1 | /* |
2 | * Copyright (c) 2007-2016 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | /* $apfw: pf_ruleset.c,v 1.2 2007/08/10 03:00:16 jhw Exp $ */ |
30 | /* $OpenBSD: pf_ruleset.c,v 1.1 2006/10/27 13:56:51 mcbride Exp $ */ |
31 | |
32 | /* |
33 | * Copyright (c) 2001 Daniel Hartmeier |
34 | * Copyright (c) 2002,2003 Henning Brauer |
35 | * NAT64 - Copyright (c) 2010 Viagenie Inc. (http://www.viagenie.ca) |
36 | * All rights reserved. |
37 | * |
38 | * Redistribution and use in source and binary forms, with or without |
39 | * modification, are permitted provided that the following conditions |
40 | * are met: |
41 | * |
42 | * - Redistributions of source code must retain the above copyright |
43 | * notice, this list of conditions and the following disclaimer. |
44 | * - Redistributions in binary form must reproduce the above |
45 | * copyright notice, this list of conditions and the following |
46 | * disclaimer in the documentation and/or other materials provided |
47 | * with the distribution. |
48 | * |
49 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
50 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
51 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS |
52 | * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE |
53 | * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, |
54 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, |
55 | * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
56 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER |
57 | * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
58 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN |
59 | * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
60 | * POSSIBILITY OF SUCH DAMAGE. |
61 | * |
62 | * Effort sponsored in part by the Defense Advanced Research Projects |
63 | * Agency (DARPA) and Air Force Research Laboratory, Air Force |
64 | * Materiel Command, USAF, under agreement number F30602-01-2-0537. |
65 | * |
66 | */ |
67 | |
68 | #include <sys/param.h> |
69 | #include <sys/socket.h> |
70 | #ifdef KERNEL |
71 | #include <sys/systm.h> |
72 | #include <sys/malloc.h> |
73 | #include <libkern/libkern.h> |
74 | #endif /* KERNEL */ |
75 | #include <sys/mbuf.h> |
76 | |
77 | #include <netinet/ip_dummynet.h> |
78 | #include <netinet/in.h> |
79 | #include <netinet/in_systm.h> |
80 | #include <netinet/ip.h> |
81 | #include <netinet/tcp.h> |
82 | |
83 | #include <net/if.h> |
84 | #include <net/pfvar.h> |
85 | |
86 | #if INET6 |
87 | #include <netinet/ip6.h> |
88 | #endif /* INET6 */ |
89 | |
90 | |
91 | #ifdef KERNEL |
92 | #define DPFPRINTF(format, x...) \ |
93 | if (pf_status.debug >= PF_DEBUG_NOISY) \ |
94 | printf(format, ##x) |
95 | #define rs_malloc(x) _MALLOC(x, M_TEMP, M_WAITOK) |
96 | #define rs_free(x) _FREE(x, M_TEMP) |
97 | #define strrchr _strrchr |
98 | |
99 | static char * |
100 | _strrchr(const char *c, int ch) |
101 | { |
102 | char *p = (char *)(size_t)c, *save; |
103 | |
104 | for (save = NULL; ; ++p) { |
105 | if (*p == ch) |
106 | save = (char *)p; |
107 | if (*p == '\0') |
108 | return (save); |
109 | } |
110 | /* NOTREACHED */ |
111 | } |
112 | |
113 | #else |
114 | /* Userland equivalents so we can lend code to pfctl et al. */ |
115 | |
116 | #include <arpa/inet.h> |
117 | #include <errno.h> |
118 | #include <stdio.h> |
119 | #include <stdlib.h> |
120 | #include <string.h> |
121 | #define rs_malloc(x) malloc(x) |
122 | #define rs_free(x) free(x) |
123 | |
124 | #ifdef PFDEBUG |
125 | #include <sys/stdarg.h> |
126 | #define DPFPRINTF(format, x...) fprintf(stderr, format, ##x) |
127 | #else |
128 | #define DPFPRINTF(format, x...) ((void)0) |
129 | #endif /* PFDEBUG */ |
