1 /*
2 * Copyright (c) 2015-2021 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #include <string.h>
30
31 #include <kern/thread_call.h>
32 #include <kern/zalloc.h>
33
34 #include <net/if.h>
35 #include <net/if_var.h>
36 #include <net/net_api_stats.h>
37 #include <net/necp.h>
38 #include <net/network_agent.h>
39 #include <net/ntstat.h>
40
41 #include <netinet/in_pcb.h>
42 #include <netinet/in_var.h>
43 #include <netinet/ip.h>
44 #include <netinet/ip6.h>
45 #include <netinet/mp_pcb.h>
46 #include <netinet/tcp_cc.h>
47 #include <netinet/tcp_fsm.h>
48 #include <netinet/tcp_cache.h>
49 #include <netinet6/in6_var.h>
50
51 #include <sys/domain.h>
52 #include <sys/file_internal.h>
53 #include <sys/kauth.h>
54 #include <sys/kernel.h>
55 #include <sys/malloc.h>
56 #include <sys/poll.h>
57 #include <sys/priv.h>
58 #include <sys/protosw.h>
59 #include <sys/queue.h>
60 #include <sys/socket.h>
61 #include <sys/socketvar.h>
62 #include <sys/sysproto.h>
63 #include <sys/systm.h>
64 #include <sys/types.h>
65 #include <sys/codesign.h>
66 #include <libkern/section_keywords.h>
67
68 #include <os/refcnt.h>
69
70 #if SKYWALK
71 #include <skywalk/os_skywalk_private.h>
72 #include <skywalk/nexus/flowswitch/flow/flow_var.h>
73 #endif /* SKYWALK */
74
75 #if CONFIG_MACF
76 #include <security/mac_framework.h>
77 #endif
78
79 /*
80 * NECP Client Architecture
81 * ------------------------------------------------
82 * See <net/necp.c> for a discussion on NECP database architecture.
83 *
84 * Each client of NECP provides a set of parameters for a connection or network state
85 * evaluation, on which NECP policy evaluation is run. This produces a policy result
86 * which can be accessed by the originating process, along with events for when policies
87 * results have changed.
88 *
89 * ------------------------------------------------
90 * NECP Client FD
91 * ------------------------------------------------
92 * A process opens an NECP file descriptor using necp_open(). This is a very simple
93 * file descriptor, upon which the process may do the following operations:
94 * - necp_client_action(...), to add/remove/query clients
95 * - kqueue, to watch for readable events
96 * - close(), to close the client session and release all clients
97 *
98 * Client objects are allocated structures that hang off of the file descriptor. Each
99 * client contains:
100 * - Client ID, a UUID that references the client across the system
101 * - Parameters, a buffer of TLVs that describe the client's connection parameters,
102 * such as the remote and local endpoints, interface requirements, etc.
103 * - Result, a buffer of TLVs containing the current policy evaluation for the client.
104 * This result will be updated whenever a network change occurs that impacts the
105 * policy result for that client.
106 *
107 * +--------------+
108 * | NECP fd |
109 * +--------------+
110 * ||
111 * ==================================
112 * || || ||
113 * +--------------+ +--------------+ +--------------+
114 * | Client ID | | Client ID | | Client ID |
115 * | ---- | | ---- | | ---- |
116 * | Parameters | | Parameters | | Parameters |
117 * | ---- | | ---- | | ---- |
118 * | Result | | Result | | Result |
119 * +--------------+ +--------------+ +--------------+
120 *
121 * ------------------------------------------------
122 * Client Actions
123 * ------------------------------------------------
124 * - Add. Input parameters as a buffer of TLVs, and output a client ID. Allocates a
125 * new client structure on the file descriptor.
126 * - Remove. Input a client ID. Removes a client structure from the file descriptor.
127 * - Copy Parameters. Input a client ID, and output parameter TLVs.
128 * - Copy Result. Input a client ID, and output result TLVs. Alternatively, input empty
129 * client ID and get next unread client result.
130 * - Copy List. List all client IDs.
131 *
132 * ------------------------------------------------
133 * Client Policy Evaluation
134 * ------------------------------------------------
135 * Policies are evaluated for clients upon client creation, and upon update events,
136 * which are network/agent/policy changes coalesced by a timer.
137 *
138 * The policy evaluation goes through the following steps:
139 * 1. Parse client parameters.
140 * 2. Select a scoped interface if applicable. This involves using require/prohibit
141 * parameters, along with the local address, to select the most appropriate interface
142 * if not explicitly set by the client parameters.
143 * 3. Run NECP application-level policy evalution
144 * 4. Set policy result into client result buffer.
145 *
146 * ------------------------------------------------
147 * Client Observers
148 * ------------------------------------------------
149 * If necp_open() is called with the NECP_OPEN_FLAG_OBSERVER flag, and the process
150 * passes the necessary privilege check, the fd is allowed to use necp_client_action()
151 * to copy client state attached to the file descriptors of other processes, and to
152 * list all client IDs on the system.
153 */
154
155 extern u_int32_t necp_debug;
156
157 static int necpop_select(struct fileproc *, int, void *, vfs_context_t);
158 static int necpop_close(struct fileglob *, vfs_context_t);
159 static int necpop_kqfilter(struct fileproc *, struct knote *, struct kevent_qos_s *);
160
161 // Timer functions
162 static int necp_timeout_microseconds = 1000 * 100; // 100ms
163 static int necp_timeout_leeway_microseconds = 1000 * 500; // 500ms
164 #if SKYWALK
165 static int necp_collect_stats_timeout_microseconds = 1000 * 1000 * 1; // 1s
166 static int necp_collect_stats_timeout_leeway_microseconds = 1000 * 500; // 500ms
167 static int necp_close_arenas_timeout_microseconds = 1000 * 1000 * 10; // 10s
168 static int necp_close_arenas_timeout_leeway_microseconds = 1000 * 1000 * 1; // 1s
169 #endif /* SKYWALK */
170
171 static int necp_client_fd_count = 0;
172 static int necp_observer_fd_count = 0;
173 static int necp_client_count = 0;
174 static int necp_socket_flow_count = 0;
175 static int necp_if_flow_count = 0;
176 static int necp_observer_message_limit = 256;
177
178 /*
179 * NECP client tracing control -
180 *
181 * necp_client_tracing_level : 1 for client trace, 2 for flow trace, 3 for parameter details
182 * necp_client_tracing_pid : match client with pid
183 */
184 static int necp_client_tracing_level = 0;
185 static int necp_client_tracing_pid = 0;
186
187 #define NECP_CLIENT_TRACE_LEVEL_CLIENT 1
188 #define NECP_CLIENT_TRACE_LEVEL_FLOW 2
189 #define NECP_CLIENT_TRACE_LEVEL_PARAMS 3
190
191 #define NECP_CLIENT_TRACE_PID_MATCHED(pid) \
192 (pid == necp_client_tracing_pid)
193
194 #define NECP_ENABLE_CLIENT_TRACE(level) \
195 ((necp_client_tracing_level >= level && \
196 (!necp_client_tracing_pid || NECP_CLIENT_TRACE_PID_MATCHED(client->proc_pid))) ? necp_client_tracing_level : 0)
197
198 #define NECP_CLIENT_LOG(client, fmt, ...) \
199 if (client && NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_CLIENT)) { \
200 uuid_string_t client_uuid_str = { }; \
201 uuid_unparse_lower(client->client_id, client_uuid_str); \
202 NECPLOG(LOG_NOTICE, "NECP_CLIENT_LOG <pid %d %s>: " fmt "\n", client ? client->proc_pid : 0, client_uuid_str, ##__VA_ARGS__); \
203 }
204
205 #define NECP_CLIENT_FLOW_LOG(client, flow, fmt, ...) \
206 if (client && flow && NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_FLOW)) { \
207 uuid_string_t client_uuid_str = { }; \
208 uuid_unparse_lower(client->client_id, client_uuid_str); \
209 uuid_string_t flow_uuid_str = { }; \
210 uuid_unparse_lower(flow->registration_id, flow_uuid_str); \
211 NECPLOG(LOG_NOTICE, "NECP CLIENT FLOW TRACE <pid %d %s> <flow %s>: " fmt "\n", client ? client->proc_pid : 0, client_uuid_str, flow_uuid_str, ##__VA_ARGS__); \
212 }
213
214 #define NECP_CLIENT_PARAMS_LOG(client, fmt, ...) \
215 if (client && NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) { \
216 uuid_string_t client_uuid_str = { }; \
217 uuid_unparse_lower(client->client_id, client_uuid_str); \
218 NECPLOG(LOG_NOTICE, "NECP_CLIENT_PARAMS_LOG <pid %d %s>: " fmt "\n", client ? client->proc_pid : 0, client_uuid_str, ##__VA_ARGS__); \
219 }
220
221 #define NECP_SOCKET_PID(so) \
222 ((so->so_flags & SOF_DELEGATED) ? so->e_pid : so->last_pid)
223
224 #define NECP_ENABLE_SOCKET_TRACE(level) \
225 ((necp_client_tracing_level >= level && \
226 (!necp_client_tracing_pid || NECP_CLIENT_TRACE_PID_MATCHED(NECP_SOCKET_PID(so)))) ? necp_client_tracing_level : 0)
227
228 #define NECP_SOCKET_PARAMS_LOG(so, fmt, ...) \
229 if (so && NECP_ENABLE_SOCKET_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) { \
230 NECPLOG(LOG_NOTICE, "NECP_SOCKET_PARAMS_LOG <pid %d>: " fmt "\n", NECP_SOCKET_PID(so), ##__VA_ARGS__); \
231 }
232
233 #define NECP_SOCKET_ATTRIBUTE_LOG(fmt, ...) \
234 if (necp_client_tracing_level >= NECP_CLIENT_TRACE_LEVEL_PARAMS) { \
235 NECPLOG(LOG_NOTICE, "NECP_SOCKET_ATTRIBUTE_LOG: " fmt "\n", ##__VA_ARGS__); \
236 }
237
238 #define NECP_CLIENT_TRACKER_LOG(pid, fmt, ...) \
239 if (pid) { \
240 NECPLOG(LOG_NOTICE, "NECP_CLIENT_TRACKER_LOG <pid %d>: " fmt "\n", pid, ##__VA_ARGS__); \
241 }
242
243 #if SKYWALK
244 static int necp_arena_count = 0;
245 static int necp_sysctl_arena_count = 0;
246 static int necp_nexus_flow_count = 0;
247
248 /* userspace stats sanity check range, same unit as TCP (see TCP_RTT_SCALE) */
249 static uint32_t necp_client_stats_rtt_floor = 1; // 32us
250 static uint32_t necp_client_stats_rtt_ceiling = 1920000; // 60s
251 const static struct sk_stats_flow ntstat_sk_stats_zero;
252 #endif /* SKYWALK */
253
254 /*
255 * Global lock to protect socket inp_necp_attributes across updates.
256 * NECP updating these attributes and clients accessing these attributes
257 * must take this lock.
258 */
259 static LCK_GRP_DECLARE(necp_socket_attr_lock_grp, "necpSocketAttrGroup");
260 LCK_MTX_DECLARE(necp_socket_attr_lock, &necp_socket_attr_lock_grp);
261
262 os_refgrp_decl(static, necp_client_refgrp, "NECPClientRefGroup", NULL);
263
264 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_FD_COUNT, client_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_fd_count, 0, "");
265 SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_FD_COUNT, observer_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_observer_fd_count, 0, "");
266 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_COUNT, client_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_count, 0, "");
267 SYSCTL_INT(_net_necp, NECPCTL_SOCKET_FLOW_COUNT, socket_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_socket_flow_count, 0, "");
268 SYSCTL_INT(_net_necp, NECPCTL_IF_FLOW_COUNT, if_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_if_flow_count, 0, "");
269 SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_MESSAGE_LIMIT, observer_message_limit, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_observer_message_limit, 256, "");
270 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_TRACING_LEVEL, necp_client_tracing_level, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_client_tracing_level, 0, "");
271 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_TRACING_PID, necp_client_tracing_pid, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_client_tracing_pid, 0, "");
272
273 #if SKYWALK
274 SYSCTL_INT(_net_necp, NECPCTL_ARENA_COUNT, arena_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_arena_count, 0, "");
275 SYSCTL_INT(_net_necp, NECPCTL_SYSCTL_ARENA_COUNT, sysctl_arena_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_sysctl_arena_count, 0, "");
276 SYSCTL_INT(_net_necp, NECPCTL_NEXUS_FLOW_COUNT, nexus_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_nexus_flow_count, 0, "");
277 #if (DEVELOPMENT || DEBUG)
278 SYSCTL_UINT(_net_necp, OID_AUTO, collect_stats_interval_us, CTLFLAG_RW | CTLFLAG_LOCKED, &necp_collect_stats_timeout_microseconds, 0, "");
279 SYSCTL_UINT(_net_necp, OID_AUTO, necp_client_stats_rtt_floor, CTLFLAG_RW | CTLFLAG_LOCKED, &necp_client_stats_rtt_floor, 0, "");
280 SYSCTL_UINT(_net_necp, OID_AUTO, necp_client_stats_rtt_ceiling, CTLFLAG_RW | CTLFLAG_LOCKED, &necp_client_stats_rtt_ceiling, 0, "");
281 #endif /* (DEVELOPMENT || DEBUG) */
282 #endif /* SKYWALK */
283
284 #define NECP_MAX_CLIENT_LIST_SIZE 1024 * 1024 // 1MB
285 #define NECP_MAX_AGENT_ACTION_SIZE 256
286
287 extern int tvtohz(struct timeval *);
288 extern unsigned int get_maxmtu(struct rtentry *);
289
290 // Parsed parameters
291 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR 0x00001
292 #define NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR 0x00002
293 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF 0x00004
294 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF 0x00008
295 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE 0x00010
296 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE 0x00020
297 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT 0x00040
298 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT 0x00080
299 #define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT 0x00100
300 #define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT 0x00200
301 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE 0x00400
302 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE 0x00800
303 #define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE 0x01000
304 #define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE 0x02000
305 #define NECP_PARSED_PARAMETERS_FIELD_FLAGS 0x04000
306 #define NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL 0x08000
307 #define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID 0x10000
308 #define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID 0x20000
309 #define NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS 0x40000
310 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT 0x80000
311 #define NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID 0x100000
312 #define NECP_PARSED_PARAMETERS_FIELD_ETHERTYPE 0x200000
313 #define NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL 0x400000
314 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE 0x800000
315 #define NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER 0x1000000
316 #define NECP_PARSED_PARAMETERS_FIELD_PARENT_UUID 0x2000000
317
318
319 #define NECP_MAX_INTERFACE_PARAMETERS 16
320 #define NECP_MAX_AGENT_PARAMETERS 4
321 struct necp_client_parsed_parameters {
322 u_int32_t valid_fields;
323 u_int32_t flags;
324 u_int64_t delegated_upid;
325 union necp_sockaddr_union local_addr;
326 union necp_sockaddr_union remote_addr;
327 u_int32_t required_interface_index;
328 char prohibited_interfaces[NECP_MAX_INTERFACE_PARAMETERS][IFXNAMSIZ];
329 u_int8_t required_interface_type;
330 u_int8_t local_address_preference;
331 u_int8_t prohibited_interface_types[NECP_MAX_INTERFACE_PARAMETERS];
332 struct necp_client_parameter_netagent_type required_netagent_types[NECP_MAX_AGENT_PARAMETERS];
333 struct necp_client_parameter_netagent_type prohibited_netagent_types[NECP_MAX_AGENT_PARAMETERS];
334 struct necp_client_parameter_netagent_type preferred_netagent_types[NECP_MAX_AGENT_PARAMETERS];
335 struct necp_client_parameter_netagent_type avoided_netagent_types[NECP_MAX_AGENT_PARAMETERS];
336 uuid_t required_netagents[NECP_MAX_AGENT_PARAMETERS];
337 uuid_t prohibited_netagents[NECP_MAX_AGENT_PARAMETERS];
338 uuid_t preferred_netagents[NECP_MAX_AGENT_PARAMETERS];
339 uuid_t avoided_netagents[NECP_MAX_AGENT_PARAMETERS];
340 u_int8_t ip_protocol;
341 u_int8_t transport_protocol;
342 u_int16_t ethertype;
343 pid_t effective_pid;
344 uuid_t effective_uuid;
345 uuid_t parent_uuid;
346 u_int32_t traffic_class;
347 };
348
349 static bool
350 necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters,
351 u_int *return_ifindex, bool *validate_agents);
352
353 static bool
354 necp_ifnet_matches_local_address(struct ifnet *ifp, struct sockaddr *sa);
355
356 static bool
357 necp_ifnet_matches_parameters(struct ifnet *ifp,
358 struct necp_client_parsed_parameters *parsed_parameters,
359 u_int32_t override_flags,
360 u_int32_t *preferred_count,
361 bool secondary_interface,
362 bool require_scoped_field);
363
364 static const struct fileops necp_fd_ops = {
365 .fo_type = DTYPE_NETPOLICY,
366 .fo_read = fo_no_read,
367 .fo_write = fo_no_write,
368 .fo_ioctl = fo_no_ioctl,
369 .fo_select = necpop_select,
370 .fo_close = necpop_close,
371 .fo_drain = fo_no_drain,
372 .fo_kqfilter = necpop_kqfilter,
373 };
374
375 struct necp_client_assertion {
376 LIST_ENTRY(necp_client_assertion) assertion_chain;
377 uuid_t asserted_netagent;
378 };
379
380 struct necp_client_flow_header {
381 struct necp_tlv_header outer_header;
382 struct necp_tlv_header flow_id_tlv_header;
383 uuid_t flow_id;
384 struct necp_tlv_header flags_tlv_header;
385 u_int32_t flags_value;
386 struct necp_tlv_header interface_tlv_header;
387 struct necp_client_result_interface interface_value;
388 } __attribute__((__packed__));
389
390 struct necp_client_flow_protoctl_event_header {
391 struct necp_tlv_header protoctl_tlv_header;
392 struct necp_client_flow_protoctl_event protoctl_event;
393 } __attribute__((__packed__));
394
395 struct necp_client_nexus_flow_header {
396 struct necp_client_flow_header flow_header;
397 struct necp_tlv_header agent_tlv_header;
398 struct necp_client_result_netagent agent_value;
399 struct necp_tlv_header tfo_cookie_tlv_header;
400 u_int8_t tfo_cookie_value[NECP_TFO_COOKIE_LEN_MAX];
401 } __attribute__((__packed__));
402
403 #if SKYWALK
404 struct necp_arena_info;
405 #endif
406
407 struct necp_client_flow {
408 LIST_ENTRY(necp_client_flow) flow_chain;
409 unsigned invalid : 1;
410 unsigned nexus : 1; // If true, flow is a nexus; if false, flow is attached to socket
411 unsigned socket : 1;
412 unsigned viable : 1;
413 unsigned assigned : 1;
414 unsigned has_protoctl_event : 1;
415 unsigned check_tcp_heuristics : 1;
416 unsigned _reserved : 1;
417 union {
418 uuid_t nexus_agent;
419 struct {
420 void *socket_handle;
421 necp_client_flow_cb cb;
422 };
423 } u;
424 uint32_t interface_index;
425 u_short delegated_interface_index;
426 uint16_t interface_flags;
427 uint32_t necp_flow_flags;
428 struct necp_client_flow_protoctl_event protoctl_event;
429 union necp_sockaddr_union local_addr;
430 union necp_sockaddr_union remote_addr;
431
432 size_t assigned_results_length;
433 u_int8_t *assigned_results;
434 };
435
436 struct necp_client_flow_registration {
437 RB_ENTRY(necp_client_flow_registration) fd_link;
438 RB_ENTRY(necp_client_flow_registration) global_link;
439 RB_ENTRY(necp_client_flow_registration) client_link;
440 LIST_ENTRY(necp_client_flow_registration) collect_stats_chain;
441 uuid_t registration_id;
442 u_int32_t flags;
443 unsigned flow_result_read : 1;
444 unsigned defunct : 1;
445 void *interface_handle;
446 necp_client_flow_cb interface_cb;
447 struct necp_client *client;
448 LIST_HEAD(_necp_registration_flow_list, necp_client_flow) flow_list;
449 #if SKYWALK
450 struct necp_arena_info *stats_arena; /* arena where the stats objects came from */
451 void * kstats_kaddr; /* kernel snapshot of untrusted userspace stats, for calculating delta */
452 mach_vm_address_t ustats_uaddr; /* userspace stats (untrusted) */
453 nstat_userland_context stats_handler_context;
454 struct flow_stats *nexus_stats; /* shared stats objects between necp_client and skywalk */
455 #endif /* !SKYWALK */
456 u_int64_t last_interface_details __attribute__((aligned(sizeof(u_int64_t))));
457 };
458
459 static int necp_client_flow_id_cmp(struct necp_client_flow_registration *flow0, struct necp_client_flow_registration *flow1);
460
461 RB_HEAD(_necp_client_flow_tree, necp_client_flow_registration);
462 RB_PROTOTYPE_PREV(_necp_client_flow_tree, necp_client_flow_registration, client_link, necp_client_flow_id_cmp);
463 RB_GENERATE_PREV(_necp_client_flow_tree, necp_client_flow_registration, client_link, necp_client_flow_id_cmp);
464
465 #define NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT 4
466 #define NECP_CLIENT_MAX_INTERFACE_OPTIONS 16
467
468 #define NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT (NECP_CLIENT_MAX_INTERFACE_OPTIONS - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT)
469
470 struct necp_client {
471 RB_ENTRY(necp_client) link;
472 RB_ENTRY(necp_client) global_link;
473
474 decl_lck_mtx_data(, lock);
475 decl_lck_mtx_data(, route_lock);
476 os_refcnt_t reference_count;
477
478 uuid_t client_id;
479 unsigned result_read : 1;
480 unsigned group_members_read : 1;
481 unsigned allow_multiple_flows : 1;
482 unsigned legacy_client_is_flow : 1;
483
484 unsigned platform_binary : 1;
485
486 size_t result_length;
487 u_int8_t result[NECP_BASE_CLIENT_RESULT_SIZE];
488
489 necp_policy_id policy_id;
490
491 u_int8_t ip_protocol;
492 int proc_pid;
493
494 u_int64_t delegated_upid;
495
496 struct _necp_client_flow_tree flow_registrations;
497 LIST_HEAD(_necp_client_assertion_list, necp_client_assertion) assertion_list;
498
499 size_t assigned_group_members_length;
500 u_int8_t *assigned_group_members;
501
502 struct rtentry *current_route;
503
504 struct necp_client_interface_option interface_options[NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
505 struct necp_client_interface_option *extra_interface_options;
506 u_int8_t interface_option_count; // Number in interface_options + extra_interface_options
507
508 struct necp_client_result_netagent failed_trigger_agent;
509
510 void *agent_handle;
511
512 uuid_t override_euuid;
513
514 #if SKYWALK
515 netns_token port_reservation;
516 nstat_context nstat_context;
517 uuid_t latest_flow_registration_id;
518 struct necp_client *original_parameters_source;
519 #endif /* !SKYWALK */
520
521 size_t parameters_length;
522 u_int8_t *parameters;
523 };
524
525 #define NECP_CLIENT_LOCK(_c) lck_mtx_lock(&_c->lock)
526 #define NECP_CLIENT_UNLOCK(_c) lck_mtx_unlock(&_c->lock)
527 #define NECP_CLIENT_ASSERT_LOCKED(_c) LCK_MTX_ASSERT(&_c->lock, LCK_MTX_ASSERT_OWNED)
528 #define NECP_CLIENT_ASSERT_UNLOCKED(_c) LCK_MTX_ASSERT(&_c->lock, LCK_MTX_ASSERT_NOTOWNED)
529
530 #define NECP_CLIENT_ROUTE_LOCK(_c) lck_mtx_lock(&_c->route_lock)
531 #define NECP_CLIENT_ROUTE_UNLOCK(_c) lck_mtx_unlock(&_c->route_lock)
532
533 static void necp_client_retain_locked(struct necp_client *client);
534 static void necp_client_retain(struct necp_client *client);
535
536 static bool necp_client_release_locked(struct necp_client *client);
537 static bool necp_client_release(struct necp_client *client);
538
539 static void
540 necp_client_add_assertion(struct necp_client *client, uuid_t netagent_uuid);
541
542 static bool
543 necp_client_remove_assertion(struct necp_client *client, uuid_t netagent_uuid);
544
545 LIST_HEAD(_necp_flow_registration_list, necp_client_flow_registration);
546 static struct _necp_flow_registration_list necp_collect_stats_flow_list;
547
548 struct necp_flow_defunct {
549 LIST_ENTRY(necp_flow_defunct) chain;
550
551 uuid_t flow_id;
552 uuid_t nexus_agent;
553 void *agent_handle;
554 int proc_pid;
555 u_int32_t flags;
556 struct necp_client_agent_parameters close_parameters;
557 bool has_close_parameters;
558 };
559
560 LIST_HEAD(_necp_flow_defunct_list, necp_flow_defunct);
561
562 static int necp_client_id_cmp(struct necp_client *client0, struct necp_client *client1);
563
564 RB_HEAD(_necp_client_tree, necp_client);
565 RB_PROTOTYPE_PREV(_necp_client_tree, necp_client, link, necp_client_id_cmp);
566 RB_GENERATE_PREV(_necp_client_tree, necp_client, link, necp_client_id_cmp);
567
568 RB_HEAD(_necp_client_global_tree, necp_client);
569 RB_PROTOTYPE_PREV(_necp_client_global_tree, necp_client, global_link, necp_client_id_cmp);
570 RB_GENERATE_PREV(_necp_client_global_tree, necp_client, global_link, necp_client_id_cmp);
571
572 RB_HEAD(_necp_fd_flow_tree, necp_client_flow_registration);
573 RB_PROTOTYPE_PREV(_necp_fd_flow_tree, necp_client_flow_registration, fd_link, necp_client_flow_id_cmp);
574 RB_GENERATE_PREV(_necp_fd_flow_tree, necp_client_flow_registration, fd_link, necp_client_flow_id_cmp);
575
576 RB_HEAD(_necp_client_flow_global_tree, necp_client_flow_registration);
577 RB_PROTOTYPE_PREV(_necp_client_flow_global_tree, necp_client_flow_registration, global_link, necp_client_flow_id_cmp);
578 RB_GENERATE_PREV(_necp_client_flow_global_tree, necp_client_flow_registration, global_link, necp_client_flow_id_cmp);
579
580 static struct _necp_client_global_tree necp_client_global_tree;
581 static struct _necp_client_flow_global_tree necp_client_flow_global_tree;
582
583 struct necp_client_update {
584 TAILQ_ENTRY(necp_client_update) chain;
585
586 uuid_t client_id;
587
588 size_t update_length;
589 struct necp_client_observer_update *update;
590 };
591
592 #if SKYWALK
593 struct necp_arena_info {
594 LIST_ENTRY(necp_arena_info) nai_chain;
595 u_int32_t nai_flags;
596 pid_t nai_proc_pid;
597 struct skmem_arena *nai_arena;
598 struct skmem_arena_mmap_info nai_mmap;
599 mach_vm_offset_t nai_roff;
600 u_int32_t nai_use_count;
601 };
602 #endif /* !SKYWALK */
603
604 #define NAIF_ATTACHED 0x1 // arena is attached to list
605 #define NAIF_REDIRECT 0x2 // arena mmap has been redirected
606 #define NAIF_DEFUNCT 0x4 // arena is now defunct
607
608 struct necp_fd_data {
609 u_int8_t necp_fd_type;
610 LIST_ENTRY(necp_fd_data) chain;
611 struct _necp_client_tree clients;
612 struct _necp_fd_flow_tree flows;
613 TAILQ_HEAD(_necp_client_update_list, necp_client_update) update_list;
614 int update_count;
615 int flags;
616
617 unsigned background : 1;
618
619 int proc_pid;
620 decl_lck_mtx_data(, fd_lock);
621 struct selinfo si;
622 #if SKYWALK
623 // Arenas and their mmap info for per-process stats. Stats objects are allocated from an active arena
624 // that is not redirected/defunct. The stats_arena_active keeps track of such an arena, and it also
625 // holds a reference count on the object. Each flow allocating a stats object also holds a reference
626 // the necp_arena_info (where the object got allocated from). During defunct, we redirect the mapping
627 // of the arena such that any attempt to access (read/write) will result in getting zero-filled pages.
628 // We then go thru all of the flows for the process and free the stats objects associated with them,
629 // followed by destroying the skmem region(s) associated with the arena. The stats_arena_list keeps
630 // track of all current and defunct stats arenas; there could be more than one arena created for the
631 // process as the arena destruction happens when its reference count drops to 0.
632 struct necp_arena_info *stats_arena_active;
633 LIST_HEAD(_necp_arena_info_list, necp_arena_info) stats_arena_list;
634 u_int32_t stats_arena_gencnt;
635
636 struct skmem_arena *sysctl_arena;
637 struct skmem_arena_mmap_info sysctl_mmap;
638 mach_vm_offset_t system_sysctls_roff;
639 #endif /* !SKYWALK */
640 };
641
642 #define NECP_FD_LOCK(_f) lck_mtx_lock(&_f->fd_lock)
643 #define NECP_FD_UNLOCK(_f) lck_mtx_unlock(&_f->fd_lock)
644 #define NECP_FD_ASSERT_LOCKED(_f) LCK_MTX_ASSERT(&_f->fd_lock, LCK_MTX_ASSERT_OWNED)
645 #define NECP_FD_ASSERT_UNLOCKED(_f) LCK_MTX_ASSERT(&_f->fd_lock, LCK_MTX_ASSERT_NOTOWNED)
646
647 static LIST_HEAD(_necp_fd_list, necp_fd_data) necp_fd_list;
648 static LIST_HEAD(_necp_fd_observer_list, necp_fd_data) necp_fd_observer_list;
649
650 static ZONE_DEFINE(necp_client_fd_zone, "necp.clientfd",
651 sizeof(struct necp_fd_data), ZC_NONE);
652
653 #define NECP_FLOW_ZONE_NAME "necp.flow"
654 #define NECP_FLOW_REGISTRATION_ZONE_NAME "necp.flowregistration"
655
656 static unsigned int necp_flow_size; /* size of necp_client_flow */
657 static struct mcache *necp_flow_cache; /* cache for necp_client_flow */
658
659 static unsigned int necp_flow_registration_size; /* size of necp_client_flow_registration */
660 static struct mcache *necp_flow_registration_cache; /* cache for necp_client_flow_registration */
661
662 #if SKYWALK
663 static ZONE_DEFINE(necp_arena_info_zone, "necp.arenainfo",
664 sizeof(struct necp_arena_info), ZC_ZFREE_CLEARMEM);
665 #endif /* !SKYWALK */
666
667 static LCK_ATTR_DECLARE(necp_fd_mtx_attr, 0, 0);
668 static LCK_GRP_DECLARE(necp_fd_mtx_grp, "necp_fd");
669
670 static LCK_RW_DECLARE_ATTR(necp_fd_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
671 static LCK_RW_DECLARE_ATTR(necp_observer_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
672 static LCK_RW_DECLARE_ATTR(necp_client_tree_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
673 static LCK_RW_DECLARE_ATTR(necp_flow_tree_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
674 static LCK_RW_DECLARE_ATTR(necp_collect_stats_list_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
675
676
677 #define NECP_STATS_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_collect_stats_list_lock)
678 #define NECP_STATS_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_collect_stats_list_lock)
679 #define NECP_STATS_LIST_UNLOCK() lck_rw_done(&necp_collect_stats_list_lock)
680
681 #define NECP_CLIENT_TREE_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_client_tree_lock)
682 #define NECP_CLIENT_TREE_LOCK_SHARED() lck_rw_lock_shared(&necp_client_tree_lock)
683 #define NECP_CLIENT_TREE_UNLOCK() lck_rw_done(&necp_client_tree_lock)
684 #define NECP_CLIENT_TREE_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_client_tree_lock, LCK_RW_ASSERT_HELD)
685
686 #define NECP_FLOW_TREE_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_flow_tree_lock)
687 #define NECP_FLOW_TREE_LOCK_SHARED() lck_rw_lock_shared(&necp_flow_tree_lock)
688 #define NECP_FLOW_TREE_UNLOCK() lck_rw_done(&necp_flow_tree_lock)
689 #define NECP_FLOW_TREE_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_flow_tree_lock, LCK_RW_ASSERT_HELD)
690
691 #define NECP_FD_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_fd_lock)
692 #define NECP_FD_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_fd_lock)
693 #define NECP_FD_LIST_UNLOCK() lck_rw_done(&necp_fd_lock)
694
695 #define NECP_OBSERVER_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_observer_lock)
696 #define NECP_OBSERVER_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_observer_lock)
697 #define NECP_OBSERVER_LIST_UNLOCK() lck_rw_done(&necp_observer_lock)
698
699 // Locking Notes
700
701 // Take NECP_FD_LIST_LOCK when accessing or modifying the necp_fd_list
702 // Take NECP_CLIENT_TREE_LOCK when accessing or modifying the necp_client_global_tree
703 // Take NECP_FLOW_TREE_LOCK when accessing or modifying the necp_client_flow_global_tree
704 // Take NECP_STATS_LIST_LOCK when accessing or modifying the necp_collect_stats_flow_list
705 // Take NECP_FD_LOCK when accessing or modifying an necp_fd_data entry
706 // Take NECP_CLIENT_LOCK when accessing or modifying a single necp_client
707 // Take NECP_CLIENT_ROUTE_LOCK when accessing or modifying a client's route
708
709 // Precedence, where 1 is the first lock that must be taken
710 // 1. NECP_FD_LIST_LOCK
711 // 2. NECP_FD_LOCK (any)
712 // 3. NECP_CLIENT_TREE_LOCK
713 // 4. NECP_CLIENT_LOCK (any)
714 // 5. NECP_FLOW_TREE_LOCK
715 // 6. NECP_STATS_LIST_LOCK
716 // 7. NECP_CLIENT_ROUTE_LOCK (any)
717
718 static thread_call_t necp_client_update_tcall;
719
720 #if SKYWALK
721 static thread_call_t necp_client_collect_stats_tcall;
722 static thread_call_t necp_close_empty_arenas_tcall;
723
724 static void necp_fd_insert_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai);
725 static void necp_fd_remove_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai);
726 static struct necp_arena_info *necp_fd_mredirect_stats_arena(struct necp_fd_data *fd_data, struct proc *proc);
727
728 static void necp_arena_info_retain(struct necp_arena_info *nai);
729 static void necp_arena_info_release(struct necp_arena_info *nai);
730 static struct necp_arena_info *necp_arena_info_alloc(void);
731 static void necp_arena_info_free(struct necp_arena_info *nai);
732
733 static int necp_arena_initialize(struct necp_fd_data *fd_data, bool locked);
734 static int necp_stats_initialize(struct necp_fd_data *fd_data, struct necp_client *client,
735 struct necp_client_flow_registration *flow_registration, struct necp_stats_bufreq *bufreq);
736 static int necp_arena_create(struct necp_fd_data *fd_data, size_t obj_size, size_t obj_cnt, struct proc *p);
737 static int necp_arena_stats_obj_alloc(struct necp_fd_data *fd_data, mach_vm_offset_t *off, struct necp_arena_info **stats_arena, void **kstats_kaddr, boolean_t cansleep);
738 static void necp_arena_stats_obj_free(struct necp_fd_data *fd_data, struct necp_arena_info *stats_arena, void **kstats_kaddr, mach_vm_address_t *ustats_uaddr);
739 static void necp_stats_arenas_destroy(struct necp_fd_data *fd_data, boolean_t closing);
740
741 static int necp_sysctl_arena_initialize(struct necp_fd_data *fd_data, bool locked);
742 static void necp_sysctl_arena_destroy(struct necp_fd_data *fd_data);
743 static void *necp_arena_sysctls_obj(struct necp_fd_data *fd_data, mach_vm_offset_t *off, size_t *size);
744 #endif /* !SKYWALK */
745
746 void necp_copy_inp_domain_info(struct inpcb *, struct socket *, nstat_domain_info *);
747
748 static void
necp_lock_socket_attributes(void)749 necp_lock_socket_attributes(void)
750 {
751 lck_mtx_lock(&necp_socket_attr_lock);
752 }
753 static void
necp_unlock_socket_attributes(void)754 necp_unlock_socket_attributes(void)
755 {
756 lck_mtx_unlock(&necp_socket_attr_lock);
757 }
758
759 /// NECP file descriptor functions
760
761 static void
necp_fd_notify(struct necp_fd_data * fd_data,bool locked)762 necp_fd_notify(struct necp_fd_data *fd_data, bool locked)
763 {
764 struct selinfo *si = &fd_data->si;
765
766 if (!locked) {
767 NECP_FD_LOCK(fd_data);
768 }
769
770 selwakeup(si);
771
772 // use a non-zero hint to tell the notification from the
773 // call done in kqueue_scan() which uses 0
774 KNOTE(&si->si_note, 1); // notification
775
776 if (!locked) {
777 NECP_FD_UNLOCK(fd_data);
778 }
779 }
780
781 static inline bool
necp_client_has_unread_flows(struct necp_client * client)782 necp_client_has_unread_flows(struct necp_client *client)
783 {
784 NECP_CLIENT_ASSERT_LOCKED(client);
785 struct necp_client_flow_registration *flow_registration = NULL;
786 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
787 if (!flow_registration->flow_result_read) {
788 return true;
789 }
790 }
791 return false;
792 }
793
794 static int
necp_fd_poll(struct necp_fd_data * fd_data,int events,void * wql,struct proc * p,int is_kevent)795 necp_fd_poll(struct necp_fd_data *fd_data, int events, void *wql, struct proc *p, int is_kevent)
796 {
797 #pragma unused(wql, p, is_kevent)
798 u_int revents = 0;
799
800 u_int want_rx = events & (POLLIN | POLLRDNORM);
801 if (want_rx) {
802 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
803 // Push-mode observers are readable when they have a new update
804 if (!TAILQ_EMPTY(&fd_data->update_list)) {
805 revents |= want_rx;
806 }
807 } else {
808 // Standard fds are readable when some client is unread
809 struct necp_client *client = NULL;
810 bool has_unread_clients = FALSE;
811 RB_FOREACH(client, _necp_client_tree, &fd_data->clients) {
812 NECP_CLIENT_LOCK(client);
813 if (!client->result_read || !client->group_members_read || necp_client_has_unread_flows(client)) {
814 has_unread_clients = TRUE;
815 }
816 NECP_CLIENT_UNLOCK(client);
817 if (has_unread_clients) {
818 break;
819 }
820 }
821
822 if (has_unread_clients) {
823 revents |= want_rx;
824 }
825 }
826 }
827
828 return revents;
829 }
830
831 static inline void
necp_generate_client_id(uuid_t client_id,bool is_flow)832 necp_generate_client_id(uuid_t client_id, bool is_flow)
833 {
834 uuid_generate_random(client_id);
835
836 if (is_flow) {
837 client_id[9] |= 0x01;
838 } else {
839 client_id[9] &= ~0x01;
840 }
841 }
842
843 static inline bool
necp_client_id_is_flow(uuid_t client_id)844 necp_client_id_is_flow(uuid_t client_id)
845 {
846 return client_id[9] & 0x01;
847 }
848
849 static struct necp_client *
necp_find_client_and_lock(uuid_t client_id)850 necp_find_client_and_lock(uuid_t client_id)
851 {
852 NECP_CLIENT_TREE_ASSERT_LOCKED();
853
854 struct necp_client *client = NULL;
855
856 if (necp_client_id_is_flow(client_id)) {
857 NECP_FLOW_TREE_LOCK_SHARED();
858 struct necp_client_flow_registration find;
859 uuid_copy(find.registration_id, client_id);
860 struct necp_client_flow_registration *flow = RB_FIND(_necp_client_flow_global_tree, &necp_client_flow_global_tree, &find);
861 if (flow != NULL) {
862 client = flow->client;
863 }
864 NECP_FLOW_TREE_UNLOCK();
865 } else {
866 struct necp_client find;
867 uuid_copy(find.client_id, client_id);
868 client = RB_FIND(_necp_client_global_tree, &necp_client_global_tree, &find);
869 }
870
871 if (client != NULL) {
872 NECP_CLIENT_LOCK(client);
873 }
874
875 return client;
876 }
877
878 static struct necp_client_flow_registration *
necp_client_find_flow(struct necp_client * client,uuid_t flow_id)879 necp_client_find_flow(struct necp_client *client, uuid_t flow_id)
880 {
881 NECP_CLIENT_ASSERT_LOCKED(client);
882 struct necp_client_flow_registration *flow = NULL;
883
884 if (necp_client_id_is_flow(flow_id)) {
885 struct necp_client_flow_registration find;
886 uuid_copy(find.registration_id, flow_id);
887 flow = RB_FIND(_necp_client_flow_tree, &client->flow_registrations, &find);
888 } else {
889 flow = RB_ROOT(&client->flow_registrations);
890 }
891
892 return flow;
893 }
894
895 static struct necp_client *
necp_client_fd_find_client_unlocked(struct necp_fd_data * client_fd,uuid_t client_id)896 necp_client_fd_find_client_unlocked(struct necp_fd_data *client_fd, uuid_t client_id)
897 {
898 NECP_FD_ASSERT_LOCKED(client_fd);
899 struct necp_client *client = NULL;
900
901 if (necp_client_id_is_flow(client_id)) {
902 struct necp_client_flow_registration find;
903 uuid_copy(find.registration_id, client_id);
904 struct necp_client_flow_registration *flow = RB_FIND(_necp_fd_flow_tree, &client_fd->flows, &find);
905 if (flow != NULL) {
906 client = flow->client;
907 }
908 } else {
909 struct necp_client find;
910 uuid_copy(find.client_id, client_id);
911 client = RB_FIND(_necp_client_tree, &client_fd->clients, &find);
912 }
913
914 return client;
915 }
916
917 static struct necp_client *
necp_client_fd_find_client_and_lock(struct necp_fd_data * client_fd,uuid_t client_id)918 necp_client_fd_find_client_and_lock(struct necp_fd_data *client_fd, uuid_t client_id)
919 {
920 struct necp_client *client = necp_client_fd_find_client_unlocked(client_fd, client_id);
921 if (client != NULL) {
922 NECP_CLIENT_LOCK(client);
923 }
924
925 return client;
926 }
927
928 static inline int
necp_client_id_cmp(struct necp_client * client0,struct necp_client * client1)929 necp_client_id_cmp(struct necp_client *client0, struct necp_client *client1)
930 {
931 return uuid_compare(client0->client_id, client1->client_id);
932 }
933
934 static inline int
necp_client_flow_id_cmp(struct necp_client_flow_registration * flow0,struct necp_client_flow_registration * flow1)935 necp_client_flow_id_cmp(struct necp_client_flow_registration *flow0, struct necp_client_flow_registration *flow1)
936 {
937 return uuid_compare(flow0->registration_id, flow1->registration_id);
938 }
939
940 static int
necpop_select(struct fileproc * fp,int which,void * wql,vfs_context_t ctx)941 necpop_select(struct fileproc *fp, int which, void *wql, vfs_context_t ctx)
942 {
943 #pragma unused(fp, which, wql, ctx)
944 return 0;
945 struct necp_fd_data *fd_data = NULL;
946 int revents = 0;
947 int events = 0;
948 proc_t procp;
949
950 fd_data = (struct necp_fd_data *)fp_get_data(fp);
951 if (fd_data == NULL) {
952 return 0;
953 }
954
955 procp = vfs_context_proc(ctx);
956
957 switch (which) {
958 case FREAD: {
959 events = POLLIN;
960 break;
961 }
962
963 default: {
964 return 1;
965 }
966 }
967
968 NECP_FD_LOCK(fd_data);
969 revents = necp_fd_poll(fd_data, events, wql, procp, 0);
970 NECP_FD_UNLOCK(fd_data);
971
972 return (events & revents) ? 1 : 0;
973 }
974
975 static void
necp_fd_knrdetach(struct knote * kn)976 necp_fd_knrdetach(struct knote *kn)
977 {
978 struct necp_fd_data *fd_data = (struct necp_fd_data *)kn->kn_hook;
979 struct selinfo *si = &fd_data->si;
980
981 NECP_FD_LOCK(fd_data);
982 KNOTE_DETACH(&si->si_note, kn);
983 NECP_FD_UNLOCK(fd_data);
984 }
985
986 static int
necp_fd_knread(struct knote * kn,long hint)987 necp_fd_knread(struct knote *kn, long hint)
988 {
989 #pragma unused(kn, hint)
990 return 1; /* assume we are ready */
991 }
992
993 static int
necp_fd_knrprocess(struct knote * kn,struct kevent_qos_s * kev)994 necp_fd_knrprocess(struct knote *kn, struct kevent_qos_s *kev)
995 {
996 struct necp_fd_data *fd_data;
997 int revents;
998 int res;
999
1000 fd_data = (struct necp_fd_data *)kn->kn_hook;
1001
1002 NECP_FD_LOCK(fd_data);
1003 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
1004 res = ((revents & POLLIN) != 0);
1005 if (res) {
1006 knote_fill_kevent(kn, kev, 0);
1007 }
1008 NECP_FD_UNLOCK(fd_data);
1009 return res;
1010 }
1011
1012 static int
necp_fd_knrtouch(struct knote * kn,struct kevent_qos_s * kev)1013 necp_fd_knrtouch(struct knote *kn, struct kevent_qos_s *kev)
1014 {
1015 #pragma unused(kev)
1016 struct necp_fd_data *fd_data;
1017 int revents;
1018
1019 fd_data = (struct necp_fd_data *)kn->kn_hook;
1020
1021 NECP_FD_LOCK(fd_data);
1022 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
1023 NECP_FD_UNLOCK(fd_data);
1024
1025 return (revents & POLLIN) != 0;
1026 }
1027
1028 SECURITY_READ_ONLY_EARLY(struct filterops) necp_fd_rfiltops = {
1029 .f_isfd = 1,
1030 .f_detach = necp_fd_knrdetach,
1031 .f_event = necp_fd_knread,
1032 .f_touch = necp_fd_knrtouch,
1033 .f_process = necp_fd_knrprocess,
1034 };
1035
1036 static int
necpop_kqfilter(struct fileproc * fp,struct knote * kn,__unused struct kevent_qos_s * kev)1037 necpop_kqfilter(struct fileproc *fp, struct knote *kn,
1038 __unused struct kevent_qos_s *kev)
1039 {
1040 struct necp_fd_data *fd_data = NULL;
1041 int revents;
1042
1043 if (kn->kn_filter != EVFILT_READ) {
1044 NECPLOG(LOG_ERR, "bad filter request %d", kn->kn_filter);
1045 knote_set_error(kn, EINVAL);
1046 return 0;
1047 }
1048
1049 fd_data = (struct necp_fd_data *)fp_get_data(fp);
1050 if (fd_data == NULL) {
1051 NECPLOG0(LOG_ERR, "No channel for kqfilter");
1052 knote_set_error(kn, ENOENT);
1053 return 0;
1054 }
1055
1056 NECP_FD_LOCK(fd_data);
1057 kn->kn_filtid = EVFILTID_NECP_FD;
1058 kn->kn_hook = fd_data;
1059 KNOTE_ATTACH(&fd_data->si.si_note, kn);
1060
1061 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
1062
1063 NECP_FD_UNLOCK(fd_data);
1064
1065 return (revents & POLLIN) != 0;
1066 }
1067
1068 #define INTERFACE_FLAGS_SHIFT 32
1069 #define INTERFACE_FLAGS_MASK 0xffff
1070 #define INTERFACE_INDEX_SHIFT 0
1071 #define INTERFACE_INDEX_MASK 0xffffffff
1072
1073 static uint64_t
combine_interface_details(uint32_t interface_index,uint16_t interface_flags)1074 combine_interface_details(uint32_t interface_index, uint16_t interface_flags)
1075 {
1076 return ((uint64_t)interface_flags & INTERFACE_FLAGS_MASK) << INTERFACE_FLAGS_SHIFT |
1077 ((uint64_t)interface_index & INTERFACE_INDEX_MASK) << INTERFACE_INDEX_SHIFT;
1078 }
1079
1080 #if SKYWALK
1081
1082 static void
split_interface_details(uint64_t combined_details,uint32_t * interface_index,uint16_t * interface_flags)1083 split_interface_details(uint64_t combined_details, uint32_t *interface_index, uint16_t *interface_flags)
1084 {
1085 *interface_index = (combined_details >> INTERFACE_INDEX_SHIFT) & INTERFACE_INDEX_MASK;
1086 *interface_flags = (combined_details >> INTERFACE_FLAGS_SHIFT) & INTERFACE_FLAGS_MASK;
1087 }
1088
1089 static void
necp_flow_save_current_interface_details(struct necp_client_flow_registration * flow_registration)1090 necp_flow_save_current_interface_details(struct necp_client_flow_registration *flow_registration)
1091 {
1092 struct necp_client_flow *flow = NULL;
1093 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1094 if (flow->nexus) {
1095 uint64_t combined_details = combine_interface_details(flow->interface_index, flow->interface_flags);
1096 atomic_set_64(&flow_registration->last_interface_details, combined_details);
1097 break;
1098 }
1099 }
1100 }
1101
1102 static void
necp_client_collect_interface_stats(struct necp_client_flow_registration * flow_registration,struct ifnet_stats_per_flow * ifs)1103 necp_client_collect_interface_stats(struct necp_client_flow_registration *flow_registration, struct ifnet_stats_per_flow *ifs)
1104 {
1105 struct necp_client_flow *flow = NULL;
1106
1107 if (ifs == NULL || ifs->txpackets == 0 || ifs->rxpackets == 0) {
1108 return; // App might have crashed without publishing ifs
1109 }
1110
1111 // Do malicious stats detection here
1112
1113 // Fold userspace stats into (trusted) kernel stats (stored in ifp).
1114 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1115 uint32_t if_idx = flow->interface_index;
1116 ifnet_t ifp = NULL;
1117 ifnet_head_lock_shared();
1118 if (if_idx != IFSCOPE_NONE && if_idx <= (uint32_t)if_index) {
1119 ifp = ifindex2ifnet[if_idx];
1120 ifnet_update_stats_per_flow(ifs, ifp);
1121 }
1122 ifnet_head_done();
1123
1124 // Currently there is only one flow that uses the shared necp
1125 // stats region, so this loop should exit after updating an ifp
1126 break;
1127 }
1128 }
1129
1130 static void
necp_client_collect_stats(struct necp_client_flow_registration * flow_registration)1131 necp_client_collect_stats(struct necp_client_flow_registration *flow_registration)
1132 {
1133 struct necp_all_kstats *kstats = (struct necp_all_kstats *)flow_registration->kstats_kaddr;
1134 if (kstats == NULL) {
1135 return;
1136 }
1137
1138 // Grab userspace stats delta (untrusted).
1139 struct necp_tcp_stats *curr_tcpstats = (struct necp_tcp_stats *)kstats->necp_stats_ustats;
1140 struct necp_tcp_stats *prev_tcpstats = (struct necp_tcp_stats *)&kstats->necp_stats_comm;
1141 #define diff_n_update(field) \
1142 u_int32_t d_##field = (curr_tcpstats->necp_tcp_counts.necp_stat_##field - prev_tcpstats->necp_tcp_counts.necp_stat_##field); \
1143 prev_tcpstats->necp_tcp_counts.necp_stat_##field += d_##field;
1144 diff_n_update(rxpackets);
1145 diff_n_update(txpackets);
1146 if (d_rxpackets == 0 && d_txpackets == 0) {
1147 return; // no activity since last collection, stop here
1148 }
1149 diff_n_update(rxbytes);
1150 diff_n_update(txbytes);
1151 diff_n_update(rxduplicatebytes);
1152 diff_n_update(rxoutoforderbytes);
1153 diff_n_update(txretransmit);
1154 diff_n_update(connectattempts);
1155 diff_n_update(connectsuccesses);
1156 uint32_t rtt = prev_tcpstats->necp_tcp_counts.necp_stat_avg_rtt = curr_tcpstats->necp_tcp_counts.necp_stat_avg_rtt;
1157 uint32_t rtt_var = prev_tcpstats->necp_tcp_counts.necp_stat_var_rtt = curr_tcpstats->necp_tcp_counts.necp_stat_var_rtt;
1158 #undef diff_n_update
1159
1160 // Do malicious stats detection with the deltas here.
1161 // RTT check (not necessarily attacks, might just be not measured since we report stats async periodically).
1162 if (rtt < necp_client_stats_rtt_floor || rtt > necp_client_stats_rtt_ceiling) {
1163 rtt = rtt_var = 0; // nstat_route_update to skip 0 rtt
1164 }
1165
1166 // Fold userspace stats into (trusted) kernel stats (stored in route).
1167 NECP_CLIENT_ROUTE_LOCK(flow_registration->client);
1168 struct rtentry *route = flow_registration->client->current_route;
1169 if (route != NULL) {
1170 nstat_route_update(route, d_connectattempts, d_connectsuccesses, d_rxpackets, d_rxbytes, d_rxduplicatebytes,
1171 d_rxoutoforderbytes, d_txpackets, d_txbytes, d_txretransmit, rtt, rtt_var);
1172 }
1173 NECP_CLIENT_ROUTE_UNLOCK(flow_registration->client);
1174 }
1175
1176 // This is called from various places; "closing" here implies the client being closed/removed if true, otherwise being
1177 // defunct. In the former, we expect the caller to not hold the lock; for the latter it must have acquired it.
