1 /*
2 * Copyright (c) 2015-2023 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #include <string.h>
30
31 #include <kern/thread_call.h>
32 #include <kern/zalloc.h>
33
34 #include <net/if.h>
35 #include <net/if_var.h>
36 #include <net/net_api_stats.h>
37 #include <net/necp.h>
38 #include <net/network_agent.h>
39 #include <net/ntstat.h>
40
41 #include <netinet/in_pcb.h>
42 #include <netinet/in_var.h>
43 #include <netinet/ip.h>
44 #include <netinet/ip6.h>
45 #include <netinet/mp_pcb.h>
46 #include <netinet/tcp_cc.h>
47 #include <netinet/tcp_fsm.h>
48 #include <netinet/tcp_cache.h>
49 #include <netinet6/in6_var.h>
50
51 #include <sys/domain.h>
52 #include <sys/file_internal.h>
53 #include <sys/kauth.h>
54 #include <sys/kernel.h>
55 #include <sys/malloc.h>
56 #include <sys/poll.h>
57 #include <sys/priv.h>
58 #include <sys/protosw.h>
59 #include <sys/queue.h>
60 #include <sys/socket.h>
61 #include <sys/socketvar.h>
62 #include <sys/sysproto.h>
63 #include <sys/systm.h>
64 #include <sys/types.h>
65 #include <sys/codesign.h>
66 #include <libkern/section_keywords.h>
67 #include <IOKit/IOBSD.h>
68
69 #include <os/refcnt.h>
70
71 #include <CodeSignature/Entitlements.h>
72
73 #if SKYWALK
74 #include <skywalk/os_skywalk_private.h>
75 #include <skywalk/nexus/flowswitch/flow/flow_var.h>
76 #include <skywalk/nexus/flowswitch/nx_flowswitch.h>
77 #endif /* SKYWALK */
78
79 #if CONFIG_MACF
80 #include <security/mac_framework.h>
81 #endif
82
83 /*
84 * NECP Client Architecture
85 * ------------------------------------------------
86 * See <net/necp.c> for a discussion on NECP database architecture.
87 *
88 * Each client of NECP provides a set of parameters for a connection or network state
89 * evaluation, on which NECP policy evaluation is run. This produces a policy result
90 * which can be accessed by the originating process, along with events for when policies
91 * results have changed.
92 *
93 * ------------------------------------------------
94 * NECP Client FD
95 * ------------------------------------------------
96 * A process opens an NECP file descriptor using necp_open(). This is a very simple
97 * file descriptor, upon which the process may do the following operations:
98 * - necp_client_action(...), to add/remove/query clients
99 * - kqueue, to watch for readable events
100 * - close(), to close the client session and release all clients
101 *
102 * Client objects are allocated structures that hang off of the file descriptor. Each
103 * client contains:
104 * - Client ID, a UUID that references the client across the system
105 * - Parameters, a buffer of TLVs that describe the client's connection parameters,
106 * such as the remote and local endpoints, interface requirements, etc.
107 * - Result, a buffer of TLVs containing the current policy evaluation for the client.
108 * This result will be updated whenever a network change occurs that impacts the
109 * policy result for that client.
110 *
111 * +--------------+
112 * | NECP fd |
113 * +--------------+
114 * ||
115 * ==================================
116 * || || ||
117 * +--------------+ +--------------+ +--------------+
118 * | Client ID | | Client ID | | Client ID |
119 * | ---- | | ---- | | ---- |
120 * | Parameters | | Parameters | | Parameters |
121 * | ---- | | ---- | | ---- |
122 * | Result | | Result | | Result |
123 * +--------------+ +--------------+ +--------------+
124 *
125 * ------------------------------------------------
126 * Client Actions
127 * ------------------------------------------------
128 * - Add. Input parameters as a buffer of TLVs, and output a client ID. Allocates a
129 * new client structure on the file descriptor.
130 * - Remove. Input a client ID. Removes a client structure from the file descriptor.
131 * - Copy Parameters. Input a client ID, and output parameter TLVs.
132 * - Copy Result. Input a client ID, and output result TLVs. Alternatively, input empty
133 * client ID and get next unread client result.
134 * - Copy List. List all client IDs.
135 *
136 * ------------------------------------------------
137 * Client Policy Evaluation
138 * ------------------------------------------------
139 * Policies are evaluated for clients upon client creation, and upon update events,
140 * which are network/agent/policy changes coalesced by a timer.
141 *
142 * The policy evaluation goes through the following steps:
143 * 1. Parse client parameters.
144 * 2. Select a scoped interface if applicable. This involves using require/prohibit
145 * parameters, along with the local address, to select the most appropriate interface
146 * if not explicitly set by the client parameters.
147 * 3. Run NECP application-level policy evalution
148 * 4. Set policy result into client result buffer.
149 *
150 * ------------------------------------------------
151 * Client Observers
152 * ------------------------------------------------
153 * If necp_open() is called with the NECP_OPEN_FLAG_OBSERVER flag, and the process
154 * passes the necessary privilege check, the fd is allowed to use necp_client_action()
155 * to copy client state attached to the file descriptors of other processes, and to
156 * list all client IDs on the system.
157 */
158
159 extern u_int32_t necp_debug;
160
161 static int necpop_select(struct fileproc *, int, void *, vfs_context_t);
162 static int necpop_close(struct fileglob *, vfs_context_t);
163 static int necpop_kqfilter(struct fileproc *, struct knote *, struct kevent_qos_s *);
164
165 // Timer functions
166 static int necp_timeout_microseconds = 1000 * 100; // 100ms
167 static int necp_timeout_leeway_microseconds = 1000 * 50; // 50ms
168 #if SKYWALK
169 static int necp_collect_stats_timeout_microseconds = 1000 * 1000 * 1; // 1s
170 static int necp_collect_stats_timeout_leeway_microseconds = 1000 * 500; // 500ms
171 static int necp_close_arenas_timeout_microseconds = 1000 * 1000 * 10; // 10s
172 static int necp_close_arenas_timeout_leeway_microseconds = 1000 * 1000 * 1; // 1s
173 #endif /* SKYWALK */
174
175 static int necp_client_fd_count = 0;
176 static int necp_observer_fd_count = 0;
177 static int necp_client_count = 0;
178 static int necp_socket_flow_count = 0;
179 static int necp_if_flow_count = 0;
180 static int necp_observer_message_limit = 256;
181
182 /*
183 * NECP client tracing control -
184 *
185 * necp_client_tracing_level : 1 for client trace, 2 for flow trace, 3 for parameter details
186 * necp_client_tracing_pid : match client with pid
187 */
188 static int necp_client_tracing_level = 0;
189 static int necp_client_tracing_pid = 0;
190
191 #define NECP_CLIENT_TRACE_LEVEL_CLIENT 1
192 #define NECP_CLIENT_TRACE_LEVEL_FLOW 2
193 #define NECP_CLIENT_TRACE_LEVEL_PARAMS 3
194
195 #define NECP_CLIENT_TRACE_PID_MATCHED(pid) \
196 (pid == necp_client_tracing_pid)
197
198 #define NECP_ENABLE_CLIENT_TRACE(level) \
199 ((necp_client_tracing_level >= level && \
200 (!necp_client_tracing_pid || NECP_CLIENT_TRACE_PID_MATCHED(client->proc_pid))) ? necp_client_tracing_level : 0)
201
202 #define NECP_CLIENT_LOG(client, fmt, ...) \
203 if (client && NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_CLIENT)) { \
204 uuid_string_t client_uuid_str = { }; \
205 uuid_unparse_lower(client->client_id, client_uuid_str); \
206 NECPLOG(LOG_NOTICE, "NECP_CLIENT_LOG <pid %d %s>: " fmt "\n", client ? client->proc_pid : 0, client_uuid_str, ##__VA_ARGS__); \
207 }
208
209 #define NECP_CLIENT_FLOW_LOG(client, flow, fmt, ...) \
210 if (client && flow && NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_FLOW)) { \
211 uuid_string_t client_uuid_str = { }; \
212 uuid_unparse_lower(client->client_id, client_uuid_str); \
213 uuid_string_t flow_uuid_str = { }; \
214 uuid_unparse_lower(flow->registration_id, flow_uuid_str); \
215 NECPLOG(LOG_NOTICE, "NECP CLIENT FLOW TRACE <pid %d %s> <flow %s>: " fmt "\n", client ? client->proc_pid : 0, client_uuid_str, flow_uuid_str, ##__VA_ARGS__); \
216 }
217
218 #define NECP_CLIENT_PARAMS_LOG(client, fmt, ...) \
219 if (client && NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) { \
220 uuid_string_t client_uuid_str = { }; \
221 uuid_unparse_lower(client->client_id, client_uuid_str); \
222 NECPLOG(LOG_NOTICE, "NECP_CLIENT_PARAMS_LOG <pid %d %s>: " fmt "\n", client ? client->proc_pid : 0, client_uuid_str, ##__VA_ARGS__); \
223 }
224
225 #define NECP_SOCKET_PID(so) \
226 ((so->so_flags & SOF_DELEGATED) ? so->e_pid : so->last_pid)
227
228 #define NECP_ENABLE_SOCKET_TRACE(level) \
229 ((necp_client_tracing_level >= level && \
230 (!necp_client_tracing_pid || NECP_CLIENT_TRACE_PID_MATCHED(NECP_SOCKET_PID(so)))) ? necp_client_tracing_level : 0)
231
232 #define NECP_SOCKET_PARAMS_LOG(so, fmt, ...) \
233 if (so && NECP_ENABLE_SOCKET_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) { \
234 NECPLOG(LOG_NOTICE, "NECP_SOCKET_PARAMS_LOG <pid %d>: " fmt "\n", NECP_SOCKET_PID(so), ##__VA_ARGS__); \
235 }
236
237 #define NECP_SOCKET_ATTRIBUTE_LOG(fmt, ...) \
238 if (necp_client_tracing_level >= NECP_CLIENT_TRACE_LEVEL_PARAMS) { \
239 NECPLOG(LOG_NOTICE, "NECP_SOCKET_ATTRIBUTE_LOG: " fmt "\n", ##__VA_ARGS__); \
240 }
241
242 #define NECP_CLIENT_TRACKER_LOG(pid, fmt, ...) \
243 if (pid) { \
244 NECPLOG(LOG_NOTICE, "NECP_CLIENT_TRACKER_LOG <pid %d>: " fmt "\n", pid, ##__VA_ARGS__); \
245 }
246
247 #if SKYWALK
248 static int necp_arena_count = 0;
249 static int necp_sysctl_arena_count = 0;
250 static int necp_nexus_flow_count = 0;
251
252 /* userspace stats sanity check range, same unit as TCP (see TCP_RTT_SCALE) */
253 static uint32_t necp_client_stats_rtt_floor = 1; // 32us
254 static uint32_t necp_client_stats_rtt_ceiling = 1920000; // 60s
255 const static struct sk_stats_flow ntstat_sk_stats_zero;
256 #endif /* SKYWALK */
257
258 /*
259 * Global lock to protect socket inp_necp_attributes across updates.
260 * NECP updating these attributes and clients accessing these attributes
261 * must take this lock.
262 */
263 static LCK_GRP_DECLARE(necp_socket_attr_lock_grp, "necpSocketAttrGroup");
264 LCK_MTX_DECLARE(necp_socket_attr_lock, &necp_socket_attr_lock_grp);
265
266 os_refgrp_decl(static, necp_client_refgrp, "NECPClientRefGroup", NULL);
267
268 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_FD_COUNT, client_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_fd_count, 0, "");
269 SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_FD_COUNT, observer_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_observer_fd_count, 0, "");
270 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_COUNT, client_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_count, 0, "");
271 SYSCTL_INT(_net_necp, NECPCTL_SOCKET_FLOW_COUNT, socket_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_socket_flow_count, 0, "");
272 SYSCTL_INT(_net_necp, NECPCTL_IF_FLOW_COUNT, if_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_if_flow_count, 0, "");
273 SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_MESSAGE_LIMIT, observer_message_limit, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_observer_message_limit, 256, "");
274 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_TRACING_LEVEL, necp_client_tracing_level, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_client_tracing_level, 0, "");
275 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_TRACING_PID, necp_client_tracing_pid, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_client_tracing_pid, 0, "");
276
277 #if SKYWALK
278 SYSCTL_INT(_net_necp, NECPCTL_ARENA_COUNT, arena_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_arena_count, 0, "");
279 SYSCTL_INT(_net_necp, NECPCTL_SYSCTL_ARENA_COUNT, sysctl_arena_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_sysctl_arena_count, 0, "");
280 SYSCTL_INT(_net_necp, NECPCTL_NEXUS_FLOW_COUNT, nexus_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_nexus_flow_count, 0, "");
281 #if (DEVELOPMENT || DEBUG)
282 SYSCTL_UINT(_net_necp, OID_AUTO, collect_stats_interval_us, CTLFLAG_RW | CTLFLAG_LOCKED, &necp_collect_stats_timeout_microseconds, 0, "");
283 SYSCTL_UINT(_net_necp, OID_AUTO, necp_client_stats_rtt_floor, CTLFLAG_RW | CTLFLAG_LOCKED, &necp_client_stats_rtt_floor, 0, "");
284 SYSCTL_UINT(_net_necp, OID_AUTO, necp_client_stats_rtt_ceiling, CTLFLAG_RW | CTLFLAG_LOCKED, &necp_client_stats_rtt_ceiling, 0, "");
285 #endif /* (DEVELOPMENT || DEBUG) */
286 #endif /* SKYWALK */
287
288 #define NECP_MAX_CLIENT_LIST_SIZE 1024 * 1024 // 1MB
289 #define NECP_MAX_AGENT_ACTION_SIZE 10 * 1024 // 10K
290
291 extern int tvtohz(struct timeval *);
292 extern unsigned int get_maxmtu(struct rtentry *);
293
294 // Parsed parameters
295 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR 0x00001
296 #define NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR 0x00002
297 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF 0x00004
298 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF 0x00008
299 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE 0x00010
300 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE 0x00020
301 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT 0x00040
302 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT 0x00080
303 #define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT 0x00100
304 #define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT 0x00200
305 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE 0x00400
306 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE 0x00800
307 #define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE 0x01000
308 #define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE 0x02000
309 #define NECP_PARSED_PARAMETERS_FIELD_FLAGS 0x04000
310 #define NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL 0x08000
311 #define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID 0x10000
312 #define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID 0x20000
313 #define NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS 0x40000
314 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT 0x80000
315 #define NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID 0x100000
316 #define NECP_PARSED_PARAMETERS_FIELD_ETHERTYPE 0x200000
317 #define NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL 0x400000
318 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE 0x800000
319 #define NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER 0x1000000
320 #define NECP_PARSED_PARAMETERS_FIELD_PARENT_UUID 0x2000000
321 #define NECP_PARSED_PARAMETERS_FIELD_FLOW_DEMUX_PATTERN 0x4000000
322 #define NECP_PARSED_PARAMETERS_FIELD_UID 0x8000000
323 #define NECP_PARSED_PARAMETERS_FIELD_PERSONA_ID 0x10000000
324
325
326 #define NECP_MAX_INTERFACE_PARAMETERS 16
327 #define NECP_MAX_AGENT_PARAMETERS 4
328 struct necp_client_parsed_parameters {
329 u_int32_t valid_fields;
330 u_int32_t flags;
331 u_int64_t delegated_upid;
332 union necp_sockaddr_union local_addr;
333 union necp_sockaddr_union remote_addr;
334 u_int32_t required_interface_index;
335 char prohibited_interfaces[NECP_MAX_INTERFACE_PARAMETERS][IFXNAMSIZ];
336 u_int8_t required_interface_type;
337 u_int8_t local_address_preference;
338 u_int8_t prohibited_interface_types[NECP_MAX_INTERFACE_PARAMETERS];
339 struct necp_client_parameter_netagent_type required_netagent_types[NECP_MAX_AGENT_PARAMETERS];
340 struct necp_client_parameter_netagent_type prohibited_netagent_types[NECP_MAX_AGENT_PARAMETERS];
341 struct necp_client_parameter_netagent_type preferred_netagent_types[NECP_MAX_AGENT_PARAMETERS];
342 struct necp_client_parameter_netagent_type avoided_netagent_types[NECP_MAX_AGENT_PARAMETERS];
343 uuid_t required_netagents[NECP_MAX_AGENT_PARAMETERS];
344 uuid_t prohibited_netagents[NECP_MAX_AGENT_PARAMETERS];
345 uuid_t preferred_netagents[NECP_MAX_AGENT_PARAMETERS];
346 uuid_t avoided_netagents[NECP_MAX_AGENT_PARAMETERS];
347 u_int8_t ip_protocol;
348 u_int8_t transport_protocol;
349 u_int16_t ethertype;
350 pid_t effective_pid;
351 uuid_t effective_uuid;
352 uuid_t parent_uuid;
353 u_int32_t traffic_class;
354 struct necp_demux_pattern demux_patterns[NECP_MAX_DEMUX_PATTERNS];
355 u_int8_t demux_pattern_count;
356 uid_t uid;
357 uid_t persona_id;
358 };
359
360 static bool
361 necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters,
362 u_int *return_ifindex, bool *validate_agents);
363
364 static bool
365 necp_ifnet_matches_local_address(struct ifnet *ifp, struct sockaddr *sa);
366
367 static bool
368 necp_ifnet_matches_parameters(struct ifnet *ifp,
369 struct necp_client_parsed_parameters *parsed_parameters,
370 u_int32_t override_flags,
371 u_int32_t *preferred_count,
372 bool secondary_interface,
373 bool require_scoped_field);
374
375 static const struct fileops necp_fd_ops = {
376 .fo_type = DTYPE_NETPOLICY,
377 .fo_read = fo_no_read,
378 .fo_write = fo_no_write,
379 .fo_ioctl = fo_no_ioctl,
380 .fo_select = necpop_select,
381 .fo_close = necpop_close,
382 .fo_drain = fo_no_drain,
383 .fo_kqfilter = necpop_kqfilter,
384 };
385
386 struct necp_client_assertion {
387 LIST_ENTRY(necp_client_assertion) assertion_chain;
388 uuid_t asserted_netagent;
389 };
390
391 struct necp_client_flow_header {
392 struct necp_tlv_header outer_header;
393 struct necp_tlv_header flow_id_tlv_header;
394 uuid_t flow_id;
395 struct necp_tlv_header flags_tlv_header;
396 u_int32_t flags_value;
397 struct necp_tlv_header interface_tlv_header;
398 struct necp_client_result_interface interface_value;
399 } __attribute__((__packed__));
400
401 struct necp_client_flow_protoctl_event_header {
402 struct necp_tlv_header protoctl_tlv_header;
403 struct necp_client_flow_protoctl_event protoctl_event;
404 } __attribute__((__packed__));
405
406 struct necp_client_nexus_flow_header {
407 struct necp_client_flow_header flow_header;
408 struct necp_tlv_header agent_tlv_header;
409 struct necp_client_result_netagent agent_value;
410 struct necp_tlv_header tfo_cookie_tlv_header;
411 u_int8_t tfo_cookie_value[NECP_TFO_COOKIE_LEN_MAX];
412 } __attribute__((__packed__));
413
414 #if SKYWALK
415 struct necp_arena_info;
416 #endif
417
418 struct necp_client_flow {
419 LIST_ENTRY(necp_client_flow) flow_chain;
420 unsigned invalid : 1;
421 unsigned nexus : 1; // If true, flow is a nexus; if false, flow is attached to socket
422 unsigned socket : 1;
423 unsigned viable : 1;
424 unsigned assigned : 1;
425 unsigned has_protoctl_event : 1;
426 unsigned check_tcp_heuristics : 1;
427 unsigned _reserved : 1;
428 union {
429 uuid_t nexus_agent;
430 struct {
431 void *socket_handle;
432 necp_client_flow_cb cb;
433 };
434 } u;
435 uint32_t interface_index;
436 u_short delegated_interface_index;
437 uint32_t interface_flags;
438 uint32_t necp_flow_flags;
439 struct necp_client_flow_protoctl_event protoctl_event;
440 union necp_sockaddr_union local_addr;
441 union necp_sockaddr_union remote_addr;
442
443 size_t assigned_results_length;
444 u_int8_t *assigned_results;
445 };
446
447 struct necp_client_flow_registration {
448 RB_ENTRY(necp_client_flow_registration) fd_link;
449 RB_ENTRY(necp_client_flow_registration) global_link;
450 RB_ENTRY(necp_client_flow_registration) client_link;
451 LIST_ENTRY(necp_client_flow_registration) collect_stats_chain;
452 uuid_t registration_id;
453 u_int32_t flags;
454 unsigned flow_result_read : 1;
455 unsigned defunct : 1;
456 void *interface_handle;
457 necp_client_flow_cb interface_cb;
458 struct necp_client *client;
459 LIST_HEAD(_necp_registration_flow_list, necp_client_flow) flow_list;
460 #if SKYWALK
461 struct necp_arena_info *stats_arena; /* arena where the stats objects came from */
462 void * kstats_kaddr; /* kernel snapshot of untrusted userspace stats, for calculating delta */
463 mach_vm_address_t ustats_uaddr; /* userspace stats (untrusted) */
464 nstat_userland_context stats_handler_context;
465 struct flow_stats *nexus_stats; /* shared stats objects between necp_client and skywalk */
466 #endif /* !SKYWALK */
467 u_int64_t last_interface_details __attribute__((aligned(sizeof(u_int64_t))));
468 };
469
470 static int necp_client_flow_id_cmp(struct necp_client_flow_registration *flow0, struct necp_client_flow_registration *flow1);
471
472 RB_HEAD(_necp_client_flow_tree, necp_client_flow_registration);
473 RB_PROTOTYPE_PREV(_necp_client_flow_tree, necp_client_flow_registration, client_link, necp_client_flow_id_cmp);
474 RB_GENERATE_PREV(_necp_client_flow_tree, necp_client_flow_registration, client_link, necp_client_flow_id_cmp);
475
476 #define NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT 4
477 #define NECP_CLIENT_MAX_INTERFACE_OPTIONS 32
478
479 #define NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT (NECP_CLIENT_MAX_INTERFACE_OPTIONS - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT)
480
481 struct necp_client {
482 RB_ENTRY(necp_client) link;
483 RB_ENTRY(necp_client) global_link;
484
485 decl_lck_mtx_data(, lock);
486 decl_lck_mtx_data(, route_lock);
487 os_refcnt_t reference_count;
488
489 uuid_t client_id;
490 unsigned result_read : 1;
491 unsigned group_members_read : 1;
492 unsigned allow_multiple_flows : 1;
493 unsigned legacy_client_is_flow : 1;
494
495 unsigned platform_binary : 1;
496 unsigned validated_parent : 1;
497
498 size_t result_length;
499 u_int8_t result[NECP_BASE_CLIENT_RESULT_SIZE];
500
501 necp_policy_id policy_id;
502 necp_policy_id skip_policy_id;
503
504 u_int8_t ip_protocol;
505 int proc_pid;
506
507 u_int64_t delegated_upid;
508
509 struct _necp_client_flow_tree flow_registrations;
510 LIST_HEAD(_necp_client_assertion_list, necp_client_assertion) assertion_list;
511
512 size_t assigned_group_members_length;
513 u_int8_t *assigned_group_members;
514
515 struct rtentry *current_route;
516
517 struct necp_client_interface_option interface_options[NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
518 struct necp_client_interface_option *extra_interface_options;
519 u_int8_t interface_option_count; // Number in interface_options + extra_interface_options
520
521 struct necp_client_result_netagent failed_trigger_agent;
522
523 void *agent_handle;
524
525 uuid_t override_euuid;
526
527 #if SKYWALK
528 netns_token port_reservation;
529 nstat_context nstat_context;
530 uuid_t latest_flow_registration_id;
531 uuid_t parent_client_id;
532 struct necp_client *original_parameters_source;
533 #endif /* !SKYWALK */
534
535 size_t parameters_length;
536 u_int8_t *parameters;
537 };
538
539 #define NECP_CLIENT_LOCK(_c) lck_mtx_lock(&_c->lock)
540 #define NECP_CLIENT_UNLOCK(_c) lck_mtx_unlock(&_c->lock)
541 #define NECP_CLIENT_ASSERT_LOCKED(_c) LCK_MTX_ASSERT(&_c->lock, LCK_MTX_ASSERT_OWNED)
542 #define NECP_CLIENT_ASSERT_UNLOCKED(_c) LCK_MTX_ASSERT(&_c->lock, LCK_MTX_ASSERT_NOTOWNED)
543
544 #define NECP_CLIENT_ROUTE_LOCK(_c) lck_mtx_lock(&_c->route_lock)
545 #define NECP_CLIENT_ROUTE_UNLOCK(_c) lck_mtx_unlock(&_c->route_lock)
546
547 static void necp_client_retain_locked(struct necp_client *client);
548 static void necp_client_retain(struct necp_client *client);
549
550 static bool necp_client_release_locked(struct necp_client *client);
551 static bool necp_client_release(struct necp_client *client);
552
553 static void
554 necp_client_add_assertion(struct necp_client *client, uuid_t netagent_uuid);
555
556 static bool
557 necp_client_remove_assertion(struct necp_client *client, uuid_t netagent_uuid);
558
559 static int
560 necp_client_copy_parameters_locked(struct necp_client *client,
561 struct necp_client_nexus_parameters *parameters);
562
563 LIST_HEAD(_necp_flow_registration_list, necp_client_flow_registration);
564 static struct _necp_flow_registration_list necp_collect_stats_flow_list;
565
566 struct necp_flow_defunct {
567 LIST_ENTRY(necp_flow_defunct) chain;
568
569 uuid_t flow_id;
570 uuid_t nexus_agent;
571 void *agent_handle;
572 int proc_pid;
573 u_int32_t flags;
574 struct necp_client_agent_parameters close_parameters;
575 bool has_close_parameters;
576 };
577
578 LIST_HEAD(_necp_flow_defunct_list, necp_flow_defunct);
579
580 static int necp_client_id_cmp(struct necp_client *client0, struct necp_client *client1);
581
582 RB_HEAD(_necp_client_tree, necp_client);
583 RB_PROTOTYPE_PREV(_necp_client_tree, necp_client, link, necp_client_id_cmp);
584 RB_GENERATE_PREV(_necp_client_tree, necp_client, link, necp_client_id_cmp);
585
586 RB_HEAD(_necp_client_global_tree, necp_client);
587 RB_PROTOTYPE_PREV(_necp_client_global_tree, necp_client, global_link, necp_client_id_cmp);
588 RB_GENERATE_PREV(_necp_client_global_tree, necp_client, global_link, necp_client_id_cmp);
589
590 RB_HEAD(_necp_fd_flow_tree, necp_client_flow_registration);
591 RB_PROTOTYPE_PREV(_necp_fd_flow_tree, necp_client_flow_registration, fd_link, necp_client_flow_id_cmp);
592 RB_GENERATE_PREV(_necp_fd_flow_tree, necp_client_flow_registration, fd_link, necp_client_flow_id_cmp);
593
594 RB_HEAD(_necp_client_flow_global_tree, necp_client_flow_registration);
595 RB_PROTOTYPE_PREV(_necp_client_flow_global_tree, necp_client_flow_registration, global_link, necp_client_flow_id_cmp);
596 RB_GENERATE_PREV(_necp_client_flow_global_tree, necp_client_flow_registration, global_link, necp_client_flow_id_cmp);
597
598 static struct _necp_client_global_tree necp_client_global_tree;
599 static struct _necp_client_flow_global_tree necp_client_flow_global_tree;
600
601 struct necp_client_update {
602 TAILQ_ENTRY(necp_client_update) chain;
603
604 uuid_t client_id;
605
606 size_t update_length;
607 struct necp_client_observer_update *update;
608 };
609
610 #if SKYWALK
611 struct necp_arena_info {
612 LIST_ENTRY(necp_arena_info) nai_chain;
613 u_int32_t nai_flags;
614 pid_t nai_proc_pid;
615 struct skmem_arena *nai_arena;
616 struct skmem_arena_mmap_info nai_mmap;
617 mach_vm_offset_t nai_roff;
618 u_int32_t nai_use_count;
619 };
620 #endif /* !SKYWALK */
621
622 #define NAIF_ATTACHED 0x1 // arena is attached to list
623 #define NAIF_REDIRECT 0x2 // arena mmap has been redirected
624 #define NAIF_DEFUNCT 0x4 // arena is now defunct
625
626 #define NECP_FD_REPORTED_AGENT_COUNT 2
627
628 struct necp_fd_reported_agents {
629 uuid_t agent_uuid[NECP_FD_REPORTED_AGENT_COUNT];
630 };
631
632 struct necp_fd_data {
633 u_int8_t necp_fd_type;
634 LIST_ENTRY(necp_fd_data) chain;
635 struct _necp_client_tree clients;
636 struct _necp_fd_flow_tree flows;
637 TAILQ_HEAD(_necp_client_update_list, necp_client_update) update_list;
638 int update_count;
639 int flags;
640
641 unsigned background : 1;
642 unsigned request_in_process_flow_divert : 1;
643
644 int proc_pid;
645 decl_lck_mtx_data(, fd_lock);
646 struct selinfo si;
647
648 struct necp_fd_reported_agents reported_agents;
649 #if SKYWALK
650 // Arenas and their mmap info for per-process stats. Stats objects are allocated from an active arena
651 // that is not redirected/defunct. The stats_arena_active keeps track of such an arena, and it also
652 // holds a reference count on the object. Each flow allocating a stats object also holds a reference
653 // the necp_arena_info (where the object got allocated from). During defunct, we redirect the mapping
654 // of the arena such that any attempt to access (read/write) will result in getting zero-filled pages.
655 // We then go thru all of the flows for the process and free the stats objects associated with them,
656 // followed by destroying the skmem region(s) associated with the arena. The stats_arena_list keeps
657 // track of all current and defunct stats arenas; there could be more than one arena created for the
658 // process as the arena destruction happens when its reference count drops to 0.
659 struct necp_arena_info *stats_arena_active;
660 LIST_HEAD(_necp_arena_info_list, necp_arena_info) stats_arena_list;
661 u_int32_t stats_arena_gencnt;
662
663 struct skmem_arena *sysctl_arena;
664 struct skmem_arena_mmap_info sysctl_mmap;
665 mach_vm_offset_t system_sysctls_roff;
666 #endif /* !SKYWALK */
667 };
668
669 #define NECP_FD_LOCK(_f) lck_mtx_lock(&_f->fd_lock)
670 #define NECP_FD_UNLOCK(_f) lck_mtx_unlock(&_f->fd_lock)
671 #define NECP_FD_ASSERT_LOCKED(_f) LCK_MTX_ASSERT(&_f->fd_lock, LCK_MTX_ASSERT_OWNED)
672 #define NECP_FD_ASSERT_UNLOCKED(_f) LCK_MTX_ASSERT(&_f->fd_lock, LCK_MTX_ASSERT_NOTOWNED)
673
674 static LIST_HEAD(_necp_fd_list, necp_fd_data) necp_fd_list;
675 static LIST_HEAD(_necp_fd_observer_list, necp_fd_data) necp_fd_observer_list;
676
677 #if SKYWALK
678 static KALLOC_TYPE_DEFINE(necp_arena_info_zone, struct necp_arena_info, NET_KT_DEFAULT);
679 #endif /* !SKYWALK */
680
681 static LCK_ATTR_DECLARE(necp_fd_mtx_attr, 0, 0);
682 static LCK_GRP_DECLARE(necp_fd_mtx_grp, "necp_fd");
683
684 static LCK_RW_DECLARE_ATTR(necp_fd_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
685 static LCK_RW_DECLARE_ATTR(necp_observer_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
686 static LCK_RW_DECLARE_ATTR(necp_client_tree_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
687 static LCK_RW_DECLARE_ATTR(necp_flow_tree_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
688 static LCK_RW_DECLARE_ATTR(necp_collect_stats_list_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
689
690
691 #define NECP_STATS_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_collect_stats_list_lock)
692 #define NECP_STATS_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_collect_stats_list_lock)
693 #define NECP_STATS_LIST_UNLOCK() lck_rw_done(&necp_collect_stats_list_lock)
694
695 #define NECP_CLIENT_TREE_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_client_tree_lock)
696 #define NECP_CLIENT_TREE_LOCK_SHARED() lck_rw_lock_shared(&necp_client_tree_lock)
697 #define NECP_CLIENT_TREE_UNLOCK() lck_rw_done(&necp_client_tree_lock)
698 #define NECP_CLIENT_TREE_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_client_tree_lock, LCK_RW_ASSERT_HELD)
699
700 #define NECP_FLOW_TREE_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_flow_tree_lock)
701 #define NECP_FLOW_TREE_LOCK_SHARED() lck_rw_lock_shared(&necp_flow_tree_lock)
702 #define NECP_FLOW_TREE_UNLOCK() lck_rw_done(&necp_flow_tree_lock)
703 #define NECP_FLOW_TREE_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_flow_tree_lock, LCK_RW_ASSERT_HELD)
704
705 #define NECP_FD_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_fd_lock)
706 #define NECP_FD_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_fd_lock)
707 #define NECP_FD_LIST_UNLOCK() lck_rw_done(&necp_fd_lock)
708 #define NECP_FD_LIST_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_fd_lock, LCK_RW_ASSERT_HELD)
709
710 #define NECP_OBSERVER_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_observer_lock)
711 #define NECP_OBSERVER_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_observer_lock)
712 #define NECP_OBSERVER_LIST_UNLOCK() lck_rw_done(&necp_observer_lock)
713
714 // Locking Notes
715
716 // Take NECP_FD_LIST_LOCK when accessing or modifying the necp_fd_list
717 // Take NECP_CLIENT_TREE_LOCK when accessing or modifying the necp_client_global_tree
718 // Take NECP_FLOW_TREE_LOCK when accessing or modifying the necp_client_flow_global_tree
719 // Take NECP_STATS_LIST_LOCK when accessing or modifying the necp_collect_stats_flow_list
720 // Take NECP_FD_LOCK when accessing or modifying an necp_fd_data entry
721 // Take NECP_CLIENT_LOCK when accessing or modifying a single necp_client
722 // Take NECP_CLIENT_ROUTE_LOCK when accessing or modifying a client's route
723
724 // Precedence, where 1 is the first lock that must be taken
725 // 1. NECP_FD_LIST_LOCK
726 // 2. NECP_FD_LOCK (any)
727 // 3. NECP_CLIENT_TREE_LOCK
728 // 4. NECP_CLIENT_LOCK (any)
729 // 5. NECP_FLOW_TREE_LOCK
730 // 6. NECP_STATS_LIST_LOCK
731 // 7. NECP_CLIENT_ROUTE_LOCK (any)
732
733 static thread_call_t necp_client_update_tcall;
734 static uint32_t necp_update_all_clients_sched_cnt = 0;
735 static uint64_t necp_update_all_clients_sched_abstime = 0;
736 static LCK_RW_DECLARE_ATTR(necp_update_all_clients_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
737 #define NECP_UPDATE_ALL_CLIENTS_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_update_all_clients_lock)
738 #define NECP_UPDATE_ALL_CLIENTS_SHARED_TO_EXCLUSIVE() lck_rw_lock_shared_to_exclusive(&necp_update_all_clients_lock)
739 #define NECP_UPDATE_ALL_CLIENTS_SHARED() lck_rw_lock_shared(&necp_update_all_clients_lock)
740 #define NECP_UPDATE_ALL_CLIENTS_UNLOCK() lck_rw_done(&necp_update_all_clients_lock)
741
742 // Array of PIDs that will trigger in-process flow divert, protected by NECP_FD_LIST_LOCK
743 #define NECP_MAX_FLOW_DIVERT_NEEDED_PIDS 4
744 static pid_t necp_flow_divert_needed_pids[NECP_MAX_FLOW_DIVERT_NEEDED_PIDS];
745
746 #if SKYWALK
747 static thread_call_t necp_client_collect_stats_tcall;
748 static thread_call_t necp_close_empty_arenas_tcall;
749
750 static void necp_fd_insert_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai);
751 static void necp_fd_remove_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai);
752 static struct necp_arena_info *necp_fd_mredirect_stats_arena(struct necp_fd_data *fd_data, struct proc *proc);
753
754 static void necp_arena_info_retain(struct necp_arena_info *nai);
755 static void necp_arena_info_release(struct necp_arena_info *nai);
756 static struct necp_arena_info *necp_arena_info_alloc(void);
757 static void necp_arena_info_free(struct necp_arena_info *nai);
758
759 static int necp_arena_initialize(struct necp_fd_data *fd_data, bool locked);
760 static int necp_stats_initialize(struct necp_fd_data *fd_data, struct necp_client *client,
761 struct necp_client_flow_registration *flow_registration, struct necp_stats_bufreq *bufreq);
762 static int necp_arena_create(struct necp_fd_data *fd_data, size_t obj_size, size_t obj_cnt, struct proc *p);
763 static int necp_arena_stats_obj_alloc(struct necp_fd_data *fd_data, mach_vm_offset_t *off, struct necp_arena_info **stats_arena, void **kstats_kaddr, boolean_t cansleep);
764 static void necp_arena_stats_obj_free(struct necp_fd_data *fd_data, struct necp_arena_info *stats_arena, void **kstats_kaddr, mach_vm_address_t *ustats_uaddr);
765 static void necp_stats_arenas_destroy(struct necp_fd_data *fd_data, boolean_t closing);
766
767 static int necp_sysctl_arena_initialize(struct necp_fd_data *fd_data, bool locked);
768 static void necp_sysctl_arena_destroy(struct necp_fd_data *fd_data);
769 static void *necp_arena_sysctls_obj(struct necp_fd_data *fd_data, mach_vm_offset_t *off, size_t *size);
770 #endif /* !SKYWALK */
771
772 void necp_copy_inp_domain_info(struct inpcb *, struct socket *, nstat_domain_info *);
773 void necp_with_inp_domain_name(struct socket *so, void *ctx, void (*with_func)(char *domain_name, void *ctx));
774
775 static void
necp_lock_socket_attributes(void)776 necp_lock_socket_attributes(void)
777 {
778 lck_mtx_lock(&necp_socket_attr_lock);
779 }
780
781 static void
necp_unlock_socket_attributes(void)782 necp_unlock_socket_attributes(void)
783 {
784 lck_mtx_unlock(&necp_socket_attr_lock);
785 }
786
787 /// NECP file descriptor functions
788
789 static void
necp_fd_notify(struct necp_fd_data * fd_data,bool locked)790 necp_fd_notify(struct necp_fd_data *fd_data, bool locked)
791 {
792 struct selinfo *si = &fd_data->si;
793
794 if (!locked) {
795 NECP_FD_LOCK(fd_data);
796 }
797
798 selwakeup(si);
799
800 // use a non-zero hint to tell the notification from the
801 // call done in kqueue_scan() which uses 0
802 KNOTE(&si->si_note, 1); // notification
803
804 if (!locked) {
805 NECP_FD_UNLOCK(fd_data);
806 }
807 }
808
809 static inline bool
necp_client_has_unread_flows(struct necp_client * client)810 necp_client_has_unread_flows(struct necp_client *client)
811 {
812 NECP_CLIENT_ASSERT_LOCKED(client);
813 struct necp_client_flow_registration *flow_registration = NULL;
814 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
815 if (!flow_registration->flow_result_read) {
816 return true;
817 }
818 }
819 return false;
820 }
821
822 static int
necp_fd_poll(struct necp_fd_data * fd_data,int events,void * wql,struct proc * p,int is_kevent)823 necp_fd_poll(struct necp_fd_data *fd_data, int events, void *wql, struct proc *p, int is_kevent)
824 {
825 #pragma unused(wql, p, is_kevent)
826 u_int revents = 0;
827
828 u_int want_rx = events & (POLLIN | POLLRDNORM);
829 if (want_rx) {
830 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
831 // Push-mode observers are readable when they have a new update
832 if (!TAILQ_EMPTY(&fd_data->update_list)) {
833 revents |= want_rx;
834 }
835 } else {
836 // Standard fds are readable when some client is unread
837 struct necp_client *client = NULL;
838 bool has_unread_clients = FALSE;
839 RB_FOREACH(client, _necp_client_tree, &fd_data->clients) {
840 NECP_CLIENT_LOCK(client);
841 if (!client->result_read || !client->group_members_read || necp_client_has_unread_flows(client)) {
842 has_unread_clients = TRUE;
843 }
844 NECP_CLIENT_UNLOCK(client);
845 if (has_unread_clients) {
846 break;
847 }
848 }
849
850 if (has_unread_clients || fd_data->request_in_process_flow_divert) {
851 revents |= want_rx;
852 }
853 }
854 }
855
856 return revents;
857 }
858
859 static inline void
necp_generate_client_id(uuid_t client_id,bool is_flow)860 necp_generate_client_id(uuid_t client_id, bool is_flow)
861 {
862 uuid_generate_random(client_id);
863
864 if (is_flow) {
865 client_id[9] |= 0x01;
866 } else {
867 client_id[9] &= ~0x01;
868 }
869 }
870
871 static inline bool
necp_client_id_is_flow(uuid_t client_id)872 necp_client_id_is_flow(uuid_t client_id)
873 {
874 return client_id[9] & 0x01;
875 }
876
877 static struct necp_client *
necp_find_client_and_lock(uuid_t client_id)878 necp_find_client_and_lock(uuid_t client_id)
879 {
880 NECP_CLIENT_TREE_ASSERT_LOCKED();
881
882 struct necp_client *client = NULL;
883
884 if (necp_client_id_is_flow(client_id)) {
885 NECP_FLOW_TREE_LOCK_SHARED();
886 struct necp_client_flow_registration find;
887 uuid_copy(find.registration_id, client_id);
888 struct necp_client_flow_registration *flow = RB_FIND(_necp_client_flow_global_tree, &necp_client_flow_global_tree, &find);
889 if (flow != NULL) {
890 client = flow->client;
891 }
892 NECP_FLOW_TREE_UNLOCK();
893 } else {
894 struct necp_client find;
895 uuid_copy(find.client_id, client_id);
896 client = RB_FIND(_necp_client_global_tree, &necp_client_global_tree, &find);
897 }
898
899 if (client != NULL) {
900 NECP_CLIENT_LOCK(client);
901 }
902
903 return client;
904 }
905
906 static struct necp_client_flow_registration *
necp_client_find_flow(struct necp_client * client,uuid_t flow_id)907 necp_client_find_flow(struct necp_client *client, uuid_t flow_id)
908 {
909 NECP_CLIENT_ASSERT_LOCKED(client);
910 struct necp_client_flow_registration *flow = NULL;
911
912 if (necp_client_id_is_flow(flow_id)) {
913 struct necp_client_flow_registration find;
914 uuid_copy(find.registration_id, flow_id);
915 flow = RB_FIND(_necp_client_flow_tree, &client->flow_registrations, &find);
916 } else {
917 flow = RB_ROOT(&client->flow_registrations);
918 }
919
920 return flow;
921 }
922
923 static struct necp_client *
necp_client_fd_find_client_unlocked(struct necp_fd_data * client_fd,uuid_t client_id)924 necp_client_fd_find_client_unlocked(struct necp_fd_data *client_fd, uuid_t client_id)
925 {
926 NECP_FD_ASSERT_LOCKED(client_fd);
927 struct necp_client *client = NULL;
928
929 if (necp_client_id_is_flow(client_id)) {
930 struct necp_client_flow_registration find;
931 uuid_copy(find.registration_id, client_id);
932 struct necp_client_flow_registration *flow = RB_FIND(_necp_fd_flow_tree, &client_fd->flows, &find);
933 if (flow != NULL) {
934 client = flow->client;
935 }
936 } else {
937 struct necp_client find;
938 uuid_copy(find.client_id, client_id);
939 client = RB_FIND(_necp_client_tree, &client_fd->clients, &find);
940 }
941
942 return client;
943 }
944
945 static struct necp_client *
necp_client_fd_find_client_and_lock(struct necp_fd_data * client_fd,uuid_t client_id)946 necp_client_fd_find_client_and_lock(struct necp_fd_data *client_fd, uuid_t client_id)
947 {
948 struct necp_client *client = necp_client_fd_find_client_unlocked(client_fd, client_id);
949 if (client != NULL) {
950 NECP_CLIENT_LOCK(client);
951 }
952
953 return client;
954 }
955
956 static inline int
necp_client_id_cmp(struct necp_client * client0,struct necp_client * client1)957 necp_client_id_cmp(struct necp_client *client0, struct necp_client *client1)
958 {
959 return uuid_compare(client0->client_id, client1->client_id);
960 }
961
962 static inline int
necp_client_flow_id_cmp(struct necp_client_flow_registration * flow0,struct necp_client_flow_registration * flow1)963 necp_client_flow_id_cmp(struct necp_client_flow_registration *flow0, struct necp_client_flow_registration *flow1)
964 {
965 return uuid_compare(flow0->registration_id, flow1->registration_id);
966 }
967
968 static int
necpop_select(struct fileproc * fp,int which,void * wql,vfs_context_t ctx)969 necpop_select(struct fileproc *fp, int which, void *wql, vfs_context_t ctx)
970 {
971 #pragma unused(fp, which, wql, ctx)
972 return 0;
973 struct necp_fd_data *fd_data = NULL;
974 int revents = 0;
975 int events = 0;
976 proc_t procp;
977
978 fd_data = (struct necp_fd_data *)fp_get_data(fp);
979 if (fd_data == NULL) {
980 return 0;
981 }
982
983 procp = vfs_context_proc(ctx);
984
985 switch (which) {
986 case FREAD: {
987 events = POLLIN;
988 break;
989 }
990
991 default: {
992 return 1;
993 }
994 }
995
996 NECP_FD_LOCK(fd_data);
997 revents = necp_fd_poll(fd_data, events, wql, procp, 0);
998 NECP_FD_UNLOCK(fd_data);
999
1000 return (events & revents) ? 1 : 0;
1001 }
1002
1003 static void
necp_fd_knrdetach(struct knote * kn)1004 necp_fd_knrdetach(struct knote *kn)
1005 {
1006 struct necp_fd_data *fd_data = (struct necp_fd_data *)knote_kn_hook_get_raw(kn);
1007 struct selinfo *si = &fd_data->si;
1008
1009 NECP_FD_LOCK(fd_data);
1010 KNOTE_DETACH(&si->si_note, kn);
1011 NECP_FD_UNLOCK(fd_data);
1012 }
1013
1014 static int
necp_fd_knread(struct knote * kn,long hint)1015 necp_fd_knread(struct knote *kn, long hint)
1016 {
1017 #pragma unused(kn, hint)
1018 return 1; /* assume we are ready */
1019 }
1020
1021 static int
necp_fd_knrprocess(struct knote * kn,struct kevent_qos_s * kev)1022 necp_fd_knrprocess(struct knote *kn, struct kevent_qos_s *kev)
1023 {
1024 struct necp_fd_data *fd_data;
1025 int revents;
1026 int res;
1027
1028 fd_data = (struct necp_fd_data *)knote_kn_hook_get_raw(kn);
1029
1030 NECP_FD_LOCK(fd_data);
1031 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
1032 res = ((revents & POLLIN) != 0);
1033 if (res) {
1034 knote_fill_kevent(kn, kev, 0);
1035 }
1036 NECP_FD_UNLOCK(fd_data);
1037 return res;
1038 }
1039
1040 static int
necp_fd_knrtouch(struct knote * kn,struct kevent_qos_s * kev)1041 necp_fd_knrtouch(struct knote *kn, struct kevent_qos_s *kev)
1042 {
1043 #pragma unused(kev)
1044 struct necp_fd_data *fd_data;
1045 int revents;
1046
1047 fd_data = (struct necp_fd_data *)knote_kn_hook_get_raw(kn);
1048
1049 NECP_FD_LOCK(fd_data);
1050 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
1051 NECP_FD_UNLOCK(fd_data);
1052
1053 return (revents & POLLIN) != 0;
1054 }
1055
1056 SECURITY_READ_ONLY_EARLY(struct filterops) necp_fd_rfiltops = {
1057 .f_isfd = 1,
1058 .f_detach = necp_fd_knrdetach,
1059 .f_event = necp_fd_knread,
1060 .f_touch = necp_fd_knrtouch,
1061 .f_process = necp_fd_knrprocess,
1062 };
1063
1064 static int
necpop_kqfilter(struct fileproc * fp,struct knote * kn,__unused struct kevent_qos_s * kev)1065 necpop_kqfilter(struct fileproc *fp, struct knote *kn,
1066 __unused struct kevent_qos_s *kev)
1067 {
1068 struct necp_fd_data *fd_data = NULL;
1069 int revents;
1070
1071 if (kn->kn_filter != EVFILT_READ) {
1072 NECPLOG(LOG_ERR, "bad filter request %d", kn->kn_filter);
1073 knote_set_error(kn, EINVAL);
1074 return 0;
1075 }
1076
1077 fd_data = (struct necp_fd_data *)fp_get_data(fp);
1078 if (fd_data == NULL) {
1079 NECPLOG0(LOG_ERR, "No channel for kqfilter");
1080 knote_set_error(kn, ENOENT);
1081 return 0;
1082 }
1083
1084 NECP_FD_LOCK(fd_data);
1085 kn->kn_filtid = EVFILTID_NECP_FD;
1086 knote_kn_hook_set_raw(kn, fd_data);
1087 KNOTE_ATTACH(&fd_data->si.si_note, kn);
1088
1089 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
1090
1091 NECP_FD_UNLOCK(fd_data);
1092
1093 return (revents & POLLIN) != 0;
1094 }
1095
1096 #define INTERFACE_FLAGS_SHIFT 32
1097 #define INTERFACE_FLAGS_MASK 0xffffffff
1098 #define INTERFACE_INDEX_SHIFT 0
1099 #define INTERFACE_INDEX_MASK 0xffffffff
1100
1101 static uint64_t
combine_interface_details(uint32_t interface_index,uint32_t interface_flags)1102 combine_interface_details(uint32_t interface_index, uint32_t interface_flags)
1103 {
1104 return ((uint64_t)interface_flags & INTERFACE_FLAGS_MASK) << INTERFACE_FLAGS_SHIFT |
1105 ((uint64_t)interface_index & INTERFACE_INDEX_MASK) << INTERFACE_INDEX_SHIFT;
1106 }
1107
1108 #if SKYWALK
1109
1110 static void
split_interface_details(uint64_t combined_details,uint32_t * interface_index,uint32_t * interface_flags)1111 split_interface_details(uint64_t combined_details, uint32_t *interface_index, uint32_t *interface_flags)
1112 {
1113 *interface_index = (combined_details >> INTERFACE_INDEX_SHIFT) & INTERFACE_INDEX_MASK;
1114 *interface_flags = (combined_details >> INTERFACE_FLAGS_SHIFT) & INTERFACE_FLAGS_MASK;
1115 }
1116
1117 static void
necp_flow_save_current_interface_details(struct necp_client_flow_registration * flow_registration)1118 necp_flow_save_current_interface_details(struct necp_client_flow_registration *flow_registration)
1119 {
1120 struct necp_client_flow *flow = NULL;
1121 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1122 if (flow->nexus) {
1123 uint64_t combined_details = combine_interface_details(flow->interface_index, flow->interface_flags);
1124 os_atomic_store(&flow_registration->last_interface_details, combined_details, release);
1125 break;
1126 }
1127 }
1128 }
1129
1130 static void
necp_client_collect_interface_stats(struct necp_client_flow_registration * flow_registration,struct ifnet_stats_per_flow * ifs)1131 necp_client_collect_interface_stats(struct necp_client_flow_registration *flow_registration, struct ifnet_stats_per_flow *ifs)
1132 {
1133 struct necp_client_flow *flow = NULL;
1134
1135 if (ifs == NULL || ifs->txpackets == 0 || ifs->rxpackets == 0) {
1136 return; // App might have crashed without publishing ifs
1137 }
1138
1139 // Do malicious stats detection here
1140
1141 // Fold userspace stats into (trusted) kernel stats (stored in ifp).
1142 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1143 uint32_t if_idx = flow->interface_index;
1144 ifnet_t ifp = NULL;
1145 ifnet_head_lock_shared();
1146 if (if_idx != IFSCOPE_NONE && if_idx <= (uint32_t)if_index) {
1147 ifp = ifindex2ifnet[if_idx];
1148 ifnet_update_stats_per_flow(ifs, ifp);
1149 }
1150 ifnet_head_done();
1151
1152 // Currently there is only one flow that uses the shared necp
1153 // stats region, so this loop should exit after updating an ifp
1154 break;
1155 }
1156 }
1157
1158 static void
necp_client_collect_stats(struct necp_client_flow_registration * flow_registration)1159 necp_client_collect_stats(struct necp_client_flow_registration *flow_registration)
1160 {
1161 struct necp_all_kstats *kstats = (struct necp_all_kstats *)flow_registration->kstats_kaddr;
1162 if (kstats == NULL) {
1163 return;
1164 }
1165
1166 // Grab userspace stats delta (untrusted).
1167 struct necp_tcp_stats *curr_tcpstats = (struct necp_tcp_stats *)kstats->necp_stats_ustats;
1168 struct necp_tcp_stats *prev_tcpstats = (struct necp_tcp_stats *)&kstats->necp_stats_comm;
1169 #define diff_n_update(field) \
1170 u_int32_t d_##field = (curr_tcpstats->necp_tcp_counts.necp_stat_##field - prev_tcpstats->necp_tcp_counts.necp_stat_##field); \
1171 prev_tcpstats->necp_tcp_counts.necp_stat_##field += d_##field;
1172 diff_n_update(rxpackets);
1173 diff_n_update(txpackets);
1174 if (d_rxpackets == 0 && d_txpackets == 0) {
1175 return; // no activity since last collection, stop here
1176 }
1177 diff_n_update(rxbytes);
1178 diff_n_update(txbytes);
1179 diff_n_update(rxduplicatebytes);
1180 diff_n_update(rxoutoforderbytes);
1181 diff_n_update(txretransmit);
1182 diff_n_update(connectattempts);
1183 diff_n_update(connectsuccesses);
1184 uint32_t rtt = prev_tcpstats->necp_tcp_counts.necp_stat_avg_rtt = curr_tcpstats->necp_tcp_counts.necp_stat_avg_rtt;
1185 uint32_t rtt_var = prev_tcpstats->necp_tcp_counts.necp_stat_var_rtt = curr_tcpstats->necp_tcp_counts.necp_stat_var_rtt;
1186 #undef diff_n_update
1187
1188 // Do malicious stats detection with the deltas here.
1189 // RTT check (not necessarily attacks, might just be not measured since we report stats async periodically).
1190 if (rtt < necp_client_stats_rtt_floor || rtt > necp_client_stats_rtt_ceiling) {
1191 rtt = rtt_var = 0; // nstat_route_update to skip 0 rtt
1192 }
1193
1194 // Fold userspace stats into (trusted) kernel stats (stored in route).
1195 NECP_CLIENT_ROUTE_LOCK(flow_registration->client);
1196 struct rtentry *route = flow_registration->client->current_route;
1197 if (route != NULL) {
1198 nstat_route_update(route, d_connectattempts, d_connectsuccesses, d_rxpackets, d_rxbytes, d_rxduplicatebytes,
1199 d_rxoutoforderbytes, d_txpackets, d_txbytes, d_txretransmit, rtt, rtt_var);
1200 }
1201 NECP_CLIENT_ROUTE_UNLOCK(flow_registration->client);
1202 }
1203
1204 // This is called from various places; "closing" here implies the client being closed/removed if true, otherwise being
1205 // defunct. In the former, we expect the caller to not hold the lock; for the latter it must have acquired it.
