1 /*
2 * Copyright (c) 2015-2022 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #include <string.h>
30
31 #include <kern/thread_call.h>
32 #include <kern/zalloc.h>
33
34 #include <net/if.h>
35 #include <net/if_var.h>
36 #include <net/net_api_stats.h>
37 #include <net/necp.h>
38 #include <net/network_agent.h>
39 #include <net/ntstat.h>
40
41 #include <netinet/in_pcb.h>
42 #include <netinet/in_var.h>
43 #include <netinet/ip.h>
44 #include <netinet/ip6.h>
45 #include <netinet/mp_pcb.h>
46 #include <netinet/tcp_cc.h>
47 #include <netinet/tcp_fsm.h>
48 #include <netinet/tcp_cache.h>
49 #include <netinet6/in6_var.h>
50
51 #include <sys/domain.h>
52 #include <sys/file_internal.h>
53 #include <sys/kauth.h>
54 #include <sys/kernel.h>
55 #include <sys/malloc.h>
56 #include <sys/poll.h>
57 #include <sys/priv.h>
58 #include <sys/protosw.h>
59 #include <sys/queue.h>
60 #include <sys/socket.h>
61 #include <sys/socketvar.h>
62 #include <sys/sysproto.h>
63 #include <sys/systm.h>
64 #include <sys/types.h>
65 #include <sys/codesign.h>
66 #include <libkern/section_keywords.h>
67
68 #include <os/refcnt.h>
69
70 #if SKYWALK
71 #include <skywalk/os_skywalk_private.h>
72 #include <skywalk/nexus/flowswitch/flow/flow_var.h>
73 #include <skywalk/nexus/netif/nx_netif.h>
74 #endif /* SKYWALK */
75
76 #if CONFIG_MACF
77 #include <security/mac_framework.h>
78 #endif
79
80 /*
81 * NECP Client Architecture
82 * ------------------------------------------------
83 * See <net/necp.c> for a discussion on NECP database architecture.
84 *
85 * Each client of NECP provides a set of parameters for a connection or network state
86 * evaluation, on which NECP policy evaluation is run. This produces a policy result
87 * which can be accessed by the originating process, along with events for when policies
88 * results have changed.
89 *
90 * ------------------------------------------------
91 * NECP Client FD
92 * ------------------------------------------------
93 * A process opens an NECP file descriptor using necp_open(). This is a very simple
94 * file descriptor, upon which the process may do the following operations:
95 * - necp_client_action(...), to add/remove/query clients
96 * - kqueue, to watch for readable events
97 * - close(), to close the client session and release all clients
98 *
99 * Client objects are allocated structures that hang off of the file descriptor. Each
100 * client contains:
101 * - Client ID, a UUID that references the client across the system
102 * - Parameters, a buffer of TLVs that describe the client's connection parameters,
103 * such as the remote and local endpoints, interface requirements, etc.
104 * - Result, a buffer of TLVs containing the current policy evaluation for the client.
105 * This result will be updated whenever a network change occurs that impacts the
106 * policy result for that client.
107 *
108 * +--------------+
109 * | NECP fd |
110 * +--------------+
111 * ||
112 * ==================================
113 * || || ||
114 * +--------------+ +--------------+ +--------------+
115 * | Client ID | | Client ID | | Client ID |
116 * | ---- | | ---- | | ---- |
117 * | Parameters | | Parameters | | Parameters |
118 * | ---- | | ---- | | ---- |
119 * | Result | | Result | | Result |
120 * +--------------+ +--------------+ +--------------+
121 *
122 * ------------------------------------------------
123 * Client Actions
124 * ------------------------------------------------
125 * - Add. Input parameters as a buffer of TLVs, and output a client ID. Allocates a
126 * new client structure on the file descriptor.
127 * - Remove. Input a client ID. Removes a client structure from the file descriptor.
128 * - Copy Parameters. Input a client ID, and output parameter TLVs.
129 * - Copy Result. Input a client ID, and output result TLVs. Alternatively, input empty
130 * client ID and get next unread client result.
131 * - Copy List. List all client IDs.
132 *
133 * ------------------------------------------------
134 * Client Policy Evaluation
135 * ------------------------------------------------
136 * Policies are evaluated for clients upon client creation, and upon update events,
137 * which are network/agent/policy changes coalesced by a timer.
138 *
139 * The policy evaluation goes through the following steps:
140 * 1. Parse client parameters.
141 * 2. Select a scoped interface if applicable. This involves using require/prohibit
142 * parameters, along with the local address, to select the most appropriate interface
143 * if not explicitly set by the client parameters.
144 * 3. Run NECP application-level policy evalution
145 * 4. Set policy result into client result buffer.
146 *
147 * ------------------------------------------------
148 * Client Observers
149 * ------------------------------------------------
150 * If necp_open() is called with the NECP_OPEN_FLAG_OBSERVER flag, and the process
151 * passes the necessary privilege check, the fd is allowed to use necp_client_action()
152 * to copy client state attached to the file descriptors of other processes, and to
153 * list all client IDs on the system.
154 */
155
156 extern u_int32_t necp_debug;
157
158 static int necpop_select(struct fileproc *, int, void *, vfs_context_t);
159 static int necpop_close(struct fileglob *, vfs_context_t);
160 static int necpop_kqfilter(struct fileproc *, struct knote *, struct kevent_qos_s *);
161
162 // Timer functions
163 static int necp_timeout_microseconds = 1000 * 100; // 100ms
164 static int necp_timeout_leeway_microseconds = 1000 * 50; // 50ms
165 #if SKYWALK
166 static int necp_collect_stats_timeout_microseconds = 1000 * 1000 * 1; // 1s
167 static int necp_collect_stats_timeout_leeway_microseconds = 1000 * 500; // 500ms
168 static int necp_close_arenas_timeout_microseconds = 1000 * 1000 * 10; // 10s
169 static int necp_close_arenas_timeout_leeway_microseconds = 1000 * 1000 * 1; // 1s
170 #endif /* SKYWALK */
171
172 static int necp_client_fd_count = 0;
173 static int necp_observer_fd_count = 0;
174 static int necp_client_count = 0;
175 static int necp_socket_flow_count = 0;
176 static int necp_if_flow_count = 0;
177 static int necp_observer_message_limit = 256;
178
179 /*
180 * NECP client tracing control -
181 *
182 * necp_client_tracing_level : 1 for client trace, 2 for flow trace, 3 for parameter details
183 * necp_client_tracing_pid : match client with pid
184 */
185 static int necp_client_tracing_level = 0;
186 static int necp_client_tracing_pid = 0;
187
188 #define NECP_CLIENT_TRACE_LEVEL_CLIENT 1
189 #define NECP_CLIENT_TRACE_LEVEL_FLOW 2
190 #define NECP_CLIENT_TRACE_LEVEL_PARAMS 3
191
192 #define NECP_CLIENT_TRACE_PID_MATCHED(pid) \
193 (pid == necp_client_tracing_pid)
194
195 #define NECP_ENABLE_CLIENT_TRACE(level) \
196 ((necp_client_tracing_level >= level && \
197 (!necp_client_tracing_pid || NECP_CLIENT_TRACE_PID_MATCHED(client->proc_pid))) ? necp_client_tracing_level : 0)
198
199 #define NECP_CLIENT_LOG(client, fmt, ...) \
200 if (client && NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_CLIENT)) { \
201 uuid_string_t client_uuid_str = { }; \
202 uuid_unparse_lower(client->client_id, client_uuid_str); \
203 NECPLOG(LOG_NOTICE, "NECP_CLIENT_LOG <pid %d %s>: " fmt "\n", client ? client->proc_pid : 0, client_uuid_str, ##__VA_ARGS__); \
204 }
205
206 #define NECP_CLIENT_FLOW_LOG(client, flow, fmt, ...) \
207 if (client && flow && NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_FLOW)) { \
208 uuid_string_t client_uuid_str = { }; \
209 uuid_unparse_lower(client->client_id, client_uuid_str); \
210 uuid_string_t flow_uuid_str = { }; \
211 uuid_unparse_lower(flow->registration_id, flow_uuid_str); \
212 NECPLOG(LOG_NOTICE, "NECP CLIENT FLOW TRACE <pid %d %s> <flow %s>: " fmt "\n", client ? client->proc_pid : 0, client_uuid_str, flow_uuid_str, ##__VA_ARGS__); \
213 }
214
215 #define NECP_CLIENT_PARAMS_LOG(client, fmt, ...) \
216 if (client && NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) { \
217 uuid_string_t client_uuid_str = { }; \
218 uuid_unparse_lower(client->client_id, client_uuid_str); \
219 NECPLOG(LOG_NOTICE, "NECP_CLIENT_PARAMS_LOG <pid %d %s>: " fmt "\n", client ? client->proc_pid : 0, client_uuid_str, ##__VA_ARGS__); \
220 }
221
222 #define NECP_SOCKET_PID(so) \
223 ((so->so_flags & SOF_DELEGATED) ? so->e_pid : so->last_pid)
224
225 #define NECP_ENABLE_SOCKET_TRACE(level) \
226 ((necp_client_tracing_level >= level && \
227 (!necp_client_tracing_pid || NECP_CLIENT_TRACE_PID_MATCHED(NECP_SOCKET_PID(so)))) ? necp_client_tracing_level : 0)
228
229 #define NECP_SOCKET_PARAMS_LOG(so, fmt, ...) \
230 if (so && NECP_ENABLE_SOCKET_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) { \
231 NECPLOG(LOG_NOTICE, "NECP_SOCKET_PARAMS_LOG <pid %d>: " fmt "\n", NECP_SOCKET_PID(so), ##__VA_ARGS__); \
232 }
233
234 #define NECP_SOCKET_ATTRIBUTE_LOG(fmt, ...) \
235 if (necp_client_tracing_level >= NECP_CLIENT_TRACE_LEVEL_PARAMS) { \
236 NECPLOG(LOG_NOTICE, "NECP_SOCKET_ATTRIBUTE_LOG: " fmt "\n", ##__VA_ARGS__); \
237 }
238
239 #define NECP_CLIENT_TRACKER_LOG(pid, fmt, ...) \
240 if (pid) { \
241 NECPLOG(LOG_NOTICE, "NECP_CLIENT_TRACKER_LOG <pid %d>: " fmt "\n", pid, ##__VA_ARGS__); \
242 }
243
244 #if SKYWALK
245 static int necp_arena_count = 0;
246 static int necp_sysctl_arena_count = 0;
247 static int necp_nexus_flow_count = 0;
248
249 /* userspace stats sanity check range, same unit as TCP (see TCP_RTT_SCALE) */
250 static uint32_t necp_client_stats_rtt_floor = 1; // 32us
251 static uint32_t necp_client_stats_rtt_ceiling = 1920000; // 60s
252 const static struct sk_stats_flow ntstat_sk_stats_zero;
253 #endif /* SKYWALK */
254
255 /*
256 * Global lock to protect socket inp_necp_attributes across updates.
257 * NECP updating these attributes and clients accessing these attributes
258 * must take this lock.
259 */
260 static LCK_GRP_DECLARE(necp_socket_attr_lock_grp, "necpSocketAttrGroup");
261 LCK_MTX_DECLARE(necp_socket_attr_lock, &necp_socket_attr_lock_grp);
262
263 os_refgrp_decl(static, necp_client_refgrp, "NECPClientRefGroup", NULL);
264
265 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_FD_COUNT, client_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_fd_count, 0, "");
266 SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_FD_COUNT, observer_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_observer_fd_count, 0, "");
267 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_COUNT, client_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_count, 0, "");
268 SYSCTL_INT(_net_necp, NECPCTL_SOCKET_FLOW_COUNT, socket_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_socket_flow_count, 0, "");
269 SYSCTL_INT(_net_necp, NECPCTL_IF_FLOW_COUNT, if_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_if_flow_count, 0, "");
270 SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_MESSAGE_LIMIT, observer_message_limit, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_observer_message_limit, 256, "");
271 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_TRACING_LEVEL, necp_client_tracing_level, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_client_tracing_level, 0, "");
272 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_TRACING_PID, necp_client_tracing_pid, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_client_tracing_pid, 0, "");
273
274 #if SKYWALK
275 SYSCTL_INT(_net_necp, NECPCTL_ARENA_COUNT, arena_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_arena_count, 0, "");
276 SYSCTL_INT(_net_necp, NECPCTL_SYSCTL_ARENA_COUNT, sysctl_arena_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_sysctl_arena_count, 0, "");
277 SYSCTL_INT(_net_necp, NECPCTL_NEXUS_FLOW_COUNT, nexus_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_nexus_flow_count, 0, "");
278 #if (DEVELOPMENT || DEBUG)
279 SYSCTL_UINT(_net_necp, OID_AUTO, collect_stats_interval_us, CTLFLAG_RW | CTLFLAG_LOCKED, &necp_collect_stats_timeout_microseconds, 0, "");
280 SYSCTL_UINT(_net_necp, OID_AUTO, necp_client_stats_rtt_floor, CTLFLAG_RW | CTLFLAG_LOCKED, &necp_client_stats_rtt_floor, 0, "");
281 SYSCTL_UINT(_net_necp, OID_AUTO, necp_client_stats_rtt_ceiling, CTLFLAG_RW | CTLFLAG_LOCKED, &necp_client_stats_rtt_ceiling, 0, "");
282 #endif /* (DEVELOPMENT || DEBUG) */
283 #endif /* SKYWALK */
284
285 #define NECP_MAX_CLIENT_LIST_SIZE 1024 * 1024 // 1MB
286 #define NECP_MAX_AGENT_ACTION_SIZE 10 * 1024 // 10K
287
288 extern int tvtohz(struct timeval *);
289 extern unsigned int get_maxmtu(struct rtentry *);
290
291 // Parsed parameters
292 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR 0x00001
293 #define NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR 0x00002
294 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF 0x00004
295 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF 0x00008
296 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE 0x00010
297 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE 0x00020
298 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT 0x00040
299 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT 0x00080
300 #define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT 0x00100
301 #define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT 0x00200
302 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE 0x00400
303 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE 0x00800
304 #define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE 0x01000
305 #define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE 0x02000
306 #define NECP_PARSED_PARAMETERS_FIELD_FLAGS 0x04000
307 #define NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL 0x08000
308 #define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID 0x10000
309 #define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID 0x20000
310 #define NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS 0x40000
311 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT 0x80000
312 #define NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID 0x100000
313 #define NECP_PARSED_PARAMETERS_FIELD_ETHERTYPE 0x200000
314 #define NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL 0x400000
315 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE 0x800000
316 #define NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER 0x1000000
317 #define NECP_PARSED_PARAMETERS_FIELD_PARENT_UUID 0x2000000
318 #define NECP_PARSED_PARAMETERS_FIELD_FLOW_DEMUX_PATTERN 0x4000000
319
320
321 #define NECP_MAX_INTERFACE_PARAMETERS 16
322 #define NECP_MAX_AGENT_PARAMETERS 4
323 struct necp_client_parsed_parameters {
324 u_int32_t valid_fields;
325 u_int32_t flags;
326 u_int64_t delegated_upid;
327 union necp_sockaddr_union local_addr;
328 union necp_sockaddr_union remote_addr;
329 u_int32_t required_interface_index;
330 char prohibited_interfaces[NECP_MAX_INTERFACE_PARAMETERS][IFXNAMSIZ];
331 u_int8_t required_interface_type;
332 u_int8_t local_address_preference;
333 u_int8_t prohibited_interface_types[NECP_MAX_INTERFACE_PARAMETERS];
334 struct necp_client_parameter_netagent_type required_netagent_types[NECP_MAX_AGENT_PARAMETERS];
335 struct necp_client_parameter_netagent_type prohibited_netagent_types[NECP_MAX_AGENT_PARAMETERS];
336 struct necp_client_parameter_netagent_type preferred_netagent_types[NECP_MAX_AGENT_PARAMETERS];
337 struct necp_client_parameter_netagent_type avoided_netagent_types[NECP_MAX_AGENT_PARAMETERS];
338 uuid_t required_netagents[NECP_MAX_AGENT_PARAMETERS];
339 uuid_t prohibited_netagents[NECP_MAX_AGENT_PARAMETERS];
340 uuid_t preferred_netagents[NECP_MAX_AGENT_PARAMETERS];
341 uuid_t avoided_netagents[NECP_MAX_AGENT_PARAMETERS];
342 u_int8_t ip_protocol;
343 u_int8_t transport_protocol;
344 u_int16_t ethertype;
345 pid_t effective_pid;
346 uuid_t effective_uuid;
347 uuid_t parent_uuid;
348 u_int32_t traffic_class;
349 struct necp_demux_pattern demux_patterns[NECP_MAX_DEMUX_PATTERNS];
350 u_int8_t demux_pattern_count;
351 };
352
353 static bool
354 necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters,
355 u_int *return_ifindex, bool *validate_agents);
356
357 static bool
358 necp_ifnet_matches_local_address(struct ifnet *ifp, struct sockaddr *sa);
359
360 static bool
361 necp_ifnet_matches_parameters(struct ifnet *ifp,
362 struct necp_client_parsed_parameters *parsed_parameters,
363 u_int32_t override_flags,
364 u_int32_t *preferred_count,
365 bool secondary_interface,
366 bool require_scoped_field);
367
368 static const struct fileops necp_fd_ops = {
369 .fo_type = DTYPE_NETPOLICY,
370 .fo_read = fo_no_read,
371 .fo_write = fo_no_write,
372 .fo_ioctl = fo_no_ioctl,
373 .fo_select = necpop_select,
374 .fo_close = necpop_close,
375 .fo_drain = fo_no_drain,
376 .fo_kqfilter = necpop_kqfilter,
377 };
378
379 struct necp_client_assertion {
380 LIST_ENTRY(necp_client_assertion) assertion_chain;
381 uuid_t asserted_netagent;
382 };
383
384 struct necp_client_flow_header {
385 struct necp_tlv_header outer_header;
386 struct necp_tlv_header flow_id_tlv_header;
387 uuid_t flow_id;
388 struct necp_tlv_header flags_tlv_header;
389 u_int32_t flags_value;
390 struct necp_tlv_header interface_tlv_header;
391 struct necp_client_result_interface interface_value;
392 } __attribute__((__packed__));
393
394 struct necp_client_flow_protoctl_event_header {
395 struct necp_tlv_header protoctl_tlv_header;
396 struct necp_client_flow_protoctl_event protoctl_event;
397 } __attribute__((__packed__));
398
399 struct necp_client_nexus_flow_header {
400 struct necp_client_flow_header flow_header;
401 struct necp_tlv_header agent_tlv_header;
402 struct necp_client_result_netagent agent_value;
403 struct necp_tlv_header tfo_cookie_tlv_header;
404 u_int8_t tfo_cookie_value[NECP_TFO_COOKIE_LEN_MAX];
405 } __attribute__((__packed__));
406
407 #if SKYWALK
408 struct necp_arena_info;
409 #endif
410
411 struct necp_client_flow {
412 LIST_ENTRY(necp_client_flow) flow_chain;
413 unsigned invalid : 1;
414 unsigned nexus : 1; // If true, flow is a nexus; if false, flow is attached to socket
415 unsigned socket : 1;
416 unsigned viable : 1;
417 unsigned assigned : 1;
418 unsigned has_protoctl_event : 1;
419 unsigned check_tcp_heuristics : 1;
420 unsigned _reserved : 1;
421 union {
422 uuid_t nexus_agent;
423 struct {
424 void *socket_handle;
425 necp_client_flow_cb cb;
426 };
427 } u;
428 uint32_t interface_index;
429 u_short delegated_interface_index;
430 uint16_t interface_flags;
431 uint32_t necp_flow_flags;
432 struct necp_client_flow_protoctl_event protoctl_event;
433 union necp_sockaddr_union local_addr;
434 union necp_sockaddr_union remote_addr;
435
436 size_t assigned_results_length;
437 u_int8_t *assigned_results;
438 };
439
440 struct necp_client_flow_registration {
441 RB_ENTRY(necp_client_flow_registration) fd_link;
442 RB_ENTRY(necp_client_flow_registration) global_link;
443 RB_ENTRY(necp_client_flow_registration) client_link;
444 LIST_ENTRY(necp_client_flow_registration) collect_stats_chain;
445 uuid_t registration_id;
446 u_int32_t flags;
447 unsigned flow_result_read : 1;
448 unsigned defunct : 1;
449 void *interface_handle;
450 necp_client_flow_cb interface_cb;
451 struct necp_client *client;
452 LIST_HEAD(_necp_registration_flow_list, necp_client_flow) flow_list;
453 #if SKYWALK
454 struct necp_arena_info *stats_arena; /* arena where the stats objects came from */
455 void * kstats_kaddr; /* kernel snapshot of untrusted userspace stats, for calculating delta */
456 mach_vm_address_t ustats_uaddr; /* userspace stats (untrusted) */
457 nstat_userland_context stats_handler_context;
458 struct flow_stats *nexus_stats; /* shared stats objects between necp_client and skywalk */
459 #endif /* !SKYWALK */
460 u_int64_t last_interface_details __attribute__((aligned(sizeof(u_int64_t))));
461 };
462
463 static int necp_client_flow_id_cmp(struct necp_client_flow_registration *flow0, struct necp_client_flow_registration *flow1);
464
465 RB_HEAD(_necp_client_flow_tree, necp_client_flow_registration);
466 RB_PROTOTYPE_PREV(_necp_client_flow_tree, necp_client_flow_registration, client_link, necp_client_flow_id_cmp);
467 RB_GENERATE_PREV(_necp_client_flow_tree, necp_client_flow_registration, client_link, necp_client_flow_id_cmp);
468
469 #define NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT 4
470 #define NECP_CLIENT_MAX_INTERFACE_OPTIONS 32
471
472 #define NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT (NECP_CLIENT_MAX_INTERFACE_OPTIONS - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT)
473
474 struct necp_client {
475 RB_ENTRY(necp_client) link;
476 RB_ENTRY(necp_client) global_link;
477
478 decl_lck_mtx_data(, lock);
479 decl_lck_mtx_data(, route_lock);
480 os_refcnt_t reference_count;
481
482 uuid_t client_id;
483 unsigned result_read : 1;
484 unsigned group_members_read : 1;
485 unsigned allow_multiple_flows : 1;
486 unsigned legacy_client_is_flow : 1;
487
488 unsigned platform_binary : 1;
489 unsigned validated_parent : 1;
490
491 size_t result_length;
492 u_int8_t result[NECP_BASE_CLIENT_RESULT_SIZE];
493
494 necp_policy_id policy_id;
495
496 u_int8_t ip_protocol;
497 int proc_pid;
498
499 u_int64_t delegated_upid;
500
501 struct _necp_client_flow_tree flow_registrations;
502 LIST_HEAD(_necp_client_assertion_list, necp_client_assertion) assertion_list;
503
504 size_t assigned_group_members_length;
505 u_int8_t *assigned_group_members;
506
507 struct rtentry *current_route;
508
509 struct necp_client_interface_option interface_options[NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
510 struct necp_client_interface_option *extra_interface_options;
511 u_int8_t interface_option_count; // Number in interface_options + extra_interface_options
512
513 struct necp_client_result_netagent failed_trigger_agent;
514
515 void *agent_handle;
516
517 uuid_t override_euuid;
518
519 #if SKYWALK
520 netns_token port_reservation;
521 nstat_context nstat_context;
522 uuid_t latest_flow_registration_id;
523 uuid_t parent_client_id;
524 struct necp_client *original_parameters_source;
525 #endif /* !SKYWALK */
526
527 size_t parameters_length;
528 u_int8_t *parameters;
529 };
530
531 #define NECP_CLIENT_LOCK(_c) lck_mtx_lock(&_c->lock)
532 #define NECP_CLIENT_UNLOCK(_c) lck_mtx_unlock(&_c->lock)
533 #define NECP_CLIENT_ASSERT_LOCKED(_c) LCK_MTX_ASSERT(&_c->lock, LCK_MTX_ASSERT_OWNED)
534 #define NECP_CLIENT_ASSERT_UNLOCKED(_c) LCK_MTX_ASSERT(&_c->lock, LCK_MTX_ASSERT_NOTOWNED)
535
536 #define NECP_CLIENT_ROUTE_LOCK(_c) lck_mtx_lock(&_c->route_lock)
537 #define NECP_CLIENT_ROUTE_UNLOCK(_c) lck_mtx_unlock(&_c->route_lock)
538
539 static void necp_client_retain_locked(struct necp_client *client);
540 static void necp_client_retain(struct necp_client *client);
541
542 static bool necp_client_release_locked(struct necp_client *client);
543 static bool necp_client_release(struct necp_client *client);
544
545 static void
546 necp_client_add_assertion(struct necp_client *client, uuid_t netagent_uuid);
547
548 static bool
549 necp_client_remove_assertion(struct necp_client *client, uuid_t netagent_uuid);
550
551 static int
552 necp_client_copy_parameters_locked(struct necp_client *client,
553 struct necp_client_nexus_parameters *parameters);
554
555 LIST_HEAD(_necp_flow_registration_list, necp_client_flow_registration);
556 static struct _necp_flow_registration_list necp_collect_stats_flow_list;
557
558 struct necp_flow_defunct {
559 LIST_ENTRY(necp_flow_defunct) chain;
560
561 uuid_t flow_id;
562 uuid_t nexus_agent;
563 void *agent_handle;
564 int proc_pid;
565 u_int32_t flags;
566 struct necp_client_agent_parameters close_parameters;
567 bool has_close_parameters;
568 };
569
570 LIST_HEAD(_necp_flow_defunct_list, necp_flow_defunct);
571
572 static int necp_client_id_cmp(struct necp_client *client0, struct necp_client *client1);
573
574 RB_HEAD(_necp_client_tree, necp_client);
575 RB_PROTOTYPE_PREV(_necp_client_tree, necp_client, link, necp_client_id_cmp);
576 RB_GENERATE_PREV(_necp_client_tree, necp_client, link, necp_client_id_cmp);
577
578 RB_HEAD(_necp_client_global_tree, necp_client);
579 RB_PROTOTYPE_PREV(_necp_client_global_tree, necp_client, global_link, necp_client_id_cmp);
580 RB_GENERATE_PREV(_necp_client_global_tree, necp_client, global_link, necp_client_id_cmp);
581
582 RB_HEAD(_necp_fd_flow_tree, necp_client_flow_registration);
583 RB_PROTOTYPE_PREV(_necp_fd_flow_tree, necp_client_flow_registration, fd_link, necp_client_flow_id_cmp);
584 RB_GENERATE_PREV(_necp_fd_flow_tree, necp_client_flow_registration, fd_link, necp_client_flow_id_cmp);
585
586 RB_HEAD(_necp_client_flow_global_tree, necp_client_flow_registration);
587 RB_PROTOTYPE_PREV(_necp_client_flow_global_tree, necp_client_flow_registration, global_link, necp_client_flow_id_cmp);
588 RB_GENERATE_PREV(_necp_client_flow_global_tree, necp_client_flow_registration, global_link, necp_client_flow_id_cmp);
589
590 static struct _necp_client_global_tree necp_client_global_tree;
591 static struct _necp_client_flow_global_tree necp_client_flow_global_tree;
592
593 struct necp_client_update {
594 TAILQ_ENTRY(necp_client_update) chain;
595
596 uuid_t client_id;
597
598 size_t update_length;
599 struct necp_client_observer_update *update;
600 };
601
602 #if SKYWALK
603 struct necp_arena_info {
604 LIST_ENTRY(necp_arena_info) nai_chain;
605 u_int32_t nai_flags;
606 pid_t nai_proc_pid;
607 struct skmem_arena *nai_arena;
608 struct skmem_arena_mmap_info nai_mmap;
609 mach_vm_offset_t nai_roff;
610 u_int32_t nai_use_count;
611 };
612 #endif /* !SKYWALK */
613
614 #define NAIF_ATTACHED 0x1 // arena is attached to list
615 #define NAIF_REDIRECT 0x2 // arena mmap has been redirected
616 #define NAIF_DEFUNCT 0x4 // arena is now defunct
617
618 struct necp_fd_data {
619 u_int8_t necp_fd_type;
620 LIST_ENTRY(necp_fd_data) chain;
621 struct _necp_client_tree clients;
622 struct _necp_fd_flow_tree flows;
623 TAILQ_HEAD(_necp_client_update_list, necp_client_update) update_list;
624 int update_count;
625 int flags;
626
627 unsigned background : 1;
628
629 int proc_pid;
630 decl_lck_mtx_data(, fd_lock);
631 struct selinfo si;
632 #if SKYWALK
633 // Arenas and their mmap info for per-process stats. Stats objects are allocated from an active arena
634 // that is not redirected/defunct. The stats_arena_active keeps track of such an arena, and it also
635 // holds a reference count on the object. Each flow allocating a stats object also holds a reference
636 // the necp_arena_info (where the object got allocated from). During defunct, we redirect the mapping
637 // of the arena such that any attempt to access (read/write) will result in getting zero-filled pages.
638 // We then go thru all of the flows for the process and free the stats objects associated with them,
639 // followed by destroying the skmem region(s) associated with the arena. The stats_arena_list keeps
640 // track of all current and defunct stats arenas; there could be more than one arena created for the
641 // process as the arena destruction happens when its reference count drops to 0.
642 struct necp_arena_info *stats_arena_active;
643 LIST_HEAD(_necp_arena_info_list, necp_arena_info) stats_arena_list;
644 u_int32_t stats_arena_gencnt;
645
646 struct skmem_arena *sysctl_arena;
647 struct skmem_arena_mmap_info sysctl_mmap;
648 mach_vm_offset_t system_sysctls_roff;
649 #endif /* !SKYWALK */
650 };
651
652 #define NECP_FD_LOCK(_f) lck_mtx_lock(&_f->fd_lock)
653 #define NECP_FD_UNLOCK(_f) lck_mtx_unlock(&_f->fd_lock)
654 #define NECP_FD_ASSERT_LOCKED(_f) LCK_MTX_ASSERT(&_f->fd_lock, LCK_MTX_ASSERT_OWNED)
655 #define NECP_FD_ASSERT_UNLOCKED(_f) LCK_MTX_ASSERT(&_f->fd_lock, LCK_MTX_ASSERT_NOTOWNED)
656
657 static LIST_HEAD(_necp_fd_list, necp_fd_data) necp_fd_list;
658 static LIST_HEAD(_necp_fd_observer_list, necp_fd_data) necp_fd_observer_list;
659
660 #if SKYWALK
661 static KALLOC_TYPE_DEFINE(necp_arena_info_zone, struct necp_arena_info, NET_KT_DEFAULT);
662 #endif /* !SKYWALK */
663
664 static LCK_ATTR_DECLARE(necp_fd_mtx_attr, 0, 0);
665 static LCK_GRP_DECLARE(necp_fd_mtx_grp, "necp_fd");
666
667 static LCK_RW_DECLARE_ATTR(necp_fd_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
668 static LCK_RW_DECLARE_ATTR(necp_observer_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
669 static LCK_RW_DECLARE_ATTR(necp_client_tree_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
670 static LCK_RW_DECLARE_ATTR(necp_flow_tree_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
671 static LCK_RW_DECLARE_ATTR(necp_collect_stats_list_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
672
673
674 #define NECP_STATS_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_collect_stats_list_lock)
675 #define NECP_STATS_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_collect_stats_list_lock)
676 #define NECP_STATS_LIST_UNLOCK() lck_rw_done(&necp_collect_stats_list_lock)
677
678 #define NECP_CLIENT_TREE_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_client_tree_lock)
679 #define NECP_CLIENT_TREE_LOCK_SHARED() lck_rw_lock_shared(&necp_client_tree_lock)
680 #define NECP_CLIENT_TREE_UNLOCK() lck_rw_done(&necp_client_tree_lock)
681 #define NECP_CLIENT_TREE_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_client_tree_lock, LCK_RW_ASSERT_HELD)
682
683 #define NECP_FLOW_TREE_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_flow_tree_lock)
684 #define NECP_FLOW_TREE_LOCK_SHARED() lck_rw_lock_shared(&necp_flow_tree_lock)
685 #define NECP_FLOW_TREE_UNLOCK() lck_rw_done(&necp_flow_tree_lock)
686 #define NECP_FLOW_TREE_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_flow_tree_lock, LCK_RW_ASSERT_HELD)
687
688 #define NECP_FD_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_fd_lock)
689 #define NECP_FD_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_fd_lock)
690 #define NECP_FD_LIST_UNLOCK() lck_rw_done(&necp_fd_lock)
691
692 #define NECP_OBSERVER_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_observer_lock)
693 #define NECP_OBSERVER_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_observer_lock)
694 #define NECP_OBSERVER_LIST_UNLOCK() lck_rw_done(&necp_observer_lock)
695
696 // Locking Notes
697
698 // Take NECP_FD_LIST_LOCK when accessing or modifying the necp_fd_list
699 // Take NECP_CLIENT_TREE_LOCK when accessing or modifying the necp_client_global_tree
700 // Take NECP_FLOW_TREE_LOCK when accessing or modifying the necp_client_flow_global_tree
701 // Take NECP_STATS_LIST_LOCK when accessing or modifying the necp_collect_stats_flow_list
702 // Take NECP_FD_LOCK when accessing or modifying an necp_fd_data entry
703 // Take NECP_CLIENT_LOCK when accessing or modifying a single necp_client
704 // Take NECP_CLIENT_ROUTE_LOCK when accessing or modifying a client's route
705
706 // Precedence, where 1 is the first lock that must be taken
707 // 1. NECP_FD_LIST_LOCK
708 // 2. NECP_FD_LOCK (any)
709 // 3. NECP_CLIENT_TREE_LOCK
710 // 4. NECP_CLIENT_LOCK (any)
711 // 5. NECP_FLOW_TREE_LOCK
712 // 6. NECP_STATS_LIST_LOCK
713 // 7. NECP_CLIENT_ROUTE_LOCK (any)
714
715 static thread_call_t necp_client_update_tcall;
716 static uint32_t necp_update_all_clients_sched_cnt = 0;
717 static uint64_t necp_update_all_clients_sched_abstime = 0;
718 static LCK_RW_DECLARE_ATTR(necp_update_all_clients_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
719 #define NECP_UPDATE_ALL_CLIENTS_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_update_all_clients_lock)
720 #define NECP_UPDATE_ALL_CLIENTS_SHARED_TO_EXCLUSIVE() lck_rw_lock_shared_to_exclusive(&necp_update_all_clients_lock)
721 #define NECP_UPDATE_ALL_CLIENTS_SHARED() lck_rw_lock_shared(&necp_update_all_clients_lock)
722 #define NECP_UPDATE_ALL_CLIENTS_UNLOCK() lck_rw_done(&necp_update_all_clients_lock)
723
724
725 #if SKYWALK
726 static thread_call_t necp_client_collect_stats_tcall;
727 static thread_call_t necp_close_empty_arenas_tcall;
728
729 static void necp_fd_insert_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai);
730 static void necp_fd_remove_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai);
731 static struct necp_arena_info *necp_fd_mredirect_stats_arena(struct necp_fd_data *fd_data, struct proc *proc);
732
733 static void necp_arena_info_retain(struct necp_arena_info *nai);
734 static void necp_arena_info_release(struct necp_arena_info *nai);
735 static struct necp_arena_info *necp_arena_info_alloc(void);
736 static void necp_arena_info_free(struct necp_arena_info *nai);
737
738 static int necp_arena_initialize(struct necp_fd_data *fd_data, bool locked);
739 static int necp_stats_initialize(struct necp_fd_data *fd_data, struct necp_client *client,
740 struct necp_client_flow_registration *flow_registration, struct necp_stats_bufreq *bufreq);
741 static int necp_arena_create(struct necp_fd_data *fd_data, size_t obj_size, size_t obj_cnt, struct proc *p);
742 static int necp_arena_stats_obj_alloc(struct necp_fd_data *fd_data, mach_vm_offset_t *off, struct necp_arena_info **stats_arena, void **kstats_kaddr, boolean_t cansleep);
743 static void necp_arena_stats_obj_free(struct necp_fd_data *fd_data, struct necp_arena_info *stats_arena, void **kstats_kaddr, mach_vm_address_t *ustats_uaddr);
744 static void necp_stats_arenas_destroy(struct necp_fd_data *fd_data, boolean_t closing);
745
746 static int necp_sysctl_arena_initialize(struct necp_fd_data *fd_data, bool locked);
747 static void necp_sysctl_arena_destroy(struct necp_fd_data *fd_data);
748 static void *necp_arena_sysctls_obj(struct necp_fd_data *fd_data, mach_vm_offset_t *off, size_t *size);
749 #endif /* !SKYWALK */
750
751 void necp_copy_inp_domain_info(struct inpcb *, struct socket *, nstat_domain_info *);
752 void necp_with_inp_domain_name(struct socket *so, void *ctx, void (*with_func)(char *domain_name, void *ctx));
753
754 static void
necp_lock_socket_attributes(void)755 necp_lock_socket_attributes(void)
756 {
757 lck_mtx_lock(&necp_socket_attr_lock);
758 }
759
760 static void
necp_unlock_socket_attributes(void)761 necp_unlock_socket_attributes(void)
762 {
763 lck_mtx_unlock(&necp_socket_attr_lock);
764 }
765
766 /// NECP file descriptor functions
767
768 static void
necp_fd_notify(struct necp_fd_data * fd_data,bool locked)769 necp_fd_notify(struct necp_fd_data *fd_data, bool locked)
770 {
771 struct selinfo *si = &fd_data->si;
772
773 if (!locked) {
774 NECP_FD_LOCK(fd_data);
775 }
776
777 selwakeup(si);
778
779 // use a non-zero hint to tell the notification from the
780 // call done in kqueue_scan() which uses 0
781 KNOTE(&si->si_note, 1); // notification
782
783 if (!locked) {
784 NECP_FD_UNLOCK(fd_data);
785 }
786 }
787
788 static inline bool
necp_client_has_unread_flows(struct necp_client * client)789 necp_client_has_unread_flows(struct necp_client *client)
790 {
791 NECP_CLIENT_ASSERT_LOCKED(client);
792 struct necp_client_flow_registration *flow_registration = NULL;
793 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
794 if (!flow_registration->flow_result_read) {
795 return true;
796 }
797 }
798 return false;
799 }
800
801 static int
necp_fd_poll(struct necp_fd_data * fd_data,int events,void * wql,struct proc * p,int is_kevent)802 necp_fd_poll(struct necp_fd_data *fd_data, int events, void *wql, struct proc *p, int is_kevent)
803 {
804 #pragma unused(wql, p, is_kevent)
805 u_int revents = 0;
806
807 u_int want_rx = events & (POLLIN | POLLRDNORM);
808 if (want_rx) {
809 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
810 // Push-mode observers are readable when they have a new update
811 if (!TAILQ_EMPTY(&fd_data->update_list)) {
812 revents |= want_rx;
813 }
814 } else {
815 // Standard fds are readable when some client is unread
816 struct necp_client *client = NULL;
817 bool has_unread_clients = FALSE;
818 RB_FOREACH(client, _necp_client_tree, &fd_data->clients) {
819 NECP_CLIENT_LOCK(client);
820 if (!client->result_read || !client->group_members_read || necp_client_has_unread_flows(client)) {
821 has_unread_clients = TRUE;
822 }
823 NECP_CLIENT_UNLOCK(client);
824 if (has_unread_clients) {
825 break;
826 }
827 }
828
829 if (has_unread_clients) {
830 revents |= want_rx;
831 }
832 }
833 }
834
835 return revents;
836 }
837
838 static inline void
necp_generate_client_id(uuid_t client_id,bool is_flow)839 necp_generate_client_id(uuid_t client_id, bool is_flow)
840 {
841 uuid_generate_random(client_id);
842
843 if (is_flow) {
844 client_id[9] |= 0x01;
845 } else {
846 client_id[9] &= ~0x01;
847 }
848 }
849
850 static inline bool
necp_client_id_is_flow(uuid_t client_id)851 necp_client_id_is_flow(uuid_t client_id)
852 {
853 return client_id[9] & 0x01;
854 }
855
856 static struct necp_client *
necp_find_client_and_lock(uuid_t client_id)857 necp_find_client_and_lock(uuid_t client_id)
858 {
859 NECP_CLIENT_TREE_ASSERT_LOCKED();
860
861 struct necp_client *client = NULL;
862
863 if (necp_client_id_is_flow(client_id)) {
864 NECP_FLOW_TREE_LOCK_SHARED();
865 struct necp_client_flow_registration find;
866 uuid_copy(find.registration_id, client_id);
867 struct necp_client_flow_registration *flow = RB_FIND(_necp_client_flow_global_tree, &necp_client_flow_global_tree, &find);
868 if (flow != NULL) {
869 client = flow->client;
870 }
871 NECP_FLOW_TREE_UNLOCK();
872 } else {
873 struct necp_client find;
874 uuid_copy(find.client_id, client_id);
875 client = RB_FIND(_necp_client_global_tree, &necp_client_global_tree, &find);
876 }
877
878 if (client != NULL) {
879 NECP_CLIENT_LOCK(client);
880 }
881
882 return client;
883 }
884
885 static struct necp_client_flow_registration *
necp_client_find_flow(struct necp_client * client,uuid_t flow_id)886 necp_client_find_flow(struct necp_client *client, uuid_t flow_id)
887 {
888 NECP_CLIENT_ASSERT_LOCKED(client);
889 struct necp_client_flow_registration *flow = NULL;
890
891 if (necp_client_id_is_flow(flow_id)) {
892 struct necp_client_flow_registration find;
893 uuid_copy(find.registration_id, flow_id);
894 flow = RB_FIND(_necp_client_flow_tree, &client->flow_registrations, &find);
895 } else {
896 flow = RB_ROOT(&client->flow_registrations);
897 }
898
899 return flow;
900 }
901
902 static struct necp_client *
necp_client_fd_find_client_unlocked(struct necp_fd_data * client_fd,uuid_t client_id)903 necp_client_fd_find_client_unlocked(struct necp_fd_data *client_fd, uuid_t client_id)
904 {
905 NECP_FD_ASSERT_LOCKED(client_fd);
906 struct necp_client *client = NULL;
907
908 if (necp_client_id_is_flow(client_id)) {
909 struct necp_client_flow_registration find;
910 uuid_copy(find.registration_id, client_id);
911 struct necp_client_flow_registration *flow = RB_FIND(_necp_fd_flow_tree, &client_fd->flows, &find);
912 if (flow != NULL) {
913 client = flow->client;
914 }
915 } else {
916 struct necp_client find;
917 uuid_copy(find.client_id, client_id);
918 client = RB_FIND(_necp_client_tree, &client_fd->clients, &find);
919 }
920
921 return client;
922 }
923
924 static struct necp_client *
necp_client_fd_find_client_and_lock(struct necp_fd_data * client_fd,uuid_t client_id)925 necp_client_fd_find_client_and_lock(struct necp_fd_data *client_fd, uuid_t client_id)
926 {
927 struct necp_client *client = necp_client_fd_find_client_unlocked(client_fd, client_id);
928 if (client != NULL) {
929 NECP_CLIENT_LOCK(client);
930 }
931
932 return client;
933 }
934
935 static inline int
necp_client_id_cmp(struct necp_client * client0,struct necp_client * client1)936 necp_client_id_cmp(struct necp_client *client0, struct necp_client *client1)
937 {
938 return uuid_compare(client0->client_id, client1->client_id);
939 }
940
941 static inline int
necp_client_flow_id_cmp(struct necp_client_flow_registration * flow0,struct necp_client_flow_registration * flow1)942 necp_client_flow_id_cmp(struct necp_client_flow_registration *flow0, struct necp_client_flow_registration *flow1)
943 {
944 return uuid_compare(flow0->registration_id, flow1->registration_id);
945 }
946
947 static int
necpop_select(struct fileproc * fp,int which,void * wql,vfs_context_t ctx)948 necpop_select(struct fileproc *fp, int which, void *wql, vfs_context_t ctx)
949 {
950 #pragma unused(fp, which, wql, ctx)
951 return 0;
952 struct necp_fd_data *fd_data = NULL;
953 int revents = 0;
954 int events = 0;
955 proc_t procp;
956
957 fd_data = (struct necp_fd_data *)fp_get_data(fp);
958 if (fd_data == NULL) {
959 return 0;
960 }
961
962 procp = vfs_context_proc(ctx);
963
964 switch (which) {
965 case FREAD: {
966 events = POLLIN;
967 break;
968 }
969
970 default: {
971 return 1;
972 }
973 }
974
975 NECP_FD_LOCK(fd_data);
976 revents = necp_fd_poll(fd_data, events, wql, procp, 0);
977 NECP_FD_UNLOCK(fd_data);
978
979 return (events & revents) ? 1 : 0;
980 }
981
982 static void
necp_fd_knrdetach(struct knote * kn)983 necp_fd_knrdetach(struct knote *kn)
984 {
985 struct necp_fd_data *fd_data = (struct necp_fd_data *)kn->kn_hook;
986 struct selinfo *si = &fd_data->si;
987
988 NECP_FD_LOCK(fd_data);
989 KNOTE_DETACH(&si->si_note, kn);
990 NECP_FD_UNLOCK(fd_data);
991 }
992
993 static int
necp_fd_knread(struct knote * kn,long hint)994 necp_fd_knread(struct knote *kn, long hint)
995 {
996 #pragma unused(kn, hint)
997 return 1; /* assume we are ready */
998 }
999
1000 static int
necp_fd_knrprocess(struct knote * kn,struct kevent_qos_s * kev)1001 necp_fd_knrprocess(struct knote *kn, struct kevent_qos_s *kev)
1002 {
1003 struct necp_fd_data *fd_data;
1004 int revents;
1005 int res;
1006
1007 fd_data = (struct necp_fd_data *)kn->kn_hook;
1008
1009 NECP_FD_LOCK(fd_data);
1010 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
1011 res = ((revents & POLLIN) != 0);
1012 if (res) {
1013 knote_fill_kevent(kn, kev, 0);
1014 }
1015 NECP_FD_UNLOCK(fd_data);
1016 return res;
1017 }
1018
1019 static int
necp_fd_knrtouch(struct knote * kn,struct kevent_qos_s * kev)1020 necp_fd_knrtouch(struct knote *kn, struct kevent_qos_s *kev)
1021 {
1022 #pragma unused(kev)
1023 struct necp_fd_data *fd_data;
1024 int revents;
1025
1026 fd_data = (struct necp_fd_data *)kn->kn_hook;
1027
1028 NECP_FD_LOCK(fd_data);
1029 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
1030 NECP_FD_UNLOCK(fd_data);
1031
1032 return (revents & POLLIN) != 0;
1033 }
1034
1035 SECURITY_READ_ONLY_EARLY(struct filterops) necp_fd_rfiltops = {
1036 .f_isfd = 1,
1037 .f_detach = necp_fd_knrdetach,
1038 .f_event = necp_fd_knread,
1039 .f_touch = necp_fd_knrtouch,
1040 .f_process = necp_fd_knrprocess,
1041 };
1042
1043 static int
necpop_kqfilter(struct fileproc * fp,struct knote * kn,__unused struct kevent_qos_s * kev)1044 necpop_kqfilter(struct fileproc *fp, struct knote *kn,
1045 __unused struct kevent_qos_s *kev)
1046 {
1047 struct necp_fd_data *fd_data = NULL;
1048 int revents;
1049
1050 if (kn->kn_filter != EVFILT_READ) {
1051 NECPLOG(LOG_ERR, "bad filter request %d", kn->kn_filter);
1052 knote_set_error(kn, EINVAL);
1053 return 0;
1054 }
1055
1056 fd_data = (struct necp_fd_data *)fp_get_data(fp);
1057 if (fd_data == NULL) {
1058 NECPLOG0(LOG_ERR, "No channel for kqfilter");
1059 knote_set_error(kn, ENOENT);
1060 return 0;
1061 }
1062
1063 NECP_FD_LOCK(fd_data);
1064 kn->kn_filtid = EVFILTID_NECP_FD;
1065 kn->kn_hook = fd_data;
1066 KNOTE_ATTACH(&fd_data->si.si_note, kn);
1067
1068 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
1069
1070 NECP_FD_UNLOCK(fd_data);
1071
1072 return (revents & POLLIN) != 0;
1073 }
1074
1075 #define INTERFACE_FLAGS_SHIFT 32
1076 #define INTERFACE_FLAGS_MASK 0xffff
1077 #define INTERFACE_INDEX_SHIFT 0
1078 #define INTERFACE_INDEX_MASK 0xffffffff
1079
1080 static uint64_t
combine_interface_details(uint32_t interface_index,uint16_t interface_flags)1081 combine_interface_details(uint32_t interface_index, uint16_t interface_flags)
1082 {
1083 return ((uint64_t)interface_flags & INTERFACE_FLAGS_MASK) << INTERFACE_FLAGS_SHIFT |
1084 ((uint64_t)interface_index & INTERFACE_INDEX_MASK) << INTERFACE_INDEX_SHIFT;
1085 }
1086
1087 #if SKYWALK
1088
1089 static void
split_interface_details(uint64_t combined_details,uint32_t * interface_index,uint16_t * interface_flags)1090 split_interface_details(uint64_t combined_details, uint32_t *interface_index, uint16_t *interface_flags)
1091 {
1092 *interface_index = (combined_details >> INTERFACE_INDEX_SHIFT) & INTERFACE_INDEX_MASK;
1093 *interface_flags = (combined_details >> INTERFACE_FLAGS_SHIFT) & INTERFACE_FLAGS_MASK;
1094 }
1095
1096 static void
necp_flow_save_current_interface_details(struct necp_client_flow_registration * flow_registration)1097 necp_flow_save_current_interface_details(struct necp_client_flow_registration *flow_registration)
1098 {
1099 struct necp_client_flow *flow = NULL;
1100 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1101 if (flow->nexus) {
1102 uint64_t combined_details = combine_interface_details(flow->interface_index, flow->interface_flags);
1103 atomic_set_64(&flow_registration->last_interface_details, combined_details);
1104 break;
1105 }
1106 }
1107 }
1108
1109 static void
necp_client_collect_interface_stats(struct necp_client_flow_registration * flow_registration,struct ifnet_stats_per_flow * ifs)1110 necp_client_collect_interface_stats(struct necp_client_flow_registration *flow_registration, struct ifnet_stats_per_flow *ifs)
1111 {
1112 struct necp_client_flow *flow = NULL;
1113
1114 if (ifs == NULL || ifs->txpackets == 0 || ifs->rxpackets == 0) {
1115 return; // App might have crashed without publishing ifs
1116 }
1117
1118 // Do malicious stats detection here
1119
1120 // Fold userspace stats into (trusted) kernel stats (stored in ifp).
1121 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1122 uint32_t if_idx = flow->interface_index;
1123 ifnet_t ifp = NULL;
1124 ifnet_head_lock_shared();
1125 if (if_idx != IFSCOPE_NONE && if_idx <= (uint32_t)if_index) {
1126 ifp = ifindex2ifnet[if_idx];
1127 ifnet_update_stats_per_flow(ifs, ifp);
1128 }
1129 ifnet_head_done();
1130
1131 // Currently there is only one flow that uses the shared necp
1132 // stats region, so this loop should exit after updating an ifp
1133 break;
1134 }
1135 }
1136
1137 static void
necp_client_collect_stats(struct necp_client_flow_registration * flow_registration)1138 necp_client_collect_stats(struct necp_client_flow_registration *flow_registration)
1139 {
1140 struct necp_all_kstats *kstats = (struct necp_all_kstats *)flow_registration->kstats_kaddr;
1141 if (kstats == NULL) {
1142 return;
1143 }
1144
1145 // Grab userspace stats delta (untrusted).
1146 struct necp_tcp_stats *curr_tcpstats = (struct necp_tcp_stats *)kstats->necp_stats_ustats;
1147 struct necp_tcp_stats *prev_tcpstats = (struct necp_tcp_stats *)&kstats->necp_stats_comm;
1148 #define diff_n_update(field) \
1149 u_int32_t d_##field = (curr_tcpstats->necp_tcp_counts.necp_stat_##field - prev_tcpstats->necp_tcp_counts.necp_stat_##field); \
1150 prev_tcpstats->necp_tcp_counts.necp_stat_##field += d_##field;
1151 diff_n_update(rxpackets);
1152 diff_n_update(txpackets);
1153 if (d_rxpackets == 0 && d_txpackets == 0) {
1154 return; // no activity since last collection, stop here
1155 }
1156 diff_n_update(rxbytes);
1157 diff_n_update(txbytes);
1158 diff_n_update(rxduplicatebytes);
1159 diff_n_update(rxoutoforderbytes);
1160 diff_n_update(txretransmit);
1161 diff_n_update(connectattempts);
1162 diff_n_update(connectsuccesses);
1163 uint32_t rtt = prev_tcpstats->necp_tcp_counts.necp_stat_avg_rtt = curr_tcpstats->necp_tcp_counts.necp_stat_avg_rtt;
1164 uint32_t rtt_var = prev_tcpstats->necp_tcp_counts.necp_stat_var_rtt = curr_tcpstats->necp_tcp_counts.necp_stat_var_rtt;
1165 #undef diff_n_update
1166
1167 // Do malicious stats detection with the deltas here.
1168 // RTT check (not necessarily attacks, might just be not measured since we report stats async periodically).
1169 if (rtt < necp_client_stats_rtt_floor || rtt > necp_client_stats_rtt_ceiling) {
1170 rtt = rtt_var = 0; // nstat_route_update to skip 0 rtt
1171 }
1172
1173 // Fold userspace stats into (trusted) kernel stats (stored in route).
1174 NECP_CLIENT_ROUTE_LOCK(flow_registration->client);
1175 struct rtentry *route = flow_registration->client->current_route;
1176 if (route != NULL) {
1177 nstat_route_update(route, d_connectattempts, d_connectsuccesses, d_rxpackets, d_rxbytes, d_rxduplicatebytes,
1178 d_rxoutoforderbytes, d_txpackets, d_txbytes, d_txretransmit, rtt, rtt_var);
1179 }
1180 NECP_CLIENT_ROUTE_UNLOCK(flow_registration->client);
1181 }
1182
1183 // This is called from various places; "closing" here implies the client being closed/removed if true, otherwise being
1184 // defunct. In the former, we expect the caller to not hold the lock; for the latter it must have acquired it.
