1 /*
2 * Copyright (c) 2015-2023 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #include <string.h>
30
31 #include <kern/thread_call.h>
32 #include <kern/zalloc.h>
33
34 #include <net/if.h>
35 #include <net/if_var.h>
36 #include <net/net_api_stats.h>
37 #include <net/necp.h>
38 #include <net/network_agent.h>
39 #include <net/ntstat.h>
40
41 #include <netinet/in_pcb.h>
42 #include <netinet/in_var.h>
43 #include <netinet/ip.h>
44 #include <netinet/ip6.h>
45 #include <netinet/mp_pcb.h>
46 #include <netinet/tcp_cc.h>
47 #include <netinet/tcp_fsm.h>
48 #include <netinet/tcp_cache.h>
49 #include <netinet6/in6_var.h>
50
51 #include <sys/domain.h>
52 #include <sys/file_internal.h>
53 #include <sys/kauth.h>
54 #include <sys/kernel.h>
55 #include <sys/malloc.h>
56 #include <sys/poll.h>
57 #include <sys/priv.h>
58 #include <sys/protosw.h>
59 #include <sys/queue.h>
60 #include <sys/socket.h>
61 #include <sys/socketvar.h>
62 #include <sys/sysproto.h>
63 #include <sys/systm.h>
64 #include <sys/types.h>
65 #include <sys/codesign.h>
66 #include <libkern/section_keywords.h>
67
68 #include <os/refcnt.h>
69
70 #if SKYWALK
71 #include <skywalk/os_skywalk_private.h>
72 #include <skywalk/nexus/flowswitch/flow/flow_var.h>
73 #include <skywalk/nexus/flowswitch/nx_flowswitch.h>
74 #endif /* SKYWALK */
75
76 #if CONFIG_MACF
77 #include <security/mac_framework.h>
78 #endif
79
80 /*
81 * NECP Client Architecture
82 * ------------------------------------------------
83 * See <net/necp.c> for a discussion on NECP database architecture.
84 *
85 * Each client of NECP provides a set of parameters for a connection or network state
86 * evaluation, on which NECP policy evaluation is run. This produces a policy result
87 * which can be accessed by the originating process, along with events for when policies
88 * results have changed.
89 *
90 * ------------------------------------------------
91 * NECP Client FD
92 * ------------------------------------------------
93 * A process opens an NECP file descriptor using necp_open(). This is a very simple
94 * file descriptor, upon which the process may do the following operations:
95 * - necp_client_action(...), to add/remove/query clients
96 * - kqueue, to watch for readable events
97 * - close(), to close the client session and release all clients
98 *
99 * Client objects are allocated structures that hang off of the file descriptor. Each
100 * client contains:
101 * - Client ID, a UUID that references the client across the system
102 * - Parameters, a buffer of TLVs that describe the client's connection parameters,
103 * such as the remote and local endpoints, interface requirements, etc.
104 * - Result, a buffer of TLVs containing the current policy evaluation for the client.
105 * This result will be updated whenever a network change occurs that impacts the
106 * policy result for that client.
107 *
108 * +--------------+
109 * | NECP fd |
110 * +--------------+
111 * ||
112 * ==================================
113 * || || ||
114 * +--------------+ +--------------+ +--------------+
115 * | Client ID | | Client ID | | Client ID |
116 * | ---- | | ---- | | ---- |
117 * | Parameters | | Parameters | | Parameters |
118 * | ---- | | ---- | | ---- |
119 * | Result | | Result | | Result |
120 * +--------------+ +--------------+ +--------------+
121 *
122 * ------------------------------------------------
123 * Client Actions
124 * ------------------------------------------------
125 * - Add. Input parameters as a buffer of TLVs, and output a client ID. Allocates a
126 * new client structure on the file descriptor.
127 * - Remove. Input a client ID. Removes a client structure from the file descriptor.
128 * - Copy Parameters. Input a client ID, and output parameter TLVs.
129 * - Copy Result. Input a client ID, and output result TLVs. Alternatively, input empty
130 * client ID and get next unread client result.
131 * - Copy List. List all client IDs.
132 *
133 * ------------------------------------------------
134 * Client Policy Evaluation
135 * ------------------------------------------------
136 * Policies are evaluated for clients upon client creation, and upon update events,
137 * which are network/agent/policy changes coalesced by a timer.
138 *
139 * The policy evaluation goes through the following steps:
140 * 1. Parse client parameters.
141 * 2. Select a scoped interface if applicable. This involves using require/prohibit
142 * parameters, along with the local address, to select the most appropriate interface
143 * if not explicitly set by the client parameters.
144 * 3. Run NECP application-level policy evalution
145 * 4. Set policy result into client result buffer.
146 *
147 * ------------------------------------------------
148 * Client Observers
149 * ------------------------------------------------
150 * If necp_open() is called with the NECP_OPEN_FLAG_OBSERVER flag, and the process
151 * passes the necessary privilege check, the fd is allowed to use necp_client_action()
152 * to copy client state attached to the file descriptors of other processes, and to
153 * list all client IDs on the system.
154 */
155
156 extern u_int32_t necp_debug;
157
158 static int necpop_select(struct fileproc *, int, void *, vfs_context_t);
159 static int necpop_close(struct fileglob *, vfs_context_t);
160 static int necpop_kqfilter(struct fileproc *, struct knote *, struct kevent_qos_s *);
161
162 // Timer functions
163 static int necp_timeout_microseconds = 1000 * 100; // 100ms
164 static int necp_timeout_leeway_microseconds = 1000 * 50; // 50ms
165 #if SKYWALK
166 static int necp_collect_stats_timeout_microseconds = 1000 * 1000 * 1; // 1s
167 static int necp_collect_stats_timeout_leeway_microseconds = 1000 * 500; // 500ms
168 static int necp_close_arenas_timeout_microseconds = 1000 * 1000 * 10; // 10s
169 static int necp_close_arenas_timeout_leeway_microseconds = 1000 * 1000 * 1; // 1s
170 #endif /* SKYWALK */
171
172 static int necp_client_fd_count = 0;
173 static int necp_observer_fd_count = 0;
174 static int necp_client_count = 0;
175 static int necp_socket_flow_count = 0;
176 static int necp_if_flow_count = 0;
177 static int necp_observer_message_limit = 256;
178
179 /*
180 * NECP client tracing control -
181 *
182 * necp_client_tracing_level : 1 for client trace, 2 for flow trace, 3 for parameter details
183 * necp_client_tracing_pid : match client with pid
184 */
185 static int necp_client_tracing_level = 0;
186 static int necp_client_tracing_pid = 0;
187
188 #define NECP_CLIENT_TRACE_LEVEL_CLIENT 1
189 #define NECP_CLIENT_TRACE_LEVEL_FLOW 2
190 #define NECP_CLIENT_TRACE_LEVEL_PARAMS 3
191
192 #define NECP_CLIENT_TRACE_PID_MATCHED(pid) \
193 (pid == necp_client_tracing_pid)
194
195 #define NECP_ENABLE_CLIENT_TRACE(level) \
196 ((necp_client_tracing_level >= level && \
197 (!necp_client_tracing_pid || NECP_CLIENT_TRACE_PID_MATCHED(client->proc_pid))) ? necp_client_tracing_level : 0)
198
199 #define NECP_CLIENT_LOG(client, fmt, ...) \
200 if (client && NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_CLIENT)) { \
201 uuid_string_t client_uuid_str = { }; \
202 uuid_unparse_lower(client->client_id, client_uuid_str); \
203 NECPLOG(LOG_NOTICE, "NECP_CLIENT_LOG <pid %d %s>: " fmt "\n", client ? client->proc_pid : 0, client_uuid_str, ##__VA_ARGS__); \
204 }
205
206 #define NECP_CLIENT_FLOW_LOG(client, flow, fmt, ...) \
207 if (client && flow && NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_FLOW)) { \
208 uuid_string_t client_uuid_str = { }; \
209 uuid_unparse_lower(client->client_id, client_uuid_str); \
210 uuid_string_t flow_uuid_str = { }; \
211 uuid_unparse_lower(flow->registration_id, flow_uuid_str); \
212 NECPLOG(LOG_NOTICE, "NECP CLIENT FLOW TRACE <pid %d %s> <flow %s>: " fmt "\n", client ? client->proc_pid : 0, client_uuid_str, flow_uuid_str, ##__VA_ARGS__); \
213 }
214
215 #define NECP_CLIENT_PARAMS_LOG(client, fmt, ...) \
216 if (client && NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) { \
217 uuid_string_t client_uuid_str = { }; \
218 uuid_unparse_lower(client->client_id, client_uuid_str); \
219 NECPLOG(LOG_NOTICE, "NECP_CLIENT_PARAMS_LOG <pid %d %s>: " fmt "\n", client ? client->proc_pid : 0, client_uuid_str, ##__VA_ARGS__); \
220 }
221
222 #define NECP_SOCKET_PID(so) \
223 ((so->so_flags & SOF_DELEGATED) ? so->e_pid : so->last_pid)
224
225 #define NECP_ENABLE_SOCKET_TRACE(level) \
226 ((necp_client_tracing_level >= level && \
227 (!necp_client_tracing_pid || NECP_CLIENT_TRACE_PID_MATCHED(NECP_SOCKET_PID(so)))) ? necp_client_tracing_level : 0)
228
229 #define NECP_SOCKET_PARAMS_LOG(so, fmt, ...) \
230 if (so && NECP_ENABLE_SOCKET_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) { \
231 NECPLOG(LOG_NOTICE, "NECP_SOCKET_PARAMS_LOG <pid %d>: " fmt "\n", NECP_SOCKET_PID(so), ##__VA_ARGS__); \
232 }
233
234 #define NECP_SOCKET_ATTRIBUTE_LOG(fmt, ...) \
235 if (necp_client_tracing_level >= NECP_CLIENT_TRACE_LEVEL_PARAMS) { \
236 NECPLOG(LOG_NOTICE, "NECP_SOCKET_ATTRIBUTE_LOG: " fmt "\n", ##__VA_ARGS__); \
237 }
238
239 #define NECP_CLIENT_TRACKER_LOG(pid, fmt, ...) \
240 if (pid) { \
241 NECPLOG(LOG_NOTICE, "NECP_CLIENT_TRACKER_LOG <pid %d>: " fmt "\n", pid, ##__VA_ARGS__); \
242 }
243
244 #if SKYWALK
245 static int necp_arena_count = 0;
246 static int necp_sysctl_arena_count = 0;
247 static int necp_nexus_flow_count = 0;
248
249 /* userspace stats sanity check range, same unit as TCP (see TCP_RTT_SCALE) */
250 static uint32_t necp_client_stats_rtt_floor = 1; // 32us
251 static uint32_t necp_client_stats_rtt_ceiling = 1920000; // 60s
252 const static struct sk_stats_flow ntstat_sk_stats_zero;
253 #endif /* SKYWALK */
254
255 /*
256 * Global lock to protect socket inp_necp_attributes across updates.
257 * NECP updating these attributes and clients accessing these attributes
258 * must take this lock.
259 */
260 static LCK_GRP_DECLARE(necp_socket_attr_lock_grp, "necpSocketAttrGroup");
261 LCK_MTX_DECLARE(necp_socket_attr_lock, &necp_socket_attr_lock_grp);
262
263 os_refgrp_decl(static, necp_client_refgrp, "NECPClientRefGroup", NULL);
264
265 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_FD_COUNT, client_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_fd_count, 0, "");
266 SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_FD_COUNT, observer_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_observer_fd_count, 0, "");
267 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_COUNT, client_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_count, 0, "");
268 SYSCTL_INT(_net_necp, NECPCTL_SOCKET_FLOW_COUNT, socket_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_socket_flow_count, 0, "");
269 SYSCTL_INT(_net_necp, NECPCTL_IF_FLOW_COUNT, if_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_if_flow_count, 0, "");
270 SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_MESSAGE_LIMIT, observer_message_limit, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_observer_message_limit, 256, "");
271 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_TRACING_LEVEL, necp_client_tracing_level, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_client_tracing_level, 0, "");
272 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_TRACING_PID, necp_client_tracing_pid, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_client_tracing_pid, 0, "");
273
274 #if SKYWALK
275 SYSCTL_INT(_net_necp, NECPCTL_ARENA_COUNT, arena_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_arena_count, 0, "");
276 SYSCTL_INT(_net_necp, NECPCTL_SYSCTL_ARENA_COUNT, sysctl_arena_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_sysctl_arena_count, 0, "");
277 SYSCTL_INT(_net_necp, NECPCTL_NEXUS_FLOW_COUNT, nexus_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_nexus_flow_count, 0, "");
278 #if (DEVELOPMENT || DEBUG)
279 SYSCTL_UINT(_net_necp, OID_AUTO, collect_stats_interval_us, CTLFLAG_RW | CTLFLAG_LOCKED, &necp_collect_stats_timeout_microseconds, 0, "");
280 SYSCTL_UINT(_net_necp, OID_AUTO, necp_client_stats_rtt_floor, CTLFLAG_RW | CTLFLAG_LOCKED, &necp_client_stats_rtt_floor, 0, "");
281 SYSCTL_UINT(_net_necp, OID_AUTO, necp_client_stats_rtt_ceiling, CTLFLAG_RW | CTLFLAG_LOCKED, &necp_client_stats_rtt_ceiling, 0, "");
282 #endif /* (DEVELOPMENT || DEBUG) */
283 #endif /* SKYWALK */
284
285 #define NECP_MAX_CLIENT_LIST_SIZE 1024 * 1024 // 1MB
286 #define NECP_MAX_AGENT_ACTION_SIZE 10 * 1024 // 10K
287
288 extern int tvtohz(struct timeval *);
289 extern unsigned int get_maxmtu(struct rtentry *);
290
291 // Parsed parameters
292 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR 0x00001
293 #define NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR 0x00002
294 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF 0x00004
295 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF 0x00008
296 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE 0x00010
297 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE 0x00020
298 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT 0x00040
299 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT 0x00080
300 #define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT 0x00100
301 #define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT 0x00200
302 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE 0x00400
303 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE 0x00800
304 #define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE 0x01000
305 #define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE 0x02000
306 #define NECP_PARSED_PARAMETERS_FIELD_FLAGS 0x04000
307 #define NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL 0x08000
308 #define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID 0x10000
309 #define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID 0x20000
310 #define NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS 0x40000
311 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT 0x80000
312 #define NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID 0x100000
313 #define NECP_PARSED_PARAMETERS_FIELD_ETHERTYPE 0x200000
314 #define NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL 0x400000
315 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE 0x800000
316 #define NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER 0x1000000
317 #define NECP_PARSED_PARAMETERS_FIELD_PARENT_UUID 0x2000000
318 #define NECP_PARSED_PARAMETERS_FIELD_FLOW_DEMUX_PATTERN 0x4000000
319 #define NECP_PARSED_PARAMETERS_FIELD_UID 0x8000000
320 #define NECP_PARSED_PARAMETERS_FIELD_PERSONA_ID 0x10000000
321
322
323 #define NECP_MAX_INTERFACE_PARAMETERS 16
324 #define NECP_MAX_AGENT_PARAMETERS 4
325 struct necp_client_parsed_parameters {
326 u_int32_t valid_fields;
327 u_int32_t flags;
328 u_int64_t delegated_upid;
329 union necp_sockaddr_union local_addr;
330 union necp_sockaddr_union remote_addr;
331 u_int32_t required_interface_index;
332 char prohibited_interfaces[NECP_MAX_INTERFACE_PARAMETERS][IFXNAMSIZ];
333 u_int8_t required_interface_type;
334 u_int8_t local_address_preference;
335 u_int8_t prohibited_interface_types[NECP_MAX_INTERFACE_PARAMETERS];
336 struct necp_client_parameter_netagent_type required_netagent_types[NECP_MAX_AGENT_PARAMETERS];
337 struct necp_client_parameter_netagent_type prohibited_netagent_types[NECP_MAX_AGENT_PARAMETERS];
338 struct necp_client_parameter_netagent_type preferred_netagent_types[NECP_MAX_AGENT_PARAMETERS];
339 struct necp_client_parameter_netagent_type avoided_netagent_types[NECP_MAX_AGENT_PARAMETERS];
340 uuid_t required_netagents[NECP_MAX_AGENT_PARAMETERS];
341 uuid_t prohibited_netagents[NECP_MAX_AGENT_PARAMETERS];
342 uuid_t preferred_netagents[NECP_MAX_AGENT_PARAMETERS];
343 uuid_t avoided_netagents[NECP_MAX_AGENT_PARAMETERS];
344 u_int8_t ip_protocol;
345 u_int8_t transport_protocol;
346 u_int16_t ethertype;
347 pid_t effective_pid;
348 uuid_t effective_uuid;
349 uuid_t parent_uuid;
350 u_int32_t traffic_class;
351 struct necp_demux_pattern demux_patterns[NECP_MAX_DEMUX_PATTERNS];
352 u_int8_t demux_pattern_count;
353 uid_t uid;
354 uid_t persona_id;
355 };
356
357 static bool
358 necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters,
359 u_int *return_ifindex, bool *validate_agents);
360
361 static bool
362 necp_ifnet_matches_local_address(struct ifnet *ifp, struct sockaddr *sa);
363
364 static bool
365 necp_ifnet_matches_parameters(struct ifnet *ifp,
366 struct necp_client_parsed_parameters *parsed_parameters,
367 u_int32_t override_flags,
368 u_int32_t *preferred_count,
369 bool secondary_interface,
370 bool require_scoped_field);
371
372 static const struct fileops necp_fd_ops = {
373 .fo_type = DTYPE_NETPOLICY,
374 .fo_read = fo_no_read,
375 .fo_write = fo_no_write,
376 .fo_ioctl = fo_no_ioctl,
377 .fo_select = necpop_select,
378 .fo_close = necpop_close,
379 .fo_drain = fo_no_drain,
380 .fo_kqfilter = necpop_kqfilter,
381 };
382
383 struct necp_client_assertion {
384 LIST_ENTRY(necp_client_assertion) assertion_chain;
385 uuid_t asserted_netagent;
386 };
387
388 struct necp_client_flow_header {
389 struct necp_tlv_header outer_header;
390 struct necp_tlv_header flow_id_tlv_header;
391 uuid_t flow_id;
392 struct necp_tlv_header flags_tlv_header;
393 u_int32_t flags_value;
394 struct necp_tlv_header interface_tlv_header;
395 struct necp_client_result_interface interface_value;
396 } __attribute__((__packed__));
397
398 struct necp_client_flow_protoctl_event_header {
399 struct necp_tlv_header protoctl_tlv_header;
400 struct necp_client_flow_protoctl_event protoctl_event;
401 } __attribute__((__packed__));
402
403 struct necp_client_nexus_flow_header {
404 struct necp_client_flow_header flow_header;
405 struct necp_tlv_header agent_tlv_header;
406 struct necp_client_result_netagent agent_value;
407 struct necp_tlv_header tfo_cookie_tlv_header;
408 u_int8_t tfo_cookie_value[NECP_TFO_COOKIE_LEN_MAX];
409 } __attribute__((__packed__));
410
411 #if SKYWALK
412 struct necp_arena_info;
413 #endif
414
415 struct necp_client_flow {
416 LIST_ENTRY(necp_client_flow) flow_chain;
417 unsigned invalid : 1;
418 unsigned nexus : 1; // If true, flow is a nexus; if false, flow is attached to socket
419 unsigned socket : 1;
420 unsigned viable : 1;
421 unsigned assigned : 1;
422 unsigned has_protoctl_event : 1;
423 unsigned check_tcp_heuristics : 1;
424 unsigned _reserved : 1;
425 union {
426 uuid_t nexus_agent;
427 struct {
428 void *socket_handle;
429 necp_client_flow_cb cb;
430 };
431 } u;
432 uint32_t interface_index;
433 u_short delegated_interface_index;
434 uint16_t interface_flags;
435 uint32_t necp_flow_flags;
436 struct necp_client_flow_protoctl_event protoctl_event;
437 union necp_sockaddr_union local_addr;
438 union necp_sockaddr_union remote_addr;
439
440 size_t assigned_results_length;
441 u_int8_t *assigned_results;
442 };
443
444 struct necp_client_flow_registration {
445 RB_ENTRY(necp_client_flow_registration) fd_link;
446 RB_ENTRY(necp_client_flow_registration) global_link;
447 RB_ENTRY(necp_client_flow_registration) client_link;
448 LIST_ENTRY(necp_client_flow_registration) collect_stats_chain;
449 uuid_t registration_id;
450 u_int32_t flags;
451 unsigned flow_result_read : 1;
452 unsigned defunct : 1;
453 void *interface_handle;
454 necp_client_flow_cb interface_cb;
455 struct necp_client *client;
456 LIST_HEAD(_necp_registration_flow_list, necp_client_flow) flow_list;
457 #if SKYWALK
458 struct necp_arena_info *stats_arena; /* arena where the stats objects came from */
459 void * kstats_kaddr; /* kernel snapshot of untrusted userspace stats, for calculating delta */
460 mach_vm_address_t ustats_uaddr; /* userspace stats (untrusted) */
461 nstat_userland_context stats_handler_context;
462 struct flow_stats *nexus_stats; /* shared stats objects between necp_client and skywalk */
463 #endif /* !SKYWALK */
464 u_int64_t last_interface_details __attribute__((aligned(sizeof(u_int64_t))));
465 };
466
467 static int necp_client_flow_id_cmp(struct necp_client_flow_registration *flow0, struct necp_client_flow_registration *flow1);
468
469 RB_HEAD(_necp_client_flow_tree, necp_client_flow_registration);
470 RB_PROTOTYPE_PREV(_necp_client_flow_tree, necp_client_flow_registration, client_link, necp_client_flow_id_cmp);
471 RB_GENERATE_PREV(_necp_client_flow_tree, necp_client_flow_registration, client_link, necp_client_flow_id_cmp);
472
473 #define NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT 4
474 #define NECP_CLIENT_MAX_INTERFACE_OPTIONS 32
475
476 #define NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT (NECP_CLIENT_MAX_INTERFACE_OPTIONS - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT)
477
478 struct necp_client {
479 RB_ENTRY(necp_client) link;
480 RB_ENTRY(necp_client) global_link;
481
482 decl_lck_mtx_data(, lock);
483 decl_lck_mtx_data(, route_lock);
484 os_refcnt_t reference_count;
485
486 uuid_t client_id;
487 unsigned result_read : 1;
488 unsigned group_members_read : 1;
489 unsigned allow_multiple_flows : 1;
490 unsigned legacy_client_is_flow : 1;
491
492 unsigned platform_binary : 1;
493 unsigned validated_parent : 1;
494
495 size_t result_length;
496 u_int8_t result[NECP_BASE_CLIENT_RESULT_SIZE];
497
498 necp_policy_id policy_id;
499
500 u_int8_t ip_protocol;
501 int proc_pid;
502
503 u_int64_t delegated_upid;
504
505 struct _necp_client_flow_tree flow_registrations;
506 LIST_HEAD(_necp_client_assertion_list, necp_client_assertion) assertion_list;
507
508 size_t assigned_group_members_length;
509 u_int8_t *assigned_group_members;
510
511 struct rtentry *current_route;
512
513 struct necp_client_interface_option interface_options[NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
514 struct necp_client_interface_option *extra_interface_options;
515 u_int8_t interface_option_count; // Number in interface_options + extra_interface_options
516
517 struct necp_client_result_netagent failed_trigger_agent;
518
519 void *agent_handle;
520
521 uuid_t override_euuid;
522
523 #if SKYWALK
524 netns_token port_reservation;
525 nstat_context nstat_context;
526 uuid_t latest_flow_registration_id;
527 uuid_t parent_client_id;
528 struct necp_client *original_parameters_source;
529 #endif /* !SKYWALK */
530
531 size_t parameters_length;
532 u_int8_t *parameters;
533 };
534
535 #define NECP_CLIENT_LOCK(_c) lck_mtx_lock(&_c->lock)
536 #define NECP_CLIENT_UNLOCK(_c) lck_mtx_unlock(&_c->lock)
537 #define NECP_CLIENT_ASSERT_LOCKED(_c) LCK_MTX_ASSERT(&_c->lock, LCK_MTX_ASSERT_OWNED)
538 #define NECP_CLIENT_ASSERT_UNLOCKED(_c) LCK_MTX_ASSERT(&_c->lock, LCK_MTX_ASSERT_NOTOWNED)
539
540 #define NECP_CLIENT_ROUTE_LOCK(_c) lck_mtx_lock(&_c->route_lock)
541 #define NECP_CLIENT_ROUTE_UNLOCK(_c) lck_mtx_unlock(&_c->route_lock)
542
543 static void necp_client_retain_locked(struct necp_client *client);
544 static void necp_client_retain(struct necp_client *client);
545
546 static bool necp_client_release_locked(struct necp_client *client);
547 static bool necp_client_release(struct necp_client *client);
548
549 static void
550 necp_client_add_assertion(struct necp_client *client, uuid_t netagent_uuid);
551
552 static bool
553 necp_client_remove_assertion(struct necp_client *client, uuid_t netagent_uuid);
554
555 static int
556 necp_client_copy_parameters_locked(struct necp_client *client,
557 struct necp_client_nexus_parameters *parameters);
558
559 LIST_HEAD(_necp_flow_registration_list, necp_client_flow_registration);
560 static struct _necp_flow_registration_list necp_collect_stats_flow_list;
561
562 struct necp_flow_defunct {
563 LIST_ENTRY(necp_flow_defunct) chain;
564
565 uuid_t flow_id;
566 uuid_t nexus_agent;
567 void *agent_handle;
568 int proc_pid;
569 u_int32_t flags;
570 struct necp_client_agent_parameters close_parameters;
571 bool has_close_parameters;
572 };
573
574 LIST_HEAD(_necp_flow_defunct_list, necp_flow_defunct);
575
576 static int necp_client_id_cmp(struct necp_client *client0, struct necp_client *client1);
577
578 RB_HEAD(_necp_client_tree, necp_client);
579 RB_PROTOTYPE_PREV(_necp_client_tree, necp_client, link, necp_client_id_cmp);
580 RB_GENERATE_PREV(_necp_client_tree, necp_client, link, necp_client_id_cmp);
581
582 RB_HEAD(_necp_client_global_tree, necp_client);
583 RB_PROTOTYPE_PREV(_necp_client_global_tree, necp_client, global_link, necp_client_id_cmp);
584 RB_GENERATE_PREV(_necp_client_global_tree, necp_client, global_link, necp_client_id_cmp);
585
586 RB_HEAD(_necp_fd_flow_tree, necp_client_flow_registration);
587 RB_PROTOTYPE_PREV(_necp_fd_flow_tree, necp_client_flow_registration, fd_link, necp_client_flow_id_cmp);
588 RB_GENERATE_PREV(_necp_fd_flow_tree, necp_client_flow_registration, fd_link, necp_client_flow_id_cmp);
589
590 RB_HEAD(_necp_client_flow_global_tree, necp_client_flow_registration);
591 RB_PROTOTYPE_PREV(_necp_client_flow_global_tree, necp_client_flow_registration, global_link, necp_client_flow_id_cmp);
592 RB_GENERATE_PREV(_necp_client_flow_global_tree, necp_client_flow_registration, global_link, necp_client_flow_id_cmp);
593
594 static struct _necp_client_global_tree necp_client_global_tree;
595 static struct _necp_client_flow_global_tree necp_client_flow_global_tree;
596
597 struct necp_client_update {
598 TAILQ_ENTRY(necp_client_update) chain;
599
600 uuid_t client_id;
601
602 size_t update_length;
603 struct necp_client_observer_update *update;
604 };
605
606 #if SKYWALK
607 struct necp_arena_info {
608 LIST_ENTRY(necp_arena_info) nai_chain;
609 u_int32_t nai_flags;
610 pid_t nai_proc_pid;
611 struct skmem_arena *nai_arena;
612 struct skmem_arena_mmap_info nai_mmap;
613 mach_vm_offset_t nai_roff;
614 u_int32_t nai_use_count;
615 };
616 #endif /* !SKYWALK */
617
618 #define NAIF_ATTACHED 0x1 // arena is attached to list
619 #define NAIF_REDIRECT 0x2 // arena mmap has been redirected
620 #define NAIF_DEFUNCT 0x4 // arena is now defunct
621
622 #define NECP_FD_REPORTED_AGENT_COUNT 2
623
624 struct necp_fd_reported_agents {
625 uuid_t agent_uuid[NECP_FD_REPORTED_AGENT_COUNT];
626 };
627
628 struct necp_fd_data {
629 u_int8_t necp_fd_type;
630 LIST_ENTRY(necp_fd_data) chain;
631 struct _necp_client_tree clients;
632 struct _necp_fd_flow_tree flows;
633 TAILQ_HEAD(_necp_client_update_list, necp_client_update) update_list;
634 int update_count;
635 int flags;
636
637 unsigned background : 1;
638 unsigned request_in_process_flow_divert : 1;
639
640 int proc_pid;
641 decl_lck_mtx_data(, fd_lock);
642 struct selinfo si;
643
644 struct necp_fd_reported_agents reported_agents;
645 #if SKYWALK
646 // Arenas and their mmap info for per-process stats. Stats objects are allocated from an active arena
647 // that is not redirected/defunct. The stats_arena_active keeps track of such an arena, and it also
648 // holds a reference count on the object. Each flow allocating a stats object also holds a reference
649 // the necp_arena_info (where the object got allocated from). During defunct, we redirect the mapping
650 // of the arena such that any attempt to access (read/write) will result in getting zero-filled pages.
651 // We then go thru all of the flows for the process and free the stats objects associated with them,
652 // followed by destroying the skmem region(s) associated with the arena. The stats_arena_list keeps
653 // track of all current and defunct stats arenas; there could be more than one arena created for the
654 // process as the arena destruction happens when its reference count drops to 0.