1206 static void
necp_destroy_flow_stats(struct necp_fd_data * fd_data,struct necp_client_flow_registration * flow_registration,struct ifnet_stats_per_flow * flow_ifnet_stats,boolean_t closing)1207 necp_destroy_flow_stats(struct necp_fd_data *fd_data,
1208 struct necp_client_flow_registration *flow_registration,
1209 struct ifnet_stats_per_flow *flow_ifnet_stats,
1210 boolean_t closing)
1211 {
1212 NECP_FD_ASSERT_LOCKED(fd_data);
1213
1214 struct necp_client *client = flow_registration->client;
1215
1216 if (closing) {
1217 NECP_CLIENT_ASSERT_UNLOCKED(client);
1218 NECP_CLIENT_LOCK(client);
1219 } else {
1220 NECP_CLIENT_ASSERT_LOCKED(client);
1221 }
1222
1223 // the interface stats are independent of the flow stats, hence we check here
1224 if (flow_ifnet_stats != NULL) {
1225 necp_client_collect_interface_stats(flow_registration, flow_ifnet_stats);
1226 }
1227
1228 if (flow_registration->kstats_kaddr != NULL) {
1229 NECP_STATS_LIST_LOCK_EXCLUSIVE();
1230 necp_client_collect_stats(flow_registration);
1231 const bool destroyed = necp_client_release_locked(client); // Drop the reference held by the stats list
1232 ASSERT(!destroyed);
1233 (void)destroyed;
1234 LIST_REMOVE(flow_registration, collect_stats_chain);
1235 NECP_STATS_LIST_UNLOCK();
1236 if (flow_registration->stats_handler_context != NULL) {
1237 ntstat_userland_stats_close(flow_registration->stats_handler_context);
1238 flow_registration->stats_handler_context = NULL;
1239 }
1240 necp_arena_stats_obj_free(fd_data, flow_registration->stats_arena, &flow_registration->kstats_kaddr, &flow_registration->ustats_uaddr);
1241 ASSERT(flow_registration->kstats_kaddr == NULL);
1242 ASSERT(flow_registration->ustats_uaddr == 0);
1243 }
1244
1245 if (flow_registration->nexus_stats != NULL) {
1246 flow_stats_release(flow_registration->nexus_stats);
1247 flow_registration->nexus_stats = NULL;
1248 }
1249
1250 if (closing) {
1251 NECP_CLIENT_UNLOCK(client);
1252 }
1253 }
1254
1255 static void
necp_schedule_collect_stats_clients(bool recur)1256 necp_schedule_collect_stats_clients(bool recur)
1257 {
1258 if (necp_client_collect_stats_tcall == NULL ||
1259 (!recur && thread_call_isactive(necp_client_collect_stats_tcall))) {
1260 return;
1261 }
1262
1263 uint64_t deadline = 0;
1264 uint64_t leeway = 0;
1265 clock_interval_to_deadline(necp_collect_stats_timeout_microseconds, NSEC_PER_USEC, &deadline);
1266 clock_interval_to_absolutetime_interval(necp_collect_stats_timeout_leeway_microseconds, NSEC_PER_USEC, &leeway);
1267
1268 thread_call_enter_delayed_with_leeway(necp_client_collect_stats_tcall, NULL,
1269 deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
1270 }
1271
1272 static void
necp_collect_stats_client_callout(__unused thread_call_param_t dummy,__unused thread_call_param_t arg)1273 necp_collect_stats_client_callout(__unused thread_call_param_t dummy,
1274 __unused thread_call_param_t arg)
1275 {
1276 struct necp_client_flow_registration *flow_registration;
1277
1278 net_update_uptime();
1279 NECP_STATS_LIST_LOCK_SHARED();
1280 if (LIST_EMPTY(&necp_collect_stats_flow_list)) {
1281 NECP_STATS_LIST_UNLOCK();
1282 return;
1283 }
1284 LIST_FOREACH(flow_registration, &necp_collect_stats_flow_list, collect_stats_chain) {
1285 // Collecting stats should be cheap (atomic increments)
1286 // Values like flow_registration->kstats_kaddr are guaranteed to be valid
1287 // as long as the flow_registration is in the stats list
1288 necp_client_collect_stats(flow_registration);
1289 }
1290 NECP_STATS_LIST_UNLOCK();
1291
1292 necp_schedule_collect_stats_clients(TRUE); // recurring collection
1293 }
1294
1295 #endif /* !SKYWALK */
1296
1297 static void
necp_defunct_flow_registration(struct necp_client * client,struct necp_client_flow_registration * flow_registration,struct _necp_flow_defunct_list * defunct_list)1298 necp_defunct_flow_registration(struct necp_client *client,
1299 struct necp_client_flow_registration *flow_registration,
1300 struct _necp_flow_defunct_list *defunct_list)
1301 {
1302 NECP_CLIENT_ASSERT_LOCKED(client);
1303
1304 if (!flow_registration->defunct) {
1305 bool needs_defunct = false;
1306 struct necp_client_flow *search_flow = NULL;
1307 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
1308 if (search_flow->nexus &&
1309 !uuid_is_null(search_flow->u.nexus_agent)) {
1310 // Save defunct values for the nexus
1311 if (defunct_list != NULL) {
1312 // Sleeping alloc won't fail; copy only what's necessary
1313 struct necp_flow_defunct *flow_defunct = kalloc_type(struct necp_flow_defunct,
1314 Z_WAITOK | Z_ZERO);
1315 uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent);
1316 uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
1317 client->client_id :
1318 flow_registration->registration_id));
1319 flow_defunct->proc_pid = client->proc_pid;
1320 flow_defunct->agent_handle = client->agent_handle;
1321 flow_defunct->flags = flow_registration->flags;
1322 #if SKYWALK
1323 if (flow_registration->kstats_kaddr != NULL) {
1324 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
1325 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
1326 if (quicstats != NULL) {
1327 memcpy(flow_defunct->close_parameters.u.close_token, quicstats->necp_quic_extra.ssr_token, sizeof(flow_defunct->close_parameters.u.close_token));
1328 flow_defunct->has_close_parameters = true;
1329 }
1330 }
1331 #endif /* SKYWALK */
1332 // Add to the list provided by caller
1333 LIST_INSERT_HEAD(defunct_list, flow_defunct, chain);
1334 }
1335
1336 needs_defunct = true;
1337 }
1338 }
1339
1340 if (needs_defunct) {
1341 #if SKYWALK
1342 // Close the stats early
1343 if (flow_registration->stats_handler_context != NULL) {
1344 ntstat_userland_stats_event(flow_registration->stats_handler_context,
1345 NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT);
1346 }
1347 #endif /* SKYWALK */
1348
1349 // Only set defunct if there was some assigned flow
1350 flow_registration->defunct = true;
1351 }
1352 }
1353 }
1354
1355 static void
necp_defunct_client_for_policy(struct necp_client * client,struct _necp_flow_defunct_list * defunct_list)1356 necp_defunct_client_for_policy(struct necp_client *client,
1357 struct _necp_flow_defunct_list *defunct_list)
1358 {
1359 NECP_CLIENT_ASSERT_LOCKED(client);
1360
1361 struct necp_client_flow_registration *flow_registration = NULL;
1362 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
1363 necp_defunct_flow_registration(client, flow_registration, defunct_list);
1364 }
1365 }
1366
1367 static void
necp_client_free(struct necp_client * client)1368 necp_client_free(struct necp_client *client)
1369 {
1370 NECP_CLIENT_ASSERT_UNLOCKED(client);
1371
1372 kfree_data(client->extra_interface_options,
1373 sizeof(struct necp_client_interface_option) * NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT);
1374 client->extra_interface_options = NULL;
1375
1376 kfree_data(client->parameters, client->parameters_length);
1377 client->parameters = NULL;
1378
1379 kfree_data(client->assigned_group_members, client->assigned_group_members_length);
1380 client->assigned_group_members = NULL;
1381
1382 lck_mtx_destroy(&client->route_lock, &necp_fd_mtx_grp);
1383 lck_mtx_destroy(&client->lock, &necp_fd_mtx_grp);
1384
1385 kfree_type(struct necp_client, client);
1386 }
1387
1388 static void
necp_client_retain_locked(struct necp_client * client)1389 necp_client_retain_locked(struct necp_client *client)
1390 {
1391 NECP_CLIENT_ASSERT_LOCKED(client);
1392
1393 os_ref_retain_locked(&client->reference_count);
1394 }
1395
1396 static void
necp_client_retain(struct necp_client * client)1397 necp_client_retain(struct necp_client *client)
1398 {
1399 NECP_CLIENT_LOCK(client);
1400 necp_client_retain_locked(client);
1401 NECP_CLIENT_UNLOCK(client);
1402 }
1403
1404 static bool
necp_client_release_locked(struct necp_client * client)1405 necp_client_release_locked(struct necp_client *client)
1406 {
1407 NECP_CLIENT_ASSERT_LOCKED(client);
1408
1409 os_ref_count_t count = os_ref_release_locked(&client->reference_count);
1410 if (count == 0) {
1411 NECP_CLIENT_UNLOCK(client);
1412 necp_client_free(client);
1413 }
1414
1415 return count == 0;
1416 }
1417
1418 static bool
necp_client_release(struct necp_client * client)1419 necp_client_release(struct necp_client *client)
1420 {
1421 bool last_ref;
1422
1423 NECP_CLIENT_LOCK(client);
1424 if (!(last_ref = necp_client_release_locked(client))) {
1425 NECP_CLIENT_UNLOCK(client);
1426 }
1427
1428 return last_ref;
1429 }
1430
1431 static struct necp_client_update *
necp_client_update_alloc(const void * data,size_t length)1432 necp_client_update_alloc(const void *data, size_t length)
1433 {
1434 struct necp_client_update *client_update;
1435 struct necp_client_observer_update *buffer;
1436 size_t alloc_size;
1437
1438 if (os_add_overflow(length, sizeof(*buffer), &alloc_size)) {
1439 return NULL;
1440 }
1441 buffer = kalloc_data(alloc_size, Z_WAITOK);
1442 if (buffer == NULL) {
1443 return NULL;
1444 }
1445
1446 client_update = kalloc_type(struct necp_client_update,
1447 Z_WAITOK | Z_ZERO | Z_NOFAIL);
1448 client_update->update_length = alloc_size;
1449 client_update->update = buffer;
1450 memcpy(buffer->tlv_buffer, data, length);
1451 return client_update;
1452 }
1453
1454 static void
necp_client_update_free(struct necp_client_update * client_update)1455 necp_client_update_free(struct necp_client_update *client_update)
1456 {
1457 kfree_data(client_update->update, client_update->update_length);
1458 kfree_type(struct necp_client_update, client_update);
1459 }
1460
1461 static void
necp_client_update_observer_add_internal(struct necp_fd_data * observer_fd,struct necp_client * client)1462 necp_client_update_observer_add_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1463 {
1464 struct necp_client_update *client_update;
1465
1466 NECP_FD_LOCK(observer_fd);
1467
1468 if (observer_fd->update_count >= necp_observer_message_limit) {
1469 NECP_FD_UNLOCK(observer_fd);
1470 return;
1471 }
1472
1473 client_update = necp_client_update_alloc(client->parameters, client->parameters_length);
1474 if (client_update != NULL) {
1475 uuid_copy(client_update->client_id, client->client_id);
1476 client_update->update->update_type = NECP_CLIENT_UPDATE_TYPE_PARAMETERS;
1477 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1478 observer_fd->update_count++;
1479
1480 necp_fd_notify(observer_fd, true);
1481 }
1482
1483 NECP_FD_UNLOCK(observer_fd);
1484 }
1485
1486 static void
necp_client_update_observer_update_internal(struct necp_fd_data * observer_fd,struct necp_client * client)1487 necp_client_update_observer_update_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1488 {
1489 NECP_FD_LOCK(observer_fd);
1490
1491 if (observer_fd->update_count >= necp_observer_message_limit) {
1492 NECP_FD_UNLOCK(observer_fd);
1493 return;
1494 }
1495
1496 struct necp_client_update *client_update = necp_client_update_alloc(client->result, client->result_length);
1497 if (client_update != NULL) {
1498 uuid_copy(client_update->client_id, client->client_id);
1499 client_update->update->update_type = NECP_CLIENT_UPDATE_TYPE_RESULT;
1500 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1501 observer_fd->update_count++;
1502
1503 necp_fd_notify(observer_fd, true);
1504 }
1505
1506 NECP_FD_UNLOCK(observer_fd);
1507 }
1508
1509 static void
necp_client_update_observer_remove_internal(struct necp_fd_data * observer_fd,struct necp_client * client)1510 necp_client_update_observer_remove_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1511 {
1512 NECP_FD_LOCK(observer_fd);
1513
1514 if (observer_fd->update_count >= necp_observer_message_limit) {
1515 NECP_FD_UNLOCK(observer_fd);
1516 return;
1517 }
1518
1519 struct necp_client_update *client_update = necp_client_update_alloc(NULL, 0);
1520 if (client_update != NULL) {
1521 uuid_copy(client_update->client_id, client->client_id);
1522 client_update->update->update_type = NECP_CLIENT_UPDATE_TYPE_REMOVE;
1523 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1524 observer_fd->update_count++;
1525
1526 necp_fd_notify(observer_fd, true);
1527 }
1528
1529 NECP_FD_UNLOCK(observer_fd);
1530 }
1531
1532 static void
necp_client_update_observer_add(struct necp_client * client)1533 necp_client_update_observer_add(struct necp_client *client)
1534 {
1535 NECP_OBSERVER_LIST_LOCK_SHARED();
1536
1537 if (LIST_EMPTY(&necp_fd_observer_list)) {
1538 // No observers, bail
1539 NECP_OBSERVER_LIST_UNLOCK();
1540 return;
1541 }
1542
1543 struct necp_fd_data *observer_fd = NULL;
1544 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1545 necp_client_update_observer_add_internal(observer_fd, client);
1546 }
1547
1548 NECP_OBSERVER_LIST_UNLOCK();
1549 }
1550
1551 static void
necp_client_update_observer_update(struct necp_client * client)1552 necp_client_update_observer_update(struct necp_client *client)
1553 {
1554 NECP_OBSERVER_LIST_LOCK_SHARED();
1555
1556 if (LIST_EMPTY(&necp_fd_observer_list)) {
1557 // No observers, bail
1558 NECP_OBSERVER_LIST_UNLOCK();
1559 return;
1560 }
1561
1562 struct necp_fd_data *observer_fd = NULL;
1563 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1564 necp_client_update_observer_update_internal(observer_fd, client);
1565 }
1566
1567 NECP_OBSERVER_LIST_UNLOCK();
1568 }
1569
1570 static void
necp_client_update_observer_remove(struct necp_client * client)1571 necp_client_update_observer_remove(struct necp_client *client)
1572 {
1573 NECP_OBSERVER_LIST_LOCK_SHARED();
1574
1575 if (LIST_EMPTY(&necp_fd_observer_list)) {
1576 // No observers, bail
1577 NECP_OBSERVER_LIST_UNLOCK();
1578 return;
1579 }
1580
1581 struct necp_fd_data *observer_fd = NULL;
1582 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1583 necp_client_update_observer_remove_internal(observer_fd, client);
1584 }
1585
1586 NECP_OBSERVER_LIST_UNLOCK();
1587 }
1588
1589 static void
necp_destroy_client_flow_registration(struct necp_client * client,struct necp_client_flow_registration * flow_registration,pid_t pid,bool abort)1590 necp_destroy_client_flow_registration(struct necp_client *client,
1591 struct necp_client_flow_registration *flow_registration,
1592 pid_t pid, bool abort)
1593 {
1594 NECP_CLIENT_ASSERT_LOCKED(client);
1595
1596 bool has_close_parameters = false;
1597 struct necp_client_agent_parameters close_parameters = {};
1598 memset(close_parameters.u.close_token, 0, sizeof(close_parameters.u.close_token));
1599 #if SKYWALK
1600 if (flow_registration->kstats_kaddr != NULL) {
1601 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
1602 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
1603 if (quicstats != NULL &&
1604 quicstats->necp_quic_udp_stats.necp_udp_hdr.necp_stats_type == NECP_CLIENT_STATISTICS_TYPE_QUIC) {
1605 memcpy(close_parameters.u.close_token, quicstats->necp_quic_extra.ssr_token, sizeof(close_parameters.u.close_token));
1606 has_close_parameters = true;
1607 }
1608 }
1609
1610 // Release reference held on the stats arena
1611 if (flow_registration->stats_arena != NULL) {
1612 necp_arena_info_release(flow_registration->stats_arena);
1613 flow_registration->stats_arena = NULL;
1614 }
1615 #endif /* SKYWALK */
1616
1617 struct necp_client_flow *search_flow = NULL;
1618 struct necp_client_flow *temp_flow = NULL;
1619 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
1620 if (search_flow->nexus &&
1621 !uuid_is_null(search_flow->u.nexus_agent)) {
1622 // Don't unregister for defunct flows
1623 if (!flow_registration->defunct) {
1624 u_int8_t message_type = (abort ? NETAGENT_MESSAGE_TYPE_ABORT_NEXUS :
1625 NETAGENT_MESSAGE_TYPE_CLOSE_NEXUS);
1626 if (((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
1627 (flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
1628 !(flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
1629 message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
1630 }
1631 int netagent_error = netagent_client_message_with_params(search_flow->u.nexus_agent,
1632 ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
1633 client->client_id :
1634 flow_registration->registration_id),
1635 pid, client->agent_handle,
1636 message_type,
1637 has_close_parameters ? &close_parameters : NULL,
1638 NULL, 0);
1639 if (netagent_error != 0 && netagent_error != ENOENT) {
1640 NECPLOG(LOG_ERR, "necp_client_remove close nexus error (%d) MESSAGE TYPE %u", netagent_error, message_type);
1641 }
1642 }
1643 uuid_clear(search_flow->u.nexus_agent);
1644 }
1645 if (search_flow->assigned_results != NULL) {
1646 kfree_data(search_flow->assigned_results, search_flow->assigned_results_length);
1647 search_flow->assigned_results = NULL;
1648 }
1649 LIST_REMOVE(search_flow, flow_chain);
1650 #if SKYWALK
1651 if (search_flow->nexus) {
1652 OSDecrementAtomic(&necp_nexus_flow_count);
1653 } else
1654 #endif /* SKYWALK */
1655 if (search_flow->socket) {
1656 OSDecrementAtomic(&necp_socket_flow_count);
1657 } else {
1658 OSDecrementAtomic(&necp_if_flow_count);
1659 }
1660 kfree_type(struct necp_client_flow, search_flow);
1661 }
1662
1663 RB_REMOVE(_necp_client_flow_tree, &client->flow_registrations, flow_registration);
1664 flow_registration->client = NULL;
1665
1666 kfree_type(struct necp_client_flow_registration, flow_registration);
1667 }
1668
1669 static void
necp_destroy_client(struct necp_client * client,pid_t pid,bool abort)1670 necp_destroy_client(struct necp_client *client, pid_t pid, bool abort)
1671 {
1672 NECP_CLIENT_ASSERT_UNLOCKED(client);
1673
1674 #if SKYWALK
1675 if (client->nstat_context != NULL) {
1676 // This is a catch-all that should be rarely used.
1677 nstat_provider_stats_close(client->nstat_context);
1678 client->nstat_context = NULL;
1679 }
1680 if (client->original_parameters_source != NULL) {
1681 necp_client_release(client->original_parameters_source);
1682 client->original_parameters_source = NULL;
1683 }
1684 #endif /* SKYWALK */
1685 necp_client_update_observer_remove(client);
1686
1687 NECP_CLIENT_LOCK(client);
1688
1689 // Free route
1690 NECP_CLIENT_ROUTE_LOCK(client);
1691 if (client->current_route != NULL) {
1692 rtfree(client->current_route);
1693 client->current_route = NULL;
1694 }
1695 NECP_CLIENT_ROUTE_UNLOCK(client);
1696
1697 // Remove flow assignments
1698 struct necp_client_flow_registration *flow_registration = NULL;
1699 struct necp_client_flow_registration *temp_flow_registration = NULL;
1700 RB_FOREACH_SAFE(flow_registration, _necp_client_flow_tree, &client->flow_registrations, temp_flow_registration) {
1701 necp_destroy_client_flow_registration(client, flow_registration, pid, abort);
1702 }
1703
1704 #if SKYWALK
1705 // Remove port reservation
1706 if (NETNS_TOKEN_VALID(&client->port_reservation)) {
1707 netns_release(&client->port_reservation);
1708 }
1709 #endif /* !SKYWALK */
1710
1711 // Remove agent assertions
1712 struct necp_client_assertion *search_assertion = NULL;
1713 struct necp_client_assertion *temp_assertion = NULL;
1714 LIST_FOREACH_SAFE(search_assertion, &client->assertion_list, assertion_chain, temp_assertion) {
1715 int netagent_error = netagent_client_message(search_assertion->asserted_netagent, client->client_id, pid,
1716 client->agent_handle, NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT);
1717 if (netagent_error != 0) {
1718 NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR),
1719 "necp_client_remove unassert agent error (%d)", netagent_error);
1720 }
1721 LIST_REMOVE(search_assertion, assertion_chain);
1722 kfree_type(struct necp_client_assertion, search_assertion);
1723 }
1724
1725 if (!necp_client_release_locked(client)) {
1726 NECP_CLIENT_UNLOCK(client);
1727 }
1728
1729 OSDecrementAtomic(&necp_client_count);
1730 }
1731
1732 static bool
1733 necp_defunct_client_fd_locked_inner(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, bool destroy_stats);
1734
1735 static void
necp_process_defunct_list(struct _necp_flow_defunct_list * defunct_list)1736 necp_process_defunct_list(struct _necp_flow_defunct_list *defunct_list)
1737 {
1738 if (!LIST_EMPTY(defunct_list)) {
1739 struct necp_flow_defunct *flow_defunct = NULL;
1740 struct necp_flow_defunct *temp_flow_defunct = NULL;
1741
1742 // For each newly defunct client, send a message to the nexus to remove the flow
1743 LIST_FOREACH_SAFE(flow_defunct, defunct_list, chain, temp_flow_defunct) {
1744 if (!uuid_is_null(flow_defunct->nexus_agent)) {
1745 u_int8_t message_type = NETAGENT_MESSAGE_TYPE_ABORT_NEXUS;
1746 if (((flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
1747 (flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
1748 !(flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
1749 message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
1750 }
1751 int netagent_error = netagent_client_message_with_params(flow_defunct->nexus_agent,
1752 flow_defunct->flow_id,
1753 flow_defunct->proc_pid,
1754 flow_defunct->agent_handle,
1755 message_type,
1756 flow_defunct->has_close_parameters ? &flow_defunct->close_parameters : NULL,
1757 NULL, 0);
1758 if (netagent_error != 0) {
1759 char namebuf[MAXCOMLEN + 1];
1760 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
1761 proc_name(flow_defunct->proc_pid, namebuf, sizeof(namebuf));
1762 NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR), "necp_update_client abort nexus error (%d) for pid %d %s", netagent_error, flow_defunct->proc_pid, namebuf);
1763 }
1764 }
1765 LIST_REMOVE(flow_defunct, chain);
1766 kfree_type(struct necp_flow_defunct, flow_defunct);
1767 }
1768 }
1769 ASSERT(LIST_EMPTY(defunct_list));
1770 }
1771
1772 static int
necpop_close(struct fileglob * fg,vfs_context_t ctx)1773 necpop_close(struct fileglob *fg, vfs_context_t ctx)
1774 {
1775 #pragma unused(ctx)
1776 struct necp_fd_data *fd_data = NULL;
1777 int error = 0;
1778
1779 fd_data = (struct necp_fd_data *)fg_get_data(fg);
1780 fg_set_data(fg, NULL);
1781
1782 if (fd_data != NULL) {
1783 struct _necp_client_tree clients_to_close;
1784 RB_INIT(&clients_to_close);
1785
1786 // Remove from list quickly
1787 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
1788 NECP_OBSERVER_LIST_LOCK_EXCLUSIVE();
1789 LIST_REMOVE(fd_data, chain);
1790 NECP_OBSERVER_LIST_UNLOCK();
1791 } else {
1792 NECP_FD_LIST_LOCK_EXCLUSIVE();
1793 LIST_REMOVE(fd_data, chain);
1794 NECP_FD_LIST_UNLOCK();
1795 }
1796
1797 NECP_FD_LOCK(fd_data);
1798 pid_t pid = fd_data->proc_pid;
1799
1800 struct _necp_flow_defunct_list defunct_list;
1801 LIST_INIT(&defunct_list);
1802
1803 (void)necp_defunct_client_fd_locked_inner(fd_data, &defunct_list, false);
1804
1805 struct necp_client_flow_registration *flow_registration = NULL;
1806 struct necp_client_flow_registration *temp_flow_registration = NULL;
1807 RB_FOREACH_SAFE(flow_registration, _necp_fd_flow_tree, &fd_data->flows, temp_flow_registration) {
1808 #if SKYWALK
1809 necp_destroy_flow_stats(fd_data, flow_registration, NULL, TRUE);
1810 #endif /* SKYWALK */
1811 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
1812 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
1813 NECP_FLOW_TREE_UNLOCK();
1814 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
1815 }
1816
1817 struct necp_client *client = NULL;
1818 struct necp_client *temp_client = NULL;
1819 RB_FOREACH_SAFE(client, _necp_client_tree, &fd_data->clients, temp_client) {
1820 // Clear out the agent_handle to avoid dangling pointers back to fd_data
1821 NECP_CLIENT_LOCK(client);
1822 client->agent_handle = NULL;
1823 NECP_CLIENT_UNLOCK(client);
1824
1825 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
1826 RB_REMOVE(_necp_client_global_tree, &necp_client_global_tree, client);
1827 NECP_CLIENT_TREE_UNLOCK();
1828 RB_REMOVE(_necp_client_tree, &fd_data->clients, client);
1829 RB_INSERT(_necp_client_tree, &clients_to_close, client);
1830 }
1831
1832 struct necp_client_update *client_update = NULL;
1833 struct necp_client_update *temp_update = NULL;
1834 TAILQ_FOREACH_SAFE(client_update, &fd_data->update_list, chain, temp_update) {
1835 // Flush pending updates
1836 TAILQ_REMOVE(&fd_data->update_list, client_update, chain);
1837 necp_client_update_free(client_update);
1838 }
1839 fd_data->update_count = 0;
1840
1841 #if SKYWALK
1842 // Cleanup stats arena(s); indicate that we're closing
1843 necp_stats_arenas_destroy(fd_data, TRUE);
1844 ASSERT(fd_data->stats_arena_active == NULL);
1845 ASSERT(LIST_EMPTY(&fd_data->stats_arena_list));
1846
1847 // Cleanup systctl arena
1848 necp_sysctl_arena_destroy(fd_data);
1849 ASSERT(fd_data->sysctl_arena == NULL);
1850 #endif /* SKYWALK */
1851
1852 NECP_FD_UNLOCK(fd_data);
1853
1854 selthreadclear(&fd_data->si);
1855
1856 lck_mtx_destroy(&fd_data->fd_lock, &necp_fd_mtx_grp);
1857
1858 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
1859 OSDecrementAtomic(&necp_observer_fd_count);
1860 } else {
1861 OSDecrementAtomic(&necp_client_fd_count);
1862 }
1863
1864 kfree_type(struct necp_fd_data, fd_data);
1865
1866 RB_FOREACH_SAFE(client, _necp_client_tree, &clients_to_close, temp_client) {
1867 RB_REMOVE(_necp_client_tree, &clients_to_close, client);
1868 necp_destroy_client(client, pid, true);
1869 }
1870
1871 necp_process_defunct_list(&defunct_list);
1872 }
1873
1874 return error;
1875 }
1876
1877 /// NECP client utilities
1878
1879 static inline bool
necp_address_is_wildcard(const union necp_sockaddr_union * const addr)1880 necp_address_is_wildcard(const union necp_sockaddr_union * const addr)
1881 {
1882 return (addr->sa.sa_family == AF_INET && addr->sin.sin_addr.s_addr == INADDR_ANY) ||
1883 (addr->sa.sa_family == AF_INET6 && IN6_IS_ADDR_UNSPECIFIED(&addr->sin6.sin6_addr));
1884 }
1885
1886 static int
necp_find_fd_data(struct proc * p,int fd,struct fileproc ** fpp,struct necp_fd_data ** fd_data)1887 necp_find_fd_data(struct proc *p, int fd,
1888 struct fileproc **fpp, struct necp_fd_data **fd_data)
1889 {
1890 struct fileproc *fp;
1891 int error = fp_get_ftype(p, fd, DTYPE_NETPOLICY, ENODEV, &fp);
1892
1893 if (error == 0) {
1894 *fd_data = (struct necp_fd_data *)fp_get_data(fp);
1895 *fpp = fp;
1896
1897 if ((*fd_data)->necp_fd_type != necp_fd_type_client) {
1898 // Not a client fd, ignore
1899 fp_drop(p, fd, fp, 0);
1900 error = EINVAL;
1901 }
1902 }
1903 return error;
1904 }
1905
1906 static void
necp_client_add_nexus_flow(struct necp_client_flow_registration * flow_registration,uuid_t nexus_agent,uint32_t interface_index,uint32_t interface_flags)1907 necp_client_add_nexus_flow(struct necp_client_flow_registration *flow_registration,
1908 uuid_t nexus_agent,
1909 uint32_t interface_index,
1910 uint32_t interface_flags)
1911 {
1912 struct necp_client_flow *new_flow = kalloc_type(struct necp_client_flow, Z_WAITOK | Z_ZERO | Z_NOFAIL);
1913
1914 new_flow->nexus = TRUE;
1915 uuid_copy(new_flow->u.nexus_agent, nexus_agent);
1916 new_flow->interface_index = interface_index;
1917 new_flow->interface_flags = interface_flags;
1918 new_flow->check_tcp_heuristics = TRUE;
1919
1920 #if SKYWALK
1921 OSIncrementAtomic(&necp_nexus_flow_count);
1922 #endif /* SKYWALK */
1923
1924 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
1925
1926 #if SKYWALK
1927 necp_flow_save_current_interface_details(flow_registration);
1928 #endif /* SKYWALK */
1929 }
1930
1931 static void
necp_client_add_nexus_flow_if_needed(struct necp_client_flow_registration * flow_registration,uuid_t nexus_agent,uint32_t interface_index)1932 necp_client_add_nexus_flow_if_needed(struct necp_client_flow_registration *flow_registration,
1933 uuid_t nexus_agent,
1934 uint32_t interface_index)
1935 {
1936 struct necp_client_flow *flow = NULL;
1937 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1938 if (flow->nexus &&
1939 uuid_compare(flow->u.nexus_agent, nexus_agent) == 0) {
1940 return;
1941 }
1942 }
1943
1944 uint32_t interface_flags = 0;
1945 ifnet_t ifp = NULL;
1946 ifnet_head_lock_shared();
1947 if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
1948 ifp = ifindex2ifnet[interface_index];
1949 if (ifp != NULL) {
1950 ifnet_lock_shared(ifp);
1951 interface_flags = nstat_ifnet_to_flags(ifp);
1952 ifnet_lock_done(ifp);
1953 }
1954 }
1955 ifnet_head_done();
1956 necp_client_add_nexus_flow(flow_registration, nexus_agent, interface_index, interface_flags);
1957 }
1958
1959 static struct necp_client_flow *
necp_client_add_interface_flow(struct necp_client_flow_registration * flow_registration,uint32_t interface_index)1960 necp_client_add_interface_flow(struct necp_client_flow_registration *flow_registration,
1961 uint32_t interface_index)
1962 {
1963 struct necp_client_flow *new_flow = kalloc_type(struct necp_client_flow, Z_WAITOK | Z_ZERO | Z_NOFAIL);
1964
1965 // Neither nexus nor socket
1966 new_flow->interface_index = interface_index;
1967 new_flow->u.socket_handle = flow_registration->interface_handle;
1968 new_flow->u.cb = flow_registration->interface_cb;
1969
1970 OSIncrementAtomic(&necp_if_flow_count);
1971
1972 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
1973
1974 return new_flow;
1975 }
1976
1977 static struct necp_client_flow *
necp_client_add_interface_flow_if_needed(struct necp_client * client,struct necp_client_flow_registration * flow_registration,uint32_t interface_index)1978 necp_client_add_interface_flow_if_needed(struct necp_client *client,
1979 struct necp_client_flow_registration *flow_registration,
1980 uint32_t interface_index)
1981 {
1982 if (!client->allow_multiple_flows ||
1983 interface_index == IFSCOPE_NONE) {
1984 // Interface not set, or client not allowed to use this mode
1985 return NULL;
1986 }
1987
1988 struct necp_client_flow *flow = NULL;
1989 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1990 if (!flow->nexus && !flow->socket && flow->interface_index == interface_index) {
1991 // Already have the flow
1992 flow->invalid = FALSE;
1993 flow->u.socket_handle = flow_registration->interface_handle;
1994 flow->u.cb = flow_registration->interface_cb;
1995 return NULL;
1996 }
1997 }
1998 return necp_client_add_interface_flow(flow_registration, interface_index);
1999 }
2000
2001 static void
necp_client_add_interface_option_if_needed(struct necp_client * client,uint32_t interface_index,uint32_t interface_generation,uuid_t * nexus_agent,bool network_provider)2002 necp_client_add_interface_option_if_needed(struct necp_client *client,
2003 uint32_t interface_index,
2004 uint32_t interface_generation,
2005 uuid_t *nexus_agent,
2006 bool network_provider)
2007 {
2008 if ((interface_index == IFSCOPE_NONE && !network_provider) ||
2009 (client->interface_option_count != 0 && !client->allow_multiple_flows)) {
2010 // Interface not set, or client not allowed to use this mode
2011 return;
2012 }
2013
2014 if (client->interface_option_count >= NECP_CLIENT_MAX_INTERFACE_OPTIONS) {
2015 // Cannot take any more interface options
2016 return;
2017 }
2018
2019 // Check if already present
2020 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
2021 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
2022 struct necp_client_interface_option *option = &client->interface_options[option_i];
2023 if (option->interface_index == interface_index) {
2024 if (nexus_agent == NULL) {
2025 return;
2026 }
2027 if (uuid_compare(option->nexus_agent, *nexus_agent) == 0) {
2028 return;
2029 }
2030 if (uuid_is_null(option->nexus_agent)) {
2031 uuid_copy(option->nexus_agent, *nexus_agent);
2032 return;
2033 }
2034 // If we get to this point, this is a new nexus flow
2035 }
2036 } else {
2037 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
2038 if (option->interface_index == interface_index) {
2039 if (nexus_agent == NULL) {
2040 return;
2041 }
2042 if (uuid_compare(option->nexus_agent, *nexus_agent) == 0) {
2043 return;
2044 }
2045 if (uuid_is_null(option->nexus_agent)) {
2046 uuid_copy(option->nexus_agent, *nexus_agent);
2047 return;
2048 }
2049 // If we get to this point, this is a new nexus flow
2050 }
2051 }
2052 }
2053
2054 // Add a new entry
2055 if (client->interface_option_count < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
2056 // Add to static
2057 struct necp_client_interface_option *option = &client->interface_options[client->interface_option_count];
2058 option->interface_index = interface_index;
2059 option->interface_generation = interface_generation;
2060 if (nexus_agent != NULL) {
2061 uuid_copy(option->nexus_agent, *nexus_agent);
2062 } else {
2063 uuid_clear(option->nexus_agent);
2064 }
2065 client->interface_option_count++;
2066 } else {
2067 // Add to extra
2068 if (client->extra_interface_options == NULL) {
2069 client->extra_interface_options = (struct necp_client_interface_option *)kalloc_data(
2070 sizeof(struct necp_client_interface_option) * NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT, Z_WAITOK | Z_ZERO);
2071 }
2072 if (client->extra_interface_options != NULL) {
2073 struct necp_client_interface_option *option = &client->extra_interface_options[client->interface_option_count - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
2074 option->interface_index = interface_index;
2075 option->interface_generation = interface_generation;
2076 if (nexus_agent != NULL) {
2077 uuid_copy(option->nexus_agent, *nexus_agent);
2078 } else {
2079 uuid_clear(option->nexus_agent);
2080 }
2081 client->interface_option_count++;
2082 }
2083 }
2084 }
2085
2086 static bool
necp_client_flow_is_viable(proc_t proc,struct necp_client * client,struct necp_client_flow * flow)2087 necp_client_flow_is_viable(proc_t proc, struct necp_client *client,
2088 struct necp_client_flow *flow)
2089 {
2090 struct necp_aggregate_result result;
2091 bool ignore_address = (client->allow_multiple_flows && !flow->nexus && !flow->socket);
2092
2093 flow->necp_flow_flags = 0;
2094 int error = necp_application_find_policy_match_internal(proc, client->parameters,
2095 (u_int32_t)client->parameters_length,
2096 &result, &flow->necp_flow_flags, NULL,
2097 flow->interface_index,
2098 &flow->local_addr, &flow->remote_addr, NULL, NULL,
2099 NULL, ignore_address, true, NULL);
2100
2101 // Check for blocking agents
2102 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
2103 if (uuid_is_null(result.netagents[i])) {
2104 // Passed end of valid agents
2105 break;
2106 }
2107 if (result.netagent_use_flags[i] & NECP_AGENT_USE_FLAG_REMOVE) {
2108 // A removed agent, ignore
2109 continue;
2110 }
2111 u_int32_t flags = netagent_get_flags(result.netagents[i]);
2112 if ((flags & NETAGENT_FLAG_REGISTERED) &&
2113 !(flags & NETAGENT_FLAG_VOLUNTARY) &&
2114 !(flags & NETAGENT_FLAG_ACTIVE) &&
2115 !(flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY)) {
2116 // A required agent is not active, cause the flow to be marked non-viable
2117 return false;
2118 }
2119 }
2120
2121 if (flow->interface_index != IFSCOPE_NONE) {
2122 ifnet_head_lock_shared();
2123
2124 struct ifnet *ifp = ifindex2ifnet[flow->interface_index];
2125 if (ifp && ifp->if_delegated.ifp != IFSCOPE_NONE) {
2126 flow->delegated_interface_index = ifp->if_delegated.ifp->if_index;
2127 }
2128
2129 ifnet_head_done();
2130 }
2131
2132 return error == 0 &&
2133 result.routed_interface_index != IFSCOPE_NONE &&
2134 result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP;
2135 }
2136
2137 static void
necp_flow_add_interface_flows(proc_t proc,struct necp_client * client,struct necp_client_flow_registration * flow_registration,bool send_initial)2138 necp_flow_add_interface_flows(proc_t proc,
2139 struct necp_client *client,
2140 struct necp_client_flow_registration *flow_registration,
2141 bool send_initial)
2142 {
2143 // Traverse all interfaces and add a tracking flow if needed
2144 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
2145 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
2146 struct necp_client_interface_option *option = &client->interface_options[option_i];
2147 struct necp_client_flow *flow = necp_client_add_interface_flow_if_needed(client, flow_registration, option->interface_index);
2148 if (flow != NULL && send_initial) {
2149 flow->viable = necp_client_flow_is_viable(proc, client, flow);
2150 if (flow->viable && flow->u.cb) {
2151 bool viable = flow->viable;
2152 flow->u.cb(flow_registration->interface_handle, NECP_CLIENT_CBACTION_INITIAL, flow->interface_index, flow->necp_flow_flags, &viable);
2153 flow->viable = viable;
2154 }
2155 }
2156 } else {
2157 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
2158 struct necp_client_flow *flow = necp_client_add_interface_flow_if_needed(client, flow_registration, option->interface_index);
2159 if (flow != NULL && send_initial) {
2160 flow->viable = necp_client_flow_is_viable(proc, client, flow);
2161 if (flow->viable && flow->u.cb) {
2162 bool viable = flow->viable;
2163 flow->u.cb(flow_registration->interface_handle, NECP_CLIENT_CBACTION_INITIAL, flow->interface_index, flow->necp_flow_flags, &viable);
2164 flow->viable = viable;
2165 }
2166 }
2167 }
2168 }
2169 }
2170
2171 static bool
necp_client_update_flows(proc_t proc,struct necp_client * client,struct _necp_flow_defunct_list * defunct_list)2172 necp_client_update_flows(proc_t proc,
2173 struct necp_client *client,
2174 struct _necp_flow_defunct_list *defunct_list)
2175 {
2176 NECP_CLIENT_ASSERT_LOCKED(client);
2177
2178 bool any_client_updated = FALSE;
2179 struct necp_client_flow *flow = NULL;
2180 struct necp_client_flow *temp_flow = NULL;
2181 struct necp_client_flow_registration *flow_registration = NULL;
2182 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
2183 if (flow_registration->interface_cb != NULL) {
2184 // Add any interface flows that are not already tracked
2185 necp_flow_add_interface_flows(proc, client, flow_registration, false);
2186 }
2187
2188 LIST_FOREACH_SAFE(flow, &flow_registration->flow_list, flow_chain, temp_flow) {
2189 bool client_updated = FALSE;
2190
2191 // Check policy result for flow
2192 u_short old_delegated_ifindex = flow->delegated_interface_index;
2193
2194 int old_flags = flow->necp_flow_flags;
2195 bool viable = necp_client_flow_is_viable(proc, client, flow);
2196
2197 // TODO: Defunct nexus flows that are blocked by policy
2198
2199 if (flow->viable != viable) {
2200 flow->viable = viable;
2201 client_updated = TRUE;
2202 }
2203
2204 if ((old_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE) !=
2205 (flow->necp_flow_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE)) {
2206 client_updated = TRUE;
2207 }
2208
2209 if (flow->delegated_interface_index != old_delegated_ifindex) {
2210 client_updated = TRUE;
2211 }
2212
2213 if (flow->viable && client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) {
2214 bool flow_viable = flow->viable;
2215 flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_VIABLE, flow->interface_index, flow->necp_flow_flags, &flow_viable);
2216 flow->viable = flow_viable;
2217 }
2218
2219 if (!flow->viable || flow->invalid) {
2220 if (client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) {
2221 bool flow_viable = flow->viable;
2222 flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_NONVIABLE, flow->interface_index, flow->necp_flow_flags, &flow_viable);
2223 flow->viable = flow_viable;
2224 }
2225 // The callback might change the viable-flag of the
2226 // flow depending on its policy. Thus, we need to
2227 // check the flags again after the callback.
2228 }
2229
2230 #if SKYWALK
2231 if (defunct_list != NULL) {
2232 if (flow->invalid && flow->nexus && flow->assigned && !uuid_is_null(flow->u.nexus_agent)) {
2233 // This is a nexus flow that was assigned, but not found on path
2234 u_int32_t flags = netagent_get_flags(flow->u.nexus_agent);
2235 if (!(flags & NETAGENT_FLAG_REGISTERED)) {
2236 // The agent is no longer registered! Mark defunct.
2237 necp_defunct_flow_registration(client, flow_registration, defunct_list);
2238 client_updated = TRUE;
2239 }
2240 }
2241 }
2242 #else /* !SKYWALK */
2243 (void)defunct_list;
2244 #endif /* !SKYWALK */
2245
2246 // Handle flows that no longer match
2247 if (!flow->viable || flow->invalid) {
2248 // Drop them as long as they aren't assigned data
2249 if (!flow->nexus && !flow->assigned) {
2250 if (flow->assigned_results != NULL) {
2251 kfree_data(flow->assigned_results, flow->assigned_results_length);
2252 flow->assigned_results = NULL;
2253 client_updated = TRUE;
2254 }
2255 LIST_REMOVE(flow, flow_chain);
2256 #if SKYWALK
2257 if (flow->nexus) {
2258 OSDecrementAtomic(&necp_nexus_flow_count);
2259 } else
2260 #endif /* SKYWALK */
2261 if (flow->socket) {
2262 OSDecrementAtomic(&necp_socket_flow_count);
2263 } else {
2264 OSDecrementAtomic(&necp_if_flow_count);
2265 }
2266 kfree_type(struct necp_client_flow, flow);
2267 }
2268 }
2269
2270 any_client_updated |= client_updated;
2271 }
2272 #if SKYWALK
2273 necp_flow_save_current_interface_details(flow_registration);
2274 #endif /* SKYWALK */
2275 }
2276
2277 return any_client_updated;
2278 }
2279
2280 static void
necp_client_mark_all_nonsocket_flows_as_invalid(struct necp_client * client)2281 necp_client_mark_all_nonsocket_flows_as_invalid(struct necp_client *client)
2282 {
2283 struct necp_client_flow_registration *flow_registration = NULL;
2284 struct necp_client_flow *flow = NULL;
2285 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
2286 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
2287 if (!flow->socket) { // Socket flows are not marked as invalid
2288 flow->invalid = TRUE;
2289 }
2290 }
2291 }
2292
2293 // Reset option count every update
2294 client->interface_option_count = 0;
2295 }
2296
2297 static inline bool
necp_netagent_is_requested(const struct necp_client_parsed_parameters * parameters,uuid_t * netagent_uuid)2298 necp_netagent_is_requested(const struct necp_client_parsed_parameters *parameters,
2299 uuid_t *netagent_uuid)
2300 {
2301 // Specific use agents only apply when requested
2302 bool requested = false;
2303 if (parameters != NULL) {
2304 // Check required agent UUIDs
2305 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2306 if (uuid_is_null(parameters->required_netagents[i])) {
2307 break;
2308 }
2309 if (uuid_compare(parameters->required_netagents[i], *netagent_uuid) == 0) {
2310 requested = true;
2311 break;
2312 }
2313 }
2314
2315 if (!requested) {
2316 // Check required agent types
2317 bool fetched_type = false;
2318 char netagent_domain[NETAGENT_DOMAINSIZE];
2319 char netagent_type[NETAGENT_TYPESIZE];
2320 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
2321 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
2322
2323 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2324 if (strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
2325 strlen(parameters->required_netagent_types[i].netagent_type) == 0) {
2326 break;
2327 }
2328
2329 if (!fetched_type) {
2330 if (netagent_get_agent_domain_and_type(*netagent_uuid, netagent_domain, netagent_type)) {
2331 fetched_type = TRUE;
2332 } else {
2333 break;
2334 }
2335 }
2336
2337 if ((strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
2338 strncmp(netagent_domain, parameters->required_netagent_types[i].netagent_domain, NETAGENT_DOMAINSIZE) == 0) &&
2339 (strlen(parameters->required_netagent_types[i].netagent_type) == 0 ||
2340 strncmp(netagent_type, parameters->required_netagent_types[i].netagent_type, NETAGENT_TYPESIZE) == 0)) {
2341 requested = true;
2342 break;
2343 }
2344 }
2345 }
2346
2347 // Check preferred agent UUIDs
2348 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2349 if (uuid_is_null(parameters->preferred_netagents[i])) {
2350 break;
2351 }
2352 if (uuid_compare(parameters->preferred_netagents[i], *netagent_uuid) == 0) {
2353 requested = true;
2354 break;
2355 }
2356 }
2357
2358 if (!requested) {
2359 // Check preferred agent types
2360 bool fetched_type = false;
2361 char netagent_domain[NETAGENT_DOMAINSIZE];
2362 char netagent_type[NETAGENT_TYPESIZE];
2363 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
2364 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
2365
2366 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2367 if (strlen(parameters->preferred_netagent_types[i].netagent_domain) == 0 ||
2368 strlen(parameters->preferred_netagent_types[i].netagent_type) == 0) {
2369 break;
2370 }
2371
2372 if (!fetched_type) {
2373 if (netagent_get_agent_domain_and_type(*netagent_uuid, netagent_domain, netagent_type)) {
2374 fetched_type = TRUE;
2375 } else {
2376 break;
2377 }
2378 }
2379
2380 if ((strlen(parameters->preferred_netagent_types[i].netagent_domain) == 0 ||
2381 strncmp(netagent_domain, parameters->preferred_netagent_types[i].netagent_domain, NETAGENT_DOMAINSIZE) == 0) &&
2382 (strlen(parameters->preferred_netagent_types[i].netagent_type) == 0 ||
2383 strncmp(netagent_type, parameters->preferred_netagent_types[i].netagent_type, NETAGENT_TYPESIZE) == 0)) {
2384 requested = true;
2385 break;
2386 }
2387 }
2388 }
2389 }
2390
2391 return requested;
2392 }
2393
2394 static bool
necp_netagent_applies_to_client(struct necp_client * client,const struct necp_client_parsed_parameters * parameters,uuid_t * netagent_uuid,bool allow_nexus,uint32_t interface_index,uint32_t interface_generation)2395 necp_netagent_applies_to_client(struct necp_client *client,
2396 const struct necp_client_parsed_parameters *parameters,
2397 uuid_t *netagent_uuid, bool allow_nexus,
2398 uint32_t interface_index, uint32_t interface_generation)
2399 {
2400 #pragma unused(interface_index, interface_generation)
2401 bool applies = FALSE;
2402 u_int32_t flags = netagent_get_flags(*netagent_uuid);
2403 if (!(flags & NETAGENT_FLAG_REGISTERED)) {
2404 // Unregistered agents never apply
2405 return applies;
2406 }
2407
2408 const bool is_nexus_agent = ((flags & NETAGENT_FLAG_NEXUS_PROVIDER) ||
2409 (flags & NETAGENT_FLAG_NEXUS_LISTENER) ||
2410 (flags & NETAGENT_FLAG_CUSTOM_ETHER_NEXUS) ||
2411 (flags & NETAGENT_FLAG_CUSTOM_IP_NEXUS) ||
2412 (flags & NETAGENT_FLAG_INTERPOSE_NEXUS));
2413 if (is_nexus_agent) {
2414 if (!allow_nexus) {
2415 // Hide nexus providers unless allowed
2416 // Direct interfaces and direct policies are allowed to use a nexus
2417 // Delegate interfaces or re-scoped interfaces are not allowed
2418 return applies;
2419 }
2420
2421 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) &&
2422 !(flags & NETAGENT_FLAG_CUSTOM_ETHER_NEXUS)) {
2423 // Client requested a custom ether nexus, but this nexus isn't one
2424 return applies;
2425 }
2426
2427 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP) &&
2428 !(flags & NETAGENT_FLAG_CUSTOM_IP_NEXUS)) {
2429 // Client requested a custom IP nexus, but this nexus isn't one
2430 return applies;
2431 }
2432
2433 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) &&
2434 !(flags & NETAGENT_FLAG_INTERPOSE_NEXUS)) {
2435 // Client requested an interpose nexus, but this nexus isn't one
2436 return applies;
2437 }
2438
2439 if (!(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) &&
2440 !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP) &&
2441 !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) &&
2442 !(flags & NETAGENT_FLAG_NEXUS_PROVIDER)) {
2443 // Client requested default parameters, but this nexus isn't generic
2444 return applies;
2445 }
2446 }
2447
2448 if (uuid_compare(client->failed_trigger_agent.netagent_uuid, *netagent_uuid) == 0) {
2449 if (client->failed_trigger_agent.generation == netagent_get_generation(*netagent_uuid)) {
2450 // If this agent was triggered, and failed, and hasn't changed, keep hiding it
2451 return applies;
2452 } else {
2453 // Mismatch generation, clear out old trigger
2454 uuid_clear(client->failed_trigger_agent.netagent_uuid);
2455 client->failed_trigger_agent.generation = 0;
2456 }
2457 }
2458
2459 if (flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY) {
2460 // Specific use agents only apply when requested
2461 applies = necp_netagent_is_requested(parameters, netagent_uuid);
2462 } else {
2463 applies = TRUE;
2464 }
2465
2466 #if SKYWALK
2467 // Add nexus agent if it is a nexus, and either is not a listener, or the nexus supports listeners
2468 if (applies && is_nexus_agent &&
2469 !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) && // Don't add for browse paths
2470 ((flags & NETAGENT_FLAG_NEXUS_LISTENER) || !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER))) {
2471 necp_client_add_interface_option_if_needed(client, interface_index,
2472 interface_generation, netagent_uuid,
2473 (flags & NETAGENT_FLAG_NETWORK_PROVIDER));
2474 }
2475 #endif /* SKYWALK */
2476
2477 return applies;
2478 }
2479
2480 static void
necp_client_add_agent_interface_options(struct necp_client * client,const struct necp_client_parsed_parameters * parsed_parameters,ifnet_t ifp)2481 necp_client_add_agent_interface_options(struct necp_client *client,
2482 const struct necp_client_parsed_parameters *parsed_parameters,
2483 ifnet_t ifp)
2484 {
2485 if (ifp != NULL && ifp->if_agentids != NULL) {
2486 for (u_int32_t i = 0; i < ifp->if_agentcount; i++) {
2487 if (uuid_is_null(ifp->if_agentids[i])) {
2488 continue;
2489 }
2490 // Relies on the side effect that nexus agents that apply will create flows
2491 (void)necp_netagent_applies_to_client(client, parsed_parameters, &ifp->if_agentids[i], TRUE,
2492 ifp->if_index, ifnet_get_generation(ifp));
2493 }
2494 }
2495 }
2496
2497 static void
necp_client_add_browse_interface_options(struct necp_client * client,const struct necp_client_parsed_parameters * parsed_parameters,ifnet_t ifp)2498 necp_client_add_browse_interface_options(struct necp_client *client,
2499 const struct necp_client_parsed_parameters *parsed_parameters,
2500 ifnet_t ifp)
2501 {
2502 if (ifp != NULL && ifp->if_agentids != NULL) {
2503 for (u_int32_t i = 0; i < ifp->if_agentcount; i++) {
2504 if (uuid_is_null(ifp->if_agentids[i])) {
2505 continue;
2506 }
2507
2508 u_int32_t flags = netagent_get_flags(ifp->if_agentids[i]);
2509 if ((flags & NETAGENT_FLAG_REGISTERED) &&
2510 (flags & NETAGENT_FLAG_ACTIVE) &&
2511 (flags & NETAGENT_FLAG_SUPPORTS_BROWSE) &&
2512 (!(flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY) ||
2513 necp_netagent_is_requested(parsed_parameters, &ifp->if_agentids[i]))) {
2514 necp_client_add_interface_option_if_needed(client, ifp->if_index, ifnet_get_generation(ifp), &ifp->if_agentids[i], (flags & NETAGENT_FLAG_NETWORK_PROVIDER));
2515
2516 // Finding one is enough
2517 break;
2518 }
2519 }
2520 }
2521 }
2522
2523 static inline bool
_necp_client_address_is_valid(struct sockaddr * address)2524 _necp_client_address_is_valid(struct sockaddr *address)
2525 {
2526 if (address->sa_family == AF_INET) {
2527 return address->sa_len == sizeof(struct sockaddr_in);
2528 } else if (address->sa_family == AF_INET6) {
2529 return address->sa_len == sizeof(struct sockaddr_in6);
2530 } else {
2531 return FALSE;
2532 }
2533 }
2534
2535 #define necp_client_address_is_valid(S) _necp_client_address_is_valid(SA(S))
2536
2537 static inline bool
necp_client_endpoint_is_unspecified(struct necp_client_endpoint * endpoint)2538 necp_client_endpoint_is_unspecified(struct necp_client_endpoint *endpoint)
2539 {
2540 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2541 if (endpoint->u.sa.sa_family == AF_INET) {
2542 return endpoint->u.sin.sin_addr.s_addr == INADDR_ANY;
2543 } else if (endpoint->u.sa.sa_family == AF_INET6) {
2544 return IN6_IS_ADDR_UNSPECIFIED(&endpoint->u.sin6.sin6_addr);
2545 } else {
2546 return TRUE;
2547 }
2548 } else {
2549 return TRUE;
2550 }
2551 }
2552
2553 #if SKYWALK
2554 static void
necp_client_update_local_port_parameters(u_int8_t * parameters,u_int32_t parameters_size,uint16_t local_port)2555 necp_client_update_local_port_parameters(u_int8_t *parameters,
2556 u_int32_t parameters_size,
2557 uint16_t local_port)
2558 {
2559 size_t offset = 0;
2560 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
2561 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
2562 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
2563
2564 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
2565 // If the length is larger than what can fit in the remaining parameters size, bail
2566 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
2567 break;
2568 }
2569
2570 if (length > 0) {
2571 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
2572 if (value != NULL) {
2573 switch (type) {
2574 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: {
2575 if (length >= sizeof(struct necp_policy_condition_addr)) {
2576 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
2577 if (necp_client_address_is_valid(&address_struct->address.sa)) {
2578 if (address_struct->address.sa.sa_family == AF_INET) {
2579 address_struct->address.sin.sin_port = local_port;
2580 } else if (address_struct->address.sa.sa_family == AF_INET6) {
2581 address_struct->address.sin6.sin6_port = local_port;
2582 }
2583 }
2584 }
2585 break;
2586 }
2587 case NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT: {
2588 if (length >= sizeof(struct necp_client_endpoint)) {
2589 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2590 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2591 if (endpoint->u.sa.sa_family == AF_INET) {
2592 endpoint->u.sin.sin_port = local_port;
2593 } else if (endpoint->u.sa.sa_family == AF_INET6) {
2594 endpoint->u.sin6.sin6_port = local_port;
2595 }
2596 }
2597 }
2598 break;
2599 }
2600 default: {
2601 break;
2602 }
2603 }
2604 }
2605 }
2606
2607 offset += sizeof(struct necp_tlv_header) + length;
2608 }
2609 }
2610 #endif /* !SKYWALK */
2611
2612 #define NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH 253
2613
2614 static void
necp_client_trace_parameter_parsing(struct necp_client * client,u_int8_t type,u_int8_t * value,u_int32_t length)2615 necp_client_trace_parameter_parsing(struct necp_client *client, u_int8_t type, u_int8_t *value, u_int32_t length)
2616 {
2617 uint64_t num = 0;
2618 uint16_t shortBuf;
2619 uint32_t intBuf;
2620 char buffer[NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH + 1];
2621
2622 if (value != NULL && length > 0) {
2623 switch (length) {
2624 case 1:
2625 num = *value;
2626 break;
2627 case 2:
2628 memcpy(&shortBuf, value, sizeof(shortBuf));
2629 num = shortBuf;
2630 break;
2631 case 4:
2632 memcpy(&intBuf, value, sizeof(intBuf));
2633 num = intBuf;
2634 break;
2635 case 8:
2636 memcpy(&num, value, sizeof(num));
2637 break;
2638 default:
2639 num = 0;
2640 break;
2641 }
2642 int len = NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH < length ? NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH : length;
2643 memcpy(buffer, value, len);
2644 buffer[len] = 0;
2645 NECP_CLIENT_PARAMS_LOG(client, "Parsing param - type %d length %d value <%llu (%llX)> %s", type, length, num, num, buffer);
2646 } else {
2647 NECP_CLIENT_PARAMS_LOG(client, "Parsing param - type %d length %d", type, length);
2648 }
2649 }
2650
2651 static void
necp_client_trace_parsed_parameters(struct necp_client * client,struct necp_client_parsed_parameters * parsed_parameters)2652 necp_client_trace_parsed_parameters(struct necp_client *client, struct necp_client_parsed_parameters *parsed_parameters)
2653 {
2654 int i;
2655 char local_buffer[64] = { };
2656 char remote_buffer[64] = { };
2657 uuid_string_t uuid_str = { };
2658 uuid_unparse_lower(parsed_parameters->effective_uuid, uuid_str);
2659
2660 switch (parsed_parameters->local_addr.sa.sa_family) {
2661 case AF_INET:
2662 if (parsed_parameters->local_addr.sa.sa_len == sizeof(struct sockaddr_in)) {
2663 struct sockaddr_in *addr = &parsed_parameters->local_addr.sin;
2664 inet_ntop(AF_INET, &(addr->sin_addr), local_buffer, sizeof(local_buffer));
2665 }
2666 break;
2667 case AF_INET6:
2668 if (parsed_parameters->local_addr.sa.sa_len == sizeof(struct sockaddr_in6)) {
2669 struct sockaddr_in6 *addr6 = &parsed_parameters->local_addr.sin6;
2670 inet_ntop(AF_INET6, &(addr6->sin6_addr), local_buffer, sizeof(local_buffer));
2671 }
2672 break;
2673 default:
2674 break;
2675 }
2676
2677 switch (parsed_parameters->remote_addr.sa.sa_family) {
2678 case AF_INET:
2679 if (parsed_parameters->remote_addr.sa.sa_len == sizeof(struct sockaddr_in)) {
2680 struct sockaddr_in *addr = &parsed_parameters->remote_addr.sin;
2681 inet_ntop(AF_INET, &(addr->sin_addr), remote_buffer, sizeof(remote_buffer));
2682 }
2683 break;
2684 case AF_INET6:
2685 if (parsed_parameters->remote_addr.sa.sa_len == sizeof(struct sockaddr_in6)) {
2686 struct sockaddr_in6 *addr6 = &parsed_parameters->remote_addr.sin6;
2687 inet_ntop(AF_INET6, &(addr6->sin6_addr), remote_buffer, sizeof(remote_buffer));
2688 }
2689 break;
2690 default:
2691 break;
2692 }
2693
2694 NECP_CLIENT_PARAMS_LOG(client, "Parsed params - valid_fields %X flags %X delegated_upid %llu local_addr %s remote_addr %s "
2695 "required_interface_index %u required_interface_type %d local_address_preference %d "
2696 "ip_protocol %d transport_protocol %d ethertype %d effective_pid %d effective_uuid %s uid %d persona_id %d traffic_class %d",
2697 parsed_parameters->valid_fields,
2698 parsed_parameters->flags,
2699 parsed_parameters->delegated_upid,
2700 local_buffer, remote_buffer,
2701 parsed_parameters->required_interface_index,
2702 parsed_parameters->required_interface_type,
2703 parsed_parameters->local_address_preference,
2704 parsed_parameters->ip_protocol,
2705 parsed_parameters->transport_protocol,
2706 parsed_parameters->ethertype,
2707 parsed_parameters->effective_pid,
2708 uuid_str,
2709 parsed_parameters->uid,
2710 parsed_parameters->persona_id,
2711 parsed_parameters->traffic_class);
2712
2713 NECP_CLIENT_PARAMS_LOG(client, "Parsed params - tracker flags <known-tracker %X> <non-app-initiated %X> <silent %X> <app-approved %X>",
2714 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_KNOWN_TRACKER,
2715 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_NON_APP_INITIATED,
2716 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_SILENT,
2717 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_APPROVED_APP_DOMAIN);
2718
2719 for (i = 0; i < NECP_MAX_INTERFACE_PARAMETERS && parsed_parameters->prohibited_interfaces[i][0]; i++) {
2720 NECP_CLIENT_PARAMS_LOG(client, "Parsed prohibited_interfaces[%d] <%s>", i, parsed_parameters->prohibited_interfaces[i]);
2721 }
2722
2723 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->required_netagent_types[i].netagent_domain[0]; i++) {
2724 NECP_CLIENT_PARAMS_LOG(client, "Parsed required_netagent_types[%d] <%s> <%s>", i,
2725 parsed_parameters->required_netagent_types[i].netagent_domain,
2726 parsed_parameters->required_netagent_types[i].netagent_type);
2727 }
2728 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->prohibited_netagent_types[i].netagent_domain[0]; i++) {
2729 NECP_CLIENT_PARAMS_LOG(client, "Parsed prohibited_netagent_types[%d] <%s> <%s>", i,