1185 static void
necp_destroy_flow_stats(struct necp_fd_data * fd_data,struct necp_client_flow_registration * flow_registration,struct ifnet_stats_per_flow * flow_ifnet_stats,boolean_t closing)1186 necp_destroy_flow_stats(struct necp_fd_data *fd_data,
1187 struct necp_client_flow_registration *flow_registration,
1188 struct ifnet_stats_per_flow *flow_ifnet_stats,
1189 boolean_t closing)
1190 {
1191 NECP_FD_ASSERT_LOCKED(fd_data);
1192
1193 struct necp_client *client = flow_registration->client;
1194
1195 if (closing) {
1196 NECP_CLIENT_ASSERT_UNLOCKED(client);
1197 NECP_CLIENT_LOCK(client);
1198 } else {
1199 NECP_CLIENT_ASSERT_LOCKED(client);
1200 }
1201
1202 // the interface stats are independent of the flow stats, hence we check here
1203 if (flow_ifnet_stats != NULL) {
1204 necp_client_collect_interface_stats(flow_registration, flow_ifnet_stats);
1205 }
1206
1207 if (flow_registration->kstats_kaddr != NULL) {
1208 NECP_STATS_LIST_LOCK_EXCLUSIVE();
1209 necp_client_collect_stats(flow_registration);
1210 const bool destroyed = necp_client_release_locked(client); // Drop the reference held by the stats list
1211 ASSERT(!destroyed);
1212 (void)destroyed;
1213 LIST_REMOVE(flow_registration, collect_stats_chain);
1214 NECP_STATS_LIST_UNLOCK();
1215 if (flow_registration->stats_handler_context != NULL) {
1216 ntstat_userland_stats_close(flow_registration->stats_handler_context);
1217 flow_registration->stats_handler_context = NULL;
1218 }
1219 necp_arena_stats_obj_free(fd_data, flow_registration->stats_arena, &flow_registration->kstats_kaddr, &flow_registration->ustats_uaddr);
1220 ASSERT(flow_registration->kstats_kaddr == NULL);
1221 ASSERT(flow_registration->ustats_uaddr == 0);
1222 }
1223
1224 if (flow_registration->nexus_stats != NULL) {
1225 flow_stats_release(flow_registration->nexus_stats);
1226 flow_registration->nexus_stats = NULL;
1227 }
1228
1229 if (closing) {
1230 NECP_CLIENT_UNLOCK(client);
1231 }
1232 }
1233
1234 static void
necp_schedule_collect_stats_clients(bool recur)1235 necp_schedule_collect_stats_clients(bool recur)
1236 {
1237 if (necp_client_collect_stats_tcall == NULL ||
1238 (!recur && thread_call_isactive(necp_client_collect_stats_tcall))) {
1239 return;
1240 }
1241
1242 uint64_t deadline = 0;
1243 uint64_t leeway = 0;
1244 clock_interval_to_deadline(necp_collect_stats_timeout_microseconds, NSEC_PER_USEC, &deadline);
1245 clock_interval_to_absolutetime_interval(necp_collect_stats_timeout_leeway_microseconds, NSEC_PER_USEC, &leeway);
1246
1247 thread_call_enter_delayed_with_leeway(necp_client_collect_stats_tcall, NULL,
1248 deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
1249 }
1250
1251 static void
necp_collect_stats_client_callout(__unused thread_call_param_t dummy,__unused thread_call_param_t arg)1252 necp_collect_stats_client_callout(__unused thread_call_param_t dummy,
1253 __unused thread_call_param_t arg)
1254 {
1255 struct necp_client_flow_registration *flow_registration;
1256
1257 net_update_uptime();
1258 NECP_STATS_LIST_LOCK_SHARED();
1259 if (LIST_EMPTY(&necp_collect_stats_flow_list)) {
1260 NECP_STATS_LIST_UNLOCK();
1261 return;
1262 }
1263 LIST_FOREACH(flow_registration, &necp_collect_stats_flow_list, collect_stats_chain) {
1264 // Collecting stats should be cheap (atomic increments)
1265 // Values like flow_registration->kstats_kaddr are guaranteed to be valid
1266 // as long as the flow_registration is in the stats list
1267 necp_client_collect_stats(flow_registration);
1268 }
1269 NECP_STATS_LIST_UNLOCK();
1270
1271 necp_schedule_collect_stats_clients(TRUE); // recurring collection
1272 }
1273
1274 #endif /* !SKYWALK */
1275
1276 static void
necp_defunct_flow_registration(struct necp_client * client,struct necp_client_flow_registration * flow_registration,struct _necp_flow_defunct_list * defunct_list)1277 necp_defunct_flow_registration(struct necp_client *client,
1278 struct necp_client_flow_registration *flow_registration,
1279 struct _necp_flow_defunct_list *defunct_list)
1280 {
1281 NECP_CLIENT_ASSERT_LOCKED(client);
1282
1283 if (!flow_registration->defunct) {
1284 bool needs_defunct = false;
1285 struct necp_client_flow *search_flow = NULL;
1286 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
1287 if (search_flow->nexus &&
1288 !uuid_is_null(search_flow->u.nexus_agent)) {
1289 // Save defunct values for the nexus
1290 if (defunct_list != NULL) {
1291 // Sleeping alloc won't fail; copy only what's necessary
1292 struct necp_flow_defunct *flow_defunct = kalloc_type(struct necp_flow_defunct,
1293 Z_WAITOK | Z_ZERO);
1294 uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent);
1295 uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
1296 client->client_id :
1297 flow_registration->registration_id));
1298 flow_defunct->proc_pid = client->proc_pid;
1299 flow_defunct->agent_handle = client->agent_handle;
1300 flow_defunct->flags = flow_registration->flags;
1301 #if SKYWALK
1302 if (flow_registration->kstats_kaddr != NULL) {
1303 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
1304 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
1305 if (quicstats != NULL) {
1306 memcpy(flow_defunct->close_parameters.u.close_token, quicstats->necp_quic_extra.ssr_token, sizeof(flow_defunct->close_parameters.u.close_token));
1307 flow_defunct->has_close_parameters = true;
1308 }
1309 }
1310 #endif /* SKYWALK */
1311 // Add to the list provided by caller
1312 LIST_INSERT_HEAD(defunct_list, flow_defunct, chain);
1313 }
1314
1315 needs_defunct = true;
1316 }
1317 }
1318
1319 if (needs_defunct) {
1320 #if SKYWALK
1321 // Close the stats early
1322 if (flow_registration->stats_handler_context != NULL) {
1323 ntstat_userland_stats_event(flow_registration->stats_handler_context,
1324 NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT);
1325 }
1326 #endif /* SKYWALK */
1327
1328 // Only set defunct if there was some assigned flow
1329 flow_registration->defunct = true;
1330 }
1331 }
1332 }
1333
1334 static void
necp_defunct_client_for_policy(struct necp_client * client,struct _necp_flow_defunct_list * defunct_list)1335 necp_defunct_client_for_policy(struct necp_client *client,
1336 struct _necp_flow_defunct_list *defunct_list)
1337 {
1338 NECP_CLIENT_ASSERT_LOCKED(client);
1339
1340 struct necp_client_flow_registration *flow_registration = NULL;
1341 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
1342 necp_defunct_flow_registration(client, flow_registration, defunct_list);
1343 }
1344 }
1345
1346 static void
necp_client_free(struct necp_client * client)1347 necp_client_free(struct necp_client *client)
1348 {
1349 NECP_CLIENT_ASSERT_UNLOCKED(client);
1350
1351 kfree_data(client->extra_interface_options,
1352 sizeof(struct necp_client_interface_option) * NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT);
1353 client->extra_interface_options = NULL;
1354
1355 kfree_data(client->parameters, client->parameters_length);
1356 client->parameters = NULL;
1357
1358 lck_mtx_destroy(&client->route_lock, &necp_fd_mtx_grp);
1359 lck_mtx_destroy(&client->lock, &necp_fd_mtx_grp);
1360
1361 kfree_type(struct necp_client, client);
1362 }
1363
1364 static void
necp_client_retain_locked(struct necp_client * client)1365 necp_client_retain_locked(struct necp_client *client)
1366 {
1367 NECP_CLIENT_ASSERT_LOCKED(client);
1368
1369 os_ref_retain_locked(&client->reference_count);
1370 }
1371
1372 static void
necp_client_retain(struct necp_client * client)1373 necp_client_retain(struct necp_client *client)
1374 {
1375 NECP_CLIENT_LOCK(client);
1376 necp_client_retain_locked(client);
1377 NECP_CLIENT_UNLOCK(client);
1378 }
1379
1380 static bool
necp_client_release_locked(struct necp_client * client)1381 necp_client_release_locked(struct necp_client *client)
1382 {
1383 NECP_CLIENT_ASSERT_LOCKED(client);
1384
1385 os_ref_count_t count = os_ref_release_locked(&client->reference_count);
1386 if (count == 0) {
1387 NECP_CLIENT_UNLOCK(client);
1388 necp_client_free(client);
1389 }
1390
1391 return count == 0;
1392 }
1393
1394 static bool
necp_client_release(struct necp_client * client)1395 necp_client_release(struct necp_client *client)
1396 {
1397 bool last_ref;
1398
1399 NECP_CLIENT_LOCK(client);
1400 if (!(last_ref = necp_client_release_locked(client))) {
1401 NECP_CLIENT_UNLOCK(client);
1402 }
1403
1404 return last_ref;
1405 }
1406
1407 static struct necp_client_update *
necp_client_update_alloc(const void * data,size_t length)1408 necp_client_update_alloc(const void *data, size_t length)
1409 {
1410 struct necp_client_update *client_update;
1411 struct necp_client_observer_update *buffer;
1412 size_t alloc_size;
1413
1414 if (os_add_overflow(length, sizeof(*buffer), &alloc_size)) {
1415 return NULL;
1416 }
1417 buffer = kalloc_data(alloc_size, Z_WAITOK);
1418 if (buffer == NULL) {
1419 return NULL;
1420 }
1421
1422 client_update = kalloc_type(struct necp_client_update,
1423 Z_WAITOK | Z_ZERO | Z_NOFAIL);
1424 client_update->update_length = alloc_size;
1425 client_update->update = buffer;
1426 memcpy(buffer->tlv_buffer, data, length);
1427 return client_update;
1428 }
1429
1430 static void
necp_client_update_free(struct necp_client_update * client_update)1431 necp_client_update_free(struct necp_client_update *client_update)
1432 {
1433 kfree_data(client_update->update, client_update->update_length);
1434 kfree_type(struct necp_client_update, client_update);
1435 }
1436
1437 static void
necp_client_update_observer_add_internal(struct necp_fd_data * observer_fd,struct necp_client * client)1438 necp_client_update_observer_add_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1439 {
1440 struct necp_client_update *client_update;
1441
1442 NECP_FD_LOCK(observer_fd);
1443
1444 if (observer_fd->update_count >= necp_observer_message_limit) {
1445 NECP_FD_UNLOCK(observer_fd);
1446 return;
1447 }
1448
1449 client_update = necp_client_update_alloc(client->parameters, client->parameters_length);
1450 if (client_update != NULL) {
1451 uuid_copy(client_update->client_id, client->client_id);
1452 client_update->update->update_type = NECP_CLIENT_UPDATE_TYPE_PARAMETERS;
1453 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1454 observer_fd->update_count++;
1455
1456 necp_fd_notify(observer_fd, true);
1457 }
1458
1459 NECP_FD_UNLOCK(observer_fd);
1460 }
1461
1462 static void
necp_client_update_observer_update_internal(struct necp_fd_data * observer_fd,struct necp_client * client)1463 necp_client_update_observer_update_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1464 {
1465 NECP_FD_LOCK(observer_fd);
1466
1467 if (observer_fd->update_count >= necp_observer_message_limit) {
1468 NECP_FD_UNLOCK(observer_fd);
1469 return;
1470 }
1471
1472 struct necp_client_update *client_update = necp_client_update_alloc(client->result, client->result_length);
1473 if (client_update != NULL) {
1474 uuid_copy(client_update->client_id, client->client_id);
1475 client_update->update->update_type = NECP_CLIENT_UPDATE_TYPE_RESULT;
1476 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1477 observer_fd->update_count++;
1478
1479 necp_fd_notify(observer_fd, true);
1480 }
1481
1482 NECP_FD_UNLOCK(observer_fd);
1483 }
1484
1485 static void
necp_client_update_observer_remove_internal(struct necp_fd_data * observer_fd,struct necp_client * client)1486 necp_client_update_observer_remove_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1487 {
1488 NECP_FD_LOCK(observer_fd);
1489
1490 if (observer_fd->update_count >= necp_observer_message_limit) {
1491 NECP_FD_UNLOCK(observer_fd);
1492 return;
1493 }
1494
1495 struct necp_client_update *client_update = necp_client_update_alloc(NULL, 0);
1496 if (client_update != NULL) {
1497 uuid_copy(client_update->client_id, client->client_id);
1498 client_update->update->update_type = NECP_CLIENT_UPDATE_TYPE_REMOVE;
1499 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1500 observer_fd->update_count++;
1501
1502 necp_fd_notify(observer_fd, true);
1503 }
1504
1505 NECP_FD_UNLOCK(observer_fd);
1506 }
1507
1508 static void
necp_client_update_observer_add(struct necp_client * client)1509 necp_client_update_observer_add(struct necp_client *client)
1510 {
1511 NECP_OBSERVER_LIST_LOCK_SHARED();
1512
1513 if (LIST_EMPTY(&necp_fd_observer_list)) {
1514 // No observers, bail
1515 NECP_OBSERVER_LIST_UNLOCK();
1516 return;
1517 }
1518
1519 struct necp_fd_data *observer_fd = NULL;
1520 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1521 necp_client_update_observer_add_internal(observer_fd, client);
1522 }
1523
1524 NECP_OBSERVER_LIST_UNLOCK();
1525 }
1526
1527 static void
necp_client_update_observer_update(struct necp_client * client)1528 necp_client_update_observer_update(struct necp_client *client)
1529 {
1530 NECP_OBSERVER_LIST_LOCK_SHARED();
1531
1532 if (LIST_EMPTY(&necp_fd_observer_list)) {
1533 // No observers, bail
1534 NECP_OBSERVER_LIST_UNLOCK();
1535 return;
1536 }
1537
1538 struct necp_fd_data *observer_fd = NULL;
1539 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1540 necp_client_update_observer_update_internal(observer_fd, client);
1541 }
1542
1543 NECP_OBSERVER_LIST_UNLOCK();
1544 }
1545
1546 static void
necp_client_update_observer_remove(struct necp_client * client)1547 necp_client_update_observer_remove(struct necp_client *client)
1548 {
1549 NECP_OBSERVER_LIST_LOCK_SHARED();
1550
1551 if (LIST_EMPTY(&necp_fd_observer_list)) {
1552 // No observers, bail
1553 NECP_OBSERVER_LIST_UNLOCK();
1554 return;
1555 }
1556
1557 struct necp_fd_data *observer_fd = NULL;
1558 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1559 necp_client_update_observer_remove_internal(observer_fd, client);
1560 }
1561
1562 NECP_OBSERVER_LIST_UNLOCK();
1563 }
1564
1565 static void
necp_destroy_client_flow_registration(struct necp_client * client,struct necp_client_flow_registration * flow_registration,pid_t pid,bool abort)1566 necp_destroy_client_flow_registration(struct necp_client *client,
1567 struct necp_client_flow_registration *flow_registration,
1568 pid_t pid, bool abort)
1569 {
1570 NECP_CLIENT_ASSERT_LOCKED(client);
1571
1572 bool has_close_parameters = false;
1573 struct necp_client_agent_parameters close_parameters = {};
1574 memset(close_parameters.u.close_token, 0, sizeof(close_parameters.u.close_token));
1575 #if SKYWALK
1576 if (flow_registration->kstats_kaddr != NULL) {
1577 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
1578 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
1579 if (quicstats != NULL &&
1580 quicstats->necp_quic_udp_stats.necp_udp_hdr.necp_stats_type == NECP_CLIENT_STATISTICS_TYPE_QUIC) {
1581 memcpy(close_parameters.u.close_token, quicstats->necp_quic_extra.ssr_token, sizeof(close_parameters.u.close_token));
1582 has_close_parameters = true;
1583 }
1584 }
1585
1586 // Release reference held on the stats arena
1587 if (flow_registration->stats_arena != NULL) {
1588 necp_arena_info_release(flow_registration->stats_arena);
1589 flow_registration->stats_arena = NULL;
1590 }
1591 #endif /* SKYWALK */
1592
1593 struct necp_client_flow *search_flow = NULL;
1594 struct necp_client_flow *temp_flow = NULL;
1595 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
1596 if (search_flow->nexus &&
1597 !uuid_is_null(search_flow->u.nexus_agent)) {
1598 // Don't unregister for defunct flows
1599 if (!flow_registration->defunct) {
1600 u_int8_t message_type = (abort ? NETAGENT_MESSAGE_TYPE_ABORT_NEXUS :
1601 NETAGENT_MESSAGE_TYPE_CLOSE_NEXUS);
1602 if (((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
1603 (flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
1604 !(flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
1605 message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
1606 }
1607 int netagent_error = netagent_client_message_with_params(search_flow->u.nexus_agent,
1608 ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
1609 client->client_id :
1610 flow_registration->registration_id),
1611 pid, client->agent_handle,
1612 message_type,
1613 has_close_parameters ? &close_parameters : NULL,
1614 NULL, 0);
1615 if (netagent_error != 0 && netagent_error != ENOENT) {
1616 NECPLOG(LOG_ERR, "necp_client_remove close nexus error (%d) MESSAGE TYPE %u", netagent_error, message_type);
1617 }
1618 }
1619 uuid_clear(search_flow->u.nexus_agent);
1620 }
1621 if (search_flow->assigned_results != NULL) {
1622 kfree_data(search_flow->assigned_results, search_flow->assigned_results_length);
1623 search_flow->assigned_results = NULL;
1624 }
1625 LIST_REMOVE(search_flow, flow_chain);
1626 #if SKYWALK
1627 if (search_flow->nexus) {
1628 OSDecrementAtomic(&necp_nexus_flow_count);
1629 } else
1630 #endif /* SKYWALK */
1631 if (search_flow->socket) {
1632 OSDecrementAtomic(&necp_socket_flow_count);
1633 } else {
1634 OSDecrementAtomic(&necp_if_flow_count);
1635 }
1636 kfree_type(struct necp_client_flow, search_flow);
1637 }
1638
1639 RB_REMOVE(_necp_client_flow_tree, &client->flow_registrations, flow_registration);
1640 flow_registration->client = NULL;
1641
1642 kfree_type(struct necp_client_flow_registration, flow_registration);
1643 }
1644
1645 static void
necp_destroy_client(struct necp_client * client,pid_t pid,bool abort)1646 necp_destroy_client(struct necp_client *client, pid_t pid, bool abort)
1647 {
1648 NECP_CLIENT_ASSERT_UNLOCKED(client);
1649
1650 #if SKYWALK
1651 if (client->nstat_context != NULL) {
1652 // This is a catch-all that should be rarely used.
1653 nstat_provider_stats_close(client->nstat_context);
1654 client->nstat_context = NULL;
1655 }
1656 if (client->original_parameters_source != NULL) {
1657 necp_client_release(client->original_parameters_source);
1658 client->original_parameters_source = NULL;
1659 }
1660 #endif /* SKYWALK */
1661 necp_client_update_observer_remove(client);
1662
1663 NECP_CLIENT_LOCK(client);
1664
1665 // Free route
1666 NECP_CLIENT_ROUTE_LOCK(client);
1667 if (client->current_route != NULL) {
1668 rtfree(client->current_route);
1669 client->current_route = NULL;
1670 }
1671 NECP_CLIENT_ROUTE_UNLOCK(client);
1672
1673 // Remove flow assignments
1674 struct necp_client_flow_registration *flow_registration = NULL;
1675 struct necp_client_flow_registration *temp_flow_registration = NULL;
1676 RB_FOREACH_SAFE(flow_registration, _necp_client_flow_tree, &client->flow_registrations, temp_flow_registration) {
1677 necp_destroy_client_flow_registration(client, flow_registration, pid, abort);
1678 }
1679
1680 #if SKYWALK
1681 // Remove port reservation
1682 if (NETNS_TOKEN_VALID(&client->port_reservation)) {
1683 netns_release(&client->port_reservation);
1684 }
1685 #endif /* !SKYWALK */
1686
1687 // Remove agent assertions
1688 struct necp_client_assertion *search_assertion = NULL;
1689 struct necp_client_assertion *temp_assertion = NULL;
1690 LIST_FOREACH_SAFE(search_assertion, &client->assertion_list, assertion_chain, temp_assertion) {
1691 int netagent_error = netagent_client_message(search_assertion->asserted_netagent, client->client_id, pid,
1692 client->agent_handle, NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT);
1693 if (netagent_error != 0) {
1694 NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR),
1695 "necp_client_remove unassert agent error (%d)", netagent_error);
1696 }
1697 LIST_REMOVE(search_assertion, assertion_chain);
1698 kfree_type(struct necp_client_assertion, search_assertion);
1699 }
1700
1701 if (!necp_client_release_locked(client)) {
1702 NECP_CLIENT_UNLOCK(client);
1703 }
1704
1705 OSDecrementAtomic(&necp_client_count);
1706 }
1707
1708 static bool
1709 necp_defunct_client_fd_locked_inner(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, bool destroy_stats);
1710
1711 static void
necp_process_defunct_list(struct _necp_flow_defunct_list * defunct_list)1712 necp_process_defunct_list(struct _necp_flow_defunct_list *defunct_list)
1713 {
1714 if (!LIST_EMPTY(defunct_list)) {
1715 struct necp_flow_defunct *flow_defunct = NULL;
1716 struct necp_flow_defunct *temp_flow_defunct = NULL;
1717
1718 // For each newly defunct client, send a message to the nexus to remove the flow
1719 LIST_FOREACH_SAFE(flow_defunct, defunct_list, chain, temp_flow_defunct) {
1720 if (!uuid_is_null(flow_defunct->nexus_agent)) {
1721 u_int8_t message_type = NETAGENT_MESSAGE_TYPE_ABORT_NEXUS;
1722 if (((flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
1723 (flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
1724 !(flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
1725 message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
1726 }
1727 int netagent_error = netagent_client_message_with_params(flow_defunct->nexus_agent,
1728 flow_defunct->flow_id,
1729 flow_defunct->proc_pid,
1730 flow_defunct->agent_handle,
1731 message_type,
1732 flow_defunct->has_close_parameters ? &flow_defunct->close_parameters : NULL,
1733 NULL, 0);
1734 if (netagent_error != 0) {
1735 char namebuf[MAXCOMLEN + 1];
1736 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
1737 proc_name(flow_defunct->proc_pid, namebuf, sizeof(namebuf));
1738 NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR), "necp_update_client abort nexus error (%d) for pid %d %s", netagent_error, flow_defunct->proc_pid, namebuf);
1739 }
1740 }
1741 LIST_REMOVE(flow_defunct, chain);
1742 kfree_type(struct necp_flow_defunct, flow_defunct);
1743 }
1744 }
1745 ASSERT(LIST_EMPTY(defunct_list));
1746 }
1747
1748 static int
necpop_close(struct fileglob * fg,vfs_context_t ctx)1749 necpop_close(struct fileglob *fg, vfs_context_t ctx)
1750 {
1751 #pragma unused(ctx)
1752 struct necp_fd_data *fd_data = NULL;
1753 int error = 0;
1754
1755 fd_data = (struct necp_fd_data *)fg_get_data(fg);
1756 fg_set_data(fg, NULL);
1757
1758 if (fd_data != NULL) {
1759 struct _necp_client_tree clients_to_close;
1760 RB_INIT(&clients_to_close);
1761
1762 // Remove from list quickly
1763 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
1764 NECP_OBSERVER_LIST_LOCK_EXCLUSIVE();
1765 LIST_REMOVE(fd_data, chain);
1766 NECP_OBSERVER_LIST_UNLOCK();
1767 } else {
1768 NECP_FD_LIST_LOCK_EXCLUSIVE();
1769 LIST_REMOVE(fd_data, chain);
1770 NECP_FD_LIST_UNLOCK();
1771 }
1772
1773 NECP_FD_LOCK(fd_data);
1774 pid_t pid = fd_data->proc_pid;
1775
1776 struct _necp_flow_defunct_list defunct_list;
1777 LIST_INIT(&defunct_list);
1778
1779 (void)necp_defunct_client_fd_locked_inner(fd_data, &defunct_list, false);
1780
1781 struct necp_client_flow_registration *flow_registration = NULL;
1782 struct necp_client_flow_registration *temp_flow_registration = NULL;
1783 RB_FOREACH_SAFE(flow_registration, _necp_fd_flow_tree, &fd_data->flows, temp_flow_registration) {
1784 #if SKYWALK
1785 necp_destroy_flow_stats(fd_data, flow_registration, NULL, TRUE);
1786 #endif /* SKYWALK */
1787 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
1788 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
1789 NECP_FLOW_TREE_UNLOCK();
1790 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
1791 }
1792
1793 struct necp_client *client = NULL;
1794 struct necp_client *temp_client = NULL;
1795 RB_FOREACH_SAFE(client, _necp_client_tree, &fd_data->clients, temp_client) {
1796 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
1797 RB_REMOVE(_necp_client_global_tree, &necp_client_global_tree, client);
1798 NECP_CLIENT_TREE_UNLOCK();
1799 RB_REMOVE(_necp_client_tree, &fd_data->clients, client);
1800 RB_INSERT(_necp_client_tree, &clients_to_close, client);
1801 }
1802
1803 struct necp_client_update *client_update = NULL;
1804 struct necp_client_update *temp_update = NULL;
1805 TAILQ_FOREACH_SAFE(client_update, &fd_data->update_list, chain, temp_update) {
1806 // Flush pending updates
1807 TAILQ_REMOVE(&fd_data->update_list, client_update, chain);
1808 necp_client_update_free(client_update);
1809 }
1810 fd_data->update_count = 0;
1811
1812 #if SKYWALK
1813 // Cleanup stats arena(s); indicate that we're closing
1814 necp_stats_arenas_destroy(fd_data, TRUE);
1815 ASSERT(fd_data->stats_arena_active == NULL);
1816 ASSERT(LIST_EMPTY(&fd_data->stats_arena_list));
1817
1818 // Cleanup systctl arena
1819 necp_sysctl_arena_destroy(fd_data);
1820 ASSERT(fd_data->sysctl_arena == NULL);
1821 #endif /* SKYWALK */
1822
1823 NECP_FD_UNLOCK(fd_data);
1824
1825 selthreadclear(&fd_data->si);
1826
1827 lck_mtx_destroy(&fd_data->fd_lock, &necp_fd_mtx_grp);
1828
1829 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
1830 OSDecrementAtomic(&necp_observer_fd_count);
1831 } else {
1832 OSDecrementAtomic(&necp_client_fd_count);
1833 }
1834
1835 kfree_type(struct necp_fd_data, fd_data);
1836
1837 RB_FOREACH_SAFE(client, _necp_client_tree, &clients_to_close, temp_client) {
1838 RB_REMOVE(_necp_client_tree, &clients_to_close, client);
1839 necp_destroy_client(client, pid, true);
1840 }
1841
1842 necp_process_defunct_list(&defunct_list);
1843 }
1844
1845 return error;
1846 }
1847
1848 /// NECP client utilities
1849
1850 static inline bool
necp_address_is_wildcard(const union necp_sockaddr_union * const addr)1851 necp_address_is_wildcard(const union necp_sockaddr_union * const addr)
1852 {
1853 return (addr->sa.sa_family == AF_INET && addr->sin.sin_addr.s_addr == INADDR_ANY) ||
1854 (addr->sa.sa_family == AF_INET6 && IN6_IS_ADDR_UNSPECIFIED(&addr->sin6.sin6_addr));
1855 }
1856
1857 static int
necp_find_fd_data(struct proc * p,int fd,struct fileproc ** fpp,struct necp_fd_data ** fd_data)1858 necp_find_fd_data(struct proc *p, int fd,
1859 struct fileproc **fpp, struct necp_fd_data **fd_data)
1860 {
1861 struct fileproc *fp;
1862 int error = fp_get_ftype(p, fd, DTYPE_NETPOLICY, ENODEV, &fp);
1863
1864 if (error == 0) {
1865 *fd_data = (struct necp_fd_data *)fp_get_data(fp);
1866 *fpp = fp;
1867
1868 if ((*fd_data)->necp_fd_type != necp_fd_type_client) {
1869 // Not a client fd, ignore
1870 fp_drop(p, fd, fp, 0);
1871 error = EINVAL;
1872 }
1873 }
1874 return error;
1875 }
1876
1877 static void
necp_client_add_nexus_flow(struct necp_client_flow_registration * flow_registration,uuid_t nexus_agent,uint32_t interface_index,uint16_t interface_flags)1878 necp_client_add_nexus_flow(struct necp_client_flow_registration *flow_registration,
1879 uuid_t nexus_agent,
1880 uint32_t interface_index,
1881 uint16_t interface_flags)
1882 {
1883 struct necp_client_flow *new_flow = kalloc_type(struct necp_client_flow, Z_WAITOK | Z_ZERO | Z_NOFAIL);
1884
1885 new_flow->nexus = TRUE;
1886 uuid_copy(new_flow->u.nexus_agent, nexus_agent);
1887 new_flow->interface_index = interface_index;
1888 new_flow->interface_flags = interface_flags;
1889 new_flow->check_tcp_heuristics = TRUE;
1890
1891 #if SKYWALK
1892 OSIncrementAtomic(&necp_nexus_flow_count);
1893 #endif /* SKYWALK */
1894
1895 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
1896
1897 #if SKYWALK
1898 necp_flow_save_current_interface_details(flow_registration);
1899 #endif /* SKYWALK */
1900 }
1901
1902 static void
necp_client_add_nexus_flow_if_needed(struct necp_client_flow_registration * flow_registration,uuid_t nexus_agent,uint32_t interface_index)1903 necp_client_add_nexus_flow_if_needed(struct necp_client_flow_registration *flow_registration,
1904 uuid_t nexus_agent,
1905 uint32_t interface_index)
1906 {
1907 struct necp_client_flow *flow = NULL;
1908 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1909 if (flow->nexus &&
1910 uuid_compare(flow->u.nexus_agent, nexus_agent) == 0) {
1911 return;
1912 }
1913 }
1914
1915 uint16_t interface_flags = 0;
1916 ifnet_t ifp = NULL;
1917 ifnet_head_lock_shared();
1918 if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
1919 ifp = ifindex2ifnet[interface_index];
1920 if (ifp != NULL) {
1921 ifnet_lock_shared(ifp);
1922 interface_flags = nstat_ifnet_to_flags(ifp);
1923 ifnet_lock_done(ifp);
1924 }
1925 }
1926 ifnet_head_done();
1927 necp_client_add_nexus_flow(flow_registration, nexus_agent, interface_index, interface_flags);
1928 }
1929
1930 static struct necp_client_flow *
necp_client_add_interface_flow(struct necp_client_flow_registration * flow_registration,uint32_t interface_index)1931 necp_client_add_interface_flow(struct necp_client_flow_registration *flow_registration,
1932 uint32_t interface_index)
1933 {
1934 struct necp_client_flow *new_flow = kalloc_type(struct necp_client_flow, Z_WAITOK | Z_ZERO | Z_NOFAIL);
1935
1936 // Neither nexus nor socket
1937 new_flow->interface_index = interface_index;
1938 new_flow->u.socket_handle = flow_registration->interface_handle;
1939 new_flow->u.cb = flow_registration->interface_cb;
1940
1941 OSIncrementAtomic(&necp_if_flow_count);
1942
1943 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
1944
1945 return new_flow;
1946 }
1947
1948 static struct necp_client_flow *
necp_client_add_interface_flow_if_needed(struct necp_client * client,struct necp_client_flow_registration * flow_registration,uint32_t interface_index)1949 necp_client_add_interface_flow_if_needed(struct necp_client *client,
1950 struct necp_client_flow_registration *flow_registration,
1951 uint32_t interface_index)
1952 {
1953 if (!client->allow_multiple_flows ||
1954 interface_index == IFSCOPE_NONE) {
1955 // Interface not set, or client not allowed to use this mode
1956 return NULL;
1957 }
1958
1959 struct necp_client_flow *flow = NULL;
1960 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1961 if (!flow->nexus && !flow->socket && flow->interface_index == interface_index) {
1962 // Already have the flow
1963 flow->invalid = FALSE;
1964 flow->u.socket_handle = flow_registration->interface_handle;
1965 flow->u.cb = flow_registration->interface_cb;
1966 return NULL;
1967 }
1968 }
1969 return necp_client_add_interface_flow(flow_registration, interface_index);
1970 }
1971
1972 static void
necp_client_add_interface_option_if_needed(struct necp_client * client,uint32_t interface_index,uint32_t interface_generation,uuid_t * nexus_agent,bool network_provider)1973 necp_client_add_interface_option_if_needed(struct necp_client *client,
1974 uint32_t interface_index,
1975 uint32_t interface_generation,
1976 uuid_t *nexus_agent,
1977 bool network_provider)
1978 {
1979 if ((interface_index == IFSCOPE_NONE && !network_provider) ||
1980 (client->interface_option_count != 0 && !client->allow_multiple_flows)) {
1981 // Interface not set, or client not allowed to use this mode
1982 return;
1983 }
1984
1985 if (client->interface_option_count >= NECP_CLIENT_MAX_INTERFACE_OPTIONS) {
1986 // Cannot take any more interface options
1987 return;
1988 }
1989
1990 // Check if already present
1991 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
1992 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
1993 struct necp_client_interface_option *option = &client->interface_options[option_i];
1994 if (option->interface_index == interface_index) {
1995 if (nexus_agent == NULL) {
1996 return;
1997 }
1998 if (uuid_compare(option->nexus_agent, *nexus_agent) == 0) {
1999 return;
2000 }
2001 if (uuid_is_null(option->nexus_agent)) {
2002 uuid_copy(option->nexus_agent, *nexus_agent);
2003 return;
2004 }
2005 // If we get to this point, this is a new nexus flow
2006 }
2007 } else {
2008 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
2009 if (option->interface_index == interface_index) {
2010 if (nexus_agent == NULL) {
2011 return;
2012 }
2013 if (uuid_compare(option->nexus_agent, *nexus_agent) == 0) {
2014 return;
2015 }
2016 if (uuid_is_null(option->nexus_agent)) {
2017 uuid_copy(option->nexus_agent, *nexus_agent);
2018 return;
2019 }
2020 // If we get to this point, this is a new nexus flow
2021 }
2022 }
2023 }
2024
2025 // Add a new entry
2026 if (client->interface_option_count < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
2027 // Add to static
2028 struct necp_client_interface_option *option = &client->interface_options[client->interface_option_count];
2029 option->interface_index = interface_index;
2030 option->interface_generation = interface_generation;
2031 if (nexus_agent != NULL) {
2032 uuid_copy(option->nexus_agent, *nexus_agent);
2033 } else {
2034 uuid_clear(option->nexus_agent);
2035 }
2036 client->interface_option_count++;
2037 } else {
2038 // Add to extra
2039 if (client->extra_interface_options == NULL) {
2040 client->extra_interface_options = (struct necp_client_interface_option *)kalloc_data(
2041 sizeof(struct necp_client_interface_option) * NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT, Z_WAITOK | Z_ZERO);
2042 }
2043 if (client->extra_interface_options != NULL) {
2044 struct necp_client_interface_option *option = &client->extra_interface_options[client->interface_option_count - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
2045 option->interface_index = interface_index;
2046 option->interface_generation = interface_generation;
2047 if (nexus_agent != NULL) {
2048 uuid_copy(option->nexus_agent, *nexus_agent);
2049 } else {
2050 uuid_clear(option->nexus_agent);
2051 }
2052 client->interface_option_count++;
2053 }
2054 }
2055 }
2056
2057 static bool
necp_client_flow_is_viable(proc_t proc,struct necp_client * client,struct necp_client_flow * flow)2058 necp_client_flow_is_viable(proc_t proc, struct necp_client *client,
2059 struct necp_client_flow *flow)
2060 {
2061 struct necp_aggregate_result result;
2062 bool ignore_address = (client->allow_multiple_flows && !flow->nexus && !flow->socket);
2063
2064 flow->necp_flow_flags = 0;
2065 int error = necp_application_find_policy_match_internal(proc, client->parameters,
2066 (u_int32_t)client->parameters_length,
2067 &result, &flow->necp_flow_flags, NULL,
2068 flow->interface_index,
2069 &flow->local_addr, &flow->remote_addr, NULL, NULL,
2070 NULL, ignore_address, true, NULL);
2071
2072 // Check for blocking agents
2073 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
2074 if (uuid_is_null(result.netagents[i])) {
2075 // Passed end of valid agents
2076 break;
2077 }
2078 if (result.netagent_use_flags[i] & NECP_AGENT_USE_FLAG_REMOVE) {
2079 // A removed agent, ignore
2080 continue;
2081 }
2082 u_int32_t flags = netagent_get_flags(result.netagents[i]);
2083 if ((flags & NETAGENT_FLAG_REGISTERED) &&
2084 !(flags & NETAGENT_FLAG_VOLUNTARY) &&
2085 !(flags & NETAGENT_FLAG_ACTIVE) &&
2086 !(flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY)) {
2087 // A required agent is not active, cause the flow to be marked non-viable
2088 return false;
2089 }
2090 }
2091
2092 if (flow->interface_index != IFSCOPE_NONE) {
2093 ifnet_head_lock_shared();
2094
2095 struct ifnet *ifp = ifindex2ifnet[flow->interface_index];
2096 if (ifp && ifp->if_delegated.ifp != IFSCOPE_NONE) {
2097 flow->delegated_interface_index = ifp->if_delegated.ifp->if_index;
2098 }
2099
2100 ifnet_head_done();
2101 }
2102
2103 return error == 0 &&
2104 result.routed_interface_index != IFSCOPE_NONE &&
2105 result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP;
2106 }
2107
2108 static void
necp_flow_add_interface_flows(proc_t proc,struct necp_client * client,struct necp_client_flow_registration * flow_registration,bool send_initial)2109 necp_flow_add_interface_flows(proc_t proc,
2110 struct necp_client *client,
2111 struct necp_client_flow_registration *flow_registration,
2112 bool send_initial)
2113 {
2114 // Traverse all interfaces and add a tracking flow if needed
2115 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
2116 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
2117 struct necp_client_interface_option *option = &client->interface_options[option_i];
2118 struct necp_client_flow *flow = necp_client_add_interface_flow_if_needed(client, flow_registration, option->interface_index);
2119 if (flow != NULL && send_initial) {
2120 flow->viable = necp_client_flow_is_viable(proc, client, flow);
2121 if (flow->viable && flow->u.cb) {
2122 bool viable = flow->viable;
2123 flow->u.cb(flow_registration->interface_handle, NECP_CLIENT_CBACTION_INITIAL, flow->interface_index, flow->necp_flow_flags, &viable);
2124 flow->viable = viable;
2125 }
2126 }
2127 } else {
2128 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
2129 struct necp_client_flow *flow = necp_client_add_interface_flow_if_needed(client, flow_registration, option->interface_index);
2130 if (flow != NULL && send_initial) {
2131 flow->viable = necp_client_flow_is_viable(proc, client, flow);
2132 if (flow->viable && flow->u.cb) {
2133 bool viable = flow->viable;
2134 flow->u.cb(flow_registration->interface_handle, NECP_CLIENT_CBACTION_INITIAL, flow->interface_index, flow->necp_flow_flags, &viable);
2135 flow->viable = viable;
2136 }
2137 }
2138 }
2139 }
2140 }
2141
2142 static bool
necp_client_update_flows(proc_t proc,struct necp_client * client,struct _necp_flow_defunct_list * defunct_list)2143 necp_client_update_flows(proc_t proc,
2144 struct necp_client *client,
2145 struct _necp_flow_defunct_list *defunct_list)
2146 {
2147 NECP_CLIENT_ASSERT_LOCKED(client);
2148
2149 bool any_client_updated = FALSE;
2150 struct necp_client_flow *flow = NULL;
2151 struct necp_client_flow *temp_flow = NULL;
2152 struct necp_client_flow_registration *flow_registration = NULL;
2153 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
2154 if (flow_registration->interface_cb != NULL) {
2155 // Add any interface flows that are not already tracked
2156 necp_flow_add_interface_flows(proc, client, flow_registration, false);
2157 }
2158
2159 LIST_FOREACH_SAFE(flow, &flow_registration->flow_list, flow_chain, temp_flow) {
2160 bool client_updated = FALSE;
2161
2162 // Check policy result for flow
2163 u_short old_delegated_ifindex = flow->delegated_interface_index;
2164
2165 int old_flags = flow->necp_flow_flags;
2166 bool viable = necp_client_flow_is_viable(proc, client, flow);
2167
2168 // TODO: Defunct nexus flows that are blocked by policy
2169
2170 if (flow->viable != viable) {
2171 flow->viable = viable;
2172 client_updated = TRUE;
2173 }
2174
2175 if ((old_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE) !=
2176 (flow->necp_flow_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE)) {
2177 client_updated = TRUE;
2178 }
2179
2180 if (flow->delegated_interface_index != old_delegated_ifindex) {
2181 client_updated = TRUE;
2182 }
2183
2184 if (flow->viable && client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) {
2185 bool flow_viable = flow->viable;
2186 flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_VIABLE, flow->interface_index, flow->necp_flow_flags, &flow_viable);
2187 flow->viable = flow_viable;
2188 }
2189
2190 if (!flow->viable || flow->invalid) {
2191 if (client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) {
2192 bool flow_viable = flow->viable;
2193 flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_NONVIABLE, flow->interface_index, flow->necp_flow_flags, &flow_viable);
2194 flow->viable = flow_viable;
2195 }
2196 // The callback might change the viable-flag of the
2197 // flow depending on its policy. Thus, we need to
2198 // check the flags again after the callback.
2199 }
2200
2201 #if SKYWALK
2202 if (defunct_list != NULL) {
2203 if (flow->invalid && flow->nexus && flow->assigned && !uuid_is_null(flow->u.nexus_agent)) {
2204 // This is a nexus flow that was assigned, but not found on path
2205 u_int32_t flags = netagent_get_flags(flow->u.nexus_agent);
2206 if (!(flags & NETAGENT_FLAG_REGISTERED)) {
2207 // The agent is no longer registered! Mark defunct.
2208 necp_defunct_flow_registration(client, flow_registration, defunct_list);
2209 client_updated = TRUE;
2210 }
2211 }
2212 }
2213 #else /* !SKYWALK */
2214 (void)defunct_list;
2215 #endif /* !SKYWALK */
2216
2217 // Handle flows that no longer match
2218 if (!flow->viable || flow->invalid) {
2219 // Drop them as long as they aren't assigned data
2220 if (!flow->nexus && !flow->assigned) {
2221 if (flow->assigned_results != NULL) {
2222 kfree_data(flow->assigned_results, flow->assigned_results_length);
2223 flow->assigned_results = NULL;
2224 client_updated = TRUE;
2225 }
2226 LIST_REMOVE(flow, flow_chain);
2227 #if SKYWALK
2228 if (flow->nexus) {
2229 OSDecrementAtomic(&necp_nexus_flow_count);
2230 } else
2231 #endif /* SKYWALK */
2232 if (flow->socket) {
2233 OSDecrementAtomic(&necp_socket_flow_count);
2234 } else {
2235 OSDecrementAtomic(&necp_if_flow_count);
2236 }
2237 kfree_type(struct necp_client_flow, flow);
2238 }
2239 }
2240
2241 any_client_updated |= client_updated;
2242 }
2243 #if SKYWALK
2244 necp_flow_save_current_interface_details(flow_registration);
2245 #endif /* SKYWALK */
2246 }
2247
2248 return any_client_updated;
2249 }
2250
2251 static void
necp_client_mark_all_nonsocket_flows_as_invalid(struct necp_client * client)2252 necp_client_mark_all_nonsocket_flows_as_invalid(struct necp_client *client)
2253 {
2254 struct necp_client_flow_registration *flow_registration = NULL;
2255 struct necp_client_flow *flow = NULL;
2256 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
2257 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
2258 if (!flow->socket) { // Socket flows are not marked as invalid
2259 flow->invalid = TRUE;
2260 }
2261 }
2262 }
2263
2264 // Reset option count every update
2265 client->interface_option_count = 0;
2266 }
2267
2268 static inline bool
necp_netagent_is_requested(const struct necp_client_parsed_parameters * parameters,uuid_t * netagent_uuid)2269 necp_netagent_is_requested(const struct necp_client_parsed_parameters *parameters,
2270 uuid_t *netagent_uuid)
2271 {
2272 // Specific use agents only apply when requested
2273 bool requested = false;
2274 if (parameters != NULL) {
2275 // Check required agent UUIDs
2276 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2277 if (uuid_is_null(parameters->required_netagents[i])) {
2278 break;
2279 }
2280 if (uuid_compare(parameters->required_netagents[i], *netagent_uuid) == 0) {
2281 requested = true;
2282 break;
2283 }
2284 }
2285
2286 if (!requested) {
2287 // Check required agent types
2288 bool fetched_type = false;
2289 char netagent_domain[NETAGENT_DOMAINSIZE];
2290 char netagent_type[NETAGENT_TYPESIZE];
2291 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
2292 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
2293
2294 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2295 if (strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
2296 strlen(parameters->required_netagent_types[i].netagent_type) == 0) {
2297 break;
2298 }
2299
2300 if (!fetched_type) {
2301 if (netagent_get_agent_domain_and_type(*netagent_uuid, netagent_domain, netagent_type)) {
2302 fetched_type = TRUE;
2303 } else {
2304 break;
2305 }
2306 }
2307
2308 if ((strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
2309 strncmp(netagent_domain, parameters->required_netagent_types[i].netagent_domain, NETAGENT_DOMAINSIZE) == 0) &&
2310 (strlen(parameters->required_netagent_types[i].netagent_type) == 0 ||
2311 strncmp(netagent_type, parameters->required_netagent_types[i].netagent_type, NETAGENT_TYPESIZE) == 0)) {
2312 requested = true;
2313 break;
2314 }
2315 }
2316 }
2317
2318 // Check preferred agent UUIDs
2319 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2320 if (uuid_is_null(parameters->preferred_netagents[i])) {
2321 break;
2322 }
2323 if (uuid_compare(parameters->preferred_netagents[i], *netagent_uuid) == 0) {
2324 requested = true;
2325 break;
2326 }
2327 }
2328
2329 if (!requested) {
2330 // Check preferred agent types
2331 bool fetched_type = false;
2332 char netagent_domain[NETAGENT_DOMAINSIZE];
2333 char netagent_type[NETAGENT_TYPESIZE];
2334 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
2335 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
2336
2337 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2338 if (strlen(parameters->preferred_netagent_types[i].netagent_domain) == 0 ||
2339 strlen(parameters->preferred_netagent_types[i].netagent_type) == 0) {
2340 break;
2341 }
2342
2343 if (!fetched_type) {
2344 if (netagent_get_agent_domain_and_type(*netagent_uuid, netagent_domain, netagent_type)) {
2345 fetched_type = TRUE;
2346 } else {
2347 break;
2348 }
2349 }
2350
2351 if ((strlen(parameters->preferred_netagent_types[i].netagent_domain) == 0 ||
2352 strncmp(netagent_domain, parameters->preferred_netagent_types[i].netagent_domain, NETAGENT_DOMAINSIZE) == 0) &&
2353 (strlen(parameters->preferred_netagent_types[i].netagent_type) == 0 ||
2354 strncmp(netagent_type, parameters->preferred_netagent_types[i].netagent_type, NETAGENT_TYPESIZE) == 0)) {
2355 requested = true;
2356 break;
2357 }
2358 }
2359 }
2360 }
2361
2362 return requested;
2363 }
2364
2365 static bool
necp_netagent_applies_to_client(struct necp_client * client,const struct necp_client_parsed_parameters * parameters,uuid_t * netagent_uuid,bool allow_nexus,uint32_t interface_index,uint32_t interface_generation)2366 necp_netagent_applies_to_client(struct necp_client *client,
2367 const struct necp_client_parsed_parameters *parameters,
2368 uuid_t *netagent_uuid, bool allow_nexus,
2369 uint32_t interface_index, uint32_t interface_generation)
2370 {
2371 #pragma unused(interface_index, interface_generation)
2372 bool applies = FALSE;
2373 u_int32_t flags = netagent_get_flags(*netagent_uuid);
2374 if (!(flags & NETAGENT_FLAG_REGISTERED)) {
2375 // Unregistered agents never apply
2376 return applies;
2377 }
2378
2379 const bool is_nexus_agent = ((flags & NETAGENT_FLAG_NEXUS_PROVIDER) ||
2380 (flags & NETAGENT_FLAG_NEXUS_LISTENER) ||
2381 (flags & NETAGENT_FLAG_CUSTOM_ETHER_NEXUS) ||
2382 (flags & NETAGENT_FLAG_CUSTOM_IP_NEXUS) ||
2383 (flags & NETAGENT_FLAG_INTERPOSE_NEXUS));
2384 if (is_nexus_agent) {
2385 if (!allow_nexus) {
2386 // Hide nexus providers unless allowed
2387 // Direct interfaces and direct policies are allowed to use a nexus
2388 // Delegate interfaces or re-scoped interfaces are not allowed
2389 return applies;
2390 }
2391
2392 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) &&
2393 !(flags & NETAGENT_FLAG_CUSTOM_ETHER_NEXUS)) {
2394 // Client requested a custom ether nexus, but this nexus isn't one
2395 return applies;
2396 }
2397
2398 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP) &&
2399 !(flags & NETAGENT_FLAG_CUSTOM_IP_NEXUS)) {
2400 // Client requested a custom IP nexus, but this nexus isn't one
2401 return applies;
2402 }
2403
2404 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) &&
2405 !(flags & NETAGENT_FLAG_INTERPOSE_NEXUS)) {
2406 // Client requested an interpose nexus, but this nexus isn't one
2407 return applies;
2408 }
2409
2410 if (!(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) &&
2411 !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP) &&
2412 !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) &&
2413 !(flags & NETAGENT_FLAG_NEXUS_PROVIDER)) {
2414 // Client requested default parameters, but this nexus isn't generic
2415 return applies;
2416 }
2417 }
2418
2419 if (uuid_compare(client->failed_trigger_agent.netagent_uuid, *netagent_uuid) == 0) {
2420 if (client->failed_trigger_agent.generation == netagent_get_generation(*netagent_uuid)) {
2421 // If this agent was triggered, and failed, and hasn't changed, keep hiding it
2422 return applies;
2423 } else {
2424 // Mismatch generation, clear out old trigger
2425 uuid_clear(client->failed_trigger_agent.netagent_uuid);
2426 client->failed_trigger_agent.generation = 0;
2427 }
2428 }
2429
2430 if (flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY) {
2431 // Specific use agents only apply when requested
2432 applies = necp_netagent_is_requested(parameters, netagent_uuid);
2433 } else {
2434 applies = TRUE;
2435 }
2436
2437 #if SKYWALK
2438 // Add nexus agent if it is a nexus, and either is not a listener, or the nexus supports listeners
2439 if (applies && is_nexus_agent &&
2440 !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) && // Don't add for browse paths
2441 ((flags & NETAGENT_FLAG_NEXUS_LISTENER) || !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER))) {
2442 necp_client_add_interface_option_if_needed(client, interface_index,
2443 interface_generation, netagent_uuid,
2444 (flags & NETAGENT_FLAG_NETWORK_PROVIDER));
2445 }
2446 #endif /* SKYWALK */
2447
2448 return applies;
2449 }
2450
2451 static void
necp_client_add_agent_interface_options(struct necp_client * client,const struct necp_client_parsed_parameters * parsed_parameters,ifnet_t ifp)2452 necp_client_add_agent_interface_options(struct necp_client *client,
2453 const struct necp_client_parsed_parameters *parsed_parameters,
2454 ifnet_t ifp)
2455 {
2456 if (ifp != NULL && ifp->if_agentids != NULL) {
2457 for (u_int32_t i = 0; i < ifp->if_agentcount; i++) {
2458 if (uuid_is_null(ifp->if_agentids[i])) {
2459 continue;
2460 }
2461 // Relies on the side effect that nexus agents that apply will create flows
2462 (void)necp_netagent_applies_to_client(client, parsed_parameters, &ifp->if_agentids[i], TRUE,
2463 ifp->if_index, ifnet_get_generation(ifp));
2464 }
2465 }
2466 }
2467
2468 static void
necp_client_add_browse_interface_options(struct necp_client * client,const struct necp_client_parsed_parameters * parsed_parameters,ifnet_t ifp)2469 necp_client_add_browse_interface_options(struct necp_client *client,
2470 const struct necp_client_parsed_parameters *parsed_parameters,
2471 ifnet_t ifp)
2472 {
2473 if (ifp != NULL && ifp->if_agentids != NULL) {
2474 for (u_int32_t i = 0; i < ifp->if_agentcount; i++) {
2475 if (uuid_is_null(ifp->if_agentids[i])) {
2476 continue;
2477 }
2478
2479 u_int32_t flags = netagent_get_flags(ifp->if_agentids[i]);
2480 if ((flags & NETAGENT_FLAG_REGISTERED) &&
2481 (flags & NETAGENT_FLAG_ACTIVE) &&
2482 (flags & NETAGENT_FLAG_SUPPORTS_BROWSE) &&
2483 (!(flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY) ||
2484 necp_netagent_is_requested(parsed_parameters, &ifp->if_agentids[i]))) {
2485 necp_client_add_interface_option_if_needed(client, ifp->if_index, ifnet_get_generation(ifp), &ifp->if_agentids[i], (flags & NETAGENT_FLAG_NETWORK_PROVIDER));
2486
2487 // Finding one is enough
2488 break;
2489 }
2490 }
2491 }
2492 }
2493
2494 static inline bool
_necp_client_address_is_valid(struct sockaddr * address)2495 _necp_client_address_is_valid(struct sockaddr *address)
2496 {
2497 if (address->sa_family == AF_INET) {
2498 return address->sa_len == sizeof(struct sockaddr_in);
2499 } else if (address->sa_family == AF_INET6) {
2500 return address->sa_len == sizeof(struct sockaddr_in6);
2501 } else {
2502 return FALSE;
2503 }
2504 }
2505
2506 #define necp_client_address_is_valid(S) _necp_client_address_is_valid(SA(S))
2507
2508 static inline bool
necp_client_endpoint_is_unspecified(struct necp_client_endpoint * endpoint)2509 necp_client_endpoint_is_unspecified(struct necp_client_endpoint *endpoint)
2510 {
2511 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2512 if (endpoint->u.sa.sa_family == AF_INET) {
2513 return endpoint->u.sin.sin_addr.s_addr == INADDR_ANY;
2514 } else if (endpoint->u.sa.sa_family == AF_INET6) {
2515 return IN6_IS_ADDR_UNSPECIFIED(&endpoint->u.sin6.sin6_addr);
2516 } else {
2517 return TRUE;
2518 }
2519 } else {
2520 return TRUE;
2521 }
2522 }
2523
2524 #if SKYWALK
2525 static void
necp_client_update_local_port_parameters(u_int8_t * parameters,u_int32_t parameters_size,uint16_t local_port)2526 necp_client_update_local_port_parameters(u_int8_t *parameters,
2527 u_int32_t parameters_size,
2528 uint16_t local_port)
2529 {
2530 size_t offset = 0;
2531 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
2532 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
2533 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
2534
2535 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
2536 // If the length is larger than what can fit in the remaining parameters size, bail
2537 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
2538 break;
2539 }
2540
2541 if (length > 0) {
2542 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
2543 if (value != NULL) {
2544 switch (type) {
2545 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: {
2546 if (length >= sizeof(struct necp_policy_condition_addr)) {
2547 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
2548 if (necp_client_address_is_valid(&address_struct->address.sa)) {
2549 if (address_struct->address.sa.sa_family == AF_INET) {
2550 address_struct->address.sin.sin_port = local_port;
2551 } else if (address_struct->address.sa.sa_family == AF_INET6) {
2552 address_struct->address.sin6.sin6_port = local_port;
2553 }
2554 }
2555 }
2556 break;
2557 }
2558 case NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT: {
2559 if (length >= sizeof(struct necp_client_endpoint)) {
2560 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2561 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2562 if (endpoint->u.sa.sa_family == AF_INET) {
2563 endpoint->u.sin.sin_port = local_port;
2564 } else if (endpoint->u.sa.sa_family == AF_INET6) {
2565 endpoint->u.sin6.sin6_port = local_port;
2566 }
2567 }
2568 }
2569 break;
2570 }
2571 default: {
2572 break;
2573 }
2574 }
2575 }
2576 }
2577
2578 offset += sizeof(struct necp_tlv_header) + length;
2579 }
2580 }
2581 #endif /* !SKYWALK */
2582
2583 #define NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH 253
2584
2585 static void
necp_client_trace_parameter_parsing(struct necp_client * client,u_int8_t type,u_int8_t * value,u_int32_t length)2586 necp_client_trace_parameter_parsing(struct necp_client *client, u_int8_t type, u_int8_t *value, u_int32_t length)
2587 {
2588 uint64_t num = 0;
2589 uint16_t shortBuf;
2590 uint32_t intBuf;
2591 char buffer[NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH + 1];
2592
2593 if (value != NULL && length > 0) {
2594 switch (length) {
2595 case 1:
2596 num = *value;
2597 break;
2598 case 2:
2599 memcpy(&shortBuf, value, sizeof(shortBuf));
2600 num = shortBuf;
2601 break;
2602 case 4:
2603 memcpy(&intBuf, value, sizeof(intBuf));
2604 num = intBuf;
2605 break;
2606 case 8:
2607 memcpy(&num, value, sizeof(num));
2608 break;
2609 default:
2610 num = 0;
2611 break;
2612 }
2613 int len = NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH < length ? NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH : length;
2614 memcpy(buffer, value, len);
2615 buffer[len] = 0;
2616 NECP_CLIENT_PARAMS_LOG(client, "Parsing param - type %d length %d value <%llu (%llX)> %s", type, length, num, num, buffer);