1178 static void
necp_destroy_flow_stats(struct necp_fd_data * fd_data,struct necp_client_flow_registration * flow_registration,struct ifnet_stats_per_flow * flow_ifnet_stats,boolean_t closing)1179 necp_destroy_flow_stats(struct necp_fd_data *fd_data,
1180 struct necp_client_flow_registration *flow_registration,
1181 struct ifnet_stats_per_flow *flow_ifnet_stats,
1182 boolean_t closing)
1183 {
1184 NECP_FD_ASSERT_LOCKED(fd_data);
1185
1186 struct necp_client *client = flow_registration->client;
1187
1188 if (closing) {
1189 NECP_CLIENT_ASSERT_UNLOCKED(client);
1190 NECP_CLIENT_LOCK(client);
1191 } else {
1192 NECP_CLIENT_ASSERT_LOCKED(client);
1193 }
1194
1195 // the interface stats are independent of the flow stats, hence we check here
1196 if (flow_ifnet_stats != NULL) {
1197 necp_client_collect_interface_stats(flow_registration, flow_ifnet_stats);
1198 }
1199
1200 if (flow_registration->kstats_kaddr != NULL) {
1201 NECP_STATS_LIST_LOCK_EXCLUSIVE();
1202 necp_client_collect_stats(flow_registration);
1203 const bool destroyed = necp_client_release_locked(client); // Drop the reference held by the stats list
1204 ASSERT(!destroyed);
1205 (void)destroyed;
1206 LIST_REMOVE(flow_registration, collect_stats_chain);
1207 NECP_STATS_LIST_UNLOCK();
1208 if (flow_registration->stats_handler_context != NULL) {
1209 ntstat_userland_stats_close(flow_registration->stats_handler_context);
1210 flow_registration->stats_handler_context = NULL;
1211 }
1212 necp_arena_stats_obj_free(fd_data, flow_registration->stats_arena, &flow_registration->kstats_kaddr, &flow_registration->ustats_uaddr);
1213 ASSERT(flow_registration->kstats_kaddr == NULL);
1214 ASSERT(flow_registration->ustats_uaddr == 0);
1215 }
1216
1217 if (flow_registration->nexus_stats != NULL) {
1218 flow_stats_release(flow_registration->nexus_stats);
1219 flow_registration->nexus_stats = NULL;
1220 }
1221
1222 if (closing) {
1223 NECP_CLIENT_UNLOCK(client);
1224 }
1225 }
1226
1227 static void
necp_schedule_collect_stats_clients(bool recur)1228 necp_schedule_collect_stats_clients(bool recur)
1229 {
1230 if (necp_client_collect_stats_tcall == NULL ||
1231 (!recur && thread_call_isactive(necp_client_collect_stats_tcall))) {
1232 return;
1233 }
1234
1235 uint64_t deadline = 0;
1236 uint64_t leeway = 0;
1237 clock_interval_to_deadline(necp_collect_stats_timeout_microseconds, NSEC_PER_USEC, &deadline);
1238 clock_interval_to_absolutetime_interval(necp_collect_stats_timeout_leeway_microseconds, NSEC_PER_USEC, &leeway);
1239
1240 thread_call_enter_delayed_with_leeway(necp_client_collect_stats_tcall, NULL,
1241 deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
1242 }
1243
1244 static void
necp_collect_stats_client_callout(__unused thread_call_param_t dummy,__unused thread_call_param_t arg)1245 necp_collect_stats_client_callout(__unused thread_call_param_t dummy,
1246 __unused thread_call_param_t arg)
1247 {
1248 struct necp_client_flow_registration *flow_registration;
1249
1250 net_update_uptime();
1251 NECP_STATS_LIST_LOCK_SHARED();
1252 if (LIST_EMPTY(&necp_collect_stats_flow_list)) {
1253 NECP_STATS_LIST_UNLOCK();
1254 return;
1255 }
1256 LIST_FOREACH(flow_registration, &necp_collect_stats_flow_list, collect_stats_chain) {
1257 // Collecting stats should be cheap (atomic increments)
1258 // Values like flow_registration->kstats_kaddr are guaranteed to be valid
1259 // as long as the flow_registration is in the stats list
1260 necp_client_collect_stats(flow_registration);
1261 }
1262 NECP_STATS_LIST_UNLOCK();
1263
1264 necp_schedule_collect_stats_clients(TRUE); // recurring collection
1265 }
1266
1267 #endif /* !SKYWALK */
1268
1269 static void
necp_defunct_flow_registration(struct necp_client * client,struct necp_client_flow_registration * flow_registration,struct _necp_flow_defunct_list * defunct_list)1270 necp_defunct_flow_registration(struct necp_client *client,
1271 struct necp_client_flow_registration *flow_registration,
1272 struct _necp_flow_defunct_list *defunct_list)
1273 {
1274 NECP_CLIENT_ASSERT_LOCKED(client);
1275
1276 if (!flow_registration->defunct) {
1277 bool needs_defunct = false;
1278 struct necp_client_flow *search_flow = NULL;
1279 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
1280 if (search_flow->nexus &&
1281 !uuid_is_null(search_flow->u.nexus_agent)) {
1282 // Save defunct values for the nexus
1283 if (defunct_list != NULL) {
1284 // Sleeping alloc won't fail; copy only what's necessary
1285 struct necp_flow_defunct *flow_defunct = kalloc_type(struct necp_flow_defunct,
1286 Z_WAITOK | Z_ZERO);
1287 uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent);
1288 uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
1289 client->client_id :
1290 flow_registration->registration_id));
1291 flow_defunct->proc_pid = client->proc_pid;
1292 flow_defunct->agent_handle = client->agent_handle;
1293 flow_defunct->flags = flow_registration->flags;
1294 #if SKYWALK
1295 if (flow_registration->kstats_kaddr != NULL) {
1296 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
1297 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
1298 if (quicstats != NULL) {
1299 memcpy(flow_defunct->close_parameters.u.close_token, quicstats->necp_quic_extra.ssr_token, sizeof(flow_defunct->close_parameters.u.close_token));
1300 flow_defunct->has_close_parameters = true;
1301 }
1302 }
1303 #endif /* SKYWALK */
1304 // Add to the list provided by caller
1305 LIST_INSERT_HEAD(defunct_list, flow_defunct, chain);
1306 }
1307
1308 needs_defunct = true;
1309 }
1310 }
1311
1312 if (needs_defunct) {
1313 #if SKYWALK
1314 // Close the stats early
1315 if (flow_registration->stats_handler_context != NULL) {
1316 ntstat_userland_stats_event(flow_registration->stats_handler_context,
1317 NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT);
1318 }
1319 #endif /* SKYWALK */
1320
1321 // Only set defunct if there was some assigned flow
1322 flow_registration->defunct = true;
1323 }
1324 }
1325 }
1326
1327 static void
necp_defunct_client_for_policy(struct necp_client * client,struct _necp_flow_defunct_list * defunct_list)1328 necp_defunct_client_for_policy(struct necp_client *client,
1329 struct _necp_flow_defunct_list *defunct_list)
1330 {
1331 NECP_CLIENT_ASSERT_LOCKED(client);
1332
1333 struct necp_client_flow_registration *flow_registration = NULL;
1334 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
1335 necp_defunct_flow_registration(client, flow_registration, defunct_list);
1336 }
1337 }
1338
1339 static void
necp_client_free(struct necp_client * client)1340 necp_client_free(struct necp_client *client)
1341 {
1342 NECP_CLIENT_ASSERT_UNLOCKED(client);
1343
1344 kfree_data(client->extra_interface_options,
1345 sizeof(struct necp_client_interface_option) * NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT);
1346 client->extra_interface_options = NULL;
1347
1348 kfree_data(client->parameters, client->parameters_length);
1349 client->parameters = NULL;
1350
1351 lck_mtx_destroy(&client->route_lock, &necp_fd_mtx_grp);
1352 lck_mtx_destroy(&client->lock, &necp_fd_mtx_grp);
1353
1354 kfree_type(struct necp_client, client);
1355 }
1356
1357 static void
necp_client_retain_locked(struct necp_client * client)1358 necp_client_retain_locked(struct necp_client *client)
1359 {
1360 NECP_CLIENT_ASSERT_LOCKED(client);
1361
1362 os_ref_retain_locked(&client->reference_count);
1363 }
1364
1365 static void
necp_client_retain(struct necp_client * client)1366 necp_client_retain(struct necp_client *client)
1367 {
1368 NECP_CLIENT_LOCK(client);
1369 necp_client_retain_locked(client);
1370 NECP_CLIENT_UNLOCK(client);
1371 }
1372
1373 static bool
necp_client_release_locked(struct necp_client * client)1374 necp_client_release_locked(struct necp_client *client)
1375 {
1376 NECP_CLIENT_ASSERT_LOCKED(client);
1377
1378 os_ref_count_t count = os_ref_release_locked(&client->reference_count);
1379 if (count == 0) {
1380 NECP_CLIENT_UNLOCK(client);
1381 necp_client_free(client);
1382 }
1383
1384 return count == 0;
1385 }
1386
1387 static bool
necp_client_release(struct necp_client * client)1388 necp_client_release(struct necp_client *client)
1389 {
1390 bool last_ref;
1391
1392 NECP_CLIENT_LOCK(client);
1393 if (!(last_ref = necp_client_release_locked(client))) {
1394 NECP_CLIENT_UNLOCK(client);
1395 }
1396
1397 return last_ref;
1398 }
1399
1400 static struct necp_client_update *
necp_client_update_alloc(const void * data,size_t length)1401 necp_client_update_alloc(const void *data, size_t length)
1402 {
1403 struct necp_client_update *client_update;
1404 struct necp_client_observer_update *buffer;
1405 size_t alloc_size;
1406
1407 if (os_add_overflow(length, sizeof(*buffer), &alloc_size)) {
1408 return NULL;
1409 }
1410 buffer = kalloc_data(alloc_size, Z_WAITOK);
1411 if (buffer == NULL) {
1412 return NULL;
1413 }
1414
1415 client_update = kalloc_type(struct necp_client_update,
1416 Z_WAITOK | Z_ZERO | Z_NOFAIL);
1417 client_update->update_length = alloc_size;
1418 client_update->update = buffer;
1419 memcpy(buffer->tlv_buffer, data, length);
1420 return client_update;
1421 }
1422
1423 static void
necp_client_update_free(struct necp_client_update * client_update)1424 necp_client_update_free(struct necp_client_update *client_update)
1425 {
1426 kfree_data(client_update->update, client_update->update_length);
1427 kfree_type(struct necp_client_update, client_update);
1428 }
1429
1430 static void
necp_client_update_observer_add_internal(struct necp_fd_data * observer_fd,struct necp_client * client)1431 necp_client_update_observer_add_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1432 {
1433 struct necp_client_update *client_update;
1434
1435 NECP_FD_LOCK(observer_fd);
1436
1437 if (observer_fd->update_count >= necp_observer_message_limit) {
1438 NECP_FD_UNLOCK(observer_fd);
1439 return;
1440 }
1441
1442 client_update = necp_client_update_alloc(client->parameters, client->parameters_length);
1443 if (client_update != NULL) {
1444 uuid_copy(client_update->client_id, client->client_id);
1445 client_update->update->update_type = NECP_CLIENT_UPDATE_TYPE_PARAMETERS;
1446 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1447 observer_fd->update_count++;
1448
1449 necp_fd_notify(observer_fd, true);
1450 }
1451
1452 NECP_FD_UNLOCK(observer_fd);
1453 }
1454
1455 static void
necp_client_update_observer_update_internal(struct necp_fd_data * observer_fd,struct necp_client * client)1456 necp_client_update_observer_update_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1457 {
1458 NECP_FD_LOCK(observer_fd);
1459
1460 if (observer_fd->update_count >= necp_observer_message_limit) {
1461 NECP_FD_UNLOCK(observer_fd);
1462 return;
1463 }
1464
1465 struct necp_client_update *client_update = necp_client_update_alloc(client->result, client->result_length);
1466 if (client_update != NULL) {
1467 uuid_copy(client_update->client_id, client->client_id);
1468 client_update->update->update_type = NECP_CLIENT_UPDATE_TYPE_RESULT;
1469 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1470 observer_fd->update_count++;
1471
1472 necp_fd_notify(observer_fd, true);
1473 }
1474
1475 NECP_FD_UNLOCK(observer_fd);
1476 }
1477
1478 static void
necp_client_update_observer_remove_internal(struct necp_fd_data * observer_fd,struct necp_client * client)1479 necp_client_update_observer_remove_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1480 {
1481 NECP_FD_LOCK(observer_fd);
1482
1483 if (observer_fd->update_count >= necp_observer_message_limit) {
1484 NECP_FD_UNLOCK(observer_fd);
1485 return;
1486 }
1487
1488 struct necp_client_update *client_update = necp_client_update_alloc(NULL, 0);
1489 if (client_update != NULL) {
1490 uuid_copy(client_update->client_id, client->client_id);
1491 client_update->update->update_type = NECP_CLIENT_UPDATE_TYPE_REMOVE;
1492 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1493 observer_fd->update_count++;
1494
1495 necp_fd_notify(observer_fd, true);
1496 }
1497
1498 NECP_FD_UNLOCK(observer_fd);
1499 }
1500
1501 static void
necp_client_update_observer_add(struct necp_client * client)1502 necp_client_update_observer_add(struct necp_client *client)
1503 {
1504 NECP_OBSERVER_LIST_LOCK_SHARED();
1505
1506 if (LIST_EMPTY(&necp_fd_observer_list)) {
1507 // No observers, bail
1508 NECP_OBSERVER_LIST_UNLOCK();
1509 return;
1510 }
1511
1512 struct necp_fd_data *observer_fd = NULL;
1513 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1514 necp_client_update_observer_add_internal(observer_fd, client);
1515 }
1516
1517 NECP_OBSERVER_LIST_UNLOCK();
1518 }
1519
1520 static void
necp_client_update_observer_update(struct necp_client * client)1521 necp_client_update_observer_update(struct necp_client *client)
1522 {
1523 NECP_OBSERVER_LIST_LOCK_SHARED();
1524
1525 if (LIST_EMPTY(&necp_fd_observer_list)) {
1526 // No observers, bail
1527 NECP_OBSERVER_LIST_UNLOCK();
1528 return;
1529 }
1530
1531 struct necp_fd_data *observer_fd = NULL;
1532 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1533 necp_client_update_observer_update_internal(observer_fd, client);
1534 }
1535
1536 NECP_OBSERVER_LIST_UNLOCK();
1537 }
1538
1539 static void
necp_client_update_observer_remove(struct necp_client * client)1540 necp_client_update_observer_remove(struct necp_client *client)
1541 {
1542 NECP_OBSERVER_LIST_LOCK_SHARED();
1543
1544 if (LIST_EMPTY(&necp_fd_observer_list)) {
1545 // No observers, bail
1546 NECP_OBSERVER_LIST_UNLOCK();
1547 return;
1548 }
1549
1550 struct necp_fd_data *observer_fd = NULL;
1551 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1552 necp_client_update_observer_remove_internal(observer_fd, client);
1553 }
1554
1555 NECP_OBSERVER_LIST_UNLOCK();
1556 }
1557
1558 static void
necp_destroy_client_flow_registration(struct necp_client * client,struct necp_client_flow_registration * flow_registration,pid_t pid,bool abort)1559 necp_destroy_client_flow_registration(struct necp_client *client,
1560 struct necp_client_flow_registration *flow_registration,
1561 pid_t pid, bool abort)
1562 {
1563 NECP_CLIENT_ASSERT_LOCKED(client);
1564
1565 bool has_close_parameters = false;
1566 struct necp_client_agent_parameters close_parameters = {};
1567 memset(close_parameters.u.close_token, 0, sizeof(close_parameters.u.close_token));
1568 #if SKYWALK
1569 if (flow_registration->kstats_kaddr != NULL) {
1570 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
1571 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
1572 if (quicstats != NULL &&
1573 quicstats->necp_quic_udp_stats.necp_udp_hdr.necp_stats_type == NECP_CLIENT_STATISTICS_TYPE_QUIC) {
1574 memcpy(close_parameters.u.close_token, quicstats->necp_quic_extra.ssr_token, sizeof(close_parameters.u.close_token));
1575 has_close_parameters = true;
1576 }
1577 }
1578
1579 // Release reference held on the stats arena
1580 if (flow_registration->stats_arena != NULL) {
1581 necp_arena_info_release(flow_registration->stats_arena);
1582 flow_registration->stats_arena = NULL;
1583 }
1584 #endif /* SKYWALK */
1585
1586 struct necp_client_flow *search_flow = NULL;
1587 struct necp_client_flow *temp_flow = NULL;
1588 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
1589 if (search_flow->nexus &&
1590 !uuid_is_null(search_flow->u.nexus_agent)) {
1591 // Don't unregister for defunct flows
1592 if (!flow_registration->defunct) {
1593 u_int8_t message_type = (abort ? NETAGENT_MESSAGE_TYPE_ABORT_NEXUS :
1594 NETAGENT_MESSAGE_TYPE_CLOSE_NEXUS);
1595 if (((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
1596 (flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
1597 !(flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
1598 message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
1599 }
1600 int netagent_error = netagent_client_message_with_params(search_flow->u.nexus_agent,
1601 ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
1602 client->client_id :
1603 flow_registration->registration_id),
1604 pid, client->agent_handle,
1605 message_type,
1606 has_close_parameters ? &close_parameters : NULL,
1607 NULL, 0);
1608 if (netagent_error != 0 && netagent_error != ENOENT) {
1609 NECPLOG(LOG_ERR, "necp_client_remove close nexus error (%d) MESSAGE TYPE %u", netagent_error, message_type);
1610 }
1611 }
1612 uuid_clear(search_flow->u.nexus_agent);
1613 }
1614 if (search_flow->assigned_results != NULL) {
1615 kfree_data(search_flow->assigned_results, search_flow->assigned_results_length);
1616 search_flow->assigned_results = NULL;
1617 }
1618 LIST_REMOVE(search_flow, flow_chain);
1619 #if SKYWALK
1620 if (search_flow->nexus) {
1621 OSDecrementAtomic(&necp_nexus_flow_count);
1622 } else
1623 #endif /* SKYWALK */
1624 if (search_flow->socket) {
1625 OSDecrementAtomic(&necp_socket_flow_count);
1626 } else {
1627 OSDecrementAtomic(&necp_if_flow_count);
1628 }
1629 mcache_free(necp_flow_cache, search_flow);
1630 }
1631
1632 RB_REMOVE(_necp_client_flow_tree, &client->flow_registrations, flow_registration);
1633 flow_registration->client = NULL;
1634
1635 mcache_free(necp_flow_registration_cache, flow_registration);
1636 }
1637
1638 static void
necp_destroy_client(struct necp_client * client,pid_t pid,bool abort)1639 necp_destroy_client(struct necp_client *client, pid_t pid, bool abort)
1640 {
1641 NECP_CLIENT_ASSERT_UNLOCKED(client);
1642
1643 #if SKYWALK
1644 if (client->nstat_context != NULL) {
1645 // This is a catch-all that should be rarely used.
1646 nstat_provider_stats_close(client->nstat_context);
1647 client->nstat_context = NULL;
1648 }
1649 if (client->original_parameters_source != NULL) {
1650 necp_client_release(client->original_parameters_source);
1651 client->original_parameters_source = NULL;
1652 }
1653 #endif /* SKYWALK */
1654 necp_client_update_observer_remove(client);
1655
1656 NECP_CLIENT_LOCK(client);
1657
1658 // Free route
1659 NECP_CLIENT_ROUTE_LOCK(client);
1660 if (client->current_route != NULL) {
1661 rtfree(client->current_route);
1662 client->current_route = NULL;
1663 }
1664 NECP_CLIENT_ROUTE_UNLOCK(client);
1665
1666 // Remove flow assignments
1667 struct necp_client_flow_registration *flow_registration = NULL;
1668 struct necp_client_flow_registration *temp_flow_registration = NULL;
1669 RB_FOREACH_SAFE(flow_registration, _necp_client_flow_tree, &client->flow_registrations, temp_flow_registration) {
1670 necp_destroy_client_flow_registration(client, flow_registration, pid, abort);
1671 }
1672
1673 #if SKYWALK
1674 // Remove port reservation
1675 if (NETNS_TOKEN_VALID(&client->port_reservation)) {
1676 netns_release(&client->port_reservation);
1677 }
1678 #endif /* !SKYWALK */
1679
1680 // Remove agent assertions
1681 struct necp_client_assertion *search_assertion = NULL;
1682 struct necp_client_assertion *temp_assertion = NULL;
1683 LIST_FOREACH_SAFE(search_assertion, &client->assertion_list, assertion_chain, temp_assertion) {
1684 int netagent_error = netagent_client_message(search_assertion->asserted_netagent, client->client_id, pid,
1685 client->agent_handle, NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT);
1686 if (netagent_error != 0) {
1687 NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR),
1688 "necp_client_remove unassert agent error (%d)", netagent_error);
1689 }
1690 LIST_REMOVE(search_assertion, assertion_chain);
1691 kfree_type(struct necp_client_assertion, search_assertion);
1692 }
1693
1694 if (!necp_client_release_locked(client)) {
1695 NECP_CLIENT_UNLOCK(client);
1696 }
1697
1698 OSDecrementAtomic(&necp_client_count);
1699 }
1700
1701 static bool
1702 necp_defunct_client_fd_locked_inner(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, bool destroy_stats);
1703
1704 static void
necp_process_defunct_list(struct _necp_flow_defunct_list * defunct_list)1705 necp_process_defunct_list(struct _necp_flow_defunct_list *defunct_list)
1706 {
1707 if (!LIST_EMPTY(defunct_list)) {
1708 struct necp_flow_defunct *flow_defunct = NULL;
1709 struct necp_flow_defunct *temp_flow_defunct = NULL;
1710
1711 // For each newly defunct client, send a message to the nexus to remove the flow
1712 LIST_FOREACH_SAFE(flow_defunct, defunct_list, chain, temp_flow_defunct) {
1713 if (!uuid_is_null(flow_defunct->nexus_agent)) {
1714 u_int8_t message_type = NETAGENT_MESSAGE_TYPE_ABORT_NEXUS;
1715 if (((flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
1716 (flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
1717 !(flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
1718 message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
1719 }
1720 int netagent_error = netagent_client_message_with_params(flow_defunct->nexus_agent,
1721 flow_defunct->flow_id,
1722 flow_defunct->proc_pid,
1723 flow_defunct->agent_handle,
1724 message_type,
1725 flow_defunct->has_close_parameters ? &flow_defunct->close_parameters : NULL,
1726 NULL, 0);
1727 if (netagent_error != 0) {
1728 char namebuf[MAXCOMLEN + 1];
1729 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
1730 proc_name(flow_defunct->proc_pid, namebuf, sizeof(namebuf));
1731 NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR), "necp_update_client abort nexus error (%d) for pid %d %s", netagent_error, flow_defunct->proc_pid, namebuf);
1732 }
1733 }
1734 LIST_REMOVE(flow_defunct, chain);
1735 kfree_type(struct necp_flow_defunct, flow_defunct);
1736 }
1737 }
1738 ASSERT(LIST_EMPTY(defunct_list));
1739 }
1740
1741 static int
necpop_close(struct fileglob * fg,vfs_context_t ctx)1742 necpop_close(struct fileglob *fg, vfs_context_t ctx)
1743 {
1744 #pragma unused(ctx)
1745 struct necp_fd_data *fd_data = NULL;
1746 int error = 0;
1747
1748 fd_data = (struct necp_fd_data *)fg_get_data(fg);
1749 fg_set_data(fg, NULL);
1750
1751 if (fd_data != NULL) {
1752 struct _necp_client_tree clients_to_close;
1753 RB_INIT(&clients_to_close);
1754
1755 // Remove from list quickly
1756 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
1757 NECP_OBSERVER_LIST_LOCK_EXCLUSIVE();
1758 LIST_REMOVE(fd_data, chain);
1759 NECP_OBSERVER_LIST_UNLOCK();
1760 } else {
1761 NECP_FD_LIST_LOCK_EXCLUSIVE();
1762 LIST_REMOVE(fd_data, chain);
1763 NECP_FD_LIST_UNLOCK();
1764 }
1765
1766 NECP_FD_LOCK(fd_data);
1767 pid_t pid = fd_data->proc_pid;
1768
1769 struct _necp_flow_defunct_list defunct_list;
1770 LIST_INIT(&defunct_list);
1771
1772 (void)necp_defunct_client_fd_locked_inner(fd_data, &defunct_list, false);
1773
1774 struct necp_client_flow_registration *flow_registration = NULL;
1775 struct necp_client_flow_registration *temp_flow_registration = NULL;
1776 RB_FOREACH_SAFE(flow_registration, _necp_fd_flow_tree, &fd_data->flows, temp_flow_registration) {
1777 #if SKYWALK
1778 necp_destroy_flow_stats(fd_data, flow_registration, NULL, TRUE);
1779 #endif /* SKYWALK */
1780 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
1781 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
1782 NECP_FLOW_TREE_UNLOCK();
1783 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
1784 }
1785
1786 struct necp_client *client = NULL;
1787 struct necp_client *temp_client = NULL;
1788 RB_FOREACH_SAFE(client, _necp_client_tree, &fd_data->clients, temp_client) {
1789 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
1790 RB_REMOVE(_necp_client_global_tree, &necp_client_global_tree, client);
1791 NECP_CLIENT_TREE_UNLOCK();
1792 RB_REMOVE(_necp_client_tree, &fd_data->clients, client);
1793 RB_INSERT(_necp_client_tree, &clients_to_close, client);
1794 }
1795
1796 struct necp_client_update *client_update = NULL;
1797 struct necp_client_update *temp_update = NULL;
1798 TAILQ_FOREACH_SAFE(client_update, &fd_data->update_list, chain, temp_update) {
1799 // Flush pending updates
1800 TAILQ_REMOVE(&fd_data->update_list, client_update, chain);
1801 necp_client_update_free(client_update);
1802 }
1803 fd_data->update_count = 0;
1804
1805 #if SKYWALK
1806 // Cleanup stats arena(s); indicate that we're closing
1807 necp_stats_arenas_destroy(fd_data, TRUE);
1808 ASSERT(fd_data->stats_arena_active == NULL);
1809 ASSERT(LIST_EMPTY(&fd_data->stats_arena_list));
1810
1811 // Cleanup systctl arena
1812 necp_sysctl_arena_destroy(fd_data);
1813 ASSERT(fd_data->sysctl_arena == NULL);
1814 #endif /* SKYWALK */
1815
1816 NECP_FD_UNLOCK(fd_data);
1817
1818 selthreadclear(&fd_data->si);
1819
1820 lck_mtx_destroy(&fd_data->fd_lock, &necp_fd_mtx_grp);
1821
1822 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
1823 OSDecrementAtomic(&necp_observer_fd_count);
1824 } else {
1825 OSDecrementAtomic(&necp_client_fd_count);
1826 }
1827
1828 zfree(necp_client_fd_zone, fd_data);
1829 fd_data = NULL;
1830
1831 RB_FOREACH_SAFE(client, _necp_client_tree, &clients_to_close, temp_client) {
1832 RB_REMOVE(_necp_client_tree, &clients_to_close, client);
1833 necp_destroy_client(client, pid, true);
1834 }
1835
1836 necp_process_defunct_list(&defunct_list);
1837 }
1838
1839 return error;
1840 }
1841
1842 /// NECP client utilities
1843
1844 static inline bool
necp_address_is_wildcard(const union necp_sockaddr_union * const addr)1845 necp_address_is_wildcard(const union necp_sockaddr_union * const addr)
1846 {
1847 return (addr->sa.sa_family == AF_INET && addr->sin.sin_addr.s_addr == INADDR_ANY) ||
1848 (addr->sa.sa_family == AF_INET6 && IN6_IS_ADDR_UNSPECIFIED(&addr->sin6.sin6_addr));
1849 }
1850
1851 static int
necp_find_fd_data(struct proc * p,int fd,struct fileproc ** fpp,struct necp_fd_data ** fd_data)1852 necp_find_fd_data(struct proc *p, int fd,
1853 struct fileproc **fpp, struct necp_fd_data **fd_data)
1854 {
1855 struct fileproc *fp;
1856 int error = fp_get_ftype(p, fd, DTYPE_NETPOLICY, ENODEV, &fp);
1857
1858 if (error == 0) {
1859 *fd_data = (struct necp_fd_data *)fp_get_data(fp);
1860 *fpp = fp;
1861
1862 if ((*fd_data)->necp_fd_type != necp_fd_type_client) {
1863 // Not a client fd, ignore
1864 fp_drop(p, fd, fp, 0);
1865 error = EINVAL;
1866 }
1867 }
1868 return error;
1869 }
1870
1871 static void
necp_client_add_nexus_flow(struct necp_client_flow_registration * flow_registration,uuid_t nexus_agent,uint32_t interface_index,uint16_t interface_flags)1872 necp_client_add_nexus_flow(struct necp_client_flow_registration *flow_registration,
1873 uuid_t nexus_agent,
1874 uint32_t interface_index,
1875 uint16_t interface_flags)
1876 {
1877 struct necp_client_flow *new_flow = mcache_alloc(necp_flow_cache, MCR_SLEEP);
1878 if (new_flow == NULL) {
1879 NECPLOG0(LOG_ERR, "Failed to allocate nexus flow");
1880 return;
1881 }
1882
1883 memset(new_flow, 0, sizeof(*new_flow));
1884
1885 new_flow->nexus = TRUE;
1886 uuid_copy(new_flow->u.nexus_agent, nexus_agent);
1887 new_flow->interface_index = interface_index;
1888 new_flow->interface_flags = interface_flags;
1889 new_flow->check_tcp_heuristics = TRUE;
1890
1891 #if SKYWALK
1892 OSIncrementAtomic(&necp_nexus_flow_count);
1893 #endif /* SKYWALK */
1894
1895 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
1896
1897 #if SKYWALK
1898 necp_flow_save_current_interface_details(flow_registration);
1899 #endif /* SKYWALK */
1900 }
1901
1902 static void
necp_client_add_nexus_flow_if_needed(struct necp_client_flow_registration * flow_registration,uuid_t nexus_agent,uint32_t interface_index)1903 necp_client_add_nexus_flow_if_needed(struct necp_client_flow_registration *flow_registration,
1904 uuid_t nexus_agent,
1905 uint32_t interface_index)
1906 {
1907 struct necp_client_flow *flow = NULL;
1908 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1909 if (flow->nexus &&
1910 uuid_compare(flow->u.nexus_agent, nexus_agent) == 0) {
1911 return;
1912 }
1913 }
1914
1915 uint16_t interface_flags = 0;
1916 ifnet_t ifp = NULL;
1917 ifnet_head_lock_shared();
1918 if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
1919 ifp = ifindex2ifnet[interface_index];
1920 if (ifp != NULL) {
1921 ifnet_lock_shared(ifp);
1922 interface_flags = nstat_ifnet_to_flags(ifp);
1923 ifnet_lock_done(ifp);
1924 }
1925 }
1926 ifnet_head_done();
1927 necp_client_add_nexus_flow(flow_registration, nexus_agent, interface_index, interface_flags);
1928 }
1929
1930 static struct necp_client_flow *
necp_client_add_interface_flow(struct necp_client_flow_registration * flow_registration,uint32_t interface_index)1931 necp_client_add_interface_flow(struct necp_client_flow_registration *flow_registration,
1932 uint32_t interface_index)
1933 {
1934 struct necp_client_flow *new_flow = mcache_alloc(necp_flow_cache, MCR_SLEEP);
1935 if (new_flow == NULL) {
1936 NECPLOG0(LOG_ERR, "Failed to allocate interface flow");
1937 return NULL;
1938 }
1939
1940 memset(new_flow, 0, sizeof(*new_flow));
1941
1942 // Neither nexus nor socket
1943 new_flow->interface_index = interface_index;
1944 new_flow->u.socket_handle = flow_registration->interface_handle;
1945 new_flow->u.cb = flow_registration->interface_cb;
1946
1947 OSIncrementAtomic(&necp_if_flow_count);
1948
1949 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
1950
1951 return new_flow;
1952 }
1953
1954 static struct necp_client_flow *
necp_client_add_interface_flow_if_needed(struct necp_client * client,struct necp_client_flow_registration * flow_registration,uint32_t interface_index)1955 necp_client_add_interface_flow_if_needed(struct necp_client *client,
1956 struct necp_client_flow_registration *flow_registration,
1957 uint32_t interface_index)
1958 {
1959 if (!client->allow_multiple_flows ||
1960 interface_index == IFSCOPE_NONE) {
1961 // Interface not set, or client not allowed to use this mode
1962 return NULL;
1963 }
1964
1965 struct necp_client_flow *flow = NULL;
1966 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1967 if (!flow->nexus && !flow->socket && flow->interface_index == interface_index) {
1968 // Already have the flow
1969 flow->invalid = FALSE;
1970 flow->u.socket_handle = flow_registration->interface_handle;
1971 flow->u.cb = flow_registration->interface_cb;
1972 return NULL;
1973 }
1974 }
1975 return necp_client_add_interface_flow(flow_registration, interface_index);
1976 }
1977
1978 static void
necp_client_add_interface_option_if_needed(struct necp_client * client,uint32_t interface_index,uint32_t interface_generation,uuid_t * nexus_agent,bool network_provider)1979 necp_client_add_interface_option_if_needed(struct necp_client *client,
1980 uint32_t interface_index,
1981 uint32_t interface_generation,
1982 uuid_t *nexus_agent,
1983 bool network_provider)
1984 {
1985 if ((interface_index == IFSCOPE_NONE && !network_provider) ||
1986 (client->interface_option_count != 0 && !client->allow_multiple_flows)) {
1987 // Interface not set, or client not allowed to use this mode
1988 return;
1989 }
1990
1991 if (client->interface_option_count >= NECP_CLIENT_MAX_INTERFACE_OPTIONS) {
1992 // Cannot take any more interface options
1993 return;
1994 }
1995
1996 // Check if already present
1997 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
1998 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
1999 struct necp_client_interface_option *option = &client->interface_options[option_i];
2000 if (option->interface_index == interface_index) {
2001 if (nexus_agent == NULL) {
2002 return;
2003 }
2004 if (uuid_compare(option->nexus_agent, *nexus_agent) == 0) {
2005 return;
2006 }
2007 if (uuid_is_null(option->nexus_agent)) {
2008 uuid_copy(option->nexus_agent, *nexus_agent);
2009 return;
2010 }
2011 // If we get to this point, this is a new nexus flow
2012 }
2013 } else {
2014 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
2015 if (option->interface_index == interface_index) {
2016 if (nexus_agent == NULL) {
2017 return;
2018 }
2019 if (uuid_compare(option->nexus_agent, *nexus_agent) == 0) {
2020 return;
2021 }
2022 if (uuid_is_null(option->nexus_agent)) {
2023 uuid_copy(option->nexus_agent, *nexus_agent);
2024 return;
2025 }
2026 // If we get to this point, this is a new nexus flow
2027 }
2028 }
2029 }
2030
2031 // Add a new entry
2032 if (client->interface_option_count < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
2033 // Add to static
2034 struct necp_client_interface_option *option = &client->interface_options[client->interface_option_count];
2035 option->interface_index = interface_index;
2036 option->interface_generation = interface_generation;
2037 if (nexus_agent != NULL) {
2038 uuid_copy(option->nexus_agent, *nexus_agent);
2039 } else {
2040 uuid_clear(option->nexus_agent);
2041 }
2042 client->interface_option_count++;
2043 } else {
2044 // Add to extra
2045 if (client->extra_interface_options == NULL) {
2046 client->extra_interface_options = (struct necp_client_interface_option *)kalloc_data(
2047 sizeof(struct necp_client_interface_option) * NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT, Z_WAITOK | Z_ZERO);
2048 }
2049 if (client->extra_interface_options != NULL) {
2050 struct necp_client_interface_option *option = &client->extra_interface_options[client->interface_option_count - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
2051 option->interface_index = interface_index;
2052 option->interface_generation = interface_generation;
2053 if (nexus_agent != NULL) {
2054 uuid_copy(option->nexus_agent, *nexus_agent);
2055 } else {
2056 uuid_clear(option->nexus_agent);
2057 }
2058 client->interface_option_count++;
2059 }
2060 }
2061 }
2062
2063 static bool
necp_client_flow_is_viable(proc_t proc,struct necp_client * client,struct necp_client_flow * flow)2064 necp_client_flow_is_viable(proc_t proc, struct necp_client *client,
2065 struct necp_client_flow *flow)
2066 {
2067 struct necp_aggregate_result result;
2068 bool ignore_address = (client->allow_multiple_flows && !flow->nexus && !flow->socket);
2069
2070 flow->necp_flow_flags = 0;
2071 int error = necp_application_find_policy_match_internal(proc, client->parameters,
2072 (u_int32_t)client->parameters_length,
2073 &result, &flow->necp_flow_flags, NULL,
2074 flow->interface_index,
2075 &flow->local_addr, &flow->remote_addr, NULL, NULL,
2076 NULL, ignore_address, true, NULL);
2077
2078 // Check for blocking agents
2079 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
2080 if (uuid_is_null(result.netagents[i])) {
2081 // Passed end of valid agents
2082 break;
2083 }
2084 if (result.netagent_use_flags[i] & NECP_AGENT_USE_FLAG_REMOVE) {
2085 // A removed agent, ignore
2086 continue;
2087 }
2088 u_int32_t flags = netagent_get_flags(result.netagents[i]);
2089 if ((flags & NETAGENT_FLAG_REGISTERED) &&
2090 !(flags & NETAGENT_FLAG_VOLUNTARY) &&
2091 !(flags & NETAGENT_FLAG_ACTIVE) &&
2092 !(flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY)) {
2093 // A required agent is not active, cause the flow to be marked non-viable
2094 return false;
2095 }
2096 }
2097
2098 if (flow->interface_index != IFSCOPE_NONE) {
2099 ifnet_head_lock_shared();
2100
2101 struct ifnet *ifp = ifindex2ifnet[flow->interface_index];
2102 if (ifp && ifp->if_delegated.ifp != IFSCOPE_NONE) {
2103 flow->delegated_interface_index = ifp->if_delegated.ifp->if_index;
2104 }
2105
2106 ifnet_head_done();
2107 }
2108
2109 return error == 0 &&
2110 result.routed_interface_index != IFSCOPE_NONE &&
2111 result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP;
2112 }
2113
2114 static void
necp_flow_add_interface_flows(proc_t proc,struct necp_client * client,struct necp_client_flow_registration * flow_registration,bool send_initial)2115 necp_flow_add_interface_flows(proc_t proc,
2116 struct necp_client *client,
2117 struct necp_client_flow_registration *flow_registration,
2118 bool send_initial)
2119 {
2120 // Traverse all interfaces and add a tracking flow if needed
2121 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
2122 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
2123 struct necp_client_interface_option *option = &client->interface_options[option_i];
2124 struct necp_client_flow *flow = necp_client_add_interface_flow_if_needed(client, flow_registration, option->interface_index);
2125 if (flow != NULL && send_initial) {
2126 flow->viable = necp_client_flow_is_viable(proc, client, flow);
2127 if (flow->viable && flow->u.cb) {
2128 bool viable = flow->viable;
2129 flow->u.cb(flow_registration->interface_handle, NECP_CLIENT_CBACTION_INITIAL, flow->interface_index, flow->necp_flow_flags, &viable);
2130 flow->viable = viable;
2131 }
2132 }
2133 } else {
2134 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
2135 struct necp_client_flow *flow = necp_client_add_interface_flow_if_needed(client, flow_registration, option->interface_index);
2136 if (flow != NULL && send_initial) {
2137 flow->viable = necp_client_flow_is_viable(proc, client, flow);
2138 if (flow->viable && flow->u.cb) {
2139 bool viable = flow->viable;
2140 flow->u.cb(flow_registration->interface_handle, NECP_CLIENT_CBACTION_INITIAL, flow->interface_index, flow->necp_flow_flags, &viable);
2141 flow->viable = viable;
2142 }
2143 }
2144 }
2145 }
2146 }
2147
2148 static bool
necp_client_update_flows(proc_t proc,struct necp_client * client,struct _necp_flow_defunct_list * defunct_list)2149 necp_client_update_flows(proc_t proc,
2150 struct necp_client *client,
2151 struct _necp_flow_defunct_list *defunct_list)
2152 {
2153 NECP_CLIENT_ASSERT_LOCKED(client);
2154
2155 bool any_client_updated = FALSE;
2156 struct necp_client_flow *flow = NULL;
2157 struct necp_client_flow *temp_flow = NULL;
2158 struct necp_client_flow_registration *flow_registration = NULL;
2159 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
2160 if (flow_registration->interface_cb != NULL) {
2161 // Add any interface flows that are not already tracked
2162 necp_flow_add_interface_flows(proc, client, flow_registration, false);
2163 }
2164
2165 LIST_FOREACH_SAFE(flow, &flow_registration->flow_list, flow_chain, temp_flow) {
2166 bool client_updated = FALSE;
2167
2168 // Check policy result for flow
2169 u_short old_delegated_ifindex = flow->delegated_interface_index;
2170
2171 int old_flags = flow->necp_flow_flags;
2172 bool viable = necp_client_flow_is_viable(proc, client, flow);
2173
2174 // TODO: Defunct nexus flows that are blocked by policy
2175
2176 if (flow->viable != viable) {
2177 flow->viable = viable;
2178 client_updated = TRUE;
2179 }
2180
2181 if ((old_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE) !=
2182 (flow->necp_flow_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE)) {
2183 client_updated = TRUE;
2184 }
2185
2186 if (flow->delegated_interface_index != old_delegated_ifindex) {
2187 client_updated = TRUE;
2188 }
2189
2190 if (flow->viable && client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) {
2191 bool flow_viable = flow->viable;
2192 flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_VIABLE, flow->interface_index, flow->necp_flow_flags, &flow_viable);
2193 flow->viable = flow_viable;
2194 }
2195
2196 if (!flow->viable || flow->invalid) {
2197 if (client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) {
2198 bool flow_viable = flow->viable;
2199 flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_NONVIABLE, flow->interface_index, flow->necp_flow_flags, &flow_viable);
2200 flow->viable = flow_viable;
2201 }
2202 // The callback might change the viable-flag of the
2203 // flow depending on its policy. Thus, we need to
2204 // check the flags again after the callback.
2205 }
2206
2207 #if SKYWALK
2208 if (defunct_list != NULL) {
2209 if (flow->invalid && flow->nexus && flow->assigned && !uuid_is_null(flow->u.nexus_agent)) {
2210 // This is a nexus flow that was assigned, but not found on path
2211 u_int32_t flags = netagent_get_flags(flow->u.nexus_agent);
2212 if (!(flags & NETAGENT_FLAG_REGISTERED)) {
2213 // The agent is no longer registered! Mark defunct.