2730 parsed_parameters->prohibited_netagent_types[i].netagent_domain,
2731 parsed_parameters->prohibited_netagent_types[i].netagent_type);
2732 }
2733 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->preferred_netagent_types[i].netagent_domain[0]; i++) {
2734 NECP_CLIENT_PARAMS_LOG(client, "Parsed preferred_netagent_types[%d] <%s> <%s>", i,
2735 parsed_parameters->preferred_netagent_types[i].netagent_domain,
2736 parsed_parameters->preferred_netagent_types[i].netagent_type);
2737 }
2738 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->avoided_netagent_types[i].netagent_domain[0]; i++) {
2739 NECP_CLIENT_PARAMS_LOG(client, "Parsed avoided_netagent_types[%d] <%s> <%s>", i,
2740 parsed_parameters->avoided_netagent_types[i].netagent_domain,
2741 parsed_parameters->avoided_netagent_types[i].netagent_type);
2742 }
2743
2744 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->required_netagents[i]); i++) {
2745 uuid_unparse_lower(parsed_parameters->required_netagents[i], uuid_str);
2746 NECP_CLIENT_PARAMS_LOG(client, "Parsed required_netagents[%d] <%s>", i, uuid_str);
2747 }
2748 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->prohibited_netagents[i]); i++) {
2749 uuid_unparse_lower(parsed_parameters->prohibited_netagents[i], uuid_str);
2750 NECP_CLIENT_PARAMS_LOG(client, "Parsed prohibited_netagents[%d] <%s>", i, uuid_str);
2751 }
2752 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->preferred_netagents[i]); i++) {
2753 uuid_unparse_lower(parsed_parameters->preferred_netagents[i], uuid_str);
2754 NECP_CLIENT_PARAMS_LOG(client, "Parsed preferred_netagents[%d] <%s>", i, uuid_str);
2755 }
2756 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->avoided_netagents[i]); i++) {
2757 uuid_unparse_lower(parsed_parameters->avoided_netagents[i], uuid_str);
2758 NECP_CLIENT_PARAMS_LOG(client, "Parsed avoided_netagents[%d] <%s>", i, uuid_str);
2759 }
2760 }
2761
2762 static bool
necp_client_strings_are_equal(const char * string1,size_t string1_length,const char * string2,size_t string2_length)2763 necp_client_strings_are_equal(const char *string1, size_t string1_length,
2764 const char *string2, size_t string2_length)
2765 {
2766 if (string1 == NULL || string2 == NULL) {
2767 return false;
2768 }
2769 const size_t string1_actual_length = strnlen(string1, string1_length);
2770 const size_t string2_actual_length = strnlen(string2, string2_length);
2771 if (string1_actual_length != string2_actual_length) {
2772 return false;
2773 }
2774 return strncmp(string1, string2, string1_actual_length) == 0;
2775 }
2776
2777 static int
necp_client_parse_parameters(struct necp_client * client,u_int8_t * parameters,u_int32_t parameters_size,struct necp_client_parsed_parameters * parsed_parameters)2778 necp_client_parse_parameters(struct necp_client *client, u_int8_t *parameters,
2779 u_int32_t parameters_size,
2780 struct necp_client_parsed_parameters *parsed_parameters)
2781 {
2782 int error = 0;
2783 size_t offset = 0;
2784
2785 u_int32_t num_prohibited_interfaces = 0;
2786 u_int32_t num_prohibited_interface_types = 0;
2787 u_int32_t num_required_agents = 0;
2788 u_int32_t num_prohibited_agents = 0;
2789 u_int32_t num_preferred_agents = 0;
2790 u_int32_t num_avoided_agents = 0;
2791 u_int32_t num_required_agent_types = 0;
2792 u_int32_t num_prohibited_agent_types = 0;
2793 u_int32_t num_preferred_agent_types = 0;
2794 u_int32_t num_avoided_agent_types = 0;
2795 u_int8_t *resolver_tag = NULL;
2796 u_int32_t resolver_tag_length = 0;
2797 u_int8_t *client_hostname = NULL;
2798 u_int32_t hostname_length = 0;
2799 uuid_t parent_id = {};
2800
2801 if (parsed_parameters == NULL) {
2802 return EINVAL;
2803 }
2804
2805 memset(parsed_parameters, 0, sizeof(struct necp_client_parsed_parameters));
2806
2807 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
2808 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
2809 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
2810
2811 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
2812 // If the length is larger than what can fit in the remaining parameters size, bail
2813 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
2814 break;
2815 }
2816
2817 if (length > 0) {
2818 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
2819 if (value != NULL) {
2820 switch (type) {
2821 case NECP_CLIENT_PARAMETER_BOUND_INTERFACE: {
2822 if (length <= IFXNAMSIZ && length > 0) {
2823 ifnet_t bound_interface = NULL;
2824 char interface_name[IFXNAMSIZ];
2825 memcpy(interface_name, value, length);
2826 interface_name[length - 1] = 0; // Make sure the string is NULL terminated
2827 if (ifnet_find_by_name(interface_name, &bound_interface) == 0) {
2828 parsed_parameters->required_interface_index = bound_interface->if_index;
2829 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF;
2830 ifnet_release(bound_interface);
2831 }
2832 }
2833 break;
2834 }
2835 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: {
2836 if (length >= sizeof(struct necp_policy_condition_addr)) {
2837 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
2838 if (necp_client_address_is_valid(&address_struct->address.sa)) {
2839 memcpy(&parsed_parameters->local_addr, &address_struct->address, sizeof(address_struct->address));
2840 if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
2841 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
2842 }
2843 if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
2844 (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
2845 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
2846 }
2847 }
2848 }
2849 break;
2850 }
2851 case NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT: {
2852 if (length >= sizeof(struct necp_client_endpoint)) {
2853 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2854 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2855 memcpy(&parsed_parameters->local_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
2856 if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
2857 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
2858 }
2859 if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
2860 (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
2861 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
2862 }
2863 }
2864 }
2865 break;
2866 }
2867 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
2868 if (length >= sizeof(struct necp_policy_condition_addr)) {
2869 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
2870 if (necp_client_address_is_valid(&address_struct->address.sa)) {
2871 memcpy(&parsed_parameters->remote_addr, &address_struct->address, sizeof(address_struct->address));
2872 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
2873 }
2874 }
2875 break;
2876 }
2877 case NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT: {
2878 if (length >= sizeof(struct necp_client_endpoint)) {
2879 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2880 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2881 memcpy(&parsed_parameters->remote_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
2882 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
2883 }
2884 }
2885 break;
2886 }
2887 case NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE: {
2888 if (num_prohibited_interfaces >= NECP_MAX_INTERFACE_PARAMETERS) {
2889 break;
2890 }
2891 if (length <= IFXNAMSIZ && length > 0) {
2892 memcpy(parsed_parameters->prohibited_interfaces[num_prohibited_interfaces], value, length);
2893 parsed_parameters->prohibited_interfaces[num_prohibited_interfaces][length - 1] = 0; // Make sure the string is NULL terminated
2894 num_prohibited_interfaces++;
2895 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF;
2896 }
2897 break;
2898 }
2899 case NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE: {
2900 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) {
2901 break;
2902 }
2903 if (length >= sizeof(u_int8_t)) {
2904 memcpy(&parsed_parameters->required_interface_type, value, sizeof(u_int8_t));
2905 if (parsed_parameters->required_interface_type) {
2906 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE;
2907 }
2908 }
2909 break;
2910 }
2911 case NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE: {
2912 if (num_prohibited_interface_types >= NECP_MAX_INTERFACE_PARAMETERS) {
2913 break;
2914 }
2915 if (length >= sizeof(u_int8_t)) {
2916 memcpy(&parsed_parameters->prohibited_interface_types[num_prohibited_interface_types], value, sizeof(u_int8_t));
2917 num_prohibited_interface_types++;
2918 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE;
2919 }
2920 break;
2921 }
2922 case NECP_CLIENT_PARAMETER_REQUIRE_AGENT: {
2923 if (num_required_agents >= NECP_MAX_AGENT_PARAMETERS) {
2924 break;
2925 }
2926 if (length >= sizeof(uuid_t)) {
2927 memcpy(&parsed_parameters->required_netagents[num_required_agents], value, sizeof(uuid_t));
2928 num_required_agents++;
2929 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT;
2930 }
2931 break;
2932 }
2933 case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT: {
2934 if (num_prohibited_agents >= NECP_MAX_AGENT_PARAMETERS) {
2935 break;
2936 }
2937 if (length >= sizeof(uuid_t)) {
2938 memcpy(&parsed_parameters->prohibited_netagents[num_prohibited_agents], value, sizeof(uuid_t));
2939 num_prohibited_agents++;
2940 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT;
2941 }
2942 break;
2943 }
2944 case NECP_CLIENT_PARAMETER_PREFER_AGENT: {
2945 if (num_preferred_agents >= NECP_MAX_AGENT_PARAMETERS) {
2946 break;
2947 }
2948 if (length >= sizeof(uuid_t)) {
2949 memcpy(&parsed_parameters->preferred_netagents[num_preferred_agents], value, sizeof(uuid_t));
2950 num_preferred_agents++;
2951 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT;
2952 }
2953 break;
2954 }
2955 case NECP_CLIENT_PARAMETER_AVOID_AGENT: {
2956 if (num_avoided_agents >= NECP_MAX_AGENT_PARAMETERS) {
2957 break;
2958 }
2959 if (length >= sizeof(uuid_t)) {
2960 memcpy(&parsed_parameters->avoided_netagents[num_avoided_agents], value, sizeof(uuid_t));
2961 num_avoided_agents++;
2962 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT;
2963 }
2964 break;
2965 }
2966 case NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE: {
2967 if (num_required_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2968 break;
2969 }
2970 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2971 memcpy(&parsed_parameters->required_netagent_types[num_required_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2972 num_required_agent_types++;
2973 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE;
2974 }
2975 break;
2976 }
2977 case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE: {
2978 if (num_prohibited_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2979 break;
2980 }
2981 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2982 memcpy(&parsed_parameters->prohibited_netagent_types[num_prohibited_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2983 num_prohibited_agent_types++;
2984 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE;
2985 }
2986 break;
2987 }
2988 case NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE: {
2989 if (num_preferred_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2990 break;
2991 }
2992 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2993 memcpy(&parsed_parameters->preferred_netagent_types[num_preferred_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2994 num_preferred_agent_types++;
2995 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE;
2996 }
2997 break;
2998 }
2999 case NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE: {
3000 if (num_avoided_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
3001 break;
3002 }
3003 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
3004 memcpy(&parsed_parameters->avoided_netagent_types[num_avoided_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
3005 num_avoided_agent_types++;
3006 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE;
3007 }
3008 break;
3009 }
3010 case NECP_CLIENT_PARAMETER_FLAGS: {
3011 if (length >= sizeof(u_int32_t)) {
3012 memcpy(&parsed_parameters->flags, value, sizeof(parsed_parameters->flags));
3013 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_FLAGS;
3014 }
3015 break;
3016 }
3017 case NECP_CLIENT_PARAMETER_IP_PROTOCOL: {
3018 if (length == sizeof(u_int16_t)) {
3019 u_int16_t large_ip_protocol = 0;
3020 memcpy(&large_ip_protocol, value, sizeof(large_ip_protocol));
3021 parsed_parameters->ip_protocol = (u_int8_t)large_ip_protocol;
3022 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL;
3023 } else if (length >= sizeof(parsed_parameters->ip_protocol)) {
3024 memcpy(&parsed_parameters->ip_protocol, value, sizeof(parsed_parameters->ip_protocol));
3025 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL;
3026 }
3027 break;
3028 }
3029 case NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL: {
3030 if (length >= sizeof(parsed_parameters->transport_protocol)) {
3031 memcpy(&parsed_parameters->transport_protocol, value, sizeof(parsed_parameters->transport_protocol));
3032 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL;
3033 }
3034 break;
3035 }
3036 case NECP_CLIENT_PARAMETER_PID: {
3037 if (length >= sizeof(parsed_parameters->effective_pid)) {
3038 memcpy(&parsed_parameters->effective_pid, value, sizeof(parsed_parameters->effective_pid));
3039 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID;
3040 }
3041 break;
3042 }
3043 case NECP_CLIENT_PARAMETER_DELEGATED_UPID: {
3044 if (length >= sizeof(parsed_parameters->delegated_upid)) {
3045 memcpy(&parsed_parameters->delegated_upid, value, sizeof(parsed_parameters->delegated_upid));
3046 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID;
3047 }
3048 break;
3049 }
3050 case NECP_CLIENT_PARAMETER_ETHERTYPE: {
3051 if (length >= sizeof(parsed_parameters->ethertype)) {
3052 memcpy(&parsed_parameters->ethertype, value, sizeof(parsed_parameters->ethertype));
3053 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_ETHERTYPE;
3054 }
3055 break;
3056 }
3057 case NECP_CLIENT_PARAMETER_APPLICATION: {
3058 if (length >= sizeof(parsed_parameters->effective_uuid)) {
3059 memcpy(&parsed_parameters->effective_uuid, value, sizeof(parsed_parameters->effective_uuid));
3060 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID;
3061 }
3062 break;
3063 }
3064 case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: {
3065 if (length >= sizeof(parsed_parameters->traffic_class)) {
3066 memcpy(&parsed_parameters->traffic_class, value, sizeof(parsed_parameters->traffic_class));
3067 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS;
3068 }
3069 break;
3070 }
3071 case NECP_CLIENT_PARAMETER_RESOLVER_TAG: {
3072 if (length > 0) {
3073 if (resolver_tag != NULL) {
3074 // Multiple resolver tags is invalid
3075 NECPLOG0(LOG_ERR, "Multiple resolver tags are not supported");
3076 error = EINVAL;
3077 } else {
3078 resolver_tag = (u_int8_t *)value;
3079 resolver_tag_length = length;
3080 }
3081 }
3082 break;
3083 }
3084 case NECP_CLIENT_PARAMETER_DOMAIN: {
3085 if (length > 0) {
3086 client_hostname = (u_int8_t *)value;
3087 hostname_length = length;
3088 }
3089 break;
3090 }
3091 case NECP_CLIENT_PARAMETER_PARENT_ID: {
3092 if (length == sizeof(parent_id)) {
3093 uuid_copy(parent_id, value);
3094 memcpy(&parsed_parameters->parent_uuid, value, sizeof(parsed_parameters->parent_uuid));
3095 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PARENT_UUID;
3096 }
3097 break;
3098 }
3099 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE: {
3100 if (length >= sizeof(parsed_parameters->local_address_preference)) {
3101 memcpy(&parsed_parameters->local_address_preference, value, sizeof(parsed_parameters->local_address_preference));
3102 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE;
3103 }
3104 break;
3105 }
3106 case NECP_CLIENT_PARAMETER_ATTRIBUTED_BUNDLE_IDENTIFIER: {
3107 if (length > 0) {
3108 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER;
3109 }
3110 break;
3111 }
3112 case NECP_CLIENT_PARAMETER_FLOW_DEMUX_PATTERN: {
3113 if (parsed_parameters->demux_pattern_count >= NECP_MAX_DEMUX_PATTERNS) {
3114 break;
3115 }
3116 if (length >= sizeof(struct necp_demux_pattern)) {
3117 memcpy(&parsed_parameters->demux_patterns[parsed_parameters->demux_pattern_count], value, sizeof(struct necp_demux_pattern));
3118 parsed_parameters->demux_pattern_count++;
3119 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_FLOW_DEMUX_PATTERN;
3120 }
3121 break;
3122 }
3123 case NECP_CLIENT_PARAMETER_APPLICATION_ID: {
3124 if (length >= sizeof(necp_application_id_t)) {
3125 necp_application_id_t *application_id = (necp_application_id_t *)(void *)value;
3126 // UID
3127 parsed_parameters->uid = application_id->uid;
3128 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_UID;
3129 // EUUID
3130 uuid_copy(parsed_parameters->effective_uuid, application_id->effective_uuid);
3131 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID;
3132 // PERSONA
3133 parsed_parameters->persona_id = application_id->persona_id;
3134 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PERSONA_ID;
3135 }
3136 break;
3137 }
3138 default: {
3139 break;
3140 }
3141 }
3142 }
3143
3144 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) {
3145 necp_client_trace_parameter_parsing(client, type, value, length);
3146 }
3147 }
3148
3149 offset += sizeof(struct necp_tlv_header) + length;
3150 }
3151
3152 if (resolver_tag != NULL) {
3153 struct necp_client_validatable *validatable = (struct necp_client_validatable *)resolver_tag;
3154 if (resolver_tag_length <= sizeof(struct necp_client_validatable)) {
3155 error = EINVAL;
3156 NECPLOG(LOG_ERR, "Resolver tag length too short: %u", resolver_tag_length);
3157 } else {
3158 bool matches = true;
3159
3160 // Check the client UUID for client-specific results
3161 if (validatable->signable.sign_type == NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER ||
3162 validatable->signable.sign_type == NECP_CLIENT_SIGN_TYPE_BROWSE_RESULT ||
3163 validatable->signable.sign_type == NECP_CLIENT_SIGN_TYPE_SERVICE_RESOLVER_ANSWER) {
3164 if (uuid_compare(parent_id, validatable->signable.client_id) != 0 &&
3165 uuid_compare(client->client_id, validatable->signable.client_id) != 0) {
3166 NECPLOG0(LOG_ERR, "Resolver tag invalid client ID");
3167 matches = false;
3168 }
3169 }
3170
3171 size_t data_length = resolver_tag_length - sizeof(struct necp_client_validatable);
3172 switch (validatable->signable.sign_type) {
3173 case NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER:
3174 case NECP_CLIENT_SIGN_TYPE_SYSTEM_RESOLVER_ANSWER: {
3175 if (data_length < (sizeof(struct necp_client_host_resolver_answer) - sizeof(struct necp_client_signable))) {
3176 NECPLOG0(LOG_ERR, "Resolver tag invalid length for resolver answer");
3177 matches = false;
3178 } else {
3179 struct necp_client_host_resolver_answer *answer_struct = (struct necp_client_host_resolver_answer *)&validatable->signable;
3180 if (data_length != (sizeof(struct necp_client_host_resolver_answer) + answer_struct->hostname_length - sizeof(struct necp_client_signable))) {
3181 NECPLOG0(LOG_ERR, "Resolver tag invalid length for resolver answer");
3182 matches = false;
3183 } else {
3184 if (answer_struct->hostname_length != 0 && // If the hostname on the signed answer is empty, ignore
3185 !necp_client_strings_are_equal((const char *)client_hostname, hostname_length,
3186 answer_struct->hostname, answer_struct->hostname_length)) {
3187 NECPLOG0(LOG_ERR, "Resolver tag hostname does not match");
3188 matches = false;
3189 } else if (answer_struct->address_answer.sa.sa_family != parsed_parameters->remote_addr.sa.sa_family ||
3190 answer_struct->address_answer.sa.sa_len != parsed_parameters->remote_addr.sa.sa_len) {
3191 NECPLOG0(LOG_ERR, "Resolver tag address type does not match");
3192 matches = false;
3193 } else if (answer_struct->address_answer.sin.sin_port != 0 && // If the port on the signed answer is empty, ignore
3194 answer_struct->address_answer.sin.sin_port != parsed_parameters->remote_addr.sin.sin_port) {
3195 NECPLOG0(LOG_ERR, "Resolver tag port does not match");
3196 matches = false;
3197 } else if ((answer_struct->address_answer.sa.sa_family == AF_INET &&
3198 answer_struct->address_answer.sin.sin_addr.s_addr != parsed_parameters->remote_addr.sin.sin_addr.s_addr) ||
3199 (answer_struct->address_answer.sa.sa_family == AF_INET6 &&
3200 memcmp(&answer_struct->address_answer.sin6.sin6_addr, &parsed_parameters->remote_addr.sin6.sin6_addr, sizeof(struct in6_addr)) != 0)) {
3201 NECPLOG0(LOG_ERR, "Resolver tag address does not match");
3202 matches = false;
3203 }
3204 }
3205 }
3206 break;
3207 }
3208 case NECP_CLIENT_SIGN_TYPE_BROWSE_RESULT:
3209 case NECP_CLIENT_SIGN_TYPE_SYSTEM_BROWSE_RESULT: {
3210 if (data_length < (sizeof(struct necp_client_browse_result) - sizeof(struct necp_client_signable))) {
3211 NECPLOG0(LOG_ERR, "Resolver tag invalid length for browse result");
3212 matches = false;
3213 } else {
3214 struct necp_client_browse_result *answer_struct = (struct necp_client_browse_result *)&validatable->signable;
3215 if (data_length != (sizeof(struct necp_client_browse_result) + answer_struct->service_length - sizeof(struct necp_client_signable))) {
3216 NECPLOG0(LOG_ERR, "Resolver tag invalid length for browse result");
3217 matches = false;
3218 }
3219 }
3220 break;
3221 }
3222 case NECP_CLIENT_SIGN_TYPE_SERVICE_RESOLVER_ANSWER:
3223 case NECP_CLIENT_SIGN_TYPE_SYSTEM_SERVICE_RESOLVER_ANSWER: {
3224 if (data_length < (sizeof(struct necp_client_service_resolver_answer) - sizeof(struct necp_client_signable))) {
3225 NECPLOG0(LOG_ERR, "Resolver tag invalid length for service resolver answer");
3226 matches = false;
3227 } else {
3228 struct necp_client_service_resolver_answer *answer_struct = (struct necp_client_service_resolver_answer *)&validatable->signable;
3229 if (data_length != (sizeof(struct necp_client_service_resolver_answer) + answer_struct->service_length + answer_struct->hostname_length - sizeof(struct necp_client_signable))) {
3230 NECPLOG0(LOG_ERR, "Resolver tag invalid length for service resolver answer");
3231 matches = false;
3232 }
3233 }
3234 break;
3235 }
3236 default: {
3237 NECPLOG(LOG_ERR, "Resolver tag unknown sign type: %u", validatable->signable.sign_type);
3238 matches = false;
3239 break;
3240 }
3241 }
3242 if (!matches) {
3243 error = EAUTH;
3244 } else {
3245 const bool validated = necp_validate_resolver_answer(validatable->signable.client_id,
3246 validatable->signable.sign_type,
3247 validatable->signable.signable_data, data_length,
3248 validatable->signature.signed_tag, sizeof(validatable->signature.signed_tag));
3249 if (!validated) {
3250 error = EAUTH;
3251 NECPLOG0(LOG_ERR, "Failed to validate resolve answer");
3252 }
3253 }
3254 }
3255 }
3256
3257 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) {
3258 necp_client_trace_parsed_parameters(client, parsed_parameters);
3259 }
3260
3261 return error;
3262 }
3263
3264 static int
necp_client_parse_result(u_int8_t * result,u_int32_t result_size,union necp_sockaddr_union * local_address,union necp_sockaddr_union * remote_address,void ** flow_stats)3265 necp_client_parse_result(u_int8_t *result,
3266 u_int32_t result_size,
3267 union necp_sockaddr_union *local_address,
3268 union necp_sockaddr_union *remote_address,
3269 void **flow_stats)
3270 {
3271 #pragma unused(flow_stats)
3272 int error = 0;
3273 size_t offset = 0;
3274
3275 while ((offset + sizeof(struct necp_tlv_header)) <= result_size) {
3276 u_int8_t type = necp_buffer_get_tlv_type(result, offset);
3277 u_int32_t length = necp_buffer_get_tlv_length(result, offset);
3278
3279 if (length > 0 && (offset + sizeof(struct necp_tlv_header) + length) <= result_size) {
3280 u_int8_t *value = necp_buffer_get_tlv_value(result, offset, NULL);
3281 if (value != NULL) {
3282 switch (type) {
3283 case NECP_CLIENT_RESULT_LOCAL_ENDPOINT: {
3284 if (length >= sizeof(struct necp_client_endpoint)) {
3285 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
3286 if (local_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
3287 memcpy(local_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
3288 }
3289 }
3290 break;
3291 }
3292 case NECP_CLIENT_RESULT_REMOTE_ENDPOINT: {
3293 if (length >= sizeof(struct necp_client_endpoint)) {
3294 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
3295 if (remote_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
3296 memcpy(remote_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
3297 }
3298 }
3299 break;
3300 }
3301 #if SKYWALK
3302 case NECP_CLIENT_RESULT_NEXUS_FLOW_STATS: {
3303 // this TLV contains flow_stats pointer which is refcnt'ed.
3304 if (flow_stats != NULL && length >= sizeof(struct sk_stats_flow *)) {
3305 struct flow_stats *fs = *(void **)(void *)value;
3306 // transfer the refcnt to flow_stats pointer
3307 *flow_stats = fs;
3308 }
3309 memset(value, 0, length); // nullify TLV always
3310 break;
3311 }
3312 #endif /* SKYWALK */
3313 default: {
3314 break;
3315 }
3316 }
3317 }
3318 }
3319
3320 offset += sizeof(struct necp_tlv_header) + length;
3321 }
3322
3323 return error;
3324 }
3325
3326 static struct necp_client_flow_registration *
necp_client_create_flow_registration(struct necp_fd_data * fd_data,struct necp_client * client)3327 necp_client_create_flow_registration(struct necp_fd_data *fd_data, struct necp_client *client)
3328 {
3329 NECP_FD_ASSERT_LOCKED(fd_data);
3330 NECP_CLIENT_ASSERT_LOCKED(client);
3331
3332 struct necp_client_flow_registration *new_registration = kalloc_type(struct necp_client_flow_registration, Z_WAITOK | Z_ZERO | Z_NOFAIL);
3333
3334 new_registration->last_interface_details = combine_interface_details(IFSCOPE_NONE, NSTAT_IFNET_IS_UNKNOWN_TYPE);
3335
3336 necp_generate_client_id(new_registration->registration_id, true);
3337 LIST_INIT(&new_registration->flow_list);
3338
3339 // Add registration to client list
3340 RB_INSERT(_necp_client_flow_tree, &client->flow_registrations, new_registration);
3341
3342 // Add registration to fd list
3343 RB_INSERT(_necp_fd_flow_tree, &fd_data->flows, new_registration);
3344
3345 // Add registration to global tree for lookup
3346 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
3347 RB_INSERT(_necp_client_flow_global_tree, &necp_client_flow_global_tree, new_registration);
3348 NECP_FLOW_TREE_UNLOCK();
3349
3350 new_registration->client = client;
3351
3352 #if SKYWALK
3353 {
3354 // The uuid caching here is something of a hack, but saves a dynamic lookup with attendant lock hierarchy issues
3355 uint64_t stats_event_type = (uuid_is_null(client->latest_flow_registration_id)) ? NSTAT_EVENT_SRC_FLOW_UUID_ASSIGNED : NSTAT_EVENT_SRC_FLOW_UUID_CHANGED;
3356 uuid_copy(client->latest_flow_registration_id, new_registration->registration_id);
3357
3358 // With the flow uuid known, push a new statistics update to ensure the uuid gets known by any clients before the flow can close
3359 if (client->nstat_context != NULL) {
3360 nstat_provider_stats_event(client->nstat_context, stats_event_type);
3361 }
3362 }
3363 #endif /* !SKYWALK */
3364
3365 // Start out assuming there is nothing to read from the flow
3366 new_registration->flow_result_read = true;
3367
3368 return new_registration;
3369 }
3370
3371 static void
necp_client_add_socket_flow(struct necp_client_flow_registration * flow_registration,struct inpcb * inp)3372 necp_client_add_socket_flow(struct necp_client_flow_registration *flow_registration,
3373 struct inpcb *inp)
3374 {
3375 struct necp_client_flow *new_flow = kalloc_type(struct necp_client_flow, Z_WAITOK | Z_ZERO | Z_NOFAIL);
3376
3377 new_flow->socket = TRUE;
3378 new_flow->u.socket_handle = inp;
3379 new_flow->u.cb = inp->necp_cb;
3380
3381 OSIncrementAtomic(&necp_socket_flow_count);
3382
3383 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
3384 }
3385
3386 static int
necp_client_register_socket_inner(pid_t pid,uuid_t client_id,struct inpcb * inp,bool is_listener)3387 necp_client_register_socket_inner(pid_t pid, uuid_t client_id, struct inpcb *inp, bool is_listener)
3388 {
3389 int error = 0;
3390 struct necp_fd_data *client_fd = NULL;
3391 bool found_client = FALSE;
3392
3393 NECP_FD_LIST_LOCK_SHARED();
3394 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3395 NECP_FD_LOCK(client_fd);
3396 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3397 if (client != NULL) {
3398 if (!pid || client->proc_pid == pid) {
3399 if (is_listener) {
3400 found_client = TRUE;
3401 #if SKYWALK
3402 // Check netns token for registration
3403 if (!NETNS_TOKEN_VALID(&client->port_reservation)) {
3404 error = EINVAL;
3405 }
3406 #endif /* !SKYWALK */
3407 } else {
3408 // Find client flow and assign from socket
3409 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3410 if (flow_registration != NULL) {
3411 // Found the right client and flow registration, add a new flow
3412 found_client = TRUE;
3413 necp_client_add_socket_flow(flow_registration, inp);
3414 } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
3415 // No flows yet on this client, add a new registration
3416 flow_registration = necp_client_create_flow_registration(client_fd, client);
3417 if (flow_registration == NULL) {
3418 error = ENOMEM;
3419 } else {
3420 // Add a new flow
3421 found_client = TRUE;
3422 necp_client_add_socket_flow(flow_registration, inp);
3423 }
3424 }
3425 }
3426 }
3427
3428 NECP_CLIENT_UNLOCK(client);
3429 }
3430 NECP_FD_UNLOCK(client_fd);
3431
3432 if (found_client) {
3433 break;
3434 }
3435 }
3436 NECP_FD_LIST_UNLOCK();
3437
3438 if (!found_client) {
3439 error = ENOENT;
3440 } else {
3441 // Count the sockets that have the NECP client UUID set
3442 struct socket *so = inp->inp_socket;
3443 if (!(so->so_flags1 & SOF1_HAS_NECP_CLIENT_UUID)) {
3444 so->so_flags1 |= SOF1_HAS_NECP_CLIENT_UUID;
3445 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_necp_clientuuid_total);
3446 }
3447 }
3448
3449 return error;
3450 }
3451
3452 int
necp_client_register_socket_flow(pid_t pid,uuid_t client_id,struct inpcb * inp)3453 necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp)
3454 {
3455 return necp_client_register_socket_inner(pid, client_id, inp, false);
3456 }
3457
3458 int
necp_client_register_socket_listener(pid_t pid,uuid_t client_id,struct inpcb * inp)3459 necp_client_register_socket_listener(pid_t pid, uuid_t client_id, struct inpcb *inp)
3460 {
3461 return necp_client_register_socket_inner(pid, client_id, inp, true);
3462 }
3463
3464 #if SKYWALK
3465 int
necp_client_get_netns_flow_info(uuid_t client_id,struct ns_flow_info * flow_info)3466 necp_client_get_netns_flow_info(uuid_t client_id, struct ns_flow_info *flow_info)
3467 {
3468 int error = 0;
3469 struct necp_fd_data *client_fd = NULL;
3470 bool found_client = FALSE;
3471
3472 NECP_FD_LIST_LOCK_SHARED();
3473 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3474 NECP_FD_LOCK(client_fd);
3475 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3476 if (client != NULL) {
3477 found_client = TRUE;
3478 if (!NETNS_TOKEN_VALID(&client->port_reservation)) {
3479 error = EINVAL;
3480 } else {
3481 error = netns_get_flow_info(&client->port_reservation, flow_info);
3482 }
3483
3484 NECP_CLIENT_UNLOCK(client);
3485 }
3486 NECP_FD_UNLOCK(client_fd);
3487
3488 if (found_client) {
3489 break;
3490 }
3491 }
3492 NECP_FD_LIST_UNLOCK();
3493
3494 if (!found_client) {
3495 error = ENOENT;
3496 }
3497
3498 return error;
3499 }
3500 #endif /* !SKYWALK */
3501
3502 static void
necp_client_add_multipath_interface_flows(struct necp_client_flow_registration * flow_registration,struct necp_client * client,struct mppcb * mpp)3503 necp_client_add_multipath_interface_flows(struct necp_client_flow_registration *flow_registration,
3504 struct necp_client *client,
3505 struct mppcb *mpp)
3506 {
3507 flow_registration->interface_handle = mpp;
3508 flow_registration->interface_cb = mpp->necp_cb;
3509
3510 proc_t proc = proc_find(client->proc_pid);
3511 if (proc == PROC_NULL) {
3512 return;
3513 }
3514
3515 // Traverse all interfaces and add a tracking flow if needed
3516 necp_flow_add_interface_flows(proc, client, flow_registration, true);
3517
3518 proc_rele(proc);
3519 proc = PROC_NULL;
3520 }
3521
3522 int
necp_client_register_multipath_cb(pid_t pid,uuid_t client_id,struct mppcb * mpp)3523 necp_client_register_multipath_cb(pid_t pid, uuid_t client_id, struct mppcb *mpp)
3524 {
3525 int error = 0;
3526 struct necp_fd_data *client_fd = NULL;
3527 bool found_client = FALSE;
3528
3529 NECP_FD_LIST_LOCK_SHARED();
3530 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3531 NECP_FD_LOCK(client_fd);
3532 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3533 if (client != NULL) {
3534 if (!pid || client->proc_pid == pid) {
3535 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3536 if (flow_registration != NULL) {
3537 // Found the right client and flow registration, add a new flow
3538 found_client = TRUE;
3539 necp_client_add_multipath_interface_flows(flow_registration, client, mpp);
3540 } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
3541 // No flows yet on this client, add a new registration
3542 flow_registration = necp_client_create_flow_registration(client_fd, client);
3543 if (flow_registration == NULL) {
3544 error = ENOMEM;
3545 } else {
3546 // Add a new flow
3547 found_client = TRUE;
3548 necp_client_add_multipath_interface_flows(flow_registration, client, mpp);
3549 }
3550 }
3551 }
3552
3553 NECP_CLIENT_UNLOCK(client);
3554 }
3555 NECP_FD_UNLOCK(client_fd);
3556
3557 if (found_client) {
3558 break;
3559 }
3560 }
3561 NECP_FD_LIST_UNLOCK();
3562
3563 if (!found_client && error == 0) {
3564 error = ENOENT;
3565 }
3566
3567 return error;
3568 }
3569
3570 #define NETAGENT_DOMAIN_RADIO_MANAGER "WirelessRadioManager"
3571 #define NETAGENT_TYPE_RADIO_MANAGER "WirelessRadioManager:BB Manager"
3572
3573 static int
necp_client_lookup_bb_radio_manager(struct necp_client * client,uuid_t netagent_uuid)3574 necp_client_lookup_bb_radio_manager(struct necp_client *client,
3575 uuid_t netagent_uuid)
3576 {
3577 char netagent_domain[NETAGENT_DOMAINSIZE];
3578 char netagent_type[NETAGENT_TYPESIZE];
3579 struct necp_aggregate_result result;
3580 proc_t proc;
3581 int error;
3582
3583 proc = proc_find(client->proc_pid);
3584 if (proc == PROC_NULL) {
3585 return ESRCH;
3586 }
3587
3588 error = necp_application_find_policy_match_internal(proc, client->parameters, (u_int32_t)client->parameters_length,
3589 &result, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL, true, true, NULL);
3590
3591 proc_rele(proc);
3592 proc = PROC_NULL;
3593
3594 if (error) {
3595 return error;
3596 }
3597
3598 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
3599 if (uuid_is_null(result.netagents[i])) {
3600 // Passed end of valid agents
3601 break;
3602 }
3603
3604 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
3605 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
3606 if (netagent_get_agent_domain_and_type(result.netagents[i], netagent_domain, netagent_type) == FALSE) {
3607 continue;
3608 }
3609
3610 if (strncmp(netagent_domain, NETAGENT_DOMAIN_RADIO_MANAGER, NETAGENT_DOMAINSIZE) != 0) {
3611 continue;
3612 }
3613
3614 if (strncmp(netagent_type, NETAGENT_TYPE_RADIO_MANAGER, NETAGENT_TYPESIZE) != 0) {
3615 continue;
3616 }
3617
3618 uuid_copy(netagent_uuid, result.netagents[i]);
3619
3620 break;
3621 }
3622
3623 return 0;
3624 }
3625
3626 static int
necp_client_assert_bb_radio_manager_common(struct necp_client * client,bool assert)3627 necp_client_assert_bb_radio_manager_common(struct necp_client *client, bool assert)
3628 {
3629 uuid_t netagent_uuid;
3630 uint8_t assert_type;
3631 int error;
3632
3633 error = necp_client_lookup_bb_radio_manager(client, netagent_uuid);
3634 if (error) {
3635 NECPLOG0(LOG_ERR, "BB radio manager agent not found");
3636 return error;
3637 }
3638
3639 // Before unasserting, verify that the assertion was already taken
3640 if (assert == FALSE) {
3641 assert_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
3642
3643 if (!necp_client_remove_assertion(client, netagent_uuid)) {
3644 return EINVAL;
3645 }
3646 } else {
3647 assert_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT;
3648 }
3649
3650 error = netagent_client_message(netagent_uuid, client->client_id, client->proc_pid, client->agent_handle, assert_type);
3651 if (error) {
3652 NECPLOG0(LOG_ERR, "netagent_client_message failed");
3653 return error;
3654 }
3655
3656 // Only save the assertion if the action succeeded
3657 if (assert == TRUE) {
3658 necp_client_add_assertion(client, netagent_uuid);
3659 }
3660
3661 return 0;
3662 }
3663
3664 int
necp_client_assert_bb_radio_manager(uuid_t client_id,bool assert)3665 necp_client_assert_bb_radio_manager(uuid_t client_id, bool assert)
3666 {
3667 struct necp_client *client;
3668 int error = 0;
3669
3670 NECP_CLIENT_TREE_LOCK_SHARED();
3671
3672 client = necp_find_client_and_lock(client_id);
3673
3674 if (client) {
3675 // Found the right client!
3676 error = necp_client_assert_bb_radio_manager_common(client, assert);
3677
3678 NECP_CLIENT_UNLOCK(client);
3679 } else {
3680 NECPLOG0(LOG_ERR, "Couldn't find client");
3681 error = ENOENT;
3682 }
3683
3684 NECP_CLIENT_TREE_UNLOCK();
3685
3686 return error;
3687 }
3688
3689 static int
necp_client_unregister_socket_flow(uuid_t client_id,void * handle)3690 necp_client_unregister_socket_flow(uuid_t client_id, void *handle)
3691 {
3692 int error = 0;
3693 struct necp_fd_data *client_fd = NULL;
3694 bool found_client = FALSE;
3695 bool client_updated = FALSE;
3696
3697 NECP_FD_LIST_LOCK_SHARED();
3698 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3699 NECP_FD_LOCK(client_fd);
3700
3701 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3702 if (client != NULL) {
3703 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3704 if (flow_registration != NULL) {
3705 // Found the right client and flow!
3706 found_client = TRUE;
3707
3708 // Remove flow assignment
3709 struct necp_client_flow *search_flow = NULL;
3710 struct necp_client_flow *temp_flow = NULL;
3711 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
3712 if (search_flow->socket && search_flow->u.socket_handle == handle) {
3713 if (search_flow->assigned_results != NULL) {
3714 kfree_data(search_flow->assigned_results, search_flow->assigned_results_length);
3715 search_flow->assigned_results = NULL;
3716 }
3717 client_updated = TRUE;
3718 flow_registration->flow_result_read = FALSE;
3719 LIST_REMOVE(search_flow, flow_chain);
3720 OSDecrementAtomic(&necp_socket_flow_count);
3721 kfree_type(struct necp_client_flow, search_flow);
3722 }
3723 }
3724 }
3725
3726 NECP_CLIENT_UNLOCK(client);
3727 }
3728
3729 if (client_updated) {
3730 necp_fd_notify(client_fd, true);
3731 }
3732 NECP_FD_UNLOCK(client_fd);
3733
3734 if (found_client) {
3735 break;
3736 }
3737 }
3738 NECP_FD_LIST_UNLOCK();
3739
3740 if (!found_client) {
3741 error = ENOENT;
3742 }
3743
3744 return error;
3745 }
3746
3747 static int
necp_client_unregister_multipath_cb(uuid_t client_id,void * handle)3748 necp_client_unregister_multipath_cb(uuid_t client_id, void *handle)
3749 {
3750 int error = 0;
3751 bool found_client = FALSE;
3752
3753 NECP_CLIENT_TREE_LOCK_SHARED();
3754
3755 struct necp_client *client = necp_find_client_and_lock(client_id);
3756 if (client != NULL) {
3757 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3758 if (flow_registration != NULL) {
3759 // Found the right client and flow!
3760 found_client = TRUE;
3761
3762 // Remove flow assignment
3763 struct necp_client_flow *search_flow = NULL;
3764 struct necp_client_flow *temp_flow = NULL;
3765 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
3766 if (!search_flow->socket && !search_flow->nexus &&
3767 search_flow->u.socket_handle == handle) {
3768 search_flow->u.socket_handle = NULL;
3769 search_flow->u.cb = NULL;
3770 }
3771 }
3772
3773 flow_registration->interface_handle = NULL;
3774 flow_registration->interface_cb = NULL;
3775 }
3776
3777 NECP_CLIENT_UNLOCK(client);
3778 }
3779
3780 NECP_CLIENT_TREE_UNLOCK();
3781
3782 if (!found_client) {
3783 error = ENOENT;
3784 }
3785
3786 return error;
3787 }
3788
3789 int
necp_client_assign_from_socket(pid_t pid,uuid_t client_id,struct inpcb * inp)3790 necp_client_assign_from_socket(pid_t pid, uuid_t client_id, struct inpcb *inp)
3791 {
3792 int error = 0;
3793 struct necp_fd_data *client_fd = NULL;
3794 bool found_client = FALSE;
3795 bool client_updated = FALSE;
3796
3797 NECP_FD_LIST_LOCK_SHARED();
3798 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3799 if (pid && client_fd->proc_pid != pid) {
3800 continue;
3801 }
3802
3803 proc_t proc = proc_find(client_fd->proc_pid);
3804 if (proc == PROC_NULL) {
3805 continue;
3806 }
3807
3808 NECP_FD_LOCK(client_fd);
3809
3810 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3811 if (client != NULL) {
3812 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3813 if (flow_registration == NULL && RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
3814 // No flows yet on this client, add a new registration
3815 flow_registration = necp_client_create_flow_registration(client_fd, client);
3816 if (flow_registration == NULL) {
3817 error = ENOMEM;
3818 }
3819 }
3820 if (flow_registration != NULL) {
3821 // Found the right client and flow!
3822 found_client = TRUE;
3823
3824 struct necp_client_flow *flow = NULL;
3825 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
3826 if (flow->socket && flow->u.socket_handle == inp) {
3827 // Release prior results and route
3828 if (flow->assigned_results != NULL) {
3829 kfree_data(flow->assigned_results, flow->assigned_results_length);
3830 flow->assigned_results = NULL;
3831 }
3832
3833 ifnet_t ifp = NULL;
3834 if ((inp->inp_flags & INP_BOUND_IF) && inp->inp_boundifp) {
3835 ifp = inp->inp_boundifp;
3836 } else {
3837 ifp = inp->inp_last_outifp;
3838 }
3839
3840 if (ifp != NULL) {
3841 flow->interface_index = ifp->if_index;
3842 } else {
3843 flow->interface_index = IFSCOPE_NONE;
3844 }
3845
3846 if (inp->inp_vflag & INP_IPV4) {
3847 flow->local_addr.sin.sin_family = AF_INET;
3848 flow->local_addr.sin.sin_len = sizeof(struct sockaddr_in);
3849 flow->local_addr.sin.sin_port = inp->inp_lport;
3850 memcpy(&flow->local_addr.sin.sin_addr, &inp->inp_laddr, sizeof(struct in_addr));
3851
3852 flow->remote_addr.sin.sin_family = AF_INET;
3853 flow->remote_addr.sin.sin_len = sizeof(struct sockaddr_in);
3854 flow->remote_addr.sin.sin_port = inp->inp_fport;
3855 memcpy(&flow->remote_addr.sin.sin_addr, &inp->inp_faddr, sizeof(struct in_addr));
3856 } else if (inp->inp_vflag & INP_IPV6) {
3857 in6_ip6_to_sockaddr(&inp->in6p_laddr, inp->inp_lport, inp->inp_lifscope, &flow->local_addr.sin6, sizeof(flow->local_addr));
3858 in6_ip6_to_sockaddr(&inp->in6p_faddr, inp->inp_fport, inp->inp_fifscope, &flow->remote_addr.sin6, sizeof(flow->remote_addr));
3859 }
3860
3861 flow->viable = necp_client_flow_is_viable(proc, client, flow);
3862
3863 uuid_t empty_uuid;
3864 uuid_clear(empty_uuid);
3865 flow->assigned = TRUE;
3866 flow->assigned_results = necp_create_nexus_assign_message(empty_uuid, 0, NULL, 0,
3867 (struct necp_client_endpoint *)&flow->local_addr,
3868 (struct necp_client_endpoint *)&flow->remote_addr,
3869 NULL, 0, NULL, &flow->assigned_results_length);
3870 flow_registration->flow_result_read = FALSE;
3871 client_updated = TRUE;
3872 break;
3873 }
3874 }
3875 }
3876
3877 NECP_CLIENT_UNLOCK(client);
3878 }
3879 if (client_updated) {
3880 necp_fd_notify(client_fd, true);
3881 }
3882 NECP_FD_UNLOCK(client_fd);
3883
3884 proc_rele(proc);
3885 proc = PROC_NULL;
3886
3887 if (found_client) {
3888 break;
3889 }
3890 }
3891 NECP_FD_LIST_UNLOCK();
3892
3893 if (error == 0) {
3894 if (!found_client) {
3895 error = ENOENT;
3896 } else if (!client_updated) {
3897 error = EINVAL;
3898 }
3899 }
3900
3901 return error;
3902 }
3903
3904 bool
necp_socket_is_allowed_to_recv_on_interface(struct inpcb * inp,ifnet_t interface)3905 necp_socket_is_allowed_to_recv_on_interface(struct inpcb *inp, ifnet_t interface)
3906 {
3907 if (interface == NULL ||
3908 inp == NULL ||
3909 !(inp->inp_flags2 & INP2_EXTERNAL_PORT) ||
3910 uuid_is_null(inp->necp_client_uuid)) {
3911 // If there's no interface or client ID to check,
3912 // or if this is not a listener, pass.
3913 // Outbound connections will have already been
3914 // validated for policy.
3915 return TRUE;
3916 }
3917
3918 // Only filter out listener sockets (no remote address specified)
3919 if ((inp->inp_vflag & INP_IPV4) &&
3920 inp->inp_faddr.s_addr != INADDR_ANY) {
3921 return TRUE;
3922 }
3923 if ((inp->inp_vflag & INP_IPV6) &&
3924 !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
3925 return TRUE;
3926 }
3927
3928 bool allowed = TRUE;
3929
3930 NECP_CLIENT_TREE_LOCK_SHARED();
3931
3932 struct necp_client *client = necp_find_client_and_lock(inp->necp_client_uuid);
3933 if (client != NULL) {
3934 struct necp_client_parsed_parameters *parsed_parameters = NULL;
3935
3936 parsed_parameters = kalloc_type(struct necp_client_parsed_parameters,
3937 Z_WAITOK | Z_ZERO | Z_NOFAIL);
3938 int error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, parsed_parameters);
3939 if (error == 0) {
3940 if (!necp_ifnet_matches_parameters(interface, parsed_parameters, 0, NULL, true, false)) {
3941 allowed = FALSE;
3942 }
3943 }
3944 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
3945
3946 NECP_CLIENT_UNLOCK(client);
3947 }
3948
3949 NECP_CLIENT_TREE_UNLOCK();
3950
3951 return allowed;
3952 }
3953
3954 int
necp_update_flow_protoctl_event(uuid_t netagent_uuid,uuid_t client_id,uint32_t protoctl_event_code,uint32_t protoctl_event_val,uint32_t protoctl_event_tcp_seq_number)3955 necp_update_flow_protoctl_event(uuid_t netagent_uuid, uuid_t client_id,
3956 uint32_t protoctl_event_code, uint32_t protoctl_event_val,
3957 uint32_t protoctl_event_tcp_seq_number)
3958 {
3959 int error = 0;
3960 struct necp_fd_data *client_fd = NULL;
3961 bool found_client = FALSE;
3962 bool client_updated = FALSE;
3963
3964 NECP_FD_LIST_LOCK_SHARED();
3965 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3966 proc_t proc = proc_find(client_fd->proc_pid);
3967 if (proc == PROC_NULL) {
3968 continue;
3969 }
3970
3971 NECP_FD_LOCK(client_fd);
3972
3973 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3974 if (client != NULL) {
3975 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3976 if (flow_registration != NULL) {
3977 // Found the right client and flow!
3978 found_client = TRUE;
3979
3980 struct necp_client_flow *flow = NULL;
3981 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
3982 // Verify that the client nexus agent matches
3983 if ((flow->nexus && uuid_compare(flow->u.nexus_agent, netagent_uuid) == 0) ||
3984 flow->socket) {
3985 flow->has_protoctl_event = TRUE;
3986 flow->protoctl_event.protoctl_event_code = protoctl_event_code;
3987 flow->protoctl_event.protoctl_event_val = protoctl_event_val;
3988 flow->protoctl_event.protoctl_event_tcp_seq_num = protoctl_event_tcp_seq_number;
3989 flow_registration->flow_result_read = FALSE;
3990 client_updated = TRUE;
3991 break;
3992 }
3993 }
3994 }
3995
3996 NECP_CLIENT_UNLOCK(client);
3997 }
3998
3999 if (client_updated) {
4000 necp_fd_notify(client_fd, true);
4001 }
4002
4003 NECP_FD_UNLOCK(client_fd);
4004 proc_rele(proc);
4005 proc = PROC_NULL;
4006
4007 if (found_client) {
4008 break;
4009 }
4010 }
4011 NECP_FD_LIST_UNLOCK();
4012
4013 if (!found_client) {
4014 error = ENOENT;
4015 } else if (!client_updated) {
4016 error = EINVAL;
4017 }
4018 return error;
4019 }
4020
4021 static bool
necp_assign_client_result_locked(struct proc * proc,struct necp_fd_data * client_fd,struct necp_client * client,struct necp_client_flow_registration * flow_registration,uuid_t netagent_uuid,u_int8_t * assigned_results,size_t assigned_results_length,bool notify_fd,bool assigned_from_userspace_agent)4022 necp_assign_client_result_locked(struct proc *proc,
4023 struct necp_fd_data *client_fd,
4024 struct necp_client *client,
4025 struct necp_client_flow_registration *flow_registration,
4026 uuid_t netagent_uuid,
4027 u_int8_t *assigned_results,
4028 size_t assigned_results_length,
4029 bool notify_fd,
4030 bool assigned_from_userspace_agent)
4031 {
4032 bool client_updated = FALSE;
4033
4034 NECP_FD_ASSERT_LOCKED(client_fd);
4035 NECP_CLIENT_ASSERT_LOCKED(client);
4036
4037 struct necp_client_flow *flow = NULL;
4038 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
4039 // Verify that the client nexus agent matches
4040 if (flow->nexus &&
4041 uuid_compare(flow->u.nexus_agent, netagent_uuid) == 0) {
4042 // Release prior results and route
4043 if (flow->assigned_results != NULL) {
4044 kfree_data(flow->assigned_results, flow->assigned_results_length);
4045 flow->assigned_results = NULL;
4046 }
4047
4048 void *nexus_stats = NULL;
4049 if (assigned_results != NULL && assigned_results_length > 0) {
4050 int error = necp_client_parse_result(assigned_results, (u_int32_t)assigned_results_length,
4051 &flow->local_addr, &flow->remote_addr,
4052 assigned_from_userspace_agent ? NULL : &nexus_stats); // Only assign stats from kernel agents
4053 VERIFY(error == 0);
4054 }
4055
4056 flow->viable = necp_client_flow_is_viable(proc, client, flow);
4057
4058 flow->assigned = TRUE;
4059 flow->assigned_results = assigned_results;
4060 flow->assigned_results_length = assigned_results_length;
4061 flow_registration->flow_result_read = FALSE;
4062 #if SKYWALK
4063 if (nexus_stats != NULL) {
4064 if (flow_registration->nexus_stats != NULL) {
4065 flow_stats_release(flow_registration->nexus_stats);
4066 }
4067 flow_registration->nexus_stats = nexus_stats;
4068 }
4069 #endif /* SKYWALK */
4070 client_updated = TRUE;
4071 break;
4072 }
4073 }
4074
4075 if (client_updated && notify_fd) {
4076 necp_fd_notify(client_fd, true);
4077 }
4078
4079 // if not updated, client must free assigned_results
4080 return client_updated;
4081 }
4082
4083 int
necp_assign_client_result(uuid_t netagent_uuid,uuid_t client_id,u_int8_t * assigned_results,size_t assigned_results_length)4084 necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id,
4085 u_int8_t *assigned_results, size_t assigned_results_length)
4086 {
4087 int error = 0;
4088 struct necp_fd_data *client_fd = NULL;
4089 bool found_client = FALSE;
4090 bool client_updated = FALSE;
4091
4092 NECP_FD_LIST_LOCK_SHARED();
4093
4094 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
4095 proc_t proc = proc_find(client_fd->proc_pid);
4096 if (proc == PROC_NULL) {
4097 continue;
4098 }
4099
4100 NECP_FD_LOCK(client_fd);
4101 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
4102 if (client != NULL) {
4103 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
4104 if (flow_registration != NULL) {
4105 // Found the right client and flow!
4106 found_client = TRUE;
4107 if (necp_assign_client_result_locked(proc, client_fd, client, flow_registration, netagent_uuid,
4108 assigned_results, assigned_results_length, true, true)) {
4109 client_updated = TRUE;
4110 }
4111 }
4112
4113 NECP_CLIENT_UNLOCK(client);
4114 }
4115 NECP_FD_UNLOCK(client_fd);
4116
4117 proc_rele(proc);
4118 proc = PROC_NULL;
4119
4120 if (found_client) {
4121 break;
4122 }
4123 }
4124
4125 NECP_FD_LIST_UNLOCK();
4126
4127 // upon error, client must free assigned_results
4128 if (!found_client) {
4129 error = ENOENT;
4130 } else if (!client_updated) {
4131 error = EINVAL;
4132 }
4133
4134 return error;
4135 }
4136
4137 int
necp_assign_client_group_members(uuid_t netagent_uuid,uuid_t client_id,u_int8_t * assigned_group_members,size_t assigned_group_members_length)4138 necp_assign_client_group_members(uuid_t netagent_uuid, uuid_t client_id,
4139 u_int8_t *assigned_group_members, size_t assigned_group_members_length)
4140 {
4141 #pragma unused(netagent_uuid)
4142 int error = 0;
4143 struct necp_fd_data *client_fd = NULL;
4144 bool found_client = false;
4145 bool client_updated = false;
4146
4147 NECP_FD_LIST_LOCK_SHARED();
4148
4149 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
4150 proc_t proc = proc_find(client_fd->proc_pid);
4151 if (proc == PROC_NULL) {
4152 continue;
4153 }
4154
4155 NECP_FD_LOCK(client_fd);
4156 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
4157 if (client != NULL) {
4158 found_client = true;
4159 // Release prior results
4160 if (client->assigned_group_members != NULL) {
4161 kfree_data(client->assigned_group_members, client->assigned_group_members_length);
4162 client->assigned_group_members = NULL;
4163 }
4164
4165 // Save new results
4166 client->assigned_group_members = assigned_group_members;
4167 client->assigned_group_members_length = assigned_group_members_length;
4168 client->group_members_read = false;
4169
4170 client_updated = true;
4171 necp_fd_notify(client_fd, true);
4172
4173 NECP_CLIENT_UNLOCK(client);
4174 }
4175 NECP_FD_UNLOCK(client_fd);
4176
4177 proc_rele(proc);
4178 proc = PROC_NULL;
4179
4180 if (found_client) {
4181 break;
4182 }
4183 }
4184
4185 NECP_FD_LIST_UNLOCK();
4186
4187 // upon error, client must free assigned_results
4188 if (!found_client) {
4189 error = ENOENT;
4190 } else if (!client_updated) {
4191 error = EINVAL;
4192 }
4193
4194 return error;
4195 }
4196
4197 /// Client updating
4198
4199 static bool
necp_update_parsed_parameters(struct necp_client_parsed_parameters * parsed_parameters,struct necp_aggregate_result * result)4200 necp_update_parsed_parameters(struct necp_client_parsed_parameters *parsed_parameters,
4201 struct necp_aggregate_result *result)
4202 {
4203 if (parsed_parameters == NULL ||
4204 result == NULL) {
4205 return false;
4206 }
4207
4208 bool updated = false;
4209 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
4210 if (uuid_is_null(result->netagents[i])) {
4211 // Passed end of valid agents
4212 break;
4213 }
4214
4215 if (!(result->netagent_use_flags[i] & NECP_AGENT_USE_FLAG_SCOPE)) {
4216 // Not a scoped agent, ignore
4217 continue;
4218 }
4219
4220 // This is a scoped agent. Add it to the required agents.
4221 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
4222 // Already some required agents, add this at the end
4223 for (int j = 0; j < NECP_MAX_AGENT_PARAMETERS; j++) {
4224 if (uuid_compare(parsed_parameters->required_netagents[j], result->netagents[i]) == 0) {
4225 // Already required, break
4226 break;
4227 }
4228 if (uuid_is_null(parsed_parameters->required_netagents[j])) {
4229 // Add here
4230 memcpy(&parsed_parameters->required_netagents[j], result->netagents[i], sizeof(uuid_t));
4231 updated = true;
4232 break;
4233 }
4234 }
4235 } else {
4236 // No required agents yet, add this one
4237 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT;
4238 memcpy(&parsed_parameters->required_netagents[0], result->netagents[i], sizeof(uuid_t));
4239 updated = true;
4240 }
4241
4242 // Remove requirements for agents of the same type
4243 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
4244 char remove_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
4245 char remove_agent_type[NETAGENT_TYPESIZE] = { 0 };
4246 if (netagent_get_agent_domain_and_type(result->netagents[i], remove_agent_domain, remove_agent_type)) {
4247 for (int j = 0; j < NECP_MAX_AGENT_PARAMETERS; j++) {
4248 if (strlen(parsed_parameters->required_netagent_types[j].netagent_domain) == 0 &&
4249 strlen(parsed_parameters->required_netagent_types[j].netagent_type) == 0) {
4250 break;
4251 }
4252
4253 if (strncmp(parsed_parameters->required_netagent_types[j].netagent_domain, remove_agent_domain, NETAGENT_DOMAINSIZE) == 0 &&
4254 strncmp(parsed_parameters->required_netagent_types[j].netagent_type, remove_agent_type, NETAGENT_TYPESIZE) == 0) {
4255 updated = true;
4256
4257 if (j == NECP_MAX_AGENT_PARAMETERS - 1) {
4258 // Last field, just clear and break
4259 memset(&parsed_parameters->required_netagent_types[NECP_MAX_AGENT_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
4260 break;
4261 } else {
4262 // Move the parameters down, clear the last entry
4263 memmove(&parsed_parameters->required_netagent_types[j],
4264 &parsed_parameters->required_netagent_types[j + 1],
4265 sizeof(struct necp_client_parameter_netagent_type) * (NECP_MAX_AGENT_PARAMETERS - (j + 1)));
4266 memset(&parsed_parameters->required_netagent_types[NECP_MAX_AGENT_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
4267 // Continue, don't increment but look at the new shifted item instead
4268 continue;
4269 }
4270 }
4271
4272 // Increment j to look at the next agent type parameter
4273 j++;
4274 }
4275 }
4276 }
4277 }
4278
4279 if (updated &&
4280 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4281 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) {
4282 // A required interface index was added after the fact. Clear it.
4283 parsed_parameters->required_interface_index = IFSCOPE_NONE;
4284 }
4285
4286
4287 return updated;
4288 }
4289
4290 static inline bool
necp_agent_types_match(const char * agent_domain1,const char * agent_type1,const char * agent_domain2,const char * agent_type2)4291 necp_agent_types_match(const char *agent_domain1, const char *agent_type1,
4292 const char *agent_domain2, const char *agent_type2)
4293 {
4294 return (strlen(agent_domain1) == 0 ||
4295 strncmp(agent_domain2, agent_domain1, NETAGENT_DOMAINSIZE) == 0) &&
4296 (strlen(agent_type1) == 0 ||
4297 strncmp(agent_type2, agent_type1, NETAGENT_TYPESIZE) == 0);
4298 }
4299
4300 static inline bool
necp_calculate_client_result(proc_t proc,struct necp_client * client,struct necp_client_parsed_parameters * parsed_parameters,struct necp_aggregate_result * result,u_int32_t * flags,u_int32_t * reason,struct necp_client_endpoint * v4_gateway,struct necp_client_endpoint * v6_gateway,uuid_t * override_euuid)4301 necp_calculate_client_result(proc_t proc,
4302 struct necp_client *client,
4303 struct necp_client_parsed_parameters *parsed_parameters,
4304 struct necp_aggregate_result *result,
4305 u_int32_t *flags,
4306 u_int32_t *reason,
4307 struct necp_client_endpoint *v4_gateway,
4308 struct necp_client_endpoint *v6_gateway,
4309 uuid_t *override_euuid)
4310 {
4311 struct rtentry *route = NULL;
4312
4313 // Check parameters to find best interface
4314 bool validate_agents = false;
4315 u_int matching_if_index = 0;
4316 if (necp_find_matching_interface_index(parsed_parameters, &matching_if_index, &validate_agents)) {
4317 if (matching_if_index != 0) {
4318 parsed_parameters->required_interface_index = matching_if_index;
4319 }
4320 // Interface found or not needed, match policy.