2617 } else {
2618 NECP_CLIENT_PARAMS_LOG(client, "Parsing param - type %d length %d", type, length);
2619 }
2620 }
2621
2622 static void
necp_client_trace_parsed_parameters(struct necp_client * client,struct necp_client_parsed_parameters * parsed_parameters)2623 necp_client_trace_parsed_parameters(struct necp_client *client, struct necp_client_parsed_parameters *parsed_parameters)
2624 {
2625 int i;
2626 char local_buffer[64] = { };
2627 char remote_buffer[64] = { };
2628 uuid_string_t uuid_str = { };
2629 uuid_unparse_lower(parsed_parameters->effective_uuid, uuid_str);
2630
2631 switch (parsed_parameters->local_addr.sa.sa_family) {
2632 case AF_INET:
2633 if (parsed_parameters->local_addr.sa.sa_len == sizeof(struct sockaddr_in)) {
2634 struct sockaddr_in *addr = &parsed_parameters->local_addr.sin;
2635 inet_ntop(AF_INET, &(addr->sin_addr), local_buffer, sizeof(local_buffer));
2636 }
2637 break;
2638 case AF_INET6:
2639 if (parsed_parameters->local_addr.sa.sa_len == sizeof(struct sockaddr_in6)) {
2640 struct sockaddr_in6 *addr6 = &parsed_parameters->local_addr.sin6;
2641 inet_ntop(AF_INET6, &(addr6->sin6_addr), local_buffer, sizeof(local_buffer));
2642 }
2643 break;
2644 default:
2645 break;
2646 }
2647
2648 switch (parsed_parameters->remote_addr.sa.sa_family) {
2649 case AF_INET:
2650 if (parsed_parameters->remote_addr.sa.sa_len == sizeof(struct sockaddr_in)) {
2651 struct sockaddr_in *addr = &parsed_parameters->remote_addr.sin;
2652 inet_ntop(AF_INET, &(addr->sin_addr), remote_buffer, sizeof(remote_buffer));
2653 }
2654 break;
2655 case AF_INET6:
2656 if (parsed_parameters->remote_addr.sa.sa_len == sizeof(struct sockaddr_in6)) {
2657 struct sockaddr_in6 *addr6 = &parsed_parameters->remote_addr.sin6;
2658 inet_ntop(AF_INET6, &(addr6->sin6_addr), remote_buffer, sizeof(remote_buffer));
2659 }
2660 break;
2661 default:
2662 break;
2663 }
2664
2665 NECP_CLIENT_PARAMS_LOG(client, "Parsed params - valid_fields %X flags %X delegated_upid %llu local_addr %s remote_addr %s "
2666 "required_interface_index %u required_interface_type %d local_address_preference %d "
2667 "ip_protocol %d transport_protocol %d ethertype %d effective_pid %d effective_uuid %s traffic_class %d",
2668 parsed_parameters->valid_fields,
2669 parsed_parameters->flags,
2670 parsed_parameters->delegated_upid,
2671 local_buffer, remote_buffer,
2672 parsed_parameters->required_interface_index,
2673 parsed_parameters->required_interface_type,
2674 parsed_parameters->local_address_preference,
2675 parsed_parameters->ip_protocol,
2676 parsed_parameters->transport_protocol,
2677 parsed_parameters->ethertype,
2678 parsed_parameters->effective_pid,
2679 uuid_str,
2680 parsed_parameters->traffic_class);
2681
2682 NECP_CLIENT_PARAMS_LOG(client, "Parsed params - tracker flags <known-tracker %X> <non-app-initiated %X> <silent %X> <app-approved %X>",
2683 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_KNOWN_TRACKER,
2684 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_NON_APP_INITIATED,
2685 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_SILENT,
2686 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_APPROVED_APP_DOMAIN);
2687
2688 for (i = 0; i < NECP_MAX_INTERFACE_PARAMETERS && parsed_parameters->prohibited_interfaces[i][0]; i++) {
2689 NECP_CLIENT_PARAMS_LOG(client, "Parsed prohibited_interfaces[%d] <%s>", i, parsed_parameters->prohibited_interfaces[i]);
2690 }
2691
2692 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->required_netagent_types[i].netagent_domain[0]; i++) {
2693 NECP_CLIENT_PARAMS_LOG(client, "Parsed required_netagent_types[%d] <%s> <%s>", i,
2694 parsed_parameters->required_netagent_types[i].netagent_domain,
2695 parsed_parameters->required_netagent_types[i].netagent_type);
2696 }
2697 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->prohibited_netagent_types[i].netagent_domain[0]; i++) {
2698 NECP_CLIENT_PARAMS_LOG(client, "Parsed prohibited_netagent_types[%d] <%s> <%s>", i,
2699 parsed_parameters->prohibited_netagent_types[i].netagent_domain,
2700 parsed_parameters->prohibited_netagent_types[i].netagent_type);
2701 }
2702 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->preferred_netagent_types[i].netagent_domain[0]; i++) {
2703 NECP_CLIENT_PARAMS_LOG(client, "Parsed preferred_netagent_types[%d] <%s> <%s>", i,
2704 parsed_parameters->preferred_netagent_types[i].netagent_domain,
2705 parsed_parameters->preferred_netagent_types[i].netagent_type);
2706 }
2707 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->avoided_netagent_types[i].netagent_domain[0]; i++) {
2708 NECP_CLIENT_PARAMS_LOG(client, "Parsed avoided_netagent_types[%d] <%s> <%s>", i,
2709 parsed_parameters->avoided_netagent_types[i].netagent_domain,
2710 parsed_parameters->avoided_netagent_types[i].netagent_type);
2711 }
2712
2713 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->required_netagents[i]); i++) {
2714 uuid_unparse_lower(parsed_parameters->required_netagents[i], uuid_str);
2715 NECP_CLIENT_PARAMS_LOG(client, "Parsed required_netagents[%d] <%s>", i, uuid_str);
2716 }
2717 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->prohibited_netagents[i]); i++) {
2718 uuid_unparse_lower(parsed_parameters->prohibited_netagents[i], uuid_str);
2719 NECP_CLIENT_PARAMS_LOG(client, "Parsed prohibited_netagents[%d] <%s>", i, uuid_str);
2720 }
2721 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->preferred_netagents[i]); i++) {
2722 uuid_unparse_lower(parsed_parameters->preferred_netagents[i], uuid_str);
2723 NECP_CLIENT_PARAMS_LOG(client, "Parsed preferred_netagents[%d] <%s>", i, uuid_str);
2724 }
2725 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->avoided_netagents[i]); i++) {
2726 uuid_unparse_lower(parsed_parameters->avoided_netagents[i], uuid_str);
2727 NECP_CLIENT_PARAMS_LOG(client, "Parsed avoided_netagents[%d] <%s>", i, uuid_str);
2728 }
2729 }
2730
2731 static bool
necp_client_strings_are_equal(const char * string1,size_t string1_length,const char * string2,size_t string2_length)2732 necp_client_strings_are_equal(const char *string1, size_t string1_length,
2733 const char *string2, size_t string2_length)
2734 {
2735 if (string1 == NULL || string2 == NULL) {
2736 return false;
2737 }
2738 const size_t string1_actual_length = strnlen(string1, string1_length);
2739 const size_t string2_actual_length = strnlen(string2, string2_length);
2740 if (string1_actual_length != string2_actual_length) {
2741 return false;
2742 }
2743 return strncmp(string1, string2, string1_actual_length) == 0;
2744 }
2745
2746 static int
necp_client_parse_parameters(struct necp_client * client,u_int8_t * parameters,u_int32_t parameters_size,struct necp_client_parsed_parameters * parsed_parameters)2747 necp_client_parse_parameters(struct necp_client *client, u_int8_t *parameters,
2748 u_int32_t parameters_size,
2749 struct necp_client_parsed_parameters *parsed_parameters)
2750 {
2751 int error = 0;
2752 size_t offset = 0;
2753
2754 u_int32_t num_prohibited_interfaces = 0;
2755 u_int32_t num_prohibited_interface_types = 0;
2756 u_int32_t num_required_agents = 0;
2757 u_int32_t num_prohibited_agents = 0;
2758 u_int32_t num_preferred_agents = 0;
2759 u_int32_t num_avoided_agents = 0;
2760 u_int32_t num_required_agent_types = 0;
2761 u_int32_t num_prohibited_agent_types = 0;
2762 u_int32_t num_preferred_agent_types = 0;
2763 u_int32_t num_avoided_agent_types = 0;
2764 u_int8_t *resolver_tag = NULL;
2765 u_int32_t resolver_tag_length = 0;
2766 u_int8_t *client_hostname = NULL;
2767 u_int32_t hostname_length = 0;
2768 uuid_t parent_id = {};
2769
2770 if (parsed_parameters == NULL) {
2771 return EINVAL;
2772 }
2773
2774 memset(parsed_parameters, 0, sizeof(struct necp_client_parsed_parameters));
2775
2776 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
2777 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
2778 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
2779
2780 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
2781 // If the length is larger than what can fit in the remaining parameters size, bail
2782 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
2783 break;
2784 }
2785
2786 if (length > 0) {
2787 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
2788 if (value != NULL) {
2789 switch (type) {
2790 case NECP_CLIENT_PARAMETER_BOUND_INTERFACE: {
2791 if (length <= IFXNAMSIZ && length > 0) {
2792 ifnet_t bound_interface = NULL;
2793 char interface_name[IFXNAMSIZ];
2794 memcpy(interface_name, value, length);
2795 interface_name[length - 1] = 0; // Make sure the string is NULL terminated
2796 if (ifnet_find_by_name(interface_name, &bound_interface) == 0) {
2797 parsed_parameters->required_interface_index = bound_interface->if_index;
2798 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF;
2799 ifnet_release(bound_interface);
2800 }
2801 }
2802 break;
2803 }
2804 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: {
2805 if (length >= sizeof(struct necp_policy_condition_addr)) {
2806 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
2807 if (necp_client_address_is_valid(&address_struct->address.sa)) {
2808 memcpy(&parsed_parameters->local_addr, &address_struct->address, sizeof(address_struct->address));
2809 if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
2810 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
2811 }
2812 if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
2813 (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
2814 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
2815 }
2816 }
2817 }
2818 break;
2819 }
2820 case NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT: {
2821 if (length >= sizeof(struct necp_client_endpoint)) {
2822 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2823 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2824 memcpy(&parsed_parameters->local_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
2825 if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
2826 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
2827 }
2828 if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
2829 (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
2830 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
2831 }
2832 }
2833 }
2834 break;
2835 }
2836 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
2837 if (length >= sizeof(struct necp_policy_condition_addr)) {
2838 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
2839 if (necp_client_address_is_valid(&address_struct->address.sa)) {
2840 memcpy(&parsed_parameters->remote_addr, &address_struct->address, sizeof(address_struct->address));
2841 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
2842 }
2843 }
2844 break;
2845 }
2846 case NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT: {
2847 if (length >= sizeof(struct necp_client_endpoint)) {
2848 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2849 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2850 memcpy(&parsed_parameters->remote_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
2851 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
2852 }
2853 }
2854 break;
2855 }
2856 case NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE: {
2857 if (num_prohibited_interfaces >= NECP_MAX_INTERFACE_PARAMETERS) {
2858 break;
2859 }
2860 if (length <= IFXNAMSIZ && length > 0) {
2861 memcpy(parsed_parameters->prohibited_interfaces[num_prohibited_interfaces], value, length);
2862 parsed_parameters->prohibited_interfaces[num_prohibited_interfaces][length - 1] = 0; // Make sure the string is NULL terminated
2863 num_prohibited_interfaces++;
2864 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF;
2865 }
2866 break;
2867 }
2868 case NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE: {
2869 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) {
2870 break;
2871 }
2872 if (length >= sizeof(u_int8_t)) {
2873 memcpy(&parsed_parameters->required_interface_type, value, sizeof(u_int8_t));
2874 if (parsed_parameters->required_interface_type) {
2875 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE;
2876 }
2877 }
2878 break;
2879 }
2880 case NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE: {
2881 if (num_prohibited_interface_types >= NECP_MAX_INTERFACE_PARAMETERS) {
2882 break;
2883 }
2884 if (length >= sizeof(u_int8_t)) {
2885 memcpy(&parsed_parameters->prohibited_interface_types[num_prohibited_interface_types], value, sizeof(u_int8_t));
2886 num_prohibited_interface_types++;
2887 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE;
2888 }
2889 break;
2890 }
2891 case NECP_CLIENT_PARAMETER_REQUIRE_AGENT: {
2892 if (num_required_agents >= NECP_MAX_AGENT_PARAMETERS) {
2893 break;
2894 }
2895 if (length >= sizeof(uuid_t)) {
2896 memcpy(&parsed_parameters->required_netagents[num_required_agents], value, sizeof(uuid_t));
2897 num_required_agents++;
2898 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT;
2899 }
2900 break;
2901 }
2902 case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT: {
2903 if (num_prohibited_agents >= NECP_MAX_AGENT_PARAMETERS) {
2904 break;
2905 }
2906 if (length >= sizeof(uuid_t)) {
2907 memcpy(&parsed_parameters->prohibited_netagents[num_prohibited_agents], value, sizeof(uuid_t));
2908 num_prohibited_agents++;
2909 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT;
2910 }
2911 break;
2912 }
2913 case NECP_CLIENT_PARAMETER_PREFER_AGENT: {
2914 if (num_preferred_agents >= NECP_MAX_AGENT_PARAMETERS) {
2915 break;
2916 }
2917 if (length >= sizeof(uuid_t)) {
2918 memcpy(&parsed_parameters->preferred_netagents[num_preferred_agents], value, sizeof(uuid_t));
2919 num_preferred_agents++;
2920 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT;
2921 }
2922 break;
2923 }
2924 case NECP_CLIENT_PARAMETER_AVOID_AGENT: {
2925 if (num_avoided_agents >= NECP_MAX_AGENT_PARAMETERS) {
2926 break;
2927 }
2928 if (length >= sizeof(uuid_t)) {
2929 memcpy(&parsed_parameters->avoided_netagents[num_avoided_agents], value, sizeof(uuid_t));
2930 num_avoided_agents++;
2931 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT;
2932 }
2933 break;
2934 }
2935 case NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE: {
2936 if (num_required_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2937 break;
2938 }
2939 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2940 memcpy(&parsed_parameters->required_netagent_types[num_required_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2941 num_required_agent_types++;
2942 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE;
2943 }
2944 break;
2945 }
2946 case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE: {
2947 if (num_prohibited_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2948 break;
2949 }
2950 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2951 memcpy(&parsed_parameters->prohibited_netagent_types[num_prohibited_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2952 num_prohibited_agent_types++;
2953 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE;
2954 }
2955 break;
2956 }
2957 case NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE: {
2958 if (num_preferred_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2959 break;
2960 }
2961 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2962 memcpy(&parsed_parameters->preferred_netagent_types[num_preferred_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2963 num_preferred_agent_types++;
2964 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE;
2965 }
2966 break;
2967 }
2968 case NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE: {
2969 if (num_avoided_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2970 break;
2971 }
2972 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2973 memcpy(&parsed_parameters->avoided_netagent_types[num_avoided_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2974 num_avoided_agent_types++;
2975 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE;
2976 }
2977 break;
2978 }
2979 case NECP_CLIENT_PARAMETER_FLAGS: {
2980 if (length >= sizeof(u_int32_t)) {
2981 memcpy(&parsed_parameters->flags, value, sizeof(parsed_parameters->flags));
2982 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_FLAGS;
2983 }
2984 break;
2985 }
2986 case NECP_CLIENT_PARAMETER_IP_PROTOCOL: {
2987 if (length == sizeof(u_int16_t)) {
2988 u_int16_t large_ip_protocol = 0;
2989 memcpy(&large_ip_protocol, value, sizeof(large_ip_protocol));
2990 parsed_parameters->ip_protocol = (u_int8_t)large_ip_protocol;
2991 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL;
2992 } else if (length >= sizeof(parsed_parameters->ip_protocol)) {
2993 memcpy(&parsed_parameters->ip_protocol, value, sizeof(parsed_parameters->ip_protocol));
2994 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL;
2995 }
2996 break;
2997 }
2998 case NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL: {
2999 if (length >= sizeof(parsed_parameters->transport_protocol)) {
3000 memcpy(&parsed_parameters->transport_protocol, value, sizeof(parsed_parameters->transport_protocol));
3001 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL;
3002 }
3003 break;
3004 }
3005 case NECP_CLIENT_PARAMETER_PID: {
3006 if (length >= sizeof(parsed_parameters->effective_pid)) {
3007 memcpy(&parsed_parameters->effective_pid, value, sizeof(parsed_parameters->effective_pid));
3008 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID;
3009 }
3010 break;
3011 }
3012 case NECP_CLIENT_PARAMETER_DELEGATED_UPID: {
3013 if (length >= sizeof(parsed_parameters->delegated_upid)) {
3014 memcpy(&parsed_parameters->delegated_upid, value, sizeof(parsed_parameters->delegated_upid));
3015 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID;
3016 }
3017 break;
3018 }
3019 case NECP_CLIENT_PARAMETER_ETHERTYPE: {
3020 if (length >= sizeof(parsed_parameters->ethertype)) {
3021 memcpy(&parsed_parameters->ethertype, value, sizeof(parsed_parameters->ethertype));
3022 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_ETHERTYPE;
3023 }
3024 break;
3025 }
3026 case NECP_CLIENT_PARAMETER_APPLICATION: {
3027 if (length >= sizeof(parsed_parameters->effective_uuid)) {
3028 memcpy(&parsed_parameters->effective_uuid, value, sizeof(parsed_parameters->effective_uuid));
3029 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID;
3030 }
3031 break;
3032 }
3033 case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: {
3034 if (length >= sizeof(parsed_parameters->traffic_class)) {
3035 memcpy(&parsed_parameters->traffic_class, value, sizeof(parsed_parameters->traffic_class));
3036 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS;
3037 }
3038 break;
3039 }
3040 case NECP_CLIENT_PARAMETER_RESOLVER_TAG: {
3041 if (length > 0) {
3042 if (resolver_tag != NULL) {
3043 // Multiple resolver tags is invalid
3044 NECPLOG0(LOG_ERR, "Multiple resolver tags are not supported");
3045 error = EINVAL;
3046 } else {
3047 resolver_tag = (u_int8_t *)value;
3048 resolver_tag_length = length;
3049 }
3050 }
3051 break;
3052 }
3053 case NECP_CLIENT_PARAMETER_DOMAIN: {
3054 if (length > 0) {
3055 client_hostname = (u_int8_t *)value;
3056 hostname_length = length;
3057 }
3058 break;
3059 }
3060 case NECP_CLIENT_PARAMETER_PARENT_ID: {
3061 if (length == sizeof(parent_id)) {
3062 uuid_copy(parent_id, value);
3063 memcpy(&parsed_parameters->parent_uuid, value, sizeof(parsed_parameters->parent_uuid));
3064 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PARENT_UUID;
3065 }
3066 break;
3067 }
3068 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE: {
3069 if (length >= sizeof(parsed_parameters->local_address_preference)) {
3070 memcpy(&parsed_parameters->local_address_preference, value, sizeof(parsed_parameters->local_address_preference));
3071 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE;
3072 }
3073 break;
3074 }
3075 case NECP_CLIENT_PARAMETER_ATTRIBUTED_BUNDLE_IDENTIFIER: {
3076 if (length > 0) {
3077 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER;
3078 }
3079 break;
3080 }
3081 case NECP_CLIENT_PARAMETER_FLOW_DEMUX_PATTERN: {
3082 if (parsed_parameters->demux_pattern_count >= NECP_MAX_DEMUX_PATTERNS) {
3083 break;
3084 }
3085 if (length >= sizeof(struct necp_demux_pattern)) {
3086 memcpy(&parsed_parameters->demux_patterns[parsed_parameters->demux_pattern_count], value, sizeof(struct necp_demux_pattern));
3087 parsed_parameters->demux_pattern_count++;
3088 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_FLOW_DEMUX_PATTERN;
3089 }
3090 break;
3091 }
3092 default: {
3093 break;
3094 }
3095 }
3096 }
3097
3098 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) {
3099 necp_client_trace_parameter_parsing(client, type, value, length);
3100 }
3101 }
3102
3103 offset += sizeof(struct necp_tlv_header) + length;
3104 }
3105
3106 if (resolver_tag != NULL) {
3107 struct necp_client_validatable *validatable = (struct necp_client_validatable *)resolver_tag;
3108 if (resolver_tag_length <= sizeof(struct necp_client_validatable)) {
3109 error = EINVAL;
3110 NECPLOG(LOG_ERR, "Resolver tag length too short: %u", resolver_tag_length);
3111 } else {
3112 bool matches = true;
3113
3114 // Check the client UUID for client-specific results
3115 if (validatable->signable.sign_type == NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER ||
3116 validatable->signable.sign_type == NECP_CLIENT_SIGN_TYPE_BROWSE_RESULT ||
3117 validatable->signable.sign_type == NECP_CLIENT_SIGN_TYPE_SERVICE_RESOLVER_ANSWER) {
3118 if (uuid_compare(parent_id, validatable->signable.client_id) != 0 &&
3119 uuid_compare(client->client_id, validatable->signable.client_id) != 0) {
3120 NECPLOG0(LOG_ERR, "Resolver tag invalid client ID");
3121 matches = false;
3122 }
3123 }
3124
3125 size_t data_length = resolver_tag_length - sizeof(struct necp_client_validatable);
3126 switch (validatable->signable.sign_type) {
3127 case NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER:
3128 case NECP_CLIENT_SIGN_TYPE_SYSTEM_RESOLVER_ANSWER: {
3129 if (data_length < (sizeof(struct necp_client_host_resolver_answer) - sizeof(struct necp_client_signable))) {
3130 NECPLOG0(LOG_ERR, "Resolver tag invalid length for resolver answer");
3131 matches = false;
3132 } else {
3133 struct necp_client_host_resolver_answer *answer_struct = (struct necp_client_host_resolver_answer *)&validatable->signable;
3134 if (data_length != (sizeof(struct necp_client_host_resolver_answer) + answer_struct->hostname_length - sizeof(struct necp_client_signable))) {
3135 NECPLOG0(LOG_ERR, "Resolver tag invalid length for resolver answer");
3136 matches = false;
3137 } else {
3138 if (answer_struct->hostname_length != 0 && // If the hostname on the signed answer is empty, ignore
3139 !necp_client_strings_are_equal((const char *)client_hostname, hostname_length,
3140 answer_struct->hostname, answer_struct->hostname_length)) {
3141 NECPLOG0(LOG_ERR, "Resolver tag hostname does not match");
3142 matches = false;
3143 } else if (answer_struct->address_answer.sa.sa_family != parsed_parameters->remote_addr.sa.sa_family ||
3144 answer_struct->address_answer.sa.sa_len != parsed_parameters->remote_addr.sa.sa_len) {
3145 NECPLOG0(LOG_ERR, "Resolver tag address type does not match");
3146 matches = false;
3147 } else if (answer_struct->address_answer.sin.sin_port != 0 && // If the port on the signed answer is empty, ignore
3148 answer_struct->address_answer.sin.sin_port != parsed_parameters->remote_addr.sin.sin_port) {
3149 NECPLOG0(LOG_ERR, "Resolver tag port does not match");
3150 matches = false;
3151 } else if ((answer_struct->address_answer.sa.sa_family == AF_INET &&
3152 answer_struct->address_answer.sin.sin_addr.s_addr != parsed_parameters->remote_addr.sin.sin_addr.s_addr) ||
3153 (answer_struct->address_answer.sa.sa_family == AF_INET6 &&
3154 memcmp(&answer_struct->address_answer.sin6.sin6_addr, &parsed_parameters->remote_addr.sin6.sin6_addr, sizeof(struct in6_addr)) != 0)) {
3155 NECPLOG0(LOG_ERR, "Resolver tag address does not match");
3156 matches = false;
3157 }
3158 }
3159 }
3160 break;
3161 }
3162 case NECP_CLIENT_SIGN_TYPE_BROWSE_RESULT:
3163 case NECP_CLIENT_SIGN_TYPE_SYSTEM_BROWSE_RESULT: {
3164 if (data_length < (sizeof(struct necp_client_browse_result) - sizeof(struct necp_client_signable))) {
3165 NECPLOG0(LOG_ERR, "Resolver tag invalid length for browse result");
3166 matches = false;
3167 } else {
3168 struct necp_client_browse_result *answer_struct = (struct necp_client_browse_result *)&validatable->signable;
3169 if (data_length != (sizeof(struct necp_client_browse_result) + answer_struct->service_length - sizeof(struct necp_client_signable))) {
3170 NECPLOG0(LOG_ERR, "Resolver tag invalid length for browse result");
3171 matches = false;
3172 }
3173 }
3174 break;
3175 }
3176 case NECP_CLIENT_SIGN_TYPE_SERVICE_RESOLVER_ANSWER:
3177 case NECP_CLIENT_SIGN_TYPE_SYSTEM_SERVICE_RESOLVER_ANSWER: {
3178 if (data_length < (sizeof(struct necp_client_service_resolver_answer) - sizeof(struct necp_client_signable))) {
3179 NECPLOG0(LOG_ERR, "Resolver tag invalid length for service resolver answer");
3180 matches = false;
3181 } else {
3182 struct necp_client_service_resolver_answer *answer_struct = (struct necp_client_service_resolver_answer *)&validatable->signable;
3183 if (data_length != (sizeof(struct necp_client_service_resolver_answer) + answer_struct->service_length + answer_struct->hostname_length - sizeof(struct necp_client_signable))) {
3184 NECPLOG0(LOG_ERR, "Resolver tag invalid length for service resolver answer");
3185 matches = false;
3186 }
3187 }
3188 break;
3189 }
3190 default: {
3191 NECPLOG(LOG_ERR, "Resolver tag unknown sign type: %u", validatable->signable.sign_type);
3192 matches = false;
3193 break;
3194 }
3195 }
3196 if (!matches) {
3197 error = EAUTH;
3198 } else {
3199 const bool validated = necp_validate_resolver_answer(validatable->signable.client_id,
3200 validatable->signable.sign_type,
3201 validatable->signable.signable_data, data_length,
3202 validatable->signature.signed_tag, sizeof(validatable->signature.signed_tag));
3203 if (!validated) {
3204 error = EAUTH;
3205 NECPLOG0(LOG_ERR, "Failed to validate resolve answer");
3206 }
3207 }
3208 }
3209 }
3210
3211 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) {
3212 necp_client_trace_parsed_parameters(client, parsed_parameters);
3213 }
3214
3215 return error;
3216 }
3217
3218 static int
necp_client_parse_result(u_int8_t * result,u_int32_t result_size,union necp_sockaddr_union * local_address,union necp_sockaddr_union * remote_address,void ** flow_stats)3219 necp_client_parse_result(u_int8_t *result,
3220 u_int32_t result_size,
3221 union necp_sockaddr_union *local_address,
3222 union necp_sockaddr_union *remote_address,
3223 void **flow_stats)
3224 {
3225 #pragma unused(flow_stats)
3226 int error = 0;
3227 size_t offset = 0;
3228
3229 while ((offset + sizeof(struct necp_tlv_header)) <= result_size) {
3230 u_int8_t type = necp_buffer_get_tlv_type(result, offset);
3231 u_int32_t length = necp_buffer_get_tlv_length(result, offset);
3232
3233 if (length > 0 && (offset + sizeof(struct necp_tlv_header) + length) <= result_size) {
3234 u_int8_t *value = necp_buffer_get_tlv_value(result, offset, NULL);
3235 if (value != NULL) {
3236 switch (type) {
3237 case NECP_CLIENT_RESULT_LOCAL_ENDPOINT: {
3238 if (length >= sizeof(struct necp_client_endpoint)) {
3239 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
3240 if (local_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
3241 memcpy(local_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
3242 }
3243 }
3244 break;
3245 }
3246 case NECP_CLIENT_RESULT_REMOTE_ENDPOINT: {
3247 if (length >= sizeof(struct necp_client_endpoint)) {
3248 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
3249 if (remote_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
3250 memcpy(remote_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
3251 }
3252 }
3253 break;
3254 }
3255 #if SKYWALK
3256 case NECP_CLIENT_RESULT_NEXUS_FLOW_STATS: {
3257 // this TLV contains flow_stats pointer which is refcnt'ed.
3258 if (flow_stats != NULL && length >= sizeof(struct sk_stats_flow *)) {
3259 struct flow_stats *fs = *(void **)(void *)value;
3260 // transfer the refcnt to flow_stats pointer
3261 *flow_stats = fs;
3262 }
3263 memset(value, 0, length); // nullify TLV always
3264 break;
3265 }
3266 #endif /* SKYWALK */
3267 default: {
3268 break;
3269 }
3270 }
3271 }
3272 }
3273
3274 offset += sizeof(struct necp_tlv_header) + length;
3275 }
3276
3277 return error;
3278 }
3279
3280 static struct necp_client_flow_registration *
necp_client_create_flow_registration(struct necp_fd_data * fd_data,struct necp_client * client)3281 necp_client_create_flow_registration(struct necp_fd_data *fd_data, struct necp_client *client)
3282 {
3283 NECP_FD_ASSERT_LOCKED(fd_data);
3284 NECP_CLIENT_ASSERT_LOCKED(client);
3285
3286 struct necp_client_flow_registration *new_registration = kalloc_type(struct necp_client_flow_registration, Z_WAITOK | Z_ZERO | Z_NOFAIL);
3287
3288 new_registration->last_interface_details = combine_interface_details(IFSCOPE_NONE, NSTAT_IFNET_IS_UNKNOWN_TYPE);
3289
3290 necp_generate_client_id(new_registration->registration_id, true);
3291 LIST_INIT(&new_registration->flow_list);
3292
3293 // Add registration to client list
3294 RB_INSERT(_necp_client_flow_tree, &client->flow_registrations, new_registration);
3295
3296 // Add registration to fd list
3297 RB_INSERT(_necp_fd_flow_tree, &fd_data->flows, new_registration);
3298
3299 // Add registration to global tree for lookup
3300 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
3301 RB_INSERT(_necp_client_flow_global_tree, &necp_client_flow_global_tree, new_registration);
3302 NECP_FLOW_TREE_UNLOCK();
3303
3304 new_registration->client = client;
3305
3306 #if SKYWALK
3307 {
3308 // The uuid caching here is something of a hack, but saves a dynamic lookup with attendant lock hierarchy issues
3309 uint64_t stats_event_type = (uuid_is_null(client->latest_flow_registration_id)) ? NSTAT_EVENT_SRC_FLOW_UUID_ASSIGNED : NSTAT_EVENT_SRC_FLOW_UUID_CHANGED;
3310 uuid_copy(client->latest_flow_registration_id, new_registration->registration_id);
3311
3312 // With the flow uuid known, push a new statistics update to ensure the uuid gets known by any clients before the flow can close
3313 if (client->nstat_context != NULL) {
3314 nstat_provider_stats_event(client->nstat_context, stats_event_type);
3315 }
3316 }
3317 #endif /* !SKYWALK */
3318
3319 // Start out assuming there is nothing to read from the flow
3320 new_registration->flow_result_read = true;
3321
3322 return new_registration;
3323 }
3324
3325 static void
necp_client_add_socket_flow(struct necp_client_flow_registration * flow_registration,struct inpcb * inp)3326 necp_client_add_socket_flow(struct necp_client_flow_registration *flow_registration,
3327 struct inpcb *inp)
3328 {
3329 struct necp_client_flow *new_flow = kalloc_type(struct necp_client_flow, Z_WAITOK | Z_ZERO | Z_NOFAIL);
3330
3331 new_flow->socket = TRUE;
3332 new_flow->u.socket_handle = inp;
3333 new_flow->u.cb = inp->necp_cb;
3334
3335 OSIncrementAtomic(&necp_socket_flow_count);
3336
3337 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
3338 }
3339
3340 static int
necp_client_register_socket_inner(pid_t pid,uuid_t client_id,struct inpcb * inp,bool is_listener)3341 necp_client_register_socket_inner(pid_t pid, uuid_t client_id, struct inpcb *inp, bool is_listener)
3342 {
3343 int error = 0;
3344 struct necp_fd_data *client_fd = NULL;
3345 bool found_client = FALSE;
3346
3347 NECP_FD_LIST_LOCK_SHARED();
3348 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3349 NECP_FD_LOCK(client_fd);
3350 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3351 if (client != NULL) {
3352 if (!pid || client->proc_pid == pid) {
3353 if (is_listener) {
3354 found_client = TRUE;
3355 #if SKYWALK
3356 // Check netns token for registration
3357 if (!NETNS_TOKEN_VALID(&client->port_reservation)) {
3358 error = EINVAL;
3359 }
3360 #endif /* !SKYWALK */
3361 } else {
3362 // Find client flow and assign from socket
3363 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3364 if (flow_registration != NULL) {
3365 // Found the right client and flow registration, add a new flow
3366 found_client = TRUE;
3367 necp_client_add_socket_flow(flow_registration, inp);
3368 } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
3369 // No flows yet on this client, add a new registration
3370 flow_registration = necp_client_create_flow_registration(client_fd, client);
3371 if (flow_registration == NULL) {
3372 error = ENOMEM;
3373 } else {
3374 // Add a new flow
3375 found_client = TRUE;
3376 necp_client_add_socket_flow(flow_registration, inp);
3377 }
3378 }
3379 }
3380 }
3381
3382 NECP_CLIENT_UNLOCK(client);
3383 }
3384 NECP_FD_UNLOCK(client_fd);
3385
3386 if (found_client) {
3387 break;
3388 }
3389 }
3390 NECP_FD_LIST_UNLOCK();
3391
3392 if (!found_client) {
3393 error = ENOENT;
3394 } else {
3395 // Count the sockets that have the NECP client UUID set
3396 struct socket *so = inp->inp_socket;
3397 if (!(so->so_flags1 & SOF1_HAS_NECP_CLIENT_UUID)) {
3398 so->so_flags1 |= SOF1_HAS_NECP_CLIENT_UUID;
3399 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_necp_clientuuid_total);
3400 }
3401 }
3402
3403 return error;
3404 }
3405
3406 int
necp_client_register_socket_flow(pid_t pid,uuid_t client_id,struct inpcb * inp)3407 necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp)
3408 {
3409 return necp_client_register_socket_inner(pid, client_id, inp, false);
3410 }
3411
3412 int
necp_client_register_socket_listener(pid_t pid,uuid_t client_id,struct inpcb * inp)3413 necp_client_register_socket_listener(pid_t pid, uuid_t client_id, struct inpcb *inp)
3414 {
3415 return necp_client_register_socket_inner(pid, client_id, inp, true);
3416 }
3417
3418 #if SKYWALK
3419 int
necp_client_get_netns_flow_info(uuid_t client_id,struct ns_flow_info * flow_info)3420 necp_client_get_netns_flow_info(uuid_t client_id, struct ns_flow_info *flow_info)
3421 {
3422 int error = 0;
3423 struct necp_fd_data *client_fd = NULL;
3424 bool found_client = FALSE;
3425
3426 NECP_FD_LIST_LOCK_SHARED();
3427 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3428 NECP_FD_LOCK(client_fd);
3429 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3430 if (client != NULL) {
3431 found_client = TRUE;
3432 if (!NETNS_TOKEN_VALID(&client->port_reservation)) {
3433 error = EINVAL;
3434 } else {
3435 error = netns_get_flow_info(&client->port_reservation, flow_info);
3436 }
3437
3438 NECP_CLIENT_UNLOCK(client);
3439 }
3440 NECP_FD_UNLOCK(client_fd);
3441
3442 if (found_client) {
3443 break;
3444 }
3445 }
3446 NECP_FD_LIST_UNLOCK();
3447
3448 if (!found_client) {
3449 error = ENOENT;
3450 }
3451
3452 return error;
3453 }
3454 #endif /* !SKYWALK */
3455
3456 static void
necp_client_add_multipath_interface_flows(struct necp_client_flow_registration * flow_registration,struct necp_client * client,struct mppcb * mpp)3457 necp_client_add_multipath_interface_flows(struct necp_client_flow_registration *flow_registration,
3458 struct necp_client *client,
3459 struct mppcb *mpp)
3460 {
3461 flow_registration->interface_handle = mpp;
3462 flow_registration->interface_cb = mpp->necp_cb;
3463
3464 proc_t proc = proc_find(client->proc_pid);
3465 if (proc == PROC_NULL) {
3466 return;
3467 }
3468
3469 // Traverse all interfaces and add a tracking flow if needed
3470 necp_flow_add_interface_flows(proc, client, flow_registration, true);
3471
3472 proc_rele(proc);
3473 proc = PROC_NULL;
3474 }
3475
3476 int
necp_client_register_multipath_cb(pid_t pid,uuid_t client_id,struct mppcb * mpp)3477 necp_client_register_multipath_cb(pid_t pid, uuid_t client_id, struct mppcb *mpp)
3478 {
3479 int error = 0;
3480 struct necp_fd_data *client_fd = NULL;
3481 bool found_client = FALSE;
3482
3483 NECP_FD_LIST_LOCK_SHARED();
3484 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3485 NECP_FD_LOCK(client_fd);
3486 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3487 if (client != NULL) {
3488 if (!pid || client->proc_pid == pid) {
3489 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3490 if (flow_registration != NULL) {
3491 // Found the right client and flow registration, add a new flow
3492 found_client = TRUE;
3493 necp_client_add_multipath_interface_flows(flow_registration, client, mpp);
3494 } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
3495 // No flows yet on this client, add a new registration
3496 flow_registration = necp_client_create_flow_registration(client_fd, client);
3497 if (flow_registration == NULL) {
3498 error = ENOMEM;
3499 } else {
3500 // Add a new flow
3501 found_client = TRUE;
3502 necp_client_add_multipath_interface_flows(flow_registration, client, mpp);
3503 }
3504 }
3505 }
3506
3507 NECP_CLIENT_UNLOCK(client);
3508 }
3509 NECP_FD_UNLOCK(client_fd);
3510
3511 if (found_client) {
3512 break;
3513 }
3514 }
3515 NECP_FD_LIST_UNLOCK();
3516
3517 if (!found_client && error == 0) {
3518 error = ENOENT;
3519 }
3520
3521 return error;
3522 }
3523
3524 #define NETAGENT_DOMAIN_RADIO_MANAGER "WirelessRadioManager"
3525 #define NETAGENT_TYPE_RADIO_MANAGER "WirelessRadioManager:BB Manager"
3526
3527 static int
necp_client_lookup_bb_radio_manager(struct necp_client * client,uuid_t netagent_uuid)3528 necp_client_lookup_bb_radio_manager(struct necp_client *client,
3529 uuid_t netagent_uuid)
3530 {
3531 char netagent_domain[NETAGENT_DOMAINSIZE];
3532 char netagent_type[NETAGENT_TYPESIZE];
3533 struct necp_aggregate_result result;
3534 proc_t proc;
3535 int error;
3536
3537 proc = proc_find(client->proc_pid);
3538 if (proc == PROC_NULL) {
3539 return ESRCH;
3540 }
3541
3542 error = necp_application_find_policy_match_internal(proc, client->parameters, (u_int32_t)client->parameters_length,
3543 &result, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL, true, true, NULL);
3544
3545 proc_rele(proc);
3546 proc = PROC_NULL;
3547
3548 if (error) {
3549 return error;
3550 }
3551
3552 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
3553 if (uuid_is_null(result.netagents[i])) {
3554 // Passed end of valid agents
3555 break;
3556 }
3557
3558 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
3559 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
3560 if (netagent_get_agent_domain_and_type(result.netagents[i], netagent_domain, netagent_type) == FALSE) {
3561 continue;
3562 }
3563
3564 if (strncmp(netagent_domain, NETAGENT_DOMAIN_RADIO_MANAGER, NETAGENT_DOMAINSIZE) != 0) {
3565 continue;
3566 }
3567
3568 if (strncmp(netagent_type, NETAGENT_TYPE_RADIO_MANAGER, NETAGENT_TYPESIZE) != 0) {
3569 continue;
3570 }
3571
3572 uuid_copy(netagent_uuid, result.netagents[i]);
3573
3574 break;
3575 }
3576
3577 return 0;
3578 }
3579
3580 static int
necp_client_assert_bb_radio_manager_common(struct necp_client * client,bool assert)3581 necp_client_assert_bb_radio_manager_common(struct necp_client *client, bool assert)
3582 {
3583 uuid_t netagent_uuid;
3584 uint8_t assert_type;
3585 int error;
3586
3587 error = necp_client_lookup_bb_radio_manager(client, netagent_uuid);
3588 if (error) {
3589 NECPLOG0(LOG_ERR, "BB radio manager agent not found");
3590 return error;
3591 }
3592
3593 // Before unasserting, verify that the assertion was already taken
3594 if (assert == FALSE) {
3595 assert_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
3596
3597 if (!necp_client_remove_assertion(client, netagent_uuid)) {
3598 return EINVAL;
3599 }
3600 } else {
3601 assert_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT;
3602 }
3603
3604 error = netagent_client_message(netagent_uuid, client->client_id, client->proc_pid, client->agent_handle, assert_type);
3605 if (error) {
3606 NECPLOG0(LOG_ERR, "netagent_client_message failed");
3607 return error;
3608 }
3609
3610 // Only save the assertion if the action succeeded
3611 if (assert == TRUE) {
3612 necp_client_add_assertion(client, netagent_uuid);
3613 }
3614
3615 return 0;
3616 }
3617
3618 int
necp_client_assert_bb_radio_manager(uuid_t client_id,bool assert)3619 necp_client_assert_bb_radio_manager(uuid_t client_id, bool assert)
3620 {
3621 struct necp_client *client;
3622 int error = 0;
3623
3624 NECP_CLIENT_TREE_LOCK_SHARED();
3625
3626 client = necp_find_client_and_lock(client_id);
3627
3628 if (client) {
3629 // Found the right client!
3630 error = necp_client_assert_bb_radio_manager_common(client, assert);
3631
3632 NECP_CLIENT_UNLOCK(client);
3633 } else {
3634 NECPLOG0(LOG_ERR, "Couldn't find client");
3635 error = ENOENT;
3636 }
3637
3638 NECP_CLIENT_TREE_UNLOCK();
3639
3640 return error;
3641 }
3642
3643 static int
necp_client_unregister_socket_flow(uuid_t client_id,void * handle)3644 necp_client_unregister_socket_flow(uuid_t client_id, void *handle)
3645 {
3646 int error = 0;
3647 struct necp_fd_data *client_fd = NULL;
3648 bool found_client = FALSE;
3649 bool client_updated = FALSE;
3650
3651 NECP_FD_LIST_LOCK_SHARED();
3652 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3653 NECP_FD_LOCK(client_fd);
3654
3655 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3656 if (client != NULL) {
3657 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3658 if (flow_registration != NULL) {
3659 // Found the right client and flow!
3660 found_client = TRUE;
3661
3662 // Remove flow assignment
3663 struct necp_client_flow *search_flow = NULL;
3664 struct necp_client_flow *temp_flow = NULL;
3665 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
3666 if (search_flow->socket && search_flow->u.socket_handle == handle) {
3667 if (search_flow->assigned_results != NULL) {
3668 kfree_data(search_flow->assigned_results, search_flow->assigned_results_length);
3669 search_flow->assigned_results = NULL;
3670 }
3671 client_updated = TRUE;
3672 flow_registration->flow_result_read = FALSE;
3673 LIST_REMOVE(search_flow, flow_chain);
3674 OSDecrementAtomic(&necp_socket_flow_count);
3675 kfree_type(struct necp_client_flow, search_flow);
3676 }
3677 }
3678 }
3679
3680 NECP_CLIENT_UNLOCK(client);
3681 }
3682
3683 if (client_updated) {
3684 necp_fd_notify(client_fd, true);
3685 }
3686 NECP_FD_UNLOCK(client_fd);
3687
3688 if (found_client) {
3689 break;
3690 }
3691 }
3692 NECP_FD_LIST_UNLOCK();
3693
3694 if (!found_client) {
3695 error = ENOENT;
3696 }
3697
3698 return error;
3699 }
3700
3701 static int
necp_client_unregister_multipath_cb(uuid_t client_id,void * handle)3702 necp_client_unregister_multipath_cb(uuid_t client_id, void *handle)
3703 {
3704 int error = 0;
3705 bool found_client = FALSE;
3706
3707 NECP_CLIENT_TREE_LOCK_SHARED();
3708
3709 struct necp_client *client = necp_find_client_and_lock(client_id);
3710 if (client != NULL) {
3711 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3712 if (flow_registration != NULL) {
3713 // Found the right client and flow!
3714 found_client = TRUE;
3715
3716 // Remove flow assignment
3717 struct necp_client_flow *search_flow = NULL;
3718 struct necp_client_flow *temp_flow = NULL;
3719 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
3720 if (!search_flow->socket && !search_flow->nexus &&
3721 search_flow->u.socket_handle == handle) {
3722 search_flow->u.socket_handle = NULL;
3723 search_flow->u.cb = NULL;
3724 }
3725 }
3726
3727 flow_registration->interface_handle = NULL;
3728 flow_registration->interface_cb = NULL;
3729 }
3730
3731 NECP_CLIENT_UNLOCK(client);
3732 }
3733
3734 NECP_CLIENT_TREE_UNLOCK();
3735
3736 if (!found_client) {
3737 error = ENOENT;
3738 }
3739
3740 return error;
3741 }
3742
3743 int
necp_client_assign_from_socket(pid_t pid,uuid_t client_id,struct inpcb * inp)3744 necp_client_assign_from_socket(pid_t pid, uuid_t client_id, struct inpcb *inp)
3745 {
3746 int error = 0;
3747 struct necp_fd_data *client_fd = NULL;
3748 bool found_client = FALSE;
3749 bool client_updated = FALSE;
3750
3751 NECP_FD_LIST_LOCK_SHARED();
3752 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3753 if (pid && client_fd->proc_pid != pid) {
3754 continue;
3755 }
3756
3757 proc_t proc = proc_find(client_fd->proc_pid);
3758 if (proc == PROC_NULL) {
3759 continue;
3760 }
3761
3762 NECP_FD_LOCK(client_fd);
3763
3764 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3765 if (client != NULL) {
3766 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3767 if (flow_registration == NULL && RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
3768 // No flows yet on this client, add a new registration
3769 flow_registration = necp_client_create_flow_registration(client_fd, client);
3770 if (flow_registration == NULL) {
3771 error = ENOMEM;
3772 }
3773 }
3774 if (flow_registration != NULL) {
3775 // Found the right client and flow!
3776 found_client = TRUE;
3777
3778 struct necp_client_flow *flow = NULL;
3779 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
3780 if (flow->socket && flow->u.socket_handle == inp) {
3781 // Release prior results and route
3782 if (flow->assigned_results != NULL) {
3783 kfree_data(flow->assigned_results, flow->assigned_results_length);
3784 flow->assigned_results = NULL;
3785 }
3786
3787 ifnet_t ifp = NULL;
3788 if ((inp->inp_flags & INP_BOUND_IF) && inp->inp_boundifp) {
3789 ifp = inp->inp_boundifp;
3790 } else {
3791 ifp = inp->inp_last_outifp;
3792 }
3793
3794 if (ifp != NULL) {
3795 flow->interface_index = ifp->if_index;
3796 } else {
3797 flow->interface_index = IFSCOPE_NONE;
3798 }
3799
3800 if (inp->inp_vflag & INP_IPV4) {
3801 flow->local_addr.sin.sin_family = AF_INET;
3802 flow->local_addr.sin.sin_len = sizeof(struct sockaddr_in);
3803 flow->local_addr.sin.sin_port = inp->inp_lport;
3804 memcpy(&flow->local_addr.sin.sin_addr, &inp->inp_laddr, sizeof(struct in_addr));
3805
3806 flow->remote_addr.sin.sin_family = AF_INET;
3807 flow->remote_addr.sin.sin_len = sizeof(struct sockaddr_in);
3808 flow->remote_addr.sin.sin_port = inp->inp_fport;
3809 memcpy(&flow->remote_addr.sin.sin_addr, &inp->inp_faddr, sizeof(struct in_addr));
3810 } else if (inp->inp_vflag & INP_IPV6) {
3811 in6_ip6_to_sockaddr(&inp->in6p_laddr, inp->inp_lport, inp->inp_lifscope, &flow->local_addr.sin6, sizeof(flow->local_addr));
3812 in6_ip6_to_sockaddr(&inp->in6p_faddr, inp->inp_fport, inp->inp_fifscope, &flow->remote_addr.sin6, sizeof(flow->remote_addr));
3813 }
3814
3815 flow->viable = necp_client_flow_is_viable(proc, client, flow);
3816
3817 uuid_t empty_uuid;
3818 uuid_clear(empty_uuid);
3819 flow->assigned = TRUE;
3820 flow->assigned_results = necp_create_nexus_assign_message(empty_uuid, 0, NULL, 0,
3821 (struct necp_client_endpoint *)&flow->local_addr,
3822 (struct necp_client_endpoint *)&flow->remote_addr,
3823 NULL, 0, NULL, &flow->assigned_results_length);
3824 flow_registration->flow_result_read = FALSE;
3825 client_updated = TRUE;
3826 break;
3827 }
3828 }
3829 }
3830
3831 NECP_CLIENT_UNLOCK(client);
3832 }
3833 if (client_updated) {
3834 necp_fd_notify(client_fd, true);
3835 }
3836 NECP_FD_UNLOCK(client_fd);
3837
3838 proc_rele(proc);
3839 proc = PROC_NULL;
3840
3841 if (found_client) {
3842 break;
3843 }
3844 }
3845 NECP_FD_LIST_UNLOCK();
3846
3847 if (error == 0) {
3848 if (!found_client) {
3849 error = ENOENT;
3850 } else if (!client_updated) {
3851 error = EINVAL;
3852 }
3853 }
3854
3855 return error;
3856 }
3857
3858 bool
necp_socket_is_allowed_to_recv_on_interface(struct inpcb * inp,ifnet_t interface)3859 necp_socket_is_allowed_to_recv_on_interface(struct inpcb *inp, ifnet_t interface)
3860 {
3861 if (interface == NULL ||
3862 inp == NULL ||
3863 !(inp->inp_flags2 & INP2_EXTERNAL_PORT) ||
3864 uuid_is_null(inp->necp_client_uuid)) {
3865 // If there's no interface or client ID to check,
3866 // or if this is not a listener, pass.
3867 // Outbound connections will have already been
3868 // validated for policy.
3869 return TRUE;
3870 }
3871
3872 // Only filter out listener sockets (no remote address specified)
3873 if ((inp->inp_vflag & INP_IPV4) &&
3874 inp->inp_faddr.s_addr != INADDR_ANY) {
3875 return TRUE;
3876 }
3877 if ((inp->inp_vflag & INP_IPV6) &&
3878 !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
3879 return TRUE;
3880 }
3881
3882 bool allowed = TRUE;
3883
3884 NECP_CLIENT_TREE_LOCK_SHARED();
3885
3886 struct necp_client *client = necp_find_client_and_lock(inp->necp_client_uuid);
3887 if (client != NULL) {
3888 struct necp_client_parsed_parameters *parsed_parameters = NULL;
3889
3890 parsed_parameters = kalloc_type(struct necp_client_parsed_parameters,
3891 Z_WAITOK | Z_ZERO | Z_NOFAIL);
3892 int error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, parsed_parameters);
3893 if (error == 0) {
3894 if (!necp_ifnet_matches_parameters(interface, parsed_parameters, 0, NULL, true, false)) {
3895 allowed = FALSE;
3896 }
3897 }
3898 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
3899
3900 NECP_CLIENT_UNLOCK(client);
3901 }
3902
3903 NECP_CLIENT_TREE_UNLOCK();
3904
3905 return allowed;
3906 }
3907
3908 int
necp_update_flow_protoctl_event(uuid_t netagent_uuid,uuid_t client_id,uint32_t protoctl_event_code,uint32_t protoctl_event_val,uint32_t protoctl_event_tcp_seq_number)3909 necp_update_flow_protoctl_event(uuid_t netagent_uuid, uuid_t client_id,
3910 uint32_t protoctl_event_code, uint32_t protoctl_event_val,
3911 uint32_t protoctl_event_tcp_seq_number)
3912 {
3913 int error = 0;
3914 struct necp_fd_data *client_fd = NULL;
3915 bool found_client = FALSE;
3916 bool client_updated = FALSE;
3917
3918 NECP_FD_LIST_LOCK_SHARED();
3919 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3920 proc_t proc = proc_find(client_fd->proc_pid);
3921 if (proc == PROC_NULL) {
3922 continue;
3923 }
3924
3925 NECP_FD_LOCK(client_fd);
3926
3927 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3928 if (client != NULL) {
3929 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3930 if (flow_registration != NULL) {
3931 // Found the right client and flow!
3932 found_client = TRUE;
3933
3934 struct necp_client_flow *flow = NULL;
3935 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
3936 // Verify that the client nexus agent matches
3937 if ((flow->nexus && uuid_compare(flow->u.nexus_agent, netagent_uuid) == 0) ||
3938 flow->socket) {
3939 flow->has_protoctl_event = TRUE;
3940 flow->protoctl_event.protoctl_event_code = protoctl_event_code;
3941 flow->protoctl_event.protoctl_event_val = protoctl_event_val;
3942 flow->protoctl_event.protoctl_event_tcp_seq_num = protoctl_event_tcp_seq_number;
3943 flow_registration->flow_result_read = FALSE;
3944 client_updated = TRUE;
3945 break;
3946 }
3947 }
3948 }
3949
3950 NECP_CLIENT_UNLOCK(client);
3951 }
3952
3953 if (client_updated) {
3954 necp_fd_notify(client_fd, true);
3955 }
3956
3957 NECP_FD_UNLOCK(client_fd);
3958 proc_rele(proc);
3959 proc = PROC_NULL;
3960
3961 if (found_client) {
3962 break;
3963 }
3964 }
3965 NECP_FD_LIST_UNLOCK();
3966
3967 if (!found_client) {
3968 error = ENOENT;
3969 } else if (!client_updated) {
3970 error = EINVAL;
3971 }
3972 return error;
3973 }
3974
3975 static bool
necp_assign_client_result_locked(struct proc * proc,struct necp_fd_data * client_fd,struct necp_client * client,struct necp_client_flow_registration * flow_registration,uuid_t netagent_uuid,u_int8_t * assigned_results,size_t assigned_results_length,bool notify_fd,bool assigned_from_userspace_agent)3976 necp_assign_client_result_locked(struct proc *proc,
3977 struct necp_fd_data *client_fd,
3978 struct necp_client *client,
3979 struct necp_client_flow_registration *flow_registration,
3980 uuid_t netagent_uuid,
3981 u_int8_t *assigned_results,
3982 size_t assigned_results_length,
3983 bool notify_fd,
3984 bool assigned_from_userspace_agent)
3985 {
3986 bool client_updated = FALSE;
3987
3988 NECP_FD_ASSERT_LOCKED(client_fd);
3989 NECP_CLIENT_ASSERT_LOCKED(client);
3990
3991 struct necp_client_flow *flow = NULL;
3992 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
3993 // Verify that the client nexus agent matches
3994 if (flow->nexus &&
3995 uuid_compare(flow->u.nexus_agent, netagent_uuid) == 0) {
3996 // Release prior results and route
3997 if (flow->assigned_results != NULL) {
3998 kfree_data(flow->assigned_results, flow->assigned_results_length);
3999 flow->assigned_results = NULL;
4000 }
4001
4002 void *nexus_stats = NULL;
4003 if (assigned_results != NULL && assigned_results_length > 0) {
4004 int error = necp_client_parse_result(assigned_results, (u_int32_t)assigned_results_length,
4005 &flow->local_addr, &flow->remote_addr,
4006 assigned_from_userspace_agent ? NULL : &nexus_stats); // Only assign stats from kernel agents
4007 VERIFY(error == 0);
4008 }
4009
4010 flow->viable = necp_client_flow_is_viable(proc, client, flow);
4011
4012 flow->assigned = TRUE;
4013 flow->assigned_results = assigned_results;
4014 flow->assigned_results_length = assigned_results_length;
4015 flow_registration->flow_result_read = FALSE;
4016 #if SKYWALK
4017 if (nexus_stats != NULL) {
4018 if (flow_registration->nexus_stats != NULL) {
4019 flow_stats_release(flow_registration->nexus_stats);
4020 }
4021 flow_registration->nexus_stats = nexus_stats;
4022 }
4023 #endif /* SKYWALK */
4024 client_updated = TRUE;
4025 break;
4026 }
4027 }
4028
4029 if (client_updated && notify_fd) {
4030 necp_fd_notify(client_fd, true);
4031 }
4032
4033 // if not updated, client must free assigned_results
4034 return client_updated;
4035 }
4036
4037 int
necp_assign_client_result(uuid_t netagent_uuid,uuid_t client_id,u_int8_t * assigned_results,size_t assigned_results_length)4038 necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id,
4039 u_int8_t *assigned_results, size_t assigned_results_length)
4040 {
4041 int error = 0;
4042 struct necp_fd_data *client_fd = NULL;
4043 bool found_client = FALSE;
4044 bool client_updated = FALSE;
4045
4046 NECP_FD_LIST_LOCK_SHARED();
4047
4048 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
4049 proc_t proc = proc_find(client_fd->proc_pid);
4050 if (proc == PROC_NULL) {
4051 continue;
4052 }
4053
4054 NECP_FD_LOCK(client_fd);
4055 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
4056 if (client != NULL) {
4057 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
4058 if (flow_registration != NULL) {
4059 // Found the right client and flow!
