1 /*
2 * Copyright (c) 2015-2023 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #include <string.h>
30
31 #include <kern/thread_call.h>
32 #include <kern/zalloc.h>
33
34 #include <net/if.h>
35 #include <net/if_var.h>
36 #include <net/net_api_stats.h>
37 #include <net/necp.h>
38 #include <net/network_agent.h>
39 #include <net/ntstat.h>
40
41 #include <netinet/in_pcb.h>
42 #include <netinet/in_var.h>
43 #include <netinet/ip.h>
44 #include <netinet/ip6.h>
45 #include <netinet/mp_pcb.h>
46 #include <netinet/tcp_cc.h>
47 #include <netinet/tcp_fsm.h>
48 #include <netinet/tcp_cache.h>
49 #include <netinet6/in6_var.h>
50
51 #include <sys/domain.h>
52 #include <sys/file_internal.h>
53 #include <sys/kauth.h>
54 #include <sys/kernel.h>
55 #include <sys/malloc.h>
56 #include <sys/poll.h>
57 #include <sys/priv.h>
58 #include <sys/protosw.h>
59 #include <sys/queue.h>
60 #include <sys/socket.h>
61 #include <sys/socketvar.h>
62 #include <sys/sysproto.h>
63 #include <sys/systm.h>
64 #include <sys/types.h>
65 #include <sys/codesign.h>
66 #include <libkern/section_keywords.h>
67
68 #include <os/refcnt.h>
69
70 #if SKYWALK
71 #include <skywalk/os_skywalk_private.h>
72 #include <skywalk/nexus/flowswitch/flow/flow_var.h>
73 #include <skywalk/nexus/flowswitch/nx_flowswitch.h>
74 #endif /* SKYWALK */
75
76 #if CONFIG_MACF
77 #include <security/mac_framework.h>
78 #endif
79
80 /*
81 * NECP Client Architecture
82 * ------------------------------------------------
83 * See <net/necp.c> for a discussion on NECP database architecture.
84 *
85 * Each client of NECP provides a set of parameters for a connection or network state
86 * evaluation, on which NECP policy evaluation is run. This produces a policy result
87 * which can be accessed by the originating process, along with events for when policies
88 * results have changed.
89 *
90 * ------------------------------------------------
91 * NECP Client FD
92 * ------------------------------------------------
93 * A process opens an NECP file descriptor using necp_open(). This is a very simple
94 * file descriptor, upon which the process may do the following operations:
95 * - necp_client_action(...), to add/remove/query clients
96 * - kqueue, to watch for readable events
97 * - close(), to close the client session and release all clients
98 *
99 * Client objects are allocated structures that hang off of the file descriptor. Each
100 * client contains:
101 * - Client ID, a UUID that references the client across the system
102 * - Parameters, a buffer of TLVs that describe the client's connection parameters,
103 * such as the remote and local endpoints, interface requirements, etc.
104 * - Result, a buffer of TLVs containing the current policy evaluation for the client.
105 * This result will be updated whenever a network change occurs that impacts the
106 * policy result for that client.
107 *
108 * +--------------+
109 * | NECP fd |
110 * +--------------+
111 * ||
112 * ==================================
113 * || || ||
114 * +--------------+ +--------------+ +--------------+
115 * | Client ID | | Client ID | | Client ID |
116 * | ---- | | ---- | | ---- |
117 * | Parameters | | Parameters | | Parameters |
118 * | ---- | | ---- | | ---- |
119 * | Result | | Result | | Result |
120 * +--------------+ +--------------+ +--------------+
121 *
122 * ------------------------------------------------
123 * Client Actions
124 * ------------------------------------------------
125 * - Add. Input parameters as a buffer of TLVs, and output a client ID. Allocates a
126 * new client structure on the file descriptor.
127 * - Remove. Input a client ID. Removes a client structure from the file descriptor.
128 * - Copy Parameters. Input a client ID, and output parameter TLVs.
129 * - Copy Result. Input a client ID, and output result TLVs. Alternatively, input empty
130 * client ID and get next unread client result.
131 * - Copy List. List all client IDs.
132 *
133 * ------------------------------------------------
134 * Client Policy Evaluation
135 * ------------------------------------------------
136 * Policies are evaluated for clients upon client creation, and upon update events,
137 * which are network/agent/policy changes coalesced by a timer.
138 *
139 * The policy evaluation goes through the following steps:
140 * 1. Parse client parameters.
141 * 2. Select a scoped interface if applicable. This involves using require/prohibit
142 * parameters, along with the local address, to select the most appropriate interface
143 * if not explicitly set by the client parameters.
144 * 3. Run NECP application-level policy evalution
145 * 4. Set policy result into client result buffer.
146 *
147 * ------------------------------------------------
148 * Client Observers
149 * ------------------------------------------------
150 * If necp_open() is called with the NECP_OPEN_FLAG_OBSERVER flag, and the process
151 * passes the necessary privilege check, the fd is allowed to use necp_client_action()
152 * to copy client state attached to the file descriptors of other processes, and to
153 * list all client IDs on the system.
154 */
155
156 extern u_int32_t necp_debug;
157
158 static int necpop_select(struct fileproc *, int, void *, vfs_context_t);
159 static int necpop_close(struct fileglob *, vfs_context_t);
160 static int necpop_kqfilter(struct fileproc *, struct knote *, struct kevent_qos_s *);
161
162 // Timer functions
163 static int necp_timeout_microseconds = 1000 * 100; // 100ms
164 static int necp_timeout_leeway_microseconds = 1000 * 50; // 50ms
165 #if SKYWALK
166 static int necp_collect_stats_timeout_microseconds = 1000 * 1000 * 1; // 1s
167 static int necp_collect_stats_timeout_leeway_microseconds = 1000 * 500; // 500ms
168 static int necp_close_arenas_timeout_microseconds = 1000 * 1000 * 10; // 10s
169 static int necp_close_arenas_timeout_leeway_microseconds = 1000 * 1000 * 1; // 1s
170 #endif /* SKYWALK */
171
172 static int necp_client_fd_count = 0;
173 static int necp_observer_fd_count = 0;
174 static int necp_client_count = 0;
175 static int necp_socket_flow_count = 0;
176 static int necp_if_flow_count = 0;
177 static int necp_observer_message_limit = 256;
178
179 /*
180 * NECP client tracing control -
181 *
182 * necp_client_tracing_level : 1 for client trace, 2 for flow trace, 3 for parameter details
183 * necp_client_tracing_pid : match client with pid
184 */
185 static int necp_client_tracing_level = 0;
186 static int necp_client_tracing_pid = 0;
187
188 #define NECP_CLIENT_TRACE_LEVEL_CLIENT 1
189 #define NECP_CLIENT_TRACE_LEVEL_FLOW 2
190 #define NECP_CLIENT_TRACE_LEVEL_PARAMS 3
191
192 #define NECP_CLIENT_TRACE_PID_MATCHED(pid) \
193 (pid == necp_client_tracing_pid)
194
195 #define NECP_ENABLE_CLIENT_TRACE(level) \
196 ((necp_client_tracing_level >= level && \
197 (!necp_client_tracing_pid || NECP_CLIENT_TRACE_PID_MATCHED(client->proc_pid))) ? necp_client_tracing_level : 0)
198
199 #define NECP_CLIENT_LOG(client, fmt, ...) \
200 if (client && NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_CLIENT)) { \
201 uuid_string_t client_uuid_str = { }; \
202 uuid_unparse_lower(client->client_id, client_uuid_str); \
203 NECPLOG(LOG_NOTICE, "NECP_CLIENT_LOG <pid %d %s>: " fmt "\n", client ? client->proc_pid : 0, client_uuid_str, ##__VA_ARGS__); \
204 }
205
206 #define NECP_CLIENT_FLOW_LOG(client, flow, fmt, ...) \
207 if (client && flow && NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_FLOW)) { \
208 uuid_string_t client_uuid_str = { }; \
209 uuid_unparse_lower(client->client_id, client_uuid_str); \
210 uuid_string_t flow_uuid_str = { }; \
211 uuid_unparse_lower(flow->registration_id, flow_uuid_str); \
212 NECPLOG(LOG_NOTICE, "NECP CLIENT FLOW TRACE <pid %d %s> <flow %s>: " fmt "\n", client ? client->proc_pid : 0, client_uuid_str, flow_uuid_str, ##__VA_ARGS__); \
213 }
214
215 #define NECP_CLIENT_PARAMS_LOG(client, fmt, ...) \
216 if (client && NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) { \
217 uuid_string_t client_uuid_str = { }; \
218 uuid_unparse_lower(client->client_id, client_uuid_str); \
219 NECPLOG(LOG_NOTICE, "NECP_CLIENT_PARAMS_LOG <pid %d %s>: " fmt "\n", client ? client->proc_pid : 0, client_uuid_str, ##__VA_ARGS__); \
220 }
221
222 #define NECP_SOCKET_PID(so) \
223 ((so->so_flags & SOF_DELEGATED) ? so->e_pid : so->last_pid)
224
225 #define NECP_ENABLE_SOCKET_TRACE(level) \
226 ((necp_client_tracing_level >= level && \
227 (!necp_client_tracing_pid || NECP_CLIENT_TRACE_PID_MATCHED(NECP_SOCKET_PID(so)))) ? necp_client_tracing_level : 0)
228
229 #define NECP_SOCKET_PARAMS_LOG(so, fmt, ...) \
230 if (so && NECP_ENABLE_SOCKET_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) { \
231 NECPLOG(LOG_NOTICE, "NECP_SOCKET_PARAMS_LOG <pid %d>: " fmt "\n", NECP_SOCKET_PID(so), ##__VA_ARGS__); \
232 }
233
234 #define NECP_SOCKET_ATTRIBUTE_LOG(fmt, ...) \
235 if (necp_client_tracing_level >= NECP_CLIENT_TRACE_LEVEL_PARAMS) { \
236 NECPLOG(LOG_NOTICE, "NECP_SOCKET_ATTRIBUTE_LOG: " fmt "\n", ##__VA_ARGS__); \
237 }
238
239 #define NECP_CLIENT_TRACKER_LOG(pid, fmt, ...) \
240 if (pid) { \
241 NECPLOG(LOG_NOTICE, "NECP_CLIENT_TRACKER_LOG <pid %d>: " fmt "\n", pid, ##__VA_ARGS__); \
242 }
243
244 #if SKYWALK
245 static int necp_arena_count = 0;
246 static int necp_sysctl_arena_count = 0;
247 static int necp_nexus_flow_count = 0;
248
249 /* userspace stats sanity check range, same unit as TCP (see TCP_RTT_SCALE) */
250 static uint32_t necp_client_stats_rtt_floor = 1; // 32us
251 static uint32_t necp_client_stats_rtt_ceiling = 1920000; // 60s
252 const static struct sk_stats_flow ntstat_sk_stats_zero;
253 #endif /* SKYWALK */
254
255 /*
256 * Global lock to protect socket inp_necp_attributes across updates.
257 * NECP updating these attributes and clients accessing these attributes
258 * must take this lock.
259 */
260 static LCK_GRP_DECLARE(necp_socket_attr_lock_grp, "necpSocketAttrGroup");
261 LCK_MTX_DECLARE(necp_socket_attr_lock, &necp_socket_attr_lock_grp);
262
263 os_refgrp_decl(static, necp_client_refgrp, "NECPClientRefGroup", NULL);
264
265 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_FD_COUNT, client_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_fd_count, 0, "");
266 SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_FD_COUNT, observer_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_observer_fd_count, 0, "");
267 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_COUNT, client_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_count, 0, "");
268 SYSCTL_INT(_net_necp, NECPCTL_SOCKET_FLOW_COUNT, socket_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_socket_flow_count, 0, "");
269 SYSCTL_INT(_net_necp, NECPCTL_IF_FLOW_COUNT, if_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_if_flow_count, 0, "");
270 SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_MESSAGE_LIMIT, observer_message_limit, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_observer_message_limit, 256, "");
271 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_TRACING_LEVEL, necp_client_tracing_level, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_client_tracing_level, 0, "");
272 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_TRACING_PID, necp_client_tracing_pid, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_client_tracing_pid, 0, "");
273
274 #if SKYWALK
275 SYSCTL_INT(_net_necp, NECPCTL_ARENA_COUNT, arena_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_arena_count, 0, "");
276 SYSCTL_INT(_net_necp, NECPCTL_SYSCTL_ARENA_COUNT, sysctl_arena_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_sysctl_arena_count, 0, "");
277 SYSCTL_INT(_net_necp, NECPCTL_NEXUS_FLOW_COUNT, nexus_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_nexus_flow_count, 0, "");
278 #if (DEVELOPMENT || DEBUG)
279 SYSCTL_UINT(_net_necp, OID_AUTO, collect_stats_interval_us, CTLFLAG_RW | CTLFLAG_LOCKED, &necp_collect_stats_timeout_microseconds, 0, "");
280 SYSCTL_UINT(_net_necp, OID_AUTO, necp_client_stats_rtt_floor, CTLFLAG_RW | CTLFLAG_LOCKED, &necp_client_stats_rtt_floor, 0, "");
281 SYSCTL_UINT(_net_necp, OID_AUTO, necp_client_stats_rtt_ceiling, CTLFLAG_RW | CTLFLAG_LOCKED, &necp_client_stats_rtt_ceiling, 0, "");
282 #endif /* (DEVELOPMENT || DEBUG) */
283 #endif /* SKYWALK */
284
285 #define NECP_MAX_CLIENT_LIST_SIZE 1024 * 1024 // 1MB
286 #define NECP_MAX_AGENT_ACTION_SIZE 10 * 1024 // 10K
287
288 extern int tvtohz(struct timeval *);
289 extern unsigned int get_maxmtu(struct rtentry *);
290
291 // Parsed parameters
292 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR 0x00001
293 #define NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR 0x00002
294 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF 0x00004
295 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF 0x00008
296 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE 0x00010
297 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE 0x00020
298 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT 0x00040
299 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT 0x00080
300 #define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT 0x00100
301 #define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT 0x00200
302 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE 0x00400
303 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE 0x00800
304 #define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE 0x01000
305 #define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE 0x02000
306 #define NECP_PARSED_PARAMETERS_FIELD_FLAGS 0x04000
307 #define NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL 0x08000
308 #define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID 0x10000
309 #define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID 0x20000
310 #define NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS 0x40000
311 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT 0x80000
312 #define NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID 0x100000
313 #define NECP_PARSED_PARAMETERS_FIELD_ETHERTYPE 0x200000
314 #define NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL 0x400000
315 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE 0x800000
316 #define NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER 0x1000000
317 #define NECP_PARSED_PARAMETERS_FIELD_PARENT_UUID 0x2000000
318 #define NECP_PARSED_PARAMETERS_FIELD_FLOW_DEMUX_PATTERN 0x4000000
319 #define NECP_PARSED_PARAMETERS_FIELD_UID 0x8000000
320 #define NECP_PARSED_PARAMETERS_FIELD_PERSONA_ID 0x10000000
321
322
323 #define NECP_MAX_INTERFACE_PARAMETERS 16
324 #define NECP_MAX_AGENT_PARAMETERS 4
325 struct necp_client_parsed_parameters {
326 u_int32_t valid_fields;
327 u_int32_t flags;
328 u_int64_t delegated_upid;
329 union necp_sockaddr_union local_addr;
330 union necp_sockaddr_union remote_addr;
331 u_int32_t required_interface_index;
332 char prohibited_interfaces[NECP_MAX_INTERFACE_PARAMETERS][IFXNAMSIZ];
333 u_int8_t required_interface_type;
334 u_int8_t local_address_preference;
335 u_int8_t prohibited_interface_types[NECP_MAX_INTERFACE_PARAMETERS];
336 struct necp_client_parameter_netagent_type required_netagent_types[NECP_MAX_AGENT_PARAMETERS];
337 struct necp_client_parameter_netagent_type prohibited_netagent_types[NECP_MAX_AGENT_PARAMETERS];
338 struct necp_client_parameter_netagent_type preferred_netagent_types[NECP_MAX_AGENT_PARAMETERS];
339 struct necp_client_parameter_netagent_type avoided_netagent_types[NECP_MAX_AGENT_PARAMETERS];
340 uuid_t required_netagents[NECP_MAX_AGENT_PARAMETERS];
341 uuid_t prohibited_netagents[NECP_MAX_AGENT_PARAMETERS];
342 uuid_t preferred_netagents[NECP_MAX_AGENT_PARAMETERS];
343 uuid_t avoided_netagents[NECP_MAX_AGENT_PARAMETERS];
344 u_int8_t ip_protocol;
345 u_int8_t transport_protocol;
346 u_int16_t ethertype;
347 pid_t effective_pid;
348 uuid_t effective_uuid;
349 uuid_t parent_uuid;
350 u_int32_t traffic_class;
351 struct necp_demux_pattern demux_patterns[NECP_MAX_DEMUX_PATTERNS];
352 u_int8_t demux_pattern_count;
353 uid_t uid;
354 uid_t persona_id;
355 };
356
357 static bool
358 necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters,
359 u_int *return_ifindex, bool *validate_agents);
360
361 static bool
362 necp_ifnet_matches_local_address(struct ifnet *ifp, struct sockaddr *sa);
363
364 static bool
365 necp_ifnet_matches_parameters(struct ifnet *ifp,
366 struct necp_client_parsed_parameters *parsed_parameters,
367 u_int32_t override_flags,
368 u_int32_t *preferred_count,
369 bool secondary_interface,
370 bool require_scoped_field);
371
372 static const struct fileops necp_fd_ops = {
373 .fo_type = DTYPE_NETPOLICY,
374 .fo_read = fo_no_read,
375 .fo_write = fo_no_write,
376 .fo_ioctl = fo_no_ioctl,
377 .fo_select = necpop_select,
378 .fo_close = necpop_close,
379 .fo_drain = fo_no_drain,
380 .fo_kqfilter = necpop_kqfilter,
381 };
382
383 struct necp_client_assertion {
384 LIST_ENTRY(necp_client_assertion) assertion_chain;
385 uuid_t asserted_netagent;
386 };
387
388 struct necp_client_flow_header {
389 struct necp_tlv_header outer_header;
390 struct necp_tlv_header flow_id_tlv_header;
391 uuid_t flow_id;
392 struct necp_tlv_header flags_tlv_header;
393 u_int32_t flags_value;
394 struct necp_tlv_header interface_tlv_header;
395 struct necp_client_result_interface interface_value;
396 } __attribute__((__packed__));
397
398 struct necp_client_flow_protoctl_event_header {
399 struct necp_tlv_header protoctl_tlv_header;
400 struct necp_client_flow_protoctl_event protoctl_event;
401 } __attribute__((__packed__));
402
403 struct necp_client_nexus_flow_header {
404 struct necp_client_flow_header flow_header;
405 struct necp_tlv_header agent_tlv_header;
406 struct necp_client_result_netagent agent_value;
407 struct necp_tlv_header tfo_cookie_tlv_header;
408 u_int8_t tfo_cookie_value[NECP_TFO_COOKIE_LEN_MAX];
409 } __attribute__((__packed__));
410
411 #if SKYWALK
412 struct necp_arena_info;
413 #endif
414
415 struct necp_client_flow {
416 LIST_ENTRY(necp_client_flow) flow_chain;
417 unsigned invalid : 1;
418 unsigned nexus : 1; // If true, flow is a nexus; if false, flow is attached to socket
419 unsigned socket : 1;
420 unsigned viable : 1;
421 unsigned assigned : 1;
422 unsigned has_protoctl_event : 1;
423 unsigned check_tcp_heuristics : 1;
424 unsigned _reserved : 1;
425 union {
426 uuid_t nexus_agent;
427 struct {
428 void *socket_handle;
429 necp_client_flow_cb cb;
430 };
431 } u;
432 uint32_t interface_index;
433 u_short delegated_interface_index;
434 uint16_t interface_flags;
435 uint32_t necp_flow_flags;
436 struct necp_client_flow_protoctl_event protoctl_event;
437 union necp_sockaddr_union local_addr;
438 union necp_sockaddr_union remote_addr;
439
440 size_t assigned_results_length;
441 u_int8_t *assigned_results;
442 };
443
444 struct necp_client_flow_registration {
445 RB_ENTRY(necp_client_flow_registration) fd_link;
446 RB_ENTRY(necp_client_flow_registration) global_link;
447 RB_ENTRY(necp_client_flow_registration) client_link;
448 LIST_ENTRY(necp_client_flow_registration) collect_stats_chain;
449 uuid_t registration_id;
450 u_int32_t flags;
451 unsigned flow_result_read : 1;
452 unsigned defunct : 1;
453 void *interface_handle;
454 necp_client_flow_cb interface_cb;
455 struct necp_client *client;
456 LIST_HEAD(_necp_registration_flow_list, necp_client_flow) flow_list;
457 #if SKYWALK
458 struct necp_arena_info *stats_arena; /* arena where the stats objects came from */
459 void * kstats_kaddr; /* kernel snapshot of untrusted userspace stats, for calculating delta */
460 mach_vm_address_t ustats_uaddr; /* userspace stats (untrusted) */
461 nstat_userland_context stats_handler_context;
462 struct flow_stats *nexus_stats; /* shared stats objects between necp_client and skywalk */
463 #endif /* !SKYWALK */
464 u_int64_t last_interface_details __attribute__((aligned(sizeof(u_int64_t))));
465 };
466
467 static int necp_client_flow_id_cmp(struct necp_client_flow_registration *flow0, struct necp_client_flow_registration *flow1);
468
469 RB_HEAD(_necp_client_flow_tree, necp_client_flow_registration);
470 RB_PROTOTYPE_PREV(_necp_client_flow_tree, necp_client_flow_registration, client_link, necp_client_flow_id_cmp);
471 RB_GENERATE_PREV(_necp_client_flow_tree, necp_client_flow_registration, client_link, necp_client_flow_id_cmp);
472
473 #define NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT 4
474 #define NECP_CLIENT_MAX_INTERFACE_OPTIONS 32
475
476 #define NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT (NECP_CLIENT_MAX_INTERFACE_OPTIONS - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT)
477
478 struct necp_client {
479 RB_ENTRY(necp_client) link;
480 RB_ENTRY(necp_client) global_link;
481
482 decl_lck_mtx_data(, lock);
483 decl_lck_mtx_data(, route_lock);
484 os_refcnt_t reference_count;
485
486 uuid_t client_id;
487 unsigned result_read : 1;
488 unsigned group_members_read : 1;
489 unsigned allow_multiple_flows : 1;
490 unsigned legacy_client_is_flow : 1;
491
492 unsigned platform_binary : 1;
493 unsigned validated_parent : 1;
494
495 size_t result_length;
496 u_int8_t result[NECP_BASE_CLIENT_RESULT_SIZE];
497
498 necp_policy_id policy_id;
499 necp_policy_id skip_policy_id;
500
501 u_int8_t ip_protocol;
502 int proc_pid;
503
504 u_int64_t delegated_upid;
505
506 struct _necp_client_flow_tree flow_registrations;
507 LIST_HEAD(_necp_client_assertion_list, necp_client_assertion) assertion_list;
508
509 size_t assigned_group_members_length;
510 u_int8_t *assigned_group_members;
511
512 struct rtentry *current_route;
513
514 struct necp_client_interface_option interface_options[NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
515 struct necp_client_interface_option *extra_interface_options;
516 u_int8_t interface_option_count; // Number in interface_options + extra_interface_options
517
518 struct necp_client_result_netagent failed_trigger_agent;
519
520 void *agent_handle;
521
522 uuid_t override_euuid;
523
524 #if SKYWALK
525 netns_token port_reservation;
526 nstat_context nstat_context;
527 uuid_t latest_flow_registration_id;
528 uuid_t parent_client_id;
529 struct necp_client *original_parameters_source;
530 #endif /* !SKYWALK */
531
532 size_t parameters_length;
533 u_int8_t *parameters;
534 };
535
536 #define NECP_CLIENT_LOCK(_c) lck_mtx_lock(&_c->lock)
537 #define NECP_CLIENT_UNLOCK(_c) lck_mtx_unlock(&_c->lock)
538 #define NECP_CLIENT_ASSERT_LOCKED(_c) LCK_MTX_ASSERT(&_c->lock, LCK_MTX_ASSERT_OWNED)
539 #define NECP_CLIENT_ASSERT_UNLOCKED(_c) LCK_MTX_ASSERT(&_c->lock, LCK_MTX_ASSERT_NOTOWNED)
540
541 #define NECP_CLIENT_ROUTE_LOCK(_c) lck_mtx_lock(&_c->route_lock)
542 #define NECP_CLIENT_ROUTE_UNLOCK(_c) lck_mtx_unlock(&_c->route_lock)
543
544 static void necp_client_retain_locked(struct necp_client *client);
545 static void necp_client_retain(struct necp_client *client);
546
547 static bool necp_client_release_locked(struct necp_client *client);
548 static bool necp_client_release(struct necp_client *client);
549
550 static void
551 necp_client_add_assertion(struct necp_client *client, uuid_t netagent_uuid);
552
553 static bool
554 necp_client_remove_assertion(struct necp_client *client, uuid_t netagent_uuid);
555
556 static int
557 necp_client_copy_parameters_locked(struct necp_client *client,
558 struct necp_client_nexus_parameters *parameters);
559
560 LIST_HEAD(_necp_flow_registration_list, necp_client_flow_registration);
561 static struct _necp_flow_registration_list necp_collect_stats_flow_list;
562
563 struct necp_flow_defunct {
564 LIST_ENTRY(necp_flow_defunct) chain;
565
566 uuid_t flow_id;
567 uuid_t nexus_agent;
568 void *agent_handle;
569 int proc_pid;
570 u_int32_t flags;
571 struct necp_client_agent_parameters close_parameters;
572 bool has_close_parameters;
573 };
574
575 LIST_HEAD(_necp_flow_defunct_list, necp_flow_defunct);
576
577 static int necp_client_id_cmp(struct necp_client *client0, struct necp_client *client1);
578
579 RB_HEAD(_necp_client_tree, necp_client);
580 RB_PROTOTYPE_PREV(_necp_client_tree, necp_client, link, necp_client_id_cmp);
581 RB_GENERATE_PREV(_necp_client_tree, necp_client, link, necp_client_id_cmp);
582
583 RB_HEAD(_necp_client_global_tree, necp_client);
584 RB_PROTOTYPE_PREV(_necp_client_global_tree, necp_client, global_link, necp_client_id_cmp);
585 RB_GENERATE_PREV(_necp_client_global_tree, necp_client, global_link, necp_client_id_cmp);
586
587 RB_HEAD(_necp_fd_flow_tree, necp_client_flow_registration);
588 RB_PROTOTYPE_PREV(_necp_fd_flow_tree, necp_client_flow_registration, fd_link, necp_client_flow_id_cmp);
589 RB_GENERATE_PREV(_necp_fd_flow_tree, necp_client_flow_registration, fd_link, necp_client_flow_id_cmp);
590
591 RB_HEAD(_necp_client_flow_global_tree, necp_client_flow_registration);
592 RB_PROTOTYPE_PREV(_necp_client_flow_global_tree, necp_client_flow_registration, global_link, necp_client_flow_id_cmp);
593 RB_GENERATE_PREV(_necp_client_flow_global_tree, necp_client_flow_registration, global_link, necp_client_flow_id_cmp);
594
595 static struct _necp_client_global_tree necp_client_global_tree;
596 static struct _necp_client_flow_global_tree necp_client_flow_global_tree;
597
598 struct necp_client_update {
599 TAILQ_ENTRY(necp_client_update) chain;
600
601 uuid_t client_id;
602
603 size_t update_length;
604 struct necp_client_observer_update *update;
605 };
606
607 #if SKYWALK
608 struct necp_arena_info {
609 LIST_ENTRY(necp_arena_info) nai_chain;
610 u_int32_t nai_flags;
611 pid_t nai_proc_pid;
612 struct skmem_arena *nai_arena;
613 struct skmem_arena_mmap_info nai_mmap;
614 mach_vm_offset_t nai_roff;
615 u_int32_t nai_use_count;
616 };
617 #endif /* !SKYWALK */
618
619 #define NAIF_ATTACHED 0x1 // arena is attached to list
620 #define NAIF_REDIRECT 0x2 // arena mmap has been redirected
621 #define NAIF_DEFUNCT 0x4 // arena is now defunct
622
623 #define NECP_FD_REPORTED_AGENT_COUNT 2
624
625 struct necp_fd_reported_agents {
626 uuid_t agent_uuid[NECP_FD_REPORTED_AGENT_COUNT];
627 };
628
629 struct necp_fd_data {
630 u_int8_t necp_fd_type;
631 LIST_ENTRY(necp_fd_data) chain;
632 struct _necp_client_tree clients;
633 struct _necp_fd_flow_tree flows;
634 TAILQ_HEAD(_necp_client_update_list, necp_client_update) update_list;
635 int update_count;
636 int flags;
637
638 unsigned background : 1;
639 unsigned request_in_process_flow_divert : 1;
640
641 int proc_pid;
642 decl_lck_mtx_data(, fd_lock);
643 struct selinfo si;
644
645 struct necp_fd_reported_agents reported_agents;
646 #if SKYWALK
647 // Arenas and their mmap info for per-process stats. Stats objects are allocated from an active arena
648 // that is not redirected/defunct. The stats_arena_active keeps track of such an arena, and it also
649 // holds a reference count on the object. Each flow allocating a stats object also holds a reference
650 // the necp_arena_info (where the object got allocated from). During defunct, we redirect the mapping
651 // of the arena such that any attempt to access (read/write) will result in getting zero-filled pages.
652 // We then go thru all of the flows for the process and free the stats objects associated with them,
653 // followed by destroying the skmem region(s) associated with the arena. The stats_arena_list keeps
654 // track of all current and defunct stats arenas; there could be more than one arena created for the
655 // process as the arena destruction happens when its reference count drops to 0.
656 struct necp_arena_info *stats_arena_active;
657 LIST_HEAD(_necp_arena_info_list, necp_arena_info) stats_arena_list;
658 u_int32_t stats_arena_gencnt;
659
660 struct skmem_arena *sysctl_arena;
661 struct skmem_arena_mmap_info sysctl_mmap;
662 mach_vm_offset_t system_sysctls_roff;
663 #endif /* !SKYWALK */
664 };
665
666 #define NECP_FD_LOCK(_f) lck_mtx_lock(&_f->fd_lock)
667 #define NECP_FD_UNLOCK(_f) lck_mtx_unlock(&_f->fd_lock)
668 #define NECP_FD_ASSERT_LOCKED(_f) LCK_MTX_ASSERT(&_f->fd_lock, LCK_MTX_ASSERT_OWNED)
669 #define NECP_FD_ASSERT_UNLOCKED(_f) LCK_MTX_ASSERT(&_f->fd_lock, LCK_MTX_ASSERT_NOTOWNED)
670
671 static LIST_HEAD(_necp_fd_list, necp_fd_data) necp_fd_list;
672 static LIST_HEAD(_necp_fd_observer_list, necp_fd_data) necp_fd_observer_list;
673
674 #if SKYWALK
675 static KALLOC_TYPE_DEFINE(necp_arena_info_zone, struct necp_arena_info, NET_KT_DEFAULT);
676 #endif /* !SKYWALK */
677
678 static LCK_ATTR_DECLARE(necp_fd_mtx_attr, 0, 0);
679 static LCK_GRP_DECLARE(necp_fd_mtx_grp, "necp_fd");
680
681 static LCK_RW_DECLARE_ATTR(necp_fd_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
682 static LCK_RW_DECLARE_ATTR(necp_observer_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
683 static LCK_RW_DECLARE_ATTR(necp_client_tree_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
684 static LCK_RW_DECLARE_ATTR(necp_flow_tree_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
685 static LCK_RW_DECLARE_ATTR(necp_collect_stats_list_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
686
687
688 #define NECP_STATS_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_collect_stats_list_lock)
689 #define NECP_STATS_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_collect_stats_list_lock)
690 #define NECP_STATS_LIST_UNLOCK() lck_rw_done(&necp_collect_stats_list_lock)
691
692 #define NECP_CLIENT_TREE_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_client_tree_lock)
693 #define NECP_CLIENT_TREE_LOCK_SHARED() lck_rw_lock_shared(&necp_client_tree_lock)
694 #define NECP_CLIENT_TREE_UNLOCK() lck_rw_done(&necp_client_tree_lock)
695 #define NECP_CLIENT_TREE_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_client_tree_lock, LCK_RW_ASSERT_HELD)
696
697 #define NECP_FLOW_TREE_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_flow_tree_lock)
698 #define NECP_FLOW_TREE_LOCK_SHARED() lck_rw_lock_shared(&necp_flow_tree_lock)
699 #define NECP_FLOW_TREE_UNLOCK() lck_rw_done(&necp_flow_tree_lock)
700 #define NECP_FLOW_TREE_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_flow_tree_lock, LCK_RW_ASSERT_HELD)
701
702 #define NECP_FD_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_fd_lock)
703 #define NECP_FD_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_fd_lock)
704 #define NECP_FD_LIST_UNLOCK() lck_rw_done(&necp_fd_lock)
705 #define NECP_FD_LIST_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_fd_lock, LCK_RW_ASSERT_HELD)
706
707 #define NECP_OBSERVER_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_observer_lock)
708 #define NECP_OBSERVER_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_observer_lock)
709 #define NECP_OBSERVER_LIST_UNLOCK() lck_rw_done(&necp_observer_lock)
710
711 // Locking Notes
712
713 // Take NECP_FD_LIST_LOCK when accessing or modifying the necp_fd_list
714 // Take NECP_CLIENT_TREE_LOCK when accessing or modifying the necp_client_global_tree
715 // Take NECP_FLOW_TREE_LOCK when accessing or modifying the necp_client_flow_global_tree
716 // Take NECP_STATS_LIST_LOCK when accessing or modifying the necp_collect_stats_flow_list
717 // Take NECP_FD_LOCK when accessing or modifying an necp_fd_data entry
718 // Take NECP_CLIENT_LOCK when accessing or modifying a single necp_client
719 // Take NECP_CLIENT_ROUTE_LOCK when accessing or modifying a client's route
720
721 // Precedence, where 1 is the first lock that must be taken
722 // 1. NECP_FD_LIST_LOCK
723 // 2. NECP_FD_LOCK (any)
724 // 3. NECP_CLIENT_TREE_LOCK
725 // 4. NECP_CLIENT_LOCK (any)
726 // 5. NECP_FLOW_TREE_LOCK
727 // 6. NECP_STATS_LIST_LOCK
728 // 7. NECP_CLIENT_ROUTE_LOCK (any)
729
730 static thread_call_t necp_client_update_tcall;
731 static uint32_t necp_update_all_clients_sched_cnt = 0;
732 static uint64_t necp_update_all_clients_sched_abstime = 0;
733 static LCK_RW_DECLARE_ATTR(necp_update_all_clients_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
734 #define NECP_UPDATE_ALL_CLIENTS_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_update_all_clients_lock)
735 #define NECP_UPDATE_ALL_CLIENTS_SHARED_TO_EXCLUSIVE() lck_rw_lock_shared_to_exclusive(&necp_update_all_clients_lock)
736 #define NECP_UPDATE_ALL_CLIENTS_SHARED() lck_rw_lock_shared(&necp_update_all_clients_lock)
737 #define NECP_UPDATE_ALL_CLIENTS_UNLOCK() lck_rw_done(&necp_update_all_clients_lock)
738
739 // Array of PIDs that will trigger in-process flow divert, protected by NECP_FD_LIST_LOCK
740 #define NECP_MAX_FLOW_DIVERT_NEEDED_PIDS 4
741 static pid_t necp_flow_divert_needed_pids[NECP_MAX_FLOW_DIVERT_NEEDED_PIDS];
742
743 #if SKYWALK
744 static thread_call_t necp_client_collect_stats_tcall;
745 static thread_call_t necp_close_empty_arenas_tcall;
746
747 static void necp_fd_insert_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai);
748 static void necp_fd_remove_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai);
749 static struct necp_arena_info *necp_fd_mredirect_stats_arena(struct necp_fd_data *fd_data, struct proc *proc);
750
751 static void necp_arena_info_retain(struct necp_arena_info *nai);
752 static void necp_arena_info_release(struct necp_arena_info *nai);
753 static struct necp_arena_info *necp_arena_info_alloc(void);
754 static void necp_arena_info_free(struct necp_arena_info *nai);
755
756 static int necp_arena_initialize(struct necp_fd_data *fd_data, bool locked);
757 static int necp_stats_initialize(struct necp_fd_data *fd_data, struct necp_client *client,
758 struct necp_client_flow_registration *flow_registration, struct necp_stats_bufreq *bufreq);
759 static int necp_arena_create(struct necp_fd_data *fd_data, size_t obj_size, size_t obj_cnt, struct proc *p);
760 static int necp_arena_stats_obj_alloc(struct necp_fd_data *fd_data, mach_vm_offset_t *off, struct necp_arena_info **stats_arena, void **kstats_kaddr, boolean_t cansleep);
761 static void necp_arena_stats_obj_free(struct necp_fd_data *fd_data, struct necp_arena_info *stats_arena, void **kstats_kaddr, mach_vm_address_t *ustats_uaddr);
762 static void necp_stats_arenas_destroy(struct necp_fd_data *fd_data, boolean_t closing);
763
764 static int necp_sysctl_arena_initialize(struct necp_fd_data *fd_data, bool locked);
765 static void necp_sysctl_arena_destroy(struct necp_fd_data *fd_data);
766 static void *necp_arena_sysctls_obj(struct necp_fd_data *fd_data, mach_vm_offset_t *off, size_t *size);
767 #endif /* !SKYWALK */
768
769 void necp_copy_inp_domain_info(struct inpcb *, struct socket *, nstat_domain_info *);
770 void necp_with_inp_domain_name(struct socket *so, void *ctx, void (*with_func)(char *domain_name, void *ctx));
771
772 static void
necp_lock_socket_attributes(void)773 necp_lock_socket_attributes(void)
774 {
775 lck_mtx_lock(&necp_socket_attr_lock);
776 }
777
778 static void
necp_unlock_socket_attributes(void)779 necp_unlock_socket_attributes(void)
780 {
781 lck_mtx_unlock(&necp_socket_attr_lock);
782 }
783
784 /// NECP file descriptor functions
785
786 static void
necp_fd_notify(struct necp_fd_data * fd_data,bool locked)787 necp_fd_notify(struct necp_fd_data *fd_data, bool locked)
788 {
789 struct selinfo *si = &fd_data->si;
790
791 if (!locked) {
792 NECP_FD_LOCK(fd_data);
793 }
794
795 selwakeup(si);
796
797 // use a non-zero hint to tell the notification from the
798 // call done in kqueue_scan() which uses 0
799 KNOTE(&si->si_note, 1); // notification
800
801 if (!locked) {
802 NECP_FD_UNLOCK(fd_data);
803 }
804 }
805
806 static inline bool
necp_client_has_unread_flows(struct necp_client * client)807 necp_client_has_unread_flows(struct necp_client *client)
808 {
809 NECP_CLIENT_ASSERT_LOCKED(client);
810 struct necp_client_flow_registration *flow_registration = NULL;
811 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
812 if (!flow_registration->flow_result_read) {
813 return true;
814 }
815 }
816 return false;
817 }
818
819 static int
necp_fd_poll(struct necp_fd_data * fd_data,int events,void * wql,struct proc * p,int is_kevent)820 necp_fd_poll(struct necp_fd_data *fd_data, int events, void *wql, struct proc *p, int is_kevent)
821 {
822 #pragma unused(wql, p, is_kevent)
823 u_int revents = 0;
824
825 u_int want_rx = events & (POLLIN | POLLRDNORM);
826 if (want_rx) {
827 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
828 // Push-mode observers are readable when they have a new update
829 if (!TAILQ_EMPTY(&fd_data->update_list)) {
830 revents |= want_rx;
831 }
832 } else {
833 // Standard fds are readable when some client is unread
834 struct necp_client *client = NULL;
835 bool has_unread_clients = FALSE;
836 RB_FOREACH(client, _necp_client_tree, &fd_data->clients) {
837 NECP_CLIENT_LOCK(client);
838 if (!client->result_read || !client->group_members_read || necp_client_has_unread_flows(client)) {
839 has_unread_clients = TRUE;
840 }
841 NECP_CLIENT_UNLOCK(client);
842 if (has_unread_clients) {
843 break;
844 }
845 }
846
847 if (has_unread_clients || fd_data->request_in_process_flow_divert) {
848 revents |= want_rx;
849 }
850 }
851 }
852
853 return revents;
854 }
855
856 static inline void
necp_generate_client_id(uuid_t client_id,bool is_flow)857 necp_generate_client_id(uuid_t client_id, bool is_flow)
858 {
859 uuid_generate_random(client_id);
860
861 if (is_flow) {
862 client_id[9] |= 0x01;
863 } else {
864 client_id[9] &= ~0x01;
865 }
866 }
867
868 static inline bool
necp_client_id_is_flow(uuid_t client_id)869 necp_client_id_is_flow(uuid_t client_id)
870 {
871 return client_id[9] & 0x01;
872 }
873
874 static struct necp_client *
necp_find_client_and_lock(uuid_t client_id)875 necp_find_client_and_lock(uuid_t client_id)
876 {
877 NECP_CLIENT_TREE_ASSERT_LOCKED();
878
879 struct necp_client *client = NULL;
880
881 if (necp_client_id_is_flow(client_id)) {
882 NECP_FLOW_TREE_LOCK_SHARED();
883 struct necp_client_flow_registration find;
884 uuid_copy(find.registration_id, client_id);
885 struct necp_client_flow_registration *flow = RB_FIND(_necp_client_flow_global_tree, &necp_client_flow_global_tree, &find);
886 if (flow != NULL) {
887 client = flow->client;
888 }
889 NECP_FLOW_TREE_UNLOCK();
890 } else {
891 struct necp_client find;
892 uuid_copy(find.client_id, client_id);
893 client = RB_FIND(_necp_client_global_tree, &necp_client_global_tree, &find);
894 }
895
896 if (client != NULL) {
897 NECP_CLIENT_LOCK(client);
898 }
899
900 return client;
901 }
902
903 static struct necp_client_flow_registration *
necp_client_find_flow(struct necp_client * client,uuid_t flow_id)904 necp_client_find_flow(struct necp_client *client, uuid_t flow_id)
905 {
906 NECP_CLIENT_ASSERT_LOCKED(client);
907 struct necp_client_flow_registration *flow = NULL;
908
909 if (necp_client_id_is_flow(flow_id)) {
910 struct necp_client_flow_registration find;
911 uuid_copy(find.registration_id, flow_id);
912 flow = RB_FIND(_necp_client_flow_tree, &client->flow_registrations, &find);
913 } else {
914 flow = RB_ROOT(&client->flow_registrations);
915 }
916
917 return flow;
918 }
919
920 static struct necp_client *
necp_client_fd_find_client_unlocked(struct necp_fd_data * client_fd,uuid_t client_id)921 necp_client_fd_find_client_unlocked(struct necp_fd_data *client_fd, uuid_t client_id)
922 {
923 NECP_FD_ASSERT_LOCKED(client_fd);
924 struct necp_client *client = NULL;
925
926 if (necp_client_id_is_flow(client_id)) {
927 struct necp_client_flow_registration find;
928 uuid_copy(find.registration_id, client_id);
929 struct necp_client_flow_registration *flow = RB_FIND(_necp_fd_flow_tree, &client_fd->flows, &find);
930 if (flow != NULL) {
931 client = flow->client;
932 }
933 } else {
934 struct necp_client find;
935 uuid_copy(find.client_id, client_id);
936 client = RB_FIND(_necp_client_tree, &client_fd->clients, &find);
937 }
938
939 return client;
940 }
941
942 static struct necp_client *
necp_client_fd_find_client_and_lock(struct necp_fd_data * client_fd,uuid_t client_id)943 necp_client_fd_find_client_and_lock(struct necp_fd_data *client_fd, uuid_t client_id)
944 {
945 struct necp_client *client = necp_client_fd_find_client_unlocked(client_fd, client_id);
946 if (client != NULL) {
947 NECP_CLIENT_LOCK(client);
948 }
949
950 return client;
951 }
952
953 static inline int
necp_client_id_cmp(struct necp_client * client0,struct necp_client * client1)954 necp_client_id_cmp(struct necp_client *client0, struct necp_client *client1)
955 {
956 return uuid_compare(client0->client_id, client1->client_id);
957 }
958
959 static inline int
necp_client_flow_id_cmp(struct necp_client_flow_registration * flow0,struct necp_client_flow_registration * flow1)960 necp_client_flow_id_cmp(struct necp_client_flow_registration *flow0, struct necp_client_flow_registration *flow1)
961 {
962 return uuid_compare(flow0->registration_id, flow1->registration_id);
963 }
964
965 static int
necpop_select(struct fileproc * fp,int which,void * wql,vfs_context_t ctx)966 necpop_select(struct fileproc *fp, int which, void *wql, vfs_context_t ctx)
967 {
968 #pragma unused(fp, which, wql, ctx)
969 return 0;
970 struct necp_fd_data *fd_data = NULL;
971 int revents = 0;
972 int events = 0;
973 proc_t procp;
974
975 fd_data = (struct necp_fd_data *)fp_get_data(fp);
976 if (fd_data == NULL) {
977 return 0;
978 }
979
980 procp = vfs_context_proc(ctx);
981
982 switch (which) {
983 case FREAD: {
984 events = POLLIN;
985 break;
986 }
987
988 default: {
989 return 1;
990 }
991 }
992
993 NECP_FD_LOCK(fd_data);
994 revents = necp_fd_poll(fd_data, events, wql, procp, 0);
995 NECP_FD_UNLOCK(fd_data);
996
997 return (events & revents) ? 1 : 0;
998 }
999
1000 static void
necp_fd_knrdetach(struct knote * kn)1001 necp_fd_knrdetach(struct knote *kn)
1002 {
1003 struct necp_fd_data *fd_data = (struct necp_fd_data *)knote_kn_hook_get_raw(kn);
1004 struct selinfo *si = &fd_data->si;
1005
1006 NECP_FD_LOCK(fd_data);
1007 KNOTE_DETACH(&si->si_note, kn);
1008 NECP_FD_UNLOCK(fd_data);
1009 }
1010
1011 static int
necp_fd_knread(struct knote * kn,long hint)1012 necp_fd_knread(struct knote *kn, long hint)
1013 {
1014 #pragma unused(kn, hint)
1015 return 1; /* assume we are ready */
1016 }
1017
1018 static int
necp_fd_knrprocess(struct knote * kn,struct kevent_qos_s * kev)1019 necp_fd_knrprocess(struct knote *kn, struct kevent_qos_s *kev)
1020 {
1021 struct necp_fd_data *fd_data;
1022 int revents;
1023 int res;
1024
1025 fd_data = (struct necp_fd_data *)knote_kn_hook_get_raw(kn);
1026
1027 NECP_FD_LOCK(fd_data);
1028 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
1029 res = ((revents & POLLIN) != 0);
1030 if (res) {
1031 knote_fill_kevent(kn, kev, 0);
1032 }
1033 NECP_FD_UNLOCK(fd_data);
1034 return res;
1035 }
1036
1037 static int
necp_fd_knrtouch(struct knote * kn,struct kevent_qos_s * kev)1038 necp_fd_knrtouch(struct knote *kn, struct kevent_qos_s *kev)
1039 {
1040 #pragma unused(kev)
1041 struct necp_fd_data *fd_data;
1042 int revents;
1043
1044 fd_data = (struct necp_fd_data *)knote_kn_hook_get_raw(kn);
1045
1046 NECP_FD_LOCK(fd_data);
1047 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
1048 NECP_FD_UNLOCK(fd_data);
1049
1050 return (revents & POLLIN) != 0;
1051 }
1052
1053 SECURITY_READ_ONLY_EARLY(struct filterops) necp_fd_rfiltops = {
1054 .f_isfd = 1,
1055 .f_detach = necp_fd_knrdetach,
1056 .f_event = necp_fd_knread,
1057 .f_touch = necp_fd_knrtouch,
1058 .f_process = necp_fd_knrprocess,
1059 };
1060
1061 static int
necpop_kqfilter(struct fileproc * fp,struct knote * kn,__unused struct kevent_qos_s * kev)1062 necpop_kqfilter(struct fileproc *fp, struct knote *kn,
1063 __unused struct kevent_qos_s *kev)
1064 {
1065 struct necp_fd_data *fd_data = NULL;
1066 int revents;
1067
1068 if (kn->kn_filter != EVFILT_READ) {
1069 NECPLOG(LOG_ERR, "bad filter request %d", kn->kn_filter);
1070 knote_set_error(kn, EINVAL);
1071 return 0;
1072 }
1073
1074 fd_data = (struct necp_fd_data *)fp_get_data(fp);
1075 if (fd_data == NULL) {
1076 NECPLOG0(LOG_ERR, "No channel for kqfilter");
1077 knote_set_error(kn, ENOENT);
1078 return 0;
1079 }
1080
1081 NECP_FD_LOCK(fd_data);
1082 kn->kn_filtid = EVFILTID_NECP_FD;
1083 knote_kn_hook_set_raw(kn, fd_data);
1084 KNOTE_ATTACH(&fd_data->si.si_note, kn);
1085
1086 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
1087
1088 NECP_FD_UNLOCK(fd_data);
1089
1090 return (revents & POLLIN) != 0;
1091 }
1092
1093 #define INTERFACE_FLAGS_SHIFT 32
1094 #define INTERFACE_FLAGS_MASK 0xffff
1095 #define INTERFACE_INDEX_SHIFT 0
1096 #define INTERFACE_INDEX_MASK 0xffffffff
1097
1098 static uint64_t
combine_interface_details(uint32_t interface_index,uint16_t interface_flags)1099 combine_interface_details(uint32_t interface_index, uint16_t interface_flags)
1100 {
1101 return ((uint64_t)interface_flags & INTERFACE_FLAGS_MASK) << INTERFACE_FLAGS_SHIFT |
1102 ((uint64_t)interface_index & INTERFACE_INDEX_MASK) << INTERFACE_INDEX_SHIFT;
1103 }
1104
1105 #if SKYWALK
1106
1107 static void
split_interface_details(uint64_t combined_details,uint32_t * interface_index,uint16_t * interface_flags)1108 split_interface_details(uint64_t combined_details, uint32_t *interface_index, uint16_t *interface_flags)
1109 {
1110 *interface_index = (combined_details >> INTERFACE_INDEX_SHIFT) & INTERFACE_INDEX_MASK;
1111 *interface_flags = (combined_details >> INTERFACE_FLAGS_SHIFT) & INTERFACE_FLAGS_MASK;
1112 }
1113
1114 static void
necp_flow_save_current_interface_details(struct necp_client_flow_registration * flow_registration)1115 necp_flow_save_current_interface_details(struct necp_client_flow_registration *flow_registration)
1116 {
1117 struct necp_client_flow *flow = NULL;
1118 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1119 if (flow->nexus) {
1120 uint64_t combined_details = combine_interface_details(flow->interface_index, flow->interface_flags);
1121 os_atomic_store(&flow_registration->last_interface_details, combined_details, release);
1122 break;
1123 }
1124 }
1125 }
1126
1127 static void
necp_client_collect_interface_stats(struct necp_client_flow_registration * flow_registration,struct ifnet_stats_per_flow * ifs)1128 necp_client_collect_interface_stats(struct necp_client_flow_registration *flow_registration, struct ifnet_stats_per_flow *ifs)
1129 {
1130 struct necp_client_flow *flow = NULL;
1131
1132 if (ifs == NULL || ifs->txpackets == 0 || ifs->rxpackets == 0) {
1133 return; // App might have crashed without publishing ifs
1134 }
1135
1136 // Do malicious stats detection here
1137
1138 // Fold userspace stats into (trusted) kernel stats (stored in ifp).
1139 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1140 uint32_t if_idx = flow->interface_index;
1141 ifnet_t ifp = NULL;
1142 ifnet_head_lock_shared();
1143 if (if_idx != IFSCOPE_NONE && if_idx <= (uint32_t)if_index) {
1144 ifp = ifindex2ifnet[if_idx];
1145 ifnet_update_stats_per_flow(ifs, ifp);
1146 }
1147 ifnet_head_done();
1148
1149 // Currently there is only one flow that uses the shared necp
1150 // stats region, so this loop should exit after updating an ifp
1151 break;
1152 }
1153 }
1154
1155 static void
necp_client_collect_stats(struct necp_client_flow_registration * flow_registration)1156 necp_client_collect_stats(struct necp_client_flow_registration *flow_registration)
1157 {
1158 struct necp_all_kstats *kstats = (struct necp_all_kstats *)flow_registration->kstats_kaddr;
1159 if (kstats == NULL) {
1160 return;
1161 }
1162
1163 // Grab userspace stats delta (untrusted).
1164 struct necp_tcp_stats *curr_tcpstats = (struct necp_tcp_stats *)kstats->necp_stats_ustats;
1165 struct necp_tcp_stats *prev_tcpstats = (struct necp_tcp_stats *)&kstats->necp_stats_comm;
1166 #define diff_n_update(field) \
1167 u_int32_t d_##field = (curr_tcpstats->necp_tcp_counts.necp_stat_##field - prev_tcpstats->necp_tcp_counts.necp_stat_##field); \
1168 prev_tcpstats->necp_tcp_counts.necp_stat_##field += d_##field;
1169 diff_n_update(rxpackets);
1170 diff_n_update(txpackets);
1171 if (d_rxpackets == 0 && d_txpackets == 0) {
1172 return; // no activity since last collection, stop here
1173 }
1174 diff_n_update(rxbytes);
1175 diff_n_update(txbytes);
1176 diff_n_update(rxduplicatebytes);
1177 diff_n_update(rxoutoforderbytes);
1178 diff_n_update(txretransmit);
1179 diff_n_update(connectattempts);
1180 diff_n_update(connectsuccesses);
1181 uint32_t rtt = prev_tcpstats->necp_tcp_counts.necp_stat_avg_rtt = curr_tcpstats->necp_tcp_counts.necp_stat_avg_rtt;
1182 uint32_t rtt_var = prev_tcpstats->necp_tcp_counts.necp_stat_var_rtt = curr_tcpstats->necp_tcp_counts.necp_stat_var_rtt;
1183 #undef diff_n_update
1184
1185 // Do malicious stats detection with the deltas here.
1186 // RTT check (not necessarily attacks, might just be not measured since we report stats async periodically).
1187 if (rtt < necp_client_stats_rtt_floor || rtt > necp_client_stats_rtt_ceiling) {
1188 rtt = rtt_var = 0; // nstat_route_update to skip 0 rtt
1189 }
1190
1191 // Fold userspace stats into (trusted) kernel stats (stored in route).
1192 NECP_CLIENT_ROUTE_LOCK(flow_registration->client);
1193 struct rtentry *route = flow_registration->client->current_route;
1194 if (route != NULL) {
1195 nstat_route_update(route, d_connectattempts, d_connectsuccesses, d_rxpackets, d_rxbytes, d_rxduplicatebytes,
1196 d_rxoutoforderbytes, d_txpackets, d_txbytes, d_txretransmit, rtt, rtt_var);
1197 }
1198 NECP_CLIENT_ROUTE_UNLOCK(flow_registration->client);
1199 }
1200
1201 // This is called from various places; "closing" here implies the client being closed/removed if true, otherwise being
1202 // defunct. In the former, we expect the caller to not hold the lock; for the latter it must have acquired it.