4321 memset(result, 0, sizeof(*result));
4322 int error = necp_application_find_policy_match_internal(proc, client->parameters,
4323 (u_int32_t)client->parameters_length,
4324 result, flags, reason, matching_if_index,
4325 NULL, NULL,
4326 v4_gateway, v6_gateway,
4327 &route, false, true,
4328 override_euuid);
4329 if (error != 0) {
4330 if (route != NULL) {
4331 rtfree(route);
4332 }
4333 return FALSE;
4334 }
4335
4336 if (validate_agents) {
4337 bool requirement_failed = FALSE;
4338 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
4339 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4340 if (uuid_is_null(parsed_parameters->required_netagents[i])) {
4341 break;
4342 }
4343
4344 bool requirement_found = FALSE;
4345 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4346 if (uuid_is_null(result->netagents[j])) {
4347 break;
4348 }
4349
4350 if (result->netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) {
4351 // A removed agent, ignore
4352 continue;
4353 }
4354
4355 if (uuid_compare(parsed_parameters->required_netagents[i], result->netagents[j]) == 0) {
4356 requirement_found = TRUE;
4357 break;
4358 }
4359 }
4360
4361 if (!requirement_found) {
4362 requirement_failed = TRUE;
4363 break;
4364 }
4365 }
4366 }
4367
4368 if (!requirement_failed && parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
4369 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4370 if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 &&
4371 strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
4372 break;
4373 }
4374
4375 bool requirement_found = FALSE;
4376 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4377 if (uuid_is_null(result->netagents[j])) {
4378 break;
4379 }
4380
4381 if (result->netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) {
4382 // A removed agent, ignore
4383 continue;
4384 }
4385
4386 char policy_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
4387 char policy_agent_type[NETAGENT_TYPESIZE] = { 0 };
4388
4389 if (netagent_get_agent_domain_and_type(result->netagents[j], policy_agent_domain, policy_agent_type)) {
4390 if (necp_agent_types_match(parsed_parameters->required_netagent_types[i].netagent_domain,
4391 parsed_parameters->required_netagent_types[i].netagent_type,
4392 policy_agent_domain, policy_agent_type)) {
4393 requirement_found = TRUE;
4394 break;
4395 }
4396 }
4397 }
4398
4399 if (!requirement_found) {
4400 requirement_failed = TRUE;
4401 break;
4402 }
4403 }
4404 }
4405
4406 if (requirement_failed) {
4407 // Agent requirement failed. Clear out the whole result, make everything fail.
4408 memset(result, 0, sizeof(*result));
4409 if (route != NULL) {
4410 rtfree(route);
4411 }
4412 return TRUE;
4413 }
4414 }
4415
4416 // Reset current route
4417 NECP_CLIENT_ROUTE_LOCK(client);
4418 if (client->current_route != NULL) {
4419 rtfree(client->current_route);
4420 }
4421 client->current_route = route;
4422 NECP_CLIENT_ROUTE_UNLOCK(client);
4423 } else {
4424 // Interface not found. Clear out the whole result, make everything fail.
4425 memset(result, 0, sizeof(*result));
4426 }
4427
4428 return TRUE;
4429 }
4430
4431 #define NECP_PARSED_PARAMETERS_REQUIRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF | \
4432 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
4433 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
4434 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE)
4435
4436 static bool
necp_update_client_result(proc_t proc,struct necp_fd_data * client_fd,struct necp_client * client,struct _necp_flow_defunct_list * defunct_list)4437 necp_update_client_result(proc_t proc,
4438 struct necp_fd_data *client_fd,
4439 struct necp_client *client,
4440 struct _necp_flow_defunct_list *defunct_list)
4441 {
4442 struct necp_client_result_netagent netagent;
4443 struct necp_aggregate_result result;
4444 struct necp_client_parsed_parameters *parsed_parameters = NULL;
4445 u_int32_t flags = 0;
4446 u_int32_t reason = 0;
4447
4448 NECP_CLIENT_ASSERT_LOCKED(client);
4449
4450 parsed_parameters = kalloc_type(struct necp_client_parsed_parameters,
4451 Z_WAITOK | Z_ZERO | Z_NOFAIL);
4452
4453 // Nexus flows will be brought back if they are still valid
4454 necp_client_mark_all_nonsocket_flows_as_invalid(client);
4455
4456 int error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, parsed_parameters);
4457 if (error != 0) {
4458 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4459 return FALSE;
4460 }
4461 bool originally_scoped = (parsed_parameters->required_interface_index != IFSCOPE_NONE);
4462
4463 // Update saved IP protocol
4464 client->ip_protocol = parsed_parameters->ip_protocol;
4465
4466 // Calculate the policy result
4467 struct necp_client_endpoint v4_gateway = {};
4468 struct necp_client_endpoint v6_gateway = {};
4469 uuid_t override_euuid;
4470 uuid_clear(override_euuid);
4471 if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags, &reason, &v4_gateway, &v6_gateway, &override_euuid)) {
4472 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4473 return FALSE;
4474 }
4475
4476 if (necp_update_parsed_parameters(parsed_parameters, &result)) {
4477 // Changed the parameters based on result, try again (only once)
4478 if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags, &reason, &v4_gateway, &v6_gateway, &override_euuid)) {
4479 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4480 return FALSE;
4481 }
4482 }
4483
4484 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
4485 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4486 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) {
4487 // Listener should not apply required interface index if
4488 parsed_parameters->required_interface_index = IFSCOPE_NONE;
4489 }
4490
4491 // Save the last policy id on the client
4492 client->policy_id = result.policy_id;
4493 client->skip_policy_id = result.skip_policy_id;
4494 uuid_copy(client->override_euuid, override_euuid);
4495
4496 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_MULTIPATH) ||
4497 (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) ||
4498 ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
4499 result.routing_result != NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED)) {
4500 client->allow_multiple_flows = TRUE;
4501 } else {
4502 client->allow_multiple_flows = FALSE;
4503 }
4504
4505 // If the original request was scoped, and the policy result matches, make sure the result is scoped
4506 if ((result.routing_result == NECP_KERNEL_POLICY_RESULT_NONE ||
4507 result.routing_result == NECP_KERNEL_POLICY_RESULT_PASS) &&
4508 result.routed_interface_index != IFSCOPE_NONE &&
4509 parsed_parameters->required_interface_index == result.routed_interface_index) {
4510 result.routing_result = NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED;
4511 result.routing_result_parameter.scoped_interface_index = result.routed_interface_index;
4512 }
4513
4514 if (defunct_list != NULL &&
4515 result.routing_result == NECP_KERNEL_POLICY_RESULT_DROP) {
4516 // If we are forced to drop the client, defunct it if it has flows
4517 necp_defunct_client_for_policy(client, defunct_list);
4518 }
4519
4520 // Recalculate flags
4521 if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
4522 // Listeners are valid as long as they aren't dropped
4523 if (result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP) {
4524 flags |= NECP_CLIENT_RESULT_FLAG_SATISFIED;
4525 }
4526 } else if (result.routed_interface_index != 0) {
4527 // Clients without flows determine viability based on having some routable interface
4528 flags |= NECP_CLIENT_RESULT_FLAG_SATISFIED;
4529 }
4530
4531 bool updated = FALSE;
4532 u_int8_t *cursor = client->result;
4533 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FLAGS, sizeof(flags), &flags, &updated, client->result, sizeof(client->result));
4534 if (reason != 0) {
4535 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_REASON, sizeof(reason), &reason, &updated, client->result, sizeof(client->result));
4536 }
4537 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_CLIENT_ID, sizeof(uuid_t), client->client_id, &updated,
4538 client->result, sizeof(client->result));
4539 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT, sizeof(result.routing_result), &result.routing_result, &updated,
4540 client->result, sizeof(client->result));
4541 if (result.routing_result_parameter.tunnel_interface_index != 0) {
4542 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER,
4543 sizeof(result.routing_result_parameter), &result.routing_result_parameter, &updated,
4544 client->result, sizeof(client->result));
4545 }
4546 if (result.filter_control_unit != 0) {
4547 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT,
4548 sizeof(result.filter_control_unit), &result.filter_control_unit, &updated,
4549 client->result, sizeof(client->result));
4550 }
4551 if (result.flow_divert_aggregate_unit != 0) {
4552 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FLOW_DIVERT_AGGREGATE_UNIT,
4553 sizeof(result.flow_divert_aggregate_unit), &result.flow_divert_aggregate_unit, &updated,
4554 client->result, sizeof(client->result));
4555 }
4556 if (result.routed_interface_index != 0) {
4557 u_int routed_interface_index = result.routed_interface_index;
4558 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
4559 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_REQUIRED_FIELDS) &&
4560 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4561 parsed_parameters->required_interface_index != result.routed_interface_index) {
4562 routed_interface_index = parsed_parameters->required_interface_index;
4563 }
4564
4565 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_INDEX,
4566 sizeof(routed_interface_index), &routed_interface_index, &updated,
4567 client->result, sizeof(client->result));
4568 }
4569 if (client_fd && client_fd->flags & NECP_OPEN_FLAG_BACKGROUND) {
4570 u_int32_t effective_traffic_class = SO_TC_BK_SYS;
4571 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS,
4572 sizeof(effective_traffic_class), &effective_traffic_class, &updated,
4573 client->result, sizeof(client->result));
4574 }
4575
4576 if (client_fd->background) {
4577 bool has_assigned_flow = FALSE;
4578 struct necp_client_flow_registration *flow_registration = NULL;
4579 struct necp_client_flow *search_flow = NULL;
4580 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
4581 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
4582 if (search_flow->assigned) {
4583 has_assigned_flow = TRUE;
4584 break;
4585 }
4586 }
4587 }
4588
4589 if (has_assigned_flow) {
4590 u_int32_t background = client_fd->background;
4591 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG,
4592 sizeof(background), &background, &updated,
4593 client->result, sizeof(client->result));
4594 }
4595 }
4596
4597 bool write_v4_gateway = !necp_client_endpoint_is_unspecified(&v4_gateway);
4598 bool write_v6_gateway = !necp_client_endpoint_is_unspecified(&v6_gateway);
4599
4600 NECP_CLIENT_ROUTE_LOCK(client);
4601 if (client->current_route != NULL) {
4602 const u_int32_t route_mtu = get_maxmtu(client->current_route);
4603 if (route_mtu != 0) {
4604 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_MTU,
4605 sizeof(route_mtu), &route_mtu, &updated,
4606 client->result, sizeof(client->result));
4607 }
4608 bool has_remote_addr = parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
4609 if (has_remote_addr && client->current_route->rt_gateway != NULL) {
4610 if (client->current_route->rt_gateway->sa_family == AF_INET) {
4611 write_v6_gateway = false;
4612 } else if (client->current_route->rt_gateway->sa_family == AF_INET6) {
4613 write_v4_gateway = false;
4614 }
4615 }
4616 }
4617 NECP_CLIENT_ROUTE_UNLOCK(client);
4618
4619 if (write_v4_gateway) {
4620 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_GATEWAY,
4621 sizeof(struct necp_client_endpoint), &v4_gateway, &updated,
4622 client->result, sizeof(client->result));
4623 }
4624
4625 if (write_v6_gateway) {
4626 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_GATEWAY,
4627 sizeof(struct necp_client_endpoint), &v6_gateway, &updated,
4628 client->result, sizeof(client->result));
4629 }
4630
4631 for (int i = 0; i < NAT64_MAX_NUM_PREFIXES; i++) {
4632 if (result.nat64_prefixes[i].prefix_len != 0) {
4633 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NAT64,
4634 sizeof(result.nat64_prefixes), result.nat64_prefixes, &updated,
4635 client->result, sizeof(client->result));
4636 break;
4637 }
4638 }
4639
4640 if (result.mss_recommended != 0) {
4641 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_RECOMMENDED_MSS,
4642 sizeof(result.mss_recommended), &result.mss_recommended, &updated,
4643 client->result, sizeof(client->result));
4644 }
4645
4646 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
4647 if (uuid_is_null(result.netagents[i])) {
4648 break;
4649 }
4650 if (result.netagent_use_flags[i] & NECP_AGENT_USE_FLAG_REMOVE) {
4651 // A removed agent, ignore
4652 continue;
4653 }
4654 uuid_copy(netagent.netagent_uuid, result.netagents[i]);
4655 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4656 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE, 0, 0)) {
4657 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4658 client->result, sizeof(client->result));
4659 }
4660 }
4661
4662 ifnet_head_lock_shared();
4663 ifnet_t direct_interface = NULL;
4664 ifnet_t delegate_interface = NULL;
4665 ifnet_t original_scoped_interface = NULL;
4666
4667 if (result.routed_interface_index != IFSCOPE_NONE && result.routed_interface_index <= (u_int32_t)if_index) {
4668 direct_interface = ifindex2ifnet[result.routed_interface_index];
4669 } else if (parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4670 parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
4671 // If the request was scoped, but the route didn't match, still grab the agents
4672 direct_interface = ifindex2ifnet[parsed_parameters->required_interface_index];
4673 } else if (result.routed_interface_index == IFSCOPE_NONE &&
4674 result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED &&
4675 result.routing_result_parameter.scoped_interface_index != IFSCOPE_NONE) {
4676 direct_interface = ifindex2ifnet[result.routing_result_parameter.scoped_interface_index];
4677 }
4678 if (direct_interface != NULL) {
4679 delegate_interface = direct_interface->if_delegated.ifp;
4680 }
4681 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
4682 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_REQUIRED_FIELDS) &&
4683 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4684 parsed_parameters->required_interface_index != result.routing_result_parameter.tunnel_interface_index &&
4685 parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
4686 original_scoped_interface = ifindex2ifnet[parsed_parameters->required_interface_index];
4687 }
4688 // Add interfaces
4689 if (original_scoped_interface != NULL) {
4690 struct necp_client_result_interface interface_struct;
4691 interface_struct.index = original_scoped_interface->if_index;
4692 interface_struct.generation = ifnet_get_generation(original_scoped_interface);
4693 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
4694 client->result, sizeof(client->result));
4695 }
4696 if (direct_interface != NULL) {
4697 struct necp_client_result_interface interface_struct;
4698 interface_struct.index = direct_interface->if_index;
4699 interface_struct.generation = ifnet_get_generation(direct_interface);
4700 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
4701 client->result, sizeof(client->result));
4702
4703 // Set the delta time since interface up/down
4704 struct timeval updown_delta = {};
4705 if (ifnet_updown_delta(direct_interface, &updown_delta) == 0) {
4706 u_int32_t delta = updown_delta.tv_sec;
4707 bool ignore_updated = FALSE;
4708 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_TIME_DELTA,
4709 sizeof(delta), &delta, &ignore_updated,
4710 client->result, sizeof(client->result));
4711 }
4712 }
4713 if (delegate_interface != NULL) {
4714 struct necp_client_result_interface interface_struct;
4715 interface_struct.index = delegate_interface->if_index;
4716 interface_struct.generation = ifnet_get_generation(delegate_interface);
4717 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
4718 client->result, sizeof(client->result));
4719 }
4720
4721 // Update multipath/listener interface flows
4722 if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_MULTIPATH) {
4723 // Add the interface option for the routed interface first
4724 if (direct_interface != NULL) {
4725 // Add nexus agent
4726 necp_client_add_agent_interface_options(client, parsed_parameters, direct_interface);
4727
4728 // Add interface option in case it is not a nexus
4729 necp_client_add_interface_option_if_needed(client, direct_interface->if_index,
4730 ifnet_get_generation(direct_interface), NULL, false);
4731 }
4732 if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INBOUND) {
4733 // For inbound multipath, add from the global list (like a listener)
4734 struct ifnet *multi_interface = NULL;
4735 TAILQ_FOREACH(multi_interface, &ifnet_head, if_link) {
4736 if ((multi_interface->if_flags & (IFF_UP | IFF_RUNNING)) &&
4737 necp_ifnet_matches_parameters(multi_interface, parsed_parameters, 0, NULL, true, false)) {
4738 // Add nexus agents for inbound multipath
4739 necp_client_add_agent_interface_options(client, parsed_parameters, multi_interface);
4740 }
4741 }
4742 } else {
4743 // Get other multipath interface options from ordered list
4744 struct ifnet *multi_interface = NULL;
4745 TAILQ_FOREACH(multi_interface, &ifnet_ordered_head, if_ordered_link) {
4746 if (multi_interface != direct_interface &&
4747 necp_ifnet_matches_parameters(multi_interface, parsed_parameters, 0, NULL, true, false)) {
4748 // Add nexus agents for multipath
4749 necp_client_add_agent_interface_options(client, parsed_parameters, multi_interface);
4750
4751 // Add multipath interface flows for kernel MPTCP
4752 necp_client_add_interface_option_if_needed(client, multi_interface->if_index,
4753 ifnet_get_generation(multi_interface), NULL, false);
4754 }
4755 }
4756 }
4757 } else if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
4758 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) {
4759 if (direct_interface != NULL) {
4760 // If scoped, only listen on that interface
4761 // Add nexus agents for listeners
4762 necp_client_add_agent_interface_options(client, parsed_parameters, direct_interface);
4763
4764 // Add interface option in case it is not a nexus
4765 necp_client_add_interface_option_if_needed(client, direct_interface->if_index,
4766 ifnet_get_generation(direct_interface), NULL, false);
4767 }
4768 } else {
4769 // Get listener interface options from global list
4770 struct ifnet *listen_interface = NULL;
4771 TAILQ_FOREACH(listen_interface, &ifnet_head, if_link) {
4772 if ((listen_interface->if_flags & (IFF_UP | IFF_RUNNING)) &&
4773 necp_ifnet_matches_parameters(listen_interface, parsed_parameters, 0, NULL, true, false)) {
4774 // Add nexus agents for listeners
4775 necp_client_add_agent_interface_options(client, parsed_parameters, listen_interface);
4776 }
4777 }
4778 }
4779 } else if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) {
4780 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED && originally_scoped) {
4781 if (direct_interface != NULL) {
4782 // Add browse option if it has an agent
4783 necp_client_add_browse_interface_options(client, parsed_parameters, direct_interface);
4784 }
4785 } else {
4786 // Get browse interface options from global list
4787 struct ifnet *browse_interface = NULL;
4788 TAILQ_FOREACH(browse_interface, &ifnet_head, if_link) {
4789 if (necp_ifnet_matches_parameters(browse_interface, parsed_parameters, 0, NULL, true, false)) {
4790 necp_client_add_browse_interface_options(client, parsed_parameters, browse_interface);
4791 }
4792 }
4793 }
4794 }
4795
4796 struct necp_client_result_estimated_throughput throughput = {
4797 .up = 0,
4798 .down = 0,
4799 };
4800
4801 // Add agents
4802 if (original_scoped_interface != NULL) {
4803 ifnet_lock_shared(original_scoped_interface);
4804 if (original_scoped_interface->if_agentids != NULL) {
4805 for (u_int32_t i = 0; i < original_scoped_interface->if_agentcount; i++) {
4806 if (uuid_is_null(original_scoped_interface->if_agentids[i])) {
4807 continue;
4808 }
4809 bool skip_agent = false;
4810 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4811 if (uuid_is_null(result.netagents[j])) {
4812 break;
4813 }
4814 if ((result.netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) &&
4815 uuid_compare(original_scoped_interface->if_agentids[i], result.netagents[j]) == 0) {
4816 skip_agent = true;
4817 break;
4818 }
4819 }
4820 if (skip_agent) {
4821 continue;
4822 }
4823 uuid_copy(netagent.netagent_uuid, original_scoped_interface->if_agentids[i]);
4824 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4825 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE,
4826 original_scoped_interface->if_index, ifnet_get_generation(original_scoped_interface))) {
4827 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4828 client->result, sizeof(client->result));
4829 }
4830 }
4831 }
4832 ifnet_lock_done(original_scoped_interface);
4833 }
4834 if (direct_interface != NULL) {
4835 ifnet_lock_shared(direct_interface);
4836 throughput.up = direct_interface->if_estimated_up_bucket;
4837 throughput.down = direct_interface->if_estimated_down_bucket;
4838 if (direct_interface->if_agentids != NULL) {
4839 for (u_int32_t i = 0; i < direct_interface->if_agentcount; i++) {
4840 if (uuid_is_null(direct_interface->if_agentids[i])) {
4841 continue;
4842 }
4843 bool skip_agent = false;
4844 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4845 if (uuid_is_null(result.netagents[j])) {
4846 break;
4847 }
4848 if ((result.netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) &&
4849 uuid_compare(direct_interface->if_agentids[i], result.netagents[j]) == 0) {
4850 skip_agent = true;
4851 break;
4852 }
4853 }
4854 if (skip_agent) {
4855 continue;
4856 }
4857 uuid_copy(netagent.netagent_uuid, direct_interface->if_agentids[i]);
4858 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4859 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE,
4860 direct_interface->if_index, ifnet_get_generation(direct_interface))) {
4861 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4862 client->result, sizeof(client->result));
4863 }
4864 }
4865 }
4866 ifnet_lock_done(direct_interface);
4867 }
4868 if (delegate_interface != NULL) {
4869 ifnet_lock_shared(delegate_interface);
4870 if (throughput.up == 0 && throughput.down == 0) {
4871 throughput.up = delegate_interface->if_estimated_up_bucket;
4872 throughput.down = delegate_interface->if_estimated_down_bucket;
4873 }
4874 if (delegate_interface->if_agentids != NULL) {
4875 for (u_int32_t i = 0; i < delegate_interface->if_agentcount; i++) {
4876 if (uuid_is_null(delegate_interface->if_agentids[i])) {
4877 continue;
4878 }
4879 bool skip_agent = false;
4880 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4881 if (uuid_is_null(result.netagents[j])) {
4882 break;
4883 }
4884 if ((result.netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) &&
4885 uuid_compare(delegate_interface->if_agentids[i], result.netagents[j]) == 0) {
4886 skip_agent = true;
4887 break;
4888 }
4889 }
4890 if (skip_agent) {
4891 continue;
4892 }
4893 uuid_copy(netagent.netagent_uuid, delegate_interface->if_agentids[i]);
4894 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4895 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE,
4896 delegate_interface->if_index, ifnet_get_generation(delegate_interface))) {
4897 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4898 client->result, sizeof(client->result));
4899 }
4900 }
4901 }
4902 ifnet_lock_done(delegate_interface);
4903 }
4904 ifnet_head_done();
4905
4906 if (throughput.up != 0 || throughput.down != 0) {
4907 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_ESTIMATED_THROUGHPUT,
4908 sizeof(throughput), &throughput, &updated, client->result, sizeof(client->result));
4909 }
4910
4911 // Add interface options
4912 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
4913 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
4914 struct necp_client_interface_option *option = &client->interface_options[option_i];
4915 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated,
4916 client->result, sizeof(client->result));
4917 } else {
4918 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
4919 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated,
4920 client->result, sizeof(client->result));
4921 }
4922 }
4923
4924 size_t new_result_length = (cursor - client->result);
4925 if (new_result_length != client->result_length) {
4926 client->result_length = new_result_length;
4927 updated = TRUE;
4928 }
4929
4930 // Update flow viability/flags
4931 if (necp_client_update_flows(proc, client, defunct_list)) {
4932 updated = TRUE;
4933 }
4934
4935 if (updated) {
4936 client->result_read = FALSE;
4937 necp_client_update_observer_update(client);
4938 }
4939
4940 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4941 return updated;
4942 }
4943
4944 static bool
necp_defunct_client_fd_locked_inner(struct necp_fd_data * client_fd,struct _necp_flow_defunct_list * defunct_list,bool destroy_stats)4945 necp_defunct_client_fd_locked_inner(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, bool destroy_stats)
4946 {
4947 bool updated_result = FALSE;
4948 struct necp_client *client = NULL;
4949
4950 NECP_FD_ASSERT_LOCKED(client_fd);
4951
4952 RB_FOREACH(client, _necp_client_tree, &client_fd->clients) {
4953 struct necp_client_flow_registration *flow_registration = NULL;
4954
4955 NECP_CLIENT_LOCK(client);
4956
4957 // Prepare close events to be sent to the nexus to effectively remove the flows
4958 struct necp_client_flow *search_flow = NULL;
4959 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
4960 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
4961 if (search_flow->nexus &&
4962 !uuid_is_null(search_flow->u.nexus_agent)) {
4963 // Sleeping alloc won't fail; copy only what's necessary
4964 struct necp_flow_defunct *flow_defunct = kalloc_type(struct necp_flow_defunct, Z_WAITOK | Z_ZERO);
4965 uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent);
4966 uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
4967 client->client_id :
4968 flow_registration->registration_id));
4969 flow_defunct->proc_pid = client->proc_pid;
4970 flow_defunct->agent_handle = client->agent_handle;
4971 flow_defunct->flags = flow_registration->flags;
4972 #if SKYWALK
4973 if (flow_registration->kstats_kaddr != NULL) {
4974 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
4975 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
4976 if (quicstats != NULL &&
4977 quicstats->necp_quic_udp_stats.necp_udp_hdr.necp_stats_type == NECP_CLIENT_STATISTICS_TYPE_QUIC) {
4978 memcpy(flow_defunct->close_parameters.u.close_token, quicstats->necp_quic_extra.ssr_token, sizeof(flow_defunct->close_parameters.u.close_token));
4979 flow_defunct->has_close_parameters = true;
4980 }
4981 }
4982 #endif /* SKYWALK */
4983 // Add to the list provided by caller
4984 LIST_INSERT_HEAD(defunct_list, flow_defunct, chain);
4985
4986 flow_registration->defunct = true;
4987 flow_registration->flow_result_read = false;
4988 updated_result = true;
4989 }
4990 }
4991 }
4992 if (destroy_stats) {
4993 #if SKYWALK
4994 // Free any remaining stats objects back to the arena where they came from;
4995 // do this independent of the above defunct check, as the client may have
4996 // been marked as defunct separately via necp_defunct_client_for_policy().
4997 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
4998 necp_destroy_flow_stats(client_fd, flow_registration, NULL, FALSE);
4999 }
5000 #endif /* SKYWALK */
5001 }
5002 NECP_CLIENT_UNLOCK(client);
5003 }
5004
5005 return updated_result;
5006 }
5007
5008 static inline void
necp_defunct_client_fd_locked(struct necp_fd_data * client_fd,struct _necp_flow_defunct_list * defunct_list,struct proc * proc)5009 necp_defunct_client_fd_locked(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, struct proc *proc)
5010 {
5011 #pragma unused(proc)
5012 bool updated_result = FALSE;
5013
5014 NECP_FD_ASSERT_LOCKED(client_fd);
5015 #if SKYWALK
5016 // redirect regions of currently-active stats arena to zero-filled pages
5017 struct necp_arena_info *nai = necp_fd_mredirect_stats_arena(client_fd, proc);
5018 #endif /* SKYWALK */
5019
5020 updated_result = necp_defunct_client_fd_locked_inner(client_fd, defunct_list, true);
5021
5022 #if SKYWALK
5023 // and tear down the currently-active arena's regions now that the redirection and freeing are done
5024 if (nai != NULL) {
5025 ASSERT((nai->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT)) == NAIF_REDIRECT);
5026 ASSERT(nai->nai_arena != NULL);
5027 ASSERT(nai->nai_mmap.ami_mapref != NULL);
5028
5029 int err = skmem_arena_defunct(nai->nai_arena);
5030 VERIFY(err == 0);
5031
5032 nai->nai_flags |= NAIF_DEFUNCT;
5033 }
5034 #endif /* SKYWALK */
5035
5036 if (updated_result) {
5037 necp_fd_notify(client_fd, true);
5038 }
5039 }
5040
5041 static inline void
necp_update_client_fd_locked(struct necp_fd_data * client_fd,proc_t proc,struct _necp_flow_defunct_list * defunct_list)5042 necp_update_client_fd_locked(struct necp_fd_data *client_fd,
5043 proc_t proc,
5044 struct _necp_flow_defunct_list *defunct_list)
5045 {
5046 struct necp_client *client = NULL;
5047 bool updated_result = FALSE;
5048 NECP_FD_ASSERT_LOCKED(client_fd);
5049 RB_FOREACH(client, _necp_client_tree, &client_fd->clients) {
5050 NECP_CLIENT_LOCK(client);
5051 if (necp_update_client_result(proc, client_fd, client, defunct_list)) {
5052 updated_result = TRUE;
5053 }
5054 NECP_CLIENT_UNLOCK(client);
5055 }
5056
5057 // Check if this PID needs to request in-process flow divert
5058 NECP_FD_LIST_ASSERT_LOCKED();
5059 for (int i = 0; i < NECP_MAX_FLOW_DIVERT_NEEDED_PIDS; i++) {
5060 if (necp_flow_divert_needed_pids[i] == 0) {
5061 break;
5062 }
5063 if (necp_flow_divert_needed_pids[i] == client_fd->proc_pid) {
5064 client_fd->request_in_process_flow_divert = true;
5065 break;
5066 }
5067 }
5068
5069 if (updated_result || client_fd->request_in_process_flow_divert) {
5070 necp_fd_notify(client_fd, true);
5071 }
5072 }
5073
5074 #if SKYWALK
5075 static void
necp_close_empty_arenas_callout(__unused thread_call_param_t dummy,__unused thread_call_param_t arg)5076 necp_close_empty_arenas_callout(__unused thread_call_param_t dummy,
5077 __unused thread_call_param_t arg)
5078 {
5079 struct necp_fd_data *client_fd = NULL;
5080
5081 NECP_FD_LIST_LOCK_SHARED();
5082
5083 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
5084 NECP_FD_LOCK(client_fd);
5085 necp_stats_arenas_destroy(client_fd, FALSE);
5086 NECP_FD_UNLOCK(client_fd);
5087 }
5088
5089 NECP_FD_LIST_UNLOCK();
5090 }
5091 #endif /* SKYWALK */
5092
5093 static void
necp_update_all_clients_callout(__unused thread_call_param_t dummy,__unused thread_call_param_t arg)5094 necp_update_all_clients_callout(__unused thread_call_param_t dummy,
5095 __unused thread_call_param_t arg)
5096 {
5097 struct necp_fd_data *client_fd = NULL;
5098
5099 NECP_UPDATE_ALL_CLIENTS_LOCK_EXCLUSIVE();
5100 uint32_t count = necp_update_all_clients_sched_cnt;
5101 necp_update_all_clients_sched_cnt = 0;
5102 necp_update_all_clients_sched_abstime = 0;
5103 NECP_UPDATE_ALL_CLIENTS_UNLOCK();
5104
5105 if (necp_debug > 0) {
5106 NECPLOG(LOG_DEBUG,
5107 "necp_update_all_clients_callout running for coalesced %u updates",
5108 count);
5109 }
5110
5111 struct _necp_flow_defunct_list defunct_list;
5112 LIST_INIT(&defunct_list);
5113
5114 NECP_FD_LIST_LOCK_SHARED();
5115
5116 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
5117 proc_t proc = proc_find(client_fd->proc_pid);
5118 if (proc == PROC_NULL) {
5119 continue;
5120 }
5121
5122 // Update all clients on one fd
5123 NECP_FD_LOCK(client_fd);
5124 necp_update_client_fd_locked(client_fd, proc, &defunct_list);
5125 NECP_FD_UNLOCK(client_fd);
5126
5127 proc_rele(proc);
5128 proc = PROC_NULL;
5129 }
5130
5131 // Reset the necp_flow_divert_needed_pids list
5132 for (int i = 0; i < NECP_MAX_FLOW_DIVERT_NEEDED_PIDS; i++) {
5133 necp_flow_divert_needed_pids[i] = 0;
5134 }
5135
5136 NECP_FD_LIST_UNLOCK();
5137
5138 // Handle the case in which some clients became newly defunct
5139 necp_process_defunct_list(&defunct_list);
5140 }
5141
5142 void
necp_update_all_clients(void)5143 necp_update_all_clients(void)
5144 {
5145 necp_update_all_clients_immediately_if_needed(false);
5146 }
5147
5148 void
necp_update_all_clients_immediately_if_needed(bool should_update_immediately)5149 necp_update_all_clients_immediately_if_needed(bool should_update_immediately)
5150 {
5151 if (necp_client_update_tcall == NULL) {
5152 // Don't try to update clients if the module is not initialized
5153 return;
5154 }
5155
5156 uint64_t deadline = 0;
5157 uint64_t leeway = 0;
5158
5159 uint32_t timeout_to_use = necp_timeout_microseconds;
5160 uint32_t leeway_to_use = necp_timeout_leeway_microseconds;
5161 if (should_update_immediately) {
5162 timeout_to_use = 1000 * 10; // 10ms
5163 leeway_to_use = 1000 * 10; // 10ms;
5164 }
5165
5166 clock_interval_to_deadline(timeout_to_use, NSEC_PER_USEC, &deadline);
5167 clock_interval_to_absolutetime_interval(leeway_to_use, NSEC_PER_USEC, &leeway);
5168
5169 NECP_UPDATE_ALL_CLIENTS_LOCK_EXCLUSIVE();
5170 bool need_cancel = false;
5171 bool need_schedule = true;
5172 uint64_t sched_abstime;
5173
5174 clock_absolutetime_interval_to_deadline(deadline + leeway, &sched_abstime);
5175
5176 /*
5177 * Do not push the timer if it is already scheduled
5178 */
5179 if (necp_update_all_clients_sched_abstime != 0) {
5180 need_schedule = false;
5181
5182 if (should_update_immediately) {
5183 /*
5184 * To update immediately we may have to cancel the current timer
5185 * if it's scheduled too far out.
5186 */
5187 if (necp_update_all_clients_sched_abstime > sched_abstime) {
5188 need_cancel = true;
5189 need_schedule = true;
5190 }
5191 }
5192 }
5193
5194 /*
5195 * Record the time of the deadline with leeway
5196 */
5197 if (need_schedule) {
5198 necp_update_all_clients_sched_abstime = sched_abstime;
5199 }
5200
5201 necp_update_all_clients_sched_cnt += 1;
5202 uint32_t count = necp_update_all_clients_sched_cnt;
5203 NECP_UPDATE_ALL_CLIENTS_UNLOCK();
5204
5205 if (need_schedule) {
5206 /*
5207 * Wait if the thread call is currently executing to make sure the
5208 * next update will be delivered to all clients
5209 */
5210 if (need_cancel) {
5211 (void) thread_call_cancel_wait(necp_client_update_tcall);
5212 }
5213
5214 (void) thread_call_enter_delayed_with_leeway(necp_client_update_tcall, NULL,
5215 deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
5216 }
5217 if (necp_debug > 0) {
5218 NECPLOG(LOG_DEBUG,
5219 "necp_update_all_clients immediate %s update %u",
5220 should_update_immediately ? "true" : "false", count);
5221 }
5222 }
5223
5224 bool
necp_set_client_as_background(proc_t proc,struct fileproc * fp,bool background)5225 necp_set_client_as_background(proc_t proc,
5226 struct fileproc *fp,
5227 bool background)
5228 {
5229 if (proc == PROC_NULL) {
5230 NECPLOG0(LOG_ERR, "NULL proc");
5231 return FALSE;
5232 }
5233
5234 if (fp == NULL) {
5235 NECPLOG0(LOG_ERR, "NULL fp");
5236 return FALSE;
5237 }
5238
5239 struct necp_fd_data *client_fd = (struct necp_fd_data *)fp_get_data(fp);
5240 if (client_fd == NULL) {
5241 NECPLOG0(LOG_ERR, "Could not find client structure for backgrounded client");
5242 return FALSE;
5243 }
5244
5245 if (client_fd->necp_fd_type != necp_fd_type_client) {
5246 // Not a client fd, ignore
5247 NECPLOG0(LOG_ERR, "Not a client fd, ignore");
5248 return FALSE;
5249 }
5250
5251 client_fd->background = background;
5252
5253 return TRUE;
5254 }
5255
5256 void
necp_fd_memstatus(proc_t proc,uint32_t status,struct necp_fd_data * client_fd)5257 necp_fd_memstatus(proc_t proc, uint32_t status,
5258 struct necp_fd_data *client_fd)
5259 {
5260 #pragma unused(proc, status, client_fd)
5261 ASSERT(proc != PROC_NULL);
5262 ASSERT(client_fd != NULL);
5263
5264 // Nothing to reap for the process or client for now,
5265 // but this is where we would trigger that in future.
5266 }
5267
5268 void
necp_fd_defunct(proc_t proc,struct necp_fd_data * client_fd)5269 necp_fd_defunct(proc_t proc, struct necp_fd_data *client_fd)
5270 {
5271 struct _necp_flow_defunct_list defunct_list;
5272
5273 ASSERT(proc != PROC_NULL);
5274 ASSERT(client_fd != NULL);
5275
5276 if (client_fd->necp_fd_type != necp_fd_type_client) {
5277 // Not a client fd, ignore
5278 return;
5279 }
5280
5281 // Our local temporary list
5282 LIST_INIT(&defunct_list);
5283
5284 // Need to hold lock so ntstats defunct the same set of clients
5285 NECP_FD_LOCK(client_fd);
5286 #if SKYWALK
5287 // Shut down statistics
5288 nstats_userland_stats_defunct_for_process(proc_getpid(proc));
5289 #endif /* SKYWALK */
5290 necp_defunct_client_fd_locked(client_fd, &defunct_list, proc);
5291 NECP_FD_UNLOCK(client_fd);
5292
5293 necp_process_defunct_list(&defunct_list);
5294 }
5295
5296 void
necp_client_request_in_process_flow_divert(pid_t pid)5297 necp_client_request_in_process_flow_divert(pid_t pid)
5298 {
5299 if (pid == 0) {
5300 return;
5301 }
5302
5303 // Add to the list of pids that should get an update. These will
5304 // get picked up on the next thread call to update client paths.
5305 NECP_FD_LIST_LOCK_SHARED();
5306 for (int i = 0; i < NECP_MAX_FLOW_DIVERT_NEEDED_PIDS; i++) {
5307 if (necp_flow_divert_needed_pids[i] == 0) {
5308 necp_flow_divert_needed_pids[i] = pid;
5309 break;
5310 }
5311 }
5312 NECP_FD_LIST_UNLOCK();
5313 }
5314
5315 static void
necp_client_remove_agent_from_result(struct necp_client * client,uuid_t netagent_uuid)5316 necp_client_remove_agent_from_result(struct necp_client *client, uuid_t netagent_uuid)
5317 {
5318 size_t offset = 0;
5319
5320 u_int8_t *result_buffer = client->result;
5321 while ((offset + sizeof(struct necp_tlv_header)) <= client->result_length) {
5322 u_int8_t type = necp_buffer_get_tlv_type(result_buffer, offset);
5323 u_int32_t length = necp_buffer_get_tlv_length(result_buffer, offset);
5324
5325 size_t tlv_total_length = (sizeof(struct necp_tlv_header) + length);
5326 if (type == NECP_CLIENT_RESULT_NETAGENT &&
5327 length == sizeof(struct necp_client_result_netagent) &&
5328 (offset + tlv_total_length) <= client->result_length) {
5329 struct necp_client_result_netagent *value = ((struct necp_client_result_netagent *)(void *)
5330 necp_buffer_get_tlv_value(result_buffer, offset, NULL));
5331 if (uuid_compare(value->netagent_uuid, netagent_uuid) == 0) {
5332 // Found a netagent to remove
5333 // Shift bytes down to remove the tlv, and adjust total length
5334 // Don't adjust the current offset
5335 memmove(result_buffer + offset,
5336 result_buffer + offset + tlv_total_length,
5337 client->result_length - (offset + tlv_total_length));
5338 client->result_length -= tlv_total_length;
5339 memset(result_buffer + client->result_length, 0, sizeof(client->result) - client->result_length);
5340 continue;
5341 }
5342 }
5343
5344 offset += tlv_total_length;
5345 }
5346 }
5347
5348 void
necp_force_update_client(uuid_t client_id,uuid_t remove_netagent_uuid,u_int32_t agent_generation)5349 necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid, u_int32_t agent_generation)
5350 {
5351 struct necp_fd_data *client_fd = NULL;
5352
5353 NECP_FD_LIST_LOCK_SHARED();
5354
5355 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
5356 bool updated_result = FALSE;
5357 NECP_FD_LOCK(client_fd);
5358 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
5359 if (client != NULL) {
5360 client->failed_trigger_agent.generation = agent_generation;
5361 uuid_copy(client->failed_trigger_agent.netagent_uuid, remove_netagent_uuid);
5362 if (!uuid_is_null(remove_netagent_uuid)) {
5363 necp_client_remove_agent_from_result(client, remove_netagent_uuid);
5364 }
5365 client->result_read = FALSE;
5366 // Found the client, break
5367 updated_result = TRUE;
5368 NECP_CLIENT_UNLOCK(client);
5369 }
5370 if (updated_result) {
5371 necp_fd_notify(client_fd, true);
5372 }
5373 NECP_FD_UNLOCK(client_fd);
5374 if (updated_result) {
5375 // Found the client, break
5376 break;
5377 }
5378 }
5379
5380 NECP_FD_LIST_UNLOCK();
5381 }
5382
5383 #if SKYWALK
5384 void
necp_client_early_close(uuid_t client_id)5385 necp_client_early_close(uuid_t client_id)
5386 {
5387 NECP_CLIENT_TREE_LOCK_SHARED();
5388
5389 struct necp_client *client = necp_find_client_and_lock(client_id);
5390 if (client != NULL) {
5391 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
5392 if (flow_registration != NULL) {
5393 // Found the right client and flow, mark the stats as over
5394 if (flow_registration->stats_handler_context != NULL) {
5395 ntstat_userland_stats_event(flow_registration->stats_handler_context,
5396 NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT);
5397 }
5398 }
5399 NECP_CLIENT_UNLOCK(client);
5400 }
5401
5402 NECP_CLIENT_TREE_UNLOCK();
5403 }
5404 #endif /* SKYWALK */
5405
5406 /// Interface matching
5407
5408 #define NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
5409 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF | \
5410 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
5411 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE | \
5412 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
5413 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT | \
5414 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
5415 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \
5416 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \
5417 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE | \
5418 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \
5419 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
5420
5421 #define NECP_PARSED_PARAMETERS_SCOPED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
5422 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
5423 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
5424 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
5425 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \
5426 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE)
5427
5428 #define NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
5429 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)
5430
5431 #define NECP_PARSED_PARAMETERS_PREFERRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
5432 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \
5433 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \
5434 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
5435
5436 static bool
necp_ifnet_matches_type(struct ifnet * ifp,u_int8_t interface_type,bool check_delegates)5437 necp_ifnet_matches_type(struct ifnet *ifp, u_int8_t interface_type, bool check_delegates)
5438 {
5439 struct ifnet *check_ifp = ifp;
5440 while (check_ifp) {
5441 if (if_functional_type(check_ifp, TRUE) == interface_type) {
5442 return TRUE;
5443 }
5444 if (!check_delegates) {
5445 break;
5446 }
5447 check_ifp = check_ifp->if_delegated.ifp;
5448 }
5449 return FALSE;
5450 }
5451
5452 static bool
necp_ifnet_matches_name(struct ifnet * ifp,const char * interface_name,bool check_delegates)5453 necp_ifnet_matches_name(struct ifnet *ifp, const char *interface_name, bool check_delegates)
5454 {
5455 struct ifnet *check_ifp = ifp;
5456 while (check_ifp) {
5457 if (strncmp(check_ifp->if_xname, interface_name, IFXNAMSIZ) == 0) {
5458 return TRUE;
5459 }
5460 if (!check_delegates) {
5461 break;
5462 }
5463 check_ifp = check_ifp->if_delegated.ifp;
5464 }
5465 return FALSE;
5466 }
5467
5468 static bool
necp_ifnet_matches_agent(struct ifnet * ifp,uuid_t * agent_uuid,bool check_delegates)5469 necp_ifnet_matches_agent(struct ifnet *ifp, uuid_t *agent_uuid, bool check_delegates)
5470 {
5471 struct ifnet *check_ifp = ifp;
5472
5473 while (check_ifp != NULL) {
5474 ifnet_lock_shared(check_ifp);
5475 if (check_ifp->if_agentids != NULL) {
5476 for (u_int32_t index = 0; index < check_ifp->if_agentcount; index++) {
5477 if (uuid_compare(check_ifp->if_agentids[index], *agent_uuid) == 0) {
5478 ifnet_lock_done(check_ifp);
5479 return TRUE;
5480 }
5481 }
5482 }
5483 ifnet_lock_done(check_ifp);
5484
5485 if (!check_delegates) {
5486 break;
5487 }
5488 check_ifp = check_ifp->if_delegated.ifp;
5489 }
5490 return FALSE;
5491 }
5492
5493 static bool
necp_ifnet_matches_agent_type(struct ifnet * ifp,const char * agent_domain,const char * agent_type,bool check_delegates)5494 necp_ifnet_matches_agent_type(struct ifnet *ifp, const char *agent_domain, const char *agent_type, bool check_delegates)
5495 {
5496 struct ifnet *check_ifp = ifp;
5497
5498 while (check_ifp != NULL) {
5499 ifnet_lock_shared(check_ifp);
5500 if (check_ifp->if_agentids != NULL) {
5501 for (u_int32_t index = 0; index < check_ifp->if_agentcount; index++) {
5502 if (uuid_is_null(check_ifp->if_agentids[index])) {
5503 continue;
5504 }
5505
5506 char if_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
5507 char if_agent_type[NETAGENT_TYPESIZE] = { 0 };
5508
5509 if (netagent_get_agent_domain_and_type(check_ifp->if_agentids[index], if_agent_domain, if_agent_type)) {
5510 if (necp_agent_types_match(agent_domain, agent_type, if_agent_domain, if_agent_type)) {
5511 ifnet_lock_done(check_ifp);
5512 return TRUE;
5513 }
5514 }
5515 }
5516 }
5517 ifnet_lock_done(check_ifp);
5518
5519 if (!check_delegates) {
5520 break;
5521 }
5522 check_ifp = check_ifp->if_delegated.ifp;
5523 }
5524 return FALSE;
5525 }
5526
5527 static bool
necp_ifnet_matches_local_address(struct ifnet * ifp,struct sockaddr * sa)5528 necp_ifnet_matches_local_address(struct ifnet *ifp, struct sockaddr *sa)
5529 {
5530 struct ifaddr *ifa = NULL;
5531 bool matched_local_address = FALSE;
5532
5533 // Transform sa into the ifaddr form
5534 // IPv6 Scope IDs are always embedded in the ifaddr list
5535 struct sockaddr_storage address;
5536 u_int ifscope = IFSCOPE_NONE;
5537 (void)sa_copy(sa, &address, &ifscope);
5538 SIN(&address)->sin_port = 0;
5539 if (address.ss_family == AF_INET6) {
5540 if (in6_embedded_scope ||
5541 !IN6_IS_SCOPE_EMBED(&SIN6(&address)->sin6_addr)) {
5542 SIN6(&address)->sin6_scope_id = 0;
5543 }
5544 }
5545
5546 ifa = ifa_ifwithaddr_scoped_locked((struct sockaddr *)&address, ifp->if_index);
5547 matched_local_address = (ifa != NULL);
5548
5549 if (ifa) {
5550 ifaddr_release(ifa);
5551 }
5552
5553 return matched_local_address;
5554 }
5555
5556 static bool
necp_interface_type_should_match_unranked_interfaces(u_int8_t interface_type)5557 necp_interface_type_should_match_unranked_interfaces(u_int8_t interface_type)
5558 {
5559 switch (interface_type) {
5560 // These are the interface types we allow a client to request even if the matching
5561 // interface isn't currently eligible to be primary (has default route, dns, etc)
5562 case IFRTYPE_FUNCTIONAL_WIFI_AWDL:
5563 case IFRTYPE_FUNCTIONAL_INTCOPROC:
5564 case IFRTYPE_FUNCTIONAL_COMPANIONLINK:
5565 return true;
5566 default:
5567 break;
5568 }
5569 return false;
5570 }
5571
5572 #define NECP_IFP_IS_ON_ORDERED_LIST(_ifp) ((_ifp)->if_ordered_link.tqe_next != NULL || (_ifp)->if_ordered_link.tqe_prev != NULL)
5573
5574 // Secondary interface flag indicates that the interface is being
5575 // used for multipath or a listener as an extra path
5576 static bool
necp_ifnet_matches_parameters(struct ifnet * ifp,struct necp_client_parsed_parameters * parsed_parameters,u_int32_t override_flags,u_int32_t * preferred_count,bool secondary_interface,bool require_scoped_field)5577 necp_ifnet_matches_parameters(struct ifnet *ifp,
5578 struct necp_client_parsed_parameters *parsed_parameters,
5579 u_int32_t override_flags,
5580 u_int32_t *preferred_count,
5581 bool secondary_interface,
5582 bool require_scoped_field)
5583 {
5584 bool matched_some_scoped_field = FALSE;
5585
5586 if (preferred_count) {
5587 *preferred_count = 0;
5588 }
5589
5590 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) {
5591 if (parsed_parameters->required_interface_index != ifp->if_index) {
5592 return FALSE;
5593 }
5594 }
5595 #if SKYWALK
5596 else {
5597 if (ifnet_is_low_latency(ifp)) {
5598 return FALSE;
5599 }
5600 }
5601 #endif /* SKYWALK */
5602
5603 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR) {
5604 if (!necp_ifnet_matches_local_address(ifp, SA(&parsed_parameters->local_addr.sa))) {
5605 return FALSE;
5606 }
5607 if (require_scoped_field) {
5608 matched_some_scoped_field = TRUE;
5609 }
5610 }
5611
5612 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) {
5613 if (override_flags != 0) {
5614 if ((override_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) &&
5615 IFNET_IS_EXPENSIVE(ifp)) {
5616 return FALSE;
5617 }
5618 if ((override_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED) &&
5619 IFNET_IS_CONSTRAINED(ifp)) {
5620 return FALSE;
5621 }
5622 } else {
5623 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) &&
5624 IFNET_IS_EXPENSIVE(ifp)) {
5625 return FALSE;
5626 }
5627 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED) &&
5628 IFNET_IS_CONSTRAINED(ifp)) {
5629 return FALSE;
5630 }
5631 }
5632 }
5633
5634 if ((!secondary_interface || // Enforce interface type if this is the primary interface
5635 !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) || // or if there are no flags
5636 !(parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE)) && // or if the flags don't give an exception
5637 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) &&
5638 !necp_ifnet_matches_type(ifp, parsed_parameters->required_interface_type, FALSE)) {
5639 return FALSE;
5640 }
5641
5642 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) {
5643 if (require_scoped_field) {
5644 matched_some_scoped_field = TRUE;
5645 }
5646 }
5647
5648 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE) {
5649 for (int i = 0; i < NECP_MAX_INTERFACE_PARAMETERS; i++) {
5650 if (parsed_parameters->prohibited_interface_types[i] == 0) {
5651 break;
5652 }
5653
5654 if (necp_ifnet_matches_type(ifp, parsed_parameters->prohibited_interface_types[i], TRUE)) {
5655 return FALSE;
5656 }
5657 }
5658 }
5659
5660 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF) {
5661 for (int i = 0; i < NECP_MAX_INTERFACE_PARAMETERS; i++) {
5662 if (strlen(parsed_parameters->prohibited_interfaces[i]) == 0) {
5663 break;
5664 }
5665
5666 if (necp_ifnet_matches_name(ifp, parsed_parameters->prohibited_interfaces[i], TRUE)) {
5667 return FALSE;
5668 }
5669 }
5670 }
5671
5672 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
5673 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5674 if (uuid_is_null(parsed_parameters->required_netagents[i])) {
5675 break;
5676 }
5677
5678 if (!necp_ifnet_matches_agent(ifp, &parsed_parameters->required_netagents[i], FALSE)) {
5679 return FALSE;
5680 }
5681
5682 if (require_scoped_field) {
5683 matched_some_scoped_field = TRUE;
5684 }
5685 }
5686 }
5687
5688 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT) {
5689 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5690 if (uuid_is_null(parsed_parameters->prohibited_netagents[i])) {
5691 break;
5692 }
5693
5694 if (necp_ifnet_matches_agent(ifp, &parsed_parameters->prohibited_netagents[i], TRUE)) {
5695 return FALSE;
5696 }
5697 }
5698 }
5699
5700 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
5701 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5702 if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 &&
5703 strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
5704 break;
5705 }
5706
5707 if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->required_netagent_types[i].netagent_domain, parsed_parameters->required_netagent_types[i].netagent_type, FALSE)) {
5708 return FALSE;
5709 }
5710
5711 if (require_scoped_field) {
5712 matched_some_scoped_field = TRUE;
5713 }
5714 }
5715 }
5716
5717 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE) {
5718 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5719 if (strlen(parsed_parameters->prohibited_netagent_types[i].netagent_domain) == 0 &&
5720 strlen(parsed_parameters->prohibited_netagent_types[i].netagent_type) == 0) {
5721 break;
5722 }
5723
5724 if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->prohibited_netagent_types[i].netagent_domain, parsed_parameters->prohibited_netagent_types[i].netagent_type, TRUE)) {
5725 return FALSE;
5726 }
5727 }
5728 }
5729
5730 // Checked preferred properties
5731 if (preferred_count) {
5732 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT) {
5733 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5734 if (uuid_is_null(parsed_parameters->preferred_netagents[i])) {
5735 break;
5736 }
5737
5738 if (necp_ifnet_matches_agent(ifp, &parsed_parameters->preferred_netagents[i], TRUE)) {
5739 (*preferred_count)++;
5740 if (require_scoped_field) {
5741 matched_some_scoped_field = TRUE;
5742 }
5743 }
5744 }
5745 }
5746
5747 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE) {
5748 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5749 if (strlen(parsed_parameters->preferred_netagent_types[i].netagent_domain) == 0 &&
5750 strlen(parsed_parameters->preferred_netagent_types[i].netagent_type) == 0) {
5751 break;
5752 }
5753
5754 if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->preferred_netagent_types[i].netagent_domain, parsed_parameters->preferred_netagent_types[i].netagent_type, TRUE)) {
5755 (*preferred_count)++;
5756 if (require_scoped_field) {
5757 matched_some_scoped_field = TRUE;
5758 }
5759 }
5760 }
5761 }
5762
5763 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT) {
5764 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5765 if (uuid_is_null(parsed_parameters->avoided_netagents[i])) {
5766 break;
5767 }
5768
5769 if (!necp_ifnet_matches_agent(ifp, &parsed_parameters->avoided_netagents[i], TRUE)) {
5770 (*preferred_count)++;
5771 }
5772 }
5773 }
5774
5775 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE) {
5776 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5777 if (strlen(parsed_parameters->avoided_netagent_types[i].netagent_domain) == 0 &&
5778 strlen(parsed_parameters->avoided_netagent_types[i].netagent_type) == 0) {
5779 break;
5780 }
5781
5782 if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->avoided_netagent_types[i].netagent_domain,
5783 parsed_parameters->avoided_netagent_types[i].netagent_type, TRUE)) {
5784 (*preferred_count)++;
5785 }
5786 }
5787 }
5788 }
5789
5790 if (require_scoped_field) {
5791 return matched_some_scoped_field;
5792 }
5793
5794 return TRUE;
5795 }
5796
5797 static bool
necp_find_matching_interface_index(struct necp_client_parsed_parameters * parsed_parameters,u_int * return_ifindex,bool * validate_agents)5798 necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters,
5799 u_int *return_ifindex, bool *validate_agents)
5800 {
5801 struct ifnet *ifp = NULL;
5802 u_int32_t best_preferred_count = 0;
5803 bool has_preferred_fields = FALSE;
5804 *return_ifindex = 0;
5805
5806 if (parsed_parameters->required_interface_index != 0) {
5807 *return_ifindex = parsed_parameters->required_interface_index;
5808 return TRUE;
5809 }
5810
5811 // Check and save off flags
5812 u_int32_t flags = 0;
5813 bool has_prohibit_flags = FALSE;
5814 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) {
5815 flags = parsed_parameters->flags;
5816 has_prohibit_flags = (parsed_parameters->flags &
5817 (NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE |
5818 NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED));
5819 }
5820
5821 if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS) &&
5822 !has_prohibit_flags) {
5823 return TRUE;
5824 }
5825
5826 has_preferred_fields = (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS);
5827
5828 // We have interesting parameters to parse and find a matching interface
5829 ifnet_head_lock_shared();
5830
5831 if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS) &&
5832 !has_preferred_fields) {
5833 // We do have fields to match, but they are only prohibitory
5834 // If the first interface in the list matches, or there are no ordered interfaces, we don't need to scope
5835 ifp = TAILQ_FIRST(&ifnet_ordered_head);
5836 if (ifp == NULL || necp_ifnet_matches_parameters(ifp, parsed_parameters, 0, NULL, false, false)) {
5837 // Don't set return_ifindex, so the client doesn't need to scope
5838 ifnet_head_done();
5839 return TRUE;
5840 }
5841
5842 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR &&
5843 parsed_parameters->remote_addr.sin6.sin6_family == AF_INET6 &&
5844 parsed_parameters->remote_addr.sin6.sin6_scope_id != IFSCOPE_NONE &&
5845 parsed_parameters->remote_addr.sin6.sin6_scope_id <= (u_int32_t)if_index) {
5846 ifp = ifindex2ifnet[parsed_parameters->remote_addr.sin6.sin6_scope_id];
5847 if (ifp != NULL && necp_ifnet_matches_parameters(ifp, parsed_parameters, 0, NULL, false, false)) {
5848 // Don't set return_ifindex, so the client doesn't need to scope since the v6 scope ID will
5849 // already route to the correct interface
5850 ifnet_head_done();
5851 return TRUE;
5852 }
5853 }
5854 }
5855
5856 // First check the ordered interface list
5857 TAILQ_FOREACH(ifp, &ifnet_ordered_head, if_ordered_link) {
5858 u_int32_t preferred_count = 0;
5859 if (necp_ifnet_matches_parameters(ifp, parsed_parameters, flags, &preferred_count, false, false)) {
5860 if (preferred_count > best_preferred_count ||
5861 *return_ifindex == 0) {
5862 // Everything matched, and is most preferred. Return this interface.
5863 *return_ifindex = ifp->if_index;
5864 best_preferred_count = preferred_count;
5865
5866 if (!has_preferred_fields) {
5867 break;
5868 }
5869 }
5870 }
5871
5872 if (has_prohibit_flags &&
5873 ifp == TAILQ_FIRST(&ifnet_ordered_head)) {
5874 // This was the first interface. From here on, if the
5875 // client prohibited either expensive or constrained,
5876 // don't allow either as a secondary interface option.
5877 flags |= (NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE |
5878 NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED);
5879 }
5880 }
5881
5882 bool is_listener = ((parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
5883 (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER));
5884
5885 // Then check the remaining interfaces
5886 if ((parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS) &&
5887 ((!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)) ||
5888 necp_interface_type_should_match_unranked_interfaces(parsed_parameters->required_interface_type) ||
5889 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR) ||
5890 is_listener) &&
5891 (*return_ifindex == 0 || has_preferred_fields)) {
5892 TAILQ_FOREACH(ifp, &ifnet_head, if_link) {
5893 u_int32_t preferred_count = 0;
5894 if (NECP_IFP_IS_ON_ORDERED_LIST(ifp)) {
5895 // This interface was in the ordered list, skip
5896 continue;
5897 }
5898 if (necp_ifnet_matches_parameters(ifp, parsed_parameters, flags, &preferred_count, false, true)) {
5899 if (preferred_count > best_preferred_count ||
5900 *return_ifindex == 0) {
5901 // Everything matched, and is most preferred. Return this interface.
