ippo_flags & IPPOF_SELECT_SRCIF)
496 ip6oa.ip6oa_flags |= IP6OAF_SELECT_SRCIF;
497 if (options->ippo_flags & IPPOF_BOUND_IF) {
498 ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF;
499 ip6oa.ip6oa_boundif = options->ippo_flags >>
500 IPPOF_SHIFT_IFSCOPE;
501 }
502 if (options->ippo_flags & IPPOF_NO_IFT_CELLULAR)
503 ip6oa.ip6oa_flags |= IP6OAF_NO_CELLULAR;
504 if (options->ippo_flags & IPPOF_BOUND_SRCADDR)
505 ip6oa.ip6oa_flags |= IP6OAF_BOUND_SRCADDR;
506 if (options->ippo_flags & IPPOF_NO_IFF_EXPENSIVE)
507 ip6oa.ip6oa_flags |= IP6OAF_NO_EXPENSIVE;
508 }
509
510 bzero(&ro, sizeof(struct route_in6));
511
512 /*
513 * Send mbuf and ifscope information. Check for correctness
514 * of ifscope information is done while searching for a route in
515 * ip6_output.
516 */
517 error = ip6_output(m, NULL, &ro, IPV6_OUTARGS, im6o, NULL, &ip6oa);
518
519 /* Release the route */
520 ROUTE_RELEASE(&ro);
521
522 if (im6o != NULL)
523 IM6O_REMREF(im6o);
524
525 return (error);
526}
527#endif /* INET6 */
528
529errno_t
530ipf_inject_output(
531 mbuf_t data,
532 ipfilter_t filter_ref,
533 ipf_pktopts_t options)
534{
535 struct mbuf *m = (struct mbuf *)data;
536 u_int8_t vers;
537 errno_t error = 0;
538
539 /* Make one byte of the header contiguous in the mbuf */
540 if (m->m_len < 1) {
541 m = m_pullup(m, 1);
542 if (m == NULL)
543 goto done;
544 }
545
546 vers = (*(u_int8_t *)m_mtod(m)) >> 4;
547 switch (vers) {
548 case 4:
549 error = ipf_injectv4_out(data, filter_ref, options);
550 break;
551#if INET6
552 case 6:
553 error = ipf_injectv6_out(data, filter_ref, options);
554 break;
555#endif
556 default:
557 m_freem(m);
558 error = ENOTSUP;
559 break;
560 }
561
562done:
563 return (error);
564}
565
566__private_extern__ ipfilter_t
567ipf_get_inject_filter(struct mbuf *m)
568{
569 ipfilter_t filter_ref = 0;
570 struct m_tag *mtag;
571
572 mtag = m_tag_locate(m, KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFILT, NULL);
573 if (mtag) {
574 filter_ref = *(ipfilter_t *)(mtag+1);
575
576 m_tag_delete(m, mtag);
577 }
578 return (filter_ref);
579}
580
581__private_extern__ int
582ipf_init(void)
583{
584 int error = 0;
585 lck_grp_attr_t *grp_attributes = 0;
586 lck_attr_t *lck_attributes = 0;
587 lck_grp_t *lck_grp = 0;
588
589 grp_attributes = lck_grp_attr_alloc_init();
590 if (grp_attributes == 0) {
591 printf("ipf_init: lck_grp_attr_alloc_init failed\n");
592 error = ENOMEM;
593 goto done;
594 }
595
596 lck_grp = lck_grp_alloc_init("IP Filter", grp_attributes);
597 if (lck_grp == 0) {
598 printf("ipf_init: lck_grp_alloc_init failed\n");
599 error = ENOMEM;
600 goto done;
601 }
602
603 lck_attributes = lck_attr_alloc_init();
604 if (lck_attributes == 0) {
605 printf("ipf_init: lck_attr_alloc_init failed\n");
606 error = ENOMEM;
607 goto done;
608 }
609
610 lck_mtx_init(kipf_lock, lck_grp, lck_attributes);
611
612 done:
613 if (lck_grp) {
614 lck_grp_free(lck_grp);
615 lck_grp = 0;
616 }
617 if (grp_attributes) {
618 lck_grp_attr_free(grp_attributes);
619 grp_attributes = 0;
620 }
621 if (lck_attributes) {
622 lck_attr_free(lck_attributes);
623 lck_attributes = 0;
624 }
625
626 return (error);
627}
628