655 struct necp_arena_info *stats_arena_active;
656 LIST_HEAD(_necp_arena_info_list, necp_arena_info) stats_arena_list;
657 u_int32_t stats_arena_gencnt;
658
659 struct skmem_arena *sysctl_arena;
660 struct skmem_arena_mmap_info sysctl_mmap;
661 mach_vm_offset_t system_sysctls_roff;
662 #endif /* !SKYWALK */
663 };
664
665 #define NECP_FD_LOCK(_f) lck_mtx_lock(&_f->fd_lock)
666 #define NECP_FD_UNLOCK(_f) lck_mtx_unlock(&_f->fd_lock)
667 #define NECP_FD_ASSERT_LOCKED(_f) LCK_MTX_ASSERT(&_f->fd_lock, LCK_MTX_ASSERT_OWNED)
668 #define NECP_FD_ASSERT_UNLOCKED(_f) LCK_MTX_ASSERT(&_f->fd_lock, LCK_MTX_ASSERT_NOTOWNED)
669
670 static LIST_HEAD(_necp_fd_list, necp_fd_data) necp_fd_list;
671 static LIST_HEAD(_necp_fd_observer_list, necp_fd_data) necp_fd_observer_list;
672
673 #if SKYWALK
674 static KALLOC_TYPE_DEFINE(necp_arena_info_zone, struct necp_arena_info, NET_KT_DEFAULT);
675 #endif /* !SKYWALK */
676
677 static LCK_ATTR_DECLARE(necp_fd_mtx_attr, 0, 0);
678 static LCK_GRP_DECLARE(necp_fd_mtx_grp, "necp_fd");
679
680 static LCK_RW_DECLARE_ATTR(necp_fd_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
681 static LCK_RW_DECLARE_ATTR(necp_observer_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
682 static LCK_RW_DECLARE_ATTR(necp_client_tree_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
683 static LCK_RW_DECLARE_ATTR(necp_flow_tree_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
684 static LCK_RW_DECLARE_ATTR(necp_collect_stats_list_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
685
686
687 #define NECP_STATS_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_collect_stats_list_lock)
688 #define NECP_STATS_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_collect_stats_list_lock)
689 #define NECP_STATS_LIST_UNLOCK() lck_rw_done(&necp_collect_stats_list_lock)
690
691 #define NECP_CLIENT_TREE_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_client_tree_lock)
692 #define NECP_CLIENT_TREE_LOCK_SHARED() lck_rw_lock_shared(&necp_client_tree_lock)
693 #define NECP_CLIENT_TREE_UNLOCK() lck_rw_done(&necp_client_tree_lock)
694 #define NECP_CLIENT_TREE_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_client_tree_lock, LCK_RW_ASSERT_HELD)
695
696 #define NECP_FLOW_TREE_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_flow_tree_lock)
697 #define NECP_FLOW_TREE_LOCK_SHARED() lck_rw_lock_shared(&necp_flow_tree_lock)
698 #define NECP_FLOW_TREE_UNLOCK() lck_rw_done(&necp_flow_tree_lock)
699 #define NECP_FLOW_TREE_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_flow_tree_lock, LCK_RW_ASSERT_HELD)
700
701 #define NECP_FD_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_fd_lock)
702 #define NECP_FD_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_fd_lock)
703 #define NECP_FD_LIST_UNLOCK() lck_rw_done(&necp_fd_lock)
704 #define NECP_FD_LIST_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_fd_lock, LCK_RW_ASSERT_HELD)
705
706 #define NECP_OBSERVER_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_observer_lock)
707 #define NECP_OBSERVER_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_observer_lock)
708 #define NECP_OBSERVER_LIST_UNLOCK() lck_rw_done(&necp_observer_lock)
709
710 // Locking Notes
711
712 // Take NECP_FD_LIST_LOCK when accessing or modifying the necp_fd_list
713 // Take NECP_CLIENT_TREE_LOCK when accessing or modifying the necp_client_global_tree
714 // Take NECP_FLOW_TREE_LOCK when accessing or modifying the necp_client_flow_global_tree
715 // Take NECP_STATS_LIST_LOCK when accessing or modifying the necp_collect_stats_flow_list
716 // Take NECP_FD_LOCK when accessing or modifying an necp_fd_data entry
717 // Take NECP_CLIENT_LOCK when accessing or modifying a single necp_client
718 // Take NECP_CLIENT_ROUTE_LOCK when accessing or modifying a client's route
719
720 // Precedence, where 1 is the first lock that must be taken
721 // 1. NECP_FD_LIST_LOCK
722 // 2. NECP_FD_LOCK (any)
723 // 3. NECP_CLIENT_TREE_LOCK
724 // 4. NECP_CLIENT_LOCK (any)
725 // 5. NECP_FLOW_TREE_LOCK
726 // 6. NECP_STATS_LIST_LOCK
727 // 7. NECP_CLIENT_ROUTE_LOCK (any)
728
729 static thread_call_t necp_client_update_tcall;
730 static uint32_t necp_update_all_clients_sched_cnt = 0;
731 static uint64_t necp_update_all_clients_sched_abstime = 0;
732 static LCK_RW_DECLARE_ATTR(necp_update_all_clients_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
733 #define NECP_UPDATE_ALL_CLIENTS_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_update_all_clients_lock)
734 #define NECP_UPDATE_ALL_CLIENTS_SHARED_TO_EXCLUSIVE() lck_rw_lock_shared_to_exclusive(&necp_update_all_clients_lock)
735 #define NECP_UPDATE_ALL_CLIENTS_SHARED() lck_rw_lock_shared(&necp_update_all_clients_lock)
736 #define NECP_UPDATE_ALL_CLIENTS_UNLOCK() lck_rw_done(&necp_update_all_clients_lock)
737
738 // Array of PIDs that will trigger in-process flow divert, protected by NECP_FD_LIST_LOCK
739 #define NECP_MAX_FLOW_DIVERT_NEEDED_PIDS 4
740 static pid_t necp_flow_divert_needed_pids[NECP_MAX_FLOW_DIVERT_NEEDED_PIDS];
741
742 #if SKYWALK
743 static thread_call_t necp_client_collect_stats_tcall;
744 static thread_call_t necp_close_empty_arenas_tcall;
745
746 static void necp_fd_insert_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai);
747 static void necp_fd_remove_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai);
748 static struct necp_arena_info *necp_fd_mredirect_stats_arena(struct necp_fd_data *fd_data, struct proc *proc);
749
750 static void necp_arena_info_retain(struct necp_arena_info *nai);
751 static void necp_arena_info_release(struct necp_arena_info *nai);
752 static struct necp_arena_info *necp_arena_info_alloc(void);
753 static void necp_arena_info_free(struct necp_arena_info *nai);
754
755 static int necp_arena_initialize(struct necp_fd_data *fd_data, bool locked);
756 static int necp_stats_initialize(struct necp_fd_data *fd_data, struct necp_client *client,
757 struct necp_client_flow_registration *flow_registration, struct necp_stats_bufreq *bufreq);
758 static int necp_arena_create(struct necp_fd_data *fd_data, size_t obj_size, size_t obj_cnt, struct proc *p);
759 static int necp_arena_stats_obj_alloc(struct necp_fd_data *fd_data, mach_vm_offset_t *off, struct necp_arena_info **stats_arena, void **kstats_kaddr, boolean_t cansleep);
760 static void necp_arena_stats_obj_free(struct necp_fd_data *fd_data, struct necp_arena_info *stats_arena, void **kstats_kaddr, mach_vm_address_t *ustats_uaddr);
761 static void necp_stats_arenas_destroy(struct necp_fd_data *fd_data, boolean_t closing);
762
763 static int necp_sysctl_arena_initialize(struct necp_fd_data *fd_data, bool locked);
764 static void necp_sysctl_arena_destroy(struct necp_fd_data *fd_data);
765 static void *necp_arena_sysctls_obj(struct necp_fd_data *fd_data, mach_vm_offset_t *off, size_t *size);
766 #endif /* !SKYWALK */
767
768 void necp_copy_inp_domain_info(struct inpcb *, struct socket *, nstat_domain_info *);
769 void necp_with_inp_domain_name(struct socket *so, void *ctx, void (*with_func)(char *domain_name, void *ctx));
770
771 static void
necp_lock_socket_attributes(void)772 necp_lock_socket_attributes(void)
773 {
774 lck_mtx_lock(&necp_socket_attr_lock);
775 }
776
777 static void
necp_unlock_socket_attributes(void)778 necp_unlock_socket_attributes(void)
779 {
780 lck_mtx_unlock(&necp_socket_attr_lock);
781 }
782
783 /// NECP file descriptor functions
784
785 static void
necp_fd_notify(struct necp_fd_data * fd_data,bool locked)786 necp_fd_notify(struct necp_fd_data *fd_data, bool locked)
787 {
788 struct selinfo *si = &fd_data->si;
789
790 if (!locked) {
791 NECP_FD_LOCK(fd_data);
792 }
793
794 selwakeup(si);
795
796 // use a non-zero hint to tell the notification from the
797 // call done in kqueue_scan() which uses 0
798 KNOTE(&si->si_note, 1); // notification
799
800 if (!locked) {
801 NECP_FD_UNLOCK(fd_data);
802 }
803 }
804
805 static inline bool
necp_client_has_unread_flows(struct necp_client * client)806 necp_client_has_unread_flows(struct necp_client *client)
807 {
808 NECP_CLIENT_ASSERT_LOCKED(client);
809 struct necp_client_flow_registration *flow_registration = NULL;
810 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
811 if (!flow_registration->flow_result_read) {
812 return true;
813 }
814 }
815 return false;
816 }
817
818 static int
necp_fd_poll(struct necp_fd_data * fd_data,int events,void * wql,struct proc * p,int is_kevent)819 necp_fd_poll(struct necp_fd_data *fd_data, int events, void *wql, struct proc *p, int is_kevent)
820 {
821 #pragma unused(wql, p, is_kevent)
822 u_int revents = 0;
823
824 u_int want_rx = events & (POLLIN | POLLRDNORM);
825 if (want_rx) {
826 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
827 // Push-mode observers are readable when they have a new update
828 if (!TAILQ_EMPTY(&fd_data->update_list)) {
829 revents |= want_rx;
830 }
831 } else {
832 // Standard fds are readable when some client is unread
833 struct necp_client *client = NULL;
834 bool has_unread_clients = FALSE;
835 RB_FOREACH(client, _necp_client_tree, &fd_data->clients) {
836 NECP_CLIENT_LOCK(client);
837 if (!client->result_read || !client->group_members_read || necp_client_has_unread_flows(client)) {
838 has_unread_clients = TRUE;
839 }
840 NECP_CLIENT_UNLOCK(client);
841 if (has_unread_clients) {
842 break;
843 }
844 }
845
846 if (has_unread_clients || fd_data->request_in_process_flow_divert) {
847 revents |= want_rx;
848 }
849 }
850 }
851
852 return revents;
853 }
854
855 static inline void
necp_generate_client_id(uuid_t client_id,bool is_flow)856 necp_generate_client_id(uuid_t client_id, bool is_flow)
857 {
858 uuid_generate_random(client_id);
859
860 if (is_flow) {
861 client_id[9] |= 0x01;
862 } else {
863 client_id[9] &= ~0x01;
864 }
865 }
866
867 static inline bool
necp_client_id_is_flow(uuid_t client_id)868 necp_client_id_is_flow(uuid_t client_id)
869 {
870 return client_id[9] & 0x01;
871 }
872
873 static struct necp_client *
necp_find_client_and_lock(uuid_t client_id)874 necp_find_client_and_lock(uuid_t client_id)
875 {
876 NECP_CLIENT_TREE_ASSERT_LOCKED();
877
878 struct necp_client *client = NULL;
879
880 if (necp_client_id_is_flow(client_id)) {
881 NECP_FLOW_TREE_LOCK_SHARED();
882 struct necp_client_flow_registration find;
883 uuid_copy(find.registration_id, client_id);
884 struct necp_client_flow_registration *flow = RB_FIND(_necp_client_flow_global_tree, &necp_client_flow_global_tree, &find);
885 if (flow != NULL) {
886 client = flow->client;
887 }
888 NECP_FLOW_TREE_UNLOCK();
889 } else {
890 struct necp_client find;
891 uuid_copy(find.client_id, client_id);
892 client = RB_FIND(_necp_client_global_tree, &necp_client_global_tree, &find);
893 }
894
895 if (client != NULL) {
896 NECP_CLIENT_LOCK(client);
897 }
898
899 return client;
900 }
901
902 static struct necp_client_flow_registration *
necp_client_find_flow(struct necp_client * client,uuid_t flow_id)903 necp_client_find_flow(struct necp_client *client, uuid_t flow_id)
904 {
905 NECP_CLIENT_ASSERT_LOCKED(client);
906 struct necp_client_flow_registration *flow = NULL;
907
908 if (necp_client_id_is_flow(flow_id)) {
909 struct necp_client_flow_registration find;
910 uuid_copy(find.registration_id, flow_id);
911 flow = RB_FIND(_necp_client_flow_tree, &client->flow_registrations, &find);
912 } else {
913 flow = RB_ROOT(&client->flow_registrations);
914 }
915
916 return flow;
917 }
918
919 static struct necp_client *
necp_client_fd_find_client_unlocked(struct necp_fd_data * client_fd,uuid_t client_id)920 necp_client_fd_find_client_unlocked(struct necp_fd_data *client_fd, uuid_t client_id)
921 {
922 NECP_FD_ASSERT_LOCKED(client_fd);
923 struct necp_client *client = NULL;
924
925 if (necp_client_id_is_flow(client_id)) {
926 struct necp_client_flow_registration find;
927 uuid_copy(find.registration_id, client_id);
928 struct necp_client_flow_registration *flow = RB_FIND(_necp_fd_flow_tree, &client_fd->flows, &find);
929 if (flow != NULL) {
930 client = flow->client;
931 }
932 } else {
933 struct necp_client find;
934 uuid_copy(find.client_id, client_id);
935 client = RB_FIND(_necp_client_tree, &client_fd->clients, &find);
936 }
937
938 return client;
939 }
940
941 static struct necp_client *
necp_client_fd_find_client_and_lock(struct necp_fd_data * client_fd,uuid_t client_id)942 necp_client_fd_find_client_and_lock(struct necp_fd_data *client_fd, uuid_t client_id)
943 {
944 struct necp_client *client = necp_client_fd_find_client_unlocked(client_fd, client_id);
945 if (client != NULL) {
946 NECP_CLIENT_LOCK(client);
947 }
948
949 return client;
950 }
951
952 static inline int
necp_client_id_cmp(struct necp_client * client0,struct necp_client * client1)953 necp_client_id_cmp(struct necp_client *client0, struct necp_client *client1)
954 {
955 return uuid_compare(client0->client_id, client1->client_id);
956 }
957
958 static inline int
necp_client_flow_id_cmp(struct necp_client_flow_registration * flow0,struct necp_client_flow_registration * flow1)959 necp_client_flow_id_cmp(struct necp_client_flow_registration *flow0, struct necp_client_flow_registration *flow1)
960 {
961 return uuid_compare(flow0->registration_id, flow1->registration_id);
962 }
963
964 static int
necpop_select(struct fileproc * fp,int which,void * wql,vfs_context_t ctx)965 necpop_select(struct fileproc *fp, int which, void *wql, vfs_context_t ctx)
966 {
967 #pragma unused(fp, which, wql, ctx)
968 return 0;
969 struct necp_fd_data *fd_data = NULL;
970 int revents = 0;
971 int events = 0;
972 proc_t procp;
973
974 fd_data = (struct necp_fd_data *)fp_get_data(fp);
975 if (fd_data == NULL) {
976 return 0;
977 }
978
979 procp = vfs_context_proc(ctx);
980
981 switch (which) {
982 case FREAD: {
983 events = POLLIN;
984 break;
985 }
986
987 default: {
988 return 1;
989 }
990 }
991
992 NECP_FD_LOCK(fd_data);
993 revents = necp_fd_poll(fd_data, events, wql, procp, 0);
994 NECP_FD_UNLOCK(fd_data);
995
996 return (events & revents) ? 1 : 0;
997 }
998
999 static void
necp_fd_knrdetach(struct knote * kn)1000 necp_fd_knrdetach(struct knote *kn)
1001 {
1002 struct necp_fd_data *fd_data = (struct necp_fd_data *)knote_kn_hook_get_raw(kn);
1003 struct selinfo *si = &fd_data->si;
1004
1005 NECP_FD_LOCK(fd_data);
1006 KNOTE_DETACH(&si->si_note, kn);
1007 NECP_FD_UNLOCK(fd_data);
1008 }
1009
1010 static int
necp_fd_knread(struct knote * kn,long hint)1011 necp_fd_knread(struct knote *kn, long hint)
1012 {
1013 #pragma unused(kn, hint)
1014 return 1; /* assume we are ready */
1015 }
1016
1017 static int
necp_fd_knrprocess(struct knote * kn,struct kevent_qos_s * kev)1018 necp_fd_knrprocess(struct knote *kn, struct kevent_qos_s *kev)
1019 {
1020 struct necp_fd_data *fd_data;
1021 int revents;
1022 int res;
1023
1024 fd_data = (struct necp_fd_data *)knote_kn_hook_get_raw(kn);
1025
1026 NECP_FD_LOCK(fd_data);
1027 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
1028 res = ((revents & POLLIN) != 0);
1029 if (res) {
1030 knote_fill_kevent(kn, kev, 0);
1031 }
1032 NECP_FD_UNLOCK(fd_data);
1033 return res;
1034 }
1035
1036 static int
necp_fd_knrtouch(struct knote * kn,struct kevent_qos_s * kev)1037 necp_fd_knrtouch(struct knote *kn, struct kevent_qos_s *kev)
1038 {
1039 #pragma unused(kev)
1040 struct necp_fd_data *fd_data;
1041 int revents;
1042
1043 fd_data = (struct necp_fd_data *)knote_kn_hook_get_raw(kn);
1044
1045 NECP_FD_LOCK(fd_data);
1046 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
1047 NECP_FD_UNLOCK(fd_data);
1048
1049 return (revents & POLLIN) != 0;
1050 }
1051
1052 SECURITY_READ_ONLY_EARLY(struct filterops) necp_fd_rfiltops = {
1053 .f_isfd = 1,
1054 .f_detach = necp_fd_knrdetach,
1055 .f_event = necp_fd_knread,
1056 .f_touch = necp_fd_knrtouch,
1057 .f_process = necp_fd_knrprocess,
1058 };
1059
1060 static int
necpop_kqfilter(struct fileproc * fp,struct knote * kn,__unused struct kevent_qos_s * kev)1061 necpop_kqfilter(struct fileproc *fp, struct knote *kn,
1062 __unused struct kevent_qos_s *kev)
1063 {
1064 struct necp_fd_data *fd_data = NULL;
1065 int revents;
1066
1067 if (kn->kn_filter != EVFILT_READ) {
1068 NECPLOG(LOG_ERR, "bad filter request %d", kn->kn_filter);
1069 knote_set_error(kn, EINVAL);
1070 return 0;
1071 }
1072
1073 fd_data = (struct necp_fd_data *)fp_get_data(fp);
1074 if (fd_data == NULL) {
1075 NECPLOG0(LOG_ERR, "No channel for kqfilter");
1076 knote_set_error(kn, ENOENT);
1077 return 0;
1078 }
1079
1080 NECP_FD_LOCK(fd_data);
1081 kn->kn_filtid = EVFILTID_NECP_FD;
1082 knote_kn_hook_set_raw(kn, fd_data);
1083 KNOTE_ATTACH(&fd_data->si.si_note, kn);
1084
1085 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
1086
1087 NECP_FD_UNLOCK(fd_data);
1088
1089 return (revents & POLLIN) != 0;
1090 }
1091
1092 #define INTERFACE_FLAGS_SHIFT 32
1093 #define INTERFACE_FLAGS_MASK 0xffff
1094 #define INTERFACE_INDEX_SHIFT 0
1095 #define INTERFACE_INDEX_MASK 0xffffffff
1096
1097 static uint64_t
combine_interface_details(uint32_t interface_index,uint16_t interface_flags)1098 combine_interface_details(uint32_t interface_index, uint16_t interface_flags)
1099 {
1100 return ((uint64_t)interface_flags & INTERFACE_FLAGS_MASK) << INTERFACE_FLAGS_SHIFT |
1101 ((uint64_t)interface_index & INTERFACE_INDEX_MASK) << INTERFACE_INDEX_SHIFT;
1102 }
1103
1104 #if SKYWALK
1105
1106 static void
split_interface_details(uint64_t combined_details,uint32_t * interface_index,uint16_t * interface_flags)1107 split_interface_details(uint64_t combined_details, uint32_t *interface_index, uint16_t *interface_flags)
1108 {
1109 *interface_index = (combined_details >> INTERFACE_INDEX_SHIFT) & INTERFACE_INDEX_MASK;
1110 *interface_flags = (combined_details >> INTERFACE_FLAGS_SHIFT) & INTERFACE_FLAGS_MASK;
1111 }
1112
1113 static void
necp_flow_save_current_interface_details(struct necp_client_flow_registration * flow_registration)1114 necp_flow_save_current_interface_details(struct necp_client_flow_registration *flow_registration)
1115 {
1116 struct necp_client_flow *flow = NULL;
1117 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1118 if (flow->nexus) {
1119 uint64_t combined_details = combine_interface_details(flow->interface_index, flow->interface_flags);
1120 os_atomic_store(&flow_registration->last_interface_details, combined_details, release);
1121 break;
1122 }
1123 }
1124 }
1125
1126 static void
necp_client_collect_interface_stats(struct necp_client_flow_registration * flow_registration,struct ifnet_stats_per_flow * ifs)1127 necp_client_collect_interface_stats(struct necp_client_flow_registration *flow_registration, struct ifnet_stats_per_flow *ifs)
1128 {
1129 struct necp_client_flow *flow = NULL;
1130
1131 if (ifs == NULL || ifs->txpackets == 0 || ifs->rxpackets == 0) {
1132 return; // App might have crashed without publishing ifs
1133 }
1134
1135 // Do malicious stats detection here
1136
1137 // Fold userspace stats into (trusted) kernel stats (stored in ifp).
1138 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1139 uint32_t if_idx = flow->interface_index;
1140 ifnet_t ifp = NULL;
1141 ifnet_head_lock_shared();
1142 if (if_idx != IFSCOPE_NONE && if_idx <= (uint32_t)if_index) {
1143 ifp = ifindex2ifnet[if_idx];
1144 ifnet_update_stats_per_flow(ifs, ifp);
1145 }
1146 ifnet_head_done();
1147
1148 // Currently there is only one flow that uses the shared necp
1149 // stats region, so this loop should exit after updating an ifp
1150 break;
1151 }
1152 }
1153
1154 static void
necp_client_collect_stats(struct necp_client_flow_registration * flow_registration)1155 necp_client_collect_stats(struct necp_client_flow_registration *flow_registration)
1156 {
1157 struct necp_all_kstats *kstats = (struct necp_all_kstats *)flow_registration->kstats_kaddr;
1158 if (kstats == NULL) {
1159 return;
1160 }
1161
1162 // Grab userspace stats delta (untrusted).
1163 struct necp_tcp_stats *curr_tcpstats = (struct necp_tcp_stats *)kstats->necp_stats_ustats;
1164 struct necp_tcp_stats *prev_tcpstats = (struct necp_tcp_stats *)&kstats->necp_stats_comm;
1165 #define diff_n_update(field) \
1166 u_int32_t d_##field = (curr_tcpstats->necp_tcp_counts.necp_stat_##field - prev_tcpstats->necp_tcp_counts.necp_stat_##field); \
1167 prev_tcpstats->necp_tcp_counts.necp_stat_##field += d_##field;
1168 diff_n_update(rxpackets);
1169 diff_n_update(txpackets);
1170 if (d_rxpackets == 0 && d_txpackets == 0) {
1171 return; // no activity since last collection, stop here
1172 }
1173 diff_n_update(rxbytes);
1174 diff_n_update(txbytes);
1175 diff_n_update(rxduplicatebytes);
1176 diff_n_update(rxoutoforderbytes);
1177 diff_n_update(txretransmit);
1178 diff_n_update(connectattempts);
1179 diff_n_update(connectsuccesses);
1180 uint32_t rtt = prev_tcpstats->necp_tcp_counts.necp_stat_avg_rtt = curr_tcpstats->necp_tcp_counts.necp_stat_avg_rtt;
1181 uint32_t rtt_var = prev_tcpstats->necp_tcp_counts.necp_stat_var_rtt = curr_tcpstats->necp_tcp_counts.necp_stat_var_rtt;
1182 #undef diff_n_update
1183
1184 // Do malicious stats detection with the deltas here.
1185 // RTT check (not necessarily attacks, might just be not measured since we report stats async periodically).
1186 if (rtt < necp_client_stats_rtt_floor || rtt > necp_client_stats_rtt_ceiling) {
1187 rtt = rtt_var = 0; // nstat_route_update to skip 0 rtt
1188 }
1189
1190 // Fold userspace stats into (trusted) kernel stats (stored in route).
1191 NECP_CLIENT_ROUTE_LOCK(flow_registration->client);
1192 struct rtentry *route = flow_registration->client->current_route;
1193 if (route != NULL) {
1194 nstat_route_update(route, d_connectattempts, d_connectsuccesses, d_rxpackets, d_rxbytes, d_rxduplicatebytes,
1195 d_rxoutoforderbytes, d_txpackets, d_txbytes, d_txretransmit, rtt, rtt_var);
1196 }
1197 NECP_CLIENT_ROUTE_UNLOCK(flow_registration->client);
1198 }
1199
1200 // This is called from various places; "closing" here implies the client being closed/removed if true, otherwise being
1201 // defunct. In the former, we expect the caller to not hold the lock; for the latter it must have acquired it.
1202 static void
necp_destroy_flow_stats(struct necp_fd_data * fd_data,struct necp_client_flow_registration * flow_registration,struct ifnet_stats_per_flow * flow_ifnet_stats,boolean_t closing)1203 necp_destroy_flow_stats(struct necp_fd_data *fd_data,
1204 struct necp_client_flow_registration *flow_registration,
1205 struct ifnet_stats_per_flow *flow_ifnet_stats,
1206 boolean_t closing)
1207 {
1208 NECP_FD_ASSERT_LOCKED(fd_data);
1209
1210 struct necp_client *client = flow_registration->client;
1211
1212 if (closing) {
1213 NECP_CLIENT_ASSERT_UNLOCKED(client);
1214 NECP_CLIENT_LOCK(client);
1215 } else {
1216 NECP_CLIENT_ASSERT_LOCKED(client);
1217 }
1218
1219 // the interface stats are independent of the flow stats, hence we check here
1220 if (flow_ifnet_stats != NULL) {
1221 necp_client_collect_interface_stats(flow_registration, flow_ifnet_stats);
1222 }
1223
1224 if (flow_registration->kstats_kaddr != NULL) {
1225 NECP_STATS_LIST_LOCK_EXCLUSIVE();
1226 necp_client_collect_stats(flow_registration);
1227 const bool destroyed = necp_client_release_locked(client); // Drop the reference held by the stats list
1228 ASSERT(!destroyed);
1229 (void)destroyed;
1230 LIST_REMOVE(flow_registration, collect_stats_chain);
1231 NECP_STATS_LIST_UNLOCK();
1232 if (flow_registration->stats_handler_context != NULL) {
1233 ntstat_userland_stats_close(flow_registration->stats_handler_context);
1234 flow_registration->stats_handler_context = NULL;
1235 }
1236 necp_arena_stats_obj_free(fd_data, flow_registration->stats_arena, &flow_registration->kstats_kaddr, &flow_registration->ustats_uaddr);
1237 ASSERT(flow_registration->kstats_kaddr == NULL);
1238 ASSERT(flow_registration->ustats_uaddr == 0);
1239 }
1240
1241 if (flow_registration->nexus_stats != NULL) {
1242 flow_stats_release(flow_registration->nexus_stats);
1243 flow_registration->nexus_stats = NULL;
1244 }
1245
1246 if (closing) {
1247 NECP_CLIENT_UNLOCK(client);
1248 }
1249 }
1250
1251 static void
necp_schedule_collect_stats_clients(bool recur)1252 necp_schedule_collect_stats_clients(bool recur)
1253 {
1254 if (necp_client_collect_stats_tcall == NULL ||
1255 (!recur && thread_call_isactive(necp_client_collect_stats_tcall))) {
1256 return;
1257 }
1258
1259 uint64_t deadline = 0;
1260 uint64_t leeway = 0;
1261 clock_interval_to_deadline(necp_collect_stats_timeout_microseconds, NSEC_PER_USEC, &deadline);
1262 clock_interval_to_absolutetime_interval(necp_collect_stats_timeout_leeway_microseconds, NSEC_PER_USEC, &leeway);
1263
1264 thread_call_enter_delayed_with_leeway(necp_client_collect_stats_tcall, NULL,
1265 deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
1266 }
1267
1268 static void
necp_collect_stats_client_callout(__unused thread_call_param_t dummy,__unused thread_call_param_t arg)1269 necp_collect_stats_client_callout(__unused thread_call_param_t dummy,
1270 __unused thread_call_param_t arg)
1271 {
1272 struct necp_client_flow_registration *flow_registration;
1273
1274 net_update_uptime();
1275 NECP_STATS_LIST_LOCK_SHARED();
1276 if (LIST_EMPTY(&necp_collect_stats_flow_list)) {
1277 NECP_STATS_LIST_UNLOCK();
1278 return;
1279 }
1280 LIST_FOREACH(flow_registration, &necp_collect_stats_flow_list, collect_stats_chain) {
1281 // Collecting stats should be cheap (atomic increments)
1282 // Values like flow_registration->kstats_kaddr are guaranteed to be valid
1283 // as long as the flow_registration is in the stats list
1284 necp_client_collect_stats(flow_registration);
1285 }
1286 NECP_STATS_LIST_UNLOCK();
1287
1288 necp_schedule_collect_stats_clients(TRUE); // recurring collection
1289 }
1290
1291 #endif /* !SKYWALK */
1292
1293 static void
necp_defunct_flow_registration(struct necp_client * client,struct necp_client_flow_registration * flow_registration,struct _necp_flow_defunct_list * defunct_list)1294 necp_defunct_flow_registration(struct necp_client *client,
1295 struct necp_client_flow_registration *flow_registration,
1296 struct _necp_flow_defunct_list *defunct_list)
1297 {
1298 NECP_CLIENT_ASSERT_LOCKED(client);
1299
1300 if (!flow_registration->defunct) {
1301 bool needs_defunct = false;
1302 struct necp_client_flow *search_flow = NULL;
1303 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
1304 if (search_flow->nexus &&
1305 !uuid_is_null(search_flow->u.nexus_agent)) {
1306 // Save defunct values for the nexus
1307 if (defunct_list != NULL) {
1308 // Sleeping alloc won't fail; copy only what's necessary
1309 struct necp_flow_defunct *flow_defunct = kalloc_type(struct necp_flow_defunct,
1310 Z_WAITOK | Z_ZERO);
1311 uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent);
1312 uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
1313 client->client_id :
1314 flow_registration->registration_id));
1315 flow_defunct->proc_pid = client->proc_pid;
1316 flow_defunct->agent_handle = client->agent_handle;
1317 flow_defunct->flags = flow_registration->flags;
1318 #if SKYWALK
1319 if (flow_registration->kstats_kaddr != NULL) {
1320 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
1321 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
1322 if (quicstats != NULL) {
1323 memcpy(flow_defunct->close_parameters.u.close_token, quicstats->necp_quic_extra.ssr_token, sizeof(flow_defunct->close_parameters.u.close_token));
1324 flow_defunct->has_close_parameters = true;
1325 }
1326 }
1327 #endif /* SKYWALK */
1328 // Add to the list provided by caller
1329 LIST_INSERT_HEAD(defunct_list, flow_defunct, chain);
1330 }
1331
1332 needs_defunct = true;
1333 }
1334 }
1335
1336 if (needs_defunct) {
1337 #if SKYWALK
1338 // Close the stats early
1339 if (flow_registration->stats_handler_context != NULL) {
1340 ntstat_userland_stats_event(flow_registration->stats_handler_context,
1341 NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT);
1342 }
1343 #endif /* SKYWALK */
1344
1345 // Only set defunct if there was some assigned flow
1346 flow_registration->defunct = true;
1347 }
1348 }
1349 }
1350
1351 static void
necp_defunct_client_for_policy(struct necp_client * client,struct _necp_flow_defunct_list * defunct_list)1352 necp_defunct_client_for_policy(struct necp_client *client,
1353 struct _necp_flow_defunct_list *defunct_list)
1354 {
1355 NECP_CLIENT_ASSERT_LOCKED(client);
1356
1357 struct necp_client_flow_registration *flow_registration = NULL;
1358 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
1359 necp_defunct_flow_registration(client, flow_registration, defunct_list);
1360 }
1361 }
1362
1363 static void
necp_client_free(struct necp_client * client)1364 necp_client_free(struct necp_client *client)
1365 {
1366 NECP_CLIENT_ASSERT_UNLOCKED(client);
1367
1368 kfree_data(client->extra_interface_options,
1369 sizeof(struct necp_client_interface_option) * NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT);
1370 client->extra_interface_options = NULL;
1371
1372 kfree_data(client->parameters, client->parameters_length);
1373 client->parameters = NULL;
1374
1375 kfree_data(client->assigned_group_members, client->assigned_group_members_length);
1376 client->assigned_group_members = NULL;
1377
1378 lck_mtx_destroy(&client->route_lock, &necp_fd_mtx_grp);
1379 lck_mtx_destroy(&client->lock, &necp_fd_mtx_grp);
1380
1381 kfree_type(struct necp_client, client);
1382 }
1383
1384 static void
necp_client_retain_locked(struct necp_client * client)1385 necp_client_retain_locked(struct necp_client *client)
1386 {
1387 NECP_CLIENT_ASSERT_LOCKED(client);
1388
1389 os_ref_retain_locked(&client->reference_count);
1390 }
1391
1392 static void
necp_client_retain(struct necp_client * client)1393 necp_client_retain(struct necp_client *client)
1394 {
1395 NECP_CLIENT_LOCK(client);
1396 necp_client_retain_locked(client);
1397 NECP_CLIENT_UNLOCK(client);
1398 }
1399
1400 static bool
necp_client_release_locked(struct necp_client * client)1401 necp_client_release_locked(struct necp_client *client)
1402 {
1403 NECP_CLIENT_ASSERT_LOCKED(client);
1404
1405 os_ref_count_t count = os_ref_release_locked(&client->reference_count);
1406 if (count == 0) {
1407 NECP_CLIENT_UNLOCK(client);
1408 necp_client_free(client);
1409 }
1410
1411 return count == 0;
1412 }
1413
1414 static bool
necp_client_release(struct necp_client * client)1415 necp_client_release(struct necp_client *client)
1416 {
1417 bool last_ref;
1418
1419 NECP_CLIENT_LOCK(client);
1420 if (!(last_ref = necp_client_release_locked(client))) {
1421 NECP_CLIENT_UNLOCK(client);
1422 }
1423
1424 return last_ref;
1425 }
1426
1427 static struct necp_client_update *
necp_client_update_alloc(const void * data,size_t length)1428 necp_client_update_alloc(const void *data, size_t length)
1429 {
1430 struct necp_client_update *client_update;
1431 struct necp_client_observer_update *buffer;
1432 size_t alloc_size;
1433
1434 if (os_add_overflow(length, sizeof(*buffer), &alloc_size)) {
1435 return NULL;
1436 }
1437 buffer = kalloc_data(alloc_size, Z_WAITOK);
1438 if (buffer == NULL) {
1439 return NULL;
1440 }
1441
1442 client_update = kalloc_type(struct necp_client_update,
1443 Z_WAITOK | Z_ZERO | Z_NOFAIL);
1444 client_update->update_length = alloc_size;
1445 client_update->update = buffer;
1446 memcpy(buffer->tlv_buffer, data, length);
1447 return client_update;
1448 }
1449
1450 static void
necp_client_update_free(struct necp_client_update * client_update)1451 necp_client_update_free(struct necp_client_update *client_update)
1452 {
1453 kfree_data(client_update->update, client_update->update_length);
1454 kfree_type(struct necp_client_update, client_update);
1455 }
1456
1457 static void
necp_client_update_observer_add_internal(struct necp_fd_data * observer_fd,struct necp_client * client)1458 necp_client_update_observer_add_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1459 {
1460 struct necp_client_update *client_update;
1461
1462 NECP_FD_LOCK(observer_fd);
1463
1464 if (observer_fd->update_count >= necp_observer_message_limit) {
1465 NECP_FD_UNLOCK(observer_fd);
1466 return;
1467 }
1468
1469 client_update = necp_client_update_alloc(client->parameters, client->parameters_length);
1470 if (client_update != NULL) {
1471 uuid_copy(client_update->client_id, client->client_id);
1472 client_update->update->update_type = NECP_CLIENT_UPDATE_TYPE_PARAMETERS;
1473 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1474 observer_fd->update_count++;
1475
1476 necp_fd_notify(observer_fd, true);
1477 }
1478
1479 NECP_FD_UNLOCK(observer_fd);
1480 }
1481
1482 static void
necp_client_update_observer_update_internal(struct necp_fd_data * observer_fd,struct necp_client * client)1483 necp_client_update_observer_update_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1484 {
1485 NECP_FD_LOCK(observer_fd);
1486
1487 if (observer_fd->update_count >= necp_observer_message_limit) {
1488 NECP_FD_UNLOCK(observer_fd);
1489 return;
1490 }
1491
1492 struct necp_client_update *client_update = necp_client_update_alloc(client->result, client->result_length);
1493 if (client_update != NULL) {
1494 uuid_copy(client_update->client_id, client->client_id);
1495 client_update->update->update_type = NECP_CLIENT_UPDATE_TYPE_RESULT;
1496 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1497 observer_fd->update_count++;
1498
1499 necp_fd_notify(observer_fd, true);
1500 }
1501
1502 NECP_FD_UNLOCK(observer_fd);
1503 }
1504
1505 static void
necp_client_update_observer_remove_internal(struct necp_fd_data * observer_fd,struct necp_client * client)1506 necp_client_update_observer_remove_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1507 {
1508 NECP_FD_LOCK(observer_fd);
1509
1510 if (observer_fd->update_count >= necp_observer_message_limit) {
1511 NECP_FD_UNLOCK(observer_fd);
1512 return;
1513 }
1514
1515 struct necp_client_update *client_update = necp_client_update_alloc(NULL, 0);
1516 if (client_update != NULL) {
1517 uuid_copy(client_update->client_id, client->client_id);
1518 client_update->update->update_type = NECP_CLIENT_UPDATE_TYPE_REMOVE;
1519 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1520 observer_fd->update_count++;
1521
1522 necp_fd_notify(observer_fd, true);
1523 }
1524
1525 NECP_FD_UNLOCK(observer_fd);
1526 }
1527
1528 static void
necp_client_update_observer_add(struct necp_client * client)1529 necp_client_update_observer_add(struct necp_client *client)
1530 {
1531 NECP_OBSERVER_LIST_LOCK_SHARED();
1532
1533 if (LIST_EMPTY(&necp_fd_observer_list)) {
1534 // No observers, bail
1535 NECP_OBSERVER_LIST_UNLOCK();
1536 return;
1537 }
1538
1539 struct necp_fd_data *observer_fd = NULL;
1540 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1541 necp_client_update_observer_add_internal(observer_fd, client);
1542 }
1543
1544 NECP_OBSERVER_LIST_UNLOCK();
1545 }
1546
1547 static void
necp_client_update_observer_update(struct necp_client * client)1548 necp_client_update_observer_update(struct necp_client *client)
1549 {
1550 NECP_OBSERVER_LIST_LOCK_SHARED();
1551
1552 if (LIST_EMPTY(&necp_fd_observer_list)) {
1553 // No observers, bail
1554 NECP_OBSERVER_LIST_UNLOCK();
1555 return;
1556 }
1557
1558 struct necp_fd_data *observer_fd = NULL;
1559 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1560 necp_client_update_observer_update_internal(observer_fd, client);
1561 }
1562
1563 NECP_OBSERVER_LIST_UNLOCK();
1564 }
1565
1566 static void
necp_client_update_observer_remove(struct necp_client * client)1567 necp_client_update_observer_remove(struct necp_client *client)
1568 {
1569 NECP_OBSERVER_LIST_LOCK_SHARED();
1570
1571 if (LIST_EMPTY(&necp_fd_observer_list)) {
1572 // No observers, bail
1573 NECP_OBSERVER_LIST_UNLOCK();
1574 return;
1575 }
1576
1577 struct necp_fd_data *observer_fd = NULL;
1578 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1579 necp_client_update_observer_remove_internal(observer_fd, client);
1580 }
1581
1582 NECP_OBSERVER_LIST_UNLOCK();
1583 }
1584
1585 static void
necp_destroy_client_flow_registration(struct necp_client * client,struct necp_client_flow_registration * flow_registration,pid_t pid,bool abort)1586 necp_destroy_client_flow_registration(struct necp_client *client,
1587 struct necp_client_flow_registration *flow_registration,
1588 pid_t pid, bool abort)
1589 {
1590 NECP_CLIENT_ASSERT_LOCKED(client);
1591
1592 bool has_close_parameters = false;
1593 struct necp_client_agent_parameters close_parameters = {};
1594 memset(close_parameters.u.close_token, 0, sizeof(close_parameters.u.close_token));
1595 #if SKYWALK
1596 if (flow_registration->kstats_kaddr != NULL) {
1597 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
1598 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
1599 if (quicstats != NULL &&
1600 quicstats->necp_quic_udp_stats.necp_udp_hdr.necp_stats_type == NECP_CLIENT_STATISTICS_TYPE_QUIC) {
1601 memcpy(close_parameters.u.close_token, quicstats->necp_quic_extra.ssr_token, sizeof(close_parameters.u.close_token));
1602 has_close_parameters = true;
1603 }
1604 }
1605
1606 // Release reference held on the stats arena
1607 if (flow_registration->stats_arena != NULL) {
1608 necp_arena_info_release(flow_registration->stats_arena);
1609 flow_registration->stats_arena = NULL;
1610 }
1611 #endif /* SKYWALK */
1612
1613 struct necp_client_flow *search_flow = NULL;
1614 struct necp_client_flow *temp_flow = NULL;
1615 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
1616 if (search_flow->nexus &&
1617 !uuid_is_null(search_flow->u.nexus_agent)) {
1618 // Don't unregister for defunct flows
1619 if (!flow_registration->defunct) {
1620 u_int8_t message_type = (abort ? NETAGENT_MESSAGE_TYPE_ABORT_NEXUS :
1621 NETAGENT_MESSAGE_TYPE_CLOSE_NEXUS);
1622 if (((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
1623 (flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
1624 !(flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
1625 message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
1626 }
1627 int netagent_error = netagent_client_message_with_params(search_flow->u.nexus_agent,
1628 ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
1629 client->client_id :
1630 flow_registration->registration_id),
1631 pid, client->agent_handle,
1632 message_type,
1633 has_close_parameters ? &close_parameters : NULL,
1634 NULL, 0);
1635 if (netagent_error != 0 && netagent_error != ENOENT) {
1636 NECPLOG(LOG_ERR, "necp_client_remove close nexus error (%d) MESSAGE TYPE %u", netagent_error, message_type);
1637 }
1638 }
1639 uuid_clear(search_flow->u.nexus_agent);
1640 }
1641 if (search_flow->assigned_results != NULL) {
1642 kfree_data(search_flow->assigned_results, search_flow->assigned_results_length);
1643 search_flow->assigned_results = NULL;
1644 }
1645 LIST_REMOVE(search_flow, flow_chain);
1646 #if SKYWALK
1647 if (search_flow->nexus) {
1648 OSDecrementAtomic(&necp_nexus_flow_count);
1649 } else
1650 #endif /* SKYWALK */
1651 if (search_flow->socket) {
1652 OSDecrementAtomic(&necp_socket_flow_count);
1653 } else {
1654 OSDecrementAtomic(&necp_if_flow_count);
1655 }
1656 kfree_type(struct necp_client_flow, search_flow);
1657 }
1658
1659 RB_REMOVE(_necp_client_flow_tree, &client->flow_registrations, flow_registration);
1660 flow_registration->client = NULL;
1661
1662 kfree_type(struct necp_client_flow_registration, flow_registration);
1663 }
1664
1665 static void
necp_destroy_client(struct necp_client * client,pid_t pid,bool abort)1666 necp_destroy_client(struct necp_client *client, pid_t pid, bool abort)
1667 {
1668 NECP_CLIENT_ASSERT_UNLOCKED(client);
1669
1670 #if SKYWALK
1671 if (client->nstat_context != NULL) {
1672 // This is a catch-all that should be rarely used.
