1 | /* |
2 | * Copyright (c) 2007-2023 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | /* $apfw: if_pflog.c,v 1.4 2008/08/27 00:01:32 jhw Exp $ */ |
30 | /* $OpenBSD: if_pflog.c,v 1.22 2006/12/15 09:31:20 otto Exp $ */ |
31 | /* |
32 | * The authors of this code are John Ioannidis (ji@tla.org), |
33 | * Angelos D. Keromytis (kermit@csd.uch.gr) and |
34 | * Niels Provos (provos@physnet.uni-hamburg.de). |
35 | * |
36 | * This code was written by John Ioannidis for BSD/OS in Athens, Greece, |
37 | * in November 1995. |
38 | * |
39 | * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, |
40 | * by Angelos D. Keromytis. |
41 | * |
42 | * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis |
43 | * and Niels Provos. |
44 | * |
45 | * Copyright (C) 1995, 1996, 1997, 1998 by John Ioannidis, Angelos D. Keromytis |
46 | * and Niels Provos. |
47 | * Copyright (c) 2001, Angelos D. Keromytis, Niels Provos. |
48 | * |
49 | * Permission to use, copy, and modify this software with or without fee |
50 | * is hereby granted, provided that this entire notice is included in |
51 | * all copies of any software which is or includes a copy or |
52 | * modification of this software. |
53 | * You may use this code under the GNU public license if you so wish. Please |
54 | * contribute changes back to the authors under this freer than GPL license |
55 | * so that we may further the use of strong encryption without limitations to |
56 | * all. |
57 | * |
58 | * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR |
59 | * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY |
60 | * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE |
61 | * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR |
62 | * PURPOSE. |
63 | */ |
64 | |
65 | #include <sys/param.h> |
66 | #include <sys/systm.h> |
67 | #include <sys/mbuf.h> |
68 | #include <sys/proc_internal.h> |
69 | #include <sys/socket.h> |
70 | #include <sys/ioctl.h> |
71 | #include <sys/mcache.h> |
72 | |
73 | #include <kern/zalloc.h> |
74 | |
75 | #include <net/if.h> |
76 | #include <net/if_var.h> |
77 | #include <net/if_types.h> |
78 | #include <net/route.h> |
79 | #include <net/bpf.h> |
80 | |
81 | #if INET |
82 | #include <netinet/in.h> |
83 | #include <netinet/in_var.h> |
84 | #include <netinet/in_systm.h> |
85 | #include <netinet/ip.h> |
86 | #endif |
87 | |
88 | #if !INET |
89 | #include <netinet/in.h> |
90 | #endif |
91 | #include <netinet6/nd6.h> |
92 | |
93 | #include <net/pfvar.h> |
94 | #include <net/if_pflog.h> |
95 | |
96 | #define PFLOGNAME "pflog" |
97 | #define PFLOGMTU (32768 + MHLEN + MLEN) |
98 | |
99 | #ifdef PFLOGDEBUG |
100 | #define DPRINTF(x) do { if (pflogdebug) printf x ; } while (0) |
101 | #else |
102 | #define DPRINTF(x) |
103 | #endif |
104 | |
105 | static int pflog_remove(struct ifnet *); |
106 | static int pflog_clone_create(struct if_clone *, u_int32_t, void *); |
107 | static int pflog_clone_destroy(struct ifnet *); |
108 | static errno_t pflogoutput(struct ifnet *, struct mbuf *); |
109 | static errno_t pflogioctl(struct ifnet *, unsigned long, void *); |
110 | static errno_t pflogdemux(struct ifnet *, struct mbuf *, char *, |
111 | protocol_family_t *); |
112 | static errno_t pflogaddproto(struct ifnet *, protocol_family_t, |
113 | const struct ifnet_demux_desc *, u_int32_t); |
114 | static errno_t pflogdelproto(struct ifnet *, protocol_family_t); |