2214 necp_defunct_flow_registration(client, flow_registration, defunct_list);
2215 client_updated = TRUE;
2216 }
2217 }
2218 }
2219 #else /* !SKYWALK */
2220 (void)defunct_list;
2221 #endif /* !SKYWALK */
2222
2223 // Handle flows that no longer match
2224 if (!flow->viable || flow->invalid) {
2225 // Drop them as long as they aren't assigned data
2226 if (!flow->nexus && !flow->assigned) {
2227 if (flow->assigned_results != NULL) {
2228 kfree_data(flow->assigned_results, flow->assigned_results_length);
2229 flow->assigned_results = NULL;
2230 client_updated = TRUE;
2231 }
2232 LIST_REMOVE(flow, flow_chain);
2233 #if SKYWALK
2234 if (flow->nexus) {
2235 OSDecrementAtomic(&necp_nexus_flow_count);
2236 } else
2237 #endif /* SKYWALK */
2238 if (flow->socket) {
2239 OSDecrementAtomic(&necp_socket_flow_count);
2240 } else {
2241 OSDecrementAtomic(&necp_if_flow_count);
2242 }
2243 mcache_free(necp_flow_cache, flow);
2244 }
2245 }
2246
2247 any_client_updated |= client_updated;
2248 }
2249 #if SKYWALK
2250 necp_flow_save_current_interface_details(flow_registration);
2251 #endif /* SKYWALK */
2252 }
2253
2254 return any_client_updated;
2255 }
2256
2257 static void
necp_client_mark_all_nonsocket_flows_as_invalid(struct necp_client * client)2258 necp_client_mark_all_nonsocket_flows_as_invalid(struct necp_client *client)
2259 {
2260 struct necp_client_flow_registration *flow_registration = NULL;
2261 struct necp_client_flow *flow = NULL;
2262 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
2263 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
2264 if (!flow->socket) { // Socket flows are not marked as invalid
2265 flow->invalid = TRUE;
2266 }
2267 }
2268 }
2269
2270 // Reset option count every update
2271 client->interface_option_count = 0;
2272 }
2273
2274 static inline bool
necp_netagent_is_requested(const struct necp_client_parsed_parameters * parameters,uuid_t * netagent_uuid)2275 necp_netagent_is_requested(const struct necp_client_parsed_parameters *parameters,
2276 uuid_t *netagent_uuid)
2277 {
2278 // Specific use agents only apply when requested
2279 bool requested = false;
2280 if (parameters != NULL) {
2281 // Check required agent UUIDs
2282 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2283 if (uuid_is_null(parameters->required_netagents[i])) {
2284 break;
2285 }
2286 if (uuid_compare(parameters->required_netagents[i], *netagent_uuid) == 0) {
2287 requested = true;
2288 break;
2289 }
2290 }
2291
2292 if (!requested) {
2293 // Check required agent types
2294 bool fetched_type = false;
2295 char netagent_domain[NETAGENT_DOMAINSIZE];
2296 char netagent_type[NETAGENT_TYPESIZE];
2297 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
2298 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
2299
2300 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2301 if (strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
2302 strlen(parameters->required_netagent_types[i].netagent_type) == 0) {
2303 break;
2304 }
2305
2306 if (!fetched_type) {
2307 if (netagent_get_agent_domain_and_type(*netagent_uuid, netagent_domain, netagent_type)) {
2308 fetched_type = TRUE;
2309 } else {
2310 break;
2311 }
2312 }
2313
2314 if ((strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
2315 strncmp(netagent_domain, parameters->required_netagent_types[i].netagent_domain, NETAGENT_DOMAINSIZE) == 0) &&
2316 (strlen(parameters->required_netagent_types[i].netagent_type) == 0 ||
2317 strncmp(netagent_type, parameters->required_netagent_types[i].netagent_type, NETAGENT_TYPESIZE) == 0)) {
2318 requested = true;
2319 break;
2320 }
2321 }
2322 }
2323
2324 // Check preferred agent UUIDs
2325 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2326 if (uuid_is_null(parameters->preferred_netagents[i])) {
2327 break;
2328 }
2329 if (uuid_compare(parameters->preferred_netagents[i], *netagent_uuid) == 0) {
2330 requested = true;
2331 break;
2332 }
2333 }
2334
2335 if (!requested) {
2336 // Check preferred agent types
2337 bool fetched_type = false;
2338 char netagent_domain[NETAGENT_DOMAINSIZE];
2339 char netagent_type[NETAGENT_TYPESIZE];
2340 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
2341 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
2342
2343 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2344 if (strlen(parameters->preferred_netagent_types[i].netagent_domain) == 0 ||
2345 strlen(parameters->preferred_netagent_types[i].netagent_type) == 0) {
2346 break;
2347 }
2348
2349 if (!fetched_type) {
2350 if (netagent_get_agent_domain_and_type(*netagent_uuid, netagent_domain, netagent_type)) {
2351 fetched_type = TRUE;
2352 } else {
2353 break;
2354 }
2355 }
2356
2357 if ((strlen(parameters->preferred_netagent_types[i].netagent_domain) == 0 ||
2358 strncmp(netagent_domain, parameters->preferred_netagent_types[i].netagent_domain, NETAGENT_DOMAINSIZE) == 0) &&
2359 (strlen(parameters->preferred_netagent_types[i].netagent_type) == 0 ||
2360 strncmp(netagent_type, parameters->preferred_netagent_types[i].netagent_type, NETAGENT_TYPESIZE) == 0)) {
2361 requested = true;
2362 break;
2363 }
2364 }
2365 }
2366 }
2367
2368 return requested;
2369 }
2370
2371 static bool
necp_netagent_applies_to_client(struct necp_client * client,const struct necp_client_parsed_parameters * parameters,uuid_t * netagent_uuid,bool allow_nexus,uint32_t interface_index,uint32_t interface_generation)2372 necp_netagent_applies_to_client(struct necp_client *client,
2373 const struct necp_client_parsed_parameters *parameters,
2374 uuid_t *netagent_uuid, bool allow_nexus,
2375 uint32_t interface_index, uint32_t interface_generation)
2376 {
2377 #pragma unused(interface_index, interface_generation)
2378 bool applies = FALSE;
2379 u_int32_t flags = netagent_get_flags(*netagent_uuid);
2380 if (!(flags & NETAGENT_FLAG_REGISTERED)) {
2381 // Unregistered agents never apply
2382 return applies;
2383 }
2384
2385 const bool is_nexus_agent = ((flags & NETAGENT_FLAG_NEXUS_PROVIDER) ||
2386 (flags & NETAGENT_FLAG_NEXUS_LISTENER) ||
2387 (flags & NETAGENT_FLAG_CUSTOM_ETHER_NEXUS) ||
2388 (flags & NETAGENT_FLAG_CUSTOM_IP_NEXUS) ||
2389 (flags & NETAGENT_FLAG_INTERPOSE_NEXUS));
2390 if (is_nexus_agent) {
2391 if (!allow_nexus) {
2392 // Hide nexus providers unless allowed
2393 // Direct interfaces and direct policies are allowed to use a nexus
2394 // Delegate interfaces or re-scoped interfaces are not allowed
2395 return applies;
2396 }
2397
2398 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) &&
2399 !(flags & NETAGENT_FLAG_CUSTOM_ETHER_NEXUS)) {
2400 // Client requested a custom ether nexus, but this nexus isn't one
2401 return applies;
2402 }
2403
2404 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP) &&
2405 !(flags & NETAGENT_FLAG_CUSTOM_IP_NEXUS)) {
2406 // Client requested a custom IP nexus, but this nexus isn't one
2407 return applies;
2408 }
2409
2410 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) &&
2411 !(flags & NETAGENT_FLAG_INTERPOSE_NEXUS)) {
2412 // Client requested an interpose nexus, but this nexus isn't one
2413 return applies;
2414 }
2415
2416 if (!(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) &&
2417 !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP) &&
2418 !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) &&
2419 !(flags & NETAGENT_FLAG_NEXUS_PROVIDER)) {
2420 // Client requested default parameters, but this nexus isn't generic
2421 return applies;
2422 }
2423 }
2424
2425 if (uuid_compare(client->failed_trigger_agent.netagent_uuid, *netagent_uuid) == 0) {
2426 if (client->failed_trigger_agent.generation == netagent_get_generation(*netagent_uuid)) {
2427 // If this agent was triggered, and failed, and hasn't changed, keep hiding it
2428 return applies;
2429 } else {
2430 // Mismatch generation, clear out old trigger
2431 uuid_clear(client->failed_trigger_agent.netagent_uuid);
2432 client->failed_trigger_agent.generation = 0;
2433 }
2434 }
2435
2436 if (flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY) {
2437 // Specific use agents only apply when requested
2438 applies = necp_netagent_is_requested(parameters, netagent_uuid);
2439 } else {
2440 applies = TRUE;
2441 }
2442
2443 #if SKYWALK
2444 // Add nexus agent if it is a nexus, and either is not a listener, or the nexus supports listeners
2445 if (applies && is_nexus_agent &&
2446 !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) && // Don't add for browse paths
2447 ((flags & NETAGENT_FLAG_NEXUS_LISTENER) || !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER))) {
2448 necp_client_add_interface_option_if_needed(client, interface_index,
2449 interface_generation, netagent_uuid,
2450 (flags & NETAGENT_FLAG_NETWORK_PROVIDER));
2451 }
2452 #endif /* SKYWALK */
2453
2454 return applies;
2455 }
2456
2457 static void
necp_client_add_agent_interface_options(struct necp_client * client,const struct necp_client_parsed_parameters * parsed_parameters,ifnet_t ifp)2458 necp_client_add_agent_interface_options(struct necp_client *client,
2459 const struct necp_client_parsed_parameters *parsed_parameters,
2460 ifnet_t ifp)
2461 {
2462 if (ifp != NULL && ifp->if_agentids != NULL) {
2463 for (u_int32_t i = 0; i < ifp->if_agentcount; i++) {
2464 if (uuid_is_null(ifp->if_agentids[i])) {
2465 continue;
2466 }
2467 // Relies on the side effect that nexus agents that apply will create flows
2468 (void)necp_netagent_applies_to_client(client, parsed_parameters, &ifp->if_agentids[i], TRUE,
2469 ifp->if_index, ifnet_get_generation(ifp));
2470 }
2471 }
2472 }
2473
2474 static void
necp_client_add_browse_interface_options(struct necp_client * client,const struct necp_client_parsed_parameters * parsed_parameters,ifnet_t ifp)2475 necp_client_add_browse_interface_options(struct necp_client *client,
2476 const struct necp_client_parsed_parameters *parsed_parameters,
2477 ifnet_t ifp)
2478 {
2479 if (ifp != NULL && ifp->if_agentids != NULL) {
2480 for (u_int32_t i = 0; i < ifp->if_agentcount; i++) {
2481 if (uuid_is_null(ifp->if_agentids[i])) {
2482 continue;
2483 }
2484
2485 u_int32_t flags = netagent_get_flags(ifp->if_agentids[i]);
2486 if ((flags & NETAGENT_FLAG_REGISTERED) &&
2487 (flags & NETAGENT_FLAG_ACTIVE) &&
2488 (flags & NETAGENT_FLAG_SUPPORTS_BROWSE) &&
2489 (!(flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY) ||
2490 necp_netagent_is_requested(parsed_parameters, &ifp->if_agentids[i]))) {
2491 necp_client_add_interface_option_if_needed(client, ifp->if_index, ifnet_get_generation(ifp), &ifp->if_agentids[i], (flags & NETAGENT_FLAG_NETWORK_PROVIDER));
2492
2493 // Finding one is enough
2494 break;
2495 }
2496 }
2497 }
2498 }
2499
2500 static inline bool
necp_client_address_is_valid(struct sockaddr * address)2501 necp_client_address_is_valid(struct sockaddr *address)
2502 {
2503 if (address->sa_family == AF_INET) {
2504 return address->sa_len == sizeof(struct sockaddr_in);
2505 } else if (address->sa_family == AF_INET6) {
2506 return address->sa_len == sizeof(struct sockaddr_in6);
2507 } else {
2508 return FALSE;
2509 }
2510 }
2511
2512 static inline bool
necp_client_endpoint_is_unspecified(struct necp_client_endpoint * endpoint)2513 necp_client_endpoint_is_unspecified(struct necp_client_endpoint *endpoint)
2514 {
2515 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2516 if (endpoint->u.sa.sa_family == AF_INET) {
2517 return endpoint->u.sin.sin_addr.s_addr == INADDR_ANY;
2518 } else if (endpoint->u.sa.sa_family == AF_INET6) {
2519 return IN6_IS_ADDR_UNSPECIFIED(&endpoint->u.sin6.sin6_addr);
2520 } else {
2521 return TRUE;
2522 }
2523 } else {
2524 return TRUE;
2525 }
2526 }
2527
2528 #if SKYWALK
2529 static void
necp_client_update_local_port_parameters(u_int8_t * parameters,u_int32_t parameters_size,uint16_t local_port)2530 necp_client_update_local_port_parameters(u_int8_t *parameters,
2531 u_int32_t parameters_size,
2532 uint16_t local_port)
2533 {
2534 size_t offset = 0;
2535 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
2536 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
2537 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
2538
2539 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
2540 // If the length is larger than what can fit in the remaining parameters size, bail
2541 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
2542 break;
2543 }
2544
2545 if (length > 0) {
2546 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
2547 if (value != NULL) {
2548 switch (type) {
2549 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: {
2550 if (length >= sizeof(struct necp_policy_condition_addr)) {
2551 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
2552 if (necp_client_address_is_valid(&address_struct->address.sa)) {
2553 if (address_struct->address.sa.sa_family == AF_INET) {
2554 address_struct->address.sin.sin_port = local_port;
2555 } else if (address_struct->address.sa.sa_family == AF_INET6) {
2556 address_struct->address.sin6.sin6_port = local_port;
2557 }
2558 }
2559 }
2560 break;
2561 }
2562 case NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT: {
2563 if (length >= sizeof(struct necp_client_endpoint)) {
2564 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2565 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2566 if (endpoint->u.sa.sa_family == AF_INET) {
2567 endpoint->u.sin.sin_port = local_port;
2568 } else if (endpoint->u.sa.sa_family == AF_INET6) {
2569 endpoint->u.sin6.sin6_port = local_port;
2570 }
2571 }
2572 }
2573 break;
2574 }
2575 default: {
2576 break;
2577 }
2578 }
2579 }
2580 }
2581
2582 offset += sizeof(struct necp_tlv_header) + length;
2583 }
2584 }
2585 #endif /* !SKYWALK */
2586
2587 #define NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH 253
2588
2589 static void
necp_client_trace_parameter_parsing(struct necp_client * client,u_int8_t type,u_int8_t * value,u_int32_t length)2590 necp_client_trace_parameter_parsing(struct necp_client *client, u_int8_t type, u_int8_t *value, u_int32_t length)
2591 {
2592 uint64_t num = 0;
2593 uint16_t shortBuf;
2594 uint32_t intBuf;
2595 char buffer[NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH + 1];
2596
2597 if (value != NULL && length > 0) {
2598 switch (length) {
2599 case 1:
2600 num = *value;
2601 break;
2602 case 2:
2603 memcpy(&shortBuf, value, sizeof(shortBuf));
2604 num = shortBuf;
2605 break;
2606 case 4:
2607 memcpy(&intBuf, value, sizeof(intBuf));
2608 num = intBuf;
2609 break;
2610 case 8:
2611 memcpy(&num, value, sizeof(num));
2612 break;
2613 default:
2614 num = 0;
2615 break;
2616 }
2617 int len = NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH < length ? NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH : length;
2618 memcpy(buffer, value, len);
2619 buffer[len] = 0;
2620 NECP_CLIENT_PARAMS_LOG(client, "Parsing param - type %d length %d value <%llu (%llX)> %s", type, length, num, num, buffer);
2621 } else {
2622 NECP_CLIENT_PARAMS_LOG(client, "Parsing param - type %d length %d", type, length);
2623 }
2624 }
2625
2626 static void
necp_client_trace_parsed_parameters(struct necp_client * client,struct necp_client_parsed_parameters * parsed_parameters)2627 necp_client_trace_parsed_parameters(struct necp_client *client, struct necp_client_parsed_parameters *parsed_parameters)
2628 {
2629 int i;
2630 char local_buffer[64] = { };
2631 char remote_buffer[64] = { };
2632 uuid_string_t uuid_str = { };
2633 uuid_unparse_lower(parsed_parameters->effective_uuid, uuid_str);
2634
2635 switch (parsed_parameters->local_addr.sa.sa_family) {
2636 case AF_INET:
2637 if (parsed_parameters->local_addr.sa.sa_len == sizeof(struct sockaddr_in)) {
2638 struct sockaddr_in *addr = &parsed_parameters->local_addr.sin;
2639 inet_ntop(AF_INET, &(addr->sin_addr), local_buffer, sizeof(local_buffer));
2640 }
2641 break;
2642 case AF_INET6:
2643 if (parsed_parameters->local_addr.sa.sa_len == sizeof(struct sockaddr_in6)) {
2644 struct sockaddr_in6 *addr6 = &parsed_parameters->local_addr.sin6;
2645 inet_ntop(AF_INET6, &(addr6->sin6_addr), local_buffer, sizeof(local_buffer));
2646 }
2647 break;
2648 default:
2649 break;
2650 }
2651
2652 switch (parsed_parameters->remote_addr.sa.sa_family) {
2653 case AF_INET:
2654 if (parsed_parameters->remote_addr.sa.sa_len == sizeof(struct sockaddr_in)) {
2655 struct sockaddr_in *addr = &parsed_parameters->remote_addr.sin;
2656 inet_ntop(AF_INET, &(addr->sin_addr), remote_buffer, sizeof(remote_buffer));
2657 }
2658 break;
2659 case AF_INET6:
2660 if (parsed_parameters->remote_addr.sa.sa_len == sizeof(struct sockaddr_in6)) {
2661 struct sockaddr_in6 *addr6 = &parsed_parameters->remote_addr.sin6;
2662 inet_ntop(AF_INET6, &(addr6->sin6_addr), remote_buffer, sizeof(remote_buffer));
2663 }
2664 break;
2665 default:
2666 break;
2667 }
2668
2669 NECP_CLIENT_PARAMS_LOG(client, "Parsed params - valid_fields %X flags %X delegated_upid %llu local_addr %s remote_addr %s "
2670 "required_interface_index %u required_interface_type %d local_address_preference %d "
2671 "ip_protocol %d transport_protocol %d ethertype %d effective_pid %d effective_uuid %s traffic_class %d",
2672 parsed_parameters->valid_fields,
2673 parsed_parameters->flags,
2674 parsed_parameters->delegated_upid,
2675 local_buffer, remote_buffer,
2676 parsed_parameters->required_interface_index,
2677 parsed_parameters->required_interface_type,
2678 parsed_parameters->local_address_preference,
2679 parsed_parameters->ip_protocol,
2680 parsed_parameters->transport_protocol,
2681 parsed_parameters->ethertype,
2682 parsed_parameters->effective_pid,
2683 uuid_str,
2684 parsed_parameters->traffic_class);
2685
2686 NECP_CLIENT_PARAMS_LOG(client, "Parsed params - tracker flags <known-tracker %X> <non-app-initiated %X> <silent %X> <app-approved %X>",
2687 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_KNOWN_TRACKER,
2688 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_NON_APP_INITIATED,
2689 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_SILENT,
2690 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_APPROVED_APP_DOMAIN);
2691
2692 for (i = 0; i < NECP_MAX_INTERFACE_PARAMETERS && parsed_parameters->prohibited_interfaces[i][0]; i++) {
2693 NECP_CLIENT_PARAMS_LOG(client, "Parsed prohibited_interfaces[%d] <%s>", i, parsed_parameters->prohibited_interfaces[i]);
2694 }
2695
2696 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->required_netagent_types[i].netagent_domain[0]; i++) {
2697 NECP_CLIENT_PARAMS_LOG(client, "Parsed required_netagent_types[%d] <%s> <%s>", i,
2698 parsed_parameters->required_netagent_types[i].netagent_domain,
2699 parsed_parameters->required_netagent_types[i].netagent_type);
2700 }
2701 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->prohibited_netagent_types[i].netagent_domain[0]; i++) {
2702 NECP_CLIENT_PARAMS_LOG(client, "Parsed prohibited_netagent_types[%d] <%s> <%s>", i,
2703 parsed_parameters->prohibited_netagent_types[i].netagent_domain,
2704 parsed_parameters->prohibited_netagent_types[i].netagent_type);
2705 }
2706 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->preferred_netagent_types[i].netagent_domain[0]; i++) {
2707 NECP_CLIENT_PARAMS_LOG(client, "Parsed preferred_netagent_types[%d] <%s> <%s>", i,
2708 parsed_parameters->preferred_netagent_types[i].netagent_domain,
2709 parsed_parameters->preferred_netagent_types[i].netagent_type);
2710 }
2711 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->avoided_netagent_types[i].netagent_domain[0]; i++) {
2712 NECP_CLIENT_PARAMS_LOG(client, "Parsed avoided_netagent_types[%d] <%s> <%s>", i,
2713 parsed_parameters->avoided_netagent_types[i].netagent_domain,
2714 parsed_parameters->avoided_netagent_types[i].netagent_type);
2715 }
2716
2717 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->required_netagents[i]); i++) {
2718 uuid_unparse_lower(parsed_parameters->required_netagents[i], uuid_str);
2719 NECP_CLIENT_PARAMS_LOG(client, "Parsed required_netagents[%d] <%s>", i, uuid_str);
2720 }
2721 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->prohibited_netagents[i]); i++) {
2722 uuid_unparse_lower(parsed_parameters->prohibited_netagents[i], uuid_str);
2723 NECP_CLIENT_PARAMS_LOG(client, "Parsed prohibited_netagents[%d] <%s>", i, uuid_str);
2724 }
2725 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->preferred_netagents[i]); i++) {
2726 uuid_unparse_lower(parsed_parameters->preferred_netagents[i], uuid_str);
2727 NECP_CLIENT_PARAMS_LOG(client, "Parsed preferred_netagents[%d] <%s>", i, uuid_str);
2728 }
2729 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->avoided_netagents[i]); i++) {
2730 uuid_unparse_lower(parsed_parameters->avoided_netagents[i], uuid_str);
2731 NECP_CLIENT_PARAMS_LOG(client, "Parsed avoided_netagents[%d] <%s>", i, uuid_str);
2732 }
2733 }
2734
2735 static int
necp_client_parse_parameters(struct necp_client * client,u_int8_t * parameters,u_int32_t parameters_size,struct necp_client_parsed_parameters * parsed_parameters)2736 necp_client_parse_parameters(struct necp_client *client, u_int8_t *parameters,
2737 u_int32_t parameters_size,
2738 struct necp_client_parsed_parameters *parsed_parameters)
2739 {
2740 int error = 0;
2741 size_t offset = 0;
2742
2743 u_int32_t num_prohibited_interfaces = 0;
2744 u_int32_t num_prohibited_interface_types = 0;
2745 u_int32_t num_required_agents = 0;
2746 u_int32_t num_prohibited_agents = 0;
2747 u_int32_t num_preferred_agents = 0;
2748 u_int32_t num_avoided_agents = 0;
2749 u_int32_t num_required_agent_types = 0;
2750 u_int32_t num_prohibited_agent_types = 0;
2751 u_int32_t num_preferred_agent_types = 0;
2752 u_int32_t num_avoided_agent_types = 0;
2753 u_int8_t *resolver_tag = NULL;
2754 u_int32_t resolver_tag_length = 0;
2755 u_int8_t *client_hostname = NULL;
2756 u_int32_t hostname_length = 0;
2757 uuid_t parent_id = {};
2758
2759 if (parsed_parameters == NULL) {
2760 return EINVAL;
2761 }
2762
2763 memset(parsed_parameters, 0, sizeof(struct necp_client_parsed_parameters));
2764
2765 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
2766 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
2767 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
2768
2769 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
2770 // If the length is larger than what can fit in the remaining parameters size, bail
2771 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
2772 break;
2773 }
2774
2775 if (length > 0) {
2776 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
2777 if (value != NULL) {
2778 switch (type) {
2779 case NECP_CLIENT_PARAMETER_BOUND_INTERFACE: {
2780 if (length <= IFXNAMSIZ && length > 0) {
2781 ifnet_t bound_interface = NULL;
2782 char interface_name[IFXNAMSIZ];
2783 memcpy(interface_name, value, length);
2784 interface_name[length - 1] = 0; // Make sure the string is NULL terminated
2785 if (ifnet_find_by_name(interface_name, &bound_interface) == 0) {
2786 parsed_parameters->required_interface_index = bound_interface->if_index;
2787 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF;
2788 ifnet_release(bound_interface);
2789 }
2790 }
2791 break;
2792 }
2793 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: {
2794 if (length >= sizeof(struct necp_policy_condition_addr)) {
2795 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
2796 if (necp_client_address_is_valid(&address_struct->address.sa)) {
2797 memcpy(&parsed_parameters->local_addr, &address_struct->address, sizeof(address_struct->address));
2798 if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
2799 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
2800 }
2801 if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
2802 (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
2803 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
2804 }
2805 }
2806 }
2807 break;
2808 }
2809 case NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT: {
2810 if (length >= sizeof(struct necp_client_endpoint)) {
2811 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2812 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2813 memcpy(&parsed_parameters->local_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
2814 if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
2815 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
2816 }
2817 if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
2818 (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
2819 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
2820 }
2821 }
2822 }
2823 break;
2824 }
2825 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
2826 if (length >= sizeof(struct necp_policy_condition_addr)) {
2827 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
2828 if (necp_client_address_is_valid(&address_struct->address.sa)) {
2829 memcpy(&parsed_parameters->remote_addr, &address_struct->address, sizeof(address_struct->address));
2830 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
2831 }
2832 }
2833 break;
2834 }
2835 case NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT: {
2836 if (length >= sizeof(struct necp_client_endpoint)) {
2837 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2838 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2839 memcpy(&parsed_parameters->remote_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
2840 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
2841 }
2842 }
2843 break;
2844 }
2845 case NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE: {
2846 if (num_prohibited_interfaces >= NECP_MAX_INTERFACE_PARAMETERS) {
2847 break;
2848 }
2849 if (length <= IFXNAMSIZ && length > 0) {
2850 memcpy(parsed_parameters->prohibited_interfaces[num_prohibited_interfaces], value, length);
2851 parsed_parameters->prohibited_interfaces[num_prohibited_interfaces][length - 1] = 0; // Make sure the string is NULL terminated
2852 num_prohibited_interfaces++;
2853 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF;
2854 }
2855 break;
2856 }
2857 case NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE: {
2858 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) {
2859 break;
2860 }
2861 if (length >= sizeof(u_int8_t)) {
2862 memcpy(&parsed_parameters->required_interface_type, value, sizeof(u_int8_t));
2863 if (parsed_parameters->required_interface_type) {
2864 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE;
2865 }
2866 }
2867 break;
2868 }
2869 case NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE: {
2870 if (num_prohibited_interface_types >= NECP_MAX_INTERFACE_PARAMETERS) {
2871 break;
2872 }
2873 if (length >= sizeof(u_int8_t)) {
2874 memcpy(&parsed_parameters->prohibited_interface_types[num_prohibited_interface_types], value, sizeof(u_int8_t));
2875 num_prohibited_interface_types++;
2876 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE;
2877 }
2878 break;
2879 }
2880 case NECP_CLIENT_PARAMETER_REQUIRE_AGENT: {
2881 if (num_required_agents >= NECP_MAX_AGENT_PARAMETERS) {
2882 break;
2883 }
2884 if (length >= sizeof(uuid_t)) {
2885 memcpy(&parsed_parameters->required_netagents[num_required_agents], value, sizeof(uuid_t));
2886 num_required_agents++;
2887 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT;
2888 }
2889 break;
2890 }
2891 case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT: {
2892 if (num_prohibited_agents >= NECP_MAX_AGENT_PARAMETERS) {
2893 break;
2894 }
2895 if (length >= sizeof(uuid_t)) {
2896 memcpy(&parsed_parameters->prohibited_netagents[num_prohibited_agents], value, sizeof(uuid_t));
2897 num_prohibited_agents++;
2898 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT;
2899 }
2900 break;
2901 }
2902 case NECP_CLIENT_PARAMETER_PREFER_AGENT: {
2903 if (num_preferred_agents >= NECP_MAX_AGENT_PARAMETERS) {
2904 break;
2905 }
2906 if (length >= sizeof(uuid_t)) {
2907 memcpy(&parsed_parameters->preferred_netagents[num_preferred_agents], value, sizeof(uuid_t));
2908 num_preferred_agents++;
2909 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT;
2910 }
2911 break;
2912 }
2913 case NECP_CLIENT_PARAMETER_AVOID_AGENT: {
2914 if (num_avoided_agents >= NECP_MAX_AGENT_PARAMETERS) {
2915 break;
2916 }
2917 if (length >= sizeof(uuid_t)) {
2918 memcpy(&parsed_parameters->avoided_netagents[num_avoided_agents], value, sizeof(uuid_t));
2919 num_avoided_agents++;
2920 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT;
2921 }
2922 break;
2923 }
2924 case NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE: {
2925 if (num_required_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2926 break;
2927 }
2928 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2929 memcpy(&parsed_parameters->required_netagent_types[num_required_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2930 num_required_agent_types++;
2931 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE;
2932 }
2933 break;
2934 }
2935 case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE: {
2936 if (num_prohibited_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2937 break;
2938 }
2939 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2940 memcpy(&parsed_parameters->prohibited_netagent_types[num_prohibited_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2941 num_prohibited_agent_types++;
2942 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE;
2943 }
2944 break;
2945 }
2946 case NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE: {
2947 if (num_preferred_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2948 break;
2949 }
2950 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2951 memcpy(&parsed_parameters->preferred_netagent_types[num_preferred_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2952 num_preferred_agent_types++;
2953 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE;
2954 }
2955 break;
2956 }
2957 case NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE: {
2958 if (num_avoided_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2959 break;
2960 }
2961 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2962 memcpy(&parsed_parameters->avoided_netagent_types[num_avoided_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2963 num_avoided_agent_types++;
2964 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE;
2965 }
2966 break;
2967 }
2968 case NECP_CLIENT_PARAMETER_FLAGS: {
2969 if (length >= sizeof(u_int32_t)) {
2970 memcpy(&parsed_parameters->flags, value, sizeof(parsed_parameters->flags));
2971 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_FLAGS;
2972 }
2973 break;
2974 }
2975 case NECP_CLIENT_PARAMETER_IP_PROTOCOL: {
2976 if (length == sizeof(u_int16_t)) {
2977 u_int16_t large_ip_protocol = 0;
2978 memcpy(&large_ip_protocol, value, sizeof(large_ip_protocol));
2979 parsed_parameters->ip_protocol = (u_int8_t)large_ip_protocol;
2980 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL;
2981 } else if (length >= sizeof(parsed_parameters->ip_protocol)) {
2982 memcpy(&parsed_parameters->ip_protocol, value, sizeof(parsed_parameters->ip_protocol));
2983 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL;
2984 }
2985 break;
2986 }
2987 case NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL: {
2988 if (length >= sizeof(parsed_parameters->transport_protocol)) {
2989 memcpy(&parsed_parameters->transport_protocol, value, sizeof(parsed_parameters->transport_protocol));
2990 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL;
2991 }
2992 break;
2993 }
2994 case NECP_CLIENT_PARAMETER_PID: {
2995 if (length >= sizeof(parsed_parameters->effective_pid)) {
2996 memcpy(&parsed_parameters->effective_pid, value, sizeof(parsed_parameters->effective_pid));
2997 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID;
2998 }
2999 break;
3000 }
3001 case NECP_CLIENT_PARAMETER_DELEGATED_UPID: {
3002 if (length >= sizeof(parsed_parameters->delegated_upid)) {
3003 memcpy(&parsed_parameters->delegated_upid, value, sizeof(parsed_parameters->delegated_upid));
3004 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID;
3005 }
3006 break;
3007 }
3008 case NECP_CLIENT_PARAMETER_ETHERTYPE: {
3009 if (length >= sizeof(parsed_parameters->ethertype)) {
3010 memcpy(&parsed_parameters->ethertype, value, sizeof(parsed_parameters->ethertype));
3011 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_ETHERTYPE;
3012 }
3013 break;
3014 }
3015 case NECP_CLIENT_PARAMETER_APPLICATION: {
3016 if (length >= sizeof(parsed_parameters->effective_uuid)) {
3017 memcpy(&parsed_parameters->effective_uuid, value, sizeof(parsed_parameters->effective_uuid));
3018 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID;
3019 }
3020 break;
3021 }
3022 case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: {
3023 if (length >= sizeof(parsed_parameters->traffic_class)) {
3024 memcpy(&parsed_parameters->traffic_class, value, sizeof(parsed_parameters->traffic_class));
3025 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS;
3026 }
3027 break;
3028 }
3029 case NECP_CLIENT_PARAMETER_RESOLVER_TAG: {
3030 if (length > 0) {
3031 resolver_tag = (u_int8_t *)value;
3032 resolver_tag_length = length;
3033 }
3034 break;
3035 }
3036 case NECP_CLIENT_PARAMETER_DOMAIN: {
3037 if (length > 0) {
3038 client_hostname = (u_int8_t *)value;
3039 hostname_length = length;
3040 }
3041 break;
3042 }
3043 case NECP_CLIENT_PARAMETER_PARENT_ID: {
3044 if (length == sizeof(parent_id)) {
3045 uuid_copy(parent_id, value);
3046 memcpy(&parsed_parameters->parent_uuid, value, sizeof(parsed_parameters->parent_uuid));
3047 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PARENT_UUID;
3048 }
3049 break;
3050 }
3051 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE: {
3052 if (length >= sizeof(parsed_parameters->local_address_preference)) {
3053 memcpy(&parsed_parameters->local_address_preference, value, sizeof(parsed_parameters->local_address_preference));
3054 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE;
3055 }
3056 break;
3057 }
3058 case NECP_CLIENT_PARAMETER_ATTRIBUTED_BUNDLE_IDENTIFIER: {
3059 if (length > 0) {
3060 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER;
3061 }
3062 break;
3063 }
3064 default: {
3065 break;
3066 }
3067 }
3068 }
3069
3070 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) {
3071 necp_client_trace_parameter_parsing(client, type, value, length);
3072 }
3073 }
3074
3075 offset += sizeof(struct necp_tlv_header) + length;
3076 }
3077
3078 if (resolver_tag != NULL) {
3079 union necp_sockaddr_union remote_addr;
3080 memcpy(&remote_addr, &parsed_parameters->remote_addr, sizeof(remote_addr));
3081 remote_addr.sin.sin_port = 0;
3082 const bool validated = necp_validate_resolver_answer(parent_id,
3083 client_hostname, hostname_length,
3084 (u_int8_t *)&remote_addr, sizeof(remote_addr),
3085 resolver_tag, resolver_tag_length);
3086 if (!validated) {
3087 error = EAUTH;
3088 NECPLOG(LOG_ERR, "Failed to validate answer for hostname %s", client_hostname);
3089 }
3090 }
3091
3092 // Log if it is a known tracker
3093 if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_KNOWN_TRACKER && client) {
3094 NECP_CLIENT_TRACKER_LOG(client->proc_pid, "Parsing tracker flags - known-tracker %X non-app-initiated %X silent %X approved-app-domain %X",
3095 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_KNOWN_TRACKER,
3096 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_NON_APP_INITIATED,
3097 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_SILENT,
3098 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_APPROVED_APP_DOMAIN);
3099 }
3100
3101 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) {
3102 necp_client_trace_parsed_parameters(client, parsed_parameters);
3103 }
3104
3105 return error;
3106 }
3107
3108 static int
necp_client_parse_result(u_int8_t * result,u_int32_t result_size,union necp_sockaddr_union * local_address,union necp_sockaddr_union * remote_address,void ** flow_stats)3109 necp_client_parse_result(u_int8_t *result,
3110 u_int32_t result_size,
3111 union necp_sockaddr_union *local_address,
3112 union necp_sockaddr_union *remote_address,
3113 void **flow_stats)
3114 {
3115 #pragma unused(flow_stats)
3116 int error = 0;
3117 size_t offset = 0;
3118
3119 while ((offset + sizeof(struct necp_tlv_header)) <= result_size) {
3120 u_int8_t type = necp_buffer_get_tlv_type(result, offset);
3121 u_int32_t length = necp_buffer_get_tlv_length(result, offset);
3122
3123 if (length > 0 && (offset + sizeof(struct necp_tlv_header) + length) <= result_size) {
3124 u_int8_t *value = necp_buffer_get_tlv_value(result, offset, NULL);
3125 if (value != NULL) {
3126 switch (type) {
3127 case NECP_CLIENT_RESULT_LOCAL_ENDPOINT: {
3128 if (length >= sizeof(struct necp_client_endpoint)) {
3129 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
3130 if (local_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
3131 memcpy(local_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
3132 }
3133 }
3134 break;
3135 }
3136 case NECP_CLIENT_RESULT_REMOTE_ENDPOINT: {
3137 if (length >= sizeof(struct necp_client_endpoint)) {
3138 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
3139 if (remote_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
3140 memcpy(remote_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
3141 }
3142 }
3143 break;
3144 }
3145 #if SKYWALK
3146 case NECP_CLIENT_RESULT_NEXUS_FLOW_STATS: {
3147 // this TLV contains flow_stats pointer which is refcnt'ed.
3148 if (length >= sizeof(struct sk_stats_flow *)) {
3149 struct flow_stats *fs = *(void **)(void *)value;
3150 if (flow_stats != NULL) {
3151 // transfer the refcnt to flow_stats pointer
3152 *flow_stats = fs;
3153 } else {
3154 // otherwise, release the refcnt
3155 VERIFY(fs != NULL);
3156 flow_stats_release(fs);
3157 }
3158 memset(value, 0, sizeof(struct flow_stats*)); // nullify TLV always
3159 }
3160 break;
3161 }
3162 #endif /* SKYWALK */
3163 default: {
3164 break;
3165 }
3166 }
3167 }
3168 }
3169
3170 offset += sizeof(struct necp_tlv_header) + length;
3171 }
3172
3173 return error;
3174 }
3175
3176 static struct necp_client_flow_registration *
necp_client_create_flow_registration(struct necp_fd_data * fd_data,struct necp_client * client)3177 necp_client_create_flow_registration(struct necp_fd_data *fd_data, struct necp_client *client)
3178 {
3179 NECP_FD_ASSERT_LOCKED(fd_data);
3180 NECP_CLIENT_ASSERT_LOCKED(client);
3181
3182 struct necp_client_flow_registration *new_registration = mcache_alloc(necp_flow_registration_cache, MCR_SLEEP);
3183 if (new_registration == NULL) {
3184 return NULL;
3185 }
3186
3187 memset(new_registration, 0, sizeof(*new_registration));
3188
3189 new_registration->last_interface_details = combine_interface_details(IFSCOPE_NONE, NSTAT_IFNET_IS_UNKNOWN_TYPE);
3190
3191 necp_generate_client_id(new_registration->registration_id, true);
3192 LIST_INIT(&new_registration->flow_list);
3193
3194 // Add registration to client list
3195 RB_INSERT(_necp_client_flow_tree, &client->flow_registrations, new_registration);
3196
3197 // Add registration to fd list
3198 RB_INSERT(_necp_fd_flow_tree, &fd_data->flows, new_registration);
3199
3200 // Add registration to global tree for lookup
3201 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
3202 RB_INSERT(_necp_client_flow_global_tree, &necp_client_flow_global_tree, new_registration);
3203 NECP_FLOW_TREE_UNLOCK();
3204
3205 new_registration->client = client;
3206
3207 #if SKYWALK
3208 {
3209 // The uuid caching here is something of a hack, but saves a dynamic lookup with attendant lock hierarchy issues
3210 uint64_t stats_event_type = (uuid_is_null(client->latest_flow_registration_id)) ? NSTAT_EVENT_SRC_FLOW_UUID_ASSIGNED : NSTAT_EVENT_SRC_FLOW_UUID_CHANGED;
3211 uuid_copy(client->latest_flow_registration_id, new_registration->registration_id);
3212
3213 // With the flow uuid known, push a new statistics update to ensure the uuid gets known by any clients before the flow can close
3214 if (client->nstat_context != NULL) {
3215 nstat_provider_stats_event(client->nstat_context, stats_event_type);
3216 }
3217 }
3218 #endif /* !SKYWALK */
3219
3220 // Start out assuming there is nothing to read from the flow
3221 new_registration->flow_result_read = true;
3222
3223 return new_registration;
3224 }
3225
3226 static void
necp_client_add_socket_flow(struct necp_client_flow_registration * flow_registration,struct inpcb * inp)3227 necp_client_add_socket_flow(struct necp_client_flow_registration *flow_registration,
3228 struct inpcb *inp)
3229 {
3230 struct necp_client_flow *new_flow = mcache_alloc(necp_flow_cache, MCR_SLEEP);
3231 if (new_flow == NULL) {
3232 NECPLOG0(LOG_ERR, "Failed to allocate socket flow");
3233 return;
3234 }
3235
3236 memset(new_flow, 0, sizeof(*new_flow));
3237
3238 new_flow->socket = TRUE;
3239 new_flow->u.socket_handle = inp;
3240 new_flow->u.cb = inp->necp_cb;
3241
3242 OSIncrementAtomic(&necp_socket_flow_count);
3243
3244 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
3245 }
3246
3247 static int
necp_client_register_socket_inner(pid_t pid,uuid_t client_id,struct inpcb * inp,bool is_listener)3248 necp_client_register_socket_inner(pid_t pid, uuid_t client_id, struct inpcb *inp, bool is_listener)
3249 {
3250 int error = 0;
3251 struct necp_fd_data *client_fd = NULL;
3252 bool found_client = FALSE;
3253
3254 NECP_FD_LIST_LOCK_SHARED();
3255 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3256 NECP_FD_LOCK(client_fd);
3257 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3258 if (client != NULL) {
3259 if (!pid || client->proc_pid == pid) {
3260 if (is_listener) {
3261 found_client = TRUE;
3262 #if SKYWALK
3263 // Check netns token for registration
3264 if (!NETNS_TOKEN_VALID(&client->port_reservation)) {
3265 error = EINVAL;
3266 }
3267 #endif /* !SKYWALK */
3268 } else {
3269 // Find client flow and assign from socket
3270 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3271 if (flow_registration != NULL) {
3272 // Found the right client and flow registration, add a new flow
3273 found_client = TRUE;
3274 necp_client_add_socket_flow(flow_registration, inp);
3275 } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
3276 // No flows yet on this client, add a new registration
3277 flow_registration = necp_client_create_flow_registration(client_fd, client);
3278 if (flow_registration == NULL) {
3279 error = ENOMEM;
3280 } else {
3281 // Add a new flow
3282 found_client = TRUE;
3283 necp_client_add_socket_flow(flow_registration, inp);
3284 }
3285 }
3286 }
3287 }
3288
3289 NECP_CLIENT_UNLOCK(client);
3290 }
3291 NECP_FD_UNLOCK(client_fd);
3292
3293 if (found_client) {
3294 break;
3295 }
3296 }
3297 NECP_FD_LIST_UNLOCK();
3298
3299 if (!found_client) {
3300 error = ENOENT;
3301 } else {
3302 // Count the sockets that have the NECP client UUID set
3303 struct socket *so = inp->inp_socket;
3304 if (!(so->so_flags1 & SOF1_HAS_NECP_CLIENT_UUID)) {
3305 so->so_flags1 |= SOF1_HAS_NECP_CLIENT_UUID;
3306 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_necp_clientuuid_total);
3307 }
3308 }
3309
3310 return error;
3311 }
3312
3313 int
necp_client_register_socket_flow(pid_t pid,uuid_t client_id,struct inpcb * inp)3314 necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp)
3315 {
3316 return necp_client_register_socket_inner(pid, client_id, inp, false);
3317 }
3318
3319 int
necp_client_register_socket_listener(pid_t pid,uuid_t client_id,struct inpcb * inp)3320 necp_client_register_socket_listener(pid_t pid, uuid_t client_id, struct inpcb *inp)
3321 {
3322 return necp_client_register_socket_inner(pid, client_id, inp, true);
3323 }
3324
3325 #if SKYWALK
3326 int
necp_client_get_netns_flow_info(uuid_t client_id,struct ns_flow_info * flow_info)3327 necp_client_get_netns_flow_info(uuid_t client_id, struct ns_flow_info *flow_info)
3328 {
3329 int error = 0;
3330 struct necp_fd_data *client_fd = NULL;
3331 bool found_client = FALSE;
3332
3333 NECP_FD_LIST_LOCK_SHARED();
3334 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3335 NECP_FD_LOCK(client_fd);
3336 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3337 if (client != NULL) {
3338 found_client = TRUE;
3339 if (!NETNS_TOKEN_VALID(&client->port_reservation)) {
3340 error = EINVAL;
3341 } else {
3342 error = netns_get_flow_info(&client->port_reservation, flow_info);
3343 }
3344
3345 NECP_CLIENT_UNLOCK(client);
3346 }
3347 NECP_FD_UNLOCK(client_fd);
3348
3349 if (found_client) {
3350 break;
3351 }
3352 }
3353 NECP_FD_LIST_UNLOCK();
3354
3355 if (!found_client) {
3356 error = ENOENT;
3357 }
3358
3359 return error;
3360 }
3361 #endif /* !SKYWALK */
3362
3363 static void
necp_client_add_multipath_interface_flows(struct necp_client_flow_registration * flow_registration,struct necp_client * client,struct mppcb * mpp)3364 necp_client_add_multipath_interface_flows(struct necp_client_flow_registration *flow_registration,
3365 struct necp_client *client,
3366 struct mppcb *mpp)
3367 {
3368 flow_registration->interface_handle = mpp;
3369 flow_registration->interface_cb = mpp->necp_cb;
3370
3371 proc_t proc = proc_find(client->proc_pid);
3372 if (proc == PROC_NULL) {
3373 return;
3374 }
3375
3376 // Traverse all interfaces and add a tracking flow if needed
3377 necp_flow_add_interface_flows(proc, client, flow_registration, true);
3378
3379 proc_rele(proc);
3380 proc = PROC_NULL;
3381 }
3382
3383 int
necp_client_register_multipath_cb(pid_t pid,uuid_t client_id,struct mppcb * mpp)3384 necp_client_register_multipath_cb(pid_t pid, uuid_t client_id, struct mppcb *mpp)
3385 {
3386 int error = 0;
3387 struct necp_fd_data *client_fd = NULL;
3388 bool found_client = FALSE;
3389
3390 NECP_FD_LIST_LOCK_SHARED();
3391 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3392 NECP_FD_LOCK(client_fd);
3393 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3394 if (client != NULL) {
3395 if (!pid || client->proc_pid == pid) {
3396 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3397 if (flow_registration != NULL) {
3398 // Found the right client and flow registration, add a new flow
3399 found_client = TRUE;
3400 necp_client_add_multipath_interface_flows(flow_registration, client, mpp);
3401 } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
3402 // No flows yet on this client, add a new registration
3403 flow_registration = necp_client_create_flow_registration(client_fd, client);
3404 if (flow_registration == NULL) {
3405 error = ENOMEM;
3406 } else {
3407 // Add a new flow
3408 found_client = TRUE;
3409 necp_client_add_multipath_interface_flows(flow_registration, client, mpp);
3410 }
3411 }
3412 }
3413
3414 NECP_CLIENT_UNLOCK(client);
3415 }
3416 NECP_FD_UNLOCK(client_fd);
3417
3418 if (found_client) {
3419 break;
3420 }
3421 }
3422 NECP_FD_LIST_UNLOCK();
3423
3424 if (!found_client && error == 0) {
3425 error = ENOENT;
3426 }
3427
3428 return error;
3429 }
3430
3431 #define NETAGENT_DOMAIN_RADIO_MANAGER "WirelessRadioManager"
3432 #define NETAGENT_TYPE_RADIO_MANAGER "WirelessRadioManager:BB Manager"
3433
3434 static int
necp_client_lookup_bb_radio_manager(struct necp_client * client,uuid_t netagent_uuid)3435 necp_client_lookup_bb_radio_manager(struct necp_client *client,
3436 uuid_t netagent_uuid)
3437 {
3438 char netagent_domain[NETAGENT_DOMAINSIZE];
3439 char netagent_type[NETAGENT_TYPESIZE];
3440 struct necp_aggregate_result result;
3441 proc_t proc;
3442 int error;
3443
3444 proc = proc_find(client->proc_pid);
3445 if (proc == PROC_NULL) {
3446 return ESRCH;
3447 }
3448
3449 error = necp_application_find_policy_match_internal(proc, client->parameters, (u_int32_t)client->parameters_length,
3450 &result, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL, true, true, NULL);
3451
3452 proc_rele(proc);
3453 proc = PROC_NULL;
3454
3455 if (error) {
3456 return error;
3457 }
3458
3459 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
3460 if (uuid_is_null(result.netagents[i])) {
3461 // Passed end of valid agents
3462 break;
3463 }
3464
3465 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
3466 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
3467 if (netagent_get_agent_domain_and_type(result.netagents[i], netagent_domain, netagent_type) == FALSE) {
3468 continue;
3469 }
3470
3471 if (strncmp(netagent_domain, NETAGENT_DOMAIN_RADIO_MANAGER, NETAGENT_DOMAINSIZE) != 0) {
3472 continue;
3473 }
3474
3475 if (strncmp(netagent_type, NETAGENT_TYPE_RADIO_MANAGER, NETAGENT_TYPESIZE) != 0) {
3476 continue;
3477 }
3478
3479 uuid_copy(netagent_uuid, result.netagents[i]);
3480
3481 break;
3482 }
3483
3484 return 0;
3485 }
3486
3487 static int
necp_client_assert_bb_radio_manager_common(struct necp_client * client,bool assert)3488 necp_client_assert_bb_radio_manager_common(struct necp_client *client, bool assert)
3489 {
3490 uuid_t netagent_uuid;
3491 uint8_t assert_type;
3492 int error;
3493
3494 error = necp_client_lookup_bb_radio_manager(client, netagent_uuid);
3495 if (error) {
3496 NECPLOG0(LOG_ERR, "BB radio manager agent not found");
3497 return error;
3498 }
3499
3500 // Before unasserting, verify that the assertion was already taken
3501 if (assert == FALSE) {
3502 assert_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
3503
3504 if (!necp_client_remove_assertion(client, netagent_uuid)) {
3505 return EINVAL;
3506 }
3507 } else {
3508 assert_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT;
3509 }
3510
3511 error = netagent_client_message(netagent_uuid, client->client_id, client->proc_pid, client->agent_handle, assert_type);
3512 if (error) {
3513 NECPLOG0(LOG_ERR, "netagent_client_message failed");
3514 return error;
3515 }
3516
3517 // Only save the assertion if the action succeeded
3518 if (assert == TRUE) {
3519 necp_client_add_assertion(client, netagent_uuid);
3520 }
3521
3522 return 0;
3523 }
3524
3525 int
necp_client_assert_bb_radio_manager(uuid_t client_id,bool assert)3526 necp_client_assert_bb_radio_manager(uuid_t client_id, bool assert)
3527 {
3528 struct necp_client *client;
3529 int error = 0;
3530
3531 NECP_CLIENT_TREE_LOCK_SHARED();
3532
3533 client = necp_find_client_and_lock(client_id);
3534
3535 if (client) {
3536 // Found the right client!
3537 error = necp_client_assert_bb_radio_manager_common(client, assert);
3538
3539 NECP_CLIENT_UNLOCK(client);
3540 } else {
3541 NECPLOG0(LOG_ERR, "Couldn't find client");
3542 error = ENOENT;
3543 }
3544
3545 NECP_CLIENT_TREE_UNLOCK();
3546
3547 return error;
3548 }
3549
3550 static int
necp_client_unregister_socket_flow(uuid_t client_id,void * handle)3551 necp_client_unregister_socket_flow(uuid_t client_id, void *handle)
3552 {
3553 int error = 0;
3554 struct necp_fd_data *client_fd = NULL;
3555 bool found_client = FALSE;
3556 bool client_updated = FALSE;
3557
3558 NECP_FD_LIST_LOCK_SHARED();
3559 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3560 NECP_FD_LOCK(client_fd);
3561
3562 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3563 if (client != NULL) {
3564 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3565 if (flow_registration != NULL) {
3566 // Found the right client and flow!
3567 found_client = TRUE;
3568
3569 // Remove flow assignment
3570 struct necp_client_flow *search_flow = NULL;
3571 struct necp_client_flow *temp_flow = NULL;
3572 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
3573 if (search_flow->socket && search_flow->u.socket_handle == handle) {
3574 if (search_flow->assigned_results != NULL) {
3575 kfree_data(search_flow->assigned_results, search_flow->assigned_results_length);
3576 search_flow->assigned_results = NULL;
3577 }
3578 client_updated = TRUE;
3579 flow_registration->flow_result_read = FALSE;
3580 LIST_REMOVE(search_flow, flow_chain);
3581 OSDecrementAtomic(&necp_socket_flow_count);
3582 mcache_free(necp_flow_cache, search_flow);
3583 }
3584 }
3585 }
3586
3587 NECP_CLIENT_UNLOCK(client);
3588 }
3589
3590 if (client_updated) {
3591 necp_fd_notify(client_fd, true);
3592 }
3593 NECP_FD_UNLOCK(client_fd);
3594
3595 if (found_client) {
3596 break;
3597 }
3598 }
3599 NECP_FD_LIST_UNLOCK();
3600
3601 if (!found_client) {
3602 error = ENOENT;
3603 }
3604
3605 return error;
3606 }
3607
3608 static int
necp_client_unregister_multipath_cb(uuid_t client_id,void * handle)3609 necp_client_unregister_multipath_cb(uuid_t client_id, void *handle)
3610 {
3611 int error = 0;
3612 bool found_client = FALSE;
3613
3614 NECP_CLIENT_TREE_LOCK_SHARED();
3615
3616 struct necp_client *client = necp_find_client_and_lock(client_id);
3617 if (client != NULL) {
3618 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3619 if (flow_registration != NULL) {
3620 // Found the right client and flow!
3621 found_client = TRUE;
3622
3623 // Remove flow assignment
3624 struct necp_client_flow *search_flow = NULL;
3625 struct necp_client_flow *temp_flow = NULL;
3626 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
3627 if (!search_flow->socket && !search_flow->nexus &&
3628 search_flow->u.socket_handle == handle) {
3629 search_flow->u.socket_handle = NULL;
3630 search_flow->u.cb = NULL;
3631 }
3632 }
3633
3634 flow_registration->interface_handle = NULL;
3635 flow_registration->interface_cb = NULL;
3636 }
3637
3638 NECP_CLIENT_UNLOCK(client);
3639 }
3640
3641 NECP_CLIENT_TREE_UNLOCK();
3642
3643 if (!found_client) {
3644 error = ENOENT;
3645 }
3646
3647 return error;
3648 }
3649
3650 int
necp_client_assign_from_socket(pid_t pid,uuid_t client_id,struct inpcb * inp)3651 necp_client_assign_from_socket(pid_t pid, uuid_t client_id, struct inpcb *inp)
3652 {
3653 int error = 0;
3654 struct necp_fd_data *client_fd = NULL;
3655 bool found_client = FALSE;
3656 bool client_updated = FALSE;
3657
3658 NECP_FD_LIST_LOCK_SHARED();
3659 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3660 if (pid && client_fd->proc_pid != pid) {
3661 continue;
3662 }
3663
3664 proc_t proc = proc_find(client_fd->proc_pid);
3665 if (proc == PROC_NULL) {
3666 continue;
3667 }
3668
3669 NECP_FD_LOCK(client_fd);
3670
3671 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3672 if (client != NULL) {
3673 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3674 if (flow_registration == NULL && RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
3675 // No flows yet on this client, add a new registration
3676 flow_registration = necp_client_create_flow_registration(client_fd, client);
3677 if (flow_registration == NULL) {
3678 error = ENOMEM;
3679 }
3680 }
3681 if (flow_registration != NULL) {
3682 // Found the right client and flow!
3683 found_client = TRUE;
3684
3685 struct necp_client_flow *flow = NULL;
3686 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
3687 if (flow->socket && flow->u.socket_handle == inp) {
3688 // Release prior results and route
3689 if (flow->assigned_results != NULL) {
3690 kfree_data(flow->assigned_results, flow->assigned_results_length);
3691 flow->assigned_results = NULL;
3692 }
3693
3694 ifnet_t ifp = NULL;
3695 if ((inp->inp_flags & INP_BOUND_IF) && inp->inp_boundifp) {
3696 ifp = inp->inp_boundifp;
3697 } else {
3698 ifp = inp->inp_last_outifp;
3699 }
3700
3701 if (ifp != NULL) {
3702 flow->interface_index = ifp->if_index;
3703 } else {
3704 flow->interface_index = IFSCOPE_NONE;
3705 }
3706
3707 if (inp->inp_vflag & INP_IPV4) {
3708 flow->local_addr.sin.sin_family = AF_INET;
3709 flow->local_addr.sin.sin_len = sizeof(struct sockaddr_in);
3710 flow->local_addr.sin.sin_port = inp->inp_lport;
3711 memcpy(&flow->local_addr.sin.sin_addr, &inp->inp_laddr, sizeof(struct in_addr));
3712
3713 flow->remote_addr.sin.sin_family = AF_INET;
3714 flow->remote_addr.sin.sin_len = sizeof(struct sockaddr_in);
3715 flow->remote_addr.sin.sin_port = inp->inp_fport;
3716 memcpy(&flow->remote_addr.sin.sin_addr, &inp->inp_faddr, sizeof(struct in_addr));
3717 } else if (inp->inp_vflag & INP_IPV6) {
3718 in6_ip6_to_sockaddr(&inp->in6p_laddr, inp->inp_lport, inp->inp_lifscope, &flow->local_addr.sin6, sizeof(flow->local_addr));
3719 in6_ip6_to_sockaddr(&inp->in6p_faddr, inp->inp_fport, inp->inp_fifscope, &flow->remote_addr.sin6, sizeof(flow->remote_addr));
3720 }
3721
3722 flow->viable = necp_client_flow_is_viable(proc, client, flow);
3723
3724 uuid_t empty_uuid;
3725 uuid_clear(empty_uuid);
3726 flow->assigned = TRUE;
3727 flow->assigned_results = necp_create_nexus_assign_message(empty_uuid, 0, NULL, 0,
3728 (struct necp_client_endpoint *)&flow->local_addr,
3729 (struct necp_client_endpoint *)&flow->remote_addr,
3730 NULL, 0, NULL, &flow->assigned_results_length);
3731 flow_registration->flow_result_read = FALSE;
3732 client_updated = TRUE;
3733 break;
3734 }
3735 }
3736 }
3737
3738 NECP_CLIENT_UNLOCK(client);
3739 }
3740 if (client_updated) {
3741 necp_fd_notify(client_fd, true);
3742 }
3743 NECP_FD_UNLOCK(client_fd);
3744
3745 proc_rele(proc);
3746 proc = PROC_NULL;
3747
3748 if (found_client) {
3749 break;
3750 }
3751 }
3752 NECP_FD_LIST_UNLOCK();
3753
3754 if (error == 0) {
3755 if (!found_client) {
3756 error = ENOENT;
3757 } else if (!client_updated) {
3758 error = EINVAL;
3759 }
3760 }
3761
3762 return error;
3763 }
3764
3765 bool
necp_socket_is_allowed_to_recv_on_interface(struct inpcb * inp,ifnet_t interface)3766 necp_socket_is_allowed_to_recv_on_interface(struct inpcb *inp, ifnet_t interface)
3767 {
3768 if (interface == NULL ||
3769 inp == NULL ||
3770 !(inp->inp_flags2 & INP2_EXTERNAL_PORT) ||
3771 uuid_is_null(inp->necp_client_uuid)) {
3772 // If there's no interface or client ID to check,
3773 // or if this is not a listener, pass.
3774 // Outbound connections will have already been
3775 // validated for policy.
3776 return TRUE;
3777 }
3778
3779 // Only filter out listener sockets (no remote address specified)
3780 if ((inp->inp_vflag & INP_IPV4) &&
3781 inp->inp_faddr.s_addr != INADDR_ANY) {
3782 return TRUE;
3783 }
3784 if ((inp->inp_vflag & INP_IPV6) &&
3785 !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
3786 return TRUE;
3787 }
3788
3789 bool allowed = TRUE;
3790
3791 NECP_CLIENT_TREE_LOCK_SHARED();
3792
3793 struct necp_client *client = necp_find_client_and_lock(inp->necp_client_uuid);
3794 if (client != NULL) {
3795 struct necp_client_parsed_parameters *parsed_parameters = NULL;
3796
3797 parsed_parameters = kalloc_type(struct necp_client_parsed_parameters,
3798 Z_WAITOK | Z_ZERO | Z_NOFAIL);
3799 int error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, parsed_parameters);
3800 if (error == 0) {
3801 if (!necp_ifnet_matches_parameters(interface, parsed_parameters, 0, NULL, true, false)) {
3802 allowed = FALSE;
3803 }
3804 }
3805 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
3806
3807 NECP_CLIENT_UNLOCK(client);
3808 }
3809
3810 NECP_CLIENT_TREE_UNLOCK();
3811
3812 return allowed;
3813 }
3814
3815 int
necp_update_flow_protoctl_event(uuid_t netagent_uuid,uuid_t client_id,uint32_t protoctl_event_code,uint32_t protoctl_event_val,uint32_t protoctl_event_tcp_seq_number)3816 necp_update_flow_protoctl_event(uuid_t netagent_uuid, uuid_t client_id,
3817 uint32_t protoctl_event_code, uint32_t protoctl_event_val,
3818 uint32_t protoctl_event_tcp_seq_number)
3819 {
3820 int error = 0;
3821 struct necp_fd_data *client_fd = NULL;
3822 bool found_client = FALSE;
3823 bool client_updated = FALSE;
3824
3825 NECP_FD_LIST_LOCK_SHARED();
3826 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3827 proc_t proc = proc_find(client_fd->proc_pid);
3828 if (proc == PROC_NULL) {
3829 continue;
3830 }
3831
3832 NECP_FD_LOCK(client_fd);
3833
3834 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3835 if (client != NULL) {
3836 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3837 if (flow_registration != NULL) {
3838 // Found the right client and flow!
3839 found_client = TRUE;
3840
3841 struct necp_client_flow *flow = NULL;
3842 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
3843 // Verify that the client nexus agent matches
3844 if ((flow->nexus && uuid_compare(flow->u.nexus_agent, netagent_uuid) == 0) ||
3845 flow->socket) {
3846 flow->has_protoctl_event = TRUE;
3847 flow->protoctl_event.protoctl_event_code = protoctl_event_code;
3848 flow->protoctl_event.protoctl_event_val = protoctl_event_val;
3849 flow->protoctl_event.protoctl_event_tcp_seq_num = protoctl_event_tcp_seq_number;
3850 flow_registration->flow_result_read = FALSE;
3851 client_updated = TRUE;
3852 break;
3853 }
3854 }
3855 }
3856
3857 NECP_CLIENT_UNLOCK(client);
3858 }
3859
3860 if (client_updated) {
3861 necp_fd_notify(client_fd, true);
3862 }
3863
3864 NECP_FD_UNLOCK(client_fd);
3865 proc_rele(proc);
3866 proc = PROC_NULL;
3867
3868 if (found_client) {
3869 break;
3870 }
3871 }
3872 NECP_FD_LIST_UNLOCK();
3873
3874 if (!found_client) {
3875 error = ENOENT;
3876 } else if (!client_updated) {
3877 error = EINVAL;
3878 }
3879 return error;
3880 }
3881
3882 static bool
necp_assign_client_result_locked(struct proc * proc,struct necp_fd_data * client_fd,struct necp_client * client,struct necp_client_flow_registration * flow_registration,uuid_t netagent_uuid,u_int8_t * assigned_results,size_t assigned_results_length,bool notify_fd)3883 necp_assign_client_result_locked(struct proc *proc,
3884 struct necp_fd_data *client_fd,
3885 struct necp_client *client,
3886 struct necp_client_flow_registration *flow_registration,
3887 uuid_t netagent_uuid,
3888 u_int8_t *assigned_results,
3889 size_t assigned_results_length,
3890 bool notify_fd)
3891 {
3892 bool client_updated = FALSE;
3893
3894 NECP_FD_ASSERT_LOCKED(client_fd);
3895 NECP_CLIENT_ASSERT_LOCKED(client);
3896
3897 struct necp_client_flow *flow = NULL;
3898 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
3899 // Verify that the client nexus agent matches
3900 if (flow->nexus &&
3901 uuid_compare(flow->u.nexus_agent, netagent_uuid) == 0) {
3902 // Release prior results and route
3903 if (flow->assigned_results != NULL) {
3904 kfree_data(flow->assigned_results, flow->assigned_results_length);
3905 flow->assigned_results = NULL;
3906 }
3907
3908 void *nexus_stats = NULL;
3909 if (assigned_results != NULL && assigned_results_length > 0) {
3910 int error = necp_client_parse_result(assigned_results, (u_int32_t)assigned_results_length,
3911 &flow->local_addr, &flow->remote_addr, &nexus_stats);
3912 VERIFY(error == 0);
3913 }
3914
3915 flow->viable = necp_client_flow_is_viable(proc, client, flow);
3916
3917 flow->assigned = TRUE;
3918 flow->assigned_results = assigned_results;
3919 flow->assigned_results_length = assigned_results_length;
3920 flow_registration->flow_result_read = FALSE;
3921 #if SKYWALK
3922 if (nexus_stats != NULL) {
3923 if (flow_registration->nexus_stats != NULL) {
3924 flow_stats_release(flow_registration->nexus_stats);
3925 }
3926 flow_registration->nexus_stats = nexus_stats;
3927 }
3928 #endif /* SKYWALK */
3929 client_updated = TRUE;
3930 break;
3931 }
3932 }
3933
3934 if (client_updated && notify_fd) {
3935 necp_fd_notify(client_fd, true);
3936 }
3937
3938 // if not updated, client must free assigned_results
3939 return client_updated;
3940 }
3941
3942 int
necp_assign_client_result(uuid_t netagent_uuid,uuid_t client_id,u_int8_t * assigned_results,size_t assigned_results_length)3943 necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id,
3944 u_int8_t *assigned_results, size_t assigned_results_length)
3945 {
3946 int error = 0;
3947 struct necp_fd_data *client_fd = NULL;
3948 bool found_client = FALSE;
3949 bool client_updated = FALSE;
3950
3951 NECP_FD_LIST_LOCK_SHARED();
3952
3953 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3954 proc_t proc = proc_find(client_fd->proc_pid);
3955 if (proc == PROC_NULL) {
3956 continue;
3957 }
3958
3959 NECP_FD_LOCK(client_fd);
3960 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3961 if (client != NULL) {
3962 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3963 if (flow_registration != NULL) {
3964 // Found the right client and flow!