130 | #endif /* KERNEL */ |
131 | |
132 | |
133 | struct pf_anchor_global pf_anchors; |
134 | struct pf_anchor pf_main_anchor; |
135 | |
136 | static __inline int pf_anchor_compare(struct pf_anchor *, struct pf_anchor *); |
137 | |
138 | RB_GENERATE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare); |
139 | RB_GENERATE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare); |
140 | |
141 | static __inline int |
142 | pf_anchor_compare(struct pf_anchor *a, struct pf_anchor *b) |
143 | { |
144 | int c = strcmp(a->path, b->path); |
145 | |
146 | return (c ? (c < 0 ? -1 : 1) : 0); |
147 | } |
148 | |
149 | int |
150 | pf_get_ruleset_number(u_int8_t action) |
151 | { |
152 | switch (action) { |
153 | case PF_SCRUB: |
154 | case PF_NOSCRUB: |
155 | return (PF_RULESET_SCRUB); |
156 | case PF_PASS: |
157 | case PF_DROP: |
158 | return (PF_RULESET_FILTER); |
159 | case PF_NAT: |
160 | case PF_NONAT: |
161 | return (PF_RULESET_NAT); |
162 | case PF_BINAT: |
163 | case PF_NOBINAT: |
164 | return (PF_RULESET_BINAT); |
165 | case PF_RDR: |
166 | case PF_NORDR: |
167 | case PF_NAT64: |
168 | case PF_NONAT64: |
169 | return (PF_RULESET_RDR); |
170 | #if DUMMYNET |
171 | case PF_DUMMYNET: |
172 | case PF_NODUMMYNET: |
173 | return (PF_RULESET_DUMMYNET); |
174 | #endif /* DUMMYNET */ |
175 | default: |
176 | return (PF_RULESET_MAX); |
177 | } |
178 | } |
179 | |
180 | void |
181 | pf_init_ruleset(struct pf_ruleset *ruleset) |
182 | { |
183 | int i; |
184 | |
185 | memset(ruleset, 0, sizeof (struct pf_ruleset)); |
186 | for (i = 0; i < PF_RULESET_MAX; i++) { |
187 | TAILQ_INIT(&ruleset->rules[i].queues[0]); |
188 | TAILQ_INIT(&ruleset->rules[i].queues[1]); |
189 | ruleset->rules[i].active.ptr = &ruleset->rules[i].queues[0]; |
190 | ruleset->rules[i].inactive.ptr = &ruleset->rules[i].queues[1]; |
191 | } |
192 | } |
193 | |
194 | struct pf_anchor * |
195 | pf_find_anchor(const char *path) |
196 | { |
197 | struct pf_anchor *key, *found; |
198 | |
199 | key = (struct pf_anchor *)rs_malloc(sizeof (*key)); |
200 | memset(key, 0, sizeof (*key)); |
201 | strlcpy(key->path, path, sizeof (key->path)); |
202 | found = RB_FIND(pf_anchor_global, &pf_anchors, key); |
203 | rs_free(key); |
204 | return (found); |
205 | } |
206 | |
207 | struct pf_ruleset * |
208 | pf_find_ruleset(const char *path) |
209 | { |
210 | struct pf_anchor *anchor; |
211 | |
212 | while (*path == '/') |
213 | path++; |
214 | if (!*path) |
215 | return (&pf_main_ruleset); |
216 | anchor = pf_find_anchor(path); |
217 | if (anchor == NULL) |
218 | return (NULL); |
219 | else |
220 | return (&anchor->ruleset); |
221 | } |
222 | |
223 | struct pf_ruleset * |
224 | pf_find_ruleset_with_owner(const char *path, const char *owner, int is_anchor, |
225 | int *error) |
226 | { |
227 | struct pf_anchor *anchor; |
228 | |
229 | while (*path == '/') |
230 | path++; |
231 | if (!*path) |
232 | return (&pf_main_ruleset); |
233 | anchor = pf_find_anchor(path); |
234 | if (anchor == NULL) { |
235 | *error = EINVAL; |
236 | return (NULL); |
237 | } else { |
238 | if ((owner && (!strcmp(owner, anchor->owner))) |
239 | || (is_anchor && !strcmp(anchor->owner, "" ))) |
240 | return (&anchor->ruleset); |
241 | *error = EPERM; |
242 | return NULL; |
243 | } |
244 | } |
245 | |
246 | struct pf_ruleset * |
247 | pf_find_or_create_ruleset(const char *path) |
248 | { |
249 | char *p, *q = NULL, *r; |
250 | struct pf_ruleset *ruleset; |
251 | struct pf_anchor *anchor = 0, *dup, *parent = NULL; |
252 | |
253 | if (path[0] == 0) |
254 | return (&pf_main_ruleset); |
255 | while (*path == '/') |
256 | path++; |
257 | ruleset = pf_find_ruleset(path); |
258 | if (ruleset != NULL) |