1673 nstat_provider_stats_close(client->nstat_context);
1674 client->nstat_context = NULL;
1675 }
1676 if (client->original_parameters_source != NULL) {
1677 necp_client_release(client->original_parameters_source);
1678 client->original_parameters_source = NULL;
1679 }
1680 #endif /* SKYWALK */
1681 necp_client_update_observer_remove(client);
1682
1683 NECP_CLIENT_LOCK(client);
1684
1685 // Free route
1686 NECP_CLIENT_ROUTE_LOCK(client);
1687 if (client->current_route != NULL) {
1688 rtfree(client->current_route);
1689 client->current_route = NULL;
1690 }
1691 NECP_CLIENT_ROUTE_UNLOCK(client);
1692
1693 // Remove flow assignments
1694 struct necp_client_flow_registration *flow_registration = NULL;
1695 struct necp_client_flow_registration *temp_flow_registration = NULL;
1696 RB_FOREACH_SAFE(flow_registration, _necp_client_flow_tree, &client->flow_registrations, temp_flow_registration) {
1697 necp_destroy_client_flow_registration(client, flow_registration, pid, abort);
1698 }
1699
1700 #if SKYWALK
1701 // Remove port reservation
1702 if (NETNS_TOKEN_VALID(&client->port_reservation)) {
1703 netns_release(&client->port_reservation);
1704 }
1705 #endif /* !SKYWALK */
1706
1707 // Remove agent assertions
1708 struct necp_client_assertion *search_assertion = NULL;
1709 struct necp_client_assertion *temp_assertion = NULL;
1710 LIST_FOREACH_SAFE(search_assertion, &client->assertion_list, assertion_chain, temp_assertion) {
1711 int netagent_error = netagent_client_message(search_assertion->asserted_netagent, client->client_id, pid,
1712 client->agent_handle, NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT);
1713 if (netagent_error != 0) {
1714 NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR),
1715 "necp_client_remove unassert agent error (%d)", netagent_error);
1716 }
1717 LIST_REMOVE(search_assertion, assertion_chain);
1718 kfree_type(struct necp_client_assertion, search_assertion);
1719 }
1720
1721 if (!necp_client_release_locked(client)) {
1722 NECP_CLIENT_UNLOCK(client);
1723 }
1724
1725 OSDecrementAtomic(&necp_client_count);
1726 }
1727
1728 static bool
1729 necp_defunct_client_fd_locked_inner(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, bool destroy_stats);
1730
1731 static void
necp_process_defunct_list(struct _necp_flow_defunct_list * defunct_list)1732 necp_process_defunct_list(struct _necp_flow_defunct_list *defunct_list)
1733 {
1734 if (!LIST_EMPTY(defunct_list)) {
1735 struct necp_flow_defunct *flow_defunct = NULL;
1736 struct necp_flow_defunct *temp_flow_defunct = NULL;
1737
1738 // For each newly defunct client, send a message to the nexus to remove the flow
1739 LIST_FOREACH_SAFE(flow_defunct, defunct_list, chain, temp_flow_defunct) {
1740 if (!uuid_is_null(flow_defunct->nexus_agent)) {
1741 u_int8_t message_type = NETAGENT_MESSAGE_TYPE_ABORT_NEXUS;
1742 if (((flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
1743 (flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
1744 !(flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
1745 message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
1746 }
1747 int netagent_error = netagent_client_message_with_params(flow_defunct->nexus_agent,
1748 flow_defunct->flow_id,
1749 flow_defunct->proc_pid,
1750 flow_defunct->agent_handle,
1751 message_type,
1752 flow_defunct->has_close_parameters ? &flow_defunct->close_parameters : NULL,
1753 NULL, 0);
1754 if (netagent_error != 0) {
1755 char namebuf[MAXCOMLEN + 1];
1756 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
1757 proc_name(flow_defunct->proc_pid, namebuf, sizeof(namebuf));
1758 NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR), "necp_update_client abort nexus error (%d) for pid %d %s", netagent_error, flow_defunct->proc_pid, namebuf);
1759 }
1760 }
1761 LIST_REMOVE(flow_defunct, chain);
1762 kfree_type(struct necp_flow_defunct, flow_defunct);
1763 }
1764 }
1765 ASSERT(LIST_EMPTY(defunct_list));
1766 }
1767
1768 static int
necpop_close(struct fileglob * fg,vfs_context_t ctx)1769 necpop_close(struct fileglob *fg, vfs_context_t ctx)
1770 {
1771 #pragma unused(ctx)
1772 struct necp_fd_data *fd_data = NULL;
1773 int error = 0;
1774
1775 fd_data = (struct necp_fd_data *)fg_get_data(fg);
1776 fg_set_data(fg, NULL);
1777
1778 if (fd_data != NULL) {
1779 struct _necp_client_tree clients_to_close;
1780 RB_INIT(&clients_to_close);
1781
1782 // Remove from list quickly
1783 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
1784 NECP_OBSERVER_LIST_LOCK_EXCLUSIVE();
1785 LIST_REMOVE(fd_data, chain);
1786 NECP_OBSERVER_LIST_UNLOCK();
1787 } else {
1788 NECP_FD_LIST_LOCK_EXCLUSIVE();
1789 LIST_REMOVE(fd_data, chain);
1790 NECP_FD_LIST_UNLOCK();
1791 }
1792
1793 NECP_FD_LOCK(fd_data);
1794 pid_t pid = fd_data->proc_pid;
1795
1796 struct _necp_flow_defunct_list defunct_list;
1797 LIST_INIT(&defunct_list);
1798
1799 (void)necp_defunct_client_fd_locked_inner(fd_data, &defunct_list, false);
1800
1801 struct necp_client_flow_registration *flow_registration = NULL;
1802 struct necp_client_flow_registration *temp_flow_registration = NULL;
1803 RB_FOREACH_SAFE(flow_registration, _necp_fd_flow_tree, &fd_data->flows, temp_flow_registration) {
1804 #if SKYWALK
1805 necp_destroy_flow_stats(fd_data, flow_registration, NULL, TRUE);
1806 #endif /* SKYWALK */
1807 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
1808 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
1809 NECP_FLOW_TREE_UNLOCK();
1810 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
1811 }
1812
1813 struct necp_client *client = NULL;
1814 struct necp_client *temp_client = NULL;
1815 RB_FOREACH_SAFE(client, _necp_client_tree, &fd_data->clients, temp_client) {
1816 // Clear out the agent_handle to avoid dangling pointers back to fd_data
1817 NECP_CLIENT_LOCK(client);
1818 client->agent_handle = NULL;
1819 NECP_CLIENT_UNLOCK(client);
1820
1821 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
1822 RB_REMOVE(_necp_client_global_tree, &necp_client_global_tree, client);
1823 NECP_CLIENT_TREE_UNLOCK();
1824 RB_REMOVE(_necp_client_tree, &fd_data->clients, client);
1825 RB_INSERT(_necp_client_tree, &clients_to_close, client);
1826 }
1827
1828 struct necp_client_update *client_update = NULL;
1829 struct necp_client_update *temp_update = NULL;
1830 TAILQ_FOREACH_SAFE(client_update, &fd_data->update_list, chain, temp_update) {
1831 // Flush pending updates
1832 TAILQ_REMOVE(&fd_data->update_list, client_update, chain);
1833 necp_client_update_free(client_update);
1834 }
1835 fd_data->update_count = 0;
1836
1837 #if SKYWALK
1838 // Cleanup stats arena(s); indicate that we're closing
1839 necp_stats_arenas_destroy(fd_data, TRUE);
1840 ASSERT(fd_data->stats_arena_active == NULL);
1841 ASSERT(LIST_EMPTY(&fd_data->stats_arena_list));
1842
1843 // Cleanup systctl arena
1844 necp_sysctl_arena_destroy(fd_data);
1845 ASSERT(fd_data->sysctl_arena == NULL);
1846 #endif /* SKYWALK */
1847
1848 NECP_FD_UNLOCK(fd_data);
1849
1850 selthreadclear(&fd_data->si);
1851
1852 lck_mtx_destroy(&fd_data->fd_lock, &necp_fd_mtx_grp);
1853
1854 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
1855 OSDecrementAtomic(&necp_observer_fd_count);
1856 } else {
1857 OSDecrementAtomic(&necp_client_fd_count);
1858 }
1859
1860 kfree_type(struct necp_fd_data, fd_data);
1861
1862 RB_FOREACH_SAFE(client, _necp_client_tree, &clients_to_close, temp_client) {
1863 RB_REMOVE(_necp_client_tree, &clients_to_close, client);
1864 necp_destroy_client(client, pid, true);
1865 }
1866
1867 necp_process_defunct_list(&defunct_list);
1868 }
1869
1870 return error;
1871 }
1872
1873 /// NECP client utilities
1874
1875 static inline bool
necp_address_is_wildcard(const union necp_sockaddr_union * const addr)1876 necp_address_is_wildcard(const union necp_sockaddr_union * const addr)
1877 {
1878 return (addr->sa.sa_family == AF_INET && addr->sin.sin_addr.s_addr == INADDR_ANY) ||
1879 (addr->sa.sa_family == AF_INET6 && IN6_IS_ADDR_UNSPECIFIED(&addr->sin6.sin6_addr));
1880 }
1881
1882 static int
necp_find_fd_data(struct proc * p,int fd,struct fileproc ** fpp,struct necp_fd_data ** fd_data)1883 necp_find_fd_data(struct proc *p, int fd,
1884 struct fileproc **fpp, struct necp_fd_data **fd_data)
1885 {
1886 struct fileproc *fp;
1887 int error = fp_get_ftype(p, fd, DTYPE_NETPOLICY, ENODEV, &fp);
1888
1889 if (error == 0) {
1890 *fd_data = (struct necp_fd_data *)fp_get_data(fp);
1891 *fpp = fp;
1892
1893 if ((*fd_data)->necp_fd_type != necp_fd_type_client) {
1894 // Not a client fd, ignore
1895 fp_drop(p, fd, fp, 0);
1896 error = EINVAL;
1897 }
1898 }
1899 return error;
1900 }
1901
1902 static void
necp_client_add_nexus_flow(struct necp_client_flow_registration * flow_registration,uuid_t nexus_agent,uint32_t interface_index,uint16_t interface_flags)1903 necp_client_add_nexus_flow(struct necp_client_flow_registration *flow_registration,
1904 uuid_t nexus_agent,
1905 uint32_t interface_index,
1906 uint16_t interface_flags)
1907 {
1908 struct necp_client_flow *new_flow = kalloc_type(struct necp_client_flow, Z_WAITOK | Z_ZERO | Z_NOFAIL);
1909
1910 new_flow->nexus = TRUE;
1911 uuid_copy(new_flow->u.nexus_agent, nexus_agent);
1912 new_flow->interface_index = interface_index;
1913 new_flow->interface_flags = interface_flags;
1914 new_flow->check_tcp_heuristics = TRUE;
1915
1916 #if SKYWALK
1917 OSIncrementAtomic(&necp_nexus_flow_count);
1918 #endif /* SKYWALK */
1919
1920 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
1921
1922 #if SKYWALK
1923 necp_flow_save_current_interface_details(flow_registration);
1924 #endif /* SKYWALK */
1925 }
1926
1927 static void
necp_client_add_nexus_flow_if_needed(struct necp_client_flow_registration * flow_registration,uuid_t nexus_agent,uint32_t interface_index)1928 necp_client_add_nexus_flow_if_needed(struct necp_client_flow_registration *flow_registration,
1929 uuid_t nexus_agent,
1930 uint32_t interface_index)
1931 {
1932 struct necp_client_flow *flow = NULL;
1933 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1934 if (flow->nexus &&
1935 uuid_compare(flow->u.nexus_agent, nexus_agent) == 0) {
1936 return;
1937 }
1938 }
1939
1940 uint16_t interface_flags = 0;
1941 ifnet_t ifp = NULL;
1942 ifnet_head_lock_shared();
1943 if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
1944 ifp = ifindex2ifnet[interface_index];
1945 if (ifp != NULL) {
1946 ifnet_lock_shared(ifp);
1947 interface_flags = nstat_ifnet_to_flags(ifp);
1948 ifnet_lock_done(ifp);
1949 }
1950 }
1951 ifnet_head_done();
1952 necp_client_add_nexus_flow(flow_registration, nexus_agent, interface_index, interface_flags);
1953 }
1954
1955 static struct necp_client_flow *
necp_client_add_interface_flow(struct necp_client_flow_registration * flow_registration,uint32_t interface_index)1956 necp_client_add_interface_flow(struct necp_client_flow_registration *flow_registration,
1957 uint32_t interface_index)
1958 {
1959 struct necp_client_flow *new_flow = kalloc_type(struct necp_client_flow, Z_WAITOK | Z_ZERO | Z_NOFAIL);
1960
1961 // Neither nexus nor socket
1962 new_flow->interface_index = interface_index;
1963 new_flow->u.socket_handle = flow_registration->interface_handle;
1964 new_flow->u.cb = flow_registration->interface_cb;
1965
1966 OSIncrementAtomic(&necp_if_flow_count);
1967
1968 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
1969
1970 return new_flow;
1971 }
1972
1973 static struct necp_client_flow *
necp_client_add_interface_flow_if_needed(struct necp_client * client,struct necp_client_flow_registration * flow_registration,uint32_t interface_index)1974 necp_client_add_interface_flow_if_needed(struct necp_client *client,
1975 struct necp_client_flow_registration *flow_registration,
1976 uint32_t interface_index)
1977 {
1978 if (!client->allow_multiple_flows ||
1979 interface_index == IFSCOPE_NONE) {
1980 // Interface not set, or client not allowed to use this mode
1981 return NULL;
1982 }
1983
1984 struct necp_client_flow *flow = NULL;
1985 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1986 if (!flow->nexus && !flow->socket && flow->interface_index == interface_index) {
1987 // Already have the flow
1988 flow->invalid = FALSE;
1989 flow->u.socket_handle = flow_registration->interface_handle;
1990 flow->u.cb = flow_registration->interface_cb;
1991 return NULL;
1992 }
1993 }
1994 return necp_client_add_interface_flow(flow_registration, interface_index);
1995 }
1996
1997 static void
necp_client_add_interface_option_if_needed(struct necp_client * client,uint32_t interface_index,uint32_t interface_generation,uuid_t * nexus_agent,bool network_provider)1998 necp_client_add_interface_option_if_needed(struct necp_client *client,
1999 uint32_t interface_index,
2000 uint32_t interface_generation,
2001 uuid_t *nexus_agent,
2002 bool network_provider)
2003 {
2004 if ((interface_index == IFSCOPE_NONE && !network_provider) ||
2005 (client->interface_option_count != 0 && !client->allow_multiple_flows)) {
2006 // Interface not set, or client not allowed to use this mode
2007 return;
2008 }
2009
2010 if (client->interface_option_count >= NECP_CLIENT_MAX_INTERFACE_OPTIONS) {
2011 // Cannot take any more interface options
2012 return;
2013 }
2014
2015 // Check if already present
2016 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
2017 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
2018 struct necp_client_interface_option *option = &client->interface_options[option_i];
2019 if (option->interface_index == interface_index) {
2020 if (nexus_agent == NULL) {
2021 return;
2022 }
2023 if (uuid_compare(option->nexus_agent, *nexus_agent) == 0) {
2024 return;
2025 }
2026 if (uuid_is_null(option->nexus_agent)) {
2027 uuid_copy(option->nexus_agent, *nexus_agent);
2028 return;
2029 }
2030 // If we get to this point, this is a new nexus flow
2031 }
2032 } else {
2033 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
2034 if (option->interface_index == interface_index) {
2035 if (nexus_agent == NULL) {
2036 return;
2037 }
2038 if (uuid_compare(option->nexus_agent, *nexus_agent) == 0) {
2039 return;
2040 }
2041 if (uuid_is_null(option->nexus_agent)) {
2042 uuid_copy(option->nexus_agent, *nexus_agent);
2043 return;
2044 }
2045 // If we get to this point, this is a new nexus flow
2046 }
2047 }
2048 }
2049
2050 // Add a new entry
2051 if (client->interface_option_count < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
2052 // Add to static
2053 struct necp_client_interface_option *option = &client->interface_options[client->interface_option_count];
2054 option->interface_index = interface_index;
2055 option->interface_generation = interface_generation;
2056 if (nexus_agent != NULL) {
2057 uuid_copy(option->nexus_agent, *nexus_agent);
2058 } else {
2059 uuid_clear(option->nexus_agent);
2060 }
2061 client->interface_option_count++;
2062 } else {
2063 // Add to extra
2064 if (client->extra_interface_options == NULL) {
2065 client->extra_interface_options = (struct necp_client_interface_option *)kalloc_data(
2066 sizeof(struct necp_client_interface_option) * NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT, Z_WAITOK | Z_ZERO);
2067 }
2068 if (client->extra_interface_options != NULL) {
2069 struct necp_client_interface_option *option = &client->extra_interface_options[client->interface_option_count - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
2070 option->interface_index = interface_index;
2071 option->interface_generation = interface_generation;
2072 if (nexus_agent != NULL) {
2073 uuid_copy(option->nexus_agent, *nexus_agent);
2074 } else {
2075 uuid_clear(option->nexus_agent);
2076 }
2077 client->interface_option_count++;
2078 }
2079 }
2080 }
2081
2082 static bool
necp_client_flow_is_viable(proc_t proc,struct necp_client * client,struct necp_client_flow * flow)2083 necp_client_flow_is_viable(proc_t proc, struct necp_client *client,
2084 struct necp_client_flow *flow)
2085 {
2086 struct necp_aggregate_result result;
2087 bool ignore_address = (client->allow_multiple_flows && !flow->nexus && !flow->socket);
2088
2089 flow->necp_flow_flags = 0;
2090 int error = necp_application_find_policy_match_internal(proc, client->parameters,
2091 (u_int32_t)client->parameters_length,
2092 &result, &flow->necp_flow_flags, NULL,
2093 flow->interface_index,
2094 &flow->local_addr, &flow->remote_addr, NULL, NULL,
2095 NULL, ignore_address, true, NULL);
2096
2097 // Check for blocking agents
2098 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
2099 if (uuid_is_null(result.netagents[i])) {
2100 // Passed end of valid agents
2101 break;
2102 }
2103 if (result.netagent_use_flags[i] & NECP_AGENT_USE_FLAG_REMOVE) {
2104 // A removed agent, ignore
2105 continue;
2106 }
2107 u_int32_t flags = netagent_get_flags(result.netagents[i]);
2108 if ((flags & NETAGENT_FLAG_REGISTERED) &&
2109 !(flags & NETAGENT_FLAG_VOLUNTARY) &&
2110 !(flags & NETAGENT_FLAG_ACTIVE) &&
2111 !(flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY)) {
2112 // A required agent is not active, cause the flow to be marked non-viable
2113 return false;
2114 }
2115 }
2116
2117 if (flow->interface_index != IFSCOPE_NONE) {
2118 ifnet_head_lock_shared();
2119
2120 struct ifnet *ifp = ifindex2ifnet[flow->interface_index];
2121 if (ifp && ifp->if_delegated.ifp != IFSCOPE_NONE) {
2122 flow->delegated_interface_index = ifp->if_delegated.ifp->if_index;
2123 }
2124
2125 ifnet_head_done();
2126 }
2127
2128 return error == 0 &&
2129 result.routed_interface_index != IFSCOPE_NONE &&
2130 result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP;
2131 }
2132
2133 static void
necp_flow_add_interface_flows(proc_t proc,struct necp_client * client,struct necp_client_flow_registration * flow_registration,bool send_initial)2134 necp_flow_add_interface_flows(proc_t proc,
2135 struct necp_client *client,
2136 struct necp_client_flow_registration *flow_registration,
2137 bool send_initial)
2138 {
2139 // Traverse all interfaces and add a tracking flow if needed
2140 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
2141 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
2142 struct necp_client_interface_option *option = &client->interface_options[option_i];
2143 struct necp_client_flow *flow = necp_client_add_interface_flow_if_needed(client, flow_registration, option->interface_index);
2144 if (flow != NULL && send_initial) {
2145 flow->viable = necp_client_flow_is_viable(proc, client, flow);
2146 if (flow->viable && flow->u.cb) {
2147 bool viable = flow->viable;
2148 flow->u.cb(flow_registration->interface_handle, NECP_CLIENT_CBACTION_INITIAL, flow->interface_index, flow->necp_flow_flags, &viable);
2149 flow->viable = viable;
2150 }
2151 }
2152 } else {
2153 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
2154 struct necp_client_flow *flow = necp_client_add_interface_flow_if_needed(client, flow_registration, option->interface_index);
2155 if (flow != NULL && send_initial) {
2156 flow->viable = necp_client_flow_is_viable(proc, client, flow);
2157 if (flow->viable && flow->u.cb) {
2158 bool viable = flow->viable;
2159 flow->u.cb(flow_registration->interface_handle, NECP_CLIENT_CBACTION_INITIAL, flow->interface_index, flow->necp_flow_flags, &viable);
2160 flow->viable = viable;
2161 }
2162 }
2163 }
2164 }
2165 }
2166
2167 static bool
necp_client_update_flows(proc_t proc,struct necp_client * client,struct _necp_flow_defunct_list * defunct_list)2168 necp_client_update_flows(proc_t proc,
2169 struct necp_client *client,
2170 struct _necp_flow_defunct_list *defunct_list)
2171 {
2172 NECP_CLIENT_ASSERT_LOCKED(client);
2173
2174 bool any_client_updated = FALSE;
2175 struct necp_client_flow *flow = NULL;
2176 struct necp_client_flow *temp_flow = NULL;
2177 struct necp_client_flow_registration *flow_registration = NULL;
2178 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
2179 if (flow_registration->interface_cb != NULL) {
2180 // Add any interface flows that are not already tracked
2181 necp_flow_add_interface_flows(proc, client, flow_registration, false);
2182 }
2183
2184 LIST_FOREACH_SAFE(flow, &flow_registration->flow_list, flow_chain, temp_flow) {
2185 bool client_updated = FALSE;
2186
2187 // Check policy result for flow
2188 u_short old_delegated_ifindex = flow->delegated_interface_index;
2189
2190 int old_flags = flow->necp_flow_flags;
2191 bool viable = necp_client_flow_is_viable(proc, client, flow);
2192
2193 // TODO: Defunct nexus flows that are blocked by policy
2194
2195 if (flow->viable != viable) {
2196 flow->viable = viable;
2197 client_updated = TRUE;
2198 }
2199
2200 if ((old_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE) !=
2201 (flow->necp_flow_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE)) {
2202 client_updated = TRUE;
2203 }
2204
2205 if (flow->delegated_interface_index != old_delegated_ifindex) {
2206 client_updated = TRUE;
2207 }
2208
2209 if (flow->viable && client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) {
2210 bool flow_viable = flow->viable;
2211 flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_VIABLE, flow->interface_index, flow->necp_flow_flags, &flow_viable);
2212 flow->viable = flow_viable;
2213 }
2214
2215 if (!flow->viable || flow->invalid) {
2216 if (client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) {
2217 bool flow_viable = flow->viable;
2218 flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_NONVIABLE, flow->interface_index, flow->necp_flow_flags, &flow_viable);
2219 flow->viable = flow_viable;
2220 }
2221 // The callback might change the viable-flag of the
2222 // flow depending on its policy. Thus, we need to
2223 // check the flags again after the callback.
2224 }
2225
2226 #if SKYWALK
2227 if (defunct_list != NULL) {
2228 if (flow->invalid && flow->nexus && flow->assigned && !uuid_is_null(flow->u.nexus_agent)) {
2229 // This is a nexus flow that was assigned, but not found on path
2230 u_int32_t flags = netagent_get_flags(flow->u.nexus_agent);
2231 if (!(flags & NETAGENT_FLAG_REGISTERED)) {
2232 // The agent is no longer registered! Mark defunct.
2233 necp_defunct_flow_registration(client, flow_registration, defunct_list);
2234 client_updated = TRUE;
2235 }
2236 }
2237 }
2238 #else /* !SKYWALK */
2239 (void)defunct_list;
2240 #endif /* !SKYWALK */
2241
2242 // Handle flows that no longer match
2243 if (!flow->viable || flow->invalid) {
2244 // Drop them as long as they aren't assigned data
2245 if (!flow->nexus && !flow->assigned) {
2246 if (flow->assigned_results != NULL) {
2247 kfree_data(flow->assigned_results, flow->assigned_results_length);
2248 flow->assigned_results = NULL;
2249 client_updated = TRUE;
2250 }
2251 LIST_REMOVE(flow, flow_chain);
2252 #if SKYWALK
2253 if (flow->nexus) {
2254 OSDecrementAtomic(&necp_nexus_flow_count);
2255 } else
2256 #endif /* SKYWALK */
2257 if (flow->socket) {
2258 OSDecrementAtomic(&necp_socket_flow_count);
2259 } else {
2260 OSDecrementAtomic(&necp_if_flow_count);
2261 }
2262 kfree_type(struct necp_client_flow, flow);
2263 }
2264 }
2265
2266 any_client_updated |= client_updated;
2267 }
2268 #if SKYWALK
2269 necp_flow_save_current_interface_details(flow_registration);
2270 #endif /* SKYWALK */
2271 }
2272
2273 return any_client_updated;
2274 }
2275
2276 static void
necp_client_mark_all_nonsocket_flows_as_invalid(struct necp_client * client)2277 necp_client_mark_all_nonsocket_flows_as_invalid(struct necp_client *client)
2278 {
2279 struct necp_client_flow_registration *flow_registration = NULL;
2280 struct necp_client_flow *flow = NULL;
2281 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
2282 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
2283 if (!flow->socket) { // Socket flows are not marked as invalid
2284 flow->invalid = TRUE;
2285 }
2286 }
2287 }
2288
2289 // Reset option count every update
2290 client->interface_option_count = 0;
2291 }
2292
2293 static inline bool
necp_netagent_is_requested(const struct necp_client_parsed_parameters * parameters,uuid_t * netagent_uuid)2294 necp_netagent_is_requested(const struct necp_client_parsed_parameters *parameters,
2295 uuid_t *netagent_uuid)
2296 {
2297 // Specific use agents only apply when requested
2298 bool requested = false;
2299 if (parameters != NULL) {
2300 // Check required agent UUIDs
2301 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2302 if (uuid_is_null(parameters->required_netagents[i])) {
2303 break;
2304 }
2305 if (uuid_compare(parameters->required_netagents[i], *netagent_uuid) == 0) {
2306 requested = true;
2307 break;
2308 }
2309 }
2310
2311 if (!requested) {
2312 // Check required agent types
2313 bool fetched_type = false;
2314 char netagent_domain[NETAGENT_DOMAINSIZE];
2315 char netagent_type[NETAGENT_TYPESIZE];
2316 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
2317 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
2318
2319 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2320 if (strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
2321 strlen(parameters->required_netagent_types[i].netagent_type) == 0) {
2322 break;
2323 }
2324
2325 if (!fetched_type) {
2326 if (netagent_get_agent_domain_and_type(*netagent_uuid, netagent_domain, netagent_type)) {
2327 fetched_type = TRUE;
2328 } else {
2329 break;
2330 }
2331 }
2332
2333 if ((strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
2334 strncmp(netagent_domain, parameters->required_netagent_types[i].netagent_domain, NETAGENT_DOMAINSIZE) == 0) &&
2335 (strlen(parameters->required_netagent_types[i].netagent_type) == 0 ||
2336 strncmp(netagent_type, parameters->required_netagent_types[i].netagent_type, NETAGENT_TYPESIZE) == 0)) {
2337 requested = true;
2338 break;
2339 }
2340 }
2341 }
2342
2343 // Check preferred agent UUIDs
2344 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2345 if (uuid_is_null(parameters->preferred_netagents[i])) {
2346 break;
2347 }
2348 if (uuid_compare(parameters->preferred_netagents[i], *netagent_uuid) == 0) {
2349 requested = true;
2350 break;
2351 }
2352 }
2353
2354 if (!requested) {
2355 // Check preferred agent types
2356 bool fetched_type = false;
2357 char netagent_domain[NETAGENT_DOMAINSIZE];
2358 char netagent_type[NETAGENT_TYPESIZE];
2359 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
2360 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
2361
2362 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
2363 if (strlen(parameters->preferred_netagent_types[i].netagent_domain) == 0 ||
2364 strlen(parameters->preferred_netagent_types[i].netagent_type) == 0) {
2365 break;
2366 }
2367
2368 if (!fetched_type) {
2369 if (netagent_get_agent_domain_and_type(*netagent_uuid, netagent_domain, netagent_type)) {
2370 fetched_type = TRUE;
2371 } else {
2372 break;
2373 }
2374 }
2375
2376 if ((strlen(parameters->preferred_netagent_types[i].netagent_domain) == 0 ||
2377 strncmp(netagent_domain, parameters->preferred_netagent_types[i].netagent_domain, NETAGENT_DOMAINSIZE) == 0) &&
2378 (strlen(parameters->preferred_netagent_types[i].netagent_type) == 0 ||
2379 strncmp(netagent_type, parameters->preferred_netagent_types[i].netagent_type, NETAGENT_TYPESIZE) == 0)) {
2380 requested = true;
2381 break;
2382 }
2383 }
2384 }
2385 }
2386
2387 return requested;
2388 }
2389
2390 static bool
necp_netagent_applies_to_client(struct necp_client * client,const struct necp_client_parsed_parameters * parameters,uuid_t * netagent_uuid,bool allow_nexus,uint32_t interface_index,uint32_t interface_generation)2391 necp_netagent_applies_to_client(struct necp_client *client,
2392 const struct necp_client_parsed_parameters *parameters,
2393 uuid_t *netagent_uuid, bool allow_nexus,
2394 uint32_t interface_index, uint32_t interface_generation)
2395 {
2396 #pragma unused(interface_index, interface_generation)
2397 bool applies = FALSE;
2398 u_int32_t flags = netagent_get_flags(*netagent_uuid);
2399 if (!(flags & NETAGENT_FLAG_REGISTERED)) {
2400 // Unregistered agents never apply
2401 return applies;
2402 }
2403
2404 const bool is_nexus_agent = ((flags & NETAGENT_FLAG_NEXUS_PROVIDER) ||
2405 (flags & NETAGENT_FLAG_NEXUS_LISTENER) ||
2406 (flags & NETAGENT_FLAG_CUSTOM_ETHER_NEXUS) ||
2407 (flags & NETAGENT_FLAG_CUSTOM_IP_NEXUS) ||
2408 (flags & NETAGENT_FLAG_INTERPOSE_NEXUS));
2409 if (is_nexus_agent) {
2410 if (!allow_nexus) {
2411 // Hide nexus providers unless allowed
2412 // Direct interfaces and direct policies are allowed to use a nexus
2413 // Delegate interfaces or re-scoped interfaces are not allowed
2414 return applies;
2415 }
2416
2417 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) &&
2418 !(flags & NETAGENT_FLAG_CUSTOM_ETHER_NEXUS)) {
2419 // Client requested a custom ether nexus, but this nexus isn't one
2420 return applies;
2421 }
2422
2423 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP) &&
2424 !(flags & NETAGENT_FLAG_CUSTOM_IP_NEXUS)) {
2425 // Client requested a custom IP nexus, but this nexus isn't one
2426 return applies;
2427 }
2428
2429 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) &&
2430 !(flags & NETAGENT_FLAG_INTERPOSE_NEXUS)) {
2431 // Client requested an interpose nexus, but this nexus isn't one
2432 return applies;
2433 }
2434
2435 if (!(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) &&
2436 !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP) &&
2437 !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) &&
2438 !(flags & NETAGENT_FLAG_NEXUS_PROVIDER)) {
2439 // Client requested default parameters, but this nexus isn't generic
2440 return applies;
2441 }
2442 }
2443
2444 if (uuid_compare(client->failed_trigger_agent.netagent_uuid, *netagent_uuid) == 0) {
2445 if (client->failed_trigger_agent.generation == netagent_get_generation(*netagent_uuid)) {
2446 // If this agent was triggered, and failed, and hasn't changed, keep hiding it
2447 return applies;
2448 } else {
2449 // Mismatch generation, clear out old trigger
2450 uuid_clear(client->failed_trigger_agent.netagent_uuid);
2451 client->failed_trigger_agent.generation = 0;
2452 }
2453 }
2454
2455 if (flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY) {
2456 // Specific use agents only apply when requested
2457 applies = necp_netagent_is_requested(parameters, netagent_uuid);
2458 } else {
2459 applies = TRUE;
2460 }
2461
2462 #if SKYWALK
2463 // Add nexus agent if it is a nexus, and either is not a listener, or the nexus supports listeners
2464 if (applies && is_nexus_agent &&
2465 !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) && // Don't add for browse paths
2466 ((flags & NETAGENT_FLAG_NEXUS_LISTENER) || !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER))) {
2467 necp_client_add_interface_option_if_needed(client, interface_index,
2468 interface_generation, netagent_uuid,
2469 (flags & NETAGENT_FLAG_NETWORK_PROVIDER));
2470 }
2471 #endif /* SKYWALK */
2472
2473 return applies;
2474 }
2475
2476 static void
necp_client_add_agent_interface_options(struct necp_client * client,const struct necp_client_parsed_parameters * parsed_parameters,ifnet_t ifp)2477 necp_client_add_agent_interface_options(struct necp_client *client,
2478 const struct necp_client_parsed_parameters *parsed_parameters,
2479 ifnet_t ifp)
2480 {
2481 if (ifp != NULL && ifp->if_agentids != NULL) {
2482 for (u_int32_t i = 0; i < ifp->if_agentcount; i++) {
2483 if (uuid_is_null(ifp->if_agentids[i])) {
2484 continue;
2485 }
2486 // Relies on the side effect that nexus agents that apply will create flows
2487 (void)necp_netagent_applies_to_client(client, parsed_parameters, &ifp->if_agentids[i], TRUE,
2488 ifp->if_index, ifnet_get_generation(ifp));
2489 }
2490 }
2491 }
2492
2493 static void
necp_client_add_browse_interface_options(struct necp_client * client,const struct necp_client_parsed_parameters * parsed_parameters,ifnet_t ifp)2494 necp_client_add_browse_interface_options(struct necp_client *client,
2495 const struct necp_client_parsed_parameters *parsed_parameters,
2496 ifnet_t ifp)
2497 {
2498 if (ifp != NULL && ifp->if_agentids != NULL) {
2499 for (u_int32_t i = 0; i < ifp->if_agentcount; i++) {
2500 if (uuid_is_null(ifp->if_agentids[i])) {
2501 continue;
2502 }
2503
2504 u_int32_t flags = netagent_get_flags(ifp->if_agentids[i]);
2505 if ((flags & NETAGENT_FLAG_REGISTERED) &&
2506 (flags & NETAGENT_FLAG_ACTIVE) &&
2507 (flags & NETAGENT_FLAG_SUPPORTS_BROWSE) &&
2508 (!(flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY) ||
2509 necp_netagent_is_requested(parsed_parameters, &ifp->if_agentids[i]))) {
2510 necp_client_add_interface_option_if_needed(client, ifp->if_index, ifnet_get_generation(ifp), &ifp->if_agentids[i], (flags & NETAGENT_FLAG_NETWORK_PROVIDER));
2511
2512 // Finding one is enough
2513 break;
2514 }
2515 }
2516 }
2517 }
2518
2519 static inline bool
_necp_client_address_is_valid(struct sockaddr * address)2520 _necp_client_address_is_valid(struct sockaddr *address)
2521 {
2522 if (address->sa_family == AF_INET) {
2523 return address->sa_len == sizeof(struct sockaddr_in);