3965 found_client = TRUE;
3966 if (necp_assign_client_result_locked(proc, client_fd, client, flow_registration, netagent_uuid,
3967 assigned_results, assigned_results_length, true)) {
3968 client_updated = TRUE;
3969 }
3970 }
3971
3972 NECP_CLIENT_UNLOCK(client);
3973 }
3974 NECP_FD_UNLOCK(client_fd);
3975
3976 proc_rele(proc);
3977 proc = PROC_NULL;
3978
3979 if (found_client) {
3980 break;
3981 }
3982 }
3983
3984 NECP_FD_LIST_UNLOCK();
3985
3986 // upon error, client must free assigned_results
3987 if (!found_client) {
3988 error = ENOENT;
3989 } else if (!client_updated) {
3990 error = EINVAL;
3991 }
3992
3993 return error;
3994 }
3995
3996 int
necp_assign_client_group_members(uuid_t netagent_uuid,uuid_t client_id,u_int8_t * assigned_group_members,size_t assigned_group_members_length)3997 necp_assign_client_group_members(uuid_t netagent_uuid, uuid_t client_id,
3998 u_int8_t *assigned_group_members, size_t assigned_group_members_length)
3999 {
4000 #pragma unused(netagent_uuid)
4001 int error = 0;
4002 struct necp_fd_data *client_fd = NULL;
4003 bool found_client = false;
4004 bool client_updated = false;
4005
4006 NECP_FD_LIST_LOCK_SHARED();
4007
4008 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
4009 proc_t proc = proc_find(client_fd->proc_pid);
4010 if (proc == PROC_NULL) {
4011 continue;
4012 }
4013
4014 NECP_FD_LOCK(client_fd);
4015 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
4016 if (client != NULL) {
4017 found_client = true;
4018 // Release prior results
4019 if (client->assigned_group_members != NULL) {
4020 kfree_data(client->assigned_group_members, client->assigned_group_members_length);
4021 client->assigned_group_members = NULL;
4022 }
4023
4024 // Save new results
4025 client->assigned_group_members = assigned_group_members;
4026 client->assigned_group_members_length = assigned_group_members_length;
4027 client->group_members_read = false;
4028
4029 client_updated = true;
4030 necp_fd_notify(client_fd, true);
4031
4032 NECP_CLIENT_UNLOCK(client);
4033 }
4034 NECP_FD_UNLOCK(client_fd);
4035
4036 proc_rele(proc);
4037 proc = PROC_NULL;
4038
4039 if (found_client) {
4040 break;
4041 }
4042 }
4043
4044 NECP_FD_LIST_UNLOCK();
4045
4046 // upon error, client must free assigned_results
4047 if (!found_client) {
4048 error = ENOENT;
4049 } else if (!client_updated) {
4050 error = EINVAL;
4051 }
4052
4053 return error;
4054 }
4055
4056 /// Client updating
4057
4058 static bool
necp_update_parsed_parameters(struct necp_client_parsed_parameters * parsed_parameters,struct necp_aggregate_result * result)4059 necp_update_parsed_parameters(struct necp_client_parsed_parameters *parsed_parameters,
4060 struct necp_aggregate_result *result)
4061 {
4062 if (parsed_parameters == NULL ||
4063 result == NULL) {
4064 return false;
4065 }
4066
4067 bool updated = false;
4068 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
4069 if (uuid_is_null(result->netagents[i])) {
4070 // Passed end of valid agents
4071 break;
4072 }
4073
4074 if (!(result->netagent_use_flags[i] & NECP_AGENT_USE_FLAG_SCOPE)) {
4075 // Not a scoped agent, ignore
4076 continue;
4077 }
4078
4079 // This is a scoped agent. Add it to the required agents.
4080 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
4081 // Already some required agents, add this at the end
4082 for (int j = 0; j < NECP_MAX_AGENT_PARAMETERS; j++) {
4083 if (uuid_compare(parsed_parameters->required_netagents[j], result->netagents[i]) == 0) {
4084 // Already required, break
4085 break;
4086 }
4087 if (uuid_is_null(parsed_parameters->required_netagents[j])) {
4088 // Add here
4089 memcpy(&parsed_parameters->required_netagents[j], result->netagents[i], sizeof(uuid_t));
4090 updated = true;
4091 break;
4092 }
4093 }
4094 } else {
4095 // No required agents yet, add this one
4096 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT;
4097 memcpy(&parsed_parameters->required_netagents[0], result->netagents[i], sizeof(uuid_t));
4098 updated = true;
4099 }
4100
4101 // Remove requirements for agents of the same type
4102 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
4103 char remove_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
4104 char remove_agent_type[NETAGENT_TYPESIZE] = { 0 };
4105 if (netagent_get_agent_domain_and_type(result->netagents[i], remove_agent_domain, remove_agent_type)) {
4106 for (int j = 0; j < NECP_MAX_AGENT_PARAMETERS; j++) {
4107 if (strlen(parsed_parameters->required_netagent_types[j].netagent_domain) == 0 &&
4108 strlen(parsed_parameters->required_netagent_types[j].netagent_type) == 0) {
4109 break;
4110 }
4111
4112 if (strncmp(parsed_parameters->required_netagent_types[j].netagent_domain, remove_agent_domain, NETAGENT_DOMAINSIZE) == 0 &&
4113 strncmp(parsed_parameters->required_netagent_types[j].netagent_type, remove_agent_type, NETAGENT_TYPESIZE) == 0) {
4114 updated = true;
4115
4116 if (j == NECP_MAX_AGENT_PARAMETERS - 1) {
4117 // Last field, just clear and break
4118 memset(&parsed_parameters->required_netagent_types[NECP_MAX_AGENT_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
4119 break;
4120 } else {
4121 // Move the parameters down, clear the last entry
4122 memmove(&parsed_parameters->required_netagent_types[j],
4123 &parsed_parameters->required_netagent_types[j + 1],
4124 sizeof(struct necp_client_parameter_netagent_type) * (NECP_MAX_AGENT_PARAMETERS - (j + 1)));
4125 memset(&parsed_parameters->required_netagent_types[NECP_MAX_AGENT_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
4126 // Continue, don't increment but look at the new shifted item instead
4127 continue;
4128 }
4129 }
4130
4131 // Increment j to look at the next agent type parameter
4132 j++;
4133 }
4134 }
4135 }
4136 }
4137
4138 if (updated &&
4139 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4140 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) {
4141 // A required interface index was added after the fact. Clear it.
4142 parsed_parameters->required_interface_index = IFSCOPE_NONE;
4143 }
4144
4145
4146 return updated;
4147 }
4148
4149 static inline bool
necp_agent_types_match(const char * agent_domain1,const char * agent_type1,const char * agent_domain2,const char * agent_type2)4150 necp_agent_types_match(const char *agent_domain1, const char *agent_type1,
4151 const char *agent_domain2, const char *agent_type2)
4152 {
4153 return (strlen(agent_domain1) == 0 ||
4154 strncmp(agent_domain2, agent_domain1, NETAGENT_DOMAINSIZE) == 0) &&
4155 (strlen(agent_type1) == 0 ||
4156 strncmp(agent_type2, agent_type1, NETAGENT_TYPESIZE) == 0);
4157 }
4158
4159 static inline bool
necp_calculate_client_result(proc_t proc,struct necp_client * client,struct necp_client_parsed_parameters * parsed_parameters,struct necp_aggregate_result * result,u_int32_t * flags,u_int32_t * reason,struct necp_client_endpoint * v4_gateway,struct necp_client_endpoint * v6_gateway,uuid_t * override_euuid)4160 necp_calculate_client_result(proc_t proc,
4161 struct necp_client *client,
4162 struct necp_client_parsed_parameters *parsed_parameters,
4163 struct necp_aggregate_result *result,
4164 u_int32_t *flags,
4165 u_int32_t *reason,
4166 struct necp_client_endpoint *v4_gateway,
4167 struct necp_client_endpoint *v6_gateway,
4168 uuid_t *override_euuid)
4169 {
4170 struct rtentry *route = NULL;
4171
4172 // Check parameters to find best interface
4173 bool validate_agents = false;
4174 u_int matching_if_index = 0;
4175 if (necp_find_matching_interface_index(parsed_parameters, &matching_if_index, &validate_agents)) {
4176 if (matching_if_index != 0) {
4177 parsed_parameters->required_interface_index = matching_if_index;
4178 }
4179 // Interface found or not needed, match policy.
4180 memset(result, 0, sizeof(*result));
4181 int error = necp_application_find_policy_match_internal(proc, client->parameters,
4182 (u_int32_t)client->parameters_length,
4183 result, flags, reason, matching_if_index,
4184 NULL, NULL,
4185 v4_gateway, v6_gateway,
4186 &route, false, true,
4187 override_euuid);
4188 if (error != 0) {
4189 if (route != NULL) {
4190 rtfree(route);
4191 }
4192 return FALSE;
4193 }
4194
4195 if (validate_agents) {
4196 bool requirement_failed = FALSE;
4197 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
4198 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4199 if (uuid_is_null(parsed_parameters->required_netagents[i])) {
4200 break;
4201 }
4202
4203 bool requirement_found = FALSE;
4204 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4205 if (uuid_is_null(result->netagents[j])) {
4206 break;
4207 }
4208
4209 if (result->netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) {
4210 // A removed agent, ignore
4211 continue;
4212 }
4213
4214 if (uuid_compare(parsed_parameters->required_netagents[i], result->netagents[j]) == 0) {
4215 requirement_found = TRUE;
4216 break;
4217 }
4218 }
4219
4220 if (!requirement_found) {
4221 requirement_failed = TRUE;
4222 break;
4223 }
4224 }
4225 }
4226
4227 if (!requirement_failed && parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
4228 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4229 if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 &&
4230 strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
4231 break;
4232 }
4233
4234 bool requirement_found = FALSE;
4235 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4236 if (uuid_is_null(result->netagents[j])) {
4237 break;
4238 }
4239
4240 if (result->netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) {
4241 // A removed agent, ignore
4242 continue;
4243 }
4244
4245 char policy_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
4246 char policy_agent_type[NETAGENT_TYPESIZE] = { 0 };
4247
4248 if (netagent_get_agent_domain_and_type(result->netagents[j], policy_agent_domain, policy_agent_type)) {
4249 if (necp_agent_types_match(parsed_parameters->required_netagent_types[i].netagent_domain,
4250 parsed_parameters->required_netagent_types[i].netagent_type,
4251 policy_agent_domain, policy_agent_type)) {
4252 requirement_found = TRUE;
4253 break;
4254 }
4255 }
4256 }
4257
4258 if (!requirement_found) {
4259 requirement_failed = TRUE;
4260 break;
4261 }
4262 }
4263 }
4264
4265 if (requirement_failed) {
4266 // Agent requirement failed. Clear out the whole result, make everything fail.
4267 memset(result, 0, sizeof(*result));
4268 if (route != NULL) {
4269 rtfree(route);
4270 }
4271 return TRUE;
4272 }
4273 }
4274
4275 // Reset current route
4276 NECP_CLIENT_ROUTE_LOCK(client);
4277 if (client->current_route != NULL) {
4278 rtfree(client->current_route);
4279 }
4280 client->current_route = route;
4281 NECP_CLIENT_ROUTE_UNLOCK(client);
4282 } else {
4283 // Interface not found. Clear out the whole result, make everything fail.
4284 memset(result, 0, sizeof(*result));
4285 }
4286
4287 return TRUE;
4288 }
4289
4290 #define NECP_PARSED_PARAMETERS_REQUIRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF | \
4291 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
4292 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
4293 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE)
4294
4295 static bool
necp_update_client_result(proc_t proc,struct necp_fd_data * client_fd,struct necp_client * client,struct _necp_flow_defunct_list * defunct_list)4296 necp_update_client_result(proc_t proc,
4297 struct necp_fd_data *client_fd,
4298 struct necp_client *client,
4299 struct _necp_flow_defunct_list *defunct_list)
4300 {
4301 struct necp_client_result_netagent netagent;
4302 struct necp_aggregate_result result;
4303 struct necp_client_parsed_parameters *parsed_parameters = NULL;
4304 u_int32_t flags = 0;
4305 u_int32_t reason = 0;
4306
4307 NECP_CLIENT_ASSERT_LOCKED(client);
4308
4309 parsed_parameters = kalloc_type(struct necp_client_parsed_parameters,
4310 Z_WAITOK | Z_ZERO | Z_NOFAIL);
4311
4312 // Nexus flows will be brought back if they are still valid
4313 necp_client_mark_all_nonsocket_flows_as_invalid(client);
4314
4315 int error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, parsed_parameters);
4316 if (error != 0) {
4317 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4318 return FALSE;
4319 }
4320
4321 // Update saved IP protocol
4322 client->ip_protocol = parsed_parameters->ip_protocol;
4323
4324 // Calculate the policy result
4325 struct necp_client_endpoint v4_gateway = {};
4326 struct necp_client_endpoint v6_gateway = {};
4327 uuid_t override_euuid;
4328 uuid_clear(override_euuid);
4329 if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags, &reason, &v4_gateway, &v6_gateway, &override_euuid)) {
4330 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4331 return FALSE;
4332 }
4333
4334 if (necp_update_parsed_parameters(parsed_parameters, &result)) {
4335 // Changed the parameters based on result, try again (only once)
4336 if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags, &reason, &v4_gateway, &v6_gateway, &override_euuid)) {
4337 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4338 return FALSE;
4339 }
4340 }
4341
4342 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
4343 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4344 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) {
4345 // Listener should not apply required interface index if
4346 parsed_parameters->required_interface_index = IFSCOPE_NONE;
4347 }
4348
4349 // Save the last policy id on the client
4350 client->policy_id = result.policy_id;
4351 uuid_copy(client->override_euuid, override_euuid);
4352
4353 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_MULTIPATH) ||
4354 (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) ||
4355 ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
4356 result.routing_result != NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED)) {
4357 client->allow_multiple_flows = TRUE;
4358 } else {
4359 client->allow_multiple_flows = FALSE;
4360 }
4361
4362 // If the original request was scoped, and the policy result matches, make sure the result is scoped
4363 if ((result.routing_result == NECP_KERNEL_POLICY_RESULT_NONE ||
4364 result.routing_result == NECP_KERNEL_POLICY_RESULT_PASS) &&
4365 result.routed_interface_index != IFSCOPE_NONE &&
4366 parsed_parameters->required_interface_index == result.routed_interface_index) {
4367 result.routing_result = NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED;
4368 result.routing_result_parameter.scoped_interface_index = result.routed_interface_index;
4369 }
4370
4371 if (defunct_list != NULL &&
4372 result.routing_result == NECP_KERNEL_POLICY_RESULT_DROP) {
4373 // If we are forced to drop the client, defunct it if it has flows
4374 necp_defunct_client_for_policy(client, defunct_list);
4375 }
4376
4377 // Recalculate flags
4378 if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
4379 // Listeners are valid as long as they aren't dropped
4380 if (result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP) {
4381 flags |= NECP_CLIENT_RESULT_FLAG_SATISFIED;
4382 }
4383 } else if (result.routed_interface_index != 0) {
4384 // Clients without flows determine viability based on having some routable interface
4385 flags |= NECP_CLIENT_RESULT_FLAG_SATISFIED;
4386 }
4387
4388 bool updated = FALSE;
4389 u_int8_t *cursor = client->result;
4390 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FLAGS, sizeof(flags), &flags, &updated, client->result, sizeof(client->result));
4391 if (reason != 0) {
4392 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_REASON, sizeof(reason), &reason, &updated, client->result, sizeof(client->result));
4393 }
4394 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_CLIENT_ID, sizeof(uuid_t), client->client_id, &updated,
4395 client->result, sizeof(client->result));
4396 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT, sizeof(result.routing_result), &result.routing_result, &updated,
4397 client->result, sizeof(client->result));
4398 if (result.routing_result_parameter.tunnel_interface_index != 0) {
4399 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER,
4400 sizeof(result.routing_result_parameter), &result.routing_result_parameter, &updated,
4401 client->result, sizeof(client->result));
4402 }
4403 if (result.filter_control_unit != 0) {
4404 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT,
4405 sizeof(result.filter_control_unit), &result.filter_control_unit, &updated,
4406 client->result, sizeof(client->result));
4407 }
4408 if (result.flow_divert_aggregate_unit != 0) {
4409 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FLOW_DIVERT_AGGREGATE_UNIT,
4410 sizeof(result.flow_divert_aggregate_unit), &result.flow_divert_aggregate_unit, &updated,
4411 client->result, sizeof(client->result));
4412 }
4413 if (result.routed_interface_index != 0) {
4414 u_int routed_interface_index = result.routed_interface_index;
4415 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
4416 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_REQUIRED_FIELDS) &&
4417 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4418 parsed_parameters->required_interface_index != result.routed_interface_index) {
4419 routed_interface_index = parsed_parameters->required_interface_index;
4420 }
4421
4422 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_INDEX,
4423 sizeof(routed_interface_index), &routed_interface_index, &updated,
4424 client->result, sizeof(client->result));
4425 }
4426 if (client_fd && client_fd->flags & NECP_OPEN_FLAG_BACKGROUND) {
4427 u_int32_t effective_traffic_class = SO_TC_BK_SYS;
4428 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS,
4429 sizeof(effective_traffic_class), &effective_traffic_class, &updated,
4430 client->result, sizeof(client->result));
4431 }
4432
4433 if (client_fd->background) {
4434 bool has_assigned_flow = FALSE;
4435 struct necp_client_flow_registration *flow_registration = NULL;
4436 struct necp_client_flow *search_flow = NULL;
4437 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
4438 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
4439 if (search_flow->assigned) {
4440 has_assigned_flow = TRUE;
4441 break;
4442 }
4443 }
4444 }
4445
4446 if (has_assigned_flow) {
4447 u_int32_t background = client_fd->background;
4448 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG,
4449 sizeof(background), &background, &updated,
4450 client->result, sizeof(client->result));
4451 }
4452 }
4453
4454 bool write_v4_gateway = !necp_client_endpoint_is_unspecified(&v4_gateway);
4455 bool write_v6_gateway = !necp_client_endpoint_is_unspecified(&v6_gateway);
4456
4457 NECP_CLIENT_ROUTE_LOCK(client);
4458 if (client->current_route != NULL) {
4459 const u_int32_t route_mtu = get_maxmtu(client->current_route);
4460 if (route_mtu != 0) {
4461 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_MTU,
4462 sizeof(route_mtu), &route_mtu, &updated,
4463 client->result, sizeof(client->result));
4464 }
4465 bool has_remote_addr = parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
4466 if (has_remote_addr && client->current_route->rt_gateway != NULL) {
4467 if (client->current_route->rt_gateway->sa_family == AF_INET) {
4468 write_v6_gateway = false;
4469 } else if (client->current_route->rt_gateway->sa_family == AF_INET6) {
4470 write_v4_gateway = false;
4471 }
4472 }
4473 }
4474 NECP_CLIENT_ROUTE_UNLOCK(client);
4475
4476 if (write_v4_gateway) {
4477 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_GATEWAY,
4478 sizeof(struct necp_client_endpoint), &v4_gateway, &updated,
4479 client->result, sizeof(client->result));
4480 }
4481
4482 if (write_v6_gateway) {
4483 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_GATEWAY,
4484 sizeof(struct necp_client_endpoint), &v6_gateway, &updated,
4485 client->result, sizeof(client->result));
4486 }
4487
4488 for (int i = 0; i < NAT64_MAX_NUM_PREFIXES; i++) {
4489 if (result.nat64_prefixes[i].prefix_len != 0) {
4490 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NAT64,
4491 sizeof(result.nat64_prefixes), result.nat64_prefixes, &updated,
4492 client->result, sizeof(client->result));
4493 break;
4494 }
4495 }
4496
4497 if (result.mss_recommended != 0) {
4498 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_RECOMMENDED_MSS,
4499 sizeof(result.mss_recommended), &result.mss_recommended, &updated,
4500 client->result, sizeof(client->result));
4501 }
4502
4503 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
4504 if (uuid_is_null(result.netagents[i])) {
4505 break;
4506 }
4507 if (result.netagent_use_flags[i] & NECP_AGENT_USE_FLAG_REMOVE) {
4508 // A removed agent, ignore
4509 continue;
4510 }
4511 uuid_copy(netagent.netagent_uuid, result.netagents[i]);
4512 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4513 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE, 0, 0)) {
4514 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4515 client->result, sizeof(client->result));
4516 }
4517 }
4518
4519 ifnet_head_lock_shared();
4520 ifnet_t direct_interface = NULL;
4521 ifnet_t delegate_interface = NULL;
4522 ifnet_t original_scoped_interface = NULL;
4523
4524 if (result.routed_interface_index != IFSCOPE_NONE && result.routed_interface_index <= (u_int32_t)if_index) {
4525 direct_interface = ifindex2ifnet[result.routed_interface_index];
4526 } else if (parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4527 parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
4528 // If the request was scoped, but the route didn't match, still grab the agents
4529 direct_interface = ifindex2ifnet[parsed_parameters->required_interface_index];
4530 } else if (result.routed_interface_index == IFSCOPE_NONE &&
4531 result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED &&
4532 result.routing_result_parameter.scoped_interface_index != IFSCOPE_NONE) {
4533 direct_interface = ifindex2ifnet[result.routing_result_parameter.scoped_interface_index];
4534 }
4535 if (direct_interface != NULL) {
4536 delegate_interface = direct_interface->if_delegated.ifp;
4537 }
4538 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
4539 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_REQUIRED_FIELDS) &&
4540 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4541 parsed_parameters->required_interface_index != result.routing_result_parameter.tunnel_interface_index &&
4542 parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
4543 original_scoped_interface = ifindex2ifnet[parsed_parameters->required_interface_index];
4544 }
4545 // Add interfaces
4546 if (original_scoped_interface != NULL) {
4547 struct necp_client_result_interface interface_struct;
4548 interface_struct.index = original_scoped_interface->if_index;
4549 interface_struct.generation = ifnet_get_generation(original_scoped_interface);
4550 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
4551 client->result, sizeof(client->result));
4552 }
4553 if (direct_interface != NULL) {
4554 struct necp_client_result_interface interface_struct;
4555 interface_struct.index = direct_interface->if_index;
4556 interface_struct.generation = ifnet_get_generation(direct_interface);
4557 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
4558 client->result, sizeof(client->result));
4559
4560 // Set the delta time since interface up/down
4561 struct timeval updown_delta = {};
4562 if (ifnet_updown_delta(direct_interface, &updown_delta) == 0) {
4563 u_int32_t delta = updown_delta.tv_sec;
4564 bool ignore_updated = FALSE;
4565 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_TIME_DELTA,
4566 sizeof(delta), &delta, &ignore_updated,
4567 client->result, sizeof(client->result));
4568 }
4569 }
4570 if (delegate_interface != NULL) {
4571 struct necp_client_result_interface interface_struct;
4572 interface_struct.index = delegate_interface->if_index;
4573 interface_struct.generation = ifnet_get_generation(delegate_interface);
4574 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
4575 client->result, sizeof(client->result));
4576 }
4577
4578 // Update multipath/listener interface flows
4579 if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_MULTIPATH) {
4580 // Add the interface option for the routed interface first
4581 if (direct_interface != NULL) {
4582 // Add nexus agent
4583 necp_client_add_agent_interface_options(client, parsed_parameters, direct_interface);
4584
4585 // Add interface option in case it is not a nexus
4586 necp_client_add_interface_option_if_needed(client, direct_interface->if_index,
4587 ifnet_get_generation(direct_interface), NULL, false);
4588 }
4589 // Get other multipath interface options from ordered list
4590 struct ifnet *multi_interface = NULL;
4591 TAILQ_FOREACH(multi_interface, &ifnet_ordered_head, if_ordered_link) {
4592 if (multi_interface != direct_interface &&
4593 necp_ifnet_matches_parameters(multi_interface, parsed_parameters, 0, NULL, true, false)) {
4594 // Add nexus agents for multipath
4595 necp_client_add_agent_interface_options(client, parsed_parameters, multi_interface);
4596
4597 // Add multipath interface flows for kernel MPTCP
4598 necp_client_add_interface_option_if_needed(client, multi_interface->if_index,
4599 ifnet_get_generation(multi_interface), NULL, false);
4600 }
4601 }
4602 } else if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
4603 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) {
4604 if (direct_interface != NULL) {
4605 // If scoped, only listen on that interface
4606 // Add nexus agents for listeners
4607 necp_client_add_agent_interface_options(client, parsed_parameters, direct_interface);
4608
4609 // Add interface option in case it is not a nexus
4610 necp_client_add_interface_option_if_needed(client, direct_interface->if_index,
4611 ifnet_get_generation(direct_interface), NULL, false);
4612 }
4613 } else {
4614 // Get listener interface options from global list
4615 struct ifnet *listen_interface = NULL;
4616 TAILQ_FOREACH(listen_interface, &ifnet_head, if_link) {
4617 if ((listen_interface->if_flags & (IFF_UP | IFF_RUNNING)) &&
4618 necp_ifnet_matches_parameters(listen_interface, parsed_parameters, 0, NULL, true, false)) {
4619 // Add nexus agents for listeners
4620 necp_client_add_agent_interface_options(client, parsed_parameters, listen_interface);
4621 }
4622 }
4623 }
4624 } else if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) {
4625 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) {
4626 if (direct_interface != NULL) {
4627 // Add browse option if it has an agent
4628 necp_client_add_browse_interface_options(client, parsed_parameters, direct_interface);
4629 }
4630 } else {
4631 // Get browse interface options from global list
4632 struct ifnet *browse_interface = NULL;
4633 TAILQ_FOREACH(browse_interface, &ifnet_head, if_link) {
4634 if (necp_ifnet_matches_parameters(browse_interface, parsed_parameters, 0, NULL, true, false)) {
4635 necp_client_add_browse_interface_options(client, parsed_parameters, browse_interface);
4636 }
4637 }
4638 }
4639 }
4640
4641 struct necp_client_result_estimated_throughput throughput = {
4642 .up = 0,
4643 .down = 0,
4644 };
4645
4646 // Add agents
4647 if (original_scoped_interface != NULL) {
4648 ifnet_lock_shared(original_scoped_interface);
4649 if (original_scoped_interface->if_agentids != NULL) {
4650 for (u_int32_t i = 0; i < original_scoped_interface->if_agentcount; i++) {
4651 if (uuid_is_null(original_scoped_interface->if_agentids[i])) {
4652 continue;
4653 }
4654 bool skip_agent = false;
4655 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4656 if (uuid_is_null(result.netagents[j])) {
4657 break;
4658 }
4659 if ((result.netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) &&
4660 uuid_compare(original_scoped_interface->if_agentids[i], result.netagents[j]) == 0) {
4661 skip_agent = true;
4662 break;
4663 }
4664 }
4665 if (skip_agent) {
4666 continue;
4667 }
4668 uuid_copy(netagent.netagent_uuid, original_scoped_interface->if_agentids[i]);
4669 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4670 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE,
4671 original_scoped_interface->if_index, ifnet_get_generation(original_scoped_interface))) {
4672 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4673 client->result, sizeof(client->result));
4674 }
4675 }
4676 }
4677 ifnet_lock_done(original_scoped_interface);
4678 }
4679 if (direct_interface != NULL) {
4680 ifnet_lock_shared(direct_interface);
4681 throughput.up = direct_interface->if_estimated_up_bucket;
4682 throughput.down = direct_interface->if_estimated_down_bucket;
4683 if (direct_interface->if_agentids != NULL) {
4684 for (u_int32_t i = 0; i < direct_interface->if_agentcount; i++) {
4685 if (uuid_is_null(direct_interface->if_agentids[i])) {
4686 continue;
4687 }
4688 bool skip_agent = false;
4689 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4690 if (uuid_is_null(result.netagents[j])) {
4691 break;
4692 }
4693 if ((result.netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) &&
4694 uuid_compare(direct_interface->if_agentids[i], result.netagents[j]) == 0) {
4695 skip_agent = true;
4696 break;
4697 }
4698 }
4699 if (skip_agent) {
4700 continue;
4701 }
4702 uuid_copy(netagent.netagent_uuid, direct_interface->if_agentids[i]);
4703 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4704 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE,
4705 direct_interface->if_index, ifnet_get_generation(direct_interface))) {
4706 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4707 client->result, sizeof(client->result));
4708 }
4709 }
4710 }
4711 ifnet_lock_done(direct_interface);
4712 }
4713 if (delegate_interface != NULL) {
4714 ifnet_lock_shared(delegate_interface);
4715 if (throughput.up == 0 && throughput.down == 0) {
4716 throughput.up = delegate_interface->if_estimated_up_bucket;
4717 throughput.down = delegate_interface->if_estimated_down_bucket;
4718 }
4719 if (delegate_interface->if_agentids != NULL) {
4720 for (u_int32_t i = 0; i < delegate_interface->if_agentcount; i++) {
4721 if (uuid_is_null(delegate_interface->if_agentids[i])) {
4722 continue;
4723 }
4724 bool skip_agent = false;
4725 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4726 if (uuid_is_null(result.netagents[j])) {
4727 break;
4728 }
4729 if ((result.netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) &&
4730 uuid_compare(delegate_interface->if_agentids[i], result.netagents[j]) == 0) {
4731 skip_agent = true;
4732 break;
4733 }
4734 }
4735 if (skip_agent) {
4736 continue;
4737 }
4738 uuid_copy(netagent.netagent_uuid, delegate_interface->if_agentids[i]);
4739 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4740 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE,
4741 delegate_interface->if_index, ifnet_get_generation(delegate_interface))) {
4742 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4743 client->result, sizeof(client->result));
4744 }
4745 }
4746 }
4747 ifnet_lock_done(delegate_interface);
4748 }
4749 ifnet_head_done();
4750
4751 if (throughput.up != 0 || throughput.down != 0) {
4752 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_ESTIMATED_THROUGHPUT,
4753 sizeof(throughput), &throughput, &updated, client->result, sizeof(client->result));
4754 }
4755
4756 // Add interface options
4757 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
4758 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
4759 struct necp_client_interface_option *option = &client->interface_options[option_i];
4760 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated,
4761 client->result, sizeof(client->result));
4762 } else {
4763 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
4764 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated,
4765 client->result, sizeof(client->result));
4766 }
4767 }
4768
4769 size_t new_result_length = (cursor - client->result);
4770 if (new_result_length != client->result_length) {
4771 client->result_length = new_result_length;
4772 updated = TRUE;
4773 }
4774
4775 // Update flow viability/flags
4776 if (necp_client_update_flows(proc, client, defunct_list)) {
4777 updated = TRUE;
4778 }
4779
4780 if (updated) {
4781 client->result_read = FALSE;
4782 necp_client_update_observer_update(client);
4783 }
4784
4785 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4786 return updated;
4787 }
4788
4789 static bool
necp_defunct_client_fd_locked_inner(struct necp_fd_data * client_fd,struct _necp_flow_defunct_list * defunct_list,bool destroy_stats)4790 necp_defunct_client_fd_locked_inner(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, bool destroy_stats)
4791 {
4792 bool updated_result = FALSE;
4793 struct necp_client *client = NULL;
4794
4795 NECP_FD_ASSERT_LOCKED(client_fd);
4796
4797 RB_FOREACH(client, _necp_client_tree, &client_fd->clients) {
4798 struct necp_client_flow_registration *flow_registration = NULL;
4799
4800 NECP_CLIENT_LOCK(client);
4801
4802 // Prepare close events to be sent to the nexus to effectively remove the flows
4803 struct necp_client_flow *search_flow = NULL;
4804 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
4805 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
4806 if (search_flow->nexus &&
4807 !uuid_is_null(search_flow->u.nexus_agent)) {
4808 // Sleeping alloc won't fail; copy only what's necessary
4809 struct necp_flow_defunct *flow_defunct = kalloc_type(struct necp_flow_defunct, Z_WAITOK | Z_ZERO);
4810 uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent);
4811 uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
4812 client->client_id :
4813 flow_registration->registration_id));
4814 flow_defunct->proc_pid = client->proc_pid;
4815 flow_defunct->agent_handle = client->agent_handle;
4816 flow_defunct->flags = flow_registration->flags;
4817 #if SKYWALK
4818 if (flow_registration->kstats_kaddr != NULL) {
4819 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
4820 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
4821 if (quicstats != NULL &&
4822 quicstats->necp_quic_udp_stats.necp_udp_hdr.necp_stats_type == NECP_CLIENT_STATISTICS_TYPE_QUIC) {
4823 memcpy(flow_defunct->close_parameters.u.close_token, quicstats->necp_quic_extra.ssr_token, sizeof(flow_defunct->close_parameters.u.close_token));
4824 flow_defunct->has_close_parameters = true;
4825 }
4826 }
4827 #endif /* SKYWALK */
4828 // Add to the list provided by caller
4829 LIST_INSERT_HEAD(defunct_list, flow_defunct, chain);
4830
4831 flow_registration->defunct = true;
4832 flow_registration->flow_result_read = false;
4833 updated_result = true;
4834 }
4835 }
4836 }
4837 if (destroy_stats) {
4838 #if SKYWALK
4839 // Free any remaining stats objects back to the arena where they came from;
4840 // do this independent of the above defunct check, as the client may have
4841 // been marked as defunct separately via necp_defunct_client_for_policy().
4842 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
4843 necp_destroy_flow_stats(client_fd, flow_registration, NULL, FALSE);
4844 }
4845 #endif /* SKYWALK */
4846 }
4847 NECP_CLIENT_UNLOCK(client);
4848 }
4849
4850 return updated_result;
4851 }
4852
4853 static inline void
necp_defunct_client_fd_locked(struct necp_fd_data * client_fd,struct _necp_flow_defunct_list * defunct_list,struct proc * proc)4854 necp_defunct_client_fd_locked(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, struct proc *proc)
4855 {
4856 #pragma unused(proc)
4857 bool updated_result = FALSE;
4858
4859 NECP_FD_ASSERT_LOCKED(client_fd);
4860 #if SKYWALK
4861 // redirect regions of currently-active stats arena to zero-filled pages
4862 struct necp_arena_info *nai = necp_fd_mredirect_stats_arena(client_fd, proc);
4863 #endif /* SKYWALK */
4864
4865 updated_result = necp_defunct_client_fd_locked_inner(client_fd, defunct_list, true);
4866
4867 #if SKYWALK
4868 // and tear down the currently-active arena's regions now that the redirection and freeing are done
4869 if (nai != NULL) {
4870 ASSERT((nai->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT)) == NAIF_REDIRECT);
4871 ASSERT(nai->nai_arena != NULL);
4872 ASSERT(nai->nai_mmap.ami_mapref != NULL);
4873
4874 int err = skmem_arena_defunct(nai->nai_arena);
4875 VERIFY(err == 0);
4876
4877 nai->nai_flags |= NAIF_DEFUNCT;
4878 }
4879 #endif /* SKYWALK */
4880
4881 if (updated_result) {
4882 necp_fd_notify(client_fd, true);
4883 }
4884 }
4885
4886 static inline void
necp_update_client_fd_locked(struct necp_fd_data * client_fd,proc_t proc,struct _necp_flow_defunct_list * defunct_list)4887 necp_update_client_fd_locked(struct necp_fd_data *client_fd,
4888 proc_t proc,
4889 struct _necp_flow_defunct_list *defunct_list)
4890 {
4891 struct necp_client *client = NULL;
4892 bool updated_result = FALSE;
4893 NECP_FD_ASSERT_LOCKED(client_fd);
4894 RB_FOREACH(client, _necp_client_tree, &client_fd->clients) {
4895 NECP_CLIENT_LOCK(client);
4896 if (necp_update_client_result(proc, client_fd, client, defunct_list)) {
4897 updated_result = TRUE;
4898 }
4899 NECP_CLIENT_UNLOCK(client);
4900 }
4901 if (updated_result) {
4902 necp_fd_notify(client_fd, true);
4903 }
4904 }
4905
4906 #if SKYWALK
4907 static void
necp_close_empty_arenas_callout(__unused thread_call_param_t dummy,__unused thread_call_param_t arg)4908 necp_close_empty_arenas_callout(__unused thread_call_param_t dummy,
4909 __unused thread_call_param_t arg)
4910 {
4911 struct necp_fd_data *client_fd = NULL;
4912
4913 NECP_FD_LIST_LOCK_SHARED();
4914
4915 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
4916 NECP_FD_LOCK(client_fd);
4917 necp_stats_arenas_destroy(client_fd, FALSE);
4918 NECP_FD_UNLOCK(client_fd);
4919 }
4920
4921 NECP_FD_LIST_UNLOCK();
4922 }
4923 #endif /* SKYWALK */
4924
4925 static void
necp_update_all_clients_callout(__unused thread_call_param_t dummy,__unused thread_call_param_t arg)4926 necp_update_all_clients_callout(__unused thread_call_param_t dummy,
4927 __unused thread_call_param_t arg)
4928 {
4929 struct necp_fd_data *client_fd = NULL;
4930
4931 struct _necp_flow_defunct_list defunct_list;
4932 LIST_INIT(&defunct_list);
4933
4934 NECP_FD_LIST_LOCK_SHARED();
4935
4936 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
4937 proc_t proc = proc_find(client_fd->proc_pid);
4938 if (proc == PROC_NULL) {
4939 continue;
4940 }
4941
4942 // Update all clients on one fd
4943 NECP_FD_LOCK(client_fd);
4944 necp_update_client_fd_locked(client_fd, proc, &defunct_list);
4945 NECP_FD_UNLOCK(client_fd);
4946
4947 proc_rele(proc);
4948 proc = PROC_NULL;
4949 }
4950
4951 NECP_FD_LIST_UNLOCK();
4952
4953 // Handle the case in which some clients became newly defunct
4954 necp_process_defunct_list(&defunct_list);
4955 }
4956
4957 void
necp_update_all_clients(void)4958 necp_update_all_clients(void)
4959 {
4960 necp_update_all_clients_immediately_if_needed(false);
4961 }
4962
4963 void
necp_update_all_clients_immediately_if_needed(bool should_update_immediately)4964 necp_update_all_clients_immediately_if_needed(bool should_update_immediately)
4965 {
4966 if (necp_client_update_tcall == NULL) {
4967 // Don't try to update clients if the module is not initialized
4968 return;
4969 }
4970
4971 uint64_t deadline = 0;
4972 uint64_t leeway = 0;
4973
4974 uint32_t timeout_to_use = necp_timeout_microseconds;
4975 uint32_t leeway_to_use = necp_timeout_leeway_microseconds;
4976 if (should_update_immediately) {
4977 timeout_to_use = 1000 * 10; // 10ms
4978 leeway_to_use = 1000 * 10; // 10ms;
4979 }
4980
4981 clock_interval_to_deadline(timeout_to_use, NSEC_PER_USEC, &deadline);
4982 clock_interval_to_absolutetime_interval(leeway_to_use, NSEC_PER_USEC, &leeway);
4983
4984 thread_call_enter_delayed_with_leeway(necp_client_update_tcall, NULL,
4985 deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
4986 }
4987
4988 bool
necp_set_client_as_background(proc_t proc,struct fileproc * fp,bool background)4989 necp_set_client_as_background(proc_t proc,
4990 struct fileproc *fp,
4991 bool background)
4992 {
4993 if (proc == PROC_NULL) {
4994 NECPLOG0(LOG_ERR, "NULL proc");
4995 return FALSE;
4996 }
4997
4998 if (fp == NULL) {
4999 NECPLOG0(LOG_ERR, "NULL fp");
5000 return FALSE;
5001 }
5002
5003 struct necp_fd_data *client_fd = (struct necp_fd_data *)fp_get_data(fp);
5004 if (client_fd == NULL) {
5005 NECPLOG0(LOG_ERR, "Could not find client structure for backgrounded client");
5006 return FALSE;
5007 }
5008
5009 if (client_fd->necp_fd_type != necp_fd_type_client) {
5010 // Not a client fd, ignore
5011 NECPLOG0(LOG_ERR, "Not a client fd, ignore");
5012 return FALSE;
5013 }
5014
5015 client_fd->background = background;
5016
5017 return TRUE;
5018 }
5019
5020 void
necp_fd_memstatus(proc_t proc,uint32_t status,struct necp_fd_data * client_fd)5021 necp_fd_memstatus(proc_t proc, uint32_t status,
5022 struct necp_fd_data *client_fd)
5023 {
5024 #pragma unused(proc, status, client_fd)
5025 ASSERT(proc != PROC_NULL);
5026 ASSERT(client_fd != NULL);
5027
5028 // Nothing to reap for the process or client for now,
5029 // but this is where we would trigger that in future.
5030 }
5031
5032 void
necp_fd_defunct(proc_t proc,struct necp_fd_data * client_fd)5033 necp_fd_defunct(proc_t proc, struct necp_fd_data *client_fd)
5034 {
5035 struct _necp_flow_defunct_list defunct_list;
5036
5037 ASSERT(proc != PROC_NULL);
5038 ASSERT(client_fd != NULL);
5039
5040 if (client_fd->necp_fd_type != necp_fd_type_client) {
5041 // Not a client fd, ignore
5042 return;
5043 }
5044
5045 // Our local temporary list
5046 LIST_INIT(&defunct_list);
5047
5048 // Need to hold lock so ntstats defunct the same set of clients
5049 NECP_FD_LOCK(client_fd);
5050 #if SKYWALK
5051 // Shut down statistics
5052 nstats_userland_stats_defunct_for_process(proc_getpid(proc));
5053 #endif /* SKYWALK */
5054 necp_defunct_client_fd_locked(client_fd, &defunct_list, proc);
5055 NECP_FD_UNLOCK(client_fd);
5056
5057 necp_process_defunct_list(&defunct_list);
5058 }
5059
5060 static void
necp_client_remove_agent_from_result(struct necp_client * client,uuid_t netagent_uuid)5061 necp_client_remove_agent_from_result(struct necp_client *client, uuid_t netagent_uuid)
5062 {
5063 size_t offset = 0;
5064
5065 u_int8_t *result_buffer = client->result;
5066 while ((offset + sizeof(struct necp_tlv_header)) <= client->result_length) {
5067 u_int8_t type = necp_buffer_get_tlv_type(result_buffer, offset);
5068 u_int32_t length = necp_buffer_get_tlv_length(result_buffer, offset);
5069
5070 size_t tlv_total_length = (sizeof(struct necp_tlv_header) + length);
5071 if (type == NECP_CLIENT_RESULT_NETAGENT &&
5072 length == sizeof(struct necp_client_result_netagent) &&
5073 (offset + tlv_total_length) <= client->result_length) {
5074 struct necp_client_result_netagent *value = ((struct necp_client_result_netagent *)(void *)
5075 necp_buffer_get_tlv_value(result_buffer, offset, NULL));
5076 if (uuid_compare(value->netagent_uuid, netagent_uuid) == 0) {
5077 // Found a netagent to remove
5078 // Shift bytes down to remove the tlv, and adjust total length
5079 // Don't adjust the current offset
5080 memmove(result_buffer + offset,
5081 result_buffer + offset + tlv_total_length,
5082 client->result_length - (offset + tlv_total_length));
5083 client->result_length -= tlv_total_length;
5084 memset(result_buffer + client->result_length, 0, sizeof(client->result) - client->result_length);
5085 continue;
5086 }
5087 }
5088
5089 offset += tlv_total_length;
5090 }
5091 }
5092
5093 void
necp_force_update_client(uuid_t client_id,uuid_t remove_netagent_uuid,u_int32_t agent_generation)5094 necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid, u_int32_t agent_generation)
5095 {
5096 struct necp_fd_data *client_fd = NULL;
5097
5098 NECP_FD_LIST_LOCK_SHARED();
5099
5100 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
5101 bool updated_result = FALSE;
5102 NECP_FD_LOCK(client_fd);
5103 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
5104 if (client != NULL) {
5105 client->failed_trigger_agent.generation = agent_generation;
5106 uuid_copy(client->failed_trigger_agent.netagent_uuid, remove_netagent_uuid);
5107 if (!uuid_is_null(remove_netagent_uuid)) {
5108 necp_client_remove_agent_from_result(client, remove_netagent_uuid);
5109 }
5110 client->result_read = FALSE;
5111 // Found the client, break
5112 updated_result = TRUE;
5113 NECP_CLIENT_UNLOCK(client);
5114 }
5115 if (updated_result) {
5116 necp_fd_notify(client_fd, true);
5117 }
5118 NECP_FD_UNLOCK(client_fd);
5119 if (updated_result) {
5120 // Found the client, break
5121 break;
5122 }
5123 }
5124
5125 NECP_FD_LIST_UNLOCK();
5126 }
5127
5128 #if SKYWALK
5129 void
necp_client_early_close(uuid_t client_id)5130 necp_client_early_close(uuid_t client_id)
5131 {
5132 NECP_CLIENT_TREE_LOCK_SHARED();
5133
5134 struct necp_client *client = necp_find_client_and_lock(client_id);
5135 if (client != NULL) {
5136 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
5137 if (flow_registration != NULL) {
5138 // Found the right client and flow, mark the stats as over
5139 if (flow_registration->stats_handler_context != NULL) {
5140 ntstat_userland_stats_event(flow_registration->stats_handler_context,
5141 NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT);
5142 }
5143 }
5144 NECP_CLIENT_UNLOCK(client);
5145 }
5146
5147 NECP_CLIENT_TREE_UNLOCK();
5148 }
5149 #endif /* SKYWALK */
5150
5151 /// Interface matching
5152
5153 #define NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
5154 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF | \
5155 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
5156 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE | \
5157 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
5158 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT | \
5159 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
5160 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \
5161 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \
5162 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE | \
5163 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \
5164 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
5165
5166 #define NECP_PARSED_PARAMETERS_SCOPED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
5167 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
5168 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
5169 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
5170 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \
5171 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE)
5172
5173 #define NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
5174 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)
5175
5176 #define NECP_PARSED_PARAMETERS_PREFERRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
5177 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \
5178 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \
5179 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
5180
5181 static bool
necp_ifnet_matches_type(struct ifnet * ifp,u_int8_t interface_type,bool check_delegates)5182 necp_ifnet_matches_type(struct ifnet *ifp, u_int8_t interface_type, bool check_delegates)
5183 {
5184 struct ifnet *check_ifp = ifp;
5185 while (check_ifp) {
5186 if (if_functional_type(check_ifp, TRUE) == interface_type) {
5187 return TRUE;
5188 }
5189 if (!check_delegates) {
5190 break;
5191 }
5192 check_ifp = check_ifp->if_delegated.ifp;
5193 }
5194 return FALSE;
5195 }
5196
5197 static bool
necp_ifnet_matches_name(struct ifnet * ifp,const char * interface_name,bool check_delegates)5198 necp_ifnet_matches_name(struct ifnet *ifp, const char *interface_name, bool check_delegates)
5199 {
5200 struct ifnet *check_ifp = ifp;
5201 while (check_ifp) {
5202 if (strncmp(check_ifp->if_xname, interface_name, IFXNAMSIZ) == 0) {
5203 return TRUE;
5204 }
5205 if (!check_delegates) {
5206 break;
5207 }
5208 check_ifp = check_ifp->if_delegated.ifp;
5209 }
5210 return FALSE;
5211 }
5212
5213 static bool
necp_ifnet_matches_agent(struct ifnet * ifp,uuid_t * agent_uuid,bool check_delegates)5214 necp_ifnet_matches_agent(struct ifnet *ifp, uuid_t *agent_uuid, bool check_delegates)
5215 {
5216 struct ifnet *check_ifp = ifp;
5217
5218 while (check_ifp != NULL) {
5219 ifnet_lock_shared(check_ifp);
5220 if (check_ifp->if_agentids != NULL) {
5221 for (u_int32_t index = 0; index < check_ifp->if_agentcount; index++) {
5222 if (uuid_compare(check_ifp->if_agentids[index], *agent_uuid) == 0) {
5223 ifnet_lock_done(check_ifp);
5224 return TRUE;
5225 }
5226 }
5227 }
5228 ifnet_lock_done(check_ifp);
5229
5230 if (!check_delegates) {
5231 break;
5232 }
5233 check_ifp = check_ifp->if_delegated.ifp;
5234 }
5235 return FALSE;
5236 }
5237
5238 static bool
necp_ifnet_matches_agent_type(struct ifnet * ifp,const char * agent_domain,const char * agent_type,bool check_delegates)5239 necp_ifnet_matches_agent_type(struct ifnet *ifp, const char *agent_domain, const char *agent_type, bool check_delegates)
5240 {
5241 struct ifnet *check_ifp = ifp;
5242
5243 while (check_ifp != NULL) {
5244 ifnet_lock_shared(check_ifp);
5245 if (check_ifp->if_agentids != NULL) {
5246 for (u_int32_t index = 0; index < check_ifp->if_agentcount; index++) {
5247 if (uuid_is_null(check_ifp->if_agentids[index])) {
5248 continue;
5249 }
5250
5251 char if_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
5252 char if_agent_type[NETAGENT_TYPESIZE] = { 0 };
5253
5254 if (netagent_get_agent_domain_and_type(check_ifp->if_agentids[index], if_agent_domain, if_agent_type)) {
5255 if (necp_agent_types_match(agent_domain, agent_type, if_agent_domain, if_agent_type)) {
5256 ifnet_lock_done(check_ifp);
5257 return TRUE;
5258 }
5259 }
5260 }
5261 }
5262 ifnet_lock_done(check_ifp);
5263
5264 if (!check_delegates) {
5265 break;
5266 }
5267 check_ifp = check_ifp->if_delegated.ifp;
5268 }
5269 return FALSE;
5270 }
5271
5272 static bool
necp_ifnet_matches_local_address(struct ifnet * ifp,struct sockaddr * sa)5273 necp_ifnet_matches_local_address(struct ifnet *ifp, struct sockaddr *sa)
5274 {
5275 struct ifaddr *ifa = NULL;
5276 bool matched_local_address = FALSE;
5277
5278 // Transform sa into the ifaddr form
5279 // IPv6 Scope IDs are always embedded in the ifaddr list
5280 struct sockaddr_storage address;
5281 u_int ifscope = IFSCOPE_NONE;
5282 (void)sa_copy(sa, &address, &ifscope);
5283 SIN(&address)->sin_port = 0;
5284 if (address.ss_family == AF_INET6) {
5285 if (in6_embedded_scope ||
5286 !IN6_IS_SCOPE_EMBED(&SIN6(&address)->sin6_addr)) {
5287 SIN6(&address)->sin6_scope_id = 0;
5288 }
5289 }
5290
5291 ifa = ifa_ifwithaddr_scoped_locked((struct sockaddr *)&address, ifp->if_index);
5292 matched_local_address = (ifa != NULL);
5293
5294 if (ifa) {
5295 ifaddr_release(ifa);
5296 }
5297
5298 return matched_local_address;
5299 }
5300
5301 static bool
necp_interface_type_is_primary_eligible(u_int8_t interface_type)5302 necp_interface_type_is_primary_eligible(u_int8_t interface_type)
5303 {
5304 switch (interface_type) {
5305 // These types can never be primary, so a client requesting these types is allowed
5306 // to match an interface that isn't currently eligible to be primary (has default
5307 // route, dns, etc)
5308 case IFRTYPE_FUNCTIONAL_WIFI_AWDL:
5309 case IFRTYPE_FUNCTIONAL_INTCOPROC:
5310 return false;
5311 default:
5312 break;
5313 }
5314 return true;
5315 }
5316
5317 #define NECP_IFP_IS_ON_ORDERED_LIST(_ifp) ((_ifp)->if_ordered_link.tqe_next != NULL || (_ifp)->if_ordered_link.tqe_prev != NULL)
5318
5319 // Secondary interface flag indicates that the interface is being
5320 // used for multipath or a listener as an extra path
5321 static bool
necp_ifnet_matches_parameters(struct ifnet * ifp,struct necp_client_parsed_parameters * parsed_parameters,u_int32_t override_flags,u_int32_t * preferred_count,bool secondary_interface,bool require_scoped_field)5322 necp_ifnet_matches_parameters(struct ifnet *ifp,
5323 struct necp_client_parsed_parameters *parsed_parameters,
5324 u_int32_t override_flags,
5325 u_int32_t *preferred_count,
5326 bool secondary_interface,
5327 bool require_scoped_field)
5328 {
5329 bool matched_some_scoped_field = FALSE;
5330
5331 if (preferred_count) {
5332 *preferred_count = 0;
5333 }
5334
5335 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) {
5336 if (parsed_parameters->required_interface_index != ifp->if_index) {
5337 return FALSE;
5338 }
5339 }
5340 #if SKYWALK
5341 else {
5342 if (ifnet_is_low_latency(ifp)) {
5343 return FALSE;
5344 }
5345 }
5346 #endif /* SKYWALK */
5347
5348 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR) {
5349 if (!necp_ifnet_matches_local_address(ifp, &parsed_parameters->local_addr.sa)) {
5350 return FALSE;
5351 }
5352 if (require_scoped_field) {
5353 matched_some_scoped_field = TRUE;
5354 }
5355 }
5356
5357 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) {
5358 if (override_flags != 0) {
5359 if ((override_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) &&
5360 IFNET_IS_EXPENSIVE(ifp)) {
5361 return FALSE;
5362 }
5363 if ((override_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED) &&
5364 IFNET_IS_CONSTRAINED(ifp)) {
5365 return FALSE;
5366 }
5367 } else {
5368 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) &&
5369 IFNET_IS_EXPENSIVE(ifp)) {
5370 return FALSE;
5371 }
5372 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED) &&
5373 IFNET_IS_CONSTRAINED(ifp)) {
5374 return FALSE;
5375 }
5376 }
5377 }
5378
5379 if ((!secondary_interface || // Enforce interface type if this is the primary interface
5380 !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) || // or if there are no flags
5381 !(parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE)) && // or if the flags don't give an exception
5382 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) &&
5383 !necp_ifnet_matches_type(ifp, parsed_parameters->required_interface_type, FALSE)) {
5384 return FALSE;
5385 }
5386
5387 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) {
5388 if (require_scoped_field) {
5389 matched_some_scoped_field = TRUE;
5390 }
5391 }
5392
5393 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE) {
5394 for (int i = 0; i < NECP_MAX_INTERFACE_PARAMETERS; i++) {
5395 if (parsed_parameters->prohibited_interface_types[i] == 0) {
5396 break;
5397 }
5398
5399 if (necp_ifnet_matches_type(ifp, parsed_parameters->prohibited_interface_types[i], TRUE)) {
5400 return FALSE;
5401 }
5402 }
5403 }
5404
5405 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF) {
5406 for (int i = 0; i < NECP_MAX_INTERFACE_PARAMETERS; i++) {
5407 if (strlen(parsed_parameters->prohibited_interfaces[i]) == 0) {
5408 break;
5409 }
5410
5411 if (necp_ifnet_matches_name(ifp, parsed_parameters->prohibited_interfaces[i], TRUE)) {
5412 return FALSE;
5413 }
5414 }
5415 }
5416
5417 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
5418 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5419 if (uuid_is_null(parsed_parameters->required_netagents[i])) {
5420 break;
5421 }
5422
5423 if (!necp_ifnet_matches_agent(ifp, &parsed_parameters->required_netagents[i], FALSE)) {
5424 return FALSE;
5425 }
5426
5427 if (require_scoped_field) {
5428 matched_some_scoped_field = TRUE;
5429 }
5430 }
5431 }
5432
5433 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT) {
5434 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5435 if (uuid_is_null(parsed_parameters->prohibited_netagents[i])) {
5436 break;
5437 }
5438
5439 if (necp_ifnet_matches_agent(ifp, &parsed_parameters->prohibited_netagents[i], TRUE)) {
5440 return FALSE;
5441 }
5442 }
5443 }
5444
5445 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
5446 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5447 if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 &&
5448 strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
5449 break;
5450 }
5451
5452 if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->required_netagent_types[i].netagent_domain, parsed_parameters->required_netagent_types[i].netagent_type, FALSE)) {
5453 return FALSE;
5454 }
5455
5456 if (require_scoped_field) {
5457 matched_some_scoped_field = TRUE;
5458 }
5459 }
5460 }
5461
5462 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE) {
5463 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5464 if (strlen(parsed_parameters->prohibited_netagent_types[i].netagent_domain) == 0 &&
5465 strlen(parsed_parameters->prohibited_netagent_types[i].netagent_type) == 0) {
5466 break;
5467 }
5468
5469 if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->prohibited_netagent_types[i].netagent_domain, parsed_parameters->prohibited_netagent_types[i].netagent_type, TRUE)) {
5470 return FALSE;
5471 }
5472 }
5473 }
5474
5475 // Checked preferred properties
5476 if (preferred_count) {
5477 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT) {
5478 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5479 if (uuid_is_null(parsed_parameters->preferred_netagents[i])) {
5480 break;
5481 }
5482
5483 if (necp_ifnet_matches_agent(ifp, &parsed_parameters->preferred_netagents[i], TRUE)) {
5484 (*preferred_count)++;
5485 if (require_scoped_field) {
5486 matched_some_scoped_field = TRUE;
5487 }
5488 }
5489 }
5490 }
5491
5492 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE) {
5493 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5494 if (strlen(parsed_parameters->preferred_netagent_types[i].netagent_domain) == 0 &&
5495 strlen(parsed_parameters->preferred_netagent_types[i].netagent_type) == 0) {
5496 break;
5497 }
5498
5499 if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->preferred_netagent_types[i].netagent_domain, parsed_parameters->preferred_netagent_types[i].netagent_type, TRUE)) {
5500 (*preferred_count)++;
5501 if (require_scoped_field) {
5502 matched_some_scoped_field = TRUE;
5503 }
5504 }
5505 }
5506 }
5507
5508 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT) {
5509 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5510 if (uuid_is_null(parsed_parameters->avoided_netagents[i])) {
5511 break;
5512 }
5513
5514 if (!necp_ifnet_matches_agent(ifp, &parsed_parameters->avoided_netagents[i], TRUE)) {
5515 (*preferred_count)++;
5516 }
5517 }
5518 }
5519
5520 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE) {
5521 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5522 if (strlen(parsed_parameters->avoided_netagent_types[i].netagent_domain) == 0 &&
5523 strlen(parsed_parameters->avoided_netagent_types[i].netagent_type) == 0) {
5524 break;
5525 }
5526
5527 if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->avoided_netagent_types[i].netagent_domain,
5528 parsed_parameters->avoided_netagent_types[i].netagent_type, TRUE)) {
5529 (*preferred_count)++;
5530 }
5531 }
5532 }
5533 }
5534
5535 if (require_scoped_field) {
5536 return matched_some_scoped_field;
5537 }
5538
5539 return TRUE;
5540 }
5541
5542 static bool
necp_find_matching_interface_index(struct necp_client_parsed_parameters * parsed_parameters,u_int * return_ifindex,bool * validate_agents)5543 necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters,
5544 u_int *return_ifindex, bool *validate_agents)
5545 {
5546 struct ifnet *ifp = NULL;
5547 u_int32_t best_preferred_count = 0;
5548 bool has_preferred_fields = FALSE;
5549 *return_ifindex = 0;
5550
5551 if (parsed_parameters->required_interface_index != 0) {
5552 *return_ifindex = parsed_parameters->required_interface_index;
5553 return TRUE;
5554 }
5555
5556 // Check and save off flags
5557 u_int32_t flags = 0;
5558 bool has_prohibit_flags = FALSE;
5559 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) {
5560 flags = parsed_parameters->flags;
5561 has_prohibit_flags = (parsed_parameters->flags &
5562 (NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE |
5563 NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED));
5564 }
5565
5566 if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS) &&
5567 !has_prohibit_flags) {
5568 return TRUE;
5569 }
5570
5571 has_preferred_fields = (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS);
5572
5573 // We have interesting parameters to parse and find a matching interface
5574 ifnet_head_lock_shared();
5575
5576 if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS) &&
5577 !has_preferred_fields) {
5578 // We do have fields to match, but they are only prohibitory
5579 // If the first interface in the list matches, or there are no ordered interfaces, we don't need to scope
5580 ifp = TAILQ_FIRST(&ifnet_ordered_head);
5581 if (ifp == NULL || necp_ifnet_matches_parameters(ifp, parsed_parameters, 0, NULL, false, false)) {
5582 // Don't set return_ifindex, so the client doesn't need to scope
5583 ifnet_head_done();
5584 return TRUE;
5585 }
5586 }
5587
5588 // First check the ordered interface list
5589 TAILQ_FOREACH(ifp, &ifnet_ordered_head, if_ordered_link) {
5590 u_int32_t preferred_count = 0;
5591 if (necp_ifnet_matches_parameters(ifp, parsed_parameters, flags, &preferred_count, false, false)) {
5592 if (preferred_count > best_preferred_count ||
5593 *return_ifindex == 0) {
5594 // Everything matched, and is most preferred. Return this interface.