1203 static void
necp_destroy_flow_stats(struct necp_fd_data * fd_data,struct necp_client_flow_registration * flow_registration,struct ifnet_stats_per_flow * flow_ifnet_stats,boolean_t closing)1204 necp_destroy_flow_stats(struct necp_fd_data *fd_data,
1205 struct necp_client_flow_registration *flow_registration,
1206 struct ifnet_stats_per_flow *flow_ifnet_stats,
1207 boolean_t closing)
1208 {
1209 NECP_FD_ASSERT_LOCKED(fd_data);
1210
1211 struct necp_client *client = flow_registration->client;
1212
1213 if (closing) {
1214 NECP_CLIENT_ASSERT_UNLOCKED(client);
1215 NECP_CLIENT_LOCK(client);
1216 } else {
1217 NECP_CLIENT_ASSERT_LOCKED(client);
1218 }
1219
1220 // the interface stats are independent of the flow stats, hence we check here
1221 if (flow_ifnet_stats != NULL) {
1222 necp_client_collect_interface_stats(flow_registration, flow_ifnet_stats);
1223 }
1224
1225 if (flow_registration->kstats_kaddr != NULL) {
1226 NECP_STATS_LIST_LOCK_EXCLUSIVE();
1227 necp_client_collect_stats(flow_registration);
1228 const bool destroyed = necp_client_release_locked(client); // Drop the reference held by the stats list
1229 ASSERT(!destroyed);
1230 (void)destroyed;
1231 LIST_REMOVE(flow_registration, collect_stats_chain);
1232 NECP_STATS_LIST_UNLOCK();
1233 if (flow_registration->stats_handler_context != NULL) {
1234 ntstat_userland_stats_close(flow_registration->stats_handler_context);
1235 flow_registration->stats_handler_context = NULL;
1236 }
1237 necp_arena_stats_obj_free(fd_data, flow_registration->stats_arena, &flow_registration->kstats_kaddr, &flow_registration->ustats_uaddr);
1238 ASSERT(flow_registration->kstats_kaddr == NULL);
1239 ASSERT(flow_registration->ustats_uaddr == 0);
1240 }
1241
1242 if (flow_registration->nexus_stats != NULL) {
1243 flow_stats_release(flow_registration->nexus_stats);
1244 flow_registration->nexus_stats = NULL;
1245 }
1246
1247 if (closing) {
1248 NECP_CLIENT_UNLOCK(client);
1249 }
1250 }
1251
1252 static void
necp_schedule_collect_stats_clients(bool recur)1253 necp_schedule_collect_stats_clients(bool recur)
1254 {
1255 if (necp_client_collect_stats_tcall == NULL ||
1256 (!recur && thread_call_isactive(necp_client_collect_stats_tcall))) {
1257 return;
1258 }
1259
1260 uint64_t deadline = 0;
1261 uint64_t leeway = 0;
1262 clock_interval_to_deadline(necp_collect_stats_timeout_microseconds, NSEC_PER_USEC, &deadline);
1263 clock_interval_to_absolutetime_interval(necp_collect_stats_timeout_leeway_microseconds, NSEC_PER_USEC, &leeway);
1264
1265 thread_call_enter_delayed_with_leeway(necp_client_collect_stats_tcall, NULL,
1266 deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
1267 }
1268
1269 static void
necp_collect_stats_client_callout(__unused thread_call_param_t dummy,__unused thread_call_param_t arg)1270 necp_collect_stats_client_callout(__unused thread_call_param_t dummy,
1271 __unused thread_call_param_t arg)
1272 {
1273 struct necp_client_flow_registration *flow_registration;
1274
1275 net_update_uptime();
1276 NECP_STATS_LIST_LOCK_SHARED();
1277 if (LIST_EMPTY(&necp_collect_stats_flow_list)) {
1278 NECP_STATS_LIST_UNLOCK();
1279 return;
1280 }
1281 LIST_FOREACH(flow_registration, &necp_collect_stats_flow_list, collect_stats_chain) {
1282 // Collecting stats should be cheap (atomic increments)
1283 // Values like flow_registration->kstats_kaddr are guaranteed to be valid
1284 // as long as the flow_registration is in the stats list
1285 necp_client_collect_stats(flow_registration);
1286 }
1287 NECP_STATS_LIST_UNLOCK();
1288
1289 necp_schedule_collect_stats_clients(TRUE); // recurring collection
1290 }
1291
1292 #endif /* !SKYWALK */
1293
1294 static void
necp_defunct_flow_registration(struct necp_client * client,struct necp_client_flow_registration * flow_registration,struct _necp_flow_defunct_list * defunct_list)1295 necp_defunct_flow_registration(struct necp_client *client,
1296 struct necp_client_flow_registration *flow_registration,
1297 struct _necp_flow_defunct_list *defunct_list)
1298 {
1299 NECP_CLIENT_ASSERT_LOCKED(client);
1300
1301 if (!flow_registration->defunct) {
1302 bool needs_defunct = false;
1303 struct necp_client_flow *search_flow = NULL;
1304 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
1305 if (search_flow->nexus &&
1306 !uuid_is_null(search_flow->u.nexus_agent)) {
1307 // Save defunct values for the nexus
1308 if (defunct_list != NULL) {
1309 // Sleeping alloc won't fail; copy only what's necessary
1310 struct necp_flow_defunct *flow_defunct = kalloc_type(struct necp_flow_defunct,
1311 Z_WAITOK | Z_ZERO);
1312 uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent);
1313 uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
1314 client->client_id :
1315 flow_registration->registration_id));
1316 flow_defunct->proc_pid = client->proc_pid;
1317 flow_defunct->agent_handle = client->agent_handle;
1318 flow_defunct->flags = flow_registration->flags;
1319 #if SKYWALK
1320 if (flow_registration->kstats_kaddr != NULL) {
1321 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
1322 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
1323 if (quicstats != NULL) {
1324 memcpy(flow_defunct->close_parameters.u.close_token, quicstats->necp_quic_extra.ssr_token, sizeof(flow_defunct->close_parameters.u.close_token));
1325 flow_defunct->has_close_parameters = true;
1326 }
1327 }
1328 #endif /* SKYWALK */
1329 // Add to the list provided by caller
1330 LIST_INSERT_HEAD(defunct_list, flow_defunct, chain);
1331 }
1332
1333 needs_defunct = true;
1334 }
1335 }
1336
1337 if (needs_defunct) {
1338 #if SKYWALK
1339 // Close the stats early
1340 if (flow_registration->stats_handler_context != NULL) {
1341 ntstat_userland_stats_event(flow_registration->stats_handler_context,
1342 NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT);
1343 }
1344 #endif /* SKYWALK */
1345
1346 // Only set defunct if there was some assigned flow
1347 flow_registration->defunct = true;
1348 }
1349 }
1350 }
1351
1352 static void
necp_defunct_client_for_policy(struct necp_client * client,struct _necp_flow_defunct_list * defunct_list)1353 necp_defunct_client_for_policy(struct necp_client *client,
1354 struct _necp_flow_defunct_list *defunct_list)
1355 {
1356 NECP_CLIENT_ASSERT_LOCKED(client);
1357
1358 struct necp_client_flow_registration *flow_registration = NULL;
1359 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
1360 necp_defunct_flow_registration(client, flow_registration, defunct_list);
1361 }
1362 }
1363
1364 static void
necp_client_free(struct necp_client * client)1365 necp_client_free(struct necp_client *client)
1366 {
1367 NECP_CLIENT_ASSERT_UNLOCKED(client);
1368
1369 kfree_data(client->extra_interface_options,
1370 sizeof(struct necp_client_interface_option) * NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT);
1371 client->extra_interface_options = NULL;
1372
1373 kfree_data(client->parameters, client->parameters_length);
1374 client->parameters = NULL;
1375
1376 kfree_data(client->assigned_group_members, client->assigned_group_members_length);
1377 client->assigned_group_members = NULL;
1378
1379 lck_mtx_destroy(&client->route_lock, &necp_fd_mtx_grp);
1380 lck_mtx_destroy(&client->lock, &necp_fd_mtx_grp);
1381
1382 kfree_type(struct necp_client, client);
1383 }
1384
1385 static void
necp_client_retain_locked(struct necp_client * client)1386 necp_client_retain_locked(struct necp_client *client)
1387 {
1388 NECP_CLIENT_ASSERT_LOCKED(client);
1389
1390 os_ref_retain_locked(&client->reference_count);
1391 }
1392
1393 static void
necp_client_retain(struct necp_client * client)1394 necp_client_retain(struct necp_client *client)
1395 {
1396 NECP_CLIENT_LOCK(client);
1397 necp_client_retain_locked(client);
1398 NECP_CLIENT_UNLOCK(client);
1399 }
1400
1401 static bool
necp_client_release_locked(struct necp_client * client)1402 necp_client_release_locked(struct necp_client *client)
1403 {
1404 NECP_CLIENT_ASSERT_LOCKED(client);
1405
1406 os_ref_count_t count = os_ref_release_locked(&client->reference_count);
1407 if (count == 0) {
1408 NECP_CLIENT_UNLOCK(client);
1409 necp_client_free(client);
1410 }
1411
1412 return count == 0;
1413 }
1414
1415 static bool
necp_client_release(struct necp_client * client)1416 necp_client_release(struct necp_client *client)
1417 {
1418 bool last_ref;
1419
1420 NECP_CLIENT_LOCK(client);
1421 if (!(last_ref = necp_client_release_locked(client))) {
1422 NECP_CLIENT_UNLOCK(client);
1423 }
1424
1425 return last_ref;
1426 }
1427
1428 static struct necp_client_update *
necp_client_update_alloc(const void * data,size_t length)1429 necp_client_update_alloc(const void *data, size_t length)
1430 {
1431 struct necp_client_update *client_update;
1432 struct necp_client_observer_update *buffer;
1433 size_t alloc_size;
1434
1435 if (os_add_overflow(length, sizeof(*buffer), &alloc_size)) {
1436 return NULL;
1437 }
1438 buffer = kalloc_data(alloc_size, Z_WAITOK);
1439 if (buffer == NULL) {
1440 return NULL;
1441 }
1442
1443 client_update = kalloc_type(struct necp_client_update,
1444 Z_WAITOK | Z_ZERO | Z_NOFAIL);
1445 client_update->update_length = alloc_size;
1446 client_update->update = buffer;
1447 memcpy(buffer->tlv_buffer, data, length);
1448 return client_update;
1449 }
1450
1451 static void
necp_client_update_free(struct necp_client_update * client_update)1452 necp_client_update_free(struct necp_client_update *client_update)
1453 {
1454 kfree_data(client_update->update, client_update->update_length);
1455 kfree_type(struct necp_client_update, client_update);
1456 }
1457
1458 static void
necp_client_update_observer_add_internal(struct necp_fd_data * observer_fd,struct necp_client * client)1459 necp_client_update_observer_add_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1460 {
1461 struct necp_client_update *client_update;
1462
1463 NECP_FD_LOCK(observer_fd);
1464
1465 if (observer_fd->update_count >= necp_observer_message_limit) {
1466 NECP_FD_UNLOCK(observer_fd);
1467 return;
1468 }
1469
1470 client_update = necp_client_update_alloc(client->parameters, client->parameters_length);
1471 if (client_update != NULL) {
1472 uuid_copy(client_update->client_id, client->client_id);
1473 client_update->update->update_type = NECP_CLIENT_UPDATE_TYPE_PARAMETERS;
1474 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1475 observer_fd->update_count++;
1476
1477 necp_fd_notify(observer_fd, true);
1478 }
1479
1480 NECP_FD_UNLOCK(observer_fd);
1481 }
1482
1483 static void
necp_client_update_observer_update_internal(struct necp_fd_data * observer_fd,struct necp_client * client)1484 necp_client_update_observer_update_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1485 {
1486 NECP_FD_LOCK(observer_fd);
1487
1488 if (observer_fd->update_count >= necp_observer_message_limit) {
1489 NECP_FD_UNLOCK(observer_fd);
1490 return;
1491 }
1492
1493 struct necp_client_update *client_update = necp_client_update_alloc(client->result, client->result_length);
1494 if (client_update != NULL) {
1495 uuid_copy(client_update->client_id, client->client_id);
1496 client_update->update->update_type = NECP_CLIENT_UPDATE_TYPE_RESULT;
1497 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1498 observer_fd->update_count++;
1499
1500 necp_fd_notify(observer_fd, true);
1501 }
1502
1503 NECP_FD_UNLOCK(observer_fd);
1504 }
1505
1506 static void
necp_client_update_observer_remove_internal(struct necp_fd_data * observer_fd,struct necp_client * client)1507 necp_client_update_observer_remove_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1508 {
1509 NECP_FD_LOCK(observer_fd);
1510
1511 if (observer_fd->update_count >= necp_observer_message_limit) {
1512 NECP_FD_UNLOCK(observer_fd);
1513 return;
1514 }
1515
1516 struct necp_client_update *client_update = necp_client_update_alloc(NULL, 0);
1517 if (client_update != NULL) {
1518 uuid_copy(client_update->client_id, client->client_id);
1519 client_update->update->update_type = NECP_CLIENT_UPDATE_TYPE_REMOVE;
1520 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1521 observer_fd->update_count++;
1522
1523 necp_fd_notify(observer_fd, true);
1524 }
1525
1526 NECP_FD_UNLOCK(observer_fd);
1527 }
1528
1529 static void
necp_client_update_observer_add(struct necp_client * client)1530 necp_client_update_observer_add(struct necp_client *client)
1531 {
1532 NECP_OBSERVER_LIST_LOCK_SHARED();
1533
1534 if (LIST_EMPTY(&necp_fd_observer_list)) {
1535 // No observers, bail
1536 NECP_OBSERVER_LIST_UNLOCK();
1537 return;
1538 }
1539
1540 struct necp_fd_data *observer_fd = NULL;
1541 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1542 necp_client_update_observer_add_internal(observer_fd, client);
1543 }
1544
1545 NECP_OBSERVER_LIST_UNLOCK();
1546 }
1547
1548 static void
necp_client_update_observer_update(struct necp_client * client)1549 necp_client_update_observer_update(struct necp_client *client)
1550 {
1551 NECP_OBSERVER_LIST_LOCK_SHARED();
1552
1553 if (LIST_EMPTY(&necp_fd_observer_list)) {
1554 // No observers, bail
1555 NECP_OBSERVER_LIST_UNLOCK();
1556 return;
1557 }
1558
1559 struct necp_fd_data *observer_fd = NULL;
1560 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1561 necp_client_update_observer_update_internal(observer_fd, client);
1562 }
1563
1564 NECP_OBSERVER_LIST_UNLOCK();
1565 }
1566
1567 static void
necp_client_update_observer_remove(struct necp_client * client)1568 necp_client_update_observer_remove(struct necp_client *client)
1569 {
1570 NECP_OBSERVER_LIST_LOCK_SHARED();
1571
1572 if (LIST_EMPTY(&necp_fd_observer_list)) {
1573 // No observers, bail
1574 NECP_OBSERVER_LIST_UNLOCK();
1575 return;
1576 }
1577
1578 struct necp_fd_data *observer_fd = NULL;
1579 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1580 necp_client_update_observer_remove_internal(observer_fd, client);
1581 }
1582
1583 NECP_OBSERVER_LIST_UNLOCK();
1584 }
1585
1586 static void
necp_destroy_client_flow_registration(struct necp_client * client,struct necp_client_flow_registration * flow_registration,pid_t pid,bool abort)1587 necp_destroy_client_flow_registration(struct necp_client *client,
1588 struct necp_client_flow_registration *flow_registration,
1589 pid_t pid, bool abort)
1590 {
1591 NECP_CLIENT_ASSERT_LOCKED(client);
1592
1593 bool has_close_parameters = false;
1594 struct necp_client_agent_parameters close_parameters = {};
1595 memset(close_parameters.u.close_token, 0, sizeof(close_parameters.u.close_token));
1596 #if SKYWALK
1597 if (flow_registration->kstats_kaddr != NULL) {
1598 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
1599 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
1600 if (quicstats != NULL &&
1601 quicstats->necp_quic_udp_stats.necp_udp_hdr.necp_stats_type == NECP_CLIENT_STATISTICS_TYPE_QUIC) {
1602 memcpy(close_parameters.u.close_token, quicstats->necp_quic_extra.ssr_token, sizeof(close_parameters.u.close_token));
1603 has_close_parameters = true;
1604 }
1605 }
1606
1607 // Release reference held on the stats arena
1608 if (flow_registration->stats_arena != NULL) {
1609 necp_arena_info_release(flow_registration->stats_arena);
1610 flow_registration->stats_arena = NULL;
1611 }
1612 #endif /* SKYWALK */
1613
1614 struct necp_client_flow *search_flow = NULL;
1615 struct necp_client_flow *temp_flow = NULL;
1616 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
1617 if (search_flow->nexus &&
1618 !uuid_is_null(search_flow->u.nexus_agent)) {
1619 // Don't unregister for defunct flows
1620 if (!flow_registration->defunct) {
1621 u_int8_t message_type = (abort ? NETAGENT_MESSAGE_TYPE_ABORT_NEXUS :
1622 NETAGENT_MESSAGE_TYPE_CLOSE_NEXUS);
1623 if (((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
1624 (flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
1625 !(flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
1626 message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
1627 }
1628 int netagent_error = netagent_client_message_with_params(search_flow->u.nexus_agent,
1629 ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
1630 client->client_id :
1631 flow_registration->registration_id),
1632 pid, client->agent_handle,
1633 message_type,
1634 has_close_parameters ? &close_parameters : NULL,
1635 NULL, 0);
1636 if (netagent_error != 0 && netagent_error != ENOENT) {
1637 NECPLOG(LOG_ERR, "necp_client_remove close nexus error (%d) MESSAGE TYPE %u", netagent_error, message_type);
1638 }
1639 }
1640 uuid_clear(search_flow->u.nexus_agent);
1641 }
1642 if (search_flow->assigned_results != NULL) {
1643 kfree_data(search_flow->assigned_results, search_flow->assigned_results_length);
1644 search_flow->assigned_results = NULL;
1645 }
1646 LIST_REMOVE(search_flow, flow_chain);
1647 #if SKYWALK
1648 if (search_flow->nexus) {
1649 OSDecrementAtomic(&necp_nexus_flow_count);
1650 } else
1651 #endif /* SKYWALK */
1652 if (search_flow->socket) {
1653 OSDecrementAtomic(&necp_socket_flow_count);
1654 } else {
1655 OSDecrementAtomic(&necp_if_flow_count);
1656 }
1657 kfree_type(struct necp_client_flow, search_flow);
1658 }
1659
1660 RB_REMOVE(_necp_client_flow_tree, &client->flow_registrations, flow_registration);
1661 flow_registration->client = NULL;
1662
1663 kfree_type(struct necp_client_flow_registration, flow_registration);
1664 }
1665
1666 static void
necp_destroy_client(struct necp_client * client,pid_t pid,bool abort)1667 necp_destroy_client(struct necp_client *client, pid_t pid, bool abort)
1668 {
1669 NECP_CLIENT_ASSERT_UNLOCKED(client);
1670
1671 #if SKYWALK
1672 if (client->nstat_context != NULL) {
1673 // This is a catch-all that should be rarely used.
1674 nstat_provider_stats_close(client->nstat_context);
1675 client->nstat_context = NULL;
1676 }
1677 if (client->original_parameters_source != NULL) {
1678 necp_client_release(client->original_parameters_source);
1679 client->original_parameters_source = NULL;
1680 }
1681 #endif /* SKYWALK */
1682 necp_client_update_observer_remove(client);
1683
1684 NECP_CLIENT_LOCK(client);
1685
1686 // Free route
1687 NECP_CLIENT_ROUTE_LOCK(client);
1688 if (client->current_route != NULL) {
1689 rtfree(client->current_route);
1690 client->current_route = NULL;
1691 }
1692 NECP_CLIENT_ROUTE_UNLOCK(client);
1693
1694 // Remove flow assignments
1695 struct necp_client_flow_registration *flow_registration = NULL;
1696 struct necp_client_flow_registration *temp_flow_registration = NULL;
1697 RB_FOREACH_SAFE(flow_registration, _necp_client_flow_tree, &client->flow_registrations, temp_flow_registration) {
1698 necp_destroy_client_flow_registration(client, flow_registration, pid, abort);
1699 }
1700
1701 #if SKYWALK
1702 // Remove port reservation
1703 if (NETNS_TOKEN_VALID(&client->port_reservation)) {
1704 netns_release(&client->port_reservation);
1705 }
1706 #endif /* !SKYWALK */
1707
1708 // Remove agent assertions
1709 struct necp_client_assertion *search_assertion = NULL;
1710 struct necp_client_assertion *temp_assertion = NULL;
1711 LIST_FOREACH_SAFE(search_assertion, &client->assertion_list, assertion_chain, temp_assertion) {
1712 int netagent_error = netagent_client_message(search_assertion->asserted_netagent, client->client_id, pid,
1713 client->agent_handle, NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT);
1714 if (netagent_error != 0) {
1715 NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR),
1716 "necp_client_remove unassert agent error (%d)", netagent_error);
1717 }
1718 LIST_REMOVE(search_assertion, assertion_chain);
1719 kfree_type(struct necp_client_assertion, search_assertion);
1720 }
1721
1722 if (!necp_client_release_locked(client)) {
1723 NECP_CLIENT_UNLOCK(client);
1724 }
1725
1726 OSDecrementAtomic(&necp_client_count);
1727 }
1728
1729 static bool
1730 necp_defunct_client_fd_locked_inner(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, bool destroy_stats);
1731
1732 static void
necp_process_defunct_list(struct _necp_flow_defunct_list * defunct_list)1733 necp_process_defunct_list(struct _necp_flow_defunct_list *defunct_list)
1734 {
1735 if (!LIST_EMPTY(defunct_list)) {
1736 struct necp_flow_defunct *flow_defunct = NULL;
1737 struct necp_flow_defunct *temp_flow_defunct = NULL;
1738
1739 // For each newly defunct client, send a message to the nexus to remove the flow
1740 LIST_FOREACH_SAFE(flow_defunct, defunct_list, chain, temp_flow_defunct) {
1741 if (!uuid_is_null(flow_defunct->nexus_agent)) {
1742 u_int8_t message_type = NETAGENT_MESSAGE_TYPE_ABORT_NEXUS;
1743 if (((flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
1744 (flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
1745 !(flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
1746 message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
1747 }
1748 int netagent_error = netagent_client_message_with_params(flow_defunct->nexus_agent,
1749 flow_defunct->flow_id,
1750 flow_defunct->proc_pid,
1751 flow_defunct->agent_handle,
1752 message_type,
1753 flow_defunct->has_close_parameters ? &flow_defunct->close_parameters : NULL,
1754 NULL, 0);
1755 if (netagent_error != 0) {
1756 char namebuf[MAXCOMLEN + 1];
1757 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
1758 proc_name(flow_defunct->proc_pid, namebuf, sizeof(namebuf));
1759 NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR), "necp_update_client abort nexus error (%d) for pid %d %s", netagent_error, flow_defunct->proc_pid, namebuf);
1760 }
1761 }
1762 LIST_REMOVE(flow_defunct, chain);
1763 kfree_type(struct necp_flow_defunct, flow_defunct);
1764 }
1765 }
1766 ASSERT(LIST_EMPTY(defunct_list));
1767 }
1768
1769 static int
necpop_close(struct fileglob * fg,vfs_context_t ctx)1770 necpop_close(struct fileglob *fg, vfs_context_t ctx)
1771 {
1772 #pragma unused(ctx)
1773 struct necp_fd_data *fd_data = NULL;
1774 int error = 0;
1775
1776 fd_data = (struct necp_fd_data *)fg_get_data(fg);
1777 fg_set_data(fg, NULL);
1778
1779 if (fd_data != NULL) {
1780 struct _necp_client_tree clients_to_close;
1781 RB_INIT(&clients_to_close);
1782
1783 // Remove from list quickly
1784 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
1785 NECP_OBSERVER_LIST_LOCK_EXCLUSIVE();
1786 LIST_REMOVE(fd_data, chain);
1787 NECP_OBSERVER_LIST_UNLOCK();
1788 } else {
1789 NECP_FD_LIST_LOCK_EXCLUSIVE();
1790 LIST_REMOVE(fd_data, chain);
1791 NECP_FD_LIST_UNLOCK();
1792 }
1793
1794 NECP_FD_LOCK(fd_data);
1795 pid_t pid = fd_data->proc_pid;
1796
1797 struct _necp_flow_defunct_list defunct_list;
1798 LIST_INIT(&defunct_list);
1799
1800 (void)necp_defunct_client_fd_locked_inner(fd_data, &defunct_list, false);
1801
1802 struct necp_client_flow_registration *flow_registration = NULL;
1803 struct necp_client_flow_registration *temp_flow_registration = NULL;
1804 RB_FOREACH_SAFE(flow_registration, _necp_fd_flow_tree, &fd_data->flows, temp_flow_registration) {
1805 #if SKYWALK
1806 necp_destroy_flow_stats(fd_data, flow_registration, NULL, TRUE);
1807 #endif /* SKYWALK */
1808 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
1809 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
1810 NECP_FLOW_TREE_UNLOCK();
1811 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
1812 }
1813
1814 struct necp_client *client = NULL;
1815 struct necp_client *temp_client = NULL;
1816 RB_FOREACH_SAFE(client, _necp_client_tree, &fd_data->clients, temp_client) {
1817 // Clear out the agent_handle to avoid dangling pointers back to fd_data
1818 NECP_CLIENT_LOCK(client);
1819 client->agent_handle = NULL;
1820 NECP_CLIENT_UNLOCK(client);
1821
1822 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
1823 RB_REMOVE(_necp_client_global_tree, &necp_client_global_tree, client);
1824 NECP_CLIENT_TREE_UNLOCK();
1825 RB_REMOVE(_necp_client_tree, &fd_data->clients, client);
1826 RB_INSERT(_necp_client_tree, &clients_to_close, client);
1827 }
1828
1829 struct necp_client_update *client_update = NULL;
1830 struct necp_client_update *temp_update = NULL;
1831 TAILQ_FOREACH_SAFE(client_update, &fd_data->update_list, chain, temp_update) {
1832 // Flush pending updates
1833 TAILQ_REMOVE(&fd_data->update_list, client_update, chain);
1834 necp_client_update_free(client_update);
1835 }
1836 fd_data->update_count = 0;
1837
1838 #if SKYWALK
1839 // Cleanup stats arena(s); indicate that we're closing
1840 necp_stats_arenas_destroy(fd_data, TRUE);
1841 ASSERT(fd_data->stats_arena_active == NULL);
1842 ASSERT(LIST_EMPTY(&fd_data->stats_arena_list));
1843
1844 // Cleanup systctl arena
1845 necp_sysctl_arena_destroy(fd_data);
1846 ASSERT(fd_data->sysctl_arena == NULL);
1847 #endif /* SKYWALK */
1848
1849 NECP_FD_UNLOCK(fd_data);
1850
1851 selthreadclear(&fd_data->si);
1852
1853 lck_mtx_destroy(&fd_data->fd_lock, &necp_fd_mtx_grp);
1854
1855 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
1856 OSDecrementAtomic(&necp_observer_fd_count);
1857 } else {
1858 OSDecrementAtomic(&necp_client_fd_count);
1859 }
1860
1861 kfree_type(struct necp_fd_data, fd_data);
1862
1863 RB_FOREACH_SAFE(client, _necp_client_tree, &clients_to_close, temp_client) {
1864 RB_REMOVE(_necp_client_tree, &clients_to_close, client);
1865 necp_destroy_client(client, pid, true);
1866 }
1867
1868 necp_process_defunct_list(&defunct_list);
1869 }
1870
1871 return error;
1872 }
1873
1874 /// NECP client utilities
1875
1876 static inline bool
necp_address_is_wildcard(const union necp_sockaddr_union * const addr)1877 necp_address_is_wildcard(const union necp_sockaddr_union * const addr)
1878 {
1879 return (addr->sa.sa_family == AF_INET && addr->sin.sin_addr.s_addr == INADDR_ANY) ||
1880 (addr->sa.sa_family == AF_INET6 && IN6_IS_ADDR_UNSPECIFIED(&addr->sin6.sin6_addr));
1881 }
1882
1883 static int
necp_find_fd_data(struct proc * p,int fd,struct fileproc ** fpp,struct necp_fd_data ** fd_data)1884 necp_find_fd_data(struct proc *p, int fd,
1885 struct fileproc **fpp, struct necp_fd_data **fd_data)
1886 {
1887 struct fileproc *fp;
1888 int error = fp_get_ftype(p, fd, DTYPE_NETPOLICY, ENODEV, &fp);
1889
1890 if (error == 0) {
1891 *fd_data = (struct necp_fd_data *)fp_get_data(fp);
1892 *fpp = fp;
1893
1894 if ((*fd_data)->necp_fd_type != necp_fd_type_client) {
1895 // Not a client fd, ignore
1896 fp_drop(p, fd, fp, 0);
1897 error = EINVAL;
1898 }
1899 }
1900 return error;
1901 }
1902
1903 static void
necp_client_add_nexus_flow(struct necp_client_flow_registration * flow_registration,uuid_t nexus_agent,uint32_t interface_index,uint16_t interface_flags)1904 necp_client_add_nexus_flow(struct necp_client_flow_registration *flow_registration,
1905 uuid_t nexus_agent,
1906 uint32_t interface_index,
1907 uint16_t interface_flags)
1908 {
1909 struct necp_client_flow *new_flow = kalloc_type(struct necp_client_flow, Z_WAITOK | Z_ZERO | Z_NOFAIL);
1910
1911 new_flow->nexus = TRUE;
1912 uuid_copy(new_flow->u.nexus_agent, nexus_agent);
1913 new_flow->interface_index = interface_index;
1914 new_flow->interface_flags = interface_flags;
1915 new_flow->check_tcp_heuristics = TRUE;
1916
1917 #if SKYWALK
1918 OSIncrementAtomic(&necp_nexus_flow_count);
1919 #endif /* SKYWALK */
1920
1921 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
1922
1923 #if SKYWALK
1924 necp_flow_save_current_interface_details(flow_registration);
1925 #endif /* SKYWALK */
1926 }
1927
1928 static void
necp_client_add_nexus_flow_if_needed(struct necp_client_flow_registration * flow_registration,uuid_t nexus_agent,uint32_t interface_index)1929 necp_client_add_nexus_flow_if_needed(struct necp_client_flow_registration *flow_registration,
1930 uuid_t nexus_agent,
1931 uint32_t interface_index)
1932 {
1933 struct necp_client_flow *flow = NULL;
1934 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1935 if (flow->nexus &&
1936 uuid_compare(flow->u.nexus_agent, nexus_agent) == 0) {
1937 return;
1938 }
1939 }
1940
1941 uint16_t interface_flags = 0;
1942 ifnet_t ifp = NULL;
1943 ifnet_head_lock_shared();
1944 if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
1945 ifp = ifindex2ifnet[interface_index];
1946 if (ifp != NULL) {
1947 ifnet_lock_shared(ifp);
1948 interface_flags = nstat_ifnet_to_flags(ifp);
1949 ifnet_lock_done(ifp);
1950 }
1951 }
1952 ifnet_head_done();
1953 necp_client_add_nexus_flow(flow_registration, nexus_agent, interface_index, interface_flags);
1954 }
1955
1956 static struct necp_client_flow *
necp_client_add_interface_flow(struct necp_client_flow_registration * flow_registration,uint32_t interface_index)1957 necp_client_add_interface_flow(struct necp_client_flow_registration *flow_registration,
1958 uint32_t interface_index)
1959 {
1960 struct necp_client_flow *new_flow = kalloc_type(struct necp_client_flow, Z_WAITOK | Z_ZERO | Z_NOFAIL);
1961
1962 // Neither nexus nor socket
1963 new_flow->interface_index = interface_index;
1964 new_flow->u.socket_handle = flow_registration->interface_handle;
1965 new_flow->u.cb = flow_registration->interface_cb;
1966
1967 OSIncrementAtomic(&necp_if_flow_count);
1968
1969 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
1970
1971 return new_flow;
1972 }
1973
1974 static struct necp_client_flow *
necp_client_add_interface_flow_if_needed(struct necp_client * client,struct necp_client_flow_registration * flow_registration,uint32_t interface_index)1975 necp_client_add_interface_flow_if_needed(struct necp_client *client,
1976 struct necp_client_flow_registration *flow_registration,
1977 uint32_t interface_index)
1978 {
1979 if (!client->allow_multiple_flows ||
1980 interface_index == IFSCOPE_NONE) {
1981 // Interface not set, or client not allowed to use this mode
1982 return NULL;
1983 }
1984
1985 struct necp_client_flow *flow = NULL;
1986 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1987 if (!flow->nexus && !flow->socket && flow->interface_index == interface_index) {
1988 // Already have the flow
1989 flow->invalid = FALSE;
1990 flow->u.socket_handle = flow_registration->interface_handle;
1991 flow->u.cb = flow_registration->interface_cb;
1992 return NULL;
1993 }
1994 }
1995 return necp_client_add_interface_flow(flow_registration, interface_index);
1996 }
1997
1998 static void
necp_client_add_interface_option_if_needed(struct necp_client * client,uint32_t interface_index,uint32_t interface_generation,uuid_t * nexus_agent,bool network_provider)1999 necp_client_add_interface_option_if_needed(struct necp_client *client,
2000 uint32_t interface_index,
2001 uint32_t interface_generation,
2002 uuid_t *nexus_agent,
2003 bool network_provider)
2004 {
2005 if ((interface_index == IFSCOPE_NONE && !network_provider) ||
2006 (client->interface_option_count != 0 && !client->allow_multiple_flows)) {
2007 // Interface not set, or client not allowed to use this mode
2008 return;
2009 }
2010
2011 if (client->interface_option_count >= NECP_CLIENT_MAX_INTERFACE_OPTIONS) {
2012 // Cannot take any more interface options
2013 return;
2014 }
2015
2016 // Check if already present
2017 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
2018 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
2019 struct necp_client_interface_option *option = &client->interface_options[option_i];
2020 if (option->interface_index == interface_index) {
2021 if (nexus_agent == NULL) {
2022 return;
2023 }
2024 if (uuid_compare(option->nexus_agent, *nexus_agent) == 0) {
2025 return;
2026 }
2027 if (uuid_is_null(option->nexus_agent)) {
2028 uuid_copy(option->nexus_agent, *nexus_agent);
2029 return;
2030 }
2031 // If we get to this point, this is a new nexus flow
2032 }
2033 } else {
2034 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
2035 if (option->interface_index == interface_index) {
2036 if (nexus_agent == NULL) {
2037 return;
2038 }
2039 if (uuid_compare(option->nexus_agent, *nexus_agent) == 0) {
2040 return;
2041 }
2042 if (uuid_is_null(option->nexus_agent)) {
2043 uuid_copy(option->nexus_agent, *nexus_agent);
2044 return;
2045 }
2046 // If we get to this point, this is a new nexus flow
2047 }
2048 }
2049 }
2050
2051 // Add a new entry
2052 if (client->interface_option_count < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
2053 // Add to static
2054 struct necp_client_interface_option *option = &client->interface_options[client->interface_option_count];
2055 option->interface_index = interface_index;
2056 option->interface_generation = interface_generation;
2057 if (nexus_agent != NULL) {
2058 uuid_copy(option->nexus_agent, *nexus_agent);
2059 } else {
2060 uuid_clear(option->nexus_agent);
2061 }
2062 client->interface_option_count++;
2063 } else {
2064 // Add to extra
2065 if (client->extra_interface_options == NULL) {
2066 client->extra_interface_options = (struct necp_client_interface_option *)kalloc_data(
2067 sizeof(struct necp_client_interface_option) * NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT, Z_WAITOK | Z_ZERO);
2068 }
2069 if (client->extra_interface_options != NULL) {
2070 struct necp_client_interface_option *option = &client->extra_interface_options[client->interface_option_count - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
2071 option->interface_index = interface_index;
2072 option->interface_generation = interface_generation;
2073 if (nexus_agent != NULL) {
2074 uuid_copy(option->nexus_agent, *nexus_agent);
2075 } else {
2076 uuid_clear(option->nexus_agent);
2077 }
2078 client->interface_option_count++;
2079 }
2080 }
2081 }
2082
2083 static bool
necp_client_flow_is_viable(proc_t proc,struct necp_client * client,struct necp_client_flow * flow)2084 necp_client_flow_is_viable(proc_t proc, struct necp_client *client,
2085 struct necp_client_flow *flow)
2086 {
2087 struct necp_aggregate_result result;
2088 bool ignore_address = (client->allow_multiple_flows && !flow->nexus && !flow->socket);
2089
2090 flow->necp_flow_flags = 0;
2091 int error = necp_application_find_policy_match_internal(proc, client->parameters,
2092 (u_int32_t)client->parameters_length,
2093 &result, &flow->necp_flow_flags, NULL,
2094 flow->interface_index,
2095 &flow->local_addr, &flow->remote_addr, NULL, NULL,
2096 NULL, ignore_address, true, NULL);
2097
2098 // Check for blocking agents
2099 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
2100 if (uuid_is_null(result.netagents[i])) {
2101 // Passed end of valid agents
2102 break;
2103 }
2104 if (result.netagent_use_flags[i] & NECP_AGENT_USE_FLAG_REMOVE) {
2105 // A removed agent, ignore
2106 continue;
2107 }
2108 u_int32_t flags = netagent_get_flags(result.netagents[i]);
2109 if ((flags & NETAGENT_FLAG_REGISTERED) &&
2110 !(flags & NETAGENT_FLAG_VOLUNTARY) &&
2111 !(flags & NETAGENT_FLAG_ACTIVE) &&
2112 !(flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY)) {
2113 // A required agent is not active, cause the flow to be marked non-viable
2114 return false;
2115 }
2116 }
2117
2118 if (flow->interface_index != IFSCOPE_NONE) {
2119 ifnet_head_lock_shared();
2120
2121 struct ifnet *ifp = ifindex2ifnet[flow->interface_index];
2122 if (ifp && ifp->if_delegated.ifp != IFSCOPE_NONE) {
2123 flow->delegated_interface_index = ifp->if_delegated.ifp->if_index;
2124 }
2125
2126 ifnet_head_done();
2127 }
2128
2129 return error == 0 &&
2130 result.routed_interface_index != IFSCOPE_NONE &&
2131 result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP;
2132 }
2133
2134 static void
necp_flow_add_interface_flows(proc_t proc,struct necp_client * client,struct necp_client_flow_registration * flow_registration,bool send_initial)2135 necp_flow_add_interface_flows(proc_t proc,
2136 struct necp_client *client,
2137 struct necp_client_flow_registration *flow_registration,
2138 bool send_initial)
2139 {
2140 // Traverse all interfaces and add a tracking flow if needed
2141 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
2142 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
2143 struct necp_client_interface_option *option = &client->interface_options[option_i];
2144 struct necp_client_flow *flow = necp_client_add_interface_flow_if_needed(client, flow_registration, option->interface_index);
2145 if (flow != NULL && send_initial) {
2146 flow->viable = necp_client_flow_is_viable(proc, client, flow);
2147 if (flow->viable && flow->u.cb) {
2148 bool viable = flow->viable;
2149 flow->u.cb(flow_registration->interface_handle, NECP_CLIENT_CBACTION_INITIAL, flow->interface_index, flow->necp_flow_flags, &viable);
2150 flow->viable = viable;
2151 }
2152 }
2153 } else {
2154 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
2155 struct necp_client_flow *flow = necp_client_add_interface_flow_if_needed(client, flow_registration, option->interface_index);
2156 if (flow != NULL && send_initial) {
2157 flow->viable = necp_client_flow_is_viable(proc, client, flow);
2158 if (flow->viable && flow->u.cb) {
2159 bool viable = flow->viable;
2160 flow->u.cb(flow_registration->interface_handle, NECP_CLIENT_CBACTION_INITIAL, flow->interface_index, flow->necp_flow_flags, &viable);
2161 flow->viable = viable;
2162 }
2163 }
2164 }
2165 }
2166 }
2167
2168 static bool
necp_client_update_flows(proc_t proc,struct necp_client * client,struct _necp_flow_defunct_list * defunct_list)2169 necp_client_update_flows(proc_t proc,
2170 struct necp_client *client,
2171 struct _necp_flow_defunct_list *defunct_list)
2172 {
2173 NECP_CLIENT_ASSERT_LOCKED(client);
2174
2175 bool any_client_updated = FALSE;
2176 struct necp_client_flow *flow = NULL;
2177 struct necp_client_flow *temp_flow = NULL;
2178 struct necp_client_flow_registration *flow_registration = NULL;
2179 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
2180 if (flow_registration->interface_cb != NULL) {
2181 // Add any interface flows that are not already tracked
2182 necp_flow_add_interface_flows(proc, client, flow_registration, false);
2183 }
2184
2185 LIST_FOREACH_SAFE(flow, &flow_registration->flow_list, flow_chain, temp_flow) {
2186 bool client_updated = FALSE;
2187
2188 // Check policy result for flow
2189 u_short old_delegated_ifindex = flow->delegated_interface_index;
2190
2191 int old_flags = flow->necp_flow_flags;
2192 bool viable = necp_client_flow_is_viable(proc, client, flow);
2193
2194 // TODO: Defunct nexus flows that are blocked by policy
2195
2196 if (flow->viable != viable) {
2197 flow->viable = viable;
2198 client_updated = TRUE;
2199 }
2200
2201 if ((old_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE) !=
2202 (flow->necp_flow_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE)) {
2203 client_updated = TRUE;
2204 }
2205
2206 if (flow->delegated_interface_index != old_delegated_ifindex) {
2207 client_updated = TRUE;
2208 }
2209
2210 if (flow->viable && client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) {
2211 bool flow_viable = flow->viable;
2212 flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_VIABLE, flow->interface_index, flow->necp_flow_flags, &flow_viable);
2213 flow->viable = flow_viable;
2214 }
2215
2216 if (!flow->viable || flow->invalid) {
2217 if (client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) {
2218 bool flow_viable = flow->viable;
2219 flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_NONVIABLE, flow->interface_index, flow->necp_flow_flags, &flow_viable);
2220 flow->viable = flow_viable;
2221 }
2222 // The callback might change the viable-flag of the
2223 // flow depending on its policy. Thus, we need to
2224 // check the flags again after the callback.
2225 }
2226
2227 #if SKYWALK
2228 if (defunct_list != NULL) {
2229 if (flow->invalid && flow->nexus && flow->assigned && !uuid_is_null(flow->u.nexus_agent)) {
2230 // This is a nexus flow that was assigned, but not found on path
2231 u_int32_t flags = netagent_get_flags(flow->u.nexus_agent);
2232 if (!(flags & NETAGENT_FLAG_REGISTERED)) {
2233 // The agent is no longer registered! Mark defunct.
2234 necp_defunct_flow_registration(client, flow_registration, defunct_list);
2235 client_updated = TRUE;
2236 }
2237 }
2238 }
2239 #else /* !SKYWALK */
2240 (void)defunct_list;
2241 #endif /* !SKYWALK */
2242
2243 // Handle flows that no longer match
2244 if (!flow->viable || flow->invalid) {
2245 // Drop them as long as they aren't assigned data
2246 if (!flow->nexus && !flow->assigned) {
2247 if (flow->assigned_results != NULL) {
2248 kfree_data(flow->assigned_results, flow->assigned_results_length);
2249 flow->assigned_results = NULL;
2250 client_updated = TRUE;
2251 }
2252 LIST_REMOVE(flow, flow_chain);
2253 #if SKYWALK
2254 if (flow->nexus) {
2255 OSDecrementAtomic(&necp_nexus_flow_count);
2256 } else
2257 #endif /* SKYWALK */
2258 if (flow->socket) {
2259 OSDecrementAtomic(&necp_socket_flow_count);
2260 } else {
2261 OSDecrementAtomic(&necp_if_flow_count);
2262 }
2263 kfree_type(struct necp_client_flow, flow);
2264 }
2265 }
2266
2267 any_client_updated |= client_updated;
2268 }
2269 #if SKYWALK
2270 necp_flow_save_current_interface_details(flow_registration);
2271 #endif /* SKYWALK */
2272 }
2273
2274 return any_client_updated;
2275 }
2276
2277 static void
necp_client_mark_all_nonsocket_flows_as_invalid(struct necp_client * client)2278 necp_client_mark_all_nonsocket_flows_as_invalid(struct necp_client *client)
2279 {
2280 struct necp_client_flow_registration *flow_registration = NULL;
2281 struct necp_client_flow *flow = NULL;
2282 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
2283 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
2284 if (!flow->socket) { // Socket flows are not marked as invalid
2285 flow->invalid = TRUE;
2286 }
2287 }
2288 }
2289
2290 // Reset option count every update
2291 client->interface_option_count = 0;
2292 }
2293
2294 static inline bool
necp_netagent_is_requested(const struct necp_client_parsed_parameters * parameters,uuid_t * netagent_uuid)2295 necp_netagent_is_requested(const struct necp_client_parsed_parameters *parameters,
2296 uuid_t *netagent_uuid)
2297 {
2298 // Specific use agents only apply when requested
2299 bool requested = false;
2300 if (parameters != NULL) {
2301 // Check required agent UUIDs
2302 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2303 if (uuid_is_null(parameters->required_netagents[i])) {
2304 break;
2305 }
2306 if (uuid_compare(parameters->required_netagents[i], *netagent_uuid) == 0) {
2307 requested = true;
2308 break;
2309 }
2310 }
2311
2312 if (!requested) {
2313 // Check required agent types
2314 bool fetched_type = false;
2315 char netagent_domain[NETAGENT_DOMAINSIZE];
2316 char netagent_type[NETAGENT_TYPESIZE];
2317 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
2318 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
2319
2320 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2321 if (strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
2322 strlen(parameters->required_netagent_types[i].netagent_type) == 0) {
2323 break;
2324 }
2325
2326 if (!fetched_type) {
2327 if (netagent_get_agent_domain_and_type(*netagent_uuid, netagent_domain, netagent_type)) {
2328 fetched_type = TRUE;
2329 } else {
2330 break;
2331 }
2332 }
2333
2334 if ((strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
2335 strncmp(netagent_domain, parameters->required_netagent_types[i].netagent_domain, NETAGENT_DOMAINSIZE) == 0) &&
2336 (strlen(parameters->required_netagent_types[i].netagent_type) == 0 ||
2337 strncmp(netagent_type, parameters->required_netagent_types[i].netagent_type, NETAGENT_TYPESIZE) == 0)) {
2338 requested = true;
2339 break;
2340 }
2341 }
2342 }
2343
2344 // Check preferred agent UUIDs
2345 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2346 if (uuid_is_null(parameters->preferred_netagents[i])) {
2347 break;
2348 }
2349 if (uuid_compare(parameters->preferred_netagents[i], *netagent_uuid) == 0) {
2350 requested = true;
2351 break;
2352 }
2353 }
2354
2355 if (!requested) {
2356 // Check preferred agent types
2357 bool fetched_type = false;
2358 char netagent_domain[NETAGENT_DOMAINSIZE];
2359 char netagent_type[NETAGENT_TYPESIZE];
2360 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
2361 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
2362
2363 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2364 if (strlen(parameters->preferred_netagent_types[i].netagent_domain) == 0 ||
2365 strlen(parameters->preferred_netagent_types[i].netagent_type) == 0) {
2366 break;
2367 }
2368
2369 if (!fetched_type) {
2370 if (netagent_get_agent_domain_and_type(*netagent_uuid, netagent_domain, netagent_type)) {
2371 fetched_type = TRUE;
2372 } else {
2373 break;
2374 }
2375 }
2376
2377 if ((strlen(parameters->preferred_netagent_types[i].netagent_domain) == 0 ||
2378 strncmp(netagent_domain, parameters->preferred_netagent_types[i].netagent_domain, NETAGENT_DOMAINSIZE) == 0) &&
2379 (strlen(parameters->preferred_netagent_types[i].netagent_type) == 0 ||
2380 strncmp(netagent_type, parameters->preferred_netagent_types[i].netagent_type, NETAGENT_TYPESIZE) == 0)) {
2381 requested = true;
2382 break;
2383 }
2384 }
2385 }
2386 }
2387
2388 return requested;
2389 }
2390
2391 static bool
necp_netagent_applies_to_client(struct necp_client * client,const struct necp_client_parsed_parameters * parameters,uuid_t * netagent_uuid,bool allow_nexus,uint32_t interface_index,uint32_t interface_generation)2392 necp_netagent_applies_to_client(struct necp_client *client,
2393 const struct necp_client_parsed_parameters *parameters,
2394 uuid_t *netagent_uuid, bool allow_nexus,
2395 uint32_t interface_index, uint32_t interface_generation)
2396 {
2397 #pragma unused(interface_index, interface_generation)
2398 bool applies = FALSE;
2399 u_int32_t flags = netagent_get_flags(*netagent_uuid);
2400 if (!(flags & NETAGENT_FLAG_REGISTERED)) {
2401 // Unregistered agents never apply
2402 return applies;
2403 }
2404
2405 const bool is_nexus_agent = ((flags & NETAGENT_FLAG_NEXUS_PROVIDER) ||
2406 (flags & NETAGENT_FLAG_NEXUS_LISTENER) ||
2407 (flags & NETAGENT_FLAG_CUSTOM_ETHER_NEXUS) ||
2408 (flags & NETAGENT_FLAG_CUSTOM_IP_NEXUS) ||
2409 (flags & NETAGENT_FLAG_INTERPOSE_NEXUS));
2410 if (is_nexus_agent) {
2411 if (!allow_nexus) {
2412 // Hide nexus providers unless allowed
2413 // Direct interfaces and direct policies are allowed to use a nexus
2414 // Delegate interfaces or re-scoped interfaces are not allowed
2415 return applies;
2416 }
2417
2418 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) &&
2419 !(flags & NETAGENT_FLAG_CUSTOM_ETHER_NEXUS)) {
2420 // Client requested a custom ether nexus, but this nexus isn't one
2421 return applies;
2422 }
2423
2424 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP) &&
2425 !(flags & NETAGENT_FLAG_CUSTOM_IP_NEXUS)) {
2426 // Client requested a custom IP nexus, but this nexus isn't one
2427 return applies;
2428 }
2429
2430 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) &&
2431 !(flags & NETAGENT_FLAG_INTERPOSE_NEXUS)) {
2432 // Client requested an interpose nexus, but this nexus isn't one
2433 return applies;
2434 }
2435
2436 if (!(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) &&
2437 !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP) &&
2438 !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) &&
2439 !(flags & NETAGENT_FLAG_NEXUS_PROVIDER)) {
2440 // Client requested default parameters, but this nexus isn't generic
2441 return applies;
2442 }
2443 }
2444
2445 if (uuid_compare(client->failed_trigger_agent.netagent_uuid, *netagent_uuid) == 0) {
2446 if (client->failed_trigger_agent.generation == netagent_get_generation(*netagent_uuid)) {
2447 // If this agent was triggered, and failed, and hasn't changed, keep hiding it
2448 return applies;
2449 } else {
2450 // Mismatch generation, clear out old trigger
2451 uuid_clear(client->failed_trigger_agent.netagent_uuid);
2452 client->failed_trigger_agent.generation = 0;
2453 }
2454 }
2455
2456 if (flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY) {
2457 // Specific use agents only apply when requested
2458 applies = necp_netagent_is_requested(parameters, netagent_uuid);
2459 } else {
2460 applies = TRUE;
2461 }
2462
2463 #if SKYWALK
2464 // Add nexus agent if it is a nexus, and either is not a listener, or the nexus supports listeners
2465 if (applies && is_nexus_agent &&
2466 !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) && // Don't add for browse paths
2467 ((flags & NETAGENT_FLAG_NEXUS_LISTENER) || !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER))) {
2468 necp_client_add_interface_option_if_needed(client, interface_index,
2469 interface_generation, netagent_uuid,
2470 (flags & NETAGENT_FLAG_NETWORK_PROVIDER));
2471 }
2472 #endif /* SKYWALK */
2473
2474 return applies;
2475 }
2476
2477 static void
necp_client_add_agent_interface_options(struct necp_client * client,const struct necp_client_parsed_parameters * parsed_parameters,ifnet_t ifp)2478 necp_client_add_agent_interface_options(struct necp_client *client,
2479 const struct necp_client_parsed_parameters *parsed_parameters,
2480 ifnet_t ifp)
2481 {
2482 if (ifp != NULL && ifp->if_agentids != NULL) {
2483 for (u_int32_t i = 0; i < ifp->if_agentcount; i++) {
2484 if (uuid_is_null(ifp->if_agentids[i])) {
2485 continue;
2486 }
2487 // Relies on the side effect that nexus agents that apply will create flows
2488 (void)necp_netagent_applies_to_client(client, parsed_parameters, &ifp->if_agentids[i], TRUE,
2489 ifp->if_index, ifnet_get_generation(ifp));
2490 }
2491 }
2492 }
2493
2494 static void
necp_client_add_browse_interface_options(struct necp_client * client,const struct necp_client_parsed_parameters * parsed_parameters,ifnet_t ifp)2495 necp_client_add_browse_interface_options(struct necp_client *client,
2496 const struct necp_client_parsed_parameters *parsed_parameters,
2497 ifnet_t ifp)
2498 {
2499 if (ifp != NULL && ifp->if_agentids != NULL) {
2500 for (u_int32_t i = 0; i < ifp->if_agentcount; i++) {
2501 if (uuid_is_null(ifp->if_agentids[i])) {
2502 continue;
2503 }
2504
2505 u_int32_t flags = netagent_get_flags(ifp->if_agentids[i]);
2506 if ((flags & NETAGENT_FLAG_REGISTERED) &&
2507 (flags & NETAGENT_FLAG_ACTIVE) &&
2508 (flags & NETAGENT_FLAG_SUPPORTS_BROWSE) &&
2509 (!(flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY) ||
2510 necp_netagent_is_requested(parsed_parameters, &ifp->if_agentids[i]))) {
2511 necp_client_add_interface_option_if_needed(client, ifp->if_index, ifnet_get_generation(ifp), &ifp->if_agentids[i], (flags & NETAGENT_FLAG_NETWORK_PROVIDER));
2512
2513 // Finding one is enough
2514 break;
2515 }
2516 }
2517 }
2518 }
2519
2520 static inline bool
_necp_client_address_is_valid(struct sockaddr * address)2521 _necp_client_address_is_valid(struct sockaddr *address)
2522 {
2523 if (address->sa_family == AF_INET) {
2524 return address->sa_len == sizeof(struct sockaddr_in);
2525 } else if (address->sa_family == AF_INET6) {
2526 return address->sa_len == sizeof(struct sockaddr_in6);
2527 } else {
2528 return FALSE;
2529 }
2530 }
2531
2532 #define necp_client_address_is_valid(S) _necp_client_address_is_valid(SA(S))
2533
2534 static inline bool
necp_client_endpoint_is_unspecified(struct necp_client_endpoint * endpoint)2535 necp_client_endpoint_is_unspecified(struct necp_client_endpoint *endpoint)
2536 {
2537 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2538 if (endpoint->u.sa.sa_family == AF_INET) {
2539 return endpoint->u.sin.sin_addr.s_addr == INADDR_ANY;
2540 } else if (endpoint->u.sa.sa_family == AF_INET6) {
2541 return IN6_IS_ADDR_UNSPECIFIED(&endpoint->u.sin6.sin6_addr);
2542 } else {
2543 return TRUE;
2544 }
2545 } else {
2546 return TRUE;
2547 }
2548 }
2549
2550 #if SKYWALK
2551 static void
necp_client_update_local_port_parameters(u_int8_t * parameters,u_int32_t parameters_size,uint16_t local_port)2552 necp_client_update_local_port_parameters(u_int8_t *parameters,
2553 u_int32_t parameters_size,
2554 uint16_t local_port)
2555 {
2556 size_t offset = 0;
2557 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
2558 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
2559 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
2560
2561 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
2562 // If the length is larger than what can fit in the remaining parameters size, bail
2563 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
2564 break;
2565 }
2566
2567 if (length > 0) {
2568 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
2569 if (value != NULL) {
2570 switch (type) {
2571 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: {
2572 if (length >= sizeof(struct necp_policy_condition_addr)) {
2573 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
2574 if (necp_client_address_is_valid(&address_struct->address.sa)) {
2575 if (address_struct->address.sa.sa_family == AF_INET) {
2576 address_struct->address.sin.sin_port = local_port;
2577 } else if (address_struct->address.sa.sa_family == AF_INET6) {
2578 address_struct->address.sin6.sin6_port = local_port;
2579 }
2580 }
2581 }
2582 break;
2583 }
2584 case NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT: {
2585 if (length >= sizeof(struct necp_client_endpoint)) {
2586 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2587 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2588 if (endpoint->u.sa.sa_family == AF_INET) {
2589 endpoint->u.sin.sin_port = local_port;
2590 } else if (endpoint->u.sa.sa_family == AF_INET6) {
2591 endpoint->u.sin6.sin6_port = local_port;
2592 }
2593 }
2594 }
2595 break;
2596 }
2597 default: {
2598 break;
2599 }
2600 }
2601 }
2602 }
2603
2604 offset += sizeof(struct necp_tlv_header) + length;
2605 }
2606 }
2607 #endif /* !SKYWALK */
2608
2609 #define NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH 253
2610
2611 static void
necp_client_trace_parameter_parsing(struct necp_client * client,u_int8_t type,u_int8_t * value,u_int32_t length)2612 necp_client_trace_parameter_parsing(struct necp_client *client, u_int8_t type, u_int8_t *value, u_int32_t length)
2613 {
2614 uint64_t num = 0;
2615 uint16_t shortBuf;
2616 uint32_t intBuf;
2617 char buffer[NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH + 1];
2618
2619 if (value != NULL && length > 0) {
2620 switch (length) {
2621 case 1:
2622 num = *value;
2623 break;
2624 case 2:
2625 memcpy(&shortBuf, value, sizeof(shortBuf));
2626 num = shortBuf;
2627 break;
2628 case 4:
2629 memcpy(&intBuf, value, sizeof(intBuf));
2630 num = intBuf;
2631 break;
2632 case 8:
2633 memcpy(&num, value, sizeof(num));
2634 break;
2635 default:
2636 num = 0;
2637 break;
2638 }
2639 int len = NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH < length ? NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH : length;
2640 memcpy(buffer, value, len);
2641 buffer[len] = 0;
2642 NECP_CLIENT_PARAMS_LOG(client, "Parsing param - type %d length %d value <%llu (%llX)> %s", type, length, num, num, buffer);
2643 } else {
2644 NECP_CLIENT_PARAMS_LOG(client, "Parsing param - type %d length %d", type, length);
2645 }
2646 }
2647
2648 static void
necp_client_trace_parsed_parameters(struct necp_client * client,struct necp_client_parsed_parameters * parsed_parameters)2649 necp_client_trace_parsed_parameters(struct necp_client *client, struct necp_client_parsed_parameters *parsed_parameters)
2650 {
2651 int i;
2652 char local_buffer[64] = { };
2653 char remote_buffer[64] = { };
2654 uuid_string_t uuid_str = { };
2655 uuid_unparse_lower(parsed_parameters->effective_uuid, uuid_str);
2656
2657 switch (parsed_parameters->local_addr.sa.sa_family) {
2658 case AF_INET:
2659 if (parsed_parameters->local_addr.sa.sa_len == sizeof(struct sockaddr_in)) {
2660 struct sockaddr_in *addr = &parsed_parameters->local_addr.sin;
2661 inet_ntop(AF_INET, &(addr->sin_addr), local_buffer, sizeof(local_buffer));
2662 }
2663 break;
2664 case AF_INET6:
2665 if (parsed_parameters->local_addr.sa.sa_len == sizeof(struct sockaddr_in6)) {
2666 struct sockaddr_in6 *addr6 = &parsed_parameters->local_addr.sin6;
2667 inet_ntop(AF_INET6, &(addr6->sin6_addr), local_buffer, sizeof(local_buffer));
2668 }
2669 break;
2670 default:
2671 break;
2672 }
2673
2674 switch (parsed_parameters->remote_addr.sa.sa_family) {
2675 case AF_INET:
2676 if (parsed_parameters->remote_addr.sa.sa_len == sizeof(struct sockaddr_in)) {
2677 struct sockaddr_in *addr = &parsed_parameters->remote_addr.sin;
2678 inet_ntop(AF_INET, &(addr->sin_addr), remote_buffer, sizeof(remote_buffer));
2679 }
2680 break;
2681 case AF_INET6:
2682 if (parsed_parameters->remote_addr.sa.sa_len == sizeof(struct sockaddr_in6)) {
2683 struct sockaddr_in6 *addr6 = &parsed_parameters->remote_addr.sin6;
2684 inet_ntop(AF_INET6, &(addr6->sin6_addr), remote_buffer, sizeof(remote_buffer));