2524 } else if (address->sa_family == AF_INET6) {
2525 return address->sa_len == sizeof(struct sockaddr_in6);
2526 } else {
2527 return FALSE;
2528 }
2529 }
2530
2531 #define necp_client_address_is_valid(S) _necp_client_address_is_valid(SA(S))
2532
2533 static inline bool
necp_client_endpoint_is_unspecified(struct necp_client_endpoint * endpoint)2534 necp_client_endpoint_is_unspecified(struct necp_client_endpoint *endpoint)
2535 {
2536 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2537 if (endpoint->u.sa.sa_family == AF_INET) {
2538 return endpoint->u.sin.sin_addr.s_addr == INADDR_ANY;
2539 } else if (endpoint->u.sa.sa_family == AF_INET6) {
2540 return IN6_IS_ADDR_UNSPECIFIED(&endpoint->u.sin6.sin6_addr);
2541 } else {
2542 return TRUE;
2543 }
2544 } else {
2545 return TRUE;
2546 }
2547 }
2548
2549 #if SKYWALK
2550 static void
necp_client_update_local_port_parameters(u_int8_t * parameters,u_int32_t parameters_size,uint16_t local_port)2551 necp_client_update_local_port_parameters(u_int8_t *parameters,
2552 u_int32_t parameters_size,
2553 uint16_t local_port)
2554 {
2555 size_t offset = 0;
2556 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
2557 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
2558 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
2559
2560 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
2561 // If the length is larger than what can fit in the remaining parameters size, bail
2562 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
2563 break;
2564 }
2565
2566 if (length > 0) {
2567 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
2568 if (value != NULL) {
2569 switch (type) {
2570 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: {
2571 if (length >= sizeof(struct necp_policy_condition_addr)) {
2572 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
2573 if (necp_client_address_is_valid(&address_struct->address.sa)) {
2574 if (address_struct->address.sa.sa_family == AF_INET) {
2575 address_struct->address.sin.sin_port = local_port;
2576 } else if (address_struct->address.sa.sa_family == AF_INET6) {
2577 address_struct->address.sin6.sin6_port = local_port;
2578 }
2579 }
2580 }
2581 break;
2582 }
2583 case NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT: {
2584 if (length >= sizeof(struct necp_client_endpoint)) {
2585 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2586 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2587 if (endpoint->u.sa.sa_family == AF_INET) {
2588 endpoint->u.sin.sin_port = local_port;
2589 } else if (endpoint->u.sa.sa_family == AF_INET6) {
2590 endpoint->u.sin6.sin6_port = local_port;
2591 }
2592 }
2593 }
2594 break;
2595 }
2596 default: {
2597 break;
2598 }
2599 }
2600 }
2601 }
2602
2603 offset += sizeof(struct necp_tlv_header) + length;
2604 }
2605 }
2606 #endif /* !SKYWALK */
2607
2608 #define NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH 253
2609
2610 static void
necp_client_trace_parameter_parsing(struct necp_client * client,u_int8_t type,u_int8_t * value,u_int32_t length)2611 necp_client_trace_parameter_parsing(struct necp_client *client, u_int8_t type, u_int8_t *value, u_int32_t length)
2612 {
2613 uint64_t num = 0;
2614 uint16_t shortBuf;
2615 uint32_t intBuf;
2616 char buffer[NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH + 1];
2617
2618 if (value != NULL && length > 0) {
2619 switch (length) {
2620 case 1:
2621 num = *value;
2622 break;
2623 case 2:
2624 memcpy(&shortBuf, value, sizeof(shortBuf));
2625 num = shortBuf;
2626 break;
2627 case 4:
2628 memcpy(&intBuf, value, sizeof(intBuf));
2629 num = intBuf;
2630 break;
2631 case 8:
2632 memcpy(&num, value, sizeof(num));
2633 break;
2634 default:
2635 num = 0;
2636 break;
2637 }
2638 int len = NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH < length ? NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH : length;
2639 memcpy(buffer, value, len);
2640 buffer[len] = 0;
2641 NECP_CLIENT_PARAMS_LOG(client, "Parsing param - type %d length %d value <%llu (%llX)> %s", type, length, num, num, buffer);
2642 } else {
2643 NECP_CLIENT_PARAMS_LOG(client, "Parsing param - type %d length %d", type, length);
2644 }
2645 }
2646
2647 static void
necp_client_trace_parsed_parameters(struct necp_client * client,struct necp_client_parsed_parameters * parsed_parameters)2648 necp_client_trace_parsed_parameters(struct necp_client *client, struct necp_client_parsed_parameters *parsed_parameters)
2649 {
2650 int i;
2651 char local_buffer[64] = { };
2652 char remote_buffer[64] = { };
2653 uuid_string_t uuid_str = { };
2654 uuid_unparse_lower(parsed_parameters->effective_uuid, uuid_str);
2655
2656 switch (parsed_parameters->local_addr.sa.sa_family) {
2657 case AF_INET:
2658 if (parsed_parameters->local_addr.sa.sa_len == sizeof(struct sockaddr_in)) {
2659 struct sockaddr_in *addr = &parsed_parameters->local_addr.sin;
2660 inet_ntop(AF_INET, &(addr->sin_addr), local_buffer, sizeof(local_buffer));
2661 }
2662 break;
2663 case AF_INET6:
2664 if (parsed_parameters->local_addr.sa.sa_len == sizeof(struct sockaddr_in6)) {
2665 struct sockaddr_in6 *addr6 = &parsed_parameters->local_addr.sin6;
2666 inet_ntop(AF_INET6, &(addr6->sin6_addr), local_buffer, sizeof(local_buffer));
2667 }
2668 break;
2669 default:
2670 break;
2671 }
2672
2673 switch (parsed_parameters->remote_addr.sa.sa_family) {
2674 case AF_INET:
2675 if (parsed_parameters->remote_addr.sa.sa_len == sizeof(struct sockaddr_in)) {
2676 struct sockaddr_in *addr = &parsed_parameters->remote_addr.sin;
2677 inet_ntop(AF_INET, &(addr->sin_addr), remote_buffer, sizeof(remote_buffer));
2678 }
2679 break;
2680 case AF_INET6:
2681 if (parsed_parameters->remote_addr.sa.sa_len == sizeof(struct sockaddr_in6)) {
2682 struct sockaddr_in6 *addr6 = &parsed_parameters->remote_addr.sin6;
2683 inet_ntop(AF_INET6, &(addr6->sin6_addr), remote_buffer, sizeof(remote_buffer));
2684 }
2685 break;
2686 default:
2687 break;
2688 }
2689
2690 NECP_CLIENT_PARAMS_LOG(client, "Parsed params - valid_fields %X flags %X delegated_upid %llu local_addr %s remote_addr %s "
2691 "required_interface_index %u required_interface_type %d local_address_preference %d "
2692 "ip_protocol %d transport_protocol %d ethertype %d effective_pid %d effective_uuid %s uid %d persona_id %d traffic_class %d",
2693 parsed_parameters->valid_fields,
2694 parsed_parameters->flags,
2695 parsed_parameters->delegated_upid,
2696 local_buffer, remote_buffer,
2697 parsed_parameters->required_interface_index,
2698 parsed_parameters->required_interface_type,
2699 parsed_parameters->local_address_preference,
2700 parsed_parameters->ip_protocol,
2701 parsed_parameters->transport_protocol,
2702 parsed_parameters->ethertype,
2703 parsed_parameters->effective_pid,
2704 uuid_str,
2705 parsed_parameters->uid,
2706 parsed_parameters->persona_id,
2707 parsed_parameters->traffic_class);
2708
2709 NECP_CLIENT_PARAMS_LOG(client, "Parsed params - tracker flags <known-tracker %X> <non-app-initiated %X> <silent %X> <app-approved %X>",
2710 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_KNOWN_TRACKER,
2711 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_NON_APP_INITIATED,
2712 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_SILENT,
2713 parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_APPROVED_APP_DOMAIN);
2714
2715 for (i = 0; i < NECP_MAX_INTERFACE_PARAMETERS && parsed_parameters->prohibited_interfaces[i][0]; i++) {
2716 NECP_CLIENT_PARAMS_LOG(client, "Parsed prohibited_interfaces[%d] <%s>", i, parsed_parameters->prohibited_interfaces[i]);
2717 }
2718
2719 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->required_netagent_types[i].netagent_domain[0]; i++) {
2720 NECP_CLIENT_PARAMS_LOG(client, "Parsed required_netagent_types[%d] <%s> <%s>", i,
2721 parsed_parameters->required_netagent_types[i].netagent_domain,
2722 parsed_parameters->required_netagent_types[i].netagent_type);
2723 }
2724 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->prohibited_netagent_types[i].netagent_domain[0]; i++) {
2725 NECP_CLIENT_PARAMS_LOG(client, "Parsed prohibited_netagent_types[%d] <%s> <%s>", i,
2726 parsed_parameters->prohibited_netagent_types[i].netagent_domain,
2727 parsed_parameters->prohibited_netagent_types[i].netagent_type);
2728 }
2729 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->preferred_netagent_types[i].netagent_domain[0]; i++) {
2730 NECP_CLIENT_PARAMS_LOG(client, "Parsed preferred_netagent_types[%d] <%s> <%s>", i,
2731 parsed_parameters->preferred_netagent_types[i].netagent_domain,
2732 parsed_parameters->preferred_netagent_types[i].netagent_type);
2733 }
2734 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && parsed_parameters->avoided_netagent_types[i].netagent_domain[0]; i++) {
2735 NECP_CLIENT_PARAMS_LOG(client, "Parsed avoided_netagent_types[%d] <%s> <%s>", i,
2736 parsed_parameters->avoided_netagent_types[i].netagent_domain,
2737 parsed_parameters->avoided_netagent_types[i].netagent_type);
2738 }
2739
2740 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->required_netagents[i]); i++) {
2741 uuid_unparse_lower(parsed_parameters->required_netagents[i], uuid_str);
2742 NECP_CLIENT_PARAMS_LOG(client, "Parsed required_netagents[%d] <%s>", i, uuid_str);
2743 }
2744 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->prohibited_netagents[i]); i++) {
2745 uuid_unparse_lower(parsed_parameters->prohibited_netagents[i], uuid_str);
2746 NECP_CLIENT_PARAMS_LOG(client, "Parsed prohibited_netagents[%d] <%s>", i, uuid_str);
2747 }
2748 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->preferred_netagents[i]); i++) {
2749 uuid_unparse_lower(parsed_parameters->preferred_netagents[i], uuid_str);
2750 NECP_CLIENT_PARAMS_LOG(client, "Parsed preferred_netagents[%d] <%s>", i, uuid_str);
2751 }
2752 for (i = 0; i < NECP_MAX_AGENT_PARAMETERS && !uuid_is_null(parsed_parameters->avoided_netagents[i]); i++) {
2753 uuid_unparse_lower(parsed_parameters->avoided_netagents[i], uuid_str);
2754 NECP_CLIENT_PARAMS_LOG(client, "Parsed avoided_netagents[%d] <%s>", i, uuid_str);
2755 }
2756 }
2757
2758 static bool
necp_client_strings_are_equal(const char * string1,size_t string1_length,const char * string2,size_t string2_length)2759 necp_client_strings_are_equal(const char *string1, size_t string1_length,
2760 const char *string2, size_t string2_length)
2761 {
2762 if (string1 == NULL || string2 == NULL) {
2763 return false;
2764 }
2765 const size_t string1_actual_length = strnlen(string1, string1_length);
2766 const size_t string2_actual_length = strnlen(string2, string2_length);
2767 if (string1_actual_length != string2_actual_length) {
2768 return false;
2769 }
2770 return strncmp(string1, string2, string1_actual_length) == 0;
2771 }
2772
2773 static int
necp_client_parse_parameters(struct necp_client * client,u_int8_t * parameters,u_int32_t parameters_size,struct necp_client_parsed_parameters * parsed_parameters)2774 necp_client_parse_parameters(struct necp_client *client, u_int8_t *parameters,
2775 u_int32_t parameters_size,
2776 struct necp_client_parsed_parameters *parsed_parameters)
2777 {
2778 int error = 0;
2779 size_t offset = 0;
2780
2781 u_int32_t num_prohibited_interfaces = 0;
2782 u_int32_t num_prohibited_interface_types = 0;
2783 u_int32_t num_required_agents = 0;
2784 u_int32_t num_prohibited_agents = 0;
2785 u_int32_t num_preferred_agents = 0;
2786 u_int32_t num_avoided_agents = 0;
2787 u_int32_t num_required_agent_types = 0;
2788 u_int32_t num_prohibited_agent_types = 0;
2789 u_int32_t num_preferred_agent_types = 0;
2790 u_int32_t num_avoided_agent_types = 0;
2791 u_int8_t *resolver_tag = NULL;
2792 u_int32_t resolver_tag_length = 0;
2793 u_int8_t *client_hostname = NULL;
2794 u_int32_t hostname_length = 0;
2795 uuid_t parent_id = {};
2796
2797 if (parsed_parameters == NULL) {
2798 return EINVAL;
2799 }
2800
2801 memset(parsed_parameters, 0, sizeof(struct necp_client_parsed_parameters));
2802
2803 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
2804 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
2805 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
2806
2807 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
2808 // If the length is larger than what can fit in the remaining parameters size, bail
2809 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
2810 break;
2811 }
2812
2813 if (length > 0) {
2814 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
2815 if (value != NULL) {
2816 switch (type) {
2817 case NECP_CLIENT_PARAMETER_BOUND_INTERFACE: {
2818 if (length <= IFXNAMSIZ && length > 0) {
2819 ifnet_t bound_interface = NULL;
2820 char interface_name[IFXNAMSIZ];
2821 memcpy(interface_name, value, length);
2822 interface_name[length - 1] = 0; // Make sure the string is NULL terminated
2823 if (ifnet_find_by_name(interface_name, &bound_interface) == 0) {
2824 parsed_parameters->required_interface_index = bound_interface->if_index;
2825 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF;
2826 ifnet_release(bound_interface);
2827 }
2828 }
2829 break;
2830 }
2831 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: {
2832 if (length >= sizeof(struct necp_policy_condition_addr)) {
2833 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
2834 if (necp_client_address_is_valid(&address_struct->address.sa)) {
2835 memcpy(&parsed_parameters->local_addr, &address_struct->address, sizeof(address_struct->address));
2836 if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
2837 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
2838 }
2839 if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
2840 (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
2841 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
2842 }
2843 }
2844 }
2845 break;
2846 }
2847 case NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT: {
2848 if (length >= sizeof(struct necp_client_endpoint)) {
2849 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2850 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2851 memcpy(&parsed_parameters->local_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
2852 if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
2853 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
2854 }
2855 if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
2856 (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
2857 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
2858 }
2859 }
2860 }
2861 break;
2862 }
2863 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
2864 if (length >= sizeof(struct necp_policy_condition_addr)) {
2865 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
2866 if (necp_client_address_is_valid(&address_struct->address.sa)) {
2867 memcpy(&parsed_parameters->remote_addr, &address_struct->address, sizeof(address_struct->address));
2868 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
2869 }
2870 }
2871 break;
2872 }
2873 case NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT: {
2874 if (length >= sizeof(struct necp_client_endpoint)) {
2875 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2876 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2877 memcpy(&parsed_parameters->remote_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
2878 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
2879 }
2880 }
2881 break;
2882 }
2883 case NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE: {
2884 if (num_prohibited_interfaces >= NECP_MAX_INTERFACE_PARAMETERS) {
2885 break;
2886 }
2887 if (length <= IFXNAMSIZ && length > 0) {
2888 memcpy(parsed_parameters->prohibited_interfaces[num_prohibited_interfaces], value, length);
2889 parsed_parameters->prohibited_interfaces[num_prohibited_interfaces][length - 1] = 0; // Make sure the string is NULL terminated
2890 num_prohibited_interfaces++;
2891 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF;
2892 }
2893 break;
2894 }
2895 case NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE: {
2896 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) {
2897 break;
2898 }
2899 if (length >= sizeof(u_int8_t)) {
2900 memcpy(&parsed_parameters->required_interface_type, value, sizeof(u_int8_t));
2901 if (parsed_parameters->required_interface_type) {
2902 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE;
2903 }
2904 }
2905 break;
2906 }
2907 case NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE: {
2908 if (num_prohibited_interface_types >= NECP_MAX_INTERFACE_PARAMETERS) {
2909 break;
2910 }
2911 if (length >= sizeof(u_int8_t)) {
2912 memcpy(&parsed_parameters->prohibited_interface_types[num_prohibited_interface_types], value, sizeof(u_int8_t));
2913 num_prohibited_interface_types++;
2914 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE;
2915 }
2916 break;
2917 }
2918 case NECP_CLIENT_PARAMETER_REQUIRE_AGENT: {
2919 if (num_required_agents >= NECP_MAX_AGENT_PARAMETERS) {
2920 break;
2921 }
2922 if (length >= sizeof(uuid_t)) {
2923 memcpy(&parsed_parameters->required_netagents[num_required_agents], value, sizeof(uuid_t));
2924 num_required_agents++;
2925 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT;
2926 }
2927 break;
2928 }
2929 case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT: {
2930 if (num_prohibited_agents >= NECP_MAX_AGENT_PARAMETERS) {
2931 break;
2932 }
2933 if (length >= sizeof(uuid_t)) {
2934 memcpy(&parsed_parameters->prohibited_netagents[num_prohibited_agents], value, sizeof(uuid_t));
2935 num_prohibited_agents++;
2936 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT;
2937 }
2938 break;
2939 }
2940 case NECP_CLIENT_PARAMETER_PREFER_AGENT: {
2941 if (num_preferred_agents >= NECP_MAX_AGENT_PARAMETERS) {
2942 break;
2943 }
2944 if (length >= sizeof(uuid_t)) {
2945 memcpy(&parsed_parameters->preferred_netagents[num_preferred_agents], value, sizeof(uuid_t));
2946 num_preferred_agents++;
2947 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT;
2948 }
2949 break;
2950 }
2951 case NECP_CLIENT_PARAMETER_AVOID_AGENT: {
2952 if (num_avoided_agents >= NECP_MAX_AGENT_PARAMETERS) {
2953 break;
2954 }
2955 if (length >= sizeof(uuid_t)) {
2956 memcpy(&parsed_parameters->avoided_netagents[num_avoided_agents], value, sizeof(uuid_t));
2957 num_avoided_agents++;
2958 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT;
2959 }
2960 break;
2961 }
2962 case NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE: {
2963 if (num_required_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2964 break;
2965 }
2966 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2967 memcpy(&parsed_parameters->required_netagent_types[num_required_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2968 num_required_agent_types++;
2969 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE;
2970 }
2971 break;
2972 }
2973 case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE: {
2974 if (num_prohibited_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2975 break;
2976 }
2977 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2978 memcpy(&parsed_parameters->prohibited_netagent_types[num_prohibited_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2979 num_prohibited_agent_types++;
2980 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE;
2981 }
2982 break;
2983 }
2984 case NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE: {
2985 if (num_preferred_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2986 break;
2987 }
2988 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2989 memcpy(&parsed_parameters->preferred_netagent_types[num_preferred_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2990 num_preferred_agent_types++;
2991 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE;
2992 }
2993 break;
2994 }
2995 case NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE: {
2996 if (num_avoided_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2997 break;
2998 }
2999 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
3000 memcpy(&parsed_parameters->avoided_netagent_types[num_avoided_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
3001 num_avoided_agent_types++;
3002 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE;
3003 }
3004 break;
3005 }
3006 case NECP_CLIENT_PARAMETER_FLAGS: {
3007 if (length >= sizeof(u_int32_t)) {
3008 memcpy(&parsed_parameters->flags, value, sizeof(parsed_parameters->flags));
3009 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_FLAGS;
3010 }
3011 break;
3012 }
3013 case NECP_CLIENT_PARAMETER_IP_PROTOCOL: {
3014 if (length == sizeof(u_int16_t)) {
3015 u_int16_t large_ip_protocol = 0;
3016 memcpy(&large_ip_protocol, value, sizeof(large_ip_protocol));
3017 parsed_parameters->ip_protocol = (u_int8_t)large_ip_protocol;
3018 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL;
3019 } else if (length >= sizeof(parsed_parameters->ip_protocol)) {
3020 memcpy(&parsed_parameters->ip_protocol, value, sizeof(parsed_parameters->ip_protocol));
3021 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL;
3022 }
3023 break;
3024 }
3025 case NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL: {
3026 if (length >= sizeof(parsed_parameters->transport_protocol)) {
3027 memcpy(&parsed_parameters->transport_protocol, value, sizeof(parsed_parameters->transport_protocol));
3028 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL;
3029 }
3030 break;
3031 }
3032 case NECP_CLIENT_PARAMETER_PID: {
3033 if (length >= sizeof(parsed_parameters->effective_pid)) {
3034 memcpy(&parsed_parameters->effective_pid, value, sizeof(parsed_parameters->effective_pid));
3035 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID;
3036 }
3037 break;
3038 }
3039 case NECP_CLIENT_PARAMETER_DELEGATED_UPID: {
3040 if (length >= sizeof(parsed_parameters->delegated_upid)) {
3041 memcpy(&parsed_parameters->delegated_upid, value, sizeof(parsed_parameters->delegated_upid));
3042 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID;
3043 }
3044 break;
3045 }
3046 case NECP_CLIENT_PARAMETER_ETHERTYPE: {
3047 if (length >= sizeof(parsed_parameters->ethertype)) {
3048 memcpy(&parsed_parameters->ethertype, value, sizeof(parsed_parameters->ethertype));
3049 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_ETHERTYPE;
3050 }
3051 break;
3052 }
3053 case NECP_CLIENT_PARAMETER_APPLICATION: {
3054 if (length >= sizeof(parsed_parameters->effective_uuid)) {
3055 memcpy(&parsed_parameters->effective_uuid, value, sizeof(parsed_parameters->effective_uuid));
3056 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID;
3057 }
3058 break;
3059 }
3060 case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: {
3061 if (length >= sizeof(parsed_parameters->traffic_class)) {
3062 memcpy(&parsed_parameters->traffic_class, value, sizeof(parsed_parameters->traffic_class));
3063 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS;
3064 }
3065 break;
3066 }
3067 case NECP_CLIENT_PARAMETER_RESOLVER_TAG: {
3068 if (length > 0) {
3069 if (resolver_tag != NULL) {
3070 // Multiple resolver tags is invalid
3071 NECPLOG0(LOG_ERR, "Multiple resolver tags are not supported");
3072 error = EINVAL;
3073 } else {
3074 resolver_tag = (u_int8_t *)value;
3075 resolver_tag_length = length;
3076 }
3077 }
3078 break;
3079 }
3080 case NECP_CLIENT_PARAMETER_DOMAIN: {
3081 if (length > 0) {
3082 client_hostname = (u_int8_t *)value;
3083 hostname_length = length;
3084 }
3085 break;
3086 }
3087 case NECP_CLIENT_PARAMETER_PARENT_ID: {
3088 if (length == sizeof(parent_id)) {
3089 uuid_copy(parent_id, value);
3090 memcpy(&parsed_parameters->parent_uuid, value, sizeof(parsed_parameters->parent_uuid));
3091 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PARENT_UUID;
3092 }
3093 break;
3094 }
3095 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE: {
3096 if (length >= sizeof(parsed_parameters->local_address_preference)) {
3097 memcpy(&parsed_parameters->local_address_preference, value, sizeof(parsed_parameters->local_address_preference));
3098 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE;
3099 }
3100 break;
3101 }
3102 case NECP_CLIENT_PARAMETER_ATTRIBUTED_BUNDLE_IDENTIFIER: {
3103 if (length > 0) {
3104 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER;
3105 }
3106 break;
3107 }
3108 case NECP_CLIENT_PARAMETER_FLOW_DEMUX_PATTERN: {
3109 if (parsed_parameters->demux_pattern_count >= NECP_MAX_DEMUX_PATTERNS) {
3110 break;
3111 }
3112 if (length >= sizeof(struct necp_demux_pattern)) {
3113 memcpy(&parsed_parameters->demux_patterns[parsed_parameters->demux_pattern_count], value, sizeof(struct necp_demux_pattern));
3114 parsed_parameters->demux_pattern_count++;
3115 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_FLOW_DEMUX_PATTERN;
3116 }
3117 break;
3118 }
3119 case NECP_CLIENT_PARAMETER_APPLICATION_ID: {
3120 if (length >= sizeof(necp_application_id_t)) {
3121 necp_application_id_t *application_id = (necp_application_id_t *)(void *)value;
3122 // UID
3123 parsed_parameters->uid = application_id->uid;
3124 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_UID;
3125 // EUUID
3126 uuid_copy(parsed_parameters->effective_uuid, application_id->effective_uuid);
3127 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID;
3128 // PERSONA
3129 parsed_parameters->persona_id = application_id->persona_id;
3130 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PERSONA_ID;
3131 }
3132 break;
3133 }
3134 default: {
3135 break;
3136 }
3137 }
3138 }
3139
3140 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) {
3141 necp_client_trace_parameter_parsing(client, type, value, length);
3142 }
3143 }
3144
3145 offset += sizeof(struct necp_tlv_header) + length;
3146 }
3147
3148 if (resolver_tag != NULL) {
3149 struct necp_client_validatable *validatable = (struct necp_client_validatable *)resolver_tag;
3150 if (resolver_tag_length <= sizeof(struct necp_client_validatable)) {
3151 error = EINVAL;
3152 NECPLOG(LOG_ERR, "Resolver tag length too short: %u", resolver_tag_length);
3153 } else {
3154 bool matches = true;
3155
3156 // Check the client UUID for client-specific results
3157 if (validatable->signable.sign_type == NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER ||
3158 validatable->signable.sign_type == NECP_CLIENT_SIGN_TYPE_BROWSE_RESULT ||
3159 validatable->signable.sign_type == NECP_CLIENT_SIGN_TYPE_SERVICE_RESOLVER_ANSWER) {
3160 if (uuid_compare(parent_id, validatable->signable.client_id) != 0 &&
3161 uuid_compare(client->client_id, validatable->signable.client_id) != 0) {
3162 NECPLOG0(LOG_ERR, "Resolver tag invalid client ID");
3163 matches = false;
3164 }
3165 }
3166
3167 size_t data_length = resolver_tag_length - sizeof(struct necp_client_validatable);
3168 switch (validatable->signable.sign_type) {
3169 case NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER:
3170 case NECP_CLIENT_SIGN_TYPE_SYSTEM_RESOLVER_ANSWER: {
3171 if (data_length < (sizeof(struct necp_client_host_resolver_answer) - sizeof(struct necp_client_signable))) {
3172 NECPLOG0(LOG_ERR, "Resolver tag invalid length for resolver answer");
3173 matches = false;
3174 } else {
3175 struct necp_client_host_resolver_answer *answer_struct = (struct necp_client_host_resolver_answer *)&validatable->signable;
3176 if (data_length != (sizeof(struct necp_client_host_resolver_answer) + answer_struct->hostname_length - sizeof(struct necp_client_signable))) {
3177 NECPLOG0(LOG_ERR, "Resolver tag invalid length for resolver answer");
3178 matches = false;
3179 } else {
3180 if (answer_struct->hostname_length != 0 && // If the hostname on the signed answer is empty, ignore
3181 !necp_client_strings_are_equal((const char *)client_hostname, hostname_length,
3182 answer_struct->hostname, answer_struct->hostname_length)) {
3183 NECPLOG0(LOG_ERR, "Resolver tag hostname does not match");
3184 matches = false;
3185 } else if (answer_struct->address_answer.sa.sa_family != parsed_parameters->remote_addr.sa.sa_family ||
3186 answer_struct->address_answer.sa.sa_len != parsed_parameters->remote_addr.sa.sa_len) {
3187 NECPLOG0(LOG_ERR, "Resolver tag address type does not match");
3188 matches = false;
3189 } else if (answer_struct->address_answer.sin.sin_port != 0 && // If the port on the signed answer is empty, ignore
3190 answer_struct->address_answer.sin.sin_port != parsed_parameters->remote_addr.sin.sin_port) {
3191 NECPLOG0(LOG_ERR, "Resolver tag port does not match");
3192 matches = false;
3193 } else if ((answer_struct->address_answer.sa.sa_family == AF_INET &&
3194 answer_struct->address_answer.sin.sin_addr.s_addr != parsed_parameters->remote_addr.sin.sin_addr.s_addr) ||
3195 (answer_struct->address_answer.sa.sa_family == AF_INET6 &&
3196 memcmp(&answer_struct->address_answer.sin6.sin6_addr, &parsed_parameters->remote_addr.sin6.sin6_addr, sizeof(struct in6_addr)) != 0)) {
3197 NECPLOG0(LOG_ERR, "Resolver tag address does not match");
3198 matches = false;
3199 }
3200 }
3201 }
3202 break;
3203 }
3204 case NECP_CLIENT_SIGN_TYPE_BROWSE_RESULT:
3205 case NECP_CLIENT_SIGN_TYPE_SYSTEM_BROWSE_RESULT: {
3206 if (data_length < (sizeof(struct necp_client_browse_result) - sizeof(struct necp_client_signable))) {
3207 NECPLOG0(LOG_ERR, "Resolver tag invalid length for browse result");
3208 matches = false;
3209 } else {
3210 struct necp_client_browse_result *answer_struct = (struct necp_client_browse_result *)&validatable->signable;
3211 if (data_length != (sizeof(struct necp_client_browse_result) + answer_struct->service_length - sizeof(struct necp_client_signable))) {
3212 NECPLOG0(LOG_ERR, "Resolver tag invalid length for browse result");
3213 matches = false;
3214 }
3215 }
3216 break;
3217 }
3218 case NECP_CLIENT_SIGN_TYPE_SERVICE_RESOLVER_ANSWER:
3219 case NECP_CLIENT_SIGN_TYPE_SYSTEM_SERVICE_RESOLVER_ANSWER: {
3220 if (data_length < (sizeof(struct necp_client_service_resolver_answer) - sizeof(struct necp_client_signable))) {
3221 NECPLOG0(LOG_ERR, "Resolver tag invalid length for service resolver answer");
3222 matches = false;
3223 } else {
3224 struct necp_client_service_resolver_answer *answer_struct = (struct necp_client_service_resolver_answer *)&validatable->signable;
3225 if (data_length != (sizeof(struct necp_client_service_resolver_answer) + answer_struct->service_length + answer_struct->hostname_length - sizeof(struct necp_client_signable))) {
3226 NECPLOG0(LOG_ERR, "Resolver tag invalid length for service resolver answer");
3227 matches = false;
3228 }
3229 }
3230 break;
3231 }
3232 default: {
3233 NECPLOG(LOG_ERR, "Resolver tag unknown sign type: %u", validatable->signable.sign_type);
3234 matches = false;
3235 break;
3236 }
3237 }
3238 if (!matches) {
3239 error = EAUTH;
3240 } else {
3241 const bool validated = necp_validate_resolver_answer(validatable->signable.client_id,
3242 validatable->signable.sign_type,
3243 validatable->signable.signable_data, data_length,
3244 validatable->signature.signed_tag, sizeof(validatable->signature.signed_tag));
3245 if (!validated) {
3246 error = EAUTH;
3247 NECPLOG0(LOG_ERR, "Failed to validate resolve answer");
3248 }
3249 }
3250 }
3251 }
3252
3253 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_PARAMS)) {
3254 necp_client_trace_parsed_parameters(client, parsed_parameters);
3255 }
3256
3257 return error;
3258 }
3259
3260 static int
necp_client_parse_result(u_int8_t * result,u_int32_t result_size,union necp_sockaddr_union * local_address,union necp_sockaddr_union * remote_address,void ** flow_stats)3261 necp_client_parse_result(u_int8_t *result,
3262 u_int32_t result_size,
3263 union necp_sockaddr_union *local_address,
3264 union necp_sockaddr_union *remote_address,
3265 void **flow_stats)
3266 {
3267 #pragma unused(flow_stats)
3268 int error = 0;
3269 size_t offset = 0;
3270
3271 while ((offset + sizeof(struct necp_tlv_header)) <= result_size) {
3272 u_int8_t type = necp_buffer_get_tlv_type(result, offset);
3273 u_int32_t length = necp_buffer_get_tlv_length(result, offset);
3274
3275 if (length > 0 && (offset + sizeof(struct necp_tlv_header) + length) <= result_size) {
3276 u_int8_t *value = necp_buffer_get_tlv_value(result, offset, NULL);
3277 if (value != NULL) {
3278 switch (type) {
3279 case NECP_CLIENT_RESULT_LOCAL_ENDPOINT: {
3280 if (length >= sizeof(struct necp_client_endpoint)) {
3281 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
3282 if (local_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
3283 memcpy(local_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
3284 }
3285 }
3286 break;
3287 }
3288 case NECP_CLIENT_RESULT_REMOTE_ENDPOINT: {
3289 if (length >= sizeof(struct necp_client_endpoint)) {
3290 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
3291 if (remote_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
3292 memcpy(remote_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
3293 }
3294 }
3295 break;
3296 }
3297 #if SKYWALK
3298 case NECP_CLIENT_RESULT_NEXUS_FLOW_STATS: {
3299 // this TLV contains flow_stats pointer which is refcnt'ed.