5595 *return_ifindex = ifp->if_index;
5596 best_preferred_count = preferred_count;
5597
5598 if (!has_preferred_fields) {
5599 break;
5600 }
5601 }
5602 }
5603
5604 if (has_prohibit_flags &&
5605 ifp == TAILQ_FIRST(&ifnet_ordered_head)) {
5606 // This was the first interface. From here on, if the
5607 // client prohibited either expensive or constrained,
5608 // don't allow either as a secondary interface option.
5609 flags |= (NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE |
5610 NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED);
5611 }
5612 }
5613
5614 bool is_listener = ((parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
5615 (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER));
5616
5617 // Then check the remaining interfaces
5618 if ((parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS) &&
5619 ((!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)) ||
5620 !necp_interface_type_is_primary_eligible(parsed_parameters->required_interface_type) ||
5621 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR) ||
5622 is_listener) &&
5623 (*return_ifindex == 0 || has_preferred_fields)) {
5624 TAILQ_FOREACH(ifp, &ifnet_head, if_link) {
5625 u_int32_t preferred_count = 0;
5626 if (NECP_IFP_IS_ON_ORDERED_LIST(ifp)) {
5627 // This interface was in the ordered list, skip
5628 continue;
5629 }
5630 if (necp_ifnet_matches_parameters(ifp, parsed_parameters, flags, &preferred_count, false, true)) {
5631 if (preferred_count > best_preferred_count ||
5632 *return_ifindex == 0) {
5633 // Everything matched, and is most preferred. Return this interface.
5634 *return_ifindex = ifp->if_index;
5635 best_preferred_count = preferred_count;
5636
5637 if (!has_preferred_fields) {
5638 break;
5639 }
5640 }
5641 }
5642 }
5643 }
5644
5645 ifnet_head_done();
5646
5647 if (has_preferred_fields && best_preferred_count == 0 &&
5648 ((parsed_parameters->valid_fields & (NECP_PARSED_PARAMETERS_SCOPED_FIELDS | NECP_PARSED_PARAMETERS_PREFERRED_FIELDS)) ==
5649 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS))) {
5650 // If only has preferred ifnet fields, and nothing was found, clear the interface index and return TRUE
5651 *return_ifindex = 0;
5652 return TRUE;
5653 }
5654
5655 if (*return_ifindex == 0 &&
5656 !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS)) {
5657 // Has required fields, but not including specific interface fields. Pass for now, and check
5658 // to see if agents are satisfied by policy.
5659 *validate_agents = TRUE;
5660 return TRUE;
5661 }
5662
5663 return *return_ifindex != 0;
5664 }
5665
5666 void
necp_copy_inp_domain_info(struct inpcb * inp,struct socket * so,nstat_domain_info * domain_info)5667 necp_copy_inp_domain_info(struct inpcb *inp, struct socket *so, nstat_domain_info *domain_info)
5668 {
5669 if (inp == NULL || so == NULL || domain_info == NULL) {
5670 return;
5671 }
5672
5673 necp_lock_socket_attributes();
5674
5675 domain_info->is_tracker = !!(so->so_flags1 & SOF1_KNOWN_TRACKER);
5676 domain_info->is_non_app_initiated = !!(so->so_flags1 & SOF1_TRACKER_NON_APP_INITIATED);
5677 if (domain_info->is_tracker &&
5678 inp->inp_necp_attributes.inp_tracker_domain != NULL) {
5679 strlcpy(domain_info->domain_name, inp->inp_necp_attributes.inp_tracker_domain,
5680 sizeof(domain_info->domain_name));
5681 } else if (inp->inp_necp_attributes.inp_domain != NULL) {
5682 strlcpy(domain_info->domain_name, inp->inp_necp_attributes.inp_domain,
5683 sizeof(domain_info->domain_name));
5684 }
5685 if (inp->inp_necp_attributes.inp_domain_owner != NULL) {
5686 strlcpy(domain_info->domain_owner, inp->inp_necp_attributes.inp_domain_owner,
5687 sizeof(domain_info->domain_owner));
5688 }
5689 if (inp->inp_necp_attributes.inp_domain_context != NULL) {
5690 strlcpy(domain_info->domain_tracker_ctxt, inp->inp_necp_attributes.inp_domain_context,
5691 sizeof(domain_info->domain_tracker_ctxt));
5692 }
5693
5694 necp_unlock_socket_attributes();
5695 }
5696
5697 static size_t
necp_find_domain_info_common(struct necp_client * client,u_int8_t * parameters,size_t parameters_size,struct necp_client_flow_registration * flow_registration,nstat_domain_info * domain_info)5698 necp_find_domain_info_common(struct necp_client *client,
5699 u_int8_t *parameters,
5700 size_t parameters_size,
5701 struct necp_client_flow_registration *flow_registration, /* For logging purposes only */
5702 nstat_domain_info *domain_info)
5703 {
5704 if (client == NULL) {
5705 return 0;
5706 }
5707 if (domain_info == NULL) {
5708 return sizeof(nstat_domain_info);
5709 }
5710
5711 size_t offset = 0;
5712 u_int32_t flags = 0;
5713 u_int8_t *tracker_domain = NULL;
5714 u_int8_t *domain = NULL;
5715
5716 NECP_CLIENT_FLOW_LOG(client, flow_registration, "Collecting stats");
5717
5718 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
5719 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
5720 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
5721
5722 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
5723 // If the length is larger than what can fit in the remaining parameters size, bail
5724 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
5725 break;
5726 }
5727
5728 if (length > 0) {
5729 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
5730 if (value != NULL) {
5731 switch (type) {
5732 case NECP_CLIENT_PARAMETER_FLAGS: {
5733 if (length >= sizeof(u_int32_t)) {
5734 memcpy(&flags, value, sizeof(u_int32_t));
5735 }
5736
5737 domain_info->is_tracker =
5738 !!(flags & NECP_CLIENT_PARAMETER_FLAG_KNOWN_TRACKER);
5739 domain_info->is_non_app_initiated =
5740 !!(flags & NECP_CLIENT_PARAMETER_FLAG_NON_APP_INITIATED);
5741 domain_info->is_silent =
5742 !!(flags & NECP_CLIENT_PARAMETER_FLAG_SILENT);
5743 break;
5744 }
5745 case NECP_CLIENT_PARAMETER_TRACKER_DOMAIN: {
5746 tracker_domain = value;
5747 break;
5748 }
5749 case NECP_CLIENT_PARAMETER_DOMAIN: {
5750 domain = value;
5751 break;
5752 }
5753 case NECP_CLIENT_PARAMETER_DOMAIN_OWNER: {
5754 strlcpy(domain_info->domain_owner, (const char *)value, sizeof(domain_info->domain_owner));
5755 break;
5756 }
5757 case NECP_CLIENT_PARAMETER_DOMAIN_CONTEXT: {
5758 strlcpy(domain_info->domain_tracker_ctxt, (const char *)value, sizeof(domain_info->domain_tracker_ctxt));
5759 break;
5760 }
5761 case NECP_CLIENT_PARAMETER_ATTRIBUTED_BUNDLE_IDENTIFIER: {
5762 strlcpy(domain_info->domain_attributed_bundle_id, (const char *)value, sizeof(domain_info->domain_attributed_bundle_id));
5763 break;
5764 }
5765 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
5766 if (length >= sizeof(struct necp_policy_condition_addr)) {
5767 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
5768 if (necp_client_address_is_valid(&address_struct->address.sa)) {
5769 memcpy(&domain_info->remote, &address_struct->address, sizeof(address_struct->address));
5770 }
5771 }
5772 break;
5773 }
5774 default: {
5775 break;
5776 }
5777 }
5778 }
5779 }
5780 offset += sizeof(struct necp_tlv_header) + length;
5781 }
5782
5783 if (domain_info->is_tracker && tracker_domain) {
5784 strlcpy(domain_info->domain_name, (const char *)tracker_domain, sizeof(domain_info->domain_name));
5785 } else if (domain) {
5786 strlcpy(domain_info->domain_name, (const char *)domain, sizeof(domain_info->domain_name));
5787 }
5788
5789 // Log if it is a known tracker
5790 if (domain_info->is_tracker && client) {
5791 NECP_CLIENT_TRACKER_LOG(client->proc_pid,
5792 "Collected stats - domain <%s> owner <%s> ctxt <%s> bundle id <%s> "
5793 "is_tracker %d is_non_app_initiated %d is_silent %d",
5794 domain_info->domain_name[0] ? "present" : "not set",
5795 domain_info->domain_owner[0] ? "present" : "not set",
5796 domain_info->domain_tracker_ctxt[0] ? "present" : "not set",
5797 domain_info->domain_attributed_bundle_id[0] ? "present" : "not set",
5798 domain_info->is_tracker,
5799 domain_info->is_non_app_initiated,
5800 domain_info->is_silent);
5801 }
5802
5803 NECP_CLIENT_FLOW_LOG(client, flow_registration,
5804 "Collected stats - domain <%s> owner <%s> ctxt <%s> bundle id <%s> "
5805 "is_tracker %d is_non_app_initiated %d is_silent %d",
5806 domain_info->domain_name,
5807 domain_info->domain_owner,
5808 domain_info->domain_tracker_ctxt,
5809 domain_info->domain_attributed_bundle_id,
5810 domain_info->is_tracker,
5811 domain_info->is_non_app_initiated,
5812 domain_info->is_silent);
5813
5814 return sizeof(nstat_domain_info);
5815 }
5816
5817 static size_t
necp_find_conn_extension_info(nstat_provider_context ctx,int requested_extension,void * buf,size_t buf_size)5818 necp_find_conn_extension_info(nstat_provider_context ctx,
5819 int requested_extension, /* The extension to be returned */
5820 void *buf, /* If not NULL, the address for extensions to be returned in */
5821 size_t buf_size) /* The size of the buffer space, typically matching the return from a previous call with a NULL buf pointer */
5822 {
5823 // Note, the caller has guaranteed that any buffer has been zeroed, there is no need to clear it again
5824
5825 if (ctx == NULL) {
5826 return 0;
5827 }
5828 struct necp_client *client = (struct necp_client *)ctx;
5829 switch (requested_extension) {
5830 case NSTAT_EXTENDED_UPDATE_TYPE_DOMAIN:
5831 // This is for completeness. The intent is that domain information can be extracted at user level from the TLV parameters
5832 if (buf == NULL) {
5833 return sizeof(nstat_domain_info);
5834 }
5835 if (buf_size < sizeof(nstat_domain_info)) {
5836 return 0;
5837 }
5838 return necp_find_domain_info_common(client, client->parameters, client->parameters_length, NULL, (nstat_domain_info *)buf);
5839
5840 case NSTAT_EXTENDED_UPDATE_TYPE_NECP_TLV:
5841 if (buf == NULL) {
5842 return client->parameters_length;
5843 }
5844 if (buf_size < client->parameters_length) {
5845 return 0;
5846 }
5847 memcpy(buf, client->parameters, client->parameters_length);
5848 return client->parameters_length;
5849
5850 case NSTAT_EXTENDED_UPDATE_TYPE_ORIGINAL_NECP_TLV:
5851 if (buf == NULL) {
5852 return (client->original_parameters_source != NULL) ? client->original_parameters_source->parameters_length : 0;
5853 }
5854 if ((client->original_parameters_source == NULL) || (buf_size < client->original_parameters_source->parameters_length)) {
5855 return 0;
5856 }
5857 memcpy(buf, client->original_parameters_source->parameters, client->original_parameters_source->parameters_length);
5858 return client->original_parameters_source->parameters_length;
5859
5860 case NSTAT_EXTENDED_UPDATE_TYPE_ORIGINAL_DOMAIN:
5861 if (buf == NULL) {
5862 return (client->original_parameters_source != NULL) ? sizeof(nstat_domain_info) : 0;
5863 }
5864 if ((buf_size < sizeof(nstat_domain_info)) || (client->original_parameters_source == NULL)) {
5865 return 0;
5866 }
5867 return necp_find_domain_info_common(client, client->original_parameters_source->parameters, client->original_parameters_source->parameters_length,
5868 NULL, (nstat_domain_info *)buf);
5869
5870 default:
5871 return 0;
5872 }
5873 }
5874
5875 #if SKYWALK
5876
5877 static size_t
necp_find_extension_info(userland_stats_provider_context * ctx,int requested_extension,void * buf,size_t buf_size)5878 necp_find_extension_info(userland_stats_provider_context *ctx,
5879 int requested_extension, /* The extension to be returned */
5880 void *buf, /* If not NULL, the address for extensions to be returned in */
5881 size_t buf_size) /* The size of the buffer space, typically matching the return from a previous call with a NULL buf pointer */
5882 {
5883 if (ctx == NULL) {
5884 return 0;
5885 }
5886 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
5887 struct necp_client *client = flow_registration->client;
5888
5889 switch (requested_extension) {
5890 case NSTAT_EXTENDED_UPDATE_TYPE_DOMAIN:
5891 if (buf == NULL) {
5892 return sizeof(nstat_domain_info);
5893 }
5894 if (buf_size < sizeof(nstat_domain_info)) {
5895 return 0;
5896 }
5897 return necp_find_domain_info_common(client, client->parameters, client->parameters_length, flow_registration, (nstat_domain_info *)buf);
5898
5899 case NSTAT_EXTENDED_UPDATE_TYPE_NECP_TLV:
5900 if (buf == NULL) {
5901 return client->parameters_length;
5902 }
5903 if (buf_size < client->parameters_length) {
5904 return 0;
5905 }
5906 memcpy(buf, client->parameters, client->parameters_length);
5907 return client->parameters_length;
5908
5909 default:
5910 return 0;
5911 }
5912 }
5913
5914 static void
necp_find_netstat_data(struct necp_client * client,union necp_sockaddr_union * remote,pid_t * effective_pid,uuid_t euuid,u_int32_t * traffic_class,u_int8_t * fallback_mode)5915 necp_find_netstat_data(struct necp_client *client,
5916 union necp_sockaddr_union *remote,
5917 pid_t *effective_pid,
5918 uuid_t euuid,
5919 u_int32_t *traffic_class,
5920 u_int8_t *fallback_mode)
5921 {
5922 size_t offset = 0;
5923 u_int8_t *parameters;
5924 u_int32_t parameters_size;
5925
5926 parameters = client->parameters;
5927 parameters_size = (u_int32_t)client->parameters_length;
5928
5929 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
5930 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
5931 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
5932
5933 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
5934 // If the length is larger than what can fit in the remaining parameters size, bail
5935 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
5936 break;
5937 }
5938
5939 if (length > 0) {
5940 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
5941 if (value != NULL) {
5942 switch (type) {
5943 case NECP_CLIENT_PARAMETER_APPLICATION: {
5944 if (length >= sizeof(uuid_t)) {
5945 uuid_copy(euuid, value);
5946 }
5947 break;
5948 }
5949 case NECP_CLIENT_PARAMETER_PID: {
5950 if (length >= sizeof(pid_t)) {
5951 memcpy(effective_pid, value, sizeof(pid_t));
5952 }
5953 break;
5954 }
5955 case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: {
5956 if (length >= sizeof(u_int32_t)) {
5957 memcpy(traffic_class, value, sizeof(u_int32_t));
5958 }
5959 break;
5960 }
5961 case NECP_CLIENT_PARAMETER_FALLBACK_MODE: {
5962 if (length >= sizeof(u_int8_t)) {
5963 memcpy(fallback_mode, value, sizeof(u_int8_t));
5964 }
5965 break;
5966 }
5967 // It is an implementation quirk that the remote address can be found in the necp parameters
5968 // while the local address must be retrieved from the flowswitch
5969 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
5970 if (length >= sizeof(struct necp_policy_condition_addr)) {
5971 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
5972 if (necp_client_address_is_valid(&address_struct->address.sa)) {
5973 memcpy(remote, &address_struct->address, sizeof(address_struct->address));
5974 }
5975 }
5976 break;
5977 }
5978 default: {
5979 break;
5980 }
5981 }
5982 }
5983 }
5984 offset += sizeof(struct necp_tlv_header) + length;
5985 }
5986 }
5987
5988 // Called from NetworkStatistics when it wishes to collect latest information for a TCP flow.
5989 // It is a responsibility of NetworkStatistics to have previously zeroed any supplied memory.
5990 static bool
necp_request_tcp_netstats(userland_stats_provider_context * ctx,u_int16_t * ifflagsp,nstat_progress_digest * digestp,nstat_counts * countsp,void * metadatap)5991 necp_request_tcp_netstats(userland_stats_provider_context *ctx,
5992 u_int16_t *ifflagsp,
5993 nstat_progress_digest *digestp,
5994 nstat_counts *countsp,
5995 void *metadatap)
5996 {
5997 if (ctx == NULL) {
5998 return false;
5999 }
6000
6001 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6002 struct necp_client *client = flow_registration->client;
6003 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
6004 struct necp_tcp_stats *tcpstats = (struct necp_tcp_stats *)ustats_kaddr;
6005 ASSERT(tcpstats != NULL);
6006
6007 u_int16_t nstat_diagnostic_flags = 0;
6008
6009 // Retrieve details from the last time the assigned flows were updated
6010 u_int32_t route_ifindex = IFSCOPE_NONE;
6011 u_int16_t route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6012 u_int64_t combined_interface_details = 0;
6013
6014 atomic_get_64(combined_interface_details, &flow_registration->last_interface_details);
6015 split_interface_details(combined_interface_details, &route_ifindex, &route_ifflags);
6016
6017 if (route_ifindex == IFSCOPE_NONE) {
6018 // Mark no interface
6019 nstat_diagnostic_flags |= NSTAT_IFNET_ROUTE_VALUE_UNOBTAINABLE;
6020 route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6021 NECPLOG(LOG_INFO, "req tcp stats, failed to get route details for pid %d curproc %d %s\n",
6022 client->proc_pid, proc_pid(current_proc()), proc_best_name(current_proc()));
6023 }
6024
6025 if (ifflagsp) {
6026 *ifflagsp = route_ifflags | nstat_diagnostic_flags;
6027 if (tcpstats->necp_tcp_extra.flags1 & SOF1_CELLFALLBACK) {
6028 *ifflagsp |= NSTAT_IFNET_VIA_CELLFALLBACK;
6029 }
6030 if ((digestp == NULL) && (countsp == NULL) && (metadatap == NULL)) {
6031 return true;
6032 }
6033 }
6034
6035 if (digestp) {
6036 // The digest is intended to give information that may help give insight into the state of the link
6037 // while avoiding the need to do the relatively expensive flowswitch lookup
6038 digestp->rxbytes = tcpstats->necp_tcp_counts.necp_stat_rxbytes;
6039 digestp->txbytes = tcpstats->necp_tcp_counts.necp_stat_txbytes;
6040 digestp->rxduplicatebytes = tcpstats->necp_tcp_counts.necp_stat_rxduplicatebytes;
6041 digestp->rxoutoforderbytes = tcpstats->necp_tcp_counts.necp_stat_rxoutoforderbytes;
6042 digestp->txretransmit = tcpstats->necp_tcp_counts.necp_stat_txretransmit;
6043 digestp->ifindex = route_ifindex;
6044 digestp->state = tcpstats->necp_tcp_extra.state;
6045 digestp->txunacked = tcpstats->necp_tcp_extra.txunacked;
6046 digestp->txwindow = tcpstats->necp_tcp_extra.txwindow;
6047 digestp->connstatus.probe_activated = tcpstats->necp_tcp_extra.probestatus.probe_activated;
6048 digestp->connstatus.write_probe_failed = tcpstats->necp_tcp_extra.probestatus.write_probe_failed;
6049 digestp->connstatus.read_probe_failed = tcpstats->necp_tcp_extra.probestatus.read_probe_failed;
6050 digestp->connstatus.conn_probe_failed = tcpstats->necp_tcp_extra.probestatus.conn_probe_failed;
6051
6052 if ((countsp == NULL) && (metadatap == NULL)) {
6053 return true;
6054 }
6055 }
6056
6057 const struct sk_stats_flow *sf = &flow_registration->nexus_stats->fs_stats;
6058 if (sf == NULL) {
6059 nstat_diagnostic_flags |= NSTAT_IFNET_FLOWSWITCH_VALUE_UNOBTAINABLE;
6060 char namebuf[MAXCOMLEN + 1];
6061 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
6062 proc_name(client->proc_pid, namebuf, sizeof(namebuf));
6063 NECPLOG(LOG_ERR, "req tcp stats, necp_client flow_registration flow_stats missing for pid %d %s curproc %d %s\n",
6064 client->proc_pid, namebuf, proc_pid(current_proc()), proc_best_name(current_proc()));
6065 sf = &ntstat_sk_stats_zero;
6066 }
6067
6068 if (countsp) {
6069 countsp->nstat_rxbytes = tcpstats->necp_tcp_counts.necp_stat_rxbytes;
6070 countsp->nstat_txbytes = tcpstats->necp_tcp_counts.necp_stat_txbytes;
6071
6072 countsp->nstat_rxduplicatebytes = tcpstats->necp_tcp_counts.necp_stat_rxduplicatebytes;
6073 countsp->nstat_rxoutoforderbytes = tcpstats->necp_tcp_counts.necp_stat_rxoutoforderbytes;
6074 countsp->nstat_txretransmit = tcpstats->necp_tcp_counts.necp_stat_txretransmit;
6075
6076 countsp->nstat_min_rtt = tcpstats->necp_tcp_counts.necp_stat_min_rtt;
6077 countsp->nstat_avg_rtt = tcpstats->necp_tcp_counts.necp_stat_avg_rtt;
6078 countsp->nstat_var_rtt = tcpstats->necp_tcp_counts.necp_stat_var_rtt;
6079
6080 countsp->nstat_connectattempts = tcpstats->necp_tcp_extra.state >= TCPS_SYN_SENT ? 1 : 0;
6081 countsp->nstat_connectsuccesses = tcpstats->necp_tcp_extra.state >= TCPS_ESTABLISHED ? 1 : 0;
6082
6083 // Supplement what the user level has told us with what we know from the flowswitch
6084 countsp->nstat_rxpackets = sf->sf_ipackets;
6085 countsp->nstat_txpackets = sf->sf_opackets;
6086 if (route_ifflags & NSTAT_IFNET_IS_CELLULAR) {
6087 countsp->nstat_cell_rxbytes = sf->sf_ibytes;
6088 countsp->nstat_cell_txbytes = sf->sf_obytes;
6089 } else if (route_ifflags & NSTAT_IFNET_IS_WIFI) {
6090 countsp->nstat_wifi_rxbytes = sf->sf_ibytes;
6091 countsp->nstat_wifi_txbytes = sf->sf_obytes;
6092 } else if (route_ifflags & NSTAT_IFNET_IS_WIRED) {
6093 countsp->nstat_wired_rxbytes = sf->sf_ibytes;
6094 countsp->nstat_wired_txbytes = sf->sf_obytes;
6095 }
6096 }
6097
6098 if (metadatap) {
6099 nstat_tcp_descriptor *desc = (nstat_tcp_descriptor *)metadatap;
6100 memset(desc, 0, sizeof(*desc));
6101
6102 // Metadata from the flow registration
6103 uuid_copy(desc->fuuid, flow_registration->registration_id);
6104
6105 // Metadata that the necp client should have in TLV format.
6106 pid_t effective_pid = client->proc_pid;
6107 necp_find_netstat_data(client, (union necp_sockaddr_union *)&desc->remote, &effective_pid, desc->euuid, &desc->traffic_class, &desc->fallback_mode);
6108 desc->epid = (u_int32_t)effective_pid;
6109
6110 // Metadata from the flow registration
6111 // This needs to revisited if multiple flows are created from one flow registration
6112 struct necp_client_flow *flow = NULL;
6113 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
6114 memcpy(&desc->local, &flow->local_addr, sizeof(desc->local));
6115 break;
6116 }
6117
6118 // Metadata from the route
6119 desc->ifindex = route_ifindex;
6120 desc->ifnet_properties = route_ifflags | nstat_diagnostic_flags;
6121 desc->ifnet_properties |= (sf->sf_flags & SFLOWF_ONLINK) ? NSTAT_IFNET_IS_LOCAL : NSTAT_IFNET_IS_NON_LOCAL;
6122 if (tcpstats->necp_tcp_extra.flags1 & SOF1_CELLFALLBACK) {
6123 desc->ifnet_properties |= NSTAT_IFNET_VIA_CELLFALLBACK;
6124 }
6125
6126 // Basic metadata from userland
6127 desc->rcvbufsize = tcpstats->necp_tcp_basic.rcvbufsize;
6128 desc->rcvbufused = tcpstats->necp_tcp_basic.rcvbufused;
6129
6130 // Additional TCP specific data
6131 desc->sndbufsize = tcpstats->necp_tcp_extra.sndbufsize;
6132 desc->sndbufused = tcpstats->necp_tcp_extra.sndbufused;
6133 desc->txunacked = tcpstats->necp_tcp_extra.txunacked;
6134 desc->txwindow = tcpstats->necp_tcp_extra.txwindow;
6135 desc->txcwindow = tcpstats->necp_tcp_extra.txcwindow;
6136 desc->traffic_mgt_flags = tcpstats->necp_tcp_extra.traffic_mgt_flags;
6137 desc->state = tcpstats->necp_tcp_extra.state;
6138
6139 u_int32_t cc_alg_index = tcpstats->necp_tcp_extra.cc_alg_index;
6140 if (cc_alg_index < TCP_CC_ALGO_COUNT) {
6141 strlcpy(desc->cc_algo, tcp_cc_algo_list[cc_alg_index]->name, sizeof(desc->cc_algo));
6142 } else {
6143 strlcpy(desc->cc_algo, "unknown", sizeof(desc->cc_algo));
6144 }
6145
6146 desc->connstatus.probe_activated = tcpstats->necp_tcp_extra.probestatus.probe_activated;
6147 desc->connstatus.write_probe_failed = tcpstats->necp_tcp_extra.probestatus.write_probe_failed;
6148 desc->connstatus.read_probe_failed = tcpstats->necp_tcp_extra.probestatus.read_probe_failed;
6149 desc->connstatus.conn_probe_failed = tcpstats->necp_tcp_extra.probestatus.conn_probe_failed;
6150
6151 memcpy(&desc->activity_bitmap, &sf->sf_activity, sizeof(sf->sf_activity));
6152 }
6153
6154 return true;
6155 }
6156
6157 // Called from NetworkStatistics when it wishes to collect latest information for a UDP flow.
6158 static bool
necp_request_udp_netstats(userland_stats_provider_context * ctx,u_int16_t * ifflagsp,nstat_progress_digest * digestp,nstat_counts * countsp,void * metadatap)6159 necp_request_udp_netstats(userland_stats_provider_context *ctx,
6160 u_int16_t *ifflagsp,
6161 nstat_progress_digest *digestp,
6162 nstat_counts *countsp,
6163 void *metadatap)
6164 {
6165 #pragma unused(digestp)
6166
6167 if (ctx == NULL) {
6168 return false;
6169 }
6170
6171 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6172 struct necp_client *client = flow_registration->client;
6173 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
6174 struct necp_udp_stats *udpstats = (struct necp_udp_stats *)ustats_kaddr;
6175 ASSERT(udpstats != NULL);
6176
6177 u_int16_t nstat_diagnostic_flags = 0;
6178
6179 // Retrieve details from the last time the assigned flows were updated
6180 u_int32_t route_ifindex = IFSCOPE_NONE;
6181 u_int16_t route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6182 u_int64_t combined_interface_details = 0;
6183
6184 atomic_get_64(combined_interface_details, &flow_registration->last_interface_details);
6185 split_interface_details(combined_interface_details, &route_ifindex, &route_ifflags);
6186
6187 if (route_ifindex == IFSCOPE_NONE) {
6188 // Mark no interface
6189 nstat_diagnostic_flags |= NSTAT_IFNET_ROUTE_VALUE_UNOBTAINABLE;
6190 route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6191 NECPLOG(LOG_INFO, "req udp stats, failed to get route details for pid %d curproc %d %s\n",
6192 client->proc_pid, proc_pid(current_proc()), proc_best_name(current_proc()));
6193 }
6194
6195 if (ifflagsp) {
6196 *ifflagsp = route_ifflags | nstat_diagnostic_flags;
6197 if ((countsp == NULL) && (metadatap == NULL)) {
6198 return true;
6199 }
6200 }
6201 const struct sk_stats_flow *sf = &flow_registration->nexus_stats->fs_stats;
6202 if (sf == NULL) {
6203 nstat_diagnostic_flags |= NSTAT_IFNET_FLOWSWITCH_VALUE_UNOBTAINABLE;
6204 char namebuf[MAXCOMLEN + 1];
6205 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
6206 proc_name(client->proc_pid, namebuf, sizeof(namebuf));
6207 NECPLOG(LOG_ERR, "req udp stats, necp_client flow_registration flow_stats missing for pid %d %s curproc %d %s\n",
6208 client->proc_pid, namebuf, proc_pid(current_proc()), proc_best_name(current_proc()));
6209 sf = &ntstat_sk_stats_zero;
6210 }
6211
6212 if (countsp) {
6213 countsp->nstat_rxbytes = udpstats->necp_udp_counts.necp_stat_rxbytes;
6214 countsp->nstat_txbytes = udpstats->necp_udp_counts.necp_stat_txbytes;
6215
6216 countsp->nstat_rxduplicatebytes = udpstats->necp_udp_counts.necp_stat_rxduplicatebytes;
6217 countsp->nstat_rxoutoforderbytes = udpstats->necp_udp_counts.necp_stat_rxoutoforderbytes;
6218 countsp->nstat_txretransmit = udpstats->necp_udp_counts.necp_stat_txretransmit;
6219
6220 countsp->nstat_min_rtt = udpstats->necp_udp_counts.necp_stat_min_rtt;
6221 countsp->nstat_avg_rtt = udpstats->necp_udp_counts.necp_stat_avg_rtt;
6222 countsp->nstat_var_rtt = udpstats->necp_udp_counts.necp_stat_var_rtt;
6223
6224 // Supplement what the user level has told us with what we know from the flowswitch
6225 countsp->nstat_rxpackets = sf->sf_ipackets;
6226 countsp->nstat_txpackets = sf->sf_opackets;
6227 if (route_ifflags & NSTAT_IFNET_IS_CELLULAR) {
6228 countsp->nstat_cell_rxbytes = sf->sf_ibytes;
6229 countsp->nstat_cell_txbytes = sf->sf_obytes;
6230 } else if (route_ifflags & NSTAT_IFNET_IS_WIFI) {
6231 countsp->nstat_wifi_rxbytes = sf->sf_ibytes;
6232 countsp->nstat_wifi_txbytes = sf->sf_obytes;
6233 } else if (route_ifflags & NSTAT_IFNET_IS_WIRED) {
6234 countsp->nstat_wired_rxbytes = sf->sf_ibytes;
6235 countsp->nstat_wired_txbytes = sf->sf_obytes;
6236 }
6237 }
6238
6239 if (metadatap) {
6240 nstat_udp_descriptor *desc = (nstat_udp_descriptor *)metadatap;
6241 memset(desc, 0, sizeof(*desc));
6242
6243 // Metadata from the flow registration
6244 uuid_copy(desc->fuuid, flow_registration->registration_id);
6245
6246 // Metadata that the necp client should have in TLV format.
6247 pid_t effective_pid = client->proc_pid;
6248 necp_find_netstat_data(client, (union necp_sockaddr_union *)&desc->remote, &effective_pid, desc->euuid, &desc->traffic_class, &desc->fallback_mode);
6249 desc->epid = (u_int32_t)effective_pid;
6250
6251 // Metadata from the flow registration
6252 // This needs to revisited if multiple flows are created from one flow registration
6253 struct necp_client_flow *flow = NULL;
6254 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
6255 memcpy(&desc->local, &flow->local_addr, sizeof(desc->local));
6256 break;
6257 }
6258
6259 // Metadata from the route
6260 desc->ifindex = route_ifindex;
6261 desc->ifnet_properties = route_ifflags | nstat_diagnostic_flags;
6262
6263 // Basic metadata is all that is required for UDP
6264 desc->rcvbufsize = udpstats->necp_udp_basic.rcvbufsize;
6265 desc->rcvbufused = udpstats->necp_udp_basic.rcvbufused;
6266
6267 memcpy(&desc->activity_bitmap, &sf->sf_activity, sizeof(sf->sf_activity));
6268 }
6269
6270 return true;
6271 }
6272
6273 // Called from NetworkStatistics when it wishes to collect latest information for a QUIC flow.
6274 //
6275 // TODO: For now it is an exact implementation as that of TCP.
6276 // Still to keep the logic separate for future divergence, keeping the routines separate.
6277 // It also seems there are lots of common code between existing implementations and
6278 // it would be good to refactor this logic at some point.
6279 static bool
necp_request_quic_netstats(userland_stats_provider_context * ctx,u_int16_t * ifflagsp,nstat_progress_digest * digestp,nstat_counts * countsp,void * metadatap)6280 necp_request_quic_netstats(userland_stats_provider_context *ctx,
6281 u_int16_t *ifflagsp,
6282 nstat_progress_digest *digestp,
6283 nstat_counts *countsp,
6284 void *metadatap)
6285 {
6286 if (ctx == NULL) {
6287 return false;
6288 }
6289
6290 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6291 struct necp_client *client = flow_registration->client;
6292 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
6293 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
6294 ASSERT(quicstats != NULL);
6295
6296 u_int16_t nstat_diagnostic_flags = 0;
6297
6298 // Retrieve details from the last time the assigned flows were updated
6299 u_int32_t route_ifindex = IFSCOPE_NONE;
6300 u_int16_t route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6301 u_int64_t combined_interface_details = 0;
6302
6303 atomic_get_64(combined_interface_details, &flow_registration->last_interface_details);
6304 split_interface_details(combined_interface_details, &route_ifindex, &route_ifflags);
6305
6306 if (route_ifindex == IFSCOPE_NONE) {
6307 // Mark no interface
6308 nstat_diagnostic_flags |= NSTAT_IFNET_ROUTE_VALUE_UNOBTAINABLE;
6309 route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6310 NECPLOG(LOG_INFO, "req quic stats, failed to get route details for pid %d curproc %d %s\n",
6311 client->proc_pid, proc_pid(current_proc()), proc_best_name(current_proc()));
6312 }
6313
6314 if (ifflagsp) {
6315 *ifflagsp = route_ifflags | nstat_diagnostic_flags;
6316 if ((digestp == NULL) && (countsp == NULL) && (metadatap == NULL)) {
6317 return true;
6318 }
6319 }
6320
6321 if (digestp) {
6322 // The digest is intended to give information that may help give insight into the state of the link
6323 // while avoiding the need to do the relatively expensive flowswitch lookup
6324 digestp->rxbytes = quicstats->necp_quic_counts.necp_stat_rxbytes;
6325 digestp->txbytes = quicstats->necp_quic_counts.necp_stat_txbytes;
6326 digestp->rxduplicatebytes = quicstats->necp_quic_counts.necp_stat_rxduplicatebytes;
6327 digestp->rxoutoforderbytes = quicstats->necp_quic_counts.necp_stat_rxoutoforderbytes;
6328 digestp->txretransmit = quicstats->necp_quic_counts.necp_stat_txretransmit;
6329 digestp->ifindex = route_ifindex;
6330 digestp->state = quicstats->necp_quic_extra.state;
6331 digestp->txunacked = quicstats->necp_quic_extra.txunacked;
6332 digestp->txwindow = quicstats->necp_quic_extra.txwindow;
6333
6334 if ((countsp == NULL) && (metadatap == NULL)) {
6335 return true;
6336 }
6337 }
6338
6339 const struct sk_stats_flow *sf = &flow_registration->nexus_stats->fs_stats;
6340 if (sf == NULL) {
6341 nstat_diagnostic_flags |= NSTAT_IFNET_FLOWSWITCH_VALUE_UNOBTAINABLE;
6342 char namebuf[MAXCOMLEN + 1];
6343 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
6344 proc_name(client->proc_pid, namebuf, sizeof(namebuf));
6345 NECPLOG(LOG_ERR, "req quic stats, necp_client flow_registration flow_stats missing for pid %d %s curproc %d %s\n",
6346 client->proc_pid, namebuf, proc_pid(current_proc()), proc_best_name(current_proc()));
6347 sf = &ntstat_sk_stats_zero;
6348 }
6349
6350 if (countsp) {
6351 countsp->nstat_rxbytes = quicstats->necp_quic_counts.necp_stat_rxbytes;
6352 countsp->nstat_txbytes = quicstats->necp_quic_counts.necp_stat_txbytes;
6353
6354 countsp->nstat_rxduplicatebytes = quicstats->necp_quic_counts.necp_stat_rxduplicatebytes;
6355 countsp->nstat_rxoutoforderbytes = quicstats->necp_quic_counts.necp_stat_rxoutoforderbytes;
6356 countsp->nstat_txretransmit = quicstats->necp_quic_counts.necp_stat_txretransmit;
6357
6358 countsp->nstat_min_rtt = quicstats->necp_quic_counts.necp_stat_min_rtt;
6359 countsp->nstat_avg_rtt = quicstats->necp_quic_counts.necp_stat_avg_rtt;
6360 countsp->nstat_var_rtt = quicstats->necp_quic_counts.necp_stat_var_rtt;
6361
6362 // TODO: It would be good to expose QUIC stats for CH/SH retransmission and connection state
6363 // Supplement what the user level has told us with what we know from the flowswitch
6364 countsp->nstat_rxpackets = sf->sf_ipackets;
6365 countsp->nstat_txpackets = sf->sf_opackets;
6366 if (route_ifflags & NSTAT_IFNET_IS_CELLULAR) {
6367 countsp->nstat_cell_rxbytes = sf->sf_ibytes;
6368 countsp->nstat_cell_txbytes = sf->sf_obytes;
6369 } else if (route_ifflags & NSTAT_IFNET_IS_WIFI) {
6370 countsp->nstat_wifi_rxbytes = sf->sf_ibytes;
6371 countsp->nstat_wifi_txbytes = sf->sf_obytes;
6372 } else if (route_ifflags & NSTAT_IFNET_IS_WIRED) {
6373 countsp->nstat_wired_rxbytes = sf->sf_ibytes;
6374 countsp->nstat_wired_txbytes = sf->sf_obytes;
6375 }
6376 }
6377
6378 if (metadatap) {
6379 nstat_quic_descriptor *desc = (nstat_quic_descriptor *)metadatap;
6380 memset(desc, 0, sizeof(*desc));
6381
6382 // Metadata from the flow registration
6383 uuid_copy(desc->fuuid, flow_registration->registration_id);
6384
6385 // Metadata, that the necp client should have, in TLV format.
6386 pid_t effective_pid = client->proc_pid;
6387 necp_find_netstat_data(client, (union necp_sockaddr_union *)&desc->remote, &effective_pid, desc->euuid, &desc->traffic_class, &desc->fallback_mode);
6388 desc->epid = (u_int32_t)effective_pid;
6389
6390 // Metadata from the flow registration
6391 // This needs to revisited if multiple flows are created from one flow registration
6392 struct necp_client_flow *flow = NULL;
6393 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
6394 memcpy(&desc->local, &flow->local_addr, sizeof(desc->local));
6395 break;
6396 }
6397
6398 // Metadata from the route
6399 desc->ifindex = route_ifindex;
6400 desc->ifnet_properties = route_ifflags | nstat_diagnostic_flags;
6401
6402 // Basic metadata from userland
6403 desc->rcvbufsize = quicstats->necp_quic_basic.rcvbufsize;
6404 desc->rcvbufused = quicstats->necp_quic_basic.rcvbufused;
6405
6406 // Additional QUIC specific data
6407 desc->sndbufsize = quicstats->necp_quic_extra.sndbufsize;
6408 desc->sndbufused = quicstats->necp_quic_extra.sndbufused;
6409 desc->txunacked = quicstats->necp_quic_extra.txunacked;
6410 desc->txwindow = quicstats->necp_quic_extra.txwindow;
6411 desc->txcwindow = quicstats->necp_quic_extra.txcwindow;
6412 desc->traffic_mgt_flags = quicstats->necp_quic_extra.traffic_mgt_flags;
6413 desc->state = quicstats->necp_quic_extra.state;
6414
6415 // TODO: CC algo defines should be named agnostic of the protocol
6416 u_int32_t cc_alg_index = quicstats->necp_quic_extra.cc_alg_index;
6417 if (cc_alg_index < TCP_CC_ALGO_COUNT) {
6418 strlcpy(desc->cc_algo, tcp_cc_algo_list[cc_alg_index]->name, sizeof(desc->cc_algo));
6419 } else {
6420 strlcpy(desc->cc_algo, "unknown", sizeof(desc->cc_algo));
6421 }
6422
6423 memcpy(&desc->activity_bitmap, &sf->sf_activity, sizeof(sf->sf_activity));
6424 }
6425 return true;
6426 }
6427
6428 #endif /* SKYWALK */
6429
6430 // Support functions for NetworkStatistics support for necp_client connections
6431
6432 static void
necp_client_inherit_from_parent(struct necp_client * client,struct necp_client * parent)6433 necp_client_inherit_from_parent(
6434 struct necp_client *client,
6435 struct necp_client *parent)
6436 {
6437 assert(client->original_parameters_source == NULL);
6438
6439 if (parent->original_parameters_source != NULL) {
6440 client->original_parameters_source = parent->original_parameters_source;
6441 } else {
6442 client->original_parameters_source = parent;
6443 }
6444 necp_client_retain(client->original_parameters_source);
6445 }
6446
6447 static void
necp_find_conn_netstat_data(struct necp_client * client,u_int32_t * ntstat_flags,pid_t * effective_pid,uuid_t puuid,uuid_t euuid)6448 necp_find_conn_netstat_data(struct necp_client *client,
6449 u_int32_t *ntstat_flags,
6450 pid_t *effective_pid,
6451 uuid_t puuid,
6452 uuid_t euuid)
6453 {
6454 bool has_remote_address = false;
6455 bool has_ip_protocol = false;
6456 bool has_transport_protocol = false;
6457 size_t offset = 0;
6458 u_int8_t *parameters;
6459 u_int32_t parameters_size;
6460
6461
6462 parameters = client->parameters;
6463 parameters_size = (u_int32_t)client->parameters_length;
6464
6465 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
6466 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
6467 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
6468
6469 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
6470 // If the length is larger than what can fit in the remaining parameters size, bail
6471 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
6472 break;
6473 }
6474
6475 if (length > 0) {
6476 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
6477 if (value != NULL) {
6478 switch (type) {
6479 case NECP_CLIENT_PARAMETER_APPLICATION: {
6480 if ((euuid) && (length >= sizeof(uuid_t))) {
6481 uuid_copy(euuid, value);
6482 }
6483 break;
6484 }
6485 case NECP_CLIENT_PARAMETER_IP_PROTOCOL: {
6486 if (length >= 1) {
6487 has_ip_protocol = true;
6488 }
6489 break;
6490 }
6491 case NECP_CLIENT_PARAMETER_PID: {
6492 if ((effective_pid) && length >= sizeof(pid_t)) {
6493 memcpy(effective_pid, value, sizeof(pid_t));
6494 }
6495 break;
6496 }
6497 case NECP_CLIENT_PARAMETER_PARENT_ID: {
6498 if ((puuid) && (length == sizeof(uuid_t))) {
6499 uuid_copy(puuid, value);
6500 }
6501 break;
6502 }
6503 // It is an implementation quirk that the remote address can be found in the necp parameters
6504 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
6505 if (length >= sizeof(struct necp_policy_condition_addr)) {
6506 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
6507 if (necp_client_address_is_valid(&address_struct->address.sa)) {
6508 has_remote_address = true;
6509 }
6510 }
6511 break;
6512 }
6513 case NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL: {
6514 if (length >= 1) {
6515 has_transport_protocol = true;
6516 }
6517 break;
6518 }
6519 default: {
6520 break;
6521 }
6522 }
6523 }
6524 }
6525 offset += sizeof(struct necp_tlv_header) + length;
6526 }
6527 if (ntstat_flags) {
6528 *ntstat_flags = (has_remote_address && has_ip_protocol && has_transport_protocol)? NSTAT_NECP_CONN_HAS_NET_ACCESS: 0;
6529 }
6530 }
6531
6532 static bool
necp_request_conn_netstats(nstat_provider_context ctx,u_int32_t * ifflagsp,nstat_counts * countsp,void * metadatap)6533 necp_request_conn_netstats(nstat_provider_context ctx,
6534 u_int32_t *ifflagsp,
6535 nstat_counts *countsp,
6536 void *metadatap)
6537 {
6538 if (ctx == NULL) {
6539 return false;
6540 }
6541 struct necp_client *client = (struct necp_client *)(uintptr_t)ctx;
6542 nstat_connection_descriptor *desc = (nstat_connection_descriptor *)metadatap;
6543
6544 if (ifflagsp) {
6545 necp_find_conn_netstat_data(client, ifflagsp, NULL, NULL, NULL);
6546 }
6547 if (countsp) {
6548 memset(countsp, 0, sizeof(*countsp));
6549 }
6550 if (desc) {
6551 memset(desc, 0, sizeof(*desc));
6552 // Metadata, that the necp client should have, in TLV format.