5902 *return_ifindex = ifp->if_index;
5903 best_preferred_count = preferred_count;
5904
5905 if (!has_preferred_fields) {
5906 break;
5907 }
5908 }
5909 }
5910 }
5911 }
5912
5913 ifnet_head_done();
5914
5915 if (has_preferred_fields && best_preferred_count == 0 &&
5916 ((parsed_parameters->valid_fields & (NECP_PARSED_PARAMETERS_SCOPED_FIELDS | NECP_PARSED_PARAMETERS_PREFERRED_FIELDS)) ==
5917 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS))) {
5918 // If only has preferred ifnet fields, and nothing was found, clear the interface index and return TRUE
5919 *return_ifindex = 0;
5920 return TRUE;
5921 }
5922
5923 if (*return_ifindex == 0 &&
5924 !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS)) {
5925 // Has required fields, but not including specific interface fields. Pass for now, and check
5926 // to see if agents are satisfied by policy.
5927 *validate_agents = TRUE;
5928 return TRUE;
5929 }
5930
5931 return *return_ifindex != 0;
5932 }
5933
5934 void
necp_copy_inp_domain_info(struct inpcb * inp,struct socket * so,nstat_domain_info * domain_info)5935 necp_copy_inp_domain_info(struct inpcb *inp, struct socket *so, nstat_domain_info *domain_info)
5936 {
5937 if (inp == NULL || so == NULL || domain_info == NULL) {
5938 return;
5939 }
5940
5941 necp_lock_socket_attributes();
5942
5943 domain_info->is_silent = !!(so->so_flags1 & SOF1_DOMAIN_INFO_SILENT);
5944 if (!domain_info->is_silent) {
5945 domain_info->is_tracker = !!(so->so_flags1 & SOF1_KNOWN_TRACKER);
5946 domain_info->is_non_app_initiated = !!(so->so_flags1 & SOF1_TRACKER_NON_APP_INITIATED);
5947 if (domain_info->is_tracker &&
5948 inp->inp_necp_attributes.inp_tracker_domain != NULL) {
5949 strlcpy(domain_info->domain_name, inp->inp_necp_attributes.inp_tracker_domain,
5950 sizeof(domain_info->domain_name));
5951 } else if (inp->inp_necp_attributes.inp_domain != NULL) {
5952 strlcpy(domain_info->domain_name, inp->inp_necp_attributes.inp_domain,
5953 sizeof(domain_info->domain_name));
5954 }
5955 if (inp->inp_necp_attributes.inp_domain_owner != NULL) {
5956 strlcpy(domain_info->domain_owner, inp->inp_necp_attributes.inp_domain_owner,
5957 sizeof(domain_info->domain_owner));
5958 }
5959 if (inp->inp_necp_attributes.inp_domain_context != NULL) {
5960 strlcpy(domain_info->domain_tracker_ctxt, inp->inp_necp_attributes.inp_domain_context,
5961 sizeof(domain_info->domain_tracker_ctxt));
5962 }
5963 }
5964
5965 necp_unlock_socket_attributes();
5966 }
5967
5968 void
necp_with_inp_domain_name(struct socket * so,void * ctx,void (* with_func)(char * domain_name,void * ctx))5969 necp_with_inp_domain_name(struct socket *so, void *ctx, void (*with_func)(char *domain_name, void *ctx))
5970 {
5971 struct inpcb *inp = NULL;
5972
5973 if (so == NULL || with_func == NULL) {
5974 return;
5975 }
5976
5977 inp = (struct inpcb *)so->so_pcb;
5978 if (inp == NULL) {
5979 return;
5980 }
5981
5982 necp_lock_socket_attributes();
5983 with_func(inp->inp_necp_attributes.inp_domain, ctx);
5984 necp_unlock_socket_attributes();
5985 }
5986
5987 static size_t
necp_find_domain_info_common(struct necp_client * client,u_int8_t * parameters,size_t parameters_size,struct necp_client_flow_registration * flow_registration,nstat_domain_info * domain_info)5988 necp_find_domain_info_common(struct necp_client *client,
5989 u_int8_t *parameters,
5990 size_t parameters_size,
5991 struct necp_client_flow_registration *flow_registration, /* For logging purposes only */
5992 nstat_domain_info *domain_info)
5993 {
5994 if (client == NULL) {
5995 return 0;
5996 }
5997 if (domain_info == NULL) {
5998 return sizeof(nstat_domain_info);
5999 }
6000
6001 size_t offset = 0;
6002 u_int32_t flags = 0;
6003 u_int8_t *tracker_domain = NULL;
6004 u_int8_t *domain = NULL;
6005 size_t tracker_domain_length = 0;
6006 size_t domain_length = 0;
6007
6008 NECP_CLIENT_FLOW_LOG(client, flow_registration, "Collecting stats");
6009
6010 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
6011 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
6012 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
6013
6014 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
6015 // If the length is larger than what can fit in the remaining parameters size, bail
6016 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
6017 break;
6018 }
6019
6020 if (length > 0) {
6021 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
6022 if (value != NULL) {
6023 switch (type) {
6024 case NECP_CLIENT_PARAMETER_FLAGS: {
6025 if (length >= sizeof(u_int32_t)) {
6026 memcpy(&flags, value, sizeof(u_int32_t));
6027 }
6028
6029 domain_info->is_tracker =
6030 !!(flags & NECP_CLIENT_PARAMETER_FLAG_KNOWN_TRACKER);
6031 domain_info->is_non_app_initiated =
6032 !!(flags & NECP_CLIENT_PARAMETER_FLAG_NON_APP_INITIATED);
6033 domain_info->is_silent =
6034 !!(flags & NECP_CLIENT_PARAMETER_FLAG_SILENT);
6035 break;
6036 }
6037 case NECP_CLIENT_PARAMETER_TRACKER_DOMAIN: {
6038 tracker_domain_length = length;
6039 tracker_domain = value;
6040 break;
6041 }
6042 case NECP_CLIENT_PARAMETER_DOMAIN: {
6043 domain_length = length;
6044 domain = value;
6045 break;
6046 }
6047 case NECP_CLIENT_PARAMETER_DOMAIN_OWNER: {
6048 size_t length_to_copy = MIN(length, sizeof(domain_info->domain_owner));
6049 strlcpy(domain_info->domain_owner, (const char *)value, length_to_copy);
6050 break;
6051 }
6052 case NECP_CLIENT_PARAMETER_DOMAIN_CONTEXT: {
6053 size_t length_to_copy = MIN(length, sizeof(domain_info->domain_tracker_ctxt));
6054 strlcpy(domain_info->domain_tracker_ctxt, (const char *)value, length_to_copy);
6055 break;
6056 }
6057 case NECP_CLIENT_PARAMETER_ATTRIBUTED_BUNDLE_IDENTIFIER: {
6058 size_t length_to_copy = MIN(length, sizeof(domain_info->domain_attributed_bundle_id));
6059 strlcpy(domain_info->domain_attributed_bundle_id, (const char *)value, length_to_copy);
6060 break;
6061 }
6062 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
6063 if (length >= sizeof(struct necp_policy_condition_addr)) {
6064 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
6065 if (necp_client_address_is_valid(&address_struct->address.sa)) {
6066 memcpy(&domain_info->remote, &address_struct->address, sizeof(address_struct->address));
6067 }
6068 }
6069 break;
6070 }
6071 default: {
6072 break;
6073 }
6074 }
6075 }
6076 }
6077 offset += sizeof(struct necp_tlv_header) + length;
6078 }
6079
6080 if (domain_info->is_silent) {
6081 memset(domain_info, 0, sizeof(*domain_info));
6082 domain_info->is_silent = true;
6083 } else if (domain_info->is_tracker && tracker_domain != NULL && tracker_domain_length > 0) {
6084 size_t length_to_copy = MIN(tracker_domain_length, sizeof(domain_info->domain_name));
6085 strlcpy(domain_info->domain_name, (const char *)tracker_domain, length_to_copy);
6086 } else if (domain != NULL && domain_length > 0) {
6087 size_t length_to_copy = MIN(domain_length, sizeof(domain_info->domain_name));
6088 strlcpy(domain_info->domain_name, (const char *)domain, length_to_copy);
6089 }
6090
6091 NECP_CLIENT_FLOW_LOG(client, flow_registration,
6092 "Collected stats - domain <%s> owner <%s> ctxt <%s> bundle id <%s> "
6093 "is_tracker %d is_non_app_initiated %d is_silent %d",
6094 domain_info->domain_name,
6095 domain_info->domain_owner,
6096 domain_info->domain_tracker_ctxt,
6097 domain_info->domain_attributed_bundle_id,
6098 domain_info->is_tracker,
6099 domain_info->is_non_app_initiated,
6100 domain_info->is_silent);
6101
6102 return sizeof(nstat_domain_info);
6103 }
6104
6105 static size_t
necp_find_conn_extension_info(nstat_provider_context ctx,int requested_extension,void * buf,size_t buf_size)6106 necp_find_conn_extension_info(nstat_provider_context ctx,
6107 int requested_extension, /* The extension to be returned */
6108 void *buf, /* If not NULL, the address for extensions to be returned in */
6109 size_t buf_size) /* The size of the buffer space, typically matching the return from a previous call with a NULL buf pointer */
6110 {
6111 // Note, the caller has guaranteed that any buffer has been zeroed, there is no need to clear it again
6112
6113 if (ctx == NULL) {
6114 return 0;
6115 }
6116 struct necp_client *client = (struct necp_client *)ctx;
6117 switch (requested_extension) {
6118 case NSTAT_EXTENDED_UPDATE_TYPE_DOMAIN:
6119 // This is for completeness. The intent is that domain information can be extracted at user level from the TLV parameters
6120 if (buf == NULL) {
6121 return sizeof(nstat_domain_info);
6122 }
6123 if (buf_size < sizeof(nstat_domain_info)) {
6124 return 0;
6125 }
6126 return necp_find_domain_info_common(client, client->parameters, client->parameters_length, NULL, (nstat_domain_info *)buf);
6127
6128 case NSTAT_EXTENDED_UPDATE_TYPE_NECP_TLV: {
6129 size_t parameters_length = client->parameters_length;
6130 if (buf == NULL) {
6131 return parameters_length;
6132 }
6133 if (buf_size < parameters_length) {
6134 return 0;
6135 }
6136 memcpy(buf, client->parameters, parameters_length);
6137 return parameters_length;
6138 }
6139 case NSTAT_EXTENDED_UPDATE_TYPE_ORIGINAL_NECP_TLV:
6140 if (buf == NULL) {
6141 return (client->original_parameters_source != NULL) ? client->original_parameters_source->parameters_length : 0;
6142 }
6143 if ((client->original_parameters_source == NULL) || (buf_size < client->original_parameters_source->parameters_length)) {
6144 return 0;
6145 }
6146 memcpy(buf, client->original_parameters_source->parameters, client->original_parameters_source->parameters_length);
6147 return client->original_parameters_source->parameters_length;
6148
6149 case NSTAT_EXTENDED_UPDATE_TYPE_ORIGINAL_DOMAIN:
6150 if (buf == NULL) {
6151 return (client->original_parameters_source != NULL) ? sizeof(nstat_domain_info) : 0;
6152 }
6153 if ((buf_size < sizeof(nstat_domain_info)) || (client->original_parameters_source == NULL)) {
6154 return 0;
6155 }
6156 return necp_find_domain_info_common(client, client->original_parameters_source->parameters, client->original_parameters_source->parameters_length,
6157 NULL, (nstat_domain_info *)buf);
6158
6159 default:
6160 return 0;
6161 }
6162 }
6163
6164 #if SKYWALK
6165
6166 static size_t
necp_find_extension_info(userland_stats_provider_context * ctx,int requested_extension,void * buf,size_t buf_size)6167 necp_find_extension_info(userland_stats_provider_context *ctx,
6168 int requested_extension, /* The extension to be returned */
6169 void *buf, /* If not NULL, the address for extensions to be returned in */
6170 size_t buf_size) /* The size of the buffer space, typically matching the return from a previous call with a NULL buf pointer */
6171 {
6172 if (ctx == NULL) {
6173 return 0;
6174 }
6175 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6176 struct necp_client *client = flow_registration->client;
6177
6178 switch (requested_extension) {
6179 case NSTAT_EXTENDED_UPDATE_TYPE_DOMAIN:
6180 if (buf == NULL) {
6181 return sizeof(nstat_domain_info);
6182 }
6183 if (buf_size < sizeof(nstat_domain_info)) {
6184 return 0;
6185 }
6186 return necp_find_domain_info_common(client, client->parameters, client->parameters_length, flow_registration, (nstat_domain_info *)buf);
6187
6188 case NSTAT_EXTENDED_UPDATE_TYPE_NECP_TLV:
6189 if (buf == NULL) {
6190 return client->parameters_length;
6191 }
6192 if (buf_size < client->parameters_length) {
6193 return 0;
6194 }
6195 memcpy(buf, client->parameters, client->parameters_length);
6196 return client->parameters_length;
6197
6198 case NSTAT_EXTENDED_UPDATE_TYPE_FUUID:
6199 if (buf == NULL) {
6200 return sizeof(uuid_t);
6201 }
6202 if (buf_size < sizeof(uuid_t)) {
6203 return 0;
6204 }
6205 uuid_copy(buf, flow_registration->registration_id);
6206 return sizeof(uuid_t);
6207
6208 default:
6209 return 0;
6210 }
6211 }
6212
6213 static void
necp_find_netstat_data(struct necp_client * client,union necp_sockaddr_union * remote,pid_t * effective_pid,uid_t * uid,uuid_t euuid,uid_t * persona_id,u_int32_t * traffic_class,u_int8_t * fallback_mode)6214 necp_find_netstat_data(struct necp_client *client,
6215 union necp_sockaddr_union *remote,
6216 pid_t *effective_pid,
6217 uid_t *uid,
6218 uuid_t euuid,
6219 uid_t *persona_id,
6220 u_int32_t *traffic_class,
6221 u_int8_t *fallback_mode)
6222 {
6223 bool have_set_euuid = false;
6224 size_t offset = 0;
6225 u_int8_t *parameters;
6226 u_int32_t parameters_size;
6227
6228 parameters = client->parameters;
6229 parameters_size = (u_int32_t)client->parameters_length;
6230
6231 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
6232 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
6233 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
6234
6235 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
6236 // If the length is larger than what can fit in the remaining parameters size, bail
6237 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
6238 break;
6239 }
6240
6241 if (length > 0) {
6242 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
6243 if (value != NULL) {
6244 switch (type) {
6245 case NECP_CLIENT_PARAMETER_APPLICATION: {
6246 if (length >= sizeof(uuid_t)) {
6247 uuid_copy(euuid, value);
6248 }
6249 break;
6250 }
6251 case NECP_CLIENT_PARAMETER_PID: {
6252 if (length >= sizeof(pid_t)) {
6253 memcpy(effective_pid, value, sizeof(pid_t));
6254 }
6255 break;
6256 }
6257 case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: {
6258 if (length >= sizeof(u_int32_t)) {
6259 memcpy(traffic_class, value, sizeof(u_int32_t));
6260 }
6261 break;
6262 }
6263 case NECP_CLIENT_PARAMETER_FALLBACK_MODE: {
6264 if (length >= sizeof(u_int8_t)) {
6265 memcpy(fallback_mode, value, sizeof(u_int8_t));
6266 }
6267 break;
6268 }
6269 // It is an implementation quirk that the remote address can be found in the necp parameters
6270 // while the local address must be retrieved from the flowswitch
6271 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
6272 if (length >= sizeof(struct necp_policy_condition_addr)) {
6273 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
6274 if (necp_client_address_is_valid(&address_struct->address.sa)) {
6275 memcpy(remote, &address_struct->address, sizeof(address_struct->address));
6276 }
6277 }
6278 break;
6279 }
6280 case NECP_CLIENT_PARAMETER_APPLICATION_ID: {
6281 if (length >= sizeof(necp_application_id_t) && uid && persona_id) {
6282 necp_application_id_t *application_id = (necp_application_id_t *)(void *)value;
6283 memcpy(uid, &application_id->uid, sizeof(uid_t));
6284 uuid_copy(euuid, application_id->effective_uuid);
6285 memcpy(persona_id, &application_id->persona_id, sizeof(uid_t));
6286 have_set_euuid = true;
6287 }
6288 break;
6289 }
6290 default: {
6291 break;
6292 }
6293 }
6294 }
6295 }
6296 offset += sizeof(struct necp_tlv_header) + length;
6297 }
6298
6299 if (!have_set_euuid) {
6300 proc_t proc = proc_find(client->proc_pid);
6301 if (proc != PROC_NULL) {
6302 uuid_t responsible_uuid = { 0 };
6303 proc_getresponsibleuuid(proc, responsible_uuid, sizeof(responsible_uuid));
6304 proc_rele(proc);
6305 if (!uuid_is_null(responsible_uuid)) {
6306 uuid_copy(euuid, responsible_uuid);
6307 }
6308 }
6309 }
6310 }
6311
6312 static u_int64_t
necp_find_netstat_initial_properties(struct necp_client * client)6313 necp_find_netstat_initial_properties(struct necp_client *client)
6314 {
6315 size_t offset = 0;
6316 u_int64_t retval = 0;
6317 u_int8_t *parameters;
6318 u_int32_t parameters_size;
6319
6320 parameters = client->parameters;
6321 parameters_size = (u_int32_t)client->parameters_length;
6322
6323 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
6324 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
6325 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
6326
6327 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
6328 // If the length is larger than what can fit in the remaining parameters size, bail
6329 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
6330 break;
6331 }
6332
6333 if (type == NECP_CLIENT_PARAMETER_FLAGS) {
6334 u_int32_t policy_condition_client_flags;
6335 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
6336 if ((value != NULL) && (length >= sizeof(policy_condition_client_flags))) {
6337 memcpy(&policy_condition_client_flags, value, sizeof(policy_condition_client_flags));
6338 if (policy_condition_client_flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
6339 retval |= NSTAT_SOURCE_IS_LISTENER;
6340 }
6341 if (policy_condition_client_flags & NECP_CLIENT_PARAMETER_FLAG_INBOUND) {
6342 retval |= NSTAT_SOURCE_IS_INBOUND;
6343 }
6344 }
6345 break;
6346 }
6347 offset += sizeof(struct necp_tlv_header) + length;
6348 }
6349 if (retval == 0) {
6350 retval = NSTAT_SOURCE_IS_OUTBOUND;
6351 }
6352 return retval;
6353 }
6354
6355 // Called from NetworkStatistics when it wishes to collect latest information for a TCP flow.
6356 // It is a responsibility of NetworkStatistics to have previously zeroed any supplied memory.
6357 static bool
necp_request_tcp_netstats(userland_stats_provider_context * ctx,u_int32_t * ifflagsp,nstat_progress_digest * digestp,nstat_counts * countsp,void * metadatap)6358 necp_request_tcp_netstats(userland_stats_provider_context *ctx,
6359 u_int32_t *ifflagsp,
6360 nstat_progress_digest *digestp,
6361 nstat_counts *countsp,
6362 void *metadatap)
6363 {
6364 if (ctx == NULL) {
6365 return false;
6366 }
6367
6368 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6369 struct necp_client *client = flow_registration->client;
6370 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
6371 struct necp_tcp_stats *tcpstats = (struct necp_tcp_stats *)ustats_kaddr;
6372 ASSERT(tcpstats != NULL);
6373
6374 u_int32_t nstat_diagnostic_flags = 0;
6375
6376 // Retrieve details from the last time the assigned flows were updated
6377 u_int32_t route_ifindex = IFSCOPE_NONE;
6378 u_int32_t route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6379 u_int64_t combined_interface_details = 0;
6380
6381 combined_interface_details = os_atomic_load(&flow_registration->last_interface_details, relaxed);
6382 split_interface_details(combined_interface_details, &route_ifindex, &route_ifflags);
6383
6384 if (route_ifindex == IFSCOPE_NONE) {
6385 // Mark no interface
6386 nstat_diagnostic_flags |= NSTAT_IFNET_ROUTE_VALUE_UNOBTAINABLE;
6387 route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6388 NECPLOG(LOG_INFO, "req tcp stats, failed to get route details for pid %d curproc %d %s\n",
6389 client->proc_pid, proc_pid(current_proc()), proc_best_name(current_proc()));
6390 }
6391
6392 if (ifflagsp) {
6393 *ifflagsp = route_ifflags | nstat_diagnostic_flags;
6394 if (tcpstats->necp_tcp_extra.flags1 & SOF1_CELLFALLBACK) {
6395 *ifflagsp |= NSTAT_IFNET_VIA_CELLFALLBACK;
6396 }
6397 if ((digestp == NULL) && (countsp == NULL) && (metadatap == NULL)) {
6398 return true;
6399 }
6400 }
6401
6402 if (digestp) {
6403 // The digest is intended to give information that may help give insight into the state of the link
6404 // while avoiding the need to do the relatively expensive flowswitch lookup
6405 digestp->rxbytes = tcpstats->necp_tcp_counts.necp_stat_rxbytes;
6406 digestp->txbytes = tcpstats->necp_tcp_counts.necp_stat_txbytes;
6407 digestp->rxduplicatebytes = tcpstats->necp_tcp_counts.necp_stat_rxduplicatebytes;
6408 digestp->rxoutoforderbytes = tcpstats->necp_tcp_counts.necp_stat_rxoutoforderbytes;
6409 digestp->txretransmit = tcpstats->necp_tcp_counts.necp_stat_txretransmit;
6410 digestp->ifindex = route_ifindex;
6411 digestp->state = tcpstats->necp_tcp_extra.state;
6412 digestp->txunacked = tcpstats->necp_tcp_extra.txunacked;
6413 digestp->txwindow = tcpstats->necp_tcp_extra.txwindow;
6414 digestp->connstatus.probe_activated = tcpstats->necp_tcp_extra.probestatus.probe_activated;
6415 digestp->connstatus.write_probe_failed = tcpstats->necp_tcp_extra.probestatus.write_probe_failed;
6416 digestp->connstatus.read_probe_failed = tcpstats->necp_tcp_extra.probestatus.read_probe_failed;
6417 digestp->connstatus.conn_probe_failed = tcpstats->necp_tcp_extra.probestatus.conn_probe_failed;
6418
6419 if ((countsp == NULL) && (metadatap == NULL)) {
6420 return true;
6421 }
6422 }
6423
6424 const struct sk_stats_flow *sf = &flow_registration->nexus_stats->fs_stats;
6425 if (sf == NULL) {
6426 nstat_diagnostic_flags |= NSTAT_IFNET_FLOWSWITCH_VALUE_UNOBTAINABLE;
6427 char namebuf[MAXCOMLEN + 1];
6428 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
6429 proc_name(client->proc_pid, namebuf, sizeof(namebuf));
6430 NECPLOG(LOG_ERR, "req tcp stats, necp_client flow_registration flow_stats missing for pid %d %s curproc %d %s\n",
6431 client->proc_pid, namebuf, proc_pid(current_proc()), proc_best_name(current_proc()));
6432 sf = &ntstat_sk_stats_zero;
6433 }
6434
6435 if (countsp) {
6436 countsp->nstat_rxbytes = tcpstats->necp_tcp_counts.necp_stat_rxbytes;
6437 countsp->nstat_txbytes = tcpstats->necp_tcp_counts.necp_stat_txbytes;
6438
6439 countsp->nstat_rxduplicatebytes = tcpstats->necp_tcp_counts.necp_stat_rxduplicatebytes;
6440 countsp->nstat_rxoutoforderbytes = tcpstats->necp_tcp_counts.necp_stat_rxoutoforderbytes;
6441 countsp->nstat_txretransmit = tcpstats->necp_tcp_counts.necp_stat_txretransmit;
6442
6443 countsp->nstat_min_rtt = tcpstats->necp_tcp_counts.necp_stat_min_rtt;
6444 countsp->nstat_avg_rtt = tcpstats->necp_tcp_counts.necp_stat_avg_rtt;
6445 countsp->nstat_var_rtt = tcpstats->necp_tcp_counts.necp_stat_var_rtt;
6446
6447 countsp->nstat_connectattempts = tcpstats->necp_tcp_extra.state >= TCPS_SYN_SENT ? 1 : 0;
6448 countsp->nstat_connectsuccesses = tcpstats->necp_tcp_extra.state >= TCPS_ESTABLISHED ? 1 : 0;
6449
6450 // Supplement what the user level has told us with what we know from the flowswitch
6451 countsp->nstat_rxpackets = sf->sf_ipackets;
6452 countsp->nstat_txpackets = sf->sf_opackets;
6453 if (route_ifflags & NSTAT_IFNET_IS_CELLULAR) {
6454 countsp->nstat_cell_rxbytes = sf->sf_ibytes;
6455 countsp->nstat_cell_txbytes = sf->sf_obytes;
6456 } else if (route_ifflags & NSTAT_IFNET_IS_WIFI) {
6457 countsp->nstat_wifi_rxbytes = sf->sf_ibytes;
6458 countsp->nstat_wifi_txbytes = sf->sf_obytes;
6459 } else if (route_ifflags & NSTAT_IFNET_IS_WIRED) {
6460 countsp->nstat_wired_rxbytes = sf->sf_ibytes;
6461 countsp->nstat_wired_txbytes = sf->sf_obytes;
6462 }
6463 }
6464
6465 if (metadatap) {
6466 nstat_tcp_descriptor *desc = (nstat_tcp_descriptor *)metadatap;
6467 memset(desc, 0, sizeof(*desc));
6468
6469 // Metadata from the flow registration
6470 uuid_copy(desc->fuuid, flow_registration->registration_id);
6471
6472 // Metadata that the necp client should have in TLV format.
6473 pid_t effective_pid = client->proc_pid;
6474 necp_find_netstat_data(client, (union necp_sockaddr_union *)&desc->remote, &effective_pid, &desc->uid, desc->euuid, &desc->persona_id, &desc->traffic_class, &desc->fallback_mode);
6475 desc->epid = (u_int32_t)effective_pid;
6476
6477 // Metadata from the flow registration
6478 // This needs to revisited if multiple flows are created from one flow registration
6479 struct necp_client_flow *flow = NULL;
6480 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
6481 memcpy(&desc->local, &flow->local_addr, sizeof(desc->local));
6482 break;
6483 }
6484
6485 // Metadata from the route
6486 desc->ifindex = route_ifindex;
6487 desc->ifnet_properties = route_ifflags | nstat_diagnostic_flags;
6488 desc->ifnet_properties |= (sf->sf_flags & SFLOWF_ONLINK) ? NSTAT_IFNET_IS_LOCAL : NSTAT_IFNET_IS_NON_LOCAL;
6489 if (tcpstats->necp_tcp_extra.flags1 & SOF1_CELLFALLBACK) {
6490 desc->ifnet_properties |= NSTAT_IFNET_VIA_CELLFALLBACK;
6491 }
6492
6493 // Basic metadata from userland
6494 desc->rcvbufsize = tcpstats->necp_tcp_basic.rcvbufsize;
6495 desc->rcvbufused = tcpstats->necp_tcp_basic.rcvbufused;
6496
6497 // Additional TCP specific data
6498 desc->sndbufsize = tcpstats->necp_tcp_extra.sndbufsize;
6499 desc->sndbufused = tcpstats->necp_tcp_extra.sndbufused;
6500 desc->txunacked = tcpstats->necp_tcp_extra.txunacked;
6501 desc->txwindow = tcpstats->necp_tcp_extra.txwindow;
6502 desc->txcwindow = tcpstats->necp_tcp_extra.txcwindow;
6503 desc->traffic_mgt_flags = tcpstats->necp_tcp_extra.traffic_mgt_flags;
6504 desc->state = tcpstats->necp_tcp_extra.state;
6505
6506 u_int32_t cc_alg_index = tcpstats->necp_tcp_extra.cc_alg_index;
6507 if (cc_alg_index < TCP_CC_ALGO_COUNT) {
6508 strlcpy(desc->cc_algo, tcp_cc_algo_list[cc_alg_index]->name, sizeof(desc->cc_algo));
6509 } else {
6510 strlcpy(desc->cc_algo, "unknown", sizeof(desc->cc_algo));
6511 }
6512
6513 desc->connstatus.probe_activated = tcpstats->necp_tcp_extra.probestatus.probe_activated;
6514 desc->connstatus.write_probe_failed = tcpstats->necp_tcp_extra.probestatus.write_probe_failed;
6515 desc->connstatus.read_probe_failed = tcpstats->necp_tcp_extra.probestatus.read_probe_failed;
6516 desc->connstatus.conn_probe_failed = tcpstats->necp_tcp_extra.probestatus.conn_probe_failed;
6517
6518 memcpy(&desc->activity_bitmap, &sf->sf_activity, sizeof(sf->sf_activity));
6519
6520 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_FLOW)) {
6521 uuid_string_t euuid_str = { 0 };
6522 uuid_unparse(desc->euuid, euuid_str);
6523 NECPLOG(LOG_NOTICE, "Collected stats - TCP - epid %d uid %d euuid %s persona id %d", desc->epid, desc->uid, euuid_str, desc->persona_id);
6524 }
6525 }
6526
6527 return true;
6528 }
6529
6530 // Called from NetworkStatistics when it wishes to collect latest information for a UDP flow.
6531 static bool
necp_request_udp_netstats(userland_stats_provider_context * ctx,u_int32_t * ifflagsp,nstat_progress_digest * digestp,nstat_counts * countsp,void * metadatap)6532 necp_request_udp_netstats(userland_stats_provider_context *ctx,
6533 u_int32_t *ifflagsp,
6534 nstat_progress_digest *digestp,
6535 nstat_counts *countsp,
6536 void *metadatap)
6537 {
6538 #pragma unused(digestp)
6539
6540 if (ctx == NULL) {
6541 return false;
6542 }
6543
6544 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6545 struct necp_client *client = flow_registration->client;
6546 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
6547 struct necp_udp_stats *udpstats = (struct necp_udp_stats *)ustats_kaddr;
6548 ASSERT(udpstats != NULL);
6549
6550 u_int32_t nstat_diagnostic_flags = 0;
6551
6552 // Retrieve details from the last time the assigned flows were updated
6553 u_int32_t route_ifindex = IFSCOPE_NONE;
6554 u_int32_t route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6555 u_int64_t combined_interface_details = 0;
6556
6557 combined_interface_details = os_atomic_load(&flow_registration->last_interface_details, relaxed);
6558 split_interface_details(combined_interface_details, &route_ifindex, &route_ifflags);
6559
6560 if (route_ifindex == IFSCOPE_NONE) {
6561 // Mark no interface
6562 nstat_diagnostic_flags |= NSTAT_IFNET_ROUTE_VALUE_UNOBTAINABLE;
6563 route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6564 NECPLOG(LOG_INFO, "req udp stats, failed to get route details for pid %d curproc %d %s\n",
6565 client->proc_pid, proc_pid(current_proc()), proc_best_name(current_proc()));
6566 }
6567
6568 if (ifflagsp) {
6569 *ifflagsp = route_ifflags | nstat_diagnostic_flags;
6570 if ((countsp == NULL) && (metadatap == NULL)) {
6571 return true;
6572 }
6573 }
6574 const struct sk_stats_flow *sf = &flow_registration->nexus_stats->fs_stats;
6575 if (sf == NULL) {
6576 nstat_diagnostic_flags |= NSTAT_IFNET_FLOWSWITCH_VALUE_UNOBTAINABLE;
6577 char namebuf[MAXCOMLEN + 1];
6578 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
6579 proc_name(client->proc_pid, namebuf, sizeof(namebuf));
6580 NECPLOG(LOG_ERR, "req udp stats, necp_client flow_registration flow_stats missing for pid %d %s curproc %d %s\n",
6581 client->proc_pid, namebuf, proc_pid(current_proc()), proc_best_name(current_proc()));
6582 sf = &ntstat_sk_stats_zero;
6583 }
6584
6585 if (countsp) {
6586 countsp->nstat_rxbytes = udpstats->necp_udp_counts.necp_stat_rxbytes;
6587 countsp->nstat_txbytes = udpstats->necp_udp_counts.necp_stat_txbytes;
6588
6589 countsp->nstat_rxduplicatebytes = udpstats->necp_udp_counts.necp_stat_rxduplicatebytes;
6590 countsp->nstat_rxoutoforderbytes = udpstats->necp_udp_counts.necp_stat_rxoutoforderbytes;
6591 countsp->nstat_txretransmit = udpstats->necp_udp_counts.necp_stat_txretransmit;
6592
6593 countsp->nstat_min_rtt = udpstats->necp_udp_counts.necp_stat_min_rtt;
6594 countsp->nstat_avg_rtt = udpstats->necp_udp_counts.necp_stat_avg_rtt;
6595 countsp->nstat_var_rtt = udpstats->necp_udp_counts.necp_stat_var_rtt;
6596
6597 // Supplement what the user level has told us with what we know from the flowswitch
6598 countsp->nstat_rxpackets = sf->sf_ipackets;
6599 countsp->nstat_txpackets = sf->sf_opackets;
6600 if (route_ifflags & NSTAT_IFNET_IS_CELLULAR) {
6601 countsp->nstat_cell_rxbytes = sf->sf_ibytes;
6602 countsp->nstat_cell_txbytes = sf->sf_obytes;
6603 } else if (route_ifflags & NSTAT_IFNET_IS_WIFI) {
6604 countsp->nstat_wifi_rxbytes = sf->sf_ibytes;
6605 countsp->nstat_wifi_txbytes = sf->sf_obytes;
6606 } else if (route_ifflags & NSTAT_IFNET_IS_WIRED) {
6607 countsp->nstat_wired_rxbytes = sf->sf_ibytes;
6608 countsp->nstat_wired_txbytes = sf->sf_obytes;
6609 }
6610 }
6611
6612 if (metadatap) {
6613 nstat_udp_descriptor *desc = (nstat_udp_descriptor *)metadatap;
6614 memset(desc, 0, sizeof(*desc));
6615
6616 // Metadata from the flow registration
6617 uuid_copy(desc->fuuid, flow_registration->registration_id);
6618
6619 // Metadata that the necp client should have in TLV format.
6620 pid_t effective_pid = client->proc_pid;
6621 necp_find_netstat_data(client, (union necp_sockaddr_union *)&desc->remote, &effective_pid, &desc->uid, desc->euuid, &desc->persona_id, &desc->traffic_class, &desc->fallback_mode);
6622 desc->epid = (u_int32_t)effective_pid;
6623
6624 // Metadata from the flow registration
6625 // This needs to revisited if multiple flows are created from one flow registration
6626 struct necp_client_flow *flow = NULL;
6627 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
6628 memcpy(&desc->local, &flow->local_addr, sizeof(desc->local));
6629 break;
6630 }
6631
6632 // Metadata from the route
6633 desc->ifindex = route_ifindex;
6634 desc->ifnet_properties = route_ifflags | nstat_diagnostic_flags;
6635 desc->ifnet_properties |= (sf->sf_flags & SFLOWF_ONLINK) ? NSTAT_IFNET_IS_LOCAL : NSTAT_IFNET_IS_NON_LOCAL;
6636
6637 // Basic metadata is all that is required for UDP
6638 desc->rcvbufsize = udpstats->necp_udp_basic.rcvbufsize;
6639 desc->rcvbufused = udpstats->necp_udp_basic.rcvbufused;
6640
6641 memcpy(&desc->activity_bitmap, &sf->sf_activity, sizeof(sf->sf_activity));
6642
6643 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_FLOW)) {
6644 uuid_string_t euuid_str = { 0 };
6645 uuid_unparse(desc->euuid, euuid_str);
6646 NECPLOG(LOG_NOTICE, "Collected stats - UDP - epid %d uid %d euuid %s persona id %d", desc->epid, desc->uid, euuid_str, desc->persona_id);
6647 }
6648 }
6649
6650 return true;
6651 }
6652
6653 // Called from NetworkStatistics when it wishes to collect latest information for a QUIC flow.
6654 //
6655 // TODO: For now it is an exact implementation as that of TCP.
6656 // Still to keep the logic separate for future divergence, keeping the routines separate.
6657 // It also seems there are lots of common code between existing implementations and
6658 // it would be good to refactor this logic at some point.
6659 static bool
necp_request_quic_netstats(userland_stats_provider_context * ctx,u_int32_t * ifflagsp,nstat_progress_digest * digestp,nstat_counts * countsp,void * metadatap)6660 necp_request_quic_netstats(userland_stats_provider_context *ctx,
6661 u_int32_t *ifflagsp,
6662 nstat_progress_digest *digestp,
6663 nstat_counts *countsp,
6664 void *metadatap)
6665 {
6666 if (ctx == NULL) {
6667 return false;
6668 }
6669
6670 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6671 struct necp_client *client = flow_registration->client;
6672 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
6673 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
6674 ASSERT(quicstats != NULL);
6675
6676 u_int32_t nstat_diagnostic_flags = 0;
6677
6678 // Retrieve details from the last time the assigned flows were updated
6679 u_int32_t route_ifindex = IFSCOPE_NONE;
6680 u_int32_t route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6681 u_int64_t combined_interface_details = 0;
6682
6683 combined_interface_details = os_atomic_load(&flow_registration->last_interface_details, relaxed);
6684 split_interface_details(combined_interface_details, &route_ifindex, &route_ifflags);
6685
6686 if (route_ifindex == IFSCOPE_NONE) {
6687 // Mark no interface
6688 nstat_diagnostic_flags |= NSTAT_IFNET_ROUTE_VALUE_UNOBTAINABLE;
6689 route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6690 NECPLOG(LOG_INFO, "req quic stats, failed to get route details for pid %d curproc %d %s\n",
6691 client->proc_pid, proc_pid(current_proc()), proc_best_name(current_proc()));
6692 }
6693
6694 if (ifflagsp) {
6695 *ifflagsp = route_ifflags | nstat_diagnostic_flags;
6696 if ((digestp == NULL) && (countsp == NULL) && (metadatap == NULL)) {
6697 return true;
6698 }
6699 }
6700
6701 if (digestp) {
6702 // The digest is intended to give information that may help give insight into the state of the link
6703 // while avoiding the need to do the relatively expensive flowswitch lookup
6704 digestp->rxbytes = quicstats->necp_quic_counts.necp_stat_rxbytes;
6705 digestp->txbytes = quicstats->necp_quic_counts.necp_stat_txbytes;
6706 digestp->rxduplicatebytes = quicstats->necp_quic_counts.necp_stat_rxduplicatebytes;
6707 digestp->rxoutoforderbytes = quicstats->necp_quic_counts.necp_stat_rxoutoforderbytes;
6708 digestp->txretransmit = quicstats->necp_quic_counts.necp_stat_txretransmit;
6709 digestp->ifindex = route_ifindex;
6710 digestp->state = quicstats->necp_quic_extra.state;
6711 digestp->txunacked = quicstats->necp_quic_extra.txunacked;
6712 digestp->txwindow = quicstats->necp_quic_extra.txwindow;
6713 digestp->connstatus.probe_activated = quicstats->necp_quic_extra.probestatus.probe_activated;
6714 digestp->connstatus.write_probe_failed = quicstats->necp_quic_extra.probestatus.write_probe_failed;
6715 digestp->connstatus.read_probe_failed = quicstats->necp_quic_extra.probestatus.read_probe_failed;
6716 digestp->connstatus.conn_probe_failed = quicstats->necp_quic_extra.probestatus.conn_probe_failed;
6717
6718 if ((countsp == NULL) && (metadatap == NULL)) {
6719 return true;
6720 }
6721 }
6722
6723 const struct sk_stats_flow *sf = &flow_registration->nexus_stats->fs_stats;
6724 if (sf == NULL) {
6725 nstat_diagnostic_flags |= NSTAT_IFNET_FLOWSWITCH_VALUE_UNOBTAINABLE;
6726 char namebuf[MAXCOMLEN + 1];
6727 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
6728 proc_name(client->proc_pid, namebuf, sizeof(namebuf));
6729 NECPLOG(LOG_ERR, "req quic stats, necp_client flow_registration flow_stats missing for pid %d %s curproc %d %s\n",
6730 client->proc_pid, namebuf, proc_pid(current_proc()), proc_best_name(current_proc()));
6731 sf = &ntstat_sk_stats_zero;
6732 }
6733
6734 if (countsp) {
6735 countsp->nstat_rxbytes = quicstats->necp_quic_counts.necp_stat_rxbytes;
6736 countsp->nstat_txbytes = quicstats->necp_quic_counts.necp_stat_txbytes;
6737
6738 countsp->nstat_rxduplicatebytes = quicstats->necp_quic_counts.necp_stat_rxduplicatebytes;
6739 countsp->nstat_rxoutoforderbytes = quicstats->necp_quic_counts.necp_stat_rxoutoforderbytes;
6740 countsp->nstat_txretransmit = quicstats->necp_quic_counts.necp_stat_txretransmit;
6741
6742 countsp->nstat_min_rtt = quicstats->necp_quic_counts.necp_stat_min_rtt;
6743 countsp->nstat_avg_rtt = quicstats->necp_quic_counts.necp_stat_avg_rtt;
6744 countsp->nstat_var_rtt = quicstats->necp_quic_counts.necp_stat_var_rtt;
6745
6746 // TODO: It would be good to expose QUIC stats for CH/SH retransmission and connection state
6747 // Supplement what the user level has told us with what we know from the flowswitch
6748 countsp->nstat_rxpackets = sf->sf_ipackets;
6749 countsp->nstat_txpackets = sf->sf_opackets;
6750 if (route_ifflags & NSTAT_IFNET_IS_CELLULAR) {
6751 countsp->nstat_cell_rxbytes = sf->sf_ibytes;
6752 countsp->nstat_cell_txbytes = sf->sf_obytes;
6753 } else if (route_ifflags & NSTAT_IFNET_IS_WIFI) {
6754 countsp->nstat_wifi_rxbytes = sf->sf_ibytes;
6755 countsp->nstat_wifi_txbytes = sf->sf_obytes;
6756 } else if (route_ifflags & NSTAT_IFNET_IS_WIRED) {
6757 countsp->nstat_wired_rxbytes = sf->sf_ibytes;
6758 countsp->nstat_wired_txbytes = sf->sf_obytes;
6759 }
6760 }
6761
6762 if (metadatap) {
6763 nstat_quic_descriptor *desc = (nstat_quic_descriptor *)metadatap;
6764 memset(desc, 0, sizeof(*desc));
6765
6766 // Metadata from the flow registration
6767 uuid_copy(desc->fuuid, flow_registration->registration_id);
6768
6769 // Metadata, that the necp client should have, in TLV format.
6770 pid_t effective_pid = client->proc_pid;
6771 necp_find_netstat_data(client, (union necp_sockaddr_union *)&desc->remote, &effective_pid, &desc->uid, desc->euuid, &desc->persona_id, &desc->traffic_class, &desc->fallback_mode);
6772 desc->epid = (u_int32_t)effective_pid;
6773
6774 // Metadata from the flow registration
6775 // This needs to revisited if multiple flows are created from one flow registration
6776 struct necp_client_flow *flow = NULL;
6777 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
6778 memcpy(&desc->local, &flow->local_addr, sizeof(desc->local));
6779 break;
6780 }
6781
6782 // Metadata from the route
6783 desc->ifindex = route_ifindex;
6784 desc->ifnet_properties = route_ifflags | nstat_diagnostic_flags;
6785 desc->ifnet_properties |= (sf->sf_flags & SFLOWF_ONLINK) ? NSTAT_IFNET_IS_LOCAL : NSTAT_IFNET_IS_NON_LOCAL;
6786
6787 // Basic metadata from userland
6788 desc->rcvbufsize = quicstats->necp_quic_basic.rcvbufsize;
6789 desc->rcvbufused = quicstats->necp_quic_basic.rcvbufused;
6790
6791 // Additional QUIC specific data
6792 desc->sndbufsize = quicstats->necp_quic_extra.sndbufsize;
6793 desc->sndbufused = quicstats->necp_quic_extra.sndbufused;
6794 desc->txunacked = quicstats->necp_quic_extra.txunacked;
6795 desc->txwindow = quicstats->necp_quic_extra.txwindow;
6796 desc->txcwindow = quicstats->necp_quic_extra.txcwindow;
6797 desc->traffic_mgt_flags = quicstats->necp_quic_extra.traffic_mgt_flags;
6798 desc->state = quicstats->necp_quic_extra.state;
6799
6800 // TODO: CC algo defines should be named agnostic of the protocol
6801 u_int32_t cc_alg_index = quicstats->necp_quic_extra.cc_alg_index;
6802 if (cc_alg_index < TCP_CC_ALGO_COUNT) {
6803 strlcpy(desc->cc_algo, tcp_cc_algo_list[cc_alg_index]->name, sizeof(desc->cc_algo));
6804 } else {
6805 strlcpy(desc->cc_algo, "unknown", sizeof(desc->cc_algo));
6806 }
6807
6808 memcpy(&desc->activity_bitmap, &sf->sf_activity, sizeof(sf->sf_activity));
6809
6810 desc->connstatus.probe_activated = quicstats->necp_quic_extra.probestatus.probe_activated;
6811 desc->connstatus.write_probe_failed = quicstats->necp_quic_extra.probestatus.write_probe_failed;
6812 desc->connstatus.read_probe_failed = quicstats->necp_quic_extra.probestatus.read_probe_failed;
6813 desc->connstatus.conn_probe_failed = quicstats->necp_quic_extra.probestatus.conn_probe_failed;
6814
6815 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_FLOW)) {
6816 uuid_string_t euuid_str = { 0 };
6817 uuid_unparse(desc->euuid, euuid_str);
6818 NECPLOG(LOG_NOTICE, "Collected stats - QUIC - epid %d uid %d euuid %s persona id %d", desc->epid, desc->uid, euuid_str, desc->persona_id);
6819 }
6820 }
6821 return true;
6822 }
6823
6824 #endif /* SKYWALK */
6825
6826 // Support functions for NetworkStatistics support for necp_client connections
6827
6828 static void
necp_client_inherit_from_parent(struct necp_client * client,struct necp_client * parent)6829 necp_client_inherit_from_parent(
6830 struct necp_client *client,
6831 struct necp_client *parent)
6832 {
6833 assert(client->original_parameters_source == NULL);
6834
6835 if (parent->original_parameters_source != NULL) {
6836 client->original_parameters_source = parent->original_parameters_source;
6837 } else {
6838 client->original_parameters_source = parent;
6839 }
6840 necp_client_retain(client->original_parameters_source);
6841 }
6842
6843 static void
necp_find_conn_netstat_data(struct necp_client * client,u_int32_t * ntstat_flags,pid_t * effective_pid,uuid_t puuid,uid_t * uid,uuid_t euuid,uid_t * persona_id)6844 necp_find_conn_netstat_data(struct necp_client *client,
6845 u_int32_t *ntstat_flags,
6846 pid_t *effective_pid,
6847 uuid_t puuid,
6848 uid_t *uid,
6849 uuid_t euuid,
6850 uid_t *persona_id)
6851 {
6852 bool has_remote_address = false;
6853 bool has_ip_protocol = false;
6854 bool has_transport_protocol = false;
6855 size_t offset = 0;
6856 u_int8_t *parameters;
6857 u_int32_t parameters_size;
6858
6859
6860 parameters = client->parameters;
6861 parameters_size = (u_int32_t)client->parameters_length;
6862
6863 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
6864 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
6865 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
6866
6867 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
6868 // If the length is larger than what can fit in the remaining parameters size, bail
6869 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
6870 break;
6871 }
6872
6873 if (length > 0) {
6874 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
6875 if (value != NULL) {
6876 switch (type) {
6877 case NECP_CLIENT_PARAMETER_APPLICATION: {
6878 if ((euuid) && (length >= sizeof(uuid_t))) {
6879 uuid_copy(euuid, value);
6880 }
6881 break;
6882 }
6883 case NECP_CLIENT_PARAMETER_IP_PROTOCOL: {
6884 if (length >= 1) {
6885 has_ip_protocol = true;
6886 }
6887 break;
6888 }
6889 case NECP_CLIENT_PARAMETER_PID: {
6890 if ((effective_pid) && length >= sizeof(pid_t)) {
6891 memcpy(effective_pid, value, sizeof(pid_t));
6892 }
6893 break;
6894 }
6895 case NECP_CLIENT_PARAMETER_PARENT_ID: {
6896 if ((puuid) && (length == sizeof(uuid_t))) {
6897 uuid_copy(puuid, value);
6898 }
6899 break;
6900 }
6901 // It is an implementation quirk that the remote address can be found in the necp parameters
6902 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
6903 if (length >= sizeof(struct necp_policy_condition_addr)) {
6904 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
6905 if (necp_client_address_is_valid(&address_struct->address.sa)) {
6906 has_remote_address = true;
6907 }
6908 }
6909 break;
6910 }
6911 case NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL: {
6912 if (length >= 1) {
6913 has_transport_protocol = true;
6914 }
6915 break;
6916 }
6917 case NECP_CLIENT_PARAMETER_APPLICATION_ID: {
6918 if (length >= sizeof(necp_application_id_t) && uid && persona_id) {
6919 necp_application_id_t *application_id = (necp_application_id_t *)(void *)value;
6920 memcpy(uid, &application_id->uid, sizeof(uid_t));
6921 uuid_copy(euuid, application_id->effective_uuid);
6922 memcpy(persona_id, &application_id->persona_id, sizeof(uid_t));
6923 }
6924 break;
6925 }
6926 default: {
6927 break;
6928 }
6929 }
6930 }
6931 }
6932 offset += sizeof(struct necp_tlv_header) + length;
6933 }
6934 if (ntstat_flags) {
6935 *ntstat_flags = (has_remote_address && has_ip_protocol && has_transport_protocol)? NSTAT_NECP_CONN_HAS_NET_ACCESS: 0;
6936 }
6937 }
6938
6939 static bool
necp_request_conn_netstats(nstat_provider_context ctx,u_int32_t * ifflagsp,nstat_counts * countsp,void * metadatap)6940 necp_request_conn_netstats(nstat_provider_context ctx,
6941 u_int32_t *ifflagsp,
6942 nstat_counts *countsp,
6943 void *metadatap)
6944 {
6945 if (ctx == NULL) {
6946 return false;
6947 }
6948 struct necp_client *client = (struct necp_client *)(uintptr_t)ctx;
6949 nstat_connection_descriptor *desc = (nstat_connection_descriptor *)metadatap;
6950
6951 if (ifflagsp) {
6952 necp_find_conn_netstat_data(client, ifflagsp, NULL, NULL, NULL, NULL, NULL);
6953 }
6954 if (countsp) {
6955 memset(countsp, 0, sizeof(*countsp));
6956 }
6957 if (desc) {
6958 memset(desc, 0, sizeof(*desc));
6959 // Metadata, that the necp client should have, in TLV format.
6960 pid_t effective_pid = client->proc_pid;
6961 necp_find_conn_netstat_data(client, &desc->ifnet_properties, &effective_pid, desc->puuid, &desc->uid, desc->euuid, &desc->persona_id);
6962 desc->epid = (u_int32_t)effective_pid;
6963
6964 // User level should obtain almost all connection information from an extension
6965 // leaving little to do here
6966 uuid_copy(desc->fuuid, client->latest_flow_registration_id);
6967 uuid_copy(desc->cuuid, client->client_id);
6968 }
6969 return true;
6970 }
6971
6972 static int
necp_skywalk_priv_check_cred(proc_t p,kauth_cred_t cred)6973 necp_skywalk_priv_check_cred(proc_t p, kauth_cred_t cred)
6974 {
6975 #pragma unused(p, cred)
6976 #if SKYWALK
6977 /* This includes Nexus controller and Skywalk observer privs */
6978 return skywalk_nxctl_check_privileges(p, cred);
6979 #else /* !SKYWALK */
6980 return 0;
6981 #endif /* !SKYWALK */
6982 }
6983
6984 /// System calls
6985
6986 int
necp_open(struct proc * p,struct necp_open_args * uap,int * retval)6987 necp_open(struct proc *p, struct necp_open_args *uap, int *retval)
6988 {
6989 #pragma unused(retval)
6990 int error = 0;
6991 struct necp_fd_data *fd_data = NULL;
6992 struct fileproc *fp = NULL;
6993 int fd = -1;
6994
6995 if (uap->flags & NECP_OPEN_FLAG_OBSERVER ||
6996 uap->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
6997 if (necp_skywalk_priv_check_cred(p, kauth_cred_get()) != 0 &&
6998 priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NETWORK_STATISTICS, 0) != 0) {
6999 NECPLOG0(LOG_ERR, "Client does not hold necessary entitlement to observe other NECP clients");
7000 error = EACCES;
7001 goto done;
7002 }
7003 }
7004
7005 #if CONFIG_MACF
7006 error = mac_necp_check_open(p, uap->flags);
7007 if (error) {
7008 goto done;
7009 }
7010 #endif /* MACF */
7011
7012 error = falloc(p, &fp, &fd);
7013 if (error != 0) {
7014 goto done;
7015 }
7016
7017 fd_data = kalloc_type(struct necp_fd_data, Z_WAITOK | Z_ZERO | Z_NOFAIL);
7018
7019 fd_data->necp_fd_type = necp_fd_type_client;
7020 fd_data->flags = uap->flags;
7021 RB_INIT(&fd_data->clients);
7022 RB_INIT(&fd_data->flows);
7023 TAILQ_INIT(&fd_data->update_list);
7024 lck_mtx_init(&fd_data->fd_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
7025 klist_init(&fd_data->si.si_note);
7026 fd_data->proc_pid = proc_pid(p);
7027 #if SKYWALK
7028 LIST_INIT(&fd_data->stats_arena_list);
7029 #endif /* !SKYWALK */
7030
7031 fp->fp_flags |= FP_CLOEXEC | FP_CLOFORK;
7032 fp->fp_glob->fg_flag = FREAD;
7033 fp->fp_glob->fg_ops = &necp_fd_ops;
7034 fp_set_data(fp, fd_data);
7035
7036 proc_fdlock(p);
7037
7038 procfdtbl_releasefd(p, fd, NULL);
7039 fp_drop(p, fd, fp, 1);
7040
7041 *retval = fd;
7042
7043 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
7044 NECP_OBSERVER_LIST_LOCK_EXCLUSIVE();
7045 LIST_INSERT_HEAD(&necp_fd_observer_list, fd_data, chain);
7046 OSIncrementAtomic(&necp_observer_fd_count);
7047 NECP_OBSERVER_LIST_UNLOCK();
7048
7049 // Walk all existing clients and add them
7050 NECP_CLIENT_TREE_LOCK_SHARED();
7051 struct necp_client *existing_client = NULL;
7052 RB_FOREACH(existing_client, _necp_client_global_tree, &necp_client_global_tree) {
7053 NECP_CLIENT_LOCK(existing_client);
7054 necp_client_update_observer_add_internal(fd_data, existing_client);
7055 necp_client_update_observer_update_internal(fd_data, existing_client);
7056 NECP_CLIENT_UNLOCK(existing_client);
7057 }
7058 NECP_CLIENT_TREE_UNLOCK();
7059 } else {
7060 NECP_FD_LIST_LOCK_EXCLUSIVE();
7061 LIST_INSERT_HEAD(&necp_fd_list, fd_data, chain);
7062 OSIncrementAtomic(&necp_client_fd_count);
7063 NECP_FD_LIST_UNLOCK();
7064 }
7065
7066 proc_fdunlock(p);
7067
7068 done:
7069 if (error != 0) {
7070 if (fp != NULL) {
7071 fp_free(p, fd, fp);
7072 fp = NULL;
7073 }
7074 if (fd_data != NULL) {
7075 kfree_type(struct necp_fd_data, fd_data);
7076 }
7077 }
7078
7079 return error;
7080 }
7081
7082 // All functions called directly from necp_client_action() to handle one of the
7083 // types should be marked with NECP_CLIENT_ACTION_FUNCTION. This ensures that
7084 // necp_client_action() does not inline all the actions into a single function.