259 | return (ruleset); |
260 | p = (char *)rs_malloc(MAXPATHLEN); |
261 | bzero(p, MAXPATHLEN); |
262 | strlcpy(p, path, MAXPATHLEN); |
263 | while (parent == NULL && (q = strrchr(p, '/')) != NULL) { |
264 | *q = 0; |
265 | if ((ruleset = pf_find_ruleset(p)) != NULL) { |
266 | parent = ruleset->anchor; |
267 | break; |
268 | } |
269 | } |
270 | if (q == NULL) |
271 | q = p; |
272 | else |
273 | q++; |
274 | strlcpy(p, path, MAXPATHLEN); |
275 | if (!*q) { |
276 | rs_free(p); |
277 | return (NULL); |
278 | } |
279 | while ((r = strchr(q, '/')) != NULL || *q) { |
280 | if (r != NULL) |
281 | *r = 0; |
282 | if (!*q || strlen(q) >= PF_ANCHOR_NAME_SIZE || |
283 | (parent != NULL && strlen(parent->path) >= |
284 | MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)) { |
285 | rs_free(p); |
286 | return (NULL); |
287 | } |
288 | anchor = (struct pf_anchor *)rs_malloc(sizeof (*anchor)); |
289 | if (anchor == NULL) { |
290 | rs_free(p); |
291 | return (NULL); |
292 | } |
293 | memset(anchor, 0, sizeof (*anchor)); |
294 | RB_INIT(&anchor->children); |
295 | strlcpy(anchor->name, q, sizeof (anchor->name)); |
296 | if (parent != NULL) { |
297 | strlcpy(anchor->path, parent->path, |
298 | sizeof (anchor->path)); |
299 | strlcat(anchor->path, "/" , sizeof (anchor->path)); |
300 | } |
301 | strlcat(anchor->path, anchor->name, sizeof (anchor->path)); |
302 | if ((dup = RB_INSERT(pf_anchor_global, &pf_anchors, anchor)) != |
303 | NULL) { |
304 | printf("pf_find_or_create_ruleset: RB_INSERT1 " |
305 | "'%s' '%s' collides with '%s' '%s'\n" , |
306 | anchor->path, anchor->name, dup->path, dup->name); |
307 | rs_free(anchor); |
308 | rs_free(p); |
309 | return (NULL); |
310 | } |
311 | if (parent != NULL) { |
312 | anchor->parent = parent; |
313 | if ((dup = RB_INSERT(pf_anchor_node, &parent->children, |
314 | anchor)) != NULL) { |
315 | printf("pf_find_or_create_ruleset: " |
316 | "RB_INSERT2 '%s' '%s' collides with " |
317 | "'%s' '%s'\n" , anchor->path, anchor->name, |
318 | dup->path, dup->name); |
319 | RB_REMOVE(pf_anchor_global, &pf_anchors, |
320 | anchor); |
321 | rs_free(anchor); |
322 | rs_free(p); |
323 | return (NULL); |
324 | } |
325 | } |
326 | pf_init_ruleset(&anchor->ruleset); |
327 | anchor->ruleset.anchor = anchor; |
328 | parent = anchor; |
329 | if (r != NULL) |
330 | q = r + 1; |
331 | else |
332 | *q = 0; |
333 | #if DUMMYNET |
334 | if(strncmp("com.apple.nlc" , anchor->name, |
335 | sizeof("com.apple.nlc" )) == 0) |
336 | is_nlc_enabled_glb = TRUE; |
337 | #endif |
338 | } |
339 | rs_free(p); |
340 | return (anchor ? &anchor->ruleset : 0); |
341 | } |
342 | |
343 | void |
344 | pf_remove_if_empty_ruleset(struct pf_ruleset *ruleset) |
345 | { |
346 | struct pf_anchor *parent; |
347 | int i; |
348 | |
349 | while (ruleset != NULL) { |
350 | if (ruleset == &pf_main_ruleset || ruleset->anchor == NULL || |
351 | !RB_EMPTY(&ruleset->anchor->children) || |
352 | ruleset->anchor->refcnt > 0 || ruleset->tables > 0 || |
353 | ruleset->topen) |
354 | return; |
355 | for (i = 0; i < PF_RULESET_MAX; ++i) |
356 | if (!TAILQ_EMPTY(ruleset->rules[i].active.ptr) || |
357 | !TAILQ_EMPTY(ruleset->rules[i].inactive.ptr) || |
358 | ruleset->rules[i].inactive.open) |
359 | return; |
360 | RB_REMOVE(pf_anchor_global, &pf_anchors, ruleset->anchor); |
361 | #if DUMMYNET |
362 | if(strncmp("com.apple.nlc" , ruleset->anchor->name, |
363 | sizeof("com.apple.nlc" )) == 0) { |
364 | struct dummynet_event dn_event; |
365 | bzero(&dn_event, sizeof(dn_event)); |
366 | dn_event.dn_event_code = DUMMYNET_NLC_DISABLED; |
367 | dummynet_event_enqueue_nwk_wq_entry(&dn_event); |
368 | is_nlc_enabled_glb = FALSE; |
369 | } |
370 | #endif |