6553 pid_t effective_pid = client->proc_pid;
6554 necp_find_conn_netstat_data(client, &desc->ifnet_properties, &effective_pid, desc->puuid, desc->euuid);
6555 desc->epid = (u_int32_t)effective_pid;
6556
6557 // User level should obtain almost all connection information from an extension
6558 // leaving little to do here
6559 uuid_copy(desc->fuuid, client->latest_flow_registration_id);
6560 uuid_copy(desc->cuuid, client->client_id);
6561 }
6562 return true;
6563 }
6564
6565 static int
necp_skywalk_priv_check_cred(proc_t p,kauth_cred_t cred)6566 necp_skywalk_priv_check_cred(proc_t p, kauth_cred_t cred)
6567 {
6568 #pragma unused(p, cred)
6569 #if SKYWALK
6570 /* This includes Nexus controller and Skywalk observer privs */
6571 return skywalk_nxctl_check_privileges(p, cred);
6572 #else /* !SKYWALK */
6573 return 0;
6574 #endif /* !SKYWALK */
6575 }
6576
6577 /// System calls
6578
6579 int
necp_open(struct proc * p,struct necp_open_args * uap,int * retval)6580 necp_open(struct proc *p, struct necp_open_args *uap, int *retval)
6581 {
6582 #pragma unused(retval)
6583 int error = 0;
6584 struct necp_fd_data *fd_data = NULL;
6585 struct fileproc *fp = NULL;
6586 int fd = -1;
6587
6588 if (uap->flags & NECP_OPEN_FLAG_OBSERVER ||
6589 uap->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
6590 if (necp_skywalk_priv_check_cred(p, kauth_cred_get()) != 0 &&
6591 priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NETWORK_STATISTICS, 0) != 0) {
6592 NECPLOG0(LOG_ERR, "Client does not hold necessary entitlement to observe other NECP clients");
6593 error = EACCES;
6594 goto done;
6595 }
6596 }
6597
6598 #if CONFIG_MACF
6599 error = mac_necp_check_open(p, uap->flags);
6600 if (error) {
6601 goto done;
6602 }
6603 #endif /* MACF */
6604
6605 error = falloc(p, &fp, &fd, vfs_context_current());
6606 if (error != 0) {
6607 goto done;
6608 }
6609
6610 if ((fd_data = zalloc(necp_client_fd_zone)) == NULL) {
6611 error = ENOMEM;
6612 goto done;
6613 }
6614
6615 memset(fd_data, 0, sizeof(*fd_data));
6616
6617 fd_data->necp_fd_type = necp_fd_type_client;
6618 fd_data->flags = uap->flags;
6619 RB_INIT(&fd_data->clients);
6620 RB_INIT(&fd_data->flows);
6621 TAILQ_INIT(&fd_data->update_list);
6622 lck_mtx_init(&fd_data->fd_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
6623 klist_init(&fd_data->si.si_note);
6624 fd_data->proc_pid = proc_pid(p);
6625 #if SKYWALK
6626 LIST_INIT(&fd_data->stats_arena_list);
6627 #endif /* !SKYWALK */
6628
6629 fp->fp_flags |= FP_CLOEXEC | FP_CLOFORK;
6630 fp->fp_glob->fg_flag = FREAD;
6631 fp->fp_glob->fg_ops = &necp_fd_ops;
6632 fp_set_data(fp, fd_data);
6633
6634 proc_fdlock(p);
6635
6636 procfdtbl_releasefd(p, fd, NULL);
6637 fp_drop(p, fd, fp, 1);
6638
6639 *retval = fd;
6640
6641 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
6642 NECP_OBSERVER_LIST_LOCK_EXCLUSIVE();
6643 LIST_INSERT_HEAD(&necp_fd_observer_list, fd_data, chain);
6644 OSIncrementAtomic(&necp_observer_fd_count);
6645 NECP_OBSERVER_LIST_UNLOCK();
6646
6647 // Walk all existing clients and add them
6648 NECP_CLIENT_TREE_LOCK_SHARED();
6649 struct necp_client *existing_client = NULL;
6650 RB_FOREACH(existing_client, _necp_client_global_tree, &necp_client_global_tree) {
6651 NECP_CLIENT_LOCK(existing_client);
6652 necp_client_update_observer_add_internal(fd_data, existing_client);
6653 necp_client_update_observer_update_internal(fd_data, existing_client);
6654 NECP_CLIENT_UNLOCK(existing_client);
6655 }
6656 NECP_CLIENT_TREE_UNLOCK();
6657 } else {
6658 NECP_FD_LIST_LOCK_EXCLUSIVE();
6659 LIST_INSERT_HEAD(&necp_fd_list, fd_data, chain);
6660 OSIncrementAtomic(&necp_client_fd_count);
6661 NECP_FD_LIST_UNLOCK();
6662 }
6663
6664 proc_fdunlock(p);
6665
6666 done:
6667 if (error != 0) {
6668 if (fp != NULL) {
6669 fp_free(p, fd, fp);
6670 fp = NULL;
6671 }
6672 if (fd_data != NULL) {
6673 zfree(necp_client_fd_zone, fd_data);
6674 fd_data = NULL;
6675 }
6676 }
6677
6678 return error;
6679 }
6680
6681 // All functions called directly from necp_client_action() to handle one of the
6682 // types should be marked with NECP_CLIENT_ACTION_FUNCTION. This ensures that
6683 // necp_client_action() does not inline all the actions into a single function.
6684 #define NECP_CLIENT_ACTION_FUNCTION __attribute__((noinline))
6685
6686 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_add(struct proc * p,struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)6687 necp_client_add(struct proc *p, struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
6688 {
6689 int error = 0;
6690 struct necp_client *client = NULL;
6691 const size_t buffer_size = uap->buffer_size;
6692
6693 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
6694 NECPLOG0(LOG_ERR, "NECP client observers with push enabled may not add their own clients");
6695 return EINVAL;
6696 }
6697
6698 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
6699 buffer_size == 0 || buffer_size > NECP_MAX_CLIENT_PARAMETERS_SIZE || uap->buffer == 0) {
6700 return EINVAL;
6701 }
6702
6703 client = kalloc_type(struct necp_client, Z_WAITOK | Z_ZERO | Z_NOFAIL);
6704 client->parameters = kalloc_data(buffer_size, Z_WAITOK | Z_NOFAIL);
6705 lck_mtx_init(&client->lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
6706 lck_mtx_init(&client->route_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
6707
6708 error = copyin(uap->buffer, client->parameters, buffer_size);
6709 if (error) {
6710 NECPLOG(LOG_ERR, "necp_client_add parameters copyin error (%d)", error);
6711 goto done;
6712 }
6713
6714 os_ref_init(&client->reference_count, &necp_client_refgrp); // Hold our reference until close
6715
6716 client->parameters_length = buffer_size;
6717 client->proc_pid = fd_data->proc_pid; // Save off proc pid in case the client will persist past fd
6718 client->agent_handle = (void *)fd_data;
6719 client->platform_binary = ((csproc_get_platform_binary(p) == 0) ? 0 : 1);
6720
6721 necp_generate_client_id(client->client_id, false);
6722 LIST_INIT(&client->assertion_list);
6723 RB_INIT(&client->flow_registrations);
6724
6725 NECP_CLIENT_LOG(client, "Adding client");
6726
6727 error = copyout(client->client_id, uap->client_id, sizeof(uuid_t));
6728 if (error) {
6729 NECPLOG(LOG_ERR, "necp_client_add client_id copyout error (%d)", error);
6730 goto done;
6731 }
6732
6733 #if SKYWALK
6734 struct necp_client_parsed_parameters parsed_parameters = {};
6735 int parse_error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, &parsed_parameters);
6736
6737 if (parse_error == 0 &&
6738 ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID) ||
6739 (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER))) {
6740 bool has_delegation_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_SOCKET_DELEGATE, 0) == 0);
6741 if (!has_delegation_entitlement) {
6742 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID) {
6743 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to delegate network traffic for other processes by upid",
6744 proc_name_address(p), proc_pid(p));
6745 }
6746 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER) {
6747 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to set attributed bundle identifier",
6748 proc_name_address(p), proc_pid(p));
6749 }
6750 error = EPERM;
6751 goto done;
6752 }
6753
6754 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID) {
6755 // Save off delegated unique PID
6756 client->delegated_upid = parsed_parameters.delegated_upid;
6757 }
6758 }
6759
6760 if (parse_error == 0 && parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) {
6761 bool has_nexus_entitlement = (necp_skywalk_priv_check_cred(p, kauth_cred_get()) == 0);
6762 if (!has_nexus_entitlement) {
6763 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to open a custom nexus client",
6764 proc_name_address(p), proc_pid(p));
6765 error = EPERM;
6766 goto done;
6767 }
6768 }
6769
6770 if (parse_error == 0 && (parsed_parameters.flags &
6771 (NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER | NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP))) {
6772 bool has_custom_protocol_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_CUSTOM_PROTOCOL, 0) == 0);
6773 if (!has_custom_protocol_entitlement) {
6774 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement for custom protocol APIs",
6775 proc_name_address(p), proc_pid(p));
6776 error = EPERM;
6777 goto done;
6778 }
6779 }
6780
6781 if (parse_error == 0 && parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER &&
6782 (parsed_parameters.ip_protocol == IPPROTO_TCP || parsed_parameters.ip_protocol == IPPROTO_UDP)) {
6783 uint32_t *netns_addr = NULL;
6784 uint8_t netns_addr_len = 0;
6785 struct ns_flow_info flow_info = {};
6786 uuid_copy(flow_info.nfi_flow_uuid, client->client_id);
6787 flow_info.nfi_protocol = parsed_parameters.ip_protocol;
6788 flow_info.nfi_owner_pid = client->proc_pid;
6789 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID) {
6790 flow_info.nfi_effective_pid = parsed_parameters.effective_pid;
6791 } else {
6792 flow_info.nfi_effective_pid = flow_info.nfi_owner_pid;
6793 }
6794 proc_name(flow_info.nfi_owner_pid, flow_info.nfi_owner_name, MAXCOMLEN);
6795 proc_name(flow_info.nfi_effective_pid, flow_info.nfi_effective_name, MAXCOMLEN);
6796
6797 if (parsed_parameters.local_addr.sa.sa_family == AF_UNSPEC) {
6798 // Treat no local address as a wildcard IPv6
6799 // parsed_parameters is already initialized to all zeros
6800 parsed_parameters.local_addr.sin6.sin6_family = AF_INET6;
6801 parsed_parameters.local_addr.sin6.sin6_len = sizeof(struct sockaddr_in6);
6802 }
6803
6804 switch (parsed_parameters.local_addr.sa.sa_family) {
6805 case AF_INET: {
6806 memcpy(&flow_info.nfi_laddr, &parsed_parameters.local_addr.sa, parsed_parameters.local_addr.sa.sa_len);
6807 netns_addr = (uint32_t *)&parsed_parameters.local_addr.sin.sin_addr;
6808 netns_addr_len = 4;
6809 break;
6810 }
6811 case AF_INET6: {
6812 memcpy(&flow_info.nfi_laddr, &parsed_parameters.local_addr.sa, parsed_parameters.local_addr.sa.sa_len);
6813 netns_addr = (uint32_t *)&parsed_parameters.local_addr.sin6.sin6_addr;
6814 netns_addr_len = 16;
6815 break;
6816 }
6817
6818 default: {
6819 NECPLOG(LOG_ERR, "necp_client_add listener invalid address family (%d)", parsed_parameters.local_addr.sa.sa_family);
6820 error = EINVAL;
6821 goto done;
6822 }
6823 }
6824 if (parsed_parameters.local_addr.sin.sin_port == 0) {
6825 error = netns_reserve_ephemeral(&client->port_reservation, netns_addr, netns_addr_len, parsed_parameters.ip_protocol,
6826 &parsed_parameters.local_addr.sin.sin_port, NETNS_LISTENER, &flow_info);
6827 if (error) {
6828 NECPLOG(LOG_ERR, "necp_client_add netns_reserve_ephemeral error (%d)", error);
6829 goto done;
6830 }
6831
6832 // Update the parameter TLVs with the assigned port
6833 necp_client_update_local_port_parameters(client->parameters, (u_int32_t)client->parameters_length, parsed_parameters.local_addr.sin.sin_port);
6834 } else {
6835 error = netns_reserve(&client->port_reservation, netns_addr, netns_addr_len, parsed_parameters.ip_protocol,
6836 parsed_parameters.local_addr.sin.sin_port, NETNS_LISTENER, &flow_info);
6837 if (error) {
6838 NECPLOG(LOG_ERR, "necp_client_add netns_reserve error (%d)", error);
6839 goto done;
6840 }
6841 }
6842 }
6843 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_PARENT_UUID) {
6844 // The parent "should" be found on fd_data without having to search across the whole necp_fd_list
6845 // It would be nice to do this a little further down where there's another instance of NECP_FD_LOCK
6846 // but the logic here depends on the parse paramters
6847 struct necp_client *parent = NULL;
6848 NECP_FD_LOCK(fd_data);
6849 parent = necp_client_fd_find_client_unlocked(fd_data, parsed_parameters.parent_uuid);
6850 if (parent != NULL) {
6851 necp_client_inherit_from_parent(client, parent);
6852 }
6853 NECP_FD_UNLOCK(fd_data);
6854 if (parent == NULL) {
6855 NECPLOG0(LOG_ERR, "necp_client_add, no necp_client_inherit_from_parent as can't find parent on fd_data");
6856 }
6857 }
6858
6859 #endif /* !SKYWALK */
6860
6861 necp_client_update_observer_add(client);
6862
6863 NECP_FD_LOCK(fd_data);
6864 RB_INSERT(_necp_client_tree, &fd_data->clients, client);
6865 OSIncrementAtomic(&necp_client_count);
6866 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
6867 RB_INSERT(_necp_client_global_tree, &necp_client_global_tree, client);
6868 NECP_CLIENT_TREE_UNLOCK();
6869
6870 // Prime the client result
6871 NECP_CLIENT_LOCK(client);
6872 (void)necp_update_client_result(current_proc(), fd_data, client, NULL);
6873 NECP_CLIENT_UNLOCK(client);
6874 NECP_FD_UNLOCK(fd_data);
6875 // Now everything is set, it's safe to plumb this in to NetworkStatistics
6876 uint32_t ntstat_properties = 0;
6877 necp_find_conn_netstat_data(client, &ntstat_properties, NULL, NULL, NULL);
6878
6879 client->nstat_context = nstat_provider_stats_open((nstat_provider_context)client,
6880 NSTAT_PROVIDER_CONN_USERLAND, (u_int64_t)ntstat_properties, necp_request_conn_netstats, necp_find_conn_extension_info);
6881 done:
6882 if (error != 0 && client != NULL) {
6883 necp_client_free(client);
6884 client = NULL;
6885 }
6886 *retval = error;
6887
6888 return error;
6889 }
6890
6891 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_claim(struct proc * p,struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)6892 necp_client_claim(struct proc *p, struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
6893 {
6894 int error = 0;
6895 uuid_t client_id = {};
6896 struct necp_client *client = NULL;
6897
6898 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
6899 error = EINVAL;
6900 goto done;
6901 }
6902
6903 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
6904 if (error) {
6905 NECPLOG(LOG_ERR, "necp_client_claim copyin client_id error (%d)", error);
6906 goto done;
6907 }
6908
6909 u_int64_t upid = proc_uniqueid(p);
6910
6911 NECP_FD_LIST_LOCK_SHARED();
6912
6913 struct necp_fd_data *find_fd = NULL;
6914 LIST_FOREACH(find_fd, &necp_fd_list, chain) {
6915 NECP_FD_LOCK(find_fd);
6916 struct necp_client *find_client = necp_client_fd_find_client_and_lock(find_fd, client_id);
6917 if (find_client != NULL) {
6918 if (find_client->delegated_upid == upid) {
6919 // Matched the client to claim; remove from the old fd
6920 client = find_client;
6921 RB_REMOVE(_necp_client_tree, &find_fd->clients, client);
6922 necp_client_retain_locked(client);
6923 }
6924 NECP_CLIENT_UNLOCK(find_client);
6925 }
6926 NECP_FD_UNLOCK(find_fd);
6927
6928 if (client != NULL) {
6929 break;
6930 }
6931 }
6932
6933 NECP_FD_LIST_UNLOCK();
6934
6935 if (client == NULL) {
6936 error = ENOENT;
6937 goto done;
6938 }
6939
6940 client->proc_pid = fd_data->proc_pid; // Transfer client to claiming pid
6941 client->agent_handle = (void *)fd_data;
6942 client->platform_binary = ((csproc_get_platform_binary(p) == 0) ? 0 : 1);
6943
6944 NECP_CLIENT_LOG(client, "Claiming client");
6945
6946 // Add matched client to our fd and re-run result
6947 NECP_FD_LOCK(fd_data);
6948 RB_INSERT(_necp_client_tree, &fd_data->clients, client);
6949 NECP_CLIENT_LOCK(client);
6950 (void)necp_update_client_result(current_proc(), fd_data, client, NULL);
6951 NECP_CLIENT_UNLOCK(client);
6952 NECP_FD_UNLOCK(fd_data);
6953
6954 necp_client_release(client);
6955
6956 done:
6957 *retval = error;
6958
6959 return error;
6960 }
6961
6962 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_remove(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)6963 necp_client_remove(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
6964 {
6965 int error = 0;
6966 uuid_t client_id = {};
6967 struct ifnet_stats_per_flow flow_ifnet_stats = {};
6968 const size_t buffer_size = uap->buffer_size;
6969
6970 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
6971 error = EINVAL;
6972 goto done;
6973 }
6974
6975 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
6976 if (error) {
6977 NECPLOG(LOG_ERR, "necp_client_remove copyin client_id error (%d)", error);
6978 goto done;
6979 }
6980
6981 if (uap->buffer != 0 && buffer_size == sizeof(flow_ifnet_stats)) {
6982 error = copyin(uap->buffer, &flow_ifnet_stats, buffer_size);
6983 if (error) {
6984 NECPLOG(LOG_ERR, "necp_client_remove flow_ifnet_stats copyin error (%d)", error);
6985 // Not fatal; make sure to zero-out stats in case of partial copy
6986 memset(&flow_ifnet_stats, 0, sizeof(flow_ifnet_stats));
6987 error = 0;
6988 }
6989 } else if (uap->buffer != 0) {
6990 NECPLOG(LOG_ERR, "necp_client_remove unexpected parameters length (%zu)", buffer_size);
6991 }
6992
6993 NECP_FD_LOCK(fd_data);
6994
6995 pid_t pid = fd_data->proc_pid;
6996 struct necp_client *client = necp_client_fd_find_client_unlocked(fd_data, client_id);
6997
6998 NECP_CLIENT_LOG(client, "Removing client");
6999
7000 if (client != NULL) {
7001 // Remove any flow registrations that match
7002 struct necp_client_flow_registration *flow_registration = NULL;
7003 struct necp_client_flow_registration *temp_flow_registration = NULL;
7004 RB_FOREACH_SAFE(flow_registration, _necp_fd_flow_tree, &fd_data->flows, temp_flow_registration) {
7005 if (flow_registration->client == client) {
7006 #if SKYWALK
7007 necp_destroy_flow_stats(fd_data, flow_registration, NULL, TRUE);
7008 #endif /* SKYWALK */
7009 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
7010 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
7011 NECP_FLOW_TREE_UNLOCK();
7012 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
7013 }
7014 }
7015 #if SKYWALK
7016 if (client->nstat_context != NULL) {
7017 // Main path, we expect stats to be in existance at this point
7018 nstat_provider_stats_close(client->nstat_context);
7019 client->nstat_context = NULL;
7020 } else {
7021 NECPLOG0(LOG_ERR, "necp_client_remove ntstat shutdown finds nstat_context NULL");
7022 }
7023 #endif /* SKYWALK */
7024 // Remove client from lists
7025 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
7026 RB_REMOVE(_necp_client_global_tree, &necp_client_global_tree, client);
7027 NECP_CLIENT_TREE_UNLOCK();
7028 RB_REMOVE(_necp_client_tree, &fd_data->clients, client);
7029 }
7030
7031 #if SKYWALK
7032 // If the currently-active arena is idle (has no more flows referring to it), or if there are defunct
7033 // arenas lingering in the list, schedule a threadcall to do the clean up. The idle check is done
7034 // by checking if the reference count is 3: one held by this client (will be released below when we
7035 // destroy it) when it's non-NULL; the rest held by stats_arena_{active,list}.
7036 if ((fd_data->stats_arena_active != NULL && fd_data->stats_arena_active->nai_use_count == 3) ||
7037 (fd_data->stats_arena_active == NULL && !LIST_EMPTY(&fd_data->stats_arena_list))) {
7038 uint64_t deadline = 0;
7039 uint64_t leeway = 0;
7040 clock_interval_to_deadline(necp_close_arenas_timeout_microseconds, NSEC_PER_USEC, &deadline);
7041 clock_interval_to_absolutetime_interval(necp_close_arenas_timeout_leeway_microseconds, NSEC_PER_USEC, &leeway);
7042
7043 thread_call_enter_delayed_with_leeway(necp_close_empty_arenas_tcall, NULL,
7044 deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
7045 }
7046 #endif /* SKYWALK */
7047
7048 NECP_FD_UNLOCK(fd_data);
7049
7050 if (client != NULL) {
7051 ASSERT(error == 0);
7052 necp_destroy_client(client, pid, true);
7053 } else {
7054 error = ENOENT;
7055 NECPLOG(LOG_ERR, "necp_client_remove invalid client_id (%d)", error);
7056 }
7057 done:
7058 *retval = error;
7059
7060 return error;
7061 }
7062
7063 static struct necp_client_flow_registration *
necp_client_fd_find_flow(struct necp_fd_data * client_fd,uuid_t flow_id)7064 necp_client_fd_find_flow(struct necp_fd_data *client_fd, uuid_t flow_id)
7065 {
7066 NECP_FD_ASSERT_LOCKED(client_fd);
7067 struct necp_client_flow_registration *flow = NULL;
7068
7069 if (necp_client_id_is_flow(flow_id)) {
7070 struct necp_client_flow_registration find;
7071 uuid_copy(find.registration_id, flow_id);
7072 flow = RB_FIND(_necp_fd_flow_tree, &client_fd->flows, &find);
7073 }
7074
7075 return flow;
7076 }
7077
7078 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_remove_flow(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7079 necp_client_remove_flow(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7080 {
7081 int error = 0;
7082 uuid_t flow_id = {};
7083 struct ifnet_stats_per_flow flow_ifnet_stats = {};
7084 const size_t buffer_size = uap->buffer_size;
7085
7086 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
7087 error = EINVAL;
7088 NECPLOG(LOG_ERR, "necp_client_remove_flow invalid client_id (length %zu)", (size_t)uap->client_id_len);
7089 goto done;
7090 }
7091
7092 error = copyin(uap->client_id, flow_id, sizeof(uuid_t));
7093 if (error) {
7094 NECPLOG(LOG_ERR, "necp_client_remove_flow copyin client_id error (%d)", error);
7095 goto done;
7096 }
7097
7098 if (uap->buffer != 0 && buffer_size == sizeof(flow_ifnet_stats)) {
7099 error = copyin(uap->buffer, &flow_ifnet_stats, buffer_size);
7100 if (error) {
7101 NECPLOG(LOG_ERR, "necp_client_remove flow_ifnet_stats copyin error (%d)", error);
7102 // Not fatal
7103 }
7104 } else if (uap->buffer != 0) {
7105 NECPLOG(LOG_ERR, "necp_client_remove unexpected parameters length (%zu)", buffer_size);
7106 }
7107
7108 NECP_FD_LOCK(fd_data);
7109 struct necp_client *client = NULL;
7110 struct necp_client_flow_registration *flow_registration = necp_client_fd_find_flow(fd_data, flow_id);
7111 if (flow_registration != NULL) {
7112 #if SKYWALK
7113 // Cleanup stats per flow
7114 necp_destroy_flow_stats(fd_data, flow_registration, &flow_ifnet_stats, TRUE);
7115 #endif /* SKYWALK */
7116 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
7117 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
7118 NECP_FLOW_TREE_UNLOCK();
7119 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
7120
7121 client = flow_registration->client;
7122 if (client != NULL) {
7123 necp_client_retain(client);
7124 }
7125 }
7126 NECP_FD_UNLOCK(fd_data);
7127
7128 NECP_CLIENT_FLOW_LOG(client, flow_registration, "removing flow");
7129
7130 if (flow_registration != NULL && client != NULL) {
7131 NECP_CLIENT_LOCK(client);
7132 if (flow_registration->client == client) {
7133 necp_destroy_client_flow_registration(client, flow_registration, fd_data->proc_pid, false);
7134 }
7135 necp_client_release_locked(client);
7136 NECP_CLIENT_UNLOCK(client);
7137 }
7138
7139 done:
7140 *retval = error;
7141 if (error != 0) {
7142 NECPLOG(LOG_ERR, "Remove flow error (%d)", error);
7143 }
7144
7145 return error;
7146 }
7147
7148 // Don't inline the function since it includes necp_client_parsed_parameters on the stack
7149 static __attribute__((noinline)) int
necp_client_check_tcp_heuristics(struct necp_client * client,struct necp_client_flow * flow,u_int32_t * flags,u_int8_t * tfo_cookie,u_int8_t * tfo_cookie_len)7150 necp_client_check_tcp_heuristics(struct necp_client *client, struct necp_client_flow *flow, u_int32_t *flags, u_int8_t *tfo_cookie, u_int8_t *tfo_cookie_len)
7151 {
7152 struct necp_client_parsed_parameters parsed_parameters;
7153 int error = 0;
7154
7155 error = necp_client_parse_parameters(client, client->parameters,
7156 (u_int32_t)client->parameters_length,
7157 &parsed_parameters);
7158 if (error) {
7159 NECPLOG(LOG_ERR, "necp_client_parse_parameters error (%d)", error);
7160 return error;
7161 }
7162
7163 if ((flow->remote_addr.sa.sa_family != AF_INET &&
7164 flow->remote_addr.sa.sa_family != AF_INET6) ||
7165 (flow->local_addr.sa.sa_family != AF_INET &&
7166 flow->local_addr.sa.sa_family != AF_INET6)) {
7167 return EINVAL;
7168 }
7169
7170 NECP_CLIENT_ROUTE_LOCK(client);
7171
7172 if (client->current_route == NULL) {
7173 error = ENOENT;
7174 goto do_unlock;
7175 }
7176
7177 bool check_ecn = false;
7178 do {
7179 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) ==
7180 NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) {
7181 check_ecn = true;
7182 break;
7183 }
7184
7185 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) ==
7186 NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) {
7187 break;
7188 }
7189
7190 if (client->current_route != NULL) {
7191 if (client->current_route->rt_ifp->if_eflags & IFEF_ECN_ENABLE) {
7192 check_ecn = true;
7193 break;
7194 }
7195 if (client->current_route->rt_ifp->if_eflags & IFEF_ECN_DISABLE) {
7196 break;
7197 }
7198 }
7199
7200 bool inbound = ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) == 0);
7201 if ((inbound && tcp_ecn_inbound == 1) ||
7202 (!inbound && tcp_ecn_outbound == 1)) {
7203 check_ecn = true;
7204 }
7205 } while (false);
7206
7207 if (check_ecn) {
7208 if (tcp_heuristic_do_ecn_with_address(client->current_route->rt_ifp,
7209 (union sockaddr_in_4_6 *)&flow->local_addr)) {
7210 *flags |= NECP_CLIENT_RESULT_FLAG_ECN_ENABLED;
7211 }
7212 }
7213
7214 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) ==
7215 NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) {
7216 if (!tcp_heuristic_do_tfo_with_address(client->current_route->rt_ifp,
7217 (union sockaddr_in_4_6 *)&flow->local_addr,
7218 (union sockaddr_in_4_6 *)&flow->remote_addr,
7219 tfo_cookie, tfo_cookie_len)) {
7220 *flags |= NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED;
7221 *tfo_cookie_len = 0;
7222 }
7223 } else {
7224 *flags |= NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED;
7225 *tfo_cookie_len = 0;
7226 }
7227 do_unlock:
7228 NECP_CLIENT_ROUTE_UNLOCK(client);
7229
7230 return error;
7231 }
7232
7233 static size_t
necp_client_calculate_flow_tlv_size(struct necp_client_flow_registration * flow_registration)7234 necp_client_calculate_flow_tlv_size(struct necp_client_flow_registration *flow_registration)
7235 {
7236 size_t assigned_results_size = 0;
7237 struct necp_client_flow *flow = NULL;
7238 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
7239 if (flow->assigned) {
7240 size_t header_length = 0;
7241 if (flow->nexus) {
7242 header_length = sizeof(struct necp_client_nexus_flow_header);
7243 } else {
7244 header_length = sizeof(struct necp_client_flow_header);
7245 }
7246 assigned_results_size += (header_length + flow->assigned_results_length);
7247
7248 if (flow->has_protoctl_event) {
7249 assigned_results_size += sizeof(struct necp_client_flow_protoctl_event_header);
7250 }
7251 }
7252 }
7253 return assigned_results_size;
7254 }
7255
7256 static int
necp_client_fillout_flow_tlvs(struct necp_client * client,bool client_is_observed,struct necp_client_flow_registration * flow_registration,struct necp_client_action_args * uap,size_t * assigned_results_cursor)7257 necp_client_fillout_flow_tlvs(struct necp_client *client,
7258 bool client_is_observed,
7259 struct necp_client_flow_registration *flow_registration,
7260 struct necp_client_action_args *uap,
7261 size_t *assigned_results_cursor)
7262 {
7263 int error = 0;
7264 struct necp_client_flow *flow = NULL;
7265 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
7266 if (flow->assigned) {
7267 // Write TLV headers
7268 struct necp_client_nexus_flow_header header = {};
7269 u_int32_t length = 0;
7270 u_int32_t flags = 0;
7271 u_int8_t tfo_cookie_len = 0;
7272 u_int8_t type = 0;
7273
7274 type = NECP_CLIENT_RESULT_FLOW_ID;
7275 length = sizeof(header.flow_header.flow_id);
7276 memcpy(&header.flow_header.flow_id_tlv_header.type, &type, sizeof(type));
7277 memcpy(&header.flow_header.flow_id_tlv_header.length, &length, sizeof(length));
7278 uuid_copy(header.flow_header.flow_id, flow_registration->registration_id);
7279
7280 if (flow->nexus) {
7281 if (flow->check_tcp_heuristics) {
7282 u_int8_t tfo_cookie[NECP_TFO_COOKIE_LEN_MAX];
7283 tfo_cookie_len = NECP_TFO_COOKIE_LEN_MAX;
7284
7285 if (necp_client_check_tcp_heuristics(client, flow, &flags,
7286 tfo_cookie, &tfo_cookie_len) != 0) {
7287 tfo_cookie_len = 0;
7288 } else {
7289 flow->check_tcp_heuristics = FALSE;
7290
7291 if (tfo_cookie_len != 0) {
7292 type = NECP_CLIENT_RESULT_TFO_COOKIE;
7293 length = tfo_cookie_len;
7294 memcpy(&header.tfo_cookie_tlv_header.type, &type, sizeof(type));
7295 memcpy(&header.tfo_cookie_tlv_header.length, &length, sizeof(length));
7296 memcpy(&header.tfo_cookie_value, tfo_cookie, tfo_cookie_len);
7297 }
7298 }
7299 }
7300 }
7301
7302 size_t header_length = 0;
7303 if (flow->nexus) {
7304 if (tfo_cookie_len != 0) {
7305 header_length = sizeof(struct necp_client_nexus_flow_header) - (NECP_TFO_COOKIE_LEN_MAX - tfo_cookie_len);
7306 } else {
7307 header_length = sizeof(struct necp_client_nexus_flow_header) - sizeof(struct necp_tlv_header) - NECP_TFO_COOKIE_LEN_MAX;
7308 }
7309 } else {
7310 header_length = sizeof(struct necp_client_flow_header);
7311 }
7312
7313 type = NECP_CLIENT_RESULT_FLAGS;
7314 length = sizeof(header.flow_header.flags_value);
7315 memcpy(&header.flow_header.flags_tlv_header.type, &type, sizeof(type));
7316 memcpy(&header.flow_header.flags_tlv_header.length, &length, sizeof(length));
7317 if (flow->assigned) {
7318 flags |= NECP_CLIENT_RESULT_FLAG_FLOW_ASSIGNED;
7319 }
7320 if (flow->viable) {
7321 flags |= NECP_CLIENT_RESULT_FLAG_FLOW_VIABLE;
7322 }
7323 if (flow_registration->defunct) {
7324 flags |= NECP_CLIENT_RESULT_FLAG_DEFUNCT;
7325 }
7326 flags |= flow->necp_flow_flags;
7327 memcpy(&header.flow_header.flags_value, &flags, sizeof(flags));
7328
7329 type = NECP_CLIENT_RESULT_INTERFACE;
7330 length = sizeof(header.flow_header.interface_value);
7331 memcpy(&header.flow_header.interface_tlv_header.type, &type, sizeof(type));
7332 memcpy(&header.flow_header.interface_tlv_header.length, &length, sizeof(length));
7333
7334 struct necp_client_result_interface interface_struct;
7335 interface_struct.generation = 0;
7336 interface_struct.index = flow->interface_index;
7337
7338 memcpy(&header.flow_header.interface_value, &interface_struct, sizeof(interface_struct));
7339 if (flow->nexus) {
7340 type = NECP_CLIENT_RESULT_NETAGENT;
7341 length = sizeof(header.agent_value);
7342 memcpy(&header.agent_tlv_header.type, &type, sizeof(type));
7343 memcpy(&header.agent_tlv_header.length, &length, sizeof(length));
7344
7345 struct necp_client_result_netagent agent_struct;
7346 uuid_copy(agent_struct.netagent_uuid, flow->u.nexus_agent);
7347 agent_struct.generation = netagent_get_generation(agent_struct.netagent_uuid);
7348
7349 memcpy(&header.agent_value, &agent_struct, sizeof(agent_struct));
7350 }
7351
7352 // Don't include outer TLV header in length field
7353 type = NECP_CLIENT_RESULT_FLOW;
7354 length = (header_length - sizeof(struct necp_tlv_header) + flow->assigned_results_length);
7355 if (flow->has_protoctl_event) {
7356 length += sizeof(struct necp_client_flow_protoctl_event_header);
7357 }
7358 memcpy(&header.flow_header.outer_header.type, &type, sizeof(type));
7359 memcpy(&header.flow_header.outer_header.length, &length, sizeof(length));
7360
7361 error = copyout(&header, uap->buffer + client->result_length + *assigned_results_cursor, header_length);
7362 if (error) {
7363 NECPLOG(LOG_ERR, "necp_client_copy assigned results tlv_header copyout error (%d)", error);
7364 return error;
7365 }
7366 *assigned_results_cursor += header_length;
7367
7368 if (flow->assigned_results && flow->assigned_results_length) {
7369 // Write inner TLVs
7370 error = copyout(flow->assigned_results, uap->buffer + client->result_length + *assigned_results_cursor,
7371 flow->assigned_results_length);
7372 if (error) {
7373 NECPLOG(LOG_ERR, "necp_client_copy assigned results copyout error (%d)", error);
7374 return error;
7375 }
7376 }
7377 *assigned_results_cursor += flow->assigned_results_length;
7378
7379 /* Read the protocol event and reset it */
7380 if (flow->has_protoctl_event) {
7381 struct necp_client_flow_protoctl_event_header protoctl_event_header = {};
7382
7383 type = NECP_CLIENT_RESULT_PROTO_CTL_EVENT;
7384 length = sizeof(protoctl_event_header.protoctl_event);
7385
7386 memcpy(&protoctl_event_header.protoctl_tlv_header.type, &type, sizeof(type));
7387 memcpy(&protoctl_event_header.protoctl_tlv_header.length, &length, sizeof(length));
7388 memcpy(&protoctl_event_header.protoctl_event, &flow->protoctl_event,
7389 sizeof(flow->protoctl_event));
7390
7391 error = copyout(&protoctl_event_header, uap->buffer + client->result_length + *assigned_results_cursor,
7392 sizeof(protoctl_event_header));
7393
7394 if (error) {
7395 NECPLOG(LOG_ERR, "necp_client_copy protocol control event results"
7396 " tlv_header copyout error (%d)", error);
7397 return error;
7398 }
7399 *assigned_results_cursor += sizeof(protoctl_event_header);
7400 flow->has_protoctl_event = FALSE;
7401 flow->protoctl_event.protoctl_event_code = 0;
7402 flow->protoctl_event.protoctl_event_val = 0;
7403 flow->protoctl_event.protoctl_event_tcp_seq_num = 0;
7404 }
7405 }
7406 }
7407 if (!client_is_observed) {
7408 flow_registration->flow_result_read = TRUE;
7409 }
7410 return 0;
7411 }
7412
7413 static int
necp_client_copy_internal(struct necp_client * client,uuid_t client_id,bool client_is_observed,struct necp_client_action_args * uap,int * retval)7414 necp_client_copy_internal(struct necp_client *client, uuid_t client_id, bool client_is_observed, struct necp_client_action_args *uap, int *retval)
7415 {
7416 NECP_CLIENT_ASSERT_LOCKED(client);
7417 int error = 0;
7418 // Copy results out
7419 if (uap->action == NECP_CLIENT_ACTION_COPY_PARAMETERS) {
7420 if (uap->buffer_size < client->parameters_length) {
7421 return EINVAL;
7422 }
7423 error = copyout(client->parameters, uap->buffer, client->parameters_length);
7424 if (error) {
7425 NECPLOG(LOG_ERR, "necp_client_copy parameters copyout error (%d)", error);
7426 return error;
7427 }
7428 *retval = client->parameters_length;
7429 } else if (uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT &&
7430 client->result_read && client->group_members_read && !necp_client_has_unread_flows(client)) {
7431 // Copy updates only, but nothing to read
7432 // Just return 0 for bytes read
7433 *retval = 0;
7434 } else if (uap->action == NECP_CLIENT_ACTION_COPY_RESULT ||
7435 uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
7436 size_t assigned_results_size = client->assigned_group_members_length;
7437
7438 bool some_flow_is_defunct = false;
7439 struct necp_client_flow_registration *single_flow_registration = NULL;
7440 if (necp_client_id_is_flow(client_id)) {
7441 single_flow_registration = necp_client_find_flow(client, client_id);
7442 if (single_flow_registration != NULL) {
7443 assigned_results_size += necp_client_calculate_flow_tlv_size(single_flow_registration);
7444 }
7445 } else {
7446 // This request is for the client, so copy everything
7447 struct necp_client_flow_registration *flow_registration = NULL;
7448 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
7449 if (flow_registration->defunct) {
7450 some_flow_is_defunct = true;
7451 }
7452 assigned_results_size += necp_client_calculate_flow_tlv_size(flow_registration);
7453 }
7454 }
7455 if (uap->buffer_size < (client->result_length + assigned_results_size)) {
7456 return EINVAL;
7457 }
7458
7459 u_int32_t original_flags = 0;
7460 bool flags_updated = false;
7461 if (some_flow_is_defunct && client->legacy_client_is_flow) {
7462 // If our client expects the defunct flag in the client, add it now
7463 u_int32_t client_flags = 0;
7464 u_int32_t value_size = 0;
7465 u_int8_t *flags_pointer = necp_buffer_get_tlv_value(client->result, 0, &value_size);
7466 if (flags_pointer != NULL && value_size == sizeof(client_flags)) {
7467 memcpy(&client_flags, flags_pointer, value_size);
7468 original_flags = client_flags;
7469 client_flags |= NECP_CLIENT_RESULT_FLAG_DEFUNCT;
7470 (void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS,
7471 sizeof(client_flags), &client_flags, &flags_updated,
7472 client->result, sizeof(client->result));
7473 }
7474 }
7475
7476 error = copyout(client->result, uap->buffer, client->result_length);
7477
7478 if (flags_updated) {
7479 // Revert stored flags
7480 (void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS,
7481 sizeof(original_flags), &original_flags, &flags_updated,
7482 client->result, sizeof(client->result));
7483 }
7484
7485 if (error != 0) {
7486 NECPLOG(LOG_ERR, "necp_client_copy result copyout error (%d)", error);
7487 return error;
7488 }
7489
7490 if (client->assigned_group_members != NULL && client->assigned_group_members_length > 0) {
7491 error = copyout(client->assigned_group_members, uap->buffer + client->result_length, client->assigned_group_members_length);
7492 if (error != 0) {
7493 NECPLOG(LOG_ERR, "necp_client_copy group members copyout error (%d)", error);
7494 return error;
7495 }
7496 }
7497
7498 size_t assigned_results_cursor = client->assigned_group_members_length; // Start with an offset based on the group members
7499 if (necp_client_id_is_flow(client_id)) {
7500 if (single_flow_registration != NULL) {
7501 error = necp_client_fillout_flow_tlvs(client, client_is_observed, single_flow_registration, uap, &assigned_results_cursor);
7502 if (error != 0) {
7503 return error;
7504 }
7505 }
7506 } else {
7507 // This request is for the client, so copy everything
7508 struct necp_client_flow_registration *flow_registration = NULL;
7509 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
7510 error = necp_client_fillout_flow_tlvs(client, client_is_observed, flow_registration, uap, &assigned_results_cursor);
7511 if (error != 0) {
7512 return error;
7513 }
7514 }
7515 }
7516
7517 *retval = client->result_length + assigned_results_cursor;
7518
7519 if (!client_is_observed) {
7520 client->result_read = TRUE;
7521 client->group_members_read = TRUE;
7522 }
7523 }
7524
7525 return 0;
7526 }
7527
7528 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7529 necp_client_copy(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7530 {
7531 int error = 0;
7532 struct necp_client *client = NULL;
7533 uuid_t client_id;
7534 uuid_clear(client_id);
7535
7536 *retval = 0;
7537
7538 if (uap->buffer_size == 0 || uap->buffer == 0) {
7539 return EINVAL;
7540 }
7541
7542 if (uap->action != NECP_CLIENT_ACTION_COPY_PARAMETERS &&
7543 uap->action != NECP_CLIENT_ACTION_COPY_RESULT &&
7544 uap->action != NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
7545 return EINVAL;
7546 }
7547
7548 if (uap->client_id) {
7549 if (uap->client_id_len != sizeof(uuid_t)) {
7550 NECPLOG(LOG_ERR, "Incorrect length (got %zu, expected %zu)", (size_t)uap->client_id_len, sizeof(uuid_t));
7551 return ERANGE;
7552 }
7553
7554 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
7555 if (error) {
7556 NECPLOG(LOG_ERR, "necp_client_copy client_id copyin error (%d)", error);
7557 return error;
7558 }
7559 }
7560
7561 const bool is_wildcard = (bool)uuid_is_null(client_id);
7562
7563 NECP_FD_LOCK(fd_data);
7564
7565 if (is_wildcard) {
7566 if (uap->action == NECP_CLIENT_ACTION_COPY_RESULT || uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
7567 struct necp_client *find_client = NULL;
7568 RB_FOREACH(find_client, _necp_client_tree, &fd_data->clients) {
7569 NECP_CLIENT_LOCK(find_client);
7570 if (!find_client->result_read || !find_client->group_members_read || necp_client_has_unread_flows(find_client)) {
7571 client = find_client;
7572 // Leave the client locked, and break
7573 break;
7574 }
7575 NECP_CLIENT_UNLOCK(find_client);
7576 }
7577 }
7578 } else {
7579 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
7580 }
7581
7582 if (client != NULL) {
7583 // If client is set, it is locked
7584 error = necp_client_copy_internal(client, client_id, FALSE, uap, retval);
7585 NECP_CLIENT_UNLOCK(client);
7586 }
7587
7588 // Unlock our own fd before moving on or returning
7589 NECP_FD_UNLOCK(fd_data);
7590
7591 if (client == NULL) {
7592 if (fd_data->flags & NECP_OPEN_FLAG_OBSERVER) {
7593 // Observers are allowed to lookup clients on other fds
7594
7595 // Lock tree
7596 NECP_CLIENT_TREE_LOCK_SHARED();
7597
7598 bool found_client = FALSE;
7599
7600 client = necp_find_client_and_lock(client_id);
7601 if (client != NULL) {
7602 // Matched, copy out data
7603 found_client = TRUE;
7604 error = necp_client_copy_internal(client, client_id, TRUE, uap, retval);
7605 NECP_CLIENT_UNLOCK(client);
7606 }
7607
7608 // Unlock tree
7609 NECP_CLIENT_TREE_UNLOCK();
7610
7611 // No client found, fail
7612 if (!found_client) {
7613 return ENOENT;
7614 }
7615 } else {
7616 // No client found, and not allowed to search other fds, fail
7617 return ENOENT;
7618 }
7619 }
7620
7621 return error;
7622 }
7623
7624 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_client_update(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7625 necp_client_copy_client_update(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7626 {
7627 int error = 0;
7628
7629 *retval = 0;
7630
7631 if (!(fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER)) {
7632 NECPLOG0(LOG_ERR, "NECP fd is not observer, cannot copy client update");
7633 return EINVAL;
7634 }
7635
7636 if (uap->client_id_len != sizeof(uuid_t) || uap->client_id == 0) {
7637 NECPLOG0(LOG_ERR, "Client id invalid, cannot copy client update");
7638 return EINVAL;
7639 }
7640
7641 if (uap->buffer_size == 0 || uap->buffer == 0) {
7642 NECPLOG0(LOG_ERR, "Buffer invalid, cannot copy client update");
7643 return EINVAL;
7644 }
7645
7646 NECP_FD_LOCK(fd_data);
7647 struct necp_client_update *client_update = TAILQ_FIRST(&fd_data->update_list);
7648 if (client_update != NULL) {
7649 TAILQ_REMOVE(&fd_data->update_list, client_update, chain);
7650 VERIFY(fd_data->update_count > 0);
7651 fd_data->update_count--;
7652 }
7653 NECP_FD_UNLOCK(fd_data);
7654
7655 if (client_update != NULL) {
7656 error = copyout(client_update->client_id, uap->client_id, sizeof(uuid_t));
7657 if (error) {
7658 NECPLOG(LOG_ERR, "Copy client update copyout client id error (%d)", error);
7659 } else {
7660 if (uap->buffer_size < client_update->update_length) {
7661 NECPLOG(LOG_ERR, "Buffer size cannot hold update (%zu < %zu)", (size_t)uap->buffer_size, client_update->update_length);
7662 error = EINVAL;
7663 } else {
7664 error = copyout(client_update->update, uap->buffer, client_update->update_length);
7665 if (error) {
7666 NECPLOG(LOG_ERR, "Copy client update copyout error (%d)", error);
7667 } else {
7668 *retval = client_update->update_length;
7669 }
7670 }
7671 }
7672
7673 necp_client_update_free(client_update);
7674 client_update = NULL;
7675 } else {
7676 error = ENOENT;
7677 }
7678
7679 return error;
7680 }
7681
7682 static int
necp_client_copy_parameters_locked(struct necp_client * client,struct necp_client_nexus_parameters * parameters)7683 necp_client_copy_parameters_locked(struct necp_client *client,
7684 struct necp_client_nexus_parameters *parameters)
7685 {
7686 VERIFY(parameters != NULL);
7687
7688 struct necp_client_parsed_parameters parsed_parameters = {};
7689 int error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, &parsed_parameters);
7690
7691 parameters->pid = client->proc_pid;
7692 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID) {
7693 parameters->epid = parsed_parameters.effective_pid;
7694 } else {
7695 parameters->epid = parameters->pid;
7696 }
7697 #if SKYWALK
7698 parameters->port_reservation = client->port_reservation;
7699 #endif /* !SKYWALK */
7700 memcpy(¶meters->local_addr, &parsed_parameters.local_addr, sizeof(parameters->local_addr));
7701 memcpy(¶meters->remote_addr, &parsed_parameters.remote_addr, sizeof(parameters->remote_addr));
7702 parameters->ip_protocol = parsed_parameters.ip_protocol;
7703 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL) {
7704 parameters->transport_protocol = parsed_parameters.transport_protocol;
7705 } else {
7706 parameters->transport_protocol = parsed_parameters.ip_protocol;
7707 }
7708 parameters->ethertype = parsed_parameters.ethertype;
7709 parameters->traffic_class = parsed_parameters.traffic_class;
7710 if (uuid_is_null(client->override_euuid)) {
7711 uuid_copy(parameters->euuid, parsed_parameters.effective_uuid);
7712 } else {
7713 uuid_copy(parameters->euuid, client->override_euuid);
7714 }
7715 parameters->is_listener = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) ? 1 : 0;
7716 parameters->is_interpose = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) ? 1 : 0;
7717 parameters->is_custom_ether = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) ? 1 : 0;
7718 parameters->policy_id = client->policy_id;
7719
7720 // parse client result flag
7721 u_int32_t client_result_flags = 0;
7722 u_int32_t value_size = 0;
7723 u_int8_t *flags_pointer = NULL;
7724 flags_pointer = necp_buffer_get_tlv_value(client->result, 0, &value_size);
7725 if (flags_pointer && value_size == sizeof(client_result_flags)) {
7726 memcpy(&client_result_flags, flags_pointer, value_size);
7727 }
7728 parameters->allow_qos_marking = (client_result_flags & NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING) ? 1 : 0;
7729
7730 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE) {
7731 if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_DEFAULT) {
7732 parameters->override_address_selection = false;
7733 } else if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_TEMPORARY) {
7734 parameters->override_address_selection = true;
7735 parameters->use_stable_address = false;
7736 } else if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_STABLE) {
7737 parameters->override_address_selection = true;
7738 parameters->use_stable_address = true;
7739 }
7740 } else {
7741 parameters->override_address_selection = false;
7742 }
7743
7744 if ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
7745 (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_NO_WAKE_FROM_SLEEP)) {
7746 parameters->no_wake_from_sleep = true;
7747 }
7748
7749 return error;
7750 }
7751
7752 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_list(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7753 necp_client_list(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7754 {
7755 int error = 0;
7756 struct necp_client *find_client = NULL;
7757 uuid_t *list = NULL;
7758 u_int32_t requested_client_count = 0;
7759 u_int32_t client_count = 0;
7760 size_t copy_buffer_size = 0;
7761
7762 if (uap->buffer_size < sizeof(requested_client_count) || uap->buffer == 0) {
7763 error = EINVAL;
7764 goto done;
7765 }
7766
7767 if (!(fd_data->flags & NECP_OPEN_FLAG_OBSERVER)) {
7768 NECPLOG0(LOG_ERR, "Client does not hold necessary entitlement to list other NECP clients");
7769 error = EACCES;
7770 goto done;
7771 }
7772
7773 error = copyin(uap->buffer, &requested_client_count, sizeof(requested_client_count));
7774 if (error) {
7775 goto done;
7776 }
7777
7778 if (os_mul_overflow(sizeof(uuid_t), requested_client_count, ©_buffer_size)) {
7779 error = ERANGE;
7780 goto done;
7781 }
7782
7783 if (uap->buffer_size - sizeof(requested_client_count) != copy_buffer_size) {
7784 error = EINVAL;
7785 goto done;
7786 }
7787
7788 if (copy_buffer_size > NECP_MAX_CLIENT_LIST_SIZE) {
7789 error = EINVAL;
7790 goto done;
7791 }
7792
7793 if (requested_client_count > 0) {
7794 if ((list = (uuid_t*)kalloc_data(copy_buffer_size, Z_WAITOK | Z_ZERO)) == NULL) {
7795 error = ENOMEM;
7796 goto done;
7797 }
7798 }
7799
7800 // Lock tree
7801 NECP_CLIENT_TREE_LOCK_SHARED();
7802
7803 find_client = NULL;
7804 RB_FOREACH(find_client, _necp_client_global_tree, &necp_client_global_tree) {
7805 NECP_CLIENT_LOCK(find_client);
7806 if (!uuid_is_null(find_client->client_id)) {
7807 if (client_count < requested_client_count) {
7808 uuid_copy(list[client_count], find_client->client_id);
7809 }
7810 client_count++;
7811 }
7812 NECP_CLIENT_UNLOCK(find_client);
7813 }
7814
7815 // Unlock tree
7816 NECP_CLIENT_TREE_UNLOCK();
7817
7818 error = copyout(&client_count, uap->buffer, sizeof(client_count));
7819 if (error) {
7820 NECPLOG(LOG_ERR, "necp_client_list buffer copyout error (%d)", error);
7821 goto done;
7822 }
7823
7824 if (requested_client_count > 0 &&
7825 client_count > 0 &&
7826 list != NULL) {
7827 error = copyout(list, uap->buffer + sizeof(client_count), copy_buffer_size);
7828 if (error) {
7829 NECPLOG(LOG_ERR, "necp_client_list client count copyout error (%d)", error);
7830 goto done;
7831 }
7832 }
7833 done:
7834 if (list != NULL) {
7835 kfree_data(list, copy_buffer_size);
7836 }
7837 *retval = error;
7838
7839 return error;
7840 }
7841
7842 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_add_flow(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7843 necp_client_add_flow(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7844 {
7845 int error = 0;
7846 struct necp_client *client = NULL;
7847 uuid_t client_id;
7848 struct necp_client_nexus_parameters parameters = {};
7849 struct proc *proc = PROC_NULL;
7850 struct necp_client_add_flow *add_request = NULL;
7851 struct necp_client_add_flow *allocated_add_request = NULL;
7852 struct necp_client_add_flow_default default_add_request = {};
7853 const size_t buffer_size = uap->buffer_size;
7854
7855 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
7856 error = EINVAL;
7857 NECPLOG(LOG_ERR, "necp_client_add_flow invalid client_id (length %zu)", (size_t)uap->client_id_len);
7858 goto done;
7859 }
7860
7861 if (uap->buffer == 0 || buffer_size < sizeof(struct necp_client_add_flow) ||
7862 buffer_size > sizeof(struct necp_client_add_flow_default) * 4) {
7863 error = EINVAL;
7864 NECPLOG(LOG_ERR, "necp_client_add_flow invalid buffer (length %zu)", buffer_size);
7865 goto done;
7866 }
7867
7868 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
7869 if (error) {
7870 NECPLOG(LOG_ERR, "necp_client_add_flow copyin client_id error (%d)", error);
7871 goto done;
7872 }
7873
7874 if (buffer_size <= sizeof(struct necp_client_add_flow_default)) {
7875 // Fits in default size
7876 error = copyin(uap->buffer, &default_add_request, buffer_size);
7877 if (error) {
7878 NECPLOG(LOG_ERR, "necp_client_add_flow copyin default_add_request error (%d)", error);
7879 goto done;
7880 }
7881
7882 add_request = (struct necp_client_add_flow *)&default_add_request;
7883 } else {
7884 allocated_add_request = (struct necp_client_add_flow *)kalloc_data(buffer_size, Z_WAITOK | Z_ZERO);
7885 if (allocated_add_request == NULL) {
7886 error = ENOMEM;
7887 goto done;
7888 }
7889
7890 error = copyin(uap->buffer, allocated_add_request, buffer_size);
7891 if (error) {
7892 NECPLOG(LOG_ERR, "necp_client_add_flow copyin default_add_request error (%d)", error);
7893 goto done;
7894 }
7895
7896 add_request = allocated_add_request;
7897 }
7898
7899 NECP_FD_LOCK(fd_data);
7900 pid_t pid = fd_data->proc_pid;
7901 proc = proc_find(pid);
7902 if (proc == PROC_NULL) {
7903 NECP_FD_UNLOCK(fd_data);
7904 NECPLOG(LOG_ERR, "necp_client_add_flow process not found for pid %d error (%d)", pid, error);
7905 error = ESRCH;
7906 goto done;
7907 }
7908
7909 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
7910 if (client == NULL) {
7911 error = ENOENT;
7912 NECP_FD_UNLOCK(fd_data);
7913 goto done;
7914 }
7915
7916 // Using ADD_FLOW indicates that the client supports multiple flows per client
7917 client->legacy_client_is_flow = false;
7918
7919 necp_client_retain_locked(client);
7920 necp_client_copy_parameters_locked(client, ¶meters);
7921
7922 struct necp_client_flow_registration *new_registration = necp_client_create_flow_registration(fd_data, client);
7923 if (new_registration == NULL) {
7924 error = ENOMEM;
7925 NECP_CLIENT_UNLOCK(client);
7926 NECP_FD_UNLOCK(fd_data);
7927 NECPLOG0(LOG_ERR, "Failed to allocate flow registration");
7928 goto done;
7929 }
7930
7931 new_registration->flags = add_request->flags;
7932
7933 // Copy new ID out to caller
7934 uuid_copy(add_request->registration_id, new_registration->registration_id);
7935
7936 NECP_CLIENT_FLOW_LOG(client, new_registration, "adding flow");
7937
7938 // Copy override address
7939 if (add_request->flags & NECP_CLIENT_FLOW_FLAGS_OVERRIDE_ADDRESS) {
7940 size_t offset_of_address = (sizeof(struct necp_client_add_flow) +
7941 add_request->stats_request_count * sizeof(struct necp_client_flow_stats));
7942 if (buffer_size >= offset_of_address + sizeof(struct sockaddr_in)) {
7943 struct sockaddr *override_address = (struct sockaddr *)(((uint8_t *)add_request) + offset_of_address);
7944 if (buffer_size >= offset_of_address + override_address->sa_len &&
7945 override_address->sa_len <= sizeof(parameters.remote_addr)) {
7946 memcpy(¶meters.remote_addr, override_address, override_address->sa_len);
7947 }
7948 }
7949 }
7950
7951 #if SKYWALK
7952 if (add_request->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS) {
7953 void *assigned_results = NULL;
7954 size_t assigned_results_length = 0;
7955 uint32_t interface_index = 0;
7956
7957 // Validate that the nexus UUID is assigned
7958 bool found_nexus = false;
7959 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
7960 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
7961 struct necp_client_interface_option *option = &client->interface_options[option_i];
7962 if (uuid_compare(option->nexus_agent, add_request->agent_uuid) == 0) {
7963 interface_index = option->interface_index;
7964 found_nexus = true;
7965 break;
7966 }
7967 } else {
7968 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
7969 if (uuid_compare(option->nexus_agent, add_request->agent_uuid) == 0) {
7970 interface_index = option->interface_index;
7971 found_nexus = true;
7972 break;
7973 }
7974 }
7975 }
7976
7977 if (!found_nexus) {
7978 NECPLOG0(LOG_ERR, "Requested nexus not found");
7979 } else {
7980 necp_client_add_nexus_flow_if_needed(new_registration, add_request->agent_uuid, interface_index);
7981
7982 error = netagent_client_message_with_params(add_request->agent_uuid,
7983 ((new_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
7984 client->client_id :
7985 new_registration->registration_id),
7986 pid, client->agent_handle,
7987 NETAGENT_MESSAGE_TYPE_REQUEST_NEXUS,
7988 (struct necp_client_agent_parameters *)¶meters,
7989 &assigned_results, &assigned_results_length);
7990 if (error != 0) {
7991 VERIFY(assigned_results == NULL);
7992 VERIFY(assigned_results_length == 0);
7993 NECPLOG(LOG_ERR, "netagent_client_message error (%d)", error);
7994 } else if (assigned_results != NULL) {
7995 if (!necp_assign_client_result_locked(proc, fd_data, client, new_registration, add_request->agent_uuid,
7996 assigned_results, assigned_results_length, false)) {
7997 kfree_data(assigned_results, assigned_results_length);
7998 }
7999 }
8000 }
8001 }
8002
8003 // Don't request stats if nexus creation fails
8004 if (error == 0 && add_request->stats_request_count > 0 && necp_arena_initialize(fd_data, true) == 0) {
8005 struct necp_client_flow_stats *stats_request = (struct necp_client_flow_stats *)&add_request->stats_requests[0];
8006 struct necp_stats_bufreq bufreq = {};
8007
8008 NECP_CLIENT_FLOW_LOG(client, new_registration, "Initializing stats");
8009
8010 bufreq.necp_stats_bufreq_id = NECP_CLIENT_STATISTICS_BUFREQ_ID;
8011 bufreq.necp_stats_bufreq_type = stats_request->stats_type;
8012 bufreq.necp_stats_bufreq_ver = stats_request->stats_version;
8013 bufreq.necp_stats_bufreq_size = stats_request->stats_size;
8014 bufreq.necp_stats_bufreq_uaddr = stats_request->stats_addr;
8015 (void)necp_stats_initialize(fd_data, client, new_registration, &bufreq);
8016 stats_request->stats_type = bufreq.necp_stats_bufreq_type;
8017 stats_request->stats_version = bufreq.necp_stats_bufreq_ver;
8018 stats_request->stats_size = bufreq.necp_stats_bufreq_size;
8019 stats_request->stats_addr = bufreq.necp_stats_bufreq_uaddr;
8020 }
8021 #endif /* !SKYWALK */
8022
8023 if (error == 0 &&
8024 (add_request->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE ||
8025 add_request->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) {
8026 uint32_t interface_index = IFSCOPE_NONE;
8027 ifnet_head_lock_shared();
8028 struct ifnet *interface = NULL;
8029 TAILQ_FOREACH(interface, &ifnet_head, if_link) {
8030 ifnet_lock_shared(interface);
8031 if (interface->if_agentids != NULL) {
8032 for (u_int32_t i = 0; i < interface->if_agentcount; i++) {
8033 if (uuid_compare(interface->if_agentids[i], add_request->agent_uuid) == 0) {
8034 interface_index = interface->if_index;
8035 break;
8036 }
8037 }
8038 }
8039 ifnet_lock_done(interface);
8040 if (interface_index != IFSCOPE_NONE) {
8041 break;
8042 }
8043 }
8044 ifnet_head_done();
8045
8046 necp_client_add_nexus_flow_if_needed(new_registration, add_request->agent_uuid, interface_index);
8047
8048 error = netagent_client_message_with_params(add_request->agent_uuid,
8049 ((new_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
8050 client->client_id :
8051 new_registration->registration_id),
8052 pid, client->agent_handle,
8053 NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT,
8054 (struct necp_client_agent_parameters *)¶meters,
8055 NULL, NULL);
8056 if (error != 0) {
8057 NECPLOG(LOG_ERR, "netagent_client_message error (%d)", error);
8058 }
8059 }
8060
8061 if (error != 0) {
8062 // Encountered an error in adding the flow, destroy the flow registration
8063 #if SKYWALK
8064 necp_destroy_flow_stats(fd_data, new_registration, NULL, false);
8065 #endif /* SKYWALK */
8066 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
8067 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, new_registration);
8068 NECP_FLOW_TREE_UNLOCK();
8069 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, new_registration);
8070 necp_destroy_client_flow_registration(client, new_registration, fd_data->proc_pid, true);
8071 new_registration = NULL;
8072 }
8073
8074 NECP_CLIENT_UNLOCK(client);
8075 NECP_FD_UNLOCK(fd_data);
8076
8077 necp_client_release(client);
8078
8079 if (error != 0) {
8080 goto done;
8081 }
8082
8083 // Copy the request back out to the caller with assigned fields
8084 error = copyout(add_request, uap->buffer, buffer_size);
8085 if (error != 0) {
8086 NECPLOG(LOG_ERR, "necp_client_add_flow copyout add_request error (%d)", error);
8087 }
8088
8089 done:
8090 *retval = error;
8091 if (error != 0) {
8092 NECPLOG(LOG_ERR, "Add flow error (%d)", error);
8093 }
8094
8095 if (allocated_add_request != NULL) {
8096 kfree_data(allocated_add_request, buffer_size);
8097 }
8098
8099 if (proc != PROC_NULL) {
8100 proc_rele(proc);
8101 }
8102 return error;
8103 }
8104
8105 #if SKYWALK
8106
8107 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_request_nexus(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8108 necp_client_request_nexus(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8109 {
8110 int error = 0;
8111 struct necp_client *client = NULL;
8112 uuid_t client_id;
8113 struct necp_client_nexus_parameters parameters = {};
8114 struct proc *proc = PROC_NULL;
8115 const size_t buffer_size = uap->buffer_size;
8116
8117 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
8118 error = EINVAL;
8119 goto done;
8120 }
8121
8122 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8123 if (error) {
8124 NECPLOG(LOG_ERR, "necp_client_request_nexus copyin client_id error (%d)", error);
8125 goto done;
8126 }
8127
8128 NECP_FD_LOCK(fd_data);
8129 pid_t pid = fd_data->proc_pid;
8130 proc = proc_find(pid);
8131 if (proc == PROC_NULL) {
8132 NECP_FD_UNLOCK(fd_data);
8133 NECPLOG(LOG_ERR, "necp_client_request_nexus process not found for pid %d error (%d)", pid, error);
8134 error = ESRCH;
8135 goto done;
8136 }
8137
8138 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8139 if (client == NULL) {
8140 NECP_FD_UNLOCK(fd_data);
8141 error = ENOENT;
8142 goto done;
8143 }
8144
8145 // Using REQUEST_NEXUS indicates that the client only supports one flow per client
8146 client->legacy_client_is_flow = true;
8147
8148 necp_client_retain_locked(client);
8149 necp_client_copy_parameters_locked(client, ¶meters);
8150
8151 do {
8152 void *assigned_results = NULL;
8153 size_t assigned_results_length = 0;
8154 uuid_t nexus_uuid;
8155 uint32_t interface_index = 0;
8156
8157 // Validate that the nexus UUID is assigned
8158 bool found_nexus = false;
8159 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
8160 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
8161 struct necp_client_interface_option *option = &client->interface_options[option_i];
8162 if (!uuid_is_null(option->nexus_agent)) {
8163 uuid_copy(nexus_uuid, option->nexus_agent);
8164 interface_index = option->interface_index;
8165 found_nexus = true;
8166 break;
8167 }
8168 } else {
8169 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
8170 if (!uuid_is_null(option->nexus_agent)) {
8171 uuid_copy(nexus_uuid, option->nexus_agent);
8172 interface_index = option->interface_index;
8173 found_nexus = true;
8174 break;
8175 }
8176 }
8177 }
8178
8179 if (!found_nexus) {
8180 NECP_CLIENT_UNLOCK(client);
8181 NECP_FD_UNLOCK(fd_data);
8182 necp_client_release(client);
8183 // Break the loop
8184 error = ENETDOWN;
8185 goto done;
8186 }
8187
8188 struct necp_client_flow_registration *new_registration = necp_client_create_flow_registration(fd_data, client);
8189 if (new_registration == NULL) {
8190 error = ENOMEM;
8191 NECP_CLIENT_UNLOCK(client);
8192 NECP_FD_UNLOCK(fd_data);
8193 necp_client_release(client);
8194 NECPLOG0(LOG_ERR, "Failed to allocate flow registration");
8195 goto done;
8196 }
8197
8198 new_registration->flags = (NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS | NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID);
8199
8200 necp_client_add_nexus_flow_if_needed(new_registration, nexus_uuid, interface_index);
8201
8202 // Note: Any clients using "request_nexus" are not flow-registration aware.