115 | static void pflogfree(struct ifnet *); |
116 | |
117 | static LIST_HEAD(, pflog_softc) pflogif_list; |
118 | static struct if_clone pflog_cloner = |
119 | IF_CLONE_INITIALIZER(PFLOGNAME, pflog_clone_create, pflog_clone_destroy, |
120 | 0, (PFLOGIFS_MAX - 1)); |
121 | |
122 | struct ifnet *pflogifs[PFLOGIFS_MAX]; /* for fast access */ |
123 | |
124 | void |
125 | pfloginit(void) |
126 | { |
127 | int i; |
128 | |
129 | LIST_INIT(&pflogif_list); |
130 | for (i = 0; i < PFLOGIFS_MAX; i++) { |
131 | pflogifs[i] = NULL; |
132 | } |
133 | |
134 | (void) if_clone_attach(&pflog_cloner); |
135 | } |
136 | |
137 | #if !XNU_TARGET_OS_OSX |
138 | |
139 | static const char * |
140 | findsubstr(const char * haystack, const char * needle, size_t needle_len) |
141 | { |
142 | const char * scan; |
143 | |
144 | for (scan = haystack; *scan != '\0'; scan++) { |
145 | if (strncmp(scan, needle, needle_len) == 0) { |
146 | return scan; |
147 | } |
148 | } |
149 | return NULL; |
150 | } |
151 | |
152 | extern char osreleasetype[]; |
153 | |
154 | #define MY_OS_RELEASE_TYPE_MATCHES(str) (findsubstr(osreleasetype, str, sizeof(str) - 1) != NULL) |
155 | |
156 | #define _DARWIN "Darwin" |
157 | #define _RESTORE "Restore" |
158 | #define _INTERNAL "Internal" |
159 | #define _NONUI "NonUI" |
160 | |
161 | static inline bool |
162 | pflog_is_enabled(void) |
163 | { |
164 | uint8_t flags; |
165 | static uint8_t pflog_enabled_flags; |
166 | |
167 | #define _FLAGS_INITIALIZED 0x1 |
168 | #define _FLAGS_ENABLED 0x2 |
169 | |
170 | if (pflog_enabled_flags != 0) { |
171 | goto done; |
172 | } |
173 | flags = _FLAGS_INITIALIZED; |
174 | if (MY_OS_RELEASE_TYPE_MATCHES(_DARWIN) || |
175 | MY_OS_RELEASE_TYPE_MATCHES(_RESTORE) || |
176 | MY_OS_RELEASE_TYPE_MATCHES(_INTERNAL) || |
177 | MY_OS_RELEASE_TYPE_MATCHES(_NONUI)) { |
178 | flags |= _FLAGS_ENABLED; |
179 | } else { |
180 | printf("%s: osreleasetype %s doesn't allow pflog\n" , __func__, |
181 | osreleasetype); |
182 | } |
183 | lck_rw_lock_exclusive(&pf_perim_lock); |
184 | pflog_enabled_flags = flags; |
185 | lck_rw_done(&pf_perim_lock); |
186 | |
187 | done: |
188 | return (pflog_enabled_flags & _FLAGS_ENABLED) != 0; |
189 | } |
190 | |
191 | #endif /* !XNU_TARGET_OS_OSX */ |
192 | |
193 | static int |
194 | pflog_clone_create(struct if_clone *ifc, u_int32_t unit, __unused void *params) |
195 | { |
196 | struct pflog_softc *pflogif; |
197 | struct ifnet_init_eparams pf_init; |
198 | int error = 0; |
199 | |
200 | #if !XNU_TARGET_OS_OSX |
201 | if (!pflog_is_enabled()) { |
202 | return EOPNOTSUPP; |
203 | } |
204 | #endif /* !XNU_TARGET_OS_OSX */ |
205 | |
206 | if (unit >= PFLOGIFS_MAX) { |
207 | /* Either the interface cloner or our initializer is broken */ |
208 | panic("%s: unit (%d) exceeds max (%d)" , __func__, unit, |
209 | PFLOGIFS_MAX); |
210 | /* NOTREACHED */ |
211 | } |
212 | |
213 | pflogif = kalloc_type(struct pflog_softc, Z_WAITOK_ZERO_NOFAIL); |
214 | |
215 | bzero(s: &pf_init, n: sizeof(pf_init)); |
216 | pf_init.ver = IFNET_INIT_CURRENT_VERSION; |
217 | pf_init.len = sizeof(pf_init); |
218 | pf_init.flags = IFNET_INIT_LEGACY; |
219 | pf_init.name = ifc->ifc_name; |
220 | pf_init.unit = unit; |
221 | pf_init.type = IFT_PFLOG; |
222 | pf_init.family = IFNET_FAMILY_LOOPBACK; |
223 | pf_init.output = pflogoutput; |
224 | pf_init.demux = pflogdemux; |