4060 found_client = TRUE;
4061 if (necp_assign_client_result_locked(proc, client_fd, client, flow_registration, netagent_uuid,
4062 assigned_results, assigned_results_length, true, true)) {
4063 client_updated = TRUE;
4064 }
4065 }
4066
4067 NECP_CLIENT_UNLOCK(client);
4068 }
4069 NECP_FD_UNLOCK(client_fd);
4070
4071 proc_rele(proc);
4072 proc = PROC_NULL;
4073
4074 if (found_client) {
4075 break;
4076 }
4077 }
4078
4079 NECP_FD_LIST_UNLOCK();
4080
4081 // upon error, client must free assigned_results
4082 if (!found_client) {
4083 error = ENOENT;
4084 } else if (!client_updated) {
4085 error = EINVAL;
4086 }
4087
4088 return error;
4089 }
4090
4091 int
necp_assign_client_group_members(uuid_t netagent_uuid,uuid_t client_id,u_int8_t * assigned_group_members,size_t assigned_group_members_length)4092 necp_assign_client_group_members(uuid_t netagent_uuid, uuid_t client_id,
4093 u_int8_t *assigned_group_members, size_t assigned_group_members_length)
4094 {
4095 #pragma unused(netagent_uuid)
4096 int error = 0;
4097 struct necp_fd_data *client_fd = NULL;
4098 bool found_client = false;
4099 bool client_updated = false;
4100
4101 NECP_FD_LIST_LOCK_SHARED();
4102
4103 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
4104 proc_t proc = proc_find(client_fd->proc_pid);
4105 if (proc == PROC_NULL) {
4106 continue;
4107 }
4108
4109 NECP_FD_LOCK(client_fd);
4110 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
4111 if (client != NULL) {
4112 found_client = true;
4113 // Release prior results
4114 if (client->assigned_group_members != NULL) {
4115 kfree_data(client->assigned_group_members, client->assigned_group_members_length);
4116 client->assigned_group_members = NULL;
4117 }
4118
4119 // Save new results
4120 client->assigned_group_members = assigned_group_members;
4121 client->assigned_group_members_length = assigned_group_members_length;
4122 client->group_members_read = false;
4123
4124 client_updated = true;
4125 necp_fd_notify(client_fd, true);
4126
4127 NECP_CLIENT_UNLOCK(client);
4128 }
4129 NECP_FD_UNLOCK(client_fd);
4130
4131 proc_rele(proc);
4132 proc = PROC_NULL;
4133
4134 if (found_client) {
4135 break;
4136 }
4137 }
4138
4139 NECP_FD_LIST_UNLOCK();
4140
4141 // upon error, client must free assigned_results
4142 if (!found_client) {
4143 error = ENOENT;
4144 } else if (!client_updated) {
4145 error = EINVAL;
4146 }
4147
4148 return error;
4149 }
4150
4151 /// Client updating
4152
4153 static bool
necp_update_parsed_parameters(struct necp_client_parsed_parameters * parsed_parameters,struct necp_aggregate_result * result)4154 necp_update_parsed_parameters(struct necp_client_parsed_parameters *parsed_parameters,
4155 struct necp_aggregate_result *result)
4156 {
4157 if (parsed_parameters == NULL ||
4158 result == NULL) {
4159 return false;
4160 }
4161
4162 bool updated = false;
4163 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
4164 if (uuid_is_null(result->netagents[i])) {
4165 // Passed end of valid agents
4166 break;
4167 }
4168
4169 if (!(result->netagent_use_flags[i] & NECP_AGENT_USE_FLAG_SCOPE)) {
4170 // Not a scoped agent, ignore
4171 continue;
4172 }
4173
4174 // This is a scoped agent. Add it to the required agents.
4175 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
4176 // Already some required agents, add this at the end
4177 for (int j = 0; j < NECP_MAX_AGENT_PARAMETERS; j++) {
4178 if (uuid_compare(parsed_parameters->required_netagents[j], result->netagents[i]) == 0) {
4179 // Already required, break
4180 break;
4181 }
4182 if (uuid_is_null(parsed_parameters->required_netagents[j])) {
4183 // Add here
4184 memcpy(&parsed_parameters->required_netagents[j], result->netagents[i], sizeof(uuid_t));
4185 updated = true;
4186 break;
4187 }
4188 }
4189 } else {
4190 // No required agents yet, add this one
4191 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT;
4192 memcpy(&parsed_parameters->required_netagents[0], result->netagents[i], sizeof(uuid_t));
4193 updated = true;
4194 }
4195
4196 // Remove requirements for agents of the same type
4197 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
4198 char remove_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
4199 char remove_agent_type[NETAGENT_TYPESIZE] = { 0 };
4200 if (netagent_get_agent_domain_and_type(result->netagents[i], remove_agent_domain, remove_agent_type)) {
4201 for (int j = 0; j < NECP_MAX_AGENT_PARAMETERS; j++) {
4202 if (strlen(parsed_parameters->required_netagent_types[j].netagent_domain) == 0 &&
4203 strlen(parsed_parameters->required_netagent_types[j].netagent_type) == 0) {
4204 break;
4205 }
4206
4207 if (strncmp(parsed_parameters->required_netagent_types[j].netagent_domain, remove_agent_domain, NETAGENT_DOMAINSIZE) == 0 &&
4208 strncmp(parsed_parameters->required_netagent_types[j].netagent_type, remove_agent_type, NETAGENT_TYPESIZE) == 0) {
4209 updated = true;
4210
4211 if (j == NECP_MAX_AGENT_PARAMETERS - 1) {
4212 // Last field, just clear and break
4213 memset(&parsed_parameters->required_netagent_types[NECP_MAX_AGENT_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
4214 break;
4215 } else {
4216 // Move the parameters down, clear the last entry
4217 memmove(&parsed_parameters->required_netagent_types[j],
4218 &parsed_parameters->required_netagent_types[j + 1],
4219 sizeof(struct necp_client_parameter_netagent_type) * (NECP_MAX_AGENT_PARAMETERS - (j + 1)));
4220 memset(&parsed_parameters->required_netagent_types[NECP_MAX_AGENT_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
4221 // Continue, don't increment but look at the new shifted item instead
4222 continue;
4223 }
4224 }
4225
4226 // Increment j to look at the next agent type parameter
4227 j++;
4228 }
4229 }
4230 }
4231 }
4232
4233 if (updated &&
4234 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4235 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) {
4236 // A required interface index was added after the fact. Clear it.
4237 parsed_parameters->required_interface_index = IFSCOPE_NONE;
4238 }
4239
4240
4241 return updated;
4242 }
4243
4244 static inline bool
necp_agent_types_match(const char * agent_domain1,const char * agent_type1,const char * agent_domain2,const char * agent_type2)4245 necp_agent_types_match(const char *agent_domain1, const char *agent_type1,
4246 const char *agent_domain2, const char *agent_type2)
4247 {
4248 return (strlen(agent_domain1) == 0 ||
4249 strncmp(agent_domain2, agent_domain1, NETAGENT_DOMAINSIZE) == 0) &&
4250 (strlen(agent_type1) == 0 ||
4251 strncmp(agent_type2, agent_type1, NETAGENT_TYPESIZE) == 0);
4252 }
4253
4254 static inline bool
necp_calculate_client_result(proc_t proc,struct necp_client * client,struct necp_client_parsed_parameters * parsed_parameters,struct necp_aggregate_result * result,u_int32_t * flags,u_int32_t * reason,struct necp_client_endpoint * v4_gateway,struct necp_client_endpoint * v6_gateway,uuid_t * override_euuid)4255 necp_calculate_client_result(proc_t proc,
4256 struct necp_client *client,
4257 struct necp_client_parsed_parameters *parsed_parameters,
4258 struct necp_aggregate_result *result,
4259 u_int32_t *flags,
4260 u_int32_t *reason,
4261 struct necp_client_endpoint *v4_gateway,
4262 struct necp_client_endpoint *v6_gateway,
4263 uuid_t *override_euuid)
4264 {
4265 struct rtentry *route = NULL;
4266
4267 // Check parameters to find best interface
4268 bool validate_agents = false;
4269 u_int matching_if_index = 0;
4270 if (necp_find_matching_interface_index(parsed_parameters, &matching_if_index, &validate_agents)) {
4271 if (matching_if_index != 0) {
4272 parsed_parameters->required_interface_index = matching_if_index;
4273 }
4274 // Interface found or not needed, match policy.
4275 memset(result, 0, sizeof(*result));
4276 int error = necp_application_find_policy_match_internal(proc, client->parameters,
4277 (u_int32_t)client->parameters_length,
4278 result, flags, reason, matching_if_index,
4279 NULL, NULL,
4280 v4_gateway, v6_gateway,
4281 &route, false, true,
4282 override_euuid);
4283 if (error != 0) {
4284 if (route != NULL) {
4285 rtfree(route);
4286 }
4287 return FALSE;
4288 }
4289
4290 if (validate_agents) {
4291 bool requirement_failed = FALSE;
4292 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
4293 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4294 if (uuid_is_null(parsed_parameters->required_netagents[i])) {
4295 break;
4296 }
4297
4298 bool requirement_found = FALSE;
4299 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4300 if (uuid_is_null(result->netagents[j])) {
4301 break;
4302 }
4303
4304 if (result->netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) {
4305 // A removed agent, ignore
4306 continue;
4307 }
4308
4309 if (uuid_compare(parsed_parameters->required_netagents[i], result->netagents[j]) == 0) {
4310 requirement_found = TRUE;
4311 break;
4312 }
4313 }
4314
4315 if (!requirement_found) {
4316 requirement_failed = TRUE;
4317 break;
4318 }
4319 }
4320 }
4321
4322 if (!requirement_failed && parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
4323 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4324 if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 &&
4325 strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
4326 break;
4327 }
4328
4329 bool requirement_found = FALSE;
4330 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4331 if (uuid_is_null(result->netagents[j])) {
4332 break;
4333 }
4334
4335 if (result->netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) {
4336 // A removed agent, ignore
4337 continue;
4338 }
4339
4340 char policy_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
4341 char policy_agent_type[NETAGENT_TYPESIZE] = { 0 };
4342
4343 if (netagent_get_agent_domain_and_type(result->netagents[j], policy_agent_domain, policy_agent_type)) {
4344 if (necp_agent_types_match(parsed_parameters->required_netagent_types[i].netagent_domain,
4345 parsed_parameters->required_netagent_types[i].netagent_type,
4346 policy_agent_domain, policy_agent_type)) {
4347 requirement_found = TRUE;
4348 break;
4349 }
4350 }
4351 }
4352
4353 if (!requirement_found) {
4354 requirement_failed = TRUE;
4355 break;
4356 }
4357 }
4358 }
4359
4360 if (requirement_failed) {
4361 // Agent requirement failed. Clear out the whole result, make everything fail.
4362 memset(result, 0, sizeof(*result));
4363 if (route != NULL) {
4364 rtfree(route);
4365 }
4366 return TRUE;
4367 }
4368 }
4369
4370 // Reset current route
4371 NECP_CLIENT_ROUTE_LOCK(client);
4372 if (client->current_route != NULL) {
4373 rtfree(client->current_route);
4374 }
4375 client->current_route = route;
4376 NECP_CLIENT_ROUTE_UNLOCK(client);
4377 } else {
4378 // Interface not found. Clear out the whole result, make everything fail.
4379 memset(result, 0, sizeof(*result));
4380 }
4381
4382 return TRUE;
4383 }
4384
4385 #define NECP_PARSED_PARAMETERS_REQUIRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF | \
4386 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
4387 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
4388 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE)
4389
4390 static bool
necp_update_client_result(proc_t proc,struct necp_fd_data * client_fd,struct necp_client * client,struct _necp_flow_defunct_list * defunct_list)4391 necp_update_client_result(proc_t proc,
4392 struct necp_fd_data *client_fd,
4393 struct necp_client *client,
4394 struct _necp_flow_defunct_list *defunct_list)
4395 {
4396 struct necp_client_result_netagent netagent;
4397 struct necp_aggregate_result result;
4398 struct necp_client_parsed_parameters *parsed_parameters = NULL;
4399 u_int32_t flags = 0;
4400 u_int32_t reason = 0;
4401
4402 NECP_CLIENT_ASSERT_LOCKED(client);
4403
4404 parsed_parameters = kalloc_type(struct necp_client_parsed_parameters,
4405 Z_WAITOK | Z_ZERO | Z_NOFAIL);
4406
4407 // Nexus flows will be brought back if they are still valid
4408 necp_client_mark_all_nonsocket_flows_as_invalid(client);
4409
4410 int error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, parsed_parameters);
4411 if (error != 0) {
4412 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4413 return FALSE;
4414 }
4415
4416 // Update saved IP protocol
4417 client->ip_protocol = parsed_parameters->ip_protocol;
4418
4419 // Calculate the policy result
4420 struct necp_client_endpoint v4_gateway = {};
4421 struct necp_client_endpoint v6_gateway = {};
4422 uuid_t override_euuid;
4423 uuid_clear(override_euuid);
4424 if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags, &reason, &v4_gateway, &v6_gateway, &override_euuid)) {
4425 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4426 return FALSE;
4427 }
4428
4429 if (necp_update_parsed_parameters(parsed_parameters, &result)) {
4430 // Changed the parameters based on result, try again (only once)
4431 if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags, &reason, &v4_gateway, &v6_gateway, &override_euuid)) {
4432 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4433 return FALSE;
4434 }
4435 }
4436
4437 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
4438 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4439 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) {
4440 // Listener should not apply required interface index if
4441 parsed_parameters->required_interface_index = IFSCOPE_NONE;
4442 }
4443
4444 // Save the last policy id on the client
4445 client->policy_id = result.policy_id;
4446 uuid_copy(client->override_euuid, override_euuid);
4447
4448 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_MULTIPATH) ||
4449 (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) ||
4450 ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
4451 result.routing_result != NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED)) {
4452 client->allow_multiple_flows = TRUE;
4453 } else {
4454 client->allow_multiple_flows = FALSE;
4455 }
4456
4457 // If the original request was scoped, and the policy result matches, make sure the result is scoped
4458 if ((result.routing_result == NECP_KERNEL_POLICY_RESULT_NONE ||
4459 result.routing_result == NECP_KERNEL_POLICY_RESULT_PASS) &&
4460 result.routed_interface_index != IFSCOPE_NONE &&
4461 parsed_parameters->required_interface_index == result.routed_interface_index) {
4462 result.routing_result = NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED;
4463 result.routing_result_parameter.scoped_interface_index = result.routed_interface_index;
4464 }
4465
4466 if (defunct_list != NULL &&
4467 result.routing_result == NECP_KERNEL_POLICY_RESULT_DROP) {
4468 // If we are forced to drop the client, defunct it if it has flows
4469 necp_defunct_client_for_policy(client, defunct_list);
4470 }
4471
4472 // Recalculate flags
4473 if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
4474 // Listeners are valid as long as they aren't dropped
4475 if (result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP) {
4476 flags |= NECP_CLIENT_RESULT_FLAG_SATISFIED;
4477 }
4478 } else if (result.routed_interface_index != 0) {
4479 // Clients without flows determine viability based on having some routable interface
4480 flags |= NECP_CLIENT_RESULT_FLAG_SATISFIED;
4481 }
4482
4483 bool updated = FALSE;
4484 u_int8_t *cursor = client->result;
4485 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FLAGS, sizeof(flags), &flags, &updated, client->result, sizeof(client->result));
4486 if (reason != 0) {
4487 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_REASON, sizeof(reason), &reason, &updated, client->result, sizeof(client->result));
4488 }
4489 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_CLIENT_ID, sizeof(uuid_t), client->client_id, &updated,
4490 client->result, sizeof(client->result));
4491 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT, sizeof(result.routing_result), &result.routing_result, &updated,
4492 client->result, sizeof(client->result));
4493 if (result.routing_result_parameter.tunnel_interface_index != 0) {
4494 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER,
4495 sizeof(result.routing_result_parameter), &result.routing_result_parameter, &updated,
4496 client->result, sizeof(client->result));
4497 }
4498 if (result.filter_control_unit != 0) {
4499 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT,
4500 sizeof(result.filter_control_unit), &result.filter_control_unit, &updated,
4501 client->result, sizeof(client->result));
4502 }
4503 if (result.flow_divert_aggregate_unit != 0) {
4504 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FLOW_DIVERT_AGGREGATE_UNIT,
4505 sizeof(result.flow_divert_aggregate_unit), &result.flow_divert_aggregate_unit, &updated,
4506 client->result, sizeof(client->result));
4507 }
4508 if (result.routed_interface_index != 0) {
4509 u_int routed_interface_index = result.routed_interface_index;
4510 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
4511 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_REQUIRED_FIELDS) &&
4512 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4513 parsed_parameters->required_interface_index != result.routed_interface_index) {
4514 routed_interface_index = parsed_parameters->required_interface_index;
4515 }
4516
4517 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_INDEX,
4518 sizeof(routed_interface_index), &routed_interface_index, &updated,
4519 client->result, sizeof(client->result));
4520 }
4521 if (client_fd && client_fd->flags & NECP_OPEN_FLAG_BACKGROUND) {
4522 u_int32_t effective_traffic_class = SO_TC_BK_SYS;
4523 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS,
4524 sizeof(effective_traffic_class), &effective_traffic_class, &updated,
4525 client->result, sizeof(client->result));
4526 }
4527
4528 if (client_fd->background) {
4529 bool has_assigned_flow = FALSE;
4530 struct necp_client_flow_registration *flow_registration = NULL;
4531 struct necp_client_flow *search_flow = NULL;
4532 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
4533 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
4534 if (search_flow->assigned) {
4535 has_assigned_flow = TRUE;
4536 break;
4537 }
4538 }
4539 }
4540
4541 if (has_assigned_flow) {
4542 u_int32_t background = client_fd->background;
4543 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG,
4544 sizeof(background), &background, &updated,
4545 client->result, sizeof(client->result));
4546 }
4547 }
4548
4549 bool write_v4_gateway = !necp_client_endpoint_is_unspecified(&v4_gateway);
4550 bool write_v6_gateway = !necp_client_endpoint_is_unspecified(&v6_gateway);
4551
4552 NECP_CLIENT_ROUTE_LOCK(client);
4553 if (client->current_route != NULL) {
4554 const u_int32_t route_mtu = get_maxmtu(client->current_route);
4555 if (route_mtu != 0) {
4556 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_MTU,
4557 sizeof(route_mtu), &route_mtu, &updated,
4558 client->result, sizeof(client->result));
4559 }
4560 bool has_remote_addr = parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
4561 if (has_remote_addr && client->current_route->rt_gateway != NULL) {
4562 if (client->current_route->rt_gateway->sa_family == AF_INET) {
4563 write_v6_gateway = false;
4564 } else if (client->current_route->rt_gateway->sa_family == AF_INET6) {
4565 write_v4_gateway = false;
4566 }
4567 }
4568 }
4569 NECP_CLIENT_ROUTE_UNLOCK(client);
4570
4571 if (write_v4_gateway) {
4572 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_GATEWAY,
4573 sizeof(struct necp_client_endpoint), &v4_gateway, &updated,
4574 client->result, sizeof(client->result));
4575 }
4576
4577 if (write_v6_gateway) {
4578 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_GATEWAY,
4579 sizeof(struct necp_client_endpoint), &v6_gateway, &updated,
4580 client->result, sizeof(client->result));
4581 }
4582
4583 for (int i = 0; i < NAT64_MAX_NUM_PREFIXES; i++) {
4584 if (result.nat64_prefixes[i].prefix_len != 0) {
4585 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NAT64,
4586 sizeof(result.nat64_prefixes), result.nat64_prefixes, &updated,
4587 client->result, sizeof(client->result));
4588 break;
4589 }
4590 }
4591
4592 if (result.mss_recommended != 0) {
4593 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_RECOMMENDED_MSS,
4594 sizeof(result.mss_recommended), &result.mss_recommended, &updated,
4595 client->result, sizeof(client->result));
4596 }
4597
4598 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
4599 if (uuid_is_null(result.netagents[i])) {
4600 break;
4601 }
4602 if (result.netagent_use_flags[i] & NECP_AGENT_USE_FLAG_REMOVE) {
4603 // A removed agent, ignore
4604 continue;
4605 }
4606 uuid_copy(netagent.netagent_uuid, result.netagents[i]);
4607 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4608 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE, 0, 0)) {
4609 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4610 client->result, sizeof(client->result));
4611 }
4612 }
4613
4614 ifnet_head_lock_shared();
4615 ifnet_t direct_interface = NULL;
4616 ifnet_t delegate_interface = NULL;
4617 ifnet_t original_scoped_interface = NULL;
4618
4619 if (result.routed_interface_index != IFSCOPE_NONE && result.routed_interface_index <= (u_int32_t)if_index) {
4620 direct_interface = ifindex2ifnet[result.routed_interface_index];
4621 } else if (parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4622 parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
4623 // If the request was scoped, but the route didn't match, still grab the agents
4624 direct_interface = ifindex2ifnet[parsed_parameters->required_interface_index];
4625 } else if (result.routed_interface_index == IFSCOPE_NONE &&
4626 result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED &&
4627 result.routing_result_parameter.scoped_interface_index != IFSCOPE_NONE) {
4628 direct_interface = ifindex2ifnet[result.routing_result_parameter.scoped_interface_index];
4629 }
4630 if (direct_interface != NULL) {
4631 delegate_interface = direct_interface->if_delegated.ifp;
4632 }
4633 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
4634 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_REQUIRED_FIELDS) &&
4635 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4636 parsed_parameters->required_interface_index != result.routing_result_parameter.tunnel_interface_index &&
4637 parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
4638 original_scoped_interface = ifindex2ifnet[parsed_parameters->required_interface_index];
4639 }
4640 // Add interfaces
4641 if (original_scoped_interface != NULL) {
4642 struct necp_client_result_interface interface_struct;
4643 interface_struct.index = original_scoped_interface->if_index;
4644 interface_struct.generation = ifnet_get_generation(original_scoped_interface);
4645 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
4646 client->result, sizeof(client->result));
4647 }
4648 if (direct_interface != NULL) {
4649 struct necp_client_result_interface interface_struct;
4650 interface_struct.index = direct_interface->if_index;
4651 interface_struct.generation = ifnet_get_generation(direct_interface);
4652 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
4653 client->result, sizeof(client->result));
4654
4655 // Set the delta time since interface up/down
4656 struct timeval updown_delta = {};
4657 if (ifnet_updown_delta(direct_interface, &updown_delta) == 0) {
4658 u_int32_t delta = updown_delta.tv_sec;
4659 bool ignore_updated = FALSE;
4660 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_TIME_DELTA,
4661 sizeof(delta), &delta, &ignore_updated,
4662 client->result, sizeof(client->result));
4663 }
4664 }
4665 if (delegate_interface != NULL) {
4666 struct necp_client_result_interface interface_struct;
4667 interface_struct.index = delegate_interface->if_index;
4668 interface_struct.generation = ifnet_get_generation(delegate_interface);
4669 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
4670 client->result, sizeof(client->result));
4671 }
4672
4673 // Update multipath/listener interface flows
4674 if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_MULTIPATH) {
4675 // Add the interface option for the routed interface first
4676 if (direct_interface != NULL) {
4677 // Add nexus agent
4678 necp_client_add_agent_interface_options(client, parsed_parameters, direct_interface);
4679
4680 // Add interface option in case it is not a nexus
4681 necp_client_add_interface_option_if_needed(client, direct_interface->if_index,
4682 ifnet_get_generation(direct_interface), NULL, false);
4683 }
4684 // Get other multipath interface options from ordered list
4685 struct ifnet *multi_interface = NULL;
4686 TAILQ_FOREACH(multi_interface, &ifnet_ordered_head, if_ordered_link) {
4687 if (multi_interface != direct_interface &&
4688 necp_ifnet_matches_parameters(multi_interface, parsed_parameters, 0, NULL, true, false)) {
4689 // Add nexus agents for multipath
4690 necp_client_add_agent_interface_options(client, parsed_parameters, multi_interface);
4691
4692 // Add multipath interface flows for kernel MPTCP
4693 necp_client_add_interface_option_if_needed(client, multi_interface->if_index,
4694 ifnet_get_generation(multi_interface), NULL, false);
4695 }
4696 }
4697 } else if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
4698 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) {
4699 if (direct_interface != NULL) {
4700 // If scoped, only listen on that interface
4701 // Add nexus agents for listeners
4702 necp_client_add_agent_interface_options(client, parsed_parameters, direct_interface);
4703
4704 // Add interface option in case it is not a nexus
4705 necp_client_add_interface_option_if_needed(client, direct_interface->if_index,
4706 ifnet_get_generation(direct_interface), NULL, false);
4707 }
4708 } else {
4709 // Get listener interface options from global list
4710 struct ifnet *listen_interface = NULL;
4711 TAILQ_FOREACH(listen_interface, &ifnet_head, if_link) {
4712 if ((listen_interface->if_flags & (IFF_UP | IFF_RUNNING)) &&
4713 necp_ifnet_matches_parameters(listen_interface, parsed_parameters, 0, NULL, true, false)) {
4714 // Add nexus agents for listeners
4715 necp_client_add_agent_interface_options(client, parsed_parameters, listen_interface);
4716 }
4717 }
4718 }
4719 } else if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) {
4720 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) {
4721 if (direct_interface != NULL) {
4722 // Add browse option if it has an agent
4723 necp_client_add_browse_interface_options(client, parsed_parameters, direct_interface);
4724 }
4725 } else {
4726 // Get browse interface options from global list
4727 struct ifnet *browse_interface = NULL;
4728 TAILQ_FOREACH(browse_interface, &ifnet_head, if_link) {
4729 if (necp_ifnet_matches_parameters(browse_interface, parsed_parameters, 0, NULL, true, false)) {
4730 necp_client_add_browse_interface_options(client, parsed_parameters, browse_interface);
4731 }
4732 }
4733 }
4734 }
4735
4736 struct necp_client_result_estimated_throughput throughput = {
4737 .up = 0,
4738 .down = 0,
4739 };
4740
4741 // Add agents
4742 if (original_scoped_interface != NULL) {
4743 ifnet_lock_shared(original_scoped_interface);
4744 if (original_scoped_interface->if_agentids != NULL) {
4745 for (u_int32_t i = 0; i < original_scoped_interface->if_agentcount; i++) {
4746 if (uuid_is_null(original_scoped_interface->if_agentids[i])) {
4747 continue;
4748 }
4749 bool skip_agent = false;
4750 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4751 if (uuid_is_null(result.netagents[j])) {
4752 break;
4753 }
4754 if ((result.netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) &&
4755 uuid_compare(original_scoped_interface->if_agentids[i], result.netagents[j]) == 0) {
4756 skip_agent = true;
4757 break;
4758 }
4759 }
4760 if (skip_agent) {
4761 continue;
4762 }
4763 uuid_copy(netagent.netagent_uuid, original_scoped_interface->if_agentids[i]);
4764 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4765 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE,
4766 original_scoped_interface->if_index, ifnet_get_generation(original_scoped_interface))) {
4767 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4768 client->result, sizeof(client->result));
4769 }
4770 }
4771 }
4772 ifnet_lock_done(original_scoped_interface);
4773 }
4774 if (direct_interface != NULL) {
4775 ifnet_lock_shared(direct_interface);
4776 throughput.up = direct_interface->if_estimated_up_bucket;
4777 throughput.down = direct_interface->if_estimated_down_bucket;
4778 if (direct_interface->if_agentids != NULL) {
4779 for (u_int32_t i = 0; i < direct_interface->if_agentcount; i++) {
4780 if (uuid_is_null(direct_interface->if_agentids[i])) {
4781 continue;
4782 }
4783 bool skip_agent = false;
4784 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4785 if (uuid_is_null(result.netagents[j])) {
4786 break;
4787 }
4788 if ((result.netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) &&
4789 uuid_compare(direct_interface->if_agentids[i], result.netagents[j]) == 0) {
4790 skip_agent = true;
4791 break;
4792 }
4793 }
4794 if (skip_agent) {
4795 continue;
4796 }
4797 uuid_copy(netagent.netagent_uuid, direct_interface->if_agentids[i]);
4798 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4799 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE,
4800 direct_interface->if_index, ifnet_get_generation(direct_interface))) {
4801 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4802 client->result, sizeof(client->result));
4803 }
4804 }
4805 }
4806 ifnet_lock_done(direct_interface);
4807 }
4808 if (delegate_interface != NULL) {
4809 ifnet_lock_shared(delegate_interface);
4810 if (throughput.up == 0 && throughput.down == 0) {
4811 throughput.up = delegate_interface->if_estimated_up_bucket;
4812 throughput.down = delegate_interface->if_estimated_down_bucket;
4813 }
4814 if (delegate_interface->if_agentids != NULL) {
4815 for (u_int32_t i = 0; i < delegate_interface->if_agentcount; i++) {
4816 if (uuid_is_null(delegate_interface->if_agentids[i])) {
4817 continue;
4818 }
4819 bool skip_agent = false;
4820 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4821 if (uuid_is_null(result.netagents[j])) {
4822 break;
4823 }
4824 if ((result.netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) &&
4825 uuid_compare(delegate_interface->if_agentids[i], result.netagents[j]) == 0) {
4826 skip_agent = true;
4827 break;
4828 }
4829 }
4830 if (skip_agent) {
4831 continue;
4832 }
4833 uuid_copy(netagent.netagent_uuid, delegate_interface->if_agentids[i]);
4834 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4835 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE,
4836 delegate_interface->if_index, ifnet_get_generation(delegate_interface))) {
4837 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4838 client->result, sizeof(client->result));
4839 }
4840 }
4841 }
4842 ifnet_lock_done(delegate_interface);
4843 }
4844 ifnet_head_done();
4845
4846 if (throughput.up != 0 || throughput.down != 0) {
4847 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_ESTIMATED_THROUGHPUT,
4848 sizeof(throughput), &throughput, &updated, client->result, sizeof(client->result));
4849 }
4850
4851 // Add interface options
4852 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
4853 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
4854 struct necp_client_interface_option *option = &client->interface_options[option_i];
4855 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated,
4856 client->result, sizeof(client->result));
4857 } else {
4858 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
4859 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated,
4860 client->result, sizeof(client->result));
4861 }
4862 }
4863
4864 size_t new_result_length = (cursor - client->result);
4865 if (new_result_length != client->result_length) {
4866 client->result_length = new_result_length;
4867 updated = TRUE;
4868 }
4869
4870 // Update flow viability/flags
4871 if (necp_client_update_flows(proc, client, defunct_list)) {
4872 updated = TRUE;
4873 }
4874
4875 if (updated) {
4876 client->result_read = FALSE;
4877 necp_client_update_observer_update(client);
4878 }
4879
4880 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4881 return updated;
4882 }
4883
4884 static bool
necp_defunct_client_fd_locked_inner(struct necp_fd_data * client_fd,struct _necp_flow_defunct_list * defunct_list,bool destroy_stats)4885 necp_defunct_client_fd_locked_inner(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, bool destroy_stats)
4886 {
4887 bool updated_result = FALSE;
4888 struct necp_client *client = NULL;
4889
4890 NECP_FD_ASSERT_LOCKED(client_fd);
4891
4892 RB_FOREACH(client, _necp_client_tree, &client_fd->clients) {
4893 struct necp_client_flow_registration *flow_registration = NULL;
4894
4895 NECP_CLIENT_LOCK(client);
4896
4897 // Prepare close events to be sent to the nexus to effectively remove the flows
4898 struct necp_client_flow *search_flow = NULL;
4899 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
4900 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
4901 if (search_flow->nexus &&
4902 !uuid_is_null(search_flow->u.nexus_agent)) {
4903 // Sleeping alloc won't fail; copy only what's necessary
4904 struct necp_flow_defunct *flow_defunct = kalloc_type(struct necp_flow_defunct, Z_WAITOK | Z_ZERO);
4905 uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent);
4906 uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
4907 client->client_id :
4908 flow_registration->registration_id));
4909 flow_defunct->proc_pid = client->proc_pid;
4910 flow_defunct->agent_handle = client->agent_handle;
4911 flow_defunct->flags = flow_registration->flags;
4912 #if SKYWALK
4913 if (flow_registration->kstats_kaddr != NULL) {
4914 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
4915 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
4916 if (quicstats != NULL &&
4917 quicstats->necp_quic_udp_stats.necp_udp_hdr.necp_stats_type == NECP_CLIENT_STATISTICS_TYPE_QUIC) {
4918 memcpy(flow_defunct->close_parameters.u.close_token, quicstats->necp_quic_extra.ssr_token, sizeof(flow_defunct->close_parameters.u.close_token));
4919 flow_defunct->has_close_parameters = true;
4920 }
4921 }
4922 #endif /* SKYWALK */
4923 // Add to the list provided by caller
4924 LIST_INSERT_HEAD(defunct_list, flow_defunct, chain);
4925
4926 flow_registration->defunct = true;
4927 flow_registration->flow_result_read = false;
4928 updated_result = true;
4929 }
4930 }
4931 }
4932 if (destroy_stats) {
4933 #if SKYWALK
4934 // Free any remaining stats objects back to the arena where they came from;
4935 // do this independent of the above defunct check, as the client may have
4936 // been marked as defunct separately via necp_defunct_client_for_policy().
4937 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
4938 necp_destroy_flow_stats(client_fd, flow_registration, NULL, FALSE);
4939 }
4940 #endif /* SKYWALK */
4941 }
4942 NECP_CLIENT_UNLOCK(client);
4943 }
4944
4945 return updated_result;
4946 }
4947
4948 static inline void
necp_defunct_client_fd_locked(struct necp_fd_data * client_fd,struct _necp_flow_defunct_list * defunct_list,struct proc * proc)4949 necp_defunct_client_fd_locked(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, struct proc *proc)
4950 {
4951 #pragma unused(proc)
4952 bool updated_result = FALSE;
4953
4954 NECP_FD_ASSERT_LOCKED(client_fd);
4955 #if SKYWALK
4956 // redirect regions of currently-active stats arena to zero-filled pages
4957 struct necp_arena_info *nai = necp_fd_mredirect_stats_arena(client_fd, proc);
4958 #endif /* SKYWALK */
4959
4960 updated_result = necp_defunct_client_fd_locked_inner(client_fd, defunct_list, true);
4961
4962 #if SKYWALK
4963 // and tear down the currently-active arena's regions now that the redirection and freeing are done
4964 if (nai != NULL) {
4965 ASSERT((nai->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT)) == NAIF_REDIRECT);
4966 ASSERT(nai->nai_arena != NULL);
4967 ASSERT(nai->nai_mmap.ami_mapref != NULL);
4968
4969 int err = skmem_arena_defunct(nai->nai_arena);
4970 VERIFY(err == 0);
4971
4972 nai->nai_flags |= NAIF_DEFUNCT;
4973 }
4974 #endif /* SKYWALK */
4975
4976 if (updated_result) {
4977 necp_fd_notify(client_fd, true);
4978 }
4979 }
4980
4981 static inline void
necp_update_client_fd_locked(struct necp_fd_data * client_fd,proc_t proc,struct _necp_flow_defunct_list * defunct_list)4982 necp_update_client_fd_locked(struct necp_fd_data *client_fd,
4983 proc_t proc,
4984 struct _necp_flow_defunct_list *defunct_list)
4985 {
4986 struct necp_client *client = NULL;
4987 bool updated_result = FALSE;
4988 NECP_FD_ASSERT_LOCKED(client_fd);
4989 RB_FOREACH(client, _necp_client_tree, &client_fd->clients) {
4990 NECP_CLIENT_LOCK(client);
4991 if (necp_update_client_result(proc, client_fd, client, defunct_list)) {
4992 updated_result = TRUE;
4993 }
4994 NECP_CLIENT_UNLOCK(client);
4995 }
4996 if (updated_result) {
4997 necp_fd_notify(client_fd, true);
4998 }
4999 }
5000
5001 #if SKYWALK
5002 static void
necp_close_empty_arenas_callout(__unused thread_call_param_t dummy,__unused thread_call_param_t arg)5003 necp_close_empty_arenas_callout(__unused thread_call_param_t dummy,
5004 __unused thread_call_param_t arg)
5005 {
5006 struct necp_fd_data *client_fd = NULL;
5007
5008 NECP_FD_LIST_LOCK_SHARED();
5009
5010 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
5011 NECP_FD_LOCK(client_fd);
5012 necp_stats_arenas_destroy(client_fd, FALSE);
5013 NECP_FD_UNLOCK(client_fd);
5014 }
5015
5016 NECP_FD_LIST_UNLOCK();
5017 }
5018 #endif /* SKYWALK */
5019
5020 static void
necp_update_all_clients_callout(__unused thread_call_param_t dummy,__unused thread_call_param_t arg)5021 necp_update_all_clients_callout(__unused thread_call_param_t dummy,
5022 __unused thread_call_param_t arg)
5023 {
5024 struct necp_fd_data *client_fd = NULL;
5025
5026 NECP_UPDATE_ALL_CLIENTS_LOCK_EXCLUSIVE();
5027 uint32_t count = necp_update_all_clients_sched_cnt;
5028 necp_update_all_clients_sched_cnt = 0;
5029 necp_update_all_clients_sched_abstime = 0;
5030 NECP_UPDATE_ALL_CLIENTS_UNLOCK();
5031
5032 if (necp_debug > 0) {
5033 NECPLOG(LOG_DEBUG,
5034 "necp_update_all_clients_callout running for coalesced %u updates",
5035 count);
5036 }
5037
5038 struct _necp_flow_defunct_list defunct_list;
5039 LIST_INIT(&defunct_list);
5040
5041 NECP_FD_LIST_LOCK_SHARED();
5042
5043 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
5044 proc_t proc = proc_find(client_fd->proc_pid);
5045 if (proc == PROC_NULL) {
5046 continue;
5047 }
5048
5049 // Update all clients on one fd
5050 NECP_FD_LOCK(client_fd);
5051 necp_update_client_fd_locked(client_fd, proc, &defunct_list);
5052 NECP_FD_UNLOCK(client_fd);
5053
5054 proc_rele(proc);
5055 proc = PROC_NULL;
5056 }
5057
5058 NECP_FD_LIST_UNLOCK();
5059
5060 // Handle the case in which some clients became newly defunct
5061 necp_process_defunct_list(&defunct_list);
5062 }
5063
5064 void
necp_update_all_clients(void)5065 necp_update_all_clients(void)
5066 {
5067 necp_update_all_clients_immediately_if_needed(false);
5068 }
5069
5070 void
necp_update_all_clients_immediately_if_needed(bool should_update_immediately)5071 necp_update_all_clients_immediately_if_needed(bool should_update_immediately)
5072 {
5073 if (necp_client_update_tcall == NULL) {
5074 // Don't try to update clients if the module is not initialized
5075 return;
5076 }
5077
5078 uint64_t deadline = 0;
5079 uint64_t leeway = 0;
5080
5081 uint32_t timeout_to_use = necp_timeout_microseconds;
5082 uint32_t leeway_to_use = necp_timeout_leeway_microseconds;
5083 if (should_update_immediately) {
5084 timeout_to_use = 1000 * 10; // 10ms
5085 leeway_to_use = 1000 * 10; // 10ms;
5086 }
5087
5088 clock_interval_to_deadline(timeout_to_use, NSEC_PER_USEC, &deadline);
5089 clock_interval_to_absolutetime_interval(leeway_to_use, NSEC_PER_USEC, &leeway);
5090
5091 NECP_UPDATE_ALL_CLIENTS_LOCK_EXCLUSIVE();
5092 bool need_cancel = false;
5093 bool need_schedule = true;
5094 uint64_t sched_abstime;
5095
5096 clock_absolutetime_interval_to_deadline(deadline + leeway, &sched_abstime);
5097
5098 /*
5099 * Do not push the timer if it is already scheduled
5100 */
5101 if (necp_update_all_clients_sched_abstime != 0) {
5102 need_schedule = false;
5103
5104 if (should_update_immediately) {
5105 /*
5106 * To update immediately we may have to cancel the current timer
5107 * if it's scheduled too far out.
5108 */
5109 if (necp_update_all_clients_sched_abstime > sched_abstime) {
5110 need_cancel = true;
5111 need_schedule = true;
5112 }
5113 }
5114 }
5115
5116 /*
5117 * Record the time of the deadline with leeway
5118 */
5119 if (need_schedule) {
5120 necp_update_all_clients_sched_abstime = sched_abstime;
5121 }
5122
5123 necp_update_all_clients_sched_cnt += 1;
5124 uint32_t count = necp_update_all_clients_sched_cnt;
5125 NECP_UPDATE_ALL_CLIENTS_UNLOCK();
5126
5127 if (need_schedule) {
5128 /*
5129 * Wait if the thread call is currently executing to make sure the
5130 * next update will be delivered to all clients
5131 */
5132 if (need_cancel) {
5133 (void) thread_call_cancel_wait(necp_client_update_tcall);
5134 }
5135
5136 (void) thread_call_enter_delayed_with_leeway(necp_client_update_tcall, NULL,
5137 deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
5138 }
5139 if (necp_debug > 0) {
5140 NECPLOG(LOG_DEBUG,
5141 "necp_update_all_clients immediate %s update %u",
5142 should_update_immediately ? "true" : "false", count);
5143 }
5144 }
5145
5146 bool
necp_set_client_as_background(proc_t proc,struct fileproc * fp,bool background)5147 necp_set_client_as_background(proc_t proc,
5148 struct fileproc *fp,
5149 bool background)
5150 {
5151 if (proc == PROC_NULL) {
5152 NECPLOG0(LOG_ERR, "NULL proc");
5153 return FALSE;
5154 }
5155
5156 if (fp == NULL) {
5157 NECPLOG0(LOG_ERR, "NULL fp");
5158 return FALSE;
5159 }
5160
5161 struct necp_fd_data *client_fd = (struct necp_fd_data *)fp_get_data(fp);
5162 if (client_fd == NULL) {
5163 NECPLOG0(LOG_ERR, "Could not find client structure for backgrounded client");
5164 return FALSE;
5165 }
5166
5167 if (client_fd->necp_fd_type != necp_fd_type_client) {
5168 // Not a client fd, ignore
5169 NECPLOG0(LOG_ERR, "Not a client fd, ignore");
5170 return FALSE;
5171 }
5172
5173 client_fd->background = background;
5174
5175 return TRUE;
5176 }
5177
5178 void
necp_fd_memstatus(proc_t proc,uint32_t status,struct necp_fd_data * client_fd)5179 necp_fd_memstatus(proc_t proc, uint32_t status,
5180 struct necp_fd_data *client_fd)
5181 {
5182 #pragma unused(proc, status, client_fd)
5183 ASSERT(proc != PROC_NULL);
5184 ASSERT(client_fd != NULL);
5185
5186 // Nothing to reap for the process or client for now,
5187 // but this is where we would trigger that in future.
5188 }
5189
5190 void
necp_fd_defunct(proc_t proc,struct necp_fd_data * client_fd)5191 necp_fd_defunct(proc_t proc, struct necp_fd_data *client_fd)
5192 {
5193 struct _necp_flow_defunct_list defunct_list;
5194
5195 ASSERT(proc != PROC_NULL);
5196 ASSERT(client_fd != NULL);
5197
5198 if (client_fd->necp_fd_type != necp_fd_type_client) {
5199 // Not a client fd, ignore
5200 return;
5201 }
5202
5203 // Our local temporary list
5204 LIST_INIT(&defunct_list);
5205
5206 // Need to hold lock so ntstats defunct the same set of clients
5207 NECP_FD_LOCK(client_fd);
5208 #if SKYWALK
5209 // Shut down statistics
5210 nstats_userland_stats_defunct_for_process(proc_getpid(proc));
5211 #endif /* SKYWALK */
5212 necp_defunct_client_fd_locked(client_fd, &defunct_list, proc);
5213 NECP_FD_UNLOCK(client_fd);
5214
5215 necp_process_defunct_list(&defunct_list);
5216 }
5217
5218 static void
necp_client_remove_agent_from_result(struct necp_client * client,uuid_t netagent_uuid)5219 necp_client_remove_agent_from_result(struct necp_client *client, uuid_t netagent_uuid)
5220 {
5221 size_t offset = 0;
5222
5223 u_int8_t *result_buffer = client->result;
5224 while ((offset + sizeof(struct necp_tlv_header)) <= client->result_length) {
5225 u_int8_t type = necp_buffer_get_tlv_type(result_buffer, offset);
5226 u_int32_t length = necp_buffer_get_tlv_length(result_buffer, offset);
5227
5228 size_t tlv_total_length = (sizeof(struct necp_tlv_header) + length);
5229 if (type == NECP_CLIENT_RESULT_NETAGENT &&
5230 length == sizeof(struct necp_client_result_netagent) &&
5231 (offset + tlv_total_length) <= client->result_length) {
5232 struct necp_client_result_netagent *value = ((struct necp_client_result_netagent *)(void *)
5233 necp_buffer_get_tlv_value(result_buffer, offset, NULL));
5234 if (uuid_compare(value->netagent_uuid, netagent_uuid) == 0) {
5235 // Found a netagent to remove
5236 // Shift bytes down to remove the tlv, and adjust total length
5237 // Don't adjust the current offset
5238 memmove(result_buffer + offset,
5239 result_buffer + offset + tlv_total_length,
5240 client->result_length - (offset + tlv_total_length));
5241 client->result_length -= tlv_total_length;
5242 memset(result_buffer + client->result_length, 0, sizeof(client->result) - client->result_length);
5243 continue;
5244 }
5245 }
5246
5247 offset += tlv_total_length;
5248 }
5249 }
5250
5251 void
necp_force_update_client(uuid_t client_id,uuid_t remove_netagent_uuid,u_int32_t agent_generation)5252 necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid, u_int32_t agent_generation)
5253 {
5254 struct necp_fd_data *client_fd = NULL;
5255
5256 NECP_FD_LIST_LOCK_SHARED();
5257
5258 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
5259 bool updated_result = FALSE;
5260 NECP_FD_LOCK(client_fd);
5261 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
5262 if (client != NULL) {
5263 client->failed_trigger_agent.generation = agent_generation;
5264 uuid_copy(client->failed_trigger_agent.netagent_uuid, remove_netagent_uuid);
5265 if (!uuid_is_null(remove_netagent_uuid)) {
5266 necp_client_remove_agent_from_result(client, remove_netagent_uuid);
5267 }
5268 client->result_read = FALSE;
5269 // Found the client, break
5270 updated_result = TRUE;
5271 NECP_CLIENT_UNLOCK(client);
5272 }
5273 if (updated_result) {
5274 necp_fd_notify(client_fd, true);
5275 }
5276 NECP_FD_UNLOCK(client_fd);
5277 if (updated_result) {
5278 // Found the client, break
5279 break;
5280 }
5281 }
5282
5283 NECP_FD_LIST_UNLOCK();
5284 }
5285
5286 #if SKYWALK
5287 void
necp_client_early_close(uuid_t client_id)5288 necp_client_early_close(uuid_t client_id)
5289 {
5290 NECP_CLIENT_TREE_LOCK_SHARED();
5291
5292 struct necp_client *client = necp_find_client_and_lock(client_id);
5293 if (client != NULL) {
5294 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
5295 if (flow_registration != NULL) {
5296 // Found the right client and flow, mark the stats as over
5297 if (flow_registration->stats_handler_context != NULL) {
5298 ntstat_userland_stats_event(flow_registration->stats_handler_context,
5299 NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT);
5300 }
5301 }
5302 NECP_CLIENT_UNLOCK(client);
5303 }
5304
5305 NECP_CLIENT_TREE_UNLOCK();
5306 }
5307 #endif /* SKYWALK */
5308
5309 /// Interface matching
5310
5311 #define NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
5312 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF | \
5313 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
5314 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE | \
5315 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
5316 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT | \
5317 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
5318 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \
5319 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \
5320 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE | \
5321 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \
5322 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
5323
5324 #define NECP_PARSED_PARAMETERS_SCOPED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
5325 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
5326 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
5327 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
5328 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \
5329 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE)
5330
5331 #define NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
5332 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)
5333
5334 #define NECP_PARSED_PARAMETERS_PREFERRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
5335 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \
5336 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \
5337 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
5338
5339 static bool
necp_ifnet_matches_type(struct ifnet * ifp,u_int8_t interface_type,bool check_delegates)5340 necp_ifnet_matches_type(struct ifnet *ifp, u_int8_t interface_type, bool check_delegates)
5341 {
5342 struct ifnet *check_ifp = ifp;
5343 while (check_ifp) {
5344 if (if_functional_type(check_ifp, TRUE) == interface_type) {
5345 return TRUE;
5346 }
5347 if (!check_delegates) {
5348 break;
5349 }
5350 check_ifp = check_ifp->if_delegated.ifp;
5351 }
5352 return FALSE;
5353 }
5354
5355 static bool
necp_ifnet_matches_name(struct ifnet * ifp,const char * interface_name,bool check_delegates)5356 necp_ifnet_matches_name(struct ifnet *ifp, const char *interface_name, bool check_delegates)
5357 {
5358 struct ifnet *check_ifp = ifp;
5359 while (check_ifp) {
5360 if (strncmp(check_ifp->if_xname, interface_name, IFXNAMSIZ) == 0) {
5361 return TRUE;
5362 }
5363 if (!check_delegates) {
5364 break;
5365 }
5366 check_ifp = check_ifp->if_delegated.ifp;
5367 }
5368 return FALSE;
5369 }
5370
5371 static bool
necp_ifnet_matches_agent(struct ifnet * ifp,uuid_t * agent_uuid,bool check_delegates)5372 necp_ifnet_matches_agent(struct ifnet *ifp, uuid_t *agent_uuid, bool check_delegates)
5373 {
5374 struct ifnet *check_ifp = ifp;
5375
5376 while (check_ifp != NULL) {
5377 ifnet_lock_shared(check_ifp);
5378 if (check_ifp->if_agentids != NULL) {
5379 for (u_int32_t index = 0; index < check_ifp->if_agentcount; index++) {
5380 if (uuid_compare(check_ifp->if_agentids[index], *agent_uuid) == 0) {
5381 ifnet_lock_done(check_ifp);
5382 return TRUE;
5383 }
5384 }
5385 }
5386 ifnet_lock_done(check_ifp);
5387
5388 if (!check_delegates) {
5389 break;
5390 }
5391 check_ifp = check_ifp->if_delegated.ifp;
5392 }
5393 return FALSE;
5394 }
5395
5396 static bool
necp_ifnet_matches_agent_type(struct ifnet * ifp,const char * agent_domain,const char * agent_type,bool check_delegates)5397 necp_ifnet_matches_agent_type(struct ifnet *ifp, const char *agent_domain, const char *agent_type, bool check_delegates)
5398 {
5399 struct ifnet *check_ifp = ifp;
5400
5401 while (check_ifp != NULL) {
5402 ifnet_lock_shared(check_ifp);
5403 if (check_ifp->if_agentids != NULL) {
5404 for (u_int32_t index = 0; index < check_ifp->if_agentcount; index++) {
5405 if (uuid_is_null(check_ifp->if_agentids[index])) {
5406 continue;
5407 }
5408
5409 char if_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
5410 char if_agent_type[NETAGENT_TYPESIZE] = { 0 };
5411
5412 if (netagent_get_agent_domain_and_type(check_ifp->if_agentids[index], if_agent_domain, if_agent_type)) {
5413 if (necp_agent_types_match(agent_domain, agent_type, if_agent_domain, if_agent_type)) {
5414 ifnet_lock_done(check_ifp);
5415 return TRUE;
5416 }
5417 }
5418 }
5419 }
5420 ifnet_lock_done(check_ifp);
5421
5422 if (!check_delegates) {
5423 break;
5424 }
5425 check_ifp = check_ifp->if_delegated.ifp;
5426 }
5427 return FALSE;
5428 }
5429
5430 static bool
necp_ifnet_matches_local_address(struct ifnet * ifp,struct sockaddr * sa)5431 necp_ifnet_matches_local_address(struct ifnet *ifp, struct sockaddr *sa)
5432 {
5433 struct ifaddr *ifa = NULL;
5434 bool matched_local_address = FALSE;
5435
5436 // Transform sa into the ifaddr form
5437 // IPv6 Scope IDs are always embedded in the ifaddr list
5438 struct sockaddr_storage address;
5439 u_int ifscope = IFSCOPE_NONE;
5440 (void)sa_copy(sa, &address, &ifscope);
5441 SIN(&address)->sin_port = 0;
5442 if (address.ss_family == AF_INET6) {
5443 if (in6_embedded_scope ||
5444 !IN6_IS_SCOPE_EMBED(&SIN6(&address)->sin6_addr)) {
5445 SIN6(&address)->sin6_scope_id = 0;
5446 }
5447 }
5448
5449 ifa = ifa_ifwithaddr_scoped_locked((struct sockaddr *)&address, ifp->if_index);
5450 matched_local_address = (ifa != NULL);
5451
5452 if (ifa) {
5453 ifaddr_release(ifa);
5454 }
5455
5456 return matched_local_address;
5457 }
5458
5459 static bool
necp_interface_type_should_match_unranked_interfaces(u_int8_t interface_type)5460 necp_interface_type_should_match_unranked_interfaces(u_int8_t interface_type)
5461 {
5462 switch (interface_type) {
5463 // These are the interface types we allow a client to request even if the matching
5464 // interface isn't currently eligible to be primary (has default route, dns, etc)
5465 case IFRTYPE_FUNCTIONAL_WIFI_AWDL:
5466 case IFRTYPE_FUNCTIONAL_INTCOPROC:
5467 case IFRTYPE_FUNCTIONAL_COMPANIONLINK:
5468 return true;
5469 default:
5470 break;
5471 }
5472 return false;
5473 }
5474
5475 #define NECP_IFP_IS_ON_ORDERED_LIST(_ifp) ((_ifp)->if_ordered_link.tqe_next != NULL || (_ifp)->if_ordered_link.tqe_prev != NULL)
5476
5477 // Secondary interface flag indicates that the interface is being
5478 // used for multipath or a listener as an extra path
5479 static bool
necp_ifnet_matches_parameters(struct ifnet * ifp,struct necp_client_parsed_parameters * parsed_parameters,u_int32_t override_flags,u_int32_t * preferred_count,bool secondary_interface,bool require_scoped_field)5480 necp_ifnet_matches_parameters(struct ifnet *ifp,
5481 struct necp_client_parsed_parameters *parsed_parameters,
5482 u_int32_t override_flags,
5483 u_int32_t *preferred_count,
5484 bool secondary_interface,
5485 bool require_scoped_field)
5486 {
5487 bool matched_some_scoped_field = FALSE;
5488
5489 if (preferred_count) {
5490 *preferred_count = 0;
5491 }
5492
5493 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) {
5494 if (parsed_parameters->required_interface_index != ifp->if_index) {
5495 return FALSE;
5496 }
5497 }
5498 #if SKYWALK
5499 else {
5500 if (ifnet_is_low_latency(ifp)) {
5501 return FALSE;
5502 }
5503 }
5504 #endif /* SKYWALK */
5505
5506 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR) {
5507 if (!necp_ifnet_matches_local_address(ifp, SA(&parsed_parameters->local_addr.sa))) {
5508 return FALSE;
5509 }
5510 if (require_scoped_field) {
5511 matched_some_scoped_field = TRUE;
5512 }
5513 }
5514
5515 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) {
5516 if (override_flags != 0) {
5517 if ((override_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) &&
5518 IFNET_IS_EXPENSIVE(ifp)) {
5519 return FALSE;
5520 }
5521 if ((override_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED) &&
5522 IFNET_IS_CONSTRAINED(ifp)) {
5523 return FALSE;
5524 }
5525 } else {
5526 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) &&
5527 IFNET_IS_EXPENSIVE(ifp)) {
5528 return FALSE;
5529 }
5530 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED) &&
5531 IFNET_IS_CONSTRAINED(ifp)) {
5532 return FALSE;
5533 }
5534 }
5535 }
5536
5537 if ((!secondary_interface || // Enforce interface type if this is the primary interface
5538 !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) || // or if there are no flags
5539 !(parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE)) && // or if the flags don't give an exception
5540 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) &&
5541 !necp_ifnet_matches_type(ifp, parsed_parameters->required_interface_type, FALSE)) {
5542 return FALSE;
5543 }
5544
5545 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) {
5546 if (require_scoped_field) {
5547 matched_some_scoped_field = TRUE;
5548 }
5549 }
5550
5551 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE) {
5552 for (int i = 0; i < NECP_MAX_INTERFACE_PARAMETERS; i++) {
5553 if (parsed_parameters->prohibited_interface_types[i] == 0) {
5554 break;
5555 }
5556
5557 if (necp_ifnet_matches_type(ifp, parsed_parameters->prohibited_interface_types[i], TRUE)) {
5558 return FALSE;
5559 }
5560 }
5561 }
5562
5563 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF) {
5564 for (int i = 0; i < NECP_MAX_INTERFACE_PARAMETERS; i++) {
5565 if (strlen(parsed_parameters->prohibited_interfaces[i]) == 0) {
5566 break;
5567 }
5568
5569 if (necp_ifnet_matches_name(ifp, parsed_parameters->prohibited_interfaces[i], TRUE)) {
5570 return FALSE;
5571 }
5572 }
5573 }
5574
5575 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
5576 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5577 if (uuid_is_null(parsed_parameters->required_netagents[i])) {
5578 break;
5579 }
5580
5581 if (!necp_ifnet_matches_agent(ifp, &parsed_parameters->required_netagents[i], FALSE)) {
5582 return FALSE;
5583 }
5584
5585 if (require_scoped_field) {
5586 matched_some_scoped_field = TRUE;
5587 }
5588 }
5589 }
5590
5591 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT) {
5592 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5593 if (uuid_is_null(parsed_parameters->prohibited_netagents[i])) {
5594 break;
5595 }
5596
5597 if (necp_ifnet_matches_agent(ifp, &parsed_parameters->prohibited_netagents[i], TRUE)) {
5598 return FALSE;
5599 }
5600 }
5601 }
5602
5603 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
5604 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5605 if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 &&
5606 strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
5607 break;
5608 }
5609
5610 if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->required_netagent_types[i].netagent_domain, parsed_parameters->required_netagent_types[i].netagent_type, FALSE)) {
5611 return FALSE;
5612 }
5613
5614 if (require_scoped_field) {
5615 matched_some_scoped_field = TRUE;
5616 }
5617 }
5618 }
5619
5620 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE) {
5621 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5622 if (strlen(parsed_parameters->prohibited_netagent_types[i].netagent_domain) == 0 &&
5623 strlen(parsed_parameters->prohibited_netagent_types[i].netagent_type) == 0) {
5624 break;
5625 }
5626
5627 if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->prohibited_netagent_types[i].netagent_domain, parsed_parameters->prohibited_netagent_types[i].netagent_type, TRUE)) {
5628 return FALSE;
5629 }
5630 }
5631 }
5632
5633 // Checked preferred properties
5634 if (preferred_count) {
5635 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT) {
5636 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5637 if (uuid_is_null(parsed_parameters->preferred_netagents[i])) {
5638 break;
5639 }
5640
5641 if (necp_ifnet_matches_agent(ifp, &parsed_parameters->preferred_netagents[i], TRUE)) {
5642 (*preferred_count)++;
5643 if (require_scoped_field) {
5644 matched_some_scoped_field = TRUE;
5645 }
5646 }
5647 }
5648 }
5649
5650 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE) {
5651 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5652 if (strlen(parsed_parameters->preferred_netagent_types[i].netagent_domain) == 0 &&
5653 strlen(parsed_parameters->preferred_netagent_types[i].netagent_type) == 0) {
5654 break;
5655 }
5656
5657 if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->preferred_netagent_types[i].netagent_domain, parsed_parameters->preferred_netagent_types[i].netagent_type, TRUE)) {
5658 (*preferred_count)++;
5659 if (require_scoped_field) {
5660 matched_some_scoped_field = TRUE;
5661 }
5662 }
5663 }
5664 }
5665
5666 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT) {
5667 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5668 if (uuid_is_null(parsed_parameters->avoided_netagents[i])) {
5669 break;
5670 }
5671
5672 if (!necp_ifnet_matches_agent(ifp, &parsed_parameters->avoided_netagents[i], TRUE)) {
5673 (*preferred_count)++;
5674 }
5675 }
5676 }
5677
5678 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE) {
5679 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5680 if (strlen(parsed_parameters->avoided_netagent_types[i].netagent_domain) == 0 &&
5681 strlen(parsed_parameters->avoided_netagent_types[i].netagent_type) == 0) {
5682 break;
5683 }
5684
5685 if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->avoided_netagent_types[i].netagent_domain,
5686 parsed_parameters->avoided_netagent_types[i].netagent_type, TRUE)) {
5687 (*preferred_count)++;
5688 }
5689 }
5690 }
5691 }
5692
5693 if (require_scoped_field) {
5694 return matched_some_scoped_field;
5695 }
5696
5697 return TRUE;
5698 }
5699
5700 static bool
necp_find_matching_interface_index(struct necp_client_parsed_parameters * parsed_parameters,u_int * return_ifindex,bool * validate_agents)5701 necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters,
5702 u_int *return_ifindex, bool *validate_agents)
5703 {
5704 struct ifnet *ifp = NULL;
5705 u_int32_t best_preferred_count = 0;
5706 bool has_preferred_fields = FALSE;
5707 *return_ifindex = 0;
5708
5709 if (parsed_parameters->required_interface_index != 0) {
5710 *return_ifindex = parsed_parameters->required_interface_index;
5711 return TRUE;
5712 }
5713
5714 // Check and save off flags
5715 u_int32_t flags = 0;
5716 bool has_prohibit_flags = FALSE;
5717 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) {
5718 flags = parsed_parameters->flags;
5719 has_prohibit_flags = (parsed_parameters->flags &
5720 (NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE |
5721 NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED));
5722 }
5723
5724 if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS) &&
5725 !has_prohibit_flags) {
5726 return TRUE;
5727 }
5728
5729 has_preferred_fields = (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS);
5730
5731 // We have interesting parameters to parse and find a matching interface
5732 ifnet_head_lock_shared();
5733
5734 if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS) &&
5735 !has_preferred_fields) {
5736 // We do have fields to match, but they are only prohibitory
5737 // If the first interface in the list matches, or there are no ordered interfaces, we don't need to scope
5738 ifp = TAILQ_FIRST(&ifnet_ordered_head);
5739 if (ifp == NULL || necp_ifnet_matches_parameters(ifp, parsed_parameters, 0, NULL, false, false)) {
5740 // Don't set return_ifindex, so the client doesn't need to scope
5741 ifnet_head_done();
5742 return TRUE;
5743 }
5744 }
5745
5746 // First check the ordered interface list
5747 TAILQ_FOREACH(ifp, &ifnet_ordered_head, if_ordered_link) {
5748 u_int32_t preferred_count = 0;
5749 if (necp_ifnet_matches_parameters(ifp, parsed_parameters, flags, &preferred_count, false, false)) {
5750 if (preferred_count > best_preferred_count ||
5751 *return_ifindex == 0) {
5752 // Everything matched, and is most preferred. Return this interface.