3300 if (flow_stats != NULL && length >= sizeof(struct sk_stats_flow *)) {
3301 struct flow_stats *fs = *(void **)(void *)value;
3302 // transfer the refcnt to flow_stats pointer
3303 *flow_stats = fs;
3304 }
3305 memset(value, 0, length); // nullify TLV always
3306 break;
3307 }
3308 #endif /* SKYWALK */
3309 default: {
3310 break;
3311 }
3312 }
3313 }
3314 }
3315
3316 offset += sizeof(struct necp_tlv_header) + length;
3317 }
3318
3319 return error;
3320 }
3321
3322 static struct necp_client_flow_registration *
necp_client_create_flow_registration(struct necp_fd_data * fd_data,struct necp_client * client)3323 necp_client_create_flow_registration(struct necp_fd_data *fd_data, struct necp_client *client)
3324 {
3325 NECP_FD_ASSERT_LOCKED(fd_data);
3326 NECP_CLIENT_ASSERT_LOCKED(client);
3327
3328 struct necp_client_flow_registration *new_registration = kalloc_type(struct necp_client_flow_registration, Z_WAITOK | Z_ZERO | Z_NOFAIL);
3329
3330 new_registration->last_interface_details = combine_interface_details(IFSCOPE_NONE, NSTAT_IFNET_IS_UNKNOWN_TYPE);
3331
3332 necp_generate_client_id(new_registration->registration_id, true);
3333 LIST_INIT(&new_registration->flow_list);
3334
3335 // Add registration to client list
3336 RB_INSERT(_necp_client_flow_tree, &client->flow_registrations, new_registration);
3337
3338 // Add registration to fd list
3339 RB_INSERT(_necp_fd_flow_tree, &fd_data->flows, new_registration);
3340
3341 // Add registration to global tree for lookup
3342 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
3343 RB_INSERT(_necp_client_flow_global_tree, &necp_client_flow_global_tree, new_registration);
3344 NECP_FLOW_TREE_UNLOCK();
3345
3346 new_registration->client = client;
3347
3348 #if SKYWALK
3349 {
3350 // The uuid caching here is something of a hack, but saves a dynamic lookup with attendant lock hierarchy issues
3351 uint64_t stats_event_type = (uuid_is_null(client->latest_flow_registration_id)) ? NSTAT_EVENT_SRC_FLOW_UUID_ASSIGNED : NSTAT_EVENT_SRC_FLOW_UUID_CHANGED;
3352 uuid_copy(client->latest_flow_registration_id, new_registration->registration_id);
3353
3354 // With the flow uuid known, push a new statistics update to ensure the uuid gets known by any clients before the flow can close
3355 if (client->nstat_context != NULL) {
3356 nstat_provider_stats_event(client->nstat_context, stats_event_type);
3357 }
3358 }
3359 #endif /* !SKYWALK */
3360
3361 // Start out assuming there is nothing to read from the flow
3362 new_registration->flow_result_read = true;
3363
3364 return new_registration;
3365 }
3366
3367 static void
necp_client_add_socket_flow(struct necp_client_flow_registration * flow_registration,struct inpcb * inp)3368 necp_client_add_socket_flow(struct necp_client_flow_registration *flow_registration,
3369 struct inpcb *inp)
3370 {
3371 struct necp_client_flow *new_flow = kalloc_type(struct necp_client_flow, Z_WAITOK | Z_ZERO | Z_NOFAIL);
3372
3373 new_flow->socket = TRUE;
3374 new_flow->u.socket_handle = inp;
3375 new_flow->u.cb = inp->necp_cb;
3376
3377 OSIncrementAtomic(&necp_socket_flow_count);
3378
3379 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
3380 }
3381
3382 static int
necp_client_register_socket_inner(pid_t pid,uuid_t client_id,struct inpcb * inp,bool is_listener)3383 necp_client_register_socket_inner(pid_t pid, uuid_t client_id, struct inpcb *inp, bool is_listener)
3384 {
3385 int error = 0;
3386 struct necp_fd_data *client_fd = NULL;
3387 bool found_client = FALSE;
3388
3389 NECP_FD_LIST_LOCK_SHARED();
3390 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3391 NECP_FD_LOCK(client_fd);
3392 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3393 if (client != NULL) {
3394 if (!pid || client->proc_pid == pid) {
3395 if (is_listener) {
3396 found_client = TRUE;
3397 #if SKYWALK
3398 // Check netns token for registration
3399 if (!NETNS_TOKEN_VALID(&client->port_reservation)) {
3400 error = EINVAL;
3401 }
3402 #endif /* !SKYWALK */
3403 } else {
3404 // Find client flow and assign from socket
3405 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3406 if (flow_registration != NULL) {
3407 // Found the right client and flow registration, add a new flow
3408 found_client = TRUE;
3409 necp_client_add_socket_flow(flow_registration, inp);
3410 } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
3411 // No flows yet on this client, add a new registration
3412 flow_registration = necp_client_create_flow_registration(client_fd, client);
3413 if (flow_registration == NULL) {
3414 error = ENOMEM;
3415 } else {
3416 // Add a new flow
3417 found_client = TRUE;
3418 necp_client_add_socket_flow(flow_registration, inp);
3419 }
3420 }
3421 }
3422 }
3423
3424 NECP_CLIENT_UNLOCK(client);
3425 }
3426 NECP_FD_UNLOCK(client_fd);
3427
3428 if (found_client) {
3429 break;
3430 }
3431 }
3432 NECP_FD_LIST_UNLOCK();
3433
3434 if (!found_client) {
3435 error = ENOENT;
3436 } else {
3437 // Count the sockets that have the NECP client UUID set
3438 struct socket *so = inp->inp_socket;
3439 if (!(so->so_flags1 & SOF1_HAS_NECP_CLIENT_UUID)) {
3440 so->so_flags1 |= SOF1_HAS_NECP_CLIENT_UUID;
3441 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_necp_clientuuid_total);
3442 }
3443 }
3444
3445 return error;
3446 }
3447
3448 int
necp_client_register_socket_flow(pid_t pid,uuid_t client_id,struct inpcb * inp)3449 necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp)
3450 {
3451 return necp_client_register_socket_inner(pid, client_id, inp, false);
3452 }
3453
3454 int
necp_client_register_socket_listener(pid_t pid,uuid_t client_id,struct inpcb * inp)3455 necp_client_register_socket_listener(pid_t pid, uuid_t client_id, struct inpcb *inp)
3456 {
3457 return necp_client_register_socket_inner(pid, client_id, inp, true);
3458 }
3459
3460 #if SKYWALK
3461 int
necp_client_get_netns_flow_info(uuid_t client_id,struct ns_flow_info * flow_info)3462 necp_client_get_netns_flow_info(uuid_t client_id, struct ns_flow_info *flow_info)
3463 {
3464 int error = 0;
3465 struct necp_fd_data *client_fd = NULL;
3466 bool found_client = FALSE;
3467
3468 NECP_FD_LIST_LOCK_SHARED();
3469 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3470 NECP_FD_LOCK(client_fd);
3471 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3472 if (client != NULL) {
3473 found_client = TRUE;
3474 if (!NETNS_TOKEN_VALID(&client->port_reservation)) {
3475 error = EINVAL;
3476 } else {
3477 error = netns_get_flow_info(&client->port_reservation, flow_info);
3478 }
3479
3480 NECP_CLIENT_UNLOCK(client);
3481 }
3482 NECP_FD_UNLOCK(client_fd);
3483
3484 if (found_client) {
3485 break;
3486 }
3487 }
3488 NECP_FD_LIST_UNLOCK();
3489
3490 if (!found_client) {
3491 error = ENOENT;
3492 }
3493
3494 return error;
3495 }
3496 #endif /* !SKYWALK */
3497
3498 static void
necp_client_add_multipath_interface_flows(struct necp_client_flow_registration * flow_registration,struct necp_client * client,struct mppcb * mpp)3499 necp_client_add_multipath_interface_flows(struct necp_client_flow_registration *flow_registration,
3500 struct necp_client *client,
3501 struct mppcb *mpp)
3502 {
3503 flow_registration->interface_handle = mpp;
3504 flow_registration->interface_cb = mpp->necp_cb;
3505
3506 proc_t proc = proc_find(client->proc_pid);
3507 if (proc == PROC_NULL) {
3508 return;
3509 }
3510
3511 // Traverse all interfaces and add a tracking flow if needed
3512 necp_flow_add_interface_flows(proc, client, flow_registration, true);
3513
3514 proc_rele(proc);
3515 proc = PROC_NULL;
3516 }
3517
3518 int
necp_client_register_multipath_cb(pid_t pid,uuid_t client_id,struct mppcb * mpp)3519 necp_client_register_multipath_cb(pid_t pid, uuid_t client_id, struct mppcb *mpp)
3520 {
3521 int error = 0;
3522 struct necp_fd_data *client_fd = NULL;
3523 bool found_client = FALSE;
3524
3525 NECP_FD_LIST_LOCK_SHARED();
3526 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3527 NECP_FD_LOCK(client_fd);
3528 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3529 if (client != NULL) {
3530 if (!pid || client->proc_pid == pid) {
3531 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3532 if (flow_registration != NULL) {
3533 // Found the right client and flow registration, add a new flow
3534 found_client = TRUE;
3535 necp_client_add_multipath_interface_flows(flow_registration, client, mpp);
3536 } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
3537 // No flows yet on this client, add a new registration
3538 flow_registration = necp_client_create_flow_registration(client_fd, client);
3539 if (flow_registration == NULL) {
3540 error = ENOMEM;
3541 } else {
3542 // Add a new flow
3543 found_client = TRUE;
3544 necp_client_add_multipath_interface_flows(flow_registration, client, mpp);
3545 }
3546 }
3547 }
3548
3549 NECP_CLIENT_UNLOCK(client);
3550 }
3551 NECP_FD_UNLOCK(client_fd);
3552
3553 if (found_client) {
3554 break;
3555 }
3556 }
3557 NECP_FD_LIST_UNLOCK();
3558
3559 if (!found_client && error == 0) {
3560 error = ENOENT;
3561 }
3562
3563 return error;
3564 }
3565
3566 #define NETAGENT_DOMAIN_RADIO_MANAGER "WirelessRadioManager"
3567 #define NETAGENT_TYPE_RADIO_MANAGER "WirelessRadioManager:BB Manager"
3568
3569 static int
necp_client_lookup_bb_radio_manager(struct necp_client * client,uuid_t netagent_uuid)3570 necp_client_lookup_bb_radio_manager(struct necp_client *client,
3571 uuid_t netagent_uuid)
3572 {
3573 char netagent_domain[NETAGENT_DOMAINSIZE];
3574 char netagent_type[NETAGENT_TYPESIZE];
3575 struct necp_aggregate_result result;
3576 proc_t proc;
3577 int error;
3578
3579 proc = proc_find(client->proc_pid);
3580 if (proc == PROC_NULL) {
3581 return ESRCH;
3582 }
3583
3584 error = necp_application_find_policy_match_internal(proc, client->parameters, (u_int32_t)client->parameters_length,
3585 &result, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL, true, true, NULL);
3586
3587 proc_rele(proc);
3588 proc = PROC_NULL;
3589
3590 if (error) {
3591 return error;
3592 }
3593
3594 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
3595 if (uuid_is_null(result.netagents[i])) {
3596 // Passed end of valid agents
3597 break;
3598 }
3599
3600 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
3601 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
3602 if (netagent_get_agent_domain_and_type(result.netagents[i], netagent_domain, netagent_type) == FALSE) {
3603 continue;
3604 }
3605
3606 if (strncmp(netagent_domain, NETAGENT_DOMAIN_RADIO_MANAGER, NETAGENT_DOMAINSIZE) != 0) {
3607 continue;
3608 }
3609
3610 if (strncmp(netagent_type, NETAGENT_TYPE_RADIO_MANAGER, NETAGENT_TYPESIZE) != 0) {
3611 continue;
3612 }
3613
3614 uuid_copy(netagent_uuid, result.netagents[i]);
3615
3616 break;
3617 }
3618
3619 return 0;
3620 }
3621
3622 static int
necp_client_assert_bb_radio_manager_common(struct necp_client * client,bool assert)3623 necp_client_assert_bb_radio_manager_common(struct necp_client *client, bool assert)
3624 {
3625 uuid_t netagent_uuid;
3626 uint8_t assert_type;
3627 int error;
3628
3629 error = necp_client_lookup_bb_radio_manager(client, netagent_uuid);
3630 if (error) {
3631 NECPLOG0(LOG_ERR, "BB radio manager agent not found");
3632 return error;
3633 }
3634
3635 // Before unasserting, verify that the assertion was already taken
3636 if (assert == FALSE) {
3637 assert_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
3638
3639 if (!necp_client_remove_assertion(client, netagent_uuid)) {
3640 return EINVAL;
3641 }
3642 } else {
3643 assert_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT;
3644 }
3645
3646 error = netagent_client_message(netagent_uuid, client->client_id, client->proc_pid, client->agent_handle, assert_type);
3647 if (error) {
3648 NECPLOG0(LOG_ERR, "netagent_client_message failed");
3649 return error;
3650 }
3651
3652 // Only save the assertion if the action succeeded
3653 if (assert == TRUE) {
3654 necp_client_add_assertion(client, netagent_uuid);
3655 }
3656
3657 return 0;
3658 }
3659
3660 int
necp_client_assert_bb_radio_manager(uuid_t client_id,bool assert)3661 necp_client_assert_bb_radio_manager(uuid_t client_id, bool assert)
3662 {
3663 struct necp_client *client;
3664 int error = 0;
3665
3666 NECP_CLIENT_TREE_LOCK_SHARED();
3667
3668 client = necp_find_client_and_lock(client_id);
3669
3670 if (client) {
3671 // Found the right client!
3672 error = necp_client_assert_bb_radio_manager_common(client, assert);
3673
3674 NECP_CLIENT_UNLOCK(client);
3675 } else {
3676 NECPLOG0(LOG_ERR, "Couldn't find client");
3677 error = ENOENT;
3678 }
3679
3680 NECP_CLIENT_TREE_UNLOCK();
3681
3682 return error;
3683 }
3684
3685 static int
necp_client_unregister_socket_flow(uuid_t client_id,void * handle)3686 necp_client_unregister_socket_flow(uuid_t client_id, void *handle)
3687 {
3688 int error = 0;
3689 struct necp_fd_data *client_fd = NULL;
3690 bool found_client = FALSE;
3691 bool client_updated = FALSE;
3692
3693 NECP_FD_LIST_LOCK_SHARED();
3694 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3695 NECP_FD_LOCK(client_fd);
3696
3697 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3698 if (client != NULL) {
3699 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3700 if (flow_registration != NULL) {
3701 // Found the right client and flow!
3702 found_client = TRUE;
3703
3704 // Remove flow assignment
3705 struct necp_client_flow *search_flow = NULL;
3706 struct necp_client_flow *temp_flow = NULL;
3707 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
3708 if (search_flow->socket && search_flow->u.socket_handle == handle) {
3709 if (search_flow->assigned_results != NULL) {
3710 kfree_data(search_flow->assigned_results, search_flow->assigned_results_length);
3711 search_flow->assigned_results = NULL;
3712 }
3713 client_updated = TRUE;
3714 flow_registration->flow_result_read = FALSE;
3715 LIST_REMOVE(search_flow, flow_chain);
3716 OSDecrementAtomic(&necp_socket_flow_count);
3717 kfree_type(struct necp_client_flow, search_flow);
3718 }
3719 }
3720 }
3721
3722 NECP_CLIENT_UNLOCK(client);
3723 }
3724
3725 if (client_updated) {
3726 necp_fd_notify(client_fd, true);
3727 }
3728 NECP_FD_UNLOCK(client_fd);
3729
3730 if (found_client) {
3731 break;
3732 }
3733 }
3734 NECP_FD_LIST_UNLOCK();
3735
3736 if (!found_client) {
3737 error = ENOENT;
3738 }
3739
3740 return error;
3741 }
3742
3743 static int
necp_client_unregister_multipath_cb(uuid_t client_id,void * handle)3744 necp_client_unregister_multipath_cb(uuid_t client_id, void *handle)
3745 {
3746 int error = 0;
3747 bool found_client = FALSE;
3748
3749 NECP_CLIENT_TREE_LOCK_SHARED();
3750
3751 struct necp_client *client = necp_find_client_and_lock(client_id);
3752 if (client != NULL) {
3753 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3754 if (flow_registration != NULL) {
3755 // Found the right client and flow!
3756 found_client = TRUE;
3757
3758 // Remove flow assignment
3759 struct necp_client_flow *search_flow = NULL;
3760 struct necp_client_flow *temp_flow = NULL;
3761 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
3762 if (!search_flow->socket && !search_flow->nexus &&
3763 search_flow->u.socket_handle == handle) {
3764 search_flow->u.socket_handle = NULL;
3765 search_flow->u.cb = NULL;
3766 }
3767 }
3768
3769 flow_registration->interface_handle = NULL;
3770 flow_registration->interface_cb = NULL;
3771 }
3772
3773 NECP_CLIENT_UNLOCK(client);
3774 }
3775
3776 NECP_CLIENT_TREE_UNLOCK();
3777
3778 if (!found_client) {
3779 error = ENOENT;
3780 }
3781
3782 return error;
3783 }
3784
3785 int
necp_client_assign_from_socket(pid_t pid,uuid_t client_id,struct inpcb * inp)3786 necp_client_assign_from_socket(pid_t pid, uuid_t client_id, struct inpcb *inp)
3787 {
3788 int error = 0;
3789 struct necp_fd_data *client_fd = NULL;
3790 bool found_client = FALSE;
3791 bool client_updated = FALSE;
3792
3793 NECP_FD_LIST_LOCK_SHARED();
3794 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3795 if (pid && client_fd->proc_pid != pid) {
3796 continue;
3797 }
3798
3799 proc_t proc = proc_find(client_fd->proc_pid);
3800 if (proc == PROC_NULL) {
3801 continue;
3802 }
3803
3804 NECP_FD_LOCK(client_fd);
3805
3806 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3807 if (client != NULL) {
3808 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3809 if (flow_registration == NULL && RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
3810 // No flows yet on this client, add a new registration
3811 flow_registration = necp_client_create_flow_registration(client_fd, client);
3812 if (flow_registration == NULL) {
3813 error = ENOMEM;
3814 }
3815 }
3816 if (flow_registration != NULL) {
3817 // Found the right client and flow!
3818 found_client = TRUE;
3819
3820 struct necp_client_flow *flow = NULL;
3821 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
3822 if (flow->socket && flow->u.socket_handle == inp) {
3823 // Release prior results and route
3824 if (flow->assigned_results != NULL) {
3825 kfree_data(flow->assigned_results, flow->assigned_results_length);
3826 flow->assigned_results = NULL;
3827 }
3828
3829 ifnet_t ifp = NULL;
3830 if ((inp->inp_flags & INP_BOUND_IF) && inp->inp_boundifp) {
3831 ifp = inp->inp_boundifp;
3832 } else {
3833 ifp = inp->inp_last_outifp;
3834 }
3835
3836 if (ifp != NULL) {
3837 flow->interface_index = ifp->if_index;
3838 } else {
3839 flow->interface_index = IFSCOPE_NONE;
3840 }
3841
3842 if (inp->inp_vflag & INP_IPV4) {
3843 flow->local_addr.sin.sin_family = AF_INET;
3844 flow->local_addr.sin.sin_len = sizeof(struct sockaddr_in);
3845 flow->local_addr.sin.sin_port = inp->inp_lport;
3846 memcpy(&flow->local_addr.sin.sin_addr, &inp->inp_laddr, sizeof(struct in_addr));
3847
3848 flow->remote_addr.sin.sin_family = AF_INET;
3849 flow->remote_addr.sin.sin_len = sizeof(struct sockaddr_in);
3850 flow->remote_addr.sin.sin_port = inp->inp_fport;
3851 memcpy(&flow->remote_addr.sin.sin_addr, &inp->inp_faddr, sizeof(struct in_addr));
3852 } else if (inp->inp_vflag & INP_IPV6) {
3853 in6_ip6_to_sockaddr(&inp->in6p_laddr, inp->inp_lport, inp->inp_lifscope, &flow->local_addr.sin6, sizeof(flow->local_addr));
3854 in6_ip6_to_sockaddr(&inp->in6p_faddr, inp->inp_fport, inp->inp_fifscope, &flow->remote_addr.sin6, sizeof(flow->remote_addr));
3855 }
3856
3857 flow->viable = necp_client_flow_is_viable(proc, client, flow);
3858
3859 uuid_t empty_uuid;
3860 uuid_clear(empty_uuid);
3861 flow->assigned = TRUE;
3862 flow->assigned_results = necp_create_nexus_assign_message(empty_uuid, 0, NULL, 0,
3863 (struct necp_client_endpoint *)&flow->local_addr,
3864 (struct necp_client_endpoint *)&flow->remote_addr,
3865 NULL, 0, NULL, &flow->assigned_results_length);
3866 flow_registration->flow_result_read = FALSE;
3867 client_updated = TRUE;
3868 break;
3869 }
3870 }
3871 }
3872
3873 NECP_CLIENT_UNLOCK(client);
3874 }
3875 if (client_updated) {
3876 necp_fd_notify(client_fd, true);
3877 }
3878 NECP_FD_UNLOCK(client_fd);
3879
3880 proc_rele(proc);
3881 proc = PROC_NULL;
3882
3883 if (found_client) {
3884 break;
3885 }
3886 }
3887 NECP_FD_LIST_UNLOCK();
3888
3889 if (error == 0) {
3890 if (!found_client) {
3891 error = ENOENT;
3892 } else if (!client_updated) {
3893 error = EINVAL;
3894 }
3895 }
3896
3897 return error;
3898 }
3899
3900 bool
necp_socket_is_allowed_to_recv_on_interface(struct inpcb * inp,ifnet_t interface)3901 necp_socket_is_allowed_to_recv_on_interface(struct inpcb *inp, ifnet_t interface)
3902 {
3903 if (interface == NULL ||
3904 inp == NULL ||
3905 !(inp->inp_flags2 & INP2_EXTERNAL_PORT) ||
3906 uuid_is_null(inp->necp_client_uuid)) {
3907 // If there's no interface or client ID to check,
3908 // or if this is not a listener, pass.
3909 // Outbound connections will have already been
3910 // validated for policy.
3911 return TRUE;
3912 }
3913
3914 // Only filter out listener sockets (no remote address specified)
3915 if ((inp->inp_vflag & INP_IPV4) &&
3916 inp->inp_faddr.s_addr != INADDR_ANY) {
3917 return TRUE;
3918 }
3919 if ((inp->inp_vflag & INP_IPV6) &&
3920 !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
3921 return TRUE;
3922 }
3923
3924 bool allowed = TRUE;
3925
3926 NECP_CLIENT_TREE_LOCK_SHARED();
3927
3928 struct necp_client *client = necp_find_client_and_lock(inp->necp_client_uuid);
3929 if (client != NULL) {
3930 struct necp_client_parsed_parameters *parsed_parameters = NULL;
3931
3932 parsed_parameters = kalloc_type(struct necp_client_parsed_parameters,
3933 Z_WAITOK | Z_ZERO | Z_NOFAIL);
3934 int error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, parsed_parameters);
3935 if (error == 0) {
3936 if (!necp_ifnet_matches_parameters(interface, parsed_parameters, 0, NULL, true, false)) {
3937 allowed = FALSE;
3938 }
3939 }
3940 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
3941
3942 NECP_CLIENT_UNLOCK(client);
3943 }
3944
3945 NECP_CLIENT_TREE_UNLOCK();
3946
3947 return allowed;
3948 }
3949
3950 int
necp_update_flow_protoctl_event(uuid_t netagent_uuid,uuid_t client_id,uint32_t protoctl_event_code,uint32_t protoctl_event_val,uint32_t protoctl_event_tcp_seq_number)3951 necp_update_flow_protoctl_event(uuid_t netagent_uuid, uuid_t client_id,
3952 uint32_t protoctl_event_code, uint32_t protoctl_event_val,
3953 uint32_t protoctl_event_tcp_seq_number)
3954 {
3955 int error = 0;
3956 struct necp_fd_data *client_fd = NULL;
3957 bool found_client = FALSE;
3958 bool client_updated = FALSE;
3959
3960 NECP_FD_LIST_LOCK_SHARED();
3961 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3962 proc_t proc = proc_find(client_fd->proc_pid);
3963 if (proc == PROC_NULL) {
3964 continue;
3965 }
3966
3967 NECP_FD_LOCK(client_fd);
3968
3969 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3970 if (client != NULL) {
3971 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3972 if (flow_registration != NULL) {
3973 // Found the right client and flow!
3974 found_client = TRUE;
3975
3976 struct necp_client_flow *flow = NULL;
3977 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
3978 // Verify that the client nexus agent matches
3979 if ((flow->nexus && uuid_compare(flow->u.nexus_agent, netagent_uuid) == 0) ||
3980 flow->socket) {
3981 flow->has_protoctl_event = TRUE;
3982 flow->protoctl_event.protoctl_event_code = protoctl_event_code;
3983 flow->protoctl_event.protoctl_event_val = protoctl_event_val;
3984 flow->protoctl_event.protoctl_event_tcp_seq_num = protoctl_event_tcp_seq_number;
3985 flow_registration->flow_result_read = FALSE;
3986 client_updated = TRUE;
3987 break;
3988 }
3989 }
3990 }
3991
3992 NECP_CLIENT_UNLOCK(client);
3993 }
3994
3995 if (client_updated) {
3996 necp_fd_notify(client_fd, true);
3997 }
3998
3999 NECP_FD_UNLOCK(client_fd);
4000 proc_rele(proc);
4001 proc = PROC_NULL;
4002
4003 if (found_client) {
4004 break;
4005 }
4006 }
4007 NECP_FD_LIST_UNLOCK();
4008
4009 if (!found_client) {
4010 error = ENOENT;
4011 } else if (!client_updated) {
4012 error = EINVAL;
4013 }
4014 return error;
4015 }
4016
4017 static bool
necp_assign_client_result_locked(struct proc * proc,struct necp_fd_data * client_fd,struct necp_client * client,struct necp_client_flow_registration * flow_registration,uuid_t netagent_uuid,u_int8_t * assigned_results,size_t assigned_results_length,bool notify_fd,bool assigned_from_userspace_agent)4018 necp_assign_client_result_locked(struct proc *proc,
4019 struct necp_fd_data *client_fd,
4020 struct necp_client *client,
4021 struct necp_client_flow_registration *flow_registration,
4022 uuid_t netagent_uuid,
4023 u_int8_t *assigned_results,
4024 size_t assigned_results_length,
4025 bool notify_fd,
4026 bool assigned_from_userspace_agent)
4027 {
4028 bool client_updated = FALSE;
4029
4030 NECP_FD_ASSERT_LOCKED(client_fd);
4031 NECP_CLIENT_ASSERT_LOCKED(client);
4032
4033 struct necp_client_flow *flow = NULL;
4034 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
4035 // Verify that the client nexus agent matches
4036 if (flow->nexus &&
4037 uuid_compare(flow->u.nexus_agent, netagent_uuid) == 0) {
4038 // Release prior results and route
4039 if (flow->assigned_results != NULL) {
4040 kfree_data(flow->assigned_results, flow->assigned_results_length);
4041 flow->assigned_results = NULL;
4042 }
4043
4044 void *nexus_stats = NULL;
4045 if (assigned_results != NULL && assigned_results_length > 0) {
4046 int error = necp_client_parse_result(assigned_results, (u_int32_t)assigned_results_length,
4047 &flow->local_addr, &flow->remote_addr,
4048 assigned_from_userspace_agent ? NULL : &nexus_stats); // Only assign stats from kernel agents
4049 VERIFY(error == 0);
4050 }
4051
4052 flow->viable = necp_client_flow_is_viable(proc, client, flow);
4053
4054 flow->assigned = TRUE;
4055 flow->assigned_results = assigned_results;
4056 flow->assigned_results_length = assigned_results_length;
4057 flow_registration->flow_result_read = FALSE;
4058 #if SKYWALK
4059 if (nexus_stats != NULL) {
4060 if (flow_registration->nexus_stats != NULL) {
4061 flow_stats_release(flow_registration->nexus_stats);
4062 }
4063 flow_registration->nexus_stats = nexus_stats;
4064 }
4065 #endif /* SKYWALK */
4066 client_updated = TRUE;
4067 break;
4068 }
4069 }
4070
4071 if (client_updated && notify_fd) {
4072 necp_fd_notify(client_fd, true);
4073 }
4074
4075 // if not updated, client must free assigned_results
4076 return client_updated;
4077 }
4078
4079 int
necp_assign_client_result(uuid_t netagent_uuid,uuid_t client_id,u_int8_t * assigned_results,size_t assigned_results_length)4080 necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id,
4081 u_int8_t *assigned_results, size_t assigned_results_length)
4082 {
4083 int error = 0;
4084 struct necp_fd_data *client_fd = NULL;
4085 bool found_client = FALSE;
4086 bool client_updated = FALSE;
4087
4088 NECP_FD_LIST_LOCK_SHARED();
4089
4090 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
4091 proc_t proc = proc_find(client_fd->proc_pid);
4092 if (proc == PROC_NULL) {
4093 continue;
4094 }
4095
4096 NECP_FD_LOCK(client_fd);
4097 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
4098 if (client != NULL) {
4099 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
4100 if (flow_registration != NULL) {
4101 // Found the right client and flow!
4102 found_client = TRUE;
4103 if (necp_assign_client_result_locked(proc, client_fd, client, flow_registration, netagent_uuid,
4104 assigned_results, assigned_results_length, true, true)) {
4105 client_updated = TRUE;
4106 }
4107 }
4108
4109 NECP_CLIENT_UNLOCK(client);
4110 }
4111 NECP_FD_UNLOCK(client_fd);
4112
4113 proc_rele(proc);
4114 proc = PROC_NULL;
4115
4116 if (found_client) {
4117 break;
4118 }
4119 }
4120
4121 NECP_FD_LIST_UNLOCK();
4122
4123 // upon error, client must free assigned_results
4124 if (!found_client) {
4125 error = ENOENT;
4126 } else if (!client_updated) {
4127 error = EINVAL;
4128 }
4129
4130 return error;
4131 }
4132
4133 int
necp_assign_client_group_members(uuid_t netagent_uuid,uuid_t client_id,u_int8_t * assigned_group_members,size_t assigned_group_members_length)4134 necp_assign_client_group_members(uuid_t netagent_uuid, uuid_t client_id,
4135 u_int8_t *assigned_group_members, size_t assigned_group_members_length)
4136 {
4137 #pragma unused(netagent_uuid)
4138 int error = 0;
4139 struct necp_fd_data *client_fd = NULL;
4140 bool found_client = false;
4141 bool client_updated = false;
4142
4143 NECP_FD_LIST_LOCK_SHARED();
4144
4145 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
4146 proc_t proc = proc_find(client_fd->proc_pid);
4147 if (proc == PROC_NULL) {
4148 continue;
4149 }
4150
4151 NECP_FD_LOCK(client_fd);
4152 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
4153 if (client != NULL) {
4154 found_client = true;
4155 // Release prior results
4156 if (client->assigned_group_members != NULL) {
4157 kfree_data(client->assigned_group_members, client->assigned_group_members_length);
4158 client->assigned_group_members = NULL;
4159 }
4160
4161 // Save new results
4162 client->assigned_group_members = assigned_group_members;
4163 client->assigned_group_members_length = assigned_group_members_length;
4164 client->group_members_read = false;
4165
4166 client_updated = true;
4167 necp_fd_notify(client_fd, true);
4168
4169 NECP_CLIENT_UNLOCK(client);
4170 }
4171 NECP_FD_UNLOCK(client_fd);
4172
4173 proc_rele(proc);
4174 proc = PROC_NULL;
4175
4176 if (found_client) {
4177 break;
4178 }
4179 }
4180
4181 NECP_FD_LIST_UNLOCK();
4182
4183 // upon error, client must free assigned_results
4184 if (!found_client) {
4185 error = ENOENT;
4186 } else if (!client_updated) {
4187 error = EINVAL;
4188 }
4189
4190 return error;
4191 }
4192
4193 /// Client updating
4194
4195 static bool
necp_update_parsed_parameters(struct necp_client_parsed_parameters * parsed_parameters,struct necp_aggregate_result * result)4196 necp_update_parsed_parameters(struct necp_client_parsed_parameters *parsed_parameters,
4197 struct necp_aggregate_result *result)
4198 {
4199 if (parsed_parameters == NULL ||
4200 result == NULL) {
4201 return false;
4202 }
4203
4204 bool updated = false;
4205 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
4206 if (uuid_is_null(result->netagents[i])) {
4207 // Passed end of valid agents
4208 break;
4209 }
4210
4211 if (!(result->netagent_use_flags[i] & NECP_AGENT_USE_FLAG_SCOPE)) {
4212 // Not a scoped agent, ignore
4213 continue;
4214 }
4215
4216 // This is a scoped agent. Add it to the required agents.
4217 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
4218 // Already some required agents, add this at the end
4219 for (int j = 0; j < NECP_MAX_AGENT_PARAMETERS; j++) {
4220 if (uuid_compare(parsed_parameters->required_netagents[j], result->netagents[i]) == 0) {
4221 // Already required, break
4222 break;
4223 }
4224 if (uuid_is_null(parsed_parameters->required_netagents[j])) {
4225 // Add here
4226 memcpy(&parsed_parameters->required_netagents[j], result->netagents[i], sizeof(uuid_t));
4227 updated = true;
4228 break;
4229 }
4230 }
4231 } else {
4232 // No required agents yet, add this one
4233 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT;
4234 memcpy(&parsed_parameters->required_netagents[0], result->netagents[i], sizeof(uuid_t));
4235 updated = true;
4236 }
4237
4238 // Remove requirements for agents of the same type
4239 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
4240 char remove_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
4241 char remove_agent_type[NETAGENT_TYPESIZE] = { 0 };
4242 if (netagent_get_agent_domain_and_type(result->netagents[i], remove_agent_domain, remove_agent_type)) {
4243 for (int j = 0; j < NECP_MAX_AGENT_PARAMETERS; j++) {
4244 if (strlen(parsed_parameters->required_netagent_types[j].netagent_domain) == 0 &&
4245 strlen(parsed_parameters->required_netagent_types[j].netagent_type) == 0) {
4246 break;
4247 }
4248
4249 if (strncmp(parsed_parameters->required_netagent_types[j].netagent_domain, remove_agent_domain, NETAGENT_DOMAINSIZE) == 0 &&
4250 strncmp(parsed_parameters->required_netagent_types[j].netagent_type, remove_agent_type, NETAGENT_TYPESIZE) == 0) {
4251 updated = true;
4252
4253 if (j == NECP_MAX_AGENT_PARAMETERS - 1) {
4254 // Last field, just clear and break
4255 memset(&parsed_parameters->required_netagent_types[NECP_MAX_AGENT_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
4256 break;
4257 } else {
4258 // Move the parameters down, clear the last entry
4259 memmove(&parsed_parameters->required_netagent_types[j],
4260 &parsed_parameters->required_netagent_types[j + 1],
4261 sizeof(struct necp_client_parameter_netagent_type) * (NECP_MAX_AGENT_PARAMETERS - (j + 1)));
4262 memset(&parsed_parameters->required_netagent_types[NECP_MAX_AGENT_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
4263 // Continue, don't increment but look at the new shifted item instead
4264 continue;
4265 }
4266 }
4267
4268 // Increment j to look at the next agent type parameter
4269 j++;
4270 }
4271 }
4272 }
4273 }
4274
4275 if (updated &&
4276 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4277 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) {
4278 // A required interface index was added after the fact. Clear it.
4279 parsed_parameters->required_interface_index = IFSCOPE_NONE;
4280 }
4281
4282
4283 return updated;
4284 }
4285
4286 static inline bool
necp_agent_types_match(const char * agent_domain1,const char * agent_type1,const char * agent_domain2,const char * agent_type2)4287 necp_agent_types_match(const char *agent_domain1, const char *agent_type1,
4288 const char *agent_domain2, const char *agent_type2)
4289 {
4290 return (strlen(agent_domain1) == 0 ||
4291 strncmp(agent_domain2, agent_domain1, NETAGENT_DOMAINSIZE) == 0) &&
4292 (strlen(agent_type1) == 0 ||
4293 strncmp(agent_type2, agent_type1, NETAGENT_TYPESIZE) == 0);
4294 }
4295
4296 static inline bool
necp_calculate_client_result(proc_t proc,struct necp_client * client,struct necp_client_parsed_parameters * parsed_parameters,struct necp_aggregate_result * result,u_int32_t * flags,u_int32_t * reason,struct necp_client_endpoint * v4_gateway,struct necp_client_endpoint * v6_gateway,uuid_t * override_euuid)4297 necp_calculate_client_result(proc_t proc,
4298 struct necp_client *client,
4299 struct necp_client_parsed_parameters *parsed_parameters,
4300 struct necp_aggregate_result *result,
4301 u_int32_t *flags,
4302 u_int32_t *reason,
4303 struct necp_client_endpoint *v4_gateway,
4304 struct necp_client_endpoint *v6_gateway,
4305 uuid_t *override_euuid)
4306 {
4307 struct rtentry *route = NULL;
4308
4309 // Check parameters to find best interface
4310 bool validate_agents = false;
4311 u_int matching_if_index = 0;
4312 if (necp_find_matching_interface_index(parsed_parameters, &matching_if_index, &validate_agents)) {
4313 if (matching_if_index != 0) {
4314 parsed_parameters->required_interface_index = matching_if_index;
4315 }
4316 // Interface found or not needed, match policy.
4317 memset(result, 0, sizeof(*result));
4318 int error = necp_application_find_policy_match_internal(proc, client->parameters,
4319 (u_int32_t)client->parameters_length,
4320 result, flags, reason, matching_if_index,
4321 NULL, NULL,
4322 v4_gateway, v6_gateway,
4323 &route, false, true,
4324 override_euuid);
4325 if (error != 0) {
4326 if (route != NULL) {
4327 rtfree(route);
4328 }
4329 return FALSE;
4330 }
4331
4332 if (validate_agents) {
4333 bool requirement_failed = FALSE;
4334 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
4335 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4336 if (uuid_is_null(parsed_parameters->required_netagents[i])) {
4337 break;
4338 }
4339
4340 bool requirement_found = FALSE;
4341 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4342 if (uuid_is_null(result->netagents[j])) {
4343 break;
4344 }
4345
4346 if (result->netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) {
4347 // A removed agent, ignore
4348 continue;
4349 }
4350
4351 if (uuid_compare(parsed_parameters->required_netagents[i], result->netagents[j]) == 0) {
4352 requirement_found = TRUE;
4353 break;
4354 }
4355 }
4356
4357 if (!requirement_found) {
4358 requirement_failed = TRUE;
4359 break;
4360 }
4361 }
4362 }
4363
4364 if (!requirement_failed && parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
4365 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4366 if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 &&
4367 strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
4368 break;
4369 }
4370
4371 bool requirement_found = FALSE;
4372 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4373 if (uuid_is_null(result->netagents[j])) {
4374 break;
4375 }
4376
4377 if (result->netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) {
4378 // A removed agent, ignore
4379 continue;
4380 }
4381
4382 char policy_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
4383 char policy_agent_type[NETAGENT_TYPESIZE] = { 0 };
4384
4385 if (netagent_get_agent_domain_and_type(result->netagents[j], policy_agent_domain, policy_agent_type)) {
4386 if (necp_agent_types_match(parsed_parameters->required_netagent_types[i].netagent_domain,
4387 parsed_parameters->required_netagent_types[i].netagent_type,
4388 policy_agent_domain, policy_agent_type)) {
4389 requirement_found = TRUE;
4390 break;
4391 }
4392 }
4393 }
4394
4395 if (!requirement_found) {
4396 requirement_failed = TRUE;
4397 break;
4398 }
4399 }
4400 }
4401
4402 if (requirement_failed) {
4403 // Agent requirement failed. Clear out the whole result, make everything fail.
4404 memset(result, 0, sizeof(*result));
4405 if (route != NULL) {
4406 rtfree(route);
4407 }
4408 return TRUE;
4409 }
4410 }
4411
4412 // Reset current route
4413 NECP_CLIENT_ROUTE_LOCK(client);
4414 if (client->current_route != NULL) {
4415 rtfree(client->current_route);
4416 }
4417 client->current_route = route;
4418 NECP_CLIENT_ROUTE_UNLOCK(client);
4419 } else {
4420 // Interface not found. Clear out the whole result, make everything fail.