8203 // Register the Client ID rather than the Registration ID with the nexus, since
8204 // the client will send traffic based on the client ID.
8205 error = netagent_client_message_with_params(nexus_uuid,
8206 ((new_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
8207 client->client_id :
8208 new_registration->registration_id),
8209 pid, client->agent_handle,
8210 NETAGENT_MESSAGE_TYPE_REQUEST_NEXUS,
8211 (struct necp_client_agent_parameters *)¶meters,
8212 &assigned_results, &assigned_results_length);
8213 if (error) {
8214 NECP_CLIENT_UNLOCK(client);
8215 NECP_FD_UNLOCK(fd_data);
8216 necp_client_release(client);
8217 VERIFY(assigned_results == NULL);
8218 VERIFY(assigned_results_length == 0);
8219 NECPLOG(LOG_ERR, "netagent_client_message error (%d)", error);
8220 goto done;
8221 }
8222
8223 if (assigned_results != NULL) {
8224 if (!necp_assign_client_result_locked(proc, fd_data, client, new_registration, nexus_uuid,
8225 assigned_results, assigned_results_length, false)) {
8226 kfree_data(assigned_results, assigned_results_length);
8227 }
8228 }
8229
8230 if (uap->buffer != 0 && buffer_size == sizeof(struct necp_stats_bufreq) &&
8231 necp_arena_initialize(fd_data, true) == 0) {
8232 struct necp_stats_bufreq bufreq = {};
8233 int copy_error = copyin(uap->buffer, &bufreq, buffer_size);
8234 if (copy_error) {
8235 NECPLOG(LOG_ERR, "necp_client_request_nexus copyin bufreq error (%d)", copy_error);
8236 } else {
8237 (void)necp_stats_initialize(fd_data, client, new_registration, &bufreq);
8238 copy_error = copyout(&bufreq, uap->buffer, buffer_size);
8239 if (copy_error != 0) {
8240 NECPLOG(LOG_ERR, "necp_client_request_nexus copyout bufreq error (%d)", copy_error);
8241 }
8242 }
8243 }
8244 } while (false);
8245
8246 NECP_CLIENT_UNLOCK(client);
8247 NECP_FD_UNLOCK(fd_data);
8248
8249 necp_client_release(client);
8250
8251 done:
8252 *retval = error;
8253 if (error != 0) {
8254 NECPLOG(LOG_ERR, "Request nexus error (%d)", error);
8255 }
8256
8257 if (proc != PROC_NULL) {
8258 proc_rele(proc);
8259 }
8260 return error;
8261 }
8262 #endif /* !SKYWALK */
8263
8264 static void
necp_client_add_assertion(struct necp_client * client,uuid_t netagent_uuid)8265 necp_client_add_assertion(struct necp_client *client, uuid_t netagent_uuid)
8266 {
8267 struct necp_client_assertion *new_assertion = NULL;
8268
8269 new_assertion = kalloc_type(struct necp_client_assertion,
8270 Z_WAITOK | Z_NOFAIL);
8271
8272 uuid_copy(new_assertion->asserted_netagent, netagent_uuid);
8273
8274 LIST_INSERT_HEAD(&client->assertion_list, new_assertion, assertion_chain);
8275 }
8276
8277 static bool
necp_client_remove_assertion(struct necp_client * client,uuid_t netagent_uuid)8278 necp_client_remove_assertion(struct necp_client *client, uuid_t netagent_uuid)
8279 {
8280 struct necp_client_assertion *found_assertion = NULL;
8281 struct necp_client_assertion *search_assertion = NULL;
8282 LIST_FOREACH(search_assertion, &client->assertion_list, assertion_chain) {
8283 if (uuid_compare(search_assertion->asserted_netagent, netagent_uuid) == 0) {
8284 found_assertion = search_assertion;
8285 break;
8286 }
8287 }
8288
8289 if (found_assertion == NULL) {
8290 NECPLOG0(LOG_ERR, "Netagent uuid not previously asserted");
8291 return false;
8292 }
8293
8294 LIST_REMOVE(found_assertion, assertion_chain);
8295 kfree_type(struct necp_client_assertion, found_assertion);
8296 return true;
8297 }
8298
8299 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_agent_action(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8300 necp_client_agent_action(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8301 {
8302 int error = 0;
8303 struct necp_client *client = NULL;
8304 uuid_t client_id;
8305 bool acted_on_agent = FALSE;
8306 u_int8_t *parameters = NULL;
8307 const size_t buffer_size = uap->buffer_size;
8308
8309 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
8310 buffer_size == 0 || uap->buffer == 0) {
8311 NECPLOG0(LOG_ERR, "necp_client_agent_action invalid parameters");
8312 error = EINVAL;
8313 goto done;
8314 }
8315
8316 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8317 if (error) {
8318 NECPLOG(LOG_ERR, "necp_client_agent_action copyin client_id error (%d)", error);
8319 goto done;
8320 }
8321
8322 if (buffer_size > NECP_MAX_AGENT_ACTION_SIZE) {
8323 NECPLOG(LOG_ERR, "necp_client_agent_action invalid buffer size (>%u)", NECP_MAX_AGENT_ACTION_SIZE);
8324 error = EINVAL;
8325 goto done;
8326 }
8327
8328 if ((parameters = (u_int8_t *)kalloc_data(buffer_size, Z_WAITOK | Z_ZERO)) == NULL) {
8329 NECPLOG0(LOG_ERR, "necp_client_agent_action malloc failed");
8330 error = ENOMEM;
8331 goto done;
8332 }
8333
8334 error = copyin(uap->buffer, parameters, buffer_size);
8335 if (error) {
8336 NECPLOG(LOG_ERR, "necp_client_agent_action parameters copyin error (%d)", error);
8337 goto done;
8338 }
8339
8340 NECP_FD_LOCK(fd_data);
8341 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8342 if (client != NULL) {
8343 size_t offset = 0;
8344 while ((offset + sizeof(struct necp_tlv_header)) <= buffer_size) {
8345 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
8346 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
8347
8348 if (length > (buffer_size - (offset + sizeof(struct necp_tlv_header)))) {
8349 // If the length is larger than what can fit in the remaining parameters size, bail
8350 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
8351 break;
8352 }
8353
8354 if (length >= sizeof(uuid_t)) {
8355 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
8356 if (value == NULL) {
8357 NECPLOG0(LOG_ERR, "Invalid TLV value");
8358 break;
8359 }
8360 if (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT ||
8361 type == NECP_CLIENT_PARAMETER_ASSERT_AGENT ||
8362 type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
8363 uuid_t agent_uuid;
8364 uuid_copy(agent_uuid, value);
8365 u_int8_t netagent_message_type = 0;
8366 if (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT) {
8367 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_TRIGGER;
8368 } else if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
8369 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT;
8370 } else if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
8371 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
8372 }
8373
8374 // Before unasserting, verify that the assertion was already taken
8375 if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
8376 if (!necp_client_remove_assertion(client, agent_uuid)) {
8377 error = ENOENT;
8378 break;
8379 }
8380 }
8381
8382 struct necp_client_nexus_parameters parsed_parameters = {};
8383 necp_client_copy_parameters_locked(client, &parsed_parameters);
8384
8385 error = netagent_client_message_with_params(agent_uuid,
8386 client_id,
8387 fd_data->proc_pid,
8388 client->agent_handle,
8389 netagent_message_type,
8390 (struct necp_client_agent_parameters *)&parsed_parameters,
8391 NULL, NULL);
8392 if (error == 0) {
8393 acted_on_agent = TRUE;
8394 } else {
8395 break;
8396 }
8397
8398 // Only save the assertion if the action succeeded
8399 if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
8400 necp_client_add_assertion(client, agent_uuid);
8401 }
8402 } else if (type == NECP_CLIENT_PARAMETER_AGENT_ADD_GROUP_MEMBERS ||
8403 type == NECP_CLIENT_PARAMETER_AGENT_REMOVE_GROUP_MEMBERS) {
8404 uuid_t agent_uuid;
8405 uuid_copy(agent_uuid, value);
8406 u_int8_t netagent_message_type = 0;
8407 if (type == NECP_CLIENT_PARAMETER_AGENT_ADD_GROUP_MEMBERS) {
8408 netagent_message_type = NETAGENT_MESSAGE_TYPE_ADD_GROUP_MEMBERS;
8409 } else if (type == NECP_CLIENT_PARAMETER_AGENT_REMOVE_GROUP_MEMBERS) {
8410 netagent_message_type = NETAGENT_MESSAGE_TYPE_REMOVE_GROUP_MEMBERS;
8411 }
8412
8413 struct necp_client_group_members group_members = {};
8414 group_members.group_members_length = (length - sizeof(uuid_t));
8415 group_members.group_members = (value + sizeof(uuid_t));
8416 error = netagent_client_message_with_params(agent_uuid,
8417 client_id,
8418 fd_data->proc_pid,
8419 client->agent_handle,
8420 netagent_message_type,
8421 (struct necp_client_agent_parameters *)&group_members,
8422 NULL, NULL);
8423 if (error == 0) {
8424 acted_on_agent = TRUE;
8425 } else {
8426 break;
8427 }
8428 } else if (type == NECP_CLIENT_PARAMETER_REPORT_AGENT_ERROR) {
8429 uuid_t agent_uuid;
8430 uuid_copy(agent_uuid, value);
8431 struct necp_client_agent_parameters agent_params = {};
8432 if ((length - sizeof(uuid_t)) >= sizeof(agent_params.u.error)) {
8433 memcpy(&agent_params.u.error,
8434 (value + sizeof(uuid_t)),
8435 sizeof(agent_params.u.error));
8436 }
8437 error = netagent_client_message_with_params(agent_uuid,
8438 client_id,
8439 fd_data->proc_pid,
8440 client->agent_handle,
8441 NETAGENT_MESSAGE_TYPE_CLIENT_ERROR,
8442 &agent_params,
8443 NULL, NULL);
8444 if (error == 0) {
8445 acted_on_agent = TRUE;
8446 } else {
8447 break;
8448 }
8449 }
8450 }
8451
8452 offset += sizeof(struct necp_tlv_header) + length;
8453 }
8454
8455 NECP_CLIENT_UNLOCK(client);
8456 }
8457 NECP_FD_UNLOCK(fd_data);
8458
8459 if (!acted_on_agent &&
8460 error == 0) {
8461 error = ENOENT;
8462 }
8463 done:
8464 *retval = error;
8465 if (parameters != NULL) {
8466 kfree_data(parameters, buffer_size);
8467 parameters = NULL;
8468 }
8469
8470 return error;
8471 }
8472
8473 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_agent(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8474 necp_client_copy_agent(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8475 {
8476 int error = 0;
8477 uuid_t agent_uuid;
8478 const size_t buffer_size = uap->buffer_size;
8479
8480 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
8481 buffer_size == 0 || uap->buffer == 0) {
8482 NECPLOG0(LOG_ERR, "necp_client_copy_agent bad input");
8483 error = EINVAL;
8484 goto done;
8485 }
8486
8487 error = copyin(uap->client_id, agent_uuid, sizeof(uuid_t));
8488 if (error) {
8489 NECPLOG(LOG_ERR, "necp_client_copy_agent copyin agent_uuid error (%d)", error);
8490 goto done;
8491 }
8492
8493 error = netagent_copyout(agent_uuid, uap->buffer, buffer_size);
8494 if (error) {
8495 // netagent_copyout already logs appropriate errors
8496 goto done;
8497 }
8498 done:
8499 *retval = error;
8500
8501 return error;
8502 }
8503
8504 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_agent_use(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8505 necp_client_agent_use(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8506 {
8507 int error = 0;
8508 struct necp_client *client = NULL;
8509 uuid_t client_id;
8510 struct necp_agent_use_parameters parameters = {};
8511 const size_t buffer_size = uap->buffer_size;
8512
8513 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
8514 buffer_size != sizeof(parameters) || uap->buffer == 0) {
8515 error = EINVAL;
8516 goto done;
8517 }
8518
8519 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8520 if (error) {
8521 NECPLOG(LOG_ERR, "Copyin client_id error (%d)", error);
8522 goto done;
8523 }
8524
8525 error = copyin(uap->buffer, ¶meters, buffer_size);
8526 if (error) {
8527 NECPLOG(LOG_ERR, "Parameters copyin error (%d)", error);
8528 goto done;
8529 }
8530
8531 NECP_FD_LOCK(fd_data);
8532 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8533 if (client != NULL) {
8534 error = netagent_use(parameters.agent_uuid, ¶meters.out_use_count);
8535 NECP_CLIENT_UNLOCK(client);
8536 } else {
8537 error = ENOENT;
8538 }
8539
8540 NECP_FD_UNLOCK(fd_data);
8541
8542 if (error == 0) {
8543 error = copyout(¶meters, uap->buffer, buffer_size);
8544 if (error) {
8545 NECPLOG(LOG_ERR, "Parameters copyout error (%d)", error);
8546 goto done;
8547 }
8548 }
8549
8550 done:
8551 *retval = error;
8552
8553 return error;
8554 }
8555
8556 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_acquire_agent_token(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8557 necp_client_acquire_agent_token(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8558 {
8559 int error = 0;
8560 uuid_t agent_uuid = {};
8561 const size_t buffer_size = uap->buffer_size;
8562
8563 *retval = 0;
8564
8565 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
8566 buffer_size == 0 || uap->buffer == 0) {
8567 NECPLOG0(LOG_ERR, "necp_client_copy_agent bad input");
8568 error = EINVAL;
8569 goto done;
8570 }
8571
8572 error = copyin(uap->client_id, agent_uuid, sizeof(uuid_t));
8573 if (error) {
8574 NECPLOG(LOG_ERR, "necp_client_copy_agent copyin agent_uuid error (%d)", error);
8575 goto done;
8576 }
8577
8578 error = netagent_acquire_token(agent_uuid, uap->buffer, buffer_size, retval);
8579 done:
8580 return error;
8581 }
8582
8583 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_interface(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8584 necp_client_copy_interface(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8585 {
8586 int error = 0;
8587 u_int32_t interface_index = 0;
8588 struct necp_interface_details interface_details = {};
8589
8590 if (uap->client_id == 0 || uap->client_id_len != sizeof(u_int32_t) ||
8591 uap->buffer_size < sizeof(interface_details) ||
8592 uap->buffer == 0) {
8593 NECPLOG0(LOG_ERR, "necp_client_copy_interface bad input");
8594 error = EINVAL;
8595 goto done;
8596 }
8597
8598 error = copyin(uap->client_id, &interface_index, sizeof(u_int32_t));
8599 if (error) {
8600 NECPLOG(LOG_ERR, "necp_client_copy_interface copyin interface_index error (%d)", error);
8601 goto done;
8602 }
8603
8604 if (interface_index == 0) {
8605 error = ENOENT;
8606 NECPLOG(LOG_ERR, "necp_client_copy_interface bad interface_index (%d)", interface_index);
8607 goto done;
8608 }
8609
8610 lck_mtx_lock(rnh_lock);
8611 ifnet_head_lock_shared();
8612 ifnet_t interface = NULL;
8613 if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
8614 interface = ifindex2ifnet[interface_index];
8615 }
8616
8617 if (interface != NULL) {
8618 if (interface->if_xname != NULL) {
8619 strlcpy((char *)&interface_details.name, interface->if_xname, sizeof(interface_details.name));
8620 }
8621 interface_details.index = interface->if_index;
8622 interface_details.generation = ifnet_get_generation(interface);
8623 if (interface->if_delegated.ifp != NULL) {
8624 interface_details.delegate_index = interface->if_delegated.ifp->if_index;
8625 }
8626 interface_details.functional_type = if_functional_type(interface, TRUE);
8627 if (IFNET_IS_EXPENSIVE(interface)) {
8628 interface_details.flags |= NECP_INTERFACE_FLAG_EXPENSIVE;
8629 }
8630 if (IFNET_IS_CONSTRAINED(interface)) {
8631 interface_details.flags |= NECP_INTERFACE_FLAG_CONSTRAINED;
8632 }
8633 if ((interface->if_eflags & IFEF_TXSTART) == IFEF_TXSTART) {
8634 interface_details.flags |= NECP_INTERFACE_FLAG_TXSTART;
8635 }
8636 if ((interface->if_eflags & IFEF_NOACKPRI) == IFEF_NOACKPRI) {
8637 interface_details.flags |= NECP_INTERFACE_FLAG_NOACKPRI;
8638 }
8639 if ((interface->if_eflags & IFEF_3CA) == IFEF_3CA) {
8640 interface_details.flags |= NECP_INTERFACE_FLAG_3CARRIERAGG;
8641 }
8642 if (IFNET_IS_LOW_POWER(interface)) {
8643 interface_details.flags |= NECP_INTERFACE_FLAG_IS_LOW_POWER;
8644 }
8645 if (interface->if_xflags & IFXF_MPK_LOG) {
8646 interface_details.flags |= NECP_INTERFACE_FLAG_MPK_LOG;
8647 }
8648 if (interface->if_flags & IFF_MULTICAST) {
8649 interface_details.flags |= NECP_INTERFACE_FLAG_SUPPORTS_MULTICAST;
8650 }
8651 if (IS_INTF_CLAT46(interface)) {
8652 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_NAT64;
8653 }
8654 interface_details.mtu = interface->if_mtu;
8655
8656 u_int8_t ipv4_signature_len = sizeof(interface_details.ipv4_signature.signature);
8657 u_int16_t ipv4_signature_flags;
8658 if (ifnet_get_netsignature(interface, AF_INET, &ipv4_signature_len, &ipv4_signature_flags,
8659 (u_int8_t *)&interface_details.ipv4_signature) != 0) {
8660 ipv4_signature_len = 0;
8661 }
8662 interface_details.ipv4_signature.signature_len = ipv4_signature_len;
8663
8664 // Check for default scoped routes for IPv4 and IPv6
8665 union necp_sockaddr_union default_address;
8666 struct rtentry *v4Route = NULL;
8667 memset(&default_address, 0, sizeof(default_address));
8668 default_address.sa.sa_family = AF_INET;
8669 default_address.sa.sa_len = sizeof(struct sockaddr_in);
8670 v4Route = rtalloc1_scoped_locked((struct sockaddr *)&default_address, 0, 0,
8671 interface->if_index);
8672 if (v4Route != NULL) {
8673 if (v4Route->rt_ifp != NULL && !IS_INTF_CLAT46(v4Route->rt_ifp)) {
8674 interface_details.flags |= NECP_INTERFACE_FLAG_IPV4_ROUTABLE;
8675 }
8676 rtfree_locked(v4Route);
8677 v4Route = NULL;
8678 }
8679
8680 struct rtentry *v6Route = NULL;
8681 memset(&default_address, 0, sizeof(default_address));
8682 default_address.sa.sa_family = AF_INET6;
8683 default_address.sa.sa_len = sizeof(struct sockaddr_in6);
8684 v6Route = rtalloc1_scoped_locked((struct sockaddr *)&default_address, 0, 0,
8685 interface->if_index);
8686 if (v6Route != NULL) {
8687 if (v6Route->rt_ifp != NULL) {
8688 interface_details.flags |= NECP_INTERFACE_FLAG_IPV6_ROUTABLE;
8689 }
8690 rtfree_locked(v6Route);
8691 v6Route = NULL;
8692 }
8693
8694 u_int8_t ipv6_signature_len = sizeof(interface_details.ipv6_signature.signature);
8695 u_int16_t ipv6_signature_flags;
8696 if (ifnet_get_netsignature(interface, AF_INET6, &ipv6_signature_len, &ipv6_signature_flags,
8697 (u_int8_t *)&interface_details.ipv6_signature) != 0) {
8698 ipv6_signature_len = 0;
8699 }
8700 interface_details.ipv6_signature.signature_len = ipv6_signature_len;
8701
8702 ifnet_lock_shared(interface);
8703 struct ifaddr *ifa = NULL;
8704 TAILQ_FOREACH(ifa, &interface->if_addrhead, ifa_link) {
8705 IFA_LOCK(ifa);
8706 if (ifa->ifa_addr->sa_family == AF_INET) {
8707 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_NETMASK;
8708 interface_details.ipv4_netmask = ((struct in_ifaddr *)ifa)->ia_sockmask.sin_addr.s_addr;
8709 if (interface->if_flags & IFF_BROADCAST) {
8710 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_BROADCAST;
8711 interface_details.ipv4_broadcast = ((struct in_ifaddr *)ifa)->ia_broadaddr.sin_addr.s_addr;
8712 }
8713 }
8714 IFA_UNLOCK(ifa);
8715 }
8716
8717 interface_details.radio_type = interface->if_radio_type;
8718 if (interface_details.radio_type == 0 && interface->if_delegated.ifp) {
8719 interface_details.radio_type = interface->if_delegated.ifp->if_radio_type;
8720 }
8721 ifnet_lock_done(interface);
8722 }
8723
8724 ifnet_head_done();
8725 lck_mtx_unlock(rnh_lock);
8726
8727 // If the client is using an older version of the struct, copy that length
8728 error = copyout(&interface_details, uap->buffer, sizeof(interface_details));
8729 if (error) {
8730 NECPLOG(LOG_ERR, "necp_client_copy_interface copyout error (%d)", error);
8731 goto done;
8732 }
8733 done:
8734 *retval = error;
8735
8736 return error;
8737 }
8738
8739 #if SKYWALK
8740
8741 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_get_interface_address(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8742 necp_client_get_interface_address(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8743 {
8744 int error = 0;
8745 u_int32_t interface_index = IFSCOPE_NONE;
8746 struct sockaddr_storage address = {};
8747 const size_t buffer_size = uap->buffer_size;
8748
8749 if (uap->client_id == 0 || uap->client_id_len != sizeof(u_int32_t) ||
8750 buffer_size < sizeof(struct sockaddr_in) ||
8751 buffer_size > sizeof(struct sockaddr_storage) ||
8752 uap->buffer == 0) {
8753 NECPLOG0(LOG_ERR, "necp_client_get_interface_address bad input");
8754 error = EINVAL;
8755 goto done;
8756 }
8757
8758 error = copyin(uap->client_id, &interface_index, sizeof(u_int32_t));
8759 if (error) {
8760 NECPLOG(LOG_ERR, "necp_client_get_interface_address copyin interface_index error (%d)", error);
8761 goto done;
8762 }
8763
8764 if (interface_index == IFSCOPE_NONE) {
8765 error = ENOENT;
8766 NECPLOG(LOG_ERR, "necp_client_get_interface_address bad interface_index (%d)", interface_index);
8767 goto done;
8768 }
8769
8770 error = copyin(uap->buffer, &address, buffer_size);
8771 if (error) {
8772 NECPLOG(LOG_ERR, "necp_client_get_interface_address copyin address error (%d)", error);
8773 goto done;
8774 }
8775
8776 if (address.ss_family != AF_INET && address.ss_family != AF_INET6) {
8777 error = EINVAL;
8778 NECPLOG(LOG_ERR, "necp_client_get_interface_address invalid address family (%u)", address.ss_family);
8779 goto done;
8780 }
8781
8782 if (address.ss_len != buffer_size) {
8783 error = EINVAL;
8784 NECPLOG(LOG_ERR, "necp_client_get_interface_address invalid address length (%u)", address.ss_len);
8785 goto done;
8786 }
8787
8788 ifnet_head_lock_shared();
8789 ifnet_t ifp = NULL;
8790 if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
8791 ifp = ifindex2ifnet[interface_index];
8792 }
8793 ifnet_head_done();
8794 if (ifp == NULL) {
8795 error = ENOENT;
8796 NECPLOG0(LOG_ERR, "necp_client_get_interface_address no matching interface found");
8797 goto done;
8798 }
8799
8800 struct rtentry *rt = rtalloc1_scoped((struct sockaddr *)&address, 0, 0, interface_index);
8801 if (rt == NULL) {
8802 error = EINVAL;
8803 NECPLOG0(LOG_ERR, "necp_client_get_interface_address route lookup failed");
8804 goto done;
8805 }
8806
8807 uint32_t gencount = 0;
8808 struct sockaddr_storage local_address = {};
8809 error = flow_route_select_laddr((union sockaddr_in_4_6 *)&local_address,
8810 (union sockaddr_in_4_6 *)&address, ifp, rt, &gencount, 1);
8811 rtfree(rt);
8812 rt = NULL;
8813
8814 if (error) {
8815 NECPLOG(LOG_ERR, "necp_client_get_interface_address local address selection failed (%d)", error);
8816 goto done;
8817 }
8818
8819 if (local_address.ss_len > buffer_size) {
8820 error = EMSGSIZE;
8821 NECPLOG(LOG_ERR, "necp_client_get_interface_address local address too long for buffer (%u)",
8822 local_address.ss_len);
8823 goto done;
8824 }
8825
8826 error = copyout(&local_address, uap->buffer, local_address.ss_len);
8827 if (error) {
8828 NECPLOG(LOG_ERR, "necp_client_get_interface_address copyout error (%d)", error);
8829 goto done;
8830 }
8831 done:
8832 *retval = error;
8833
8834 return error;
8835 }
8836
8837 extern char *proc_name_address(void *p);
8838
8839 int
necp_stats_ctor(struct skmem_obj_info * oi,struct skmem_obj_info * oim,void * arg,uint32_t skmflag)8840 necp_stats_ctor(struct skmem_obj_info *oi, struct skmem_obj_info *oim,
8841 void *arg, uint32_t skmflag)
8842 {
8843 #pragma unused(arg, skmflag)
8844 struct necp_all_kstats *kstats = SKMEM_OBJ_ADDR(oi);
8845
8846 ASSERT(oim != NULL && SKMEM_OBJ_ADDR(oim) != NULL);
8847 ASSERT(SKMEM_OBJ_SIZE(oi) == SKMEM_OBJ_SIZE(oim));
8848
8849 kstats->necp_stats_ustats = SKMEM_OBJ_ADDR(oim);
8850
8851 return 0;
8852 }
8853
8854 int
necp_stats_dtor(void * addr,void * arg)8855 necp_stats_dtor(void *addr, void *arg)
8856 {
8857 #pragma unused(addr, arg)
8858 struct necp_all_kstats *kstats = addr;
8859
8860 kstats->necp_stats_ustats = NULL;
8861
8862 return 0;
8863 }
8864
8865 static void
necp_fd_insert_stats_arena(struct necp_fd_data * fd_data,struct necp_arena_info * nai)8866 necp_fd_insert_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai)
8867 {
8868 NECP_FD_ASSERT_LOCKED(fd_data);
8869 VERIFY(!(nai->nai_flags & NAIF_ATTACHED));
8870 VERIFY(nai->nai_chain.le_next == NULL && nai->nai_chain.le_prev == NULL);
8871
8872 LIST_INSERT_HEAD(&fd_data->stats_arena_list, nai, nai_chain);
8873 nai->nai_flags |= NAIF_ATTACHED;
8874 necp_arena_info_retain(nai); // for the list
8875 }
8876
8877 static void
necp_fd_remove_stats_arena(struct necp_fd_data * fd_data,struct necp_arena_info * nai)8878 necp_fd_remove_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai)
8879 {
8880 #pragma unused(fd_data)
8881 NECP_FD_ASSERT_LOCKED(fd_data);
8882 VERIFY(nai->nai_flags & NAIF_ATTACHED);
8883 VERIFY(nai->nai_use_count >= 1);
8884
8885 LIST_REMOVE(nai, nai_chain);
8886 nai->nai_flags &= ~NAIF_ATTACHED;
8887 nai->nai_chain.le_next = NULL;
8888 nai->nai_chain.le_prev = NULL;
8889 necp_arena_info_release(nai); // for the list
8890 }
8891
8892 static struct necp_arena_info *
necp_fd_mredirect_stats_arena(struct necp_fd_data * fd_data,struct proc * proc)8893 necp_fd_mredirect_stats_arena(struct necp_fd_data *fd_data, struct proc *proc)
8894 {
8895 struct necp_arena_info *nai, *nai_ret = NULL;
8896
8897 NECP_FD_ASSERT_LOCKED(fd_data);
8898
8899 // Redirect currently-active stats arena and remove it from the active state;
8900 // upon process resumption, new flow request would trigger the creation of
8901 // another active arena.
8902 if ((nai = fd_data->stats_arena_active) != NULL) {
8903 boolean_t need_defunct = FALSE;
8904
8905 ASSERT(!(nai->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT)));
8906 VERIFY(nai->nai_use_count >= 2);
8907 ASSERT(nai->nai_arena != NULL);
8908 ASSERT(nai->nai_mmap.ami_mapref != NULL);
8909
8910 int err = skmem_arena_mredirect(nai->nai_arena, &nai->nai_mmap, proc, &need_defunct);
8911 VERIFY(err == 0);
8912 // must be TRUE since we don't mmap the arena more than once
8913 VERIFY(need_defunct == TRUE);
8914
8915 nai->nai_flags |= NAIF_REDIRECT;
8916 nai_ret = nai; // return to caller
8917
8918 necp_arena_info_release(nai); // for fd_data
8919 fd_data->stats_arena_active = nai = NULL;
8920 }
8921
8922 #if (DEVELOPMENT || DEBUG)
8923 // make sure this list now contains nothing but redirected/defunct arenas
8924 LIST_FOREACH(nai, &fd_data->stats_arena_list, nai_chain) {
8925 ASSERT(nai->nai_use_count >= 1);
8926 ASSERT(nai->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT));
8927 }
8928 #endif /* (DEVELOPMENT || DEBUG) */
8929
8930 return nai_ret;
8931 }
8932
8933 static void
necp_arena_info_retain(struct necp_arena_info * nai)8934 necp_arena_info_retain(struct necp_arena_info *nai)
8935 {
8936 nai->nai_use_count++;
8937 VERIFY(nai->nai_use_count != 0);
8938 }
8939
8940 static void
necp_arena_info_release(struct necp_arena_info * nai)8941 necp_arena_info_release(struct necp_arena_info *nai)
8942 {
8943 VERIFY(nai->nai_use_count > 0);
8944 if (--nai->nai_use_count == 0) {
8945 necp_arena_info_free(nai);
8946 }
8947 }
8948
8949 static struct necp_arena_info *
necp_arena_info_alloc(void)8950 necp_arena_info_alloc(void)
8951 {
8952 return zalloc_flags(necp_arena_info_zone, Z_WAITOK | Z_ZERO);
8953 }
8954
8955 static void
necp_arena_info_free(struct necp_arena_info * nai)8956 necp_arena_info_free(struct necp_arena_info *nai)
8957 {
8958 VERIFY(nai->nai_chain.le_next == NULL && nai->nai_chain.le_prev == NULL);
8959 VERIFY(nai->nai_use_count == 0);
8960
8961 // NOTE: destroying the arena requires that all outstanding objects
8962 // that were allocated have been freed, else it will assert.
8963 if (nai->nai_arena != NULL) {
8964 skmem_arena_munmap(nai->nai_arena, &nai->nai_mmap);
8965 skmem_arena_release(nai->nai_arena);
8966 OSDecrementAtomic(&necp_arena_count);
8967 nai->nai_arena = NULL;
8968 nai->nai_roff = 0;
8969 }
8970
8971 ASSERT(nai->nai_arena == NULL);
8972 ASSERT(nai->nai_mmap.ami_mapref == NULL);
8973 ASSERT(nai->nai_mmap.ami_arena == NULL);
8974 ASSERT(nai->nai_mmap.ami_maptask == TASK_NULL);
8975
8976 zfree(necp_arena_info_zone, nai);
8977 }
8978
8979 static int
necp_arena_create(struct necp_fd_data * fd_data,size_t obj_size,size_t obj_cnt,struct proc * p)8980 necp_arena_create(struct necp_fd_data *fd_data, size_t obj_size, size_t obj_cnt, struct proc *p)
8981 {
8982 struct skmem_region_params srp_ustats = {};
8983 struct skmem_region_params srp_kstats = {};
8984 struct necp_arena_info *nai;
8985 char name[32];
8986 int error = 0;
8987
8988 NECP_FD_ASSERT_LOCKED(fd_data);
8989 ASSERT(fd_data->stats_arena_active == NULL);
8990 ASSERT(p != PROC_NULL);
8991 ASSERT(proc_pid(p) == fd_data->proc_pid);
8992
8993 // inherit the default parameters for the stats region
8994 srp_ustats = *skmem_get_default(SKMEM_REGION_USTATS);
8995 srp_kstats = *skmem_get_default(SKMEM_REGION_KSTATS);
8996
8997 // enable multi-segment mode
8998 srp_ustats.srp_cflags &= ~SKMEM_REGION_CR_MONOLITHIC;
8999 srp_kstats.srp_cflags &= ~SKMEM_REGION_CR_MONOLITHIC;
9000
9001 // configure and adjust the region parameters
9002 srp_ustats.srp_r_obj_cnt = srp_kstats.srp_r_obj_cnt = obj_cnt;
9003 srp_ustats.srp_r_obj_size = srp_kstats.srp_r_obj_size = obj_size;
9004 skmem_region_params_config(&srp_ustats);
9005 skmem_region_params_config(&srp_kstats);
9006
9007 nai = necp_arena_info_alloc();
9008
9009 nai->nai_proc_pid = fd_data->proc_pid;
9010 (void) snprintf(name, sizeof(name), "stats-%u.%s.%d", fd_data->stats_arena_gencnt, proc_name_address(p), fd_data->proc_pid);
9011 nai->nai_arena = skmem_arena_create_for_necp(name, &srp_ustats, &srp_kstats, &error);
9012 ASSERT(nai->nai_arena != NULL || error != 0);
9013 if (error != 0) {
9014 NECPLOG(LOG_ERR, "failed to create stats arena for pid %d\n", fd_data->proc_pid);
9015 } else {
9016 OSIncrementAtomic(&necp_arena_count);
9017
9018 // Get region offsets from base of mmap span; the arena
9019 // doesn't need to be mmap'd at this point, since we simply
9020 // compute the relative offset.
9021 nai->nai_roff = skmem_arena_get_region_offset(nai->nai_arena, SKMEM_REGION_USTATS);
9022
9023 // map to the task/process; upon success, the base address of the region
9024 // will be returned in nai_mmap.ami_mapaddr; this can be communicated to
9025 // the process.
9026 error = skmem_arena_mmap(nai->nai_arena, p, &nai->nai_mmap);
9027 if (error != 0) {
9028 NECPLOG(LOG_ERR, "failed to map stats arena for pid %d\n", fd_data->proc_pid);
9029 }
9030 }
9031
9032 if (error == 0) {
9033 fd_data->stats_arena_active = nai;
9034 necp_arena_info_retain(nai); // for fd_data
9035 necp_fd_insert_stats_arena(fd_data, nai);
9036 ++fd_data->stats_arena_gencnt;
9037 } else {
9038 necp_arena_info_free(nai);
9039 }
9040
9041 return error;
9042 }
9043
9044 static int
necp_arena_stats_obj_alloc(struct necp_fd_data * fd_data,mach_vm_offset_t * off,struct necp_arena_info ** stats_arena,void ** kstats_kaddr,boolean_t cansleep)9045 necp_arena_stats_obj_alloc(struct necp_fd_data *fd_data,
9046 mach_vm_offset_t *off,
9047 struct necp_arena_info **stats_arena,
9048 void **kstats_kaddr,
9049 boolean_t cansleep)
9050 {
9051 struct skmem_cache *kstats_cp = NULL;
9052 void *ustats_obj = NULL;
9053 void *kstats_obj = NULL;
9054 struct necp_all_kstats *kstats = NULL;
9055 struct skmem_obj_info kstats_oi = {};
9056
9057 ASSERT(off != NULL);
9058 ASSERT(stats_arena != NULL && *stats_arena == NULL);
9059 ASSERT(kstats_kaddr != NULL && *kstats_kaddr == NULL);
9060
9061 NECP_FD_ASSERT_LOCKED(fd_data);
9062 ASSERT(fd_data->stats_arena_active != NULL);
9063 ASSERT(fd_data->stats_arena_active->nai_arena != NULL);
9064
9065 kstats_cp = skmem_arena_necp(fd_data->stats_arena_active->nai_arena)->arc_kstats_cache;
9066 if ((kstats_obj = skmem_cache_alloc(kstats_cp, (cansleep ? SKMEM_SLEEP : SKMEM_NOSLEEP))) == NULL) {
9067 return ENOMEM;
9068 }
9069
9070 kstats = (struct necp_all_kstats*)kstats_obj;
9071 ustats_obj = kstats->necp_stats_ustats;
9072
9073 skmem_cache_get_obj_info(kstats_cp, kstats_obj, &kstats_oi, NULL);
9074 ASSERT(SKMEM_OBJ_SIZE(&kstats_oi) >= sizeof(struct necp_all_stats));
9075 // reset all stats counters
9076 bzero(ustats_obj, SKMEM_OBJ_SIZE(&kstats_oi));
9077 bzero(&kstats->necp_stats_comm, sizeof(struct necp_all_stats));
9078 *stats_arena = fd_data->stats_arena_active;
9079 *kstats_kaddr = kstats_obj;
9080 // kstats and ustats are mirrored and have the same offset
9081 *off = fd_data->stats_arena_active->nai_roff + SKMEM_OBJ_ROFF(&kstats_oi);
9082
9083 return 0;
9084 }
9085
9086 static void
necp_arena_stats_obj_free(struct necp_fd_data * fd_data,struct necp_arena_info * stats_arena,void ** kstats_kaddr,mach_vm_address_t * ustats_uaddr)9087 necp_arena_stats_obj_free(struct necp_fd_data *fd_data, struct necp_arena_info *stats_arena, void **kstats_kaddr, mach_vm_address_t *ustats_uaddr)
9088 {
9089 #pragma unused(fd_data)
9090 NECP_FD_ASSERT_LOCKED(fd_data);
9091
9092 ASSERT(stats_arena != NULL);
9093 ASSERT(stats_arena->nai_arena != NULL);
9094 ASSERT(kstats_kaddr != NULL && *kstats_kaddr != NULL);
9095 ASSERT(ustats_uaddr != NULL);
9096
9097 skmem_cache_free(skmem_arena_necp(stats_arena->nai_arena)->arc_kstats_cache, *kstats_kaddr);
9098 *kstats_kaddr = NULL;
9099 *ustats_uaddr = 0;
9100 }
9101
9102 // This routine returns the KVA of the sysctls object, as well as the
9103 // offset of that object relative to the mmap base address for the
9104 // task/process.
9105 static void *
necp_arena_sysctls_obj(struct necp_fd_data * fd_data,mach_vm_offset_t * off,size_t * size)9106 necp_arena_sysctls_obj(struct necp_fd_data *fd_data, mach_vm_offset_t *off, size_t *size)
9107 {
9108 void *objaddr;
9109
9110 NECP_FD_ASSERT_LOCKED(fd_data);
9111 ASSERT(fd_data->sysctl_arena != NULL);
9112
9113 // kernel virtual address of the sysctls object
9114 objaddr = skmem_arena_system_sysctls_obj_addr(fd_data->sysctl_arena);
9115 ASSERT(objaddr != NULL);
9116
9117 // Return the relative offset of the sysctls object; there is
9118 // only 1 object in the entire sysctls region, and therefore the
9119 // object's offset is simply the region's offset in the arena.
9120 // (sysctl_mmap.ami_mapaddr + offset) is the address of this object
9121 // in the task/process.
9122 if (off != NULL) {
9123 *off = fd_data->system_sysctls_roff;
9124 }
9125
9126 if (size != NULL) {
9127 *size = skmem_arena_system_sysctls_obj_size(fd_data->sysctl_arena);
9128 ASSERT(*size != 0);
9129 }
9130
9131 return objaddr;
9132 }
9133
9134 static void
necp_stats_arenas_destroy(struct necp_fd_data * fd_data,boolean_t closing)9135 necp_stats_arenas_destroy(struct necp_fd_data *fd_data, boolean_t closing)
9136 {
9137 struct necp_arena_info *nai, *nai_tmp;
9138
9139 NECP_FD_ASSERT_LOCKED(fd_data);
9140
9141 // If reaping (not closing), release reference only for idle active arena; the reference
9142 // count must be 2 by now, when it's not being referred to by any clients/flows.
9143 if ((nai = fd_data->stats_arena_active) != NULL && (closing || nai->nai_use_count == 2)) {
9144 VERIFY(nai->nai_use_count >= 2);
9145 necp_arena_info_release(nai); // for fd_data
9146 fd_data->stats_arena_active = NULL;
9147 }
9148
9149 // clean up any defunct arenas left in the list
9150 LIST_FOREACH_SAFE(nai, &fd_data->stats_arena_list, nai_chain, nai_tmp) {
9151 // If reaping, release reference if the list holds the last one
9152 if (closing || nai->nai_use_count == 1) {
9153 VERIFY(nai->nai_use_count >= 1);
9154 // callee unchains nai (and may free it)
9155 necp_fd_remove_stats_arena(fd_data, nai);
9156 }
9157 }
9158 }
9159
9160 static void
necp_sysctl_arena_destroy(struct necp_fd_data * fd_data)9161 necp_sysctl_arena_destroy(struct necp_fd_data *fd_data)
9162 {
9163 NECP_FD_ASSERT_LOCKED(fd_data);
9164
9165 // NOTE: destroying the arena requires that all outstanding objects
9166 // that were allocated have been freed, else it will assert.
9167 if (fd_data->sysctl_arena != NULL) {
9168 skmem_arena_munmap(fd_data->sysctl_arena, &fd_data->sysctl_mmap);
9169 skmem_arena_release(fd_data->sysctl_arena);
9170 OSDecrementAtomic(&necp_sysctl_arena_count);
9171 fd_data->sysctl_arena = NULL;
9172 fd_data->system_sysctls_roff = 0;
9173 }
9174 }
9175
9176 static int
necp_arena_initialize(struct necp_fd_data * fd_data,bool locked)9177 necp_arena_initialize(struct necp_fd_data *fd_data, bool locked)
9178 {
9179 int error = 0;
9180 size_t stats_obj_size = MAX(sizeof(struct necp_all_stats), sizeof(struct necp_all_kstats));
9181
9182 if (!locked) {
9183 NECP_FD_LOCK(fd_data);
9184 }
9185 if (fd_data->stats_arena_active == NULL) {
9186 error = necp_arena_create(fd_data, stats_obj_size,
9187 NECP_MAX_PER_PROCESS_CLIENT_STATISTICS_STRUCTS,
9188 current_proc());
9189 }
9190 if (!locked) {
9191 NECP_FD_UNLOCK(fd_data);
9192 }
9193
9194 return error;
9195 }
9196
9197 static int
necp_sysctl_arena_initialize(struct necp_fd_data * fd_data,bool locked)9198 necp_sysctl_arena_initialize(struct necp_fd_data *fd_data, bool locked)
9199 {
9200 int error = 0;
9201
9202 if (!locked) {
9203 NECP_FD_LOCK(fd_data);
9204 }
9205
9206 NECP_FD_ASSERT_LOCKED(fd_data);
9207
9208 if (fd_data->sysctl_arena == NULL) {
9209 char name[32];
9210 struct proc *p = current_proc();
9211
9212 ASSERT(p != PROC_NULL);
9213 ASSERT(proc_pid(p) == fd_data->proc_pid);
9214
9215 (void) snprintf(name, sizeof(name), "sysctl.%s.%d", proc_name_address(p), fd_data->proc_pid);
9216 fd_data->sysctl_arena = skmem_arena_create_for_system(name, &error);
9217 ASSERT(fd_data->sysctl_arena != NULL || error != 0);
9218 if (error != 0) {
9219 NECPLOG(LOG_ERR, "failed to create arena for pid %d\n", fd_data->proc_pid);
9220 } else {
9221 OSIncrementAtomic(&necp_sysctl_arena_count);
9222
9223 // Get region offsets from base of mmap span; the arena
9224 // doesn't need to be mmap'd at this point, since we simply
9225 // compute the relative offset.