5753 *return_ifindex = ifp->if_index;
5754 best_preferred_count = preferred_count;
5755
5756 if (!has_preferred_fields) {
5757 break;
5758 }
5759 }
5760 }
5761
5762 if (has_prohibit_flags &&
5763 ifp == TAILQ_FIRST(&ifnet_ordered_head)) {
5764 // This was the first interface. From here on, if the
5765 // client prohibited either expensive or constrained,
5766 // don't allow either as a secondary interface option.
5767 flags |= (NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE |
5768 NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED);
5769 }
5770 }
5771
5772 bool is_listener = ((parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
5773 (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER));
5774
5775 // Then check the remaining interfaces
5776 if ((parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS) &&
5777 ((!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)) ||
5778 necp_interface_type_should_match_unranked_interfaces(parsed_parameters->required_interface_type) ||
5779 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR) ||
5780 is_listener) &&
5781 (*return_ifindex == 0 || has_preferred_fields)) {
5782 TAILQ_FOREACH(ifp, &ifnet_head, if_link) {
5783 u_int32_t preferred_count = 0;
5784 if (NECP_IFP_IS_ON_ORDERED_LIST(ifp)) {
5785 // This interface was in the ordered list, skip
5786 continue;
5787 }
5788 if (necp_ifnet_matches_parameters(ifp, parsed_parameters, flags, &preferred_count, false, true)) {
5789 if (preferred_count > best_preferred_count ||
5790 *return_ifindex == 0) {
5791 // Everything matched, and is most preferred. Return this interface.
5792 *return_ifindex = ifp->if_index;
5793 best_preferred_count = preferred_count;
5794
5795 if (!has_preferred_fields) {
5796 break;
5797 }
5798 }
5799 }
5800 }
5801 }
5802
5803 ifnet_head_done();
5804
5805 if (has_preferred_fields && best_preferred_count == 0 &&
5806 ((parsed_parameters->valid_fields & (NECP_PARSED_PARAMETERS_SCOPED_FIELDS | NECP_PARSED_PARAMETERS_PREFERRED_FIELDS)) ==
5807 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS))) {
5808 // If only has preferred ifnet fields, and nothing was found, clear the interface index and return TRUE
5809 *return_ifindex = 0;
5810 return TRUE;
5811 }
5812
5813 if (*return_ifindex == 0 &&
5814 !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS)) {
5815 // Has required fields, but not including specific interface fields. Pass for now, and check
5816 // to see if agents are satisfied by policy.
5817 *validate_agents = TRUE;
5818 return TRUE;
5819 }
5820
5821 return *return_ifindex != 0;
5822 }
5823
5824 void
necp_copy_inp_domain_info(struct inpcb * inp,struct socket * so,nstat_domain_info * domain_info)5825 necp_copy_inp_domain_info(struct inpcb *inp, struct socket *so, nstat_domain_info *domain_info)
5826 {
5827 if (inp == NULL || so == NULL || domain_info == NULL) {
5828 return;
5829 }
5830
5831 necp_lock_socket_attributes();
5832
5833 domain_info->is_tracker = !!(so->so_flags1 & SOF1_KNOWN_TRACKER);
5834 domain_info->is_non_app_initiated = !!(so->so_flags1 & SOF1_TRACKER_NON_APP_INITIATED);
5835 if (domain_info->is_tracker &&
5836 inp->inp_necp_attributes.inp_tracker_domain != NULL) {
5837 strlcpy(domain_info->domain_name, inp->inp_necp_attributes.inp_tracker_domain,
5838 sizeof(domain_info->domain_name));
5839 } else if (inp->inp_necp_attributes.inp_domain != NULL) {
5840 strlcpy(domain_info->domain_name, inp->inp_necp_attributes.inp_domain,
5841 sizeof(domain_info->domain_name));
5842 }
5843 if (inp->inp_necp_attributes.inp_domain_owner != NULL) {
5844 strlcpy(domain_info->domain_owner, inp->inp_necp_attributes.inp_domain_owner,
5845 sizeof(domain_info->domain_owner));
5846 }
5847 if (inp->inp_necp_attributes.inp_domain_context != NULL) {
5848 strlcpy(domain_info->domain_tracker_ctxt, inp->inp_necp_attributes.inp_domain_context,
5849 sizeof(domain_info->domain_tracker_ctxt));
5850 }
5851
5852 necp_unlock_socket_attributes();
5853 }
5854
5855 void
necp_with_inp_domain_name(struct socket * so,void * ctx,void (* with_func)(char * domain_name,void * ctx))5856 necp_with_inp_domain_name(struct socket *so, void *ctx, void (*with_func)(char *domain_name, void *ctx))
5857 {
5858 struct inpcb *inp = NULL;
5859
5860 if (so == NULL || with_func == NULL) {
5861 return;
5862 }
5863
5864 inp = (struct inpcb *)so->so_pcb;
5865 if (inp == NULL) {
5866 return;
5867 }
5868
5869 necp_lock_socket_attributes();
5870 with_func(inp->inp_necp_attributes.inp_domain, ctx);
5871 necp_unlock_socket_attributes();
5872 }
5873
5874 static size_t
necp_find_domain_info_common(struct necp_client * client,u_int8_t * parameters,size_t parameters_size,struct necp_client_flow_registration * flow_registration,nstat_domain_info * domain_info)5875 necp_find_domain_info_common(struct necp_client *client,
5876 u_int8_t *parameters,
5877 size_t parameters_size,
5878 struct necp_client_flow_registration *flow_registration, /* For logging purposes only */
5879 nstat_domain_info *domain_info)
5880 {
5881 if (client == NULL) {
5882 return 0;
5883 }
5884 if (domain_info == NULL) {
5885 return sizeof(nstat_domain_info);
5886 }
5887
5888 size_t offset = 0;
5889 u_int32_t flags = 0;
5890 u_int8_t *tracker_domain = NULL;
5891 u_int8_t *domain = NULL;
5892 size_t tracker_domain_length = 0;
5893 size_t domain_length = 0;
5894
5895 NECP_CLIENT_FLOW_LOG(client, flow_registration, "Collecting stats");
5896
5897 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
5898 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
5899 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
5900
5901 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
5902 // If the length is larger than what can fit in the remaining parameters size, bail
5903 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
5904 break;
5905 }
5906
5907 if (length > 0) {
5908 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
5909 if (value != NULL) {
5910 switch (type) {
5911 case NECP_CLIENT_PARAMETER_FLAGS: {
5912 if (length >= sizeof(u_int32_t)) {
5913 memcpy(&flags, value, sizeof(u_int32_t));
5914 }
5915
5916 domain_info->is_tracker =
5917 !!(flags & NECP_CLIENT_PARAMETER_FLAG_KNOWN_TRACKER);
5918 domain_info->is_non_app_initiated =
5919 !!(flags & NECP_CLIENT_PARAMETER_FLAG_NON_APP_INITIATED);
5920 domain_info->is_silent =
5921 !!(flags & NECP_CLIENT_PARAMETER_FLAG_SILENT);
5922 break;
5923 }
5924 case NECP_CLIENT_PARAMETER_TRACKER_DOMAIN: {
5925 tracker_domain_length = length;
5926 tracker_domain = value;
5927 break;
5928 }
5929 case NECP_CLIENT_PARAMETER_DOMAIN: {
5930 domain_length = length;
5931 domain = value;
5932 break;
5933 }
5934 case NECP_CLIENT_PARAMETER_DOMAIN_OWNER: {
5935 size_t length_to_copy = MIN(length, sizeof(domain_info->domain_owner));
5936 strlcpy(domain_info->domain_owner, (const char *)value, length_to_copy);
5937 break;
5938 }
5939 case NECP_CLIENT_PARAMETER_DOMAIN_CONTEXT: {
5940 size_t length_to_copy = MIN(length, sizeof(domain_info->domain_tracker_ctxt));
5941 strlcpy(domain_info->domain_tracker_ctxt, (const char *)value, length_to_copy);
5942 break;
5943 }
5944 case NECP_CLIENT_PARAMETER_ATTRIBUTED_BUNDLE_IDENTIFIER: {
5945 size_t length_to_copy = MIN(length, sizeof(domain_info->domain_attributed_bundle_id));
5946 strlcpy(domain_info->domain_attributed_bundle_id, (const char *)value, length_to_copy);
5947 break;
5948 }
5949 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
5950 if (length >= sizeof(struct necp_policy_condition_addr)) {
5951 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
5952 if (necp_client_address_is_valid(&address_struct->address.sa)) {
5953 memcpy(&domain_info->remote, &address_struct->address, sizeof(address_struct->address));
5954 }
5955 }
5956 break;
5957 }
5958 default: {
5959 break;
5960 }
5961 }
5962 }
5963 }
5964 offset += sizeof(struct necp_tlv_header) + length;
5965 }
5966
5967 if (domain_info->is_tracker && tracker_domain != NULL && tracker_domain_length > 0) {
5968 size_t length_to_copy = MIN(tracker_domain_length, sizeof(domain_info->domain_name));
5969 strlcpy(domain_info->domain_name, (const char *)tracker_domain, length_to_copy);
5970 } else if (domain != NULL && domain_length > 0) {
5971 size_t length_to_copy = MIN(domain_length, sizeof(domain_info->domain_name));
5972 strlcpy(domain_info->domain_name, (const char *)domain, length_to_copy);
5973 }
5974
5975 NECP_CLIENT_FLOW_LOG(client, flow_registration,
5976 "Collected stats - domain <%s> owner <%s> ctxt <%s> bundle id <%s> "
5977 "is_tracker %d is_non_app_initiated %d is_silent %d",
5978 domain_info->domain_name,
5979 domain_info->domain_owner,
5980 domain_info->domain_tracker_ctxt,
5981 domain_info->domain_attributed_bundle_id,
5982 domain_info->is_tracker,
5983 domain_info->is_non_app_initiated,
5984 domain_info->is_silent);
5985
5986 return sizeof(nstat_domain_info);
5987 }
5988
5989 static size_t
necp_find_conn_extension_info(nstat_provider_context ctx,int requested_extension,void * buf,size_t buf_size)5990 necp_find_conn_extension_info(nstat_provider_context ctx,
5991 int requested_extension, /* The extension to be returned */
5992 void *buf, /* If not NULL, the address for extensions to be returned in */
5993 size_t buf_size) /* The size of the buffer space, typically matching the return from a previous call with a NULL buf pointer */
5994 {
5995 // Note, the caller has guaranteed that any buffer has been zeroed, there is no need to clear it again
5996
5997 if (ctx == NULL) {
5998 return 0;
5999 }
6000 struct necp_client *client = (struct necp_client *)ctx;
6001 switch (requested_extension) {
6002 case NSTAT_EXTENDED_UPDATE_TYPE_DOMAIN:
6003 // This is for completeness. The intent is that domain information can be extracted at user level from the TLV parameters
6004 if (buf == NULL) {
6005 return sizeof(nstat_domain_info);
6006 }
6007 if (buf_size < sizeof(nstat_domain_info)) {
6008 return 0;
6009 }
6010 return necp_find_domain_info_common(client, client->parameters, client->parameters_length, NULL, (nstat_domain_info *)buf);
6011
6012 case NSTAT_EXTENDED_UPDATE_TYPE_NECP_TLV: {
6013 size_t parameters_length = client->parameters_length;
6014 if (buf == NULL) {
6015 return parameters_length;
6016 }
6017 if (buf_size < parameters_length) {
6018 return 0;
6019 }
6020 memcpy(buf, client->parameters, parameters_length);
6021 return parameters_length;
6022 }
6023 case NSTAT_EXTENDED_UPDATE_TYPE_ORIGINAL_NECP_TLV:
6024 if (buf == NULL) {
6025 return (client->original_parameters_source != NULL) ? client->original_parameters_source->parameters_length : 0;
6026 }
6027 if ((client->original_parameters_source == NULL) || (buf_size < client->original_parameters_source->parameters_length)) {
6028 return 0;
6029 }
6030 memcpy(buf, client->original_parameters_source->parameters, client->original_parameters_source->parameters_length);
6031 return client->original_parameters_source->parameters_length;
6032
6033 case NSTAT_EXTENDED_UPDATE_TYPE_ORIGINAL_DOMAIN:
6034 if (buf == NULL) {
6035 return (client->original_parameters_source != NULL) ? sizeof(nstat_domain_info) : 0;
6036 }
6037 if ((buf_size < sizeof(nstat_domain_info)) || (client->original_parameters_source == NULL)) {
6038 return 0;
6039 }
6040 return necp_find_domain_info_common(client, client->original_parameters_source->parameters, client->original_parameters_source->parameters_length,
6041 NULL, (nstat_domain_info *)buf);
6042
6043 default:
6044 return 0;
6045 }
6046 }
6047
6048 #if SKYWALK
6049
6050 static size_t
necp_find_extension_info(userland_stats_provider_context * ctx,int requested_extension,void * buf,size_t buf_size)6051 necp_find_extension_info(userland_stats_provider_context *ctx,
6052 int requested_extension, /* The extension to be returned */
6053 void *buf, /* If not NULL, the address for extensions to be returned in */
6054 size_t buf_size) /* The size of the buffer space, typically matching the return from a previous call with a NULL buf pointer */
6055 {
6056 if (ctx == NULL) {
6057 return 0;
6058 }
6059 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6060 struct necp_client *client = flow_registration->client;
6061
6062 switch (requested_extension) {
6063 case NSTAT_EXTENDED_UPDATE_TYPE_DOMAIN:
6064 if (buf == NULL) {
6065 return sizeof(nstat_domain_info);
6066 }
6067 if (buf_size < sizeof(nstat_domain_info)) {
6068 return 0;
6069 }
6070 return necp_find_domain_info_common(client, client->parameters, client->parameters_length, flow_registration, (nstat_domain_info *)buf);
6071
6072 case NSTAT_EXTENDED_UPDATE_TYPE_NECP_TLV:
6073 if (buf == NULL) {
6074 return client->parameters_length;
6075 }
6076 if (buf_size < client->parameters_length) {
6077 return 0;
6078 }
6079 memcpy(buf, client->parameters, client->parameters_length);
6080 return client->parameters_length;
6081
6082 case NSTAT_EXTENDED_UPDATE_TYPE_FUUID:
6083 if (buf == NULL) {
6084 return sizeof(uuid_t);
6085 }
6086 if (buf_size < sizeof(uuid_t)) {
6087 return 0;
6088 }
6089 uuid_copy(buf, flow_registration->registration_id);
6090 return sizeof(uuid_t);
6091
6092 default:
6093 return 0;
6094 }
6095 }
6096
6097 static void
necp_find_netstat_data(struct necp_client * client,union necp_sockaddr_union * remote,pid_t * effective_pid,uuid_t euuid,u_int32_t * traffic_class,u_int8_t * fallback_mode)6098 necp_find_netstat_data(struct necp_client *client,
6099 union necp_sockaddr_union *remote,
6100 pid_t *effective_pid,
6101 uuid_t euuid,
6102 u_int32_t *traffic_class,
6103 u_int8_t *fallback_mode)
6104 {
6105 size_t offset = 0;
6106 u_int8_t *parameters;
6107 u_int32_t parameters_size;
6108
6109 parameters = client->parameters;
6110 parameters_size = (u_int32_t)client->parameters_length;
6111
6112 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
6113 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
6114 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
6115
6116 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
6117 // If the length is larger than what can fit in the remaining parameters size, bail
6118 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
6119 break;
6120 }
6121
6122 if (length > 0) {
6123 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
6124 if (value != NULL) {
6125 switch (type) {
6126 case NECP_CLIENT_PARAMETER_APPLICATION: {
6127 if (length >= sizeof(uuid_t)) {
6128 uuid_copy(euuid, value);
6129 }
6130 break;
6131 }
6132 case NECP_CLIENT_PARAMETER_PID: {
6133 if (length >= sizeof(pid_t)) {
6134 memcpy(effective_pid, value, sizeof(pid_t));
6135 }
6136 break;
6137 }
6138 case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: {
6139 if (length >= sizeof(u_int32_t)) {
6140 memcpy(traffic_class, value, sizeof(u_int32_t));
6141 }
6142 break;
6143 }
6144 case NECP_CLIENT_PARAMETER_FALLBACK_MODE: {
6145 if (length >= sizeof(u_int8_t)) {
6146 memcpy(fallback_mode, value, sizeof(u_int8_t));
6147 }
6148 break;
6149 }
6150 // It is an implementation quirk that the remote address can be found in the necp parameters
6151 // while the local address must be retrieved from the flowswitch
6152 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
6153 if (length >= sizeof(struct necp_policy_condition_addr)) {
6154 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
6155 if (necp_client_address_is_valid(&address_struct->address.sa)) {
6156 memcpy(remote, &address_struct->address, sizeof(address_struct->address));
6157 }
6158 }
6159 break;
6160 }
6161 default: {
6162 break;
6163 }
6164 }
6165 }
6166 }
6167 offset += sizeof(struct necp_tlv_header) + length;
6168 }
6169 }
6170
6171 // Called from NetworkStatistics when it wishes to collect latest information for a TCP flow.
6172 // It is a responsibility of NetworkStatistics to have previously zeroed any supplied memory.
6173 static bool
necp_request_tcp_netstats(userland_stats_provider_context * ctx,u_int16_t * ifflagsp,nstat_progress_digest * digestp,nstat_counts * countsp,void * metadatap)6174 necp_request_tcp_netstats(userland_stats_provider_context *ctx,
6175 u_int16_t *ifflagsp,
6176 nstat_progress_digest *digestp,
6177 nstat_counts *countsp,
6178 void *metadatap)
6179 {
6180 if (ctx == NULL) {
6181 return false;
6182 }
6183
6184 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6185 struct necp_client *client = flow_registration->client;
6186 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
6187 struct necp_tcp_stats *tcpstats = (struct necp_tcp_stats *)ustats_kaddr;
6188 ASSERT(tcpstats != NULL);
6189
6190 u_int16_t nstat_diagnostic_flags = 0;
6191
6192 // Retrieve details from the last time the assigned flows were updated
6193 u_int32_t route_ifindex = IFSCOPE_NONE;
6194 u_int16_t route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6195 u_int64_t combined_interface_details = 0;
6196
6197 atomic_get_64(combined_interface_details, &flow_registration->last_interface_details);
6198 split_interface_details(combined_interface_details, &route_ifindex, &route_ifflags);
6199
6200 if (route_ifindex == IFSCOPE_NONE) {
6201 // Mark no interface
6202 nstat_diagnostic_flags |= NSTAT_IFNET_ROUTE_VALUE_UNOBTAINABLE;
6203 route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6204 NECPLOG(LOG_INFO, "req tcp stats, failed to get route details for pid %d curproc %d %s\n",
6205 client->proc_pid, proc_pid(current_proc()), proc_best_name(current_proc()));
6206 }
6207
6208 if (ifflagsp) {
6209 *ifflagsp = route_ifflags | nstat_diagnostic_flags;
6210 if (tcpstats->necp_tcp_extra.flags1 & SOF1_CELLFALLBACK) {
6211 *ifflagsp |= NSTAT_IFNET_VIA_CELLFALLBACK;
6212 }
6213 if ((digestp == NULL) && (countsp == NULL) && (metadatap == NULL)) {
6214 return true;
6215 }
6216 }
6217
6218 if (digestp) {
6219 // The digest is intended to give information that may help give insight into the state of the link
6220 // while avoiding the need to do the relatively expensive flowswitch lookup
6221 digestp->rxbytes = tcpstats->necp_tcp_counts.necp_stat_rxbytes;
6222 digestp->txbytes = tcpstats->necp_tcp_counts.necp_stat_txbytes;
6223 digestp->rxduplicatebytes = tcpstats->necp_tcp_counts.necp_stat_rxduplicatebytes;
6224 digestp->rxoutoforderbytes = tcpstats->necp_tcp_counts.necp_stat_rxoutoforderbytes;
6225 digestp->txretransmit = tcpstats->necp_tcp_counts.necp_stat_txretransmit;
6226 digestp->ifindex = route_ifindex;
6227 digestp->state = tcpstats->necp_tcp_extra.state;
6228 digestp->txunacked = tcpstats->necp_tcp_extra.txunacked;
6229 digestp->txwindow = tcpstats->necp_tcp_extra.txwindow;
6230 digestp->connstatus.probe_activated = tcpstats->necp_tcp_extra.probestatus.probe_activated;
6231 digestp->connstatus.write_probe_failed = tcpstats->necp_tcp_extra.probestatus.write_probe_failed;
6232 digestp->connstatus.read_probe_failed = tcpstats->necp_tcp_extra.probestatus.read_probe_failed;
6233 digestp->connstatus.conn_probe_failed = tcpstats->necp_tcp_extra.probestatus.conn_probe_failed;
6234
6235 if ((countsp == NULL) && (metadatap == NULL)) {
6236 return true;
6237 }
6238 }
6239
6240 const struct sk_stats_flow *sf = &flow_registration->nexus_stats->fs_stats;
6241 if (sf == NULL) {
6242 nstat_diagnostic_flags |= NSTAT_IFNET_FLOWSWITCH_VALUE_UNOBTAINABLE;
6243 char namebuf[MAXCOMLEN + 1];
6244 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
6245 proc_name(client->proc_pid, namebuf, sizeof(namebuf));
6246 NECPLOG(LOG_ERR, "req tcp stats, necp_client flow_registration flow_stats missing for pid %d %s curproc %d %s\n",
6247 client->proc_pid, namebuf, proc_pid(current_proc()), proc_best_name(current_proc()));
6248 sf = &ntstat_sk_stats_zero;
6249 }
6250
6251 if (countsp) {
6252 countsp->nstat_rxbytes = tcpstats->necp_tcp_counts.necp_stat_rxbytes;
6253 countsp->nstat_txbytes = tcpstats->necp_tcp_counts.necp_stat_txbytes;
6254
6255 countsp->nstat_rxduplicatebytes = tcpstats->necp_tcp_counts.necp_stat_rxduplicatebytes;
6256 countsp->nstat_rxoutoforderbytes = tcpstats->necp_tcp_counts.necp_stat_rxoutoforderbytes;
6257 countsp->nstat_txretransmit = tcpstats->necp_tcp_counts.necp_stat_txretransmit;
6258
6259 countsp->nstat_min_rtt = tcpstats->necp_tcp_counts.necp_stat_min_rtt;
6260 countsp->nstat_avg_rtt = tcpstats->necp_tcp_counts.necp_stat_avg_rtt;
6261 countsp->nstat_var_rtt = tcpstats->necp_tcp_counts.necp_stat_var_rtt;
6262
6263 countsp->nstat_connectattempts = tcpstats->necp_tcp_extra.state >= TCPS_SYN_SENT ? 1 : 0;
6264 countsp->nstat_connectsuccesses = tcpstats->necp_tcp_extra.state >= TCPS_ESTABLISHED ? 1 : 0;
6265
6266 // Supplement what the user level has told us with what we know from the flowswitch
6267 countsp->nstat_rxpackets = sf->sf_ipackets;
6268 countsp->nstat_txpackets = sf->sf_opackets;
6269 if (route_ifflags & NSTAT_IFNET_IS_CELLULAR) {
6270 countsp->nstat_cell_rxbytes = sf->sf_ibytes;
6271 countsp->nstat_cell_txbytes = sf->sf_obytes;
6272 } else if (route_ifflags & NSTAT_IFNET_IS_WIFI) {
6273 countsp->nstat_wifi_rxbytes = sf->sf_ibytes;
6274 countsp->nstat_wifi_txbytes = sf->sf_obytes;
6275 } else if (route_ifflags & NSTAT_IFNET_IS_WIRED) {
6276 countsp->nstat_wired_rxbytes = sf->sf_ibytes;
6277 countsp->nstat_wired_txbytes = sf->sf_obytes;
6278 }
6279 }
6280
6281 if (metadatap) {
6282 nstat_tcp_descriptor *desc = (nstat_tcp_descriptor *)metadatap;
6283 memset(desc, 0, sizeof(*desc));
6284
6285 // Metadata from the flow registration
6286 uuid_copy(desc->fuuid, flow_registration->registration_id);
6287
6288 // Metadata that the necp client should have in TLV format.
6289 pid_t effective_pid = client->proc_pid;
6290 necp_find_netstat_data(client, (union necp_sockaddr_union *)&desc->remote, &effective_pid, desc->euuid, &desc->traffic_class, &desc->fallback_mode);
6291 desc->epid = (u_int32_t)effective_pid;
6292
6293 // Metadata from the flow registration
6294 // This needs to revisited if multiple flows are created from one flow registration
6295 struct necp_client_flow *flow = NULL;
6296 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
6297 memcpy(&desc->local, &flow->local_addr, sizeof(desc->local));
6298 break;
6299 }
6300
6301 // Metadata from the route
6302 desc->ifindex = route_ifindex;
6303 desc->ifnet_properties = route_ifflags | nstat_diagnostic_flags;
6304 desc->ifnet_properties |= (sf->sf_flags & SFLOWF_ONLINK) ? NSTAT_IFNET_IS_LOCAL : NSTAT_IFNET_IS_NON_LOCAL;
6305 if (tcpstats->necp_tcp_extra.flags1 & SOF1_CELLFALLBACK) {
6306 desc->ifnet_properties |= NSTAT_IFNET_VIA_CELLFALLBACK;
6307 }
6308
6309 // Basic metadata from userland
6310 desc->rcvbufsize = tcpstats->necp_tcp_basic.rcvbufsize;
6311 desc->rcvbufused = tcpstats->necp_tcp_basic.rcvbufused;
6312
6313 // Additional TCP specific data
6314 desc->sndbufsize = tcpstats->necp_tcp_extra.sndbufsize;
6315 desc->sndbufused = tcpstats->necp_tcp_extra.sndbufused;
6316 desc->txunacked = tcpstats->necp_tcp_extra.txunacked;
6317 desc->txwindow = tcpstats->necp_tcp_extra.txwindow;
6318 desc->txcwindow = tcpstats->necp_tcp_extra.txcwindow;
6319 desc->traffic_mgt_flags = tcpstats->necp_tcp_extra.traffic_mgt_flags;
6320 desc->state = tcpstats->necp_tcp_extra.state;
6321
6322 u_int32_t cc_alg_index = tcpstats->necp_tcp_extra.cc_alg_index;
6323 if (cc_alg_index < TCP_CC_ALGO_COUNT) {
6324 strlcpy(desc->cc_algo, tcp_cc_algo_list[cc_alg_index]->name, sizeof(desc->cc_algo));
6325 } else {
6326 strlcpy(desc->cc_algo, "unknown", sizeof(desc->cc_algo));
6327 }
6328
6329 desc->connstatus.probe_activated = tcpstats->necp_tcp_extra.probestatus.probe_activated;
6330 desc->connstatus.write_probe_failed = tcpstats->necp_tcp_extra.probestatus.write_probe_failed;
6331 desc->connstatus.read_probe_failed = tcpstats->necp_tcp_extra.probestatus.read_probe_failed;
6332 desc->connstatus.conn_probe_failed = tcpstats->necp_tcp_extra.probestatus.conn_probe_failed;
6333
6334 memcpy(&desc->activity_bitmap, &sf->sf_activity, sizeof(sf->sf_activity));
6335 }
6336
6337 return true;
6338 }
6339
6340 // Called from NetworkStatistics when it wishes to collect latest information for a UDP flow.
6341 static bool
necp_request_udp_netstats(userland_stats_provider_context * ctx,u_int16_t * ifflagsp,nstat_progress_digest * digestp,nstat_counts * countsp,void * metadatap)6342 necp_request_udp_netstats(userland_stats_provider_context *ctx,
6343 u_int16_t *ifflagsp,
6344 nstat_progress_digest *digestp,
6345 nstat_counts *countsp,
6346 void *metadatap)
6347 {
6348 #pragma unused(digestp)
6349
6350 if (ctx == NULL) {
6351 return false;
6352 }
6353
6354 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6355 struct necp_client *client = flow_registration->client;
6356 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
6357 struct necp_udp_stats *udpstats = (struct necp_udp_stats *)ustats_kaddr;
6358 ASSERT(udpstats != NULL);
6359
6360 u_int16_t nstat_diagnostic_flags = 0;
6361
6362 // Retrieve details from the last time the assigned flows were updated
6363 u_int32_t route_ifindex = IFSCOPE_NONE;
6364 u_int16_t route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6365 u_int64_t combined_interface_details = 0;
6366
6367 atomic_get_64(combined_interface_details, &flow_registration->last_interface_details);
6368 split_interface_details(combined_interface_details, &route_ifindex, &route_ifflags);
6369
6370 if (route_ifindex == IFSCOPE_NONE) {
6371 // Mark no interface
6372 nstat_diagnostic_flags |= NSTAT_IFNET_ROUTE_VALUE_UNOBTAINABLE;
6373 route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6374 NECPLOG(LOG_INFO, "req udp stats, failed to get route details for pid %d curproc %d %s\n",
6375 client->proc_pid, proc_pid(current_proc()), proc_best_name(current_proc()));
6376 }
6377
6378 if (ifflagsp) {
6379 *ifflagsp = route_ifflags | nstat_diagnostic_flags;
6380 if ((countsp == NULL) && (metadatap == NULL)) {
6381 return true;
6382 }
6383 }
6384 const struct sk_stats_flow *sf = &flow_registration->nexus_stats->fs_stats;
6385 if (sf == NULL) {
6386 nstat_diagnostic_flags |= NSTAT_IFNET_FLOWSWITCH_VALUE_UNOBTAINABLE;
6387 char namebuf[MAXCOMLEN + 1];
6388 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
6389 proc_name(client->proc_pid, namebuf, sizeof(namebuf));
6390 NECPLOG(LOG_ERR, "req udp stats, necp_client flow_registration flow_stats missing for pid %d %s curproc %d %s\n",
6391 client->proc_pid, namebuf, proc_pid(current_proc()), proc_best_name(current_proc()));
6392 sf = &ntstat_sk_stats_zero;
6393 }
6394
6395 if (countsp) {
6396 countsp->nstat_rxbytes = udpstats->necp_udp_counts.necp_stat_rxbytes;
6397 countsp->nstat_txbytes = udpstats->necp_udp_counts.necp_stat_txbytes;
6398
6399 countsp->nstat_rxduplicatebytes = udpstats->necp_udp_counts.necp_stat_rxduplicatebytes;
6400 countsp->nstat_rxoutoforderbytes = udpstats->necp_udp_counts.necp_stat_rxoutoforderbytes;
6401 countsp->nstat_txretransmit = udpstats->necp_udp_counts.necp_stat_txretransmit;
6402
6403 countsp->nstat_min_rtt = udpstats->necp_udp_counts.necp_stat_min_rtt;
6404 countsp->nstat_avg_rtt = udpstats->necp_udp_counts.necp_stat_avg_rtt;
6405 countsp->nstat_var_rtt = udpstats->necp_udp_counts.necp_stat_var_rtt;
6406
6407 // Supplement what the user level has told us with what we know from the flowswitch
6408 countsp->nstat_rxpackets = sf->sf_ipackets;
6409 countsp->nstat_txpackets = sf->sf_opackets;
6410 if (route_ifflags & NSTAT_IFNET_IS_CELLULAR) {
6411 countsp->nstat_cell_rxbytes = sf->sf_ibytes;
6412 countsp->nstat_cell_txbytes = sf->sf_obytes;
6413 } else if (route_ifflags & NSTAT_IFNET_IS_WIFI) {
6414 countsp->nstat_wifi_rxbytes = sf->sf_ibytes;
6415 countsp->nstat_wifi_txbytes = sf->sf_obytes;
6416 } else if (route_ifflags & NSTAT_IFNET_IS_WIRED) {
6417 countsp->nstat_wired_rxbytes = sf->sf_ibytes;
6418 countsp->nstat_wired_txbytes = sf->sf_obytes;
6419 }
6420 }
6421
6422 if (metadatap) {
6423 nstat_udp_descriptor *desc = (nstat_udp_descriptor *)metadatap;
6424 memset(desc, 0, sizeof(*desc));
6425
6426 // Metadata from the flow registration
6427 uuid_copy(desc->fuuid, flow_registration->registration_id);
6428
6429 // Metadata that the necp client should have in TLV format.
6430 pid_t effective_pid = client->proc_pid;
6431 necp_find_netstat_data(client, (union necp_sockaddr_union *)&desc->remote, &effective_pid, desc->euuid, &desc->traffic_class, &desc->fallback_mode);
6432 desc->epid = (u_int32_t)effective_pid;
6433
6434 // Metadata from the flow registration
6435 // This needs to revisited if multiple flows are created from one flow registration
6436 struct necp_client_flow *flow = NULL;
6437 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
6438 memcpy(&desc->local, &flow->local_addr, sizeof(desc->local));
6439 break;
6440 }
6441
6442 // Metadata from the route
6443 desc->ifindex = route_ifindex;
6444 desc->ifnet_properties = route_ifflags | nstat_diagnostic_flags;
6445
6446 // Basic metadata is all that is required for UDP
6447 desc->rcvbufsize = udpstats->necp_udp_basic.rcvbufsize;
6448 desc->rcvbufused = udpstats->necp_udp_basic.rcvbufused;
6449
6450 memcpy(&desc->activity_bitmap, &sf->sf_activity, sizeof(sf->sf_activity));
6451 }
6452
6453 return true;
6454 }
6455
6456 // Called from NetworkStatistics when it wishes to collect latest information for a QUIC flow.
6457 //
6458 // TODO: For now it is an exact implementation as that of TCP.
6459 // Still to keep the logic separate for future divergence, keeping the routines separate.
6460 // It also seems there are lots of common code between existing implementations and
6461 // it would be good to refactor this logic at some point.
6462 static bool
necp_request_quic_netstats(userland_stats_provider_context * ctx,u_int16_t * ifflagsp,nstat_progress_digest * digestp,nstat_counts * countsp,void * metadatap)6463 necp_request_quic_netstats(userland_stats_provider_context *ctx,
6464 u_int16_t *ifflagsp,
6465 nstat_progress_digest *digestp,
6466 nstat_counts *countsp,
6467 void *metadatap)
6468 {
6469 if (ctx == NULL) {
6470 return false;
6471 }
6472
6473 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6474 struct necp_client *client = flow_registration->client;
6475 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
6476 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
6477 ASSERT(quicstats != NULL);
6478
6479 u_int16_t nstat_diagnostic_flags = 0;
6480
6481 // Retrieve details from the last time the assigned flows were updated
6482 u_int32_t route_ifindex = IFSCOPE_NONE;
6483 u_int16_t route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6484 u_int64_t combined_interface_details = 0;
6485
6486 atomic_get_64(combined_interface_details, &flow_registration->last_interface_details);
6487 split_interface_details(combined_interface_details, &route_ifindex, &route_ifflags);
6488
6489 if (route_ifindex == IFSCOPE_NONE) {
6490 // Mark no interface
6491 nstat_diagnostic_flags |= NSTAT_IFNET_ROUTE_VALUE_UNOBTAINABLE;
6492 route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6493 NECPLOG(LOG_INFO, "req quic stats, failed to get route details for pid %d curproc %d %s\n",
6494 client->proc_pid, proc_pid(current_proc()), proc_best_name(current_proc()));
6495 }
6496
6497 if (ifflagsp) {
6498 *ifflagsp = route_ifflags | nstat_diagnostic_flags;
6499 if ((digestp == NULL) && (countsp == NULL) && (metadatap == NULL)) {
6500 return true;
6501 }
6502 }
6503
6504 if (digestp) {
6505 // The digest is intended to give information that may help give insight into the state of the link
6506 // while avoiding the need to do the relatively expensive flowswitch lookup
6507 digestp->rxbytes = quicstats->necp_quic_counts.necp_stat_rxbytes;
6508 digestp->txbytes = quicstats->necp_quic_counts.necp_stat_txbytes;
6509 digestp->rxduplicatebytes = quicstats->necp_quic_counts.necp_stat_rxduplicatebytes;
6510 digestp->rxoutoforderbytes = quicstats->necp_quic_counts.necp_stat_rxoutoforderbytes;
6511 digestp->txretransmit = quicstats->necp_quic_counts.necp_stat_txretransmit;
6512 digestp->ifindex = route_ifindex;
6513 digestp->state = quicstats->necp_quic_extra.state;
6514 digestp->txunacked = quicstats->necp_quic_extra.txunacked;
6515 digestp->txwindow = quicstats->necp_quic_extra.txwindow;
6516
6517 if ((countsp == NULL) && (metadatap == NULL)) {
6518 return true;
6519 }
6520 }
6521
6522 const struct sk_stats_flow *sf = &flow_registration->nexus_stats->fs_stats;
6523 if (sf == NULL) {
6524 nstat_diagnostic_flags |= NSTAT_IFNET_FLOWSWITCH_VALUE_UNOBTAINABLE;
6525 char namebuf[MAXCOMLEN + 1];
6526 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
6527 proc_name(client->proc_pid, namebuf, sizeof(namebuf));
6528 NECPLOG(LOG_ERR, "req quic stats, necp_client flow_registration flow_stats missing for pid %d %s curproc %d %s\n",
6529 client->proc_pid, namebuf, proc_pid(current_proc()), proc_best_name(current_proc()));
6530 sf = &ntstat_sk_stats_zero;
6531 }
6532
6533 if (countsp) {
6534 countsp->nstat_rxbytes = quicstats->necp_quic_counts.necp_stat_rxbytes;
6535 countsp->nstat_txbytes = quicstats->necp_quic_counts.necp_stat_txbytes;
6536
6537 countsp->nstat_rxduplicatebytes = quicstats->necp_quic_counts.necp_stat_rxduplicatebytes;
6538 countsp->nstat_rxoutoforderbytes = quicstats->necp_quic_counts.necp_stat_rxoutoforderbytes;
6539 countsp->nstat_txretransmit = quicstats->necp_quic_counts.necp_stat_txretransmit;
6540
6541 countsp->nstat_min_rtt = quicstats->necp_quic_counts.necp_stat_min_rtt;
6542 countsp->nstat_avg_rtt = quicstats->necp_quic_counts.necp_stat_avg_rtt;
6543 countsp->nstat_var_rtt = quicstats->necp_quic_counts.necp_stat_var_rtt;
6544
6545 // TODO: It would be good to expose QUIC stats for CH/SH retransmission and connection state
6546 // Supplement what the user level has told us with what we know from the flowswitch
6547 countsp->nstat_rxpackets = sf->sf_ipackets;
6548 countsp->nstat_txpackets = sf->sf_opackets;
6549 if (route_ifflags & NSTAT_IFNET_IS_CELLULAR) {
6550 countsp->nstat_cell_rxbytes = sf->sf_ibytes;
6551 countsp->nstat_cell_txbytes = sf->sf_obytes;
6552 } else if (route_ifflags & NSTAT_IFNET_IS_WIFI) {
6553 countsp->nstat_wifi_rxbytes = sf->sf_ibytes;
6554 countsp->nstat_wifi_txbytes = sf->sf_obytes;
6555 } else if (route_ifflags & NSTAT_IFNET_IS_WIRED) {
6556 countsp->nstat_wired_rxbytes = sf->sf_ibytes;
6557 countsp->nstat_wired_txbytes = sf->sf_obytes;
6558 }
6559 }
6560
6561 if (metadatap) {
6562 nstat_quic_descriptor *desc = (nstat_quic_descriptor *)metadatap;
6563 memset(desc, 0, sizeof(*desc));
6564
6565 // Metadata from the flow registration
6566 uuid_copy(desc->fuuid, flow_registration->registration_id);
6567
6568 // Metadata, that the necp client should have, in TLV format.
6569 pid_t effective_pid = client->proc_pid;
6570 necp_find_netstat_data(client, (union necp_sockaddr_union *)&desc->remote, &effective_pid, desc->euuid, &desc->traffic_class, &desc->fallback_mode);
6571 desc->epid = (u_int32_t)effective_pid;
6572
6573 // Metadata from the flow registration
6574 // This needs to revisited if multiple flows are created from one flow registration
6575 struct necp_client_flow *flow = NULL;
6576 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
6577 memcpy(&desc->local, &flow->local_addr, sizeof(desc->local));
6578 break;
6579 }
6580
6581 // Metadata from the route
6582 desc->ifindex = route_ifindex;
6583 desc->ifnet_properties = route_ifflags | nstat_diagnostic_flags;
6584
6585 // Basic metadata from userland
6586 desc->rcvbufsize = quicstats->necp_quic_basic.rcvbufsize;
6587 desc->rcvbufused = quicstats->necp_quic_basic.rcvbufused;
6588
6589 // Additional QUIC specific data
6590 desc->sndbufsize = quicstats->necp_quic_extra.sndbufsize;
6591 desc->sndbufused = quicstats->necp_quic_extra.sndbufused;
6592 desc->txunacked = quicstats->necp_quic_extra.txunacked;
6593 desc->txwindow = quicstats->necp_quic_extra.txwindow;
6594 desc->txcwindow = quicstats->necp_quic_extra.txcwindow;
6595 desc->traffic_mgt_flags = quicstats->necp_quic_extra.traffic_mgt_flags;
6596 desc->state = quicstats->necp_quic_extra.state;
6597
6598 // TODO: CC algo defines should be named agnostic of the protocol
6599 u_int32_t cc_alg_index = quicstats->necp_quic_extra.cc_alg_index;
6600 if (cc_alg_index < TCP_CC_ALGO_COUNT) {
6601 strlcpy(desc->cc_algo, tcp_cc_algo_list[cc_alg_index]->name, sizeof(desc->cc_algo));
6602 } else {
6603 strlcpy(desc->cc_algo, "unknown", sizeof(desc->cc_algo));
6604 }
6605
6606 memcpy(&desc->activity_bitmap, &sf->sf_activity, sizeof(sf->sf_activity));
6607 }
6608 return true;
6609 }
6610
6611 #endif /* SKYWALK */
6612
6613 // Support functions for NetworkStatistics support for necp_client connections
6614
6615 static void
necp_client_inherit_from_parent(struct necp_client * client,struct necp_client * parent)6616 necp_client_inherit_from_parent(
6617 struct necp_client *client,
6618 struct necp_client *parent)
6619 {
6620 assert(client->original_parameters_source == NULL);
6621
6622 if (parent->original_parameters_source != NULL) {
6623 client->original_parameters_source = parent->original_parameters_source;
6624 } else {
6625 client->original_parameters_source = parent;
6626 }
6627 necp_client_retain(client->original_parameters_source);
6628 }
6629
6630 static void
necp_find_conn_netstat_data(struct necp_client * client,u_int32_t * ntstat_flags,pid_t * effective_pid,uuid_t puuid,uuid_t euuid)6631 necp_find_conn_netstat_data(struct necp_client *client,
6632 u_int32_t *ntstat_flags,
6633 pid_t *effective_pid,
6634 uuid_t puuid,
6635 uuid_t euuid)
6636 {
6637 bool has_remote_address = false;
6638 bool has_ip_protocol = false;
6639 bool has_transport_protocol = false;
6640 size_t offset = 0;
6641 u_int8_t *parameters;
6642 u_int32_t parameters_size;
6643
6644
6645 parameters = client->parameters;
6646 parameters_size = (u_int32_t)client->parameters_length;
6647
6648 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
6649 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
6650 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
6651
6652 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
6653 // If the length is larger than what can fit in the remaining parameters size, bail
6654 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
6655 break;
6656 }
6657
6658 if (length > 0) {
6659 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
6660 if (value != NULL) {
6661 switch (type) {
6662 case NECP_CLIENT_PARAMETER_APPLICATION: {
6663 if ((euuid) && (length >= sizeof(uuid_t))) {
6664 uuid_copy(euuid, value);
6665 }
6666 break;
6667 }
6668 case NECP_CLIENT_PARAMETER_IP_PROTOCOL: {
6669 if (length >= 1) {
6670 has_ip_protocol = true;
6671 }
6672 break;
6673 }
6674 case NECP_CLIENT_PARAMETER_PID: {
6675 if ((effective_pid) && length >= sizeof(pid_t)) {
6676 memcpy(effective_pid, value, sizeof(pid_t));
6677 }
6678 break;
6679 }
6680 case NECP_CLIENT_PARAMETER_PARENT_ID: {
6681 if ((puuid) && (length == sizeof(uuid_t))) {
6682 uuid_copy(puuid, value);
6683 }
6684 break;
6685 }
6686 // It is an implementation quirk that the remote address can be found in the necp parameters
6687 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
6688 if (length >= sizeof(struct necp_policy_condition_addr)) {
6689 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
6690 if (necp_client_address_is_valid(&address_struct->address.sa)) {
6691 has_remote_address = true;
6692 }
6693 }
6694 break;
6695 }
6696 case NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL: {
6697 if (length >= 1) {
6698 has_transport_protocol = true;
6699 }
6700 break;
6701 }
6702 default: {
6703 break;
6704 }
6705 }
6706 }
6707 }
6708 offset += sizeof(struct necp_tlv_header) + length;
6709 }
6710 if (ntstat_flags) {
6711 *ntstat_flags = (has_remote_address && has_ip_protocol && has_transport_protocol)? NSTAT_NECP_CONN_HAS_NET_ACCESS: 0;
6712 }
6713 }
6714
6715 static bool
necp_request_conn_netstats(nstat_provider_context ctx,u_int32_t * ifflagsp,nstat_counts * countsp,void * metadatap)6716 necp_request_conn_netstats(nstat_provider_context ctx,
6717 u_int32_t *ifflagsp,
6718 nstat_counts *countsp,
6719 void *metadatap)
6720 {
6721 if (ctx == NULL) {
6722 return false;
6723 }
6724 struct necp_client *client = (struct necp_client *)(uintptr_t)ctx;
6725 nstat_connection_descriptor *desc = (nstat_connection_descriptor *)metadatap;
6726
6727 if (ifflagsp) {
6728 necp_find_conn_netstat_data(client, ifflagsp, NULL, NULL, NULL);
6729 }
6730 if (countsp) {
6731 memset(countsp, 0, sizeof(*countsp));
6732 }
6733 if (desc) {
6734 memset(desc, 0, sizeof(*desc));
6735 // Metadata, that the necp client should have, in TLV format.
6736 pid_t effective_pid = client->proc_pid;
6737 necp_find_conn_netstat_data(client, &desc->ifnet_properties, &effective_pid, desc->puuid, desc->euuid);
6738 desc->epid = (u_int32_t)effective_pid;
6739
6740 // User level should obtain almost all connection information from an extension
6741 // leaving little to do here
6742 uuid_copy(desc->fuuid, client->latest_flow_registration_id);
6743 uuid_copy(desc->cuuid, client->client_id);
6744 }
6745 return true;
6746 }
6747
6748 static int
necp_skywalk_priv_check_cred(proc_t p,kauth_cred_t cred)6749 necp_skywalk_priv_check_cred(proc_t p, kauth_cred_t cred)
6750 {
6751 #pragma unused(p, cred)
6752 #if SKYWALK
6753 /* This includes Nexus controller and Skywalk observer privs */
6754 return skywalk_nxctl_check_privileges(p, cred);
6755 #else /* !SKYWALK */
6756 return 0;
6757 #endif /* !SKYWALK */
6758 }
6759
6760 /// System calls
6761
6762 int
necp_open(struct proc * p,struct necp_open_args * uap,int * retval)6763 necp_open(struct proc *p, struct necp_open_args *uap, int *retval)
6764 {
6765 #pragma unused(retval)
6766 int error = 0;
6767 struct necp_fd_data *fd_data = NULL;
6768 struct fileproc *fp = NULL;
6769 int fd = -1;
6770
6771 if (uap->flags & NECP_OPEN_FLAG_OBSERVER ||
6772 uap->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
6773 if (necp_skywalk_priv_check_cred(p, kauth_cred_get()) != 0 &&
6774 priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NETWORK_STATISTICS, 0) != 0) {
6775 NECPLOG0(LOG_ERR, "Client does not hold necessary entitlement to observe other NECP clients");
6776 error = EACCES;
6777 goto done;
6778 }
6779 }
6780
6781 #if CONFIG_MACF
6782 error = mac_necp_check_open(p, uap->flags);
6783 if (error) {
6784 goto done;
6785 }
6786 #endif /* MACF */
6787
6788 error = falloc(p, &fp, &fd, vfs_context_current());
6789 if (error != 0) {
6790 goto done;
6791 }
6792
6793 fd_data = kalloc_type(struct necp_fd_data, Z_WAITOK | Z_ZERO | Z_NOFAIL);
6794
6795 fd_data->necp_fd_type = necp_fd_type_client;
6796 fd_data->flags = uap->flags;
6797 RB_INIT(&fd_data->clients);
6798 RB_INIT(&fd_data->flows);
6799 TAILQ_INIT(&fd_data->update_list);
6800 lck_mtx_init(&fd_data->fd_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
6801 klist_init(&fd_data->si.si_note);
6802 fd_data->proc_pid = proc_pid(p);
6803 #if SKYWALK
6804 LIST_INIT(&fd_data->stats_arena_list);
6805 #endif /* !SKYWALK */
6806
6807 fp->fp_flags |= FP_CLOEXEC | FP_CLOFORK;
6808 fp->fp_glob->fg_flag = FREAD;
6809 fp->fp_glob->fg_ops = &necp_fd_ops;
6810 fp_set_data(fp, fd_data);
6811
6812 proc_fdlock(p);
6813
6814 procfdtbl_releasefd(p, fd, NULL);
6815 fp_drop(p, fd, fp, 1);
6816
6817 *retval = fd;
6818
6819 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
6820 NECP_OBSERVER_LIST_LOCK_EXCLUSIVE();
6821 LIST_INSERT_HEAD(&necp_fd_observer_list, fd_data, chain);
6822 OSIncrementAtomic(&necp_observer_fd_count);
6823 NECP_OBSERVER_LIST_UNLOCK();
6824
6825 // Walk all existing clients and add them
6826 NECP_CLIENT_TREE_LOCK_SHARED();
6827 struct necp_client *existing_client = NULL;
6828 RB_FOREACH(existing_client, _necp_client_global_tree, &necp_client_global_tree) {
6829 NECP_CLIENT_LOCK(existing_client);
6830 necp_client_update_observer_add_internal(fd_data, existing_client);
6831 necp_client_update_observer_update_internal(fd_data, existing_client);
6832 NECP_CLIENT_UNLOCK(existing_client);
6833 }
6834 NECP_CLIENT_TREE_UNLOCK();
6835 } else {
6836 NECP_FD_LIST_LOCK_EXCLUSIVE();
6837 LIST_INSERT_HEAD(&necp_fd_list, fd_data, chain);
6838 OSIncrementAtomic(&necp_client_fd_count);
6839 NECP_FD_LIST_UNLOCK();
6840 }
6841
6842 proc_fdunlock(p);
6843
6844 done:
6845 if (error != 0) {
6846 if (fp != NULL) {
6847 fp_free(p, fd, fp);
6848 fp = NULL;
6849 }
6850 if (fd_data != NULL) {
6851 kfree_type(struct necp_fd_data, fd_data);
6852 }
6853 }
6854
6855 return error;
6856 }
6857
6858 // All functions called directly from necp_client_action() to handle one of the
6859 // types should be marked with NECP_CLIENT_ACTION_FUNCTION. This ensures that
6860 // necp_client_action() does not inline all the actions into a single function.