225 | pf_init.add_proto = pflogaddproto; |
226 | pf_init.del_proto = pflogdelproto; |
227 | pf_init.softc = pflogif; |
228 | pf_init.ioctl = pflogioctl; |
229 | pf_init.detach = pflogfree; |
230 | |
231 | pflogif->sc_unit = unit; |
232 | pflogif->sc_flags |= IFPFLF_DETACHING; |
233 | |
234 | error = ifnet_allocate_extended(init: &pf_init, interface: &pflogif->sc_if); |
235 | if (error != 0) { |
236 | printf("%s: ifnet_allocate failed - %d\n" , __func__, error); |
237 | kfree_type(struct pflog_softc, pflogif); |
238 | goto done; |
239 | } |
240 | |
241 | ifnet_set_mtu(interface: pflogif->sc_if, PFLOGMTU); |
242 | ifnet_set_flags(interface: pflogif->sc_if, IFF_UP, IFF_UP); |
243 | |
244 | error = ifnet_attach(interface: pflogif->sc_if, NULL); |
245 | if (error != 0) { |
246 | printf("%s: ifnet_attach failed - %d\n" , __func__, error); |
247 | ifnet_release(interface: pflogif->sc_if); |
248 | kfree_type(struct pflog_softc, pflogif); |
249 | goto done; |
250 | } |
251 | |
252 | #if NBPFILTER > 0 |
253 | bpfattach(interface: pflogif->sc_if, DLT_PFLOG, PFLOG_HDRLEN); |
254 | #endif |
255 | |
256 | lck_rw_lock_shared(lck: &pf_perim_lock); |
257 | lck_mtx_lock(lck: &pf_lock); |
258 | LIST_INSERT_HEAD(&pflogif_list, pflogif, sc_list); |
259 | pflogifs[unit] = pflogif->sc_if; |
260 | pflogif->sc_flags &= ~IFPFLF_DETACHING; |
261 | lck_mtx_unlock(lck: &pf_lock); |
262 | lck_rw_done(lck: &pf_perim_lock); |
263 | |
264 | done: |
265 | return error; |
266 | } |
267 | |
268 | static int |
269 | pflog_remove(struct ifnet *ifp) |
270 | { |
271 | int error = 0; |
272 | struct pflog_softc *pflogif = NULL; |
273 | |
274 | lck_rw_lock_shared(lck: &pf_perim_lock); |
275 | lck_mtx_lock(lck: &pf_lock); |
276 | pflogif = ifp->if_softc; |
277 | |
278 | if (pflogif == NULL || |
279 | (pflogif->sc_flags & IFPFLF_DETACHING) != 0) { |
280 | error = EINVAL; |
281 | goto done; |
282 | } |
283 | |
284 | pflogif->sc_flags |= IFPFLF_DETACHING; |
285 | LIST_REMOVE(pflogif, sc_list); |
286 | done: |
287 | lck_mtx_unlock(lck: &pf_lock); |
288 | lck_rw_done(lck: &pf_perim_lock); |
289 | return error; |
290 | } |
291 | |
292 | static int |
293 | pflog_clone_destroy(struct ifnet *ifp) |
294 | { |
295 | int error = 0; |
296 | |
297 | if ((error = pflog_remove(ifp)) != 0) { |
298 | goto done; |
299 | } |
300 | /* bpfdetach() is taken care of as part of interface detach */ |
301 | (void)ifnet_detach(interface: ifp); |
302 | done: |
303 | return error; |
304 | } |
305 | |
306 | static errno_t |
307 | pflogoutput(struct ifnet *ifp, struct mbuf *m) |
308 | { |
309 | printf("%s: freeing data for %s\n" , __func__, if_name(ifp)); |
310 | m_freem(m); |
311 | return ENOTSUP; |
312 | } |
313 | |
314 | static errno_t |
315 | pflogioctl(struct ifnet *ifp, unsigned long cmd, void *data) |
316 | { |
317 | #pragma unused(data) |
318 | switch (cmd) { |
319 | case SIOCSIFADDR: |
320 | case SIOCAIFADDR: |
321 | case SIOCSIFDSTADDR: |
322 | case SIOCSIFFLAGS: |
323 | if (ifnet_flags(interface: ifp) & IFF_UP) { |
324 | ifnet_set_flags(interface: ifp, IFF_RUNNING, IFF_RUNNING); |
325 | } else { |
326 | ifnet_set_flags(interface: ifp, new_flags: 0, IFF_RUNNING); |
327 | } |
328 | break; |
329 | default: |
330 | return ENOTTY; |
331 | } |
332 | |
333 | return 0; |
334 | } |
335 | |
336 | static errno_t |
337 | pflogdemux(struct ifnet *ifp, struct mbuf *m, char *h, protocol_family_t *ppf) |