4421 memset(result, 0, sizeof(*result));
4422 }
4423
4424 return TRUE;
4425 }
4426
4427 #define NECP_PARSED_PARAMETERS_REQUIRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF | \
4428 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
4429 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
4430 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE)
4431
4432 static bool
necp_update_client_result(proc_t proc,struct necp_fd_data * client_fd,struct necp_client * client,struct _necp_flow_defunct_list * defunct_list)4433 necp_update_client_result(proc_t proc,
4434 struct necp_fd_data *client_fd,
4435 struct necp_client *client,
4436 struct _necp_flow_defunct_list *defunct_list)
4437 {
4438 struct necp_client_result_netagent netagent;
4439 struct necp_aggregate_result result;
4440 struct necp_client_parsed_parameters *parsed_parameters = NULL;
4441 u_int32_t flags = 0;
4442 u_int32_t reason = 0;
4443
4444 NECP_CLIENT_ASSERT_LOCKED(client);
4445
4446 parsed_parameters = kalloc_type(struct necp_client_parsed_parameters,
4447 Z_WAITOK | Z_ZERO | Z_NOFAIL);
4448
4449 // Nexus flows will be brought back if they are still valid
4450 necp_client_mark_all_nonsocket_flows_as_invalid(client);
4451
4452 int error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, parsed_parameters);
4453 if (error != 0) {
4454 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4455 return FALSE;
4456 }
4457
4458 // Update saved IP protocol
4459 client->ip_protocol = parsed_parameters->ip_protocol;
4460
4461 // Calculate the policy result
4462 struct necp_client_endpoint v4_gateway = {};
4463 struct necp_client_endpoint v6_gateway = {};
4464 uuid_t override_euuid;
4465 uuid_clear(override_euuid);
4466 if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags, &reason, &v4_gateway, &v6_gateway, &override_euuid)) {
4467 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4468 return FALSE;
4469 }
4470
4471 if (necp_update_parsed_parameters(parsed_parameters, &result)) {
4472 // Changed the parameters based on result, try again (only once)
4473 if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags, &reason, &v4_gateway, &v6_gateway, &override_euuid)) {
4474 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4475 return FALSE;
4476 }
4477 }
4478
4479 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
4480 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4481 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) {
4482 // Listener should not apply required interface index if
4483 parsed_parameters->required_interface_index = IFSCOPE_NONE;
4484 }
4485
4486 // Save the last policy id on the client
4487 client->policy_id = result.policy_id;
4488 uuid_copy(client->override_euuid, override_euuid);
4489
4490 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_MULTIPATH) ||
4491 (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) ||
4492 ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
4493 result.routing_result != NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED)) {
4494 client->allow_multiple_flows = TRUE;
4495 } else {
4496 client->allow_multiple_flows = FALSE;
4497 }
4498
4499 // If the original request was scoped, and the policy result matches, make sure the result is scoped
4500 if ((result.routing_result == NECP_KERNEL_POLICY_RESULT_NONE ||
4501 result.routing_result == NECP_KERNEL_POLICY_RESULT_PASS) &&
4502 result.routed_interface_index != IFSCOPE_NONE &&
4503 parsed_parameters->required_interface_index == result.routed_interface_index) {
4504 result.routing_result = NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED;
4505 result.routing_result_parameter.scoped_interface_index = result.routed_interface_index;
4506 }
4507
4508 if (defunct_list != NULL &&
4509 result.routing_result == NECP_KERNEL_POLICY_RESULT_DROP) {
4510 // If we are forced to drop the client, defunct it if it has flows
4511 necp_defunct_client_for_policy(client, defunct_list);
4512 }
4513
4514 // Recalculate flags
4515 if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
4516 // Listeners are valid as long as they aren't dropped
4517 if (result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP) {
4518 flags |= NECP_CLIENT_RESULT_FLAG_SATISFIED;
4519 }
4520 } else if (result.routed_interface_index != 0) {
4521 // Clients without flows determine viability based on having some routable interface
4522 flags |= NECP_CLIENT_RESULT_FLAG_SATISFIED;
4523 }
4524
4525 bool updated = FALSE;
4526 u_int8_t *cursor = client->result;
4527 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FLAGS, sizeof(flags), &flags, &updated, client->result, sizeof(client->result));
4528 if (reason != 0) {
4529 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_REASON, sizeof(reason), &reason, &updated, client->result, sizeof(client->result));
4530 }
4531 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_CLIENT_ID, sizeof(uuid_t), client->client_id, &updated,
4532 client->result, sizeof(client->result));
4533 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT, sizeof(result.routing_result), &result.routing_result, &updated,
4534 client->result, sizeof(client->result));
4535 if (result.routing_result_parameter.tunnel_interface_index != 0) {
4536 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER,
4537 sizeof(result.routing_result_parameter), &result.routing_result_parameter, &updated,
4538 client->result, sizeof(client->result));
4539 }
4540 if (result.filter_control_unit != 0) {
4541 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT,
4542 sizeof(result.filter_control_unit), &result.filter_control_unit, &updated,
4543 client->result, sizeof(client->result));
4544 }
4545 if (result.flow_divert_aggregate_unit != 0) {
4546 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FLOW_DIVERT_AGGREGATE_UNIT,
4547 sizeof(result.flow_divert_aggregate_unit), &result.flow_divert_aggregate_unit, &updated,
4548 client->result, sizeof(client->result));
4549 }
4550 if (result.routed_interface_index != 0) {
4551 u_int routed_interface_index = result.routed_interface_index;
4552 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
4553 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_REQUIRED_FIELDS) &&
4554 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4555 parsed_parameters->required_interface_index != result.routed_interface_index) {
4556 routed_interface_index = parsed_parameters->required_interface_index;
4557 }
4558
4559 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_INDEX,
4560 sizeof(routed_interface_index), &routed_interface_index, &updated,
4561 client->result, sizeof(client->result));
4562 }
4563 if (client_fd && client_fd->flags & NECP_OPEN_FLAG_BACKGROUND) {
4564 u_int32_t effective_traffic_class = SO_TC_BK_SYS;
4565 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS,
4566 sizeof(effective_traffic_class), &effective_traffic_class, &updated,
4567 client->result, sizeof(client->result));
4568 }
4569
4570 if (client_fd->background) {
4571 bool has_assigned_flow = FALSE;
4572 struct necp_client_flow_registration *flow_registration = NULL;
4573 struct necp_client_flow *search_flow = NULL;
4574 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
4575 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
4576 if (search_flow->assigned) {
4577 has_assigned_flow = TRUE;
4578 break;
4579 }
4580 }
4581 }
4582
4583 if (has_assigned_flow) {
4584 u_int32_t background = client_fd->background;
4585 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG,
4586 sizeof(background), &background, &updated,
4587 client->result, sizeof(client->result));
4588 }
4589 }
4590
4591 bool write_v4_gateway = !necp_client_endpoint_is_unspecified(&v4_gateway);
4592 bool write_v6_gateway = !necp_client_endpoint_is_unspecified(&v6_gateway);
4593
4594 NECP_CLIENT_ROUTE_LOCK(client);
4595 if (client->current_route != NULL) {
4596 const u_int32_t route_mtu = get_maxmtu(client->current_route);
4597 if (route_mtu != 0) {
4598 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_MTU,
4599 sizeof(route_mtu), &route_mtu, &updated,
4600 client->result, sizeof(client->result));
4601 }
4602 bool has_remote_addr = parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
4603 if (has_remote_addr && client->current_route->rt_gateway != NULL) {
4604 if (client->current_route->rt_gateway->sa_family == AF_INET) {
4605 write_v6_gateway = false;
4606 } else if (client->current_route->rt_gateway->sa_family == AF_INET6) {
4607 write_v4_gateway = false;
4608 }
4609 }
4610 }
4611 NECP_CLIENT_ROUTE_UNLOCK(client);
4612
4613 if (write_v4_gateway) {
4614 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_GATEWAY,
4615 sizeof(struct necp_client_endpoint), &v4_gateway, &updated,
4616 client->result, sizeof(client->result));
4617 }
4618
4619 if (write_v6_gateway) {
4620 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_GATEWAY,
4621 sizeof(struct necp_client_endpoint), &v6_gateway, &updated,
4622 client->result, sizeof(client->result));
4623 }
4624
4625 for (int i = 0; i < NAT64_MAX_NUM_PREFIXES; i++) {
4626 if (result.nat64_prefixes[i].prefix_len != 0) {
4627 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NAT64,
4628 sizeof(result.nat64_prefixes), result.nat64_prefixes, &updated,
4629 client->result, sizeof(client->result));
4630 break;
4631 }
4632 }
4633
4634 if (result.mss_recommended != 0) {
4635 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_RECOMMENDED_MSS,
4636 sizeof(result.mss_recommended), &result.mss_recommended, &updated,
4637 client->result, sizeof(client->result));
4638 }
4639
4640 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
4641 if (uuid_is_null(result.netagents[i])) {
4642 break;
4643 }
4644 if (result.netagent_use_flags[i] & NECP_AGENT_USE_FLAG_REMOVE) {
4645 // A removed agent, ignore
4646 continue;
4647 }
4648 uuid_copy(netagent.netagent_uuid, result.netagents[i]);
4649 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4650 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE, 0, 0)) {
4651 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4652 client->result, sizeof(client->result));
4653 }
4654 }
4655
4656 ifnet_head_lock_shared();
4657 ifnet_t direct_interface = NULL;
4658 ifnet_t delegate_interface = NULL;
4659 ifnet_t original_scoped_interface = NULL;
4660
4661 if (result.routed_interface_index != IFSCOPE_NONE && result.routed_interface_index <= (u_int32_t)if_index) {
4662 direct_interface = ifindex2ifnet[result.routed_interface_index];
4663 } else if (parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4664 parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
4665 // If the request was scoped, but the route didn't match, still grab the agents
4666 direct_interface = ifindex2ifnet[parsed_parameters->required_interface_index];
4667 } else if (result.routed_interface_index == IFSCOPE_NONE &&
4668 result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED &&
4669 result.routing_result_parameter.scoped_interface_index != IFSCOPE_NONE) {
4670 direct_interface = ifindex2ifnet[result.routing_result_parameter.scoped_interface_index];
4671 }
4672 if (direct_interface != NULL) {
4673 delegate_interface = direct_interface->if_delegated.ifp;
4674 }
4675 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
4676 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_REQUIRED_FIELDS) &&
4677 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
4678 parsed_parameters->required_interface_index != result.routing_result_parameter.tunnel_interface_index &&
4679 parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
4680 original_scoped_interface = ifindex2ifnet[parsed_parameters->required_interface_index];
4681 }
4682 // Add interfaces
4683 if (original_scoped_interface != NULL) {
4684 struct necp_client_result_interface interface_struct;
4685 interface_struct.index = original_scoped_interface->if_index;
4686 interface_struct.generation = ifnet_get_generation(original_scoped_interface);
4687 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
4688 client->result, sizeof(client->result));
4689 }
4690 if (direct_interface != NULL) {
4691 struct necp_client_result_interface interface_struct;
4692 interface_struct.index = direct_interface->if_index;
4693 interface_struct.generation = ifnet_get_generation(direct_interface);
4694 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
4695 client->result, sizeof(client->result));
4696
4697 // Set the delta time since interface up/down
4698 struct timeval updown_delta = {};
4699 if (ifnet_updown_delta(direct_interface, &updown_delta) == 0) {
4700 u_int32_t delta = updown_delta.tv_sec;
4701 bool ignore_updated = FALSE;
4702 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_TIME_DELTA,
4703 sizeof(delta), &delta, &ignore_updated,
4704 client->result, sizeof(client->result));
4705 }
4706 }
4707 if (delegate_interface != NULL) {
4708 struct necp_client_result_interface interface_struct;
4709 interface_struct.index = delegate_interface->if_index;
4710 interface_struct.generation = ifnet_get_generation(delegate_interface);
4711 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
4712 client->result, sizeof(client->result));
4713 }
4714
4715 // Update multipath/listener interface flows
4716 if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_MULTIPATH) {
4717 // Add the interface option for the routed interface first
4718 if (direct_interface != NULL) {
4719 // Add nexus agent
4720 necp_client_add_agent_interface_options(client, parsed_parameters, direct_interface);
4721
4722 // Add interface option in case it is not a nexus
4723 necp_client_add_interface_option_if_needed(client, direct_interface->if_index,
4724 ifnet_get_generation(direct_interface), NULL, false);
4725 }
4726 // Get other multipath interface options from ordered list
4727 struct ifnet *multi_interface = NULL;
4728 TAILQ_FOREACH(multi_interface, &ifnet_ordered_head, if_ordered_link) {
4729 if (multi_interface != direct_interface &&
4730 necp_ifnet_matches_parameters(multi_interface, parsed_parameters, 0, NULL, true, false)) {
4731 // Add nexus agents for multipath
4732 necp_client_add_agent_interface_options(client, parsed_parameters, multi_interface);
4733
4734 // Add multipath interface flows for kernel MPTCP
4735 necp_client_add_interface_option_if_needed(client, multi_interface->if_index,
4736 ifnet_get_generation(multi_interface), NULL, false);
4737 }
4738 }
4739 } else if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
4740 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) {
4741 if (direct_interface != NULL) {
4742 // If scoped, only listen on that interface
4743 // Add nexus agents for listeners
4744 necp_client_add_agent_interface_options(client, parsed_parameters, direct_interface);
4745
4746 // Add interface option in case it is not a nexus
4747 necp_client_add_interface_option_if_needed(client, direct_interface->if_index,
4748 ifnet_get_generation(direct_interface), NULL, false);
4749 }
4750 } else {
4751 // Get listener interface options from global list
4752 struct ifnet *listen_interface = NULL;
4753 TAILQ_FOREACH(listen_interface, &ifnet_head, if_link) {
4754 if ((listen_interface->if_flags & (IFF_UP | IFF_RUNNING)) &&
4755 necp_ifnet_matches_parameters(listen_interface, parsed_parameters, 0, NULL, true, false)) {
4756 // Add nexus agents for listeners
4757 necp_client_add_agent_interface_options(client, parsed_parameters, listen_interface);
4758 }
4759 }
4760 }
4761 } else if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) {
4762 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) {
4763 if (direct_interface != NULL) {
4764 // Add browse option if it has an agent
4765 necp_client_add_browse_interface_options(client, parsed_parameters, direct_interface);
4766 }
4767 } else {
4768 // Get browse interface options from global list
4769 struct ifnet *browse_interface = NULL;
4770 TAILQ_FOREACH(browse_interface, &ifnet_head, if_link) {
4771 if (necp_ifnet_matches_parameters(browse_interface, parsed_parameters, 0, NULL, true, false)) {
4772 necp_client_add_browse_interface_options(client, parsed_parameters, browse_interface);
4773 }
4774 }
4775 }
4776 }
4777
4778 struct necp_client_result_estimated_throughput throughput = {
4779 .up = 0,
4780 .down = 0,
4781 };
4782
4783 // Add agents
4784 if (original_scoped_interface != NULL) {
4785 ifnet_lock_shared(original_scoped_interface);
4786 if (original_scoped_interface->if_agentids != NULL) {
4787 for (u_int32_t i = 0; i < original_scoped_interface->if_agentcount; i++) {
4788 if (uuid_is_null(original_scoped_interface->if_agentids[i])) {
4789 continue;
4790 }
4791 bool skip_agent = false;
4792 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4793 if (uuid_is_null(result.netagents[j])) {
4794 break;
4795 }
4796 if ((result.netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) &&
4797 uuid_compare(original_scoped_interface->if_agentids[i], result.netagents[j]) == 0) {
4798 skip_agent = true;
4799 break;
4800 }
4801 }
4802 if (skip_agent) {
4803 continue;
4804 }
4805 uuid_copy(netagent.netagent_uuid, original_scoped_interface->if_agentids[i]);
4806 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4807 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE,
4808 original_scoped_interface->if_index, ifnet_get_generation(original_scoped_interface))) {
4809 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4810 client->result, sizeof(client->result));
4811 }
4812 }
4813 }
4814 ifnet_lock_done(original_scoped_interface);
4815 }
4816 if (direct_interface != NULL) {
4817 ifnet_lock_shared(direct_interface);
4818 throughput.up = direct_interface->if_estimated_up_bucket;
4819 throughput.down = direct_interface->if_estimated_down_bucket;
4820 if (direct_interface->if_agentids != NULL) {
4821 for (u_int32_t i = 0; i < direct_interface->if_agentcount; i++) {
4822 if (uuid_is_null(direct_interface->if_agentids[i])) {
4823 continue;
4824 }
4825 bool skip_agent = false;
4826 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4827 if (uuid_is_null(result.netagents[j])) {
4828 break;
4829 }
4830 if ((result.netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) &&
4831 uuid_compare(direct_interface->if_agentids[i], result.netagents[j]) == 0) {
4832 skip_agent = true;
4833 break;
4834 }
4835 }
4836 if (skip_agent) {
4837 continue;
4838 }
4839 uuid_copy(netagent.netagent_uuid, direct_interface->if_agentids[i]);
4840 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4841 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE,
4842 direct_interface->if_index, ifnet_get_generation(direct_interface))) {
4843 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4844 client->result, sizeof(client->result));
4845 }
4846 }
4847 }
4848 ifnet_lock_done(direct_interface);
4849 }
4850 if (delegate_interface != NULL) {
4851 ifnet_lock_shared(delegate_interface);
4852 if (throughput.up == 0 && throughput.down == 0) {
4853 throughput.up = delegate_interface->if_estimated_up_bucket;
4854 throughput.down = delegate_interface->if_estimated_down_bucket;
4855 }
4856 if (delegate_interface->if_agentids != NULL) {
4857 for (u_int32_t i = 0; i < delegate_interface->if_agentcount; i++) {
4858 if (uuid_is_null(delegate_interface->if_agentids[i])) {
4859 continue;
4860 }
4861 bool skip_agent = false;
4862 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
4863 if (uuid_is_null(result.netagents[j])) {
4864 break;
4865 }
4866 if ((result.netagent_use_flags[j] & NECP_AGENT_USE_FLAG_REMOVE) &&
4867 uuid_compare(delegate_interface->if_agentids[i], result.netagents[j]) == 0) {
4868 skip_agent = true;
4869 break;
4870 }
4871 }
4872 if (skip_agent) {
4873 continue;
4874 }
4875 uuid_copy(netagent.netagent_uuid, delegate_interface->if_agentids[i]);
4876 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
4877 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE,
4878 delegate_interface->if_index, ifnet_get_generation(delegate_interface))) {
4879 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
4880 client->result, sizeof(client->result));
4881 }
4882 }
4883 }
4884 ifnet_lock_done(delegate_interface);
4885 }
4886 ifnet_head_done();
4887
4888 if (throughput.up != 0 || throughput.down != 0) {
4889 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_ESTIMATED_THROUGHPUT,
4890 sizeof(throughput), &throughput, &updated, client->result, sizeof(client->result));
4891 }
4892
4893 // Add interface options
4894 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
4895 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
4896 struct necp_client_interface_option *option = &client->interface_options[option_i];
4897 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated,
4898 client->result, sizeof(client->result));
4899 } else {
4900 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
4901 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated,
4902 client->result, sizeof(client->result));
4903 }
4904 }
4905
4906 size_t new_result_length = (cursor - client->result);
4907 if (new_result_length != client->result_length) {
4908 client->result_length = new_result_length;
4909 updated = TRUE;
4910 }
4911
4912 // Update flow viability/flags
4913 if (necp_client_update_flows(proc, client, defunct_list)) {
4914 updated = TRUE;
4915 }
4916
4917 if (updated) {
4918 client->result_read = FALSE;
4919 necp_client_update_observer_update(client);
4920 }
4921
4922 kfree_type(struct necp_client_parsed_parameters, parsed_parameters);
4923 return updated;
4924 }
4925
4926 static bool
necp_defunct_client_fd_locked_inner(struct necp_fd_data * client_fd,struct _necp_flow_defunct_list * defunct_list,bool destroy_stats)4927 necp_defunct_client_fd_locked_inner(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, bool destroy_stats)
4928 {
4929 bool updated_result = FALSE;
4930 struct necp_client *client = NULL;
4931
4932 NECP_FD_ASSERT_LOCKED(client_fd);
4933
4934 RB_FOREACH(client, _necp_client_tree, &client_fd->clients) {
4935 struct necp_client_flow_registration *flow_registration = NULL;
4936
4937 NECP_CLIENT_LOCK(client);
4938
4939 // Prepare close events to be sent to the nexus to effectively remove the flows
4940 struct necp_client_flow *search_flow = NULL;
4941 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
4942 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
4943 if (search_flow->nexus &&
4944 !uuid_is_null(search_flow->u.nexus_agent)) {
4945 // Sleeping alloc won't fail; copy only what's necessary
4946 struct necp_flow_defunct *flow_defunct = kalloc_type(struct necp_flow_defunct, Z_WAITOK | Z_ZERO);
4947 uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent);
4948 uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
4949 client->client_id :
4950 flow_registration->registration_id));
4951 flow_defunct->proc_pid = client->proc_pid;
4952 flow_defunct->agent_handle = client->agent_handle;
4953 flow_defunct->flags = flow_registration->flags;
4954 #if SKYWALK
4955 if (flow_registration->kstats_kaddr != NULL) {
4956 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
4957 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
4958 if (quicstats != NULL &&
4959 quicstats->necp_quic_udp_stats.necp_udp_hdr.necp_stats_type == NECP_CLIENT_STATISTICS_TYPE_QUIC) {
4960 memcpy(flow_defunct->close_parameters.u.close_token, quicstats->necp_quic_extra.ssr_token, sizeof(flow_defunct->close_parameters.u.close_token));
4961 flow_defunct->has_close_parameters = true;
4962 }
4963 }
4964 #endif /* SKYWALK */
4965 // Add to the list provided by caller
4966 LIST_INSERT_HEAD(defunct_list, flow_defunct, chain);
4967
4968 flow_registration->defunct = true;
4969 flow_registration->flow_result_read = false;
4970 updated_result = true;
4971 }
4972 }
4973 }
4974 if (destroy_stats) {
4975 #if SKYWALK
4976 // Free any remaining stats objects back to the arena where they came from;
4977 // do this independent of the above defunct check, as the client may have
4978 // been marked as defunct separately via necp_defunct_client_for_policy().
4979 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
4980 necp_destroy_flow_stats(client_fd, flow_registration, NULL, FALSE);
4981 }
4982 #endif /* SKYWALK */
4983 }
4984 NECP_CLIENT_UNLOCK(client);
4985 }
4986
4987 return updated_result;
4988 }
4989
4990 static inline void
necp_defunct_client_fd_locked(struct necp_fd_data * client_fd,struct _necp_flow_defunct_list * defunct_list,struct proc * proc)4991 necp_defunct_client_fd_locked(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, struct proc *proc)
4992 {
4993 #pragma unused(proc)
4994 bool updated_result = FALSE;
4995
4996 NECP_FD_ASSERT_LOCKED(client_fd);
4997 #if SKYWALK
4998 // redirect regions of currently-active stats arena to zero-filled pages
4999 struct necp_arena_info *nai = necp_fd_mredirect_stats_arena(client_fd, proc);
5000 #endif /* SKYWALK */
5001
5002 updated_result = necp_defunct_client_fd_locked_inner(client_fd, defunct_list, true);
5003
5004 #if SKYWALK
5005 // and tear down the currently-active arena's regions now that the redirection and freeing are done
5006 if (nai != NULL) {
5007 ASSERT((nai->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT)) == NAIF_REDIRECT);
5008 ASSERT(nai->nai_arena != NULL);
5009 ASSERT(nai->nai_mmap.ami_mapref != NULL);
5010
5011 int err = skmem_arena_defunct(nai->nai_arena);
5012 VERIFY(err == 0);
5013
5014 nai->nai_flags |= NAIF_DEFUNCT;
5015 }
5016 #endif /* SKYWALK */
5017
5018 if (updated_result) {
5019 necp_fd_notify(client_fd, true);
5020 }
5021 }
5022
5023 static inline void
necp_update_client_fd_locked(struct necp_fd_data * client_fd,proc_t proc,struct _necp_flow_defunct_list * defunct_list)5024 necp_update_client_fd_locked(struct necp_fd_data *client_fd,
5025 proc_t proc,
5026 struct _necp_flow_defunct_list *defunct_list)
5027 {
5028 struct necp_client *client = NULL;
5029 bool updated_result = FALSE;
5030 NECP_FD_ASSERT_LOCKED(client_fd);
5031 RB_FOREACH(client, _necp_client_tree, &client_fd->clients) {
5032 NECP_CLIENT_LOCK(client);
5033 if (necp_update_client_result(proc, client_fd, client, defunct_list)) {
5034 updated_result = TRUE;
5035 }
5036 NECP_CLIENT_UNLOCK(client);
5037 }
5038
5039 // Check if this PID needs to request in-process flow divert
5040 NECP_FD_LIST_ASSERT_LOCKED();
5041 for (int i = 0; i < NECP_MAX_FLOW_DIVERT_NEEDED_PIDS; i++) {
5042 if (necp_flow_divert_needed_pids[i] == 0) {
5043 break;
5044 }
5045 if (necp_flow_divert_needed_pids[i] == client_fd->proc_pid) {
5046 client_fd->request_in_process_flow_divert = true;
5047 break;
5048 }
5049 }
5050
5051 if (updated_result || client_fd->request_in_process_flow_divert) {
5052 necp_fd_notify(client_fd, true);
5053 }
5054 }
5055
5056 #if SKYWALK
5057 static void
necp_close_empty_arenas_callout(__unused thread_call_param_t dummy,__unused thread_call_param_t arg)5058 necp_close_empty_arenas_callout(__unused thread_call_param_t dummy,
5059 __unused thread_call_param_t arg)
5060 {
5061 struct necp_fd_data *client_fd = NULL;
5062
5063 NECP_FD_LIST_LOCK_SHARED();
5064
5065 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
5066 NECP_FD_LOCK(client_fd);
5067 necp_stats_arenas_destroy(client_fd, FALSE);
5068 NECP_FD_UNLOCK(client_fd);
5069 }
5070
5071 NECP_FD_LIST_UNLOCK();
5072 }
5073 #endif /* SKYWALK */
5074
5075 static void
necp_update_all_clients_callout(__unused thread_call_param_t dummy,__unused thread_call_param_t arg)5076 necp_update_all_clients_callout(__unused thread_call_param_t dummy,
5077 __unused thread_call_param_t arg)
5078 {
5079 struct necp_fd_data *client_fd = NULL;
5080
5081 NECP_UPDATE_ALL_CLIENTS_LOCK_EXCLUSIVE();
5082 uint32_t count = necp_update_all_clients_sched_cnt;
5083 necp_update_all_clients_sched_cnt = 0;
5084 necp_update_all_clients_sched_abstime = 0;
5085 NECP_UPDATE_ALL_CLIENTS_UNLOCK();
5086
5087 if (necp_debug > 0) {
5088 NECPLOG(LOG_DEBUG,
5089 "necp_update_all_clients_callout running for coalesced %u updates",
5090 count);
5091 }
5092
5093 struct _necp_flow_defunct_list defunct_list;
5094 LIST_INIT(&defunct_list);
5095
5096 NECP_FD_LIST_LOCK_SHARED();
5097
5098 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
5099 proc_t proc = proc_find(client_fd->proc_pid);
5100 if (proc == PROC_NULL) {
5101 continue;
5102 }
5103
5104 // Update all clients on one fd
5105 NECP_FD_LOCK(client_fd);
5106 necp_update_client_fd_locked(client_fd, proc, &defunct_list);
5107 NECP_FD_UNLOCK(client_fd);
5108
5109 proc_rele(proc);
5110 proc = PROC_NULL;
5111 }
5112
5113 // Reset the necp_flow_divert_needed_pids list
5114 for (int i = 0; i < NECP_MAX_FLOW_DIVERT_NEEDED_PIDS; i++) {
5115 necp_flow_divert_needed_pids[i] = 0;
5116 }
5117
5118 NECP_FD_LIST_UNLOCK();
5119
5120 // Handle the case in which some clients became newly defunct
5121 necp_process_defunct_list(&defunct_list);
5122 }
5123
5124 void
necp_update_all_clients(void)5125 necp_update_all_clients(void)
5126 {
5127 necp_update_all_clients_immediately_if_needed(false);
5128 }
5129
5130 void
necp_update_all_clients_immediately_if_needed(bool should_update_immediately)5131 necp_update_all_clients_immediately_if_needed(bool should_update_immediately)
5132 {
5133 if (necp_client_update_tcall == NULL) {
5134 // Don't try to update clients if the module is not initialized
5135 return;
5136 }
5137
5138 uint64_t deadline = 0;
5139 uint64_t leeway = 0;
5140
5141 uint32_t timeout_to_use = necp_timeout_microseconds;
5142 uint32_t leeway_to_use = necp_timeout_leeway_microseconds;
5143 if (should_update_immediately) {
5144 timeout_to_use = 1000 * 10; // 10ms
5145 leeway_to_use = 1000 * 10; // 10ms;
5146 }
5147
5148 clock_interval_to_deadline(timeout_to_use, NSEC_PER_USEC, &deadline);
5149 clock_interval_to_absolutetime_interval(leeway_to_use, NSEC_PER_USEC, &leeway);
5150
5151 NECP_UPDATE_ALL_CLIENTS_LOCK_EXCLUSIVE();
5152 bool need_cancel = false;
5153 bool need_schedule = true;
5154 uint64_t sched_abstime;
5155
5156 clock_absolutetime_interval_to_deadline(deadline + leeway, &sched_abstime);
5157
5158 /*
5159 * Do not push the timer if it is already scheduled
5160 */
5161 if (necp_update_all_clients_sched_abstime != 0) {
5162 need_schedule = false;
5163
5164 if (should_update_immediately) {
5165 /*
5166 * To update immediately we may have to cancel the current timer
5167 * if it's scheduled too far out.
5168 */
5169 if (necp_update_all_clients_sched_abstime > sched_abstime) {
5170 need_cancel = true;
5171 need_schedule = true;
5172 }
5173 }
5174 }
5175
5176 /*
5177 * Record the time of the deadline with leeway
5178 */
5179 if (need_schedule) {
5180 necp_update_all_clients_sched_abstime = sched_abstime;
5181 }
5182
5183 necp_update_all_clients_sched_cnt += 1;
5184 uint32_t count = necp_update_all_clients_sched_cnt;
5185 NECP_UPDATE_ALL_CLIENTS_UNLOCK();
5186
5187 if (need_schedule) {
5188 /*
5189 * Wait if the thread call is currently executing to make sure the
5190 * next update will be delivered to all clients
5191 */
5192 if (need_cancel) {
5193 (void) thread_call_cancel_wait(necp_client_update_tcall);
5194 }
5195
5196 (void) thread_call_enter_delayed_with_leeway(necp_client_update_tcall, NULL,
5197 deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
5198 }
5199 if (necp_debug > 0) {
5200 NECPLOG(LOG_DEBUG,
5201 "necp_update_all_clients immediate %s update %u",
5202 should_update_immediately ? "true" : "false", count);
5203 }
5204 }
5205
5206 bool
necp_set_client_as_background(proc_t proc,struct fileproc * fp,bool background)5207 necp_set_client_as_background(proc_t proc,
5208 struct fileproc *fp,
5209 bool background)
5210 {
5211 if (proc == PROC_NULL) {
5212 NECPLOG0(LOG_ERR, "NULL proc");
5213 return FALSE;
5214 }
5215
5216 if (fp == NULL) {
5217 NECPLOG0(LOG_ERR, "NULL fp");
5218 return FALSE;
5219 }
5220
5221 struct necp_fd_data *client_fd = (struct necp_fd_data *)fp_get_data(fp);
5222 if (client_fd == NULL) {
5223 NECPLOG0(LOG_ERR, "Could not find client structure for backgrounded client");
5224 return FALSE;
5225 }
5226
5227 if (client_fd->necp_fd_type != necp_fd_type_client) {
5228 // Not a client fd, ignore
5229 NECPLOG0(LOG_ERR, "Not a client fd, ignore");
5230 return FALSE;
5231 }
5232
5233 client_fd->background = background;
5234
5235 return TRUE;
5236 }
5237
5238 void
necp_fd_memstatus(proc_t proc,uint32_t status,struct necp_fd_data * client_fd)5239 necp_fd_memstatus(proc_t proc, uint32_t status,
5240 struct necp_fd_data *client_fd)
5241 {
5242 #pragma unused(proc, status, client_fd)
5243 ASSERT(proc != PROC_NULL);
5244 ASSERT(client_fd != NULL);
5245
5246 // Nothing to reap for the process or client for now,
5247 // but this is where we would trigger that in future.
5248 }
5249
5250 void
necp_fd_defunct(proc_t proc,struct necp_fd_data * client_fd)5251 necp_fd_defunct(proc_t proc, struct necp_fd_data *client_fd)
5252 {
5253 struct _necp_flow_defunct_list defunct_list;
5254
5255 ASSERT(proc != PROC_NULL);
5256 ASSERT(client_fd != NULL);
5257
5258 if (client_fd->necp_fd_type != necp_fd_type_client) {
5259 // Not a client fd, ignore
5260 return;
5261 }
5262
5263 // Our local temporary list
5264 LIST_INIT(&defunct_list);
5265
5266 // Need to hold lock so ntstats defunct the same set of clients
5267 NECP_FD_LOCK(client_fd);
5268 #if SKYWALK
5269 // Shut down statistics
5270 nstats_userland_stats_defunct_for_process(proc_getpid(proc));
5271 #endif /* SKYWALK */
5272 necp_defunct_client_fd_locked(client_fd, &defunct_list, proc);
5273 NECP_FD_UNLOCK(client_fd);
5274
5275 necp_process_defunct_list(&defunct_list);
5276 }
5277
5278 void
necp_client_request_in_process_flow_divert(pid_t pid)5279 necp_client_request_in_process_flow_divert(pid_t pid)
5280 {
5281 if (pid == 0) {
5282 return;
5283 }
5284
5285 // Add to the list of pids that should get an update. These will
5286 // get picked up on the next thread call to update client paths.