6861 #define NECP_CLIENT_ACTION_FUNCTION __attribute__((noinline))
6862
6863 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_add(struct proc * p,struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)6864 necp_client_add(struct proc *p, struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
6865 {
6866 int error = 0;
6867 struct necp_client *client = NULL;
6868 const size_t buffer_size = uap->buffer_size;
6869
6870 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
6871 NECPLOG0(LOG_ERR, "NECP client observers with push enabled may not add their own clients");
6872 return EINVAL;
6873 }
6874
6875 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
6876 buffer_size == 0 || buffer_size > NECP_MAX_CLIENT_PARAMETERS_SIZE || uap->buffer == 0) {
6877 return EINVAL;
6878 }
6879
6880 client = kalloc_type(struct necp_client, Z_WAITOK | Z_ZERO | Z_NOFAIL);
6881 client->parameters = kalloc_data(buffer_size, Z_WAITOK | Z_NOFAIL);
6882 client->parameters_length = buffer_size;
6883 lck_mtx_init(&client->lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
6884 lck_mtx_init(&client->route_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
6885
6886 error = copyin(uap->buffer, client->parameters, buffer_size);
6887 if (error) {
6888 NECPLOG(LOG_ERR, "necp_client_add parameters copyin error (%d)", error);
6889 goto done;
6890 }
6891
6892 os_ref_init(&client->reference_count, &necp_client_refgrp); // Hold our reference until close
6893
6894 client->proc_pid = fd_data->proc_pid; // Save off proc pid in case the client will persist past fd
6895 client->agent_handle = (void *)fd_data;
6896 client->platform_binary = ((csproc_get_platform_binary(p) == 0) ? 0 : 1);
6897
6898 necp_generate_client_id(client->client_id, false);
6899 LIST_INIT(&client->assertion_list);
6900 RB_INIT(&client->flow_registrations);
6901
6902 NECP_CLIENT_LOG(client, "Adding client");
6903
6904 error = copyout(client->client_id, uap->client_id, sizeof(uuid_t));
6905 if (error) {
6906 NECPLOG(LOG_ERR, "necp_client_add client_id copyout error (%d)", error);
6907 goto done;
6908 }
6909
6910 #if SKYWALK
6911 struct necp_client_parsed_parameters parsed_parameters = {};
6912 int parse_error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, &parsed_parameters);
6913
6914 if (parse_error == 0 &&
6915 ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID) ||
6916 (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER))) {
6917 bool has_delegation_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_SOCKET_DELEGATE, 0) == 0);
6918 if (!has_delegation_entitlement) {
6919 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID) {
6920 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to delegate network traffic for other processes by upid",
6921 proc_name_address(p), proc_pid(p));
6922 }
6923 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER) {
6924 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to set attributed bundle identifier",
6925 proc_name_address(p), proc_pid(p));
6926 }
6927 error = EPERM;
6928 goto done;
6929 }
6930
6931 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID) {
6932 // Save off delegated unique PID
6933 client->delegated_upid = parsed_parameters.delegated_upid;
6934 }
6935 }
6936
6937 if (parse_error == 0 && parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) {
6938 bool has_nexus_entitlement = (necp_skywalk_priv_check_cred(p, kauth_cred_get()) == 0);
6939 if (!has_nexus_entitlement) {
6940 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to open a custom nexus client",
6941 proc_name_address(p), proc_pid(p));
6942 error = EPERM;
6943 goto done;
6944 }
6945 }
6946
6947 if (parse_error == 0 && (parsed_parameters.flags &
6948 (NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER | NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP))) {
6949 bool has_custom_protocol_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_CUSTOM_PROTOCOL, 0) == 0);
6950 if (!has_custom_protocol_entitlement) {
6951 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement for custom protocol APIs",
6952 proc_name_address(p), proc_pid(p));
6953 error = EPERM;
6954 goto done;
6955 }
6956 }
6957
6958 if (parse_error == 0 && parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER &&
6959 (parsed_parameters.ip_protocol == IPPROTO_TCP || parsed_parameters.ip_protocol == IPPROTO_UDP)) {
6960 uint32_t *netns_addr = NULL;
6961 uint8_t netns_addr_len = 0;
6962 struct ns_flow_info flow_info = {};
6963 uint32_t netns_flags = NETNS_LISTENER;
6964 uuid_copy(flow_info.nfi_flow_uuid, client->client_id);
6965 flow_info.nfi_protocol = parsed_parameters.ip_protocol;
6966 flow_info.nfi_owner_pid = client->proc_pid;
6967 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID) {
6968 flow_info.nfi_effective_pid = parsed_parameters.effective_pid;
6969 } else {
6970 flow_info.nfi_effective_pid = flow_info.nfi_owner_pid;
6971 }
6972 proc_name(flow_info.nfi_owner_pid, flow_info.nfi_owner_name, MAXCOMLEN);
6973 proc_name(flow_info.nfi_effective_pid, flow_info.nfi_effective_name, MAXCOMLEN);
6974
6975 if (parsed_parameters.local_addr.sa.sa_family == AF_UNSPEC) {
6976 // Treat no local address as a wildcard IPv6
6977 // parsed_parameters is already initialized to all zeros
6978 parsed_parameters.local_addr.sin6.sin6_family = AF_INET6;
6979 parsed_parameters.local_addr.sin6.sin6_len = sizeof(struct sockaddr_in6);
6980 }
6981
6982 switch (parsed_parameters.local_addr.sa.sa_family) {
6983 case AF_INET: {
6984 memcpy(&flow_info.nfi_laddr, &parsed_parameters.local_addr.sa, parsed_parameters.local_addr.sa.sa_len);
6985 netns_addr = (uint32_t *)&parsed_parameters.local_addr.sin.sin_addr;
6986 netns_addr_len = 4;
6987 break;
6988 }
6989 case AF_INET6: {
6990 memcpy(&flow_info.nfi_laddr, &parsed_parameters.local_addr.sa, parsed_parameters.local_addr.sa.sa_len);
6991 netns_addr = (uint32_t *)&parsed_parameters.local_addr.sin6.sin6_addr;
6992 netns_addr_len = 16;
6993 break;
6994 }
6995
6996 default: {
6997 NECPLOG(LOG_ERR, "necp_client_add listener invalid address family (%d)", parsed_parameters.local_addr.sa.sa_family);
6998 error = EINVAL;
6999 goto done;
7000 }
7001 }
7002 if ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
7003 (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_REUSE_LOCAL)) {
7004 netns_flags |= NETNS_REUSEPORT;
7005 }
7006 if (parsed_parameters.local_addr.sin.sin_port == 0) {
7007 error = netns_reserve_ephemeral(&client->port_reservation, netns_addr, netns_addr_len, parsed_parameters.ip_protocol,
7008 &parsed_parameters.local_addr.sin.sin_port, netns_flags, &flow_info);
7009 if (error) {
7010 NECPLOG(LOG_ERR, "necp_client_add netns_reserve_ephemeral error (%d)", error);
7011 goto done;
7012 }
7013
7014 // Update the parameter TLVs with the assigned port
7015 necp_client_update_local_port_parameters(client->parameters, (u_int32_t)client->parameters_length, parsed_parameters.local_addr.sin.sin_port);
7016 } else {
7017 error = netns_reserve(&client->port_reservation, netns_addr, netns_addr_len, parsed_parameters.ip_protocol,
7018 parsed_parameters.local_addr.sin.sin_port, netns_flags, &flow_info);
7019 if (error) {
7020 NECPLOG(LOG_ERR, "necp_client_add netns_reserve error (%d)", error);
7021 goto done;
7022 }
7023 }
7024 }
7025
7026 struct necp_client *parent = NULL;
7027 uuid_t parent_client_id;
7028 uuid_clear(parent_client_id);
7029 struct necp_client_nexus_parameters parent_parameters = {};
7030 uint16_t num_flow_regs = 0;
7031 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_PARENT_UUID) {
7032 // The parent "should" be found on fd_data without having to search across the whole necp_fd_list
7033 // It would be nice to do this a little further down where there's another instance of NECP_FD_LOCK
7034 // but the logic here depends on the parse paramters
7035 NECP_FD_LOCK(fd_data);
7036 parent = necp_client_fd_find_client_unlocked(fd_data, parsed_parameters.parent_uuid);
7037 if (parent != NULL) {
7038 necp_client_inherit_from_parent(client, parent);
7039 necp_client_copy_parameters_locked(client, &parent_parameters);
7040 uuid_copy(parent_client_id, parsed_parameters.parent_uuid);
7041 struct necp_client_flow_registration *flow_registration = NULL;
7042 RB_FOREACH(flow_registration, _necp_client_flow_tree, &parent->flow_registrations) {
7043 num_flow_regs++;
7044 }
7045 }
7046 NECP_FD_UNLOCK(fd_data);
7047 if (parent == NULL) {
7048 NECPLOG0(LOG_ERR, "necp_client_add, no necp_client_inherit_from_parent as can't find parent on fd_data");
7049 }
7050 }
7051 if (parse_error == 0 && parent != NULL && parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLOW_DEMUX_PATTERN) {
7052 do {
7053 if (parsed_parameters.demux_patterns[0].len == 0) {
7054 NECPLOG0(LOG_INFO, "necp_client_add, child does not have a demux pattern");
7055 break;
7056 }
7057
7058 if (uuid_is_null(parent_client_id)) {
7059 NECPLOG0(LOG_INFO, "necp_client_add, parent ID is null");
7060 break;
7061 }
7062
7063 if (num_flow_regs > 1) {
7064 NECPLOG0(LOG_INFO, "necp_client_add, multiple parent flows not supported");
7065 break;
7066 }
7067 if (parsed_parameters.ip_protocol != IPPROTO_UDP) {
7068 NECPLOG(LOG_INFO, "necp_client_add, flow demux pattern not supported for %d protocol",
7069 parsed_parameters.ip_protocol);
7070 break;
7071 }
7072 if (parsed_parameters.ip_protocol != parent_parameters.transport_protocol) {
7073 NECPLOG0(LOG_INFO, "necp_client_add, parent/child ip protocol mismatch");
7074 break;
7075 }
7076 if (parsed_parameters.local_addr.sa.sa_family != AF_INET && parsed_parameters.local_addr.sa.sa_family != AF_INET6) {
7077 NECPLOG(LOG_INFO, "necp_client_add, flow demux pattern not supported for %d family",
7078 parsed_parameters.local_addr.sa.sa_family);
7079 break;
7080 }
7081 if (parsed_parameters.local_addr.sa.sa_family != parsed_parameters.remote_addr.sa.sa_family) {
7082 NECPLOG0(LOG_INFO, "necp_client_add, local/remote address family mismatch");
7083 break;
7084 }
7085 if (parsed_parameters.local_addr.sa.sa_family != parent_parameters.local_addr.sa.sa_family) {
7086 NECPLOG0(LOG_INFO, "necp_client_add, parent/child address family mismatch");
7087 break;
7088 }
7089 if (memcmp(&parsed_parameters.local_addr.sa, &parent_parameters.local_addr.sa, parsed_parameters.local_addr.sa.sa_len)) {
7090 NECPLOG0(LOG_INFO, "necp_client_add, parent/child local address mismatch");
7091 break;
7092 }
7093 if (memcmp(&parsed_parameters.remote_addr.sa, &parent_parameters.remote_addr.sa, parsed_parameters.remote_addr.sa.sa_len)) {
7094 NECPLOG0(LOG_INFO, "necp_client_add, parent/child remote address mismatch");
7095 break;
7096 }
7097 if (parsed_parameters.local_addr.sin.sin_port != parent_parameters.local_addr.sin.sin_port) {
7098 NECPLOG0(LOG_INFO, "necp_client_add, parent/child local port mismatch");
7099 break;
7100 }
7101 if (parsed_parameters.remote_addr.sin.sin_port != parent_parameters.remote_addr.sin.sin_port) {
7102 NECPLOG0(LOG_INFO, "necp_client_add, parent/child remote port mismatch");
7103 break;
7104 }
7105 client->validated_parent = 1;
7106 uuid_copy(client->parent_client_id, parent_client_id);
7107 } while (false);
7108 }
7109
7110 #endif /* !SKYWALK */
7111
7112 necp_client_update_observer_add(client);
7113
7114 NECP_FD_LOCK(fd_data);
7115 RB_INSERT(_necp_client_tree, &fd_data->clients, client);
7116 OSIncrementAtomic(&necp_client_count);
7117 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
7118 RB_INSERT(_necp_client_global_tree, &necp_client_global_tree, client);
7119 NECP_CLIENT_TREE_UNLOCK();
7120
7121 // Prime the client result
7122 NECP_CLIENT_LOCK(client);
7123 (void)necp_update_client_result(current_proc(), fd_data, client, NULL);
7124 necp_client_retain_locked(client);
7125 NECP_CLIENT_UNLOCK(client);
7126 NECP_FD_UNLOCK(fd_data);
7127 // Now everything is set, it's safe to plumb this in to NetworkStatistics
7128 uint32_t ntstat_properties = 0;
7129 necp_find_conn_netstat_data(client, &ntstat_properties, NULL, NULL, NULL);
7130
7131 client->nstat_context = nstat_provider_stats_open((nstat_provider_context)client,
7132 NSTAT_PROVIDER_CONN_USERLAND, (u_int64_t)ntstat_properties, necp_request_conn_netstats, necp_find_conn_extension_info);
7133 necp_client_release(client);
7134 done:
7135 if (error != 0 && client != NULL) {
7136 necp_client_free(client);
7137 client = NULL;
7138 }
7139 *retval = error;
7140
7141 return error;
7142 }
7143
7144 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_claim(struct proc * p,struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7145 necp_client_claim(struct proc *p, struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7146 {
7147 int error = 0;
7148 uuid_t client_id = {};
7149 struct necp_client *client = NULL;
7150
7151 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
7152 error = EINVAL;
7153 goto done;
7154 }
7155
7156 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
7157 if (error) {
7158 NECPLOG(LOG_ERR, "necp_client_claim copyin client_id error (%d)", error);
7159 goto done;
7160 }
7161
7162 if (necp_client_id_is_flow(client_id)) {
7163 NECPLOG0(LOG_ERR, "necp_client_claim cannot claim from flow UUID");
7164 error = EINVAL;
7165 goto done;
7166 }
7167
7168 u_int64_t upid = proc_uniqueid(p);
7169
7170 NECP_FD_LIST_LOCK_SHARED();
7171
7172 struct necp_fd_data *find_fd = NULL;
7173 LIST_FOREACH(find_fd, &necp_fd_list, chain) {
7174 NECP_FD_LOCK(find_fd);
7175 struct necp_client *find_client = necp_client_fd_find_client_and_lock(find_fd, client_id);
7176 if (find_client != NULL) {
7177 if (find_client->delegated_upid == upid &&
7178 RB_EMPTY(&find_client->flow_registrations)) {
7179 // Matched the client to claim; remove from the old fd
7180 client = find_client;
7181 RB_REMOVE(_necp_client_tree, &find_fd->clients, client);
7182 necp_client_retain_locked(client);
7183 }
7184 NECP_CLIENT_UNLOCK(find_client);
7185 }
7186 NECP_FD_UNLOCK(find_fd);
7187
7188 if (client != NULL) {
7189 break;
7190 }
7191 }
7192
7193 NECP_FD_LIST_UNLOCK();
7194
7195 if (client == NULL) {
7196 error = ENOENT;
7197 goto done;
7198 }
7199
7200 client->proc_pid = fd_data->proc_pid; // Transfer client to claiming pid
7201 client->agent_handle = (void *)fd_data;
7202 client->platform_binary = ((csproc_get_platform_binary(p) == 0) ? 0 : 1);
7203
7204 NECP_CLIENT_LOG(client, "Claiming client");
7205
7206 // Add matched client to our fd and re-run result
7207 NECP_FD_LOCK(fd_data);
7208 RB_INSERT(_necp_client_tree, &fd_data->clients, client);
7209 NECP_CLIENT_LOCK(client);
7210 (void)necp_update_client_result(current_proc(), fd_data, client, NULL);
7211 NECP_CLIENT_UNLOCK(client);
7212 NECP_FD_UNLOCK(fd_data);
7213
7214 necp_client_release(client);
7215
7216 done:
7217 *retval = error;
7218
7219 return error;
7220 }
7221
7222 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_remove(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7223 necp_client_remove(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7224 {
7225 int error = 0;
7226 uuid_t client_id = {};
7227 struct ifnet_stats_per_flow flow_ifnet_stats = {};
7228 const size_t buffer_size = uap->buffer_size;
7229
7230 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
7231 error = EINVAL;
7232 goto done;
7233 }
7234
7235 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
7236 if (error) {
7237 NECPLOG(LOG_ERR, "necp_client_remove copyin client_id error (%d)", error);
7238 goto done;
7239 }
7240
7241 if (uap->buffer != 0 && buffer_size == sizeof(flow_ifnet_stats)) {
7242 error = copyin(uap->buffer, &flow_ifnet_stats, buffer_size);
7243 if (error) {
7244 NECPLOG(LOG_ERR, "necp_client_remove flow_ifnet_stats copyin error (%d)", error);
7245 // Not fatal; make sure to zero-out stats in case of partial copy
7246 memset(&flow_ifnet_stats, 0, sizeof(flow_ifnet_stats));
7247 error = 0;
7248 }
7249 } else if (uap->buffer != 0) {
7250 NECPLOG(LOG_ERR, "necp_client_remove unexpected parameters length (%zu)", buffer_size);
7251 }
7252
7253 NECP_FD_LOCK(fd_data);
7254
7255 pid_t pid = fd_data->proc_pid;
7256 struct necp_client *client = necp_client_fd_find_client_unlocked(fd_data, client_id);
7257
7258 NECP_CLIENT_LOG(client, "Removing client");
7259
7260 if (client != NULL) {
7261 // Remove any flow registrations that match
7262 struct necp_client_flow_registration *flow_registration = NULL;
7263 struct necp_client_flow_registration *temp_flow_registration = NULL;
7264 RB_FOREACH_SAFE(flow_registration, _necp_fd_flow_tree, &fd_data->flows, temp_flow_registration) {
7265 if (flow_registration->client == client) {
7266 #if SKYWALK
7267 necp_destroy_flow_stats(fd_data, flow_registration, NULL, TRUE);
7268 #endif /* SKYWALK */
7269 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
7270 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
7271 NECP_FLOW_TREE_UNLOCK();
7272 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
7273 }
7274 }
7275 #if SKYWALK
7276 if (client->nstat_context != NULL) {
7277 // Main path, we expect stats to be in existance at this point
7278 nstat_provider_stats_close(client->nstat_context);
7279 client->nstat_context = NULL;
7280 } else {
7281 NECPLOG0(LOG_ERR, "necp_client_remove ntstat shutdown finds nstat_context NULL");
7282 }
7283 #endif /* SKYWALK */
7284 // Remove client from lists
7285 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
7286 RB_REMOVE(_necp_client_global_tree, &necp_client_global_tree, client);
7287 NECP_CLIENT_TREE_UNLOCK();
7288 RB_REMOVE(_necp_client_tree, &fd_data->clients, client);
7289 }
7290
7291 #if SKYWALK
7292 // If the currently-active arena is idle (has no more flows referring to it), or if there are defunct
7293 // arenas lingering in the list, schedule a threadcall to do the clean up. The idle check is done
7294 // by checking if the reference count is 3: one held by this client (will be released below when we
7295 // destroy it) when it's non-NULL; the rest held by stats_arena_{active,list}.
7296 if ((fd_data->stats_arena_active != NULL && fd_data->stats_arena_active->nai_use_count == 3) ||
7297 (fd_data->stats_arena_active == NULL && !LIST_EMPTY(&fd_data->stats_arena_list))) {
7298 uint64_t deadline = 0;
7299 uint64_t leeway = 0;
7300 clock_interval_to_deadline(necp_close_arenas_timeout_microseconds, NSEC_PER_USEC, &deadline);
7301 clock_interval_to_absolutetime_interval(necp_close_arenas_timeout_leeway_microseconds, NSEC_PER_USEC, &leeway);
7302
7303 thread_call_enter_delayed_with_leeway(necp_close_empty_arenas_tcall, NULL,
7304 deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
7305 }
7306 #endif /* SKYWALK */
7307
7308 NECP_FD_UNLOCK(fd_data);
7309
7310 if (client != NULL) {
7311 ASSERT(error == 0);
7312 necp_destroy_client(client, pid, true);
7313 } else {
7314 error = ENOENT;
7315 NECPLOG(LOG_ERR, "necp_client_remove invalid client_id (%d)", error);
7316 }
7317 done:
7318 *retval = error;
7319
7320 return error;
7321 }
7322
7323 static struct necp_client_flow_registration *
necp_client_fd_find_flow(struct necp_fd_data * client_fd,uuid_t flow_id)7324 necp_client_fd_find_flow(struct necp_fd_data *client_fd, uuid_t flow_id)
7325 {
7326 NECP_FD_ASSERT_LOCKED(client_fd);
7327 struct necp_client_flow_registration *flow = NULL;
7328
7329 if (necp_client_id_is_flow(flow_id)) {
7330 struct necp_client_flow_registration find;
7331 uuid_copy(find.registration_id, flow_id);
7332 flow = RB_FIND(_necp_fd_flow_tree, &client_fd->flows, &find);
7333 }
7334
7335 return flow;
7336 }
7337
7338 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_remove_flow(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7339 necp_client_remove_flow(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7340 {
7341 int error = 0;
7342 uuid_t flow_id = {};
7343 struct ifnet_stats_per_flow flow_ifnet_stats = {};
7344 const size_t buffer_size = uap->buffer_size;
7345
7346 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
7347 error = EINVAL;
7348 NECPLOG(LOG_ERR, "necp_client_remove_flow invalid client_id (length %zu)", (size_t)uap->client_id_len);
7349 goto done;
7350 }
7351
7352 error = copyin(uap->client_id, flow_id, sizeof(uuid_t));
7353 if (error) {
7354 NECPLOG(LOG_ERR, "necp_client_remove_flow copyin client_id error (%d)", error);
7355 goto done;
7356 }
7357
7358 if (uap->buffer != 0 && buffer_size == sizeof(flow_ifnet_stats)) {
7359 error = copyin(uap->buffer, &flow_ifnet_stats, buffer_size);
7360 if (error) {
7361 NECPLOG(LOG_ERR, "necp_client_remove flow_ifnet_stats copyin error (%d)", error);
7362 // Not fatal
7363 }
7364 } else if (uap->buffer != 0) {
7365 NECPLOG(LOG_ERR, "necp_client_remove unexpected parameters length (%zu)", buffer_size);
7366 }
7367
7368 NECP_FD_LOCK(fd_data);
7369 struct necp_client *client = NULL;
7370 struct necp_client_flow_registration *flow_registration = necp_client_fd_find_flow(fd_data, flow_id);
7371 if (flow_registration != NULL) {
7372 #if SKYWALK
7373 // Cleanup stats per flow
7374 necp_destroy_flow_stats(fd_data, flow_registration, &flow_ifnet_stats, TRUE);
7375 #endif /* SKYWALK */
7376 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
7377 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
7378 NECP_FLOW_TREE_UNLOCK();
7379 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
7380
7381 client = flow_registration->client;
7382 if (client != NULL) {
7383 necp_client_retain(client);
7384 }
7385 }
7386 NECP_FD_UNLOCK(fd_data);
7387
7388 NECP_CLIENT_FLOW_LOG(client, flow_registration, "removing flow");
7389
7390 if (flow_registration != NULL && client != NULL) {
7391 NECP_CLIENT_LOCK(client);
7392 if (flow_registration->client == client) {
7393 necp_destroy_client_flow_registration(client, flow_registration, fd_data->proc_pid, false);
7394 }
7395 necp_client_release_locked(client);
7396 NECP_CLIENT_UNLOCK(client);
7397 }
7398
7399 done:
7400 *retval = error;
7401 if (error != 0) {
7402 NECPLOG(LOG_ERR, "Remove flow error (%d)", error);
7403 }
7404
7405 return error;
7406 }
7407
7408 // Don't inline the function since it includes necp_client_parsed_parameters on the stack
7409 static __attribute__((noinline)) int
necp_client_check_tcp_heuristics(struct necp_client * client,struct necp_client_flow * flow,u_int32_t * flags,u_int8_t * tfo_cookie,u_int8_t * tfo_cookie_len)7410 necp_client_check_tcp_heuristics(struct necp_client *client, struct necp_client_flow *flow, u_int32_t *flags, u_int8_t *tfo_cookie, u_int8_t *tfo_cookie_len)
7411 {
7412 struct necp_client_parsed_parameters parsed_parameters;
7413 int error = 0;
7414
7415 error = necp_client_parse_parameters(client, client->parameters,
7416 (u_int32_t)client->parameters_length,
7417 &parsed_parameters);
7418 if (error) {
7419 NECPLOG(LOG_ERR, "necp_client_parse_parameters error (%d)", error);
7420 return error;
7421 }
7422
7423 if ((flow->remote_addr.sa.sa_family != AF_INET &&
7424 flow->remote_addr.sa.sa_family != AF_INET6) ||
7425 (flow->local_addr.sa.sa_family != AF_INET &&
7426 flow->local_addr.sa.sa_family != AF_INET6)) {
7427 return EINVAL;
7428 }
7429
7430 NECP_CLIENT_ROUTE_LOCK(client);
7431
7432 if (client->current_route == NULL) {
7433 error = ENOENT;
7434 goto do_unlock;
7435 }
7436
7437 bool check_ecn = false;
7438 do {
7439 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) ==
7440 NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) {
7441 check_ecn = true;
7442 break;
7443 }
7444
7445 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) ==
7446 NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) {
7447 break;
7448 }
7449
7450 if (client->current_route != NULL) {
7451 if (client->current_route->rt_ifp->if_eflags & IFEF_ECN_ENABLE) {
7452 check_ecn = true;
7453 break;
7454 }
7455 if (client->current_route->rt_ifp->if_eflags & IFEF_ECN_DISABLE) {
7456 break;
7457 }
7458 }
7459
7460 bool inbound = ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) == 0);
7461 if ((inbound && tcp_ecn_inbound == 1) ||
7462 (!inbound && tcp_ecn_outbound == 1)) {
7463 check_ecn = true;
7464 }
7465 } while (false);
7466
7467 if (check_ecn) {
7468 if (tcp_heuristic_do_ecn_with_address(client->current_route->rt_ifp,
7469 (union sockaddr_in_4_6 *)&flow->local_addr)) {
7470 *flags |= NECP_CLIENT_RESULT_FLAG_ECN_ENABLED;
7471 }
7472 }
7473
7474 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) ==
7475 NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) {
7476 if (!tcp_heuristic_do_tfo_with_address(client->current_route->rt_ifp,
7477 (union sockaddr_in_4_6 *)&flow->local_addr,
7478 (union sockaddr_in_4_6 *)&flow->remote_addr,
7479 tfo_cookie, tfo_cookie_len)) {
7480 *flags |= NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED;
7481 *tfo_cookie_len = 0;
7482 }
7483 } else {
7484 *flags |= NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED;
7485 *tfo_cookie_len = 0;
7486 }
7487 do_unlock:
7488 NECP_CLIENT_ROUTE_UNLOCK(client);
7489
7490 return error;
7491 }
7492
7493 static size_t
necp_client_calculate_flow_tlv_size(struct necp_client_flow_registration * flow_registration)7494 necp_client_calculate_flow_tlv_size(struct necp_client_flow_registration *flow_registration)
7495 {
7496 size_t assigned_results_size = 0;
7497 struct necp_client_flow *flow = NULL;
7498 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
7499 if (flow->assigned) {
7500 size_t header_length = 0;
7501 if (flow->nexus) {
7502 header_length = sizeof(struct necp_client_nexus_flow_header);
7503 } else {
7504 header_length = sizeof(struct necp_client_flow_header);
7505 }
7506 assigned_results_size += (header_length + flow->assigned_results_length);
7507
7508 if (flow->has_protoctl_event) {
7509 assigned_results_size += sizeof(struct necp_client_flow_protoctl_event_header);
7510 }
7511 }
7512 }
7513 return assigned_results_size;
7514 }
7515
7516 static int
necp_client_fillout_flow_tlvs(struct necp_client * client,bool client_is_observed,struct necp_client_flow_registration * flow_registration,struct necp_client_action_args * uap,size_t * assigned_results_cursor)7517 necp_client_fillout_flow_tlvs(struct necp_client *client,
7518 bool client_is_observed,
7519 struct necp_client_flow_registration *flow_registration,
7520 struct necp_client_action_args *uap,
7521 size_t *assigned_results_cursor)
7522 {
7523 int error = 0;
7524 struct necp_client_flow *flow = NULL;
7525 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
7526 if (flow->assigned) {
7527 // Write TLV headers
7528 struct necp_client_nexus_flow_header header = {};
7529 u_int32_t length = 0;
7530 u_int32_t flags = 0;
7531 u_int8_t tfo_cookie_len = 0;
7532 u_int8_t type = 0;
7533
7534 type = NECP_CLIENT_RESULT_FLOW_ID;
7535 length = sizeof(header.flow_header.flow_id);
7536 memcpy(&header.flow_header.flow_id_tlv_header.type, &type, sizeof(type));
7537 memcpy(&header.flow_header.flow_id_tlv_header.length, &length, sizeof(length));
7538 uuid_copy(header.flow_header.flow_id, flow_registration->registration_id);
7539
7540 if (flow->nexus) {
7541 if (flow->check_tcp_heuristics) {
7542 u_int8_t tfo_cookie[NECP_TFO_COOKIE_LEN_MAX];
7543 tfo_cookie_len = NECP_TFO_COOKIE_LEN_MAX;
7544
7545 if (necp_client_check_tcp_heuristics(client, flow, &flags,
7546 tfo_cookie, &tfo_cookie_len) != 0) {
7547 tfo_cookie_len = 0;
7548 } else {
7549 flow->check_tcp_heuristics = FALSE;
7550
7551 if (tfo_cookie_len != 0) {
7552 type = NECP_CLIENT_RESULT_TFO_COOKIE;
7553 length = tfo_cookie_len;
7554 memcpy(&header.tfo_cookie_tlv_header.type, &type, sizeof(type));
7555 memcpy(&header.tfo_cookie_tlv_header.length, &length, sizeof(length));
7556 memcpy(&header.tfo_cookie_value, tfo_cookie, tfo_cookie_len);
7557 }
7558 }
7559 }
7560 }
7561
7562 size_t header_length = 0;
7563 if (flow->nexus) {
7564 if (tfo_cookie_len != 0) {
7565 header_length = sizeof(struct necp_client_nexus_flow_header) - (NECP_TFO_COOKIE_LEN_MAX - tfo_cookie_len);
7566 } else {
7567 header_length = sizeof(struct necp_client_nexus_flow_header) - sizeof(struct necp_tlv_header) - NECP_TFO_COOKIE_LEN_MAX;
7568 }
7569 } else {
7570 header_length = sizeof(struct necp_client_flow_header);
7571 }
7572
7573 type = NECP_CLIENT_RESULT_FLAGS;
7574 length = sizeof(header.flow_header.flags_value);
7575 memcpy(&header.flow_header.flags_tlv_header.type, &type, sizeof(type));
7576 memcpy(&header.flow_header.flags_tlv_header.length, &length, sizeof(length));
7577 if (flow->assigned) {
7578 flags |= NECP_CLIENT_RESULT_FLAG_FLOW_ASSIGNED;
7579 }
7580 if (flow->viable) {
7581 flags |= NECP_CLIENT_RESULT_FLAG_FLOW_VIABLE;
7582 }
7583 if (flow_registration->defunct) {
7584 flags |= NECP_CLIENT_RESULT_FLAG_DEFUNCT;
7585 }
7586 flags |= flow->necp_flow_flags;
7587 memcpy(&header.flow_header.flags_value, &flags, sizeof(flags));
7588
7589 type = NECP_CLIENT_RESULT_INTERFACE;
7590 length = sizeof(header.flow_header.interface_value);
7591 memcpy(&header.flow_header.interface_tlv_header.type, &type, sizeof(type));
7592 memcpy(&header.flow_header.interface_tlv_header.length, &length, sizeof(length));
7593
7594 struct necp_client_result_interface interface_struct;
7595 interface_struct.generation = 0;
7596 interface_struct.index = flow->interface_index;
7597
7598 memcpy(&header.flow_header.interface_value, &interface_struct, sizeof(interface_struct));
7599 if (flow->nexus) {
7600 type = NECP_CLIENT_RESULT_NETAGENT;
7601 length = sizeof(header.agent_value);
7602 memcpy(&header.agent_tlv_header.type, &type, sizeof(type));
7603 memcpy(&header.agent_tlv_header.length, &length, sizeof(length));
7604
7605 struct necp_client_result_netagent agent_struct;
7606 uuid_copy(agent_struct.netagent_uuid, flow->u.nexus_agent);
7607 agent_struct.generation = netagent_get_generation(agent_struct.netagent_uuid);
7608
7609 memcpy(&header.agent_value, &agent_struct, sizeof(agent_struct));
7610 }
7611
7612 // Don't include outer TLV header in length field
7613 type = NECP_CLIENT_RESULT_FLOW;
7614 length = (header_length - sizeof(struct necp_tlv_header) + flow->assigned_results_length);
7615 if (flow->has_protoctl_event) {
7616 length += sizeof(struct necp_client_flow_protoctl_event_header);
7617 }
7618 memcpy(&header.flow_header.outer_header.type, &type, sizeof(type));
7619 memcpy(&header.flow_header.outer_header.length, &length, sizeof(length));
7620
7621 error = copyout(&header, uap->buffer + client->result_length + *assigned_results_cursor, header_length);
7622 if (error) {
7623 NECPLOG(LOG_ERR, "necp_client_copy assigned results tlv_header copyout error (%d)", error);
7624 return error;
7625 }
7626 *assigned_results_cursor += header_length;
7627
7628 if (flow->assigned_results && flow->assigned_results_length) {
7629 // Write inner TLVs
7630 error = copyout(flow->assigned_results, uap->buffer + client->result_length + *assigned_results_cursor,
7631 flow->assigned_results_length);
7632 if (error) {
7633 NECPLOG(LOG_ERR, "necp_client_copy assigned results copyout error (%d)", error);
7634 return error;
7635 }
7636 }
7637 *assigned_results_cursor += flow->assigned_results_length;
7638
7639 /* Read the protocol event and reset it */
7640 if (flow->has_protoctl_event) {
7641 struct necp_client_flow_protoctl_event_header protoctl_event_header = {};
7642
7643 type = NECP_CLIENT_RESULT_PROTO_CTL_EVENT;
7644 length = sizeof(protoctl_event_header.protoctl_event);
7645
7646 memcpy(&protoctl_event_header.protoctl_tlv_header.type, &type, sizeof(type));
7647 memcpy(&protoctl_event_header.protoctl_tlv_header.length, &length, sizeof(length));
7648 memcpy(&protoctl_event_header.protoctl_event, &flow->protoctl_event,
7649 sizeof(flow->protoctl_event));
7650
7651 error = copyout(&protoctl_event_header, uap->buffer + client->result_length + *assigned_results_cursor,
7652 sizeof(protoctl_event_header));
7653
7654 if (error) {
7655 NECPLOG(LOG_ERR, "necp_client_copy protocol control event results"
7656 " tlv_header copyout error (%d)", error);
7657 return error;
7658 }
7659 *assigned_results_cursor += sizeof(protoctl_event_header);
7660 flow->has_protoctl_event = FALSE;
7661 flow->protoctl_event.protoctl_event_code = 0;
7662 flow->protoctl_event.protoctl_event_val = 0;
7663 flow->protoctl_event.protoctl_event_tcp_seq_num = 0;
7664 }
7665 }
7666 }
7667 if (!client_is_observed) {
7668 flow_registration->flow_result_read = TRUE;
7669 }
7670 return 0;
7671 }
7672
7673 static int
necp_client_copy_internal(struct necp_client * client,uuid_t client_id,bool client_is_observed,struct necp_client_action_args * uap,int * retval)7674 necp_client_copy_internal(struct necp_client *client, uuid_t client_id, bool client_is_observed, struct necp_client_action_args *uap, int *retval)
7675 {
7676 NECP_CLIENT_ASSERT_LOCKED(client);
7677 int error = 0;
7678 // Copy results out
7679 if (uap->action == NECP_CLIENT_ACTION_COPY_PARAMETERS) {
7680 if (uap->buffer_size < client->parameters_length) {
7681 return EINVAL;
7682 }
7683 error = copyout(client->parameters, uap->buffer, client->parameters_length);
7684 if (error) {
7685 NECPLOG(LOG_ERR, "necp_client_copy parameters copyout error (%d)", error);
7686 return error;
7687 }
7688 *retval = client->parameters_length;
7689 } else if (uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT &&
7690 client->result_read && client->group_members_read && !necp_client_has_unread_flows(client)) {
7691 // Copy updates only, but nothing to read
7692 // Just return 0 for bytes read
7693 *retval = 0;
7694 } else if (uap->action == NECP_CLIENT_ACTION_COPY_RESULT ||
7695 uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
7696 size_t assigned_results_size = client->assigned_group_members_length;
7697
7698 bool some_flow_is_defunct = false;
7699 struct necp_client_flow_registration *single_flow_registration = NULL;
7700 if (necp_client_id_is_flow(client_id)) {
7701 single_flow_registration = necp_client_find_flow(client, client_id);
7702 if (single_flow_registration != NULL) {
7703 assigned_results_size += necp_client_calculate_flow_tlv_size(single_flow_registration);
7704 }
7705 } else {
7706 // This request is for the client, so copy everything
7707 struct necp_client_flow_registration *flow_registration = NULL;
7708 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
7709 if (flow_registration->defunct) {
7710 some_flow_is_defunct = true;
7711 }
7712 assigned_results_size += necp_client_calculate_flow_tlv_size(flow_registration);
7713 }
7714 }
7715 if (uap->buffer_size < (client->result_length + assigned_results_size)) {
7716 return EINVAL;
7717 }
7718
7719 u_int32_t original_flags = 0;
7720 bool flags_updated = false;
7721 if (some_flow_is_defunct && client->legacy_client_is_flow) {
7722 // If our client expects the defunct flag in the client, add it now
7723 u_int32_t client_flags = 0;
7724 u_int32_t value_size = 0;
7725 u_int8_t *flags_pointer = necp_buffer_get_tlv_value(client->result, 0, &value_size);
7726 if (flags_pointer != NULL && value_size == sizeof(client_flags)) {
7727 memcpy(&client_flags, flags_pointer, value_size);
7728 original_flags = client_flags;
7729 client_flags |= NECP_CLIENT_RESULT_FLAG_DEFUNCT;
7730 (void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS,
7731 sizeof(client_flags), &client_flags, &flags_updated,
7732 client->result, sizeof(client->result));
7733 }
7734 }
7735
7736 error = copyout(client->result, uap->buffer, client->result_length);
7737
7738 if (flags_updated) {
7739 // Revert stored flags
7740 (void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS,
7741 sizeof(original_flags), &original_flags, &flags_updated,
7742 client->result, sizeof(client->result));
7743 }
7744
7745 if (error != 0) {
7746 NECPLOG(LOG_ERR, "necp_client_copy result copyout error (%d)", error);
7747 return error;
7748 }
7749
7750 if (client->assigned_group_members != NULL && client->assigned_group_members_length > 0) {
7751 error = copyout(client->assigned_group_members, uap->buffer + client->result_length, client->assigned_group_members_length);
7752 if (error != 0) {
7753 NECPLOG(LOG_ERR, "necp_client_copy group members copyout error (%d)", error);
7754 return error;
7755 }
7756 }
7757
7758 size_t assigned_results_cursor = client->assigned_group_members_length; // Start with an offset based on the group members
7759 if (necp_client_id_is_flow(client_id)) {
7760 if (single_flow_registration != NULL) {
7761 error = necp_client_fillout_flow_tlvs(client, client_is_observed, single_flow_registration, uap, &assigned_results_cursor);
7762 if (error != 0) {
7763 return error;
7764 }
7765 }
7766 } else {
7767 // This request is for the client, so copy everything
7768 struct necp_client_flow_registration *flow_registration = NULL;
7769 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
7770 error = necp_client_fillout_flow_tlvs(client, client_is_observed, flow_registration, uap, &assigned_results_cursor);
7771 if (error != 0) {
7772 return error;
7773 }
7774 }
7775 }
7776
7777 *retval = client->result_length + assigned_results_cursor;
7778
7779 if (!client_is_observed) {
7780 client->result_read = TRUE;
7781 client->group_members_read = TRUE;
7782 }
7783 }
7784
7785 return 0;
7786 }
7787
7788 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7789 necp_client_copy(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7790 {
7791 int error = 0;
7792 struct necp_client *client = NULL;
7793 uuid_t client_id;
7794 uuid_clear(client_id);
7795
7796 *retval = 0;
7797
7798 if (uap->buffer_size == 0 || uap->buffer == 0) {
7799 return EINVAL;
7800 }
7801
7802 if (uap->action != NECP_CLIENT_ACTION_COPY_PARAMETERS &&
7803 uap->action != NECP_CLIENT_ACTION_COPY_RESULT &&
7804 uap->action != NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
7805 return EINVAL;
7806 }
7807
7808 if (uap->client_id) {
7809 if (uap->client_id_len != sizeof(uuid_t)) {
7810 NECPLOG(LOG_ERR, "Incorrect length (got %zu, expected %zu)", (size_t)uap->client_id_len, sizeof(uuid_t));
7811 return ERANGE;
7812 }
7813
7814 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
7815 if (error) {
7816 NECPLOG(LOG_ERR, "necp_client_copy client_id copyin error (%d)", error);
7817 return error;
7818 }
7819 }
7820
7821 const bool is_wildcard = (bool)uuid_is_null(client_id);
7822
7823 NECP_FD_LOCK(fd_data);
7824
7825 if (is_wildcard) {
7826 if (uap->action == NECP_CLIENT_ACTION_COPY_RESULT || uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
7827 struct necp_client *find_client = NULL;
7828 RB_FOREACH(find_client, _necp_client_tree, &fd_data->clients) {
7829 NECP_CLIENT_LOCK(find_client);
7830 if (!find_client->result_read || !find_client->group_members_read || necp_client_has_unread_flows(find_client)) {
7831 client = find_client;
7832 // Leave the client locked, and break
7833 break;
7834 }
7835 NECP_CLIENT_UNLOCK(find_client);
7836 }
7837 }
7838 } else {
7839 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
7840 }
7841
7842 if (client != NULL) {
7843 // If client is set, it is locked
7844 error = necp_client_copy_internal(client, client_id, FALSE, uap, retval);
7845 NECP_CLIENT_UNLOCK(client);
7846 }
7847
7848 // Unlock our own fd before moving on or returning
7849 NECP_FD_UNLOCK(fd_data);
7850
7851 if (client == NULL) {
7852 if (fd_data->flags & NECP_OPEN_FLAG_OBSERVER) {
7853 // Observers are allowed to lookup clients on other fds
7854
7855 // Lock tree
7856 NECP_CLIENT_TREE_LOCK_SHARED();
7857
7858 bool found_client = FALSE;
7859
7860 client = necp_find_client_and_lock(client_id);
7861 if (client != NULL) {
7862 // Matched, copy out data
7863 found_client = TRUE;
7864 error = necp_client_copy_internal(client, client_id, TRUE, uap, retval);
7865 NECP_CLIENT_UNLOCK(client);
7866 }
7867
7868 // Unlock tree
7869 NECP_CLIENT_TREE_UNLOCK();
7870
7871 // No client found, fail
7872 if (!found_client) {
7873 return ENOENT;
7874 }
7875 } else {
7876 // No client found, and not allowed to search other fds, fail
7877 return ENOENT;
7878 }
7879 }
7880
7881 return error;
7882 }
7883
7884 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_client_update(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7885 necp_client_copy_client_update(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7886 {
7887 int error = 0;
7888
7889 *retval = 0;
7890
7891 if (!(fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER)) {
7892 NECPLOG0(LOG_ERR, "NECP fd is not observer, cannot copy client update");
7893 return EINVAL;
7894 }
7895
7896 if (uap->client_id_len != sizeof(uuid_t) || uap->client_id == 0) {
7897 NECPLOG0(LOG_ERR, "Client id invalid, cannot copy client update");
7898 return EINVAL;
7899 }
7900
7901 if (uap->buffer_size == 0 || uap->buffer == 0) {
7902 NECPLOG0(LOG_ERR, "Buffer invalid, cannot copy client update");
7903 return EINVAL;
7904 }
7905
7906 NECP_FD_LOCK(fd_data);
7907 struct necp_client_update *client_update = TAILQ_FIRST(&fd_data->update_list);
7908 if (client_update != NULL) {
7909 TAILQ_REMOVE(&fd_data->update_list, client_update, chain);
7910 VERIFY(fd_data->update_count > 0);
7911 fd_data->update_count--;
7912 }
7913 NECP_FD_UNLOCK(fd_data);
7914
7915 if (client_update != NULL) {
7916 error = copyout(client_update->client_id, uap->client_id, sizeof(uuid_t));
7917 if (error) {
7918 NECPLOG(LOG_ERR, "Copy client update copyout client id error (%d)", error);
7919 } else {
7920 if (uap->buffer_size < client_update->update_length) {
7921 NECPLOG(LOG_ERR, "Buffer size cannot hold update (%zu < %zu)", (size_t)uap->buffer_size, client_update->update_length);
7922 error = EINVAL;
7923 } else {
7924 error = copyout(client_update->update, uap->buffer, client_update->update_length);
7925 if (error) {
7926 NECPLOG(LOG_ERR, "Copy client update copyout error (%d)", error);
7927 } else {
7928 *retval = client_update->update_length;
7929 }
7930 }
7931 }
7932
7933 necp_client_update_free(client_update);
7934 client_update = NULL;
7935 } else {
7936 error = ENOENT;
7937 }
7938
7939 return error;
7940 }
7941
7942 static int
necp_client_copy_parameters_locked(struct necp_client * client,struct necp_client_nexus_parameters * parameters)7943 necp_client_copy_parameters_locked(struct necp_client *client,
7944 struct necp_client_nexus_parameters *parameters)
7945 {
7946 VERIFY(parameters != NULL);
7947
7948 struct necp_client_parsed_parameters parsed_parameters = {};
7949 int error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, &parsed_parameters);
7950
7951 parameters->pid = client->proc_pid;
7952 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID) {
7953 parameters->epid = parsed_parameters.effective_pid;
7954 } else {
7955 parameters->epid = parameters->pid;
7956 }
7957 #if SKYWALK
7958 parameters->port_reservation = client->port_reservation;
7959 #endif /* !SKYWALK */
7960 memcpy(¶meters->local_addr, &parsed_parameters.local_addr, sizeof(parameters->local_addr));
7961 memcpy(¶meters->remote_addr, &parsed_parameters.remote_addr, sizeof(parameters->remote_addr));
7962 parameters->ip_protocol = parsed_parameters.ip_protocol;
7963 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL) {
7964 parameters->transport_protocol = parsed_parameters.transport_protocol;
7965 } else {
7966 parameters->transport_protocol = parsed_parameters.ip_protocol;
7967 }
7968 parameters->ethertype = parsed_parameters.ethertype;
7969 parameters->traffic_class = parsed_parameters.traffic_class;
7970 if (uuid_is_null(client->override_euuid)) {
7971 uuid_copy(parameters->euuid, parsed_parameters.effective_uuid);
7972 } else {
7973 uuid_copy(parameters->euuid, client->override_euuid);
7974 }
7975 parameters->is_listener = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) ? 1 : 0;
7976 parameters->is_interpose = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) ? 1 : 0;
7977 parameters->is_custom_ether = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) ? 1 : 0;
7978 parameters->policy_id = client->policy_id;
7979
7980 // parse client result flag
7981 u_int32_t client_result_flags = 0;
7982 u_int32_t value_size = 0;
7983 u_int8_t *flags_pointer = NULL;
7984 flags_pointer = necp_buffer_get_tlv_value(client->result, 0, &value_size);
7985 if (flags_pointer && value_size == sizeof(client_result_flags)) {
7986 memcpy(&client_result_flags, flags_pointer, value_size);
7987 }
7988 parameters->allow_qos_marking = (client_result_flags & NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING) ? 1 : 0;
7989
7990 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE) {
7991 if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_DEFAULT) {
7992 parameters->override_address_selection = false;
7993 } else if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_TEMPORARY) {
7994 parameters->override_address_selection = true;
7995 parameters->use_stable_address = false;
7996 } else if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_STABLE) {
7997 parameters->override_address_selection = true;
7998 parameters->use_stable_address = true;
7999 }
8000 } else {
8001 parameters->override_address_selection = false;
8002 }
8003
8004 if ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
8005 (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_NO_WAKE_FROM_SLEEP)) {
8006 parameters->no_wake_from_sleep = true;
8007 }
8008
8009 if ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
8010 (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_REUSE_LOCAL)) {
8011 parameters->reuse_port = true;
8012 }
8013
8014 #if SKYWALK
8015 if (!parameters->is_listener) {
8016 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLOW_DEMUX_PATTERN) {
8017 if (parsed_parameters.demux_patterns[0].len == 0) {
8018 parameters->is_demuxable_parent = 1;
8019 } else {
8020 if (client->validated_parent) {
8021 ASSERT(!uuid_is_null(client->parent_client_id));
8022
8023 NECP_CLIENT_TREE_LOCK_SHARED();
8024 struct necp_client *parent = necp_find_client_and_lock(client->parent_client_id);
8025 if (parent != NULL) {
8026 struct necp_client_flow_registration *parent_flow_registration = NULL;
8027 RB_FOREACH(parent_flow_registration, _necp_client_flow_tree, &parent->flow_registrations) {
8028 uuid_copy(parameters->parent_flow_uuid, parent_flow_registration->registration_id);
8029 break;
8030 }
8031
8032 NECP_CLIENT_UNLOCK(parent);
8033 }
8034 NECP_CLIENT_TREE_UNLOCK();
8035
8036 if (parsed_parameters.demux_pattern_count > 0) {
8037 for (int i = 0; i < parsed_parameters.demux_pattern_count; i++) {
8038 memcpy(¶meters->demux_patterns[i], &parsed_parameters.demux_patterns[i], sizeof(struct necp_demux_pattern));
8039 }
8040 parameters->demux_pattern_count = parsed_parameters.demux_pattern_count;
8041 }
8042 }
8043 }
8044 }
8045 }
8046 #endif // SKYWALK
8047
8048 return error;
8049 }
8050
8051 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_list(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8052 necp_client_list(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8053 {
8054 int error = 0;
8055 struct necp_client *find_client = NULL;
8056 uuid_t *list = NULL;
8057 u_int32_t requested_client_count = 0;
8058 u_int32_t client_count = 0;
8059 size_t copy_buffer_size = 0;
8060
8061 if (uap->buffer_size < sizeof(requested_client_count) || uap->buffer == 0) {
8062 error = EINVAL;
8063 goto done;
8064 }
8065
8066 if (!(fd_data->flags & NECP_OPEN_FLAG_OBSERVER)) {
8067 NECPLOG0(LOG_ERR, "Client does not hold necessary entitlement to list other NECP clients");
8068 error = EACCES;
8069 goto done;
8070 }
8071
8072 error = copyin(uap->buffer, &requested_client_count, sizeof(requested_client_count));
8073 if (error) {
8074 goto done;
8075 }
8076
8077 if (os_mul_overflow(sizeof(uuid_t), requested_client_count, ©_buffer_size)) {
8078 error = ERANGE;
8079 goto done;
8080 }
8081
8082 if (uap->buffer_size - sizeof(requested_client_count) != copy_buffer_size) {
8083 error = EINVAL;
8084 goto done;
8085 }
8086
8087 if (copy_buffer_size > NECP_MAX_CLIENT_LIST_SIZE) {
8088 error = EINVAL;
8089 goto done;
8090 }
8091
8092 if (requested_client_count > 0) {
8093 if ((list = (uuid_t*)kalloc_data(copy_buffer_size, Z_WAITOK | Z_ZERO)) == NULL) {
8094 error = ENOMEM;
8095 goto done;
8096 }
8097 }
8098
8099 // Lock tree
8100 NECP_CLIENT_TREE_LOCK_SHARED();
8101
8102 find_client = NULL;
8103 RB_FOREACH(find_client, _necp_client_global_tree, &necp_client_global_tree) {
8104 NECP_CLIENT_LOCK(find_client);
8105 if (!uuid_is_null(find_client->client_id)) {
8106 if (client_count < requested_client_count) {
8107 uuid_copy(list[client_count], find_client->client_id);
8108 }
8109 client_count++;
8110 }
8111 NECP_CLIENT_UNLOCK(find_client);
8112 }
8113
8114 // Unlock tree
8115 NECP_CLIENT_TREE_UNLOCK();
8116
8117 error = copyout(&client_count, uap->buffer, sizeof(client_count));
8118 if (error) {
8119 NECPLOG(LOG_ERR, "necp_client_list buffer copyout error (%d)", error);
8120 goto done;
8121 }
8122
8123 if (requested_client_count > 0 &&
8124 client_count > 0 &&
8125 list != NULL) {
8126 error = copyout(list, uap->buffer + sizeof(client_count), copy_buffer_size);
8127 if (error) {
8128 NECPLOG(LOG_ERR, "necp_client_list client count copyout error (%d)", error);
8129 goto done;
8130 }
8131 }
8132 done:
8133 if (list != NULL) {
8134 kfree_data(list, copy_buffer_size);
8135 }
8136 *retval = error;
8137
8138 return error;
8139 }
8140
8141 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_add_flow(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8142 necp_client_add_flow(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8143 {
8144 int error = 0;
8145 struct necp_client *client = NULL;
8146 uuid_t client_id;
8147 struct necp_client_nexus_parameters parameters = {};
8148 struct proc *proc = PROC_NULL;
8149 struct necp_client_add_flow *add_request = NULL;
8150 struct necp_client_add_flow *allocated_add_request = NULL;
8151 struct necp_client_add_flow_default default_add_request = {};
8152 const size_t buffer_size = uap->buffer_size;
8153
8154 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
8155 error = EINVAL;
8156 NECPLOG(LOG_ERR, "necp_client_add_flow invalid client_id (length %zu)", (size_t)uap->client_id_len);
8157 goto done;
8158 }
8159
8160 if (uap->buffer == 0 || buffer_size < sizeof(struct necp_client_add_flow) ||
8161 buffer_size > sizeof(struct necp_client_add_flow_default) * 4) {
8162 error = EINVAL;
8163 NECPLOG(LOG_ERR, "necp_client_add_flow invalid buffer (length %zu)", buffer_size);
8164 goto done;
8165 }
8166
8167 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8168 if (error) {
8169 NECPLOG(LOG_ERR, "necp_client_add_flow copyin client_id error (%d)", error);
8170 goto done;
8171 }
8172
8173 if (buffer_size <= sizeof(struct necp_client_add_flow_default)) {
8174 // Fits in default size
8175 error = copyin(uap->buffer, &default_add_request, buffer_size);
8176 if (error) {
8177 NECPLOG(LOG_ERR, "necp_client_add_flow copyin default_add_request error (%d)", error);
8178 goto done;
8179 }
8180
8181 add_request = (struct necp_client_add_flow *)&default_add_request;
8182 } else {
8183 allocated_add_request = (struct necp_client_add_flow *)kalloc_data(buffer_size, Z_WAITOK | Z_ZERO);
8184 if (allocated_add_request == NULL) {
8185 error = ENOMEM;
8186 goto done;
8187 }
8188
8189 error = copyin(uap->buffer, allocated_add_request, buffer_size);
8190 if (error) {
8191 NECPLOG(LOG_ERR, "necp_client_add_flow copyin default_add_request error (%d)", error);
8192 goto done;
8193 }
8194
8195 add_request = allocated_add_request;
8196 }
8197
8198 NECP_FD_LOCK(fd_data);
8199 pid_t pid = fd_data->proc_pid;
8200 proc = proc_find(pid);
8201 if (proc == PROC_NULL) {
8202 NECP_FD_UNLOCK(fd_data);
8203 NECPLOG(LOG_ERR, "necp_client_add_flow process not found for pid %d error (%d)", pid, error);
8204 error = ESRCH;
8205 goto done;
8206 }
8207
8208 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8209 if (client == NULL) {
8210 error = ENOENT;
8211 NECP_FD_UNLOCK(fd_data);
8212 goto done;
8213 }
8214
8215 // Using ADD_FLOW indicates that the client supports multiple flows per client
8216 client->legacy_client_is_flow = false;
8217
8218 necp_client_retain_locked(client);
8219 necp_client_copy_parameters_locked(client, ¶meters);
8220
8221 struct necp_client_flow_registration *new_registration = necp_client_create_flow_registration(fd_data, client);
8222 if (new_registration == NULL) {
8223 error = ENOMEM;
8224 NECP_CLIENT_UNLOCK(client);
8225 NECP_FD_UNLOCK(fd_data);
8226 NECPLOG0(LOG_ERR, "Failed to allocate flow registration");
8227 goto done;
8228 }
8229
8230 new_registration->flags = add_request->flags;
8231
8232 // Copy new ID out to caller
8233 uuid_copy(add_request->registration_id, new_registration->registration_id);
8234
8235 NECP_CLIENT_FLOW_LOG(client, new_registration, "adding flow");
8236
8237 size_t trailer_offset = (sizeof(struct necp_client_add_flow) +
8238 add_request->stats_request_count * sizeof(struct necp_client_flow_stats));
8239
8240 // Copy override address
8241 if (add_request->flags & NECP_CLIENT_FLOW_FLAGS_OVERRIDE_ADDRESS) {
8242 size_t offset_of_address = trailer_offset;
8243 if (buffer_size >= offset_of_address + sizeof(struct sockaddr_in)) {
8244 struct sockaddr *override_address = (struct sockaddr *)(((uint8_t *)add_request) + offset_of_address);
8245 if (buffer_size >= offset_of_address + override_address->sa_len &&
8246 override_address->sa_len <= sizeof(parameters.remote_addr)) {
8247 memcpy(¶meters.remote_addr, override_address, override_address->sa_len);
8248 trailer_offset += override_address->sa_len;
8249 }
8250 }
8251 }
8252
8253 // Copy override IP protocol
8254 if (add_request->flags & NECP_CLIENT_FLOW_FLAGS_OVERRIDE_IP_PROTOCOL) {
8255 size_t offset_of_ip_protocol = trailer_offset;
8256 if (buffer_size >= offset_of_ip_protocol + sizeof(uint8_t)) {
8257 uint8_t *ip_protocol_p = (uint8_t *)(((uint8_t *)add_request) + offset_of_ip_protocol);
8258 memcpy(¶meters.ip_protocol, ip_protocol_p, sizeof(uint8_t));
8259 }
8260 }
8261
8262 #if SKYWALK
8263 if (add_request->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS) {
8264 void *assigned_results = NULL;
8265 size_t assigned_results_length = 0;
8266 uint32_t interface_index = 0;
8267
8268 // Validate that the nexus UUID is assigned
8269 bool found_nexus = false;
8270 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
8271 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
8272 struct necp_client_interface_option *option = &client->interface_options[option_i];
8273 if (uuid_compare(option->nexus_agent, add_request->agent_uuid) == 0) {
8274 interface_index = option->interface_index;
8275 found_nexus = true;
8276 break;
8277 }
8278 } else {
8279 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
8280 if (uuid_compare(option->nexus_agent, add_request->agent_uuid) == 0) {
8281 interface_index = option->interface_index;
8282 found_nexus = true;
8283 break;
8284 }
8285 }
8286 }
8287
8288 if (!found_nexus) {
8289 NECPLOG0(LOG_ERR, "Requested nexus not found");
8290 } else {
8291 necp_client_add_nexus_flow_if_needed(new_registration, add_request->agent_uuid, interface_index);
8292
8293 error = netagent_client_message_with_params(add_request->agent_uuid,
8294 ((new_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
8295 client->client_id :
8296 new_registration->registration_id),
8297 pid, client->agent_handle,
8298 NETAGENT_MESSAGE_TYPE_REQUEST_NEXUS,
8299 (struct necp_client_agent_parameters *)¶meters,
8300 &assigned_results, &assigned_results_length);
8301 if (error != 0) {
8302 VERIFY(assigned_results == NULL);
8303 VERIFY(assigned_results_length == 0);
8304 NECPLOG(LOG_ERR, "netagent_client_message error (%d)", error);
8305 } else if (assigned_results != NULL) {
8306 if (!necp_assign_client_result_locked(proc, fd_data, client, new_registration, add_request->agent_uuid,
8307 assigned_results, assigned_results_length, false, false)) {
8308 kfree_data(assigned_results, assigned_results_length);
8309 }
8310 }
8311 }
8312 }
8313
8314 // Don't request stats if nexus creation fails
8315 if (error == 0 && add_request->stats_request_count > 0 && necp_arena_initialize(fd_data, true) == 0) {
8316 struct necp_client_flow_stats *stats_request = (struct necp_client_flow_stats *)&add_request->stats_requests[0];
8317 struct necp_stats_bufreq bufreq = {};
8318
8319 NECP_CLIENT_FLOW_LOG(client, new_registration, "Initializing stats");
8320
8321 bufreq.necp_stats_bufreq_id = NECP_CLIENT_STATISTICS_BUFREQ_ID;
8322 bufreq.necp_stats_bufreq_type = stats_request->stats_type;
8323 bufreq.necp_stats_bufreq_ver = stats_request->stats_version;
8324 bufreq.necp_stats_bufreq_size = stats_request->stats_size;
8325 bufreq.necp_stats_bufreq_uaddr = stats_request->stats_addr;
8326 (void)necp_stats_initialize(fd_data, client, new_registration, &bufreq);
8327 stats_request->stats_type = bufreq.necp_stats_bufreq_type;
8328 stats_request->stats_version = bufreq.necp_stats_bufreq_ver;
8329 stats_request->stats_size = bufreq.necp_stats_bufreq_size;
8330 stats_request->stats_addr = bufreq.necp_stats_bufreq_uaddr;
8331 }
8332 #endif /* !SKYWALK */
8333
8334 if (error == 0 &&
8335 (add_request->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE ||
8336 add_request->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) {
8337 uint32_t interface_index = IFSCOPE_NONE;
8338 ifnet_head_lock_shared();
8339 struct ifnet *interface = NULL;
8340 TAILQ_FOREACH(interface, &ifnet_head, if_link) {
8341 ifnet_lock_shared(interface);
8342 if (interface->if_agentids != NULL) {
8343 for (u_int32_t i = 0; i < interface->if_agentcount; i++) {
8344 if (uuid_compare(interface->if_agentids[i], add_request->agent_uuid) == 0) {
8345 interface_index = interface->if_index;
8346 break;
8347 }
8348 }
8349 }
8350 ifnet_lock_done(interface);
8351 if (interface_index != IFSCOPE_NONE) {
8352 break;
8353 }
8354 }
8355 ifnet_head_done();
8356
8357 necp_client_add_nexus_flow_if_needed(new_registration, add_request->agent_uuid, interface_index);
8358
8359 error = netagent_client_message_with_params(add_request->agent_uuid,
8360 ((new_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
8361 client->client_id :
8362 new_registration->registration_id),
8363 pid, client->agent_handle,
8364 NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT,
8365 (struct necp_client_agent_parameters *)¶meters,
8366 NULL, NULL);
8367 if (error != 0) {
8368 NECPLOG(LOG_ERR, "netagent_client_message error (%d)", error);
8369 }
8370 }
8371
8372 if (error != 0) {
8373 // Encountered an error in adding the flow, destroy the flow registration
8374 #if SKYWALK
8375 necp_destroy_flow_stats(fd_data, new_registration, NULL, false);
8376 #endif /* SKYWALK */
8377 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
8378 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, new_registration);
8379 NECP_FLOW_TREE_UNLOCK();
8380 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, new_registration);
8381 necp_destroy_client_flow_registration(client, new_registration, fd_data->proc_pid, true);
8382 new_registration = NULL;
8383 }
8384
8385 NECP_CLIENT_UNLOCK(client);
8386 NECP_FD_UNLOCK(fd_data);
8387
8388 necp_client_release(client);
8389
8390 if (error != 0) {
8391 goto done;
8392 }
8393
8394 // Copy the request back out to the caller with assigned fields
8395 error = copyout(add_request, uap->buffer, buffer_size);
8396 if (error != 0) {
8397 NECPLOG(LOG_ERR, "necp_client_add_flow copyout add_request error (%d)", error);
8398 }
8399
8400 done:
8401 *retval = error;
8402 if (error != 0) {
8403 NECPLOG(LOG_ERR, "Add flow error (%d)", error);
8404 }
8405
8406 if (allocated_add_request != NULL) {
8407 kfree_data(allocated_add_request, buffer_size);
8408 }
8409
8410 if (proc != PROC_NULL) {
8411 proc_rele(proc);
8412 }
8413 return error;
8414 }
8415
8416 #if SKYWALK
8417
8418 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_request_nexus(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8419 necp_client_request_nexus(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8420 {
8421 int error = 0;
8422 struct necp_client *client = NULL;
8423 uuid_t client_id;
8424 struct necp_client_nexus_parameters parameters = {};
8425 struct proc *proc = PROC_NULL;
8426 const size_t buffer_size = uap->buffer_size;
8427
8428 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
8429 error = EINVAL;
8430 goto done;
8431 }
8432
8433 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8434 if (error) {
8435 NECPLOG(LOG_ERR, "necp_client_request_nexus copyin client_id error (%d)", error);
8436 goto done;
8437 }
8438
8439 NECP_FD_LOCK(fd_data);
8440 pid_t pid = fd_data->proc_pid;
8441 proc = proc_find(pid);
8442 if (proc == PROC_NULL) {
8443 NECP_FD_UNLOCK(fd_data);
8444 NECPLOG(LOG_ERR, "necp_client_request_nexus process not found for pid %d error (%d)", pid, error);
8445 error = ESRCH;
8446 goto done;
8447 }
8448
8449 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8450 if (client == NULL) {
8451 NECP_FD_UNLOCK(fd_data);
8452 error = ENOENT;
8453 goto done;
8454 }
8455
8456 // Using REQUEST_NEXUS indicates that the client only supports one flow per client
8457 client->legacy_client_is_flow = true;
8458
8459 necp_client_retain_locked(client);
8460 necp_client_copy_parameters_locked(client, ¶meters);
8461
8462 do {
8463 void *assigned_results = NULL;
8464 size_t assigned_results_length = 0;
8465 uuid_t nexus_uuid;
8466 uint32_t interface_index = 0;
8467
8468 // Validate that the nexus UUID is assigned
8469 bool found_nexus = false;
8470 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
8471 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
8472 struct necp_client_interface_option *option = &client->interface_options[option_i];
8473 if (!uuid_is_null(option->nexus_agent)) {
8474 uuid_copy(nexus_uuid, option->nexus_agent);
8475 interface_index = option->interface_index;
8476 found_nexus = true;
8477 break;
8478 }
8479 } else {
8480 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
8481 if (!uuid_is_null(option->nexus_agent)) {
8482 uuid_copy(nexus_uuid, option->nexus_agent);
8483 interface_index = option->interface_index;
8484 found_nexus = true;
8485 break;
8486 }
8487 }
8488 }
8489
8490 if (!found_nexus) {
8491 NECP_CLIENT_UNLOCK(client);
8492 NECP_FD_UNLOCK(fd_data);
8493 necp_client_release(client);
8494 // Break the loop
8495 error = ENETDOWN;
8496 goto done;
8497 }
8498
8499 struct necp_client_flow_registration *new_registration = necp_client_create_flow_registration(fd_data, client);
8500 if (new_registration == NULL) {
8501 error = ENOMEM;
8502 NECP_CLIENT_UNLOCK(client);
8503 NECP_FD_UNLOCK(fd_data);
8504 necp_client_release(client);
8505 NECPLOG0(LOG_ERR, "Failed to allocate flow registration");
8506 goto done;
8507 }
8508
8509 new_registration->flags = (NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS | NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID);
8510
8511 necp_client_add_nexus_flow_if_needed(new_registration, nexus_uuid, interface_index);
8512
8513 // Note: Any clients using "request_nexus" are not flow-registration aware.