2685 }
2686 break;
2687 default:
2688 break;
2689 }
2690
2691 NECP_CLIENT_PARAMS_LOG(client, "Parsed params - valid_fields %X flags %X delegated_upid %llu local_addr %s remote_addr %s "
2692 "required_interface_index %u required_interface_type %d local_address_preference %d "
2693 "ip_protocol %d transport_protocol %d ethertype %d effective_pid %d effective_uuid %s uid %d persona_id %d traffic_class %d",
2694 parsed_parameters->valid_fields,
2695 parsed_parameters->flags,
2696 parsed_parameters->delegated_upid,
2697 local_buffer, remote_buffer,
2698 parsed_parameters->required_interface_index,
2699 parsed_parameters->required_interface_type,
2700 parsed_parameters->local_address_preference,
2701 parsed_parameters->ip_protocol,
2702 parsed_parameters->transport_protocol,
2703 parsed_parameters->ethertype,
2704 parsed_parameters->effective_pid,
2705 uuid_str,
2706 parsed_parameters->uid,
2707 parsed_parameters->persona_id,
2708 parsed_parameters->traffic_class);
2709
2710 NECP_CLIENT_PARAMS_LOG(client, "Parsed params - tracker flags <known-tracker %X> <non-app-initiated %X> <silent %X> <app-approved %X>",
2711 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_KNOWN_TRACKER,
2712 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_NON_APP_INITIATED,
2713 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_SILENT,
2714 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_APPROVED_APP_DOMAIN);
2715
2716 for (i = 0; i < NECP_MAX_INTERFACE_PARAMETERS && parsed_parameters->prohibited_interfaces[i][0]; i++) {
2717 NECP_CLIENT_PARAMS_LOG(client, "Parsed prohibited_interfaces[%d] <%s>", i, parsed_parameters->prohibited_interfaces[i]);
2718 }
2719
2720 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->required_netagent_types[i].netagent_domain[0]; i++) {
2721 NECP_CLIENT_PARAMS_LOG(client, "Parsed required_netagent_types[%d] <%s> <%s>", i,
2722 parsed_parameters->required_netagent_types[i].netagent_domain,
2723 parsed_parameters->required_netagent_types[i].netagent_type);
2724 }
2725 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->prohibited_netagent_types[i].netagent_domain[0]; i++) {
2726 NECP_CLIENT_PARAMS_LOG(client, "Parsed prohibited_netagent_types[%d] <%s> <%s>", i,
2727 parsed_parameters->prohibited_netagent_types[i].netagent_domain,
2728 parsed_parameters->prohibited_netagent_types[i].netagent_type);
2729 }
2730 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->preferred_netagent_types[i].netagent_domain[0]; i++) {
2731 NECP_CLIENT_PARAMS_LOG(client, "Parsed preferred_netagent_types[%d] <%s> <%s>", i,
2732 parsed_parameters->preferred_netagent_types[i].netagent_domain,
2733 parsed_parameters->preferred_netagent_types[i].netagent_type);
2734 }
2735 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->avoided_netagent_types[i].netagent_domain[0]; i++) {
2736 NECP_CLIENT_PARAMS_LOG(client, "Parsed avoided_netagent_types[%d] <%s> <%s>", i,
2737 parsed_parameters->avoided_netagent_types[i].netagent_domain,
2738 parsed_parameters->avoided_netagent_types[i].netagent_type);
2739 }
2740
2741 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->required_netagents[i]); i++) {
2742 uuid_unparse_lower(parsed_parameters->required_netagents[i], uuid_str);
2743 NECP_CLIENT_PARAMS_LOG(client, "Parsed required_netagents[%d] <%s>", i, uuid_str);
2744 }
2745 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->prohibited_netagents[i]); i++) {
2746 uuid_unparse_lower(parsed_parameters->prohibited_netagents[i], uuid_str);
2747 NECP_CLIENT_PARAMS_LOG(client, "Parsed prohibited_netagents[%d] <%s>", i, uuid_str);
2748 }
2749 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->preferred_netagents[i]); i++) {
2750 uuid_unparse_lower(parsed_parameters->preferred_netagents[i], uuid_str);
2751 NECP_CLIENT_PARAMS_LOG(client, "Parsed preferred_netagents[%d] <%s>", i, uuid_str);
2752 }
2753 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->avoided_netagents[i]); i++) {
2754 uuid_unparse_lower(parsed_parameters->avoided_netagents[i], uuid_str);
2755 NECP_CLIENT_PARAMS_LOG(client, "Parsed avoided_netagents[%d] <%s>", i, uuid_str);
2756 }
2757 }
2758
2759 static bool
necp_client_strings_are_equal(const char * string1,size_t string1_length,const char * string2,size_t string2_length)2760 necp_client_strings_are_equal(const char *string1, size_t string1_length,
2761 const char *string2, size_t string2_length)
2762 {
2763 if (string1 == NULL || string2 == NULL) {
2764 return false;
2765 }
2766 const size_t string1_actual_length = strnlen(string1, string1_length);
2767 const size_t string2_actual_length = strnlen(string2, string2_length);
2768 if (string1_actual_length != string2_actual_length) {
2769 return false;
2770 }
2771 return strncmp(string1, string2, string1_actual_length) == 0;
2772 }
2773
2774 static int
necp_client_parse_parameters(struct necp_client * client,u_int8_t * parameters,u_int32_t parameters_size,struct necp_client_parsed_parameters * parsed_parameters)2775 necp_client_parse_parameters(struct necp_client *client, u_int8_t *parameters,
2776 u_int32_t parameters_size,
2777 struct necp_client_parsed_parameters *parsed_parameters)
2778 {
2779 int error = 0;
2780 size_t offset = 0;
2781
2782 u_int32_t num_prohibited_interfaces = 0;
2783 u_int32_t num_prohibited_interface_types = 0;
2784 u_int32_t num_required_agents = 0;
2785 u_int32_t num_prohibited_agents = 0;
2786 u_int32_t num_preferred_agents = 0;
2787 u_int32_t num_avoided_agents = 0;
2788 u_int32_t num_required_agent_types = 0;
2789 u_int32_t num_prohibited_agent_types = 0;
2790 u_int32_t num_preferred_agent_types = 0;
2791 u_int32_t num_avoided_agent_types = 0;
2792 u_int8_t *resolver_tag = NULL;
2793 u_int32_t resolver_tag_length = 0;
2794 u_int8_t *client_hostname = NULL;
2795 u_int32_t hostname_length = 0;
2796 uuid_t parent_id = {};
2797
2798 if (parsed_parameters == NULL) {
2799 return EINVAL;
2800 }
2801
2802 memset(parsed_parameters, 0, sizeof(struct necp_client_parsed_parameters));
2803
2804 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
2805 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
2806 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
2807
2808 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
2809 // If the length is larger than what can fit in the remaining parameters size, bail
2810 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
2811 break;
2812 }
2813
2814 if (length > 0) {
2815 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
2816 if (value != NULL) {
2817 switch (type) {
2818 case NECP_CLIENT_PARAMETER_BOUND_INTERFACE: {
2819 if (length <= IFXNAMSIZ && length > 0) {
2820 ifnet_t bound_interface = NULL;
2821 char interface_name[IFXNAMSIZ];
2822 memcpy(interface_name, value, length);
2823 interface_name[length - 1] = 0; // Make sure the string is NULL terminated
2824 if (ifnet_find_by_name(interface_name, &bound_interface) == 0) {
2825 parsed_parameters->required_interface_index = bound_interface->if_index;
2826 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF;
2827 ifnet_release(bound_interface);
2828 }
2829 }
2830 break;
2831 }
2832 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: {
2833 if (length >= sizeof(struct necp_policy_condition_addr)) {
2834 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
2835 if (necp_client_address_is_valid(&address_struct->address.sa)) {
2836 memcpy(&parsed_parameters->local_addr, &address_struct->address, sizeof(address_struct->address));
2837 if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
2838 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
2839 }
2840 if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
2841 (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
2842 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
2843 }
2844 }
2845 }
2846 break;
2847 }
2848 case NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT: {
2849 if (length >= sizeof(struct necp_client_endpoint)) {
2850 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2851 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2852 memcpy(&parsed_parameters->local_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
2853 if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
2854 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
2855 }
2856 if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
2857 (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
2858 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
2859 }
2860 }
2861 }
2862 break;
2863 }
2864 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
2865 if (length >= sizeof(struct necp_policy_condition_addr)) {
2866 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
2867 if (necp_client_address_is_valid(&address_struct->address.sa)) {
2868 memcpy(&parsed_parameters->remote_addr, &address_struct->address, sizeof(address_struct->address));
2869 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
2870 }
2871 }
2872 break;
2873 }
2874 case NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT: {
2875 if (length >= sizeof(struct necp_client_endpoint)) {
2876 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2877 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2878 memcpy(&parsed_parameters->remote_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
2879 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
2880 }
2881 }
2882 break;
2883 }
2884 case NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE: {
2885 if (num_prohibited_interfaces >= NECP_MAX_INTERFACE_PARAMETERS) {
2886 break;
2887 }
2888 if (length <= IFXNAMSIZ && length > 0) {
2889 memcpy(parsed_parameters->prohibited_interfaces[num_prohibited_interfaces], value, length);
2890 parsed_parameters->prohibited_interfaces[num_prohibited_interfaces][length - 1] = 0; // Make sure the string is NULL terminated
2891 num_prohibited_interfaces++;
2892 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF;
2893 }
2894 break;
2895 }
2896 case NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE: {
2897 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) {
2898 break;
2899 }
2900 if (length >= sizeof(u_int8_t)) {
2901 memcpy(&parsed_parameters->required_interface_type, value, sizeof(u_int8_t));
2902 if (parsed_parameters->required_interface_type) {
2903 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE;
2904 }
2905 }
2906 break;
2907 }
2908 case NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE: {
2909 if (num_prohibited_interface_types >= NECP_MAX_INTERFACE_PARAMETERS) {
2910 break;
2911 }
2912 if (length >= sizeof(u_int8_t)) {
2913 memcpy(&parsed_parameters->prohibited_interface_types[num_prohibited_interface_types], value, sizeof(u_int8_t));
2914 num_prohibited_interface_types++;
2915 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE;
2916 }
2917 break;
2918 }
2919 case NECP_CLIENT_PARAMETER_REQUIRE_AGENT: {
2920 if (num_required_agents >= NECP_MAX_AGENT_PARAMETERS) {
2921 break;
2922 }
2923 if (length >= sizeof(uuid_t)) {
2924 memcpy(&parsed_parameters->required_netagents[num_required_agents], value, sizeof(uuid_t));
2925 num_required_agents++;
2926 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT;
2927 }
2928 break;
2929 }
2930 case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT: {
2931 if (num_prohibited_agents >= NECP_MAX_AGENT_PARAMETERS) {
2932 break;
2933 }
2934 if (length >= sizeof(uuid_t)) {
2935 memcpy(&parsed_parameters->prohibited_netagents[num_prohibited_agents], value, sizeof(uuid_t));
2936 num_prohibited_agents++;
2937 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT;
2938 }
2939 break;
2940 }
2941 case NECP_CLIENT_PARAMETER_PREFER_AGENT: {
2942 if (num_preferred_agents >= NECP_MAX_AGENT_PARAMETERS) {
2943 break;
2944 }
2945 if (length >= sizeof(uuid_t)) {
2946 memcpy(&parsed_parameters->preferred_netagents[num_preferred_agents], value, sizeof(uuid_t));
2947 num_preferred_agents++;
2948 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT;
2949 }
2950 break;
2951 }
2952 case NECP_CLIENT_PARAMETER_AVOID_AGENT: {
2953 if (num_avoided_agents >= NECP_MAX_AGENT_PARAMETERS) {
2954 break;
2955 }
2956 if (length >= sizeof(uuid_t)) {
2957 memcpy(&parsed_parameters->avoided_netagents[num_avoided_agents], value, sizeof(uuid_t));
2958 num_avoided_agents++;
2959 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT;
2960 }
2961 break;
2962 }
2963 case NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE: {
2964 if (num_required_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2965 break;
2966 }
2967 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2968 memcpy(&parsed_parameters->required_netagent_types[num_required_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2969 num_required_agent_types++;
2970 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE;
2971 }
2972 break;
2973 }
2974 case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE: {
2975 if (num_prohibited_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2976 break;
2977 }
2978 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2979 memcpy(&parsed_parameters->prohibited_netagent_types[num_prohibited_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2980 num_prohibited_agent_types++;
2981 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE;
2982 }
2983 break;
2984 }
2985 case NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE: {
2986 if (num_preferred_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2987 break;
2988 }
2989 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2990 memcpy(&parsed_parameters->preferred_netagent_types[num_preferred_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2991 num_preferred_agent_types++;
2992 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE;
2993 }
2994 break;
2995 }
2996 case NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE: {
2997 if (num_avoided_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2998 break;
2999 }
3000 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
3001 memcpy(&parsed_parameters->avoided_netagent_types[num_avoided_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
3002 num_avoided_agent_types++;
3003 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE;
3004 }
3005 break;
3006 }
3007 case NECP_CLIENT_PARAMETER_FLAGS: {
3008 if (length >= sizeof(u_int32_t)) {
3009 memcpy(&parsed_parameters->flags, value, sizeof(parsed_parameters->flags));
3010 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_FLAGS;
3011 }
3012 break;
3013 }
3014 case NECP_CLIENT_PARAMETER_IP_PROTOCOL: {
3015 if (length == sizeof(u_int16_t)) {
3016 u_int16_t large_ip_protocol = 0;
3017 memcpy(&large_ip_protocol, value, sizeof(large_ip_protocol));
3018 parsed_parameters->ip_protocol = (u_int8_t)large_ip_protocol;
3019 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL;
3020 } else if (length >= sizeof(parsed_parameters->ip_protocol)) {
3021 memcpy(&parsed_parameters->ip_protocol, value, sizeof(parsed_parameters->ip_protocol));
3022 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL;
3023 }
3024 break;
3025 }
3026 case NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL: {
3027 if (length >= sizeof(parsed_parameters->transport_protocol)) {
3028 memcpy(&parsed_parameters->transport_protocol, value, sizeof(parsed_parameters->transport_protocol));
3029 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL;
3030 }
3031 break;
3032 }
3033 case NECP_CLIENT_PARAMETER_PID: {
3034 if (length >= sizeof(parsed_parameters->effective_pid)) {
3035 memcpy(&parsed_parameters->effective_pid, value, sizeof(parsed_parameters->effective_pid));
3036 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID;
3037 }
3038 break;
3039 }
3040 case NECP_CLIENT_PARAMETER_DELEGATED_UPID: {
3041 if (length >= sizeof(parsed_parameters->delegated_upid)) {
3042 memcpy(&parsed_parameters->delegated_upid, value, sizeof(parsed_parameters->delegated_upid));
3043 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID;
3044 }
3045 break;
3046 }
3047 case NECP_CLIENT_PARAMETER_ETHERTYPE: {
3048 if (length >= sizeof(parsed_parameters->ethertype)) {
3049 memcpy(&parsed_parameters->ethertype, value, sizeof(parsed_parameters->ethertype));
3050 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_ETHERTYPE;
3051 }
3052 break;
3053 }
3054 case NECP_CLIENT_PARAMETER_APPLICATION: {
3055 if (length >= sizeof(parsed_parameters->effective_uuid)) {
3056 memcpy(&parsed_parameters->effective_uuid, value, sizeof(parsed_parameters->effective_uuid));
3057 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID;
3058 }
3059 break;
3060 }
3061 case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: {
3062 if (length >= sizeof(parsed_parameters->traffic_class)) {
3063 memcpy(&parsed_parameters->traffic_class, value, sizeof(parsed_parameters->traffic_class));
3064 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS;
3065 }
3066 break;
3067 }
3068 case NECP_CLIENT_PARAMETER_RESOLVER_TAG: {
3069 if (length > 0) {
3070 if (resolver_tag != NULL) {
3071 // Multiple resolver tags is invalid
3072 NECPLOG0(LOG_ERR, "Multiple resolver tags are not supported");
3073 error = EINVAL;
3074 } else {
3075 resolver_tag = (u_int8_t *)value;
3076 resolver_tag_length = length;
3077 }
3078 }
3079 break;
3080 }
3081 case NECP_CLIENT_PARAMETER_DOMAIN: {
3082 if (length > 0) {
3083 client_hostname = (u_int8_t *)value;
3084 hostname_length = length;
3085 }
3086 break;
3087 }
3088 case NECP_CLIENT_PARAMETER_PARENT_ID: {
3089 if (length == sizeof(parent_id)) {
3090 uuid_copy(parent_id, value);
3091 memcpy(&parsed_parameters->parent_uuid, value, sizeof(parsed_parameters->parent_uuid));
3092 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PARENT_UUID;
3093 }
3094 break;
3095 }
3096 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE: {
3097 if (length >= sizeof(parsed_parameters->local_address_preference)) {
3098 memcpy(&parsed_parameters->local_address_preference, value, sizeof(parsed_parameters->local_address_preference));
3099 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE;
3100 }
3101 break;
3102 }
3103 case NECP_CLIENT_PARAMETER_ATTRIBUTED_BUNDLE_IDENTIFIER: {
3104 if (length > 0) {
3105 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER;
3106 }
3107 break;
3108 }
3109 case NECP_CLIENT_PARAMETER_FLOW_DEMUX_PATTERN: {
3110 if (parsed_parameters->demux_pattern_count >= NECP_MAX_DEMUX_PATTERNS) {
3111 break;
3112 }
3113 if (length >= sizeof(struct necp_demux_pattern)) {
3114 memcpy(&parsed_parameters->demux_patterns[parsed_parameters->demux_pattern_count], value, sizeof(struct necp_demux_pattern));
3115 parsed_parameters->demux_pattern_count++;
3116 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_FLOW_DEMUX_PATTERN;
3117 }
3118 break;
3119 }
3120 case NECP_CLIENT_PARAMETER_APPLICATION_ID: {
3121 if (length >= sizeof(necp_application_id_t)) {
3122 necp_application_id_t *application_id = (necp_application_id_t *)(void *)value;
3123 // UID
3124 parsed_parameters->uid = application_id->uid;
3125 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_UID;
3126 // EUUID
3127 uuid_copy(parsed_parameters->effective_uuid, application_id->effective_uuid);
3128 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID;
3129 // PERSONA
3130 parsed_parameters->persona_id = application_id->persona_id;
3131 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PERSONA_ID;
3132 }
3133 break;
3134 }
3135 default: {
3136 break;
3137 }
3138 }
3139 }
3140
3141 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) {
3142 necp_client_trace_parameter_parsing(client, type, value, length);
3143 }
3144 }
3145
3146 offset += sizeof(struct necp_tlv_header) + length;
3147 }
3148
3149 if (resolver_tag != NULL) {
3150 struct necp_client_validatable *validatable = (struct necp_client_validatable *)resolver_tag;
3151 if (resolver_tag_length <= sizeof(struct necp_client_validatable)) {
3152 error = EINVAL;
3153 NECPLOG(LOG_ERR, "Resolver tag length too short: %u", resolver_tag_length);
3154 } else {
3155 bool matches = true;
3156
3157 // Check the client UUID for client-specific results
3158 if (validatable->signable.sign_type == NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER ||
3159 validatable->signable.sign_type == NECP_CLIENT_SIGN_TYPE_BROWSE_RESULT ||
3160 validatable->signable.sign_type == NECP_CLIENT_SIGN_TYPE_SERVICE_RESOLVER_ANSWER) {
3161 if (uuid_compare(parent_id, validatable->signable.client_id) != 0 &&
3162 uuid_compare(client->client_id, validatable->signable.client_id) != 0) {
3163 NECPLOG0(LOG_ERR, "Resolver tag invalid client ID");
3164 matches = false;
3165 }
3166 }
3167
3168 size_t data_length = resolver_tag_length - sizeof(struct necp_client_validatable);
3169 switch (validatable->signable.sign_type) {
3170 case NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER:
3171 case NECP_CLIENT_SIGN_TYPE_SYSTEM_RESOLVER_ANSWER: {
3172 if (data_length < (sizeof(struct necp_client_host_resolver_answer) - sizeof(struct necp_client_signable))) {
3173 NECPLOG0(LOG_ERR, "Resolver tag invalid length for resolver answer");
3174 matches = false;
3175 } else {
3176 struct necp_client_host_resolver_answer *answer_struct = (struct necp_client_host_resolver_answer *)&validatable->signable;
3177 if (data_length != (sizeof(struct necp_client_host_resolver_answer) + answer_struct->hostname_length - sizeof(struct necp_client_signable))) {
3178 NECPLOG0(LOG_ERR, "Resolver tag invalid length for resolver answer");
3179 matches = false;
3180 } else {
3181 if (answer_struct->hostname_length != 0 && // If the hostname on the signed answer is empty, ignore
3182 !necp_client_strings_are_equal((const char *)client_hostname, hostname_length,
3183 answer_struct->hostname, answer_struct->hostname_length)) {
3184 NECPLOG0(LOG_ERR, "Resolver tag hostname does not match");
3185 matches = false;
3186 } else if (answer_struct->address_answer.sa.sa_family != parsed_parameters->remote_addr.sa.sa_family ||
3187 answer_struct->address_answer.sa.sa_len != parsed_parameters->remote_addr.sa.sa_len) {
3188 NECPLOG0(LOG_ERR, "Resolver tag address type does not match");
3189 matches = false;
3190 } else if (answer_struct->address_answer.sin.sin_port != 0 && // If the port on the signed answer is empty, ignore
3191 answer_struct->address_answer.sin.sin_port != parsed_parameters->remote_addr.sin.sin_port) {
3192 NECPLOG0(LOG_ERR, "Resolver tag port does not match");
3193 matches = false;
3194 } else if ((answer_struct->address_answer.sa.sa_family == AF_INET &&
3195 answer_struct->address_answer.sin.sin_addr.s_addr != parsed_parameters->remote_addr.sin.sin_addr.s_addr) ||
3196 (answer_struct->address_answer.sa.sa_family == AF_INET6 &&
3197 memcmp(&answer_struct->address_answer.sin6.sin6_addr, &parsed_parameters->remote_addr.sin6.sin6_addr, sizeof(struct in6_addr)) != 0)) {
3198 NECPLOG0(LOG_ERR, "Resolver tag address does not match");
3199 matches = false;
3200 }
3201 }
3202 }
3203 break;
3204 }
3205 case NECP_CLIENT_SIGN_TYPE_BROWSE_RESULT:
3206 case NECP_CLIENT_SIGN_TYPE_SYSTEM_BROWSE_RESULT: {
3207 if (data_length < (sizeof(struct necp_client_browse_result) - sizeof(struct necp_client_signable))) {
3208 NECPLOG0(LOG_ERR, "Resolver tag invalid length for browse result");
3209 matches = false;
3210 } else {
3211 struct necp_client_browse_result *answer_struct = (struct necp_client_browse_result *)&validatable->signable;
3212 if (data_length != (sizeof(struct necp_client_browse_result) + answer_struct->service_length - sizeof(struct necp_client_signable))) {
3213 NECPLOG0(LOG_ERR, "Resolver tag invalid length for browse result");
3214 matches = false;
3215 }
3216 }
3217 break;
3218 }
3219 case NECP_CLIENT_SIGN_TYPE_SERVICE_RESOLVER_ANSWER:
3220 case NECP_CLIENT_SIGN_TYPE_SYSTEM_SERVICE_RESOLVER_ANSWER: {
3221 if (data_length < (sizeof(struct necp_client_service_resolver_answer) - sizeof(struct necp_client_signable))) {
3222 NECPLOG0(LOG_ERR, "Resolver tag invalid length for service resolver answer");
3223 matches = false;
3224 } else {
3225 struct necp_client_service_resolver_answer *answer_struct = (struct necp_client_service_resolver_answer *)&validatable->signable;
3226 if (data_length != (sizeof(struct necp_client_service_resolver_answer) + answer_struct->service_length + answer_struct->hostname_length - sizeof(struct necp_client_signable))) {
3227 NECPLOG0(LOG_ERR, "Resolver tag invalid length for service resolver answer");
3228 matches = false;
3229 }
3230 }
3231 break;
3232 }
3233 default: {
3234 NECPLOG(LOG_ERR, "Resolver tag unknown sign type: %u", validatable->signable.sign_type);
3235 matches = false;
3236 break;
3237 }
3238 }
3239 if (!matches) {
3240 error = EAUTH;
3241 } else {
3242 const bool validated = necp_validate_resolver_answer(validatable->signable.client_id,
3243 validatable->signable.sign_type,
3244 validatable->signable.signable_data, data_length,
3245 validatable->signature.signed_tag, sizeof(validatable->signature.signed_tag));
3246 if (!validated) {
3247 error = EAUTH;
3248 NECPLOG0(LOG_ERR, "Failed to validate resolve answer");
3249 }
3250 }
3251 }
3252 }
3253
3254 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) {
3255 necp_client_trace_parsed_parameters(client, parsed_parameters);
3256 }
3257
3258 return error;
3259 }
3260
3261 static int
necp_client_parse_result(u_int8_t * result,u_int32_t result_size,union necp_sockaddr_union * local_address,union necp_sockaddr_union * remote_address,void ** flow_stats)3262 necp_client_parse_result(u_int8_t *result,
3263 u_int32_t result_size,
3264 union necp_sockaddr_union *local_address,
3265 union necp_sockaddr_union *remote_address,
3266 void **flow_stats)
3267 {
3268 #pragma unused(flow_stats)
3269 int error = 0;
3270 size_t offset = 0;
3271
3272 while ((offset + sizeof(struct necp_tlv_header)) <= result_size) {
3273 u_int8_t type = necp_buffer_get_tlv_type(result, offset);
3274 u_int32_t length = necp_buffer_get_tlv_length(result, offset);
3275
3276 if (length > 0 && (offset + sizeof(struct necp_tlv_header) + length) <= result_size) {
3277 u_int8_t *value = necp_buffer_get_tlv_value(result, offset, NULL);
3278 if (value != NULL) {
3279 switch (type) {
3280 case NECP_CLIENT_RESULT_LOCAL_ENDPOINT: {
3281 if (length >= sizeof(struct necp_client_endpoint)) {
3282 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
3283 if (local_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
3284 memcpy(local_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
3285 }
3286 }
3287 break;
3288 }
3289 case NECP_CLIENT_RESULT_REMOTE_ENDPOINT: {
3290 if (length >= sizeof(struct necp_client_endpoint)) {
3291 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
3292 if (remote_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
3293 memcpy(remote_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
3294 }
3295 }
3296 break;
3297 }
3298 #if SKYWALK
3299 case NECP_CLIENT_RESULT_NEXUS_FLOW_STATS: {
3300 // this TLV contains flow_stats pointer which is refcnt'ed.
3301 if (flow_stats != NULL && length >= sizeof(struct sk_stats_flow *)) {
3302 struct flow_stats *fs = *(void **)(void *)value;
3303 // transfer the refcnt to flow_stats pointer
3304 *flow_stats = fs;
3305 }
3306 memset(value, 0, length); // nullify TLV always
3307 break;
3308 }
3309 #endif /* SKYWALK */
3310 default: {
3311 break;
3312 }
3313 }
3314 }
3315 }
3316
3317 offset += sizeof(struct necp_tlv_header) + length;
3318 }
3319
3320 return error;
3321 }
3322
3323 static struct necp_client_flow_registration *
necp_client_create_flow_registration(struct necp_fd_data * fd_data,struct necp_client * client)3324 necp_client_create_flow_registration(struct necp_fd_data *fd_data, struct necp_client *client)
3325 {
3326 NECP_FD_ASSERT_LOCKED(fd_data);
3327 NECP_CLIENT_ASSERT_LOCKED(client);
3328
3329 struct necp_client_flow_registration *new_registration = kalloc_type(struct necp_client_flow_registration, Z_WAITOK | Z_ZERO | Z_NOFAIL);
3330
3331 new_registration->last_interface_details = combine_interface_details(IFSCOPE_NONE, NSTAT_IFNET_IS_UNKNOWN_TYPE);
3332
3333 necp_generate_client_id(new_registration->registration_id, true);
3334 LIST_INIT(&new_registration->flow_list);
3335
3336 // Add registration to client list
3337 RB_INSERT(_necp_client_flow_tree, &client->flow_registrations, new_registration);
3338
3339 // Add registration to fd list
3340 RB_INSERT(_necp_fd_flow_tree, &fd_data->flows, new_registration);
3341
3342 // Add registration to global tree for lookup
3343 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
3344 RB_INSERT(_necp_client_flow_global_tree, &necp_client_flow_global_tree, new_registration);
3345 NECP_FLOW_TREE_UNLOCK();
3346
3347 new_registration->client = client;
3348
3349 #if SKYWALK
3350 {
3351 // The uuid caching here is something of a hack, but saves a dynamic lookup with attendant lock hierarchy issues
3352 uint64_t stats_event_type = (uuid_is_null(client->latest_flow_registration_id)) ? NSTAT_EVENT_SRC_FLOW_UUID_ASSIGNED : NSTAT_EVENT_SRC_FLOW_UUID_CHANGED;
3353 uuid_copy(client->latest_flow_registration_id, new_registration->registration_id);
3354
3355 // With the flow uuid known, push a new statistics update to ensure the uuid gets known by any clients before the flow can close
3356 if (client->nstat_context != NULL) {
3357 nstat_provider_stats_event(client->nstat_context, stats_event_type);
3358 }
3359 }
3360 #endif /* !SKYWALK */
3361
3362 // Start out assuming there is nothing to read from the flow
3363 new_registration->flow_result_read = true;
3364
3365 return new_registration;
3366 }
3367
3368 static void
necp_client_add_socket_flow(struct necp_client_flow_registration * flow_registration,struct inpcb * inp)3369 necp_client_add_socket_flow(struct necp_client_flow_registration *flow_registration,
3370 struct inpcb *inp)
3371 {
3372 struct necp_client_flow *new_flow = kalloc_type(struct necp_client_flow, Z_WAITOK | Z_ZERO | Z_NOFAIL);
3373
3374 new_flow->socket = TRUE;
3375 new_flow->u.socket_handle = inp;
3376 new_flow->u.cb = inp->necp_cb;
3377
3378 OSIncrementAtomic(&necp_socket_flow_count);
3379
3380 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
3381 }
3382
3383 static int
necp_client_register_socket_inner(pid_t pid,uuid_t client_id,struct inpcb * inp,bool is_listener)3384 necp_client_register_socket_inner(pid_t pid, uuid_t client_id, struct inpcb *inp, bool is_listener)
3385 {
3386 int error = 0;
3387 struct necp_fd_data *client_fd = NULL;
3388 bool found_client = FALSE;
3389
3390 NECP_FD_LIST_LOCK_SHARED();
3391 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3392 NECP_FD_LOCK(client_fd);
3393 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3394 if (client != NULL) {
3395 if (!pid || client->proc_pid == pid) {
3396 if (is_listener) {
3397 found_client = TRUE;
3398 #if SKYWALK
3399 // Check netns token for registration
3400 if (!NETNS_TOKEN_VALID(&client->port_reservation)) {
3401 error = EINVAL;
3402 }
3403 #endif /* !SKYWALK */
3404 } else {
3405 // Find client flow and assign from socket
3406 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3407 if (flow_registration != NULL) {
3408 // Found the right client and flow registration, add a new flow
3409 found_client = TRUE;
3410 necp_client_add_socket_flow(flow_registration, inp);
3411 } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
3412 // No flows yet on this client, add a new registration
3413 flow_registration = necp_client_create_flow_registration(client_fd, client);
3414 if (flow_registration == NULL) {
3415 error = ENOMEM;
3416 } else {
3417 // Add a new flow
3418 found_client = TRUE;
3419 necp_client_add_socket_flow(flow_registration, inp);
3420 }
3421 }
3422 }
3423 }
3424
3425 NECP_CLIENT_UNLOCK(client);
3426 }
3427 NECP_FD_UNLOCK(client_fd);
3428
3429 if (found_client) {
3430 break;
3431 }
3432 }
3433 NECP_FD_LIST_UNLOCK();
3434
3435 if (!found_client) {
3436 error = ENOENT;
3437 } else {
3438 // Count the sockets that have the NECP client UUID set
3439 struct socket *so = inp->inp_socket;
3440 if (!(so->so_flags1 & SOF1_HAS_NECP_CLIENT_UUID)) {
3441 so->so_flags1 |= SOF1_HAS_NECP_CLIENT_UUID;
3442 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_necp_clientuuid_total);
3443 }
3444 }
3445
3446 return error;
3447 }
3448
3449 int
necp_client_register_socket_flow(pid_t pid,uuid_t client_id,struct inpcb * inp)3450 necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp)
3451 {
3452 return necp_client_register_socket_inner(pid, client_id, inp, false);
3453 }
3454
3455 int
necp_client_register_socket_listener(pid_t pid,uuid_t client_id,struct inpcb * inp)3456 necp_client_register_socket_listener(pid_t pid, uuid_t client_id, struct inpcb *inp)
3457 {
3458 return necp_client_register_socket_inner(pid, client_id, inp, true);
3459 }
3460
3461 #if SKYWALK
3462 int
necp_client_get_netns_flow_info(uuid_t client_id,struct ns_flow_info * flow_info)3463 necp_client_get_netns_flow_info(uuid_t client_id, struct ns_flow_info *flow_info)
3464 {
3465 int error = 0;
3466 struct necp_fd_data *client_fd = NULL;
3467 bool found_client = FALSE;
3468
3469 NECP_FD_LIST_LOCK_SHARED();
3470 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3471 NECP_FD_LOCK(client_fd);
3472 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3473 if (client != NULL) {
3474 found_client = TRUE;
3475 if (!NETNS_TOKEN_VALID(&client->port_reservation)) {
3476 error = EINVAL;
3477 } else {
3478 error = netns_get_flow_info(&client->port_reservation, flow_info);
3479 }
3480
3481 NECP_CLIENT_UNLOCK(client);
3482 }
3483 NECP_FD_UNLOCK(client_fd);
3484
3485 if (found_client) {
3486 break;
3487 }
3488 }
3489 NECP_FD_LIST_UNLOCK();
3490
3491 if (!found_client) {
3492 error = ENOENT;
3493 }
3494
3495 return error;
3496 }
3497 #endif /* !SKYWALK */
3498
3499 static void
necp_client_add_multipath_interface_flows(struct necp_client_flow_registration * flow_registration,struct necp_client * client,struct mppcb * mpp)3500 necp_client_add_multipath_interface_flows(struct necp_client_flow_registration *flow_registration,
3501 struct necp_client *client,
3502 struct mppcb *mpp)
3503 {
3504 flow_registration->interface_handle = mpp;
3505 flow_registration->interface_cb = mpp->necp_cb;
3506
3507 proc_t proc = proc_find(client->proc_pid);
3508 if (proc == PROC_NULL) {
3509 return;
3510 }
3511
3512 // Traverse all interfaces and add a tracking flow if needed
3513 necp_flow_add_interface_flows(proc, client, flow_registration, true);
3514
3515 proc_rele(proc);
3516 proc = PROC_NULL;
3517 }
3518
3519 int
necp_client_register_multipath_cb(pid_t pid,uuid_t client_id,struct mppcb * mpp)3520 necp_client_register_multipath_cb(pid_t pid, uuid_t client_id, struct mppcb *mpp)
3521 {
3522 int error = 0;
3523 struct necp_fd_data *client_fd = NULL;
3524 bool found_client = FALSE;
3525
3526 NECP_FD_LIST_LOCK_SHARED();
3527 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3528 NECP_FD_LOCK(client_fd);
3529 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3530 if (client != NULL) {
3531 if (!pid || client->proc_pid == pid) {
3532 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3533 if (flow_registration != NULL) {
3534 // Found the right client and flow registration, add a new flow
3535 found_client = TRUE;
3536 necp_client_add_multipath_interface_flows(flow_registration, client, mpp);
3537 } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
3538 // No flows yet on this client, add a new registration
3539 flow_registration = necp_client_create_flow_registration(client_fd, client);
3540 if (flow_registration == NULL) {
3541 error = ENOMEM;
3542 } else {
3543 // Add a new flow
3544 found_client = TRUE;
3545 necp_client_add_multipath_interface_flows(flow_registration, client, mpp);
3546 }
3547 }
3548 }
3549
3550 NECP_CLIENT_UNLOCK(client);
3551 }
3552 NECP_FD_UNLOCK(client_fd);
3553
3554 if (found_client) {
3555 break;
3556 }
3557 }
3558 NECP_FD_LIST_UNLOCK();
3559
3560 if (!found_client && error == 0) {
3561 error = ENOENT;
3562 }
3563
3564 return error;
3565 }
3566
3567 #define NETAGENT_DOMAIN_RADIO_MANAGER "WirelessRadioManager"
3568 #define NETAGENT_TYPE_RADIO_MANAGER "WirelessRadioManager:BB Manager"
3569
3570 static int
necp_client_lookup_bb_radio_manager(struct necp_client * client,uuid_t netagent_uuid)3571 necp_client_lookup_bb_radio_manager(struct necp_client *client,
3572 uuid_t netagent_uuid)
3573 {
3574 char netagent_domain[NETAGENT_DOMAINSIZE];
3575 char netagent_type[NETAGENT_TYPESIZE];
3576 struct necp_aggregate_result result;
3577 proc_t proc;
3578 int error;
3579
3580 proc = proc_find(client->proc_pid);
3581 if (proc == PROC_NULL) {
3582 return ESRCH;
3583 }
3584
3585 error = necp_application_find_policy_match_internal(proc, client->parameters, (u_int32_t)client->parameters_length,
3586 &result, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL, true, true, NULL);
3587
3588 proc_rele(proc);
3589 proc = PROC_NULL;
3590
3591 if (error) {
3592 return error;
3593 }
3594
3595 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
3596 if (uuid_is_null(result.netagents[i])) {
3597 // Passed end of valid agents
3598 break;
3599 }
3600
3601 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
3602 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
3603 if (netagent_get_agent_domain_and_type(result.netagents[i], netagent_domain, netagent_type) == FALSE) {
3604 continue;
3605 }
3606
3607 if (strncmp(netagent_domain, NETAGENT_DOMAIN_RADIO_MANAGER, NETAGENT_DOMAINSIZE) != 0) {
3608 continue;
3609 }
3610
3611 if (strncmp(netagent_type, NETAGENT_TYPE_RADIO_MANAGER, NETAGENT_TYPESIZE) != 0) {
3612 continue;
3613 }
3614
3615 uuid_copy(netagent_uuid, result.netagents[i]);
3616
3617 break;
3618 }
3619
3620 return 0;
3621 }
3622
3623 static int
necp_client_assert_bb_radio_manager_common(struct necp_client * client,bool assert)3624 necp_client_assert_bb_radio_manager_common(struct necp_client *client, bool assert)
3625 {
3626 uuid_t netagent_uuid;
3627 uint8_t assert_type;
3628 int error;
3629
3630 error = necp_client_lookup_bb_radio_manager(client, netagent_uuid);
3631 if (error) {
3632 NECPLOG0(LOG_ERR, "BB radio manager agent not found");
3633 return error;
3634 }
3635
3636 // Before unasserting, verify that the assertion was already taken
3637 if (assert == FALSE) {
3638 assert_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
3639
3640 if (!necp_client_remove_assertion(client, netagent_uuid)) {
3641 return EINVAL;
3642 }
3643 } else {
3644 assert_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT;
3645 }
3646
3647 error = netagent_client_message(netagent_uuid, client->client_id, client->proc_pid, client->agent_handle, assert_type);
3648 if (error) {
3649 NECPLOG0(LOG_ERR, "netagent_client_message failed");
3650 return error;
3651 }
3652
3653 // Only save the assertion if the action succeeded
3654 if (assert == TRUE) {
3655 necp_client_add_assertion(client, netagent_uuid);
3656 }
3657
3658 return 0;
3659 }
3660
3661 int
necp_client_assert_bb_radio_manager(uuid_t client_id,bool assert)3662 necp_client_assert_bb_radio_manager(uuid_t client_id, bool assert)
3663 {
3664 struct necp_client *client;
3665 int error = 0;
3666
3667 NECP_CLIENT_TREE_LOCK_SHARED();
3668
3669 client = necp_find_client_and_lock(client_id);
3670
3671 if (client) {
3672 // Found the right client!
3673 error = necp_client_assert_bb_radio_manager_common(client, assert);
3674
3675 NECP_CLIENT_UNLOCK(client);
3676 } else {
3677 NECPLOG0(LOG_ERR, "Couldn't find client");
3678 error = ENOENT;
3679 }
3680
3681 NECP_CLIENT_TREE_UNLOCK();
3682
3683 return error;
3684 }
3685
3686 static int
necp_client_unregister_socket_flow(uuid_t client_id,void * handle)3687 necp_client_unregister_socket_flow(uuid_t client_id, void *handle)
3688 {
3689 int error = 0;
3690 struct necp_fd_data *client_fd = NULL;
3691 bool found_client = FALSE;
3692 bool client_updated = FALSE;
3693
3694 NECP_FD_LIST_LOCK_SHARED();
3695 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3696 NECP_FD_LOCK(client_fd);
3697
3698 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3699 if (client != NULL) {
3700 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3701 if (flow_registration != NULL) {
3702 // Found the right client and flow!
3703 found_client = TRUE;
3704
3705 // Remove flow assignment
3706 struct necp_client_flow *search_flow = NULL;
3707 struct necp_client_flow *temp_flow = NULL;
3708 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
3709 if (search_flow->socket && search_flow->u.socket_handle == handle) {
3710 if (search_flow->assigned_results != NULL) {
3711 kfree_data(search_flow->assigned_results, search_flow->assigned_results_length);
3712 search_flow->assigned_results = NULL;
3713 }
3714 client_updated = TRUE;
3715 flow_registration->flow_result_read = FALSE;
3716 LIST_REMOVE(search_flow, flow_chain);
3717 OSDecrementAtomic(&necp_socket_flow_count);
3718 kfree_type(struct necp_client_flow, search_flow);
3719 }
3720 }
3721 }
3722
3723 NECP_CLIENT_UNLOCK(client);
3724 }
3725
3726 if (client_updated) {
3727 necp_fd_notify(client_fd, true);
3728 }
3729 NECP_FD_UNLOCK(client_fd);
3730
3731 if (found_client) {
3732 break;
3733 }
3734 }
3735 NECP_FD_LIST_UNLOCK();
3736
3737 if (!found_client) {
3738 error = ENOENT;
3739 }
3740
3741 return error;
3742 }
3743
3744 static int
necp_client_unregister_multipath_cb(uuid_t client_id,void * handle)3745 necp_client_unregister_multipath_cb(uuid_t client_id, void *handle)
3746 {
3747 int error = 0;
3748 bool found_client = FALSE;
3749
3750 NECP_CLIENT_TREE_LOCK_SHARED();
3751
3752 struct necp_client *client = necp_find_client_and_lock(client_id);
3753 if (client != NULL) {
3754 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3755 if (flow_registration != NULL) {
3756 // Found the right client and flow!
3757 found_client = TRUE;
3758
3759 // Remove flow assignment
3760 struct necp_client_flow *search_flow = NULL;
3761 struct necp_client_flow *temp_flow = NULL;
3762 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
3763 if (!search_flow->socket && !search_flow->nexus &&
3764 search_flow->u.socket_handle == handle) {
3765 search_flow->u.socket_handle = NULL;
3766 search_flow->u.cb = NULL;
3767 }
3768 }
3769
3770 flow_registration->interface_handle = NULL;
3771 flow_registration->interface_cb = NULL;
3772 }
3773
3774 NECP_CLIENT_UNLOCK(client);
3775 }
3776
3777 NECP_CLIENT_TREE_UNLOCK();
3778
3779 if (!found_client) {
3780 error = ENOENT;
3781 }
3782
3783 return error;
3784 }
3785
3786 int
necp_client_assign_from_socket(pid_t pid,uuid_t client_id,struct inpcb * inp)3787 necp_client_assign_from_socket(pid_t pid, uuid_t client_id, struct inpcb *inp)
3788 {
3789 int error = 0;
3790 struct necp_fd_data *client_fd = NULL;
3791 bool found_client = FALSE;
3792 bool client_updated = FALSE;
3793
3794 NECP_FD_LIST_LOCK_SHARED();
3795 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3796 if (pid && client_fd->proc_pid != pid) {
3797 continue;
3798 }
3799
3800 proc_t proc = proc_find(client_fd->proc_pid);
3801 if (proc == PROC_NULL) {
3802 continue;
3803 }
3804
3805 NECP_FD_LOCK(client_fd);
3806
3807 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3808 if (client != NULL) {
3809 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3810 if (flow_registration == NULL && RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
3811 // No flows yet on this client, add a new registration
3812 flow_registration = necp_client_create_flow_registration(client_fd, client);
3813 if (flow_registration == NULL) {
3814 error = ENOMEM;
3815 }
3816 }
3817 if (flow_registration != NULL) {
3818 // Found the right client and flow!
3819 found_client = TRUE;
3820
3821 struct necp_client_flow *flow = NULL;
3822 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
3823 if (flow->socket && flow->u.socket_handle == inp) {
3824 // Release prior results and route
3825 if (flow->assigned_results != NULL) {
3826 kfree_data(flow->assigned_results, flow->assigned_results_length);
3827 flow->assigned_results = NULL;
3828 }
3829
3830 ifnet_t ifp = NULL;
3831 if ((inp->inp_flags & INP_BOUND_IF) && inp->inp_boundifp) {
3832 ifp = inp->inp_boundifp;
3833 } else {
3834 ifp = inp->inp_last_outifp;
3835 }
3836
3837 if (ifp != NULL) {
3838 flow->interface_index = ifp->if_index;
3839 } else {
3840 flow->interface_index = IFSCOPE_NONE;
3841 }
3842
3843 if (inp->inp_vflag & INP_IPV4) {
3844 flow->local_addr.sin.sin_family = AF_INET;
3845 flow->local_addr.sin.sin_len = sizeof(struct sockaddr_in);
3846 flow->local_addr.sin.sin_port = inp->inp_lport;
3847 memcpy(&flow->local_addr.sin.sin_addr, &inp->inp_laddr, sizeof(struct in_addr));
3848
3849 flow->remote_addr.sin.sin_family = AF_INET;
3850 flow->remote_addr.sin.sin_len = sizeof(struct sockaddr_in);
3851 flow->remote_addr.sin.sin_port = inp->inp_fport;
3852 memcpy(&flow->remote_addr.sin.sin_addr, &inp->inp_faddr, sizeof(struct in_addr));
3853 } else if (inp->inp_vflag & INP_IPV6) {
3854 in6_ip6_to_sockaddr(&inp->in6p_laddr, inp->inp_lport, inp->inp_lifscope, &flow->local_addr.sin6, sizeof(flow->local_addr));
3855 in6_ip6_to_sockaddr(&inp->in6p_faddr, inp->inp_fport, inp->inp_fifscope, &flow->remote_addr.sin6, sizeof(flow->remote_addr));
3856 }
3857
3858 flow->viable = necp_client_flow_is_viable(proc, client, flow);
3859
3860 uuid_t empty_uuid;
3861 uuid_clear(empty_uuid);
3862 flow->assigned = TRUE;
3863 flow->assigned_results = necp_create_nexus_assign_message(empty_uuid, 0, NULL, 0,
3864 (struct necp_client_endpoint *)&flow->local_addr,
3865 (struct necp_client_endpoint *)&flow->remote_addr,
3866 NULL, 0, NULL, &flow->assigned_results_length);
3867 flow_registration->flow_result_read = FALSE;
3868 client_updated = TRUE;
3869 break;
3870 }
3871 }
3872 }
3873
3874 NECP_CLIENT_UNLOCK(client);
3875 }
3876 if (client_updated) {
3877 necp_fd_notify(client_fd, true);
3878 }
3879 NECP_FD_UNLOCK(client_fd);
3880
3881 proc_rele(proc);
3882 proc = PROC_NULL;
3883
3884 if (found_client) {
3885 break;
3886 }
3887 }
3888 NECP_FD_LIST_UNLOCK();
3889
3890 if (error == 0) {
3891 if (!found_client) {
3892 error = ENOENT;
3893 } else if (!client_updated) {
3894 error = EINVAL;
3895 }
3896 }
3897
3898 return error;
3899 }
3900
3901 bool
necp_socket_is_allowed_to_recv_on_interface(struct inpcb * inp,ifnet_t interface)3902 necp_socket_is_allowed_to_recv_on_interface(struct inpcb *inp, ifnet_t interface)
3903 {
3904 if (interface == NULL ||
3905 inp == NULL ||
3906 !(inp->inp_flags2 & INP2_EXTERNAL_PORT) ||
3907 uuid_is_null(inp->necp_client_uuid)) {
3908 // If there's no interface or client ID to check,
3909 // or if this is not a listener, pass.
3910 // Outbound connections will have already been
3911 // validated for policy.
3912 return TRUE;
3913 }
3914
3915 // Only filter out listener sockets (no remote address specified)
3916 if ((inp->inp_vflag & INP_IPV4) &&
3917 inp->inp_faddr.s_addr != INADDR_ANY) {
3918 return TRUE;
3919 }
3920 if ((inp->inp_vflag & INP_IPV6) &&
3921 !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
3922 return TRUE;
3923 }
3924
3925 bool allowed = TRUE;
3926
3927 NECP_CLIENT_TREE_LOCK_SHARED();
3928
3929 struct necp_client *client = necp_find_client_and_lock(inp->necp_client_uuid);
3930 if (client != NULL) {
3931 struct necp_client_parsed_parameters *parsed_parameters = NULL;
3932
3933 parsed_parameters = kalloc_type(struct necp_client_parsed_parameters,
3934 Z_WAITOK | Z_ZERO | Z_NOFAIL);
3935 int error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, parsed_parameters);
3936 if (error == 0) {
3937 if (!necp_ifnet_matches_parameters(interface, parsed_parameters, 0, NULL, true, false)) {
3938 allowed = FALSE;
3939 }
3940 }
3941 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
3942
3943 NECP_CLIENT_UNLOCK(client);
3944 }
3945
3946 NECP_CLIENT_TREE_UNLOCK();
3947
3948 return allowed;
3949 }
3950
3951 int
necp_update_flow_protoctl_event(uuid_t netagent_uuid,uuid_t client_id,uint32_t protoctl_event_code,uint32_t protoctl_event_val,uint32_t protoctl_event_tcp_seq_number)3952 necp_update_flow_protoctl_event(uuid_t netagent_uuid, uuid_t client_id,
3953 uint32_t protoctl_event_code, uint32_t protoctl_event_val,
3954 uint32_t protoctl_event_tcp_seq_number)
3955 {
3956 int error = 0;
3957 struct necp_fd_data *client_fd = NULL;
3958 bool found_client = FALSE;
3959 bool client_updated = FALSE;
3960
3961 NECP_FD_LIST_LOCK_SHARED();
3962 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3963 proc_t proc = proc_find(client_fd->proc_pid);
3964 if (proc == PROC_NULL) {
3965 continue;
3966 }
3967
3968 NECP_FD_LOCK(client_fd);
3969
3970 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3971 if (client != NULL) {
3972 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3973 if (flow_registration != NULL) {
3974 // Found the right client and flow!
3975 found_client = TRUE;
3976
3977 struct necp_client_flow *flow = NULL;
3978 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
3979 // Verify that the client nexus agent matches
3980 if ((flow->nexus && uuid_compare(flow->u.nexus_agent, netagent_uuid) == 0) ||
3981 flow->socket) {
3982 flow->has_protoctl_event = TRUE;
3983 flow->protoctl_event.protoctl_event_code = protoctl_event_code;
3984 flow->protoctl_event.protoctl_event_val = protoctl_event_val;
3985 flow->protoctl_event.protoctl_event_tcp_seq_num = protoctl_event_tcp_seq_number;
3986 flow_registration->flow_result_read = FALSE;
3987 client_updated = TRUE;
3988 break;
3989 }
3990 }
3991 }
3992
3993 NECP_CLIENT_UNLOCK(client);
3994 }
3995
3996 if (client_updated) {
3997 necp_fd_notify(client_fd, true);
3998 }
3999
4000 NECP_FD_UNLOCK(client_fd);
4001 proc_rele(proc);
4002 proc = PROC_NULL;
4003
4004 if (found_client) {
4005 break;
4006 }
4007 }
4008 NECP_FD_LIST_UNLOCK();
4009
4010 if (!found_client) {
4011 error = ENOENT;
4012 } else if (!client_updated) {
4013 error = EINVAL;
4014 }
4015 return error;
4016 }
4017
4018 static bool
necp_assign_client_result_locked(struct proc * proc,struct necp_fd_data * client_fd,struct necp_client * client,struct necp_client_flow_registration * flow_registration,uuid_t netagent_uuid,u_int8_t * assigned_results,size_t assigned_results_length,bool notify_fd,bool assigned_from_userspace_agent)4019 necp_assign_client_result_locked(struct proc *proc,
4020 struct necp_fd_data *client_fd,
4021 struct necp_client *client,
4022 struct necp_client_flow_registration *flow_registration,
4023 uuid_t netagent_uuid,
4024 u_int8_t *assigned_results,
4025 size_t assigned_results_length,
4026 bool notify_fd,
4027 bool assigned_from_userspace_agent)
4028 {
4029 bool client_updated = FALSE;
4030
4031 NECP_FD_ASSERT_LOCKED(client_fd);
4032 NECP_CLIENT_ASSERT_LOCKED(client);
4033
4034 struct necp_client_flow *flow = NULL;
4035 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
4036 // Verify that the client nexus agent matches
4037 if (flow->nexus &&
4038 uuid_compare(flow->u.nexus_agent, netagent_uuid) == 0) {
4039 // Release prior results and route
4040 if (flow->assigned_results != NULL) {
4041 kfree_data(flow->assigned_results, flow->assigned_results_length);
4042 flow->assigned_results = NULL;
4043 }
4044
4045 void *nexus_stats = NULL;
4046 if (assigned_results != NULL && assigned_results_length > 0) {
4047 int error = necp_client_parse_result(assigned_results, (u_int32_t)assigned_results_length,
4048 &flow->local_addr, &flow->remote_addr,
4049 assigned_from_userspace_agent ? NULL : &nexus_stats); // Only assign stats from kernel agents
4050 VERIFY(error == 0);
4051 }
4052
4053 flow->viable = necp_client_flow_is_viable(proc, client, flow);
4054
4055 flow->assigned = TRUE;
4056 flow->assigned_results = assigned_results;
4057 flow->assigned_results_length = assigned_results_length;
4058 flow_registration->flow_result_read = FALSE;
4059 #if SKYWALK
4060 if (nexus_stats != NULL) {
4061 if (flow_registration->nexus_stats != NULL) {
4062 flow_stats_release(flow_registration->nexus_stats);
4063 }
4064 flow_registration->nexus_stats = nexus_stats;
4065 }
4066 #endif /* SKYWALK */
4067 client_updated = TRUE;
4068 break;
4069 }
4070 }
4071
4072 if (client_updated && notify_fd) {
4073 necp_fd_notify(client_fd, true);
4074 }
4075
4076 // if not updated, client must free assigned_results
4077 return client_updated;
4078 }
4079
4080 int
necp_assign_client_result(uuid_t netagent_uuid,uuid_t client_id,u_int8_t * assigned_results,size_t assigned_results_length)4081 necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id,
4082 u_int8_t *assigned_results, size_t assigned_results_length)
4083 {
4084 int error = 0;
4085 struct necp_fd_data *client_fd = NULL;
4086 bool found_client = FALSE;
4087 bool client_updated = FALSE;
4088
4089 NECP_FD_LIST_LOCK_SHARED();
4090
4091 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
4092 proc_t proc = proc_find(client_fd->proc_pid);
4093 if (proc == PROC_NULL) {
4094 continue;
4095 }
4096
4097 NECP_FD_LOCK(client_fd);
4098 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
4099 if (client != NULL) {
4100 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
4101 if (flow_registration != NULL) {
4102 // Found the right client and flow!
4103 found_client = TRUE;
4104 if (necp_assign_client_result_locked(proc, client_fd, client, flow_registration, netagent_uuid,
4105 assigned_results, assigned_results_length, true, true)) {
4106 client_updated = TRUE;
4107 }
4108 }
4109
4110 NECP_CLIENT_UNLOCK(client);
4111 }
4112 NECP_FD_UNLOCK(client_fd);
4113
4114 proc_rele(proc);
4115 proc = PROC_NULL;
4116
4117 if (found_client) {
4118 break;
4119 }
4120 }
4121
4122 NECP_FD_LIST_UNLOCK();
4123
4124 // upon error, client must free assigned_results
4125 if (!found_client) {
4126 error = ENOENT;
4127 } else if (!client_updated) {
4128 error = EINVAL;
4129 }
4130
4131 return error;
4132 }
4133
4134 int
necp_assign_client_group_members(uuid_t netagent_uuid,uuid_t client_id,u_int8_t * assigned_group_members,size_t assigned_group_members_length)4135 necp_assign_client_group_members(uuid_t netagent_uuid, uuid_t client_id,
4136 u_int8_t *assigned_group_members, size_t assigned_group_members_length)
4137 {
4138 #pragma unused(netagent_uuid)
4139 int error = 0;
4140 struct necp_fd_data *client_fd = NULL;
4141 bool found_client = false;
4142 bool client_updated = false;
4143
4144 NECP_FD_LIST_LOCK_SHARED();
4145
4146 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
4147 proc_t proc = proc_find(client_fd->proc_pid);
4148 if (proc == PROC_NULL) {
4149 continue;
4150 }
4151
4152 NECP_FD_LOCK(client_fd);
4153 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
4154 if (client != NULL) {
4155 found_client = true;
4156 // Release prior results
4157 if (client->assigned_group_members != NULL) {
4158 kfree_data(client->assigned_group_members, client->assigned_group_members_length);
4159 client->assigned_group_members = NULL;
4160 }
4161
4162 // Save new results
4163 client->assigned_group_members = assigned_group_members;
4164 client->assigned_group_members_length = assigned_group_members_length;
4165 client->group_members_read = false;
4166
4167 client_updated = true;
4168 necp_fd_notify(client_fd, true);
4169
4170 NECP_CLIENT_UNLOCK(client);
4171 }
4172 NECP_FD_UNLOCK(client_fd);
4173
4174 proc_rele(proc);
4175 proc = PROC_NULL;
4176
4177 if (found_client) {
4178 break;
4179 }
4180 }
4181
4182 NECP_FD_LIST_UNLOCK();
4183
4184 // upon error, client must free assigned_results
4185 if (!found_client) {
4186 error = ENOENT;
4187 } else if (!client_updated) {
4188 error = EINVAL;
4189 }
4190
4191 return error;
4192 }
4193
4194 /// Client updating
4195
4196 static bool
necp_update_parsed_parameters(struct necp_client_parsed_parameters * parsed_parameters,struct necp_aggregate_result * result)4197 necp_update_parsed_parameters(struct necp_client_parsed_parameters *parsed_parameters,
4198 struct necp_aggregate_result *result)
4199 {
4200 if (parsed_parameters == NULL ||
4201 result == NULL) {
4202 return false;
4203 }
4204
4205 bool updated = false;
4206 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
4207 if (uuid_is_null(result->netagents[i])) {
4208 // Passed end of valid agents
4209 break;
4210 }
4211
4212 if (!(result->netagent_use_flags[i] & NECP_AGENT_USE_FLAG_SCOPE)) {
4213 // Not a scoped agent, ignore
4214 continue;
4215 }
4216
4217 // This is a scoped agent. Add it to the required agents.