5287 NECP_FD_LIST_LOCK_SHARED();
5288 for (int i = 0; i < NECP_MAX_FLOW_DIVERT_NEEDED_PIDS; i++) {
5289 if (necp_flow_divert_needed_pids[i] == 0) {
5290 necp_flow_divert_needed_pids[i] = pid;
5291 break;
5292 }
5293 }
5294 NECP_FD_LIST_UNLOCK();
5295 }
5296
5297 static void
necp_client_remove_agent_from_result(struct necp_client * client,uuid_t netagent_uuid)5298 necp_client_remove_agent_from_result(struct necp_client *client, uuid_t netagent_uuid)
5299 {
5300 size_t offset = 0;
5301
5302 u_int8_t *result_buffer = client->result;
5303 while ((offset + sizeof(struct necp_tlv_header)) <= client->result_length) {
5304 u_int8_t type = necp_buffer_get_tlv_type(result_buffer, offset);
5305 u_int32_t length = necp_buffer_get_tlv_length(result_buffer, offset);
5306
5307 size_t tlv_total_length = (sizeof(struct necp_tlv_header) + length);
5308 if (type == NECP_CLIENT_RESULT_NETAGENT &&
5309 length == sizeof(struct necp_client_result_netagent) &&
5310 (offset + tlv_total_length) <= client->result_length) {
5311 struct necp_client_result_netagent *value = ((struct necp_client_result_netagent *)(void *)
5312 necp_buffer_get_tlv_value(result_buffer, offset, NULL));
5313 if (uuid_compare(value->netagent_uuid, netagent_uuid) == 0) {
5314 // Found a netagent to remove
5315 // Shift bytes down to remove the tlv, and adjust total length
5316 // Don't adjust the current offset
5317 memmove(result_buffer + offset,
5318 result_buffer + offset + tlv_total_length,
5319 client->result_length - (offset + tlv_total_length));
5320 client->result_length -= tlv_total_length;
5321 memset(result_buffer + client->result_length, 0, sizeof(client->result) - client->result_length);
5322 continue;
5323 }
5324 }
5325
5326 offset += tlv_total_length;
5327 }
5328 }
5329
5330 void
necp_force_update_client(uuid_t client_id,uuid_t remove_netagent_uuid,u_int32_t agent_generation)5331 necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid, u_int32_t agent_generation)
5332 {
5333 struct necp_fd_data *client_fd = NULL;
5334
5335 NECP_FD_LIST_LOCK_SHARED();
5336
5337 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
5338 bool updated_result = FALSE;
5339 NECP_FD_LOCK(client_fd);
5340 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
5341 if (client != NULL) {
5342 client->failed_trigger_agent.generation = agent_generation;
5343 uuid_copy(client->failed_trigger_agent.netagent_uuid, remove_netagent_uuid);
5344 if (!uuid_is_null(remove_netagent_uuid)) {
5345 necp_client_remove_agent_from_result(client, remove_netagent_uuid);
5346 }
5347 client->result_read = FALSE;
5348 // Found the client, break
5349 updated_result = TRUE;
5350 NECP_CLIENT_UNLOCK(client);
5351 }
5352 if (updated_result) {
5353 necp_fd_notify(client_fd, true);
5354 }
5355 NECP_FD_UNLOCK(client_fd);
5356 if (updated_result) {
5357 // Found the client, break
5358 break;
5359 }
5360 }
5361
5362 NECP_FD_LIST_UNLOCK();
5363 }
5364
5365 #if SKYWALK
5366 void
necp_client_early_close(uuid_t client_id)5367 necp_client_early_close(uuid_t client_id)
5368 {
5369 NECP_CLIENT_TREE_LOCK_SHARED();
5370
5371 struct necp_client *client = necp_find_client_and_lock(client_id);
5372 if (client != NULL) {
5373 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
5374 if (flow_registration != NULL) {
5375 // Found the right client and flow, mark the stats as over
5376 if (flow_registration->stats_handler_context != NULL) {
5377 ntstat_userland_stats_event(flow_registration->stats_handler_context,
5378 NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT);
5379 }
5380 }
5381 NECP_CLIENT_UNLOCK(client);
5382 }
5383
5384 NECP_CLIENT_TREE_UNLOCK();
5385 }
5386 #endif /* SKYWALK */
5387
5388 /// Interface matching
5389
5390 #define NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
5391 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF | \
5392 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
5393 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE | \
5394 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
5395 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT | \
5396 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
5397 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \
5398 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \
5399 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE | \
5400 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \
5401 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
5402
5403 #define NECP_PARSED_PARAMETERS_SCOPED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
5404 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
5405 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
5406 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
5407 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \
5408 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE)
5409
5410 #define NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
5411 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)
5412
5413 #define NECP_PARSED_PARAMETERS_PREFERRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
5414 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \
5415 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \
5416 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
5417
5418 static bool
necp_ifnet_matches_type(struct ifnet * ifp,u_int8_t interface_type,bool check_delegates)5419 necp_ifnet_matches_type(struct ifnet *ifp, u_int8_t interface_type, bool check_delegates)
5420 {
5421 struct ifnet *check_ifp = ifp;
5422 while (check_ifp) {
5423 if (if_functional_type(check_ifp, TRUE) == interface_type) {
5424 return TRUE;
5425 }
5426 if (!check_delegates) {
5427 break;
5428 }
5429 check_ifp = check_ifp->if_delegated.ifp;
5430 }
5431 return FALSE;
5432 }
5433
5434 static bool
necp_ifnet_matches_name(struct ifnet * ifp,const char * interface_name,bool check_delegates)5435 necp_ifnet_matches_name(struct ifnet *ifp, const char *interface_name, bool check_delegates)
5436 {
5437 struct ifnet *check_ifp = ifp;
5438 while (check_ifp) {
5439 if (strncmp(check_ifp->if_xname, interface_name, IFXNAMSIZ) == 0) {
5440 return TRUE;
5441 }
5442 if (!check_delegates) {
5443 break;
5444 }
5445 check_ifp = check_ifp->if_delegated.ifp;
5446 }
5447 return FALSE;
5448 }
5449
5450 static bool
necp_ifnet_matches_agent(struct ifnet * ifp,uuid_t * agent_uuid,bool check_delegates)5451 necp_ifnet_matches_agent(struct ifnet *ifp, uuid_t *agent_uuid, bool check_delegates)
5452 {
5453 struct ifnet *check_ifp = ifp;
5454
5455 while (check_ifp != NULL) {
5456 ifnet_lock_shared(check_ifp);
5457 if (check_ifp->if_agentids != NULL) {
5458 for (u_int32_t index = 0; index < check_ifp->if_agentcount; index++) {
5459 if (uuid_compare(check_ifp->if_agentids[index], *agent_uuid) == 0) {
5460 ifnet_lock_done(check_ifp);
5461 return TRUE;
5462 }
5463 }
5464 }
5465 ifnet_lock_done(check_ifp);
5466
5467 if (!check_delegates) {
5468 break;
5469 }
5470 check_ifp = check_ifp->if_delegated.ifp;
5471 }
5472 return FALSE;
5473 }
5474
5475 static bool
necp_ifnet_matches_agent_type(struct ifnet * ifp,const char * agent_domain,const char * agent_type,bool check_delegates)5476 necp_ifnet_matches_agent_type(struct ifnet *ifp, const char *agent_domain, const char *agent_type, bool check_delegates)
5477 {
5478 struct ifnet *check_ifp = ifp;
5479
5480 while (check_ifp != NULL) {
5481 ifnet_lock_shared(check_ifp);
5482 if (check_ifp->if_agentids != NULL) {
5483 for (u_int32_t index = 0; index < check_ifp->if_agentcount; index++) {
5484 if (uuid_is_null(check_ifp->if_agentids[index])) {
5485 continue;
5486 }
5487
5488 char if_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
5489 char if_agent_type[NETAGENT_TYPESIZE] = { 0 };
5490
5491 if (netagent_get_agent_domain_and_type(check_ifp->if_agentids[index], if_agent_domain, if_agent_type)) {
5492 if (necp_agent_types_match(agent_domain, agent_type, if_agent_domain, if_agent_type)) {
5493 ifnet_lock_done(check_ifp);
5494 return TRUE;
5495 }
5496 }
5497 }
5498 }
5499 ifnet_lock_done(check_ifp);
5500
5501 if (!check_delegates) {
5502 break;
5503 }
5504 check_ifp = check_ifp->if_delegated.ifp;
5505 }
5506 return FALSE;
5507 }
5508
5509 static bool
necp_ifnet_matches_local_address(struct ifnet * ifp,struct sockaddr * sa)5510 necp_ifnet_matches_local_address(struct ifnet *ifp, struct sockaddr *sa)
5511 {
5512 struct ifaddr *ifa = NULL;
5513 bool matched_local_address = FALSE;
5514
5515 // Transform sa into the ifaddr form
5516 // IPv6 Scope IDs are always embedded in the ifaddr list
5517 struct sockaddr_storage address;
5518 u_int ifscope = IFSCOPE_NONE;
5519 (void)sa_copy(sa, &address, &ifscope);
5520 SIN(&address)->sin_port = 0;
5521 if (address.ss_family == AF_INET6) {
5522 if (in6_embedded_scope ||
5523 !IN6_IS_SCOPE_EMBED(&SIN6(&address)->sin6_addr)) {
5524 SIN6(&address)->sin6_scope_id = 0;
5525 }
5526 }
5527
5528 ifa = ifa_ifwithaddr_scoped_locked((struct sockaddr *)&address, ifp->if_index);
5529 matched_local_address = (ifa != NULL);
5530
5531 if (ifa) {
5532 ifaddr_release(ifa);
5533 }
5534
5535 return matched_local_address;
5536 }
5537
5538 static bool
necp_interface_type_should_match_unranked_interfaces(u_int8_t interface_type)5539 necp_interface_type_should_match_unranked_interfaces(u_int8_t interface_type)
5540 {
5541 switch (interface_type) {
5542 // These are the interface types we allow a client to request even if the matching
5543 // interface isn't currently eligible to be primary (has default route, dns, etc)
5544 case IFRTYPE_FUNCTIONAL_WIFI_AWDL:
5545 case IFRTYPE_FUNCTIONAL_INTCOPROC:
5546 case IFRTYPE_FUNCTIONAL_COMPANIONLINK:
5547 return true;
5548 default:
5549 break;
5550 }
5551 return false;
5552 }
5553
5554 #define NECP_IFP_IS_ON_ORDERED_LIST(_ifp) ((_ifp)->if_ordered_link.tqe_next != NULL || (_ifp)->if_ordered_link.tqe_prev != NULL)
5555
5556 // Secondary interface flag indicates that the interface is being
5557 // used for multipath or a listener as an extra path
5558 static bool
necp_ifnet_matches_parameters(struct ifnet * ifp,struct necp_client_parsed_parameters * parsed_parameters,u_int32_t override_flags,u_int32_t * preferred_count,bool secondary_interface,bool require_scoped_field)5559 necp_ifnet_matches_parameters(struct ifnet *ifp,
5560 struct necp_client_parsed_parameters *parsed_parameters,
5561 u_int32_t override_flags,
5562 u_int32_t *preferred_count,
5563 bool secondary_interface,
5564 bool require_scoped_field)
5565 {
5566 bool matched_some_scoped_field = FALSE;
5567
5568 if (preferred_count) {
5569 *preferred_count = 0;
5570 }
5571
5572 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) {
5573 if (parsed_parameters->required_interface_index != ifp->if_index) {
5574 return FALSE;
5575 }
5576 }
5577 #if SKYWALK
5578 else {
5579 if (ifnet_is_low_latency(ifp)) {
5580 return FALSE;
5581 }
5582 }
5583 #endif /* SKYWALK */
5584
5585 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR) {
5586 if (!necp_ifnet_matches_local_address(ifp, SA(&parsed_parameters->local_addr.sa))) {
5587 return FALSE;
5588 }
5589 if (require_scoped_field) {
5590 matched_some_scoped_field = TRUE;
5591 }
5592 }
5593
5594 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) {
5595 if (override_flags != 0) {
5596 if ((override_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) &&
5597 IFNET_IS_EXPENSIVE(ifp)) {
5598 return FALSE;
5599 }
5600 if ((override_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED) &&
5601 IFNET_IS_CONSTRAINED(ifp)) {
5602 return FALSE;
5603 }
5604 } else {
5605 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) &&
5606 IFNET_IS_EXPENSIVE(ifp)) {
5607 return FALSE;
5608 }
5609 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED) &&
5610 IFNET_IS_CONSTRAINED(ifp)) {
5611 return FALSE;
5612 }
5613 }
5614 }
5615
5616 if ((!secondary_interface || // Enforce interface type if this is the primary interface
5617 !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) || // or if there are no flags
5618 !(parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE)) && // or if the flags don't give an exception
5619 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) &&
5620 !necp_ifnet_matches_type(ifp, parsed_parameters->required_interface_type, FALSE)) {
5621 return FALSE;
5622 }
5623
5624 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) {
5625 if (require_scoped_field) {
5626 matched_some_scoped_field = TRUE;
5627 }
5628 }
5629
5630 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE) {
5631 for (int i = 0; i < NECP_MAX_INTERFACE_PARAMETERS; i++) {
5632 if (parsed_parameters->prohibited_interface_types[i] == 0) {
5633 break;
5634 }
5635
5636 if (necp_ifnet_matches_type(ifp, parsed_parameters->prohibited_interface_types[i], TRUE)) {
5637 return FALSE;
5638 }
5639 }
5640 }
5641
5642 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF) {
5643 for (int i = 0; i < NECP_MAX_INTERFACE_PARAMETERS; i++) {
5644 if (strlen(parsed_parameters->prohibited_interfaces[i]) == 0) {
5645 break;
5646 }
5647
5648 if (necp_ifnet_matches_name(ifp, parsed_parameters->prohibited_interfaces[i], TRUE)) {
5649 return FALSE;
5650 }
5651 }
5652 }
5653
5654 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
5655 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5656 if (uuid_is_null(parsed_parameters->required_netagents[i])) {
5657 break;
5658 }
5659
5660 if (!necp_ifnet_matches_agent(ifp, &parsed_parameters->required_netagents[i], FALSE)) {
5661 return FALSE;
5662 }
5663
5664 if (require_scoped_field) {
5665 matched_some_scoped_field = TRUE;
5666 }
5667 }
5668 }
5669
5670 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT) {
5671 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5672 if (uuid_is_null(parsed_parameters->prohibited_netagents[i])) {
5673 break;
5674 }
5675
5676 if (necp_ifnet_matches_agent(ifp, &parsed_parameters->prohibited_netagents[i], TRUE)) {
5677 return FALSE;
5678 }
5679 }
5680 }
5681
5682 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
5683 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5684 if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 &&
5685 strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
5686 break;
5687 }
5688
5689 if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->required_netagent_types[i].netagent_domain, parsed_parameters->required_netagent_types[i].netagent_type, FALSE)) {
5690 return FALSE;
5691 }
5692
5693 if (require_scoped_field) {
5694 matched_some_scoped_field = TRUE;
5695 }
5696 }
5697 }
5698
5699 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE) {
5700 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5701 if (strlen(parsed_parameters->prohibited_netagent_types[i].netagent_domain) == 0 &&
5702 strlen(parsed_parameters->prohibited_netagent_types[i].netagent_type) == 0) {
5703 break;
5704 }
5705
5706 if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->prohibited_netagent_types[i].netagent_domain, parsed_parameters->prohibited_netagent_types[i].netagent_type, TRUE)) {
5707 return FALSE;
5708 }
5709 }
5710 }
5711
5712 // Checked preferred properties
5713 if (preferred_count) {
5714 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT) {
5715 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5716 if (uuid_is_null(parsed_parameters->preferred_netagents[i])) {
5717 break;
5718 }
5719
5720 if (necp_ifnet_matches_agent(ifp, &parsed_parameters->preferred_netagents[i], TRUE)) {
5721 (*preferred_count)++;
5722 if (require_scoped_field) {
5723 matched_some_scoped_field = TRUE;
5724 }
5725 }
5726 }
5727 }
5728
5729 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE) {
5730 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5731 if (strlen(parsed_parameters->preferred_netagent_types[i].netagent_domain) == 0 &&
5732 strlen(parsed_parameters->preferred_netagent_types[i].netagent_type) == 0) {
5733 break;
5734 }
5735
5736 if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->preferred_netagent_types[i].netagent_domain, parsed_parameters->preferred_netagent_types[i].netagent_type, TRUE)) {
5737 (*preferred_count)++;
5738 if (require_scoped_field) {
5739 matched_some_scoped_field = TRUE;
5740 }
5741 }
5742 }
5743 }
5744
5745 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT) {
5746 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5747 if (uuid_is_null(parsed_parameters->avoided_netagents[i])) {
5748 break;
5749 }
5750
5751 if (!necp_ifnet_matches_agent(ifp, &parsed_parameters->avoided_netagents[i], TRUE)) {
5752 (*preferred_count)++;
5753 }
5754 }
5755 }
5756
5757 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE) {
5758 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
5759 if (strlen(parsed_parameters->avoided_netagent_types[i].netagent_domain) == 0 &&
5760 strlen(parsed_parameters->avoided_netagent_types[i].netagent_type) == 0) {
5761 break;
5762 }
5763
5764 if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->avoided_netagent_types[i].netagent_domain,
5765 parsed_parameters->avoided_netagent_types[i].netagent_type, TRUE)) {
5766 (*preferred_count)++;
5767 }
5768 }
5769 }
5770 }
5771
5772 if (require_scoped_field) {
5773 return matched_some_scoped_field;
5774 }
5775
5776 return TRUE;
5777 }
5778
5779 static bool
necp_find_matching_interface_index(struct necp_client_parsed_parameters * parsed_parameters,u_int * return_ifindex,bool * validate_agents)5780 necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters,
5781 u_int *return_ifindex, bool *validate_agents)
5782 {
5783 struct ifnet *ifp = NULL;
5784 u_int32_t best_preferred_count = 0;
5785 bool has_preferred_fields = FALSE;
5786 *return_ifindex = 0;
5787
5788 if (parsed_parameters->required_interface_index != 0) {
5789 *return_ifindex = parsed_parameters->required_interface_index;
5790 return TRUE;
5791 }
5792
5793 // Check and save off flags
5794 u_int32_t flags = 0;
5795 bool has_prohibit_flags = FALSE;
5796 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) {
5797 flags = parsed_parameters->flags;
5798 has_prohibit_flags = (parsed_parameters->flags &
5799 (NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE |
5800 NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED));
5801 }
5802
5803 if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS) &&
5804 !has_prohibit_flags) {
5805 return TRUE;
5806 }
5807
5808 has_preferred_fields = (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS);
5809
5810 // We have interesting parameters to parse and find a matching interface
5811 ifnet_head_lock_shared();
5812
5813 if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS) &&
5814 !has_preferred_fields) {
5815 // We do have fields to match, but they are only prohibitory
5816 // If the first interface in the list matches, or there are no ordered interfaces, we don't need to scope
5817 ifp = TAILQ_FIRST(&ifnet_ordered_head);
5818 if (ifp == NULL || necp_ifnet_matches_parameters(ifp, parsed_parameters, 0, NULL, false, false)) {
5819 // Don't set return_ifindex, so the client doesn't need to scope
5820 ifnet_head_done();
5821 return TRUE;
5822 }
5823 }
5824
5825 // First check the ordered interface list
5826 TAILQ_FOREACH(ifp, &ifnet_ordered_head, if_ordered_link) {
5827 u_int32_t preferred_count = 0;
5828 if (necp_ifnet_matches_parameters(ifp, parsed_parameters, flags, &preferred_count, false, false)) {
5829 if (preferred_count > best_preferred_count ||
5830 *return_ifindex == 0) {
5831 // Everything matched, and is most preferred. Return this interface.
5832 *return_ifindex = ifp->if_index;
5833 best_preferred_count = preferred_count;
5834
5835 if (!has_preferred_fields) {
5836 break;
5837 }
5838 }
5839 }
5840
5841 if (has_prohibit_flags &&
5842 ifp == TAILQ_FIRST(&ifnet_ordered_head)) {
5843 // This was the first interface. From here on, if the
5844 // client prohibited either expensive or constrained,
5845 // don't allow either as a secondary interface option.
5846 flags |= (NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE |
5847 NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED);
5848 }
5849 }
5850
5851 bool is_listener = ((parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
5852 (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER));
5853
5854 // Then check the remaining interfaces
5855 if ((parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS) &&
5856 ((!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)) ||
5857 necp_interface_type_should_match_unranked_interfaces(parsed_parameters->required_interface_type) ||
5858 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR) ||
5859 is_listener) &&
5860 (*return_ifindex == 0 || has_preferred_fields)) {
5861 TAILQ_FOREACH(ifp, &ifnet_head, if_link) {
5862 u_int32_t preferred_count = 0;
5863 if (NECP_IFP_IS_ON_ORDERED_LIST(ifp)) {
5864 // This interface was in the ordered list, skip
5865 continue;
5866 }
5867 if (necp_ifnet_matches_parameters(ifp, parsed_parameters, flags, &preferred_count, false, true)) {
5868 if (preferred_count > best_preferred_count ||
5869 *return_ifindex == 0) {
5870 // Everything matched, and is most preferred. Return this interface.
5871 *return_ifindex = ifp->if_index;
5872 best_preferred_count = preferred_count;
5873
5874 if (!has_preferred_fields) {
5875 break;
5876 }
5877 }
5878 }
5879 }
5880 }
5881
5882 ifnet_head_done();
5883
5884 if (has_preferred_fields && best_preferred_count == 0 &&
5885 ((parsed_parameters->valid_fields & (NECP_PARSED_PARAMETERS_SCOPED_FIELDS | NECP_PARSED_PARAMETERS_PREFERRED_FIELDS)) ==
5886 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS))) {
5887 // If only has preferred ifnet fields, and nothing was found, clear the interface index and return TRUE
5888 *return_ifindex = 0;
5889 return TRUE;
5890 }
5891
5892 if (*return_ifindex == 0 &&
5893 !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS)) {
5894 // Has required fields, but not including specific interface fields. Pass for now, and check
5895 // to see if agents are satisfied by policy.
5896 *validate_agents = TRUE;
5897 return TRUE;
5898 }
5899
5900 return *return_ifindex != 0;
5901 }
5902
5903 void
necp_copy_inp_domain_info(struct inpcb * inp,struct socket * so,nstat_domain_info * domain_info)5904 necp_copy_inp_domain_info(struct inpcb *inp, struct socket *so, nstat_domain_info *domain_info)
5905 {
5906 if (inp == NULL || so == NULL || domain_info == NULL) {
5907 return;
5908 }
5909
5910 necp_lock_socket_attributes();
5911
5912 domain_info->is_tracker = !!(so->so_flags1 & SOF1_KNOWN_TRACKER);
5913 domain_info->is_non_app_initiated = !!(so->so_flags1 & SOF1_TRACKER_NON_APP_INITIATED);
5914 if (domain_info->is_tracker &&
5915 inp->inp_necp_attributes.inp_tracker_domain != NULL) {
5916 strlcpy(domain_info->domain_name, inp->inp_necp_attributes.inp_tracker_domain,
5917 sizeof(domain_info->domain_name));
5918 } else if (inp->inp_necp_attributes.inp_domain != NULL) {
5919 strlcpy(domain_info->domain_name, inp->inp_necp_attributes.inp_domain,
5920 sizeof(domain_info->domain_name));
5921 }
5922 if (inp->inp_necp_attributes.inp_domain_owner != NULL) {
5923 strlcpy(domain_info->domain_owner, inp->inp_necp_attributes.inp_domain_owner,
5924 sizeof(domain_info->domain_owner));
5925 }
5926 if (inp->inp_necp_attributes.inp_domain_context != NULL) {
5927 strlcpy(domain_info->domain_tracker_ctxt, inp->inp_necp_attributes.inp_domain_context,
5928 sizeof(domain_info->domain_tracker_ctxt));
5929 }
5930
5931 necp_unlock_socket_attributes();
5932 }
5933
5934 void
necp_with_inp_domain_name(struct socket * so,void * ctx,void (* with_func)(char * domain_name,void * ctx))5935 necp_with_inp_domain_name(struct socket *so, void *ctx, void (*with_func)(char *domain_name, void *ctx))
5936 {
5937 struct inpcb *inp = NULL;
5938
5939 if (so == NULL || with_func == NULL) {
5940 return;
5941 }
5942
5943 inp = (struct inpcb *)so->so_pcb;
5944 if (inp == NULL) {
5945 return;
5946 }
5947
5948 necp_lock_socket_attributes();
5949 with_func(inp->inp_necp_attributes.inp_domain, ctx);
5950 necp_unlock_socket_attributes();
5951 }
5952
5953 static size_t
necp_find_domain_info_common(struct necp_client * client,u_int8_t * parameters,size_t parameters_size,struct necp_client_flow_registration * flow_registration,nstat_domain_info * domain_info)5954 necp_find_domain_info_common(struct necp_client *client,
5955 u_int8_t *parameters,
5956 size_t parameters_size,
5957 struct necp_client_flow_registration *flow_registration, /* For logging purposes only */
5958 nstat_domain_info *domain_info)
5959 {
5960 if (client == NULL) {
5961 return 0;
5962 }
5963 if (domain_info == NULL) {
5964 return sizeof(nstat_domain_info);
5965 }
5966
5967 size_t offset = 0;
5968 u_int32_t flags = 0;
5969 u_int8_t *tracker_domain = NULL;
5970 u_int8_t *domain = NULL;
5971 size_t tracker_domain_length = 0;
5972 size_t domain_length = 0;
5973
5974 NECP_CLIENT_FLOW_LOG(client, flow_registration, "Collecting stats");
5975
5976 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
5977 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
5978 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
5979
5980 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
5981 // If the length is larger than what can fit in the remaining parameters size, bail
5982 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
5983 break;
5984 }
5985
5986 if (length > 0) {
5987 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
5988 if (value != NULL) {
5989 switch (type) {
5990 case NECP_CLIENT_PARAMETER_FLAGS: {
5991 if (length >= sizeof(u_int32_t)) {
5992 memcpy(&flags, value, sizeof(u_int32_t));
5993 }
5994
5995 domain_info->is_tracker =
5996 !!(flags & NECP_CLIENT_PARAMETER_FLAG_KNOWN_TRACKER);
5997 domain_info->is_non_app_initiated =
5998 !!(flags & NECP_CLIENT_PARAMETER_FLAG_NON_APP_INITIATED);
5999 domain_info->is_silent =
6000 !!(flags & NECP_CLIENT_PARAMETER_FLAG_SILENT);
6001 break;
6002 }
6003 case NECP_CLIENT_PARAMETER_TRACKER_DOMAIN: {
6004 tracker_domain_length = length;
6005 tracker_domain = value;
6006 break;
6007 }
6008 case NECP_CLIENT_PARAMETER_DOMAIN: {
6009 domain_length = length;
6010 domain = value;
6011 break;
6012 }
6013 case NECP_CLIENT_PARAMETER_DOMAIN_OWNER: {
6014 size_t length_to_copy = MIN(length, sizeof(domain_info->domain_owner));
6015 strlcpy(domain_info->domain_owner, (const char *)value, length_to_copy);
6016 break;
6017 }
6018 case NECP_CLIENT_PARAMETER_DOMAIN_CONTEXT: {
6019 size_t length_to_copy = MIN(length, sizeof(domain_info->domain_tracker_ctxt));
6020 strlcpy(domain_info->domain_tracker_ctxt, (const char *)value, length_to_copy);
6021 break;
6022 }
6023 case NECP_CLIENT_PARAMETER_ATTRIBUTED_BUNDLE_IDENTIFIER: {
6024 size_t length_to_copy = MIN(length, sizeof(domain_info->domain_attributed_bundle_id));
6025 strlcpy(domain_info->domain_attributed_bundle_id, (const char *)value, length_to_copy);
6026 break;
6027 }
6028 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
6029 if (length >= sizeof(struct necp_policy_condition_addr)) {
6030 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
6031 if (necp_client_address_is_valid(&address_struct->address.sa)) {
6032 memcpy(&domain_info->remote, &address_struct->address, sizeof(address_struct->address));
6033 }
6034 }
6035 break;
6036 }
6037 default: {
6038 break;
6039 }
6040 }
6041 }
6042 }
6043 offset += sizeof(struct necp_tlv_header) + length;
6044 }
6045
6046 if (domain_info->is_tracker && tracker_domain != NULL && tracker_domain_length > 0) {
6047 size_t length_to_copy = MIN(tracker_domain_length, sizeof(domain_info->domain_name));
6048 strlcpy(domain_info->domain_name, (const char *)tracker_domain, length_to_copy);
6049 } else if (domain != NULL && domain_length > 0) {
6050 size_t length_to_copy = MIN(domain_length, sizeof(domain_info->domain_name));
6051 strlcpy(domain_info->domain_name, (const char *)domain, length_to_copy);
6052 }
6053
6054 NECP_CLIENT_FLOW_LOG(client, flow_registration,
6055 "Collected stats - domain <%s> owner <%s> ctxt <%s> bundle id <%s> "
6056 "is_tracker %d is_non_app_initiated %d is_silent %d",
6057 domain_info->domain_name,
6058 domain_info->domain_owner,
6059 domain_info->domain_tracker_ctxt,
6060 domain_info->domain_attributed_bundle_id,
6061 domain_info->is_tracker,
6062 domain_info->is_non_app_initiated,
6063 domain_info->is_silent);
6064
6065 return sizeof(nstat_domain_info);
6066 }
6067
6068 static size_t
necp_find_conn_extension_info(nstat_provider_context ctx,int requested_extension,void * buf,size_t buf_size)6069 necp_find_conn_extension_info(nstat_provider_context ctx,
6070 int requested_extension, /* The extension to be returned */
6071 void *buf, /* If not NULL, the address for extensions to be returned in */
6072 size_t buf_size) /* The size of the buffer space, typically matching the return from a previous call with a NULL buf pointer */
6073 {
6074 // Note, the caller has guaranteed that any buffer has been zeroed, there is no need to clear it again
6075
6076 if (ctx == NULL) {
6077 return 0;
6078 }
6079 struct necp_client *client = (struct necp_client *)ctx;
6080 switch (requested_extension) {
6081 case NSTAT_EXTENDED_UPDATE_TYPE_DOMAIN:
6082 // This is for completeness. The intent is that domain information can be extracted at user level from the TLV parameters
6083 if (buf == NULL) {
6084 return sizeof(nstat_domain_info);
6085 }
6086 if (buf_size < sizeof(nstat_domain_info)) {
6087 return 0;
6088 }
6089 return necp_find_domain_info_common(client, client->parameters, client->parameters_length, NULL, (nstat_domain_info *)buf);
6090
6091 case NSTAT_EXTENDED_UPDATE_TYPE_NECP_TLV: {
6092 size_t parameters_length = client->parameters_length;
6093 if (buf == NULL) {
6094 return parameters_length;
6095 }
6096 if (buf_size < parameters_length) {
6097 return 0;
6098 }
6099 memcpy(buf, client->parameters, parameters_length);
6100 return parameters_length;
6101 }
6102 case NSTAT_EXTENDED_UPDATE_TYPE_ORIGINAL_NECP_TLV:
6103 if (buf == NULL) {
6104 return (client->original_parameters_source != NULL) ? client->original_parameters_source->parameters_length : 0;
6105 }
6106 if ((client->original_parameters_source == NULL) || (buf_size < client->original_parameters_source->parameters_length)) {
6107 return 0;
6108 }
6109 memcpy(buf, client->original_parameters_source->parameters, client->original_parameters_source->parameters_length);
6110 return client->original_parameters_source->parameters_length;
6111
6112 case NSTAT_EXTENDED_UPDATE_TYPE_ORIGINAL_DOMAIN:
6113 if (buf == NULL) {
6114 return (client->original_parameters_source != NULL) ? sizeof(nstat_domain_info) : 0;
6115 }
6116 if ((buf_size < sizeof(nstat_domain_info)) || (client->original_parameters_source == NULL)) {
6117 return 0;
6118 }
6119 return necp_find_domain_info_common(client, client->original_parameters_source->parameters, client->original_parameters_source->parameters_length,
6120 NULL, (nstat_domain_info *)buf);
6121
6122 default:
6123 return 0;
6124 }
6125 }
6126
6127 #if SKYWALK
6128
6129 static size_t
necp_find_extension_info(userland_stats_provider_context * ctx,int requested_extension,void * buf,size_t buf_size)6130 necp_find_extension_info(userland_stats_provider_context *ctx,
6131 int requested_extension, /* The extension to be returned */
6132 void *buf, /* If not NULL, the address for extensions to be returned in */
6133 size_t buf_size) /* The size of the buffer space, typically matching the return from a previous call with a NULL buf pointer */
6134 {
6135 if (ctx == NULL) {
6136 return 0;
6137 }
6138 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6139 struct necp_client *client = flow_registration->client;
6140
6141 switch (requested_extension) {
6142 case NSTAT_EXTENDED_UPDATE_TYPE_DOMAIN:
6143 if (buf == NULL) {
6144 return sizeof(nstat_domain_info);
6145 }
6146 if (buf_size < sizeof(nstat_domain_info)) {
6147 return 0;
6148 }
6149 return necp_find_domain_info_common(client, client->parameters, client->parameters_length, flow_registration, (nstat_domain_info *)buf);
6150
6151 case NSTAT_EXTENDED_UPDATE_TYPE_NECP_TLV:
6152 if (buf == NULL) {
6153 return client->parameters_length;
6154 }
6155 if (buf_size < client->parameters_length) {
6156 return 0;
6157 }
6158 memcpy(buf, client->parameters, client->parameters_length);
6159 return client->parameters_length;
6160
6161 case NSTAT_EXTENDED_UPDATE_TYPE_FUUID:
6162 if (buf == NULL) {
6163 return sizeof(uuid_t);
6164 }
6165 if (buf_size < sizeof(uuid_t)) {
6166 return 0;
6167 }
6168 uuid_copy(buf, flow_registration->registration_id);
6169 return sizeof(uuid_t);
6170
6171 default:
6172 return 0;
6173 }
6174 }
6175
6176 static void
necp_find_netstat_data(struct necp_client * client,union necp_sockaddr_union * remote,pid_t * effective_pid,uid_t * uid,uuid_t euuid,uid_t * persona_id,u_int32_t * traffic_class,u_int8_t * fallback_mode)6177 necp_find_netstat_data(struct necp_client *client,
6178 union necp_sockaddr_union *remote,
6179 pid_t *effective_pid,
6180 uid_t *uid,
6181 uuid_t euuid,
6182 uid_t *persona_id,
6183 u_int32_t *traffic_class,
6184 u_int8_t *fallback_mode)
6185 {
6186 size_t offset = 0;
6187 u_int8_t *parameters;
6188 u_int32_t parameters_size;
6189
6190 parameters = client->parameters;
6191 parameters_size = (u_int32_t)client->parameters_length;
6192
6193 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
6194 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
6195 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
6196
6197 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
6198 // If the length is larger than what can fit in the remaining parameters size, bail
6199 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
6200 break;
6201 }
6202
6203 if (length > 0) {
6204 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
6205 if (value != NULL) {
6206 switch (type) {
6207 case NECP_CLIENT_PARAMETER_APPLICATION: {
6208 if (length >= sizeof(uuid_t)) {
6209 uuid_copy(euuid, value);
6210 }
6211 break;
6212 }
6213 case NECP_CLIENT_PARAMETER_PID: {
6214 if (length >= sizeof(pid_t)) {
6215 memcpy(effective_pid, value, sizeof(pid_t));
6216 }
6217 break;
6218 }
6219 case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: {
6220 if (length >= sizeof(u_int32_t)) {
6221 memcpy(traffic_class, value, sizeof(u_int32_t));
6222 }
6223 break;
6224 }
6225 case NECP_CLIENT_PARAMETER_FALLBACK_MODE: {
6226 if (length >= sizeof(u_int8_t)) {
6227 memcpy(fallback_mode, value, sizeof(u_int8_t));
6228 }
6229 break;
6230 }
6231 // It is an implementation quirk that the remote address can be found in the necp parameters
6232 // while the local address must be retrieved from the flowswitch
6233 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
6234 if (length >= sizeof(struct necp_policy_condition_addr)) {
6235 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
6236 if (necp_client_address_is_valid(&address_struct->address.sa)) {
6237 memcpy(remote, &address_struct->address, sizeof(address_struct->address));
6238 }
6239 }
6240 break;
6241 }
6242 case NECP_CLIENT_PARAMETER_APPLICATION_ID: {
6243 if (length >= sizeof(necp_application_id_t) && uid && persona_id) {
6244 necp_application_id_t *application_id = (necp_application_id_t *)(void *)value;
6245 memcpy(uid, &application_id->uid, sizeof(uid_t));
6246 uuid_copy(euuid, application_id->effective_uuid);
6247 memcpy(persona_id, &application_id->persona_id, sizeof(uid_t));
6248 }
6249 break;
6250 }
6251 default: {
6252 break;
6253 }
6254 }
6255 }
6256 }
6257 offset += sizeof(struct necp_tlv_header) + length;
6258 }
6259 }
6260
6261 static u_int64_t
necp_find_netstat_initial_properties(struct necp_client * client)6262 necp_find_netstat_initial_properties(struct necp_client *client)
6263 {
6264 size_t offset = 0;
6265 u_int64_t retval = 0;
6266 u_int8_t *parameters;
6267 u_int32_t parameters_size;
6268
6269 parameters = client->parameters;
6270 parameters_size = (u_int32_t)client->parameters_length;
6271
6272 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
6273 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
6274 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
6275
6276 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
6277 // If the length is larger than what can fit in the remaining parameters size, bail
6278 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
6279 break;
6280 }
6281
6282 if (type == NECP_CLIENT_PARAMETER_FLAGS) {
6283 u_int32_t policy_condition_client_flags;
6284 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
6285 if ((value != NULL) && (length >= sizeof(policy_condition_client_flags))) {
6286 memcpy(&policy_condition_client_flags, value, sizeof(policy_condition_client_flags));
6287 if (policy_condition_client_flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
6288 retval |= NSTAT_SOURCE_IS_LISTENER;
6289 }
6290 if (policy_condition_client_flags & NECP_CLIENT_PARAMETER_FLAG_INBOUND) {
6291 retval |= NSTAT_SOURCE_IS_INBOUND;
6292 }
6293 }
6294 break;
6295 }
6296 offset += sizeof(struct necp_tlv_header) + length;
6297 }
6298 if (retval == 0) {
6299 retval = NSTAT_SOURCE_IS_OUTBOUND;
6300 }
6301 return retval;
6302 }
6303
6304 // Called from NetworkStatistics when it wishes to collect latest information for a TCP flow.
6305 // It is a responsibility of NetworkStatistics to have previously zeroed any supplied memory.
6306 static bool
necp_request_tcp_netstats(userland_stats_provider_context * ctx,u_int16_t * ifflagsp,nstat_progress_digest * digestp,nstat_counts * countsp,void * metadatap)6307 necp_request_tcp_netstats(userland_stats_provider_context *ctx,
6308 u_int16_t *ifflagsp,
6309 nstat_progress_digest *digestp,
6310 nstat_counts *countsp,
6311 void *metadatap)
6312 {
6313 if (ctx == NULL) {
6314 return false;
6315 }
6316
6317 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6318 struct necp_client *client = flow_registration->client;
6319 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
6320 struct necp_tcp_stats *tcpstats = (struct necp_tcp_stats *)ustats_kaddr;
6321 ASSERT(tcpstats != NULL);
6322
6323 u_int16_t nstat_diagnostic_flags = 0;
6324
6325 // Retrieve details from the last time the assigned flows were updated
6326 u_int32_t route_ifindex = IFSCOPE_NONE;
6327 u_int16_t route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6328 u_int64_t combined_interface_details = 0;
6329
6330 combined_interface_details = os_atomic_load(&flow_registration->last_interface_details, relaxed);
6331 split_interface_details(combined_interface_details, &route_ifindex, &route_ifflags);
6332
6333 if (route_ifindex == IFSCOPE_NONE) {
6334 // Mark no interface
6335 nstat_diagnostic_flags |= NSTAT_IFNET_ROUTE_VALUE_UNOBTAINABLE;
6336 route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6337 NECPLOG(LOG_INFO, "req tcp stats, failed to get route details for pid %d curproc %d %s\n",
6338 client->proc_pid, proc_pid(current_proc()), proc_best_name(current_proc()));
6339 }
6340
6341 if (ifflagsp) {
6342 *ifflagsp = route_ifflags | nstat_diagnostic_flags;
6343 if (tcpstats->necp_tcp_extra.flags1 & SOF1_CELLFALLBACK) {
6344 *ifflagsp |= NSTAT_IFNET_VIA_CELLFALLBACK;
6345 }
6346 if ((digestp == NULL) && (countsp == NULL) && (metadatap == NULL)) {
6347 return true;
6348 }
6349 }
6350
6351 if (digestp) {
6352 // The digest is intended to give information that may help give insight into the state of the link
6353 // while avoiding the need to do the relatively expensive flowswitch lookup
6354 digestp->rxbytes = tcpstats->necp_tcp_counts.necp_stat_rxbytes;
6355 digestp->txbytes = tcpstats->necp_tcp_counts.necp_stat_txbytes;
6356 digestp->rxduplicatebytes = tcpstats->necp_tcp_counts.necp_stat_rxduplicatebytes;
6357 digestp->rxoutoforderbytes = tcpstats->necp_tcp_counts.necp_stat_rxoutoforderbytes;
6358 digestp->txretransmit = tcpstats->necp_tcp_counts.necp_stat_txretransmit;
6359 digestp->ifindex = route_ifindex;
6360 digestp->state = tcpstats->necp_tcp_extra.state;
6361 digestp->txunacked = tcpstats->necp_tcp_extra.txunacked;
6362 digestp->txwindow = tcpstats->necp_tcp_extra.txwindow;
6363 digestp->connstatus.probe_activated = tcpstats->necp_tcp_extra.probestatus.probe_activated;
6364 digestp->connstatus.write_probe_failed = tcpstats->necp_tcp_extra.probestatus.write_probe_failed;
6365 digestp->connstatus.read_probe_failed = tcpstats->necp_tcp_extra.probestatus.read_probe_failed;
6366 digestp->connstatus.conn_probe_failed = tcpstats->necp_tcp_extra.probestatus.conn_probe_failed;
6367
6368 if ((countsp == NULL) && (metadatap == NULL)) {
6369 return true;
6370 }
6371 }
6372
6373 const struct sk_stats_flow *sf = &flow_registration->nexus_stats->fs_stats;
6374 if (sf == NULL) {
6375 nstat_diagnostic_flags |= NSTAT_IFNET_FLOWSWITCH_VALUE_UNOBTAINABLE;
6376 char namebuf[MAXCOMLEN + 1];
6377 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
6378 proc_name(client->proc_pid, namebuf, sizeof(namebuf));
6379 NECPLOG(LOG_ERR, "req tcp stats, necp_client flow_registration flow_stats missing for pid %d %s curproc %d %s\n",
6380 client->proc_pid, namebuf, proc_pid(current_proc()), proc_best_name(current_proc()));
6381 sf = &ntstat_sk_stats_zero;
6382 }
6383
6384 if (countsp) {
6385 countsp->nstat_rxbytes = tcpstats->necp_tcp_counts.necp_stat_rxbytes;
6386 countsp->nstat_txbytes = tcpstats->necp_tcp_counts.necp_stat_txbytes;
6387
6388 countsp->nstat_rxduplicatebytes = tcpstats->necp_tcp_counts.necp_stat_rxduplicatebytes;
6389 countsp->nstat_rxoutoforderbytes = tcpstats->necp_tcp_counts.necp_stat_rxoutoforderbytes;
6390 countsp->nstat_txretransmit = tcpstats->necp_tcp_counts.necp_stat_txretransmit;
6391
6392 countsp->nstat_min_rtt = tcpstats->necp_tcp_counts.necp_stat_min_rtt;
6393 countsp->nstat_avg_rtt = tcpstats->necp_tcp_counts.necp_stat_avg_rtt;
6394 countsp->nstat_var_rtt = tcpstats->necp_tcp_counts.necp_stat_var_rtt;
6395
6396 countsp->nstat_connectattempts = tcpstats->necp_tcp_extra.state >= TCPS_SYN_SENT ? 1 : 0;
6397 countsp->nstat_connectsuccesses = tcpstats->necp_tcp_extra.state >= TCPS_ESTABLISHED ? 1 : 0;
6398
6399 // Supplement what the user level has told us with what we know from the flowswitch
6400 countsp->nstat_rxpackets = sf->sf_ipackets;
6401 countsp->nstat_txpackets = sf->sf_opackets;
6402 if (route_ifflags & NSTAT_IFNET_IS_CELLULAR) {
6403 countsp->nstat_cell_rxbytes = sf->sf_ibytes;
6404 countsp->nstat_cell_txbytes = sf->sf_obytes;
6405 } else if (route_ifflags & NSTAT_IFNET_IS_WIFI) {
6406 countsp->nstat_wifi_rxbytes = sf->sf_ibytes;
6407 countsp->nstat_wifi_txbytes = sf->sf_obytes;
6408 } else if (route_ifflags & NSTAT_IFNET_IS_WIRED) {
6409 countsp->nstat_wired_rxbytes = sf->sf_ibytes;
6410 countsp->nstat_wired_txbytes = sf->sf_obytes;
6411 }
6412 }
6413
6414 if (metadatap) {
6415 nstat_tcp_descriptor *desc = (nstat_tcp_descriptor *)metadatap;
6416 memset(desc, 0, sizeof(*desc));
6417
6418 // Metadata from the flow registration
6419 uuid_copy(desc->fuuid, flow_registration->registration_id);
6420
6421 // Metadata that the necp client should have in TLV format.