338 | { |
339 | #pragma unused(h, ppf) |
340 | printf("%s: freeing data for %s\n" , __func__, if_name(ifp)); |
341 | m_freem(m); |
342 | return EJUSTRETURN; |
343 | } |
344 | |
345 | static errno_t |
346 | pflogaddproto(struct ifnet *ifp, protocol_family_t pf, |
347 | const struct ifnet_demux_desc *d, u_int32_t cnt) |
348 | { |
349 | #pragma unused(ifp, pf, d, cnt) |
350 | return 0; |
351 | } |
352 | |
353 | static errno_t |
354 | pflogdelproto(struct ifnet *ifp, protocol_family_t pf) |
355 | { |
356 | #pragma unused(ifp, pf) |
357 | return 0; |
358 | } |
359 | |
360 | static void |
361 | pflogfree(struct ifnet *ifp) |
362 | { |
363 | kfree_type(struct pflog_softc, ifp->if_softc); |
364 | ifp->if_softc = NULL; |
365 | (void) ifnet_release(interface: ifp); |
366 | } |
367 | |
368 | int |
369 | pflog_packet(struct pfi_kif *kif, pbuf_t *pbuf, sa_family_t af, u_int8_t dir, |
370 | u_int8_t reason, struct pf_rule *rm, struct pf_rule *am, |
371 | struct pf_ruleset *ruleset, struct pf_pdesc *pd) |
372 | { |
373 | #if NBPFILTER > 0 |
374 | struct ifnet *ifn; |
375 | struct pfloghdr hdr; |
376 | struct mbuf *m; |
377 | |
378 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
379 | |
380 | if (kif == NULL || !pbuf_is_valid(pbuf) || rm == NULL || pd == NULL) { |
381 | return -1; |
382 | } |
383 | |
384 | if (rm->logif >= PFLOGIFS_MAX || |
385 | (ifn = pflogifs[rm->logif]) == NULL || !ifn->if_bpf) { |
386 | return 0; |
387 | } |
388 | |
389 | if ((m = pbuf_to_mbuf(pbuf, FALSE)) == NULL) { |
390 | return 0; |
391 | } |
392 | |
393 | bzero(s: &hdr, n: sizeof(hdr)); |
394 | hdr.length = PFLOG_REAL_HDRLEN; |
395 | hdr.af = af; |
396 | hdr.action = rm->action; |
397 | hdr.reason = reason; |
398 | memcpy(dst: hdr.ifname, src: kif->pfik_name, n: sizeof(hdr.ifname)); |
399 | |
400 | if (am == NULL) { |
401 | hdr.rulenr = htonl(rm->nr); |
402 | hdr.subrulenr = -1; |
403 | } else { |
404 | hdr.rulenr = htonl(am->nr); |
405 | hdr.subrulenr = htonl(rm->nr); |
406 | if (ruleset != NULL && ruleset->anchor != NULL) { |
407 | strlcpy(dst: hdr.ruleset, src: ruleset->anchor->name, |
408 | n: sizeof(hdr.ruleset)); |
409 | } |
410 | } |
411 | if (rm->log & PF_LOG_SOCKET_LOOKUP && !pd->lookup.done) { |
412 | pd->lookup.done = pf_socket_lookup(dir, pd); |
413 | } |
414 | if (pd->lookup.done > 0) { |
415 | hdr.uid = pd->lookup.uid; |
416 | hdr.pid = pd->lookup.pid; |
417 | } else { |
418 | hdr.uid = UID_MAX; |
419 | hdr.pid = NO_PID; |
420 | } |
421 | hdr.rule_uid = rm->cuid; |
422 | hdr.rule_pid = rm->cpid; |
423 | hdr.dir = dir; |
424 | |
425 | #if INET |
426 | if (af == AF_INET && dir == PF_OUT) { |
427 | struct ip *ip; |
428 | |
429 | ip = mtod(m, struct ip *); |
430 | ip->ip_sum = 0; |
431 | ip->ip_sum = in_cksum(m, ip->ip_hl << 2); |
432 | } |
433 | #endif /* INET */ |
434 | |
435 | os_atomic_inc(&ifn->if_opackets, relaxed); |
436 | os_atomic_add(&ifn->if_obytes, m->m_pkthdr.len, relaxed); |
437 | |
438 | switch (dir) { |
439 | case PF_IN: |
440 | bpf_tap_in(interface: ifn, DLT_PFLOG, packet: m, header: &hdr, PFLOG_HDRLEN); |
441 | break; |
442 | |
443 | case PF_OUT: |
444 | bpf_tap_out(interface: ifn, DLT_PFLOG, packet: m, header: &hdr, PFLOG_HDRLEN); |
445 | break; |
446 | |
447 | default: |
448 | break; |
449 | } |
450 | #endif /* NBPFILTER > 0 */ |
451 | return 0; |
452 | } |
453 | |