4218 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
4219 // Already some required agents, add this at the end
4220 for (int j = 0; j < NECP_MAX_AGENT_PARAMETERS; j++) {
4221 if (uuid_compare(parsed_parameters->required_netagents[j], result->netagents[i]) == 0) {
4222 // Already required, break
4223 break;
4224 }
4225 if (uuid_is_null(parsed_parameters->required_netagents[j])) {
4226 // Add here
4227 memcpy(&parsed_parameters->required_netagents[j], result->netagents[i], sizeof(uuid_t));
4228 updated = true;
4229 break;
4230 }
4231 }
4232 } else {
4233 // No required agents yet, add this one
4234 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT;
4235 memcpy(&parsed_parameters->required_netagents[0], result->netagents[i], sizeof(uuid_t));
4236 updated = true;
4237 }
4238
4239 // Remove requirements for agents of the same type
4240 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
4241 char remove_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
4242 char remove_agent_type[NETAGENT_TYPESIZE] = { 0 };
4243 if (netagent_get_agent_domain_and_type(result->netagents[i], remove_agent_domain, remove_agent_type)) {
4244 for (int j = 0; j < NECP_MAX_AGENT_PARAMETERS; j++) {
4245 if (strlen(parsed_parameters->required_netagent_types[j].netagent_domain) == 0 &&
4246 strlen(parsed_parameters->required_netagent_types[j].netagent_type) == 0) {
4247 break;
4248 }
4249
4250 if (strncmp(parsed_parameters->required_netagent_types[j].netagent_domain, remove_agent_domain, NETAGENT_DOMAINSIZE) == 0 &&
4251 strncmp(parsed_parameters->required_netagent_types[j].netagent_type, remove_agent_type, NETAGENT_TYPESIZE) == 0) {
4252 updated = true;
4253
4254 if (j == NECP_MAX_AGENT_PARAMETERS - 1) {
4255 // Last field, just clear and break
4256 memset(&parsed_parameters->required_netagent_types[NECP_MAX_AGENT_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
4257 break;
4258 } else {
4259 // Move the parameters down, clear the last entry
4260 memmove(&parsed_parameters->required_netagent_types[j],
4261 &parsed_parameters->required_netagent_types[j + 1],
4262 sizeof(struct necp_client_parameter_netagent_type) * (NECP_MAX_AGENT_PARAMETERS - (j + 1)));
4263 memset(&parsed_parameters->required_netagent_types[NECP_MAX_AGENT_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
4264 // Continue, don't increment but look at the new shifted item instead
4265 continue;
4266 }
4267 }
4268
4269 // Increment j to look at the next agent type parameter
4270 j++;
4271 }
4272 }
4273 }
4274 }
4275
4276 if (updated &&
4277 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4278 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) {
4279 // A required interface index was added after the fact. Clear it.
4280 parsed_parameters->required_interface_index = IFSCOPE_NONE;
4281 }
4282
4283
4284 return updated;
4285 }
4286
4287 static inline bool
necp_agent_types_match(const char * agent_domain1,const char * agent_type1,const char * agent_domain2,const char * agent_type2)4288 necp_agent_types_match(const char *agent_domain1, const char *agent_type1,
4289 const char *agent_domain2, const char *agent_type2)
4290 {
4291 return (strlen(agent_domain1) == 0 ||
4292 strncmp(agent_domain2, agent_domain1, NETAGENT_DOMAINSIZE) == 0) &&
4293 (strlen(agent_type1) == 0 ||
4294 strncmp(agent_type2, agent_type1, NETAGENT_TYPESIZE) == 0);
4295 }
4296
4297 static inline bool
necp_calculate_client_result(proc_t proc,struct necp_client * client,struct necp_client_parsed_parameters * parsed_parameters,struct necp_aggregate_result * result,u_int32_t * flags,u_int32_t * reason,struct necp_client_endpoint * v4_gateway,struct necp_client_endpoint * v6_gateway,uuid_t * override_euuid)4298 necp_calculate_client_result(proc_t proc,
4299 struct necp_client *client,
4300 struct necp_client_parsed_parameters *parsed_parameters,
4301 struct necp_aggregate_result *result,
4302 u_int32_t *flags,
4303 u_int32_t *reason,
4304 struct necp_client_endpoint *v4_gateway,
4305 struct necp_client_endpoint *v6_gateway,
4306 uuid_t *override_euuid)
4307 {
4308 struct rtentry *route = NULL;
4309
4310 // Check parameters to find best interface
4311 bool validate_agents = false;
4312 u_int matching_if_index = 0;
4313 if (necp_find_matching_interface_index(parsed_parameters, &matching_if_index, &validate_agents)) {
4314 if (matching_if_index != 0) {
4315 parsed_parameters->required_interface_index = matching_if_index;
4316 }
4317 // Interface found or not needed, match policy.
4318 memset(result, 0, sizeof(*result));
4319 int error = necp_application_find_policy_match_internal(proc, client->parameters,
4320 (u_int32_t)client->parameters_length,
4321 result, flags, reason, matching_if_index,
4322 NULL, NULL,
4323 v4_gateway, v6_gateway,
4324 &route, false, true,
4325 override_euuid);
4326 if (error != 0) {
4327 if (route != NULL) {
4328 rtfree(route);
4329 }
4330 return FALSE;
4331 }
4332
4333 if (validate_agents) {
4334 bool requirement_failed = FALSE;
4335 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
4336 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4337 if (uuid_is_null(parsed_parameters->required_netagents[i])) {
4338 break;
4339 }
4340
4341 bool requirement_found = FALSE;
4342 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4343 if (uuid_is_null(result->netagents[j])) {
4344 break;
4345 }
4346
4347 if (result->netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) {
4348 // A removed agent, ignore
4349 continue;
4350 }
4351
4352 if (uuid_compare(parsed_parameters->required_netagents[i], result->netagents[j]) == 0) {
4353 requirement_found = TRUE;
4354 break;
4355 }
4356 }
4357
4358 if (!requirement_found) {
4359 requirement_failed = TRUE;
4360 break;
4361 }
4362 }
4363 }
4364
4365 if (!requirement_failed && parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
4366 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4367 if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 &&
4368 strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
4369 break;
4370 }
4371
4372 bool requirement_found = FALSE;
4373 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4374 if (uuid_is_null(result->netagents[j])) {
4375 break;
4376 }
4377
4378 if (result->netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) {
4379 // A removed agent, ignore
4380 continue;
4381 }
4382
4383 char policy_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
4384 char policy_agent_type[NETAGENT_TYPESIZE] = { 0 };
4385
4386 if (netagent_get_agent_domain_and_type(result->netagents[j], policy_agent_domain, policy_agent_type)) {
4387 if (necp_agent_types_match(parsed_parameters->required_netagent_types[i].netagent_domain,
4388 parsed_parameters->required_netagent_types[i].netagent_type,
4389 policy_agent_domain, policy_agent_type)) {
4390 requirement_found = TRUE;
4391 break;
4392 }
4393 }
4394 }
4395
4396 if (!requirement_found) {
4397 requirement_failed = TRUE;
4398 break;
4399 }
4400 }
4401 }
4402
4403 if (requirement_failed) {
4404 // Agent requirement failed. Clear out the whole result, make everything fail.
4405 memset(result, 0, sizeof(*result));
4406 if (route != NULL) {
4407 rtfree(route);
4408 }
4409 return TRUE;
4410 }
4411 }
4412
4413 // Reset current route
4414 NECP_CLIENT_ROUTE_LOCK(client);
4415 if (client->current_route != NULL) {
4416 rtfree(client->current_route);
4417 }
4418 client->current_route = route;
4419 NECP_CLIENT_ROUTE_UNLOCK(client);
4420 } else {
4421 // Interface not found. Clear out the whole result, make everything fail.
4422 memset(result, 0, sizeof(*result));
4423 }
4424
4425 return TRUE;
4426 }
4427
4428 #define NECP_PARSED_PARAMETERS_REQUIRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF | \
4429 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
4430 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
4431 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE)
4432
4433 static bool
necp_update_client_result(proc_t proc,struct necp_fd_data * client_fd,struct necp_client * client,struct _necp_flow_defunct_list * defunct_list)4434 necp_update_client_result(proc_t proc,
4435 struct necp_fd_data *client_fd,
4436 struct necp_client *client,
4437 struct _necp_flow_defunct_list *defunct_list)
4438 {
4439 struct necp_client_result_netagent netagent;
4440 struct necp_aggregate_result result;
4441 struct necp_client_parsed_parameters *parsed_parameters = NULL;
4442 u_int32_t flags = 0;
4443 u_int32_t reason = 0;
4444
4445 NECP_CLIENT_ASSERT_LOCKED(client);
4446
4447 parsed_parameters = kalloc_type(struct necp_client_parsed_parameters,
4448 Z_WAITOK | Z_ZERO | Z_NOFAIL);
4449
4450 // Nexus flows will be brought back if they are still valid
4451 necp_client_mark_all_nonsocket_flows_as_invalid(client);
4452
4453 int error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, parsed_parameters);
4454 if (error != 0) {
4455 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4456 return FALSE;
4457 }
4458
4459 // Update saved IP protocol
4460 client->ip_protocol = parsed_parameters->ip_protocol;
4461
4462 // Calculate the policy result
4463 struct necp_client_endpoint v4_gateway = {};
4464 struct necp_client_endpoint v6_gateway = {};
4465 uuid_t override_euuid;
4466 uuid_clear(override_euuid);
4467 if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags, &reason, &v4_gateway, &v6_gateway, &override_euuid)) {
4468 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4469 return FALSE;
4470 }
4471
4472 if (necp_update_parsed_parameters(parsed_parameters, &result)) {
4473 // Changed the parameters based on result, try again (only once)
4474 if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags, &reason, &v4_gateway, &v6_gateway, &override_euuid)) {
4475 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4476 return FALSE;
4477 }
4478 }
4479
4480 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
4481 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4482 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) {
4483 // Listener should not apply required interface index if
4484 parsed_parameters->required_interface_index = IFSCOPE_NONE;
4485 }
4486
4487 // Save the last policy id on the client
4488 client->policy_id = result.policy_id;
4489 client->skip_policy_id = result.skip_policy_id;
4490 uuid_copy(client->override_euuid, override_euuid);
4491
4492 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_MULTIPATH) ||
4493 (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) ||
4494 ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
4495 result.routing_result != NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED)) {
4496 client->allow_multiple_flows = TRUE;
4497 } else {
4498 client->allow_multiple_flows = FALSE;
4499 }
4500
4501 // If the original request was scoped, and the policy result matches, make sure the result is scoped
4502 if ((result.routing_result == NECP_KERNEL_POLICY_RESULT_NONE ||
4503 result.routing_result == NECP_KERNEL_POLICY_RESULT_PASS) &&
4504 result.routed_interface_index != IFSCOPE_NONE &&
4505 parsed_parameters->required_interface_index == result.routed_interface_index) {
4506 result.routing_result = NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED;
4507 result.routing_result_parameter.scoped_interface_index = result.routed_interface_index;
4508 }
4509
4510 if (defunct_list != NULL &&
4511 result.routing_result == NECP_KERNEL_POLICY_RESULT_DROP) {
4512 // If we are forced to drop the client, defunct it if it has flows
4513 necp_defunct_client_for_policy(client, defunct_list);
4514 }
4515
4516 // Recalculate flags
4517 if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
4518 // Listeners are valid as long as they aren't dropped
4519 if (result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP) {
4520 flags |= NECP_CLIENT_RESULT_FLAG_SATISFIED;
4521 }
4522 } else if (result.routed_interface_index != 0) {
4523 // Clients without flows determine viability based on having some routable interface
4524 flags |= NECP_CLIENT_RESULT_FLAG_SATISFIED;
4525 }
4526
4527 bool updated = FALSE;
4528 u_int8_t *cursor = client->result;
4529 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FLAGS, sizeof(flags), &flags, &updated, client->result, sizeof(client->result));
4530 if (reason != 0) {
4531 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_REASON, sizeof(reason), &reason, &updated, client->result, sizeof(client->result));
4532 }
4533 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_CLIENT_ID, sizeof(uuid_t), client->client_id, &updated,
4534 client->result, sizeof(client->result));
4535 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT, sizeof(result.routing_result), &result.routing_result, &updated,
4536 client->result, sizeof(client->result));
4537 if (result.routing_result_parameter.tunnel_interface_index != 0) {
4538 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER,
4539 sizeof(result.routing_result_parameter), &result.routing_result_parameter, &updated,
4540 client->result, sizeof(client->result));
4541 }
4542 if (result.filter_control_unit != 0) {
4543 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT,
4544 sizeof(result.filter_control_unit), &result.filter_control_unit, &updated,
4545 client->result, sizeof(client->result));
4546 }
4547 if (result.flow_divert_aggregate_unit != 0) {
4548 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FLOW_DIVERT_AGGREGATE_UNIT,
4549 sizeof(result.flow_divert_aggregate_unit), &result.flow_divert_aggregate_unit, &updated,
4550 client->result, sizeof(client->result));
4551 }
4552 if (result.routed_interface_index != 0) {
4553 u_int routed_interface_index = result.routed_interface_index;
4554 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
4555 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_REQUIRED_FIELDS) &&
4556 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4557 parsed_parameters->required_interface_index != result.routed_interface_index) {
4558 routed_interface_index = parsed_parameters->required_interface_index;
4559 }
4560
4561 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_INDEX,
4562 sizeof(routed_interface_index), &routed_interface_index, &updated,
4563 client->result, sizeof(client->result));
4564 }
4565 if (client_fd && client_fd->flags & NECP_OPEN_FLAG_BACKGROUND) {
4566 u_int32_t effective_traffic_class = SO_TC_BK_SYS;
4567 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS,
4568 sizeof(effective_traffic_class), &effective_traffic_class, &updated,
4569 client->result, sizeof(client->result));
4570 }
4571
4572 if (client_fd->background) {
4573 bool has_assigned_flow = FALSE;
4574 struct necp_client_flow_registration *flow_registration = NULL;
4575 struct necp_client_flow *search_flow = NULL;
4576 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
4577 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
4578 if (search_flow->assigned) {
4579 has_assigned_flow = TRUE;
4580 break;
4581 }
4582 }
4583 }
4584
4585 if (has_assigned_flow) {
4586 u_int32_t background = client_fd->background;
4587 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG,
4588 sizeof(background), &background, &updated,
4589 client->result, sizeof(client->result));
4590 }
4591 }
4592
4593 bool write_v4_gateway = !necp_client_endpoint_is_unspecified(&v4_gateway);
4594 bool write_v6_gateway = !necp_client_endpoint_is_unspecified(&v6_gateway);
4595
4596 NECP_CLIENT_ROUTE_LOCK(client);
4597 if (client->current_route != NULL) {
4598 const u_int32_t route_mtu = get_maxmtu(client->current_route);
4599 if (route_mtu != 0) {
4600 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_MTU,
4601 sizeof(route_mtu), &route_mtu, &updated,
4602 client->result, sizeof(client->result));
4603 }
4604 bool has_remote_addr = parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
4605 if (has_remote_addr && client->current_route->rt_gateway != NULL) {
4606 if (client->current_route->rt_gateway->sa_family == AF_INET) {
4607 write_v6_gateway = false;
4608 } else if (client->current_route->rt_gateway->sa_family == AF_INET6) {
4609 write_v4_gateway = false;
4610 }
4611 }
4612 }
4613 NECP_CLIENT_ROUTE_UNLOCK(client);
4614
4615 if (write_v4_gateway) {
4616 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_GATEWAY,
4617 sizeof(struct necp_client_endpoint), &v4_gateway, &updated,
4618 client->result, sizeof(client->result));
4619 }
4620
4621 if (write_v6_gateway) {
4622 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_GATEWAY,
4623 sizeof(struct necp_client_endpoint), &v6_gateway, &updated,
4624 client->result, sizeof(client->result));
4625 }
4626
4627 for (int i = 0; i < NAT64_MAX_NUM_PREFIXES; i++) {
4628 if (result.nat64_prefixes[i].prefix_len != 0) {
4629 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NAT64,
4630 sizeof(result.nat64_prefixes), result.nat64_prefixes, &updated,
4631 client->result, sizeof(client->result));
4632 break;
4633 }
4634 }
4635
4636 if (result.mss_recommended != 0) {
4637 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_RECOMMENDED_MSS,
4638 sizeof(result.mss_recommended), &result.mss_recommended, &updated,
4639 client->result, sizeof(client->result));
4640 }
4641
4642 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
4643 if (uuid_is_null(result.netagents[i])) {
4644 break;
4645 }
4646 if (result.netagent_use_flags[i] & NECP_AGENT_USE_FLAG_REMOVE) {
4647 // A removed agent, ignore
4648 continue;
4649 }
4650 uuid_copy(netagent.netagent_uuid, result.netagents[i]);
4651 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4652 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE, 0, 0)) {
4653 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4654 client->result, sizeof(client->result));
4655 }
4656 }
4657
4658 ifnet_head_lock_shared();
4659 ifnet_t direct_interface = NULL;
4660 ifnet_t delegate_interface = NULL;
4661 ifnet_t original_scoped_interface = NULL;
4662
4663 if (result.routed_interface_index != IFSCOPE_NONE && result.routed_interface_index <= (u_int32_t)if_index) {
4664 direct_interface = ifindex2ifnet[result.routed_interface_index];
4665 } else if (parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4666 parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
4667 // If the request was scoped, but the route didn't match, still grab the agents
4668 direct_interface = ifindex2ifnet[parsed_parameters->required_interface_index];
4669 } else if (result.routed_interface_index == IFSCOPE_NONE &&
4670 result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED &&
4671 result.routing_result_parameter.scoped_interface_index != IFSCOPE_NONE) {
4672 direct_interface = ifindex2ifnet[result.routing_result_parameter.scoped_interface_index];
4673 }
4674 if (direct_interface != NULL) {
4675 delegate_interface = direct_interface->if_delegated.ifp;
4676 }
4677 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
4678 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_REQUIRED_FIELDS) &&
4679 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4680 parsed_parameters->required_interface_index != result.routing_result_parameter.tunnel_interface_index &&
4681 parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
4682 original_scoped_interface = ifindex2ifnet[parsed_parameters->required_interface_index];
4683 }
4684 // Add interfaces
4685 if (original_scoped_interface != NULL) {
4686 struct necp_client_result_interface interface_struct;
4687 interface_struct.index = original_scoped_interface->if_index;
4688 interface_struct.generation = ifnet_get_generation(original_scoped_interface);
4689 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
4690 client->result, sizeof(client->result));
4691 }
4692 if (direct_interface != NULL) {
4693 struct necp_client_result_interface interface_struct;
4694 interface_struct.index = direct_interface->if_index;
4695 interface_struct.generation = ifnet_get_generation(direct_interface);
4696 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
4697 client->result, sizeof(client->result));
4698
4699 // Set the delta time since interface up/down
4700 struct timeval updown_delta = {};
4701 if (ifnet_updown_delta(direct_interface, &updown_delta) == 0) {
4702 u_int32_t delta = updown_delta.tv_sec;
4703 bool ignore_updated = FALSE;
4704 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_TIME_DELTA,
4705 sizeof(delta), &delta, &ignore_updated,
4706 client->result, sizeof(client->result));
4707 }
4708 }
4709 if (delegate_interface != NULL) {
4710 struct necp_client_result_interface interface_struct;
4711 interface_struct.index = delegate_interface->if_index;
4712 interface_struct.generation = ifnet_get_generation(delegate_interface);
4713 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
4714 client->result, sizeof(client->result));
4715 }
4716
4717 // Update multipath/listener interface flows
4718 if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_MULTIPATH) {
4719 // Add the interface option for the routed interface first
4720 if (direct_interface != NULL) {
4721 // Add nexus agent
4722 necp_client_add_agent_interface_options(client, parsed_parameters, direct_interface);
4723
4724 // Add interface option in case it is not a nexus
4725 necp_client_add_interface_option_if_needed(client, direct_interface->if_index,
4726 ifnet_get_generation(direct_interface), NULL, false);
4727 }
4728 if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INBOUND) {
4729 // For inbound multipath, add from the global list (like a listener)
4730 struct ifnet *multi_interface = NULL;
4731 TAILQ_FOREACH(multi_interface, &ifnet_head, if_link) {
4732 if ((multi_interface->if_flags & (IFF_UP | IFF_RUNNING)) &&
4733 necp_ifnet_matches_parameters(multi_interface, parsed_parameters, 0, NULL, true, false)) {
4734 // Add nexus agents for inbound multipath
4735 necp_client_add_agent_interface_options(client, parsed_parameters, multi_interface);
4736 }
4737 }
4738 } else {
4739 // Get other multipath interface options from ordered list
4740 struct ifnet *multi_interface = NULL;
4741 TAILQ_FOREACH(multi_interface, &ifnet_ordered_head, if_ordered_link) {
4742 if (multi_interface != direct_interface &&
4743 necp_ifnet_matches_parameters(multi_interface, parsed_parameters, 0, NULL, true, false)) {
4744 // Add nexus agents for multipath
4745 necp_client_add_agent_interface_options(client, parsed_parameters, multi_interface);
4746
4747 // Add multipath interface flows for kernel MPTCP
4748 necp_client_add_interface_option_if_needed(client, multi_interface->if_index,
4749 ifnet_get_generation(multi_interface), NULL, false);
4750 }
4751 }
4752 }
4753 } else if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
4754 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) {
4755 if (direct_interface != NULL) {
4756 // If scoped, only listen on that interface
4757 // Add nexus agents for listeners
4758 necp_client_add_agent_interface_options(client, parsed_parameters, direct_interface);
4759
4760 // Add interface option in case it is not a nexus
4761 necp_client_add_interface_option_if_needed(client, direct_interface->if_index,
4762 ifnet_get_generation(direct_interface), NULL, false);
4763 }
4764 } else {
4765 // Get listener interface options from global list
4766 struct ifnet *listen_interface = NULL;
4767 TAILQ_FOREACH(listen_interface, &ifnet_head, if_link) {
4768 if ((listen_interface->if_flags & (IFF_UP | IFF_RUNNING)) &&
4769 necp_ifnet_matches_parameters(listen_interface, parsed_parameters, 0, NULL, true, false)) {
4770 // Add nexus agents for listeners
4771 necp_client_add_agent_interface_options(client, parsed_parameters, listen_interface);
4772 }
4773 }
4774 }
4775 } else if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) {
4776 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) {
4777 if (direct_interface != NULL) {
4778 // Add browse option if it has an agent
4779 necp_client_add_browse_interface_options(client, parsed_parameters, direct_interface);
4780 }
4781 } else {
4782 // Get browse interface options from global list
4783 struct ifnet *browse_interface = NULL;
4784 TAILQ_FOREACH(browse_interface, &ifnet_head, if_link) {
4785 if (necp_ifnet_matches_parameters(browse_interface, parsed_parameters, 0, NULL, true, false)) {
4786 necp_client_add_browse_interface_options(client, parsed_parameters, browse_interface);
4787 }
4788 }
4789 }
4790 }
4791
4792 struct necp_client_result_estimated_throughput throughput = {
4793 .up = 0,
4794 .down = 0,
4795 };
4796
4797 // Add agents
4798 if (original_scoped_interface != NULL) {
4799 ifnet_lock_shared(original_scoped_interface);
4800 if (original_scoped_interface->if_agentids != NULL) {
4801 for (u_int32_t i = 0; i < original_scoped_interface->if_agentcount; i++) {
4802 if (uuid_is_null(original_scoped_interface->if_agentids[i])) {
4803 continue;
4804 }
4805 bool skip_agent = false;
4806 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4807 if (uuid_is_null(result.netagents[j])) {
4808 break;
4809 }
4810 if ((result.netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) &&
4811 uuid_compare(original_scoped_interface->if_agentids[i], result.netagents[j]) == 0) {
4812 skip_agent = true;
4813 break;
4814 }
4815 }
4816 if (skip_agent) {
4817 continue;
4818 }
4819 uuid_copy(netagent.netagent_uuid, original_scoped_interface->if_agentids[i]);
4820 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4821 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE,
4822 original_scoped_interface->if_index, ifnet_get_generation(original_scoped_interface))) {
4823 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4824 client->result, sizeof(client->result));
4825 }
4826 }
4827 }
4828 ifnet_lock_done(original_scoped_interface);
4829 }
4830 if (direct_interface != NULL) {
4831 ifnet_lock_shared(direct_interface);
4832 throughput.up = direct_interface->if_estimated_up_bucket;
4833 throughput.down = direct_interface->if_estimated_down_bucket;
4834 if (direct_interface->if_agentids != NULL) {
4835 for (u_int32_t i = 0; i < direct_interface->if_agentcount; i++) {
4836 if (uuid_is_null(direct_interface->if_agentids[i])) {
4837 continue;
4838 }
4839 bool skip_agent = false;
4840 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4841 if (uuid_is_null(result.netagents[j])) {
4842 break;
4843 }
4844 if ((result.netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) &&
4845 uuid_compare(direct_interface->if_agentids[i], result.netagents[j]) == 0) {
4846 skip_agent = true;
4847 break;
4848 }
4849 }
4850 if (skip_agent) {
4851 continue;
4852 }
4853 uuid_copy(netagent.netagent_uuid, direct_interface->if_agentids[i]);
4854 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4855 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE,
4856 direct_interface->if_index, ifnet_get_generation(direct_interface))) {
4857 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4858 client->result, sizeof(client->result));
4859 }
4860 }
4861 }
4862 ifnet_lock_done(direct_interface);
4863 }
4864 if (delegate_interface != NULL) {
4865 ifnet_lock_shared(delegate_interface);
4866 if (throughput.up == 0 && throughput.down == 0) {
4867 throughput.up = delegate_interface->if_estimated_up_bucket;
4868 throughput.down = delegate_interface->if_estimated_down_bucket;
4869 }
4870 if (delegate_interface->if_agentids != NULL) {
4871 for (u_int32_t i = 0; i < delegate_interface->if_agentcount; i++) {
4872 if (uuid_is_null(delegate_interface->if_agentids[i])) {
4873 continue;
4874 }
4875 bool skip_agent = false;
4876 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4877 if (uuid_is_null(result.netagents[j])) {
4878 break;
4879 }
4880 if ((result.netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) &&
4881 uuid_compare(delegate_interface->if_agentids[i], result.netagents[j]) == 0) {
4882 skip_agent = true;
4883 break;
4884 }
4885 }
4886 if (skip_agent) {
4887 continue;
4888 }
4889 uuid_copy(netagent.netagent_uuid, delegate_interface->if_agentids[i]);
4890 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4891 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE,
4892 delegate_interface->if_index, ifnet_get_generation(delegate_interface))) {
4893 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4894 client->result, sizeof(client->result));
4895 }
4896 }
4897 }
4898 ifnet_lock_done(delegate_interface);
4899 }
4900 ifnet_head_done();
4901
4902 if (throughput.up != 0 || throughput.down != 0) {
4903 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_ESTIMATED_THROUGHPUT,
4904 sizeof(throughput), &throughput, &updated, client->result, sizeof(client->result));
4905 }
4906
4907 // Add interface options
4908 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
4909 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
4910 struct necp_client_interface_option *option = &client->interface_options[option_i];
4911 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated,
4912 client->result, sizeof(client->result));
4913 } else {
4914 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
4915 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated,
4916 client->result, sizeof(client->result));
4917 }
4918 }
4919
4920 size_t new_result_length = (cursor - client->result);
4921 if (new_result_length != client->result_length) {
4922 client->result_length = new_result_length;
4923 updated = TRUE;
4924 }
4925
4926 // Update flow viability/flags
4927 if (necp_client_update_flows(proc, client, defunct_list)) {
4928 updated = TRUE;
4929 }
4930
4931 if (updated) {
4932 client->result_read = FALSE;
4933 necp_client_update_observer_update(client);
4934 }
4935
4936 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4937 return updated;
4938 }
4939
4940 static bool
necp_defunct_client_fd_locked_inner(struct necp_fd_data * client_fd,struct _necp_flow_defunct_list * defunct_list,bool destroy_stats)4941 necp_defunct_client_fd_locked_inner(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, bool destroy_stats)
4942 {
4943 bool updated_result = FALSE;
4944 struct necp_client *client = NULL;
4945
4946 NECP_FD_ASSERT_LOCKED(client_fd);
4947
4948 RB_FOREACH(client, _necp_client_tree, &client_fd->clients) {
4949 struct necp_client_flow_registration *flow_registration = NULL;
4950
4951 NECP_CLIENT_LOCK(client);
4952
4953 // Prepare close events to be sent to the nexus to effectively remove the flows
4954 struct necp_client_flow *search_flow = NULL;
4955 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
4956 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
4957 if (search_flow->nexus &&
4958 !uuid_is_null(search_flow->u.nexus_agent)) {
4959 // Sleeping alloc won't fail; copy only what's necessary
4960 struct necp_flow_defunct *flow_defunct = kalloc_type(struct necp_flow_defunct, Z_WAITOK | Z_ZERO);
4961 uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent);
4962 uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
4963 client->client_id :
4964 flow_registration->registration_id));
4965 flow_defunct->proc_pid = client->proc_pid;
4966 flow_defunct->agent_handle = client->agent_handle;
4967 flow_defunct->flags = flow_registration->flags;
4968 #if SKYWALK
4969 if (flow_registration->kstats_kaddr != NULL) {
4970 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
4971 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
4972 if (quicstats != NULL &&
4973 quicstats->necp_quic_udp_stats.necp_udp_hdr.necp_stats_type == NECP_CLIENT_STATISTICS_TYPE_QUIC) {
4974 memcpy(flow_defunct->close_parameters.u.close_token, quicstats->necp_quic_extra.ssr_token, sizeof(flow_defunct->close_parameters.u.close_token));
4975 flow_defunct->has_close_parameters = true;
4976 }
4977 }
4978 #endif /* SKYWALK */
4979 // Add to the list provided by caller
4980 LIST_INSERT_HEAD(defunct_list, flow_defunct, chain);
4981
4982 flow_registration->defunct = true;
4983 flow_registration->flow_result_read = false;
4984 updated_result = true;
4985 }
4986 }
4987 }
4988 if (destroy_stats) {
4989 #if SKYWALK
4990 // Free any remaining stats objects back to the arena where they came from;
4991 // do this independent of the above defunct check, as the client may have
4992 // been marked as defunct separately via necp_defunct_client_for_policy().
4993 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
4994 necp_destroy_flow_stats(client_fd, flow_registration, NULL, FALSE);
4995 }
4996 #endif /* SKYWALK */
4997 }
4998 NECP_CLIENT_UNLOCK(client);
4999 }
5000
5001 return updated_result;
5002 }
5003
5004 static inline void
necp_defunct_client_fd_locked(struct necp_fd_data * client_fd,struct _necp_flow_defunct_list * defunct_list,struct proc * proc)5005 necp_defunct_client_fd_locked(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, struct proc *proc)
5006 {
5007 #pragma unused(proc)
5008 bool updated_result = FALSE;
5009
5010 NECP_FD_ASSERT_LOCKED(client_fd);
5011 #if SKYWALK
5012 // redirect regions of currently-active stats arena to zero-filled pages
5013 struct necp_arena_info *nai = necp_fd_mredirect_stats_arena(client_fd, proc);
5014 #endif /* SKYWALK */
5015
5016 updated_result = necp_defunct_client_fd_locked_inner(client_fd, defunct_list, true);
5017
5018 #if SKYWALK
5019 // and tear down the currently-active arena's regions now that the redirection and freeing are done
5020 if (nai != NULL) {
5021 ASSERT((nai->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT)) == NAIF_REDIRECT);
5022 ASSERT(nai->nai_arena != NULL);
5023 ASSERT(nai->nai_mmap.ami_mapref != NULL);
5024
5025 int err = skmem_arena_defunct(nai->nai_arena);
5026 VERIFY(err == 0);
5027
5028 nai->nai_flags |= NAIF_DEFUNCT;
5029 }
5030 #endif /* SKYWALK */
5031
5032 if (updated_result) {
5033 necp_fd_notify(client_fd, true);
5034 }
5035 }
5036
5037 static inline void
necp_update_client_fd_locked(struct necp_fd_data * client_fd,proc_t proc,struct _necp_flow_defunct_list * defunct_list)5038 necp_update_client_fd_locked(struct necp_fd_data *client_fd,
5039 proc_t proc,
5040 struct _necp_flow_defunct_list *defunct_list)
5041 {
5042 struct necp_client *client = NULL;
5043 bool updated_result = FALSE;
5044 NECP_FD_ASSERT_LOCKED(client_fd);
5045 RB_FOREACH(client, _necp_client_tree, &client_fd->clients) {
5046 NECP_CLIENT_LOCK(client);
5047 if (necp_update_client_result(proc, client_fd, client, defunct_list)) {
5048 updated_result = TRUE;
5049 }
5050 NECP_CLIENT_UNLOCK(client);
5051 }
5052
5053 // Check if this PID needs to request in-process flow divert
5054 NECP_FD_LIST_ASSERT_LOCKED();
5055 for (int i = 0; i < NECP_MAX_FLOW_DIVERT_NEEDED_PIDS; i++) {
5056 if (necp_flow_divert_needed_pids[i] == 0) {
5057 break;
5058 }
5059 if (necp_flow_divert_needed_pids[i] == client_fd->proc_pid) {
5060 client_fd->request_in_process_flow_divert = true;
5061 break;
5062 }
5063 }
5064
5065 if (updated_result || client_fd->request_in_process_flow_divert) {
5066 necp_fd_notify(client_fd, true);
5067 }
5068 }
5069
5070 #if SKYWALK
5071 static void
necp_close_empty_arenas_callout(__unused thread_call_param_t dummy,__unused thread_call_param_t arg)5072 necp_close_empty_arenas_callout(__unused thread_call_param_t dummy,
5073 __unused thread_call_param_t arg)
5074 {
5075 struct necp_fd_data *client_fd = NULL;
5076
5077 NECP_FD_LIST_LOCK_SHARED();
5078
5079 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
5080 NECP_FD_LOCK(client_fd);
5081 necp_stats_arenas_destroy(client_fd, FALSE);
5082 NECP_FD_UNLOCK(client_fd);
5083 }
5084
5085 NECP_FD_LIST_UNLOCK();
5086 }
5087 #endif /* SKYWALK */
5088
5089 static void
necp_update_all_clients_callout(__unused thread_call_param_t dummy,__unused thread_call_param_t arg)5090 necp_update_all_clients_callout(__unused thread_call_param_t dummy,
5091 __unused thread_call_param_t arg)
5092 {
5093 struct necp_fd_data *client_fd = NULL;
5094
5095 NECP_UPDATE_ALL_CLIENTS_LOCK_EXCLUSIVE();
5096 uint32_t count = necp_update_all_clients_sched_cnt;
5097 necp_update_all_clients_sched_cnt = 0;
5098 necp_update_all_clients_sched_abstime = 0;
5099 NECP_UPDATE_ALL_CLIENTS_UNLOCK();
5100
5101 if (necp_debug > 0) {
5102 NECPLOG(LOG_DEBUG,
5103 "necp_update_all_clients_callout running for coalesced %u updates",
5104 count);
5105 }
5106
5107 struct _necp_flow_defunct_list defunct_list;
5108 LIST_INIT(&defunct_list);
5109
5110 NECP_FD_LIST_LOCK_SHARED();
5111
5112 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
5113 proc_t proc = proc_find(client_fd->proc_pid);
5114 if (proc == PROC_NULL) {
5115 continue;
5116 }
5117
5118 // Update all clients on one fd
5119 NECP_FD_LOCK(client_fd);
5120 necp_update_client_fd_locked(client_fd, proc, &defunct_list);
5121 NECP_FD_UNLOCK(client_fd);
5122
5123 proc_rele(proc);
5124 proc = PROC_NULL;
5125 }
5126
5127 // Reset the necp_flow_divert_needed_pids list
5128 for (int i = 0; i < NECP_MAX_FLOW_DIVERT_NEEDED_PIDS; i++) {
5129 necp_flow_divert_needed_pids[i] = 0;
5130 }
5131
5132 NECP_FD_LIST_UNLOCK();
5133
5134 // Handle the case in which some clients became newly defunct
5135 necp_process_defunct_list(&defunct_list);
5136 }
5137
5138 void
necp_update_all_clients(void)5139 necp_update_all_clients(void)
5140 {
5141 necp_update_all_clients_immediately_if_needed(false);
5142 }
5143
5144 void
necp_update_all_clients_immediately_if_needed(bool should_update_immediately)5145 necp_update_all_clients_immediately_if_needed(bool should_update_immediately)
5146 {
5147 if (necp_client_update_tcall == NULL) {
5148 // Don't try to update clients if the module is not initialized
5149 return;
5150 }
5151
5152 uint64_t deadline = 0;
5153 uint64_t leeway = 0;
5154
5155 uint32_t timeout_to_use = necp_timeout_microseconds;
5156 uint32_t leeway_to_use = necp_timeout_leeway_microseconds;
5157 if (should_update_immediately) {
5158 timeout_to_use = 1000 * 10; // 10ms
5159 leeway_to_use = 1000 * 10; // 10ms;
5160 }
5161
5162 clock_interval_to_deadline(timeout_to_use, NSEC_PER_USEC, &deadline);
5163 clock_interval_to_absolutetime_interval(leeway_to_use, NSEC_PER_USEC, &leeway);
5164
5165 NECP_UPDATE_ALL_CLIENTS_LOCK_EXCLUSIVE();
5166 bool need_cancel = false;
5167 bool need_schedule = true;
5168 uint64_t sched_abstime;
5169
5170 clock_absolutetime_interval_to_deadline(deadline + leeway, &sched_abstime);
5171
5172 /*
5173 * Do not push the timer if it is already scheduled
5174 */
5175 if (necp_update_all_clients_sched_abstime != 0) {
5176 need_schedule = false;
5177
5178 if (should_update_immediately) {
5179 /*
5180 * To update immediately we may have to cancel the current timer
5181 * if it's scheduled too far out.
5182 */
5183 if (necp_update_all_clients_sched_abstime > sched_abstime) {
5184 need_cancel = true;
5185 need_schedule = true;
5186 }
5187 }
5188 }
5189
5190 /*
5191 * Record the time of the deadline with leeway
5192 */
5193 if (need_schedule) {
5194 necp_update_all_clients_sched_abstime = sched_abstime;
5195 }
5196
5197 necp_update_all_clients_sched_cnt += 1;
5198 uint32_t count = necp_update_all_clients_sched_cnt;
5199 NECP_UPDATE_ALL_CLIENTS_UNLOCK();
5200
5201 if (need_schedule) {
5202 /*
5203 * Wait if the thread call is currently executing to make sure the
5204 * next update will be delivered to all clients
5205 */
5206 if (need_cancel) {
5207 (void) thread_call_cancel_wait(necp_client_update_tcall);
5208 }
5209
5210 (void) thread_call_enter_delayed_with_leeway(necp_client_update_tcall, NULL,
5211 deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
5212 }
5213 if (necp_debug > 0) {
5214 NECPLOG(LOG_DEBUG,
5215 "necp_update_all_clients immediate %s update %u",
5216 should_update_immediately ? "true" : "false", count);
5217 }
5218 }
5219
5220 bool
necp_set_client_as_background(proc_t proc,struct fileproc * fp,bool background)5221 necp_set_client_as_background(proc_t proc,
5222 struct fileproc *fp,
5223 bool background)
5224 {
5225 if (proc == PROC_NULL) {
5226 NECPLOG0(LOG_ERR, "NULL proc");
5227 return FALSE;
5228 }
5229
5230 if (fp == NULL) {
5231 NECPLOG0(LOG_ERR, "NULL fp");
5232 return FALSE;
5233 }
5234
5235 struct necp_fd_data *client_fd = (struct necp_fd_data *)fp_get_data(fp);
5236 if (client_fd == NULL) {
5237 NECPLOG0(LOG_ERR, "Could not find client structure for backgrounded client");
5238 return FALSE;
5239 }
5240
5241 if (client_fd->necp_fd_type != necp_fd_type_client) {
5242 // Not a client fd, ignore
5243 NECPLOG0(LOG_ERR, "Not a client fd, ignore");
5244 return FALSE;
5245 }
5246
5247 client_fd->background = background;
5248
5249 return TRUE;
5250 }
5251
5252 void
necp_fd_memstatus(proc_t proc,uint32_t status,struct necp_fd_data * client_fd)5253 necp_fd_memstatus(proc_t proc, uint32_t status,
5254 struct necp_fd_data *client_fd)
5255 {
5256 #pragma unused(proc, status, client_fd)
5257 ASSERT(proc != PROC_NULL);
5258 ASSERT(client_fd != NULL);
5259
5260 // Nothing to reap for the process or client for now,
5261 // but this is where we would trigger that in future.
5262 }
5263
5264 void
necp_fd_defunct(proc_t proc,struct necp_fd_data * client_fd)5265 necp_fd_defunct(proc_t proc, struct necp_fd_data *client_fd)
5266 {
5267 struct _necp_flow_defunct_list defunct_list;
5268
5269 ASSERT(proc != PROC_NULL);
5270 ASSERT(client_fd != NULL);
5271
5272 if (client_fd->necp_fd_type != necp_fd_type_client) {
5273 // Not a client fd, ignore
5274 return;
5275 }
5276
5277 // Our local temporary list
5278 LIST_INIT(&defunct_list);
5279
5280 // Need to hold lock so ntstats defunct the same set of clients
5281 NECP_FD_LOCK(client_fd);
5282 #if SKYWALK
5283 // Shut down statistics
5284 nstats_userland_stats_defunct_for_process(proc_getpid(proc));
5285 #endif /* SKYWALK */
5286 necp_defunct_client_fd_locked(client_fd, &defunct_list, proc);
5287 NECP_FD_UNLOCK(client_fd);
5288
5289 necp_process_defunct_list(&defunct_list);
5290 }
5291
5292 void
necp_client_request_in_process_flow_divert(pid_t pid)5293 necp_client_request_in_process_flow_divert(pid_t pid)
5294 {
5295 if (pid == 0) {
5296 return;
5297 }
5298
5299 // Add to the list of pids that should get an update. These will
5300 // get picked up on the next thread call to update client paths.
5301 NECP_FD_LIST_LOCK_SHARED();
5302 for (int i = 0; i < NECP_MAX_FLOW_DIVERT_NEEDED_PIDS; i++) {
5303 if (necp_flow_divert_needed_pids[i] == 0) {
5304 necp_flow_divert_needed_pids[i] = pid;
5305 break;
5306 }
5307 }
5308 NECP_FD_LIST_UNLOCK();
5309 }
5310
5311 static void
necp_client_remove_agent_from_result(struct necp_client * client,uuid_t netagent_uuid)5312 necp_client_remove_agent_from_result(struct necp_client *client, uuid_t netagent_uuid)
5313 {
5314 size_t offset = 0;
5315
5316 u_int8_t *result_buffer = client->result;
5317 while ((offset + sizeof(struct necp_tlv_header)) <= client->result_length) {
5318 u_int8_t type = necp_buffer_get_tlv_type(result_buffer, offset);
5319 u_int32_t length = necp_buffer_get_tlv_length(result_buffer, offset);
5320
5321 size_t tlv_total_length = (sizeof(struct necp_tlv_header) + length);
5322 if (type == NECP_CLIENT_RESULT_NETAGENT &&
5323 length == sizeof(struct necp_client_result_netagent) &&
5324 (offset + tlv_total_length) <= client->result_length) {
5325 struct necp_client_result_netagent *value = ((struct necp_client_result_netagent *)(void *)
5326 necp_buffer_get_tlv_value(result_buffer, offset, NULL));
5327 if (uuid_compare(value->netagent_uuid, netagent_uuid) == 0) {
5328 // Found a netagent to remove
5329 // Shift bytes down to remove the tlv, and adjust total length
5330 // Don't adjust the current offset
5331 memmove(result_buffer + offset,
5332 result_buffer + offset + tlv_total_length,
5333 client->result_length - (offset + tlv_total_length));
5334 client->result_length -= tlv_total_length;
5335 memset(result_buffer + client->result_length, 0, sizeof(client->result) - client->result_length);
5336 continue;
5337 }
5338 }
5339
5340 offset += tlv_total_length;
5341 }
5342 }
5343
5344 void
necp_force_update_client(uuid_t client_id,uuid_t remove_netagent_uuid,u_int32_t agent_generation)5345 necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid, u_int32_t agent_generation)
5346 {
5347 struct necp_fd_data *client_fd = NULL;
5348
5349 NECP_FD_LIST_LOCK_SHARED();
5350
5351 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
5352 bool updated_result = FALSE;
5353 NECP_FD_LOCK(client_fd);
5354 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
5355 if (client != NULL) {
5356 client->failed_trigger_agent.generation = agent_generation;
5357 uuid_copy(client->failed_trigger_agent.netagent_uuid, remove_netagent_uuid);
5358 if (!uuid_is_null(remove_netagent_uuid)) {
5359 necp_client_remove_agent_from_result(client, remove_netagent_uuid);
5360 }
5361 client->result_read = FALSE;
5362 // Found the client, break
5363 updated_result = TRUE;
5364 NECP_CLIENT_UNLOCK(client);
5365 }
5366 if (updated_result) {
5367 necp_fd_notify(client_fd, true);
5368 }
5369 NECP_FD_UNLOCK(client_fd);
5370 if (updated_result) {
5371 // Found the client, break
5372 break;
5373 }
5374 }
5375
5376 NECP_FD_LIST_UNLOCK();
5377 }
5378
5379 #if SKYWALK
5380 void
necp_client_early_close(uuid_t client_id)5381 necp_client_early_close(uuid_t client_id)
5382 {
5383 NECP_CLIENT_TREE_LOCK_SHARED();
5384
5385 struct necp_client *client = necp_find_client_and_lock(client_id);
5386 if (client != NULL) {
5387 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
5388 if (flow_registration != NULL) {
5389 // Found the right client and flow, mark the stats as over
5390 if (flow_registration->stats_handler_context != NULL) {
5391 ntstat_userland_stats_event(flow_registration->stats_handler_context,
5392 NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT);
5393 }
5394 }
5395 NECP_CLIENT_UNLOCK(client);
5396 }
5397
5398 NECP_CLIENT_TREE_UNLOCK();
5399 }
5400 #endif /* SKYWALK */
5401
5402 /// Interface matching
5403
5404 #define NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
5405 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF | \
5406 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
5407 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE | \
5408 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
5409 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT | \
5410 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
5411 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \
5412 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \
5413 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE | \
5414 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \
5415 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
5416
5417 #define NECP_PARSED_PARAMETERS_SCOPED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
5418 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
5419 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
5420 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
5421 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \
5422 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE)
5423
5424 #define NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
5425 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)
5426
5427 #define NECP_PARSED_PARAMETERS_PREFERRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
5428 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \
5429 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \
5430 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
5431
5432 static bool
necp_ifnet_matches_type(struct ifnet * ifp,u_int8_t interface_type,bool check_delegates)5433 necp_ifnet_matches_type(struct ifnet *ifp, u_int8_t interface_type, bool check_delegates)
5434 {
5435 struct ifnet *check_ifp = ifp;
5436 while (check_ifp) {
5437 if (if_functional_type(check_ifp, TRUE) == interface_type) {
5438 return TRUE;
5439 }
5440 if (!check_delegates) {
5441 break;
5442 }
5443 check_ifp = check_ifp->if_delegated.ifp;
5444 }
5445 return FALSE;
5446 }
5447
5448 static bool
necp_ifnet_matches_name(struct ifnet * ifp,const char * interface_name,bool check_delegates)5449 necp_ifnet_matches_name(struct ifnet *ifp, const char *interface_name, bool check_delegates)
5450 {
5451 struct ifnet *check_ifp = ifp;
5452 while (check_ifp) {
5453 if (strncmp(check_ifp->if_xname, interface_name, IFXNAMSIZ) == 0) {
5454 return TRUE;
5455 }
5456 if (!check_delegates) {
5457 break;
5458 }
5459 check_ifp = check_ifp->if_delegated.ifp;
5460 }
5461 return FALSE;
5462 }
5463
5464 static bool
necp_ifnet_matches_agent(struct ifnet * ifp,uuid_t * agent_uuid,bool check_delegates)5465 necp_ifnet_matches_agent(struct ifnet *ifp, uuid_t *agent_uuid, bool check_delegates)
5466 {
5467 struct ifnet *check_ifp = ifp;
5468
5469 while (check_ifp != NULL) {
5470 ifnet_lock_shared(check_ifp);
5471 if (check_ifp->if_agentids != NULL) {
5472 for (u_int32_t index = 0; index < check_ifp->if_agentcount; index++) {
5473 if (uuid_compare(check_ifp->if_agentids[index], *agent_uuid) == 0) {
5474 ifnet_lock_done(check_ifp);
5475 return TRUE;
5476 }
5477 }
5478 }
5479 ifnet_lock_done(check_ifp);
5480
5481 if (!check_delegates) {
5482 break;
5483 }
5484 check_ifp = check_ifp->if_delegated.ifp;
5485 }
5486 return FALSE;
5487 }
5488
5489 static bool
necp_ifnet_matches_agent_type(struct ifnet * ifp,const char * agent_domain,const char * agent_type,bool check_delegates)5490 necp_ifnet_matches_agent_type(struct ifnet *ifp, const char *agent_domain, const char *agent_type, bool check_delegates)
5491 {
5492 struct ifnet *check_ifp = ifp;
5493
5494 while (check_ifp != NULL) {
5495 ifnet_lock_shared(check_ifp);
5496 if (check_ifp->if_agentids != NULL) {
5497 for (u_int32_t index = 0; index < check_ifp->if_agentcount; index++) {
5498 if (uuid_is_null(check_ifp->if_agentids[index])) {
5499 continue;
5500 }
5501
5502 char if_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
5503 char if_agent_type[NETAGENT_TYPESIZE] = { 0 };
5504
5505 if (netagent_get_agent_domain_and_type(check_ifp->if_agentids[index], if_agent_domain, if_agent_type)) {
5506 if (necp_agent_types_match(agent_domain, agent_type, if_agent_domain, if_agent_type)) {
5507 ifnet_lock_done(check_ifp);
5508 return TRUE;
5509 }
5510 }
5511 }
5512 }
5513 ifnet_lock_done(check_ifp);
5514
5515 if (!check_delegates) {
5516 break;
5517 }
5518 check_ifp = check_ifp->if_delegated.ifp;
5519 }
5520 return FALSE;
5521 }
5522
5523 static bool
necp_ifnet_matches_local_address(struct ifnet * ifp,struct sockaddr * sa)5524 necp_ifnet_matches_local_address(struct ifnet *ifp, struct sockaddr *sa)
5525 {
5526 struct ifaddr *ifa = NULL;
5527 bool matched_local_address = FALSE;
5528
5529 // Transform sa into the ifaddr form
5530 // IPv6 Scope IDs are always embedded in the ifaddr list
5531 struct sockaddr_storage address;
5532 u_int ifscope = IFSCOPE_NONE;
5533 (void)sa_copy(sa, &address, &ifscope);
5534 SIN(&address)->sin_port = 0;
5535 if (address.ss_family == AF_INET6) {
5536 if (in6_embedded_scope ||
5537 !IN6_IS_SCOPE_EMBED(&SIN6(&address)->sin6_addr)) {
5538 SIN6(&address)->sin6_scope_id = 0;
5539 }
5540 }
5541
5542 ifa = ifa_ifwithaddr_scoped_locked((struct sockaddr *)&address, ifp->if_index);
5543 matched_local_address = (ifa != NULL);
5544
5545 if (ifa) {
5546 ifaddr_release(ifa);
5547 }
5548
5549 return matched_local_address;
5550 }
5551
5552 static bool
necp_interface_type_should_match_unranked_interfaces(u_int8_t interface_type)5553 necp_interface_type_should_match_unranked_interfaces(u_int8_t interface_type)
5554 {
5555 switch (interface_type) {
5556 // These are the interface types we allow a client to request even if the matching
5557 // interface isn't currently eligible to be primary (has default route, dns, etc)
5558 case IFRTYPE_FUNCTIONAL_WIFI_AWDL:
5559 case IFRTYPE_FUNCTIONAL_INTCOPROC:
5560 case IFRTYPE_FUNCTIONAL_COMPANIONLINK:
5561 return true;
5562 default:
5563 break;
5564 }
5565 return false;
5566 }
5567
5568 #define NECP_IFP_IS_ON_ORDERED_LIST(_ifp) ((_ifp)->if_ordered_link.tqe_next != NULL || (_ifp)->if_ordered_link.tqe_prev != NULL)
5569
5570 // Secondary interface flag indicates that the interface is being
5571 // used for multipath or a listener as an extra path
5572 static bool
necp_ifnet_matches_parameters(struct ifnet * ifp,struct necp_client_parsed_parameters * parsed_parameters,u_int32_t override_flags,u_int32_t * preferred_count,bool secondary_interface,bool require_scoped_field)5573 necp_ifnet_matches_parameters(struct ifnet *ifp,
5574 struct necp_client_parsed_parameters *parsed_parameters,
5575 u_int32_t override_flags,
5576 u_int32_t *preferred_count,
5577 bool secondary_interface,
5578 bool require_scoped_field)
5579 {
5580 bool matched_some_scoped_field = FALSE;
5581
5582 if (preferred_count) {
5583 *preferred_count = 0;
5584 }
5585
5586 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) {
5587 if (parsed_parameters->required_interface_index != ifp->if_index) {
5588 return FALSE;
5589 }
5590 }
5591 #if SKYWALK
5592 else {
5593 if (ifnet_is_low_latency(ifp)) {
5594 return FALSE;
5595 }
5596 }
5597 #endif /* SKYWALK */
5598
5599 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR) {
5600 if (!necp_ifnet_matches_local_address(ifp, SA(&parsed_parameters->local_addr.sa))) {
5601 return FALSE;
5602 }
5603 if (require_scoped_field) {
5604 matched_some_scoped_field = TRUE;
5605 }
5606 }
5607
5608 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) {
5609 if (override_flags != 0) {
5610 if ((override_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) &&
5611 IFNET_IS_EXPENSIVE(ifp)) {
5612 return FALSE;
5613 }
5614 if ((override_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED) &&
5615 IFNET_IS_CONSTRAINED(ifp)) {
5616 return FALSE;
5617 }
5618 } else {
5619 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) &&
5620 IFNET_IS_EXPENSIVE(ifp)) {
5621 return FALSE;
5622 }
5623 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED) &&
5624 IFNET_IS_CONSTRAINED(ifp)) {
5625 return FALSE;
5626 }
5627 }
5628 }
5629
5630 if ((!secondary_interface || // Enforce interface type if this is the primary interface
5631 !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) || // or if there are no flags
5632 !(parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE)) && // or if the flags don't give an exception
5633 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) &&
5634 !necp_ifnet_matches_type(ifp, parsed_parameters->required_interface_type, FALSE)) {
5635 return FALSE;
5636 }
5637
5638 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) {
5639 if (require_scoped_field) {
5640 matched_some_scoped_field = TRUE;
5641 }
5642 }
5643
5644 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE) {
5645 for (int i = 0; i < NECP_MAX_INTERFACE_PARAMETERS; i++) {
5646 if (parsed_parameters->prohibited_interface_types[i] == 0) {
5647 break;
5648 }
5649
5650 if (necp_ifnet_matches_type(ifp, parsed_parameters->prohibited_interface_types[i], TRUE)) {
5651 return FALSE;
5652 }
5653 }
5654 }
5655
5656 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF) {
5657 for (int i = 0; i < NECP_MAX_INTERFACE_PARAMETERS; i++) {
5658 if (strlen(parsed_parameters->prohibited_interfaces[i]) == 0) {
5659 break;
5660 }
5661
5662 if (necp_ifnet_matches_name(ifp, parsed_parameters->prohibited_interfaces[i], TRUE)) {
5663 return FALSE;
5664 }
5665 }
5666 }
5667
5668 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
5669 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5670 if (uuid_is_null(parsed_parameters->required_netagents[i])) {
5671 break;
5672 }
5673
5674 if (!necp_ifnet_matches_agent(ifp, &parsed_parameters->required_netagents[i], FALSE)) {
5675 return FALSE;
5676 }
5677
5678 if (require_scoped_field) {
5679 matched_some_scoped_field = TRUE;
5680 }
5681 }
5682 }
5683
5684 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT) {
5685 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5686 if (uuid_is_null(parsed_parameters->prohibited_netagents[i])) {
5687 break;
5688 }
5689
5690 if (necp_ifnet_matches_agent(ifp, &parsed_parameters->prohibited_netagents[i], TRUE)) {
5691 return FALSE;
5692 }
5693 }
5694 }
5695
5696 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
5697 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5698 if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 &&
5699 strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
5700 break;
5701 }
5702
5703 if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->required_netagent_types[i].netagent_domain, parsed_parameters->required_netagent_types[i].netagent_type, FALSE)) {
5704 return FALSE;
5705 }
5706
5707 if (require_scoped_field) {
5708 matched_some_scoped_field = TRUE;
5709 }
5710 }
5711 }
5712
5713 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE) {
5714 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5715 if (strlen(parsed_parameters->prohibited_netagent_types[i].netagent_domain) == 0 &&
5716 strlen(parsed_parameters->prohibited_netagent_types[i].netagent_type) == 0) {
5717 break;
5718 }
5719
5720 if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->prohibited_netagent_types[i].netagent_domain, parsed_parameters->prohibited_netagent_types[i].netagent_type, TRUE)) {
5721 return FALSE;
5722 }
5723 }
5724 }
5725
5726 // Checked preferred properties
5727 if (preferred_count) {
5728 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT) {
5729 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5730 if (uuid_is_null(parsed_parameters->preferred_netagents[i])) {
5731 break;
5732 }
5733
5734 if (necp_ifnet_matches_agent(ifp, &parsed_parameters->preferred_netagents[i], TRUE)) {
5735 (*preferred_count)++;
5736 if (require_scoped_field) {
5737 matched_some_scoped_field = TRUE;
5738 }
5739 }
5740 }
5741 }
5742
5743 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE) {
5744 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5745 if (strlen(parsed_parameters->preferred_netagent_types[i].netagent_domain) == 0 &&
5746 strlen(parsed_parameters->preferred_netagent_types[i].netagent_type) == 0) {
5747 break;
5748 }
5749
5750 if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->preferred_netagent_types[i].netagent_domain, parsed_parameters->preferred_netagent_types[i].netagent_type, TRUE)) {
5751 (*preferred_count)++;
5752 if (require_scoped_field) {
5753 matched_some_scoped_field = TRUE;
5754 }
5755 }
5756 }
5757 }
5758
5759 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT) {
5760 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5761 if (uuid_is_null(parsed_parameters->avoided_netagents[i])) {
5762 break;
5763 }
5764
5765 if (!necp_ifnet_matches_agent(ifp, &parsed_parameters->avoided_netagents[i], TRUE)) {
5766 (*preferred_count)++;
5767 }
5768 }
5769 }
5770
5771 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE) {
5772 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5773 if (strlen(parsed_parameters->avoided_netagent_types[i].netagent_domain) == 0 &&
5774 strlen(parsed_parameters->avoided_netagent_types[i].netagent_type) == 0) {
5775 break;
5776 }
5777
5778 if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->avoided_netagent_types[i].netagent_domain,
5779 parsed_parameters->avoided_netagent_types[i].netagent_type, TRUE)) {
5780 (*preferred_count)++;
5781 }
5782 }
5783 }
5784 }
5785
5786 if (require_scoped_field) {
5787 return matched_some_scoped_field;
5788 }
5789
5790 return TRUE;
5791 }
5792
5793 static bool
necp_find_matching_interface_index(struct necp_client_parsed_parameters * parsed_parameters,u_int * return_ifindex,bool * validate_agents)5794 necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters,
5795 u_int *return_ifindex, bool *validate_agents)
5796 {
5797 struct ifnet *ifp = NULL;
5798 u_int32_t best_preferred_count = 0;
5799 bool has_preferred_fields = FALSE;
5800 *return_ifindex = 0;
5801
5802 if (parsed_parameters->required_interface_index != 0) {
5803 *return_ifindex = parsed_parameters->required_interface_index;
5804 return TRUE;
5805 }
5806
5807 // Check and save off flags
5808 u_int32_t flags = 0;
5809 bool has_prohibit_flags = FALSE;
5810 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) {
5811 flags = parsed_parameters->flags;
5812 has_prohibit_flags = (parsed_parameters->flags &
5813 (NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE |
5814 NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED));
5815 }
5816
5817 if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS) &&
5818 !has_prohibit_flags) {
5819 return TRUE;
5820 }
5821
5822 has_preferred_fields = (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS);
5823
5824 // We have interesting parameters to parse and find a matching interface
5825 ifnet_head_lock_shared();
5826
5827 if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS) &&
5828 !has_preferred_fields) {
5829 // We do have fields to match, but they are only prohibitory
5830 // If the first interface in the list matches, or there are no ordered interfaces, we don't need to scope
5831 ifp = TAILQ_FIRST(&ifnet_ordered_head);
5832 if (ifp == NULL || necp_ifnet_matches_parameters(ifp, parsed_parameters, 0, NULL, false, false)) {
5833 // Don't set return_ifindex, so the client doesn't need to scope
5834 ifnet_head_done();
5835 return TRUE;
5836 }
5837 }
5838
5839 // First check the ordered interface list
5840 TAILQ_FOREACH(ifp, &ifnet_ordered_head, if_ordered_link) {
5841 u_int32_t preferred_count = 0;
5842 if (necp_ifnet_matches_parameters(ifp, parsed_parameters, flags, &preferred_count, false, false)) {
5843 if (preferred_count > best_preferred_count ||
5844 *return_ifindex == 0) {
5845 // Everything matched, and is most preferred. Return this interface.