7085 #define NECP_CLIENT_ACTION_FUNCTION __attribute__((noinline))
7086
7087 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_add(struct proc * p,struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7088 necp_client_add(struct proc *p, struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7089 {
7090 int error = 0;
7091 struct necp_client *client = NULL;
7092 const size_t buffer_size = uap->buffer_size;
7093
7094 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
7095 NECPLOG0(LOG_ERR, "NECP client observers with push enabled may not add their own clients");
7096 return EINVAL;
7097 }
7098
7099 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
7100 buffer_size == 0 || buffer_size > NECP_MAX_CLIENT_PARAMETERS_SIZE || uap->buffer == 0) {
7101 return EINVAL;
7102 }
7103
7104 client = kalloc_type(struct necp_client, Z_WAITOK | Z_ZERO | Z_NOFAIL);
7105 client->parameters = kalloc_data(buffer_size, Z_WAITOK | Z_NOFAIL);
7106 client->parameters_length = buffer_size;
7107 lck_mtx_init(&client->lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
7108 lck_mtx_init(&client->route_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
7109
7110 error = copyin(uap->buffer, client->parameters, buffer_size);
7111 if (error) {
7112 NECPLOG(LOG_ERR, "necp_client_add parameters copyin error (%d)", error);
7113 goto done;
7114 }
7115
7116 os_ref_init(&client->reference_count, &necp_client_refgrp); // Hold our reference until close
7117
7118 client->proc_pid = fd_data->proc_pid; // Save off proc pid in case the client will persist past fd
7119 client->agent_handle = (void *)fd_data;
7120 client->platform_binary = ((csproc_get_platform_binary(p) == 0) ? 0 : 1);
7121
7122 necp_generate_client_id(client->client_id, false);
7123 LIST_INIT(&client->assertion_list);
7124 RB_INIT(&client->flow_registrations);
7125
7126 NECP_CLIENT_LOG(client, "Adding client");
7127
7128 error = copyout(client->client_id, uap->client_id, sizeof(uuid_t));
7129 if (error) {
7130 NECPLOG(LOG_ERR, "necp_client_add client_id copyout error (%d)", error);
7131 goto done;
7132 }
7133
7134 #if SKYWALK
7135 struct necp_client_parsed_parameters parsed_parameters = {};
7136 int parse_error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, &parsed_parameters);
7137
7138 if (parse_error == 0 &&
7139 ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID) ||
7140 (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER))) {
7141 bool has_delegation_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_SOCKET_DELEGATE, 0) == 0);
7142 if (!has_delegation_entitlement) {
7143 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID) {
7144 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to delegate network traffic for other processes by upid",
7145 proc_name_address(p), proc_pid(p));
7146 }
7147 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER) {
7148 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to set attributed bundle identifier",
7149 proc_name_address(p), proc_pid(p));
7150 }
7151 error = EPERM;
7152 goto done;
7153 }
7154
7155 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID) {
7156 // Save off delegated unique PID
7157 client->delegated_upid = parsed_parameters.delegated_upid;
7158 }
7159 }
7160
7161 if (parse_error == 0 && parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) {
7162 bool has_nexus_entitlement = (necp_skywalk_priv_check_cred(p, kauth_cred_get()) == 0);
7163 if (!has_nexus_entitlement) {
7164 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to open a custom nexus client",
7165 proc_name_address(p), proc_pid(p));
7166 error = EPERM;
7167 goto done;
7168 }
7169 }
7170
7171 if (parse_error == 0 && (parsed_parameters.flags &
7172 (NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER | NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP))) {
7173 bool has_custom_protocol_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_CUSTOM_PROTOCOL, 0) == 0);
7174 if (!has_custom_protocol_entitlement) {
7175 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement for custom protocol APIs",
7176 proc_name_address(p), proc_pid(p));
7177 error = EPERM;
7178 goto done;
7179 }
7180 }
7181
7182 if (parse_error == 0 && parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER &&
7183 (parsed_parameters.ip_protocol == IPPROTO_TCP || parsed_parameters.ip_protocol == IPPROTO_UDP)) {
7184 uint32_t *netns_addr = NULL;
7185 uint8_t netns_addr_len = 0;
7186 struct ns_flow_info flow_info = {};
7187 uint32_t netns_flags = NETNS_LISTENER;
7188 uuid_copy(flow_info.nfi_flow_uuid, client->client_id);
7189 flow_info.nfi_protocol = parsed_parameters.ip_protocol;
7190 flow_info.nfi_owner_pid = client->proc_pid;
7191 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID) {
7192 flow_info.nfi_effective_pid = parsed_parameters.effective_pid;
7193 } else {
7194 flow_info.nfi_effective_pid = flow_info.nfi_owner_pid;
7195 }
7196 proc_name(flow_info.nfi_owner_pid, flow_info.nfi_owner_name, MAXCOMLEN);
7197 proc_name(flow_info.nfi_effective_pid, flow_info.nfi_effective_name, MAXCOMLEN);
7198
7199 if (parsed_parameters.local_addr.sa.sa_family == AF_UNSPEC) {
7200 // Treat no local address as a wildcard IPv6
7201 // parsed_parameters is already initialized to all zeros
7202 parsed_parameters.local_addr.sin6.sin6_family = AF_INET6;
7203 parsed_parameters.local_addr.sin6.sin6_len = sizeof(struct sockaddr_in6);
7204 }
7205
7206 switch (parsed_parameters.local_addr.sa.sa_family) {
7207 case AF_INET: {
7208 memcpy(&flow_info.nfi_laddr, &parsed_parameters.local_addr.sa, parsed_parameters.local_addr.sa.sa_len);
7209 netns_addr = (uint32_t *)&parsed_parameters.local_addr.sin.sin_addr;
7210 netns_addr_len = 4;
7211 break;
7212 }
7213 case AF_INET6: {
7214 memcpy(&flow_info.nfi_laddr, &parsed_parameters.local_addr.sa, parsed_parameters.local_addr.sa.sa_len);
7215 netns_addr = (uint32_t *)&parsed_parameters.local_addr.sin6.sin6_addr;
7216 netns_addr_len = 16;
7217 break;
7218 }
7219
7220 default: {
7221 NECPLOG(LOG_ERR, "necp_client_add listener invalid address family (%d)", parsed_parameters.local_addr.sa.sa_family);
7222 error = EINVAL;
7223 goto done;
7224 }
7225 }
7226 if ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
7227 (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_REUSE_LOCAL)) {
7228 netns_flags |= NETNS_REUSEPORT;
7229 }
7230 if (parsed_parameters.local_addr.sin.sin_port == 0) {
7231 error = netns_reserve_ephemeral(&client->port_reservation, netns_addr, netns_addr_len, parsed_parameters.ip_protocol,
7232 &parsed_parameters.local_addr.sin.sin_port, netns_flags, &flow_info);
7233 if (error) {
7234 NECPLOG(LOG_ERR, "necp_client_add netns_reserve_ephemeral error (%d)", error);
7235 goto done;
7236 }
7237
7238 // Update the parameter TLVs with the assigned port
7239 necp_client_update_local_port_parameters(client->parameters, (u_int32_t)client->parameters_length, parsed_parameters.local_addr.sin.sin_port);
7240 } else {
7241 error = netns_reserve(&client->port_reservation, netns_addr, netns_addr_len, parsed_parameters.ip_protocol,
7242 parsed_parameters.local_addr.sin.sin_port, netns_flags, &flow_info);
7243 if (error) {
7244 NECPLOG(LOG_ERR, "necp_client_add netns_reserve error (%d)", error);
7245 goto done;
7246 }
7247 }
7248 }
7249
7250 struct necp_client *parent = NULL;
7251 uuid_t parent_client_id;
7252 uuid_clear(parent_client_id);
7253 struct necp_client_nexus_parameters parent_parameters = {};
7254 uint16_t num_flow_regs = 0;
7255 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_PARENT_UUID) {
7256 // The parent "should" be found on fd_data without having to search across the whole necp_fd_list
7257 // It would be nice to do this a little further down where there's another instance of NECP_FD_LOCK
7258 // but the logic here depends on the parse paramters
7259 NECP_FD_LOCK(fd_data);
7260 parent = necp_client_fd_find_client_unlocked(fd_data, parsed_parameters.parent_uuid);
7261 if (parent != NULL) {
7262 necp_client_inherit_from_parent(client, parent);
7263 necp_client_copy_parameters_locked(client, &parent_parameters);
7264 uuid_copy(parent_client_id, parsed_parameters.parent_uuid);
7265 struct necp_client_flow_registration *flow_registration = NULL;
7266 RB_FOREACH(flow_registration, _necp_client_flow_tree, &parent->flow_registrations) {
7267 num_flow_regs++;
7268 }
7269 }
7270 NECP_FD_UNLOCK(fd_data);
7271 if (parent == NULL) {
7272 NECPLOG0(LOG_ERR, "necp_client_add, no necp_client_inherit_from_parent as can't find parent on fd_data");
7273 }
7274 }
7275 if (parse_error == 0 && parent != NULL && parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLOW_DEMUX_PATTERN) {
7276 do {
7277 if (parsed_parameters.demux_patterns[0].len == 0) {
7278 NECPLOG0(LOG_INFO, "necp_client_add, child does not have a demux pattern");
7279 break;
7280 }
7281
7282 if (uuid_is_null(parent_client_id)) {
7283 NECPLOG0(LOG_INFO, "necp_client_add, parent ID is null");
7284 break;
7285 }
7286
7287 if (num_flow_regs > 1) {
7288 NECPLOG0(LOG_INFO, "necp_client_add, multiple parent flows not supported");
7289 break;
7290 }
7291 if (parsed_parameters.ip_protocol != IPPROTO_UDP) {
7292 NECPLOG(LOG_INFO, "necp_client_add, flow demux pattern not supported for %d protocol",
7293 parsed_parameters.ip_protocol);
7294 break;
7295 }
7296 if (parsed_parameters.ip_protocol != parent_parameters.ip_protocol) {
7297 NECPLOG0(LOG_INFO, "necp_client_add, parent/child ip protocol mismatch");
7298 break;
7299 }
7300 if (parsed_parameters.local_addr.sa.sa_family != AF_INET && parsed_parameters.local_addr.sa.sa_family != AF_INET6) {
7301 NECPLOG(LOG_INFO, "necp_client_add, flow demux pattern not supported for %d family",
7302 parsed_parameters.local_addr.sa.sa_family);
7303 break;
7304 }
7305 if (parsed_parameters.local_addr.sa.sa_family != parsed_parameters.remote_addr.sa.sa_family) {
7306 NECPLOG0(LOG_INFO, "necp_client_add, local/remote address family mismatch");
7307 break;
7308 }
7309 if (parsed_parameters.local_addr.sa.sa_family != parent_parameters.local_addr.sa.sa_family) {
7310 NECPLOG0(LOG_INFO, "necp_client_add, parent/child address family mismatch");
7311 break;
7312 }
7313 if (memcmp(&parsed_parameters.local_addr.sa, &parent_parameters.local_addr.sa, parsed_parameters.local_addr.sa.sa_len)) {
7314 NECPLOG0(LOG_INFO, "necp_client_add, parent/child local address mismatch");
7315 break;
7316 }
7317 if (memcmp(&parsed_parameters.remote_addr.sa, &parent_parameters.remote_addr.sa, parsed_parameters.remote_addr.sa.sa_len)) {
7318 NECPLOG0(LOG_INFO, "necp_client_add, parent/child remote address mismatch");
7319 break;
7320 }
7321 if (parsed_parameters.local_addr.sin.sin_port != parent_parameters.local_addr.sin.sin_port) {
7322 NECPLOG0(LOG_INFO, "necp_client_add, parent/child local port mismatch");
7323 break;
7324 }
7325 if (parsed_parameters.remote_addr.sin.sin_port != parent_parameters.remote_addr.sin.sin_port) {
7326 NECPLOG0(LOG_INFO, "necp_client_add, parent/child remote port mismatch");
7327 break;
7328 }
7329 client->validated_parent = 1;
7330 uuid_copy(client->parent_client_id, parent_client_id);
7331 } while (false);
7332 }
7333
7334 #endif /* !SKYWALK */
7335
7336 necp_client_update_observer_add(client);
7337
7338 NECP_FD_LOCK(fd_data);
7339 RB_INSERT(_necp_client_tree, &fd_data->clients, client);
7340 OSIncrementAtomic(&necp_client_count);
7341 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
7342 RB_INSERT(_necp_client_global_tree, &necp_client_global_tree, client);
7343 NECP_CLIENT_TREE_UNLOCK();
7344
7345 // Prime the client result
7346 NECP_CLIENT_LOCK(client);
7347 (void)necp_update_client_result(current_proc(), fd_data, client, NULL);
7348 necp_client_retain_locked(client);
7349 NECP_CLIENT_UNLOCK(client);
7350 NECP_FD_UNLOCK(fd_data);
7351 // Now everything is set, it's safe to plumb this in to NetworkStatistics
7352 uint32_t ntstat_properties = 0;
7353 necp_find_conn_netstat_data(client, &ntstat_properties, NULL, NULL, NULL, NULL, NULL);
7354
7355 client->nstat_context = nstat_provider_stats_open((nstat_provider_context)client,
7356 NSTAT_PROVIDER_CONN_USERLAND, (u_int64_t)ntstat_properties, necp_request_conn_netstats, necp_find_conn_extension_info);
7357 necp_client_release(client);
7358 done:
7359 if (error != 0 && client != NULL) {
7360 necp_client_free(client);
7361 client = NULL;
7362 }
7363 *retval = error;
7364
7365 return error;
7366 }
7367
7368 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_claim(struct proc * p,struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7369 necp_client_claim(struct proc *p, struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7370 {
7371 int error = 0;
7372 uuid_t client_id = {};
7373 struct necp_client *client = NULL;
7374
7375 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
7376 error = EINVAL;
7377 goto done;
7378 }
7379
7380 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
7381 if (error) {
7382 NECPLOG(LOG_ERR, "necp_client_claim copyin client_id error (%d)", error);
7383 goto done;
7384 }
7385
7386 if (necp_client_id_is_flow(client_id)) {
7387 NECPLOG0(LOG_ERR, "necp_client_claim cannot claim from flow UUID");
7388 error = EINVAL;
7389 goto done;
7390 }
7391
7392 u_int64_t upid = proc_uniqueid(p);
7393
7394 NECP_FD_LIST_LOCK_SHARED();
7395
7396 struct necp_fd_data *find_fd = NULL;
7397 LIST_FOREACH(find_fd, &necp_fd_list, chain) {
7398 NECP_FD_LOCK(find_fd);
7399 struct necp_client *find_client = necp_client_fd_find_client_and_lock(find_fd, client_id);
7400 if (find_client != NULL) {
7401 if (find_client->delegated_upid == upid &&
7402 RB_EMPTY(&find_client->flow_registrations)) {
7403 // Matched the client to claim; remove from the old fd
7404 client = find_client;
7405 RB_REMOVE(_necp_client_tree, &find_fd->clients, client);
7406 necp_client_retain_locked(client);
7407 }
7408 NECP_CLIENT_UNLOCK(find_client);
7409 }
7410 NECP_FD_UNLOCK(find_fd);
7411
7412 if (client != NULL) {
7413 break;
7414 }
7415 }
7416
7417 NECP_FD_LIST_UNLOCK();
7418
7419 if (client == NULL) {
7420 error = ENOENT;
7421 goto done;
7422 }
7423
7424 client->proc_pid = fd_data->proc_pid; // Transfer client to claiming pid
7425 client->agent_handle = (void *)fd_data;
7426 client->platform_binary = ((csproc_get_platform_binary(p) == 0) ? 0 : 1);
7427
7428 NECP_CLIENT_LOG(client, "Claiming client");
7429
7430 // Add matched client to our fd and re-run result
7431 NECP_FD_LOCK(fd_data);
7432 RB_INSERT(_necp_client_tree, &fd_data->clients, client);
7433 NECP_CLIENT_LOCK(client);
7434 (void)necp_update_client_result(current_proc(), fd_data, client, NULL);
7435 NECP_CLIENT_UNLOCK(client);
7436 NECP_FD_UNLOCK(fd_data);
7437
7438 necp_client_release(client);
7439
7440 done:
7441 *retval = error;
7442
7443 return error;
7444 }
7445
7446 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_remove(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7447 necp_client_remove(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7448 {
7449 int error = 0;
7450 uuid_t client_id = {};
7451 struct ifnet_stats_per_flow flow_ifnet_stats = {};
7452 const size_t buffer_size = uap->buffer_size;
7453
7454 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
7455 error = EINVAL;
7456 goto done;
7457 }
7458
7459 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
7460 if (error) {
7461 NECPLOG(LOG_ERR, "necp_client_remove copyin client_id error (%d)", error);
7462 goto done;
7463 }
7464
7465 if (uap->buffer != 0 && buffer_size == sizeof(flow_ifnet_stats)) {
7466 error = copyin(uap->buffer, &flow_ifnet_stats, buffer_size);
7467 if (error) {
7468 NECPLOG(LOG_ERR, "necp_client_remove flow_ifnet_stats copyin error (%d)", error);
7469 // Not fatal; make sure to zero-out stats in case of partial copy
7470 memset(&flow_ifnet_stats, 0, sizeof(flow_ifnet_stats));
7471 error = 0;
7472 }
7473 } else if (uap->buffer != 0) {
7474 NECPLOG(LOG_ERR, "necp_client_remove unexpected parameters length (%zu)", buffer_size);
7475 }
7476
7477 NECP_FD_LOCK(fd_data);
7478
7479 pid_t pid = fd_data->proc_pid;
7480 struct necp_client *client = necp_client_fd_find_client_unlocked(fd_data, client_id);
7481
7482 NECP_CLIENT_LOG(client, "Removing client");
7483
7484 if (client != NULL) {
7485 // Remove any flow registrations that match
7486 struct necp_client_flow_registration *flow_registration = NULL;
7487 struct necp_client_flow_registration *temp_flow_registration = NULL;
7488 RB_FOREACH_SAFE(flow_registration, _necp_fd_flow_tree, &fd_data->flows, temp_flow_registration) {
7489 if (flow_registration->client == client) {
7490 #if SKYWALK
7491 necp_destroy_flow_stats(fd_data, flow_registration, NULL, TRUE);
7492 #endif /* SKYWALK */
7493 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
7494 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
7495 NECP_FLOW_TREE_UNLOCK();
7496 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
7497 }
7498 }
7499 #if SKYWALK
7500 if (client->nstat_context != NULL) {
7501 // Main path, we expect stats to be in existance at this point
7502 nstat_provider_stats_close(client->nstat_context);
7503 client->nstat_context = NULL;
7504 } else {
7505 NECPLOG0(LOG_ERR, "necp_client_remove ntstat shutdown finds nstat_context NULL");
7506 }
7507 #endif /* SKYWALK */
7508 // Remove client from lists
7509 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
7510 RB_REMOVE(_necp_client_global_tree, &necp_client_global_tree, client);
7511 NECP_CLIENT_TREE_UNLOCK();
7512 RB_REMOVE(_necp_client_tree, &fd_data->clients, client);
7513 }
7514
7515 #if SKYWALK
7516 // If the currently-active arena is idle (has no more flows referring to it), or if there are defunct
7517 // arenas lingering in the list, schedule a threadcall to do the clean up. The idle check is done
7518 // by checking if the reference count is 3: one held by this client (will be released below when we
7519 // destroy it) when it's non-NULL; the rest held by stats_arena_{active,list}.
7520 if ((fd_data->stats_arena_active != NULL && fd_data->stats_arena_active->nai_use_count == 3) ||
7521 (fd_data->stats_arena_active == NULL && !LIST_EMPTY(&fd_data->stats_arena_list))) {
7522 uint64_t deadline = 0;
7523 uint64_t leeway = 0;
7524 clock_interval_to_deadline(necp_close_arenas_timeout_microseconds, NSEC_PER_USEC, &deadline);
7525 clock_interval_to_absolutetime_interval(necp_close_arenas_timeout_leeway_microseconds, NSEC_PER_USEC, &leeway);
7526
7527 thread_call_enter_delayed_with_leeway(necp_close_empty_arenas_tcall, NULL,
7528 deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
7529 }
7530 #endif /* SKYWALK */
7531
7532 NECP_FD_UNLOCK(fd_data);
7533
7534 if (client != NULL) {
7535 ASSERT(error == 0);
7536 necp_destroy_client(client, pid, true);
7537 } else {
7538 error = ENOENT;
7539 NECPLOG(LOG_ERR, "necp_client_remove invalid client_id (%d)", error);
7540 }
7541 done:
7542 *retval = error;
7543
7544 return error;
7545 }
7546
7547 static struct necp_client_flow_registration *
necp_client_fd_find_flow(struct necp_fd_data * client_fd,uuid_t flow_id)7548 necp_client_fd_find_flow(struct necp_fd_data *client_fd, uuid_t flow_id)
7549 {
7550 NECP_FD_ASSERT_LOCKED(client_fd);
7551 struct necp_client_flow_registration *flow = NULL;
7552
7553 if (necp_client_id_is_flow(flow_id)) {
7554 struct necp_client_flow_registration find;
7555 uuid_copy(find.registration_id, flow_id);
7556 flow = RB_FIND(_necp_fd_flow_tree, &client_fd->flows, &find);
7557 }
7558
7559 return flow;
7560 }
7561
7562 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_remove_flow(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7563 necp_client_remove_flow(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7564 {
7565 int error = 0;
7566 uuid_t flow_id = {};
7567 struct ifnet_stats_per_flow flow_ifnet_stats = {};
7568 const size_t buffer_size = uap->buffer_size;
7569
7570 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
7571 error = EINVAL;
7572 NECPLOG(LOG_ERR, "necp_client_remove_flow invalid client_id (length %zu)", (size_t)uap->client_id_len);
7573 goto done;
7574 }
7575
7576 error = copyin(uap->client_id, flow_id, sizeof(uuid_t));
7577 if (error) {
7578 NECPLOG(LOG_ERR, "necp_client_remove_flow copyin client_id error (%d)", error);
7579 goto done;
7580 }
7581
7582 if (uap->buffer != 0 && buffer_size == sizeof(flow_ifnet_stats)) {
7583 error = copyin(uap->buffer, &flow_ifnet_stats, buffer_size);
7584 if (error) {
7585 NECPLOG(LOG_ERR, "necp_client_remove flow_ifnet_stats copyin error (%d)", error);
7586 // Not fatal
7587 }
7588 } else if (uap->buffer != 0) {
7589 NECPLOG(LOG_ERR, "necp_client_remove unexpected parameters length (%zu)", buffer_size);
7590 }
7591
7592 NECP_FD_LOCK(fd_data);
7593 struct necp_client *client = NULL;
7594 struct necp_client_flow_registration *flow_registration = necp_client_fd_find_flow(fd_data, flow_id);
7595 if (flow_registration != NULL) {
7596 #if SKYWALK
7597 // Cleanup stats per flow
7598 necp_destroy_flow_stats(fd_data, flow_registration, &flow_ifnet_stats, TRUE);
7599 #endif /* SKYWALK */
7600 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
7601 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
7602 NECP_FLOW_TREE_UNLOCK();
7603 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
7604
7605 client = flow_registration->client;
7606 if (client != NULL) {
7607 necp_client_retain(client);
7608 }
7609 }
7610 NECP_FD_UNLOCK(fd_data);
7611
7612 NECP_CLIENT_FLOW_LOG(client, flow_registration, "removing flow");
7613
7614 if (flow_registration != NULL && client != NULL) {
7615 NECP_CLIENT_LOCK(client);
7616 if (flow_registration->client == client) {
7617 necp_destroy_client_flow_registration(client, flow_registration, fd_data->proc_pid, false);
7618 }
7619 necp_client_release_locked(client);
7620 NECP_CLIENT_UNLOCK(client);
7621 }
7622
7623 done:
7624 *retval = error;
7625 if (error != 0) {
7626 NECPLOG(LOG_ERR, "Remove flow error (%d)", error);
7627 }
7628
7629 return error;
7630 }
7631
7632 // Don't inline the function since it includes necp_client_parsed_parameters on the stack
7633 static __attribute__((noinline)) int
necp_client_check_tcp_heuristics(struct necp_client * client,struct necp_client_flow * flow,u_int32_t * flags,u_int8_t * tfo_cookie,u_int8_t * tfo_cookie_len)7634 necp_client_check_tcp_heuristics(struct necp_client *client, struct necp_client_flow *flow, u_int32_t *flags, u_int8_t *tfo_cookie, u_int8_t *tfo_cookie_len)
7635 {
7636 struct necp_client_parsed_parameters parsed_parameters;
7637 int error = 0;
7638
7639 error = necp_client_parse_parameters(client, client->parameters,
7640 (u_int32_t)client->parameters_length,
7641 &parsed_parameters);
7642 if (error) {
7643 NECPLOG(LOG_ERR, "necp_client_parse_parameters error (%d)", error);
7644 return error;
7645 }
7646
7647 if ((flow->remote_addr.sa.sa_family != AF_INET &&
7648 flow->remote_addr.sa.sa_family != AF_INET6) ||
7649 (flow->local_addr.sa.sa_family != AF_INET &&
7650 flow->local_addr.sa.sa_family != AF_INET6)) {
7651 return EINVAL;
7652 }
7653
7654 NECP_CLIENT_ROUTE_LOCK(client);
7655
7656 if (client->current_route == NULL) {
7657 error = ENOENT;
7658 goto do_unlock;
7659 }
7660
7661 bool check_ecn = false;
7662 do {
7663 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) ==
7664 NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) {
7665 check_ecn = true;
7666 break;
7667 }
7668
7669 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) ==
7670 NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) {
7671 break;
7672 }
7673
7674 if (client->current_route != NULL) {
7675 if (client->current_route->rt_ifp->if_eflags & IFEF_ECN_ENABLE) {
7676 check_ecn = true;
7677 break;
7678 }
7679 if (client->current_route->rt_ifp->if_eflags & IFEF_ECN_DISABLE) {
7680 break;
7681 }
7682 }
7683
7684 bool inbound = ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) == 0);
7685 if ((inbound && tcp_ecn_inbound == 1) ||
7686 (!inbound && tcp_ecn_outbound == 1)) {
7687 check_ecn = true;
7688 }
7689 } while (false);
7690
7691 if (check_ecn) {
7692 if (tcp_heuristic_do_ecn_with_address(client->current_route->rt_ifp,
7693 (union sockaddr_in_4_6 *)&flow->local_addr)) {
7694 *flags |= NECP_CLIENT_RESULT_FLAG_ECN_ENABLED;
7695 }
7696 }
7697
7698 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) ==
7699 NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) {
7700 if (!tcp_heuristic_do_tfo_with_address(client->current_route->rt_ifp,
7701 (union sockaddr_in_4_6 *)&flow->local_addr,
7702 (union sockaddr_in_4_6 *)&flow->remote_addr,
7703 tfo_cookie, tfo_cookie_len)) {
7704 *flags |= NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED;
7705 *tfo_cookie_len = 0;
7706 }
7707 } else {
7708 *flags |= NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED;
7709 *tfo_cookie_len = 0;
7710 }
7711 do_unlock:
7712 NECP_CLIENT_ROUTE_UNLOCK(client);
7713
7714 return error;
7715 }
7716
7717 static size_t
necp_client_calculate_flow_tlv_size(struct necp_client_flow_registration * flow_registration)7718 necp_client_calculate_flow_tlv_size(struct necp_client_flow_registration *flow_registration)
7719 {
7720 size_t assigned_results_size = 0;
7721 struct necp_client_flow *flow = NULL;
7722 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
7723 if (flow->assigned || !necp_client_endpoint_is_unspecified((struct necp_client_endpoint *)&flow->remote_addr)) {
7724 size_t header_length = 0;
7725 if (flow->nexus) {
7726 header_length = sizeof(struct necp_client_nexus_flow_header);
7727 } else {
7728 header_length = sizeof(struct necp_client_flow_header);
7729 }
7730 assigned_results_size += (header_length + flow->assigned_results_length);
7731
7732 if (flow->has_protoctl_event) {
7733 assigned_results_size += sizeof(struct necp_client_flow_protoctl_event_header);
7734 }
7735 }
7736 }
7737 return assigned_results_size;
7738 }
7739
7740 static int
necp_client_fillout_flow_tlvs(struct necp_client * client,bool client_is_observed,struct necp_client_flow_registration * flow_registration,struct necp_client_action_args * uap,size_t * assigned_results_cursor)7741 necp_client_fillout_flow_tlvs(struct necp_client *client,
7742 bool client_is_observed,
7743 struct necp_client_flow_registration *flow_registration,
7744 struct necp_client_action_args *uap,
7745 size_t *assigned_results_cursor)
7746 {
7747 int error = 0;
7748 struct necp_client_flow *flow = NULL;
7749 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
7750 if (flow->assigned || !necp_client_endpoint_is_unspecified((struct necp_client_endpoint *)&flow->remote_addr)) {
7751 // Write TLV headers
7752 struct necp_client_nexus_flow_header header = {};
7753 u_int32_t length = 0;
7754 u_int32_t flags = 0;
7755 u_int8_t tfo_cookie_len = 0;
7756 u_int8_t type = 0;
7757
7758 type = NECP_CLIENT_RESULT_FLOW_ID;
7759 length = sizeof(header.flow_header.flow_id);
7760 memcpy(&header.flow_header.flow_id_tlv_header.type, &type, sizeof(type));
7761 memcpy(&header.flow_header.flow_id_tlv_header.length, &length, sizeof(length));
7762 uuid_copy(header.flow_header.flow_id, flow_registration->registration_id);
7763
7764 if (flow->nexus) {
7765 if (flow->check_tcp_heuristics) {
7766 u_int8_t tfo_cookie[NECP_TFO_COOKIE_LEN_MAX];
7767 tfo_cookie_len = NECP_TFO_COOKIE_LEN_MAX;
7768
7769 if (necp_client_check_tcp_heuristics(client, flow, &flags,
7770 tfo_cookie, &tfo_cookie_len) != 0) {
7771 tfo_cookie_len = 0;
7772 } else {
7773 flow->check_tcp_heuristics = FALSE;
7774
7775 if (tfo_cookie_len != 0) {
7776 type = NECP_CLIENT_RESULT_TFO_COOKIE;
7777 length = tfo_cookie_len;
7778 memcpy(&header.tfo_cookie_tlv_header.type, &type, sizeof(type));
7779 memcpy(&header.tfo_cookie_tlv_header.length, &length, sizeof(length));
7780 memcpy(&header.tfo_cookie_value, tfo_cookie, tfo_cookie_len);
7781 }
7782 }
7783 }
7784 }
7785
7786 size_t header_length = 0;
7787 if (flow->nexus) {
7788 if (tfo_cookie_len != 0) {
7789 header_length = sizeof(struct necp_client_nexus_flow_header) - (NECP_TFO_COOKIE_LEN_MAX - tfo_cookie_len);
7790 } else {
7791 header_length = sizeof(struct necp_client_nexus_flow_header) - sizeof(struct necp_tlv_header) - NECP_TFO_COOKIE_LEN_MAX;
7792 }
7793 } else {
7794 header_length = sizeof(struct necp_client_flow_header);
7795 }
7796
7797 type = NECP_CLIENT_RESULT_FLAGS;
7798 length = sizeof(header.flow_header.flags_value);
7799 memcpy(&header.flow_header.flags_tlv_header.type, &type, sizeof(type));
7800 memcpy(&header.flow_header.flags_tlv_header.length, &length, sizeof(length));
7801 if (flow->assigned) {
7802 flags |= NECP_CLIENT_RESULT_FLAG_FLOW_ASSIGNED;
7803 }
7804 if (flow->viable) {
7805 flags |= NECP_CLIENT_RESULT_FLAG_FLOW_VIABLE;
7806 }
7807 if (flow_registration->defunct) {
7808 flags |= NECP_CLIENT_RESULT_FLAG_DEFUNCT;
7809 }
7810 flags |= flow->necp_flow_flags;
7811 memcpy(&header.flow_header.flags_value, &flags, sizeof(flags));
7812
7813 type = NECP_CLIENT_RESULT_INTERFACE;
7814 length = sizeof(header.flow_header.interface_value);
7815 memcpy(&header.flow_header.interface_tlv_header.type, &type, sizeof(type));
7816 memcpy(&header.flow_header.interface_tlv_header.length, &length, sizeof(length));
7817
7818 struct necp_client_result_interface interface_struct;
7819 interface_struct.generation = 0;
7820 interface_struct.index = flow->interface_index;
7821
7822 memcpy(&header.flow_header.interface_value, &interface_struct, sizeof(interface_struct));
7823 if (flow->nexus) {
7824 type = NECP_CLIENT_RESULT_NETAGENT;
7825 length = sizeof(header.agent_value);
7826 memcpy(&header.agent_tlv_header.type, &type, sizeof(type));
7827 memcpy(&header.agent_tlv_header.length, &length, sizeof(length));
7828
7829 struct necp_client_result_netagent agent_struct;
7830 uuid_copy(agent_struct.netagent_uuid, flow->u.nexus_agent);
7831 agent_struct.generation = netagent_get_generation(agent_struct.netagent_uuid);
7832
7833 memcpy(&header.agent_value, &agent_struct, sizeof(agent_struct));
7834 }
7835
7836 // Don't include outer TLV header in length field
7837 type = NECP_CLIENT_RESULT_FLOW;
7838 length = (header_length - sizeof(struct necp_tlv_header) + flow->assigned_results_length);
7839 if (flow->has_protoctl_event) {
7840 length += sizeof(struct necp_client_flow_protoctl_event_header);
7841 }
7842 memcpy(&header.flow_header.outer_header.type, &type, sizeof(type));
7843 memcpy(&header.flow_header.outer_header.length, &length, sizeof(length));
7844
7845 error = copyout(&header, uap->buffer + client->result_length + *assigned_results_cursor, header_length);
7846 if (error) {
7847 NECPLOG(LOG_ERR, "necp_client_copy assigned results tlv_header copyout error (%d)", error);
7848 return error;
7849 }
7850 *assigned_results_cursor += header_length;
7851
7852 if (flow->assigned_results && flow->assigned_results_length) {
7853 // Write inner TLVs
7854 error = copyout(flow->assigned_results, uap->buffer + client->result_length + *assigned_results_cursor,
7855 flow->assigned_results_length);
7856 if (error) {
7857 NECPLOG(LOG_ERR, "necp_client_copy assigned results copyout error (%d)", error);
7858 return error;
7859 }
7860 }
7861 *assigned_results_cursor += flow->assigned_results_length;
7862
7863 /* Read the protocol event and reset it */
7864 if (flow->has_protoctl_event) {
7865 struct necp_client_flow_protoctl_event_header protoctl_event_header = {};
7866
7867 type = NECP_CLIENT_RESULT_PROTO_CTL_EVENT;
7868 length = sizeof(protoctl_event_header.protoctl_event);
7869
7870 memcpy(&protoctl_event_header.protoctl_tlv_header.type, &type, sizeof(type));
7871 memcpy(&protoctl_event_header.protoctl_tlv_header.length, &length, sizeof(length));
7872 memcpy(&protoctl_event_header.protoctl_event, &flow->protoctl_event,
7873 sizeof(flow->protoctl_event));
7874
7875 error = copyout(&protoctl_event_header, uap->buffer + client->result_length + *assigned_results_cursor,
7876 sizeof(protoctl_event_header));
7877
7878 if (error) {
7879 NECPLOG(LOG_ERR, "necp_client_copy protocol control event results"
7880 " tlv_header copyout error (%d)", error);
7881 return error;
7882 }
7883 *assigned_results_cursor += sizeof(protoctl_event_header);
7884 flow->has_protoctl_event = FALSE;
7885 flow->protoctl_event.protoctl_event_code = 0;
7886 flow->protoctl_event.protoctl_event_val = 0;
7887 flow->protoctl_event.protoctl_event_tcp_seq_num = 0;
7888 }
7889 }
7890 }
7891 if (!client_is_observed) {
7892 flow_registration->flow_result_read = TRUE;
7893 }
7894 return 0;
7895 }
7896
7897 static int
necp_client_copy_internal(struct necp_client * client,uuid_t client_id,bool client_is_observed,struct necp_client_action_args * uap,int * retval)7898 necp_client_copy_internal(struct necp_client *client, uuid_t client_id, bool client_is_observed, struct necp_client_action_args *uap, int *retval)
7899 {
7900 NECP_CLIENT_ASSERT_LOCKED(client);
7901 int error = 0;
7902 // Copy results out
7903 if (uap->action == NECP_CLIENT_ACTION_COPY_PARAMETERS) {
7904 if (uap->buffer_size < client->parameters_length) {
7905 return EINVAL;
7906 }
7907 error = copyout(client->parameters, uap->buffer, client->parameters_length);
7908 if (error) {
7909 NECPLOG(LOG_ERR, "necp_client_copy parameters copyout error (%d)", error);
7910 return error;
7911 }
7912 *retval = client->parameters_length;
7913 } else if (uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT &&
7914 client->result_read && client->group_members_read && !necp_client_has_unread_flows(client)) {
7915 // Copy updates only, but nothing to read
7916 // Just return 0 for bytes read
7917 *retval = 0;
7918 } else if (uap->action == NECP_CLIENT_ACTION_COPY_RESULT ||
7919 uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
7920 size_t assigned_results_size = client->assigned_group_members_length;
7921
7922 bool some_flow_is_defunct = false;
7923 struct necp_client_flow_registration *single_flow_registration = NULL;
7924 if (necp_client_id_is_flow(client_id)) {
7925 single_flow_registration = necp_client_find_flow(client, client_id);
7926 if (single_flow_registration != NULL) {
7927 assigned_results_size += necp_client_calculate_flow_tlv_size(single_flow_registration);
7928 }
7929 } else {
7930 // This request is for the client, so copy everything
7931 struct necp_client_flow_registration *flow_registration = NULL;
7932 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
7933 if (flow_registration->defunct) {
7934 some_flow_is_defunct = true;
7935 }
7936 assigned_results_size += necp_client_calculate_flow_tlv_size(flow_registration);
7937 }
7938 }
7939 if (uap->buffer_size < (client->result_length + assigned_results_size)) {
7940 return EINVAL;
7941 }
7942
7943 u_int32_t original_flags = 0;
7944 bool flags_updated = false;
7945 if (some_flow_is_defunct && client->legacy_client_is_flow) {
7946 // If our client expects the defunct flag in the client, add it now
7947 u_int32_t client_flags = 0;
7948 u_int32_t value_size = 0;
7949 u_int8_t *flags_pointer = necp_buffer_get_tlv_value(client->result, 0, &value_size);
7950 if (flags_pointer != NULL && value_size == sizeof(client_flags)) {
7951 memcpy(&client_flags, flags_pointer, value_size);
7952 original_flags = client_flags;
7953 client_flags |= NECP_CLIENT_RESULT_FLAG_DEFUNCT;
7954 (void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS,
7955 sizeof(client_flags), &client_flags, &flags_updated,
7956 client->result, sizeof(client->result));
7957 }
7958 }
7959
7960 error = copyout(client->result, uap->buffer, client->result_length);
7961
7962 if (flags_updated) {
7963 // Revert stored flags
7964 (void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS,
7965 sizeof(original_flags), &original_flags, &flags_updated,
7966 client->result, sizeof(client->result));
7967 }
7968
7969 if (error != 0) {
7970 NECPLOG(LOG_ERR, "necp_client_copy result copyout error (%d)", error);
7971 return error;
7972 }
7973
7974 if (client->assigned_group_members != NULL && client->assigned_group_members_length > 0) {
7975 error = copyout(client->assigned_group_members, uap->buffer + client->result_length, client->assigned_group_members_length);
7976 if (error != 0) {
7977 NECPLOG(LOG_ERR, "necp_client_copy group members copyout error (%d)", error);
7978 return error;
7979 }
7980 }
7981
7982 size_t assigned_results_cursor = client->assigned_group_members_length; // Start with an offset based on the group members
7983 if (necp_client_id_is_flow(client_id)) {
7984 if (single_flow_registration != NULL) {
7985 error = necp_client_fillout_flow_tlvs(client, client_is_observed, single_flow_registration, uap, &assigned_results_cursor);
7986 if (error != 0) {
7987 return error;
7988 }
7989 }
7990 } else {
7991 // This request is for the client, so copy everything
7992 struct necp_client_flow_registration *flow_registration = NULL;
7993 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
7994 error = necp_client_fillout_flow_tlvs(client, client_is_observed, flow_registration, uap, &assigned_results_cursor);
7995 if (error != 0) {
7996 return error;
7997 }
7998 }
7999 }
8000
8001 *retval = client->result_length + assigned_results_cursor;
8002
8003 if (!client_is_observed) {
8004 client->result_read = TRUE;
8005 client->group_members_read = TRUE;
8006 }
8007 }
8008
8009 return 0;
8010 }
8011
8012 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8013 necp_client_copy(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8014 {
8015 int error = 0;
8016 struct necp_client *client = NULL;
8017 uuid_t client_id;
8018 uuid_clear(client_id);
8019
8020 *retval = 0;
8021
8022 if (uap->buffer_size == 0 || uap->buffer == 0) {
8023 return EINVAL;
8024 }
8025
8026 if (uap->action != NECP_CLIENT_ACTION_COPY_PARAMETERS &&
8027 uap->action != NECP_CLIENT_ACTION_COPY_RESULT &&
8028 uap->action != NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
8029 return EINVAL;
8030 }
8031
8032 if (uap->client_id) {
8033 if (uap->client_id_len != sizeof(uuid_t)) {
8034 NECPLOG(LOG_ERR, "Incorrect length (got %zu, expected %zu)", (size_t)uap->client_id_len, sizeof(uuid_t));
8035 return ERANGE;
8036 }
8037
8038 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8039 if (error) {
8040 NECPLOG(LOG_ERR, "necp_client_copy client_id copyin error (%d)", error);
8041 return error;
8042 }
8043 }
8044
8045 const bool is_wildcard = (bool)uuid_is_null(client_id);
8046
8047 NECP_FD_LOCK(fd_data);
8048
8049 bool send_in_process_flow_divert_message = false;
8050 if (is_wildcard) {
8051 if (uap->action == NECP_CLIENT_ACTION_COPY_RESULT || uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
8052 struct necp_client *find_client = NULL;
8053 RB_FOREACH(find_client, _necp_client_tree, &fd_data->clients) {
8054 NECP_CLIENT_LOCK(find_client);
8055 if (!find_client->result_read || !find_client->group_members_read || necp_client_has_unread_flows(find_client)) {
8056 client = find_client;
8057 // Leave the client locked, and break
8058 break;
8059 }
8060 NECP_CLIENT_UNLOCK(find_client);
8061 }
8062
8063 if (client == NULL && fd_data->request_in_process_flow_divert) {
8064 // No client found that needs update. Check for an event requesting in-process flow divert.
8065 send_in_process_flow_divert_message = true;
8066 }
8067 }
8068 } else {
8069 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8070 }
8071
8072 if (client != NULL) {
8073 if (!send_in_process_flow_divert_message) {
8074 // If client is set, it is locked
8075 error = necp_client_copy_internal(client, client_id, FALSE, uap, retval);
8076 }
8077 NECP_CLIENT_UNLOCK(client);
8078 }
8079
8080 if (send_in_process_flow_divert_message) {
8081 fd_data->request_in_process_flow_divert = false;
8082
8083 struct necp_tlv_header request_tlv = {
8084 .type = NECP_CLIENT_RESULT_REQUEST_IN_PROCESS_FLOW_DIVERT,
8085 .length = 0,
8086 };
8087 if (uap->buffer_size < sizeof(request_tlv)) {
8088 error = EINVAL;
8089 } else {
8090 error = copyout(&request_tlv, uap->buffer, sizeof(request_tlv));
8091 if (error) {
8092 NECPLOG(LOG_ERR, "necp_client_copy request flow divert TLV copyout error (%d)", error);
8093 } else {
8094 *retval = sizeof(request_tlv);
8095 }
8096 }
8097 }
8098
8099 // Unlock our own fd before moving on or returning
8100 NECP_FD_UNLOCK(fd_data);
8101
8102 if (client == NULL && !send_in_process_flow_divert_message) {
8103 if (fd_data->flags & NECP_OPEN_FLAG_OBSERVER) {
8104 // Observers are allowed to lookup clients on other fds
8105
8106 // Lock tree
8107 NECP_CLIENT_TREE_LOCK_SHARED();
8108
8109 bool found_client = FALSE;
8110
8111 client = necp_find_client_and_lock(client_id);
8112 if (client != NULL) {
8113 // Matched, copy out data
8114 found_client = TRUE;
8115 error = necp_client_copy_internal(client, client_id, TRUE, uap, retval);
8116 NECP_CLIENT_UNLOCK(client);
8117 }
8118
8119 // Unlock tree
8120 NECP_CLIENT_TREE_UNLOCK();
8121
8122 // No client found, fail
8123 if (!found_client) {
8124 return ENOENT;
8125 }
8126 } else {
8127 // No client found, and not allowed to search other fds, fail
8128 return ENOENT;
8129 }
8130 }
8131
8132 return error;
8133 }
8134
8135 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_client_update(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8136 necp_client_copy_client_update(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8137 {
8138 int error = 0;
8139
8140 *retval = 0;
8141
8142 if (!(fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER)) {
8143 NECPLOG0(LOG_ERR, "NECP fd is not observer, cannot copy client update");
8144 return EINVAL;
8145 }
8146
8147 if (uap->client_id_len != sizeof(uuid_t) || uap->client_id == 0) {
8148 NECPLOG0(LOG_ERR, "Client id invalid, cannot copy client update");
8149 return EINVAL;
8150 }
8151
8152 if (uap->buffer_size == 0 || uap->buffer == 0) {
8153 NECPLOG0(LOG_ERR, "Buffer invalid, cannot copy client update");
8154 return EINVAL;
8155 }
8156
8157 NECP_FD_LOCK(fd_data);
8158 struct necp_client_update *client_update = TAILQ_FIRST(&fd_data->update_list);
8159 if (client_update != NULL) {
8160 TAILQ_REMOVE(&fd_data->update_list, client_update, chain);
8161 VERIFY(fd_data->update_count > 0);
8162 fd_data->update_count--;
8163 }
8164 NECP_FD_UNLOCK(fd_data);
8165
8166 if (client_update != NULL) {
8167 error = copyout(client_update->client_id, uap->client_id, sizeof(uuid_t));
8168 if (error) {
8169 NECPLOG(LOG_ERR, "Copy client update copyout client id error (%d)", error);
8170 } else {
8171 if (uap->buffer_size < client_update->update_length) {
8172 NECPLOG(LOG_ERR, "Buffer size cannot hold update (%zu < %zu)", (size_t)uap->buffer_size, client_update->update_length);
8173 error = EINVAL;
8174 } else {
8175 error = copyout(client_update->update, uap->buffer, client_update->update_length);
8176 if (error) {
8177 NECPLOG(LOG_ERR, "Copy client update copyout error (%d)", error);
8178 } else {
8179 *retval = client_update->update_length;
8180 }
8181 }
8182 }
8183
8184 necp_client_update_free(client_update);
8185 client_update = NULL;
8186 } else {
8187 error = ENOENT;
8188 }
8189
8190 return error;
8191 }
8192
8193 static int
necp_client_copy_parameters_locked(struct necp_client * client,struct necp_client_nexus_parameters * parameters)8194 necp_client_copy_parameters_locked(struct necp_client *client,
8195 struct necp_client_nexus_parameters *parameters)
8196 {
8197 VERIFY(parameters != NULL);
8198
8199 struct necp_client_parsed_parameters parsed_parameters = {};
8200 int error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, &parsed_parameters);
8201
8202 parameters->pid = client->proc_pid;
8203 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID) {
8204 parameters->epid = parsed_parameters.effective_pid;
8205 } else {
8206 parameters->epid = parameters->pid;
8207 }
8208 #if SKYWALK
8209 parameters->port_reservation = client->port_reservation;
8210 #endif /* !SKYWALK */
8211 memcpy(¶meters->local_addr, &parsed_parameters.local_addr, sizeof(parameters->local_addr));
8212 memcpy(¶meters->remote_addr, &parsed_parameters.remote_addr, sizeof(parameters->remote_addr));
8213 parameters->ip_protocol = parsed_parameters.ip_protocol;
8214 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL) {
8215 parameters->transport_protocol = parsed_parameters.transport_protocol;
8216 } else {
8217 parameters->transport_protocol = parsed_parameters.ip_protocol;
8218 }
8219 parameters->ethertype = parsed_parameters.ethertype;
8220 parameters->traffic_class = parsed_parameters.traffic_class;
8221 if (uuid_is_null(client->override_euuid)) {
8222 uuid_copy(parameters->euuid, parsed_parameters.effective_uuid);
8223 } else {
8224 uuid_copy(parameters->euuid, client->override_euuid);
8225 }
8226 parameters->is_listener = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) ? 1 : 0;
8227 parameters->is_interpose = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) ? 1 : 0;
8228 parameters->is_custom_ether = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) ? 1 : 0;
8229 parameters->policy_id = client->policy_id;
8230 parameters->skip_policy_id = client->skip_policy_id;
8231
8232 // parse client result flag
8233 u_int32_t client_result_flags = 0;
8234 u_int32_t value_size = 0;
8235 u_int8_t *flags_pointer = NULL;
8236 flags_pointer = necp_buffer_get_tlv_value(client->result, 0, &value_size);
8237 if (flags_pointer && value_size == sizeof(client_result_flags)) {
8238 memcpy(&client_result_flags, flags_pointer, value_size);
8239 }
8240 parameters->allow_qos_marking = (client_result_flags & NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING) ? 1 : 0;
8241
8242 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE) {
8243 if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_DEFAULT) {
8244 parameters->override_address_selection = false;
8245 } else if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_TEMPORARY) {
8246 parameters->override_address_selection = true;
8247 parameters->use_stable_address = false;
8248 } else if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_STABLE) {
8249 parameters->override_address_selection = true;
8250 parameters->use_stable_address = true;
8251 }
8252 } else {
8253 parameters->override_address_selection = false;
8254 }
8255
8256 if ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
8257 (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_NO_WAKE_FROM_SLEEP)) {
8258 parameters->no_wake_from_sleep = true;
8259 }
8260
8261 if ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
8262 (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_REUSE_LOCAL)) {
8263 parameters->reuse_port = true;
8264 }
8265
8266 #if SKYWALK
8267 if (!parameters->is_listener) {
8268 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLOW_DEMUX_PATTERN) {
8269 if (parsed_parameters.demux_patterns[0].len == 0) {
8270 parameters->is_demuxable_parent = 1;
8271 } else {
8272 if (client->validated_parent) {
8273 ASSERT(!uuid_is_null(client->parent_client_id));
8274
8275 NECP_CLIENT_TREE_LOCK_SHARED();
8276 struct necp_client *parent = necp_find_client_and_lock(client->parent_client_id);
8277 if (parent != NULL) {
8278 struct necp_client_flow_registration *parent_flow_registration = NULL;
8279 RB_FOREACH(parent_flow_registration, _necp_client_flow_tree, &parent->flow_registrations) {
8280 uuid_copy(parameters->parent_flow_uuid, parent_flow_registration->registration_id);
8281 break;
8282 }
8283
8284 NECP_CLIENT_UNLOCK(parent);
8285 }
8286 NECP_CLIENT_TREE_UNLOCK();
8287
8288 if (parsed_parameters.demux_pattern_count > 0) {
8289 for (int i = 0; i < parsed_parameters.demux_pattern_count; i++) {
8290 memcpy(¶meters->demux_patterns[i], &parsed_parameters.demux_patterns[i], sizeof(struct necp_demux_pattern));
8291 }
8292 parameters->demux_pattern_count = parsed_parameters.demux_pattern_count;
8293 }
8294 }
8295 }
8296 }
8297 }
8298 #endif // SKYWALK
8299
8300 return error;
8301 }
8302
8303 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_list(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8304 necp_client_list(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8305 {
8306 int error = 0;
8307 struct necp_client *find_client = NULL;
8308 uuid_t *list = NULL;
8309 u_int32_t requested_client_count = 0;
8310 u_int32_t client_count = 0;
8311 size_t copy_buffer_size = 0;
8312
8313 if (uap->buffer_size < sizeof(requested_client_count) || uap->buffer == 0) {
8314 error = EINVAL;
8315 goto done;
8316 }
8317
8318 if (!(fd_data->flags & NECP_OPEN_FLAG_OBSERVER)) {
8319 NECPLOG0(LOG_ERR, "Client does not hold necessary entitlement to list other NECP clients");
8320 error = EACCES;
8321 goto done;
8322 }
8323
8324 error = copyin(uap->buffer, &requested_client_count, sizeof(requested_client_count));
8325 if (error) {
8326 goto done;
8327 }
8328
8329 if (os_mul_overflow(sizeof(uuid_t), requested_client_count, ©_buffer_size)) {
8330 error = ERANGE;
8331 goto done;
8332 }
8333
8334 if (uap->buffer_size - sizeof(requested_client_count) != copy_buffer_size) {
8335 error = EINVAL;
8336 goto done;
8337 }
8338
8339 if (copy_buffer_size > NECP_MAX_CLIENT_LIST_SIZE) {
8340 error = EINVAL;
8341 goto done;
8342 }
8343
8344 if (requested_client_count > 0) {
8345 if ((list = (uuid_t*)kalloc_data(copy_buffer_size, Z_WAITOK | Z_ZERO)) == NULL) {
8346 error = ENOMEM;
8347 goto done;
8348 }
8349 }
8350
8351 // Lock tree
8352 NECP_CLIENT_TREE_LOCK_SHARED();
8353
8354 find_client = NULL;
8355 RB_FOREACH(find_client, _necp_client_global_tree, &necp_client_global_tree) {
8356 NECP_CLIENT_LOCK(find_client);
8357 if (!uuid_is_null(find_client->client_id)) {
8358 if (client_count < requested_client_count) {
8359 uuid_copy(list[client_count], find_client->client_id);
8360 }
8361 client_count++;
8362 }
8363 NECP_CLIENT_UNLOCK(find_client);
8364 }
8365
8366 // Unlock tree
8367 NECP_CLIENT_TREE_UNLOCK();
8368
8369 error = copyout(&client_count, uap->buffer, sizeof(client_count));
8370 if (error) {
8371 NECPLOG(LOG_ERR, "necp_client_list buffer copyout error (%d)", error);
8372 goto done;
8373 }
8374
8375 if (requested_client_count > 0 &&
8376 client_count > 0 &&
8377 list != NULL) {
8378 error = copyout(list, uap->buffer + sizeof(client_count), copy_buffer_size);
8379 if (error) {
8380 NECPLOG(LOG_ERR, "necp_client_list client count copyout error (%d)", error);
8381 goto done;
8382 }
8383 }
8384 done:
8385 if (list != NULL) {
8386 kfree_data(list, copy_buffer_size);
8387 }
8388 *retval = error;
8389
8390 return error;
8391 }
8392
8393 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_add_flow(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8394 necp_client_add_flow(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8395 {
8396 int error = 0;
8397 struct necp_client *client = NULL;
8398 uuid_t client_id;
8399 struct necp_client_nexus_parameters parameters = {};
8400 struct proc *proc = PROC_NULL;
8401 struct necp_client_add_flow *add_request = NULL;
8402 struct necp_client_add_flow *allocated_add_request = NULL;
8403 struct necp_client_add_flow_default default_add_request = {};
8404 const size_t buffer_size = uap->buffer_size;
8405
8406 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
8407 error = EINVAL;
8408 NECPLOG(LOG_ERR, "necp_client_add_flow invalid client_id (length %zu)", (size_t)uap->client_id_len);
8409 goto done;
8410 }
8411
8412 if (uap->buffer == 0 || buffer_size < sizeof(struct necp_client_add_flow) ||
8413 buffer_size > sizeof(struct necp_client_add_flow_default) * 4) {
8414 error = EINVAL;
8415 NECPLOG(LOG_ERR, "necp_client_add_flow invalid buffer (length %zu)", buffer_size);
8416 goto done;
8417 }
8418
8419 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8420 if (error) {
8421 NECPLOG(LOG_ERR, "necp_client_add_flow copyin client_id error (%d)", error);
8422 goto done;
8423 }
8424
8425 if (buffer_size <= sizeof(struct necp_client_add_flow_default)) {
8426 // Fits in default size
8427 error = copyin(uap->buffer, &default_add_request, buffer_size);
8428 if (error) {
8429 NECPLOG(LOG_ERR, "necp_client_add_flow copyin default_add_request error (%d)", error);
8430 goto done;
8431 }
8432
8433 add_request = (struct necp_client_add_flow *)&default_add_request;
8434 } else {
8435 allocated_add_request = (struct necp_client_add_flow *)kalloc_data(buffer_size, Z_WAITOK | Z_ZERO);
8436 if (allocated_add_request == NULL) {
8437 error = ENOMEM;
8438 goto done;
8439 }
8440
8441 error = copyin(uap->buffer, allocated_add_request, buffer_size);
8442 if (error) {
8443 NECPLOG(LOG_ERR, "necp_client_add_flow copyin default_add_request error (%d)", error);
8444 goto done;
8445 }
8446
8447 add_request = allocated_add_request;
8448 }
8449
8450 NECP_FD_LOCK(fd_data);
8451 pid_t pid = fd_data->proc_pid;
8452 proc = proc_find(pid);
8453 if (proc == PROC_NULL) {
8454 NECP_FD_UNLOCK(fd_data);
8455 NECPLOG(LOG_ERR, "necp_client_add_flow process not found for pid %d error (%d)", pid, error);
8456 error = ESRCH;
8457 goto done;
8458 }
8459
8460 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8461 if (client == NULL) {
8462 error = ENOENT;
8463 NECP_FD_UNLOCK(fd_data);
8464 goto done;
8465 }
8466
8467 // Using ADD_FLOW indicates that the client supports multiple flows per client
8468 client->legacy_client_is_flow = false;
8469
8470 necp_client_retain_locked(client);
8471 necp_client_copy_parameters_locked(client, ¶meters);
8472
8473 struct necp_client_flow_registration *new_registration = necp_client_create_flow_registration(fd_data, client);
8474 if (new_registration == NULL) {
8475 error = ENOMEM;
8476 NECP_CLIENT_UNLOCK(client);
8477 NECP_FD_UNLOCK(fd_data);
8478 NECPLOG0(LOG_ERR, "Failed to allocate flow registration");
8479 goto done;
8480 }
8481
8482 new_registration->flags = add_request->flags;
8483
8484 // Copy new ID out to caller
8485 uuid_copy(add_request->registration_id, new_registration->registration_id);
8486
8487 NECP_CLIENT_FLOW_LOG(client, new_registration, "adding flow");
8488
8489 size_t trailer_offset = (sizeof(struct necp_client_add_flow) +
8490 add_request->stats_request_count * sizeof(struct necp_client_flow_stats));
8491
8492 // Copy override address
8493 struct sockaddr *override_address = NULL;
8494 if (add_request->flags & NECP_CLIENT_FLOW_FLAGS_OVERRIDE_ADDRESS) {
8495 size_t offset_of_address = trailer_offset;
8496 if (buffer_size >= offset_of_address + sizeof(struct sockaddr_in)) {
8497 override_address = (struct sockaddr *)(((uint8_t *)add_request) + offset_of_address);
8498 if (buffer_size >= offset_of_address + override_address->sa_len &&
8499 override_address->sa_len <= sizeof(parameters.remote_addr)) {
8500 memcpy(¶meters.remote_addr, override_address, override_address->sa_len);
8501 trailer_offset += override_address->sa_len;
8502 } else {
8503 override_address = NULL;
8504 }
8505 }
8506 }
8507
8508 // Copy override IP protocol
8509 if (add_request->flags & NECP_CLIENT_FLOW_FLAGS_OVERRIDE_IP_PROTOCOL) {
8510 size_t offset_of_ip_protocol = trailer_offset;
8511 if (buffer_size >= offset_of_ip_protocol + sizeof(uint8_t)) {
8512 uint8_t *ip_protocol_p = (uint8_t *)(((uint8_t *)add_request) + offset_of_ip_protocol);
8513 memcpy(¶meters.ip_protocol, ip_protocol_p, sizeof(uint8_t));
8514 }
8515 }
8516
8517 #if SKYWALK
8518 if (add_request->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS) {
8519 void *assigned_results = NULL;
8520 size_t assigned_results_length = 0;
8521 uint32_t interface_index = 0;
8522
8523 // Validate that the nexus UUID is assigned
8524 bool found_nexus = false;
8525 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
8526 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
8527 struct necp_client_interface_option *option = &client->interface_options[option_i];
8528 if (uuid_compare(option->nexus_agent, add_request->agent_uuid) == 0) {
8529 interface_index = option->interface_index;
8530 found_nexus = true;
8531 break;
8532 }
8533 } else {
8534 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
8535 if (uuid_compare(option->nexus_agent, add_request->agent_uuid) == 0) {
8536 interface_index = option->interface_index;
8537 found_nexus = true;
8538 break;
8539 }
8540 }
8541 }
8542
8543 if (!found_nexus) {
8544 NECPLOG0(LOG_ERR, "Requested nexus not found");
8545 } else {
8546 necp_client_add_nexus_flow_if_needed(new_registration, add_request->agent_uuid, interface_index);
8547
8548 error = netagent_client_message_with_params(add_request->agent_uuid,
8549 ((new_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
8550 client->client_id :
8551 new_registration->registration_id),
8552 pid, client->agent_handle,
8553 NETAGENT_MESSAGE_TYPE_REQUEST_NEXUS,
8554 (struct necp_client_agent_parameters *)¶meters,
8555 &assigned_results, &assigned_results_length);
8556 if (error != 0) {
8557 VERIFY(assigned_results == NULL);
8558 VERIFY(assigned_results_length == 0);
8559 NECPLOG(LOG_ERR, "netagent_client_message error (%d)", error);
8560 } else if (assigned_results != NULL) {
8561 if (!necp_assign_client_result_locked(proc, fd_data, client, new_registration, add_request->agent_uuid,
8562 assigned_results, assigned_results_length, false, false)) {
8563 kfree_data(assigned_results, assigned_results_length);
8564 }
8565 } else if (override_address != NULL) {
8566 // Save the overridden address in the flow. Find the correct flow,
8567 // and assign just the address TLV. Don't set the assigned flag.