9226 fd_data->system_sysctls_roff = skmem_arena_get_region_offset(fd_data->sysctl_arena, SKMEM_REGION_SYSCTLS);
9227
9228 // map to the task/process; upon success, the base address of the region
9229 // will be returned in nai_mmap.ami_mapaddr; this can be communicated to
9230 // the process.
9231 error = skmem_arena_mmap(fd_data->sysctl_arena, p, &fd_data->sysctl_mmap);
9232 if (error != 0) {
9233 NECPLOG(LOG_ERR, "failed to map sysctl arena for pid %d\n", fd_data->proc_pid);
9234 necp_sysctl_arena_destroy(fd_data);
9235 }
9236 }
9237 }
9238
9239 if (!locked) {
9240 NECP_FD_UNLOCK(fd_data);
9241 }
9242
9243 return error;
9244 }
9245
9246 static int
necp_client_stats_bufreq(struct necp_fd_data * fd_data,struct necp_client * client,struct necp_client_flow_registration * flow_registration,struct necp_stats_bufreq * bufreq,struct necp_stats_hdr * out_header)9247 necp_client_stats_bufreq(struct necp_fd_data *fd_data,
9248 struct necp_client *client,
9249 struct necp_client_flow_registration *flow_registration,
9250 struct necp_stats_bufreq *bufreq,
9251 struct necp_stats_hdr *out_header)
9252 {
9253 int error = 0;
9254 NECP_CLIENT_ASSERT_LOCKED(client);
9255 NECP_FD_ASSERT_LOCKED(fd_data);
9256
9257 if ((bufreq->necp_stats_bufreq_id == NECP_CLIENT_STATISTICS_BUFREQ_ID) &&
9258 ((bufreq->necp_stats_bufreq_type == NECP_CLIENT_STATISTICS_TYPE_TCP &&
9259 bufreq->necp_stats_bufreq_ver == NECP_CLIENT_STATISTICS_TYPE_TCP_CURRENT_VER) ||
9260 (bufreq->necp_stats_bufreq_type == NECP_CLIENT_STATISTICS_TYPE_UDP &&
9261 bufreq->necp_stats_bufreq_ver == NECP_CLIENT_STATISTICS_TYPE_UDP_CURRENT_VER) ||
9262 (bufreq->necp_stats_bufreq_type == NECP_CLIENT_STATISTICS_TYPE_QUIC &&
9263 bufreq->necp_stats_bufreq_ver == NECP_CLIENT_STATISTICS_TYPE_QUIC_CURRENT_VER)) &&
9264 (bufreq->necp_stats_bufreq_size == sizeof(struct necp_all_stats))) {
9265 // There should be one and only one stats allocation per client.
9266 // If asked more than once, we just repeat ourselves.
9267 if (flow_registration->ustats_uaddr == 0) {
9268 mach_vm_offset_t off;
9269 ASSERT(flow_registration->stats_arena == NULL);
9270 ASSERT(flow_registration->kstats_kaddr == NULL);
9271 ASSERT(flow_registration->ustats_uaddr == 0);
9272 error = necp_arena_stats_obj_alloc(fd_data, &off, &flow_registration->stats_arena, &flow_registration->kstats_kaddr, FALSE);
9273 if (error == 0) {
9274 // upon success, hold a reference for the client; this is released when the client is removed/closed
9275 ASSERT(flow_registration->stats_arena != NULL);
9276 necp_arena_info_retain(flow_registration->stats_arena);
9277
9278 // compute user address based on mapping info and object offset
9279 flow_registration->ustats_uaddr = flow_registration->stats_arena->nai_mmap.ami_mapaddr + off;
9280
9281 // add to collect_stats list
9282 NECP_STATS_LIST_LOCK_EXCLUSIVE();
9283 necp_client_retain_locked(client); // Add a reference to the client
9284 LIST_INSERT_HEAD(&necp_collect_stats_flow_list, flow_registration, collect_stats_chain);
9285 NECP_STATS_LIST_UNLOCK();
9286 necp_schedule_collect_stats_clients(FALSE);
9287 } else {
9288 ASSERT(flow_registration->stats_arena == NULL);
9289 ASSERT(flow_registration->kstats_kaddr == NULL);
9290 }
9291 }
9292 if (flow_registration->ustats_uaddr != 0) {
9293 ASSERT(error == 0);
9294 ASSERT(flow_registration->stats_arena != NULL);
9295 ASSERT(flow_registration->kstats_kaddr != NULL);
9296
9297 struct necp_all_kstats *kstats = (struct necp_all_kstats *)flow_registration->kstats_kaddr;
9298 kstats->necp_stats_ustats->all_stats_u.tcp_stats.necp_tcp_hdr.necp_stats_type = bufreq->necp_stats_bufreq_type;
9299 kstats->necp_stats_ustats->all_stats_u.tcp_stats.necp_tcp_hdr.necp_stats_ver = bufreq->necp_stats_bufreq_ver;
9300
9301 if (out_header) {
9302 out_header->necp_stats_type = bufreq->necp_stats_bufreq_type;
9303 out_header->necp_stats_ver = bufreq->necp_stats_bufreq_ver;
9304 }
9305
9306 bufreq->necp_stats_bufreq_uaddr = flow_registration->ustats_uaddr;
9307 }
9308 } else {
9309 error = EINVAL;
9310 }
9311
9312 return error;
9313 }
9314
9315 static int
necp_client_stats_initial(struct necp_client_flow_registration * flow_registration,uint32_t stats_type,uint32_t stats_ver)9316 necp_client_stats_initial(struct necp_client_flow_registration *flow_registration, uint32_t stats_type, uint32_t stats_ver)
9317 {
9318 // An attempted create
9319 assert(flow_registration->stats_handler_context == NULL);
9320 assert(flow_registration->stats_arena);
9321 assert(flow_registration->ustats_uaddr);
9322 assert(flow_registration->kstats_kaddr);
9323
9324 int error = 0;
9325
9326 switch (stats_type) {
9327 case NECP_CLIENT_STATISTICS_TYPE_TCP: {
9328 if (stats_ver == NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1) {
9329 flow_registration->stats_handler_context = ntstat_userland_stats_open((userland_stats_provider_context *)flow_registration,
9330 NSTAT_PROVIDER_TCP_USERLAND, 0, necp_request_tcp_netstats, necp_find_extension_info);
9331 if (flow_registration->stats_handler_context == NULL) {
9332 error = EIO;
9333 }
9334 } else {
9335 error = ENOTSUP;
9336 }
9337 break;
9338 }
9339 case NECP_CLIENT_STATISTICS_TYPE_UDP: {
9340 if (stats_ver == NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1) {
9341 flow_registration->stats_handler_context = ntstat_userland_stats_open((userland_stats_provider_context *)flow_registration,
9342 NSTAT_PROVIDER_UDP_USERLAND, 0, necp_request_udp_netstats, necp_find_extension_info);
9343 if (flow_registration->stats_handler_context == NULL) {
9344 error = EIO;
9345 }
9346 } else {
9347 error = ENOTSUP;
9348 }
9349 break;
9350 }
9351 case NECP_CLIENT_STATISTICS_TYPE_QUIC: {
9352 if (stats_ver == NECP_CLIENT_STATISTICS_TYPE_QUIC_VER_1 && flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS) {
9353 flow_registration->stats_handler_context = ntstat_userland_stats_open((userland_stats_provider_context *)flow_registration,
9354 NSTAT_PROVIDER_QUIC_USERLAND, 0, necp_request_quic_netstats, necp_find_extension_info);
9355 if (flow_registration->stats_handler_context == NULL) {
9356 error = EIO;
9357 }
9358 } else {
9359 error = ENOTSUP;
9360 }
9361 break;
9362 }
9363 default: {
9364 error = ENOTSUP;
9365 break;
9366 }
9367 }
9368 return error;
9369 }
9370
9371 static int
necp_stats_initialize(struct necp_fd_data * fd_data,struct necp_client * client,struct necp_client_flow_registration * flow_registration,struct necp_stats_bufreq * bufreq)9372 necp_stats_initialize(struct necp_fd_data *fd_data,
9373 struct necp_client *client,
9374 struct necp_client_flow_registration *flow_registration,
9375 struct necp_stats_bufreq *bufreq)
9376 {
9377 int error = 0;
9378 struct necp_stats_hdr stats_hdr = {};
9379
9380 NECP_CLIENT_ASSERT_LOCKED(client);
9381 NECP_FD_ASSERT_LOCKED(fd_data);
9382 VERIFY(fd_data->stats_arena_active != NULL);
9383 VERIFY(fd_data->stats_arena_active->nai_arena != NULL);
9384 VERIFY(!(fd_data->stats_arena_active->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT)));
9385
9386 if (bufreq == NULL) {
9387 return EINVAL;
9388 }
9389
9390 // Setup stats region
9391 error = necp_client_stats_bufreq(fd_data, client, flow_registration, bufreq, &stats_hdr);
9392 if (error) {
9393 return error;
9394 }
9395 // Notify ntstat about new flow
9396 if (flow_registration->stats_handler_context == NULL) {
9397 error = necp_client_stats_initial(flow_registration, stats_hdr.necp_stats_type, stats_hdr.necp_stats_ver);
9398 if (flow_registration->stats_handler_context != NULL) {
9399 ntstat_userland_stats_event(flow_registration->stats_handler_context, NECP_CLIENT_STATISTICS_EVENT_INIT);
9400 }
9401 NECP_CLIENT_FLOW_LOG(client, flow_registration, "Initialized stats <error %d>", error);
9402 }
9403
9404 return error;
9405 }
9406
9407 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_map_sysctls(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9408 necp_client_map_sysctls(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9409 {
9410 int result = 0;
9411 if (!retval) {
9412 retval = &result;
9413 }
9414
9415 do {
9416 mach_vm_address_t uaddr = 0;
9417 if (uap->buffer_size != sizeof(uaddr)) {
9418 *retval = EINVAL;
9419 break;
9420 }
9421
9422 *retval = necp_sysctl_arena_initialize(fd_data, false);
9423 if (*retval != 0) {
9424 break;
9425 }
9426
9427 mach_vm_offset_t off = 0;
9428 void *location = NULL;
9429 NECP_FD_LOCK(fd_data);
9430 location = necp_arena_sysctls_obj(fd_data, &off, NULL);
9431 NECP_FD_UNLOCK(fd_data);
9432
9433 if (location == NULL) {
9434 *retval = ENOENT;
9435 break;
9436 }
9437
9438 uaddr = fd_data->sysctl_mmap.ami_mapaddr + off;
9439 *retval = copyout(&uaddr, uap->buffer, sizeof(uaddr));
9440 } while (false);
9441
9442 return *retval;
9443 }
9444
9445 #endif /* !SKYWALK */
9446
9447 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_route_statistics(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9448 necp_client_copy_route_statistics(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9449 {
9450 int error = 0;
9451 struct necp_client *client = NULL;
9452 uuid_t client_id;
9453
9454 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
9455 uap->buffer_size < sizeof(struct necp_stat_counts) || uap->buffer == 0) {
9456 NECPLOG0(LOG_ERR, "necp_client_copy_route_statistics bad input");
9457 error = EINVAL;
9458 goto done;
9459 }
9460
9461 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
9462 if (error) {
9463 NECPLOG(LOG_ERR, "necp_client_copy_route_statistics copyin client_id error (%d)", error);
9464 goto done;
9465 }
9466
9467 // Lock
9468 NECP_FD_LOCK(fd_data);
9469 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
9470 if (client != NULL) {
9471 NECP_CLIENT_ROUTE_LOCK(client);
9472 struct necp_stat_counts route_stats = {};
9473 if (client->current_route != NULL && client->current_route->rt_stats != NULL) {
9474 struct nstat_counts *rt_stats = client->current_route->rt_stats;
9475 atomic_get_64(route_stats.necp_stat_rxpackets, &rt_stats->nstat_rxpackets);
9476 atomic_get_64(route_stats.necp_stat_rxbytes, &rt_stats->nstat_rxbytes);
9477 atomic_get_64(route_stats.necp_stat_txpackets, &rt_stats->nstat_txpackets);
9478 atomic_get_64(route_stats.necp_stat_txbytes, &rt_stats->nstat_txbytes);
9479 route_stats.necp_stat_rxduplicatebytes = rt_stats->nstat_rxduplicatebytes;
9480 route_stats.necp_stat_rxoutoforderbytes = rt_stats->nstat_rxoutoforderbytes;
9481 route_stats.necp_stat_txretransmit = rt_stats->nstat_txretransmit;
9482 route_stats.necp_stat_connectattempts = rt_stats->nstat_connectattempts;
9483 route_stats.necp_stat_connectsuccesses = rt_stats->nstat_connectsuccesses;
9484 route_stats.necp_stat_min_rtt = rt_stats->nstat_min_rtt;
9485 route_stats.necp_stat_avg_rtt = rt_stats->nstat_avg_rtt;
9486 route_stats.necp_stat_var_rtt = rt_stats->nstat_var_rtt;
9487 route_stats.necp_stat_route_flags = client->current_route->rt_flags;
9488 }
9489
9490 // Unlock before copying out
9491 NECP_CLIENT_ROUTE_UNLOCK(client);
9492 NECP_CLIENT_UNLOCK(client);
9493 NECP_FD_UNLOCK(fd_data);
9494
9495 error = copyout(&route_stats, uap->buffer, sizeof(route_stats));
9496 if (error) {
9497 NECPLOG(LOG_ERR, "necp_client_copy_route_statistics copyout error (%d)", error);
9498 }
9499 } else {
9500 // Unlock
9501 NECP_FD_UNLOCK(fd_data);
9502 error = ENOENT;
9503 }
9504
9505
9506 done:
9507 *retval = error;
9508 return error;
9509 }
9510
9511 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_update_cache(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9512 necp_client_update_cache(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9513 {
9514 int error = 0;
9515 struct necp_client *client = NULL;
9516 uuid_t client_id;
9517
9518 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
9519 error = EINVAL;
9520 goto done;
9521 }
9522
9523 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
9524 if (error) {
9525 NECPLOG(LOG_ERR, "necp_client_update_cache copyin client_id error (%d)", error);
9526 goto done;
9527 }
9528
9529 NECP_FD_LOCK(fd_data);
9530 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
9531 if (client == NULL) {
9532 NECP_FD_UNLOCK(fd_data);
9533 error = ENOENT;
9534 goto done;
9535 }
9536
9537 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
9538 if (flow_registration == NULL) {
9539 NECP_CLIENT_UNLOCK(client);
9540 NECP_FD_UNLOCK(fd_data);
9541 error = ENOENT;
9542 goto done;
9543 }
9544
9545 NECP_CLIENT_ROUTE_LOCK(client);
9546 // This needs to be changed when TFO/ECN is supported by multiple flows
9547 struct necp_client_flow *flow = LIST_FIRST(&flow_registration->flow_list);
9548 if (flow == NULL ||
9549 (flow->remote_addr.sa.sa_family != AF_INET &&
9550 flow->remote_addr.sa.sa_family != AF_INET6) ||
9551 (flow->local_addr.sa.sa_family != AF_INET &&
9552 flow->local_addr.sa.sa_family != AF_INET6)) {
9553 error = EINVAL;
9554 NECPLOG(LOG_ERR, "necp_client_update_cache no flow error (%d)", error);
9555 goto done_unlock;
9556 }
9557
9558 necp_cache_buffer cache_buffer;
9559 memset(&cache_buffer, 0, sizeof(cache_buffer));
9560
9561 if (uap->buffer_size != sizeof(necp_cache_buffer) ||
9562 uap->buffer == USER_ADDR_NULL) {
9563 error = EINVAL;
9564 goto done_unlock;
9565 }
9566
9567 error = copyin(uap->buffer, &cache_buffer, sizeof(cache_buffer));
9568 if (error) {
9569 NECPLOG(LOG_ERR, "necp_client_update_cache copyin cache buffer error (%d)", error);
9570 goto done_unlock;
9571 }
9572
9573 if (cache_buffer.necp_cache_buf_type == NECP_CLIENT_CACHE_TYPE_ECN &&
9574 cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_ECN_VER_1) {
9575 if (cache_buffer.necp_cache_buf_size != sizeof(necp_tcp_ecn_cache) ||
9576 cache_buffer.necp_cache_buf_addr == USER_ADDR_NULL) {
9577 error = EINVAL;
9578 goto done_unlock;
9579 }
9580
9581 necp_tcp_ecn_cache ecn_cache_buffer;
9582 memset(&ecn_cache_buffer, 0, sizeof(ecn_cache_buffer));
9583
9584 error = copyin(cache_buffer.necp_cache_buf_addr, &ecn_cache_buffer, sizeof(necp_tcp_ecn_cache));
9585 if (error) {
9586 NECPLOG(LOG_ERR, "necp_client_update_cache copyin ecn cache buffer error (%d)", error);
9587 goto done_unlock;
9588 }
9589
9590 if (client->current_route != NULL && client->current_route->rt_ifp != NULL) {
9591 if (!client->platform_binary) {
9592 ecn_cache_buffer.necp_tcp_ecn_heuristics_success = 0;
9593 }
9594 tcp_heuristics_ecn_update(&ecn_cache_buffer, client->current_route->rt_ifp,
9595 (union sockaddr_in_4_6 *)&flow->local_addr);
9596 }
9597 } else if (cache_buffer.necp_cache_buf_type == NECP_CLIENT_CACHE_TYPE_TFO &&
9598 cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_TFO_VER_1) {
9599 if (cache_buffer.necp_cache_buf_size != sizeof(necp_tcp_tfo_cache) ||
9600 cache_buffer.necp_cache_buf_addr == USER_ADDR_NULL) {
9601 error = EINVAL;
9602 goto done_unlock;
9603 }
9604
9605 necp_tcp_tfo_cache tfo_cache_buffer;
9606 memset(&tfo_cache_buffer, 0, sizeof(tfo_cache_buffer));
9607
9608 error = copyin(cache_buffer.necp_cache_buf_addr, &tfo_cache_buffer, sizeof(necp_tcp_tfo_cache));
9609 if (error) {
9610 NECPLOG(LOG_ERR, "necp_client_update_cache copyin tfo cache buffer error (%d)", error);
9611 goto done_unlock;
9612 }
9613
9614 if (client->current_route != NULL && client->current_route->rt_ifp != NULL) {
9615 if (!client->platform_binary) {
9616 tfo_cache_buffer.necp_tcp_tfo_heuristics_success = 0;
9617 }
9618 tcp_heuristics_tfo_update(&tfo_cache_buffer, client->current_route->rt_ifp,
9619 (union sockaddr_in_4_6 *)&flow->local_addr,
9620 (union sockaddr_in_4_6 *)&flow->remote_addr);
9621 }
9622 } else {
9623 error = EINVAL;
9624 }
9625 done_unlock:
9626 NECP_CLIENT_ROUTE_UNLOCK(client);
9627 NECP_CLIENT_UNLOCK(client);
9628 NECP_FD_UNLOCK(fd_data);
9629 done:
9630 *retval = error;
9631 return error;
9632 }
9633
9634 #define NECP_CLIENT_ACTION_SIGN_DEFAULT_HOSTNAME_LENGTH 64
9635 #define NECP_CLIENT_ACTION_SIGN_MAX_HOSTNAME_LENGTH 1024
9636
9637 #define NECP_CLIENT_ACTION_SIGN_TAG_LENGTH 32
9638
9639 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_sign(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9640 necp_client_sign(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9641 {
9642 int error = 0;
9643 u_int32_t hostname_length = 0;
9644 u_int8_t tag[NECP_CLIENT_ACTION_SIGN_TAG_LENGTH] = {};
9645 struct necp_client_signable signable = {};
9646 union necp_sockaddr_union address_answer = {};
9647 u_int8_t *client_hostname = NULL;
9648 u_int8_t *allocated_hostname = NULL;
9649 u_int8_t default_hostname[NECP_CLIENT_ACTION_SIGN_DEFAULT_HOSTNAME_LENGTH] = "";
9650 uint32_t tag_size = sizeof(tag);
9651
9652 *retval = 0;
9653
9654 const bool has_resolver_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_VALIDATED_RESOLVER, 0) == 0);
9655 if (!has_resolver_entitlement) {
9656 NECPLOG0(LOG_ERR, "Process does not hold the necessary entitlement to sign resolver answers");
9657 error = EPERM;
9658 goto done;
9659 }
9660
9661 if (uap->client_id == 0 || uap->client_id_len < sizeof(struct necp_client_signable)) {
9662 error = EINVAL;
9663 goto done;
9664 }
9665
9666 if (uap->buffer == 0 || uap->buffer_size != NECP_CLIENT_ACTION_SIGN_TAG_LENGTH) {
9667 error = EINVAL;
9668 goto done;
9669 }
9670
9671 error = copyin(uap->client_id, &signable, sizeof(signable));
9672 if (error) {
9673 NECPLOG(LOG_ERR, "necp_client_sign copyin signable error (%d)", error);
9674 goto done;
9675 }
9676
9677 if (signable.sign_type != NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER) {
9678 NECPLOG(LOG_ERR, "necp_client_sign unknown signable type (%u)", signable.sign_type);
9679 error = EINVAL;
9680 goto done;
9681 }
9682
9683 if (uap->client_id_len < sizeof(struct necp_client_resolver_answer)) {
9684 error = EINVAL;
9685 goto done;
9686 }
9687
9688 error = copyin(uap->client_id + sizeof(signable), &address_answer, sizeof(address_answer));
9689 if (error) {
9690 NECPLOG(LOG_ERR, "necp_client_sign copyin address_answer error (%d)", error);
9691 goto done;
9692 }
9693
9694 error = copyin(uap->client_id + sizeof(signable) + sizeof(address_answer), &hostname_length, sizeof(hostname_length));
9695 if (error) {
9696 NECPLOG(LOG_ERR, "necp_client_sign copyin hostname_length error (%d)", error);
9697 goto done;
9698 }
9699
9700 if (hostname_length > NECP_CLIENT_ACTION_SIGN_MAX_HOSTNAME_LENGTH) {
9701 error = EINVAL;
9702 goto done;
9703 }
9704
9705 if (hostname_length > NECP_CLIENT_ACTION_SIGN_DEFAULT_HOSTNAME_LENGTH) {
9706 if ((allocated_hostname = (u_int8_t *)kalloc_data(hostname_length, Z_WAITOK | Z_ZERO)) == NULL) {
9707 NECPLOG(LOG_ERR, "necp_client_sign malloc hostname %u failed", hostname_length);
9708 error = ENOMEM;
9709 goto done;
9710 }
9711
9712 client_hostname = allocated_hostname;
9713 } else {
9714 client_hostname = default_hostname;
9715 }
9716
9717 error = copyin(uap->client_id + sizeof(signable) + sizeof(address_answer) + sizeof(hostname_length), client_hostname, hostname_length);
9718 if (error) {
9719 NECPLOG(LOG_ERR, "necp_client_sign copyin hostname error (%d)", error);
9720 goto done;
9721 }
9722
9723 address_answer.sin.sin_port = 0;
9724 error = necp_sign_resolver_answer(signable.client_id, client_hostname, hostname_length,
9725 (u_int8_t *)&address_answer, sizeof(address_answer),
9726 tag, &tag_size);
9727 if (tag_size != sizeof(tag)) {
9728 NECPLOG(LOG_ERR, "necp_client_sign unexpected tag size %u", tag_size);
9729 error = EINVAL;
9730 goto done;
9731 }
9732 error = copyout(tag, uap->buffer, tag_size);
9733 if (error) {
9734 NECPLOG(LOG_ERR, "necp_client_sign copyout error (%d)", error);
9735 goto done;
9736 }
9737
9738 done:
9739 if (allocated_hostname != NULL) {
9740 kfree_data(allocated_hostname, hostname_length);
9741 allocated_hostname = NULL;
9742 }
9743 *retval = error;
9744 return error;
9745 }
9746
9747 int
necp_client_action(struct proc * p,struct necp_client_action_args * uap,int * retval)9748 necp_client_action(struct proc *p, struct necp_client_action_args *uap, int *retval)
9749 {
9750 struct fileproc *fp;
9751 int error = 0;
9752 int return_value = 0;
9753 struct necp_fd_data *fd_data = NULL;
9754
9755 error = necp_find_fd_data(p, uap->necp_fd, &fp, &fd_data);
9756 if (error != 0) {
9757 NECPLOG(LOG_ERR, "necp_client_action find fd error (%d)", error);
9758 return error;
9759 }
9760
9761 u_int32_t action = uap->action;
9762
9763 #if CONFIG_MACF
9764 error = mac_necp_check_client_action(p, fp->fp_glob, action);
9765 if (error) {
9766 return_value = error;
9767 goto done;
9768 }
9769 #endif /* MACF */
9770
9771 switch (action) {
9772 case NECP_CLIENT_ACTION_ADD: {
9773 return_value = necp_client_add(p, fd_data, uap, retval);
9774 break;
9775 }
9776 case NECP_CLIENT_ACTION_CLAIM: {
9777 return_value = necp_client_claim(p, fd_data, uap, retval);
9778 break;
9779 }
9780 case NECP_CLIENT_ACTION_REMOVE: {
9781 return_value = necp_client_remove(fd_data, uap, retval);
9782 break;
9783 }
9784 case NECP_CLIENT_ACTION_COPY_PARAMETERS:
9785 case NECP_CLIENT_ACTION_COPY_RESULT:
9786 case NECP_CLIENT_ACTION_COPY_UPDATED_RESULT: {
9787 return_value = necp_client_copy(fd_data, uap, retval);
9788 break;
9789 }
9790 case NECP_CLIENT_ACTION_COPY_LIST: {
9791 return_value = necp_client_list(fd_data, uap, retval);
9792 break;
9793 }
9794 case NECP_CLIENT_ACTION_ADD_FLOW: {
9795 return_value = necp_client_add_flow(fd_data, uap, retval);
9796 break;
9797 }
9798 case NECP_CLIENT_ACTION_REMOVE_FLOW: {
9799 return_value = necp_client_remove_flow(fd_data, uap, retval);
9800 break;
9801 }
9802 #if SKYWALK
9803 case NECP_CLIENT_ACTION_REQUEST_NEXUS_INSTANCE: {
9804 return_value = necp_client_request_nexus(fd_data, uap, retval);
9805 break;
9806 }
9807 #endif /* !SKYWALK */
9808 case NECP_CLIENT_ACTION_AGENT: {
9809 return_value = necp_client_agent_action(fd_data, uap, retval);
9810 break;
9811 }
9812 case NECP_CLIENT_ACTION_COPY_AGENT: {
9813 return_value = necp_client_copy_agent(fd_data, uap, retval);
9814 break;
9815 }
9816 case NECP_CLIENT_ACTION_AGENT_USE: {
9817 return_value = necp_client_agent_use(fd_data, uap, retval);
9818 break;
9819 }
9820 case NECP_CLIENT_ACTION_ACQUIRE_AGENT_TOKEN: {
9821 return_value = necp_client_acquire_agent_token(fd_data, uap, retval);
9822 break;
9823 }
9824 case NECP_CLIENT_ACTION_COPY_INTERFACE: {
9825 return_value = necp_client_copy_interface(fd_data, uap, retval);
9826 break;
9827 }
9828 #if SKYWALK
9829 case NECP_CLIENT_ACTION_GET_INTERFACE_ADDRESS: {
9830 return_value = necp_client_get_interface_address(fd_data, uap, retval);
9831 break;
9832 }
9833 case NECP_CLIENT_ACTION_SET_STATISTICS: {
9834 return_value = ENOTSUP;
9835 break;
9836 }
9837 case NECP_CLIENT_ACTION_MAP_SYSCTLS: {
9838 return_value = necp_client_map_sysctls(fd_data, uap, retval);
9839 break;
9840 }
9841 #endif /* !SKYWALK */
9842 case NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS: {
9843 return_value = necp_client_copy_route_statistics(fd_data, uap, retval);
9844 break;
9845 }
9846 case NECP_CLIENT_ACTION_UPDATE_CACHE: {
9847 return_value = necp_client_update_cache(fd_data, uap, retval);
9848 break;
9849 }
9850 case NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE: {
9851 return_value = necp_client_copy_client_update(fd_data, uap, retval);
9852 break;
9853 }
9854 case NECP_CLIENT_ACTION_SIGN: {
9855 return_value = necp_client_sign(fd_data, uap, retval);
9856 break;
9857 }
9858 default: {
9859 NECPLOG(LOG_ERR, "necp_client_action unknown action (%u)", action);
9860 return_value = EINVAL;
9861 break;
9862 }
9863 }
9864
9865 done:
9866 fp_drop(p, uap->necp_fd, fp, 0);
9867 return return_value;
9868 }
9869
9870 #define NECP_MAX_MATCH_POLICY_PARAMETER_SIZE 1024
9871
9872 int
necp_match_policy(struct proc * p,struct necp_match_policy_args * uap,int32_t * retval)9873 necp_match_policy(struct proc *p, struct necp_match_policy_args *uap, int32_t *retval)
9874 {
9875 #pragma unused(retval)
9876 u_int8_t *parameters = NULL;
9877 struct necp_aggregate_result returned_result;
9878 int error = 0;
9879
9880 if (uap == NULL) {
9881 error = EINVAL;
9882 goto done;
9883 }
9884
9885 if (uap->parameters == 0 || uap->parameters_size == 0 || uap->parameters_size > NECP_MAX_MATCH_POLICY_PARAMETER_SIZE || uap->returned_result == 0) {
9886 error = EINVAL;
9887 goto done;
9888 }
9889
9890 parameters = (u_int8_t *)kalloc_data(uap->parameters_size, Z_WAITOK | Z_ZERO);
9891 if (parameters == NULL) {
9892 error = ENOMEM;
9893 goto done;
9894 }
9895 // Copy parameters in
9896 error = copyin(uap->parameters, parameters, uap->parameters_size);
9897 if (error) {
9898 goto done;
9899 }
9900
9901 error = necp_application_find_policy_match_internal(p, parameters, uap->parameters_size,
9902 &returned_result, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL, false, false, NULL);
9903 if (error) {
9904 goto done;
9905 }
9906
9907 // Copy return value back
9908 error = copyout(&returned_result, uap->returned_result, sizeof(struct necp_aggregate_result));
9909 if (error) {
9910 goto done;
9911 }
9912 done:
9913 if (parameters != NULL) {
9914 kfree_data(parameters, uap->parameters_size);
9915 }
9916 return error;
9917 }
9918
9919 /// Socket operations
9920
9921 static errno_t
necp_set_socket_attribute(u_int8_t * buffer,size_t buffer_length,u_int8_t type,char ** buffer_p,bool * single_tlv)9922 necp_set_socket_attribute(u_int8_t *buffer, size_t buffer_length, u_int8_t type, char **buffer_p, bool *single_tlv)
9923 {
9924 int error = 0;
9925 int cursor = 0;
9926 size_t string_size = 0;
9927 char *local_string = NULL;
9928 u_int8_t *value = NULL;
9929 char *buffer_to_free = NULL;
9930
9931 cursor = necp_buffer_find_tlv(buffer, buffer_length, 0, type, NULL, 0);
9932 if (cursor < 0) {
9933 // This will clear out the parameter
9934 goto done;
9935 }
9936
9937 string_size = necp_buffer_get_tlv_length(buffer, cursor);
9938 if (single_tlv != NULL && (buffer_length == sizeof(struct necp_tlv_header) + string_size)) {
9939 *single_tlv = true;
9940 }
9941 if (string_size == 0 || string_size > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) {
9942 // This will clear out the parameter
9943 goto done;
9944 }
9945
9946 local_string = (char *)kalloc_data(string_size + 1, Z_WAITOK | Z_ZERO);
9947 if (local_string == NULL) {
9948 NECPLOG(LOG_ERR, "Failed to allocate a socket attribute buffer (size %zu)", string_size);
9949 goto fail;
9950 }
9951
9952 value = necp_buffer_get_tlv_value(buffer, cursor, NULL);
9953 if (value == NULL) {
9954 NECPLOG0(LOG_ERR, "Failed to get socket attribute");
9955 goto fail;
9956 }
9957
9958 memcpy(local_string, value, string_size);
9959 local_string[string_size] = 0;
9960
9961 done:
9962 buffer_to_free = *buffer_p;
9963
9964 // Protect switching of buffer pointer
9965 necp_lock_socket_attributes();
9966 *buffer_p = local_string;
9967 necp_unlock_socket_attributes();
9968
9969 if (buffer_to_free != NULL) {
9970 kfree_data_addr(buffer_to_free);
9971 }
9972 return 0;
9973 fail:
9974 if (local_string != NULL) {
9975 kfree_data(local_string, string_size + 1);
9976 }
9977 return error;
9978 }
9979
9980 errno_t
necp_set_socket_attributes(struct inp_necp_attributes * attributes,struct sockopt * sopt)9981 necp_set_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt)
9982 {
9983 int error = 0;
9984 u_int8_t *buffer = NULL;
9985 bool single_tlv = false;
9986 size_t valsize = sopt->sopt_valsize;
9987 if (valsize == 0 ||
9988 valsize > ((sizeof(struct necp_tlv_header) + NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) * 4)) {
9989 goto done;
9990 }
9991
9992 buffer = (u_int8_t *)kalloc_data(valsize, Z_WAITOK | Z_ZERO);
9993 if (buffer == NULL) {
9994 goto done;
9995 }
9996
9997 error = sooptcopyin(sopt, buffer, valsize, 0);
9998 if (error) {
9999 goto done;
10000 }
10001
10002 // If NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT is being set/cleared separately from the other attributes,
10003 // do not clear other attributes.
10004 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT, &attributes->inp_domain_context, &single_tlv);
10005 if (error) {
10006 NECPLOG0(LOG_ERR, "Could not set domain context TLV for socket attributes");
10007 goto done;
10008 }
10009 if (single_tlv == true) {
10010 goto done;
10011 }
10012
10013 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN, &attributes->inp_domain, NULL);
10014 if (error) {
10015 NECPLOG0(LOG_ERR, "Could not set domain TLV for socket attributes");
10016 goto done;
10017 }
10018
10019 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN_OWNER, &attributes->inp_domain_owner, NULL);
10020 if (error) {
10021 NECPLOG0(LOG_ERR, "Could not set domain owner TLV for socket attributes");
10022 goto done;
10023 }
10024
10025 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_TRACKER_DOMAIN, &attributes->inp_tracker_domain, NULL);
10026 if (error) {
10027 NECPLOG0(LOG_ERR, "Could not set tracker domain TLV for socket attributes");
10028 goto done;
10029 }
10030
10031 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_ACCOUNT, &attributes->inp_account, NULL);
10032 if (error) {
10033 NECPLOG0(LOG_ERR, "Could not set account TLV for socket attributes");
10034 goto done;
10035 }
10036
10037 done:
10038 NECP_SOCKET_ATTRIBUTE_LOG("NECP ATTRIBUTES SOCKET - domain <%s> owner <%s> context <%s> tracker domain <%s> account <%s>",
10039 attributes->inp_domain,
10040 attributes->inp_domain_owner,
10041 attributes->inp_domain_context,
10042 attributes->inp_tracker_domain,
10043 attributes->inp_account);
10044
10045 if (necp_debug) {
10046 NECPLOG(LOG_DEBUG, "Set on socket: Domain %s, Domain owner %s, Domain context %s, Tracker domain %s, Account %s",
10047 attributes->inp_domain,
10048 attributes->inp_domain_owner,
10049 attributes->inp_domain_context,
10050 attributes->inp_tracker_domain,
10051 attributes->inp_account);
10052 }
10053
10054 if (buffer != NULL) {
10055 kfree_data(buffer, valsize);
10056 }
10057
10058 return error;
10059 }
10060
10061 errno_t
necp_get_socket_attributes(struct inp_necp_attributes * attributes,struct sockopt * sopt)10062 necp_get_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt)
10063 {
10064 int error = 0;
10065 u_int8_t *buffer = NULL;
10066 u_int8_t *cursor = NULL;
10067 size_t valsize = 0;
10068
10069 if (attributes->inp_domain != NULL) {
10070 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_domain);
10071 }
10072 if (attributes->inp_domain_owner != NULL) {
10073 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_domain_owner);
10074 }
10075 if (attributes->inp_domain_context != NULL) {
10076 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_domain_context);
10077 }
10078 if (attributes->inp_tracker_domain != NULL) {
10079 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_tracker_domain);
10080 }
10081 if (attributes->inp_account != NULL) {
10082 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_account);
10083 }
10084 if (valsize == 0) {
10085 goto done;
10086 }
10087
10088 buffer = (u_int8_t *)kalloc_data(valsize, Z_WAITOK | Z_ZERO);
10089 if (buffer == NULL) {
10090 goto done;
10091 }
10092
10093 cursor = buffer;
10094 if (attributes->inp_domain != NULL) {
10095 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN, strlen(attributes->inp_domain), attributes->inp_domain,
10096 buffer, valsize);
10097 }
10098
10099 if (attributes->inp_domain_owner != NULL) {
10100 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN_OWNER, strlen(attributes->inp_domain_owner), attributes->inp_domain_owner,
10101 buffer, valsize);
10102 }
10103
10104 if (attributes->inp_domain_context != NULL) {
10105 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT, strlen(attributes->inp_domain_context), attributes->inp_domain_context,
10106 buffer, valsize);
10107 }
10108
10109 if (attributes->inp_tracker_domain != NULL) {
10110 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_TRACKER_DOMAIN, strlen(attributes->inp_tracker_domain), attributes->inp_tracker_domain,
10111 buffer, valsize);
10112 }
10113
10114 if (attributes->inp_account != NULL) {
10115 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_ACCOUNT, strlen(attributes->inp_account), attributes->inp_account,
10116 buffer, valsize);
10117 }
10118
10119 error = sooptcopyout(sopt, buffer, valsize);
10120 if (error) {
10121 goto done;
10122 }
10123 done:
10124 if (buffer != NULL) {
10125 kfree_data(buffer, valsize);
10126 }
10127
10128 return error;
10129 }
10130
10131 /*
10132 * necp_set_socket_domain_attributes
10133 * Called from soconnectlock/soconnectxlock to directly set the tracker domain and owner for
10134 * a newly marked tracker socket.
10135 */
10136 errno_t
necp_set_socket_domain_attributes(struct socket * so,const char * domain,const char * domain_owner)10137 necp_set_socket_domain_attributes(struct socket *so, const char *domain, const char *domain_owner)
10138 {
10139 int error = 0;
10140 struct inpcb *inp = NULL;
10141 u_int8_t *buffer = NULL;
10142 size_t valsize = 0;
10143 char *buffer_to_free = NULL;
10144
10145 if (SOCK_DOM(so) != PF_INET && SOCK_DOM(so) != PF_INET6) {
10146 error = EINVAL;
10147 goto fail;
10148 }
10149
10150 // Set domain (required)
10151
10152 valsize = strlen(domain);
10153 if (valsize == 0 || valsize > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) {
10154 error = EINVAL;
10155 goto fail;
10156 }
10157
10158 buffer = (u_int8_t *)kalloc_data(valsize + 1, Z_WAITOK | Z_ZERO);
10159 if (buffer == NULL) {
10160 error = ENOMEM;
10161 goto fail;
10162 }
10163 bcopy(domain, buffer, valsize);
10164 buffer[valsize] = 0;
10165
10166 inp = sotoinpcb(so);
10167 // Do not overwrite a previously set domain if tracker domain is different.
10168 if (inp->inp_necp_attributes.inp_domain != NULL) {
10169 if (strlen(inp->inp_necp_attributes.inp_domain) != strlen(domain) ||
10170 strncmp(inp->inp_necp_attributes.inp_domain, domain, strlen(domain)) != 0) {
10171 buffer_to_free = inp->inp_necp_attributes.inp_tracker_domain;
10172 // Protect switching of buffer pointer
10173 necp_lock_socket_attributes();
10174 inp->inp_necp_attributes.inp_tracker_domain = (char *)buffer;
10175 necp_unlock_socket_attributes();
10176 if (buffer_to_free != NULL) {
10177 kfree_data_addr(buffer_to_free);
10178 }
10179 }
10180 } else {
10181 // Protect switching of buffer pointer
10182 necp_lock_socket_attributes();
10183 inp->inp_necp_attributes.inp_domain = (char *)buffer;
10184 necp_unlock_socket_attributes();
10185 }
10186 buffer = NULL;
10187
10188 // set domain_owner (required only for tracker)
10189 if (!(so->so_flags1 & SOF1_KNOWN_TRACKER)) {
10190 goto done;
10191 }
10192
10193 valsize = strlen(domain_owner);
10194 if (valsize == 0 || valsize > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) {
10195 error = EINVAL;
10196 goto fail;
10197 }
10198
10199 buffer = (u_int8_t *)kalloc_data(valsize + 1, Z_WAITOK | Z_ZERO);
10200 if (buffer == NULL) {
10201 error = ENOMEM;
10202 goto fail;
10203 }
10204 bcopy(domain_owner, buffer, valsize);
10205 buffer[valsize] = 0;
10206
10207 inp = sotoinpcb(so);
10208
10209 buffer_to_free = inp->inp_necp_attributes.inp_domain_owner;
10210 // Protect switching of buffer pointer
10211 necp_lock_socket_attributes();
10212 inp->inp_necp_attributes.inp_domain_owner = (char *)buffer;
10213 necp_unlock_socket_attributes();
10214 buffer = NULL;
10215
10216 if (buffer_to_free != NULL) {
10217 kfree_data_addr(buffer_to_free);
10218 }
10219
10220 done:
10221 // Log if it is a known tracker
10222 if (so->so_flags1 & SOF1_KNOWN_TRACKER) {
10223 NECP_CLIENT_TRACKER_LOG(NECP_SOCKET_PID(so),
10224 "NECP ATTRIBUTES SOCKET - domain <%s> owner <%s> context <%s> tracker domain <%s> account <%s> "
10225 "<so flags - is_tracker %X non-app-initiated %X app-approved-domain %X",
10226 inp->inp_necp_attributes.inp_domain ? "present" : "not set",
10227 inp->inp_necp_attributes.inp_domain_owner ? "present" : "not set",
10228 inp->inp_necp_attributes.inp_domain_context ? "present" : "not set",
10229 inp->inp_necp_attributes.inp_tracker_domain ? "present" : "not set",
10230 inp->inp_necp_attributes.inp_account ? "present" : "not set",
10231 so->so_flags1 & SOF1_KNOWN_TRACKER,
10232 so->so_flags1 & SOF1_TRACKER_NON_APP_INITIATED,
10233 so->so_flags1 & SOF1_APPROVED_APP_DOMAIN);
10234 }
10235
10236 NECP_SOCKET_PARAMS_LOG(so, "NECP ATTRIBUTES SOCKET - domain <%s> owner <%s> context <%s> tracker domain <%s> account <%s> "
10237 "<so flags - is_tracker %X non-app-initiated %X app-approved-domain %X",
10238 inp->inp_necp_attributes.inp_domain,
10239 inp->inp_necp_attributes.inp_domain_owner,
10240 inp->inp_necp_attributes.inp_domain_context,
10241 inp->inp_necp_attributes.inp_tracker_domain,
10242 inp->inp_necp_attributes.inp_account,
10243 so->so_flags1 & SOF1_KNOWN_TRACKER,
10244 so->so_flags1 & SOF1_TRACKER_NON_APP_INITIATED,
10245 so->so_flags1 & SOF1_APPROVED_APP_DOMAIN);
10246
10247 if (necp_debug) {
10248 NECPLOG(LOG_DEBUG, "Set on socket: Domain <%s> Domain owner <%s> Domain context <%s> Tracker domain <%s> Account <%s> ",
10249 inp->inp_necp_attributes.inp_domain,
10250 inp->inp_necp_attributes.inp_domain_owner,
10251 inp->inp_necp_attributes.inp_domain_context,
10252 inp->inp_necp_attributes.inp_tracker_domain,
10253 inp->inp_necp_attributes.inp_account);
10254 }
10255 fail:
10256 if (buffer != NULL) {
10257 kfree_data(buffer, valsize + 1);
10258 }
10259 return error;
10260 }
10261
10262 void *
necp_create_nexus_assign_message(uuid_t nexus_instance,u_int32_t nexus_port,void * key,uint32_t key_length,struct necp_client_endpoint * local_endpoint,struct necp_client_endpoint * remote_endpoint,struct ether_addr * local_ether_addr,u_int32_t flow_adv_index,void * flow_stats,size_t * message_length)10263 necp_create_nexus_assign_message(uuid_t nexus_instance, u_int32_t nexus_port, void *key, uint32_t key_length,
10264 struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint, struct ether_addr *local_ether_addr,
10265 u_int32_t flow_adv_index, void *flow_stats, size_t *message_length)
10266 {
10267 u_int8_t *buffer = NULL;
10268 u_int8_t *cursor = NULL;
10269 size_t valsize = 0;
10270 bool has_nexus_assignment = FALSE;
10271
10272 if (!uuid_is_null(nexus_instance)) {
10273 has_nexus_assignment = TRUE;
10274 valsize += sizeof(struct necp_tlv_header) + sizeof(uuid_t);
10275 valsize += sizeof(struct necp_tlv_header) + sizeof(u_int32_t);
10276 }
10277 if (flow_adv_index != NECP_FLOWADV_IDX_INVALID) {
10278 valsize += sizeof(struct necp_tlv_header) + sizeof(u_int32_t);
10279 }
10280 if (key != NULL && key_length > 0) {
10281 valsize += sizeof(struct necp_tlv_header) + key_length;
10282 }
10283 if (local_endpoint != NULL) {
10284 valsize += sizeof(struct necp_tlv_header) + sizeof(struct necp_client_endpoint);
10285 }
10286 if (remote_endpoint != NULL) {
10287 valsize += sizeof(struct necp_tlv_header) + sizeof(struct necp_client_endpoint);
10288 }
10289 if (local_ether_addr != NULL) {
10290 valsize += sizeof(struct necp_tlv_header) + sizeof(struct ether_addr);
10291 }
10292 if (flow_stats != NULL) {
10293 valsize += sizeof(struct necp_tlv_header) + sizeof(void *);
10294 }
10295 if (valsize == 0) {
10296 return NULL;
10297 }
10298
10299 buffer = kalloc_data(valsize, Z_WAITOK | Z_ZERO);
10300 if (buffer == NULL) {
10301 return NULL;
10302 }
10303
10304 cursor = buffer;
10305 if (has_nexus_assignment) {
10306 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_INSTANCE, sizeof(uuid_t), nexus_instance, buffer, valsize);
10307 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_PORT, sizeof(u_int32_t), &nexus_port, buffer, valsize);
10308 }
10309 if (flow_adv_index != NECP_FLOWADV_IDX_INVALID) {
10310 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_PORT_FLOW_INDEX, sizeof(u_int32_t), &flow_adv_index, buffer, valsize);
10311 }
10312 if (key != NULL && key_length > 0) {
10313 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_PARAMETER_NEXUS_KEY, key_length, key, buffer, valsize);
10314 }
10315 if (local_endpoint != NULL) {
10316 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_LOCAL_ENDPOINT, sizeof(struct necp_client_endpoint), local_endpoint, buffer, valsize);
10317 }
10318 if (remote_endpoint != NULL) {
10319 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_REMOTE_ENDPOINT, sizeof(struct necp_client_endpoint), remote_endpoint, buffer, valsize);
10320 }
10321 if (local_ether_addr != NULL) {
10322 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_LOCAL_ETHER_ADDR, sizeof(struct ether_addr), local_ether_addr, buffer, valsize);
10323 }
10324 if (flow_stats != NULL) {
10325 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_FLOW_STATS, sizeof(void *), &flow_stats, buffer, valsize);
10326 }
10327
10328 *message_length = valsize;
10329
10330 return buffer;
10331 }
10332
10333 void
necp_inpcb_remove_cb(struct inpcb * inp)10334 necp_inpcb_remove_cb(struct inpcb *inp)
10335 {
10336 if (!uuid_is_null(inp->necp_client_uuid)) {
10337 necp_client_unregister_socket_flow(inp->necp_client_uuid, inp);
10338 uuid_clear(inp->necp_client_uuid);
10339 }
10340 }
10341
10342 void
necp_inpcb_dispose(struct inpcb * inp)10343 necp_inpcb_dispose(struct inpcb *inp)
10344 {
10345 necp_inpcb_remove_cb(inp); // Clear out socket registrations if not yet done
10346 if (inp->inp_necp_attributes.inp_domain != NULL) {
10347 kfree_data_addr(inp->inp_necp_attributes.inp_domain);
10348 inp->inp_necp_attributes.inp_domain = NULL;
10349 }
10350 if (inp->inp_necp_attributes.inp_account != NULL) {
10351 kfree_data_addr(inp->inp_necp_attributes.inp_account);
10352 inp->inp_necp_attributes.inp_account = NULL;
10353 }
10354 if (inp->inp_necp_attributes.inp_domain_owner != NULL) {
10355 kfree_data_addr(inp->inp_necp_attributes.inp_domain_owner);
10356 inp->inp_necp_attributes.inp_domain_owner = NULL;
10357 }
10358 if (inp->inp_necp_attributes.inp_domain_context != NULL) {
10359 kfree_data_addr(inp->inp_necp_attributes.inp_domain_context);
10360 inp->inp_necp_attributes.inp_domain_context = NULL;
10361 }
10362 if (inp->inp_necp_attributes.inp_tracker_domain != NULL) {
10363 kfree_data_addr(inp->inp_necp_attributes.inp_tracker_domain);
10364 inp->inp_necp_attributes.inp_tracker_domain = NULL;
10365 }
10366 }
10367
10368 void
necp_mppcb_dispose(struct mppcb * mpp)10369 necp_mppcb_dispose(struct mppcb *mpp)
10370 {
10371 if (!uuid_is_null(mpp->necp_client_uuid)) {
10372 necp_client_unregister_multipath_cb(mpp->necp_client_uuid, mpp);
10373 uuid_clear(mpp->necp_client_uuid);
10374 }
10375
10376 if (mpp->inp_necp_attributes.inp_domain != NULL) {
10377 kfree_data_addr(mpp->inp_necp_attributes.inp_domain);
10378 mpp->inp_necp_attributes.inp_domain = NULL;
10379 }
10380 if (mpp->inp_necp_attributes.inp_account != NULL) {
10381 kfree_data_addr(mpp->inp_necp_attributes.inp_account);
10382 mpp->inp_necp_attributes.inp_account = NULL;
10383 }
10384 if (mpp->inp_necp_attributes.inp_domain_owner != NULL) {
10385 kfree_data_addr(mpp->inp_necp_attributes.inp_domain_owner);
10386 mpp->inp_necp_attributes.inp_domain_owner = NULL;
10387 }
10388 if (mpp->inp_necp_attributes.inp_tracker_domain != NULL) {
10389 kfree_data_addr(mpp->inp_necp_attributes.inp_tracker_domain);
10390 mpp->inp_necp_attributes.inp_tracker_domain = NULL;
10391 }
10392 }
10393
10394 /// Module init
10395
10396 void
necp_client_init(void)10397 necp_client_init(void)
10398 {
10399 necp_flow_size = sizeof(struct necp_client_flow);
10400 necp_flow_cache = mcache_create(NECP_FLOW_ZONE_NAME, necp_flow_size, sizeof(uint64_t), 0, MCR_SLEEP);
10401 if (necp_flow_cache == NULL) {
10402 panic("mcache_create(necp_flow_cache) failed");
10403 /* NOTREACHED */
10404 }
10405
10406 necp_flow_registration_size = sizeof(struct necp_client_flow_registration);
10407 necp_flow_registration_cache = mcache_create(NECP_FLOW_REGISTRATION_ZONE_NAME, necp_flow_registration_size, sizeof(uint64_t), 0, MCR_SLEEP);
10408 if (necp_flow_registration_cache == NULL) {
10409 panic("mcache_create(necp_client_flow_registration) failed");
10410 /* NOTREACHED */
10411 }
10412
10413 necp_client_update_tcall = thread_call_allocate_with_options(necp_update_all_clients_callout, NULL,
10414 THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
10415 VERIFY(necp_client_update_tcall != NULL);
10416 #if SKYWALK
10417
10418 necp_client_collect_stats_tcall = thread_call_allocate_with_options(necp_collect_stats_client_callout, NULL,
10419 THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
10420 VERIFY(necp_client_collect_stats_tcall != NULL);
10421
10422 necp_close_empty_arenas_tcall = thread_call_allocate_with_options(necp_close_empty_arenas_callout, NULL,
10423 THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
10424 VERIFY(necp_close_empty_arenas_tcall != NULL);
10425 #endif /* SKYWALK */
10426
10427 LIST_INIT(&necp_fd_list);
10428 LIST_INIT(&necp_fd_observer_list);
10429 LIST_INIT(&necp_collect_stats_flow_list);
10430
10431 RB_INIT(&necp_client_global_tree);
10432 RB_INIT(&necp_client_flow_global_tree);
10433 }
10434
10435 void
necp_client_reap_caches(boolean_t purge)10436 necp_client_reap_caches(boolean_t purge)
10437 {
10438 mcache_reap_now(necp_flow_cache, purge);
10439 mcache_reap_now(necp_flow_registration_cache, purge);
10440 }
10441
10442 #if SKYWALK
10443 pid_t
necp_client_get_proc_pid_from_arena_info(struct skmem_arena_mmap_info * arena_info)10444 necp_client_get_proc_pid_from_arena_info(struct skmem_arena_mmap_info *arena_info)
10445 {
10446 ASSERT((arena_info->ami_arena->ar_type == SKMEM_ARENA_TYPE_NECP) || (arena_info->ami_arena->ar_type == SKMEM_ARENA_TYPE_SYSTEM));
10447
10448 if (arena_info->ami_arena->ar_type == SKMEM_ARENA_TYPE_NECP) {
10449 struct necp_arena_info *nai = container_of(arena_info, struct necp_arena_info, nai_mmap);
10450 return nai->nai_proc_pid;
10451 } else {
10452 struct necp_fd_data *fd_data = container_of(arena_info, struct necp_fd_data, sysctl_mmap);
10453 return fd_data->proc_pid;
10454 }
10455 }
10456 #endif /* !SKYWALK */
10457