5846 *return_ifindex = ifp->if_index;
5847 best_preferred_count = preferred_count;
5848
5849 if (!has_preferred_fields) {
5850 break;
5851 }
5852 }
5853 }
5854
5855 if (has_prohibit_flags &&
5856 ifp == TAILQ_FIRST(&ifnet_ordered_head)) {
5857 // This was the first interface. From here on, if the
5858 // client prohibited either expensive or constrained,
5859 // don't allow either as a secondary interface option.
5860 flags |= (NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE |
5861 NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED);
5862 }
5863 }
5864
5865 bool is_listener = ((parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
5866 (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER));
5867
5868 // Then check the remaining interfaces
5869 if ((parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS) &&
5870 ((!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)) ||
5871 necp_interface_type_should_match_unranked_interfaces(parsed_parameters->required_interface_type) ||
5872 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR) ||
5873 is_listener) &&
5874 (*return_ifindex == 0 || has_preferred_fields)) {
5875 TAILQ_FOREACH(ifp, &ifnet_head, if_link) {
5876 u_int32_t preferred_count = 0;
5877 if (NECP_IFP_IS_ON_ORDERED_LIST(ifp)) {
5878 // This interface was in the ordered list, skip
5879 continue;
5880 }
5881 if (necp_ifnet_matches_parameters(ifp, parsed_parameters, flags, &preferred_count, false, true)) {
5882 if (preferred_count > best_preferred_count ||
5883 *return_ifindex == 0) {
5884 // Everything matched, and is most preferred. Return this interface.
5885 *return_ifindex = ifp->if_index;
5886 best_preferred_count = preferred_count;
5887
5888 if (!has_preferred_fields) {
5889 break;
5890 }
5891 }
5892 }
5893 }
5894 }
5895
5896 ifnet_head_done();
5897
5898 if (has_preferred_fields && best_preferred_count == 0 &&
5899 ((parsed_parameters->valid_fields & (NECP_PARSED_PARAMETERS_SCOPED_FIELDS | NECP_PARSED_PARAMETERS_PREFERRED_FIELDS)) ==
5900 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS))) {
5901 // If only has preferred ifnet fields, and nothing was found, clear the interface index and return TRUE
5902 *return_ifindex = 0;
5903 return TRUE;
5904 }
5905
5906 if (*return_ifindex == 0 &&
5907 !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS)) {
5908 // Has required fields, but not including specific interface fields. Pass for now, and check
5909 // to see if agents are satisfied by policy.
5910 *validate_agents = TRUE;
5911 return TRUE;
5912 }
5913
5914 return *return_ifindex != 0;
5915 }
5916
5917 void
necp_copy_inp_domain_info(struct inpcb * inp,struct socket * so,nstat_domain_info * domain_info)5918 necp_copy_inp_domain_info(struct inpcb *inp, struct socket *so, nstat_domain_info *domain_info)
5919 {
5920 if (inp == NULL || so == NULL || domain_info == NULL) {
5921 return;
5922 }
5923
5924 necp_lock_socket_attributes();
5925
5926 domain_info->is_tracker = !!(so->so_flags1 & SOF1_KNOWN_TRACKER);
5927 domain_info->is_non_app_initiated = !!(so->so_flags1 & SOF1_TRACKER_NON_APP_INITIATED);
5928 if (domain_info->is_tracker &&
5929 inp->inp_necp_attributes.inp_tracker_domain != NULL) {
5930 strlcpy(domain_info->domain_name, inp->inp_necp_attributes.inp_tracker_domain,
5931 sizeof(domain_info->domain_name));
5932 } else if (inp->inp_necp_attributes.inp_domain != NULL) {
5933 strlcpy(domain_info->domain_name, inp->inp_necp_attributes.inp_domain,
5934 sizeof(domain_info->domain_name));
5935 }
5936 if (inp->inp_necp_attributes.inp_domain_owner != NULL) {
5937 strlcpy(domain_info->domain_owner, inp->inp_necp_attributes.inp_domain_owner,
5938 sizeof(domain_info->domain_owner));
5939 }
5940 if (inp->inp_necp_attributes.inp_domain_context != NULL) {
5941 strlcpy(domain_info->domain_tracker_ctxt, inp->inp_necp_attributes.inp_domain_context,
5942 sizeof(domain_info->domain_tracker_ctxt));
5943 }
5944
5945 necp_unlock_socket_attributes();
5946 }
5947
5948 void
necp_with_inp_domain_name(struct socket * so,void * ctx,void (* with_func)(char * domain_name,void * ctx))5949 necp_with_inp_domain_name(struct socket *so, void *ctx, void (*with_func)(char *domain_name, void *ctx))
5950 {
5951 struct inpcb *inp = NULL;
5952
5953 if (so == NULL || with_func == NULL) {
5954 return;
5955 }
5956
5957 inp = (struct inpcb *)so->so_pcb;
5958 if (inp == NULL) {
5959 return;
5960 }
5961
5962 necp_lock_socket_attributes();
5963 with_func(inp->inp_necp_attributes.inp_domain, ctx);
5964 necp_unlock_socket_attributes();
5965 }
5966
5967 static size_t
necp_find_domain_info_common(struct necp_client * client,u_int8_t * parameters,size_t parameters_size,struct necp_client_flow_registration * flow_registration,nstat_domain_info * domain_info)5968 necp_find_domain_info_common(struct necp_client *client,
5969 u_int8_t *parameters,
5970 size_t parameters_size,
5971 struct necp_client_flow_registration *flow_registration, /* For logging purposes only */
5972 nstat_domain_info *domain_info)
5973 {
5974 if (client == NULL) {
5975 return 0;
5976 }
5977 if (domain_info == NULL) {
5978 return sizeof(nstat_domain_info);
5979 }
5980
5981 size_t offset = 0;
5982 u_int32_t flags = 0;
5983 u_int8_t *tracker_domain = NULL;
5984 u_int8_t *domain = NULL;
5985 size_t tracker_domain_length = 0;
5986 size_t domain_length = 0;
5987
5988 NECP_CLIENT_FLOW_LOG(client, flow_registration, "Collecting stats");
5989
5990 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
5991 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
5992 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
5993
5994 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
5995 // If the length is larger than what can fit in the remaining parameters size, bail
5996 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
5997 break;
5998 }
5999
6000 if (length > 0) {
6001 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
6002 if (value != NULL) {
6003 switch (type) {
6004 case NECP_CLIENT_PARAMETER_FLAGS: {
6005 if (length >= sizeof(u_int32_t)) {
6006 memcpy(&flags, value, sizeof(u_int32_t));
6007 }
6008
6009 domain_info->is_tracker =
6010 !!(flags & NECP_CLIENT_PARAMETER_FLAG_KNOWN_TRACKER);
6011 domain_info->is_non_app_initiated =
6012 !!(flags & NECP_CLIENT_PARAMETER_FLAG_NON_APP_INITIATED);
6013 domain_info->is_silent =
6014 !!(flags & NECP_CLIENT_PARAMETER_FLAG_SILENT);
6015 break;
6016 }
6017 case NECP_CLIENT_PARAMETER_TRACKER_DOMAIN: {
6018 tracker_domain_length = length;
6019 tracker_domain = value;
6020 break;
6021 }
6022 case NECP_CLIENT_PARAMETER_DOMAIN: {
6023 domain_length = length;
6024 domain = value;
6025 break;
6026 }
6027 case NECP_CLIENT_PARAMETER_DOMAIN_OWNER: {
6028 size_t length_to_copy = MIN(length, sizeof(domain_info->domain_owner));
6029 strlcpy(domain_info->domain_owner, (const char *)value, length_to_copy);
6030 break;
6031 }
6032 case NECP_CLIENT_PARAMETER_DOMAIN_CONTEXT: {
6033 size_t length_to_copy = MIN(length, sizeof(domain_info->domain_tracker_ctxt));
6034 strlcpy(domain_info->domain_tracker_ctxt, (const char *)value, length_to_copy);
6035 break;
6036 }
6037 case NECP_CLIENT_PARAMETER_ATTRIBUTED_BUNDLE_IDENTIFIER: {
6038 size_t length_to_copy = MIN(length, sizeof(domain_info->domain_attributed_bundle_id));
6039 strlcpy(domain_info->domain_attributed_bundle_id, (const char *)value, length_to_copy);
6040 break;
6041 }
6042 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
6043 if (length >= sizeof(struct necp_policy_condition_addr)) {
6044 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
6045 if (necp_client_address_is_valid(&address_struct->address.sa)) {
6046 memcpy(&domain_info->remote, &address_struct->address, sizeof(address_struct->address));
6047 }
6048 }
6049 break;
6050 }
6051 default: {
6052 break;
6053 }
6054 }
6055 }
6056 }
6057 offset += sizeof(struct necp_tlv_header) + length;
6058 }
6059
6060 if (domain_info->is_tracker && tracker_domain != NULL && tracker_domain_length > 0) {
6061 size_t length_to_copy = MIN(tracker_domain_length, sizeof(domain_info->domain_name));
6062 strlcpy(domain_info->domain_name, (const char *)tracker_domain, length_to_copy);
6063 } else if (domain != NULL && domain_length > 0) {
6064 size_t length_to_copy = MIN(domain_length, sizeof(domain_info->domain_name));
6065 strlcpy(domain_info->domain_name, (const char *)domain, length_to_copy);
6066 }
6067
6068 NECP_CLIENT_FLOW_LOG(client, flow_registration,
6069 "Collected stats - domain <%s> owner <%s> ctxt <%s> bundle id <%s> "
6070 "is_tracker %d is_non_app_initiated %d is_silent %d",
6071 domain_info->domain_name,
6072 domain_info->domain_owner,
6073 domain_info->domain_tracker_ctxt,
6074 domain_info->domain_attributed_bundle_id,
6075 domain_info->is_tracker,
6076 domain_info->is_non_app_initiated,
6077 domain_info->is_silent);
6078
6079 return sizeof(nstat_domain_info);
6080 }
6081
6082 static size_t
necp_find_conn_extension_info(nstat_provider_context ctx,int requested_extension,void * buf,size_t buf_size)6083 necp_find_conn_extension_info(nstat_provider_context ctx,
6084 int requested_extension, /* The extension to be returned */
6085 void *buf, /* If not NULL, the address for extensions to be returned in */
6086 size_t buf_size) /* The size of the buffer space, typically matching the return from a previous call with a NULL buf pointer */
6087 {
6088 // Note, the caller has guaranteed that any buffer has been zeroed, there is no need to clear it again
6089
6090 if (ctx == NULL) {
6091 return 0;
6092 }
6093 struct necp_client *client = (struct necp_client *)ctx;
6094 switch (requested_extension) {
6095 case NSTAT_EXTENDED_UPDATE_TYPE_DOMAIN:
6096 // This is for completeness. The intent is that domain information can be extracted at user level from the TLV parameters
6097 if (buf == NULL) {
6098 return sizeof(nstat_domain_info);
6099 }
6100 if (buf_size < sizeof(nstat_domain_info)) {
6101 return 0;
6102 }
6103 return necp_find_domain_info_common(client, client->parameters, client->parameters_length, NULL, (nstat_domain_info *)buf);
6104
6105 case NSTAT_EXTENDED_UPDATE_TYPE_NECP_TLV: {
6106 size_t parameters_length = client->parameters_length;
6107 if (buf == NULL) {
6108 return parameters_length;
6109 }
6110 if (buf_size < parameters_length) {
6111 return 0;
6112 }
6113 memcpy(buf, client->parameters, parameters_length);
6114 return parameters_length;
6115 }
6116 case NSTAT_EXTENDED_UPDATE_TYPE_ORIGINAL_NECP_TLV:
6117 if (buf == NULL) {
6118 return (client->original_parameters_source != NULL) ? client->original_parameters_source->parameters_length : 0;
6119 }
6120 if ((client->original_parameters_source == NULL) || (buf_size < client->original_parameters_source->parameters_length)) {
6121 return 0;
6122 }
6123 memcpy(buf, client->original_parameters_source->parameters, client->original_parameters_source->parameters_length);
6124 return client->original_parameters_source->parameters_length;
6125
6126 case NSTAT_EXTENDED_UPDATE_TYPE_ORIGINAL_DOMAIN:
6127 if (buf == NULL) {
6128 return (client->original_parameters_source != NULL) ? sizeof(nstat_domain_info) : 0;
6129 }
6130 if ((buf_size < sizeof(nstat_domain_info)) || (client->original_parameters_source == NULL)) {
6131 return 0;
6132 }
6133 return necp_find_domain_info_common(client, client->original_parameters_source->parameters, client->original_parameters_source->parameters_length,
6134 NULL, (nstat_domain_info *)buf);
6135
6136 default:
6137 return 0;
6138 }
6139 }
6140
6141 #if SKYWALK
6142
6143 static size_t
necp_find_extension_info(userland_stats_provider_context * ctx,int requested_extension,void * buf,size_t buf_size)6144 necp_find_extension_info(userland_stats_provider_context *ctx,
6145 int requested_extension, /* The extension to be returned */
6146 void *buf, /* If not NULL, the address for extensions to be returned in */
6147 size_t buf_size) /* The size of the buffer space, typically matching the return from a previous call with a NULL buf pointer */
6148 {
6149 if (ctx == NULL) {
6150 return 0;
6151 }
6152 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6153 struct necp_client *client = flow_registration->client;
6154
6155 switch (requested_extension) {
6156 case NSTAT_EXTENDED_UPDATE_TYPE_DOMAIN:
6157 if (buf == NULL) {
6158 return sizeof(nstat_domain_info);
6159 }
6160 if (buf_size < sizeof(nstat_domain_info)) {
6161 return 0;
6162 }
6163 return necp_find_domain_info_common(client, client->parameters, client->parameters_length, flow_registration, (nstat_domain_info *)buf);
6164
6165 case NSTAT_EXTENDED_UPDATE_TYPE_NECP_TLV:
6166 if (buf == NULL) {
6167 return client->parameters_length;
6168 }
6169 if (buf_size < client->parameters_length) {
6170 return 0;
6171 }
6172 memcpy(buf, client->parameters, client->parameters_length);
6173 return client->parameters_length;
6174
6175 case NSTAT_EXTENDED_UPDATE_TYPE_FUUID:
6176 if (buf == NULL) {
6177 return sizeof(uuid_t);
6178 }
6179 if (buf_size < sizeof(uuid_t)) {
6180 return 0;
6181 }
6182 uuid_copy(buf, flow_registration->registration_id);
6183 return sizeof(uuid_t);
6184
6185 default:
6186 return 0;
6187 }
6188 }
6189
6190 static void
necp_find_netstat_data(struct necp_client * client,union necp_sockaddr_union * remote,pid_t * effective_pid,uid_t * uid,uuid_t euuid,uid_t * persona_id,u_int32_t * traffic_class,u_int8_t * fallback_mode)6191 necp_find_netstat_data(struct necp_client *client,
6192 union necp_sockaddr_union *remote,
6193 pid_t *effective_pid,
6194 uid_t *uid,
6195 uuid_t euuid,
6196 uid_t *persona_id,
6197 u_int32_t *traffic_class,
6198 u_int8_t *fallback_mode)
6199 {
6200 size_t offset = 0;
6201 u_int8_t *parameters;
6202 u_int32_t parameters_size;
6203
6204 parameters = client->parameters;
6205 parameters_size = (u_int32_t)client->parameters_length;
6206
6207 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
6208 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
6209 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
6210
6211 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
6212 // If the length is larger than what can fit in the remaining parameters size, bail
6213 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
6214 break;
6215 }
6216
6217 if (length > 0) {
6218 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
6219 if (value != NULL) {
6220 switch (type) {
6221 case NECP_CLIENT_PARAMETER_APPLICATION: {
6222 if (length >= sizeof(uuid_t)) {
6223 uuid_copy(euuid, value);
6224 }
6225 break;
6226 }
6227 case NECP_CLIENT_PARAMETER_PID: {
6228 if (length >= sizeof(pid_t)) {
6229 memcpy(effective_pid, value, sizeof(pid_t));
6230 }
6231 break;
6232 }
6233 case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: {
6234 if (length >= sizeof(u_int32_t)) {
6235 memcpy(traffic_class, value, sizeof(u_int32_t));
6236 }
6237 break;
6238 }
6239 case NECP_CLIENT_PARAMETER_FALLBACK_MODE: {
6240 if (length >= sizeof(u_int8_t)) {
6241 memcpy(fallback_mode, value, sizeof(u_int8_t));
6242 }
6243 break;
6244 }
6245 // It is an implementation quirk that the remote address can be found in the necp parameters
6246 // while the local address must be retrieved from the flowswitch
6247 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
6248 if (length >= sizeof(struct necp_policy_condition_addr)) {
6249 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
6250 if (necp_client_address_is_valid(&address_struct->address.sa)) {
6251 memcpy(remote, &address_struct->address, sizeof(address_struct->address));
6252 }
6253 }
6254 break;
6255 }
6256 case NECP_CLIENT_PARAMETER_APPLICATION_ID: {
6257 if (length >= sizeof(necp_application_id_t) && uid && persona_id) {
6258 necp_application_id_t *application_id = (necp_application_id_t *)(void *)value;
6259 memcpy(uid, &application_id->uid, sizeof(uid_t));
6260 uuid_copy(euuid, application_id->effective_uuid);
6261 memcpy(persona_id, &application_id->persona_id, sizeof(uid_t));
6262 }
6263 break;
6264 }
6265 default: {
6266 break;
6267 }
6268 }
6269 }
6270 }
6271 offset += sizeof(struct necp_tlv_header) + length;
6272 }
6273 }
6274
6275 static u_int64_t
necp_find_netstat_initial_properties(struct necp_client * client)6276 necp_find_netstat_initial_properties(struct necp_client *client)
6277 {
6278 size_t offset = 0;
6279 u_int64_t retval = 0;
6280 u_int8_t *parameters;
6281 u_int32_t parameters_size;
6282
6283 parameters = client->parameters;
6284 parameters_size = (u_int32_t)client->parameters_length;
6285
6286 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
6287 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
6288 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
6289
6290 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
6291 // If the length is larger than what can fit in the remaining parameters size, bail
6292 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
6293 break;
6294 }
6295
6296 if (type == NECP_CLIENT_PARAMETER_FLAGS) {
6297 u_int32_t policy_condition_client_flags;
6298 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
6299 if ((value != NULL) && (length >= sizeof(policy_condition_client_flags))) {
6300 memcpy(&policy_condition_client_flags, value, sizeof(policy_condition_client_flags));
6301 if (policy_condition_client_flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
6302 retval |= NSTAT_SOURCE_IS_LISTENER;
6303 }
6304 if (policy_condition_client_flags & NECP_CLIENT_PARAMETER_FLAG_INBOUND) {
6305 retval |= NSTAT_SOURCE_IS_INBOUND;
6306 }
6307 }
6308 break;
6309 }
6310 offset += sizeof(struct necp_tlv_header) + length;
6311 }
6312 if (retval == 0) {
6313 retval = NSTAT_SOURCE_IS_OUTBOUND;
6314 }
6315 return retval;
6316 }
6317
6318 // Called from NetworkStatistics when it wishes to collect latest information for a TCP flow.
6319 // It is a responsibility of NetworkStatistics to have previously zeroed any supplied memory.
6320 static bool
necp_request_tcp_netstats(userland_stats_provider_context * ctx,u_int16_t * ifflagsp,nstat_progress_digest * digestp,nstat_counts * countsp,void * metadatap)6321 necp_request_tcp_netstats(userland_stats_provider_context *ctx,
6322 u_int16_t *ifflagsp,
6323 nstat_progress_digest *digestp,
6324 nstat_counts *countsp,
6325 void *metadatap)
6326 {
6327 if (ctx == NULL) {
6328 return false;
6329 }
6330
6331 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6332 struct necp_client *client = flow_registration->client;
6333 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
6334 struct necp_tcp_stats *tcpstats = (struct necp_tcp_stats *)ustats_kaddr;
6335 ASSERT(tcpstats != NULL);
6336
6337 u_int16_t nstat_diagnostic_flags = 0;
6338
6339 // Retrieve details from the last time the assigned flows were updated
6340 u_int32_t route_ifindex = IFSCOPE_NONE;
6341 u_int16_t route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6342 u_int64_t combined_interface_details = 0;
6343
6344 combined_interface_details = os_atomic_load(&flow_registration->last_interface_details, relaxed);
6345 split_interface_details(combined_interface_details, &route_ifindex, &route_ifflags);
6346
6347 if (route_ifindex == IFSCOPE_NONE) {
6348 // Mark no interface
6349 nstat_diagnostic_flags |= NSTAT_IFNET_ROUTE_VALUE_UNOBTAINABLE;
6350 route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6351 NECPLOG(LOG_INFO, "req tcp stats, failed to get route details for pid %d curproc %d %s\n",
6352 client->proc_pid, proc_pid(current_proc()), proc_best_name(current_proc()));
6353 }
6354
6355 if (ifflagsp) {
6356 *ifflagsp = route_ifflags | nstat_diagnostic_flags;
6357 if (tcpstats->necp_tcp_extra.flags1 & SOF1_CELLFALLBACK) {
6358 *ifflagsp |= NSTAT_IFNET_VIA_CELLFALLBACK;
6359 }
6360 if ((digestp == NULL) && (countsp == NULL) && (metadatap == NULL)) {
6361 return true;
6362 }
6363 }
6364
6365 if (digestp) {
6366 // The digest is intended to give information that may help give insight into the state of the link
6367 // while avoiding the need to do the relatively expensive flowswitch lookup
6368 digestp->rxbytes = tcpstats->necp_tcp_counts.necp_stat_rxbytes;
6369 digestp->txbytes = tcpstats->necp_tcp_counts.necp_stat_txbytes;
6370 digestp->rxduplicatebytes = tcpstats->necp_tcp_counts.necp_stat_rxduplicatebytes;
6371 digestp->rxoutoforderbytes = tcpstats->necp_tcp_counts.necp_stat_rxoutoforderbytes;
6372 digestp->txretransmit = tcpstats->necp_tcp_counts.necp_stat_txretransmit;
6373 digestp->ifindex = route_ifindex;
6374 digestp->state = tcpstats->necp_tcp_extra.state;
6375 digestp->txunacked = tcpstats->necp_tcp_extra.txunacked;
6376 digestp->txwindow = tcpstats->necp_tcp_extra.txwindow;
6377 digestp->connstatus.probe_activated = tcpstats->necp_tcp_extra.probestatus.probe_activated;
6378 digestp->connstatus.write_probe_failed = tcpstats->necp_tcp_extra.probestatus.write_probe_failed;
6379 digestp->connstatus.read_probe_failed = tcpstats->necp_tcp_extra.probestatus.read_probe_failed;
6380 digestp->connstatus.conn_probe_failed = tcpstats->necp_tcp_extra.probestatus.conn_probe_failed;
6381
6382 if ((countsp == NULL) && (metadatap == NULL)) {
6383 return true;
6384 }
6385 }
6386
6387 const struct sk_stats_flow *sf = &flow_registration->nexus_stats->fs_stats;
6388 if (sf == NULL) {
6389 nstat_diagnostic_flags |= NSTAT_IFNET_FLOWSWITCH_VALUE_UNOBTAINABLE;
6390 char namebuf[MAXCOMLEN + 1];
6391 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
6392 proc_name(client->proc_pid, namebuf, sizeof(namebuf));
6393 NECPLOG(LOG_ERR, "req tcp stats, necp_client flow_registration flow_stats missing for pid %d %s curproc %d %s\n",
6394 client->proc_pid, namebuf, proc_pid(current_proc()), proc_best_name(current_proc()));
6395 sf = &ntstat_sk_stats_zero;
6396 }
6397
6398 if (countsp) {
6399 countsp->nstat_rxbytes = tcpstats->necp_tcp_counts.necp_stat_rxbytes;
6400 countsp->nstat_txbytes = tcpstats->necp_tcp_counts.necp_stat_txbytes;
6401
6402 countsp->nstat_rxduplicatebytes = tcpstats->necp_tcp_counts.necp_stat_rxduplicatebytes;
6403 countsp->nstat_rxoutoforderbytes = tcpstats->necp_tcp_counts.necp_stat_rxoutoforderbytes;
6404 countsp->nstat_txretransmit = tcpstats->necp_tcp_counts.necp_stat_txretransmit;
6405
6406 countsp->nstat_min_rtt = tcpstats->necp_tcp_counts.necp_stat_min_rtt;
6407 countsp->nstat_avg_rtt = tcpstats->necp_tcp_counts.necp_stat_avg_rtt;
6408 countsp->nstat_var_rtt = tcpstats->necp_tcp_counts.necp_stat_var_rtt;
6409
6410 countsp->nstat_connectattempts = tcpstats->necp_tcp_extra.state >= TCPS_SYN_SENT ? 1 : 0;
6411 countsp->nstat_connectsuccesses = tcpstats->necp_tcp_extra.state >= TCPS_ESTABLISHED ? 1 : 0;
6412
6413 // Supplement what the user level has told us with what we know from the flowswitch
6414 countsp->nstat_rxpackets = sf->sf_ipackets;
6415 countsp->nstat_txpackets = sf->sf_opackets;
6416 if (route_ifflags & NSTAT_IFNET_IS_CELLULAR) {
6417 countsp->nstat_cell_rxbytes = sf->sf_ibytes;
6418 countsp->nstat_cell_txbytes = sf->sf_obytes;
6419 } else if (route_ifflags & NSTAT_IFNET_IS_WIFI) {
6420 countsp->nstat_wifi_rxbytes = sf->sf_ibytes;
6421 countsp->nstat_wifi_txbytes = sf->sf_obytes;
6422 } else if (route_ifflags & NSTAT_IFNET_IS_WIRED) {
6423 countsp->nstat_wired_rxbytes = sf->sf_ibytes;
6424 countsp->nstat_wired_txbytes = sf->sf_obytes;
6425 }
6426 }
6427
6428 if (metadatap) {
6429 nstat_tcp_descriptor *desc = (nstat_tcp_descriptor *)metadatap;
6430 memset(desc, 0, sizeof(*desc));
6431
6432 // Metadata from the flow registration
6433 uuid_copy(desc->fuuid, flow_registration->registration_id);
6434
6435 // Metadata that the necp client should have in TLV format.
6436 pid_t effective_pid = client->proc_pid;
6437 necp_find_netstat_data(client, (union necp_sockaddr_union *)&desc->remote, &effective_pid, &desc->uid, desc->euuid, &desc->persona_id, &desc->traffic_class, &desc->fallback_mode);
6438 desc->epid = (u_int32_t)effective_pid;
6439
6440 // Metadata from the flow registration
6441 // This needs to revisited if multiple flows are created from one flow registration
6442 struct necp_client_flow *flow = NULL;
6443 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
6444 memcpy(&desc->local, &flow->local_addr, sizeof(desc->local));
6445 break;
6446 }
6447
6448 // Metadata from the route
6449 desc->ifindex = route_ifindex;
6450 desc->ifnet_properties = route_ifflags | nstat_diagnostic_flags;
6451 desc->ifnet_properties |= (sf->sf_flags & SFLOWF_ONLINK) ? NSTAT_IFNET_IS_LOCAL : NSTAT_IFNET_IS_NON_LOCAL;
6452 if (tcpstats->necp_tcp_extra.flags1 & SOF1_CELLFALLBACK) {
6453 desc->ifnet_properties |= NSTAT_IFNET_VIA_CELLFALLBACK;
6454 }
6455
6456 // Basic metadata from userland
6457 desc->rcvbufsize = tcpstats->necp_tcp_basic.rcvbufsize;
6458 desc->rcvbufused = tcpstats->necp_tcp_basic.rcvbufused;
6459
6460 // Additional TCP specific data
6461 desc->sndbufsize = tcpstats->necp_tcp_extra.sndbufsize;
6462 desc->sndbufused = tcpstats->necp_tcp_extra.sndbufused;
6463 desc->txunacked = tcpstats->necp_tcp_extra.txunacked;
6464 desc->txwindow = tcpstats->necp_tcp_extra.txwindow;
6465 desc->txcwindow = tcpstats->necp_tcp_extra.txcwindow;
6466 desc->traffic_mgt_flags = tcpstats->necp_tcp_extra.traffic_mgt_flags;
6467 desc->state = tcpstats->necp_tcp_extra.state;
6468
6469 u_int32_t cc_alg_index = tcpstats->necp_tcp_extra.cc_alg_index;
6470 if (cc_alg_index < TCP_CC_ALGO_COUNT) {
6471 strlcpy(desc->cc_algo, tcp_cc_algo_list[cc_alg_index]->name, sizeof(desc->cc_algo));
6472 } else {
6473 strlcpy(desc->cc_algo, "unknown", sizeof(desc->cc_algo));
6474 }
6475
6476 desc->connstatus.probe_activated = tcpstats->necp_tcp_extra.probestatus.probe_activated;
6477 desc->connstatus.write_probe_failed = tcpstats->necp_tcp_extra.probestatus.write_probe_failed;
6478 desc->connstatus.read_probe_failed = tcpstats->necp_tcp_extra.probestatus.read_probe_failed;
6479 desc->connstatus.conn_probe_failed = tcpstats->necp_tcp_extra.probestatus.conn_probe_failed;
6480
6481 memcpy(&desc->activity_bitmap, &sf->sf_activity, sizeof(sf->sf_activity));
6482
6483 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_FLOW)) {
6484 uuid_string_t euuid_str = { 0 };
6485 uuid_unparse(desc->euuid, euuid_str);
6486 NECPLOG(LOG_NOTICE, "Collected stats - TCP - epid %d uid %d euuid %s persona id %d", desc->epid, desc->uid, euuid_str, desc->persona_id);
6487 }
6488 }
6489
6490 return true;
6491 }
6492
6493 // Called from NetworkStatistics when it wishes to collect latest information for a UDP flow.
6494 static bool
necp_request_udp_netstats(userland_stats_provider_context * ctx,u_int16_t * ifflagsp,nstat_progress_digest * digestp,nstat_counts * countsp,void * metadatap)6495 necp_request_udp_netstats(userland_stats_provider_context *ctx,
6496 u_int16_t *ifflagsp,
6497 nstat_progress_digest *digestp,
6498 nstat_counts *countsp,
6499 void *metadatap)
6500 {
6501 #pragma unused(digestp)
6502
6503 if (ctx == NULL) {
6504 return false;
6505 }
6506
6507 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6508 struct necp_client *client = flow_registration->client;
6509 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
6510 struct necp_udp_stats *udpstats = (struct necp_udp_stats *)ustats_kaddr;
6511 ASSERT(udpstats != NULL);
6512
6513 u_int16_t nstat_diagnostic_flags = 0;
6514
6515 // Retrieve details from the last time the assigned flows were updated
6516 u_int32_t route_ifindex = IFSCOPE_NONE;
6517 u_int16_t route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6518 u_int64_t combined_interface_details = 0;
6519
6520 combined_interface_details = os_atomic_load(&flow_registration->last_interface_details, relaxed);
6521 split_interface_details(combined_interface_details, &route_ifindex, &route_ifflags);
6522
6523 if (route_ifindex == IFSCOPE_NONE) {
6524 // Mark no interface
6525 nstat_diagnostic_flags |= NSTAT_IFNET_ROUTE_VALUE_UNOBTAINABLE;
6526 route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6527 NECPLOG(LOG_INFO, "req udp stats, failed to get route details for pid %d curproc %d %s\n",
6528 client->proc_pid, proc_pid(current_proc()), proc_best_name(current_proc()));
6529 }
6530
6531 if (ifflagsp) {
6532 *ifflagsp = route_ifflags | nstat_diagnostic_flags;
6533 if ((countsp == NULL) && (metadatap == NULL)) {
6534 return true;
6535 }
6536 }
6537 const struct sk_stats_flow *sf = &flow_registration->nexus_stats->fs_stats;
6538 if (sf == NULL) {
6539 nstat_diagnostic_flags |= NSTAT_IFNET_FLOWSWITCH_VALUE_UNOBTAINABLE;
6540 char namebuf[MAXCOMLEN + 1];
6541 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
6542 proc_name(client->proc_pid, namebuf, sizeof(namebuf));
6543 NECPLOG(LOG_ERR, "req udp stats, necp_client flow_registration flow_stats missing for pid %d %s curproc %d %s\n",
6544 client->proc_pid, namebuf, proc_pid(current_proc()), proc_best_name(current_proc()));
6545 sf = &ntstat_sk_stats_zero;
6546 }
6547
6548 if (countsp) {
6549 countsp->nstat_rxbytes = udpstats->necp_udp_counts.necp_stat_rxbytes;
6550 countsp->nstat_txbytes = udpstats->necp_udp_counts.necp_stat_txbytes;
6551
6552 countsp->nstat_rxduplicatebytes = udpstats->necp_udp_counts.necp_stat_rxduplicatebytes;
6553 countsp->nstat_rxoutoforderbytes = udpstats->necp_udp_counts.necp_stat_rxoutoforderbytes;
6554 countsp->nstat_txretransmit = udpstats->necp_udp_counts.necp_stat_txretransmit;
6555
6556 countsp->nstat_min_rtt = udpstats->necp_udp_counts.necp_stat_min_rtt;
6557 countsp->nstat_avg_rtt = udpstats->necp_udp_counts.necp_stat_avg_rtt;
6558 countsp->nstat_var_rtt = udpstats->necp_udp_counts.necp_stat_var_rtt;
6559
6560 // Supplement what the user level has told us with what we know from the flowswitch
6561 countsp->nstat_rxpackets = sf->sf_ipackets;
6562 countsp->nstat_txpackets = sf->sf_opackets;
6563 if (route_ifflags & NSTAT_IFNET_IS_CELLULAR) {
6564 countsp->nstat_cell_rxbytes = sf->sf_ibytes;
6565 countsp->nstat_cell_txbytes = sf->sf_obytes;
6566 } else if (route_ifflags & NSTAT_IFNET_IS_WIFI) {
6567 countsp->nstat_wifi_rxbytes = sf->sf_ibytes;
6568 countsp->nstat_wifi_txbytes = sf->sf_obytes;
6569 } else if (route_ifflags & NSTAT_IFNET_IS_WIRED) {
6570 countsp->nstat_wired_rxbytes = sf->sf_ibytes;
6571 countsp->nstat_wired_txbytes = sf->sf_obytes;
6572 }
6573 }
6574
6575 if (metadatap) {
6576 nstat_udp_descriptor *desc = (nstat_udp_descriptor *)metadatap;
6577 memset(desc, 0, sizeof(*desc));
6578
6579 // Metadata from the flow registration
6580 uuid_copy(desc->fuuid, flow_registration->registration_id);
6581
6582 // Metadata that the necp client should have in TLV format.
6583 pid_t effective_pid = client->proc_pid;
6584 necp_find_netstat_data(client, (union necp_sockaddr_union *)&desc->remote, &effective_pid, &desc->uid, desc->euuid, &desc->persona_id, &desc->traffic_class, &desc->fallback_mode);
6585 desc->epid = (u_int32_t)effective_pid;
6586
6587 // Metadata from the flow registration
6588 // This needs to revisited if multiple flows are created from one flow registration
6589 struct necp_client_flow *flow = NULL;
6590 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
6591 memcpy(&desc->local, &flow->local_addr, sizeof(desc->local));
6592 break;
6593 }
6594
6595 // Metadata from the route
6596 desc->ifindex = route_ifindex;
6597 desc->ifnet_properties = route_ifflags | nstat_diagnostic_flags;
6598 desc->ifnet_properties |= (sf->sf_flags & SFLOWF_ONLINK) ? NSTAT_IFNET_IS_LOCAL : NSTAT_IFNET_IS_NON_LOCAL;
6599
6600 // Basic metadata is all that is required for UDP
6601 desc->rcvbufsize = udpstats->necp_udp_basic.rcvbufsize;
6602 desc->rcvbufused = udpstats->necp_udp_basic.rcvbufused;
6603
6604 memcpy(&desc->activity_bitmap, &sf->sf_activity, sizeof(sf->sf_activity));
6605
6606 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_FLOW)) {
6607 uuid_string_t euuid_str = { 0 };
6608 uuid_unparse(desc->euuid, euuid_str);
6609 NECPLOG(LOG_NOTICE, "Collected stats - UDP - epid %d uid %d euuid %s persona id %d", desc->epid, desc->uid, euuid_str, desc->persona_id);
6610 }
6611 }
6612
6613 return true;
6614 }
6615
6616 // Called from NetworkStatistics when it wishes to collect latest information for a QUIC flow.
6617 //
6618 // TODO: For now it is an exact implementation as that of TCP.
6619 // Still to keep the logic separate for future divergence, keeping the routines separate.
6620 // It also seems there are lots of common code between existing implementations and
6621 // it would be good to refactor this logic at some point.
6622 static bool
necp_request_quic_netstats(userland_stats_provider_context * ctx,u_int16_t * ifflagsp,nstat_progress_digest * digestp,nstat_counts * countsp,void * metadatap)6623 necp_request_quic_netstats(userland_stats_provider_context *ctx,
6624 u_int16_t *ifflagsp,
6625 nstat_progress_digest *digestp,
6626 nstat_counts *countsp,
6627 void *metadatap)
6628 {
6629 if (ctx == NULL) {
6630 return false;
6631 }
6632
6633 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6634 struct necp_client *client = flow_registration->client;
6635 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
6636 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
6637 ASSERT(quicstats != NULL);
6638
6639 u_int16_t nstat_diagnostic_flags = 0;
6640
6641 // Retrieve details from the last time the assigned flows were updated
6642 u_int32_t route_ifindex = IFSCOPE_NONE;
6643 u_int16_t route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6644 u_int64_t combined_interface_details = 0;
6645
6646 combined_interface_details = os_atomic_load(&flow_registration->last_interface_details, relaxed);
6647 split_interface_details(combined_interface_details, &route_ifindex, &route_ifflags);
6648
6649 if (route_ifindex == IFSCOPE_NONE) {
6650 // Mark no interface
6651 nstat_diagnostic_flags |= NSTAT_IFNET_ROUTE_VALUE_UNOBTAINABLE;
6652 route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6653 NECPLOG(LOG_INFO, "req quic stats, failed to get route details for pid %d curproc %d %s\n",
6654 client->proc_pid, proc_pid(current_proc()), proc_best_name(current_proc()));
6655 }
6656
6657 if (ifflagsp) {
6658 *ifflagsp = route_ifflags | nstat_diagnostic_flags;
6659 if ((digestp == NULL) && (countsp == NULL) && (metadatap == NULL)) {
6660 return true;
6661 }
6662 }
6663
6664 if (digestp) {
6665 // The digest is intended to give information that may help give insight into the state of the link
6666 // while avoiding the need to do the relatively expensive flowswitch lookup
6667 digestp->rxbytes = quicstats->necp_quic_counts.necp_stat_rxbytes;
6668 digestp->txbytes = quicstats->necp_quic_counts.necp_stat_txbytes;
6669 digestp->rxduplicatebytes = quicstats->necp_quic_counts.necp_stat_rxduplicatebytes;
6670 digestp->rxoutoforderbytes = quicstats->necp_quic_counts.necp_stat_rxoutoforderbytes;
6671 digestp->txretransmit = quicstats->necp_quic_counts.necp_stat_txretransmit;
6672 digestp->ifindex = route_ifindex;
6673 digestp->state = quicstats->necp_quic_extra.state;
6674 digestp->txunacked = quicstats->necp_quic_extra.txunacked;
6675 digestp->txwindow = quicstats->necp_quic_extra.txwindow;
6676 digestp->connstatus.probe_activated = quicstats->necp_quic_extra.probestatus.probe_activated;
6677 digestp->connstatus.write_probe_failed = quicstats->necp_quic_extra.probestatus.write_probe_failed;
6678 digestp->connstatus.read_probe_failed = quicstats->necp_quic_extra.probestatus.read_probe_failed;
6679 digestp->connstatus.conn_probe_failed = quicstats->necp_quic_extra.probestatus.conn_probe_failed;
6680
6681 if ((countsp == NULL) && (metadatap == NULL)) {
6682 return true;
6683 }
6684 }
6685
6686 const struct sk_stats_flow *sf = &flow_registration->nexus_stats->fs_stats;
6687 if (sf == NULL) {
6688 nstat_diagnostic_flags |= NSTAT_IFNET_FLOWSWITCH_VALUE_UNOBTAINABLE;
6689 char namebuf[MAXCOMLEN + 1];
6690 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
6691 proc_name(client->proc_pid, namebuf, sizeof(namebuf));
6692 NECPLOG(LOG_ERR, "req quic stats, necp_client flow_registration flow_stats missing for pid %d %s curproc %d %s\n",
6693 client->proc_pid, namebuf, proc_pid(current_proc()), proc_best_name(current_proc()));
6694 sf = &ntstat_sk_stats_zero;
6695 }
6696
6697 if (countsp) {
6698 countsp->nstat_rxbytes = quicstats->necp_quic_counts.necp_stat_rxbytes;
6699 countsp->nstat_txbytes = quicstats->necp_quic_counts.necp_stat_txbytes;
6700
6701 countsp->nstat_rxduplicatebytes = quicstats->necp_quic_counts.necp_stat_rxduplicatebytes;
6702 countsp->nstat_rxoutoforderbytes = quicstats->necp_quic_counts.necp_stat_rxoutoforderbytes;
6703 countsp->nstat_txretransmit = quicstats->necp_quic_counts.necp_stat_txretransmit;
6704
6705 countsp->nstat_min_rtt = quicstats->necp_quic_counts.necp_stat_min_rtt;
6706 countsp->nstat_avg_rtt = quicstats->necp_quic_counts.necp_stat_avg_rtt;
6707 countsp->nstat_var_rtt = quicstats->necp_quic_counts.necp_stat_var_rtt;
6708
6709 // TODO: It would be good to expose QUIC stats for CH/SH retransmission and connection state
6710 // Supplement what the user level has told us with what we know from the flowswitch
6711 countsp->nstat_rxpackets = sf->sf_ipackets;
6712 countsp->nstat_txpackets = sf->sf_opackets;
6713 if (route_ifflags & NSTAT_IFNET_IS_CELLULAR) {
6714 countsp->nstat_cell_rxbytes = sf->sf_ibytes;
6715 countsp->nstat_cell_txbytes = sf->sf_obytes;
6716 } else if (route_ifflags & NSTAT_IFNET_IS_WIFI) {
6717 countsp->nstat_wifi_rxbytes = sf->sf_ibytes;
6718 countsp->nstat_wifi_txbytes = sf->sf_obytes;
6719 } else if (route_ifflags & NSTAT_IFNET_IS_WIRED) {
6720 countsp->nstat_wired_rxbytes = sf->sf_ibytes;
6721 countsp->nstat_wired_txbytes = sf->sf_obytes;
6722 }
6723 }
6724
6725 if (metadatap) {
6726 nstat_quic_descriptor *desc = (nstat_quic_descriptor *)metadatap;
6727 memset(desc, 0, sizeof(*desc));
6728
6729 // Metadata from the flow registration
6730 uuid_copy(desc->fuuid, flow_registration->registration_id);
6731
6732 // Metadata, that the necp client should have, in TLV format.
6733 pid_t effective_pid = client->proc_pid;
6734 necp_find_netstat_data(client, (union necp_sockaddr_union *)&desc->remote, &effective_pid, &desc->uid, desc->euuid, &desc->persona_id, &desc->traffic_class, &desc->fallback_mode);
6735 desc->epid = (u_int32_t)effective_pid;
6736
6737 // Metadata from the flow registration
6738 // This needs to revisited if multiple flows are created from one flow registration
6739 struct necp_client_flow *flow = NULL;
6740 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
6741 memcpy(&desc->local, &flow->local_addr, sizeof(desc->local));
6742 break;
6743 }
6744
6745 // Metadata from the route
6746 desc->ifindex = route_ifindex;
6747 desc->ifnet_properties = route_ifflags | nstat_diagnostic_flags;
6748 desc->ifnet_properties |= (sf->sf_flags & SFLOWF_ONLINK) ? NSTAT_IFNET_IS_LOCAL : NSTAT_IFNET_IS_NON_LOCAL;
6749
6750 // Basic metadata from userland
6751 desc->rcvbufsize = quicstats->necp_quic_basic.rcvbufsize;
6752 desc->rcvbufused = quicstats->necp_quic_basic.rcvbufused;
6753
6754 // Additional QUIC specific data
6755 desc->sndbufsize = quicstats->necp_quic_extra.sndbufsize;
6756 desc->sndbufused = quicstats->necp_quic_extra.sndbufused;
6757 desc->txunacked = quicstats->necp_quic_extra.txunacked;
6758 desc->txwindow = quicstats->necp_quic_extra.txwindow;
6759 desc->txcwindow = quicstats->necp_quic_extra.txcwindow;
6760 desc->traffic_mgt_flags = quicstats->necp_quic_extra.traffic_mgt_flags;
6761 desc->state = quicstats->necp_quic_extra.state;
6762
6763 // TODO: CC algo defines should be named agnostic of the protocol
6764 u_int32_t cc_alg_index = quicstats->necp_quic_extra.cc_alg_index;
6765 if (cc_alg_index < TCP_CC_ALGO_COUNT) {
6766 strlcpy(desc->cc_algo, tcp_cc_algo_list[cc_alg_index]->name, sizeof(desc->cc_algo));
6767 } else {
6768 strlcpy(desc->cc_algo, "unknown", sizeof(desc->cc_algo));
6769 }
6770
6771 memcpy(&desc->activity_bitmap, &sf->sf_activity, sizeof(sf->sf_activity));
6772
6773 desc->connstatus.probe_activated = quicstats->necp_quic_extra.probestatus.probe_activated;
6774 desc->connstatus.write_probe_failed = quicstats->necp_quic_extra.probestatus.write_probe_failed;
6775 desc->connstatus.read_probe_failed = quicstats->necp_quic_extra.probestatus.read_probe_failed;
6776 desc->connstatus.conn_probe_failed = quicstats->necp_quic_extra.probestatus.conn_probe_failed;
6777
6778 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_FLOW)) {
6779 uuid_string_t euuid_str = { 0 };
6780 uuid_unparse(desc->euuid, euuid_str);
6781 NECPLOG(LOG_NOTICE, "Collected stats - QUIC - epid %d uid %d euuid %s persona id %d", desc->epid, desc->uid, euuid_str, desc->persona_id);
6782 }
6783 }
6784 return true;
6785 }
6786
6787 #endif /* SKYWALK */
6788
6789 // Support functions for NetworkStatistics support for necp_client connections
6790
6791 static void
necp_client_inherit_from_parent(struct necp_client * client,struct necp_client * parent)6792 necp_client_inherit_from_parent(
6793 struct necp_client *client,
6794 struct necp_client *parent)
6795 {
6796 assert(client->original_parameters_source == NULL);
6797
6798 if (parent->original_parameters_source != NULL) {
6799 client->original_parameters_source = parent->original_parameters_source;
6800 } else {
6801 client->original_parameters_source = parent;
6802 }
6803 necp_client_retain(client->original_parameters_source);
6804 }
6805
6806 static void
necp_find_conn_netstat_data(struct necp_client * client,u_int32_t * ntstat_flags,pid_t * effective_pid,uuid_t puuid,uid_t * uid,uuid_t euuid,uid_t * persona_id)6807 necp_find_conn_netstat_data(struct necp_client *client,
6808 u_int32_t *ntstat_flags,
6809 pid_t *effective_pid,
6810 uuid_t puuid,
6811 uid_t *uid,
6812 uuid_t euuid,
6813 uid_t *persona_id)
6814 {
6815 bool has_remote_address = false;
6816 bool has_ip_protocol = false;
6817 bool has_transport_protocol = false;
6818 size_t offset = 0;
6819 u_int8_t *parameters;
6820 u_int32_t parameters_size;
6821
6822
6823 parameters = client->parameters;
6824 parameters_size = (u_int32_t)client->parameters_length;
6825
6826 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
6827 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
6828 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
6829
6830 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
6831 // If the length is larger than what can fit in the remaining parameters size, bail
6832 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
6833 break;
6834 }
6835
6836 if (length > 0) {
6837 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
6838 if (value != NULL) {
6839 switch (type) {
6840 case NECP_CLIENT_PARAMETER_APPLICATION: {
6841 if ((euuid) && (length >= sizeof(uuid_t))) {
6842 uuid_copy(euuid, value);
6843 }
6844 break;
6845 }
6846 case NECP_CLIENT_PARAMETER_IP_PROTOCOL: {
6847 if (length >= 1) {
6848 has_ip_protocol = true;
6849 }
6850 break;
6851 }
6852 case NECP_CLIENT_PARAMETER_PID: {
6853 if ((effective_pid) && length >= sizeof(pid_t)) {
6854 memcpy(effective_pid, value, sizeof(pid_t));
6855 }
6856 break;
6857 }
6858 case NECP_CLIENT_PARAMETER_PARENT_ID: {
6859 if ((puuid) && (length == sizeof(uuid_t))) {
6860 uuid_copy(puuid, value);
6861 }
6862 break;
6863 }
6864 // It is an implementation quirk that the remote address can be found in the necp parameters
6865 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
6866 if (length >= sizeof(struct necp_policy_condition_addr)) {
6867 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
6868 if (necp_client_address_is_valid(&address_struct->address.sa)) {
6869 has_remote_address = true;
6870 }
6871 }
6872 break;
6873 }
6874 case NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL: {
6875 if (length >= 1) {
6876 has_transport_protocol = true;
6877 }
6878 break;
6879 }
6880 case NECP_CLIENT_PARAMETER_APPLICATION_ID: {
6881 if (length >= sizeof(necp_application_id_t) && uid && persona_id) {
6882 necp_application_id_t *application_id = (necp_application_id_t *)(void *)value;
6883 memcpy(uid, &application_id->uid, sizeof(uid_t));
6884 uuid_copy(euuid, application_id->effective_uuid);
6885 memcpy(persona_id, &application_id->persona_id, sizeof(uid_t));
6886 }
6887 break;
6888 }
6889 default: {
6890 break;
6891 }
6892 }
6893 }
6894 }
6895 offset += sizeof(struct necp_tlv_header) + length;
6896 }
6897 if (ntstat_flags) {
6898 *ntstat_flags = (has_remote_address && has_ip_protocol && has_transport_protocol)? NSTAT_NECP_CONN_HAS_NET_ACCESS: 0;
6899 }
6900 }
6901
6902 static bool
necp_request_conn_netstats(nstat_provider_context ctx,u_int32_t * ifflagsp,nstat_counts * countsp,void * metadatap)6903 necp_request_conn_netstats(nstat_provider_context ctx,
6904 u_int32_t *ifflagsp,
6905 nstat_counts *countsp,
6906 void *metadatap)
6907 {
6908 if (ctx == NULL) {
6909 return false;
6910 }
6911 struct necp_client *client = (struct necp_client *)(uintptr_t)ctx;
6912 nstat_connection_descriptor *desc = (nstat_connection_descriptor *)metadatap;
6913
6914 if (ifflagsp) {
6915 necp_find_conn_netstat_data(client, ifflagsp, NULL, NULL, NULL, NULL, NULL);
6916 }
6917 if (countsp) {
6918 memset(countsp, 0, sizeof(*countsp));
6919 }
6920 if (desc) {
6921 memset(desc, 0, sizeof(*desc));
6922 // Metadata, that the necp client should have, in TLV format.
6923 pid_t effective_pid = client->proc_pid;
6924 necp_find_conn_netstat_data(client, &desc->ifnet_properties, &effective_pid, desc->puuid, &desc->uid, desc->euuid, &desc->persona_id);
6925 desc->epid = (u_int32_t)effective_pid;
6926
6927 // User level should obtain almost all connection information from an extension
6928 // leaving little to do here
6929 uuid_copy(desc->fuuid, client->latest_flow_registration_id);
6930 uuid_copy(desc->cuuid, client->client_id);
6931 }
6932 return true;
6933 }
6934
6935 static int
necp_skywalk_priv_check_cred(proc_t p,kauth_cred_t cred)6936 necp_skywalk_priv_check_cred(proc_t p, kauth_cred_t cred)
6937 {
6938 #pragma unused(p, cred)
6939 #if SKYWALK
6940 /* This includes Nexus controller and Skywalk observer privs */
6941 return skywalk_nxctl_check_privileges(p, cred);
6942 #else /* !SKYWALK */
6943 return 0;
6944 #endif /* !SKYWALK */
6945 }
6946
6947 /// System calls
6948
6949 int
necp_open(struct proc * p,struct necp_open_args * uap,int * retval)6950 necp_open(struct proc *p, struct necp_open_args *uap, int *retval)
6951 {
6952 #pragma unused(retval)
6953 int error = 0;
6954 struct necp_fd_data *fd_data = NULL;
6955 struct fileproc *fp = NULL;
6956 int fd = -1;
6957
6958 if (uap->flags & NECP_OPEN_FLAG_OBSERVER ||
6959 uap->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
6960 if (necp_skywalk_priv_check_cred(p, kauth_cred_get()) != 0 &&
6961 priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NETWORK_STATISTICS, 0) != 0) {
6962 NECPLOG0(LOG_ERR, "Client does not hold necessary entitlement to observe other NECP clients");
6963 error = EACCES;
6964 goto done;
6965 }
6966 }
6967
6968 #if CONFIG_MACF
6969 error = mac_necp_check_open(p, uap->flags);
6970 if (error) {
6971 goto done;
6972 }
6973 #endif /* MACF */
6974
6975 error = falloc(p, &fp, &fd, vfs_context_current());
6976 if (error != 0) {
6977 goto done;
6978 }
6979
6980 fd_data = kalloc_type(struct necp_fd_data, Z_WAITOK | Z_ZERO | Z_NOFAIL);
6981
6982 fd_data->necp_fd_type = necp_fd_type_client;
6983 fd_data->flags = uap->flags;
6984 RB_INIT(&fd_data->clients);
6985 RB_INIT(&fd_data->flows);
6986 TAILQ_INIT(&fd_data->update_list);
6987 lck_mtx_init(&fd_data->fd_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
6988 klist_init(&fd_data->si.si_note);
6989 fd_data->proc_pid = proc_pid(p);
6990 #if SKYWALK
6991 LIST_INIT(&fd_data->stats_arena_list);
6992 #endif /* !SKYWALK */
6993
6994 fp->fp_flags |= FP_CLOEXEC | FP_CLOFORK;
6995 fp->fp_glob->fg_flag = FREAD;
6996 fp->fp_glob->fg_ops = &necp_fd_ops;
6997 fp_set_data(fp, fd_data);
6998
6999 proc_fdlock(p);
7000
7001 procfdtbl_releasefd(p, fd, NULL);
7002 fp_drop(p, fd, fp, 1);
7003
7004 *retval = fd;
7005
7006 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
7007 NECP_OBSERVER_LIST_LOCK_EXCLUSIVE();
7008 LIST_INSERT_HEAD(&necp_fd_observer_list, fd_data, chain);
7009 OSIncrementAtomic(&necp_observer_fd_count);
7010 NECP_OBSERVER_LIST_UNLOCK();
7011
7012 // Walk all existing clients and add them
7013 NECP_CLIENT_TREE_LOCK_SHARED();
7014 struct necp_client *existing_client = NULL;
7015 RB_FOREACH(existing_client, _necp_client_global_tree, &necp_client_global_tree) {
7016 NECP_CLIENT_LOCK(existing_client);
7017 necp_client_update_observer_add_internal(fd_data, existing_client);
7018 necp_client_update_observer_update_internal(fd_data, existing_client);
7019 NECP_CLIENT_UNLOCK(existing_client);
7020 }
7021 NECP_CLIENT_TREE_UNLOCK();
7022 } else {
7023 NECP_FD_LIST_LOCK_EXCLUSIVE();
7024 LIST_INSERT_HEAD(&necp_fd_list, fd_data, chain);
7025 OSIncrementAtomic(&necp_client_fd_count);
7026 NECP_FD_LIST_UNLOCK();
7027 }
7028
7029 proc_fdunlock(p);
7030
7031 done:
7032 if (error != 0) {
7033 if (fp != NULL) {
7034 fp_free(p, fd, fp);
7035 fp = NULL;
7036 }
7037 if (fd_data != NULL) {
7038 kfree_type(struct necp_fd_data, fd_data);
7039 }
7040 }
7041
7042 return error;
7043 }
7044
7045 // All functions called directly from necp_client_action() to handle one of the
7046 // types should be marked with NECP_CLIENT_ACTION_FUNCTION. This ensures that
7047 // necp_client_action() does not inline all the actions into a single function.