8568 struct necp_client_flow *flow = NULL;
8569 LIST_FOREACH(flow, &new_registration->flow_list, flow_chain) {
8570 if (flow->nexus &&
8571 uuid_compare(flow->u.nexus_agent, add_request->agent_uuid) == 0) {
8572 if (flow->assigned_results == NULL) {
8573 memcpy(&flow->remote_addr, override_address, override_address->sa_len);
8574 uuid_t empty_uuid;
8575 uuid_clear(empty_uuid);
8576 flow->assigned_results = necp_create_nexus_assign_message(empty_uuid, 0, NULL, 0,
8577 (struct necp_client_endpoint *)&flow->local_addr,
8578 (struct necp_client_endpoint *)&flow->remote_addr,
8579 NULL, 0, NULL, &flow->assigned_results_length);
8580 }
8581 break;
8582 }
8583 }
8584 }
8585 }
8586 }
8587
8588 // Don't request stats if nexus creation fails
8589 if (error == 0 && add_request->stats_request_count > 0 && necp_arena_initialize(fd_data, true) == 0) {
8590 struct necp_client_flow_stats *stats_request = (struct necp_client_flow_stats *)&add_request->stats_requests[0];
8591 struct necp_stats_bufreq bufreq = {};
8592
8593 NECP_CLIENT_FLOW_LOG(client, new_registration, "Initializing stats");
8594
8595 bufreq.necp_stats_bufreq_id = NECP_CLIENT_STATISTICS_BUFREQ_ID;
8596 bufreq.necp_stats_bufreq_type = stats_request->stats_type;
8597 bufreq.necp_stats_bufreq_ver = stats_request->stats_version;
8598 bufreq.necp_stats_bufreq_size = stats_request->stats_size;
8599 bufreq.necp_stats_bufreq_uaddr = stats_request->stats_addr;
8600 (void)necp_stats_initialize(fd_data, client, new_registration, &bufreq);
8601 stats_request->stats_type = bufreq.necp_stats_bufreq_type;
8602 stats_request->stats_version = bufreq.necp_stats_bufreq_ver;
8603 stats_request->stats_size = bufreq.necp_stats_bufreq_size;
8604 stats_request->stats_addr = bufreq.necp_stats_bufreq_uaddr;
8605 }
8606 #endif /* !SKYWALK */
8607
8608 if (error == 0 &&
8609 (add_request->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE ||
8610 add_request->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) {
8611 uint32_t interface_index = IFSCOPE_NONE;
8612 ifnet_head_lock_shared();
8613 struct ifnet *interface = NULL;
8614 TAILQ_FOREACH(interface, &ifnet_head, if_link) {
8615 ifnet_lock_shared(interface);
8616 if (interface->if_agentids != NULL) {
8617 for (u_int32_t i = 0; i < interface->if_agentcount; i++) {
8618 if (uuid_compare(interface->if_agentids[i], add_request->agent_uuid) == 0) {
8619 interface_index = interface->if_index;
8620 break;
8621 }
8622 }
8623 }
8624 ifnet_lock_done(interface);
8625 if (interface_index != IFSCOPE_NONE) {
8626 break;
8627 }
8628 }
8629 ifnet_head_done();
8630
8631 necp_client_add_nexus_flow_if_needed(new_registration, add_request->agent_uuid, interface_index);
8632
8633 error = netagent_client_message_with_params(add_request->agent_uuid,
8634 ((new_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
8635 client->client_id :
8636 new_registration->registration_id),
8637 pid, client->agent_handle,
8638 NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT,
8639 (struct necp_client_agent_parameters *)¶meters,
8640 NULL, NULL);
8641 if (error != 0) {
8642 NECPLOG(LOG_ERR, "netagent_client_message error (%d)", error);
8643 }
8644 }
8645
8646 if (error != 0) {
8647 // Encountered an error in adding the flow, destroy the flow registration
8648 #if SKYWALK
8649 necp_destroy_flow_stats(fd_data, new_registration, NULL, false);
8650 #endif /* SKYWALK */
8651 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
8652 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, new_registration);
8653 NECP_FLOW_TREE_UNLOCK();
8654 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, new_registration);
8655 necp_destroy_client_flow_registration(client, new_registration, fd_data->proc_pid, true);
8656 new_registration = NULL;
8657 }
8658
8659 NECP_CLIENT_UNLOCK(client);
8660 NECP_FD_UNLOCK(fd_data);
8661
8662 necp_client_release(client);
8663
8664 if (error != 0) {
8665 goto done;
8666 }
8667
8668 // Copy the request back out to the caller with assigned fields
8669 error = copyout(add_request, uap->buffer, buffer_size);
8670 if (error != 0) {
8671 NECPLOG(LOG_ERR, "necp_client_add_flow copyout add_request error (%d)", error);
8672 }
8673
8674 done:
8675 *retval = error;
8676 if (error != 0) {
8677 NECPLOG(LOG_ERR, "Add flow error (%d)", error);
8678 }
8679
8680 if (allocated_add_request != NULL) {
8681 kfree_data(allocated_add_request, buffer_size);
8682 }
8683
8684 if (proc != PROC_NULL) {
8685 proc_rele(proc);
8686 }
8687 return error;
8688 }
8689
8690 #if SKYWALK
8691
8692 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_request_nexus(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8693 necp_client_request_nexus(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8694 {
8695 int error = 0;
8696 struct necp_client *client = NULL;
8697 uuid_t client_id;
8698 struct necp_client_nexus_parameters parameters = {};
8699 struct proc *proc = PROC_NULL;
8700 const size_t buffer_size = uap->buffer_size;
8701
8702 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
8703 error = EINVAL;
8704 goto done;
8705 }
8706
8707 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8708 if (error) {
8709 NECPLOG(LOG_ERR, "necp_client_request_nexus copyin client_id error (%d)", error);
8710 goto done;
8711 }
8712
8713 NECP_FD_LOCK(fd_data);
8714 pid_t pid = fd_data->proc_pid;
8715 proc = proc_find(pid);
8716 if (proc == PROC_NULL) {
8717 NECP_FD_UNLOCK(fd_data);
8718 NECPLOG(LOG_ERR, "necp_client_request_nexus process not found for pid %d error (%d)", pid, error);
8719 error = ESRCH;
8720 goto done;
8721 }
8722
8723 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8724 if (client == NULL) {
8725 NECP_FD_UNLOCK(fd_data);
8726 error = ENOENT;
8727 goto done;
8728 }
8729
8730 // Using REQUEST_NEXUS indicates that the client only supports one flow per client
8731 client->legacy_client_is_flow = true;
8732
8733 necp_client_retain_locked(client);
8734 necp_client_copy_parameters_locked(client, ¶meters);
8735
8736 do {
8737 void *assigned_results = NULL;
8738 size_t assigned_results_length = 0;
8739 uuid_t nexus_uuid;
8740 uint32_t interface_index = 0;
8741
8742 // Validate that the nexus UUID is assigned
8743 bool found_nexus = false;
8744 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
8745 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
8746 struct necp_client_interface_option *option = &client->interface_options[option_i];
8747 if (!uuid_is_null(option->nexus_agent)) {
8748 uuid_copy(nexus_uuid, option->nexus_agent);
8749 interface_index = option->interface_index;
8750 found_nexus = true;
8751 break;
8752 }
8753 } else {
8754 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
8755 if (!uuid_is_null(option->nexus_agent)) {
8756 uuid_copy(nexus_uuid, option->nexus_agent);
8757 interface_index = option->interface_index;
8758 found_nexus = true;
8759 break;
8760 }
8761 }
8762 }
8763
8764 if (!found_nexus) {
8765 NECP_CLIENT_UNLOCK(client);
8766 NECP_FD_UNLOCK(fd_data);
8767 necp_client_release(client);
8768 // Break the loop
8769 error = ENETDOWN;
8770 goto done;
8771 }
8772
8773 struct necp_client_flow_registration *new_registration = necp_client_create_flow_registration(fd_data, client);
8774 if (new_registration == NULL) {
8775 error = ENOMEM;
8776 NECP_CLIENT_UNLOCK(client);
8777 NECP_FD_UNLOCK(fd_data);
8778 necp_client_release(client);
8779 NECPLOG0(LOG_ERR, "Failed to allocate flow registration");
8780 goto done;
8781 }
8782
8783 new_registration->flags = (NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS | NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID);
8784
8785 necp_client_add_nexus_flow_if_needed(new_registration, nexus_uuid, interface_index);
8786
8787 // Note: Any clients using "request_nexus" are not flow-registration aware.
8788 // Register the Client ID rather than the Registration ID with the nexus, since
8789 // the client will send traffic based on the client ID.
8790 error = netagent_client_message_with_params(nexus_uuid,
8791 ((new_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
8792 client->client_id :
8793 new_registration->registration_id),
8794 pid, client->agent_handle,
8795 NETAGENT_MESSAGE_TYPE_REQUEST_NEXUS,
8796 (struct necp_client_agent_parameters *)¶meters,
8797 &assigned_results, &assigned_results_length);
8798 if (error) {
8799 NECP_CLIENT_UNLOCK(client);
8800 NECP_FD_UNLOCK(fd_data);
8801 necp_client_release(client);
8802 VERIFY(assigned_results == NULL);
8803 VERIFY(assigned_results_length == 0);
8804 NECPLOG(LOG_ERR, "netagent_client_message error (%d)", error);
8805 goto done;
8806 }
8807
8808 if (assigned_results != NULL) {
8809 if (!necp_assign_client_result_locked(proc, fd_data, client, new_registration, nexus_uuid,
8810 assigned_results, assigned_results_length, false, false)) {
8811 kfree_data(assigned_results, assigned_results_length);
8812 }
8813 }
8814
8815 if (uap->buffer != 0 && buffer_size == sizeof(struct necp_stats_bufreq) &&
8816 necp_arena_initialize(fd_data, true) == 0) {
8817 struct necp_stats_bufreq bufreq = {};
8818 int copy_error = copyin(uap->buffer, &bufreq, buffer_size);
8819 if (copy_error) {
8820 NECPLOG(LOG_ERR, "necp_client_request_nexus copyin bufreq error (%d)", copy_error);
8821 } else {
8822 (void)necp_stats_initialize(fd_data, client, new_registration, &bufreq);
8823 copy_error = copyout(&bufreq, uap->buffer, buffer_size);
8824 if (copy_error != 0) {
8825 NECPLOG(LOG_ERR, "necp_client_request_nexus copyout bufreq error (%d)", copy_error);
8826 }
8827 }
8828 }
8829 } while (false);
8830
8831 NECP_CLIENT_UNLOCK(client);
8832 NECP_FD_UNLOCK(fd_data);
8833
8834 necp_client_release(client);
8835
8836 done:
8837 *retval = error;
8838 if (error != 0) {
8839 NECPLOG(LOG_ERR, "Request nexus error (%d)", error);
8840 }
8841
8842 if (proc != PROC_NULL) {
8843 proc_rele(proc);
8844 }
8845 return error;
8846 }
8847 #endif /* !SKYWALK */
8848
8849 static void
necp_client_add_assertion(struct necp_client * client,uuid_t netagent_uuid)8850 necp_client_add_assertion(struct necp_client *client, uuid_t netagent_uuid)
8851 {
8852 struct necp_client_assertion *new_assertion = NULL;
8853
8854 new_assertion = kalloc_type(struct necp_client_assertion,
8855 Z_WAITOK | Z_NOFAIL);
8856
8857 uuid_copy(new_assertion->asserted_netagent, netagent_uuid);
8858
8859 LIST_INSERT_HEAD(&client->assertion_list, new_assertion, assertion_chain);
8860 }
8861
8862 static bool
necp_client_remove_assertion(struct necp_client * client,uuid_t netagent_uuid)8863 necp_client_remove_assertion(struct necp_client *client, uuid_t netagent_uuid)
8864 {
8865 struct necp_client_assertion *found_assertion = NULL;
8866 struct necp_client_assertion *search_assertion = NULL;
8867 LIST_FOREACH(search_assertion, &client->assertion_list, assertion_chain) {
8868 if (uuid_compare(search_assertion->asserted_netagent, netagent_uuid) == 0) {
8869 found_assertion = search_assertion;
8870 break;
8871 }
8872 }
8873
8874 if (found_assertion == NULL) {
8875 NECPLOG0(LOG_ERR, "Netagent uuid not previously asserted");
8876 return false;
8877 }
8878
8879 LIST_REMOVE(found_assertion, assertion_chain);
8880 kfree_type(struct necp_client_assertion, found_assertion);
8881 return true;
8882 }
8883
8884 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_agent_action(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8885 necp_client_agent_action(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8886 {
8887 int error = 0;
8888 struct necp_client *client = NULL;
8889 uuid_t client_id;
8890 bool acted_on_agent = FALSE;
8891 u_int8_t *parameters = NULL;
8892 const size_t buffer_size = uap->buffer_size;
8893
8894 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
8895 buffer_size == 0 || uap->buffer == 0) {
8896 NECPLOG0(LOG_ERR, "necp_client_agent_action invalid parameters");
8897 error = EINVAL;
8898 goto done;
8899 }
8900
8901 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8902 if (error) {
8903 NECPLOG(LOG_ERR, "necp_client_agent_action copyin client_id error (%d)", error);
8904 goto done;
8905 }
8906
8907 if (buffer_size > NECP_MAX_AGENT_ACTION_SIZE) {
8908 NECPLOG(LOG_ERR, "necp_client_agent_action invalid buffer size (>%u)", NECP_MAX_AGENT_ACTION_SIZE);
8909 error = EINVAL;
8910 goto done;
8911 }
8912
8913 if ((parameters = (u_int8_t *)kalloc_data(buffer_size, Z_WAITOK | Z_ZERO)) == NULL) {
8914 NECPLOG0(LOG_ERR, "necp_client_agent_action malloc failed");
8915 error = ENOMEM;
8916 goto done;
8917 }
8918
8919 error = copyin(uap->buffer, parameters, buffer_size);
8920 if (error) {
8921 NECPLOG(LOG_ERR, "necp_client_agent_action parameters copyin error (%d)", error);
8922 goto done;
8923 }
8924
8925 NECP_FD_LOCK(fd_data);
8926 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8927 if (client != NULL) {
8928 size_t offset = 0;
8929 while ((offset + sizeof(struct necp_tlv_header)) <= buffer_size) {
8930 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
8931 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
8932
8933 if (length > (buffer_size - (offset + sizeof(struct necp_tlv_header)))) {
8934 // If the length is larger than what can fit in the remaining parameters size, bail
8935 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
8936 break;
8937 }
8938
8939 if (length >= sizeof(uuid_t)) {
8940 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
8941 if (value == NULL) {
8942 NECPLOG0(LOG_ERR, "Invalid TLV value");
8943 break;
8944 }
8945 if (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT ||
8946 type == NECP_CLIENT_PARAMETER_ASSERT_AGENT ||
8947 type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
8948 uuid_t agent_uuid;
8949 uuid_copy(agent_uuid, value);
8950 u_int8_t netagent_message_type = 0;
8951 if (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT) {
8952 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_TRIGGER;
8953 } else if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
8954 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT;
8955 } else if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
8956 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
8957 }
8958
8959 // Before unasserting, verify that the assertion was already taken
8960 if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
8961 if (!necp_client_remove_assertion(client, agent_uuid)) {
8962 error = ENOENT;
8963 break;
8964 }
8965 }
8966
8967 struct necp_client_nexus_parameters parsed_parameters = {};
8968 necp_client_copy_parameters_locked(client, &parsed_parameters);
8969
8970 error = netagent_client_message_with_params(agent_uuid,
8971 client_id,
8972 fd_data->proc_pid,
8973 client->agent_handle,
8974 netagent_message_type,
8975 (struct necp_client_agent_parameters *)&parsed_parameters,
8976 NULL, NULL);
8977 if (error == 0) {
8978 acted_on_agent = TRUE;
8979 } else {
8980 break;
8981 }
8982
8983 // Only save the assertion if the action succeeded
8984 if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
8985 necp_client_add_assertion(client, agent_uuid);
8986 }
8987 } else if (type == NECP_CLIENT_PARAMETER_AGENT_ADD_GROUP_MEMBERS ||
8988 type == NECP_CLIENT_PARAMETER_AGENT_REMOVE_GROUP_MEMBERS) {
8989 uuid_t agent_uuid;
8990 uuid_copy(agent_uuid, value);
8991 u_int8_t netagent_message_type = 0;
8992 if (type == NECP_CLIENT_PARAMETER_AGENT_ADD_GROUP_MEMBERS) {
8993 netagent_message_type = NETAGENT_MESSAGE_TYPE_ADD_GROUP_MEMBERS;
8994 } else if (type == NECP_CLIENT_PARAMETER_AGENT_REMOVE_GROUP_MEMBERS) {
8995 netagent_message_type = NETAGENT_MESSAGE_TYPE_REMOVE_GROUP_MEMBERS;
8996 }
8997
8998 struct necp_client_group_members group_members = {};
8999 group_members.group_members_length = (length - sizeof(uuid_t));
9000 group_members.group_members = (value + sizeof(uuid_t));
9001 error = netagent_client_message_with_params(agent_uuid,
9002 client_id,
9003 fd_data->proc_pid,
9004 client->agent_handle,
9005 netagent_message_type,
9006 (struct necp_client_agent_parameters *)&group_members,
9007 NULL, NULL);
9008 if (error == 0) {
9009 acted_on_agent = TRUE;
9010 } else {
9011 break;
9012 }
9013 } else if (type == NECP_CLIENT_PARAMETER_REPORT_AGENT_ERROR) {
9014 uuid_t agent_uuid;
9015 uuid_copy(agent_uuid, value);
9016 struct necp_client_agent_parameters agent_params = {};
9017 if ((length - sizeof(uuid_t)) >= sizeof(agent_params.u.error.error)) {
9018 memcpy(&agent_params.u.error.error,
9019 (value + sizeof(uuid_t)),
9020 sizeof(agent_params.u.error.error));
9021 }
9022 bool agent_reported = false;
9023 for (int agent_i = 0; agent_i < NECP_FD_REPORTED_AGENT_COUNT; agent_i++) {
9024 if (uuid_compare(agent_uuid, fd_data->reported_agents.agent_uuid[agent_i]) == 0) {
9025 // Found a match, already reported
9026 agent_reported = true;
9027 break;
9028 }
9029 }
9030 agent_params.u.error.force_report = !agent_reported;
9031 if (!agent_reported) {
9032 // Save this agent as having been reported
9033 bool saved_agent_uuid = false;
9034 for (int agent_i = 0; agent_i < NECP_FD_REPORTED_AGENT_COUNT; agent_i++) {
9035 if (uuid_is_null(fd_data->reported_agents.agent_uuid[agent_i])) {
9036 uuid_copy(fd_data->reported_agents.agent_uuid[agent_i], agent_uuid);
9037 saved_agent_uuid = true;
9038 break;
9039 }
9040 }
9041 if (!saved_agent_uuid) {
9042 // Reported agent UUIDs full, move over and insert at the end
9043 for (int agent_i = 0; agent_i < NECP_FD_REPORTED_AGENT_COUNT; agent_i++) {
9044 if (agent_i + 1 < NECP_FD_REPORTED_AGENT_COUNT) {
9045 uuid_copy(fd_data->reported_agents.agent_uuid[agent_i], fd_data->reported_agents.agent_uuid[agent_i + 1]);
9046 } else {
9047 uuid_copy(fd_data->reported_agents.agent_uuid[agent_i], agent_uuid);
9048 }
9049 }
9050 }
9051 }
9052 error = netagent_client_message_with_params(agent_uuid,
9053 client_id,
9054 fd_data->proc_pid,
9055 client->agent_handle,
9056 NETAGENT_MESSAGE_TYPE_CLIENT_ERROR,
9057 &agent_params,
9058 NULL, NULL);
9059 if (error == 0) {
9060 acted_on_agent = TRUE;
9061 } else {
9062 break;
9063 }
9064 }
9065 }
9066
9067 offset += sizeof(struct necp_tlv_header) + length;
9068 }
9069
9070 NECP_CLIENT_UNLOCK(client);
9071 }
9072 NECP_FD_UNLOCK(fd_data);
9073
9074 if (!acted_on_agent &&
9075 error == 0) {
9076 error = ENOENT;
9077 }
9078 done:
9079 *retval = error;
9080 if (parameters != NULL) {
9081 kfree_data(parameters, buffer_size);
9082 parameters = NULL;
9083 }
9084
9085 return error;
9086 }
9087
9088 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_agent(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9089 necp_client_copy_agent(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9090 {
9091 int error = 0;
9092 uuid_t agent_uuid;
9093 const size_t buffer_size = uap->buffer_size;
9094
9095 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
9096 buffer_size == 0 || uap->buffer == 0) {
9097 NECPLOG0(LOG_ERR, "necp_client_copy_agent bad input");
9098 error = EINVAL;
9099 goto done;
9100 }
9101
9102 error = copyin(uap->client_id, agent_uuid, sizeof(uuid_t));
9103 if (error) {
9104 NECPLOG(LOG_ERR, "necp_client_copy_agent copyin agent_uuid error (%d)", error);
9105 goto done;
9106 }
9107
9108 error = netagent_copyout(agent_uuid, uap->buffer, buffer_size);
9109 if (error) {
9110 // netagent_copyout already logs appropriate errors
9111 goto done;
9112 }
9113 done:
9114 *retval = error;
9115
9116 return error;
9117 }
9118
9119 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_agent_use(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9120 necp_client_agent_use(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9121 {
9122 int error = 0;
9123 struct necp_client *client = NULL;
9124 uuid_t client_id;
9125 struct necp_agent_use_parameters parameters = {};
9126 const size_t buffer_size = uap->buffer_size;
9127
9128 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
9129 buffer_size != sizeof(parameters) || uap->buffer == 0) {
9130 error = EINVAL;
9131 goto done;
9132 }
9133
9134 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
9135 if (error) {
9136 NECPLOG(LOG_ERR, "Copyin client_id error (%d)", error);
9137 goto done;
9138 }
9139
9140 error = copyin(uap->buffer, ¶meters, buffer_size);
9141 if (error) {
9142 NECPLOG(LOG_ERR, "Parameters copyin error (%d)", error);
9143 goto done;
9144 }
9145
9146 NECP_FD_LOCK(fd_data);
9147 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
9148 if (client != NULL) {
9149 error = netagent_use(parameters.agent_uuid, ¶meters.out_use_count);
9150 NECP_CLIENT_UNLOCK(client);
9151 } else {
9152 error = ENOENT;
9153 }
9154
9155 NECP_FD_UNLOCK(fd_data);
9156
9157 if (error == 0) {
9158 error = copyout(¶meters, uap->buffer, buffer_size);
9159 if (error) {
9160 NECPLOG(LOG_ERR, "Parameters copyout error (%d)", error);
9161 goto done;
9162 }
9163 }
9164
9165 done:
9166 *retval = error;
9167
9168 return error;
9169 }
9170
9171 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_acquire_agent_token(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9172 necp_client_acquire_agent_token(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9173 {
9174 int error = 0;
9175 uuid_t agent_uuid = {};
9176 const size_t buffer_size = uap->buffer_size;
9177
9178 *retval = 0;
9179
9180 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
9181 buffer_size == 0 || uap->buffer == 0) {
9182 NECPLOG0(LOG_ERR, "necp_client_copy_agent bad input");
9183 error = EINVAL;
9184 goto done;
9185 }
9186
9187 error = copyin(uap->client_id, agent_uuid, sizeof(uuid_t));
9188 if (error) {
9189 NECPLOG(LOG_ERR, "necp_client_copy_agent copyin agent_uuid error (%d)", error);
9190 goto done;
9191 }
9192
9193 error = netagent_acquire_token(agent_uuid, uap->buffer, buffer_size, retval);
9194 done:
9195 return error;
9196 }
9197
9198 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_interface(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9199 necp_client_copy_interface(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9200 {
9201 int error = 0;
9202 u_int32_t interface_index = 0;
9203 struct necp_interface_details interface_details = {};
9204
9205 if (uap->client_id == 0 || uap->client_id_len != sizeof(u_int32_t) ||
9206 uap->buffer_size < sizeof(interface_details) ||
9207 uap->buffer == 0) {
9208 NECPLOG0(LOG_ERR, "necp_client_copy_interface bad input");
9209 error = EINVAL;
9210 goto done;
9211 }
9212
9213 error = copyin(uap->client_id, &interface_index, sizeof(u_int32_t));
9214 if (error) {
9215 NECPLOG(LOG_ERR, "necp_client_copy_interface copyin interface_index error (%d)", error);
9216 goto done;
9217 }
9218
9219 if (interface_index == 0) {
9220 error = ENOENT;
9221 NECPLOG(LOG_ERR, "necp_client_copy_interface bad interface_index (%d)", interface_index);
9222 goto done;
9223 }
9224
9225 lck_mtx_lock(rnh_lock);
9226 ifnet_head_lock_shared();
9227 ifnet_t interface = NULL;
9228 if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
9229 interface = ifindex2ifnet[interface_index];
9230 }
9231
9232 if (interface != NULL) {
9233 if (interface->if_xname != NULL) {
9234 strlcpy((char *)&interface_details.name, interface->if_xname, sizeof(interface_details.name));
9235 }
9236 interface_details.index = interface->if_index;
9237 interface_details.generation = ifnet_get_generation(interface);
9238 if (interface->if_delegated.ifp != NULL) {
9239 interface_details.delegate_index = interface->if_delegated.ifp->if_index;
9240 }
9241 interface_details.functional_type = if_functional_type(interface, TRUE);
9242 if (IFNET_IS_EXPENSIVE(interface)) {
9243 interface_details.flags |= NECP_INTERFACE_FLAG_EXPENSIVE;
9244 }
9245 if (IFNET_IS_CONSTRAINED(interface)) {
9246 interface_details.flags |= NECP_INTERFACE_FLAG_CONSTRAINED;
9247 }
9248 if ((interface->if_eflags & IFEF_TXSTART) == IFEF_TXSTART) {
9249 interface_details.flags |= NECP_INTERFACE_FLAG_TXSTART;
9250 }
9251 if ((interface->if_eflags & IFEF_NOACKPRI) == IFEF_NOACKPRI) {
9252 interface_details.flags |= NECP_INTERFACE_FLAG_NOACKPRI;
9253 }
9254 if ((interface->if_eflags & IFEF_3CA) == IFEF_3CA) {
9255 interface_details.flags |= NECP_INTERFACE_FLAG_3CARRIERAGG;
9256 }
9257 if (IFNET_IS_LOW_POWER(interface)) {
9258 interface_details.flags |= NECP_INTERFACE_FLAG_IS_LOW_POWER;
9259 }
9260 if (interface->if_xflags & IFXF_MPK_LOG) {
9261 interface_details.flags |= NECP_INTERFACE_FLAG_MPK_LOG;
9262 }
9263 if (interface->if_flags & IFF_MULTICAST) {
9264 interface_details.flags |= NECP_INTERFACE_FLAG_SUPPORTS_MULTICAST;
9265 }
9266 if (IS_INTF_CLAT46(interface)) {
9267 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_NAT64;
9268 }
9269 interface_details.mtu = interface->if_mtu;
9270 #if SKYWALK
9271 fsw_get_tso_capabilities(interface, &interface_details.tso_max_segment_size_v4,
9272 &interface_details.tso_max_segment_size_v6);
9273
9274 interface_details.hwcsum_flags = interface->if_hwassist & IFNET_CHECKSUMF;
9275 #endif /* SKYWALK */
9276
9277 u_int8_t ipv4_signature_len = sizeof(interface_details.ipv4_signature.signature);
9278 u_int16_t ipv4_signature_flags;
9279 if (ifnet_get_netsignature(interface, AF_INET, &ipv4_signature_len, &ipv4_signature_flags,
9280 (u_int8_t *)&interface_details.ipv4_signature) != 0) {
9281 ipv4_signature_len = 0;
9282 }
9283 interface_details.ipv4_signature.signature_len = ipv4_signature_len;
9284
9285 // Check for default scoped routes for IPv4 and IPv6
9286 union necp_sockaddr_union default_address;
9287 struct rtentry *v4Route = NULL;
9288 memset(&default_address, 0, sizeof(default_address));
9289 default_address.sa.sa_family = AF_INET;
9290 default_address.sa.sa_len = sizeof(struct sockaddr_in);
9291 v4Route = rtalloc1_scoped_locked((struct sockaddr *)&default_address, 0, 0,
9292 interface->if_index);
9293 if (v4Route != NULL) {
9294 if (v4Route->rt_ifp != NULL && !IS_INTF_CLAT46(v4Route->rt_ifp)) {
9295 interface_details.flags |= NECP_INTERFACE_FLAG_IPV4_ROUTABLE;
9296 }
9297 rtfree_locked(v4Route);
9298 v4Route = NULL;
9299 }
9300
9301 struct rtentry *v6Route = NULL;
9302 memset(&default_address, 0, sizeof(default_address));
9303 default_address.sa.sa_family = AF_INET6;
9304 default_address.sa.sa_len = sizeof(struct sockaddr_in6);
9305 v6Route = rtalloc1_scoped_locked((struct sockaddr *)&default_address, 0, 0,
9306 interface->if_index);
9307 if (v6Route != NULL) {
9308 if (v6Route->rt_ifp != NULL) {
9309 interface_details.flags |= NECP_INTERFACE_FLAG_IPV6_ROUTABLE;
9310 }
9311 rtfree_locked(v6Route);
9312 v6Route = NULL;
9313 }
9314
9315 u_int8_t ipv6_signature_len = sizeof(interface_details.ipv6_signature.signature);
9316 u_int16_t ipv6_signature_flags;
9317 if (ifnet_get_netsignature(interface, AF_INET6, &ipv6_signature_len, &ipv6_signature_flags,
9318 (u_int8_t *)&interface_details.ipv6_signature) != 0) {
9319 ipv6_signature_len = 0;
9320 }
9321 interface_details.ipv6_signature.signature_len = ipv6_signature_len;
9322
9323 ifnet_lock_shared(interface);
9324 struct ifaddr *ifa = NULL;
9325 TAILQ_FOREACH(ifa, &interface->if_addrhead, ifa_link) {
9326 IFA_LOCK(ifa);
9327 if (ifa->ifa_addr->sa_family == AF_INET) {
9328 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_NETMASK;
9329 interface_details.ipv4_netmask = ((struct in_ifaddr *)ifa)->ia_sockmask.sin_addr.s_addr;
9330 if (interface->if_flags & IFF_BROADCAST) {
9331 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_BROADCAST;
9332 interface_details.ipv4_broadcast = ((struct in_ifaddr *)ifa)->ia_broadaddr.sin_addr.s_addr;
9333 }
9334 }
9335 IFA_UNLOCK(ifa);
9336 }
9337
9338 interface_details.radio_type = interface->if_radio_type;
9339 if (interface_details.radio_type == 0 && interface->if_delegated.ifp) {
9340 interface_details.radio_type = interface->if_delegated.ifp->if_radio_type;
9341 }
9342 ifnet_lock_done(interface);
9343 }
9344
9345 ifnet_head_done();
9346 lck_mtx_unlock(rnh_lock);
9347
9348 // If the client is using an older version of the struct, copy that length
9349 error = copyout(&interface_details, uap->buffer, sizeof(interface_details));
9350 if (error) {
9351 NECPLOG(LOG_ERR, "necp_client_copy_interface copyout error (%d)", error);
9352 goto done;
9353 }
9354 done:
9355 *retval = error;
9356
9357 return error;
9358 }
9359
9360 #if SKYWALK
9361
9362 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_get_interface_address(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9363 necp_client_get_interface_address(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9364 {
9365 int error = 0;
9366 u_int32_t interface_index = IFSCOPE_NONE;
9367 struct sockaddr_storage address = {};
9368 const size_t buffer_size = uap->buffer_size;
9369
9370 if (uap->client_id == 0 || uap->client_id_len != sizeof(u_int32_t) ||
9371 buffer_size < sizeof(struct sockaddr_in) ||
9372 buffer_size > sizeof(struct sockaddr_storage) ||
9373 uap->buffer == 0) {
9374 NECPLOG0(LOG_ERR, "necp_client_get_interface_address bad input");
9375 error = EINVAL;
9376 goto done;
9377 }
9378
9379 error = copyin(uap->client_id, &interface_index, sizeof(u_int32_t));
9380 if (error) {
9381 NECPLOG(LOG_ERR, "necp_client_get_interface_address copyin interface_index error (%d)", error);
9382 goto done;
9383 }
9384
9385 if (interface_index == IFSCOPE_NONE) {
9386 error = ENOENT;
9387 NECPLOG(LOG_ERR, "necp_client_get_interface_address bad interface_index (%d)", interface_index);
9388 goto done;
9389 }
9390
9391 error = copyin(uap->buffer, &address, buffer_size);
9392 if (error) {
9393 NECPLOG(LOG_ERR, "necp_client_get_interface_address copyin address error (%d)", error);
9394 goto done;
9395 }
9396
9397 if (address.ss_family != AF_INET && address.ss_family != AF_INET6) {
9398 error = EINVAL;
9399 NECPLOG(LOG_ERR, "necp_client_get_interface_address invalid address family (%u)", address.ss_family);
9400 goto done;
9401 }
9402
9403 if (address.ss_len != buffer_size) {
9404 error = EINVAL;
9405 NECPLOG(LOG_ERR, "necp_client_get_interface_address invalid address length (%u)", address.ss_len);
9406 goto done;
9407 }
9408
9409 ifnet_head_lock_shared();
9410 ifnet_t ifp = NULL;
9411 if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
9412 ifp = ifindex2ifnet[interface_index];
9413 }
9414 ifnet_head_done();
9415 if (ifp == NULL) {
9416 error = ENOENT;
9417 NECPLOG0(LOG_ERR, "necp_client_get_interface_address no matching interface found");
9418 goto done;
9419 }
9420
9421 struct rtentry *rt = rtalloc1_scoped((struct sockaddr *)&address, 0, 0, interface_index);
9422 if (rt == NULL) {
9423 error = EINVAL;
9424 NECPLOG0(LOG_ERR, "necp_client_get_interface_address route lookup failed");
9425 goto done;
9426 }
9427
9428 uint32_t gencount = 0;
9429 struct sockaddr_storage local_address = {};
9430 error = flow_route_select_laddr((union sockaddr_in_4_6 *)&local_address,
9431 (union sockaddr_in_4_6 *)&address, ifp, rt, &gencount, 1);
9432 rtfree(rt);
9433 rt = NULL;
9434
9435 if (error) {
9436 NECPLOG(LOG_ERR, "necp_client_get_interface_address local address selection failed (%d)", error);
9437 goto done;
9438 }
9439
9440 if (local_address.ss_len > buffer_size) {
9441 error = EMSGSIZE;
9442 NECPLOG(LOG_ERR, "necp_client_get_interface_address local address too long for buffer (%u)",
9443 local_address.ss_len);
9444 goto done;
9445 }
9446
9447 error = copyout(&local_address, uap->buffer, local_address.ss_len);
9448 if (error) {
9449 NECPLOG(LOG_ERR, "necp_client_get_interface_address copyout error (%d)", error);
9450 goto done;
9451 }
9452 done:
9453 *retval = error;
9454
9455 return error;
9456 }
9457
9458 extern char *proc_name_address(void *p);
9459
9460 int
necp_stats_ctor(struct skmem_obj_info * oi,struct skmem_obj_info * oim,void * arg,uint32_t skmflag)9461 necp_stats_ctor(struct skmem_obj_info *oi, struct skmem_obj_info *oim,
9462 void *arg, uint32_t skmflag)
9463 {
9464 #pragma unused(arg, skmflag)
9465 struct necp_all_kstats *kstats = SKMEM_OBJ_ADDR(oi);
9466
9467 ASSERT(oim != NULL && SKMEM_OBJ_ADDR(oim) != NULL);
9468 ASSERT(SKMEM_OBJ_SIZE(oi) == SKMEM_OBJ_SIZE(oim));
9469
9470 kstats->necp_stats_ustats = SKMEM_OBJ_ADDR(oim);
9471
9472 return 0;
9473 }
9474
9475 int
necp_stats_dtor(void * addr,void * arg)9476 necp_stats_dtor(void *addr, void *arg)
9477 {
9478 #pragma unused(addr, arg)
9479 struct necp_all_kstats *kstats = addr;
9480
9481 kstats->necp_stats_ustats = NULL;
9482
9483 return 0;
9484 }
9485
9486 static void
necp_fd_insert_stats_arena(struct necp_fd_data * fd_data,struct necp_arena_info * nai)9487 necp_fd_insert_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai)
9488 {
9489 NECP_FD_ASSERT_LOCKED(fd_data);
9490 VERIFY(!(nai->nai_flags & NAIF_ATTACHED));
9491 VERIFY(nai->nai_chain.le_next == NULL && nai->nai_chain.le_prev == NULL);
9492
9493 LIST_INSERT_HEAD(&fd_data->stats_arena_list, nai, nai_chain);
9494 nai->nai_flags |= NAIF_ATTACHED;
9495 necp_arena_info_retain(nai); // for the list
9496 }
9497
9498 static void
necp_fd_remove_stats_arena(struct necp_fd_data * fd_data,struct necp_arena_info * nai)9499 necp_fd_remove_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai)
9500 {
9501 #pragma unused(fd_data)
9502 NECP_FD_ASSERT_LOCKED(fd_data);
9503 VERIFY(nai->nai_flags & NAIF_ATTACHED);
9504 VERIFY(nai->nai_use_count >= 1);
9505
9506 LIST_REMOVE(nai, nai_chain);
9507 nai->nai_flags &= ~NAIF_ATTACHED;
9508 nai->nai_chain.le_next = NULL;
9509 nai->nai_chain.le_prev = NULL;
9510 necp_arena_info_release(nai); // for the list
9511 }
9512
9513 static struct necp_arena_info *
necp_fd_mredirect_stats_arena(struct necp_fd_data * fd_data,struct proc * proc)9514 necp_fd_mredirect_stats_arena(struct necp_fd_data *fd_data, struct proc *proc)
9515 {
9516 struct necp_arena_info *nai, *nai_ret = NULL;
9517
9518 NECP_FD_ASSERT_LOCKED(fd_data);
9519
9520 // Redirect currently-active stats arena and remove it from the active state;
9521 // upon process resumption, new flow request would trigger the creation of
9522 // another active arena.
9523 if ((nai = fd_data->stats_arena_active) != NULL) {
9524 boolean_t need_defunct = FALSE;
9525
9526 ASSERT(!(nai->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT)));
9527 VERIFY(nai->nai_use_count >= 2);
9528 ASSERT(nai->nai_arena != NULL);
9529 ASSERT(nai->nai_mmap.ami_mapref != NULL);
9530
9531 int err = skmem_arena_mredirect(nai->nai_arena, &nai->nai_mmap, proc, &need_defunct);
9532 VERIFY(err == 0);
9533 // must be TRUE since we don't mmap the arena more than once
9534 VERIFY(need_defunct == TRUE);
9535
9536 nai->nai_flags |= NAIF_REDIRECT;
9537 nai_ret = nai; // return to caller
9538
9539 necp_arena_info_release(nai); // for fd_data
9540 fd_data->stats_arena_active = nai = NULL;
9541 }
9542
9543 #if (DEVELOPMENT || DEBUG)
9544 // make sure this list now contains nothing but redirected/defunct arenas
9545 LIST_FOREACH(nai, &fd_data->stats_arena_list, nai_chain) {
9546 ASSERT(nai->nai_use_count >= 1);
9547 ASSERT(nai->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT));
9548 }
9549 #endif /* (DEVELOPMENT || DEBUG) */
9550
9551 return nai_ret;
9552 }
9553
9554 static void
necp_arena_info_retain(struct necp_arena_info * nai)9555 necp_arena_info_retain(struct necp_arena_info *nai)
9556 {
9557 nai->nai_use_count++;
9558 VERIFY(nai->nai_use_count != 0);
9559 }
9560
9561 static void
necp_arena_info_release(struct necp_arena_info * nai)9562 necp_arena_info_release(struct necp_arena_info *nai)
9563 {
9564 VERIFY(nai->nai_use_count > 0);
9565 if (--nai->nai_use_count == 0) {
9566 necp_arena_info_free(nai);
9567 }
9568 }
9569
9570 static struct necp_arena_info *
necp_arena_info_alloc(void)9571 necp_arena_info_alloc(void)
9572 {
9573 return zalloc_flags(necp_arena_info_zone, Z_WAITOK | Z_ZERO);
9574 }
9575
9576 static void
necp_arena_info_free(struct necp_arena_info * nai)9577 necp_arena_info_free(struct necp_arena_info *nai)
9578 {
9579 VERIFY(nai->nai_chain.le_next == NULL && nai->nai_chain.le_prev == NULL);
9580 VERIFY(nai->nai_use_count == 0);
9581
9582 // NOTE: destroying the arena requires that all outstanding objects
9583 // that were allocated have been freed, else it will assert.
9584 if (nai->nai_arena != NULL) {
9585 skmem_arena_munmap(nai->nai_arena, &nai->nai_mmap);
9586 skmem_arena_release(nai->nai_arena);
9587 OSDecrementAtomic(&necp_arena_count);
9588 nai->nai_arena = NULL;
9589 nai->nai_roff = 0;
9590 }
9591
9592 ASSERT(nai->nai_arena == NULL);
9593 ASSERT(nai->nai_mmap.ami_mapref == NULL);
9594 ASSERT(nai->nai_mmap.ami_arena == NULL);
9595 ASSERT(nai->nai_mmap.ami_maptask == TASK_NULL);
9596
9597 zfree(necp_arena_info_zone, nai);
9598 }
9599
9600 static int
necp_arena_create(struct necp_fd_data * fd_data,size_t obj_size,size_t obj_cnt,struct proc * p)9601 necp_arena_create(struct necp_fd_data *fd_data, size_t obj_size, size_t obj_cnt, struct proc *p)
9602 {
9603 struct skmem_region_params srp_ustats = {};
9604 struct skmem_region_params srp_kstats = {};
9605 struct necp_arena_info *nai;
9606 char name[32];
9607 int error = 0;
9608
9609 NECP_FD_ASSERT_LOCKED(fd_data);
9610 ASSERT(fd_data->stats_arena_active == NULL);
9611 ASSERT(p != PROC_NULL);
9612 ASSERT(proc_pid(p) == fd_data->proc_pid);
9613
9614 // inherit the default parameters for the stats region
9615 srp_ustats = *skmem_get_default(SKMEM_REGION_USTATS);
9616 srp_kstats = *skmem_get_default(SKMEM_REGION_KSTATS);
9617
9618 // enable multi-segment mode
9619 srp_ustats.srp_cflags &= ~SKMEM_REGION_CR_MONOLITHIC;
9620 srp_kstats.srp_cflags &= ~SKMEM_REGION_CR_MONOLITHIC;
9621
9622 // configure and adjust the region parameters
9623 srp_ustats.srp_r_obj_cnt = srp_kstats.srp_r_obj_cnt = obj_cnt;
9624 srp_ustats.srp_r_obj_size = srp_kstats.srp_r_obj_size = obj_size;
9625 skmem_region_params_config(&srp_ustats);
9626 skmem_region_params_config(&srp_kstats);
9627
9628 nai = necp_arena_info_alloc();
9629
9630 nai->nai_proc_pid = fd_data->proc_pid;
9631 (void) snprintf(name, sizeof(name), "stats-%u.%s.%d", fd_data->stats_arena_gencnt, proc_name_address(p), fd_data->proc_pid);
9632 nai->nai_arena = skmem_arena_create_for_necp(name, &srp_ustats, &srp_kstats, &error);
9633 ASSERT(nai->nai_arena != NULL || error != 0);
9634 if (error != 0) {
9635 NECPLOG(LOG_ERR, "failed to create stats arena for pid %d\n", fd_data->proc_pid);
9636 } else {
9637 OSIncrementAtomic(&necp_arena_count);
9638
9639 // Get region offsets from base of mmap span; the arena
9640 // doesn't need to be mmap'd at this point, since we simply
9641 // compute the relative offset.
9642 nai->nai_roff = skmem_arena_get_region_offset(nai->nai_arena, SKMEM_REGION_USTATS);
9643
9644 // map to the task/process; upon success, the base address of the region
9645 // will be returned in nai_mmap.ami_mapaddr; this can be communicated to
9646 // the process.
9647 error = skmem_arena_mmap(nai->nai_arena, p, &nai->nai_mmap);
9648 if (error != 0) {
9649 NECPLOG(LOG_ERR, "failed to map stats arena for pid %d\n", fd_data->proc_pid);
9650 }
9651 }
9652
9653 if (error == 0) {
9654 fd_data->stats_arena_active = nai;
9655 necp_arena_info_retain(nai); // for fd_data
9656 necp_fd_insert_stats_arena(fd_data, nai);
9657 ++fd_data->stats_arena_gencnt;
9658 } else {
9659 necp_arena_info_free(nai);
9660 }
9661
9662 return error;
9663 }
9664
9665 static int
necp_arena_stats_obj_alloc(struct necp_fd_data * fd_data,mach_vm_offset_t * off,struct necp_arena_info ** stats_arena,void ** kstats_kaddr,boolean_t cansleep)9666 necp_arena_stats_obj_alloc(struct necp_fd_data *fd_data,
9667 mach_vm_offset_t *off,
9668 struct necp_arena_info **stats_arena,
9669 void **kstats_kaddr,
9670 boolean_t cansleep)
9671 {
9672 struct skmem_cache *kstats_cp = NULL;
9673 void *ustats_obj = NULL;
9674 void *kstats_obj = NULL;
9675 struct necp_all_kstats *kstats = NULL;
9676 struct skmem_obj_info kstats_oi = {};
9677
9678 ASSERT(off != NULL);
9679 ASSERT(stats_arena != NULL && *stats_arena == NULL);
9680 ASSERT(kstats_kaddr != NULL && *kstats_kaddr == NULL);
9681
9682 NECP_FD_ASSERT_LOCKED(fd_data);
9683 ASSERT(fd_data->stats_arena_active != NULL);
9684 ASSERT(fd_data->stats_arena_active->nai_arena != NULL);
9685
9686 kstats_cp = skmem_arena_necp(fd_data->stats_arena_active->nai_arena)->arc_kstats_cache;
9687 if ((kstats_obj = skmem_cache_alloc(kstats_cp, (cansleep ? SKMEM_SLEEP : SKMEM_NOSLEEP))) == NULL) {
9688 return ENOMEM;
9689 }
9690
9691 kstats = (struct necp_all_kstats*)kstats_obj;
9692 ustats_obj = kstats->necp_stats_ustats;
9693
9694 skmem_cache_get_obj_info(kstats_cp, kstats_obj, &kstats_oi, NULL);
9695 ASSERT(SKMEM_OBJ_SIZE(&kstats_oi) >= sizeof(struct necp_all_stats));
9696 // reset all stats counters
9697 bzero(ustats_obj, SKMEM_OBJ_SIZE(&kstats_oi));
9698 bzero(&kstats->necp_stats_comm, sizeof(struct necp_all_stats));
9699 *stats_arena = fd_data->stats_arena_active;
9700 *kstats_kaddr = kstats_obj;
9701 // kstats and ustats are mirrored and have the same offset
9702 *off = fd_data->stats_arena_active->nai_roff + SKMEM_OBJ_ROFF(&kstats_oi);
9703
9704 return 0;
9705 }
9706
9707 static void
necp_arena_stats_obj_free(struct necp_fd_data * fd_data,struct necp_arena_info * stats_arena,void ** kstats_kaddr,mach_vm_address_t * ustats_uaddr)9708 necp_arena_stats_obj_free(struct necp_fd_data *fd_data, struct necp_arena_info *stats_arena, void **kstats_kaddr, mach_vm_address_t *ustats_uaddr)
9709 {
9710 #pragma unused(fd_data)
9711 NECP_FD_ASSERT_LOCKED(fd_data);
9712
9713 ASSERT(stats_arena != NULL);
9714 ASSERT(stats_arena->nai_arena != NULL);
9715 ASSERT(kstats_kaddr != NULL && *kstats_kaddr != NULL);
9716 ASSERT(ustats_uaddr != NULL);
9717
9718 skmem_cache_free(skmem_arena_necp(stats_arena->nai_arena)->arc_kstats_cache, *kstats_kaddr);
9719 *kstats_kaddr = NULL;
9720 *ustats_uaddr = 0;
9721 }
9722
9723 // This routine returns the KVA of the sysctls object, as well as the
9724 // offset of that object relative to the mmap base address for the
9725 // task/process.
9726 static void *
necp_arena_sysctls_obj(struct necp_fd_data * fd_data,mach_vm_offset_t * off,size_t * size)9727 necp_arena_sysctls_obj(struct necp_fd_data *fd_data, mach_vm_offset_t *off, size_t *size)
9728 {
9729 void *objaddr;
9730
9731 NECP_FD_ASSERT_LOCKED(fd_data);
9732 ASSERT(fd_data->sysctl_arena != NULL);
9733
9734 // kernel virtual address of the sysctls object
9735 objaddr = skmem_arena_system_sysctls_obj_addr(fd_data->sysctl_arena);
9736 ASSERT(objaddr != NULL);
9737
9738 // Return the relative offset of the sysctls object; there is
9739 // only 1 object in the entire sysctls region, and therefore the
9740 // object's offset is simply the region's offset in the arena.
9741 // (sysctl_mmap.ami_mapaddr + offset) is the address of this object
9742 // in the task/process.
9743 if (off != NULL) {
9744 *off = fd_data->system_sysctls_roff;
9745 }
9746
9747 if (size != NULL) {
9748 *size = skmem_arena_system_sysctls_obj_size(fd_data->sysctl_arena);
9749 ASSERT(*size != 0);
9750 }
9751
9752 return objaddr;
9753 }
9754
9755 static void
necp_stats_arenas_destroy(struct necp_fd_data * fd_data,boolean_t closing)9756 necp_stats_arenas_destroy(struct necp_fd_data *fd_data, boolean_t closing)
9757 {
9758 struct necp_arena_info *nai, *nai_tmp;
9759
9760 NECP_FD_ASSERT_LOCKED(fd_data);
9761
9762 // If reaping (not closing), release reference only for idle active arena; the reference
9763 // count must be 2 by now, when it's not being referred to by any clients/flows.
9764 if ((nai = fd_data->stats_arena_active) != NULL && (closing || nai->nai_use_count == 2)) {
9765 VERIFY(nai->nai_use_count >= 2);
9766 necp_arena_info_release(nai); // for fd_data
9767 fd_data->stats_arena_active = NULL;
9768 }
9769
9770 // clean up any defunct arenas left in the list
9771 LIST_FOREACH_SAFE(nai, &fd_data->stats_arena_list, nai_chain, nai_tmp) {
9772 // If reaping, release reference if the list holds the last one
9773 if (closing || nai->nai_use_count == 1) {
9774 VERIFY(nai->nai_use_count >= 1);
9775 // callee unchains nai (and may free it)
9776 necp_fd_remove_stats_arena(fd_data, nai);
9777 }
9778 }
9779 }
9780
9781 static void
necp_sysctl_arena_destroy(struct necp_fd_data * fd_data)9782 necp_sysctl_arena_destroy(struct necp_fd_data *fd_data)
9783 {
9784 NECP_FD_ASSERT_LOCKED(fd_data);
9785
9786 // NOTE: destroying the arena requires that all outstanding objects
9787 // that were allocated have been freed, else it will assert.
9788 if (fd_data->sysctl_arena != NULL) {
9789 skmem_arena_munmap(fd_data->sysctl_arena, &fd_data->sysctl_mmap);
9790 skmem_arena_release(fd_data->sysctl_arena);
9791 OSDecrementAtomic(&necp_sysctl_arena_count);
9792 fd_data->sysctl_arena = NULL;
9793 fd_data->system_sysctls_roff = 0;
9794 }
9795 }
9796
9797 static int
necp_arena_initialize(struct necp_fd_data * fd_data,bool locked)9798 necp_arena_initialize(struct necp_fd_data *fd_data, bool locked)
9799 {
9800 int error = 0;
9801 size_t stats_obj_size = MAX(sizeof(struct necp_all_stats), sizeof(struct necp_all_kstats));
9802
9803 if (!locked) {
9804 NECP_FD_LOCK(fd_data);
9805 }
9806 if (fd_data->stats_arena_active == NULL) {
9807 error = necp_arena_create(fd_data, stats_obj_size,
9808 NECP_MAX_PER_PROCESS_CLIENT_STATISTICS_STRUCTS,
9809 current_proc());
9810 }
9811 if (!locked) {
9812 NECP_FD_UNLOCK(fd_data);
9813 }
9814
9815 return error;
9816 }
9817
9818 static int
necp_sysctl_arena_initialize(struct necp_fd_data * fd_data,bool locked)9819 necp_sysctl_arena_initialize(struct necp_fd_data *fd_data, bool locked)
9820 {
9821 int error = 0;
9822
9823 if (!locked) {
9824 NECP_FD_LOCK(fd_data);
9825 }
9826
9827 NECP_FD_ASSERT_LOCKED(fd_data);
9828
9829 if (fd_data->sysctl_arena == NULL) {
9830 char name[32];
9831 struct proc *p = current_proc();
9832
9833 ASSERT(p != PROC_NULL);
9834 ASSERT(proc_pid(p) == fd_data->proc_pid);
9835
9836 (void) snprintf(name, sizeof(name), "sysctl.%s.%d", proc_name_address(p), fd_data->proc_pid);
9837 fd_data->sysctl_arena = skmem_arena_create_for_system(name, &error);
9838 ASSERT(fd_data->sysctl_arena != NULL || error != 0);
9839 if (error != 0) {
9840 NECPLOG(LOG_ERR, "failed to create arena for pid %d\n", fd_data->proc_pid);
9841 } else {
9842 OSIncrementAtomic(&necp_sysctl_arena_count);
9843
9844 // Get region offsets from base of mmap span; the arena
9845 // doesn't need to be mmap'd at this point, since we simply
9846 // compute the relative offset.
9847 fd_data->system_sysctls_roff = skmem_arena_get_region_offset(fd_data->sysctl_arena, SKMEM_REGION_SYSCTLS);
9848
9849 // map to the task/process; upon success, the base address of the region
9850 // will be returned in nai_mmap.ami_mapaddr; this can be communicated to
9851 // the process.
9852 error = skmem_arena_mmap(fd_data->sysctl_arena, p, &fd_data->sysctl_mmap);
9853 if (error != 0) {
9854 NECPLOG(LOG_ERR, "failed to map sysctl arena for pid %d\n", fd_data->proc_pid);
9855 necp_sysctl_arena_destroy(fd_data);
9856 }
9857 }
9858 }
9859
9860 if (!locked) {
9861 NECP_FD_UNLOCK(fd_data);
9862 }
9863
9864 return error;
9865 }
9866
9867 static int
necp_client_stats_bufreq(struct necp_fd_data * fd_data,struct necp_client * client,struct necp_client_flow_registration * flow_registration,struct necp_stats_bufreq * bufreq,struct necp_stats_hdr * out_header)9868 necp_client_stats_bufreq(struct necp_fd_data *fd_data,
9869 struct necp_client *client,
9870 struct necp_client_flow_registration *flow_registration,
9871 struct necp_stats_bufreq *bufreq,
9872 struct necp_stats_hdr *out_header)
9873 {
9874 int error = 0;
9875 NECP_CLIENT_ASSERT_LOCKED(client);
9876 NECP_FD_ASSERT_LOCKED(fd_data);
9877
9878 if ((bufreq->necp_stats_bufreq_id == NECP_CLIENT_STATISTICS_BUFREQ_ID) &&
9879 ((bufreq->necp_stats_bufreq_type == NECP_CLIENT_STATISTICS_TYPE_TCP &&
9880 bufreq->necp_stats_bufreq_ver == NECP_CLIENT_STATISTICS_TYPE_TCP_CURRENT_VER) ||
9881 (bufreq->necp_stats_bufreq_type == NECP_CLIENT_STATISTICS_TYPE_UDP &&
9882 bufreq->necp_stats_bufreq_ver == NECP_CLIENT_STATISTICS_TYPE_UDP_CURRENT_VER) ||
9883 (bufreq->necp_stats_bufreq_type == NECP_CLIENT_STATISTICS_TYPE_QUIC &&
9884 bufreq->necp_stats_bufreq_ver == NECP_CLIENT_STATISTICS_TYPE_QUIC_CURRENT_VER)) &&
9885 (bufreq->necp_stats_bufreq_size == sizeof(struct necp_all_stats))) {
9886 // There should be one and only one stats allocation per client.
9887 // If asked more than once, we just repeat ourselves.