371 | if ((parent = ruleset->anchor->parent) != NULL) |
372 | RB_REMOVE(pf_anchor_node, &parent->children, |
373 | ruleset->anchor); |
374 | rs_free(ruleset->anchor); |
375 | if (parent == NULL) |
376 | return; |
377 | ruleset = &parent->ruleset; |
378 | } |
379 | } |
380 | |
381 | int |
382 | pf_anchor_setup(struct pf_rule *r, const struct pf_ruleset *s, |
383 | const char *name) |
384 | { |
385 | char *p, *path; |
386 | struct pf_ruleset *ruleset; |
387 | |
388 | r->anchor = NULL; |
389 | r->anchor_relative = 0; |
390 | r->anchor_wildcard = 0; |
391 | if (!name[0]) |
392 | return (0); |
393 | path = (char *)rs_malloc(MAXPATHLEN); |
394 | bzero(path, MAXPATHLEN); |
395 | if (name[0] == '/') |
396 | strlcpy(path, name + 1, MAXPATHLEN); |
397 | else { |
398 | /* relative path */ |
399 | r->anchor_relative = 1; |
400 | if (s->anchor == NULL || !s->anchor->path[0]) |
401 | path[0] = 0; |
402 | else |
403 | strlcpy(path, s->anchor->path, MAXPATHLEN); |
404 | while (name[0] == '.' && name[1] == '.' && name[2] == '/') { |
405 | if (!path[0]) { |
406 | printf("pf_anchor_setup: .. beyond root\n" ); |
407 | rs_free(path); |
408 | return (1); |
409 | } |
410 | if ((p = strrchr(path, '/')) != NULL) |
411 | *p = 0; |
412 | else |
413 | path[0] = 0; |
414 | r->anchor_relative++; |
415 | name += 3; |
416 | } |
417 | if (path[0]) |
418 | strlcat(path, "/" , MAXPATHLEN); |
419 | strlcat(path, name, MAXPATHLEN); |
420 | } |
421 | if ((p = strrchr(path, '/')) != NULL && strcmp(p, "/*" ) == 0) { |
422 | r->anchor_wildcard = 1; |
423 | *p = 0; |
424 | } |
425 | ruleset = pf_find_or_create_ruleset(path); |
426 | rs_free(path); |
427 | if (ruleset == NULL || ruleset->anchor == NULL) { |
428 | printf("pf_anchor_setup: ruleset\n" ); |
429 | return (1); |
430 | } |
431 | r->anchor = ruleset->anchor; |
432 | r->anchor->refcnt++; |
433 | return (0); |
434 | } |
435 | |
436 | int |
437 | pf_anchor_copyout(const struct pf_ruleset *rs, const struct pf_rule *r, |
438 | struct pfioc_rule *pr) |
439 | { |
440 | pr->anchor_call[0] = 0; |
441 | if (r->anchor == NULL) |
442 | return (0); |
443 | if (!r->anchor_relative) { |
444 | strlcpy(pr->anchor_call, "/" , sizeof (pr->anchor_call)); |
445 | strlcat(pr->anchor_call, r->anchor->path, |
446 | sizeof (pr->anchor_call)); |
447 | } else { |
448 | char *a, *p; |
449 | int i; |
450 | |
451 | a = (char *)rs_malloc(MAXPATHLEN); |
452 | bzero(a, MAXPATHLEN); |
453 | if (rs->anchor == NULL) |
454 | a[0] = 0; |
455 | else |
456 | strlcpy(a, rs->anchor->path, MAXPATHLEN); |
457 | for (i = 1; i < r->anchor_relative; ++i) { |
458 | if ((p = strrchr(a, '/')) == NULL) |
459 | p = a; |
460 | *p = 0; |
461 | strlcat(pr->anchor_call, "../" , |
462 | sizeof (pr->anchor_call)); |
463 | } |
464 | if (strncmp(a, r->anchor->path, strlen(a))) { |
465 | printf("pf_anchor_copyout: '%s' '%s'\n" , a, |
466 | r->anchor->path); |
467 | rs_free(a); |
468 | return (1); |
469 | } |
470 | if (strlen(r->anchor->path) > strlen(a)) |
471 | strlcat(pr->anchor_call, r->anchor->path + (a[0] ? |
472 | strlen(a) + 1 : 0), sizeof (pr->anchor_call)); |
473 | rs_free(a); |
474 | } |
475 | if (r->anchor_wildcard) |
476 | strlcat(pr->anchor_call, pr->anchor_call[0] ? "/*" : "*" , |
477 | sizeof (pr->anchor_call)); |
478 | return (0); |
479 | } |
480 | |
481 | void |
482 | pf_anchor_remove(struct pf_rule *r) |
483 | { |
484 | if (r->anchor == NULL) |
485 | return; |
486 | if (r->anchor->refcnt <= 0) { |
487 | printf("pf_anchor_remove: broken refcount\n" ); |
488 | r->anchor = NULL; |
489 | return; |
490 | } |
491 | if (!--r->anchor->refcnt) |
492 | pf_remove_if_empty_ruleset(&r->anchor->ruleset); |
493 | r->anchor = NULL; |
494 | } |
495 | |