7048 #define NECP_CLIENT_ACTION_FUNCTION __attribute__((noinline))
7049
7050 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_add(struct proc * p,struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7051 necp_client_add(struct proc *p, struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7052 {
7053 int error = 0;
7054 struct necp_client *client = NULL;
7055 const size_t buffer_size = uap->buffer_size;
7056
7057 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
7058 NECPLOG0(LOG_ERR, "NECP client observers with push enabled may not add their own clients");
7059 return EINVAL;
7060 }
7061
7062 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
7063 buffer_size == 0 || buffer_size > NECP_MAX_CLIENT_PARAMETERS_SIZE || uap->buffer == 0) {
7064 return EINVAL;
7065 }
7066
7067 client = kalloc_type(struct necp_client, Z_WAITOK | Z_ZERO | Z_NOFAIL);
7068 client->parameters = kalloc_data(buffer_size, Z_WAITOK | Z_NOFAIL);
7069 client->parameters_length = buffer_size;
7070 lck_mtx_init(&client->lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
7071 lck_mtx_init(&client->route_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
7072
7073 error = copyin(uap->buffer, client->parameters, buffer_size);
7074 if (error) {
7075 NECPLOG(LOG_ERR, "necp_client_add parameters copyin error (%d)", error);
7076 goto done;
7077 }
7078
7079 os_ref_init(&client->reference_count, &necp_client_refgrp); // Hold our reference until close
7080
7081 client->proc_pid = fd_data->proc_pid; // Save off proc pid in case the client will persist past fd
7082 client->agent_handle = (void *)fd_data;
7083 client->platform_binary = ((csproc_get_platform_binary(p) == 0) ? 0 : 1);
7084
7085 necp_generate_client_id(client->client_id, false);
7086 LIST_INIT(&client->assertion_list);
7087 RB_INIT(&client->flow_registrations);
7088
7089 NECP_CLIENT_LOG(client, "Adding client");
7090
7091 error = copyout(client->client_id, uap->client_id, sizeof(uuid_t));
7092 if (error) {
7093 NECPLOG(LOG_ERR, "necp_client_add client_id copyout error (%d)", error);
7094 goto done;
7095 }
7096
7097 #if SKYWALK
7098 struct necp_client_parsed_parameters parsed_parameters = {};
7099 int parse_error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, &parsed_parameters);
7100
7101 if (parse_error == 0 &&
7102 ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID) ||
7103 (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER))) {
7104 bool has_delegation_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_SOCKET_DELEGATE, 0) == 0);
7105 if (!has_delegation_entitlement) {
7106 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID) {
7107 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to delegate network traffic for other processes by upid",
7108 proc_name_address(p), proc_pid(p));
7109 }
7110 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER) {
7111 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to set attributed bundle identifier",
7112 proc_name_address(p), proc_pid(p));
7113 }
7114 error = EPERM;
7115 goto done;
7116 }
7117
7118 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID) {
7119 // Save off delegated unique PID
7120 client->delegated_upid = parsed_parameters.delegated_upid;
7121 }
7122 }
7123
7124 if (parse_error == 0 && parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) {
7125 bool has_nexus_entitlement = (necp_skywalk_priv_check_cred(p, kauth_cred_get()) == 0);
7126 if (!has_nexus_entitlement) {
7127 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to open a custom nexus client",
7128 proc_name_address(p), proc_pid(p));
7129 error = EPERM;
7130 goto done;
7131 }
7132 }
7133
7134 if (parse_error == 0 && (parsed_parameters.flags &
7135 (NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER | NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP))) {
7136 bool has_custom_protocol_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_CUSTOM_PROTOCOL, 0) == 0);
7137 if (!has_custom_protocol_entitlement) {
7138 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement for custom protocol APIs",
7139 proc_name_address(p), proc_pid(p));
7140 error = EPERM;
7141 goto done;
7142 }
7143 }
7144
7145 if (parse_error == 0 && parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER &&
7146 (parsed_parameters.ip_protocol == IPPROTO_TCP || parsed_parameters.ip_protocol == IPPROTO_UDP)) {
7147 uint32_t *netns_addr = NULL;
7148 uint8_t netns_addr_len = 0;
7149 struct ns_flow_info flow_info = {};
7150 uint32_t netns_flags = NETNS_LISTENER;
7151 uuid_copy(flow_info.nfi_flow_uuid, client->client_id);
7152 flow_info.nfi_protocol = parsed_parameters.ip_protocol;
7153 flow_info.nfi_owner_pid = client->proc_pid;
7154 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID) {
7155 flow_info.nfi_effective_pid = parsed_parameters.effective_pid;
7156 } else {
7157 flow_info.nfi_effective_pid = flow_info.nfi_owner_pid;
7158 }
7159 proc_name(flow_info.nfi_owner_pid, flow_info.nfi_owner_name, MAXCOMLEN);
7160 proc_name(flow_info.nfi_effective_pid, flow_info.nfi_effective_name, MAXCOMLEN);
7161
7162 if (parsed_parameters.local_addr.sa.sa_family == AF_UNSPEC) {
7163 // Treat no local address as a wildcard IPv6
7164 // parsed_parameters is already initialized to all zeros
7165 parsed_parameters.local_addr.sin6.sin6_family = AF_INET6;
7166 parsed_parameters.local_addr.sin6.sin6_len = sizeof(struct sockaddr_in6);
7167 }
7168
7169 switch (parsed_parameters.local_addr.sa.sa_family) {
7170 case AF_INET: {
7171 memcpy(&flow_info.nfi_laddr, &parsed_parameters.local_addr.sa, parsed_parameters.local_addr.sa.sa_len);
7172 netns_addr = (uint32_t *)&parsed_parameters.local_addr.sin.sin_addr;
7173 netns_addr_len = 4;
7174 break;
7175 }
7176 case AF_INET6: {
7177 memcpy(&flow_info.nfi_laddr, &parsed_parameters.local_addr.sa, parsed_parameters.local_addr.sa.sa_len);
7178 netns_addr = (uint32_t *)&parsed_parameters.local_addr.sin6.sin6_addr;
7179 netns_addr_len = 16;
7180 break;
7181 }
7182
7183 default: {
7184 NECPLOG(LOG_ERR, "necp_client_add listener invalid address family (%d)", parsed_parameters.local_addr.sa.sa_family);
7185 error = EINVAL;
7186 goto done;
7187 }
7188 }
7189 if ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
7190 (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_REUSE_LOCAL)) {
7191 netns_flags |= NETNS_REUSEPORT;
7192 }
7193 if (parsed_parameters.local_addr.sin.sin_port == 0) {
7194 error = netns_reserve_ephemeral(&client->port_reservation, netns_addr, netns_addr_len, parsed_parameters.ip_protocol,
7195 &parsed_parameters.local_addr.sin.sin_port, netns_flags, &flow_info);
7196 if (error) {
7197 NECPLOG(LOG_ERR, "necp_client_add netns_reserve_ephemeral error (%d)", error);
7198 goto done;
7199 }
7200
7201 // Update the parameter TLVs with the assigned port
7202 necp_client_update_local_port_parameters(client->parameters, (u_int32_t)client->parameters_length, parsed_parameters.local_addr.sin.sin_port);
7203 } else {
7204 error = netns_reserve(&client->port_reservation, netns_addr, netns_addr_len, parsed_parameters.ip_protocol,
7205 parsed_parameters.local_addr.sin.sin_port, netns_flags, &flow_info);
7206 if (error) {
7207 NECPLOG(LOG_ERR, "necp_client_add netns_reserve error (%d)", error);
7208 goto done;
7209 }
7210 }
7211 }
7212
7213 struct necp_client *parent = NULL;
7214 uuid_t parent_client_id;
7215 uuid_clear(parent_client_id);
7216 struct necp_client_nexus_parameters parent_parameters = {};
7217 uint16_t num_flow_regs = 0;
7218 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_PARENT_UUID) {
7219 // The parent "should" be found on fd_data without having to search across the whole necp_fd_list
7220 // It would be nice to do this a little further down where there's another instance of NECP_FD_LOCK
7221 // but the logic here depends on the parse paramters
7222 NECP_FD_LOCK(fd_data);
7223 parent = necp_client_fd_find_client_unlocked(fd_data, parsed_parameters.parent_uuid);
7224 if (parent != NULL) {
7225 necp_client_inherit_from_parent(client, parent);
7226 necp_client_copy_parameters_locked(client, &parent_parameters);
7227 uuid_copy(parent_client_id, parsed_parameters.parent_uuid);
7228 struct necp_client_flow_registration *flow_registration = NULL;
7229 RB_FOREACH(flow_registration, _necp_client_flow_tree, &parent->flow_registrations) {
7230 num_flow_regs++;
7231 }
7232 }
7233 NECP_FD_UNLOCK(fd_data);
7234 if (parent == NULL) {
7235 NECPLOG0(LOG_ERR, "necp_client_add, no necp_client_inherit_from_parent as can't find parent on fd_data");
7236 }
7237 }
7238 if (parse_error == 0 && parent != NULL && parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLOW_DEMUX_PATTERN) {
7239 do {
7240 if (parsed_parameters.demux_patterns[0].len == 0) {
7241 NECPLOG0(LOG_INFO, "necp_client_add, child does not have a demux pattern");
7242 break;
7243 }
7244
7245 if (uuid_is_null(parent_client_id)) {
7246 NECPLOG0(LOG_INFO, "necp_client_add, parent ID is null");
7247 break;
7248 }
7249
7250 if (num_flow_regs > 1) {
7251 NECPLOG0(LOG_INFO, "necp_client_add, multiple parent flows not supported");
7252 break;
7253 }
7254 if (parsed_parameters.ip_protocol != IPPROTO_UDP) {
7255 NECPLOG(LOG_INFO, "necp_client_add, flow demux pattern not supported for %d protocol",
7256 parsed_parameters.ip_protocol);
7257 break;
7258 }
7259 if (parsed_parameters.ip_protocol != parent_parameters.ip_protocol) {
7260 NECPLOG0(LOG_INFO, "necp_client_add, parent/child ip protocol mismatch");
7261 break;
7262 }
7263 if (parsed_parameters.local_addr.sa.sa_family != AF_INET && parsed_parameters.local_addr.sa.sa_family != AF_INET6) {
7264 NECPLOG(LOG_INFO, "necp_client_add, flow demux pattern not supported for %d family",
7265 parsed_parameters.local_addr.sa.sa_family);
7266 break;
7267 }
7268 if (parsed_parameters.local_addr.sa.sa_family != parsed_parameters.remote_addr.sa.sa_family) {
7269 NECPLOG0(LOG_INFO, "necp_client_add, local/remote address family mismatch");
7270 break;
7271 }
7272 if (parsed_parameters.local_addr.sa.sa_family != parent_parameters.local_addr.sa.sa_family) {
7273 NECPLOG0(LOG_INFO, "necp_client_add, parent/child address family mismatch");
7274 break;
7275 }
7276 if (memcmp(&parsed_parameters.local_addr.sa, &parent_parameters.local_addr.sa, parsed_parameters.local_addr.sa.sa_len)) {
7277 NECPLOG0(LOG_INFO, "necp_client_add, parent/child local address mismatch");
7278 break;
7279 }
7280 if (memcmp(&parsed_parameters.remote_addr.sa, &parent_parameters.remote_addr.sa, parsed_parameters.remote_addr.sa.sa_len)) {
7281 NECPLOG0(LOG_INFO, "necp_client_add, parent/child remote address mismatch");
7282 break;
7283 }
7284 if (parsed_parameters.local_addr.sin.sin_port != parent_parameters.local_addr.sin.sin_port) {
7285 NECPLOG0(LOG_INFO, "necp_client_add, parent/child local port mismatch");
7286 break;
7287 }
7288 if (parsed_parameters.remote_addr.sin.sin_port != parent_parameters.remote_addr.sin.sin_port) {
7289 NECPLOG0(LOG_INFO, "necp_client_add, parent/child remote port mismatch");
7290 break;
7291 }
7292 client->validated_parent = 1;
7293 uuid_copy(client->parent_client_id, parent_client_id);
7294 } while (false);
7295 }
7296
7297 #endif /* !SKYWALK */
7298
7299 necp_client_update_observer_add(client);
7300
7301 NECP_FD_LOCK(fd_data);
7302 RB_INSERT(_necp_client_tree, &fd_data->clients, client);
7303 OSIncrementAtomic(&necp_client_count);
7304 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
7305 RB_INSERT(_necp_client_global_tree, &necp_client_global_tree, client);
7306 NECP_CLIENT_TREE_UNLOCK();
7307
7308 // Prime the client result
7309 NECP_CLIENT_LOCK(client);
7310 (void)necp_update_client_result(current_proc(), fd_data, client, NULL);
7311 necp_client_retain_locked(client);
7312 NECP_CLIENT_UNLOCK(client);
7313 NECP_FD_UNLOCK(fd_data);
7314 // Now everything is set, it's safe to plumb this in to NetworkStatistics
7315 uint32_t ntstat_properties = 0;
7316 necp_find_conn_netstat_data(client, &ntstat_properties, NULL, NULL, NULL, NULL, NULL);
7317
7318 client->nstat_context = nstat_provider_stats_open((nstat_provider_context)client,
7319 NSTAT_PROVIDER_CONN_USERLAND, (u_int64_t)ntstat_properties, necp_request_conn_netstats, necp_find_conn_extension_info);
7320 necp_client_release(client);
7321 done:
7322 if (error != 0 && client != NULL) {
7323 necp_client_free(client);
7324 client = NULL;
7325 }
7326 *retval = error;
7327
7328 return error;
7329 }
7330
7331 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_claim(struct proc * p,struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7332 necp_client_claim(struct proc *p, struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7333 {
7334 int error = 0;
7335 uuid_t client_id = {};
7336 struct necp_client *client = NULL;
7337
7338 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
7339 error = EINVAL;
7340 goto done;
7341 }
7342
7343 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
7344 if (error) {
7345 NECPLOG(LOG_ERR, "necp_client_claim copyin client_id error (%d)", error);
7346 goto done;
7347 }
7348
7349 if (necp_client_id_is_flow(client_id)) {
7350 NECPLOG0(LOG_ERR, "necp_client_claim cannot claim from flow UUID");
7351 error = EINVAL;
7352 goto done;
7353 }
7354
7355 u_int64_t upid = proc_uniqueid(p);
7356
7357 NECP_FD_LIST_LOCK_SHARED();
7358
7359 struct necp_fd_data *find_fd = NULL;
7360 LIST_FOREACH(find_fd, &necp_fd_list, chain) {
7361 NECP_FD_LOCK(find_fd);
7362 struct necp_client *find_client = necp_client_fd_find_client_and_lock(find_fd, client_id);
7363 if (find_client != NULL) {
7364 if (find_client->delegated_upid == upid &&
7365 RB_EMPTY(&find_client->flow_registrations)) {
7366 // Matched the client to claim; remove from the old fd
7367 client = find_client;
7368 RB_REMOVE(_necp_client_tree, &find_fd->clients, client);
7369 necp_client_retain_locked(client);
7370 }
7371 NECP_CLIENT_UNLOCK(find_client);
7372 }
7373 NECP_FD_UNLOCK(find_fd);
7374
7375 if (client != NULL) {
7376 break;
7377 }
7378 }
7379
7380 NECP_FD_LIST_UNLOCK();
7381
7382 if (client == NULL) {
7383 error = ENOENT;
7384 goto done;
7385 }
7386
7387 client->proc_pid = fd_data->proc_pid; // Transfer client to claiming pid
7388 client->agent_handle = (void *)fd_data;
7389 client->platform_binary = ((csproc_get_platform_binary(p) == 0) ? 0 : 1);
7390
7391 NECP_CLIENT_LOG(client, "Claiming client");
7392
7393 // Add matched client to our fd and re-run result
7394 NECP_FD_LOCK(fd_data);
7395 RB_INSERT(_necp_client_tree, &fd_data->clients, client);
7396 NECP_CLIENT_LOCK(client);
7397 (void)necp_update_client_result(current_proc(), fd_data, client, NULL);
7398 NECP_CLIENT_UNLOCK(client);
7399 NECP_FD_UNLOCK(fd_data);
7400
7401 necp_client_release(client);
7402
7403 done:
7404 *retval = error;
7405
7406 return error;
7407 }
7408
7409 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_remove(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7410 necp_client_remove(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7411 {
7412 int error = 0;
7413 uuid_t client_id = {};
7414 struct ifnet_stats_per_flow flow_ifnet_stats = {};
7415 const size_t buffer_size = uap->buffer_size;
7416
7417 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
7418 error = EINVAL;
7419 goto done;
7420 }
7421
7422 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
7423 if (error) {
7424 NECPLOG(LOG_ERR, "necp_client_remove copyin client_id error (%d)", error);
7425 goto done;
7426 }
7427
7428 if (uap->buffer != 0 && buffer_size == sizeof(flow_ifnet_stats)) {
7429 error = copyin(uap->buffer, &flow_ifnet_stats, buffer_size);
7430 if (error) {
7431 NECPLOG(LOG_ERR, "necp_client_remove flow_ifnet_stats copyin error (%d)", error);
7432 // Not fatal; make sure to zero-out stats in case of partial copy
7433 memset(&flow_ifnet_stats, 0, sizeof(flow_ifnet_stats));
7434 error = 0;
7435 }
7436 } else if (uap->buffer != 0) {
7437 NECPLOG(LOG_ERR, "necp_client_remove unexpected parameters length (%zu)", buffer_size);
7438 }
7439
7440 NECP_FD_LOCK(fd_data);
7441
7442 pid_t pid = fd_data->proc_pid;
7443 struct necp_client *client = necp_client_fd_find_client_unlocked(fd_data, client_id);
7444
7445 NECP_CLIENT_LOG(client, "Removing client");
7446
7447 if (client != NULL) {
7448 // Remove any flow registrations that match
7449 struct necp_client_flow_registration *flow_registration = NULL;
7450 struct necp_client_flow_registration *temp_flow_registration = NULL;
7451 RB_FOREACH_SAFE(flow_registration, _necp_fd_flow_tree, &fd_data->flows, temp_flow_registration) {
7452 if (flow_registration->client == client) {
7453 #if SKYWALK
7454 necp_destroy_flow_stats(fd_data, flow_registration, NULL, TRUE);
7455 #endif /* SKYWALK */
7456 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
7457 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
7458 NECP_FLOW_TREE_UNLOCK();
7459 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
7460 }
7461 }
7462 #if SKYWALK
7463 if (client->nstat_context != NULL) {
7464 // Main path, we expect stats to be in existance at this point
7465 nstat_provider_stats_close(client->nstat_context);
7466 client->nstat_context = NULL;
7467 } else {
7468 NECPLOG0(LOG_ERR, "necp_client_remove ntstat shutdown finds nstat_context NULL");
7469 }
7470 #endif /* SKYWALK */
7471 // Remove client from lists
7472 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
7473 RB_REMOVE(_necp_client_global_tree, &necp_client_global_tree, client);
7474 NECP_CLIENT_TREE_UNLOCK();
7475 RB_REMOVE(_necp_client_tree, &fd_data->clients, client);
7476 }
7477
7478 #if SKYWALK
7479 // If the currently-active arena is idle (has no more flows referring to it), or if there are defunct
7480 // arenas lingering in the list, schedule a threadcall to do the clean up. The idle check is done
7481 // by checking if the reference count is 3: one held by this client (will be released below when we
7482 // destroy it) when it's non-NULL; the rest held by stats_arena_{active,list}.
7483 if ((fd_data->stats_arena_active != NULL && fd_data->stats_arena_active->nai_use_count == 3) ||
7484 (fd_data->stats_arena_active == NULL && !LIST_EMPTY(&fd_data->stats_arena_list))) {
7485 uint64_t deadline = 0;
7486 uint64_t leeway = 0;
7487 clock_interval_to_deadline(necp_close_arenas_timeout_microseconds, NSEC_PER_USEC, &deadline);
7488 clock_interval_to_absolutetime_interval(necp_close_arenas_timeout_leeway_microseconds, NSEC_PER_USEC, &leeway);
7489
7490 thread_call_enter_delayed_with_leeway(necp_close_empty_arenas_tcall, NULL,
7491 deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
7492 }
7493 #endif /* SKYWALK */
7494
7495 NECP_FD_UNLOCK(fd_data);
7496
7497 if (client != NULL) {
7498 ASSERT(error == 0);
7499 necp_destroy_client(client, pid, true);
7500 } else {
7501 error = ENOENT;
7502 NECPLOG(LOG_ERR, "necp_client_remove invalid client_id (%d)", error);
7503 }
7504 done:
7505 *retval = error;
7506
7507 return error;
7508 }
7509
7510 static struct necp_client_flow_registration *
necp_client_fd_find_flow(struct necp_fd_data * client_fd,uuid_t flow_id)7511 necp_client_fd_find_flow(struct necp_fd_data *client_fd, uuid_t flow_id)
7512 {
7513 NECP_FD_ASSERT_LOCKED(client_fd);
7514 struct necp_client_flow_registration *flow = NULL;
7515
7516 if (necp_client_id_is_flow(flow_id)) {
7517 struct necp_client_flow_registration find;
7518 uuid_copy(find.registration_id, flow_id);
7519 flow = RB_FIND(_necp_fd_flow_tree, &client_fd->flows, &find);
7520 }
7521
7522 return flow;
7523 }
7524
7525 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_remove_flow(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7526 necp_client_remove_flow(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7527 {
7528 int error = 0;
7529 uuid_t flow_id = {};
7530 struct ifnet_stats_per_flow flow_ifnet_stats = {};
7531 const size_t buffer_size = uap->buffer_size;
7532
7533 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
7534 error = EINVAL;
7535 NECPLOG(LOG_ERR, "necp_client_remove_flow invalid client_id (length %zu)", (size_t)uap->client_id_len);
7536 goto done;
7537 }
7538
7539 error = copyin(uap->client_id, flow_id, sizeof(uuid_t));
7540 if (error) {
7541 NECPLOG(LOG_ERR, "necp_client_remove_flow copyin client_id error (%d)", error);
7542 goto done;
7543 }
7544
7545 if (uap->buffer != 0 && buffer_size == sizeof(flow_ifnet_stats)) {
7546 error = copyin(uap->buffer, &flow_ifnet_stats, buffer_size);
7547 if (error) {
7548 NECPLOG(LOG_ERR, "necp_client_remove flow_ifnet_stats copyin error (%d)", error);
7549 // Not fatal
7550 }
7551 } else if (uap->buffer != 0) {
7552 NECPLOG(LOG_ERR, "necp_client_remove unexpected parameters length (%zu)", buffer_size);
7553 }
7554
7555 NECP_FD_LOCK(fd_data);
7556 struct necp_client *client = NULL;
7557 struct necp_client_flow_registration *flow_registration = necp_client_fd_find_flow(fd_data, flow_id);
7558 if (flow_registration != NULL) {
7559 #if SKYWALK
7560 // Cleanup stats per flow
7561 necp_destroy_flow_stats(fd_data, flow_registration, &flow_ifnet_stats, TRUE);
7562 #endif /* SKYWALK */
7563 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
7564 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
7565 NECP_FLOW_TREE_UNLOCK();
7566 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
7567
7568 client = flow_registration->client;
7569 if (client != NULL) {
7570 necp_client_retain(client);
7571 }
7572 }
7573 NECP_FD_UNLOCK(fd_data);
7574
7575 NECP_CLIENT_FLOW_LOG(client, flow_registration, "removing flow");
7576
7577 if (flow_registration != NULL && client != NULL) {
7578 NECP_CLIENT_LOCK(client);
7579 if (flow_registration->client == client) {
7580 necp_destroy_client_flow_registration(client, flow_registration, fd_data->proc_pid, false);
7581 }
7582 necp_client_release_locked(client);
7583 NECP_CLIENT_UNLOCK(client);
7584 }
7585
7586 done:
7587 *retval = error;
7588 if (error != 0) {
7589 NECPLOG(LOG_ERR, "Remove flow error (%d)", error);
7590 }
7591
7592 return error;
7593 }
7594
7595 // Don't inline the function since it includes necp_client_parsed_parameters on the stack
7596 static __attribute__((noinline)) int
necp_client_check_tcp_heuristics(struct necp_client * client,struct necp_client_flow * flow,u_int32_t * flags,u_int8_t * tfo_cookie,u_int8_t * tfo_cookie_len)7597 necp_client_check_tcp_heuristics(struct necp_client *client, struct necp_client_flow *flow, u_int32_t *flags, u_int8_t *tfo_cookie, u_int8_t *tfo_cookie_len)
7598 {
7599 struct necp_client_parsed_parameters parsed_parameters;
7600 int error = 0;
7601
7602 error = necp_client_parse_parameters(client, client->parameters,
7603 (u_int32_t)client->parameters_length,
7604 &parsed_parameters);
7605 if (error) {
7606 NECPLOG(LOG_ERR, "necp_client_parse_parameters error (%d)", error);
7607 return error;
7608 }
7609
7610 if ((flow->remote_addr.sa.sa_family != AF_INET &&
7611 flow->remote_addr.sa.sa_family != AF_INET6) ||
7612 (flow->local_addr.sa.sa_family != AF_INET &&
7613 flow->local_addr.sa.sa_family != AF_INET6)) {
7614 return EINVAL;
7615 }
7616
7617 NECP_CLIENT_ROUTE_LOCK(client);
7618
7619 if (client->current_route == NULL) {
7620 error = ENOENT;
7621 goto do_unlock;
7622 }
7623
7624 bool check_ecn = false;
7625 do {
7626 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) ==
7627 NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) {
7628 check_ecn = true;
7629 break;
7630 }
7631
7632 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) ==
7633 NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) {
7634 break;
7635 }
7636
7637 if (client->current_route != NULL) {
7638 if (client->current_route->rt_ifp->if_eflags & IFEF_ECN_ENABLE) {
7639 check_ecn = true;
7640 break;
7641 }
7642 if (client->current_route->rt_ifp->if_eflags & IFEF_ECN_DISABLE) {
7643 break;
7644 }
7645 }
7646
7647 bool inbound = ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) == 0);
7648 if ((inbound && tcp_ecn_inbound == 1) ||
7649 (!inbound && tcp_ecn_outbound == 1)) {
7650 check_ecn = true;
7651 }
7652 } while (false);
7653
7654 if (check_ecn) {
7655 if (tcp_heuristic_do_ecn_with_address(client->current_route->rt_ifp,
7656 (union sockaddr_in_4_6 *)&flow->local_addr)) {
7657 *flags |= NECP_CLIENT_RESULT_FLAG_ECN_ENABLED;
7658 }
7659 }
7660
7661 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) ==
7662 NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) {
7663 if (!tcp_heuristic_do_tfo_with_address(client->current_route->rt_ifp,
7664 (union sockaddr_in_4_6 *)&flow->local_addr,
7665 (union sockaddr_in_4_6 *)&flow->remote_addr,
7666 tfo_cookie, tfo_cookie_len)) {
7667 *flags |= NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED;
7668 *tfo_cookie_len = 0;
7669 }
7670 } else {
7671 *flags |= NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED;
7672 *tfo_cookie_len = 0;
7673 }
7674 do_unlock:
7675 NECP_CLIENT_ROUTE_UNLOCK(client);
7676
7677 return error;
7678 }
7679
7680 static size_t
necp_client_calculate_flow_tlv_size(struct necp_client_flow_registration * flow_registration)7681 necp_client_calculate_flow_tlv_size(struct necp_client_flow_registration *flow_registration)
7682 {
7683 size_t assigned_results_size = 0;
7684 struct necp_client_flow *flow = NULL;
7685 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
7686 if (flow->assigned || !necp_client_endpoint_is_unspecified((struct necp_client_endpoint *)&flow->remote_addr)) {
7687 size_t header_length = 0;
7688 if (flow->nexus) {
7689 header_length = sizeof(struct necp_client_nexus_flow_header);
7690 } else {
7691 header_length = sizeof(struct necp_client_flow_header);
7692 }
7693 assigned_results_size += (header_length + flow->assigned_results_length);
7694
7695 if (flow->has_protoctl_event) {
7696 assigned_results_size += sizeof(struct necp_client_flow_protoctl_event_header);
7697 }
7698 }
7699 }
7700 return assigned_results_size;
7701 }
7702
7703 static int
necp_client_fillout_flow_tlvs(struct necp_client * client,bool client_is_observed,struct necp_client_flow_registration * flow_registration,struct necp_client_action_args * uap,size_t * assigned_results_cursor)7704 necp_client_fillout_flow_tlvs(struct necp_client *client,
7705 bool client_is_observed,
7706 struct necp_client_flow_registration *flow_registration,
7707 struct necp_client_action_args *uap,
7708 size_t *assigned_results_cursor)
7709 {
7710 int error = 0;
7711 struct necp_client_flow *flow = NULL;
7712 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
7713 if (flow->assigned || !necp_client_endpoint_is_unspecified((struct necp_client_endpoint *)&flow->remote_addr)) {
7714 // Write TLV headers
7715 struct necp_client_nexus_flow_header header = {};
7716 u_int32_t length = 0;
7717 u_int32_t flags = 0;
7718 u_int8_t tfo_cookie_len = 0;
7719 u_int8_t type = 0;
7720
7721 type = NECP_CLIENT_RESULT_FLOW_ID;
7722 length = sizeof(header.flow_header.flow_id);
7723 memcpy(&header.flow_header.flow_id_tlv_header.type, &type, sizeof(type));
7724 memcpy(&header.flow_header.flow_id_tlv_header.length, &length, sizeof(length));
7725 uuid_copy(header.flow_header.flow_id, flow_registration->registration_id);
7726
7727 if (flow->nexus) {
7728 if (flow->check_tcp_heuristics) {
7729 u_int8_t tfo_cookie[NECP_TFO_COOKIE_LEN_MAX];
7730 tfo_cookie_len = NECP_TFO_COOKIE_LEN_MAX;
7731
7732 if (necp_client_check_tcp_heuristics(client, flow, &flags,
7733 tfo_cookie, &tfo_cookie_len) != 0) {
7734 tfo_cookie_len = 0;
7735 } else {
7736 flow->check_tcp_heuristics = FALSE;
7737
7738 if (tfo_cookie_len != 0) {
7739 type = NECP_CLIENT_RESULT_TFO_COOKIE;
7740 length = tfo_cookie_len;
7741 memcpy(&header.tfo_cookie_tlv_header.type, &type, sizeof(type));
7742 memcpy(&header.tfo_cookie_tlv_header.length, &length, sizeof(length));
7743 memcpy(&header.tfo_cookie_value, tfo_cookie, tfo_cookie_len);
7744 }
7745 }
7746 }
7747 }
7748
7749 size_t header_length = 0;
7750 if (flow->nexus) {
7751 if (tfo_cookie_len != 0) {
7752 header_length = sizeof(struct necp_client_nexus_flow_header) - (NECP_TFO_COOKIE_LEN_MAX - tfo_cookie_len);
7753 } else {
7754 header_length = sizeof(struct necp_client_nexus_flow_header) - sizeof(struct necp_tlv_header) - NECP_TFO_COOKIE_LEN_MAX;
7755 }
7756 } else {
7757 header_length = sizeof(struct necp_client_flow_header);
7758 }
7759
7760 type = NECP_CLIENT_RESULT_FLAGS;
7761 length = sizeof(header.flow_header.flags_value);
7762 memcpy(&header.flow_header.flags_tlv_header.type, &type, sizeof(type));
7763 memcpy(&header.flow_header.flags_tlv_header.length, &length, sizeof(length));
7764 if (flow->assigned) {
7765 flags |= NECP_CLIENT_RESULT_FLAG_FLOW_ASSIGNED;
7766 }
7767 if (flow->viable) {
7768 flags |= NECP_CLIENT_RESULT_FLAG_FLOW_VIABLE;
7769 }
7770 if (flow_registration->defunct) {
7771 flags |= NECP_CLIENT_RESULT_FLAG_DEFUNCT;
7772 }
7773 flags |= flow->necp_flow_flags;
7774 memcpy(&header.flow_header.flags_value, &flags, sizeof(flags));
7775
7776 type = NECP_CLIENT_RESULT_INTERFACE;
7777 length = sizeof(header.flow_header.interface_value);
7778 memcpy(&header.flow_header.interface_tlv_header.type, &type, sizeof(type));
7779 memcpy(&header.flow_header.interface_tlv_header.length, &length, sizeof(length));
7780
7781 struct necp_client_result_interface interface_struct;
7782 interface_struct.generation = 0;
7783 interface_struct.index = flow->interface_index;
7784
7785 memcpy(&header.flow_header.interface_value, &interface_struct, sizeof(interface_struct));
7786 if (flow->nexus) {
7787 type = NECP_CLIENT_RESULT_NETAGENT;
7788 length = sizeof(header.agent_value);
7789 memcpy(&header.agent_tlv_header.type, &type, sizeof(type));
7790 memcpy(&header.agent_tlv_header.length, &length, sizeof(length));
7791
7792 struct necp_client_result_netagent agent_struct;
7793 uuid_copy(agent_struct.netagent_uuid, flow->u.nexus_agent);
7794 agent_struct.generation = netagent_get_generation(agent_struct.netagent_uuid);
7795
7796 memcpy(&header.agent_value, &agent_struct, sizeof(agent_struct));
7797 }
7798
7799 // Don't include outer TLV header in length field
7800 type = NECP_CLIENT_RESULT_FLOW;
7801 length = (header_length - sizeof(struct necp_tlv_header) + flow->assigned_results_length);
7802 if (flow->has_protoctl_event) {
7803 length += sizeof(struct necp_client_flow_protoctl_event_header);
7804 }
7805 memcpy(&header.flow_header.outer_header.type, &type, sizeof(type));
7806 memcpy(&header.flow_header.outer_header.length, &length, sizeof(length));
7807
7808 error = copyout(&header, uap->buffer + client->result_length + *assigned_results_cursor, header_length);
7809 if (error) {
7810 NECPLOG(LOG_ERR, "necp_client_copy assigned results tlv_header copyout error (%d)", error);
7811 return error;
7812 }
7813 *assigned_results_cursor += header_length;
7814
7815 if (flow->assigned_results && flow->assigned_results_length) {
7816 // Write inner TLVs
7817 error = copyout(flow->assigned_results, uap->buffer + client->result_length + *assigned_results_cursor,
7818 flow->assigned_results_length);
7819 if (error) {
7820 NECPLOG(LOG_ERR, "necp_client_copy assigned results copyout error (%d)", error);
7821 return error;
7822 }
7823 }
7824 *assigned_results_cursor += flow->assigned_results_length;
7825
7826 /* Read the protocol event and reset it */
7827 if (flow->has_protoctl_event) {
7828 struct necp_client_flow_protoctl_event_header protoctl_event_header = {};
7829
7830 type = NECP_CLIENT_RESULT_PROTO_CTL_EVENT;
7831 length = sizeof(protoctl_event_header.protoctl_event);
7832
7833 memcpy(&protoctl_event_header.protoctl_tlv_header.type, &type, sizeof(type));
7834 memcpy(&protoctl_event_header.protoctl_tlv_header.length, &length, sizeof(length));
7835 memcpy(&protoctl_event_header.protoctl_event, &flow->protoctl_event,
7836 sizeof(flow->protoctl_event));
7837
7838 error = copyout(&protoctl_event_header, uap->buffer + client->result_length + *assigned_results_cursor,
7839 sizeof(protoctl_event_header));
7840
7841 if (error) {
7842 NECPLOG(LOG_ERR, "necp_client_copy protocol control event results"
7843 " tlv_header copyout error (%d)", error);
7844 return error;
7845 }
7846 *assigned_results_cursor += sizeof(protoctl_event_header);
7847 flow->has_protoctl_event = FALSE;
7848 flow->protoctl_event.protoctl_event_code = 0;
7849 flow->protoctl_event.protoctl_event_val = 0;
7850 flow->protoctl_event.protoctl_event_tcp_seq_num = 0;
7851 }
7852 }
7853 }
7854 if (!client_is_observed) {
7855 flow_registration->flow_result_read = TRUE;
7856 }
7857 return 0;
7858 }
7859
7860 static int
necp_client_copy_internal(struct necp_client * client,uuid_t client_id,bool client_is_observed,struct necp_client_action_args * uap,int * retval)7861 necp_client_copy_internal(struct necp_client *client, uuid_t client_id, bool client_is_observed, struct necp_client_action_args *uap, int *retval)
7862 {
7863 NECP_CLIENT_ASSERT_LOCKED(client);
7864 int error = 0;
7865 // Copy results out
7866 if (uap->action == NECP_CLIENT_ACTION_COPY_PARAMETERS) {
7867 if (uap->buffer_size < client->parameters_length) {
7868 return EINVAL;
7869 }
7870 error = copyout(client->parameters, uap->buffer, client->parameters_length);
7871 if (error) {
7872 NECPLOG(LOG_ERR, "necp_client_copy parameters copyout error (%d)", error);
7873 return error;
7874 }
7875 *retval = client->parameters_length;
7876 } else if (uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT &&
7877 client->result_read && client->group_members_read && !necp_client_has_unread_flows(client)) {
7878 // Copy updates only, but nothing to read
7879 // Just return 0 for bytes read
7880 *retval = 0;
7881 } else if (uap->action == NECP_CLIENT_ACTION_COPY_RESULT ||
7882 uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
7883 size_t assigned_results_size = client->assigned_group_members_length;
7884
7885 bool some_flow_is_defunct = false;
7886 struct necp_client_flow_registration *single_flow_registration = NULL;
7887 if (necp_client_id_is_flow(client_id)) {
7888 single_flow_registration = necp_client_find_flow(client, client_id);
7889 if (single_flow_registration != NULL) {
7890 assigned_results_size += necp_client_calculate_flow_tlv_size(single_flow_registration);
7891 }
7892 } else {
7893 // This request is for the client, so copy everything
7894 struct necp_client_flow_registration *flow_registration = NULL;
7895 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
7896 if (flow_registration->defunct) {
7897 some_flow_is_defunct = true;
7898 }
7899 assigned_results_size += necp_client_calculate_flow_tlv_size(flow_registration);
7900 }
7901 }
7902 if (uap->buffer_size < (client->result_length + assigned_results_size)) {
7903 return EINVAL;
7904 }
7905
7906 u_int32_t original_flags = 0;
7907 bool flags_updated = false;
7908 if (some_flow_is_defunct && client->legacy_client_is_flow) {
7909 // If our client expects the defunct flag in the client, add it now
7910 u_int32_t client_flags = 0;
7911 u_int32_t value_size = 0;
7912 u_int8_t *flags_pointer = necp_buffer_get_tlv_value(client->result, 0, &value_size);
7913 if (flags_pointer != NULL && value_size == sizeof(client_flags)) {
7914 memcpy(&client_flags, flags_pointer, value_size);
7915 original_flags = client_flags;
7916 client_flags |= NECP_CLIENT_RESULT_FLAG_DEFUNCT;
7917 (void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS,
7918 sizeof(client_flags), &client_flags, &flags_updated,
7919 client->result, sizeof(client->result));
7920 }
7921 }
7922
7923 error = copyout(client->result, uap->buffer, client->result_length);
7924
7925 if (flags_updated) {
7926 // Revert stored flags
7927 (void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS,
7928 sizeof(original_flags), &original_flags, &flags_updated,
7929 client->result, sizeof(client->result));
7930 }
7931
7932 if (error != 0) {
7933 NECPLOG(LOG_ERR, "necp_client_copy result copyout error (%d)", error);
7934 return error;
7935 }
7936
7937 if (client->assigned_group_members != NULL && client->assigned_group_members_length > 0) {
7938 error = copyout(client->assigned_group_members, uap->buffer + client->result_length, client->assigned_group_members_length);
7939 if (error != 0) {
7940 NECPLOG(LOG_ERR, "necp_client_copy group members copyout error (%d)", error);
7941 return error;
7942 }
7943 }
7944
7945 size_t assigned_results_cursor = client->assigned_group_members_length; // Start with an offset based on the group members
7946 if (necp_client_id_is_flow(client_id)) {
7947 if (single_flow_registration != NULL) {
7948 error = necp_client_fillout_flow_tlvs(client, client_is_observed, single_flow_registration, uap, &assigned_results_cursor);
7949 if (error != 0) {
7950 return error;
7951 }
7952 }
7953 } else {
7954 // This request is for the client, so copy everything
7955 struct necp_client_flow_registration *flow_registration = NULL;
7956 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
7957 error = necp_client_fillout_flow_tlvs(client, client_is_observed, flow_registration, uap, &assigned_results_cursor);
7958 if (error != 0) {
7959 return error;
7960 }
7961 }
7962 }
7963
7964 *retval = client->result_length + assigned_results_cursor;
7965
7966 if (!client_is_observed) {
7967 client->result_read = TRUE;
7968 client->group_members_read = TRUE;
7969 }
7970 }
7971
7972 return 0;
7973 }
7974
7975 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7976 necp_client_copy(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7977 {
7978 int error = 0;
7979 struct necp_client *client = NULL;
7980 uuid_t client_id;
7981 uuid_clear(client_id);
7982
7983 *retval = 0;
7984
7985 if (uap->buffer_size == 0 || uap->buffer == 0) {
7986 return EINVAL;
7987 }
7988
7989 if (uap->action != NECP_CLIENT_ACTION_COPY_PARAMETERS &&
7990 uap->action != NECP_CLIENT_ACTION_COPY_RESULT &&
7991 uap->action != NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
7992 return EINVAL;
7993 }
7994
7995 if (uap->client_id) {
7996 if (uap->client_id_len != sizeof(uuid_t)) {
7997 NECPLOG(LOG_ERR, "Incorrect length (got %zu, expected %zu)", (size_t)uap->client_id_len, sizeof(uuid_t));
7998 return ERANGE;
7999 }
8000
8001 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8002 if (error) {
8003 NECPLOG(LOG_ERR, "necp_client_copy client_id copyin error (%d)", error);
8004 return error;
8005 }
8006 }
8007
8008 const bool is_wildcard = (bool)uuid_is_null(client_id);
8009
8010 NECP_FD_LOCK(fd_data);
8011
8012 bool send_in_process_flow_divert_message = false;
8013 if (is_wildcard) {
8014 if (uap->action == NECP_CLIENT_ACTION_COPY_RESULT || uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
8015 struct necp_client *find_client = NULL;
8016 RB_FOREACH(find_client, _necp_client_tree, &fd_data->clients) {
8017 NECP_CLIENT_LOCK(find_client);
8018 if (!find_client->result_read || !find_client->group_members_read || necp_client_has_unread_flows(find_client)) {
8019 client = find_client;
8020 // Leave the client locked, and break
8021 break;
8022 }
8023 NECP_CLIENT_UNLOCK(find_client);
8024 }
8025
8026 if (client == NULL && fd_data->request_in_process_flow_divert) {
8027 // No client found that needs update. Check for an event requesting in-process flow divert.
8028 send_in_process_flow_divert_message = true;
8029 }
8030 }
8031 } else {
8032 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8033 }
8034
8035 if (client != NULL) {
8036 if (!send_in_process_flow_divert_message) {
8037 // If client is set, it is locked
8038 error = necp_client_copy_internal(client, client_id, FALSE, uap, retval);
8039 }
8040 NECP_CLIENT_UNLOCK(client);
8041 }
8042
8043 if (send_in_process_flow_divert_message) {
8044 fd_data->request_in_process_flow_divert = false;
8045
8046 struct necp_tlv_header request_tlv = {
8047 .type = NECP_CLIENT_RESULT_REQUEST_IN_PROCESS_FLOW_DIVERT,
8048 .length = 0,
8049 };
8050 if (uap->buffer_size < sizeof(request_tlv)) {
8051 error = EINVAL;
8052 } else {
8053 error = copyout(&request_tlv, uap->buffer, sizeof(request_tlv));
8054 if (error) {
8055 NECPLOG(LOG_ERR, "necp_client_copy request flow divert TLV copyout error (%d)", error);
8056 } else {
8057 *retval = sizeof(request_tlv);
8058 }
8059 }
8060 }
8061
8062 // Unlock our own fd before moving on or returning
8063 NECP_FD_UNLOCK(fd_data);
8064
8065 if (client == NULL && !send_in_process_flow_divert_message) {
8066 if (fd_data->flags & NECP_OPEN_FLAG_OBSERVER) {
8067 // Observers are allowed to lookup clients on other fds
8068
8069 // Lock tree
8070 NECP_CLIENT_TREE_LOCK_SHARED();
8071
8072 bool found_client = FALSE;
8073
8074 client = necp_find_client_and_lock(client_id);
8075 if (client != NULL) {
8076 // Matched, copy out data
8077 found_client = TRUE;
8078 error = necp_client_copy_internal(client, client_id, TRUE, uap, retval);
8079 NECP_CLIENT_UNLOCK(client);
8080 }
8081
8082 // Unlock tree
8083 NECP_CLIENT_TREE_UNLOCK();
8084
8085 // No client found, fail
8086 if (!found_client) {
8087 return ENOENT;
8088 }
8089 } else {
8090 // No client found, and not allowed to search other fds, fail
8091 return ENOENT;
8092 }
8093 }
8094
8095 return error;
8096 }
8097
8098 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_client_update(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8099 necp_client_copy_client_update(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8100 {
8101 int error = 0;
8102
8103 *retval = 0;
8104
8105 if (!(fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER)) {
8106 NECPLOG0(LOG_ERR, "NECP fd is not observer, cannot copy client update");
8107 return EINVAL;
8108 }
8109
8110 if (uap->client_id_len != sizeof(uuid_t) || uap->client_id == 0) {
8111 NECPLOG0(LOG_ERR, "Client id invalid, cannot copy client update");
8112 return EINVAL;
8113 }
8114
8115 if (uap->buffer_size == 0 || uap->buffer == 0) {
8116 NECPLOG0(LOG_ERR, "Buffer invalid, cannot copy client update");
8117 return EINVAL;
8118 }
8119
8120 NECP_FD_LOCK(fd_data);
8121 struct necp_client_update *client_update = TAILQ_FIRST(&fd_data->update_list);
8122 if (client_update != NULL) {
8123 TAILQ_REMOVE(&fd_data->update_list, client_update, chain);
8124 VERIFY(fd_data->update_count > 0);
8125 fd_data->update_count--;
8126 }
8127 NECP_FD_UNLOCK(fd_data);
8128
8129 if (client_update != NULL) {
8130 error = copyout(client_update->client_id, uap->client_id, sizeof(uuid_t));
8131 if (error) {
8132 NECPLOG(LOG_ERR, "Copy client update copyout client id error (%d)", error);
8133 } else {
8134 if (uap->buffer_size < client_update->update_length) {
8135 NECPLOG(LOG_ERR, "Buffer size cannot hold update (%zu < %zu)", (size_t)uap->buffer_size, client_update->update_length);
8136 error = EINVAL;
8137 } else {
8138 error = copyout(client_update->update, uap->buffer, client_update->update_length);
8139 if (error) {
8140 NECPLOG(LOG_ERR, "Copy client update copyout error (%d)", error);
8141 } else {
8142 *retval = client_update->update_length;
8143 }
8144 }
8145 }
8146
8147 necp_client_update_free(client_update);
8148 client_update = NULL;
8149 } else {
8150 error = ENOENT;
8151 }
8152
8153 return error;
8154 }
8155
8156 static int
necp_client_copy_parameters_locked(struct necp_client * client,struct necp_client_nexus_parameters * parameters)8157 necp_client_copy_parameters_locked(struct necp_client *client,
8158 struct necp_client_nexus_parameters *parameters)
8159 {
8160 VERIFY(parameters != NULL);
8161
8162 struct necp_client_parsed_parameters parsed_parameters = {};
8163 int error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, &parsed_parameters);
8164
8165 parameters->pid = client->proc_pid;
8166 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID) {
8167 parameters->epid = parsed_parameters.effective_pid;
8168 } else {
8169 parameters->epid = parameters->pid;
8170 }
8171 #if SKYWALK
8172 parameters->port_reservation = client->port_reservation;
8173 #endif /* !SKYWALK */
8174 memcpy(¶meters->local_addr, &parsed_parameters.local_addr, sizeof(parameters->local_addr));
8175 memcpy(¶meters->remote_addr, &parsed_parameters.remote_addr, sizeof(parameters->remote_addr));
8176 parameters->ip_protocol = parsed_parameters.ip_protocol;
8177 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL) {
8178 parameters->transport_protocol = parsed_parameters.transport_protocol;
8179 } else {
8180 parameters->transport_protocol = parsed_parameters.ip_protocol;
8181 }
8182 parameters->ethertype = parsed_parameters.ethertype;
8183 parameters->traffic_class = parsed_parameters.traffic_class;
8184 if (uuid_is_null(client->override_euuid)) {
8185 uuid_copy(parameters->euuid, parsed_parameters.effective_uuid);
8186 } else {
8187 uuid_copy(parameters->euuid, client->override_euuid);
8188 }
8189 parameters->is_listener = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) ? 1 : 0;
8190 parameters->is_interpose = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) ? 1 : 0;
8191 parameters->is_custom_ether = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) ? 1 : 0;
8192 parameters->policy_id = client->policy_id;
8193 parameters->skip_policy_id = client->skip_policy_id;
8194
8195 // parse client result flag
8196 u_int32_t client_result_flags = 0;
8197 u_int32_t value_size = 0;
8198 u_int8_t *flags_pointer = NULL;
8199 flags_pointer = necp_buffer_get_tlv_value(client->result, 0, &value_size);
8200 if (flags_pointer && value_size == sizeof(client_result_flags)) {
8201 memcpy(&client_result_flags, flags_pointer, value_size);
8202 }
8203 parameters->allow_qos_marking = (client_result_flags & NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING) ? 1 : 0;
8204
8205 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE) {
8206 if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_DEFAULT) {
8207 parameters->override_address_selection = false;
8208 } else if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_TEMPORARY) {
8209 parameters->override_address_selection = true;
8210 parameters->use_stable_address = false;
8211 } else if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_STABLE) {
8212 parameters->override_address_selection = true;
8213 parameters->use_stable_address = true;
8214 }
8215 } else {
8216 parameters->override_address_selection = false;
8217 }
8218
8219 if ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
8220 (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_NO_WAKE_FROM_SLEEP)) {
8221 parameters->no_wake_from_sleep = true;
8222 }
8223
8224 if ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
8225 (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_REUSE_LOCAL)) {
8226 parameters->reuse_port = true;
8227 }
8228
8229 #if SKYWALK
8230 if (!parameters->is_listener) {
8231 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLOW_DEMUX_PATTERN) {
8232 if (parsed_parameters.demux_patterns[0].len == 0) {
8233 parameters->is_demuxable_parent = 1;
8234 } else {
8235 if (client->validated_parent) {
8236 ASSERT(!uuid_is_null(client->parent_client_id));
8237
8238 NECP_CLIENT_TREE_LOCK_SHARED();
8239 struct necp_client *parent = necp_find_client_and_lock(client->parent_client_id);
8240 if (parent != NULL) {
8241 struct necp_client_flow_registration *parent_flow_registration = NULL;
8242 RB_FOREACH(parent_flow_registration, _necp_client_flow_tree, &parent->flow_registrations) {
8243 uuid_copy(parameters->parent_flow_uuid, parent_flow_registration->registration_id);
8244 break;
8245 }
8246
8247 NECP_CLIENT_UNLOCK(parent);
8248 }
8249 NECP_CLIENT_TREE_UNLOCK();
8250
8251 if (parsed_parameters.demux_pattern_count > 0) {
8252 for (int i = 0; i < parsed_parameters.demux_pattern_count; i++) {
8253 memcpy(¶meters->demux_patterns[i], &parsed_parameters.demux_patterns[i], sizeof(struct necp_demux_pattern));
8254 }
8255 parameters->demux_pattern_count = parsed_parameters.demux_pattern_count;
8256 }
8257 }
8258 }
8259 }
8260 }
8261 #endif // SKYWALK
8262
8263 return error;
8264 }
8265
8266 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_list(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8267 necp_client_list(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8268 {
8269 int error = 0;
8270 struct necp_client *find_client = NULL;
8271 uuid_t *list = NULL;
8272 u_int32_t requested_client_count = 0;
8273 u_int32_t client_count = 0;
8274 size_t copy_buffer_size = 0;
8275
8276 if (uap->buffer_size < sizeof(requested_client_count) || uap->buffer == 0) {
8277 error = EINVAL;
8278 goto done;
8279 }
8280
8281 if (!(fd_data->flags & NECP_OPEN_FLAG_OBSERVER)) {
8282 NECPLOG0(LOG_ERR, "Client does not hold necessary entitlement to list other NECP clients");
8283 error = EACCES;
8284 goto done;
8285 }
8286
8287 error = copyin(uap->buffer, &requested_client_count, sizeof(requested_client_count));
8288 if (error) {
8289 goto done;
8290 }
8291
8292 if (os_mul_overflow(sizeof(uuid_t), requested_client_count, ©_buffer_size)) {
8293 error = ERANGE;
8294 goto done;
8295 }
8296
8297 if (uap->buffer_size - sizeof(requested_client_count) != copy_buffer_size) {
8298 error = EINVAL;
8299 goto done;
8300 }
8301
8302 if (copy_buffer_size > NECP_MAX_CLIENT_LIST_SIZE) {
8303 error = EINVAL;
8304 goto done;
8305 }
8306
8307 if (requested_client_count > 0) {
8308 if ((list = (uuid_t*)kalloc_data(copy_buffer_size, Z_WAITOK | Z_ZERO)) == NULL) {
8309 error = ENOMEM;
8310 goto done;
8311 }
8312 }
8313
8314 // Lock tree
8315 NECP_CLIENT_TREE_LOCK_SHARED();
8316
8317 find_client = NULL;
8318 RB_FOREACH(find_client, _necp_client_global_tree, &necp_client_global_tree) {
8319 NECP_CLIENT_LOCK(find_client);
8320 if (!uuid_is_null(find_client->client_id)) {
8321 if (client_count < requested_client_count) {
8322 uuid_copy(list[client_count], find_client->client_id);
8323 }
8324 client_count++;
8325 }
8326 NECP_CLIENT_UNLOCK(find_client);
8327 }
8328
8329 // Unlock tree
8330 NECP_CLIENT_TREE_UNLOCK();
8331
8332 error = copyout(&client_count, uap->buffer, sizeof(client_count));
8333 if (error) {
8334 NECPLOG(LOG_ERR, "necp_client_list buffer copyout error (%d)", error);
8335 goto done;
8336 }
8337
8338 if (requested_client_count > 0 &&
8339 client_count > 0 &&
8340 list != NULL) {
8341 error = copyout(list, uap->buffer + sizeof(client_count), copy_buffer_size);
8342 if (error) {
8343 NECPLOG(LOG_ERR, "necp_client_list client count copyout error (%d)", error);
8344 goto done;
8345 }
8346 }
8347 done:
8348 if (list != NULL) {
8349 kfree_data(list, copy_buffer_size);
8350 }
8351 *retval = error;
8352
8353 return error;
8354 }
8355
8356 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_add_flow(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8357 necp_client_add_flow(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8358 {
8359 int error = 0;
8360 struct necp_client *client = NULL;
8361 uuid_t client_id;
8362 struct necp_client_nexus_parameters parameters = {};
8363 struct proc *proc = PROC_NULL;
8364 struct necp_client_add_flow *add_request = NULL;
8365 struct necp_client_add_flow *allocated_add_request = NULL;
8366 struct necp_client_add_flow_default default_add_request = {};
8367 const size_t buffer_size = uap->buffer_size;
8368
8369 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
8370 error = EINVAL;
8371 NECPLOG(LOG_ERR, "necp_client_add_flow invalid client_id (length %zu)", (size_t)uap->client_id_len);
8372 goto done;
8373 }
8374
8375 if (uap->buffer == 0 || buffer_size < sizeof(struct necp_client_add_flow) ||
8376 buffer_size > sizeof(struct necp_client_add_flow_default) * 4) {
8377 error = EINVAL;
8378 NECPLOG(LOG_ERR, "necp_client_add_flow invalid buffer (length %zu)", buffer_size);
8379 goto done;
8380 }
8381
8382 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8383 if (error) {
8384 NECPLOG(LOG_ERR, "necp_client_add_flow copyin client_id error (%d)", error);
8385 goto done;
8386 }
8387
8388 if (buffer_size <= sizeof(struct necp_client_add_flow_default)) {
8389 // Fits in default size
8390 error = copyin(uap->buffer, &default_add_request, buffer_size);
8391 if (error) {
8392 NECPLOG(LOG_ERR, "necp_client_add_flow copyin default_add_request error (%d)", error);
8393 goto done;
8394 }
8395
8396 add_request = (struct necp_client_add_flow *)&default_add_request;
8397 } else {
8398 allocated_add_request = (struct necp_client_add_flow *)kalloc_data(buffer_size, Z_WAITOK | Z_ZERO);
8399 if (allocated_add_request == NULL) {
8400 error = ENOMEM;
8401 goto done;
8402 }
8403
8404 error = copyin(uap->buffer, allocated_add_request, buffer_size);
8405 if (error) {
8406 NECPLOG(LOG_ERR, "necp_client_add_flow copyin default_add_request error (%d)", error);
8407 goto done;
8408 }
8409
8410 add_request = allocated_add_request;
8411 }
8412
8413 NECP_FD_LOCK(fd_data);
8414 pid_t pid = fd_data->proc_pid;
8415 proc = proc_find(pid);
8416 if (proc == PROC_NULL) {
8417 NECP_FD_UNLOCK(fd_data);
8418 NECPLOG(LOG_ERR, "necp_client_add_flow process not found for pid %d error (%d)", pid, error);
8419 error = ESRCH;
8420 goto done;
8421 }
8422
8423 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8424 if (client == NULL) {
8425 error = ENOENT;
8426 NECP_FD_UNLOCK(fd_data);
8427 goto done;
8428 }
8429
8430 // Using ADD_FLOW indicates that the client supports multiple flows per client
8431 client->legacy_client_is_flow = false;
8432
8433 necp_client_retain_locked(client);
8434 necp_client_copy_parameters_locked(client, ¶meters);
8435
8436 struct necp_client_flow_registration *new_registration = necp_client_create_flow_registration(fd_data, client);
8437 if (new_registration == NULL) {
8438 error = ENOMEM;
8439 NECP_CLIENT_UNLOCK(client);
8440 NECP_FD_UNLOCK(fd_data);
8441 NECPLOG0(LOG_ERR, "Failed to allocate flow registration");
8442 goto done;
8443 }
8444
8445 new_registration->flags = add_request->flags;
8446
8447 // Copy new ID out to caller
8448 uuid_copy(add_request->registration_id, new_registration->registration_id);
8449
8450 NECP_CLIENT_FLOW_LOG(client, new_registration, "adding flow");
8451
8452 size_t trailer_offset = (sizeof(struct necp_client_add_flow) +
8453 add_request->stats_request_count * sizeof(struct necp_client_flow_stats));
8454
8455 // Copy override address
8456 struct sockaddr *override_address = NULL;
8457 if (add_request->flags & NECP_CLIENT_FLOW_FLAGS_OVERRIDE_ADDRESS) {
8458 size_t offset_of_address = trailer_offset;
8459 if (buffer_size >= offset_of_address + sizeof(struct sockaddr_in)) {
8460 override_address = (struct sockaddr *)(((uint8_t *)add_request) + offset_of_address);
8461 if (buffer_size >= offset_of_address + override_address->sa_len &&
8462 override_address->sa_len <= sizeof(parameters.remote_addr)) {
8463 memcpy(¶meters.remote_addr, override_address, override_address->sa_len);
8464 trailer_offset += override_address->sa_len;
8465 } else {
8466 override_address = NULL;
8467 }
8468 }
8469 }
8470
8471 // Copy override IP protocol
8472 if (add_request->flags & NECP_CLIENT_FLOW_FLAGS_OVERRIDE_IP_PROTOCOL) {
8473 size_t offset_of_ip_protocol = trailer_offset;
8474 if (buffer_size >= offset_of_ip_protocol + sizeof(uint8_t)) {
8475 uint8_t *ip_protocol_p = (uint8_t *)(((uint8_t *)add_request) + offset_of_ip_protocol);
8476 memcpy(¶meters.ip_protocol, ip_protocol_p, sizeof(uint8_t));
8477 }
8478 }
8479
8480 #if SKYWALK
8481 if (add_request->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS) {
8482 void *assigned_results = NULL;
8483 size_t assigned_results_length = 0;
8484 uint32_t interface_index = 0;
8485
8486 // Validate that the nexus UUID is assigned
8487 bool found_nexus = false;
8488 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
8489 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
8490 struct necp_client_interface_option *option = &client->interface_options[option_i];
8491 if (uuid_compare(option->nexus_agent, add_request->agent_uuid) == 0) {
8492 interface_index = option->interface_index;
8493 found_nexus = true;
8494 break;
8495 }
8496 } else {
8497 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
8498 if (uuid_compare(option->nexus_agent, add_request->agent_uuid) == 0) {
8499 interface_index = option->interface_index;
8500 found_nexus = true;
8501 break;
8502 }
8503 }
8504 }
8505
8506 if (!found_nexus) {
8507 NECPLOG0(LOG_ERR, "Requested nexus not found");
8508 } else {
8509 necp_client_add_nexus_flow_if_needed(new_registration, add_request->agent_uuid, interface_index);
8510
8511 error = netagent_client_message_with_params(add_request->agent_uuid,
8512 ((new_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
8513 client->client_id :
8514 new_registration->registration_id),
8515 pid, client->agent_handle,
8516 NETAGENT_MESSAGE_TYPE_REQUEST_NEXUS,
8517 (struct necp_client_agent_parameters *)¶meters,
8518 &assigned_results, &assigned_results_length);
8519 if (error != 0) {
8520 VERIFY(assigned_results == NULL);
8521 VERIFY(assigned_results_length == 0);
8522 NECPLOG(LOG_ERR, "netagent_client_message error (%d)", error);
8523 } else if (assigned_results != NULL) {
8524 if (!necp_assign_client_result_locked(proc, fd_data, client, new_registration, add_request->agent_uuid,
8525 assigned_results, assigned_results_length, false, false)) {
8526 kfree_data(assigned_results, assigned_results_length);
8527 }
8528 } else if (override_address != NULL) {
8529 // Save the overridden address in the flow. Find the correct flow,
8530 // and assign just the address TLV. Don't set the assigned flag.