8514 // Register the Client ID rather than the Registration ID with the nexus, since
8515 // the client will send traffic based on the client ID.
8516 error = netagent_client_message_with_params(nexus_uuid,
8517 ((new_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
8518 client->client_id :
8519 new_registration->registration_id),
8520 pid, client->agent_handle,
8521 NETAGENT_MESSAGE_TYPE_REQUEST_NEXUS,
8522 (struct necp_client_agent_parameters *)¶meters,
8523 &assigned_results, &assigned_results_length);
8524 if (error) {
8525 NECP_CLIENT_UNLOCK(client);
8526 NECP_FD_UNLOCK(fd_data);
8527 necp_client_release(client);
8528 VERIFY(assigned_results == NULL);
8529 VERIFY(assigned_results_length == 0);
8530 NECPLOG(LOG_ERR, "netagent_client_message error (%d)", error);
8531 goto done;
8532 }
8533
8534 if (assigned_results != NULL) {
8535 if (!necp_assign_client_result_locked(proc, fd_data, client, new_registration, nexus_uuid,
8536 assigned_results, assigned_results_length, false, false)) {
8537 kfree_data(assigned_results, assigned_results_length);
8538 }
8539 }
8540
8541 if (uap->buffer != 0 && buffer_size == sizeof(struct necp_stats_bufreq) &&
8542 necp_arena_initialize(fd_data, true) == 0) {
8543 struct necp_stats_bufreq bufreq = {};
8544 int copy_error = copyin(uap->buffer, &bufreq, buffer_size);
8545 if (copy_error) {
8546 NECPLOG(LOG_ERR, "necp_client_request_nexus copyin bufreq error (%d)", copy_error);
8547 } else {
8548 (void)necp_stats_initialize(fd_data, client, new_registration, &bufreq);
8549 copy_error = copyout(&bufreq, uap->buffer, buffer_size);
8550 if (copy_error != 0) {
8551 NECPLOG(LOG_ERR, "necp_client_request_nexus copyout bufreq error (%d)", copy_error);
8552 }
8553 }
8554 }
8555 } while (false);
8556
8557 NECP_CLIENT_UNLOCK(client);
8558 NECP_FD_UNLOCK(fd_data);
8559
8560 necp_client_release(client);
8561
8562 done:
8563 *retval = error;
8564 if (error != 0) {
8565 NECPLOG(LOG_ERR, "Request nexus error (%d)", error);
8566 }
8567
8568 if (proc != PROC_NULL) {
8569 proc_rele(proc);
8570 }
8571 return error;
8572 }
8573 #endif /* !SKYWALK */
8574
8575 static void
necp_client_add_assertion(struct necp_client * client,uuid_t netagent_uuid)8576 necp_client_add_assertion(struct necp_client *client, uuid_t netagent_uuid)
8577 {
8578 struct necp_client_assertion *new_assertion = NULL;
8579
8580 new_assertion = kalloc_type(struct necp_client_assertion,
8581 Z_WAITOK | Z_NOFAIL);
8582
8583 uuid_copy(new_assertion->asserted_netagent, netagent_uuid);
8584
8585 LIST_INSERT_HEAD(&client->assertion_list, new_assertion, assertion_chain);
8586 }
8587
8588 static bool
necp_client_remove_assertion(struct necp_client * client,uuid_t netagent_uuid)8589 necp_client_remove_assertion(struct necp_client *client, uuid_t netagent_uuid)
8590 {
8591 struct necp_client_assertion *found_assertion = NULL;
8592 struct necp_client_assertion *search_assertion = NULL;
8593 LIST_FOREACH(search_assertion, &client->assertion_list, assertion_chain) {
8594 if (uuid_compare(search_assertion->asserted_netagent, netagent_uuid) == 0) {
8595 found_assertion = search_assertion;
8596 break;
8597 }
8598 }
8599
8600 if (found_assertion == NULL) {
8601 NECPLOG0(LOG_ERR, "Netagent uuid not previously asserted");
8602 return false;
8603 }
8604
8605 LIST_REMOVE(found_assertion, assertion_chain);
8606 kfree_type(struct necp_client_assertion, found_assertion);
8607 return true;
8608 }
8609
8610 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_agent_action(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8611 necp_client_agent_action(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8612 {
8613 int error = 0;
8614 struct necp_client *client = NULL;
8615 uuid_t client_id;
8616 bool acted_on_agent = FALSE;
8617 u_int8_t *parameters = NULL;
8618 const size_t buffer_size = uap->buffer_size;
8619
8620 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
8621 buffer_size == 0 || uap->buffer == 0) {
8622 NECPLOG0(LOG_ERR, "necp_client_agent_action invalid parameters");
8623 error = EINVAL;
8624 goto done;
8625 }
8626
8627 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8628 if (error) {
8629 NECPLOG(LOG_ERR, "necp_client_agent_action copyin client_id error (%d)", error);
8630 goto done;
8631 }
8632
8633 if (buffer_size > NECP_MAX_AGENT_ACTION_SIZE) {
8634 NECPLOG(LOG_ERR, "necp_client_agent_action invalid buffer size (>%u)", NECP_MAX_AGENT_ACTION_SIZE);
8635 error = EINVAL;
8636 goto done;
8637 }
8638
8639 if ((parameters = (u_int8_t *)kalloc_data(buffer_size, Z_WAITOK | Z_ZERO)) == NULL) {
8640 NECPLOG0(LOG_ERR, "necp_client_agent_action malloc failed");
8641 error = ENOMEM;
8642 goto done;
8643 }
8644
8645 error = copyin(uap->buffer, parameters, buffer_size);
8646 if (error) {
8647 NECPLOG(LOG_ERR, "necp_client_agent_action parameters copyin error (%d)", error);
8648 goto done;
8649 }
8650
8651 NECP_FD_LOCK(fd_data);
8652 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8653 if (client != NULL) {
8654 size_t offset = 0;
8655 while ((offset + sizeof(struct necp_tlv_header)) <= buffer_size) {
8656 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
8657 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
8658
8659 if (length > (buffer_size - (offset + sizeof(struct necp_tlv_header)))) {
8660 // If the length is larger than what can fit in the remaining parameters size, bail
8661 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
8662 break;
8663 }
8664
8665 if (length >= sizeof(uuid_t)) {
8666 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
8667 if (value == NULL) {
8668 NECPLOG0(LOG_ERR, "Invalid TLV value");
8669 break;
8670 }
8671 if (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT ||
8672 type == NECP_CLIENT_PARAMETER_ASSERT_AGENT ||
8673 type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
8674 uuid_t agent_uuid;
8675 uuid_copy(agent_uuid, value);
8676 u_int8_t netagent_message_type = 0;
8677 if (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT) {
8678 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_TRIGGER;
8679 } else if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
8680 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT;
8681 } else if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
8682 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
8683 }
8684
8685 // Before unasserting, verify that the assertion was already taken
8686 if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
8687 if (!necp_client_remove_assertion(client, agent_uuid)) {
8688 error = ENOENT;
8689 break;
8690 }
8691 }
8692
8693 struct necp_client_nexus_parameters parsed_parameters = {};
8694 necp_client_copy_parameters_locked(client, &parsed_parameters);
8695
8696 error = netagent_client_message_with_params(agent_uuid,
8697 client_id,
8698 fd_data->proc_pid,
8699 client->agent_handle,
8700 netagent_message_type,
8701 (struct necp_client_agent_parameters *)&parsed_parameters,
8702 NULL, NULL);
8703 if (error == 0) {
8704 acted_on_agent = TRUE;
8705 } else {
8706 break;
8707 }
8708
8709 // Only save the assertion if the action succeeded
8710 if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
8711 necp_client_add_assertion(client, agent_uuid);
8712 }
8713 } else if (type == NECP_CLIENT_PARAMETER_AGENT_ADD_GROUP_MEMBERS ||
8714 type == NECP_CLIENT_PARAMETER_AGENT_REMOVE_GROUP_MEMBERS) {
8715 uuid_t agent_uuid;
8716 uuid_copy(agent_uuid, value);
8717 u_int8_t netagent_message_type = 0;
8718 if (type == NECP_CLIENT_PARAMETER_AGENT_ADD_GROUP_MEMBERS) {
8719 netagent_message_type = NETAGENT_MESSAGE_TYPE_ADD_GROUP_MEMBERS;
8720 } else if (type == NECP_CLIENT_PARAMETER_AGENT_REMOVE_GROUP_MEMBERS) {
8721 netagent_message_type = NETAGENT_MESSAGE_TYPE_REMOVE_GROUP_MEMBERS;
8722 }
8723
8724 struct necp_client_group_members group_members = {};
8725 group_members.group_members_length = (length - sizeof(uuid_t));
8726 group_members.group_members = (value + sizeof(uuid_t));
8727 error = netagent_client_message_with_params(agent_uuid,
8728 client_id,
8729 fd_data->proc_pid,
8730 client->agent_handle,
8731 netagent_message_type,
8732 (struct necp_client_agent_parameters *)&group_members,
8733 NULL, NULL);
8734 if (error == 0) {
8735 acted_on_agent = TRUE;
8736 } else {
8737 break;
8738 }
8739 } else if (type == NECP_CLIENT_PARAMETER_REPORT_AGENT_ERROR) {
8740 uuid_t agent_uuid;
8741 uuid_copy(agent_uuid, value);
8742 struct necp_client_agent_parameters agent_params = {};
8743 if ((length - sizeof(uuid_t)) >= sizeof(agent_params.u.error)) {
8744 memcpy(&agent_params.u.error,
8745 (value + sizeof(uuid_t)),
8746 sizeof(agent_params.u.error));
8747 }
8748 error = netagent_client_message_with_params(agent_uuid,
8749 client_id,
8750 fd_data->proc_pid,
8751 client->agent_handle,
8752 NETAGENT_MESSAGE_TYPE_CLIENT_ERROR,
8753 &agent_params,
8754 NULL, NULL);
8755 if (error == 0) {
8756 acted_on_agent = TRUE;
8757 } else {
8758 break;
8759 }
8760 }
8761 }
8762
8763 offset += sizeof(struct necp_tlv_header) + length;
8764 }
8765
8766 NECP_CLIENT_UNLOCK(client);
8767 }
8768 NECP_FD_UNLOCK(fd_data);
8769
8770 if (!acted_on_agent &&
8771 error == 0) {
8772 error = ENOENT;
8773 }
8774 done:
8775 *retval = error;
8776 if (parameters != NULL) {
8777 kfree_data(parameters, buffer_size);
8778 parameters = NULL;
8779 }
8780
8781 return error;
8782 }
8783
8784 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_agent(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8785 necp_client_copy_agent(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8786 {
8787 int error = 0;
8788 uuid_t agent_uuid;
8789 const size_t buffer_size = uap->buffer_size;
8790
8791 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
8792 buffer_size == 0 || uap->buffer == 0) {
8793 NECPLOG0(LOG_ERR, "necp_client_copy_agent bad input");
8794 error = EINVAL;
8795 goto done;
8796 }
8797
8798 error = copyin(uap->client_id, agent_uuid, sizeof(uuid_t));
8799 if (error) {
8800 NECPLOG(LOG_ERR, "necp_client_copy_agent copyin agent_uuid error (%d)", error);
8801 goto done;
8802 }
8803
8804 error = netagent_copyout(agent_uuid, uap->buffer, buffer_size);
8805 if (error) {
8806 // netagent_copyout already logs appropriate errors
8807 goto done;
8808 }
8809 done:
8810 *retval = error;
8811
8812 return error;
8813 }
8814
8815 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_agent_use(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8816 necp_client_agent_use(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8817 {
8818 int error = 0;
8819 struct necp_client *client = NULL;
8820 uuid_t client_id;
8821 struct necp_agent_use_parameters parameters = {};
8822 const size_t buffer_size = uap->buffer_size;
8823
8824 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
8825 buffer_size != sizeof(parameters) || uap->buffer == 0) {
8826 error = EINVAL;
8827 goto done;
8828 }
8829
8830 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8831 if (error) {
8832 NECPLOG(LOG_ERR, "Copyin client_id error (%d)", error);
8833 goto done;
8834 }
8835
8836 error = copyin(uap->buffer, ¶meters, buffer_size);
8837 if (error) {
8838 NECPLOG(LOG_ERR, "Parameters copyin error (%d)", error);
8839 goto done;
8840 }
8841
8842 NECP_FD_LOCK(fd_data);
8843 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8844 if (client != NULL) {
8845 error = netagent_use(parameters.agent_uuid, ¶meters.out_use_count);
8846 NECP_CLIENT_UNLOCK(client);
8847 } else {
8848 error = ENOENT;
8849 }
8850
8851 NECP_FD_UNLOCK(fd_data);
8852
8853 if (error == 0) {
8854 error = copyout(¶meters, uap->buffer, buffer_size);
8855 if (error) {
8856 NECPLOG(LOG_ERR, "Parameters copyout error (%d)", error);
8857 goto done;
8858 }
8859 }
8860
8861 done:
8862 *retval = error;
8863
8864 return error;
8865 }
8866
8867 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_acquire_agent_token(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8868 necp_client_acquire_agent_token(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8869 {
8870 int error = 0;
8871 uuid_t agent_uuid = {};
8872 const size_t buffer_size = uap->buffer_size;
8873
8874 *retval = 0;
8875
8876 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
8877 buffer_size == 0 || uap->buffer == 0) {
8878 NECPLOG0(LOG_ERR, "necp_client_copy_agent bad input");
8879 error = EINVAL;
8880 goto done;
8881 }
8882
8883 error = copyin(uap->client_id, agent_uuid, sizeof(uuid_t));
8884 if (error) {
8885 NECPLOG(LOG_ERR, "necp_client_copy_agent copyin agent_uuid error (%d)", error);
8886 goto done;
8887 }
8888
8889 error = netagent_acquire_token(agent_uuid, uap->buffer, buffer_size, retval);
8890 done:
8891 return error;
8892 }
8893
8894 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_interface(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8895 necp_client_copy_interface(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8896 {
8897 int error = 0;
8898 u_int32_t interface_index = 0;
8899 struct necp_interface_details interface_details = {};
8900
8901 if (uap->client_id == 0 || uap->client_id_len != sizeof(u_int32_t) ||
8902 uap->buffer_size < sizeof(interface_details) ||
8903 uap->buffer == 0) {
8904 NECPLOG0(LOG_ERR, "necp_client_copy_interface bad input");
8905 error = EINVAL;
8906 goto done;
8907 }
8908
8909 error = copyin(uap->client_id, &interface_index, sizeof(u_int32_t));
8910 if (error) {
8911 NECPLOG(LOG_ERR, "necp_client_copy_interface copyin interface_index error (%d)", error);
8912 goto done;
8913 }
8914
8915 if (interface_index == 0) {
8916 error = ENOENT;
8917 NECPLOG(LOG_ERR, "necp_client_copy_interface bad interface_index (%d)", interface_index);
8918 goto done;
8919 }
8920
8921 lck_mtx_lock(rnh_lock);
8922 ifnet_head_lock_shared();
8923 ifnet_t interface = NULL;
8924 if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
8925 interface = ifindex2ifnet[interface_index];
8926 }
8927
8928 if (interface != NULL) {
8929 if (interface->if_xname != NULL) {
8930 strlcpy((char *)&interface_details.name, interface->if_xname, sizeof(interface_details.name));
8931 }
8932 interface_details.index = interface->if_index;
8933 interface_details.generation = ifnet_get_generation(interface);
8934 if (interface->if_delegated.ifp != NULL) {
8935 interface_details.delegate_index = interface->if_delegated.ifp->if_index;
8936 }
8937 interface_details.functional_type = if_functional_type(interface, TRUE);
8938 if (IFNET_IS_EXPENSIVE(interface)) {
8939 interface_details.flags |= NECP_INTERFACE_FLAG_EXPENSIVE;
8940 }
8941 if (IFNET_IS_CONSTRAINED(interface)) {
8942 interface_details.flags |= NECP_INTERFACE_FLAG_CONSTRAINED;
8943 }
8944 if ((interface->if_eflags & IFEF_TXSTART) == IFEF_TXSTART) {
8945 interface_details.flags |= NECP_INTERFACE_FLAG_TXSTART;
8946 }
8947 if ((interface->if_eflags & IFEF_NOACKPRI) == IFEF_NOACKPRI) {
8948 interface_details.flags |= NECP_INTERFACE_FLAG_NOACKPRI;
8949 }
8950 if ((interface->if_eflags & IFEF_3CA) == IFEF_3CA) {
8951 interface_details.flags |= NECP_INTERFACE_FLAG_3CARRIERAGG;
8952 }
8953 if (IFNET_IS_LOW_POWER(interface)) {
8954 interface_details.flags |= NECP_INTERFACE_FLAG_IS_LOW_POWER;
8955 }
8956 if (interface->if_xflags & IFXF_MPK_LOG) {
8957 interface_details.flags |= NECP_INTERFACE_FLAG_MPK_LOG;
8958 }
8959 if (interface->if_flags & IFF_MULTICAST) {
8960 interface_details.flags |= NECP_INTERFACE_FLAG_SUPPORTS_MULTICAST;
8961 }
8962 if (IS_INTF_CLAT46(interface)) {
8963 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_NAT64;
8964 }
8965 interface_details.mtu = interface->if_mtu;
8966 #if SKYWALK
8967 nx_netif_get_interface_tso_capabilities(interface, &interface_details.tso_max_segment_size_v4, &interface_details.tso_max_segment_size_v6);
8968 #endif /* SKYWALK */
8969
8970 u_int8_t ipv4_signature_len = sizeof(interface_details.ipv4_signature.signature);
8971 u_int16_t ipv4_signature_flags;
8972 if (ifnet_get_netsignature(interface, AF_INET, &ipv4_signature_len, &ipv4_signature_flags,
8973 (u_int8_t *)&interface_details.ipv4_signature) != 0) {
8974 ipv4_signature_len = 0;
8975 }
8976 interface_details.ipv4_signature.signature_len = ipv4_signature_len;
8977
8978 // Check for default scoped routes for IPv4 and IPv6
8979 union necp_sockaddr_union default_address;
8980 struct rtentry *v4Route = NULL;
8981 memset(&default_address, 0, sizeof(default_address));
8982 default_address.sa.sa_family = AF_INET;
8983 default_address.sa.sa_len = sizeof(struct sockaddr_in);
8984 v4Route = rtalloc1_scoped_locked((struct sockaddr *)&default_address, 0, 0,
8985 interface->if_index);
8986 if (v4Route != NULL) {
8987 if (v4Route->rt_ifp != NULL && !IS_INTF_CLAT46(v4Route->rt_ifp)) {
8988 interface_details.flags |= NECP_INTERFACE_FLAG_IPV4_ROUTABLE;
8989 }
8990 rtfree_locked(v4Route);
8991 v4Route = NULL;
8992 }
8993
8994 struct rtentry *v6Route = NULL;
8995 memset(&default_address, 0, sizeof(default_address));
8996 default_address.sa.sa_family = AF_INET6;
8997 default_address.sa.sa_len = sizeof(struct sockaddr_in6);
8998 v6Route = rtalloc1_scoped_locked((struct sockaddr *)&default_address, 0, 0,
8999 interface->if_index);
9000 if (v6Route != NULL) {
9001 if (v6Route->rt_ifp != NULL) {
9002 interface_details.flags |= NECP_INTERFACE_FLAG_IPV6_ROUTABLE;
9003 }
9004 rtfree_locked(v6Route);
9005 v6Route = NULL;
9006 }
9007
9008 u_int8_t ipv6_signature_len = sizeof(interface_details.ipv6_signature.signature);
9009 u_int16_t ipv6_signature_flags;
9010 if (ifnet_get_netsignature(interface, AF_INET6, &ipv6_signature_len, &ipv6_signature_flags,
9011 (u_int8_t *)&interface_details.ipv6_signature) != 0) {
9012 ipv6_signature_len = 0;
9013 }
9014 interface_details.ipv6_signature.signature_len = ipv6_signature_len;
9015
9016 ifnet_lock_shared(interface);
9017 struct ifaddr *ifa = NULL;
9018 TAILQ_FOREACH(ifa, &interface->if_addrhead, ifa_link) {
9019 IFA_LOCK(ifa);
9020 if (ifa->ifa_addr->sa_family == AF_INET) {
9021 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_NETMASK;
9022 interface_details.ipv4_netmask = ((struct in_ifaddr *)ifa)->ia_sockmask.sin_addr.s_addr;
9023 if (interface->if_flags & IFF_BROADCAST) {
9024 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_BROADCAST;
9025 interface_details.ipv4_broadcast = ((struct in_ifaddr *)ifa)->ia_broadaddr.sin_addr.s_addr;
9026 }
9027 }
9028 IFA_UNLOCK(ifa);
9029 }
9030
9031 interface_details.radio_type = interface->if_radio_type;
9032 if (interface_details.radio_type == 0 && interface->if_delegated.ifp) {
9033 interface_details.radio_type = interface->if_delegated.ifp->if_radio_type;
9034 }
9035 ifnet_lock_done(interface);
9036 }
9037
9038 ifnet_head_done();
9039 lck_mtx_unlock(rnh_lock);
9040
9041 // If the client is using an older version of the struct, copy that length
9042 error = copyout(&interface_details, uap->buffer, sizeof(interface_details));
9043 if (error) {
9044 NECPLOG(LOG_ERR, "necp_client_copy_interface copyout error (%d)", error);
9045 goto done;
9046 }
9047 done:
9048 *retval = error;
9049
9050 return error;
9051 }
9052
9053 #if SKYWALK
9054
9055 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_get_interface_address(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9056 necp_client_get_interface_address(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9057 {
9058 int error = 0;
9059 u_int32_t interface_index = IFSCOPE_NONE;
9060 struct sockaddr_storage address = {};
9061 const size_t buffer_size = uap->buffer_size;
9062
9063 if (uap->client_id == 0 || uap->client_id_len != sizeof(u_int32_t) ||
9064 buffer_size < sizeof(struct sockaddr_in) ||
9065 buffer_size > sizeof(struct sockaddr_storage) ||
9066 uap->buffer == 0) {
9067 NECPLOG0(LOG_ERR, "necp_client_get_interface_address bad input");
9068 error = EINVAL;
9069 goto done;
9070 }
9071
9072 error = copyin(uap->client_id, &interface_index, sizeof(u_int32_t));
9073 if (error) {
9074 NECPLOG(LOG_ERR, "necp_client_get_interface_address copyin interface_index error (%d)", error);
9075 goto done;
9076 }
9077
9078 if (interface_index == IFSCOPE_NONE) {
9079 error = ENOENT;
9080 NECPLOG(LOG_ERR, "necp_client_get_interface_address bad interface_index (%d)", interface_index);
9081 goto done;
9082 }
9083
9084 error = copyin(uap->buffer, &address, buffer_size);
9085 if (error) {
9086 NECPLOG(LOG_ERR, "necp_client_get_interface_address copyin address error (%d)", error);
9087 goto done;
9088 }
9089
9090 if (address.ss_family != AF_INET && address.ss_family != AF_INET6) {
9091 error = EINVAL;
9092 NECPLOG(LOG_ERR, "necp_client_get_interface_address invalid address family (%u)", address.ss_family);
9093 goto done;
9094 }
9095
9096 if (address.ss_len != buffer_size) {
9097 error = EINVAL;
9098 NECPLOG(LOG_ERR, "necp_client_get_interface_address invalid address length (%u)", address.ss_len);
9099 goto done;
9100 }
9101
9102 ifnet_head_lock_shared();
9103 ifnet_t ifp = NULL;
9104 if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
9105 ifp = ifindex2ifnet[interface_index];
9106 }
9107 ifnet_head_done();
9108 if (ifp == NULL) {
9109 error = ENOENT;
9110 NECPLOG0(LOG_ERR, "necp_client_get_interface_address no matching interface found");
9111 goto done;
9112 }
9113
9114 struct rtentry *rt = rtalloc1_scoped((struct sockaddr *)&address, 0, 0, interface_index);
9115 if (rt == NULL) {
9116 error = EINVAL;
9117 NECPLOG0(LOG_ERR, "necp_client_get_interface_address route lookup failed");
9118 goto done;
9119 }
9120
9121 uint32_t gencount = 0;
9122 struct sockaddr_storage local_address = {};
9123 error = flow_route_select_laddr((union sockaddr_in_4_6 *)&local_address,
9124 (union sockaddr_in_4_6 *)&address, ifp, rt, &gencount, 1);
9125 rtfree(rt);
9126 rt = NULL;
9127
9128 if (error) {
9129 NECPLOG(LOG_ERR, "necp_client_get_interface_address local address selection failed (%d)", error);
9130 goto done;
9131 }
9132
9133 if (local_address.ss_len > buffer_size) {
9134 error = EMSGSIZE;
9135 NECPLOG(LOG_ERR, "necp_client_get_interface_address local address too long for buffer (%u)",
9136 local_address.ss_len);
9137 goto done;
9138 }
9139
9140 error = copyout(&local_address, uap->buffer, local_address.ss_len);
9141 if (error) {
9142 NECPLOG(LOG_ERR, "necp_client_get_interface_address copyout error (%d)", error);
9143 goto done;
9144 }
9145 done:
9146 *retval = error;
9147
9148 return error;
9149 }
9150
9151 extern char *proc_name_address(void *p);
9152
9153 int
necp_stats_ctor(struct skmem_obj_info * oi,struct skmem_obj_info * oim,void * arg,uint32_t skmflag)9154 necp_stats_ctor(struct skmem_obj_info *oi, struct skmem_obj_info *oim,
9155 void *arg, uint32_t skmflag)
9156 {
9157 #pragma unused(arg, skmflag)
9158 struct necp_all_kstats *kstats = SKMEM_OBJ_ADDR(oi);
9159
9160 ASSERT(oim != NULL && SKMEM_OBJ_ADDR(oim) != NULL);
9161 ASSERT(SKMEM_OBJ_SIZE(oi) == SKMEM_OBJ_SIZE(oim));
9162
9163 kstats->necp_stats_ustats = SKMEM_OBJ_ADDR(oim);
9164
9165 return 0;
9166 }
9167
9168 int
necp_stats_dtor(void * addr,void * arg)9169 necp_stats_dtor(void *addr, void *arg)
9170 {
9171 #pragma unused(addr, arg)
9172 struct necp_all_kstats *kstats = addr;
9173
9174 kstats->necp_stats_ustats = NULL;
9175
9176 return 0;
9177 }
9178
9179 static void
necp_fd_insert_stats_arena(struct necp_fd_data * fd_data,struct necp_arena_info * nai)9180 necp_fd_insert_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai)
9181 {
9182 NECP_FD_ASSERT_LOCKED(fd_data);
9183 VERIFY(!(nai->nai_flags & NAIF_ATTACHED));
9184 VERIFY(nai->nai_chain.le_next == NULL && nai->nai_chain.le_prev == NULL);
9185
9186 LIST_INSERT_HEAD(&fd_data->stats_arena_list, nai, nai_chain);
9187 nai->nai_flags |= NAIF_ATTACHED;
9188 necp_arena_info_retain(nai); // for the list
9189 }
9190
9191 static void
necp_fd_remove_stats_arena(struct necp_fd_data * fd_data,struct necp_arena_info * nai)9192 necp_fd_remove_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai)
9193 {
9194 #pragma unused(fd_data)
9195 NECP_FD_ASSERT_LOCKED(fd_data);
9196 VERIFY(nai->nai_flags & NAIF_ATTACHED);
9197 VERIFY(nai->nai_use_count >= 1);
9198
9199 LIST_REMOVE(nai, nai_chain);
9200 nai->nai_flags &= ~NAIF_ATTACHED;
9201 nai->nai_chain.le_next = NULL;
9202 nai->nai_chain.le_prev = NULL;
9203 necp_arena_info_release(nai); // for the list
9204 }
9205
9206 static struct necp_arena_info *
necp_fd_mredirect_stats_arena(struct necp_fd_data * fd_data,struct proc * proc)9207 necp_fd_mredirect_stats_arena(struct necp_fd_data *fd_data, struct proc *proc)
9208 {
9209 struct necp_arena_info *nai, *nai_ret = NULL;
9210
9211 NECP_FD_ASSERT_LOCKED(fd_data);
9212
9213 // Redirect currently-active stats arena and remove it from the active state;
9214 // upon process resumption, new flow request would trigger the creation of
9215 // another active arena.
9216 if ((nai = fd_data->stats_arena_active) != NULL) {
9217 boolean_t need_defunct = FALSE;
9218
9219 ASSERT(!(nai->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT)));
9220 VERIFY(nai->nai_use_count >= 2);
9221 ASSERT(nai->nai_arena != NULL);
9222 ASSERT(nai->nai_mmap.ami_mapref != NULL);
9223
9224 int err = skmem_arena_mredirect(nai->nai_arena, &nai->nai_mmap, proc, &need_defunct);
9225 VERIFY(err == 0);
9226 // must be TRUE since we don't mmap the arena more than once
9227 VERIFY(need_defunct == TRUE);
9228
9229 nai->nai_flags |= NAIF_REDIRECT;
9230 nai_ret = nai; // return to caller
9231
9232 necp_arena_info_release(nai); // for fd_data
9233 fd_data->stats_arena_active = nai = NULL;
9234 }
9235
9236 #if (DEVELOPMENT || DEBUG)
9237 // make sure this list now contains nothing but redirected/defunct arenas
9238 LIST_FOREACH(nai, &fd_data->stats_arena_list, nai_chain) {
9239 ASSERT(nai->nai_use_count >= 1);
9240 ASSERT(nai->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT));
9241 }
9242 #endif /* (DEVELOPMENT || DEBUG) */
9243
9244 return nai_ret;
9245 }
9246
9247 static void
necp_arena_info_retain(struct necp_arena_info * nai)9248 necp_arena_info_retain(struct necp_arena_info *nai)
9249 {
9250 nai->nai_use_count++;
9251 VERIFY(nai->nai_use_count != 0);
9252 }
9253
9254 static void
necp_arena_info_release(struct necp_arena_info * nai)9255 necp_arena_info_release(struct necp_arena_info *nai)
9256 {
9257 VERIFY(nai->nai_use_count > 0);
9258 if (--nai->nai_use_count == 0) {
9259 necp_arena_info_free(nai);
9260 }
9261 }
9262
9263 static struct necp_arena_info *
necp_arena_info_alloc(void)9264 necp_arena_info_alloc(void)
9265 {
9266 return zalloc_flags(necp_arena_info_zone, Z_WAITOK | Z_ZERO);
9267 }
9268
9269 static void
necp_arena_info_free(struct necp_arena_info * nai)9270 necp_arena_info_free(struct necp_arena_info *nai)
9271 {
9272 VERIFY(nai->nai_chain.le_next == NULL && nai->nai_chain.le_prev == NULL);
9273 VERIFY(nai->nai_use_count == 0);
9274
9275 // NOTE: destroying the arena requires that all outstanding objects
9276 // that were allocated have been freed, else it will assert.
9277 if (nai->nai_arena != NULL) {
9278 skmem_arena_munmap(nai->nai_arena, &nai->nai_mmap);
9279 skmem_arena_release(nai->nai_arena);
9280 OSDecrementAtomic(&necp_arena_count);
9281 nai->nai_arena = NULL;
9282 nai->nai_roff = 0;
9283 }
9284
9285 ASSERT(nai->nai_arena == NULL);
9286 ASSERT(nai->nai_mmap.ami_mapref == NULL);
9287 ASSERT(nai->nai_mmap.ami_arena == NULL);
9288 ASSERT(nai->nai_mmap.ami_maptask == TASK_NULL);
9289
9290 zfree(necp_arena_info_zone, nai);
9291 }
9292
9293 static int
necp_arena_create(struct necp_fd_data * fd_data,size_t obj_size,size_t obj_cnt,struct proc * p)9294 necp_arena_create(struct necp_fd_data *fd_data, size_t obj_size, size_t obj_cnt, struct proc *p)
9295 {
9296 struct skmem_region_params srp_ustats = {};
9297 struct skmem_region_params srp_kstats = {};
9298 struct necp_arena_info *nai;
9299 char name[32];
9300 int error = 0;
9301
9302 NECP_FD_ASSERT_LOCKED(fd_data);
9303 ASSERT(fd_data->stats_arena_active == NULL);
9304 ASSERT(p != PROC_NULL);
9305 ASSERT(proc_pid(p) == fd_data->proc_pid);
9306
9307 // inherit the default parameters for the stats region
9308 srp_ustats = *skmem_get_default(SKMEM_REGION_USTATS);
9309 srp_kstats = *skmem_get_default(SKMEM_REGION_KSTATS);
9310
9311 // enable multi-segment mode
9312 srp_ustats.srp_cflags &= ~SKMEM_REGION_CR_MONOLITHIC;
9313 srp_kstats.srp_cflags &= ~SKMEM_REGION_CR_MONOLITHIC;
9314
9315 // configure and adjust the region parameters
9316 srp_ustats.srp_r_obj_cnt = srp_kstats.srp_r_obj_cnt = obj_cnt;
9317 srp_ustats.srp_r_obj_size = srp_kstats.srp_r_obj_size = obj_size;
9318 skmem_region_params_config(&srp_ustats);
9319 skmem_region_params_config(&srp_kstats);
9320
9321 nai = necp_arena_info_alloc();
9322
9323 nai->nai_proc_pid = fd_data->proc_pid;
9324 (void) snprintf(name, sizeof(name), "stats-%u.%s.%d", fd_data->stats_arena_gencnt, proc_name_address(p), fd_data->proc_pid);
9325 nai->nai_arena = skmem_arena_create_for_necp(name, &srp_ustats, &srp_kstats, &error);
9326 ASSERT(nai->nai_arena != NULL || error != 0);
9327 if (error != 0) {
9328 NECPLOG(LOG_ERR, "failed to create stats arena for pid %d\n", fd_data->proc_pid);
9329 } else {
9330 OSIncrementAtomic(&necp_arena_count);
9331
9332 // Get region offsets from base of mmap span; the arena
9333 // doesn't need to be mmap'd at this point, since we simply
9334 // compute the relative offset.
9335 nai->nai_roff = skmem_arena_get_region_offset(nai->nai_arena, SKMEM_REGION_USTATS);
9336
9337 // map to the task/process; upon success, the base address of the region
9338 // will be returned in nai_mmap.ami_mapaddr; this can be communicated to
9339 // the process.
9340 error = skmem_arena_mmap(nai->nai_arena, p, &nai->nai_mmap);
9341 if (error != 0) {
9342 NECPLOG(LOG_ERR, "failed to map stats arena for pid %d\n", fd_data->proc_pid);
9343 }
9344 }
9345
9346 if (error == 0) {
9347 fd_data->stats_arena_active = nai;
9348 necp_arena_info_retain(nai); // for fd_data
9349 necp_fd_insert_stats_arena(fd_data, nai);
9350 ++fd_data->stats_arena_gencnt;
9351 } else {
9352 necp_arena_info_free(nai);
9353 }
9354
9355 return error;
9356 }
9357
9358 static int
necp_arena_stats_obj_alloc(struct necp_fd_data * fd_data,mach_vm_offset_t * off,struct necp_arena_info ** stats_arena,void ** kstats_kaddr,boolean_t cansleep)9359 necp_arena_stats_obj_alloc(struct necp_fd_data *fd_data,
9360 mach_vm_offset_t *off,
9361 struct necp_arena_info **stats_arena,
9362 void **kstats_kaddr,
9363 boolean_t cansleep)
9364 {
9365 struct skmem_cache *kstats_cp = NULL;
9366 void *ustats_obj = NULL;
9367 void *kstats_obj = NULL;
9368 struct necp_all_kstats *kstats = NULL;
9369 struct skmem_obj_info kstats_oi = {};
9370
9371 ASSERT(off != NULL);
9372 ASSERT(stats_arena != NULL && *stats_arena == NULL);
9373 ASSERT(kstats_kaddr != NULL && *kstats_kaddr == NULL);
9374
9375 NECP_FD_ASSERT_LOCKED(fd_data);
9376 ASSERT(fd_data->stats_arena_active != NULL);
9377 ASSERT(fd_data->stats_arena_active->nai_arena != NULL);
9378
9379 kstats_cp = skmem_arena_necp(fd_data->stats_arena_active->nai_arena)->arc_kstats_cache;
9380 if ((kstats_obj = skmem_cache_alloc(kstats_cp, (cansleep ? SKMEM_SLEEP : SKMEM_NOSLEEP))) == NULL) {
9381 return ENOMEM;
9382 }
9383
9384 kstats = (struct necp_all_kstats*)kstats_obj;
9385 ustats_obj = kstats->necp_stats_ustats;
9386
9387 skmem_cache_get_obj_info(kstats_cp, kstats_obj, &kstats_oi, NULL);
9388 ASSERT(SKMEM_OBJ_SIZE(&kstats_oi) >= sizeof(struct necp_all_stats));
9389 // reset all stats counters
9390 bzero(ustats_obj, SKMEM_OBJ_SIZE(&kstats_oi));
9391 bzero(&kstats->necp_stats_comm, sizeof(struct necp_all_stats));
9392 *stats_arena = fd_data->stats_arena_active;
9393 *kstats_kaddr = kstats_obj;
9394 // kstats and ustats are mirrored and have the same offset
9395 *off = fd_data->stats_arena_active->nai_roff + SKMEM_OBJ_ROFF(&kstats_oi);
9396
9397 return 0;
9398 }
9399
9400 static void
necp_arena_stats_obj_free(struct necp_fd_data * fd_data,struct necp_arena_info * stats_arena,void ** kstats_kaddr,mach_vm_address_t * ustats_uaddr)9401 necp_arena_stats_obj_free(struct necp_fd_data *fd_data, struct necp_arena_info *stats_arena, void **kstats_kaddr, mach_vm_address_t *ustats_uaddr)
9402 {
9403 #pragma unused(fd_data)
9404 NECP_FD_ASSERT_LOCKED(fd_data);
9405
9406 ASSERT(stats_arena != NULL);
9407 ASSERT(stats_arena->nai_arena != NULL);
9408 ASSERT(kstats_kaddr != NULL && *kstats_kaddr != NULL);
9409 ASSERT(ustats_uaddr != NULL);
9410
9411 skmem_cache_free(skmem_arena_necp(stats_arena->nai_arena)->arc_kstats_cache, *kstats_kaddr);
9412 *kstats_kaddr = NULL;
9413 *ustats_uaddr = 0;
9414 }
9415
9416 // This routine returns the KVA of the sysctls object, as well as the
9417 // offset of that object relative to the mmap base address for the
9418 // task/process.
9419 static void *
necp_arena_sysctls_obj(struct necp_fd_data * fd_data,mach_vm_offset_t * off,size_t * size)9420 necp_arena_sysctls_obj(struct necp_fd_data *fd_data, mach_vm_offset_t *off, size_t *size)
9421 {
9422 void *objaddr;
9423
9424 NECP_FD_ASSERT_LOCKED(fd_data);
9425 ASSERT(fd_data->sysctl_arena != NULL);
9426
9427 // kernel virtual address of the sysctls object
9428 objaddr = skmem_arena_system_sysctls_obj_addr(fd_data->sysctl_arena);
9429 ASSERT(objaddr != NULL);
9430
9431 // Return the relative offset of the sysctls object; there is
9432 // only 1 object in the entire sysctls region, and therefore the
9433 // object's offset is simply the region's offset in the arena.
9434 // (sysctl_mmap.ami_mapaddr + offset) is the address of this object
9435 // in the task/process.
9436 if (off != NULL) {
9437 *off = fd_data->system_sysctls_roff;
9438 }
9439
9440 if (size != NULL) {
9441 *size = skmem_arena_system_sysctls_obj_size(fd_data->sysctl_arena);
9442 ASSERT(*size != 0);
9443 }
9444
9445 return objaddr;
9446 }
9447
9448 static void
necp_stats_arenas_destroy(struct necp_fd_data * fd_data,boolean_t closing)9449 necp_stats_arenas_destroy(struct necp_fd_data *fd_data, boolean_t closing)
9450 {
9451 struct necp_arena_info *nai, *nai_tmp;
9452
9453 NECP_FD_ASSERT_LOCKED(fd_data);
9454
9455 // If reaping (not closing), release reference only for idle active arena; the reference
9456 // count must be 2 by now, when it's not being referred to by any clients/flows.
9457 if ((nai = fd_data->stats_arena_active) != NULL && (closing || nai->nai_use_count == 2)) {
9458 VERIFY(nai->nai_use_count >= 2);
9459 necp_arena_info_release(nai); // for fd_data
9460 fd_data->stats_arena_active = NULL;
9461 }
9462
9463 // clean up any defunct arenas left in the list
9464 LIST_FOREACH_SAFE(nai, &fd_data->stats_arena_list, nai_chain, nai_tmp) {
9465 // If reaping, release reference if the list holds the last one
9466 if (closing || nai->nai_use_count == 1) {
9467 VERIFY(nai->nai_use_count >= 1);
9468 // callee unchains nai (and may free it)
9469 necp_fd_remove_stats_arena(fd_data, nai);
9470 }
9471 }
9472 }
9473
9474 static void
necp_sysctl_arena_destroy(struct necp_fd_data * fd_data)9475 necp_sysctl_arena_destroy(struct necp_fd_data *fd_data)
9476 {
9477 NECP_FD_ASSERT_LOCKED(fd_data);
9478
9479 // NOTE: destroying the arena requires that all outstanding objects
9480 // that were allocated have been freed, else it will assert.
9481 if (fd_data->sysctl_arena != NULL) {
9482 skmem_arena_munmap(fd_data->sysctl_arena, &fd_data->sysctl_mmap);
9483 skmem_arena_release(fd_data->sysctl_arena);
9484 OSDecrementAtomic(&necp_sysctl_arena_count);
9485 fd_data->sysctl_arena = NULL;
9486 fd_data->system_sysctls_roff = 0;
9487 }
9488 }
9489
9490 static int
necp_arena_initialize(struct necp_fd_data * fd_data,bool locked)9491 necp_arena_initialize(struct necp_fd_data *fd_data, bool locked)
9492 {
9493 int error = 0;
9494 size_t stats_obj_size = MAX(sizeof(struct necp_all_stats), sizeof(struct necp_all_kstats));
9495
9496 if (!locked) {
9497 NECP_FD_LOCK(fd_data);
9498 }
9499 if (fd_data->stats_arena_active == NULL) {
9500 error = necp_arena_create(fd_data, stats_obj_size,
9501 NECP_MAX_PER_PROCESS_CLIENT_STATISTICS_STRUCTS,
9502 current_proc());
9503 }
9504 if (!locked) {
9505 NECP_FD_UNLOCK(fd_data);
9506 }
9507
9508 return error;
9509 }
9510
9511 static int
necp_sysctl_arena_initialize(struct necp_fd_data * fd_data,bool locked)9512 necp_sysctl_arena_initialize(struct necp_fd_data *fd_data, bool locked)
9513 {
9514 int error = 0;
9515
9516 if (!locked) {
9517 NECP_FD_LOCK(fd_data);
9518 }
9519
9520 NECP_FD_ASSERT_LOCKED(fd_data);
9521
9522 if (fd_data->sysctl_arena == NULL) {
9523 char name[32];
9524 struct proc *p = current_proc();
9525
9526 ASSERT(p != PROC_NULL);
9527 ASSERT(proc_pid(p) == fd_data->proc_pid);
9528
9529 (void) snprintf(name, sizeof(name), "sysctl.%s.%d", proc_name_address(p), fd_data->proc_pid);
9530 fd_data->sysctl_arena = skmem_arena_create_for_system(name, &error);
9531 ASSERT(fd_data->sysctl_arena != NULL || error != 0);
9532 if (error != 0) {
9533 NECPLOG(LOG_ERR, "failed to create arena for pid %d\n", fd_data->proc_pid);
9534 } else {
9535 OSIncrementAtomic(&necp_sysctl_arena_count);
9536
9537 // Get region offsets from base of mmap span; the arena
9538 // doesn't need to be mmap'd at this point, since we simply
9539 // compute the relative offset.
9540 fd_data->system_sysctls_roff = skmem_arena_get_region_offset(fd_data->sysctl_arena, SKMEM_REGION_SYSCTLS);
9541
9542 // map to the task/process; upon success, the base address of the region
9543 // will be returned in nai_mmap.ami_mapaddr; this can be communicated to
9544 // the process.
9545 error = skmem_arena_mmap(fd_data->sysctl_arena, p, &fd_data->sysctl_mmap);
9546 if (error != 0) {
9547 NECPLOG(LOG_ERR, "failed to map sysctl arena for pid %d\n", fd_data->proc_pid);
9548 necp_sysctl_arena_destroy(fd_data);
9549 }
9550 }
9551 }
9552
9553 if (!locked) {
9554 NECP_FD_UNLOCK(fd_data);
9555 }
9556
9557 return error;
9558 }
9559
9560 static int
necp_client_stats_bufreq(struct necp_fd_data * fd_data,struct necp_client * client,struct necp_client_flow_registration * flow_registration,struct necp_stats_bufreq * bufreq,struct necp_stats_hdr * out_header)9561 necp_client_stats_bufreq(struct necp_fd_data *fd_data,
9562 struct necp_client *client,
9563 struct necp_client_flow_registration *flow_registration,
9564 struct necp_stats_bufreq *bufreq,
9565 struct necp_stats_hdr *out_header)
9566 {
9567 int error = 0;
9568 NECP_CLIENT_ASSERT_LOCKED(client);
9569 NECP_FD_ASSERT_LOCKED(fd_data);
9570
9571 if ((bufreq->necp_stats_bufreq_id == NECP_CLIENT_STATISTICS_BUFREQ_ID) &&
9572 ((bufreq->necp_stats_bufreq_type == NECP_CLIENT_STATISTICS_TYPE_TCP &&
9573 bufreq->necp_stats_bufreq_ver == NECP_CLIENT_STATISTICS_TYPE_TCP_CURRENT_VER) ||
9574 (bufreq->necp_stats_bufreq_type == NECP_CLIENT_STATISTICS_TYPE_UDP &&
9575 bufreq->necp_stats_bufreq_ver == NECP_CLIENT_STATISTICS_TYPE_UDP_CURRENT_VER) ||
9576 (bufreq->necp_stats_bufreq_type == NECP_CLIENT_STATISTICS_TYPE_QUIC &&
9577 bufreq->necp_stats_bufreq_ver == NECP_CLIENT_STATISTICS_TYPE_QUIC_CURRENT_VER)) &&
9578 (bufreq->necp_stats_bufreq_size == sizeof(struct necp_all_stats))) {
9579 // There should be one and only one stats allocation per client.
9580 // If asked more than once, we just repeat ourselves.