9888 if (flow_registration->ustats_uaddr == 0) {
9889 mach_vm_offset_t off;
9890 ASSERT(flow_registration->stats_arena == NULL);
9891 ASSERT(flow_registration->kstats_kaddr == NULL);
9892 ASSERT(flow_registration->ustats_uaddr == 0);
9893 error = necp_arena_stats_obj_alloc(fd_data, &off, &flow_registration->stats_arena, &flow_registration->kstats_kaddr, FALSE);
9894 if (error == 0) {
9895 // upon success, hold a reference for the client; this is released when the client is removed/closed
9896 ASSERT(flow_registration->stats_arena != NULL);
9897 necp_arena_info_retain(flow_registration->stats_arena);
9898
9899 // compute user address based on mapping info and object offset
9900 flow_registration->ustats_uaddr = flow_registration->stats_arena->nai_mmap.ami_mapaddr + off;
9901
9902 // add to collect_stats list
9903 NECP_STATS_LIST_LOCK_EXCLUSIVE();
9904 necp_client_retain_locked(client); // Add a reference to the client
9905 LIST_INSERT_HEAD(&necp_collect_stats_flow_list, flow_registration, collect_stats_chain);
9906 NECP_STATS_LIST_UNLOCK();
9907 necp_schedule_collect_stats_clients(FALSE);
9908 } else {
9909 ASSERT(flow_registration->stats_arena == NULL);
9910 ASSERT(flow_registration->kstats_kaddr == NULL);
9911 }
9912 }
9913 if (flow_registration->ustats_uaddr != 0) {
9914 ASSERT(error == 0);
9915 ASSERT(flow_registration->stats_arena != NULL);
9916 ASSERT(flow_registration->kstats_kaddr != NULL);
9917
9918 struct necp_all_kstats *kstats = (struct necp_all_kstats *)flow_registration->kstats_kaddr;
9919 kstats->necp_stats_ustats->all_stats_u.tcp_stats.necp_tcp_hdr.necp_stats_type = bufreq->necp_stats_bufreq_type;
9920 kstats->necp_stats_ustats->all_stats_u.tcp_stats.necp_tcp_hdr.necp_stats_ver = bufreq->necp_stats_bufreq_ver;
9921
9922 if (out_header) {
9923 out_header->necp_stats_type = bufreq->necp_stats_bufreq_type;
9924 out_header->necp_stats_ver = bufreq->necp_stats_bufreq_ver;
9925 }
9926
9927 bufreq->necp_stats_bufreq_uaddr = flow_registration->ustats_uaddr;
9928 }
9929 } else {
9930 error = EINVAL;
9931 }
9932
9933 return error;
9934 }
9935
9936 static int
necp_client_stats_initial(struct necp_client_flow_registration * flow_registration,uint32_t stats_type,uint32_t stats_ver)9937 necp_client_stats_initial(struct necp_client_flow_registration *flow_registration, uint32_t stats_type, uint32_t stats_ver)
9938 {
9939 // An attempted create
9940 assert(flow_registration->stats_handler_context == NULL);
9941 assert(flow_registration->stats_arena);
9942 assert(flow_registration->ustats_uaddr);
9943 assert(flow_registration->kstats_kaddr);
9944
9945 int error = 0;
9946 uint64_t ntstat_properties = necp_find_netstat_initial_properties(flow_registration->client);
9947
9948 switch (stats_type) {
9949 case NECP_CLIENT_STATISTICS_TYPE_TCP: {
9950 if (stats_ver == NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1) {
9951 flow_registration->stats_handler_context = ntstat_userland_stats_open((userland_stats_provider_context *)flow_registration,
9952 NSTAT_PROVIDER_TCP_USERLAND, ntstat_properties, necp_request_tcp_netstats, necp_find_extension_info);
9953 if (flow_registration->stats_handler_context == NULL) {
9954 error = EIO;
9955 }
9956 } else {
9957 error = ENOTSUP;
9958 }
9959 break;
9960 }
9961 case NECP_CLIENT_STATISTICS_TYPE_UDP: {
9962 if (stats_ver == NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1) {
9963 flow_registration->stats_handler_context = ntstat_userland_stats_open((userland_stats_provider_context *)flow_registration,
9964 NSTAT_PROVIDER_UDP_USERLAND, ntstat_properties, necp_request_udp_netstats, necp_find_extension_info);
9965 if (flow_registration->stats_handler_context == NULL) {
9966 error = EIO;
9967 }
9968 } else {
9969 error = ENOTSUP;
9970 }
9971 break;
9972 }
9973 case NECP_CLIENT_STATISTICS_TYPE_QUIC: {
9974 if (stats_ver == NECP_CLIENT_STATISTICS_TYPE_QUIC_VER_1 && flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS) {
9975 flow_registration->stats_handler_context = ntstat_userland_stats_open((userland_stats_provider_context *)flow_registration,
9976 NSTAT_PROVIDER_QUIC_USERLAND, ntstat_properties, necp_request_quic_netstats, necp_find_extension_info);
9977 if (flow_registration->stats_handler_context == NULL) {
9978 error = EIO;
9979 }
9980 } else {
9981 error = ENOTSUP;
9982 }
9983 break;
9984 }
9985 default: {
9986 error = ENOTSUP;
9987 break;
9988 }
9989 }
9990 return error;
9991 }
9992
9993 static int
necp_stats_initialize(struct necp_fd_data * fd_data,struct necp_client * client,struct necp_client_flow_registration * flow_registration,struct necp_stats_bufreq * bufreq)9994 necp_stats_initialize(struct necp_fd_data *fd_data,
9995 struct necp_client *client,
9996 struct necp_client_flow_registration *flow_registration,
9997 struct necp_stats_bufreq *bufreq)
9998 {
9999 int error = 0;
10000 struct necp_stats_hdr stats_hdr = {};
10001
10002 NECP_CLIENT_ASSERT_LOCKED(client);
10003 NECP_FD_ASSERT_LOCKED(fd_data);
10004 VERIFY(fd_data->stats_arena_active != NULL);
10005 VERIFY(fd_data->stats_arena_active->nai_arena != NULL);
10006 VERIFY(!(fd_data->stats_arena_active->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT)));
10007
10008 if (bufreq == NULL) {
10009 return EINVAL;
10010 }
10011
10012 // Setup stats region
10013 error = necp_client_stats_bufreq(fd_data, client, flow_registration, bufreq, &stats_hdr);
10014 if (error) {
10015 return error;
10016 }
10017 // Notify ntstat about new flow
10018 if (flow_registration->stats_handler_context == NULL) {
10019 error = necp_client_stats_initial(flow_registration, stats_hdr.necp_stats_type, stats_hdr.necp_stats_ver);
10020 if (flow_registration->stats_handler_context != NULL) {
10021 ntstat_userland_stats_event(flow_registration->stats_handler_context, NECP_CLIENT_STATISTICS_EVENT_INIT);
10022 }
10023 NECP_CLIENT_FLOW_LOG(client, flow_registration, "Initialized stats <error %d>", error);
10024 }
10025
10026 return error;
10027 }
10028
10029 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_map_sysctls(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)10030 necp_client_map_sysctls(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
10031 {
10032 int result = 0;
10033 if (!retval) {
10034 retval = &result;
10035 }
10036
10037 do {
10038 mach_vm_address_t uaddr = 0;
10039 if (uap->buffer_size != sizeof(uaddr)) {
10040 *retval = EINVAL;
10041 break;
10042 }
10043
10044 *retval = necp_sysctl_arena_initialize(fd_data, false);
10045 if (*retval != 0) {
10046 break;
10047 }
10048
10049 mach_vm_offset_t off = 0;
10050 void *location = NULL;
10051 NECP_FD_LOCK(fd_data);
10052 location = necp_arena_sysctls_obj(fd_data, &off, NULL);
10053 NECP_FD_UNLOCK(fd_data);
10054
10055 if (location == NULL) {
10056 *retval = ENOENT;
10057 break;
10058 }
10059
10060 uaddr = fd_data->sysctl_mmap.ami_mapaddr + off;
10061 *retval = copyout(&uaddr, uap->buffer, sizeof(uaddr));
10062 } while (false);
10063
10064 return *retval;
10065 }
10066
10067 #endif /* !SKYWALK */
10068
10069 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_route_statistics(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)10070 necp_client_copy_route_statistics(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
10071 {
10072 int error = 0;
10073 struct necp_client *client = NULL;
10074 uuid_t client_id;
10075
10076 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
10077 uap->buffer_size < sizeof(struct necp_stat_counts) || uap->buffer == 0) {
10078 NECPLOG0(LOG_ERR, "necp_client_copy_route_statistics bad input");
10079 error = EINVAL;
10080 goto done;
10081 }
10082
10083 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
10084 if (error) {
10085 NECPLOG(LOG_ERR, "necp_client_copy_route_statistics copyin client_id error (%d)", error);
10086 goto done;
10087 }
10088
10089 // Lock
10090 NECP_FD_LOCK(fd_data);
10091 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
10092 if (client != NULL) {
10093 NECP_CLIENT_ROUTE_LOCK(client);
10094 struct necp_stat_counts route_stats = {};
10095 if (client->current_route != NULL && client->current_route->rt_stats != NULL) {
10096 struct nstat_counts *rt_stats = client->current_route->rt_stats;
10097 route_stats.necp_stat_rxpackets = os_atomic_load(&rt_stats->nstat_rxpackets, relaxed);
10098 route_stats.necp_stat_rxbytes = os_atomic_load(&rt_stats->nstat_rxbytes, relaxed);
10099 route_stats.necp_stat_txpackets = os_atomic_load(&rt_stats->nstat_txpackets, relaxed);
10100 route_stats.necp_stat_txbytes = os_atomic_load(&rt_stats->nstat_txbytes, relaxed);
10101 route_stats.necp_stat_rxduplicatebytes = rt_stats->nstat_rxduplicatebytes;
10102 route_stats.necp_stat_rxoutoforderbytes = rt_stats->nstat_rxoutoforderbytes;
10103 route_stats.necp_stat_txretransmit = rt_stats->nstat_txretransmit;
10104 route_stats.necp_stat_connectattempts = rt_stats->nstat_connectattempts;
10105 route_stats.necp_stat_connectsuccesses = rt_stats->nstat_connectsuccesses;
10106 route_stats.necp_stat_min_rtt = rt_stats->nstat_min_rtt;
10107 route_stats.necp_stat_avg_rtt = rt_stats->nstat_avg_rtt;
10108 route_stats.necp_stat_var_rtt = rt_stats->nstat_var_rtt;
10109 route_stats.necp_stat_route_flags = client->current_route->rt_flags;
10110 }
10111
10112 // Unlock before copying out
10113 NECP_CLIENT_ROUTE_UNLOCK(client);
10114 NECP_CLIENT_UNLOCK(client);
10115 NECP_FD_UNLOCK(fd_data);
10116
10117 error = copyout(&route_stats, uap->buffer, sizeof(route_stats));
10118 if (error) {
10119 NECPLOG(LOG_ERR, "necp_client_copy_route_statistics copyout error (%d)", error);
10120 }
10121 } else {
10122 // Unlock
10123 NECP_FD_UNLOCK(fd_data);
10124 error = ENOENT;
10125 }
10126
10127
10128 done:
10129 *retval = error;
10130 return error;
10131 }
10132
10133 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_update_cache(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)10134 necp_client_update_cache(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
10135 {
10136 int error = 0;
10137 struct necp_client *client = NULL;
10138 uuid_t client_id;
10139
10140 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
10141 error = EINVAL;
10142 goto done;
10143 }
10144
10145 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
10146 if (error) {
10147 NECPLOG(LOG_ERR, "necp_client_update_cache copyin client_id error (%d)", error);
10148 goto done;
10149 }
10150
10151 NECP_FD_LOCK(fd_data);
10152 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
10153 if (client == NULL) {
10154 NECP_FD_UNLOCK(fd_data);
10155 error = ENOENT;
10156 goto done;
10157 }
10158
10159 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
10160 if (flow_registration == NULL) {
10161 NECP_CLIENT_UNLOCK(client);
10162 NECP_FD_UNLOCK(fd_data);
10163 error = ENOENT;
10164 goto done;
10165 }
10166
10167 NECP_CLIENT_ROUTE_LOCK(client);
10168 // This needs to be changed when TFO/ECN is supported by multiple flows
10169 struct necp_client_flow *flow = LIST_FIRST(&flow_registration->flow_list);
10170 if (flow == NULL ||
10171 (flow->remote_addr.sa.sa_family != AF_INET &&
10172 flow->remote_addr.sa.sa_family != AF_INET6) ||
10173 (flow->local_addr.sa.sa_family != AF_INET &&
10174 flow->local_addr.sa.sa_family != AF_INET6)) {
10175 error = EINVAL;
10176 NECPLOG(LOG_ERR, "necp_client_update_cache no flow error (%d)", error);
10177 goto done_unlock;
10178 }
10179
10180 necp_cache_buffer cache_buffer;
10181 memset(&cache_buffer, 0, sizeof(cache_buffer));
10182
10183 if (uap->buffer_size != sizeof(necp_cache_buffer) ||
10184 uap->buffer == USER_ADDR_NULL) {
10185 error = EINVAL;
10186 goto done_unlock;
10187 }
10188
10189 error = copyin(uap->buffer, &cache_buffer, sizeof(cache_buffer));
10190 if (error) {
10191 NECPLOG(LOG_ERR, "necp_client_update_cache copyin cache buffer error (%d)", error);
10192 goto done_unlock;
10193 }
10194
10195 if (cache_buffer.necp_cache_buf_type == NECP_CLIENT_CACHE_TYPE_ECN &&
10196 cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_ECN_VER_1) {
10197 if (cache_buffer.necp_cache_buf_size != sizeof(necp_tcp_ecn_cache) ||
10198 cache_buffer.necp_cache_buf_addr == USER_ADDR_NULL) {
10199 error = EINVAL;
10200 goto done_unlock;
10201 }
10202
10203 necp_tcp_ecn_cache ecn_cache_buffer;
10204 memset(&ecn_cache_buffer, 0, sizeof(ecn_cache_buffer));
10205
10206 error = copyin(cache_buffer.necp_cache_buf_addr, &ecn_cache_buffer, sizeof(necp_tcp_ecn_cache));
10207 if (error) {
10208 NECPLOG(LOG_ERR, "necp_client_update_cache copyin ecn cache buffer error (%d)", error);
10209 goto done_unlock;
10210 }
10211
10212 if (client->current_route != NULL && client->current_route->rt_ifp != NULL) {
10213 if (!client->platform_binary) {
10214 ecn_cache_buffer.necp_tcp_ecn_heuristics_success = 0;
10215 }
10216 tcp_heuristics_ecn_update(&ecn_cache_buffer, client->current_route->rt_ifp,
10217 (union sockaddr_in_4_6 *)&flow->local_addr);
10218 }
10219 } else if (cache_buffer.necp_cache_buf_type == NECP_CLIENT_CACHE_TYPE_TFO &&
10220 cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_TFO_VER_1) {
10221 if (cache_buffer.necp_cache_buf_size != sizeof(necp_tcp_tfo_cache) ||
10222 cache_buffer.necp_cache_buf_addr == USER_ADDR_NULL) {
10223 error = EINVAL;
10224 goto done_unlock;
10225 }
10226
10227 necp_tcp_tfo_cache tfo_cache_buffer;
10228 memset(&tfo_cache_buffer, 0, sizeof(tfo_cache_buffer));
10229
10230 error = copyin(cache_buffer.necp_cache_buf_addr, &tfo_cache_buffer, sizeof(necp_tcp_tfo_cache));
10231 if (error) {
10232 NECPLOG(LOG_ERR, "necp_client_update_cache copyin tfo cache buffer error (%d)", error);
10233 goto done_unlock;
10234 }
10235
10236 if (client->current_route != NULL && client->current_route->rt_ifp != NULL) {
10237 if (!client->platform_binary) {
10238 tfo_cache_buffer.necp_tcp_tfo_heuristics_success = 0;
10239 }
10240 tcp_heuristics_tfo_update(&tfo_cache_buffer, client->current_route->rt_ifp,
10241 (union sockaddr_in_4_6 *)&flow->local_addr,
10242 (union sockaddr_in_4_6 *)&flow->remote_addr);
10243 }
10244 } else {
10245 error = EINVAL;
10246 }
10247 done_unlock:
10248 NECP_CLIENT_ROUTE_UNLOCK(client);
10249 NECP_CLIENT_UNLOCK(client);
10250 NECP_FD_UNLOCK(fd_data);
10251 done:
10252 *retval = error;
10253 return error;
10254 }
10255
10256 // Most results will fit into this size
10257 struct necp_client_signable_default {
10258 uuid_t client_id;
10259 u_int32_t sign_type;
10260 u_int8_t signable_data[NECP_CLIENT_ACTION_SIGN_DEFAULT_DATA_LENGTH];
10261 } __attribute__((__packed__));
10262
10263 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_sign(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)10264 necp_client_sign(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
10265 {
10266 int error = 0;
10267 u_int8_t tag[NECP_CLIENT_ACTION_SIGN_TAG_LENGTH] = {};
10268 struct necp_client_signable *signable = NULL;
10269 struct necp_client_signable *allocated_signable = NULL;
10270 struct necp_client_signable_default default_signable = {};
10271 size_t tag_size = sizeof(tag);
10272
10273 const size_t signable_length = uap->client_id_len;
10274 const size_t return_tag_length = uap->buffer_size;
10275
10276 *retval = 0;
10277
10278 const bool has_resolver_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_VALIDATED_RESOLVER, 0) == 0);
10279 if (!has_resolver_entitlement) {
10280 NECPLOG0(LOG_ERR, "Process does not hold the necessary entitlement to sign resolver answers");
10281 error = EPERM;
10282 goto done;
10283 }
10284
10285 if (uap->client_id == 0 || signable_length < sizeof(*signable) || signable_length > NECP_CLIENT_ACTION_SIGN_MAX_TOTAL_LENGTH) {
10286 error = EINVAL;
10287 goto done;
10288 }
10289
10290 if (uap->buffer == 0 || return_tag_length != NECP_CLIENT_ACTION_SIGN_TAG_LENGTH) {
10291 error = EINVAL;
10292 goto done;
10293 }
10294
10295 if (signable_length <= sizeof(default_signable)) {
10296 signable = (struct necp_client_signable *)&default_signable;
10297 } else {
10298 if ((allocated_signable = (struct necp_client_signable *)kalloc_data(signable_length, Z_WAITOK | Z_ZERO)) == NULL) {
10299 NECPLOG(LOG_ERR, "necp_client_sign allocate signable %zu failed", signable_length);
10300 error = ENOMEM;
10301 goto done;
10302 }
10303 signable = allocated_signable;
10304 }
10305
10306 error = copyin(uap->client_id, signable, signable_length);
10307 if (error) {
10308 NECPLOG(LOG_ERR, "necp_client_sign copyin signable error (%d)", error);
10309 goto done;
10310 }
10311
10312 size_t data_length = 0;
10313 switch (signable->sign_type) {
10314 case NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER:
10315 case NECP_CLIENT_SIGN_TYPE_SYSTEM_RESOLVER_ANSWER: {
10316 data_length = (sizeof(struct necp_client_host_resolver_answer) - sizeof(struct necp_client_signable));
10317 if (signable_length < (sizeof(struct necp_client_signable) + data_length)) {
10318 error = EINVAL;
10319 goto done;
10320 }
10321 struct necp_client_host_resolver_answer *signable_struct = (struct necp_client_host_resolver_answer *)signable;
10322 if (signable_struct->hostname_length > NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH ||
10323 signable_length != (sizeof(struct necp_client_signable) + data_length + signable_struct->hostname_length)) {
10324 error = EINVAL;
10325 goto done;
10326 }
10327 data_length += signable_struct->hostname_length;
10328 break;
10329 }
10330 case NECP_CLIENT_SIGN_TYPE_BROWSE_RESULT:
10331 case NECP_CLIENT_SIGN_TYPE_SYSTEM_BROWSE_RESULT: {
10332 data_length = (sizeof(struct necp_client_browse_result) - sizeof(struct necp_client_signable));
10333 if (signable_length < (sizeof(struct necp_client_signable) + data_length)) {
10334 error = EINVAL;
10335 goto done;
10336 }
10337 struct necp_client_browse_result *signable_struct = (struct necp_client_browse_result *)signable;
10338 if (signable_struct->service_length > NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH ||
10339 signable_length != (sizeof(struct necp_client_signable) + data_length + signable_struct->service_length)) {
10340 error = EINVAL;
10341 goto done;
10342 }
10343 data_length += signable_struct->service_length;
10344 break;
10345 }
10346 case NECP_CLIENT_SIGN_TYPE_SERVICE_RESOLVER_ANSWER:
10347 case NECP_CLIENT_SIGN_TYPE_SYSTEM_SERVICE_RESOLVER_ANSWER: {
10348 data_length = (sizeof(struct necp_client_service_resolver_answer) - sizeof(struct necp_client_signable));
10349 if (signable_length < (sizeof(struct necp_client_signable) + data_length)) {
10350 error = EINVAL;
10351 goto done;
10352 }
10353 struct necp_client_service_resolver_answer *signable_struct = (struct necp_client_service_resolver_answer *)signable;
10354 if (signable_struct->service_length > NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH ||
10355 signable_struct->hostname_length > NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH ||
10356 signable_length != (sizeof(struct necp_client_signable) + data_length + signable_struct->service_length + signable_struct->hostname_length)) {
10357 error = EINVAL;
10358 goto done;
10359 }
10360 data_length += signable_struct->service_length;
10361 data_length += signable_struct->hostname_length;
10362 break;
10363 }
10364 default: {
10365 NECPLOG(LOG_ERR, "necp_client_sign unknown signable type (%u)", signable->sign_type);
10366 error = EINVAL;
10367 goto done;
10368 }
10369 }
10370
10371 error = necp_sign_resolver_answer(signable->client_id, signable->sign_type,
10372 signable->signable_data, data_length,
10373 tag, &tag_size);
10374 if (tag_size != sizeof(tag)) {
10375 NECPLOG(LOG_ERR, "necp_client_sign unexpected tag size %zu", tag_size);
10376 error = EINVAL;
10377 goto done;
10378 }
10379 error = copyout(tag, uap->buffer, tag_size);
10380 if (error) {
10381 NECPLOG(LOG_ERR, "necp_client_sign copyout error (%d)", error);
10382 goto done;
10383 }
10384
10385 done:
10386 if (allocated_signable != NULL) {
10387 kfree_data(allocated_signable, signable_length);
10388 allocated_signable = NULL;
10389 }
10390 *retval = error;
10391 return error;
10392 }
10393
10394 // Most results will fit into this size
10395 struct necp_client_validatable_default {
10396 struct necp_client_signature signature;
10397 struct necp_client_signable_default signable;
10398 } __attribute__((__packed__));
10399
10400 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_validate(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)10401 necp_client_validate(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
10402 {
10403 int error = 0;
10404 struct necp_client_validatable *validatable = NULL;
10405 struct necp_client_validatable *allocated_validatable = NULL;
10406 struct necp_client_validatable_default default_validatable = {};
10407
10408 const size_t validatable_length = uap->client_id_len;
10409
10410 *retval = 0;
10411
10412 const bool has_resolver_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_VALIDATED_RESOLVER, 0) == 0);
10413 if (!has_resolver_entitlement) {
10414 NECPLOG0(LOG_ERR, "Process does not hold the necessary entitlement to directly validate resolver answers");
10415 error = EPERM;
10416 goto done;
10417 }
10418
10419 if (uap->client_id == 0 || validatable_length < sizeof(*validatable) ||
10420 validatable_length > (NECP_CLIENT_ACTION_SIGN_MAX_TOTAL_LENGTH + NECP_CLIENT_ACTION_SIGN_TAG_LENGTH)) {
10421 error = EINVAL;
10422 goto done;
10423 }
10424
10425 if (validatable_length <= sizeof(default_validatable)) {
10426 validatable = (struct necp_client_validatable *)&default_validatable;
10427 } else {
10428 if ((allocated_validatable = (struct necp_client_validatable *)kalloc_data(validatable_length, Z_WAITOK | Z_ZERO)) == NULL) {
10429 NECPLOG(LOG_ERR, "necp_client_validate allocate struct %zu failed", validatable_length);
10430 error = ENOMEM;
10431 goto done;
10432 }
10433 validatable = allocated_validatable;
10434 }
10435
10436 error = copyin(uap->client_id, validatable, validatable_length);
10437 if (error) {
10438 NECPLOG(LOG_ERR, "necp_client_validate copyin error (%d)", error);
10439 goto done;
10440 }
10441
10442 const bool validated = necp_validate_resolver_answer(validatable->signable.client_id, validatable->signable.sign_type,
10443 validatable->signable.signable_data, validatable_length - sizeof(struct necp_client_validatable),
10444 validatable->signature.signed_tag, sizeof(validatable->signature.signed_tag));
10445 if (!validated) {
10446 // Return EAUTH to indicate that the signature failed
10447 error = EAUTH;
10448 }
10449
10450 done:
10451 if (allocated_validatable != NULL) {
10452 kfree_data(allocated_validatable, validatable_length);
10453 allocated_validatable = NULL;
10454 }
10455 *retval = error;
10456 return error;
10457 }
10458
10459 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_get_signed_client_id(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)10460 necp_client_get_signed_client_id(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
10461 {
10462 int error = 0;
10463 *retval = 0;
10464 u_int32_t request_type = 0;
10465 struct necp_client_signed_client_id_uuid client_id = { 0 };
10466 const size_t buffer_size = uap->buffer_size;
10467 u_int8_t tag[NECP_CLIENT_ACTION_SIGN_TAG_LENGTH] = {};
10468 size_t tag_size = sizeof(tag);
10469
10470 // Only allow entitled processes to get the client ID.
10471 proc_t proc = current_proc();
10472 task_t __single task = proc_task(proc);
10473 bool has_delegation_entitlement = task != NULL && IOTaskHasEntitlement(task, kCSWebBrowserHostEntitlement);
10474 if (!has_delegation_entitlement) {
10475 has_delegation_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_SOCKET_DELEGATE, 0) == 0);
10476 }
10477 if (!has_delegation_entitlement) {
10478 NECPLOG0(LOG_ERR, "necp_client_get_signed_client_id client lacks the necessary entitlement");
10479 error = EAUTH;
10480 goto done;
10481 }
10482
10483 if (uap->client_id == 0 || uap->client_id_len != sizeof(u_int32_t) ||
10484 buffer_size < sizeof(struct necp_client_signed_client_id_uuid) ||
10485 uap->buffer == 0) {
10486 NECPLOG0(LOG_ERR, "necp_client_get_signed_client_id bad input");
10487 error = EINVAL;
10488 goto done;
10489 }
10490
10491 error = copyin(uap->client_id, &request_type, sizeof(u_int32_t));
10492 if (error) {
10493 NECPLOG(LOG_ERR, "necp_client_get_signed_client_id copyin request_type error (%d)", error);
10494 goto done;
10495 }
10496
10497 if (request_type != NECP_CLIENT_SIGNED_CLIENT_ID_TYPE_UUID) {
10498 error = ENOENT;
10499 NECPLOG(LOG_ERR, "necp_client_get_signed_client_id bad request_type (%d)", request_type);
10500 goto done;
10501 }
10502
10503 uuid_t application_uuid;
10504 uuid_clear(application_uuid);
10505 proc_getexecutableuuid(proc, application_uuid, sizeof(application_uuid));
10506
10507 error = necp_sign_application_id(application_uuid,
10508 NECP_CLIENT_SIGNED_CLIENT_ID_TYPE_UUID,
10509 tag, &tag_size);
10510 if (tag_size != sizeof(tag)) {
10511 NECPLOG(LOG_ERR, "necp_client_get_signed_client_id unexpected tag size %zu", tag_size);
10512 error = EINVAL;
10513 goto done;
10514 }
10515 uuid_copy(client_id.client_id, application_uuid);
10516 client_id.signature_length = tag_size;
10517 memcpy(client_id.signature_data, tag, tag_size);
10518
10519 error = copyout(&client_id, uap->buffer, sizeof(client_id));
10520 if (error != 0) {
10521 NECPLOG(LOG_ERR, "necp_client_get_signed_client_id copyout error (%d)", error);
10522 goto done;
10523 }
10524
10525 done:
10526 *retval = error;
10527 return error;
10528 }
10529
10530 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_set_signed_client_id(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)10531 necp_client_set_signed_client_id(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
10532 {
10533 int error = 0;
10534 *retval = 0;
10535 u_int32_t request_type = 0;
10536 struct necp_client_signed_client_id_uuid client_id = { 0 };
10537 const size_t buffer_size = uap->buffer_size;
10538
10539 // Only allow entitled processes to set the client ID.
10540 proc_t proc = current_proc();
10541 task_t __single task = proc_task(proc);
10542 bool has_delegation_entitlement = task != NULL && IOTaskHasEntitlement(task, kCSWebBrowserNetworkEntitlement);
10543 if (!has_delegation_entitlement) {
10544 has_delegation_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_SOCKET_DELEGATE, 0) == 0);
10545 }
10546 if (!has_delegation_entitlement) {
10547 NECPLOG0(LOG_ERR, "necp_client_set_signed_client_id client lacks the necessary entitlement");
10548 error = EAUTH;
10549 goto done;
10550 }
10551
10552 if (uap->client_id == 0 || uap->client_id_len != sizeof(u_int32_t) ||
10553 buffer_size < sizeof(struct necp_client_signed_client_id_uuid) ||
10554 uap->buffer == 0) {
10555 NECPLOG0(LOG_ERR, "necp_client_set_signed_client_id bad input");
10556 error = EINVAL;
10557 goto done;
10558 }
10559
10560 error = copyin(uap->client_id, &request_type, sizeof(u_int32_t));
10561 if (error) {
10562 NECPLOG(LOG_ERR, "necp_client_set_signed_client_id copyin request_type error (%d)", error);
10563 goto done;
10564 }
10565
10566 if (request_type != NECP_CLIENT_SIGNED_CLIENT_ID_TYPE_UUID) {
10567 error = ENOENT;
10568 NECPLOG(LOG_ERR, "necp_client_set_signed_client_id bad request_type (%d)", request_type);
10569 goto done;
10570 }
10571
10572 error = copyin(uap->buffer, &client_id, sizeof(struct necp_client_signed_client_id_uuid));
10573 if (error) {
10574 NECPLOG(LOG_ERR, "necp_client_set_signed_client_id copyin request error (%d)", error);
10575 goto done;
10576 }
10577
10578 const bool validated = necp_validate_application_id(client_id.client_id,
10579 NECP_CLIENT_SIGNED_CLIENT_ID_TYPE_UUID,
10580 client_id.signature_data, sizeof(client_id.signature_data));
10581 if (!validated) {
10582 // Return EAUTH to indicate that the signature failed
10583 error = EAUTH;
10584 NECPLOG(LOG_ERR, "necp_client_set_signed_client_id signature validation failed (%d)", error);
10585 goto done;
10586 }
10587
10588 proc_setresponsibleuuid(proc, client_id.client_id, sizeof(client_id.client_id));
10589
10590 done:
10591 *retval = error;
10592 return error;
10593 }
10594
10595 int
necp_client_action(struct proc * p,struct necp_client_action_args * uap,int * retval)10596 necp_client_action(struct proc *p, struct necp_client_action_args *uap, int *retval)
10597 {
10598 struct fileproc *fp;
10599 int error = 0;
10600 int return_value = 0;
10601 struct necp_fd_data *fd_data = NULL;
10602
10603 error = necp_find_fd_data(p, uap->necp_fd, &fp, &fd_data);
10604 if (error != 0) {
10605 NECPLOG(LOG_ERR, "necp_client_action find fd error (%d)", error);
10606 return error;
10607 }
10608
10609 u_int32_t action = uap->action;
10610
10611 #if CONFIG_MACF
10612 error = mac_necp_check_client_action(p, fp->fp_glob, action);
10613 if (error) {
10614 return_value = error;
10615 goto done;
10616 }
10617 #endif /* MACF */
10618
10619 switch (action) {
10620 case NECP_CLIENT_ACTION_ADD: {
10621 return_value = necp_client_add(p, fd_data, uap, retval);
10622 break;
10623 }
10624 case NECP_CLIENT_ACTION_CLAIM: {
10625 return_value = necp_client_claim(p, fd_data, uap, retval);
10626 break;
10627 }
10628 case NECP_CLIENT_ACTION_REMOVE: {
10629 return_value = necp_client_remove(fd_data, uap, retval);
10630 break;
10631 }
10632 case NECP_CLIENT_ACTION_COPY_PARAMETERS:
10633 case NECP_CLIENT_ACTION_COPY_RESULT:
10634 case NECP_CLIENT_ACTION_COPY_UPDATED_RESULT: {
10635 return_value = necp_client_copy(fd_data, uap, retval);
10636 break;
10637 }
10638 case NECP_CLIENT_ACTION_COPY_LIST: {
10639 return_value = necp_client_list(fd_data, uap, retval);
10640 break;
10641 }
10642 case NECP_CLIENT_ACTION_ADD_FLOW: {
10643 return_value = necp_client_add_flow(fd_data, uap, retval);
10644 break;
10645 }
10646 case NECP_CLIENT_ACTION_REMOVE_FLOW: {
10647 return_value = necp_client_remove_flow(fd_data, uap, retval);
10648 break;
10649 }
10650 #if SKYWALK
10651 case NECP_CLIENT_ACTION_REQUEST_NEXUS_INSTANCE: {
10652 return_value = necp_client_request_nexus(fd_data, uap, retval);
10653 break;
10654 }
10655 #endif /* !SKYWALK */
10656 case NECP_CLIENT_ACTION_AGENT: {
10657 return_value = necp_client_agent_action(fd_data, uap, retval);
10658 break;
10659 }
10660 case NECP_CLIENT_ACTION_COPY_AGENT: {
10661 return_value = necp_client_copy_agent(fd_data, uap, retval);
10662 break;
10663 }
10664 case NECP_CLIENT_ACTION_AGENT_USE: {
10665 return_value = necp_client_agent_use(fd_data, uap, retval);
10666 break;
10667 }
10668 case NECP_CLIENT_ACTION_ACQUIRE_AGENT_TOKEN: {
10669 return_value = necp_client_acquire_agent_token(fd_data, uap, retval);
10670 break;
10671 }
10672 case NECP_CLIENT_ACTION_COPY_INTERFACE: {
10673 return_value = necp_client_copy_interface(fd_data, uap, retval);
10674 break;
10675 }
10676 #if SKYWALK
10677 case NECP_CLIENT_ACTION_GET_INTERFACE_ADDRESS: {
10678 return_value = necp_client_get_interface_address(fd_data, uap, retval);
10679 break;
10680 }
10681 case NECP_CLIENT_ACTION_SET_STATISTICS: {
10682 return_value = ENOTSUP;
10683 break;
10684 }
10685 case NECP_CLIENT_ACTION_MAP_SYSCTLS: {
10686 return_value = necp_client_map_sysctls(fd_data, uap, retval);
10687 break;
10688 }
10689 #endif /* !SKYWALK */
10690 case NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS: {
10691 return_value = necp_client_copy_route_statistics(fd_data, uap, retval);
10692 break;
10693 }
10694 case NECP_CLIENT_ACTION_UPDATE_CACHE: {
10695 return_value = necp_client_update_cache(fd_data, uap, retval);
10696 break;
10697 }
10698 case NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE: {
10699 return_value = necp_client_copy_client_update(fd_data, uap, retval);
10700 break;
10701 }
10702 case NECP_CLIENT_ACTION_SIGN: {
10703 return_value = necp_client_sign(fd_data, uap, retval);
10704 break;
10705 }
10706 case NECP_CLIENT_ACTION_VALIDATE: {
10707 return_value = necp_client_validate(fd_data, uap, retval);
10708 break;
10709 }
10710 case NECP_CLIENT_ACTION_GET_SIGNED_CLIENT_ID: {
10711 return_value = necp_client_get_signed_client_id(fd_data, uap, retval);
10712 break;
10713 }
10714 case NECP_CLIENT_ACTION_SET_SIGNED_CLIENT_ID: {
10715 return_value = necp_client_set_signed_client_id(fd_data, uap, retval);
10716 break;
10717 }
10718 default: {
10719 NECPLOG(LOG_ERR, "necp_client_action unknown action (%u)", action);
10720 return_value = EINVAL;
10721 break;
10722 }
10723 }
10724
10725 done:
10726 fp_drop(p, uap->necp_fd, fp, 0);
10727 return return_value;
10728 }
10729
10730 #define NECP_MAX_MATCH_POLICY_PARAMETER_SIZE 1024
10731
10732 int
necp_match_policy(struct proc * p,struct necp_match_policy_args * uap,int32_t * retval)10733 necp_match_policy(struct proc *p, struct necp_match_policy_args *uap, int32_t *retval)
10734 {
10735 #pragma unused(retval)
10736 u_int8_t *parameters = NULL;
10737 struct necp_aggregate_result returned_result;
10738 int error = 0;
10739
10740 if (uap == NULL) {
10741 error = EINVAL;
10742 goto done;
10743 }
10744
10745 if (uap->parameters == 0 || uap->parameters_size == 0 || uap->parameters_size > NECP_MAX_MATCH_POLICY_PARAMETER_SIZE || uap->returned_result == 0) {
10746 error = EINVAL;
10747 goto done;
10748 }
10749
10750 parameters = (u_int8_t *)kalloc_data(uap->parameters_size, Z_WAITOK | Z_ZERO);
10751 if (parameters == NULL) {
10752 error = ENOMEM;
10753 goto done;
10754 }
10755 // Copy parameters in
10756 error = copyin(uap->parameters, parameters, uap->parameters_size);
10757 if (error) {
10758 goto done;
10759 }
10760
10761 error = necp_application_find_policy_match_internal(p, parameters, uap->parameters_size,
10762 &returned_result, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL, false, false, NULL);
10763 if (error) {
10764 goto done;
10765 }
10766
10767 // Copy return value back
10768 error = copyout(&returned_result, uap->returned_result, sizeof(struct necp_aggregate_result));
10769 if (error) {
10770 goto done;
10771 }
10772 done:
10773 if (parameters != NULL) {
10774 kfree_data(parameters, uap->parameters_size);
10775 }
10776 return error;
10777 }
10778
10779 /// Socket operations
10780
10781 static errno_t
necp_set_socket_attribute(u_int8_t * buffer,size_t buffer_length,u_int8_t type,char ** buffer_p,bool * single_tlv)10782 necp_set_socket_attribute(u_int8_t *buffer, size_t buffer_length, u_int8_t type, char **buffer_p, bool *single_tlv)
10783 {
10784 int error = 0;
10785 int cursor = 0;
10786 size_t string_size = 0;
10787 char *local_string = NULL;
10788 u_int8_t *value = NULL;
10789 char *buffer_to_free = NULL;
10790
10791 cursor = necp_buffer_find_tlv(buffer, buffer_length, 0, type, NULL, 0);
10792 if (cursor < 0) {
10793 // This will clear out the parameter
10794 goto done;
10795 }
10796
10797 string_size = necp_buffer_get_tlv_length(buffer, cursor);
10798 if (single_tlv != NULL && (buffer_length == sizeof(struct necp_tlv_header) + string_size)) {
10799 *single_tlv = true;
10800 }
10801 if (string_size == 0 || string_size > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) {
10802 // This will clear out the parameter
10803 goto done;
10804 }
10805
10806 local_string = (char *)kalloc_data(string_size + 1, Z_WAITOK | Z_ZERO);
10807 if (local_string == NULL) {
10808 NECPLOG(LOG_ERR, "Failed to allocate a socket attribute buffer (size %zu)", string_size);
10809 goto fail;
10810 }
10811
10812 value = necp_buffer_get_tlv_value(buffer, cursor, NULL);
10813 if (value == NULL) {
10814 NECPLOG0(LOG_ERR, "Failed to get socket attribute");
10815 goto fail;
10816 }
10817
10818 memcpy(local_string, value, string_size);
10819 local_string[string_size] = 0;
10820
10821 done:
10822 buffer_to_free = *buffer_p;
10823
10824 // Protect switching of buffer pointer
10825 necp_lock_socket_attributes();
10826 *buffer_p = local_string;
10827 necp_unlock_socket_attributes();
10828
10829 if (buffer_to_free != NULL) {
10830 kfree_data_addr(buffer_to_free);
10831 }
10832 return 0;
10833 fail:
10834 if (local_string != NULL) {
10835 kfree_data(local_string, string_size + 1);
10836 }
10837 return error;
10838 }
10839
10840 errno_t
necp_set_socket_attributes(struct inp_necp_attributes * attributes,struct sockopt * sopt)10841 necp_set_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt)
10842 {
10843 int error = 0;
10844 u_int8_t *buffer = NULL;
10845 bool single_tlv = false;
10846 size_t valsize = sopt->sopt_valsize;
10847 if (valsize == 0 ||
10848 valsize > ((sizeof(struct necp_tlv_header) + NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) * 4)) {
10849 goto done;
10850 }
10851
10852 buffer = (u_int8_t *)kalloc_data(valsize, Z_WAITOK | Z_ZERO);
10853 if (buffer == NULL) {
10854 goto done;
10855 }
10856
10857 error = sooptcopyin(sopt, buffer, valsize, 0);
10858 if (error) {
10859 goto done;
10860 }
10861
10862 // If NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT is being set/cleared separately from the other attributes,
10863 // do not clear other attributes.
10864 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT, &attributes->inp_domain_context, &single_tlv);
10865 if (error) {
10866 NECPLOG0(LOG_ERR, "Could not set domain context TLV for socket attributes");
10867 goto done;
10868 }
10869 if (single_tlv == true) {
10870 goto done;
10871 }
10872
10873 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN, &attributes->inp_domain, NULL);
10874 if (error) {
10875 NECPLOG0(LOG_ERR, "Could not set domain TLV for socket attributes");
10876 goto done;
10877 }
10878
10879 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN_OWNER, &attributes->inp_domain_owner, NULL);
10880 if (error) {
10881 NECPLOG0(LOG_ERR, "Could not set domain owner TLV for socket attributes");
10882 goto done;
10883 }
10884
10885 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_TRACKER_DOMAIN, &attributes->inp_tracker_domain, NULL);
10886 if (error) {
10887 NECPLOG0(LOG_ERR, "Could not set tracker domain TLV for socket attributes");
10888 goto done;
10889 }
10890
10891 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_ACCOUNT, &attributes->inp_account, NULL);
10892 if (error) {
10893 NECPLOG0(LOG_ERR, "Could not set account TLV for socket attributes");
10894 goto done;
10895 }
10896
10897 done:
10898 NECP_SOCKET_ATTRIBUTE_LOG("NECP ATTRIBUTES SOCKET - domain <%s> owner <%s> context <%s> tracker domain <%s> account <%s>",
10899 attributes->inp_domain,
10900 attributes->inp_domain_owner,
10901 attributes->inp_domain_context,
10902 attributes->inp_tracker_domain,
10903 attributes->inp_account);
10904
10905 if (necp_debug) {
10906 NECPLOG(LOG_DEBUG, "Set on socket: Domain %s, Domain owner %s, Domain context %s, Tracker domain %s, Account %s",
10907 attributes->inp_domain,
10908 attributes->inp_domain_owner,
10909 attributes->inp_domain_context,
10910 attributes->inp_tracker_domain,
10911 attributes->inp_account);
10912 }
10913
10914 if (buffer != NULL) {
10915 kfree_data(buffer, valsize);
10916 }
10917
10918 return error;
10919 }
10920
10921 errno_t
necp_get_socket_attributes(struct inp_necp_attributes * attributes,struct sockopt * sopt)10922 necp_get_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt)
10923 {
10924 int error = 0;
10925 u_int8_t *buffer = NULL;
10926 u_int8_t *cursor = NULL;
10927 size_t valsize = 0;
10928
10929 if (attributes->inp_domain != NULL) {
10930 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_domain);
10931 }
10932 if (attributes->inp_domain_owner != NULL) {
10933 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_domain_owner);
10934 }
10935 if (attributes->inp_domain_context != NULL) {
10936 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_domain_context);
10937 }
10938 if (attributes->inp_tracker_domain != NULL) {
10939 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_tracker_domain);
10940 }
10941 if (attributes->inp_account != NULL) {
10942 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_account);
10943 }
10944 if (valsize == 0) {
10945 goto done;
10946 }
10947
10948 buffer = (u_int8_t *)kalloc_data(valsize, Z_WAITOK | Z_ZERO);
10949 if (buffer == NULL) {
10950 goto done;
10951 }
10952
10953 cursor = buffer;
10954 if (attributes->inp_domain != NULL) {
10955 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN, strlen(attributes->inp_domain), attributes->inp_domain,
10956 buffer, valsize);
10957 }
10958
10959 if (attributes->inp_domain_owner != NULL) {
10960 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN_OWNER, strlen(attributes->inp_domain_owner), attributes->inp_domain_owner,
10961 buffer, valsize);
10962 }
10963
10964 if (attributes->inp_domain_context != NULL) {
10965 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT, strlen(attributes->inp_domain_context), attributes->inp_domain_context,
10966 buffer, valsize);
10967 }
10968
10969 if (attributes->inp_tracker_domain != NULL) {
10970 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_TRACKER_DOMAIN, strlen(attributes->inp_tracker_domain), attributes->inp_tracker_domain,
10971 buffer, valsize);
10972 }
10973
10974 if (attributes->inp_account != NULL) {
10975 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_ACCOUNT, strlen(attributes->inp_account), attributes->inp_account,
10976 buffer, valsize);
10977 }
10978
10979 error = sooptcopyout(sopt, buffer, valsize);
10980 if (error) {
10981 goto done;
10982 }
10983 done:
10984 if (buffer != NULL) {
10985 kfree_data(buffer, valsize);
10986 }
10987
10988 return error;
10989 }
10990
10991 int
necp_set_socket_resolver_signature(struct inpcb * inp,struct sockopt * sopt)10992 necp_set_socket_resolver_signature(struct inpcb *inp, struct sockopt *sopt)
10993 {
10994 const size_t valsize = sopt->sopt_valsize;
10995 if (valsize > NECP_CLIENT_ACTION_SIGN_MAX_TOTAL_LENGTH + NECP_CLIENT_ACTION_SIGN_TAG_LENGTH) {
10996 return EINVAL;
10997 }
10998
10999 necp_lock_socket_attributes();
11000 if (inp->inp_resolver_signature != NULL) {
11001 kfree_data(inp->inp_resolver_signature, inp->inp_resolver_signature_length);
11002 }
11003 inp->inp_resolver_signature_length = 0;
11004
11005 int error = 0;
11006 if (valsize > 0) {
11007 inp->inp_resolver_signature = kalloc_data(valsize, Z_WAITOK | Z_ZERO);
11008 if ((error = sooptcopyin(sopt, inp->inp_resolver_signature, valsize,
11009 valsize)) != 0) {
11010 // Free the signature buffer if the copyin failed
11011 kfree_data(inp->inp_resolver_signature, valsize);
11012 } else {
11013 inp->inp_resolver_signature_length = valsize;
11014 }
11015 }
11016 necp_unlock_socket_attributes();
11017
11018 return error;
11019 }
11020
11021 int
necp_get_socket_resolver_signature(struct inpcb * inp,struct sockopt * sopt)11022 necp_get_socket_resolver_signature(struct inpcb *inp, struct sockopt *sopt)
11023 {
11024 int error = 0;
11025 necp_lock_socket_attributes();
11026 if (inp->inp_resolver_signature == NULL ||
11027 inp->inp_resolver_signature_length == 0) {
11028 error = ENOENT;
11029 } else {
11030 error = sooptcopyout(sopt, inp->inp_resolver_signature,
11031 inp->inp_resolver_signature_length);
11032 }
11033 necp_unlock_socket_attributes();
11034 return error;
11035 }
11036
11037 bool
necp_socket_has_resolver_signature(struct inpcb * inp)11038 necp_socket_has_resolver_signature(struct inpcb *inp)
11039 {
11040 necp_lock_socket_attributes();
11041 bool has_signature = (inp->inp_resolver_signature != NULL && inp->inp_resolver_signature_length != 0);
11042 necp_unlock_socket_attributes();
11043 return has_signature;
11044 }
11045
11046 bool
necp_socket_resolver_signature_matches_address(struct inpcb * inp,union necp_sockaddr_union * address)11047 necp_socket_resolver_signature_matches_address(struct inpcb *inp, union necp_sockaddr_union *address)
11048 {
11049 bool matches_address = false;
11050 necp_lock_socket_attributes();
11051 if (inp->inp_resolver_signature != NULL && inp->inp_resolver_signature_length > 0 && address->sa.sa_len > 0) {
11052 struct necp_client_validatable *validatable = (struct necp_client_validatable *)inp->inp_resolver_signature;
11053 if (inp->inp_resolver_signature_length > sizeof(struct necp_client_validatable) &&
11054 validatable->signable.sign_type == NECP_CLIENT_SIGN_TYPE_SYSTEM_RESOLVER_ANSWER) {
11055 size_t data_length = inp->inp_resolver_signature_length - sizeof(struct necp_client_validatable);
11056 if (data_length >= (sizeof(struct necp_client_host_resolver_answer) - sizeof(struct necp_client_signable))) {
11057 struct necp_client_host_resolver_answer *answer_struct = (struct necp_client_host_resolver_answer *)&validatable->signable;
11058 if (data_length == (sizeof(struct necp_client_host_resolver_answer) + answer_struct->hostname_length - sizeof(struct necp_client_signable)) &&
11059 answer_struct->address_answer.sa.sa_family == address->sa.sa_family &&
11060 answer_struct->address_answer.sa.sa_len == address->sa.sa_len &&
11061 (answer_struct->address_answer.sin.sin_port == 0 ||
11062 answer_struct->address_answer.sin.sin_port == address->sin.sin_port) &&
11063 ((answer_struct->address_answer.sa.sa_family == AF_INET &&
11064 answer_struct->address_answer.sin.sin_addr.s_addr == address->sin.sin_addr.s_addr) ||
11065 (answer_struct->address_answer.sa.sa_family == AF_INET6 &&
11066 memcmp(&answer_struct->address_answer.sin6.sin6_addr, &address->sin6.sin6_addr, sizeof(struct in6_addr)) == 0))) {
11067 // Address matches
11068 const bool validated = necp_validate_resolver_answer(validatable->signable.client_id,
11069 validatable->signable.sign_type,
11070 validatable->signable.signable_data, data_length,
11071 validatable->signature.signed_tag, sizeof(validatable->signature.signed_tag));
11072 if (validated) {
11073 // Answer is validated
11074 matches_address = true;
11075 }
11076 }
11077 }
11078 }
11079 }
11080 necp_unlock_socket_attributes();
11081 return matches_address;
11082 }
11083
11084 /*
11085 * necp_set_socket_domain_attributes
11086 * Called from soconnectlock/soconnectxlock to directly set the tracker domain and owner for
11087 * a newly marked tracker socket.
11088 */
11089 errno_t
necp_set_socket_domain_attributes(struct socket * so,const char * domain,const char * domain_owner)11090 necp_set_socket_domain_attributes(struct socket *so, const char *domain, const char *domain_owner)
11091 {
11092 int error = 0;
11093 struct inpcb *inp = NULL;
11094 u_int8_t *buffer = NULL;
11095 size_t valsize = 0;
11096 char *buffer_to_free = NULL;
11097
11098 if (SOCK_DOM(so) != PF_INET && SOCK_DOM(so) != PF_INET6) {
11099 error = EINVAL;
11100 goto fail;
11101 }
11102
11103 // Set domain (required)
11104
11105 valsize = strlen(domain);
11106 if (valsize == 0 || valsize > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) {
11107 error = EINVAL;
11108 goto fail;
11109 }
11110
11111 buffer = (u_int8_t *)kalloc_data(valsize + 1, Z_WAITOK | Z_ZERO);
11112 if (buffer == NULL) {
11113 error = ENOMEM;
11114 goto fail;
11115 }
11116 bcopy(domain, buffer, valsize);
11117 buffer[valsize] = 0;
11118
11119 inp = sotoinpcb(so);
11120 // Do not overwrite a previously set domain if tracker domain is different.
11121 if (inp->inp_necp_attributes.inp_domain != NULL) {
11122 if (strlen(inp->inp_necp_attributes.inp_domain) != strlen(domain) ||
11123 strncmp(inp->inp_necp_attributes.inp_domain, domain, strlen(domain)) != 0) {
11124 buffer_to_free = inp->inp_necp_attributes.inp_tracker_domain;
11125 // Protect switching of buffer pointer
11126 necp_lock_socket_attributes();
11127 inp->inp_necp_attributes.inp_tracker_domain = (char *)buffer;
11128 necp_unlock_socket_attributes();
11129 if (buffer_to_free != NULL) {
11130 kfree_data_addr(buffer_to_free);
11131 }
11132 } else {
11133 kfree_data_addr(buffer);
11134 }
11135 } else {
11136 // Protect switching of buffer pointer
11137 necp_lock_socket_attributes();
11138 inp->inp_necp_attributes.inp_domain = (char *)buffer;
11139 necp_unlock_socket_attributes();
11140 }
11141 buffer = NULL;
11142
11143 // set domain_owner (required only for tracker)
11144 if (!(so->so_flags1 & SOF1_KNOWN_TRACKER)) {
11145 goto done;
11146 }
11147
11148 valsize = strlen(domain_owner);
11149 if (valsize == 0 || valsize > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) {
11150 error = EINVAL;
11151 goto fail;
11152 }
11153
11154 buffer = (u_int8_t *)kalloc_data(valsize + 1, Z_WAITOK | Z_ZERO);
11155 if (buffer == NULL) {
11156 error = ENOMEM;
11157 goto fail;
11158 }
11159 bcopy(domain_owner, buffer, valsize);
11160 buffer[valsize] = 0;
11161
11162 inp = sotoinpcb(so);
11163
11164 buffer_to_free = inp->inp_necp_attributes.inp_domain_owner;
11165 // Protect switching of buffer pointer
11166 necp_lock_socket_attributes();
11167 inp->inp_necp_attributes.inp_domain_owner = (char *)buffer;
11168 necp_unlock_socket_attributes();
11169 buffer = NULL;
11170
11171 if (buffer_to_free != NULL) {
11172 kfree_data_addr(buffer_to_free);
11173 }
11174
11175 done:
11176 NECP_SOCKET_PARAMS_LOG(so, "NECP ATTRIBUTES SOCKET - domain <%s> owner <%s> context <%s> tracker domain <%s> account <%s> "
11177 "<so flags - is_tracker %X non-app-initiated %X app-approved-domain %X",
11178 inp->inp_necp_attributes.inp_domain,
11179 inp->inp_necp_attributes.inp_domain_owner,
11180 inp->inp_necp_attributes.inp_domain_context,
11181 inp->inp_necp_attributes.inp_tracker_domain,
11182 inp->inp_necp_attributes.inp_account,
11183 so->so_flags1 & SOF1_KNOWN_TRACKER,
11184 so->so_flags1 & SOF1_TRACKER_NON_APP_INITIATED,
11185 so->so_flags1 & SOF1_APPROVED_APP_DOMAIN);
11186
11187 if (necp_debug) {
11188 NECPLOG(LOG_DEBUG, "Set on socket: Domain <%s> Domain owner <%s> Domain context <%s> Tracker domain <%s> Account <%s> ",
11189 inp->inp_necp_attributes.inp_domain,
11190 inp->inp_necp_attributes.inp_domain_owner,
11191 inp->inp_necp_attributes.inp_domain_context,
11192 inp->inp_necp_attributes.inp_tracker_domain,
11193 inp->inp_necp_attributes.inp_account);
11194 }
11195 fail:
11196 if (buffer != NULL) {
11197 kfree_data(buffer, valsize + 1);
11198 }
11199 return error;
11200 }
11201
11202 void *
necp_create_nexus_assign_message(uuid_t nexus_instance,nexus_port_t nexus_port,void * key,uint32_t key_length,struct necp_client_endpoint * local_endpoint,struct necp_client_endpoint * remote_endpoint,struct ether_addr * local_ether_addr,u_int32_t flow_adv_index,void * flow_stats,size_t * message_length)11203 necp_create_nexus_assign_message(uuid_t nexus_instance, nexus_port_t nexus_port, void *key, uint32_t key_length,
11204 struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint, struct ether_addr *local_ether_addr,
11205 u_int32_t flow_adv_index, void *flow_stats, size_t *message_length)
11206 {
11207 u_int8_t *buffer = NULL;
11208 u_int8_t *cursor = NULL;
11209 size_t valsize = 0;
11210 bool has_nexus_assignment = FALSE;
11211
11212 if (!uuid_is_null(nexus_instance)) {
11213 has_nexus_assignment = TRUE;
11214 valsize += sizeof(struct necp_tlv_header) + sizeof(uuid_t);
11215 valsize += sizeof(struct necp_tlv_header) + sizeof(nexus_port_t);
11216 }
11217 if (flow_adv_index != NECP_FLOWADV_IDX_INVALID) {
11218 valsize += sizeof(struct necp_tlv_header) + sizeof(u_int32_t);
11219 }
11220 if (key != NULL && key_length > 0) {
11221 valsize += sizeof(struct necp_tlv_header) + key_length;
11222 }
11223 if (local_endpoint != NULL) {
11224 valsize += sizeof(struct necp_tlv_header) + sizeof(struct necp_client_endpoint);
11225 }
11226 if (remote_endpoint != NULL) {
11227 valsize += sizeof(struct necp_tlv_header) + sizeof(struct necp_client_endpoint);
11228 }
11229 if (local_ether_addr != NULL) {
11230 valsize += sizeof(struct necp_tlv_header) + sizeof(struct ether_addr);
11231 }
11232 if (flow_stats != NULL) {
11233 valsize += sizeof(struct necp_tlv_header) + sizeof(void *);
11234 }
11235 if (valsize == 0) {
11236 return NULL;
11237 }
11238
11239 buffer = kalloc_data(valsize, Z_WAITOK | Z_ZERO);
11240 if (buffer == NULL) {
11241 return NULL;
11242 }
11243
11244 cursor = buffer;
11245 if (has_nexus_assignment) {
11246 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_INSTANCE, sizeof(uuid_t), nexus_instance, buffer, valsize);
11247 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_PORT, sizeof(nexus_port_t), &nexus_port, buffer, valsize);
11248 }
11249 if (flow_adv_index != NECP_FLOWADV_IDX_INVALID) {
11250 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_PORT_FLOW_INDEX, sizeof(u_int32_t), &flow_adv_index, buffer, valsize);
11251 }
11252 if (key != NULL && key_length > 0) {
11253 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_PARAMETER_NEXUS_KEY, key_length, key, buffer, valsize);
11254 }
11255 if (local_endpoint != NULL) {
11256 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_LOCAL_ENDPOINT, sizeof(struct necp_client_endpoint), local_endpoint, buffer, valsize);
11257 }
11258 if (remote_endpoint != NULL) {
11259 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_REMOTE_ENDPOINT, sizeof(struct necp_client_endpoint), remote_endpoint, buffer, valsize);
11260 }
11261 if (local_ether_addr != NULL) {
11262 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_LOCAL_ETHER_ADDR, sizeof(struct ether_addr), local_ether_addr, buffer, valsize);
11263 }
11264 if (flow_stats != NULL) {
11265 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_FLOW_STATS, sizeof(void *), &flow_stats, buffer, valsize);
11266 }
11267
11268 *message_length = valsize;
11269
11270 return buffer;
11271 }
11272
11273 void
necp_inpcb_remove_cb(struct inpcb * inp)11274 necp_inpcb_remove_cb(struct inpcb *inp)
11275 {
11276 if (!uuid_is_null(inp->necp_client_uuid)) {
11277 necp_client_unregister_socket_flow(inp->necp_client_uuid, inp);
11278 uuid_clear(inp->necp_client_uuid);
11279 }
11280 }
11281
11282 void
necp_inpcb_dispose(struct inpcb * inp)11283 necp_inpcb_dispose(struct inpcb *inp)
11284 {
11285 necp_inpcb_remove_cb(inp); // Clear out socket registrations if not yet done
11286 if (inp->inp_necp_attributes.inp_domain != NULL) {
11287 kfree_data_addr(inp->inp_necp_attributes.inp_domain);
11288 inp->inp_necp_attributes.inp_domain = NULL;
11289 }
11290 if (inp->inp_necp_attributes.inp_account != NULL) {
11291 kfree_data_addr(inp->inp_necp_attributes.inp_account);
11292 inp->inp_necp_attributes.inp_account = NULL;
11293 }
11294 if (inp->inp_necp_attributes.inp_domain_owner != NULL) {
11295 kfree_data_addr(inp->inp_necp_attributes.inp_domain_owner);
11296 inp->inp_necp_attributes.inp_domain_owner = NULL;
11297 }
11298 if (inp->inp_necp_attributes.inp_domain_context != NULL) {
11299 kfree_data_addr(inp->inp_necp_attributes.inp_domain_context);
11300 inp->inp_necp_attributes.inp_domain_context = NULL;
11301 }
11302 if (inp->inp_necp_attributes.inp_tracker_domain != NULL) {
11303 kfree_data_addr(inp->inp_necp_attributes.inp_tracker_domain);
11304 inp->inp_necp_attributes.inp_tracker_domain = NULL;
11305 }
11306 if (inp->inp_resolver_signature != NULL) {
11307 kfree_data(inp->inp_resolver_signature, inp->inp_resolver_signature_length);
11308 }
11309 inp->inp_resolver_signature_length = 0;
11310 }
11311
11312 void
necp_mppcb_dispose(struct mppcb * mpp)11313 necp_mppcb_dispose(struct mppcb *mpp)
11314 {
11315 if (!uuid_is_null(mpp->necp_client_uuid)) {
11316 necp_client_unregister_multipath_cb(mpp->necp_client_uuid, mpp);
11317 uuid_clear(mpp->necp_client_uuid);
11318 }
11319
11320 if (mpp->inp_necp_attributes.inp_domain != NULL) {
11321 kfree_data_addr(mpp->inp_necp_attributes.inp_domain);
11322 mpp->inp_necp_attributes.inp_domain = NULL;
11323 }
11324 if (mpp->inp_necp_attributes.inp_account != NULL) {
11325 kfree_data_addr(mpp->inp_necp_attributes.inp_account);
11326 mpp->inp_necp_attributes.inp_account = NULL;
11327 }
11328 if (mpp->inp_necp_attributes.inp_domain_owner != NULL) {
11329 kfree_data_addr(mpp->inp_necp_attributes.inp_domain_owner);
11330 mpp->inp_necp_attributes.inp_domain_owner = NULL;
11331 }
11332 if (mpp->inp_necp_attributes.inp_tracker_domain != NULL) {
11333 kfree_data_addr(mpp->inp_necp_attributes.inp_tracker_domain);
11334 mpp->inp_necp_attributes.inp_tracker_domain = NULL;
11335 }
11336 }
11337
11338 /// Module init
11339
11340 void
necp_client_init(void)11341 necp_client_init(void)
11342 {
11343 necp_client_update_tcall = thread_call_allocate_with_options(necp_update_all_clients_callout, NULL,
11344 THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
11345 VERIFY(necp_client_update_tcall != NULL);
11346 #if SKYWALK
11347
11348 necp_client_collect_stats_tcall = thread_call_allocate_with_options(necp_collect_stats_client_callout, NULL,
11349 THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
11350 VERIFY(necp_client_collect_stats_tcall != NULL);
11351
11352 necp_close_empty_arenas_tcall = thread_call_allocate_with_options(necp_close_empty_arenas_callout, NULL,
11353 THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
11354 VERIFY(necp_close_empty_arenas_tcall != NULL);
11355 #endif /* SKYWALK */
11356
11357 LIST_INIT(&necp_fd_list);
11358 LIST_INIT(&necp_fd_observer_list);
11359 LIST_INIT(&necp_collect_stats_flow_list);
11360
11361 RB_INIT(&necp_client_global_tree);
11362 RB_INIT(&necp_client_flow_global_tree);
11363 }
11364
11365 #if SKYWALK
11366 pid_t
necp_client_get_proc_pid_from_arena_info(struct skmem_arena_mmap_info * arena_info)11367 necp_client_get_proc_pid_from_arena_info(struct skmem_arena_mmap_info *arena_info)
11368 {
11369 ASSERT((arena_info->ami_arena->ar_type == SKMEM_ARENA_TYPE_NECP) || (arena_info->ami_arena->ar_type == SKMEM_ARENA_TYPE_SYSTEM));
11370
11371 if (arena_info->ami_arena->ar_type == SKMEM_ARENA_TYPE_NECP) {
11372 struct necp_arena_info *nai = container_of(arena_info, struct necp_arena_info, nai_mmap);
11373 return nai->nai_proc_pid;
11374 } else {
11375 struct necp_fd_data *fd_data = container_of(arena_info, struct necp_fd_data, sysctl_mmap);
11376 return fd_data->proc_pid;
11377 }
11378 }
11379 #endif /* !SKYWALK */
11380