8531 struct necp_client_flow *flow = NULL;
8532 LIST_FOREACH(flow, &new_registration->flow_list, flow_chain) {
8533 if (flow->nexus &&
8534 uuid_compare(flow->u.nexus_agent, add_request->agent_uuid) == 0) {
8535 if (flow->assigned_results == NULL) {
8536 memcpy(&flow->remote_addr, override_address, override_address->sa_len);
8537 uuid_t empty_uuid;
8538 uuid_clear(empty_uuid);
8539 flow->assigned_results = necp_create_nexus_assign_message(empty_uuid, 0, NULL, 0,
8540 (struct necp_client_endpoint *)&flow->local_addr,
8541 (struct necp_client_endpoint *)&flow->remote_addr,
8542 NULL, 0, NULL, &flow->assigned_results_length);
8543 }
8544 break;
8545 }
8546 }
8547 }
8548 }
8549 }
8550
8551 // Don't request stats if nexus creation fails
8552 if (error == 0 && add_request->stats_request_count > 0 && necp_arena_initialize(fd_data, true) == 0) {
8553 struct necp_client_flow_stats *stats_request = (struct necp_client_flow_stats *)&add_request->stats_requests[0];
8554 struct necp_stats_bufreq bufreq = {};
8555
8556 NECP_CLIENT_FLOW_LOG(client, new_registration, "Initializing stats");
8557
8558 bufreq.necp_stats_bufreq_id = NECP_CLIENT_STATISTICS_BUFREQ_ID;
8559 bufreq.necp_stats_bufreq_type = stats_request->stats_type;
8560 bufreq.necp_stats_bufreq_ver = stats_request->stats_version;
8561 bufreq.necp_stats_bufreq_size = stats_request->stats_size;
8562 bufreq.necp_stats_bufreq_uaddr = stats_request->stats_addr;
8563 (void)necp_stats_initialize(fd_data, client, new_registration, &bufreq);
8564 stats_request->stats_type = bufreq.necp_stats_bufreq_type;
8565 stats_request->stats_version = bufreq.necp_stats_bufreq_ver;
8566 stats_request->stats_size = bufreq.necp_stats_bufreq_size;
8567 stats_request->stats_addr = bufreq.necp_stats_bufreq_uaddr;
8568 }
8569 #endif /* !SKYWALK */
8570
8571 if (error == 0 &&
8572 (add_request->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE ||
8573 add_request->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) {
8574 uint32_t interface_index = IFSCOPE_NONE;
8575 ifnet_head_lock_shared();
8576 struct ifnet *interface = NULL;
8577 TAILQ_FOREACH(interface, &ifnet_head, if_link) {
8578 ifnet_lock_shared(interface);
8579 if (interface->if_agentids != NULL) {
8580 for (u_int32_t i = 0; i < interface->if_agentcount; i++) {
8581 if (uuid_compare(interface->if_agentids[i], add_request->agent_uuid) == 0) {
8582 interface_index = interface->if_index;
8583 break;
8584 }
8585 }
8586 }
8587 ifnet_lock_done(interface);
8588 if (interface_index != IFSCOPE_NONE) {
8589 break;
8590 }
8591 }
8592 ifnet_head_done();
8593
8594 necp_client_add_nexus_flow_if_needed(new_registration, add_request->agent_uuid, interface_index);
8595
8596 error = netagent_client_message_with_params(add_request->agent_uuid,
8597 ((new_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
8598 client->client_id :
8599 new_registration->registration_id),
8600 pid, client->agent_handle,
8601 NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT,
8602 (struct necp_client_agent_parameters *)¶meters,
8603 NULL, NULL);
8604 if (error != 0) {
8605 NECPLOG(LOG_ERR, "netagent_client_message error (%d)", error);
8606 }
8607 }
8608
8609 if (error != 0) {
8610 // Encountered an error in adding the flow, destroy the flow registration
8611 #if SKYWALK
8612 necp_destroy_flow_stats(fd_data, new_registration, NULL, false);
8613 #endif /* SKYWALK */
8614 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
8615 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, new_registration);
8616 NECP_FLOW_TREE_UNLOCK();
8617 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, new_registration);
8618 necp_destroy_client_flow_registration(client, new_registration, fd_data->proc_pid, true);
8619 new_registration = NULL;
8620 }
8621
8622 NECP_CLIENT_UNLOCK(client);
8623 NECP_FD_UNLOCK(fd_data);
8624
8625 necp_client_release(client);
8626
8627 if (error != 0) {
8628 goto done;
8629 }
8630
8631 // Copy the request back out to the caller with assigned fields
8632 error = copyout(add_request, uap->buffer, buffer_size);
8633 if (error != 0) {
8634 NECPLOG(LOG_ERR, "necp_client_add_flow copyout add_request error (%d)", error);
8635 }
8636
8637 done:
8638 *retval = error;
8639 if (error != 0) {
8640 NECPLOG(LOG_ERR, "Add flow error (%d)", error);
8641 }
8642
8643 if (allocated_add_request != NULL) {
8644 kfree_data(allocated_add_request, buffer_size);
8645 }
8646
8647 if (proc != PROC_NULL) {
8648 proc_rele(proc);
8649 }
8650 return error;
8651 }
8652
8653 #if SKYWALK
8654
8655 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_request_nexus(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8656 necp_client_request_nexus(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8657 {
8658 int error = 0;
8659 struct necp_client *client = NULL;
8660 uuid_t client_id;
8661 struct necp_client_nexus_parameters parameters = {};
8662 struct proc *proc = PROC_NULL;
8663 const size_t buffer_size = uap->buffer_size;
8664
8665 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
8666 error = EINVAL;
8667 goto done;
8668 }
8669
8670 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8671 if (error) {
8672 NECPLOG(LOG_ERR, "necp_client_request_nexus copyin client_id error (%d)", error);
8673 goto done;
8674 }
8675
8676 NECP_FD_LOCK(fd_data);
8677 pid_t pid = fd_data->proc_pid;
8678 proc = proc_find(pid);
8679 if (proc == PROC_NULL) {
8680 NECP_FD_UNLOCK(fd_data);
8681 NECPLOG(LOG_ERR, "necp_client_request_nexus process not found for pid %d error (%d)", pid, error);
8682 error = ESRCH;
8683 goto done;
8684 }
8685
8686 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8687 if (client == NULL) {
8688 NECP_FD_UNLOCK(fd_data);
8689 error = ENOENT;
8690 goto done;
8691 }
8692
8693 // Using REQUEST_NEXUS indicates that the client only supports one flow per client
8694 client->legacy_client_is_flow = true;
8695
8696 necp_client_retain_locked(client);
8697 necp_client_copy_parameters_locked(client, ¶meters);
8698
8699 do {
8700 void *assigned_results = NULL;
8701 size_t assigned_results_length = 0;
8702 uuid_t nexus_uuid;
8703 uint32_t interface_index = 0;
8704
8705 // Validate that the nexus UUID is assigned
8706 bool found_nexus = false;
8707 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
8708 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
8709 struct necp_client_interface_option *option = &client->interface_options[option_i];
8710 if (!uuid_is_null(option->nexus_agent)) {
8711 uuid_copy(nexus_uuid, option->nexus_agent);
8712 interface_index = option->interface_index;
8713 found_nexus = true;
8714 break;
8715 }
8716 } else {
8717 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
8718 if (!uuid_is_null(option->nexus_agent)) {
8719 uuid_copy(nexus_uuid, option->nexus_agent);
8720 interface_index = option->interface_index;
8721 found_nexus = true;
8722 break;
8723 }
8724 }
8725 }
8726
8727 if (!found_nexus) {
8728 NECP_CLIENT_UNLOCK(client);
8729 NECP_FD_UNLOCK(fd_data);
8730 necp_client_release(client);
8731 // Break the loop
8732 error = ENETDOWN;
8733 goto done;
8734 }
8735
8736 struct necp_client_flow_registration *new_registration = necp_client_create_flow_registration(fd_data, client);
8737 if (new_registration == NULL) {
8738 error = ENOMEM;
8739 NECP_CLIENT_UNLOCK(client);
8740 NECP_FD_UNLOCK(fd_data);
8741 necp_client_release(client);
8742 NECPLOG0(LOG_ERR, "Failed to allocate flow registration");
8743 goto done;
8744 }
8745
8746 new_registration->flags = (NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS | NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID);
8747
8748 necp_client_add_nexus_flow_if_needed(new_registration, nexus_uuid, interface_index);
8749
8750 // Note: Any clients using "request_nexus" are not flow-registration aware.
8751 // Register the Client ID rather than the Registration ID with the nexus, since
8752 // the client will send traffic based on the client ID.
8753 error = netagent_client_message_with_params(nexus_uuid,
8754 ((new_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
8755 client->client_id :
8756 new_registration->registration_id),
8757 pid, client->agent_handle,
8758 NETAGENT_MESSAGE_TYPE_REQUEST_NEXUS,
8759 (struct necp_client_agent_parameters *)¶meters,
8760 &assigned_results, &assigned_results_length);
8761 if (error) {
8762 NECP_CLIENT_UNLOCK(client);
8763 NECP_FD_UNLOCK(fd_data);
8764 necp_client_release(client);
8765 VERIFY(assigned_results == NULL);
8766 VERIFY(assigned_results_length == 0);
8767 NECPLOG(LOG_ERR, "netagent_client_message error (%d)", error);
8768 goto done;
8769 }
8770
8771 if (assigned_results != NULL) {
8772 if (!necp_assign_client_result_locked(proc, fd_data, client, new_registration, nexus_uuid,
8773 assigned_results, assigned_results_length, false, false)) {
8774 kfree_data(assigned_results, assigned_results_length);
8775 }
8776 }
8777
8778 if (uap->buffer != 0 && buffer_size == sizeof(struct necp_stats_bufreq) &&
8779 necp_arena_initialize(fd_data, true) == 0) {
8780 struct necp_stats_bufreq bufreq = {};
8781 int copy_error = copyin(uap->buffer, &bufreq, buffer_size);
8782 if (copy_error) {
8783 NECPLOG(LOG_ERR, "necp_client_request_nexus copyin bufreq error (%d)", copy_error);
8784 } else {
8785 (void)necp_stats_initialize(fd_data, client, new_registration, &bufreq);
8786 copy_error = copyout(&bufreq, uap->buffer, buffer_size);
8787 if (copy_error != 0) {
8788 NECPLOG(LOG_ERR, "necp_client_request_nexus copyout bufreq error (%d)", copy_error);
8789 }
8790 }
8791 }
8792 } while (false);
8793
8794 NECP_CLIENT_UNLOCK(client);
8795 NECP_FD_UNLOCK(fd_data);
8796
8797 necp_client_release(client);
8798
8799 done:
8800 *retval = error;
8801 if (error != 0) {
8802 NECPLOG(LOG_ERR, "Request nexus error (%d)", error);
8803 }
8804
8805 if (proc != PROC_NULL) {
8806 proc_rele(proc);
8807 }
8808 return error;
8809 }
8810 #endif /* !SKYWALK */
8811
8812 static void
necp_client_add_assertion(struct necp_client * client,uuid_t netagent_uuid)8813 necp_client_add_assertion(struct necp_client *client, uuid_t netagent_uuid)
8814 {
8815 struct necp_client_assertion *new_assertion = NULL;
8816
8817 new_assertion = kalloc_type(struct necp_client_assertion,
8818 Z_WAITOK | Z_NOFAIL);
8819
8820 uuid_copy(new_assertion->asserted_netagent, netagent_uuid);
8821
8822 LIST_INSERT_HEAD(&client->assertion_list, new_assertion, assertion_chain);
8823 }
8824
8825 static bool
necp_client_remove_assertion(struct necp_client * client,uuid_t netagent_uuid)8826 necp_client_remove_assertion(struct necp_client *client, uuid_t netagent_uuid)
8827 {
8828 struct necp_client_assertion *found_assertion = NULL;
8829 struct necp_client_assertion *search_assertion = NULL;
8830 LIST_FOREACH(search_assertion, &client->assertion_list, assertion_chain) {
8831 if (uuid_compare(search_assertion->asserted_netagent, netagent_uuid) == 0) {
8832 found_assertion = search_assertion;
8833 break;
8834 }
8835 }
8836
8837 if (found_assertion == NULL) {
8838 NECPLOG0(LOG_ERR, "Netagent uuid not previously asserted");
8839 return false;
8840 }
8841
8842 LIST_REMOVE(found_assertion, assertion_chain);
8843 kfree_type(struct necp_client_assertion, found_assertion);
8844 return true;
8845 }
8846
8847 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_agent_action(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8848 necp_client_agent_action(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8849 {
8850 int error = 0;
8851 struct necp_client *client = NULL;
8852 uuid_t client_id;
8853 bool acted_on_agent = FALSE;
8854 u_int8_t *parameters = NULL;
8855 const size_t buffer_size = uap->buffer_size;
8856
8857 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
8858 buffer_size == 0 || uap->buffer == 0) {
8859 NECPLOG0(LOG_ERR, "necp_client_agent_action invalid parameters");
8860 error = EINVAL;
8861 goto done;
8862 }
8863
8864 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8865 if (error) {
8866 NECPLOG(LOG_ERR, "necp_client_agent_action copyin client_id error (%d)", error);
8867 goto done;
8868 }
8869
8870 if (buffer_size > NECP_MAX_AGENT_ACTION_SIZE) {
8871 NECPLOG(LOG_ERR, "necp_client_agent_action invalid buffer size (>%u)", NECP_MAX_AGENT_ACTION_SIZE);
8872 error = EINVAL;
8873 goto done;
8874 }
8875
8876 if ((parameters = (u_int8_t *)kalloc_data(buffer_size, Z_WAITOK | Z_ZERO)) == NULL) {
8877 NECPLOG0(LOG_ERR, "necp_client_agent_action malloc failed");
8878 error = ENOMEM;
8879 goto done;
8880 }
8881
8882 error = copyin(uap->buffer, parameters, buffer_size);
8883 if (error) {
8884 NECPLOG(LOG_ERR, "necp_client_agent_action parameters copyin error (%d)", error);
8885 goto done;
8886 }
8887
8888 NECP_FD_LOCK(fd_data);
8889 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8890 if (client != NULL) {
8891 size_t offset = 0;
8892 while ((offset + sizeof(struct necp_tlv_header)) <= buffer_size) {
8893 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
8894 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
8895
8896 if (length > (buffer_size - (offset + sizeof(struct necp_tlv_header)))) {
8897 // If the length is larger than what can fit in the remaining parameters size, bail
8898 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
8899 break;
8900 }
8901
8902 if (length >= sizeof(uuid_t)) {
8903 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
8904 if (value == NULL) {
8905 NECPLOG0(LOG_ERR, "Invalid TLV value");
8906 break;
8907 }
8908 if (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT ||
8909 type == NECP_CLIENT_PARAMETER_ASSERT_AGENT ||
8910 type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
8911 uuid_t agent_uuid;
8912 uuid_copy(agent_uuid, value);
8913 u_int8_t netagent_message_type = 0;
8914 if (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT) {
8915 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_TRIGGER;
8916 } else if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
8917 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT;
8918 } else if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
8919 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
8920 }
8921
8922 // Before unasserting, verify that the assertion was already taken
8923 if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
8924 if (!necp_client_remove_assertion(client, agent_uuid)) {
8925 error = ENOENT;
8926 break;
8927 }
8928 }
8929
8930 struct necp_client_nexus_parameters parsed_parameters = {};
8931 necp_client_copy_parameters_locked(client, &parsed_parameters);
8932
8933 error = netagent_client_message_with_params(agent_uuid,
8934 client_id,
8935 fd_data->proc_pid,
8936 client->agent_handle,
8937 netagent_message_type,
8938 (struct necp_client_agent_parameters *)&parsed_parameters,
8939 NULL, NULL);
8940 if (error == 0) {
8941 acted_on_agent = TRUE;
8942 } else {
8943 break;
8944 }
8945
8946 // Only save the assertion if the action succeeded
8947 if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
8948 necp_client_add_assertion(client, agent_uuid);
8949 }
8950 } else if (type == NECP_CLIENT_PARAMETER_AGENT_ADD_GROUP_MEMBERS ||
8951 type == NECP_CLIENT_PARAMETER_AGENT_REMOVE_GROUP_MEMBERS) {
8952 uuid_t agent_uuid;
8953 uuid_copy(agent_uuid, value);
8954 u_int8_t netagent_message_type = 0;
8955 if (type == NECP_CLIENT_PARAMETER_AGENT_ADD_GROUP_MEMBERS) {
8956 netagent_message_type = NETAGENT_MESSAGE_TYPE_ADD_GROUP_MEMBERS;
8957 } else if (type == NECP_CLIENT_PARAMETER_AGENT_REMOVE_GROUP_MEMBERS) {
8958 netagent_message_type = NETAGENT_MESSAGE_TYPE_REMOVE_GROUP_MEMBERS;
8959 }
8960
8961 struct necp_client_group_members group_members = {};
8962 group_members.group_members_length = (length - sizeof(uuid_t));
8963 group_members.group_members = (value + sizeof(uuid_t));
8964 error = netagent_client_message_with_params(agent_uuid,
8965 client_id,
8966 fd_data->proc_pid,
8967 client->agent_handle,
8968 netagent_message_type,
8969 (struct necp_client_agent_parameters *)&group_members,
8970 NULL, NULL);
8971 if (error == 0) {
8972 acted_on_agent = TRUE;
8973 } else {
8974 break;
8975 }
8976 } else if (type == NECP_CLIENT_PARAMETER_REPORT_AGENT_ERROR) {
8977 uuid_t agent_uuid;
8978 uuid_copy(agent_uuid, value);
8979 struct necp_client_agent_parameters agent_params = {};
8980 if ((length - sizeof(uuid_t)) >= sizeof(agent_params.u.error.error)) {
8981 memcpy(&agent_params.u.error.error,
8982 (value + sizeof(uuid_t)),
8983 sizeof(agent_params.u.error.error));
8984 }
8985 bool agent_reported = false;
8986 for (int agent_i = 0; agent_i < NECP_FD_REPORTED_AGENT_COUNT; agent_i++) {
8987 if (uuid_compare(agent_uuid, fd_data->reported_agents.agent_uuid[agent_i]) == 0) {
8988 // Found a match, already reported
8989 agent_reported = true;
8990 break;
8991 }
8992 }
8993 agent_params.u.error.force_report = !agent_reported;
8994 if (!agent_reported) {
8995 // Save this agent as having been reported
8996 bool saved_agent_uuid = false;
8997 for (int agent_i = 0; agent_i < NECP_FD_REPORTED_AGENT_COUNT; agent_i++) {
8998 if (uuid_is_null(fd_data->reported_agents.agent_uuid[agent_i])) {
8999 uuid_copy(fd_data->reported_agents.agent_uuid[agent_i], agent_uuid);
9000 saved_agent_uuid = true;
9001 break;
9002 }
9003 }
9004 if (!saved_agent_uuid) {
9005 // Reported agent UUIDs full, move over and insert at the end
9006 for (int agent_i = 0; agent_i < NECP_FD_REPORTED_AGENT_COUNT; agent_i++) {
9007 if (agent_i + 1 < NECP_FD_REPORTED_AGENT_COUNT) {
9008 uuid_copy(fd_data->reported_agents.agent_uuid[agent_i], fd_data->reported_agents.agent_uuid[agent_i + 1]);
9009 } else {
9010 uuid_copy(fd_data->reported_agents.agent_uuid[agent_i], agent_uuid);
9011 }
9012 }
9013 }
9014 }
9015 error = netagent_client_message_with_params(agent_uuid,
9016 client_id,
9017 fd_data->proc_pid,
9018 client->agent_handle,
9019 NETAGENT_MESSAGE_TYPE_CLIENT_ERROR,
9020 &agent_params,
9021 NULL, NULL);
9022 if (error == 0) {
9023 acted_on_agent = TRUE;
9024 } else {
9025 break;
9026 }
9027 }
9028 }
9029
9030 offset += sizeof(struct necp_tlv_header) + length;
9031 }
9032
9033 NECP_CLIENT_UNLOCK(client);
9034 }
9035 NECP_FD_UNLOCK(fd_data);
9036
9037 if (!acted_on_agent &&
9038 error == 0) {
9039 error = ENOENT;
9040 }
9041 done:
9042 *retval = error;
9043 if (parameters != NULL) {
9044 kfree_data(parameters, buffer_size);
9045 parameters = NULL;
9046 }
9047
9048 return error;
9049 }
9050
9051 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_agent(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9052 necp_client_copy_agent(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9053 {
9054 int error = 0;
9055 uuid_t agent_uuid;
9056 const size_t buffer_size = uap->buffer_size;
9057
9058 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
9059 buffer_size == 0 || uap->buffer == 0) {
9060 NECPLOG0(LOG_ERR, "necp_client_copy_agent bad input");
9061 error = EINVAL;
9062 goto done;
9063 }
9064
9065 error = copyin(uap->client_id, agent_uuid, sizeof(uuid_t));
9066 if (error) {
9067 NECPLOG(LOG_ERR, "necp_client_copy_agent copyin agent_uuid error (%d)", error);
9068 goto done;
9069 }
9070
9071 error = netagent_copyout(agent_uuid, uap->buffer, buffer_size);
9072 if (error) {
9073 // netagent_copyout already logs appropriate errors
9074 goto done;
9075 }
9076 done:
9077 *retval = error;
9078
9079 return error;
9080 }
9081
9082 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_agent_use(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9083 necp_client_agent_use(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9084 {
9085 int error = 0;
9086 struct necp_client *client = NULL;
9087 uuid_t client_id;
9088 struct necp_agent_use_parameters parameters = {};
9089 const size_t buffer_size = uap->buffer_size;
9090
9091 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
9092 buffer_size != sizeof(parameters) || uap->buffer == 0) {
9093 error = EINVAL;
9094 goto done;
9095 }
9096
9097 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
9098 if (error) {
9099 NECPLOG(LOG_ERR, "Copyin client_id error (%d)", error);
9100 goto done;
9101 }
9102
9103 error = copyin(uap->buffer, ¶meters, buffer_size);
9104 if (error) {
9105 NECPLOG(LOG_ERR, "Parameters copyin error (%d)", error);
9106 goto done;
9107 }
9108
9109 NECP_FD_LOCK(fd_data);
9110 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
9111 if (client != NULL) {
9112 error = netagent_use(parameters.agent_uuid, ¶meters.out_use_count);
9113 NECP_CLIENT_UNLOCK(client);
9114 } else {
9115 error = ENOENT;
9116 }
9117
9118 NECP_FD_UNLOCK(fd_data);
9119
9120 if (error == 0) {
9121 error = copyout(¶meters, uap->buffer, buffer_size);
9122 if (error) {
9123 NECPLOG(LOG_ERR, "Parameters copyout error (%d)", error);
9124 goto done;
9125 }
9126 }
9127
9128 done:
9129 *retval = error;
9130
9131 return error;
9132 }
9133
9134 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_acquire_agent_token(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9135 necp_client_acquire_agent_token(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9136 {
9137 int error = 0;
9138 uuid_t agent_uuid = {};
9139 const size_t buffer_size = uap->buffer_size;
9140
9141 *retval = 0;
9142
9143 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
9144 buffer_size == 0 || uap->buffer == 0) {
9145 NECPLOG0(LOG_ERR, "necp_client_copy_agent bad input");
9146 error = EINVAL;
9147 goto done;
9148 }
9149
9150 error = copyin(uap->client_id, agent_uuid, sizeof(uuid_t));
9151 if (error) {
9152 NECPLOG(LOG_ERR, "necp_client_copy_agent copyin agent_uuid error (%d)", error);
9153 goto done;
9154 }
9155
9156 error = netagent_acquire_token(agent_uuid, uap->buffer, buffer_size, retval);
9157 done:
9158 return error;
9159 }
9160
9161 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_interface(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9162 necp_client_copy_interface(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9163 {
9164 int error = 0;
9165 u_int32_t interface_index = 0;
9166 struct necp_interface_details interface_details = {};
9167
9168 if (uap->client_id == 0 || uap->client_id_len != sizeof(u_int32_t) ||
9169 uap->buffer_size < sizeof(interface_details) ||
9170 uap->buffer == 0) {
9171 NECPLOG0(LOG_ERR, "necp_client_copy_interface bad input");
9172 error = EINVAL;
9173 goto done;
9174 }
9175
9176 error = copyin(uap->client_id, &interface_index, sizeof(u_int32_t));
9177 if (error) {
9178 NECPLOG(LOG_ERR, "necp_client_copy_interface copyin interface_index error (%d)", error);
9179 goto done;
9180 }
9181
9182 if (interface_index == 0) {
9183 error = ENOENT;
9184 NECPLOG(LOG_ERR, "necp_client_copy_interface bad interface_index (%d)", interface_index);
9185 goto done;
9186 }
9187
9188 lck_mtx_lock(rnh_lock);
9189 ifnet_head_lock_shared();
9190 ifnet_t interface = NULL;
9191 if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
9192 interface = ifindex2ifnet[interface_index];
9193 }
9194
9195 if (interface != NULL) {
9196 if (interface->if_xname != NULL) {
9197 strlcpy((char *)&interface_details.name, interface->if_xname, sizeof(interface_details.name));
9198 }
9199 interface_details.index = interface->if_index;
9200 interface_details.generation = ifnet_get_generation(interface);
9201 if (interface->if_delegated.ifp != NULL) {
9202 interface_details.delegate_index = interface->if_delegated.ifp->if_index;
9203 }
9204 interface_details.functional_type = if_functional_type(interface, TRUE);
9205 if (IFNET_IS_EXPENSIVE(interface)) {
9206 interface_details.flags |= NECP_INTERFACE_FLAG_EXPENSIVE;
9207 }
9208 if (IFNET_IS_CONSTRAINED(interface)) {
9209 interface_details.flags |= NECP_INTERFACE_FLAG_CONSTRAINED;
9210 }
9211 if ((interface->if_eflags & IFEF_TXSTART) == IFEF_TXSTART) {
9212 interface_details.flags |= NECP_INTERFACE_FLAG_TXSTART;
9213 }
9214 if ((interface->if_eflags & IFEF_NOACKPRI) == IFEF_NOACKPRI) {
9215 interface_details.flags |= NECP_INTERFACE_FLAG_NOACKPRI;
9216 }
9217 if ((interface->if_eflags & IFEF_3CA) == IFEF_3CA) {
9218 interface_details.flags |= NECP_INTERFACE_FLAG_3CARRIERAGG;
9219 }
9220 if (IFNET_IS_LOW_POWER(interface)) {
9221 interface_details.flags |= NECP_INTERFACE_FLAG_IS_LOW_POWER;
9222 }
9223 if (interface->if_xflags & IFXF_MPK_LOG) {
9224 interface_details.flags |= NECP_INTERFACE_FLAG_MPK_LOG;
9225 }
9226 if (interface->if_flags & IFF_MULTICAST) {
9227 interface_details.flags |= NECP_INTERFACE_FLAG_SUPPORTS_MULTICAST;
9228 }
9229 if (IS_INTF_CLAT46(interface)) {
9230 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_NAT64;
9231 }
9232 interface_details.mtu = interface->if_mtu;
9233 #if SKYWALK
9234 fsw_get_tso_capabilities(interface, &interface_details.tso_max_segment_size_v4,
9235 &interface_details.tso_max_segment_size_v6);
9236
9237 interface_details.hwcsum_flags = interface->if_hwassist & IFNET_CHECKSUMF;
9238 #endif /* SKYWALK */
9239
9240 u_int8_t ipv4_signature_len = sizeof(interface_details.ipv4_signature.signature);
9241 u_int16_t ipv4_signature_flags;
9242 if (ifnet_get_netsignature(interface, AF_INET, &ipv4_signature_len, &ipv4_signature_flags,
9243 (u_int8_t *)&interface_details.ipv4_signature) != 0) {
9244 ipv4_signature_len = 0;
9245 }
9246 interface_details.ipv4_signature.signature_len = ipv4_signature_len;
9247
9248 // Check for default scoped routes for IPv4 and IPv6
9249 union necp_sockaddr_union default_address;
9250 struct rtentry *v4Route = NULL;
9251 memset(&default_address, 0, sizeof(default_address));
9252 default_address.sa.sa_family = AF_INET;
9253 default_address.sa.sa_len = sizeof(struct sockaddr_in);
9254 v4Route = rtalloc1_scoped_locked((struct sockaddr *)&default_address, 0, 0,
9255 interface->if_index);
9256 if (v4Route != NULL) {
9257 if (v4Route->rt_ifp != NULL && !IS_INTF_CLAT46(v4Route->rt_ifp)) {
9258 interface_details.flags |= NECP_INTERFACE_FLAG_IPV4_ROUTABLE;
9259 }
9260 rtfree_locked(v4Route);
9261 v4Route = NULL;
9262 }
9263
9264 struct rtentry *v6Route = NULL;
9265 memset(&default_address, 0, sizeof(default_address));
9266 default_address.sa.sa_family = AF_INET6;
9267 default_address.sa.sa_len = sizeof(struct sockaddr_in6);
9268 v6Route = rtalloc1_scoped_locked((struct sockaddr *)&default_address, 0, 0,
9269 interface->if_index);
9270 if (v6Route != NULL) {
9271 if (v6Route->rt_ifp != NULL) {
9272 interface_details.flags |= NECP_INTERFACE_FLAG_IPV6_ROUTABLE;
9273 }
9274 rtfree_locked(v6Route);
9275 v6Route = NULL;
9276 }
9277
9278 u_int8_t ipv6_signature_len = sizeof(interface_details.ipv6_signature.signature);
9279 u_int16_t ipv6_signature_flags;
9280 if (ifnet_get_netsignature(interface, AF_INET6, &ipv6_signature_len, &ipv6_signature_flags,
9281 (u_int8_t *)&interface_details.ipv6_signature) != 0) {
9282 ipv6_signature_len = 0;
9283 }
9284 interface_details.ipv6_signature.signature_len = ipv6_signature_len;
9285
9286 ifnet_lock_shared(interface);
9287 struct ifaddr *ifa = NULL;
9288 TAILQ_FOREACH(ifa, &interface->if_addrhead, ifa_link) {
9289 IFA_LOCK(ifa);
9290 if (ifa->ifa_addr->sa_family == AF_INET) {
9291 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_NETMASK;
9292 interface_details.ipv4_netmask = ((struct in_ifaddr *)ifa)->ia_sockmask.sin_addr.s_addr;
9293 if (interface->if_flags & IFF_BROADCAST) {
9294 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_BROADCAST;
9295 interface_details.ipv4_broadcast = ((struct in_ifaddr *)ifa)->ia_broadaddr.sin_addr.s_addr;
9296 }
9297 }
9298 IFA_UNLOCK(ifa);
9299 }
9300
9301 interface_details.radio_type = interface->if_radio_type;
9302 if (interface_details.radio_type == 0 && interface->if_delegated.ifp) {
9303 interface_details.radio_type = interface->if_delegated.ifp->if_radio_type;
9304 }
9305 ifnet_lock_done(interface);
9306 }
9307
9308 ifnet_head_done();
9309 lck_mtx_unlock(rnh_lock);
9310
9311 // If the client is using an older version of the struct, copy that length
9312 error = copyout(&interface_details, uap->buffer, sizeof(interface_details));
9313 if (error) {
9314 NECPLOG(LOG_ERR, "necp_client_copy_interface copyout error (%d)", error);
9315 goto done;
9316 }
9317 done:
9318 *retval = error;
9319
9320 return error;
9321 }
9322
9323 #if SKYWALK
9324
9325 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_get_interface_address(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9326 necp_client_get_interface_address(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9327 {
9328 int error = 0;
9329 u_int32_t interface_index = IFSCOPE_NONE;
9330 struct sockaddr_storage address = {};
9331 const size_t buffer_size = uap->buffer_size;
9332
9333 if (uap->client_id == 0 || uap->client_id_len != sizeof(u_int32_t) ||
9334 buffer_size < sizeof(struct sockaddr_in) ||
9335 buffer_size > sizeof(struct sockaddr_storage) ||
9336 uap->buffer == 0) {
9337 NECPLOG0(LOG_ERR, "necp_client_get_interface_address bad input");
9338 error = EINVAL;
9339 goto done;
9340 }
9341
9342 error = copyin(uap->client_id, &interface_index, sizeof(u_int32_t));
9343 if (error) {
9344 NECPLOG(LOG_ERR, "necp_client_get_interface_address copyin interface_index error (%d)", error);
9345 goto done;
9346 }
9347
9348 if (interface_index == IFSCOPE_NONE) {
9349 error = ENOENT;
9350 NECPLOG(LOG_ERR, "necp_client_get_interface_address bad interface_index (%d)", interface_index);
9351 goto done;
9352 }
9353
9354 error = copyin(uap->buffer, &address, buffer_size);
9355 if (error) {
9356 NECPLOG(LOG_ERR, "necp_client_get_interface_address copyin address error (%d)", error);
9357 goto done;
9358 }
9359
9360 if (address.ss_family != AF_INET && address.ss_family != AF_INET6) {
9361 error = EINVAL;
9362 NECPLOG(LOG_ERR, "necp_client_get_interface_address invalid address family (%u)", address.ss_family);
9363 goto done;
9364 }
9365
9366 if (address.ss_len != buffer_size) {
9367 error = EINVAL;
9368 NECPLOG(LOG_ERR, "necp_client_get_interface_address invalid address length (%u)", address.ss_len);
9369 goto done;
9370 }
9371
9372 ifnet_head_lock_shared();
9373 ifnet_t ifp = NULL;
9374 if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
9375 ifp = ifindex2ifnet[interface_index];
9376 }
9377 ifnet_head_done();
9378 if (ifp == NULL) {
9379 error = ENOENT;
9380 NECPLOG0(LOG_ERR, "necp_client_get_interface_address no matching interface found");
9381 goto done;
9382 }
9383
9384 struct rtentry *rt = rtalloc1_scoped((struct sockaddr *)&address, 0, 0, interface_index);
9385 if (rt == NULL) {
9386 error = EINVAL;
9387 NECPLOG0(LOG_ERR, "necp_client_get_interface_address route lookup failed");
9388 goto done;
9389 }
9390
9391 uint32_t gencount = 0;
9392 struct sockaddr_storage local_address = {};
9393 error = flow_route_select_laddr((union sockaddr_in_4_6 *)&local_address,
9394 (union sockaddr_in_4_6 *)&address, ifp, rt, &gencount, 1);
9395 rtfree(rt);
9396 rt = NULL;
9397
9398 if (error) {
9399 NECPLOG(LOG_ERR, "necp_client_get_interface_address local address selection failed (%d)", error);
9400 goto done;
9401 }
9402
9403 if (local_address.ss_len > buffer_size) {
9404 error = EMSGSIZE;
9405 NECPLOG(LOG_ERR, "necp_client_get_interface_address local address too long for buffer (%u)",
9406 local_address.ss_len);
9407 goto done;
9408 }
9409
9410 error = copyout(&local_address, uap->buffer, local_address.ss_len);
9411 if (error) {
9412 NECPLOG(LOG_ERR, "necp_client_get_interface_address copyout error (%d)", error);
9413 goto done;
9414 }
9415 done:
9416 *retval = error;
9417
9418 return error;
9419 }
9420
9421 extern char *proc_name_address(void *p);
9422
9423 int
necp_stats_ctor(struct skmem_obj_info * oi,struct skmem_obj_info * oim,void * arg,uint32_t skmflag)9424 necp_stats_ctor(struct skmem_obj_info *oi, struct skmem_obj_info *oim,
9425 void *arg, uint32_t skmflag)
9426 {
9427 #pragma unused(arg, skmflag)
9428 struct necp_all_kstats *kstats = SKMEM_OBJ_ADDR(oi);
9429
9430 ASSERT(oim != NULL && SKMEM_OBJ_ADDR(oim) != NULL);
9431 ASSERT(SKMEM_OBJ_SIZE(oi) == SKMEM_OBJ_SIZE(oim));
9432
9433 kstats->necp_stats_ustats = SKMEM_OBJ_ADDR(oim);
9434
9435 return 0;
9436 }
9437
9438 int
necp_stats_dtor(void * addr,void * arg)9439 necp_stats_dtor(void *addr, void *arg)
9440 {
9441 #pragma unused(addr, arg)
9442 struct necp_all_kstats *kstats = addr;
9443
9444 kstats->necp_stats_ustats = NULL;
9445
9446 return 0;
9447 }
9448
9449 static void
necp_fd_insert_stats_arena(struct necp_fd_data * fd_data,struct necp_arena_info * nai)9450 necp_fd_insert_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai)
9451 {
9452 NECP_FD_ASSERT_LOCKED(fd_data);
9453 VERIFY(!(nai->nai_flags & NAIF_ATTACHED));
9454 VERIFY(nai->nai_chain.le_next == NULL && nai->nai_chain.le_prev == NULL);
9455
9456 LIST_INSERT_HEAD(&fd_data->stats_arena_list, nai, nai_chain);
9457 nai->nai_flags |= NAIF_ATTACHED;
9458 necp_arena_info_retain(nai); // for the list
9459 }
9460
9461 static void
necp_fd_remove_stats_arena(struct necp_fd_data * fd_data,struct necp_arena_info * nai)9462 necp_fd_remove_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai)
9463 {
9464 #pragma unused(fd_data)
9465 NECP_FD_ASSERT_LOCKED(fd_data);
9466 VERIFY(nai->nai_flags & NAIF_ATTACHED);
9467 VERIFY(nai->nai_use_count >= 1);
9468
9469 LIST_REMOVE(nai, nai_chain);
9470 nai->nai_flags &= ~NAIF_ATTACHED;
9471 nai->nai_chain.le_next = NULL;
9472 nai->nai_chain.le_prev = NULL;
9473 necp_arena_info_release(nai); // for the list
9474 }
9475
9476 static struct necp_arena_info *
necp_fd_mredirect_stats_arena(struct necp_fd_data * fd_data,struct proc * proc)9477 necp_fd_mredirect_stats_arena(struct necp_fd_data *fd_data, struct proc *proc)
9478 {
9479 struct necp_arena_info *nai, *nai_ret = NULL;
9480
9481 NECP_FD_ASSERT_LOCKED(fd_data);
9482
9483 // Redirect currently-active stats arena and remove it from the active state;
9484 // upon process resumption, new flow request would trigger the creation of
9485 // another active arena.
9486 if ((nai = fd_data->stats_arena_active) != NULL) {
9487 boolean_t need_defunct = FALSE;
9488
9489 ASSERT(!(nai->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT)));
9490 VERIFY(nai->nai_use_count >= 2);
9491 ASSERT(nai->nai_arena != NULL);
9492 ASSERT(nai->nai_mmap.ami_mapref != NULL);
9493
9494 int err = skmem_arena_mredirect(nai->nai_arena, &nai->nai_mmap, proc, &need_defunct);
9495 VERIFY(err == 0);
9496 // must be TRUE since we don't mmap the arena more than once
9497 VERIFY(need_defunct == TRUE);
9498
9499 nai->nai_flags |= NAIF_REDIRECT;
9500 nai_ret = nai; // return to caller
9501
9502 necp_arena_info_release(nai); // for fd_data
9503 fd_data->stats_arena_active = nai = NULL;
9504 }
9505
9506 #if (DEVELOPMENT || DEBUG)
9507 // make sure this list now contains nothing but redirected/defunct arenas
9508 LIST_FOREACH(nai, &fd_data->stats_arena_list, nai_chain) {
9509 ASSERT(nai->nai_use_count >= 1);
9510 ASSERT(nai->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT));
9511 }
9512 #endif /* (DEVELOPMENT || DEBUG) */
9513
9514 return nai_ret;
9515 }
9516
9517 static void
necp_arena_info_retain(struct necp_arena_info * nai)9518 necp_arena_info_retain(struct necp_arena_info *nai)
9519 {
9520 nai->nai_use_count++;
9521 VERIFY(nai->nai_use_count != 0);
9522 }
9523
9524 static void
necp_arena_info_release(struct necp_arena_info * nai)9525 necp_arena_info_release(struct necp_arena_info *nai)
9526 {
9527 VERIFY(nai->nai_use_count > 0);
9528 if (--nai->nai_use_count == 0) {
9529 necp_arena_info_free(nai);
9530 }
9531 }
9532
9533 static struct necp_arena_info *
necp_arena_info_alloc(void)9534 necp_arena_info_alloc(void)
9535 {
9536 return zalloc_flags(necp_arena_info_zone, Z_WAITOK | Z_ZERO);
9537 }
9538
9539 static void
necp_arena_info_free(struct necp_arena_info * nai)9540 necp_arena_info_free(struct necp_arena_info *nai)
9541 {
9542 VERIFY(nai->nai_chain.le_next == NULL && nai->nai_chain.le_prev == NULL);
9543 VERIFY(nai->nai_use_count == 0);
9544
9545 // NOTE: destroying the arena requires that all outstanding objects
9546 // that were allocated have been freed, else it will assert.
9547 if (nai->nai_arena != NULL) {
9548 skmem_arena_munmap(nai->nai_arena, &nai->nai_mmap);
9549 skmem_arena_release(nai->nai_arena);
9550 OSDecrementAtomic(&necp_arena_count);
9551 nai->nai_arena = NULL;
9552 nai->nai_roff = 0;
9553 }
9554
9555 ASSERT(nai->nai_arena == NULL);
9556 ASSERT(nai->nai_mmap.ami_mapref == NULL);
9557 ASSERT(nai->nai_mmap.ami_arena == NULL);
9558 ASSERT(nai->nai_mmap.ami_maptask == TASK_NULL);
9559
9560 zfree(necp_arena_info_zone, nai);
9561 }
9562
9563 static int
necp_arena_create(struct necp_fd_data * fd_data,size_t obj_size,size_t obj_cnt,struct proc * p)9564 necp_arena_create(struct necp_fd_data *fd_data, size_t obj_size, size_t obj_cnt, struct proc *p)
9565 {
9566 struct skmem_region_params srp_ustats = {};
9567 struct skmem_region_params srp_kstats = {};
9568 struct necp_arena_info *nai;
9569 char name[32];
9570 int error = 0;
9571
9572 NECP_FD_ASSERT_LOCKED(fd_data);
9573 ASSERT(fd_data->stats_arena_active == NULL);
9574 ASSERT(p != PROC_NULL);
9575 ASSERT(proc_pid(p) == fd_data->proc_pid);
9576
9577 // inherit the default parameters for the stats region
9578 srp_ustats = *skmem_get_default(SKMEM_REGION_USTATS);
9579 srp_kstats = *skmem_get_default(SKMEM_REGION_KSTATS);
9580
9581 // enable multi-segment mode
9582 srp_ustats.srp_cflags &= ~SKMEM_REGION_CR_MONOLITHIC;
9583 srp_kstats.srp_cflags &= ~SKMEM_REGION_CR_MONOLITHIC;
9584
9585 // configure and adjust the region parameters
9586 srp_ustats.srp_r_obj_cnt = srp_kstats.srp_r_obj_cnt = obj_cnt;
9587 srp_ustats.srp_r_obj_size = srp_kstats.srp_r_obj_size = obj_size;
9588 skmem_region_params_config(&srp_ustats);
9589 skmem_region_params_config(&srp_kstats);
9590
9591 nai = necp_arena_info_alloc();
9592
9593 nai->nai_proc_pid = fd_data->proc_pid;
9594 (void) snprintf(name, sizeof(name), "stats-%u.%s.%d", fd_data->stats_arena_gencnt, proc_name_address(p), fd_data->proc_pid);
9595 nai->nai_arena = skmem_arena_create_for_necp(name, &srp_ustats, &srp_kstats, &error);
9596 ASSERT(nai->nai_arena != NULL || error != 0);
9597 if (error != 0) {
9598 NECPLOG(LOG_ERR, "failed to create stats arena for pid %d\n", fd_data->proc_pid);
9599 } else {
9600 OSIncrementAtomic(&necp_arena_count);
9601
9602 // Get region offsets from base of mmap span; the arena
9603 // doesn't need to be mmap'd at this point, since we simply
9604 // compute the relative offset.
9605 nai->nai_roff = skmem_arena_get_region_offset(nai->nai_arena, SKMEM_REGION_USTATS);
9606
9607 // map to the task/process; upon success, the base address of the region
9608 // will be returned in nai_mmap.ami_mapaddr; this can be communicated to
9609 // the process.
9610 error = skmem_arena_mmap(nai->nai_arena, p, &nai->nai_mmap);
9611 if (error != 0) {
9612 NECPLOG(LOG_ERR, "failed to map stats arena for pid %d\n", fd_data->proc_pid);
9613 }
9614 }
9615
9616 if (error == 0) {
9617 fd_data->stats_arena_active = nai;
9618 necp_arena_info_retain(nai); // for fd_data
9619 necp_fd_insert_stats_arena(fd_data, nai);
9620 ++fd_data->stats_arena_gencnt;
9621 } else {
9622 necp_arena_info_free(nai);
9623 }
9624
9625 return error;
9626 }
9627
9628 static int
necp_arena_stats_obj_alloc(struct necp_fd_data * fd_data,mach_vm_offset_t * off,struct necp_arena_info ** stats_arena,void ** kstats_kaddr,boolean_t cansleep)9629 necp_arena_stats_obj_alloc(struct necp_fd_data *fd_data,
9630 mach_vm_offset_t *off,
9631 struct necp_arena_info **stats_arena,
9632 void **kstats_kaddr,
9633 boolean_t cansleep)
9634 {
9635 struct skmem_cache *kstats_cp = NULL;
9636 void *ustats_obj = NULL;
9637 void *kstats_obj = NULL;
9638 struct necp_all_kstats *kstats = NULL;
9639 struct skmem_obj_info kstats_oi = {};
9640
9641 ASSERT(off != NULL);
9642 ASSERT(stats_arena != NULL && *stats_arena == NULL);
9643 ASSERT(kstats_kaddr != NULL && *kstats_kaddr == NULL);
9644
9645 NECP_FD_ASSERT_LOCKED(fd_data);
9646 ASSERT(fd_data->stats_arena_active != NULL);
9647 ASSERT(fd_data->stats_arena_active->nai_arena != NULL);
9648
9649 kstats_cp = skmem_arena_necp(fd_data->stats_arena_active->nai_arena)->arc_kstats_cache;
9650 if ((kstats_obj = skmem_cache_alloc(kstats_cp, (cansleep ? SKMEM_SLEEP : SKMEM_NOSLEEP))) == NULL) {
9651 return ENOMEM;
9652 }
9653
9654 kstats = (struct necp_all_kstats*)kstats_obj;
9655 ustats_obj = kstats->necp_stats_ustats;
9656
9657 skmem_cache_get_obj_info(kstats_cp, kstats_obj, &kstats_oi, NULL);
9658 ASSERT(SKMEM_OBJ_SIZE(&kstats_oi) >= sizeof(struct necp_all_stats));
9659 // reset all stats counters
9660 bzero(ustats_obj, SKMEM_OBJ_SIZE(&kstats_oi));
9661 bzero(&kstats->necp_stats_comm, sizeof(struct necp_all_stats));
9662 *stats_arena = fd_data->stats_arena_active;
9663 *kstats_kaddr = kstats_obj;
9664 // kstats and ustats are mirrored and have the same offset
9665 *off = fd_data->stats_arena_active->nai_roff + SKMEM_OBJ_ROFF(&kstats_oi);
9666
9667 return 0;
9668 }
9669
9670 static void
necp_arena_stats_obj_free(struct necp_fd_data * fd_data,struct necp_arena_info * stats_arena,void ** kstats_kaddr,mach_vm_address_t * ustats_uaddr)9671 necp_arena_stats_obj_free(struct necp_fd_data *fd_data, struct necp_arena_info *stats_arena, void **kstats_kaddr, mach_vm_address_t *ustats_uaddr)
9672 {
9673 #pragma unused(fd_data)
9674 NECP_FD_ASSERT_LOCKED(fd_data);
9675
9676 ASSERT(stats_arena != NULL);
9677 ASSERT(stats_arena->nai_arena != NULL);
9678 ASSERT(kstats_kaddr != NULL && *kstats_kaddr != NULL);
9679 ASSERT(ustats_uaddr != NULL);
9680
9681 skmem_cache_free(skmem_arena_necp(stats_arena->nai_arena)->arc_kstats_cache, *kstats_kaddr);
9682 *kstats_kaddr = NULL;
9683 *ustats_uaddr = 0;
9684 }
9685
9686 // This routine returns the KVA of the sysctls object, as well as the
9687 // offset of that object relative to the mmap base address for the
9688 // task/process.
9689 static void *
necp_arena_sysctls_obj(struct necp_fd_data * fd_data,mach_vm_offset_t * off,size_t * size)9690 necp_arena_sysctls_obj(struct necp_fd_data *fd_data, mach_vm_offset_t *off, size_t *size)
9691 {
9692 void *objaddr;
9693
9694 NECP_FD_ASSERT_LOCKED(fd_data);
9695 ASSERT(fd_data->sysctl_arena != NULL);
9696
9697 // kernel virtual address of the sysctls object
9698 objaddr = skmem_arena_system_sysctls_obj_addr(fd_data->sysctl_arena);
9699 ASSERT(objaddr != NULL);
9700
9701 // Return the relative offset of the sysctls object; there is
9702 // only 1 object in the entire sysctls region, and therefore the
9703 // object's offset is simply the region's offset in the arena.
9704 // (sysctl_mmap.ami_mapaddr + offset) is the address of this object
9705 // in the task/process.
9706 if (off != NULL) {
9707 *off = fd_data->system_sysctls_roff;
9708 }
9709
9710 if (size != NULL) {
9711 *size = skmem_arena_system_sysctls_obj_size(fd_data->sysctl_arena);
9712 ASSERT(*size != 0);
9713 }
9714
9715 return objaddr;
9716 }
9717
9718 static void
necp_stats_arenas_destroy(struct necp_fd_data * fd_data,boolean_t closing)9719 necp_stats_arenas_destroy(struct necp_fd_data *fd_data, boolean_t closing)
9720 {
9721 struct necp_arena_info *nai, *nai_tmp;
9722
9723 NECP_FD_ASSERT_LOCKED(fd_data);
9724
9725 // If reaping (not closing), release reference only for idle active arena; the reference
9726 // count must be 2 by now, when it's not being referred to by any clients/flows.
9727 if ((nai = fd_data->stats_arena_active) != NULL && (closing || nai->nai_use_count == 2)) {
9728 VERIFY(nai->nai_use_count >= 2);
9729 necp_arena_info_release(nai); // for fd_data
9730 fd_data->stats_arena_active = NULL;
9731 }
9732
9733 // clean up any defunct arenas left in the list
9734 LIST_FOREACH_SAFE(nai, &fd_data->stats_arena_list, nai_chain, nai_tmp) {
9735 // If reaping, release reference if the list holds the last one
9736 if (closing || nai->nai_use_count == 1) {
9737 VERIFY(nai->nai_use_count >= 1);
9738 // callee unchains nai (and may free it)
9739 necp_fd_remove_stats_arena(fd_data, nai);
9740 }
9741 }
9742 }
9743
9744 static void
necp_sysctl_arena_destroy(struct necp_fd_data * fd_data)9745 necp_sysctl_arena_destroy(struct necp_fd_data *fd_data)
9746 {
9747 NECP_FD_ASSERT_LOCKED(fd_data);
9748
9749 // NOTE: destroying the arena requires that all outstanding objects
9750 // that were allocated have been freed, else it will assert.
9751 if (fd_data->sysctl_arena != NULL) {
9752 skmem_arena_munmap(fd_data->sysctl_arena, &fd_data->sysctl_mmap);
9753 skmem_arena_release(fd_data->sysctl_arena);
9754 OSDecrementAtomic(&necp_sysctl_arena_count);
9755 fd_data->sysctl_arena = NULL;
9756 fd_data->system_sysctls_roff = 0;
9757 }
9758 }
9759
9760 static int
necp_arena_initialize(struct necp_fd_data * fd_data,bool locked)9761 necp_arena_initialize(struct necp_fd_data *fd_data, bool locked)
9762 {
9763 int error = 0;
9764 size_t stats_obj_size = MAX(sizeof(struct necp_all_stats), sizeof(struct necp_all_kstats));
9765
9766 if (!locked) {
9767 NECP_FD_LOCK(fd_data);
9768 }
9769 if (fd_data->stats_arena_active == NULL) {
9770 error = necp_arena_create(fd_data, stats_obj_size,
9771 NECP_MAX_PER_PROCESS_CLIENT_STATISTICS_STRUCTS,
9772 current_proc());
9773 }
9774 if (!locked) {
9775 NECP_FD_UNLOCK(fd_data);
9776 }
9777
9778 return error;
9779 }
9780
9781 static int
necp_sysctl_arena_initialize(struct necp_fd_data * fd_data,bool locked)9782 necp_sysctl_arena_initialize(struct necp_fd_data *fd_data, bool locked)
9783 {
9784 int error = 0;
9785
9786 if (!locked) {
9787 NECP_FD_LOCK(fd_data);
9788 }
9789
9790 NECP_FD_ASSERT_LOCKED(fd_data);
9791
9792 if (fd_data->sysctl_arena == NULL) {
9793 char name[32];
9794 struct proc *p = current_proc();
9795
9796 ASSERT(p != PROC_NULL);
9797 ASSERT(proc_pid(p) == fd_data->proc_pid);
9798
9799 (void) snprintf(name, sizeof(name), "sysctl.%s.%d", proc_name_address(p), fd_data->proc_pid);
9800 fd_data->sysctl_arena = skmem_arena_create_for_system(name, &error);
9801 ASSERT(fd_data->sysctl_arena != NULL || error != 0);
9802 if (error != 0) {
9803 NECPLOG(LOG_ERR, "failed to create arena for pid %d\n", fd_data->proc_pid);
9804 } else {
9805 OSIncrementAtomic(&necp_sysctl_arena_count);
9806
9807 // Get region offsets from base of mmap span; the arena
9808 // doesn't need to be mmap'd at this point, since we simply
9809 // compute the relative offset.
9810 fd_data->system_sysctls_roff = skmem_arena_get_region_offset(fd_data->sysctl_arena, SKMEM_REGION_SYSCTLS);
9811
9812 // map to the task/process; upon success, the base address of the region
9813 // will be returned in nai_mmap.ami_mapaddr; this can be communicated to
9814 // the process.
9815 error = skmem_arena_mmap(fd_data->sysctl_arena, p, &fd_data->sysctl_mmap);
9816 if (error != 0) {
9817 NECPLOG(LOG_ERR, "failed to map sysctl arena for pid %d\n", fd_data->proc_pid);
9818 necp_sysctl_arena_destroy(fd_data);
9819 }
9820 }
9821 }
9822
9823 if (!locked) {
9824 NECP_FD_UNLOCK(fd_data);
9825 }
9826
9827 return error;
9828 }
9829
9830 static int
necp_client_stats_bufreq(struct necp_fd_data * fd_data,struct necp_client * client,struct necp_client_flow_registration * flow_registration,struct necp_stats_bufreq * bufreq,struct necp_stats_hdr * out_header)9831 necp_client_stats_bufreq(struct necp_fd_data *fd_data,
9832 struct necp_client *client,
9833 struct necp_client_flow_registration *flow_registration,
9834 struct necp_stats_bufreq *bufreq,
9835 struct necp_stats_hdr *out_header)
9836 {
9837 int error = 0;
9838 NECP_CLIENT_ASSERT_LOCKED(client);
9839 NECP_FD_ASSERT_LOCKED(fd_data);
9840
9841 if ((bufreq->necp_stats_bufreq_id == NECP_CLIENT_STATISTICS_BUFREQ_ID) &&
9842 ((bufreq->necp_stats_bufreq_type == NECP_CLIENT_STATISTICS_TYPE_TCP &&
9843 bufreq->necp_stats_bufreq_ver == NECP_CLIENT_STATISTICS_TYPE_TCP_CURRENT_VER) ||
9844 (bufreq->necp_stats_bufreq_type == NECP_CLIENT_STATISTICS_TYPE_UDP &&
9845 bufreq->necp_stats_bufreq_ver == NECP_CLIENT_STATISTICS_TYPE_UDP_CURRENT_VER) ||
9846 (bufreq->necp_stats_bufreq_type == NECP_CLIENT_STATISTICS_TYPE_QUIC &&
9847 bufreq->necp_stats_bufreq_ver == NECP_CLIENT_STATISTICS_TYPE_QUIC_CURRENT_VER)) &&
9848 (bufreq->necp_stats_bufreq_size == sizeof(struct necp_all_stats))) {
9849 // There should be one and only one stats allocation per client.