9581 if (flow_registration->ustats_uaddr == 0) {
9582 mach_vm_offset_t off;
9583 ASSERT(flow_registration->stats_arena == NULL);
9584 ASSERT(flow_registration->kstats_kaddr == NULL);
9585 ASSERT(flow_registration->ustats_uaddr == 0);
9586 error = necp_arena_stats_obj_alloc(fd_data, &off, &flow_registration->stats_arena, &flow_registration->kstats_kaddr, FALSE);
9587 if (error == 0) {
9588 // upon success, hold a reference for the client; this is released when the client is removed/closed
9589 ASSERT(flow_registration->stats_arena != NULL);
9590 necp_arena_info_retain(flow_registration->stats_arena);
9591
9592 // compute user address based on mapping info and object offset
9593 flow_registration->ustats_uaddr = flow_registration->stats_arena->nai_mmap.ami_mapaddr + off;
9594
9595 // add to collect_stats list
9596 NECP_STATS_LIST_LOCK_EXCLUSIVE();
9597 necp_client_retain_locked(client); // Add a reference to the client
9598 LIST_INSERT_HEAD(&necp_collect_stats_flow_list, flow_registration, collect_stats_chain);
9599 NECP_STATS_LIST_UNLOCK();
9600 necp_schedule_collect_stats_clients(FALSE);
9601 } else {
9602 ASSERT(flow_registration->stats_arena == NULL);
9603 ASSERT(flow_registration->kstats_kaddr == NULL);
9604 }
9605 }
9606 if (flow_registration->ustats_uaddr != 0) {
9607 ASSERT(error == 0);
9608 ASSERT(flow_registration->stats_arena != NULL);
9609 ASSERT(flow_registration->kstats_kaddr != NULL);
9610
9611 struct necp_all_kstats *kstats = (struct necp_all_kstats *)flow_registration->kstats_kaddr;
9612 kstats->necp_stats_ustats->all_stats_u.tcp_stats.necp_tcp_hdr.necp_stats_type = bufreq->necp_stats_bufreq_type;
9613 kstats->necp_stats_ustats->all_stats_u.tcp_stats.necp_tcp_hdr.necp_stats_ver = bufreq->necp_stats_bufreq_ver;
9614
9615 if (out_header) {
9616 out_header->necp_stats_type = bufreq->necp_stats_bufreq_type;
9617 out_header->necp_stats_ver = bufreq->necp_stats_bufreq_ver;
9618 }
9619
9620 bufreq->necp_stats_bufreq_uaddr = flow_registration->ustats_uaddr;
9621 }
9622 } else {
9623 error = EINVAL;
9624 }
9625
9626 return error;
9627 }
9628
9629 static int
necp_client_stats_initial(struct necp_client_flow_registration * flow_registration,uint32_t stats_type,uint32_t stats_ver)9630 necp_client_stats_initial(struct necp_client_flow_registration *flow_registration, uint32_t stats_type, uint32_t stats_ver)
9631 {
9632 // An attempted create
9633 assert(flow_registration->stats_handler_context == NULL);
9634 assert(flow_registration->stats_arena);
9635 assert(flow_registration->ustats_uaddr);
9636 assert(flow_registration->kstats_kaddr);
9637
9638 int error = 0;
9639
9640 switch (stats_type) {
9641 case NECP_CLIENT_STATISTICS_TYPE_TCP: {
9642 if (stats_ver == NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1) {
9643 flow_registration->stats_handler_context = ntstat_userland_stats_open((userland_stats_provider_context *)flow_registration,
9644 NSTAT_PROVIDER_TCP_USERLAND, 0, necp_request_tcp_netstats, necp_find_extension_info);
9645 if (flow_registration->stats_handler_context == NULL) {
9646 error = EIO;
9647 }
9648 } else {
9649 error = ENOTSUP;
9650 }
9651 break;
9652 }
9653 case NECP_CLIENT_STATISTICS_TYPE_UDP: {
9654 if (stats_ver == NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1) {
9655 flow_registration->stats_handler_context = ntstat_userland_stats_open((userland_stats_provider_context *)flow_registration,
9656 NSTAT_PROVIDER_UDP_USERLAND, 0, necp_request_udp_netstats, necp_find_extension_info);
9657 if (flow_registration->stats_handler_context == NULL) {
9658 error = EIO;
9659 }
9660 } else {
9661 error = ENOTSUP;
9662 }
9663 break;
9664 }
9665 case NECP_CLIENT_STATISTICS_TYPE_QUIC: {
9666 if (stats_ver == NECP_CLIENT_STATISTICS_TYPE_QUIC_VER_1 && flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS) {
9667 flow_registration->stats_handler_context = ntstat_userland_stats_open((userland_stats_provider_context *)flow_registration,
9668 NSTAT_PROVIDER_QUIC_USERLAND, 0, necp_request_quic_netstats, necp_find_extension_info);
9669 if (flow_registration->stats_handler_context == NULL) {
9670 error = EIO;
9671 }
9672 } else {
9673 error = ENOTSUP;
9674 }
9675 break;
9676 }
9677 default: {
9678 error = ENOTSUP;
9679 break;
9680 }
9681 }
9682 return error;
9683 }
9684
9685 static int
necp_stats_initialize(struct necp_fd_data * fd_data,struct necp_client * client,struct necp_client_flow_registration * flow_registration,struct necp_stats_bufreq * bufreq)9686 necp_stats_initialize(struct necp_fd_data *fd_data,
9687 struct necp_client *client,
9688 struct necp_client_flow_registration *flow_registration,
9689 struct necp_stats_bufreq *bufreq)
9690 {
9691 int error = 0;
9692 struct necp_stats_hdr stats_hdr = {};
9693
9694 NECP_CLIENT_ASSERT_LOCKED(client);
9695 NECP_FD_ASSERT_LOCKED(fd_data);
9696 VERIFY(fd_data->stats_arena_active != NULL);
9697 VERIFY(fd_data->stats_arena_active->nai_arena != NULL);
9698 VERIFY(!(fd_data->stats_arena_active->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT)));
9699
9700 if (bufreq == NULL) {
9701 return EINVAL;
9702 }
9703
9704 // Setup stats region
9705 error = necp_client_stats_bufreq(fd_data, client, flow_registration, bufreq, &stats_hdr);
9706 if (error) {
9707 return error;
9708 }
9709 // Notify ntstat about new flow
9710 if (flow_registration->stats_handler_context == NULL) {
9711 error = necp_client_stats_initial(flow_registration, stats_hdr.necp_stats_type, stats_hdr.necp_stats_ver);
9712 if (flow_registration->stats_handler_context != NULL) {
9713 ntstat_userland_stats_event(flow_registration->stats_handler_context, NECP_CLIENT_STATISTICS_EVENT_INIT);
9714 }
9715 NECP_CLIENT_FLOW_LOG(client, flow_registration, "Initialized stats <error %d>", error);
9716 }
9717
9718 return error;
9719 }
9720
9721 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_map_sysctls(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9722 necp_client_map_sysctls(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9723 {
9724 int result = 0;
9725 if (!retval) {
9726 retval = &result;
9727 }
9728
9729 do {
9730 mach_vm_address_t uaddr = 0;
9731 if (uap->buffer_size != sizeof(uaddr)) {
9732 *retval = EINVAL;
9733 break;
9734 }
9735
9736 *retval = necp_sysctl_arena_initialize(fd_data, false);
9737 if (*retval != 0) {
9738 break;
9739 }
9740
9741 mach_vm_offset_t off = 0;
9742 void *location = NULL;
9743 NECP_FD_LOCK(fd_data);
9744 location = necp_arena_sysctls_obj(fd_data, &off, NULL);
9745 NECP_FD_UNLOCK(fd_data);
9746
9747 if (location == NULL) {
9748 *retval = ENOENT;
9749 break;
9750 }
9751
9752 uaddr = fd_data->sysctl_mmap.ami_mapaddr + off;
9753 *retval = copyout(&uaddr, uap->buffer, sizeof(uaddr));
9754 } while (false);
9755
9756 return *retval;
9757 }
9758
9759 #endif /* !SKYWALK */
9760
9761 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_route_statistics(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9762 necp_client_copy_route_statistics(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9763 {
9764 int error = 0;
9765 struct necp_client *client = NULL;
9766 uuid_t client_id;
9767
9768 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
9769 uap->buffer_size < sizeof(struct necp_stat_counts) || uap->buffer == 0) {
9770 NECPLOG0(LOG_ERR, "necp_client_copy_route_statistics bad input");
9771 error = EINVAL;
9772 goto done;
9773 }
9774
9775 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
9776 if (error) {
9777 NECPLOG(LOG_ERR, "necp_client_copy_route_statistics copyin client_id error (%d)", error);
9778 goto done;
9779 }
9780
9781 // Lock
9782 NECP_FD_LOCK(fd_data);
9783 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
9784 if (client != NULL) {
9785 NECP_CLIENT_ROUTE_LOCK(client);
9786 struct necp_stat_counts route_stats = {};
9787 if (client->current_route != NULL && client->current_route->rt_stats != NULL) {
9788 struct nstat_counts *rt_stats = client->current_route->rt_stats;
9789 atomic_get_64(route_stats.necp_stat_rxpackets, &rt_stats->nstat_rxpackets);
9790 atomic_get_64(route_stats.necp_stat_rxbytes, &rt_stats->nstat_rxbytes);
9791 atomic_get_64(route_stats.necp_stat_txpackets, &rt_stats->nstat_txpackets);
9792 atomic_get_64(route_stats.necp_stat_txbytes, &rt_stats->nstat_txbytes);
9793 route_stats.necp_stat_rxduplicatebytes = rt_stats->nstat_rxduplicatebytes;
9794 route_stats.necp_stat_rxoutoforderbytes = rt_stats->nstat_rxoutoforderbytes;
9795 route_stats.necp_stat_txretransmit = rt_stats->nstat_txretransmit;
9796 route_stats.necp_stat_connectattempts = rt_stats->nstat_connectattempts;
9797 route_stats.necp_stat_connectsuccesses = rt_stats->nstat_connectsuccesses;
9798 route_stats.necp_stat_min_rtt = rt_stats->nstat_min_rtt;
9799 route_stats.necp_stat_avg_rtt = rt_stats->nstat_avg_rtt;
9800 route_stats.necp_stat_var_rtt = rt_stats->nstat_var_rtt;
9801 route_stats.necp_stat_route_flags = client->current_route->rt_flags;
9802 }
9803
9804 // Unlock before copying out
9805 NECP_CLIENT_ROUTE_UNLOCK(client);
9806 NECP_CLIENT_UNLOCK(client);
9807 NECP_FD_UNLOCK(fd_data);
9808
9809 error = copyout(&route_stats, uap->buffer, sizeof(route_stats));
9810 if (error) {
9811 NECPLOG(LOG_ERR, "necp_client_copy_route_statistics copyout error (%d)", error);
9812 }
9813 } else {
9814 // Unlock
9815 NECP_FD_UNLOCK(fd_data);
9816 error = ENOENT;
9817 }
9818
9819
9820 done:
9821 *retval = error;
9822 return error;
9823 }
9824
9825 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_update_cache(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9826 necp_client_update_cache(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9827 {
9828 int error = 0;
9829 struct necp_client *client = NULL;
9830 uuid_t client_id;
9831
9832 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
9833 error = EINVAL;
9834 goto done;
9835 }
9836
9837 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
9838 if (error) {
9839 NECPLOG(LOG_ERR, "necp_client_update_cache copyin client_id error (%d)", error);
9840 goto done;
9841 }
9842
9843 NECP_FD_LOCK(fd_data);
9844 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
9845 if (client == NULL) {
9846 NECP_FD_UNLOCK(fd_data);
9847 error = ENOENT;
9848 goto done;
9849 }
9850
9851 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
9852 if (flow_registration == NULL) {
9853 NECP_CLIENT_UNLOCK(client);
9854 NECP_FD_UNLOCK(fd_data);
9855 error = ENOENT;
9856 goto done;
9857 }
9858
9859 NECP_CLIENT_ROUTE_LOCK(client);
9860 // This needs to be changed when TFO/ECN is supported by multiple flows
9861 struct necp_client_flow *flow = LIST_FIRST(&flow_registration->flow_list);
9862 if (flow == NULL ||
9863 (flow->remote_addr.sa.sa_family != AF_INET &&
9864 flow->remote_addr.sa.sa_family != AF_INET6) ||
9865 (flow->local_addr.sa.sa_family != AF_INET &&
9866 flow->local_addr.sa.sa_family != AF_INET6)) {
9867 error = EINVAL;
9868 NECPLOG(LOG_ERR, "necp_client_update_cache no flow error (%d)", error);
9869 goto done_unlock;
9870 }
9871
9872 necp_cache_buffer cache_buffer;
9873 memset(&cache_buffer, 0, sizeof(cache_buffer));
9874
9875 if (uap->buffer_size != sizeof(necp_cache_buffer) ||
9876 uap->buffer == USER_ADDR_NULL) {
9877 error = EINVAL;
9878 goto done_unlock;
9879 }
9880
9881 error = copyin(uap->buffer, &cache_buffer, sizeof(cache_buffer));
9882 if (error) {
9883 NECPLOG(LOG_ERR, "necp_client_update_cache copyin cache buffer error (%d)", error);
9884 goto done_unlock;
9885 }
9886
9887 if (cache_buffer.necp_cache_buf_type == NECP_CLIENT_CACHE_TYPE_ECN &&
9888 cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_ECN_VER_1) {
9889 if (cache_buffer.necp_cache_buf_size != sizeof(necp_tcp_ecn_cache) ||
9890 cache_buffer.necp_cache_buf_addr == USER_ADDR_NULL) {
9891 error = EINVAL;
9892 goto done_unlock;
9893 }
9894
9895 necp_tcp_ecn_cache ecn_cache_buffer;
9896 memset(&ecn_cache_buffer, 0, sizeof(ecn_cache_buffer));
9897
9898 error = copyin(cache_buffer.necp_cache_buf_addr, &ecn_cache_buffer, sizeof(necp_tcp_ecn_cache));
9899 if (error) {
9900 NECPLOG(LOG_ERR, "necp_client_update_cache copyin ecn cache buffer error (%d)", error);
9901 goto done_unlock;
9902 }
9903
9904 if (client->current_route != NULL && client->current_route->rt_ifp != NULL) {
9905 if (!client->platform_binary) {
9906 ecn_cache_buffer.necp_tcp_ecn_heuristics_success = 0;
9907 }
9908 tcp_heuristics_ecn_update(&ecn_cache_buffer, client->current_route->rt_ifp,
9909 (union sockaddr_in_4_6 *)&flow->local_addr);
9910 }
9911 } else if (cache_buffer.necp_cache_buf_type == NECP_CLIENT_CACHE_TYPE_TFO &&
9912 cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_TFO_VER_1) {
9913 if (cache_buffer.necp_cache_buf_size != sizeof(necp_tcp_tfo_cache) ||
9914 cache_buffer.necp_cache_buf_addr == USER_ADDR_NULL) {
9915 error = EINVAL;
9916 goto done_unlock;
9917 }
9918
9919 necp_tcp_tfo_cache tfo_cache_buffer;
9920 memset(&tfo_cache_buffer, 0, sizeof(tfo_cache_buffer));
9921
9922 error = copyin(cache_buffer.necp_cache_buf_addr, &tfo_cache_buffer, sizeof(necp_tcp_tfo_cache));
9923 if (error) {
9924 NECPLOG(LOG_ERR, "necp_client_update_cache copyin tfo cache buffer error (%d)", error);
9925 goto done_unlock;
9926 }
9927
9928 if (client->current_route != NULL && client->current_route->rt_ifp != NULL) {
9929 if (!client->platform_binary) {
9930 tfo_cache_buffer.necp_tcp_tfo_heuristics_success = 0;
9931 }
9932 tcp_heuristics_tfo_update(&tfo_cache_buffer, client->current_route->rt_ifp,
9933 (union sockaddr_in_4_6 *)&flow->local_addr,
9934 (union sockaddr_in_4_6 *)&flow->remote_addr);
9935 }
9936 } else {
9937 error = EINVAL;
9938 }
9939 done_unlock:
9940 NECP_CLIENT_ROUTE_UNLOCK(client);
9941 NECP_CLIENT_UNLOCK(client);
9942 NECP_FD_UNLOCK(fd_data);
9943 done:
9944 *retval = error;
9945 return error;
9946 }
9947
9948 // Most results will fit into this size
9949 struct necp_client_signable_default {
9950 uuid_t client_id;
9951 u_int32_t sign_type;
9952 u_int8_t signable_data[NECP_CLIENT_ACTION_SIGN_DEFAULT_DATA_LENGTH];
9953 } __attribute__((__packed__));
9954
9955 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_sign(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9956 necp_client_sign(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9957 {
9958 int error = 0;
9959 u_int8_t tag[NECP_CLIENT_ACTION_SIGN_TAG_LENGTH] = {};
9960 struct necp_client_signable *signable = NULL;
9961 struct necp_client_signable *allocated_signable = NULL;
9962 struct necp_client_signable_default default_signable = {};
9963 size_t tag_size = sizeof(tag);
9964
9965 const size_t signable_length = uap->client_id_len;
9966 const size_t return_tag_length = uap->buffer_size;
9967
9968 *retval = 0;
9969
9970 const bool has_resolver_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_VALIDATED_RESOLVER, 0) == 0);
9971 if (!has_resolver_entitlement) {
9972 NECPLOG0(LOG_ERR, "Process does not hold the necessary entitlement to sign resolver answers");
9973 error = EPERM;
9974 goto done;
9975 }
9976
9977 if (uap->client_id == 0 || signable_length < sizeof(*signable) || signable_length > NECP_CLIENT_ACTION_SIGN_MAX_TOTAL_LENGTH) {
9978 error = EINVAL;
9979 goto done;
9980 }
9981
9982 if (uap->buffer == 0 || return_tag_length != NECP_CLIENT_ACTION_SIGN_TAG_LENGTH) {
9983 error = EINVAL;
9984 goto done;
9985 }
9986
9987 if (signable_length <= sizeof(default_signable)) {
9988 signable = (struct necp_client_signable *)&default_signable;
9989 } else {
9990 if ((allocated_signable = (struct necp_client_signable *)kalloc_data(signable_length, Z_WAITOK | Z_ZERO)) == NULL) {
9991 NECPLOG(LOG_ERR, "necp_client_sign allocate signable %zu failed", signable_length);
9992 error = ENOMEM;
9993 goto done;
9994 }
9995 signable = allocated_signable;
9996 }
9997
9998 error = copyin(uap->client_id, signable, signable_length);
9999 if (error) {
10000 NECPLOG(LOG_ERR, "necp_client_sign copyin signable error (%d)", error);
10001 goto done;
10002 }
10003
10004 size_t data_length = 0;
10005 switch (signable->sign_type) {
10006 case NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER:
10007 case NECP_CLIENT_SIGN_TYPE_SYSTEM_RESOLVER_ANSWER: {
10008 data_length = (sizeof(struct necp_client_host_resolver_answer) - sizeof(struct necp_client_signable));
10009 if (signable_length < (sizeof(struct necp_client_signable) + data_length)) {
10010 error = EINVAL;
10011 goto done;
10012 }
10013 struct necp_client_host_resolver_answer *signable_struct = (struct necp_client_host_resolver_answer *)signable;
10014 if (signable_struct->hostname_length > NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH ||
10015 signable_length != (sizeof(struct necp_client_signable) + data_length + signable_struct->hostname_length)) {
10016 error = EINVAL;
10017 goto done;
10018 }
10019 data_length += signable_struct->hostname_length;
10020 break;
10021 }
10022 case NECP_CLIENT_SIGN_TYPE_BROWSE_RESULT:
10023 case NECP_CLIENT_SIGN_TYPE_SYSTEM_BROWSE_RESULT: {
10024 data_length = (sizeof(struct necp_client_browse_result) - sizeof(struct necp_client_signable));
10025 if (signable_length < (sizeof(struct necp_client_signable) + data_length)) {
10026 error = EINVAL;
10027 goto done;
10028 }
10029 struct necp_client_browse_result *signable_struct = (struct necp_client_browse_result *)signable;
10030 if (signable_struct->service_length > NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH ||
10031 signable_length != (sizeof(struct necp_client_signable) + data_length + signable_struct->service_length)) {
10032 error = EINVAL;
10033 goto done;
10034 }
10035 data_length += signable_struct->service_length;
10036 break;
10037 }
10038 case NECP_CLIENT_SIGN_TYPE_SERVICE_RESOLVER_ANSWER:
10039 case NECP_CLIENT_SIGN_TYPE_SYSTEM_SERVICE_RESOLVER_ANSWER: {
10040 data_length = (sizeof(struct necp_client_service_resolver_answer) - sizeof(struct necp_client_signable));
10041 if (signable_length < (sizeof(struct necp_client_signable) + data_length)) {
10042 error = EINVAL;
10043 goto done;
10044 }
10045 struct necp_client_service_resolver_answer *signable_struct = (struct necp_client_service_resolver_answer *)signable;
10046 if (signable_struct->service_length > NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH ||
10047 signable_struct->hostname_length > NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH ||
10048 signable_length != (sizeof(struct necp_client_signable) + data_length + signable_struct->service_length + signable_struct->hostname_length)) {
10049 error = EINVAL;
10050 goto done;
10051 }
10052 data_length += signable_struct->service_length;
10053 data_length += signable_struct->hostname_length;
10054 break;
10055 }
10056 default: {
10057 NECPLOG(LOG_ERR, "necp_client_sign unknown signable type (%u)", signable->sign_type);
10058 error = EINVAL;
10059 goto done;
10060 }
10061 }
10062
10063 error = necp_sign_resolver_answer(signable->client_id, signable->sign_type,
10064 signable->signable_data, data_length,
10065 tag, &tag_size);
10066 if (tag_size != sizeof(tag)) {
10067 NECPLOG(LOG_ERR, "necp_client_sign unexpected tag size %zu", tag_size);
10068 error = EINVAL;
10069 goto done;
10070 }
10071 error = copyout(tag, uap->buffer, tag_size);
10072 if (error) {
10073 NECPLOG(LOG_ERR, "necp_client_sign copyout error (%d)", error);
10074 goto done;
10075 }
10076
10077 done:
10078 if (allocated_signable != NULL) {
10079 kfree_data(allocated_signable, signable_length);
10080 allocated_signable = NULL;
10081 }
10082 *retval = error;
10083 return error;
10084 }
10085
10086 // Most results will fit into this size
10087 struct necp_client_validatable_default {
10088 struct necp_client_signature signature;
10089 struct necp_client_signable_default signable;
10090 } __attribute__((__packed__));
10091
10092 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_validate(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)10093 necp_client_validate(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
10094 {
10095 int error = 0;
10096 struct necp_client_validatable *validatable = NULL;
10097 struct necp_client_validatable *allocated_validatable = NULL;
10098 struct necp_client_validatable_default default_validatable = {};
10099
10100 const size_t validatable_length = uap->client_id_len;
10101
10102 *retval = 0;
10103
10104 const bool has_resolver_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_VALIDATED_RESOLVER, 0) == 0);
10105 if (!has_resolver_entitlement) {
10106 NECPLOG0(LOG_ERR, "Process does not hold the necessary entitlement to directly validate resolver answers");
10107 error = EPERM;
10108 goto done;
10109 }
10110
10111 if (uap->client_id == 0 || validatable_length < sizeof(*validatable) ||
10112 validatable_length > (NECP_CLIENT_ACTION_SIGN_MAX_TOTAL_LENGTH + NECP_CLIENT_ACTION_SIGN_TAG_LENGTH)) {
10113 error = EINVAL;
10114 goto done;
10115 }
10116
10117 if (validatable_length <= sizeof(default_validatable)) {
10118 validatable = (struct necp_client_validatable *)&default_validatable;
10119 } else {
10120 if ((allocated_validatable = (struct necp_client_validatable *)kalloc_data(validatable_length, Z_WAITOK | Z_ZERO)) == NULL) {
10121 NECPLOG(LOG_ERR, "necp_client_validate allocate struct %zu failed", validatable_length);
10122 error = ENOMEM;
10123 goto done;
10124 }
10125 validatable = allocated_validatable;
10126 }
10127
10128 error = copyin(uap->client_id, validatable, validatable_length);
10129 if (error) {
10130 NECPLOG(LOG_ERR, "necp_client_validate copyin error (%d)", error);
10131 goto done;
10132 }
10133
10134 const bool validated = necp_validate_resolver_answer(validatable->signable.client_id, validatable->signable.sign_type,
10135 validatable->signable.signable_data, validatable_length - sizeof(struct necp_client_validatable),
10136 validatable->signature.signed_tag, sizeof(validatable->signature.signed_tag));
10137 if (!validated) {
10138 // Return EAUTH to indicate that the signature failed
10139 error = EAUTH;
10140 }
10141
10142 done:
10143 if (allocated_validatable != NULL) {
10144 kfree_data(allocated_validatable, validatable_length);
10145 allocated_validatable = NULL;
10146 }
10147 *retval = error;
10148 return error;
10149 }
10150
10151 int
necp_client_action(struct proc * p,struct necp_client_action_args * uap,int * retval)10152 necp_client_action(struct proc *p, struct necp_client_action_args *uap, int *retval)
10153 {
10154 struct fileproc *fp;
10155 int error = 0;
10156 int return_value = 0;
10157 struct necp_fd_data *fd_data = NULL;
10158
10159 error = necp_find_fd_data(p, uap->necp_fd, &fp, &fd_data);
10160 if (error != 0) {
10161 NECPLOG(LOG_ERR, "necp_client_action find fd error (%d)", error);
10162 return error;
10163 }
10164
10165 u_int32_t action = uap->action;
10166
10167 #if CONFIG_MACF
10168 error = mac_necp_check_client_action(p, fp->fp_glob, action);
10169 if (error) {
10170 return_value = error;
10171 goto done;
10172 }
10173 #endif /* MACF */
10174
10175 switch (action) {
10176 case NECP_CLIENT_ACTION_ADD: {
10177 return_value = necp_client_add(p, fd_data, uap, retval);
10178 break;
10179 }
10180 case NECP_CLIENT_ACTION_CLAIM: {
10181 return_value = necp_client_claim(p, fd_data, uap, retval);
10182 break;
10183 }
10184 case NECP_CLIENT_ACTION_REMOVE: {
10185 return_value = necp_client_remove(fd_data, uap, retval);
10186 break;
10187 }
10188 case NECP_CLIENT_ACTION_COPY_PARAMETERS:
10189 case NECP_CLIENT_ACTION_COPY_RESULT:
10190 case NECP_CLIENT_ACTION_COPY_UPDATED_RESULT: {
10191 return_value = necp_client_copy(fd_data, uap, retval);
10192 break;
10193 }
10194 case NECP_CLIENT_ACTION_COPY_LIST: {
10195 return_value = necp_client_list(fd_data, uap, retval);
10196 break;
10197 }
10198 case NECP_CLIENT_ACTION_ADD_FLOW: {
10199 return_value = necp_client_add_flow(fd_data, uap, retval);
10200 break;
10201 }
10202 case NECP_CLIENT_ACTION_REMOVE_FLOW: {
10203 return_value = necp_client_remove_flow(fd_data, uap, retval);
10204 break;
10205 }
10206 #if SKYWALK
10207 case NECP_CLIENT_ACTION_REQUEST_NEXUS_INSTANCE: {
10208 return_value = necp_client_request_nexus(fd_data, uap, retval);
10209 break;
10210 }
10211 #endif /* !SKYWALK */
10212 case NECP_CLIENT_ACTION_AGENT: {
10213 return_value = necp_client_agent_action(fd_data, uap, retval);
10214 break;
10215 }
10216 case NECP_CLIENT_ACTION_COPY_AGENT: {
10217 return_value = necp_client_copy_agent(fd_data, uap, retval);
10218 break;
10219 }
10220 case NECP_CLIENT_ACTION_AGENT_USE: {
10221 return_value = necp_client_agent_use(fd_data, uap, retval);
10222 break;
10223 }
10224 case NECP_CLIENT_ACTION_ACQUIRE_AGENT_TOKEN: {
10225 return_value = necp_client_acquire_agent_token(fd_data, uap, retval);
10226 break;
10227 }
10228 case NECP_CLIENT_ACTION_COPY_INTERFACE: {
10229 return_value = necp_client_copy_interface(fd_data, uap, retval);
10230 break;
10231 }
10232 #if SKYWALK
10233 case NECP_CLIENT_ACTION_GET_INTERFACE_ADDRESS: {
10234 return_value = necp_client_get_interface_address(fd_data, uap, retval);
10235 break;
10236 }
10237 case NECP_CLIENT_ACTION_SET_STATISTICS: {
10238 return_value = ENOTSUP;
10239 break;
10240 }
10241 case NECP_CLIENT_ACTION_MAP_SYSCTLS: {
10242 return_value = necp_client_map_sysctls(fd_data, uap, retval);
10243 break;
10244 }
10245 #endif /* !SKYWALK */
10246 case NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS: {
10247 return_value = necp_client_copy_route_statistics(fd_data, uap, retval);
10248 break;
10249 }
10250 case NECP_CLIENT_ACTION_UPDATE_CACHE: {
10251 return_value = necp_client_update_cache(fd_data, uap, retval);
10252 break;
10253 }
10254 case NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE: {
10255 return_value = necp_client_copy_client_update(fd_data, uap, retval);
10256 break;
10257 }
10258 case NECP_CLIENT_ACTION_SIGN: {
10259 return_value = necp_client_sign(fd_data, uap, retval);
10260 break;
10261 }
10262 case NECP_CLIENT_ACTION_VALIDATE: {
10263 return_value = necp_client_validate(fd_data, uap, retval);
10264 break;
10265 }
10266 default: {
10267 NECPLOG(LOG_ERR, "necp_client_action unknown action (%u)", action);
10268 return_value = EINVAL;
10269 break;
10270 }
10271 }
10272
10273 done:
10274 fp_drop(p, uap->necp_fd, fp, 0);
10275 return return_value;
10276 }
10277
10278 #define NECP_MAX_MATCH_POLICY_PARAMETER_SIZE 1024
10279
10280 int
necp_match_policy(struct proc * p,struct necp_match_policy_args * uap,int32_t * retval)10281 necp_match_policy(struct proc *p, struct necp_match_policy_args *uap, int32_t *retval)
10282 {
10283 #pragma unused(retval)
10284 u_int8_t *parameters = NULL;
10285 struct necp_aggregate_result returned_result;
10286 int error = 0;
10287
10288 if (uap == NULL) {
10289 error = EINVAL;
10290 goto done;
10291 }
10292
10293 if (uap->parameters == 0 || uap->parameters_size == 0 || uap->parameters_size > NECP_MAX_MATCH_POLICY_PARAMETER_SIZE || uap->returned_result == 0) {
10294 error = EINVAL;
10295 goto done;
10296 }
10297
10298 parameters = (u_int8_t *)kalloc_data(uap->parameters_size, Z_WAITOK | Z_ZERO);
10299 if (parameters == NULL) {
10300 error = ENOMEM;
10301 goto done;
10302 }
10303 // Copy parameters in
10304 error = copyin(uap->parameters, parameters, uap->parameters_size);
10305 if (error) {
10306 goto done;
10307 }
10308
10309 error = necp_application_find_policy_match_internal(p, parameters, uap->parameters_size,
10310 &returned_result, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL, false, false, NULL);
10311 if (error) {
10312 goto done;
10313 }
10314
10315 // Copy return value back
10316 error = copyout(&returned_result, uap->returned_result, sizeof(struct necp_aggregate_result));
10317 if (error) {
10318 goto done;
10319 }
10320 done:
10321 if (parameters != NULL) {
10322 kfree_data(parameters, uap->parameters_size);
10323 }
10324 return error;
10325 }
10326
10327 /// Socket operations
10328
10329 static errno_t
necp_set_socket_attribute(u_int8_t * buffer,size_t buffer_length,u_int8_t type,char ** buffer_p,bool * single_tlv)10330 necp_set_socket_attribute(u_int8_t *buffer, size_t buffer_length, u_int8_t type, char **buffer_p, bool *single_tlv)
10331 {
10332 int error = 0;
10333 int cursor = 0;
10334 size_t string_size = 0;
10335 char *local_string = NULL;
10336 u_int8_t *value = NULL;
10337 char *buffer_to_free = NULL;
10338
10339 cursor = necp_buffer_find_tlv(buffer, buffer_length, 0, type, NULL, 0);
10340 if (cursor < 0) {
10341 // This will clear out the parameter
10342 goto done;
10343 }
10344
10345 string_size = necp_buffer_get_tlv_length(buffer, cursor);
10346 if (single_tlv != NULL && (buffer_length == sizeof(struct necp_tlv_header) + string_size)) {
10347 *single_tlv = true;
10348 }
10349 if (string_size == 0 || string_size > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) {
10350 // This will clear out the parameter
10351 goto done;
10352 }
10353
10354 local_string = (char *)kalloc_data(string_size + 1, Z_WAITOK | Z_ZERO);
10355 if (local_string == NULL) {
10356 NECPLOG(LOG_ERR, "Failed to allocate a socket attribute buffer (size %zu)", string_size);
10357 goto fail;
10358 }
10359
10360 value = necp_buffer_get_tlv_value(buffer, cursor, NULL);
10361 if (value == NULL) {
10362 NECPLOG0(LOG_ERR, "Failed to get socket attribute");
10363 goto fail;
10364 }
10365
10366 memcpy(local_string, value, string_size);
10367 local_string[string_size] = 0;
10368
10369 done:
10370 buffer_to_free = *buffer_p;
10371
10372 // Protect switching of buffer pointer
10373 necp_lock_socket_attributes();
10374 *buffer_p = local_string;
10375 necp_unlock_socket_attributes();
10376
10377 if (buffer_to_free != NULL) {
10378 kfree_data_addr(buffer_to_free);
10379 }
10380 return 0;
10381 fail:
10382 if (local_string != NULL) {
10383 kfree_data(local_string, string_size + 1);
10384 }
10385 return error;
10386 }
10387
10388 errno_t
necp_set_socket_attributes(struct inp_necp_attributes * attributes,struct sockopt * sopt)10389 necp_set_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt)
10390 {
10391 int error = 0;
10392 u_int8_t *buffer = NULL;
10393 bool single_tlv = false;
10394 size_t valsize = sopt->sopt_valsize;
10395 if (valsize == 0 ||
10396 valsize > ((sizeof(struct necp_tlv_header) + NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) * 4)) {
10397 goto done;
10398 }
10399
10400 buffer = (u_int8_t *)kalloc_data(valsize, Z_WAITOK | Z_ZERO);
10401 if (buffer == NULL) {
10402 goto done;
10403 }
10404
10405 error = sooptcopyin(sopt, buffer, valsize, 0);
10406 if (error) {
10407 goto done;
10408 }
10409
10410 // If NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT is being set/cleared separately from the other attributes,
10411 // do not clear other attributes.
10412 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT, &attributes->inp_domain_context, &single_tlv);
10413 if (error) {
10414 NECPLOG0(LOG_ERR, "Could not set domain context TLV for socket attributes");
10415 goto done;
10416 }
10417 if (single_tlv == true) {
10418 goto done;
10419 }
10420
10421 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN, &attributes->inp_domain, NULL);
10422 if (error) {
10423 NECPLOG0(LOG_ERR, "Could not set domain TLV for socket attributes");
10424 goto done;
10425 }
10426
10427 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN_OWNER, &attributes->inp_domain_owner, NULL);
10428 if (error) {
10429 NECPLOG0(LOG_ERR, "Could not set domain owner TLV for socket attributes");
10430 goto done;
10431 }
10432
10433 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_TRACKER_DOMAIN, &attributes->inp_tracker_domain, NULL);
10434 if (error) {
10435 NECPLOG0(LOG_ERR, "Could not set tracker domain TLV for socket attributes");
10436 goto done;
10437 }
10438
10439 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_ACCOUNT, &attributes->inp_account, NULL);
10440 if (error) {
10441 NECPLOG0(LOG_ERR, "Could not set account TLV for socket attributes");
10442 goto done;
10443 }
10444
10445 done:
10446 NECP_SOCKET_ATTRIBUTE_LOG("NECP ATTRIBUTES SOCKET - domain <%s> owner <%s> context <%s> tracker domain <%s> account <%s>",
10447 attributes->inp_domain,
10448 attributes->inp_domain_owner,
10449 attributes->inp_domain_context,
10450 attributes->inp_tracker_domain,
10451 attributes->inp_account);
10452
10453 if (necp_debug) {
10454 NECPLOG(LOG_DEBUG, "Set on socket: Domain %s, Domain owner %s, Domain context %s, Tracker domain %s, Account %s",
10455 attributes->inp_domain,
10456 attributes->inp_domain_owner,
10457 attributes->inp_domain_context,
10458 attributes->inp_tracker_domain,
10459 attributes->inp_account);
10460 }
10461
10462 if (buffer != NULL) {
10463 kfree_data(buffer, valsize);
10464 }
10465
10466 return error;
10467 }
10468
10469 errno_t
necp_get_socket_attributes(struct inp_necp_attributes * attributes,struct sockopt * sopt)10470 necp_get_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt)
10471 {
10472 int error = 0;
10473 u_int8_t *buffer = NULL;
10474 u_int8_t *cursor = NULL;
10475 size_t valsize = 0;
10476
10477 if (attributes->inp_domain != NULL) {
10478 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_domain);
10479 }
10480 if (attributes->inp_domain_owner != NULL) {
10481 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_domain_owner);
10482 }
10483 if (attributes->inp_domain_context != NULL) {
10484 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_domain_context);
10485 }
10486 if (attributes->inp_tracker_domain != NULL) {
10487 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_tracker_domain);
10488 }
10489 if (attributes->inp_account != NULL) {
10490 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_account);
10491 }
10492 if (valsize == 0) {
10493 goto done;
10494 }
10495
10496 buffer = (u_int8_t *)kalloc_data(valsize, Z_WAITOK | Z_ZERO);
10497 if (buffer == NULL) {
10498 goto done;
10499 }
10500
10501 cursor = buffer;
10502 if (attributes->inp_domain != NULL) {
10503 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN, strlen(attributes->inp_domain), attributes->inp_domain,
10504 buffer, valsize);
10505 }
10506
10507 if (attributes->inp_domain_owner != NULL) {
10508 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN_OWNER, strlen(attributes->inp_domain_owner), attributes->inp_domain_owner,
10509 buffer, valsize);
10510 }
10511
10512 if (attributes->inp_domain_context != NULL) {
10513 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT, strlen(attributes->inp_domain_context), attributes->inp_domain_context,
10514 buffer, valsize);
10515 }
10516
10517 if (attributes->inp_tracker_domain != NULL) {
10518 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_TRACKER_DOMAIN, strlen(attributes->inp_tracker_domain), attributes->inp_tracker_domain,
10519 buffer, valsize);
10520 }
10521
10522 if (attributes->inp_account != NULL) {
10523 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_ACCOUNT, strlen(attributes->inp_account), attributes->inp_account,
10524 buffer, valsize);
10525 }
10526
10527 error = sooptcopyout(sopt, buffer, valsize);
10528 if (error) {
10529 goto done;
10530 }
10531 done:
10532 if (buffer != NULL) {
10533 kfree_data(buffer, valsize);
10534 }
10535
10536 return error;
10537 }
10538
10539 int
necp_set_socket_resolver_signature(struct inpcb * inp,struct sockopt * sopt)10540 necp_set_socket_resolver_signature(struct inpcb *inp, struct sockopt *sopt)
10541 {
10542 const size_t valsize = sopt->sopt_valsize;
10543 if (valsize > NECP_CLIENT_ACTION_SIGN_MAX_TOTAL_LENGTH + NECP_CLIENT_ACTION_SIGN_TAG_LENGTH) {
10544 return EINVAL;
10545 }
10546
10547 necp_lock_socket_attributes();
10548 if (inp->inp_resolver_signature != NULL) {
10549 kfree_data(inp->inp_resolver_signature, inp->inp_resolver_signature_length);
10550 }
10551 inp->inp_resolver_signature_length = 0;
10552
10553 int error = 0;
10554 if (valsize > 0) {
10555 inp->inp_resolver_signature = kalloc_data(valsize, Z_WAITOK | Z_ZERO);
10556 if ((error = sooptcopyin(sopt, inp->inp_resolver_signature, valsize,
10557 valsize)) != 0) {
10558 // Free the signature buffer if the copyin failed
10559 kfree_data(inp->inp_resolver_signature, valsize);
10560 } else {
10561 inp->inp_resolver_signature_length = valsize;
10562 }
10563 }
10564 necp_unlock_socket_attributes();
10565
10566 return error;
10567 }
10568
10569 int
necp_get_socket_resolver_signature(struct inpcb * inp,struct sockopt * sopt)10570 necp_get_socket_resolver_signature(struct inpcb *inp, struct sockopt *sopt)
10571 {
10572 int error = 0;
10573 necp_lock_socket_attributes();
10574 if (inp->inp_resolver_signature == NULL ||
10575 inp->inp_resolver_signature_length == 0) {
10576 error = ENOENT;
10577 } else {
10578 error = sooptcopyout(sopt, inp->inp_resolver_signature,
10579 inp->inp_resolver_signature_length);
10580 }
10581 necp_unlock_socket_attributes();
10582 return error;
10583 }
10584
10585 bool
necp_socket_has_resolver_signature(struct inpcb * inp)10586 necp_socket_has_resolver_signature(struct inpcb *inp)
10587 {
10588 necp_lock_socket_attributes();
10589 bool has_signature = (inp->inp_resolver_signature != NULL && inp->inp_resolver_signature_length != 0);
10590 necp_unlock_socket_attributes();
10591 return has_signature;
10592 }
10593
10594 bool
necp_socket_resolver_signature_matches_address(struct inpcb * inp,union necp_sockaddr_union * address)10595 necp_socket_resolver_signature_matches_address(struct inpcb *inp, union necp_sockaddr_union *address)
10596 {
10597 bool matches_address = false;
10598 necp_lock_socket_attributes();
10599 if (inp->inp_resolver_signature != NULL && inp->inp_resolver_signature_length > 0 && address->sa.sa_len > 0) {
10600 struct necp_client_validatable *validatable = (struct necp_client_validatable *)inp->inp_resolver_signature;
10601 if (inp->inp_resolver_signature_length > sizeof(struct necp_client_validatable) &&
10602 validatable->signable.sign_type == NECP_CLIENT_SIGN_TYPE_SYSTEM_RESOLVER_ANSWER) {
10603 size_t data_length = inp->inp_resolver_signature_length - sizeof(struct necp_client_validatable);
10604 if (data_length >= (sizeof(struct necp_client_host_resolver_answer) - sizeof(struct necp_client_signable))) {
10605 struct necp_client_host_resolver_answer *answer_struct = (struct necp_client_host_resolver_answer *)&validatable->signable;
10606 if (data_length == (sizeof(struct necp_client_host_resolver_answer) + answer_struct->hostname_length - sizeof(struct necp_client_signable)) &&
10607 answer_struct->address_answer.sa.sa_family == address->sa.sa_family &&
10608 answer_struct->address_answer.sa.sa_len == address->sa.sa_len &&
10609 (answer_struct->address_answer.sin.sin_port == 0 ||
10610 answer_struct->address_answer.sin.sin_port == address->sin.sin_port) &&
10611 ((answer_struct->address_answer.sa.sa_family == AF_INET &&
10612 answer_struct->address_answer.sin.sin_addr.s_addr == address->sin.sin_addr.s_addr) ||
10613 (answer_struct->address_answer.sa.sa_family == AF_INET6 &&
10614 memcmp(&answer_struct->address_answer.sin6.sin6_addr, &address->sin6.sin6_addr, sizeof(struct in6_addr)) == 0))) {
10615 // Address matches
10616 const bool validated = necp_validate_resolver_answer(validatable->signable.client_id,
10617 validatable->signable.sign_type,
10618 validatable->signable.signable_data, data_length,
10619 validatable->signature.signed_tag, sizeof(validatable->signature.signed_tag));
10620 if (validated) {
10621 // Answer is validated
10622 matches_address = true;
10623 }
10624 }
10625 }
10626 }
10627 }
10628 necp_unlock_socket_attributes();
10629 return matches_address;
10630 }
10631
10632 /*
10633 * necp_set_socket_domain_attributes
10634 * Called from soconnectlock/soconnectxlock to directly set the tracker domain and owner for
10635 * a newly marked tracker socket.
10636 */
10637 errno_t
necp_set_socket_domain_attributes(struct socket * so,const char * domain,const char * domain_owner)10638 necp_set_socket_domain_attributes(struct socket *so, const char *domain, const char *domain_owner)
10639 {
10640 int error = 0;
10641 struct inpcb *inp = NULL;
10642 u_int8_t *buffer = NULL;
10643 size_t valsize = 0;
10644 char *buffer_to_free = NULL;
10645
10646 if (SOCK_DOM(so) != PF_INET && SOCK_DOM(so) != PF_INET6) {
10647 error = EINVAL;
10648 goto fail;
10649 }
10650
10651 // Set domain (required)
10652
10653 valsize = strlen(domain);
10654 if (valsize == 0 || valsize > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) {
10655 error = EINVAL;
10656 goto fail;
10657 }
10658
10659 buffer = (u_int8_t *)kalloc_data(valsize + 1, Z_WAITOK | Z_ZERO);
10660 if (buffer == NULL) {
10661 error = ENOMEM;
10662 goto fail;
10663 }
10664 bcopy(domain, buffer, valsize);
10665 buffer[valsize] = 0;
10666
10667 inp = sotoinpcb(so);
10668 // Do not overwrite a previously set domain if tracker domain is different.
10669 if (inp->inp_necp_attributes.inp_domain != NULL) {
10670 if (strlen(inp->inp_necp_attributes.inp_domain) != strlen(domain) ||
10671 strncmp(inp->inp_necp_attributes.inp_domain, domain, strlen(domain)) != 0) {
10672 buffer_to_free = inp->inp_necp_attributes.inp_tracker_domain;
10673 // Protect switching of buffer pointer
10674 necp_lock_socket_attributes();
10675 inp->inp_necp_attributes.inp_tracker_domain = (char *)buffer;
10676 necp_unlock_socket_attributes();
10677 if (buffer_to_free != NULL) {
10678 kfree_data_addr(buffer_to_free);
10679 }
10680 } else {
10681 kfree_data_addr(buffer);
10682 }
10683 } else {
10684 // Protect switching of buffer pointer
10685 necp_lock_socket_attributes();
10686 inp->inp_necp_attributes.inp_domain = (char *)buffer;
10687 necp_unlock_socket_attributes();
10688 }
10689 buffer = NULL;
10690
10691 // set domain_owner (required only for tracker)
10692 if (!(so->so_flags1 & SOF1_KNOWN_TRACKER)) {
10693 goto done;
10694 }
10695
10696 valsize = strlen(domain_owner);
10697 if (valsize == 0 || valsize > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) {
10698 error = EINVAL;
10699 goto fail;
10700 }
10701
10702 buffer = (u_int8_t *)kalloc_data(valsize + 1, Z_WAITOK | Z_ZERO);
10703 if (buffer == NULL) {
10704 error = ENOMEM;
10705 goto fail;
10706 }
10707 bcopy(domain_owner, buffer, valsize);
10708 buffer[valsize] = 0;
10709
10710 inp = sotoinpcb(so);
10711
10712 buffer_to_free = inp->inp_necp_attributes.inp_domain_owner;
10713 // Protect switching of buffer pointer
10714 necp_lock_socket_attributes();
10715 inp->inp_necp_attributes.inp_domain_owner = (char *)buffer;
10716 necp_unlock_socket_attributes();
10717 buffer = NULL;
10718
10719 if (buffer_to_free != NULL) {
10720 kfree_data_addr(buffer_to_free);
10721 }
10722
10723 done:
10724 NECP_SOCKET_PARAMS_LOG(so, "NECP ATTRIBUTES SOCKET - domain <%s> owner <%s> context <%s> tracker domain <%s> account <%s> "
10725 "<so flags - is_tracker %X non-app-initiated %X app-approved-domain %X",
10726 inp->inp_necp_attributes.inp_domain,
10727 inp->inp_necp_attributes.inp_domain_owner,
10728 inp->inp_necp_attributes.inp_domain_context,
10729 inp->inp_necp_attributes.inp_tracker_domain,
10730 inp->inp_necp_attributes.inp_account,
10731 so->so_flags1 & SOF1_KNOWN_TRACKER,
10732 so->so_flags1 & SOF1_TRACKER_NON_APP_INITIATED,
10733 so->so_flags1 & SOF1_APPROVED_APP_DOMAIN);
10734
10735 if (necp_debug) {
10736 NECPLOG(LOG_DEBUG, "Set on socket: Domain <%s> Domain owner <%s> Domain context <%s> Tracker domain <%s> Account <%s> ",
10737 inp->inp_necp_attributes.inp_domain,
10738 inp->inp_necp_attributes.inp_domain_owner,
10739 inp->inp_necp_attributes.inp_domain_context,
10740 inp->inp_necp_attributes.inp_tracker_domain,
10741 inp->inp_necp_attributes.inp_account);
10742 }
10743 fail:
10744 if (buffer != NULL) {
10745 kfree_data(buffer, valsize + 1);
10746 }
10747 return error;
10748 }
10749
10750 void *
necp_create_nexus_assign_message(uuid_t nexus_instance,nexus_port_t nexus_port,void * key,uint32_t key_length,struct necp_client_endpoint * local_endpoint,struct necp_client_endpoint * remote_endpoint,struct ether_addr * local_ether_addr,u_int32_t flow_adv_index,void * flow_stats,size_t * message_length)10751 necp_create_nexus_assign_message(uuid_t nexus_instance, nexus_port_t nexus_port, void *key, uint32_t key_length,
10752 struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint, struct ether_addr *local_ether_addr,
10753 u_int32_t flow_adv_index, void *flow_stats, size_t *message_length)
10754 {
10755 u_int8_t *buffer = NULL;
10756 u_int8_t *cursor = NULL;
10757 size_t valsize = 0;
10758 bool has_nexus_assignment = FALSE;
10759
10760 if (!uuid_is_null(nexus_instance)) {
10761 has_nexus_assignment = TRUE;
10762 valsize += sizeof(struct necp_tlv_header) + sizeof(uuid_t);
10763 valsize += sizeof(struct necp_tlv_header) + sizeof(nexus_port_t);
10764 }
10765 if (flow_adv_index != NECP_FLOWADV_IDX_INVALID) {
10766 valsize += sizeof(struct necp_tlv_header) + sizeof(u_int32_t);
10767 }
10768 if (key != NULL && key_length > 0) {
10769 valsize += sizeof(struct necp_tlv_header) + key_length;
10770 }
10771 if (local_endpoint != NULL) {
10772 valsize += sizeof(struct necp_tlv_header) + sizeof(struct necp_client_endpoint);
10773 }
10774 if (remote_endpoint != NULL) {
10775 valsize += sizeof(struct necp_tlv_header) + sizeof(struct necp_client_endpoint);
10776 }
10777 if (local_ether_addr != NULL) {
10778 valsize += sizeof(struct necp_tlv_header) + sizeof(struct ether_addr);
10779 }
10780 if (flow_stats != NULL) {
10781 valsize += sizeof(struct necp_tlv_header) + sizeof(void *);
10782 }
10783 if (valsize == 0) {
10784 return NULL;
10785 }
10786
10787 buffer = kalloc_data(valsize, Z_WAITOK | Z_ZERO);
10788 if (buffer == NULL) {
10789 return NULL;
10790 }
10791
10792 cursor = buffer;
10793 if (has_nexus_assignment) {
10794 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_INSTANCE, sizeof(uuid_t), nexus_instance, buffer, valsize);
10795 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_PORT, sizeof(nexus_port_t), &nexus_port, buffer, valsize);
10796 }
10797 if (flow_adv_index != NECP_FLOWADV_IDX_INVALID) {
10798 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_PORT_FLOW_INDEX, sizeof(u_int32_t), &flow_adv_index, buffer, valsize);
10799 }
10800 if (key != NULL && key_length > 0) {
10801 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_PARAMETER_NEXUS_KEY, key_length, key, buffer, valsize);
10802 }
10803 if (local_endpoint != NULL) {
10804 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_LOCAL_ENDPOINT, sizeof(struct necp_client_endpoint), local_endpoint, buffer, valsize);
10805 }
10806 if (remote_endpoint != NULL) {
10807 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_REMOTE_ENDPOINT, sizeof(struct necp_client_endpoint), remote_endpoint, buffer, valsize);
10808 }
10809 if (local_ether_addr != NULL) {
10810 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_LOCAL_ETHER_ADDR, sizeof(struct ether_addr), local_ether_addr, buffer, valsize);
10811 }
10812 if (flow_stats != NULL) {
10813 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_FLOW_STATS, sizeof(void *), &flow_stats, buffer, valsize);
10814 }
10815
10816 *message_length = valsize;
10817
10818 return buffer;
10819 }
10820
10821 void
necp_inpcb_remove_cb(struct inpcb * inp)10822 necp_inpcb_remove_cb(struct inpcb *inp)
10823 {
10824 if (!uuid_is_null(inp->necp_client_uuid)) {
10825 necp_client_unregister_socket_flow(inp->necp_client_uuid, inp);
10826 uuid_clear(inp->necp_client_uuid);
10827 }
10828 }
10829
10830 void
necp_inpcb_dispose(struct inpcb * inp)10831 necp_inpcb_dispose(struct inpcb *inp)
10832 {
10833 necp_inpcb_remove_cb(inp); // Clear out socket registrations if not yet done
10834 if (inp->inp_necp_attributes.inp_domain != NULL) {
10835 kfree_data_addr(inp->inp_necp_attributes.inp_domain);
10836 inp->inp_necp_attributes.inp_domain = NULL;
10837 }
10838 if (inp->inp_necp_attributes.inp_account != NULL) {
10839 kfree_data_addr(inp->inp_necp_attributes.inp_account);
10840 inp->inp_necp_attributes.inp_account = NULL;
10841 }
10842 if (inp->inp_necp_attributes.inp_domain_owner != NULL) {
10843 kfree_data_addr(inp->inp_necp_attributes.inp_domain_owner);
10844 inp->inp_necp_attributes.inp_domain_owner = NULL;
10845 }
10846 if (inp->inp_necp_attributes.inp_domain_context != NULL) {
10847 kfree_data_addr(inp->inp_necp_attributes.inp_domain_context);
10848 inp->inp_necp_attributes.inp_domain_context = NULL;
10849 }
10850 if (inp->inp_necp_attributes.inp_tracker_domain != NULL) {
10851 kfree_data_addr(inp->inp_necp_attributes.inp_tracker_domain);
10852 inp->inp_necp_attributes.inp_tracker_domain = NULL;
10853 }
10854 if (inp->inp_resolver_signature != NULL) {
10855 kfree_data(inp->inp_resolver_signature, inp->inp_resolver_signature_length);
10856 }
10857 inp->inp_resolver_signature_length = 0;
10858 }
10859
10860 void
necp_mppcb_dispose(struct mppcb * mpp)10861 necp_mppcb_dispose(struct mppcb *mpp)
10862 {
10863 if (!uuid_is_null(mpp->necp_client_uuid)) {
10864 necp_client_unregister_multipath_cb(mpp->necp_client_uuid, mpp);
10865 uuid_clear(mpp->necp_client_uuid);
10866 }
10867
10868 if (mpp->inp_necp_attributes.inp_domain != NULL) {
10869 kfree_data_addr(mpp->inp_necp_attributes.inp_domain);
10870 mpp->inp_necp_attributes.inp_domain = NULL;
10871 }
10872 if (mpp->inp_necp_attributes.inp_account != NULL) {
10873 kfree_data_addr(mpp->inp_necp_attributes.inp_account);
10874 mpp->inp_necp_attributes.inp_account = NULL;
10875 }
10876 if (mpp->inp_necp_attributes.inp_domain_owner != NULL) {
10877 kfree_data_addr(mpp->inp_necp_attributes.inp_domain_owner);
10878 mpp->inp_necp_attributes.inp_domain_owner = NULL;
10879 }
10880 if (mpp->inp_necp_attributes.inp_tracker_domain != NULL) {
10881 kfree_data_addr(mpp->inp_necp_attributes.inp_tracker_domain);
10882 mpp->inp_necp_attributes.inp_tracker_domain = NULL;
10883 }
10884 }
10885
10886 /// Module init
10887
10888 void
necp_client_init(void)10889 necp_client_init(void)
10890 {
10891 necp_client_update_tcall = thread_call_allocate_with_options(necp_update_all_clients_callout, NULL,
10892 THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
10893 VERIFY(necp_client_update_tcall != NULL);
10894 #if SKYWALK
10895
10896 necp_client_collect_stats_tcall = thread_call_allocate_with_options(necp_collect_stats_client_callout, NULL,
10897 THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
10898 VERIFY(necp_client_collect_stats_tcall != NULL);
10899
10900 necp_close_empty_arenas_tcall = thread_call_allocate_with_options(necp_close_empty_arenas_callout, NULL,
10901 THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
10902 VERIFY(necp_close_empty_arenas_tcall != NULL);
10903 #endif /* SKYWALK */
10904
10905 LIST_INIT(&necp_fd_list);
10906 LIST_INIT(&necp_fd_observer_list);
10907 LIST_INIT(&necp_collect_stats_flow_list);
10908
10909 RB_INIT(&necp_client_global_tree);
10910 RB_INIT(&necp_client_flow_global_tree);
10911 }
10912
10913 #if SKYWALK
10914 pid_t
necp_client_get_proc_pid_from_arena_info(struct skmem_arena_mmap_info * arena_info)10915 necp_client_get_proc_pid_from_arena_info(struct skmem_arena_mmap_info *arena_info)
10916 {
10917 ASSERT((arena_info->ami_arena->ar_type == SKMEM_ARENA_TYPE_NECP) || (arena_info->ami_arena->ar_type == SKMEM_ARENA_TYPE_SYSTEM));
10918
10919 if (arena_info->ami_arena->ar_type == SKMEM_ARENA_TYPE_NECP) {
10920 struct necp_arena_info *nai = container_of(arena_info, struct necp_arena_info, nai_mmap);
10921 return nai->nai_proc_pid;
10922 } else {
10923 struct necp_fd_data *fd_data = container_of(arena_info, struct necp_fd_data, sysctl_mmap);
10924 return fd_data->proc_pid;
10925 }
10926 }
10927 #endif /* !SKYWALK */
10928