9850 // If asked more than once, we just repeat ourselves.
9851 if (flow_registration->ustats_uaddr == 0) {
9852 mach_vm_offset_t off;
9853 ASSERT(flow_registration->stats_arena == NULL);
9854 ASSERT(flow_registration->kstats_kaddr == NULL);
9855 ASSERT(flow_registration->ustats_uaddr == 0);
9856 error = necp_arena_stats_obj_alloc(fd_data, &off, &flow_registration->stats_arena, &flow_registration->kstats_kaddr, FALSE);
9857 if (error == 0) {
9858 // upon success, hold a reference for the client; this is released when the client is removed/closed
9859 ASSERT(flow_registration->stats_arena != NULL);
9860 necp_arena_info_retain(flow_registration->stats_arena);
9861
9862 // compute user address based on mapping info and object offset
9863 flow_registration->ustats_uaddr = flow_registration->stats_arena->nai_mmap.ami_mapaddr + off;
9864
9865 // add to collect_stats list
9866 NECP_STATS_LIST_LOCK_EXCLUSIVE();
9867 necp_client_retain_locked(client); // Add a reference to the client
9868 LIST_INSERT_HEAD(&necp_collect_stats_flow_list, flow_registration, collect_stats_chain);
9869 NECP_STATS_LIST_UNLOCK();
9870 necp_schedule_collect_stats_clients(FALSE);
9871 } else {
9872 ASSERT(flow_registration->stats_arena == NULL);
9873 ASSERT(flow_registration->kstats_kaddr == NULL);
9874 }
9875 }
9876 if (flow_registration->ustats_uaddr != 0) {
9877 ASSERT(error == 0);
9878 ASSERT(flow_registration->stats_arena != NULL);
9879 ASSERT(flow_registration->kstats_kaddr != NULL);
9880
9881 struct necp_all_kstats *kstats = (struct necp_all_kstats *)flow_registration->kstats_kaddr;
9882 kstats->necp_stats_ustats->all_stats_u.tcp_stats.necp_tcp_hdr.necp_stats_type = bufreq->necp_stats_bufreq_type;
9883 kstats->necp_stats_ustats->all_stats_u.tcp_stats.necp_tcp_hdr.necp_stats_ver = bufreq->necp_stats_bufreq_ver;
9884
9885 if (out_header) {
9886 out_header->necp_stats_type = bufreq->necp_stats_bufreq_type;
9887 out_header->necp_stats_ver = bufreq->necp_stats_bufreq_ver;
9888 }
9889
9890 bufreq->necp_stats_bufreq_uaddr = flow_registration->ustats_uaddr;
9891 }
9892 } else {
9893 error = EINVAL;
9894 }
9895
9896 return error;
9897 }
9898
9899 static int
necp_client_stats_initial(struct necp_client_flow_registration * flow_registration,uint32_t stats_type,uint32_t stats_ver)9900 necp_client_stats_initial(struct necp_client_flow_registration *flow_registration, uint32_t stats_type, uint32_t stats_ver)
9901 {
9902 // An attempted create
9903 assert(flow_registration->stats_handler_context == NULL);
9904 assert(flow_registration->stats_arena);
9905 assert(flow_registration->ustats_uaddr);
9906 assert(flow_registration->kstats_kaddr);
9907
9908 int error = 0;
9909 uint64_t ntstat_properties = necp_find_netstat_initial_properties(flow_registration->client);
9910
9911 switch (stats_type) {
9912 case NECP_CLIENT_STATISTICS_TYPE_TCP: {
9913 if (stats_ver == NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1) {
9914 flow_registration->stats_handler_context = ntstat_userland_stats_open((userland_stats_provider_context *)flow_registration,
9915 NSTAT_PROVIDER_TCP_USERLAND, ntstat_properties, necp_request_tcp_netstats, necp_find_extension_info);
9916 if (flow_registration->stats_handler_context == NULL) {
9917 error = EIO;
9918 }
9919 } else {
9920 error = ENOTSUP;
9921 }
9922 break;
9923 }
9924 case NECP_CLIENT_STATISTICS_TYPE_UDP: {
9925 if (stats_ver == NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1) {
9926 flow_registration->stats_handler_context = ntstat_userland_stats_open((userland_stats_provider_context *)flow_registration,
9927 NSTAT_PROVIDER_UDP_USERLAND, ntstat_properties, necp_request_udp_netstats, necp_find_extension_info);
9928 if (flow_registration->stats_handler_context == NULL) {
9929 error = EIO;
9930 }
9931 } else {
9932 error = ENOTSUP;
9933 }
9934 break;
9935 }
9936 case NECP_CLIENT_STATISTICS_TYPE_QUIC: {
9937 if (stats_ver == NECP_CLIENT_STATISTICS_TYPE_QUIC_VER_1 && flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS) {
9938 flow_registration->stats_handler_context = ntstat_userland_stats_open((userland_stats_provider_context *)flow_registration,
9939 NSTAT_PROVIDER_QUIC_USERLAND, ntstat_properties, necp_request_quic_netstats, necp_find_extension_info);
9940 if (flow_registration->stats_handler_context == NULL) {
9941 error = EIO;
9942 }
9943 } else {
9944 error = ENOTSUP;
9945 }
9946 break;
9947 }
9948 default: {
9949 error = ENOTSUP;
9950 break;
9951 }
9952 }
9953 return error;
9954 }
9955
9956 static int
necp_stats_initialize(struct necp_fd_data * fd_data,struct necp_client * client,struct necp_client_flow_registration * flow_registration,struct necp_stats_bufreq * bufreq)9957 necp_stats_initialize(struct necp_fd_data *fd_data,
9958 struct necp_client *client,
9959 struct necp_client_flow_registration *flow_registration,
9960 struct necp_stats_bufreq *bufreq)
9961 {
9962 int error = 0;
9963 struct necp_stats_hdr stats_hdr = {};
9964
9965 NECP_CLIENT_ASSERT_LOCKED(client);
9966 NECP_FD_ASSERT_LOCKED(fd_data);
9967 VERIFY(fd_data->stats_arena_active != NULL);
9968 VERIFY(fd_data->stats_arena_active->nai_arena != NULL);
9969 VERIFY(!(fd_data->stats_arena_active->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT)));
9970
9971 if (bufreq == NULL) {
9972 return EINVAL;
9973 }
9974
9975 // Setup stats region
9976 error = necp_client_stats_bufreq(fd_data, client, flow_registration, bufreq, &stats_hdr);
9977 if (error) {
9978 return error;
9979 }
9980 // Notify ntstat about new flow
9981 if (flow_registration->stats_handler_context == NULL) {
9982 error = necp_client_stats_initial(flow_registration, stats_hdr.necp_stats_type, stats_hdr.necp_stats_ver);
9983 if (flow_registration->stats_handler_context != NULL) {
9984 ntstat_userland_stats_event(flow_registration->stats_handler_context, NECP_CLIENT_STATISTICS_EVENT_INIT);
9985 }
9986 NECP_CLIENT_FLOW_LOG(client, flow_registration, "Initialized stats <error %d>", error);
9987 }
9988
9989 return error;
9990 }
9991
9992 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_map_sysctls(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9993 necp_client_map_sysctls(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9994 {
9995 int result = 0;
9996 if (!retval) {
9997 retval = &result;
9998 }
9999
10000 do {
10001 mach_vm_address_t uaddr = 0;
10002 if (uap->buffer_size != sizeof(uaddr)) {
10003 *retval = EINVAL;
10004 break;
10005 }
10006
10007 *retval = necp_sysctl_arena_initialize(fd_data, false);
10008 if (*retval != 0) {
10009 break;
10010 }
10011
10012 mach_vm_offset_t off = 0;
10013 void *location = NULL;
10014 NECP_FD_LOCK(fd_data);
10015 location = necp_arena_sysctls_obj(fd_data, &off, NULL);
10016 NECP_FD_UNLOCK(fd_data);
10017
10018 if (location == NULL) {
10019 *retval = ENOENT;
10020 break;
10021 }
10022
10023 uaddr = fd_data->sysctl_mmap.ami_mapaddr + off;
10024 *retval = copyout(&uaddr, uap->buffer, sizeof(uaddr));
10025 } while (false);
10026
10027 return *retval;
10028 }
10029
10030 #endif /* !SKYWALK */
10031
10032 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_route_statistics(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)10033 necp_client_copy_route_statistics(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
10034 {
10035 int error = 0;
10036 struct necp_client *client = NULL;
10037 uuid_t client_id;
10038
10039 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
10040 uap->buffer_size < sizeof(struct necp_stat_counts) || uap->buffer == 0) {
10041 NECPLOG0(LOG_ERR, "necp_client_copy_route_statistics bad input");
10042 error = EINVAL;
10043 goto done;
10044 }
10045
10046 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
10047 if (error) {
10048 NECPLOG(LOG_ERR, "necp_client_copy_route_statistics copyin client_id error (%d)", error);
10049 goto done;
10050 }
10051
10052 // Lock
10053 NECP_FD_LOCK(fd_data);
10054 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
10055 if (client != NULL) {
10056 NECP_CLIENT_ROUTE_LOCK(client);
10057 struct necp_stat_counts route_stats = {};
10058 if (client->current_route != NULL && client->current_route->rt_stats != NULL) {
10059 struct nstat_counts *rt_stats = client->current_route->rt_stats;
10060 route_stats.necp_stat_rxpackets = os_atomic_load(&rt_stats->nstat_rxpackets, relaxed);
10061 route_stats.necp_stat_rxbytes = os_atomic_load(&rt_stats->nstat_rxbytes, relaxed);
10062 route_stats.necp_stat_txpackets = os_atomic_load(&rt_stats->nstat_txpackets, relaxed);
10063 route_stats.necp_stat_txbytes = os_atomic_load(&rt_stats->nstat_txbytes, relaxed);
10064 route_stats.necp_stat_rxduplicatebytes = rt_stats->nstat_rxduplicatebytes;
10065 route_stats.necp_stat_rxoutoforderbytes = rt_stats->nstat_rxoutoforderbytes;
10066 route_stats.necp_stat_txretransmit = rt_stats->nstat_txretransmit;
10067 route_stats.necp_stat_connectattempts = rt_stats->nstat_connectattempts;
10068 route_stats.necp_stat_connectsuccesses = rt_stats->nstat_connectsuccesses;
10069 route_stats.necp_stat_min_rtt = rt_stats->nstat_min_rtt;
10070 route_stats.necp_stat_avg_rtt = rt_stats->nstat_avg_rtt;
10071 route_stats.necp_stat_var_rtt = rt_stats->nstat_var_rtt;
10072 route_stats.necp_stat_route_flags = client->current_route->rt_flags;
10073 }
10074
10075 // Unlock before copying out
10076 NECP_CLIENT_ROUTE_UNLOCK(client);
10077 NECP_CLIENT_UNLOCK(client);
10078 NECP_FD_UNLOCK(fd_data);
10079
10080 error = copyout(&route_stats, uap->buffer, sizeof(route_stats));
10081 if (error) {
10082 NECPLOG(LOG_ERR, "necp_client_copy_route_statistics copyout error (%d)", error);
10083 }
10084 } else {
10085 // Unlock
10086 NECP_FD_UNLOCK(fd_data);
10087 error = ENOENT;
10088 }
10089
10090
10091 done:
10092 *retval = error;
10093 return error;
10094 }
10095
10096 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_update_cache(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)10097 necp_client_update_cache(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
10098 {
10099 int error = 0;
10100 struct necp_client *client = NULL;
10101 uuid_t client_id;
10102
10103 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
10104 error = EINVAL;
10105 goto done;
10106 }
10107
10108 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
10109 if (error) {
10110 NECPLOG(LOG_ERR, "necp_client_update_cache copyin client_id error (%d)", error);
10111 goto done;
10112 }
10113
10114 NECP_FD_LOCK(fd_data);
10115 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
10116 if (client == NULL) {
10117 NECP_FD_UNLOCK(fd_data);
10118 error = ENOENT;
10119 goto done;
10120 }
10121
10122 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
10123 if (flow_registration == NULL) {
10124 NECP_CLIENT_UNLOCK(client);
10125 NECP_FD_UNLOCK(fd_data);
10126 error = ENOENT;
10127 goto done;
10128 }
10129
10130 NECP_CLIENT_ROUTE_LOCK(client);
10131 // This needs to be changed when TFO/ECN is supported by multiple flows
10132 struct necp_client_flow *flow = LIST_FIRST(&flow_registration->flow_list);
10133 if (flow == NULL ||
10134 (flow->remote_addr.sa.sa_family != AF_INET &&
10135 flow->remote_addr.sa.sa_family != AF_INET6) ||
10136 (flow->local_addr.sa.sa_family != AF_INET &&
10137 flow->local_addr.sa.sa_family != AF_INET6)) {
10138 error = EINVAL;
10139 NECPLOG(LOG_ERR, "necp_client_update_cache no flow error (%d)", error);
10140 goto done_unlock;
10141 }
10142
10143 necp_cache_buffer cache_buffer;
10144 memset(&cache_buffer, 0, sizeof(cache_buffer));
10145
10146 if (uap->buffer_size != sizeof(necp_cache_buffer) ||
10147 uap->buffer == USER_ADDR_NULL) {
10148 error = EINVAL;
10149 goto done_unlock;
10150 }
10151
10152 error = copyin(uap->buffer, &cache_buffer, sizeof(cache_buffer));
10153 if (error) {
10154 NECPLOG(LOG_ERR, "necp_client_update_cache copyin cache buffer error (%d)", error);
10155 goto done_unlock;
10156 }
10157
10158 if (cache_buffer.necp_cache_buf_type == NECP_CLIENT_CACHE_TYPE_ECN &&
10159 cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_ECN_VER_1) {
10160 if (cache_buffer.necp_cache_buf_size != sizeof(necp_tcp_ecn_cache) ||
10161 cache_buffer.necp_cache_buf_addr == USER_ADDR_NULL) {
10162 error = EINVAL;
10163 goto done_unlock;
10164 }
10165
10166 necp_tcp_ecn_cache ecn_cache_buffer;
10167 memset(&ecn_cache_buffer, 0, sizeof(ecn_cache_buffer));
10168
10169 error = copyin(cache_buffer.necp_cache_buf_addr, &ecn_cache_buffer, sizeof(necp_tcp_ecn_cache));
10170 if (error) {
10171 NECPLOG(LOG_ERR, "necp_client_update_cache copyin ecn cache buffer error (%d)", error);
10172 goto done_unlock;
10173 }
10174
10175 if (client->current_route != NULL && client->current_route->rt_ifp != NULL) {
10176 if (!client->platform_binary) {
10177 ecn_cache_buffer.necp_tcp_ecn_heuristics_success = 0;
10178 }
10179 tcp_heuristics_ecn_update(&ecn_cache_buffer, client->current_route->rt_ifp,
10180 (union sockaddr_in_4_6 *)&flow->local_addr);
10181 }
10182 } else if (cache_buffer.necp_cache_buf_type == NECP_CLIENT_CACHE_TYPE_TFO &&
10183 cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_TFO_VER_1) {
10184 if (cache_buffer.necp_cache_buf_size != sizeof(necp_tcp_tfo_cache) ||
10185 cache_buffer.necp_cache_buf_addr == USER_ADDR_NULL) {
10186 error = EINVAL;
10187 goto done_unlock;
10188 }
10189
10190 necp_tcp_tfo_cache tfo_cache_buffer;
10191 memset(&tfo_cache_buffer, 0, sizeof(tfo_cache_buffer));
10192
10193 error = copyin(cache_buffer.necp_cache_buf_addr, &tfo_cache_buffer, sizeof(necp_tcp_tfo_cache));
10194 if (error) {
10195 NECPLOG(LOG_ERR, "necp_client_update_cache copyin tfo cache buffer error (%d)", error);
10196 goto done_unlock;
10197 }
10198
10199 if (client->current_route != NULL && client->current_route->rt_ifp != NULL) {
10200 if (!client->platform_binary) {
10201 tfo_cache_buffer.necp_tcp_tfo_heuristics_success = 0;
10202 }
10203 tcp_heuristics_tfo_update(&tfo_cache_buffer, client->current_route->rt_ifp,
10204 (union sockaddr_in_4_6 *)&flow->local_addr,
10205 (union sockaddr_in_4_6 *)&flow->remote_addr);
10206 }
10207 } else {
10208 error = EINVAL;
10209 }
10210 done_unlock:
10211 NECP_CLIENT_ROUTE_UNLOCK(client);
10212 NECP_CLIENT_UNLOCK(client);
10213 NECP_FD_UNLOCK(fd_data);
10214 done:
10215 *retval = error;
10216 return error;
10217 }
10218
10219 // Most results will fit into this size
10220 struct necp_client_signable_default {
10221 uuid_t client_id;
10222 u_int32_t sign_type;
10223 u_int8_t signable_data[NECP_CLIENT_ACTION_SIGN_DEFAULT_DATA_LENGTH];
10224 } __attribute__((__packed__));
10225
10226 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_sign(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)10227 necp_client_sign(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
10228 {
10229 int error = 0;
10230 u_int8_t tag[NECP_CLIENT_ACTION_SIGN_TAG_LENGTH] = {};
10231 struct necp_client_signable *signable = NULL;
10232 struct necp_client_signable *allocated_signable = NULL;
10233 struct necp_client_signable_default default_signable = {};
10234 size_t tag_size = sizeof(tag);
10235
10236 const size_t signable_length = uap->client_id_len;
10237 const size_t return_tag_length = uap->buffer_size;
10238
10239 *retval = 0;
10240
10241 const bool has_resolver_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_VALIDATED_RESOLVER, 0) == 0);
10242 if (!has_resolver_entitlement) {
10243 NECPLOG0(LOG_ERR, "Process does not hold the necessary entitlement to sign resolver answers");
10244 error = EPERM;
10245 goto done;
10246 }
10247
10248 if (uap->client_id == 0 || signable_length < sizeof(*signable) || signable_length > NECP_CLIENT_ACTION_SIGN_MAX_TOTAL_LENGTH) {
10249 error = EINVAL;
10250 goto done;
10251 }
10252
10253 if (uap->buffer == 0 || return_tag_length != NECP_CLIENT_ACTION_SIGN_TAG_LENGTH) {
10254 error = EINVAL;
10255 goto done;
10256 }
10257
10258 if (signable_length <= sizeof(default_signable)) {
10259 signable = (struct necp_client_signable *)&default_signable;
10260 } else {
10261 if ((allocated_signable = (struct necp_client_signable *)kalloc_data(signable_length, Z_WAITOK | Z_ZERO)) == NULL) {
10262 NECPLOG(LOG_ERR, "necp_client_sign allocate signable %zu failed", signable_length);
10263 error = ENOMEM;
10264 goto done;
10265 }
10266 signable = allocated_signable;
10267 }
10268
10269 error = copyin(uap->client_id, signable, signable_length);
10270 if (error) {
10271 NECPLOG(LOG_ERR, "necp_client_sign copyin signable error (%d)", error);
10272 goto done;
10273 }
10274
10275 size_t data_length = 0;
10276 switch (signable->sign_type) {
10277 case NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER:
10278 case NECP_CLIENT_SIGN_TYPE_SYSTEM_RESOLVER_ANSWER: {
10279 data_length = (sizeof(struct necp_client_host_resolver_answer) - sizeof(struct necp_client_signable));
10280 if (signable_length < (sizeof(struct necp_client_signable) + data_length)) {
10281 error = EINVAL;
10282 goto done;
10283 }
10284 struct necp_client_host_resolver_answer *signable_struct = (struct necp_client_host_resolver_answer *)signable;
10285 if (signable_struct->hostname_length > NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH ||
10286 signable_length != (sizeof(struct necp_client_signable) + data_length + signable_struct->hostname_length)) {
10287 error = EINVAL;
10288 goto done;
10289 }
10290 data_length += signable_struct->hostname_length;
10291 break;
10292 }
10293 case NECP_CLIENT_SIGN_TYPE_BROWSE_RESULT:
10294 case NECP_CLIENT_SIGN_TYPE_SYSTEM_BROWSE_RESULT: {
10295 data_length = (sizeof(struct necp_client_browse_result) - sizeof(struct necp_client_signable));
10296 if (signable_length < (sizeof(struct necp_client_signable) + data_length)) {
10297 error = EINVAL;
10298 goto done;
10299 }
10300 struct necp_client_browse_result *signable_struct = (struct necp_client_browse_result *)signable;
10301 if (signable_struct->service_length > NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH ||
10302 signable_length != (sizeof(struct necp_client_signable) + data_length + signable_struct->service_length)) {
10303 error = EINVAL;
10304 goto done;
10305 }
10306 data_length += signable_struct->service_length;
10307 break;
10308 }
10309 case NECP_CLIENT_SIGN_TYPE_SERVICE_RESOLVER_ANSWER:
10310 case NECP_CLIENT_SIGN_TYPE_SYSTEM_SERVICE_RESOLVER_ANSWER: {
10311 data_length = (sizeof(struct necp_client_service_resolver_answer) - sizeof(struct necp_client_signable));
10312 if (signable_length < (sizeof(struct necp_client_signable) + data_length)) {
10313 error = EINVAL;
10314 goto done;
10315 }
10316 struct necp_client_service_resolver_answer *signable_struct = (struct necp_client_service_resolver_answer *)signable;
10317 if (signable_struct->service_length > NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH ||
10318 signable_struct->hostname_length > NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH ||
10319 signable_length != (sizeof(struct necp_client_signable) + data_length + signable_struct->service_length + signable_struct->hostname_length)) {
10320 error = EINVAL;
10321 goto done;
10322 }
10323 data_length += signable_struct->service_length;
10324 data_length += signable_struct->hostname_length;
10325 break;
10326 }
10327 default: {
10328 NECPLOG(LOG_ERR, "necp_client_sign unknown signable type (%u)", signable->sign_type);
10329 error = EINVAL;
10330 goto done;
10331 }
10332 }
10333
10334 error = necp_sign_resolver_answer(signable->client_id, signable->sign_type,
10335 signable->signable_data, data_length,
10336 tag, &tag_size);
10337 if (tag_size != sizeof(tag)) {
10338 NECPLOG(LOG_ERR, "necp_client_sign unexpected tag size %zu", tag_size);
10339 error = EINVAL;
10340 goto done;
10341 }
10342 error = copyout(tag, uap->buffer, tag_size);
10343 if (error) {
10344 NECPLOG(LOG_ERR, "necp_client_sign copyout error (%d)", error);
10345 goto done;
10346 }
10347
10348 done:
10349 if (allocated_signable != NULL) {
10350 kfree_data(allocated_signable, signable_length);
10351 allocated_signable = NULL;
10352 }
10353 *retval = error;
10354 return error;
10355 }
10356
10357 // Most results will fit into this size
10358 struct necp_client_validatable_default {
10359 struct necp_client_signature signature;
10360 struct necp_client_signable_default signable;
10361 } __attribute__((__packed__));
10362
10363 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_validate(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)10364 necp_client_validate(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
10365 {
10366 int error = 0;
10367 struct necp_client_validatable *validatable = NULL;
10368 struct necp_client_validatable *allocated_validatable = NULL;
10369 struct necp_client_validatable_default default_validatable = {};
10370
10371 const size_t validatable_length = uap->client_id_len;
10372
10373 *retval = 0;
10374
10375 const bool has_resolver_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_VALIDATED_RESOLVER, 0) == 0);
10376 if (!has_resolver_entitlement) {
10377 NECPLOG0(LOG_ERR, "Process does not hold the necessary entitlement to directly validate resolver answers");
10378 error = EPERM;
10379 goto done;
10380 }
10381
10382 if (uap->client_id == 0 || validatable_length < sizeof(*validatable) ||
10383 validatable_length > (NECP_CLIENT_ACTION_SIGN_MAX_TOTAL_LENGTH + NECP_CLIENT_ACTION_SIGN_TAG_LENGTH)) {
10384 error = EINVAL;
10385 goto done;
10386 }
10387
10388 if (validatable_length <= sizeof(default_validatable)) {
10389 validatable = (struct necp_client_validatable *)&default_validatable;
10390 } else {
10391 if ((allocated_validatable = (struct necp_client_validatable *)kalloc_data(validatable_length, Z_WAITOK | Z_ZERO)) == NULL) {
10392 NECPLOG(LOG_ERR, "necp_client_validate allocate struct %zu failed", validatable_length);
10393 error = ENOMEM;
10394 goto done;
10395 }
10396 validatable = allocated_validatable;
10397 }
10398
10399 error = copyin(uap->client_id, validatable, validatable_length);
10400 if (error) {
10401 NECPLOG(LOG_ERR, "necp_client_validate copyin error (%d)", error);
10402 goto done;
10403 }
10404
10405 const bool validated = necp_validate_resolver_answer(validatable->signable.client_id, validatable->signable.sign_type,
10406 validatable->signable.signable_data, validatable_length - sizeof(struct necp_client_validatable),
10407 validatable->signature.signed_tag, sizeof(validatable->signature.signed_tag));
10408 if (!validated) {
10409 // Return EAUTH to indicate that the signature failed
10410 error = EAUTH;
10411 }
10412
10413 done:
10414 if (allocated_validatable != NULL) {
10415 kfree_data(allocated_validatable, validatable_length);
10416 allocated_validatable = NULL;
10417 }
10418 *retval = error;
10419 return error;
10420 }
10421
10422 int
necp_client_action(struct proc * p,struct necp_client_action_args * uap,int * retval)10423 necp_client_action(struct proc *p, struct necp_client_action_args *uap, int *retval)
10424 {
10425 struct fileproc *fp;
10426 int error = 0;
10427 int return_value = 0;
10428 struct necp_fd_data *fd_data = NULL;
10429
10430 error = necp_find_fd_data(p, uap->necp_fd, &fp, &fd_data);
10431 if (error != 0) {
10432 NECPLOG(LOG_ERR, "necp_client_action find fd error (%d)", error);
10433 return error;
10434 }
10435
10436 u_int32_t action = uap->action;
10437
10438 #if CONFIG_MACF
10439 error = mac_necp_check_client_action(p, fp->fp_glob, action);
10440 if (error) {
10441 return_value = error;
10442 goto done;
10443 }
10444 #endif /* MACF */
10445
10446 switch (action) {
10447 case NECP_CLIENT_ACTION_ADD: {
10448 return_value = necp_client_add(p, fd_data, uap, retval);
10449 break;
10450 }
10451 case NECP_CLIENT_ACTION_CLAIM: {
10452 return_value = necp_client_claim(p, fd_data, uap, retval);
10453 break;
10454 }
10455 case NECP_CLIENT_ACTION_REMOVE: {
10456 return_value = necp_client_remove(fd_data, uap, retval);
10457 break;
10458 }
10459 case NECP_CLIENT_ACTION_COPY_PARAMETERS:
10460 case NECP_CLIENT_ACTION_COPY_RESULT:
10461 case NECP_CLIENT_ACTION_COPY_UPDATED_RESULT: {
10462 return_value = necp_client_copy(fd_data, uap, retval);
10463 break;
10464 }
10465 case NECP_CLIENT_ACTION_COPY_LIST: {
10466 return_value = necp_client_list(fd_data, uap, retval);
10467 break;
10468 }
10469 case NECP_CLIENT_ACTION_ADD_FLOW: {
10470 return_value = necp_client_add_flow(fd_data, uap, retval);
10471 break;
10472 }
10473 case NECP_CLIENT_ACTION_REMOVE_FLOW: {
10474 return_value = necp_client_remove_flow(fd_data, uap, retval);
10475 break;
10476 }
10477 #if SKYWALK
10478 case NECP_CLIENT_ACTION_REQUEST_NEXUS_INSTANCE: {
10479 return_value = necp_client_request_nexus(fd_data, uap, retval);
10480 break;
10481 }
10482 #endif /* !SKYWALK */
10483 case NECP_CLIENT_ACTION_AGENT: {
10484 return_value = necp_client_agent_action(fd_data, uap, retval);
10485 break;
10486 }
10487 case NECP_CLIENT_ACTION_COPY_AGENT: {
10488 return_value = necp_client_copy_agent(fd_data, uap, retval);
10489 break;
10490 }
10491 case NECP_CLIENT_ACTION_AGENT_USE: {
10492 return_value = necp_client_agent_use(fd_data, uap, retval);
10493 break;
10494 }
10495 case NECP_CLIENT_ACTION_ACQUIRE_AGENT_TOKEN: {
10496 return_value = necp_client_acquire_agent_token(fd_data, uap, retval);
10497 break;
10498 }
10499 case NECP_CLIENT_ACTION_COPY_INTERFACE: {
10500 return_value = necp_client_copy_interface(fd_data, uap, retval);
10501 break;
10502 }
10503 #if SKYWALK
10504 case NECP_CLIENT_ACTION_GET_INTERFACE_ADDRESS: {
10505 return_value = necp_client_get_interface_address(fd_data, uap, retval);
10506 break;
10507 }
10508 case NECP_CLIENT_ACTION_SET_STATISTICS: {
10509 return_value = ENOTSUP;
10510 break;
10511 }
10512 case NECP_CLIENT_ACTION_MAP_SYSCTLS: {
10513 return_value = necp_client_map_sysctls(fd_data, uap, retval);
10514 break;
10515 }
10516 #endif /* !SKYWALK */
10517 case NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS: {
10518 return_value = necp_client_copy_route_statistics(fd_data, uap, retval);
10519 break;
10520 }
10521 case NECP_CLIENT_ACTION_UPDATE_CACHE: {
10522 return_value = necp_client_update_cache(fd_data, uap, retval);
10523 break;
10524 }
10525 case NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE: {
10526 return_value = necp_client_copy_client_update(fd_data, uap, retval);
10527 break;
10528 }
10529 case NECP_CLIENT_ACTION_SIGN: {
10530 return_value = necp_client_sign(fd_data, uap, retval);
10531 break;
10532 }
10533 case NECP_CLIENT_ACTION_VALIDATE: {
10534 return_value = necp_client_validate(fd_data, uap, retval);
10535 break;
10536 }
10537 default: {
10538 NECPLOG(LOG_ERR, "necp_client_action unknown action (%u)", action);
10539 return_value = EINVAL;
10540 break;
10541 }
10542 }
10543
10544 done:
10545 fp_drop(p, uap->necp_fd, fp, 0);
10546 return return_value;
10547 }
10548
10549 #define NECP_MAX_MATCH_POLICY_PARAMETER_SIZE 1024
10550
10551 int
necp_match_policy(struct proc * p,struct necp_match_policy_args * uap,int32_t * retval)10552 necp_match_policy(struct proc *p, struct necp_match_policy_args *uap, int32_t *retval)
10553 {
10554 #pragma unused(retval)
10555 u_int8_t *parameters = NULL;
10556 struct necp_aggregate_result returned_result;
10557 int error = 0;
10558
10559 if (uap == NULL) {
10560 error = EINVAL;
10561 goto done;
10562 }
10563
10564 if (uap->parameters == 0 || uap->parameters_size == 0 || uap->parameters_size > NECP_MAX_MATCH_POLICY_PARAMETER_SIZE || uap->returned_result == 0) {
10565 error = EINVAL;
10566 goto done;
10567 }
10568
10569 parameters = (u_int8_t *)kalloc_data(uap->parameters_size, Z_WAITOK | Z_ZERO);
10570 if (parameters == NULL) {
10571 error = ENOMEM;
10572 goto done;
10573 }
10574 // Copy parameters in
10575 error = copyin(uap->parameters, parameters, uap->parameters_size);
10576 if (error) {
10577 goto done;
10578 }
10579
10580 error = necp_application_find_policy_match_internal(p, parameters, uap->parameters_size,
10581 &returned_result, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL, false, false, NULL);
10582 if (error) {
10583 goto done;
10584 }
10585
10586 // Copy return value back
10587 error = copyout(&returned_result, uap->returned_result, sizeof(struct necp_aggregate_result));
10588 if (error) {
10589 goto done;
10590 }
10591 done:
10592 if (parameters != NULL) {
10593 kfree_data(parameters, uap->parameters_size);
10594 }
10595 return error;
10596 }
10597
10598 /// Socket operations
10599
10600 static errno_t
necp_set_socket_attribute(u_int8_t * buffer,size_t buffer_length,u_int8_t type,char ** buffer_p,bool * single_tlv)10601 necp_set_socket_attribute(u_int8_t *buffer, size_t buffer_length, u_int8_t type, char **buffer_p, bool *single_tlv)
10602 {
10603 int error = 0;
10604 int cursor = 0;
10605 size_t string_size = 0;
10606 char *local_string = NULL;
10607 u_int8_t *value = NULL;
10608 char *buffer_to_free = NULL;
10609
10610 cursor = necp_buffer_find_tlv(buffer, buffer_length, 0, type, NULL, 0);
10611 if (cursor < 0) {
10612 // This will clear out the parameter
10613 goto done;
10614 }
10615
10616 string_size = necp_buffer_get_tlv_length(buffer, cursor);
10617 if (single_tlv != NULL && (buffer_length == sizeof(struct necp_tlv_header) + string_size)) {
10618 *single_tlv = true;
10619 }
10620 if (string_size == 0 || string_size > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) {
10621 // This will clear out the parameter
10622 goto done;
10623 }
10624
10625 local_string = (char *)kalloc_data(string_size + 1, Z_WAITOK | Z_ZERO);
10626 if (local_string == NULL) {
10627 NECPLOG(LOG_ERR, "Failed to allocate a socket attribute buffer (size %zu)", string_size);
10628 goto fail;
10629 }
10630
10631 value = necp_buffer_get_tlv_value(buffer, cursor, NULL);
10632 if (value == NULL) {
10633 NECPLOG0(LOG_ERR, "Failed to get socket attribute");
10634 goto fail;
10635 }
10636
10637 memcpy(local_string, value, string_size);
10638 local_string[string_size] = 0;
10639
10640 done:
10641 buffer_to_free = *buffer_p;
10642
10643 // Protect switching of buffer pointer
10644 necp_lock_socket_attributes();
10645 *buffer_p = local_string;
10646 necp_unlock_socket_attributes();
10647
10648 if (buffer_to_free != NULL) {
10649 kfree_data_addr(buffer_to_free);
10650 }
10651 return 0;
10652 fail:
10653 if (local_string != NULL) {
10654 kfree_data(local_string, string_size + 1);
10655 }
10656 return error;
10657 }
10658
10659 errno_t
necp_set_socket_attributes(struct inp_necp_attributes * attributes,struct sockopt * sopt)10660 necp_set_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt)
10661 {
10662 int error = 0;
10663 u_int8_t *buffer = NULL;
10664 bool single_tlv = false;
10665 size_t valsize = sopt->sopt_valsize;
10666 if (valsize == 0 ||
10667 valsize > ((sizeof(struct necp_tlv_header) + NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) * 4)) {
10668 goto done;
10669 }
10670
10671 buffer = (u_int8_t *)kalloc_data(valsize, Z_WAITOK | Z_ZERO);
10672 if (buffer == NULL) {
10673 goto done;
10674 }
10675
10676 error = sooptcopyin(sopt, buffer, valsize, 0);
10677 if (error) {
10678 goto done;
10679 }
10680
10681 // If NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT is being set/cleared separately from the other attributes,
10682 // do not clear other attributes.
10683 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT, &attributes->inp_domain_context, &single_tlv);
10684 if (error) {
10685 NECPLOG0(LOG_ERR, "Could not set domain context TLV for socket attributes");
10686 goto done;
10687 }
10688 if (single_tlv == true) {
10689 goto done;
10690 }
10691
10692 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN, &attributes->inp_domain, NULL);
10693 if (error) {
10694 NECPLOG0(LOG_ERR, "Could not set domain TLV for socket attributes");
10695 goto done;
10696 }
10697
10698 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN_OWNER, &attributes->inp_domain_owner, NULL);
10699 if (error) {
10700 NECPLOG0(LOG_ERR, "Could not set domain owner TLV for socket attributes");
10701 goto done;
10702 }
10703
10704 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_TRACKER_DOMAIN, &attributes->inp_tracker_domain, NULL);
10705 if (error) {
10706 NECPLOG0(LOG_ERR, "Could not set tracker domain TLV for socket attributes");
10707 goto done;
10708 }
10709
10710 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_ACCOUNT, &attributes->inp_account, NULL);
10711 if (error) {
10712 NECPLOG0(LOG_ERR, "Could not set account TLV for socket attributes");
10713 goto done;
10714 }
10715
10716 done:
10717 NECP_SOCKET_ATTRIBUTE_LOG("NECP ATTRIBUTES SOCKET - domain <%s> owner <%s> context <%s> tracker domain <%s> account <%s>",
10718 attributes->inp_domain,
10719 attributes->inp_domain_owner,
10720 attributes->inp_domain_context,
10721 attributes->inp_tracker_domain,
10722 attributes->inp_account);
10723
10724 if (necp_debug) {
10725 NECPLOG(LOG_DEBUG, "Set on socket: Domain %s, Domain owner %s, Domain context %s, Tracker domain %s, Account %s",
10726 attributes->inp_domain,
10727 attributes->inp_domain_owner,
10728 attributes->inp_domain_context,
10729 attributes->inp_tracker_domain,
10730 attributes->inp_account);
10731 }
10732
10733 if (buffer != NULL) {
10734 kfree_data(buffer, valsize);
10735 }
10736
10737 return error;
10738 }
10739
10740 errno_t
necp_get_socket_attributes(struct inp_necp_attributes * attributes,struct sockopt * sopt)10741 necp_get_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt)
10742 {
10743 int error = 0;
10744 u_int8_t *buffer = NULL;
10745 u_int8_t *cursor = NULL;
10746 size_t valsize = 0;
10747
10748 if (attributes->inp_domain != NULL) {
10749 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_domain);
10750 }
10751 if (attributes->inp_domain_owner != NULL) {
10752 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_domain_owner);
10753 }
10754 if (attributes->inp_domain_context != NULL) {
10755 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_domain_context);
10756 }
10757 if (attributes->inp_tracker_domain != NULL) {
10758 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_tracker_domain);
10759 }
10760 if (attributes->inp_account != NULL) {
10761 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_account);
10762 }
10763 if (valsize == 0) {
10764 goto done;
10765 }
10766
10767 buffer = (u_int8_t *)kalloc_data(valsize, Z_WAITOK | Z_ZERO);
10768 if (buffer == NULL) {
10769 goto done;
10770 }
10771
10772 cursor = buffer;
10773 if (attributes->inp_domain != NULL) {
10774 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN, strlen(attributes->inp_domain), attributes->inp_domain,
10775 buffer, valsize);
10776 }
10777
10778 if (attributes->inp_domain_owner != NULL) {
10779 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN_OWNER, strlen(attributes->inp_domain_owner), attributes->inp_domain_owner,
10780 buffer, valsize);
10781 }
10782
10783 if (attributes->inp_domain_context != NULL) {
10784 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT, strlen(attributes->inp_domain_context), attributes->inp_domain_context,
10785 buffer, valsize);
10786 }
10787
10788 if (attributes->inp_tracker_domain != NULL) {
10789 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_TRACKER_DOMAIN, strlen(attributes->inp_tracker_domain), attributes->inp_tracker_domain,
10790 buffer, valsize);
10791 }
10792
10793 if (attributes->inp_account != NULL) {
10794 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_ACCOUNT, strlen(attributes->inp_account), attributes->inp_account,
10795 buffer, valsize);
10796 }
10797
10798 error = sooptcopyout(sopt, buffer, valsize);
10799 if (error) {
10800 goto done;
10801 }
10802 done:
10803 if (buffer != NULL) {
10804 kfree_data(buffer, valsize);
10805 }
10806
10807 return error;
10808 }
10809
10810 int
necp_set_socket_resolver_signature(struct inpcb * inp,struct sockopt * sopt)10811 necp_set_socket_resolver_signature(struct inpcb *inp, struct sockopt *sopt)
10812 {
10813 const size_t valsize = sopt->sopt_valsize;
10814 if (valsize > NECP_CLIENT_ACTION_SIGN_MAX_TOTAL_LENGTH + NECP_CLIENT_ACTION_SIGN_TAG_LENGTH) {
10815 return EINVAL;
10816 }
10817
10818 necp_lock_socket_attributes();
10819 if (inp->inp_resolver_signature != NULL) {
10820 kfree_data(inp->inp_resolver_signature, inp->inp_resolver_signature_length);
10821 }
10822 inp->inp_resolver_signature_length = 0;
10823
10824 int error = 0;
10825 if (valsize > 0) {
10826 inp->inp_resolver_signature = kalloc_data(valsize, Z_WAITOK | Z_ZERO);
10827 if ((error = sooptcopyin(sopt, inp->inp_resolver_signature, valsize,
10828 valsize)) != 0) {
10829 // Free the signature buffer if the copyin failed
10830 kfree_data(inp->inp_resolver_signature, valsize);
10831 } else {
10832 inp->inp_resolver_signature_length = valsize;
10833 }
10834 }
10835 necp_unlock_socket_attributes();
10836
10837 return error;
10838 }
10839
10840 int
necp_get_socket_resolver_signature(struct inpcb * inp,struct sockopt * sopt)10841 necp_get_socket_resolver_signature(struct inpcb *inp, struct sockopt *sopt)
10842 {
10843 int error = 0;
10844 necp_lock_socket_attributes();
10845 if (inp->inp_resolver_signature == NULL ||
10846 inp->inp_resolver_signature_length == 0) {
10847 error = ENOENT;
10848 } else {
10849 error = sooptcopyout(sopt, inp->inp_resolver_signature,
10850 inp->inp_resolver_signature_length);
10851 }
10852 necp_unlock_socket_attributes();
10853 return error;
10854 }
10855
10856 bool
necp_socket_has_resolver_signature(struct inpcb * inp)10857 necp_socket_has_resolver_signature(struct inpcb *inp)
10858 {
10859 necp_lock_socket_attributes();
10860 bool has_signature = (inp->inp_resolver_signature != NULL && inp->inp_resolver_signature_length != 0);
10861 necp_unlock_socket_attributes();
10862 return has_signature;
10863 }
10864
10865 bool
necp_socket_resolver_signature_matches_address(struct inpcb * inp,union necp_sockaddr_union * address)10866 necp_socket_resolver_signature_matches_address(struct inpcb *inp, union necp_sockaddr_union *address)
10867 {
10868 bool matches_address = false;
10869 necp_lock_socket_attributes();
10870 if (inp->inp_resolver_signature != NULL && inp->inp_resolver_signature_length > 0 && address->sa.sa_len > 0) {
10871 struct necp_client_validatable *validatable = (struct necp_client_validatable *)inp->inp_resolver_signature;
10872 if (inp->inp_resolver_signature_length > sizeof(struct necp_client_validatable) &&
10873 validatable->signable.sign_type == NECP_CLIENT_SIGN_TYPE_SYSTEM_RESOLVER_ANSWER) {
10874 size_t data_length = inp->inp_resolver_signature_length - sizeof(struct necp_client_validatable);
10875 if (data_length >= (sizeof(struct necp_client_host_resolver_answer) - sizeof(struct necp_client_signable))) {
10876 struct necp_client_host_resolver_answer *answer_struct = (struct necp_client_host_resolver_answer *)&validatable->signable;
10877 if (data_length == (sizeof(struct necp_client_host_resolver_answer) + answer_struct->hostname_length - sizeof(struct necp_client_signable)) &&
10878 answer_struct->address_answer.sa.sa_family == address->sa.sa_family &&
10879 answer_struct->address_answer.sa.sa_len == address->sa.sa_len &&
10880 (answer_struct->address_answer.sin.sin_port == 0 ||
10881 answer_struct->address_answer.sin.sin_port == address->sin.sin_port) &&
10882 ((answer_struct->address_answer.sa.sa_family == AF_INET &&
10883 answer_struct->address_answer.sin.sin_addr.s_addr == address->sin.sin_addr.s_addr) ||
10884 (answer_struct->address_answer.sa.sa_family == AF_INET6 &&
10885 memcmp(&answer_struct->address_answer.sin6.sin6_addr, &address->sin6.sin6_addr, sizeof(struct in6_addr)) == 0))) {
10886 // Address matches
10887 const bool validated = necp_validate_resolver_answer(validatable->signable.client_id,
10888 validatable->signable.sign_type,
10889 validatable->signable.signable_data, data_length,
10890 validatable->signature.signed_tag, sizeof(validatable->signature.signed_tag));
10891 if (validated) {
10892 // Answer is validated
10893 matches_address = true;
10894 }
10895 }
10896 }
10897 }
10898 }
10899 necp_unlock_socket_attributes();
10900 return matches_address;
10901 }
10902
10903 /*
10904 * necp_set_socket_domain_attributes
10905 * Called from soconnectlock/soconnectxlock to directly set the tracker domain and owner for
10906 * a newly marked tracker socket.
10907 */
10908 errno_t
necp_set_socket_domain_attributes(struct socket * so,const char * domain,const char * domain_owner)10909 necp_set_socket_domain_attributes(struct socket *so, const char *domain, const char *domain_owner)
10910 {
10911 int error = 0;
10912 struct inpcb *inp = NULL;
10913 u_int8_t *buffer = NULL;
10914 size_t valsize = 0;
10915 char *buffer_to_free = NULL;
10916
10917 if (SOCK_DOM(so) != PF_INET && SOCK_DOM(so) != PF_INET6) {
10918 error = EINVAL;
10919 goto fail;
10920 }
10921
10922 // Set domain (required)
10923
10924 valsize = strlen(domain);
10925 if (valsize == 0 || valsize > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) {
10926 error = EINVAL;
10927 goto fail;
10928 }
10929
10930 buffer = (u_int8_t *)kalloc_data(valsize + 1, Z_WAITOK | Z_ZERO);
10931 if (buffer == NULL) {
10932 error = ENOMEM;
10933 goto fail;
10934 }
10935 bcopy(domain, buffer, valsize);
10936 buffer[valsize] = 0;
10937
10938 inp = sotoinpcb(so);
10939 // Do not overwrite a previously set domain if tracker domain is different.
10940 if (inp->inp_necp_attributes.inp_domain != NULL) {
10941 if (strlen(inp->inp_necp_attributes.inp_domain) != strlen(domain) ||
10942 strncmp(inp->inp_necp_attributes.inp_domain, domain, strlen(domain)) != 0) {
10943 buffer_to_free = inp->inp_necp_attributes.inp_tracker_domain;
10944 // Protect switching of buffer pointer
10945 necp_lock_socket_attributes();
10946 inp->inp_necp_attributes.inp_tracker_domain = (char *)buffer;
10947 necp_unlock_socket_attributes();
10948 if (buffer_to_free != NULL) {
10949 kfree_data_addr(buffer_to_free);
10950 }
10951 } else {
10952 kfree_data_addr(buffer);
10953 }
10954 } else {
10955 // Protect switching of buffer pointer
10956 necp_lock_socket_attributes();
10957 inp->inp_necp_attributes.inp_domain = (char *)buffer;
10958 necp_unlock_socket_attributes();
10959 }
10960 buffer = NULL;
10961
10962 // set domain_owner (required only for tracker)
10963 if (!(so->so_flags1 & SOF1_KNOWN_TRACKER)) {
10964 goto done;
10965 }
10966
10967 valsize = strlen(domain_owner);
10968 if (valsize == 0 || valsize > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) {
10969 error = EINVAL;
10970 goto fail;
10971 }
10972
10973 buffer = (u_int8_t *)kalloc_data(valsize + 1, Z_WAITOK | Z_ZERO);
10974 if (buffer == NULL) {
10975 error = ENOMEM;
10976 goto fail;
10977 }
10978 bcopy(domain_owner, buffer, valsize);
10979 buffer[valsize] = 0;
10980
10981 inp = sotoinpcb(so);
10982
10983 buffer_to_free = inp->inp_necp_attributes.inp_domain_owner;
10984 // Protect switching of buffer pointer
10985 necp_lock_socket_attributes();
10986 inp->inp_necp_attributes.inp_domain_owner = (char *)buffer;
10987 necp_unlock_socket_attributes();
10988 buffer = NULL;
10989
10990 if (buffer_to_free != NULL) {
10991 kfree_data_addr(buffer_to_free);
10992 }
10993
10994 done:
10995 NECP_SOCKET_PARAMS_LOG(so, "NECP ATTRIBUTES SOCKET - domain <%s> owner <%s> context <%s> tracker domain <%s> account <%s> "
10996 "<so flags - is_tracker %X non-app-initiated %X app-approved-domain %X",
10997 inp->inp_necp_attributes.inp_domain,
10998 inp->inp_necp_attributes.inp_domain_owner,
10999 inp->inp_necp_attributes.inp_domain_context,
11000 inp->inp_necp_attributes.inp_tracker_domain,
11001 inp->inp_necp_attributes.inp_account,
11002 so->so_flags1 & SOF1_KNOWN_TRACKER,
11003 so->so_flags1 & SOF1_TRACKER_NON_APP_INITIATED,
11004 so->so_flags1 & SOF1_APPROVED_APP_DOMAIN);
11005
11006 if (necp_debug) {
11007 NECPLOG(LOG_DEBUG, "Set on socket: Domain <%s> Domain owner <%s> Domain context <%s> Tracker domain <%s> Account <%s> ",
11008 inp->inp_necp_attributes.inp_domain,
11009 inp->inp_necp_attributes.inp_domain_owner,
11010 inp->inp_necp_attributes.inp_domain_context,
11011 inp->inp_necp_attributes.inp_tracker_domain,
11012 inp->inp_necp_attributes.inp_account);
11013 }
11014 fail:
11015 if (buffer != NULL) {
11016 kfree_data(buffer, valsize + 1);
11017 }
11018 return error;
11019 }
11020
11021 void *
necp_create_nexus_assign_message(uuid_t nexus_instance,nexus_port_t nexus_port,void * key,uint32_t key_length,struct necp_client_endpoint * local_endpoint,struct necp_client_endpoint * remote_endpoint,struct ether_addr * local_ether_addr,u_int32_t flow_adv_index,void * flow_stats,size_t * message_length)11022 necp_create_nexus_assign_message(uuid_t nexus_instance, nexus_port_t nexus_port, void *key, uint32_t key_length,
11023 struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint, struct ether_addr *local_ether_addr,
11024 u_int32_t flow_adv_index, void *flow_stats, size_t *message_length)
11025 {
11026 u_int8_t *buffer = NULL;
11027 u_int8_t *cursor = NULL;
11028 size_t valsize = 0;
11029 bool has_nexus_assignment = FALSE;
11030
11031 if (!uuid_is_null(nexus_instance)) {
11032 has_nexus_assignment = TRUE;
11033 valsize += sizeof(struct necp_tlv_header) + sizeof(uuid_t);
11034 valsize += sizeof(struct necp_tlv_header) + sizeof(nexus_port_t);
11035 }
11036 if (flow_adv_index != NECP_FLOWADV_IDX_INVALID) {
11037 valsize += sizeof(struct necp_tlv_header) + sizeof(u_int32_t);
11038 }
11039 if (key != NULL && key_length > 0) {
11040 valsize += sizeof(struct necp_tlv_header) + key_length;
11041 }
11042 if (local_endpoint != NULL) {
11043 valsize += sizeof(struct necp_tlv_header) + sizeof(struct necp_client_endpoint);
11044 }
11045 if (remote_endpoint != NULL) {
11046 valsize += sizeof(struct necp_tlv_header) + sizeof(struct necp_client_endpoint);
11047 }
11048 if (local_ether_addr != NULL) {
11049 valsize += sizeof(struct necp_tlv_header) + sizeof(struct ether_addr);
11050 }
11051 if (flow_stats != NULL) {
11052 valsize += sizeof(struct necp_tlv_header) + sizeof(void *);
11053 }
11054 if (valsize == 0) {
11055 return NULL;
11056 }
11057
11058 buffer = kalloc_data(valsize, Z_WAITOK | Z_ZERO);
11059 if (buffer == NULL) {
11060 return NULL;
11061 }
11062
11063 cursor = buffer;
11064 if (has_nexus_assignment) {
11065 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_INSTANCE, sizeof(uuid_t), nexus_instance, buffer, valsize);
11066 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_PORT, sizeof(nexus_port_t), &nexus_port, buffer, valsize);
11067 }
11068 if (flow_adv_index != NECP_FLOWADV_IDX_INVALID) {
11069 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_PORT_FLOW_INDEX, sizeof(u_int32_t), &flow_adv_index, buffer, valsize);
11070 }
11071 if (key != NULL && key_length > 0) {
11072 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_PARAMETER_NEXUS_KEY, key_length, key, buffer, valsize);
11073 }
11074 if (local_endpoint != NULL) {
11075 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_LOCAL_ENDPOINT, sizeof(struct necp_client_endpoint), local_endpoint, buffer, valsize);
11076 }
11077 if (remote_endpoint != NULL) {
11078 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_REMOTE_ENDPOINT, sizeof(struct necp_client_endpoint), remote_endpoint, buffer, valsize);
11079 }
11080 if (local_ether_addr != NULL) {
11081 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_LOCAL_ETHER_ADDR, sizeof(struct ether_addr), local_ether_addr, buffer, valsize);
11082 }
11083 if (flow_stats != NULL) {
11084 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_FLOW_STATS, sizeof(void *), &flow_stats, buffer, valsize);
11085 }
11086
11087 *message_length = valsize;
11088
11089 return buffer;
11090 }
11091
11092 void
necp_inpcb_remove_cb(struct inpcb * inp)11093 necp_inpcb_remove_cb(struct inpcb *inp)
11094 {
11095 if (!uuid_is_null(inp->necp_client_uuid)) {
11096 necp_client_unregister_socket_flow(inp->necp_client_uuid, inp);
11097 uuid_clear(inp->necp_client_uuid);
11098 }
11099 }
11100
11101 void
necp_inpcb_dispose(struct inpcb * inp)11102 necp_inpcb_dispose(struct inpcb *inp)
11103 {
11104 necp_inpcb_remove_cb(inp); // Clear out socket registrations if not yet done
11105 if (inp->inp_necp_attributes.inp_domain != NULL) {
11106 kfree_data_addr(inp->inp_necp_attributes.inp_domain);
11107 inp->inp_necp_attributes.inp_domain = NULL;
11108 }
11109 if (inp->inp_necp_attributes.inp_account != NULL) {
11110 kfree_data_addr(inp->inp_necp_attributes.inp_account);
11111 inp->inp_necp_attributes.inp_account = NULL;
11112 }
11113 if (inp->inp_necp_attributes.inp_domain_owner != NULL) {
11114 kfree_data_addr(inp->inp_necp_attributes.inp_domain_owner);
11115 inp->inp_necp_attributes.inp_domain_owner = NULL;
11116 }
11117 if (inp->inp_necp_attributes.inp_domain_context != NULL) {
11118 kfree_data_addr(inp->inp_necp_attributes.inp_domain_context);
11119 inp->inp_necp_attributes.inp_domain_context = NULL;
11120 }
11121 if (inp->inp_necp_attributes.inp_tracker_domain != NULL) {
11122 kfree_data_addr(inp->inp_necp_attributes.inp_tracker_domain);
11123 inp->inp_necp_attributes.inp_tracker_domain = NULL;
11124 }
11125 if (inp->inp_resolver_signature != NULL) {
11126 kfree_data(inp->inp_resolver_signature, inp->inp_resolver_signature_length);
11127 }
11128 inp->inp_resolver_signature_length = 0;
11129 }
11130
11131 void
necp_mppcb_dispose(struct mppcb * mpp)11132 necp_mppcb_dispose(struct mppcb *mpp)
11133 {
11134 if (!uuid_is_null(mpp->necp_client_uuid)) {
11135 necp_client_unregister_multipath_cb(mpp->necp_client_uuid, mpp);
11136 uuid_clear(mpp->necp_client_uuid);
11137 }
11138
11139 if (mpp->inp_necp_attributes.inp_domain != NULL) {
11140 kfree_data_addr(mpp->inp_necp_attributes.inp_domain);
11141 mpp->inp_necp_attributes.inp_domain = NULL;
11142 }
11143 if (mpp->inp_necp_attributes.inp_account != NULL) {
11144 kfree_data_addr(mpp->inp_necp_attributes.inp_account);
11145 mpp->inp_necp_attributes.inp_account = NULL;
11146 }
11147 if (mpp->inp_necp_attributes.inp_domain_owner != NULL) {
11148 kfree_data_addr(mpp->inp_necp_attributes.inp_domain_owner);
11149 mpp->inp_necp_attributes.inp_domain_owner = NULL;
11150 }
11151 if (mpp->inp_necp_attributes.inp_tracker_domain != NULL) {
11152 kfree_data_addr(mpp->inp_necp_attributes.inp_tracker_domain);
11153 mpp->inp_necp_attributes.inp_tracker_domain = NULL;
11154 }
11155 }
11156
11157 /// Module init
11158
11159 void
necp_client_init(void)11160 necp_client_init(void)
11161 {
11162 necp_client_update_tcall = thread_call_allocate_with_options(necp_update_all_clients_callout, NULL,
11163 THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
11164 VERIFY(necp_client_update_tcall != NULL);
11165 #if SKYWALK
11166
11167 necp_client_collect_stats_tcall = thread_call_allocate_with_options(necp_collect_stats_client_callout, NULL,
11168 THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
11169 VERIFY(necp_client_collect_stats_tcall != NULL);
11170
11171 necp_close_empty_arenas_tcall = thread_call_allocate_with_options(necp_close_empty_arenas_callout, NULL,
11172 THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
11173 VERIFY(necp_close_empty_arenas_tcall != NULL);
11174 #endif /* SKYWALK */
11175
11176 LIST_INIT(&necp_fd_list);
11177 LIST_INIT(&necp_fd_observer_list);
11178 LIST_INIT(&necp_collect_stats_flow_list);
11179
11180 RB_INIT(&necp_client_global_tree);
11181 RB_INIT(&necp_client_flow_global_tree);
11182 }
11183
11184 #if SKYWALK
11185 pid_t
necp_client_get_proc_pid_from_arena_info(struct skmem_arena_mmap_info * arena_info)11186 necp_client_get_proc_pid_from_arena_info(struct skmem_arena_mmap_info *arena_info)
11187 {
11188 ASSERT((arena_info->ami_arena->ar_type == SKMEM_ARENA_TYPE_NECP) || (arena_info->ami_arena->ar_type == SKMEM_ARENA_TYPE_SYSTEM));
11189
11190 if (arena_info->ami_arena->ar_type == SKMEM_ARENA_TYPE_NECP) {
11191 struct necp_arena_info *nai = container_of(arena_info, struct necp_arena_info, nai_mmap);
11192 return nai->nai_proc_pid;
11193 } else {
11194 struct necp_fd_data *fd_data = container_of(arena_info, struct necp_fd_data, sysctl_mmap);
11195 return fd_data->proc_pid;
11196 }
11197 }
11198 #endif /* !SKYWALK */
11199