6422 pid_t effective_pid = client->proc_pid;
6423 necp_find_netstat_data(client, (union necp_sockaddr_union *)&desc->remote, &effective_pid, &desc->uid, desc->euuid, &desc->persona_id, &desc->traffic_class, &desc->fallback_mode);
6424 desc->epid = (u_int32_t)effective_pid;
6425
6426 // Metadata from the flow registration
6427 // This needs to revisited if multiple flows are created from one flow registration
6428 struct necp_client_flow *flow = NULL;
6429 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
6430 memcpy(&desc->local, &flow->local_addr, sizeof(desc->local));
6431 break;
6432 }
6433
6434 // Metadata from the route
6435 desc->ifindex = route_ifindex;
6436 desc->ifnet_properties = route_ifflags | nstat_diagnostic_flags;
6437 desc->ifnet_properties |= (sf->sf_flags & SFLOWF_ONLINK) ? NSTAT_IFNET_IS_LOCAL : NSTAT_IFNET_IS_NON_LOCAL;
6438 if (tcpstats->necp_tcp_extra.flags1 & SOF1_CELLFALLBACK) {
6439 desc->ifnet_properties |= NSTAT_IFNET_VIA_CELLFALLBACK;
6440 }
6441
6442 // Basic metadata from userland
6443 desc->rcvbufsize = tcpstats->necp_tcp_basic.rcvbufsize;
6444 desc->rcvbufused = tcpstats->necp_tcp_basic.rcvbufused;
6445
6446 // Additional TCP specific data
6447 desc->sndbufsize = tcpstats->necp_tcp_extra.sndbufsize;
6448 desc->sndbufused = tcpstats->necp_tcp_extra.sndbufused;
6449 desc->txunacked = tcpstats->necp_tcp_extra.txunacked;
6450 desc->txwindow = tcpstats->necp_tcp_extra.txwindow;
6451 desc->txcwindow = tcpstats->necp_tcp_extra.txcwindow;
6452 desc->traffic_mgt_flags = tcpstats->necp_tcp_extra.traffic_mgt_flags;
6453 desc->state = tcpstats->necp_tcp_extra.state;
6454
6455 u_int32_t cc_alg_index = tcpstats->necp_tcp_extra.cc_alg_index;
6456 if (cc_alg_index < TCP_CC_ALGO_COUNT) {
6457 strlcpy(desc->cc_algo, tcp_cc_algo_list[cc_alg_index]->name, sizeof(desc->cc_algo));
6458 } else {
6459 strlcpy(desc->cc_algo, "unknown", sizeof(desc->cc_algo));
6460 }
6461
6462 desc->connstatus.probe_activated = tcpstats->necp_tcp_extra.probestatus.probe_activated;
6463 desc->connstatus.write_probe_failed = tcpstats->necp_tcp_extra.probestatus.write_probe_failed;
6464 desc->connstatus.read_probe_failed = tcpstats->necp_tcp_extra.probestatus.read_probe_failed;
6465 desc->connstatus.conn_probe_failed = tcpstats->necp_tcp_extra.probestatus.conn_probe_failed;
6466
6467 memcpy(&desc->activity_bitmap, &sf->sf_activity, sizeof(sf->sf_activity));
6468
6469 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_FLOW)) {
6470 uuid_string_t euuid_str = { 0 };
6471 uuid_unparse(desc->euuid, euuid_str);
6472 NECPLOG(LOG_NOTICE, "Collected stats - TCP - epid %d uid %d euuid %s persona id %d", desc->epid, desc->uid, euuid_str, desc->persona_id);
6473 }
6474 }
6475
6476 return true;
6477 }
6478
6479 // Called from NetworkStatistics when it wishes to collect latest information for a UDP flow.
6480 static bool
necp_request_udp_netstats(userland_stats_provider_context * ctx,u_int16_t * ifflagsp,nstat_progress_digest * digestp,nstat_counts * countsp,void * metadatap)6481 necp_request_udp_netstats(userland_stats_provider_context *ctx,
6482 u_int16_t *ifflagsp,
6483 nstat_progress_digest *digestp,
6484 nstat_counts *countsp,
6485 void *metadatap)
6486 {
6487 #pragma unused(digestp)
6488
6489 if (ctx == NULL) {
6490 return false;
6491 }
6492
6493 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6494 struct necp_client *client = flow_registration->client;
6495 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
6496 struct necp_udp_stats *udpstats = (struct necp_udp_stats *)ustats_kaddr;
6497 ASSERT(udpstats != NULL);
6498
6499 u_int16_t nstat_diagnostic_flags = 0;
6500
6501 // Retrieve details from the last time the assigned flows were updated
6502 u_int32_t route_ifindex = IFSCOPE_NONE;
6503 u_int16_t route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6504 u_int64_t combined_interface_details = 0;
6505
6506 combined_interface_details = os_atomic_load(&flow_registration->last_interface_details, relaxed);
6507 split_interface_details(combined_interface_details, &route_ifindex, &route_ifflags);
6508
6509 if (route_ifindex == IFSCOPE_NONE) {
6510 // Mark no interface
6511 nstat_diagnostic_flags |= NSTAT_IFNET_ROUTE_VALUE_UNOBTAINABLE;
6512 route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6513 NECPLOG(LOG_INFO, "req udp stats, failed to get route details for pid %d curproc %d %s\n",
6514 client->proc_pid, proc_pid(current_proc()), proc_best_name(current_proc()));
6515 }
6516
6517 if (ifflagsp) {
6518 *ifflagsp = route_ifflags | nstat_diagnostic_flags;
6519 if ((countsp == NULL) && (metadatap == NULL)) {
6520 return true;
6521 }
6522 }
6523 const struct sk_stats_flow *sf = &flow_registration->nexus_stats->fs_stats;
6524 if (sf == NULL) {
6525 nstat_diagnostic_flags |= NSTAT_IFNET_FLOWSWITCH_VALUE_UNOBTAINABLE;
6526 char namebuf[MAXCOMLEN + 1];
6527 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
6528 proc_name(client->proc_pid, namebuf, sizeof(namebuf));
6529 NECPLOG(LOG_ERR, "req udp stats, necp_client flow_registration flow_stats missing for pid %d %s curproc %d %s\n",
6530 client->proc_pid, namebuf, proc_pid(current_proc()), proc_best_name(current_proc()));
6531 sf = &ntstat_sk_stats_zero;
6532 }
6533
6534 if (countsp) {
6535 countsp->nstat_rxbytes = udpstats->necp_udp_counts.necp_stat_rxbytes;
6536 countsp->nstat_txbytes = udpstats->necp_udp_counts.necp_stat_txbytes;
6537
6538 countsp->nstat_rxduplicatebytes = udpstats->necp_udp_counts.necp_stat_rxduplicatebytes;
6539 countsp->nstat_rxoutoforderbytes = udpstats->necp_udp_counts.necp_stat_rxoutoforderbytes;
6540 countsp->nstat_txretransmit = udpstats->necp_udp_counts.necp_stat_txretransmit;
6541
6542 countsp->nstat_min_rtt = udpstats->necp_udp_counts.necp_stat_min_rtt;
6543 countsp->nstat_avg_rtt = udpstats->necp_udp_counts.necp_stat_avg_rtt;
6544 countsp->nstat_var_rtt = udpstats->necp_udp_counts.necp_stat_var_rtt;
6545
6546 // Supplement what the user level has told us with what we know from the flowswitch
6547 countsp->nstat_rxpackets = sf->sf_ipackets;
6548 countsp->nstat_txpackets = sf->sf_opackets;
6549 if (route_ifflags & NSTAT_IFNET_IS_CELLULAR) {
6550 countsp->nstat_cell_rxbytes = sf->sf_ibytes;
6551 countsp->nstat_cell_txbytes = sf->sf_obytes;
6552 } else if (route_ifflags & NSTAT_IFNET_IS_WIFI) {
6553 countsp->nstat_wifi_rxbytes = sf->sf_ibytes;
6554 countsp->nstat_wifi_txbytes = sf->sf_obytes;
6555 } else if (route_ifflags & NSTAT_IFNET_IS_WIRED) {
6556 countsp->nstat_wired_rxbytes = sf->sf_ibytes;
6557 countsp->nstat_wired_txbytes = sf->sf_obytes;
6558 }
6559 }
6560
6561 if (metadatap) {
6562 nstat_udp_descriptor *desc = (nstat_udp_descriptor *)metadatap;
6563 memset(desc, 0, sizeof(*desc));
6564
6565 // Metadata from the flow registration
6566 uuid_copy(desc->fuuid, flow_registration->registration_id);
6567
6568 // Metadata that the necp client should have in TLV format.
6569 pid_t effective_pid = client->proc_pid;
6570 necp_find_netstat_data(client, (union necp_sockaddr_union *)&desc->remote, &effective_pid, &desc->uid, desc->euuid, &desc->persona_id, &desc->traffic_class, &desc->fallback_mode);
6571 desc->epid = (u_int32_t)effective_pid;
6572
6573 // Metadata from the flow registration
6574 // This needs to revisited if multiple flows are created from one flow registration
6575 struct necp_client_flow *flow = NULL;
6576 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
6577 memcpy(&desc->local, &flow->local_addr, sizeof(desc->local));
6578 break;
6579 }
6580
6581 // Metadata from the route
6582 desc->ifindex = route_ifindex;
6583 desc->ifnet_properties = route_ifflags | nstat_diagnostic_flags;
6584
6585 // Basic metadata is all that is required for UDP
6586 desc->rcvbufsize = udpstats->necp_udp_basic.rcvbufsize;
6587 desc->rcvbufused = udpstats->necp_udp_basic.rcvbufused;
6588
6589 memcpy(&desc->activity_bitmap, &sf->sf_activity, sizeof(sf->sf_activity));
6590
6591 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_FLOW)) {
6592 uuid_string_t euuid_str = { 0 };
6593 uuid_unparse(desc->euuid, euuid_str);
6594 NECPLOG(LOG_NOTICE, "Collected stats - UDP - epid %d uid %d euuid %s persona id %d", desc->epid, desc->uid, euuid_str, desc->persona_id);
6595 }
6596 }
6597
6598 return true;
6599 }
6600
6601 // Called from NetworkStatistics when it wishes to collect latest information for a QUIC flow.
6602 //
6603 // TODO: For now it is an exact implementation as that of TCP.
6604 // Still to keep the logic separate for future divergence, keeping the routines separate.
6605 // It also seems there are lots of common code between existing implementations and
6606 // it would be good to refactor this logic at some point.
6607 static bool
necp_request_quic_netstats(userland_stats_provider_context * ctx,u_int16_t * ifflagsp,nstat_progress_digest * digestp,nstat_counts * countsp,void * metadatap)6608 necp_request_quic_netstats(userland_stats_provider_context *ctx,
6609 u_int16_t *ifflagsp,
6610 nstat_progress_digest *digestp,
6611 nstat_counts *countsp,
6612 void *metadatap)
6613 {
6614 if (ctx == NULL) {
6615 return false;
6616 }
6617
6618 struct necp_client_flow_registration *flow_registration = (struct necp_client_flow_registration *)(uintptr_t)ctx;
6619 struct necp_client *client = flow_registration->client;
6620 struct necp_all_stats *ustats_kaddr = ((struct necp_all_kstats *)flow_registration->kstats_kaddr)->necp_stats_ustats;
6621 struct necp_quic_stats *quicstats = (struct necp_quic_stats *)ustats_kaddr;
6622 ASSERT(quicstats != NULL);
6623
6624 u_int16_t nstat_diagnostic_flags = 0;
6625
6626 // Retrieve details from the last time the assigned flows were updated
6627 u_int32_t route_ifindex = IFSCOPE_NONE;
6628 u_int16_t route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6629 u_int64_t combined_interface_details = 0;
6630
6631 combined_interface_details = os_atomic_load(&flow_registration->last_interface_details, relaxed);
6632 split_interface_details(combined_interface_details, &route_ifindex, &route_ifflags);
6633
6634 if (route_ifindex == IFSCOPE_NONE) {
6635 // Mark no interface
6636 nstat_diagnostic_flags |= NSTAT_IFNET_ROUTE_VALUE_UNOBTAINABLE;
6637 route_ifflags = NSTAT_IFNET_IS_UNKNOWN_TYPE;
6638 NECPLOG(LOG_INFO, "req quic stats, failed to get route details for pid %d curproc %d %s\n",
6639 client->proc_pid, proc_pid(current_proc()), proc_best_name(current_proc()));
6640 }
6641
6642 if (ifflagsp) {
6643 *ifflagsp = route_ifflags | nstat_diagnostic_flags;
6644 if ((digestp == NULL) && (countsp == NULL) && (metadatap == NULL)) {
6645 return true;
6646 }
6647 }
6648
6649 if (digestp) {
6650 // The digest is intended to give information that may help give insight into the state of the link
6651 // while avoiding the need to do the relatively expensive flowswitch lookup
6652 digestp->rxbytes = quicstats->necp_quic_counts.necp_stat_rxbytes;
6653 digestp->txbytes = quicstats->necp_quic_counts.necp_stat_txbytes;
6654 digestp->rxduplicatebytes = quicstats->necp_quic_counts.necp_stat_rxduplicatebytes;
6655 digestp->rxoutoforderbytes = quicstats->necp_quic_counts.necp_stat_rxoutoforderbytes;
6656 digestp->txretransmit = quicstats->necp_quic_counts.necp_stat_txretransmit;
6657 digestp->ifindex = route_ifindex;
6658 digestp->state = quicstats->necp_quic_extra.state;
6659 digestp->txunacked = quicstats->necp_quic_extra.txunacked;
6660 digestp->txwindow = quicstats->necp_quic_extra.txwindow;
6661 digestp->connstatus.probe_activated = quicstats->necp_quic_extra.probestatus.probe_activated;
6662 digestp->connstatus.write_probe_failed = quicstats->necp_quic_extra.probestatus.write_probe_failed;
6663 digestp->connstatus.read_probe_failed = quicstats->necp_quic_extra.probestatus.read_probe_failed;
6664 digestp->connstatus.conn_probe_failed = quicstats->necp_quic_extra.probestatus.conn_probe_failed;
6665
6666 if ((countsp == NULL) && (metadatap == NULL)) {
6667 return true;
6668 }
6669 }
6670
6671 const struct sk_stats_flow *sf = &flow_registration->nexus_stats->fs_stats;
6672 if (sf == NULL) {
6673 nstat_diagnostic_flags |= NSTAT_IFNET_FLOWSWITCH_VALUE_UNOBTAINABLE;
6674 char namebuf[MAXCOMLEN + 1];
6675 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
6676 proc_name(client->proc_pid, namebuf, sizeof(namebuf));
6677 NECPLOG(LOG_ERR, "req quic stats, necp_client flow_registration flow_stats missing for pid %d %s curproc %d %s\n",
6678 client->proc_pid, namebuf, proc_pid(current_proc()), proc_best_name(current_proc()));
6679 sf = &ntstat_sk_stats_zero;
6680 }
6681
6682 if (countsp) {
6683 countsp->nstat_rxbytes = quicstats->necp_quic_counts.necp_stat_rxbytes;
6684 countsp->nstat_txbytes = quicstats->necp_quic_counts.necp_stat_txbytes;
6685
6686 countsp->nstat_rxduplicatebytes = quicstats->necp_quic_counts.necp_stat_rxduplicatebytes;
6687 countsp->nstat_rxoutoforderbytes = quicstats->necp_quic_counts.necp_stat_rxoutoforderbytes;
6688 countsp->nstat_txretransmit = quicstats->necp_quic_counts.necp_stat_txretransmit;
6689
6690 countsp->nstat_min_rtt = quicstats->necp_quic_counts.necp_stat_min_rtt;
6691 countsp->nstat_avg_rtt = quicstats->necp_quic_counts.necp_stat_avg_rtt;
6692 countsp->nstat_var_rtt = quicstats->necp_quic_counts.necp_stat_var_rtt;
6693
6694 // TODO: It would be good to expose QUIC stats for CH/SH retransmission and connection state
6695 // Supplement what the user level has told us with what we know from the flowswitch
6696 countsp->nstat_rxpackets = sf->sf_ipackets;
6697 countsp->nstat_txpackets = sf->sf_opackets;
6698 if (route_ifflags & NSTAT_IFNET_IS_CELLULAR) {
6699 countsp->nstat_cell_rxbytes = sf->sf_ibytes;
6700 countsp->nstat_cell_txbytes = sf->sf_obytes;
6701 } else if (route_ifflags & NSTAT_IFNET_IS_WIFI) {
6702 countsp->nstat_wifi_rxbytes = sf->sf_ibytes;
6703 countsp->nstat_wifi_txbytes = sf->sf_obytes;
6704 } else if (route_ifflags & NSTAT_IFNET_IS_WIRED) {
6705 countsp->nstat_wired_rxbytes = sf->sf_ibytes;
6706 countsp->nstat_wired_txbytes = sf->sf_obytes;
6707 }
6708 }
6709
6710 if (metadatap) {
6711 nstat_quic_descriptor *desc = (nstat_quic_descriptor *)metadatap;
6712 memset(desc, 0, sizeof(*desc));
6713
6714 // Metadata from the flow registration
6715 uuid_copy(desc->fuuid, flow_registration->registration_id);
6716
6717 // Metadata, that the necp client should have, in TLV format.
6718 pid_t effective_pid = client->proc_pid;
6719 necp_find_netstat_data(client, (union necp_sockaddr_union *)&desc->remote, &effective_pid, &desc->uid, desc->euuid, &desc->persona_id, &desc->traffic_class, &desc->fallback_mode);
6720 desc->epid = (u_int32_t)effective_pid;
6721
6722 // Metadata from the flow registration
6723 // This needs to revisited if multiple flows are created from one flow registration
6724 struct necp_client_flow *flow = NULL;
6725 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
6726 memcpy(&desc->local, &flow->local_addr, sizeof(desc->local));
6727 break;
6728 }
6729
6730 // Metadata from the route
6731 desc->ifindex = route_ifindex;
6732 desc->ifnet_properties = route_ifflags | nstat_diagnostic_flags;
6733
6734 // Basic metadata from userland
6735 desc->rcvbufsize = quicstats->necp_quic_basic.rcvbufsize;
6736 desc->rcvbufused = quicstats->necp_quic_basic.rcvbufused;
6737
6738 // Additional QUIC specific data
6739 desc->sndbufsize = quicstats->necp_quic_extra.sndbufsize;
6740 desc->sndbufused = quicstats->necp_quic_extra.sndbufused;
6741 desc->txunacked = quicstats->necp_quic_extra.txunacked;
6742 desc->txwindow = quicstats->necp_quic_extra.txwindow;
6743 desc->txcwindow = quicstats->necp_quic_extra.txcwindow;
6744 desc->traffic_mgt_flags = quicstats->necp_quic_extra.traffic_mgt_flags;
6745 desc->state = quicstats->necp_quic_extra.state;
6746
6747 // TODO: CC algo defines should be named agnostic of the protocol
6748 u_int32_t cc_alg_index = quicstats->necp_quic_extra.cc_alg_index;
6749 if (cc_alg_index < TCP_CC_ALGO_COUNT) {
6750 strlcpy(desc->cc_algo, tcp_cc_algo_list[cc_alg_index]->name, sizeof(desc->cc_algo));
6751 } else {
6752 strlcpy(desc->cc_algo, "unknown", sizeof(desc->cc_algo));
6753 }
6754
6755 memcpy(&desc->activity_bitmap, &sf->sf_activity, sizeof(sf->sf_activity));
6756
6757 desc->connstatus.probe_activated = quicstats->necp_quic_extra.probestatus.probe_activated;
6758 desc->connstatus.write_probe_failed = quicstats->necp_quic_extra.probestatus.write_probe_failed;
6759 desc->connstatus.read_probe_failed = quicstats->necp_quic_extra.probestatus.read_probe_failed;
6760 desc->connstatus.conn_probe_failed = quicstats->necp_quic_extra.probestatus.conn_probe_failed;
6761
6762 if (NECP_ENABLE_CLIENT_TRACE(NECP_CLIENT_TRACE_LEVEL_FLOW)) {
6763 uuid_string_t euuid_str = { 0 };
6764 uuid_unparse(desc->euuid, euuid_str);
6765 NECPLOG(LOG_NOTICE, "Collected stats - QUIC - epid %d uid %d euuid %s persona id %d", desc->epid, desc->uid, euuid_str, desc->persona_id);
6766 }
6767 }
6768 return true;
6769 }
6770
6771 #endif /* SKYWALK */
6772
6773 // Support functions for NetworkStatistics support for necp_client connections
6774
6775 static void
necp_client_inherit_from_parent(struct necp_client * client,struct necp_client * parent)6776 necp_client_inherit_from_parent(
6777 struct necp_client *client,
6778 struct necp_client *parent)
6779 {
6780 assert(client->original_parameters_source == NULL);
6781
6782 if (parent->original_parameters_source != NULL) {
6783 client->original_parameters_source = parent->original_parameters_source;
6784 } else {
6785 client->original_parameters_source = parent;
6786 }
6787 necp_client_retain(client->original_parameters_source);
6788 }
6789
6790 static void
necp_find_conn_netstat_data(struct necp_client * client,u_int32_t * ntstat_flags,pid_t * effective_pid,uuid_t puuid,uid_t * uid,uuid_t euuid,uid_t * persona_id)6791 necp_find_conn_netstat_data(struct necp_client *client,
6792 u_int32_t *ntstat_flags,
6793 pid_t *effective_pid,
6794 uuid_t puuid,
6795 uid_t *uid,
6796 uuid_t euuid,
6797 uid_t *persona_id)
6798 {
6799 bool has_remote_address = false;
6800 bool has_ip_protocol = false;
6801 bool has_transport_protocol = false;
6802 size_t offset = 0;
6803 u_int8_t *parameters;
6804 u_int32_t parameters_size;
6805
6806
6807 parameters = client->parameters;
6808 parameters_size = (u_int32_t)client->parameters_length;
6809
6810 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
6811 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
6812 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
6813
6814 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
6815 // If the length is larger than what can fit in the remaining parameters size, bail
6816 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
6817 break;
6818 }
6819
6820 if (length > 0) {
6821 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
6822 if (value != NULL) {
6823 switch (type) {
6824 case NECP_CLIENT_PARAMETER_APPLICATION: {
6825 if ((euuid) && (length >= sizeof(uuid_t))) {
6826 uuid_copy(euuid, value);
6827 }
6828 break;
6829 }
6830 case NECP_CLIENT_PARAMETER_IP_PROTOCOL: {
6831 if (length >= 1) {
6832 has_ip_protocol = true;
6833 }
6834 break;
6835 }
6836 case NECP_CLIENT_PARAMETER_PID: {
6837 if ((effective_pid) && length >= sizeof(pid_t)) {
6838 memcpy(effective_pid, value, sizeof(pid_t));
6839 }
6840 break;
6841 }
6842 case NECP_CLIENT_PARAMETER_PARENT_ID: {
6843 if ((puuid) && (length == sizeof(uuid_t))) {
6844 uuid_copy(puuid, value);
6845 }
6846 break;
6847 }
6848 // It is an implementation quirk that the remote address can be found in the necp parameters
6849 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
6850 if (length >= sizeof(struct necp_policy_condition_addr)) {
6851 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
6852 if (necp_client_address_is_valid(&address_struct->address.sa)) {
6853 has_remote_address = true;
6854 }
6855 }
6856 break;
6857 }
6858 case NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL: {
6859 if (length >= 1) {
6860 has_transport_protocol = true;
6861 }
6862 break;
6863 }
6864 case NECP_CLIENT_PARAMETER_APPLICATION_ID: {
6865 if (length >= sizeof(necp_application_id_t) && uid && persona_id) {
6866 necp_application_id_t *application_id = (necp_application_id_t *)(void *)value;
6867 memcpy(uid, &application_id->uid, sizeof(uid_t));
6868 uuid_copy(euuid, application_id->effective_uuid);
6869 memcpy(persona_id, &application_id->persona_id, sizeof(uid_t));
6870 }
6871 break;
6872 }
6873 default: {
6874 break;
6875 }
6876 }
6877 }
6878 }
6879 offset += sizeof(struct necp_tlv_header) + length;
6880 }
6881 if (ntstat_flags) {
6882 *ntstat_flags = (has_remote_address && has_ip_protocol && has_transport_protocol)? NSTAT_NECP_CONN_HAS_NET_ACCESS: 0;
6883 }
6884 }
6885
6886 static bool
necp_request_conn_netstats(nstat_provider_context ctx,u_int32_t * ifflagsp,nstat_counts * countsp,void * metadatap)6887 necp_request_conn_netstats(nstat_provider_context ctx,
6888 u_int32_t *ifflagsp,
6889 nstat_counts *countsp,
6890 void *metadatap)
6891 {
6892 if (ctx == NULL) {
6893 return false;
6894 }
6895 struct necp_client *client = (struct necp_client *)(uintptr_t)ctx;
6896 nstat_connection_descriptor *desc = (nstat_connection_descriptor *)metadatap;
6897
6898 if (ifflagsp) {
6899 necp_find_conn_netstat_data(client, ifflagsp, NULL, NULL, NULL, NULL, NULL);
6900 }
6901 if (countsp) {
6902 memset(countsp, 0, sizeof(*countsp));
6903 }
6904 if (desc) {
6905 memset(desc, 0, sizeof(*desc));
6906 // Metadata, that the necp client should have, in TLV format.
6907 pid_t effective_pid = client->proc_pid;
6908 necp_find_conn_netstat_data(client, &desc->ifnet_properties, &effective_pid, desc->puuid, &desc->uid, desc->euuid, &desc->persona_id);
6909 desc->epid = (u_int32_t)effective_pid;
6910
6911 // User level should obtain almost all connection information from an extension
6912 // leaving little to do here
6913 uuid_copy(desc->fuuid, client->latest_flow_registration_id);
6914 uuid_copy(desc->cuuid, client->client_id);
6915 }
6916 return true;
6917 }
6918
6919 static int
necp_skywalk_priv_check_cred(proc_t p,kauth_cred_t cred)6920 necp_skywalk_priv_check_cred(proc_t p, kauth_cred_t cred)
6921 {
6922 #pragma unused(p, cred)
6923 #if SKYWALK
6924 /* This includes Nexus controller and Skywalk observer privs */
6925 return skywalk_nxctl_check_privileges(p, cred);
6926 #else /* !SKYWALK */
6927 return 0;
6928 #endif /* !SKYWALK */
6929 }
6930
6931 /// System calls
6932
6933 int
necp_open(struct proc * p,struct necp_open_args * uap,int * retval)6934 necp_open(struct proc *p, struct necp_open_args *uap, int *retval)
6935 {
6936 #pragma unused(retval)
6937 int error = 0;
6938 struct necp_fd_data *fd_data = NULL;
6939 struct fileproc *fp = NULL;
6940 int fd = -1;
6941
6942 if (uap->flags & NECP_OPEN_FLAG_OBSERVER ||
6943 uap->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
6944 if (necp_skywalk_priv_check_cred(p, kauth_cred_get()) != 0 &&
6945 priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NETWORK_STATISTICS, 0) != 0) {
6946 NECPLOG0(LOG_ERR, "Client does not hold necessary entitlement to observe other NECP clients");
6947 error = EACCES;
6948 goto done;
6949 }
6950 }
6951
6952 #if CONFIG_MACF
6953 error = mac_necp_check_open(p, uap->flags);
6954 if (error) {
6955 goto done;
6956 }
6957 #endif /* MACF */
6958
6959 error = falloc(p, &fp, &fd, vfs_context_current());
6960 if (error != 0) {
6961 goto done;
6962 }
6963
6964 fd_data = kalloc_type(struct necp_fd_data, Z_WAITOK | Z_ZERO | Z_NOFAIL);
6965
6966 fd_data->necp_fd_type = necp_fd_type_client;
6967 fd_data->flags = uap->flags;
6968 RB_INIT(&fd_data->clients);
6969 RB_INIT(&fd_data->flows);
6970 TAILQ_INIT(&fd_data->update_list);
6971 lck_mtx_init(&fd_data->fd_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
6972 klist_init(&fd_data->si.si_note);
6973 fd_data->proc_pid = proc_pid(p);
6974 #if SKYWALK
6975 LIST_INIT(&fd_data->stats_arena_list);
6976 #endif /* !SKYWALK */
6977
6978 fp->fp_flags |= FP_CLOEXEC | FP_CLOFORK;
6979 fp->fp_glob->fg_flag = FREAD;
6980 fp->fp_glob->fg_ops = &necp_fd_ops;
6981 fp_set_data(fp, fd_data);
6982
6983 proc_fdlock(p);
6984
6985 procfdtbl_releasefd(p, fd, NULL);
6986 fp_drop(p, fd, fp, 1);
6987
6988 *retval = fd;
6989
6990 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
6991 NECP_OBSERVER_LIST_LOCK_EXCLUSIVE();
6992 LIST_INSERT_HEAD(&necp_fd_observer_list, fd_data, chain);
6993 OSIncrementAtomic(&necp_observer_fd_count);
6994 NECP_OBSERVER_LIST_UNLOCK();
6995
6996 // Walk all existing clients and add them
6997 NECP_CLIENT_TREE_LOCK_SHARED();
6998 struct necp_client *existing_client = NULL;
6999 RB_FOREACH(existing_client, _necp_client_global_tree, &necp_client_global_tree) {
7000 NECP_CLIENT_LOCK(existing_client);
7001 necp_client_update_observer_add_internal(fd_data, existing_client);
7002 necp_client_update_observer_update_internal(fd_data, existing_client);
7003 NECP_CLIENT_UNLOCK(existing_client);
7004 }
7005 NECP_CLIENT_TREE_UNLOCK();
7006 } else {
7007 NECP_FD_LIST_LOCK_EXCLUSIVE();
7008 LIST_INSERT_HEAD(&necp_fd_list, fd_data, chain);
7009 OSIncrementAtomic(&necp_client_fd_count);
7010 NECP_FD_LIST_UNLOCK();
7011 }
7012
7013 proc_fdunlock(p);
7014
7015 done:
7016 if (error != 0) {
7017 if (fp != NULL) {
7018 fp_free(p, fd, fp);
7019 fp = NULL;
7020 }
7021 if (fd_data != NULL) {
7022 kfree_type(struct necp_fd_data, fd_data);
7023 }
7024 }
7025
7026 return error;
7027 }
7028
7029 // All functions called directly from necp_client_action() to handle one of the
7030 // types should be marked with NECP_CLIENT_ACTION_FUNCTION. This ensures that
7031 // necp_client_action() does not inline all the actions into a single function.
7032 #define NECP_CLIENT_ACTION_FUNCTION __attribute__((noinline))
7033
7034 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_add(struct proc * p,struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7035 necp_client_add(struct proc *p, struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7036 {
7037 int error = 0;
7038 struct necp_client *client = NULL;
7039 const size_t buffer_size = uap->buffer_size;
7040
7041 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
7042 NECPLOG0(LOG_ERR, "NECP client observers with push enabled may not add their own clients");
7043 return EINVAL;
7044 }
7045
7046 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
7047 buffer_size == 0 || buffer_size > NECP_MAX_CLIENT_PARAMETERS_SIZE || uap->buffer == 0) {
7048 return EINVAL;
7049 }
7050
7051 client = kalloc_type(struct necp_client, Z_WAITOK | Z_ZERO | Z_NOFAIL);
7052 client->parameters = kalloc_data(buffer_size, Z_WAITOK | Z_NOFAIL);
7053 client->parameters_length = buffer_size;
7054 lck_mtx_init(&client->lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
7055 lck_mtx_init(&client->route_lock, &necp_fd_mtx_grp, &necp_fd_mtx_attr);
7056
7057 error = copyin(uap->buffer, client->parameters, buffer_size);
7058 if (error) {
7059 NECPLOG(LOG_ERR, "necp_client_add parameters copyin error (%d)", error);
7060 goto done;
7061 }
7062
7063 os_ref_init(&client->reference_count, &necp_client_refgrp); // Hold our reference until close
7064
7065 client->proc_pid = fd_data->proc_pid; // Save off proc pid in case the client will persist past fd
7066 client->agent_handle = (void *)fd_data;
7067 client->platform_binary = ((csproc_get_platform_binary(p) == 0) ? 0 : 1);
7068
7069 necp_generate_client_id(client->client_id, false);
7070 LIST_INIT(&client->assertion_list);
7071 RB_INIT(&client->flow_registrations);
7072
7073 NECP_CLIENT_LOG(client, "Adding client");
7074
7075 error = copyout(client->client_id, uap->client_id, sizeof(uuid_t));
7076 if (error) {
7077 NECPLOG(LOG_ERR, "necp_client_add client_id copyout error (%d)", error);
7078 goto done;
7079 }
7080
7081 #if SKYWALK
7082 struct necp_client_parsed_parameters parsed_parameters = {};
7083 int parse_error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, &parsed_parameters);
7084
7085 if (parse_error == 0 &&
7086 ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID) ||
7087 (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER))) {
7088 bool has_delegation_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_SOCKET_DELEGATE, 0) == 0);
7089 if (!has_delegation_entitlement) {
7090 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID) {
7091 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to delegate network traffic for other processes by upid",
7092 proc_name_address(p), proc_pid(p));
7093 }
7094 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_ATTRIBUTED_BUNDLE_IDENTIFIER) {
7095 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to set attributed bundle identifier",
7096 proc_name_address(p), proc_pid(p));
7097 }
7098 error = EPERM;
7099 goto done;
7100 }
7101
7102 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID) {
7103 // Save off delegated unique PID
7104 client->delegated_upid = parsed_parameters.delegated_upid;
7105 }
7106 }
7107
7108 if (parse_error == 0 && parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) {
7109 bool has_nexus_entitlement = (necp_skywalk_priv_check_cred(p, kauth_cred_get()) == 0);
7110 if (!has_nexus_entitlement) {
7111 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to open a custom nexus client",
7112 proc_name_address(p), proc_pid(p));
7113 error = EPERM;
7114 goto done;
7115 }
7116 }
7117
7118 if (parse_error == 0 && (parsed_parameters.flags &
7119 (NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER | NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP))) {
7120 bool has_custom_protocol_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_CUSTOM_PROTOCOL, 0) == 0);
7121 if (!has_custom_protocol_entitlement) {
7122 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement for custom protocol APIs",
7123 proc_name_address(p), proc_pid(p));
7124 error = EPERM;
7125 goto done;
7126 }
7127 }
7128
7129 if (parse_error == 0 && parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER &&
7130 (parsed_parameters.ip_protocol == IPPROTO_TCP || parsed_parameters.ip_protocol == IPPROTO_UDP)) {
7131 uint32_t *netns_addr = NULL;
7132 uint8_t netns_addr_len = 0;
7133 struct ns_flow_info flow_info = {};
7134 uint32_t netns_flags = NETNS_LISTENER;
7135 uuid_copy(flow_info.nfi_flow_uuid, client->client_id);
7136 flow_info.nfi_protocol = parsed_parameters.ip_protocol;
7137 flow_info.nfi_owner_pid = client->proc_pid;
7138 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID) {
7139 flow_info.nfi_effective_pid = parsed_parameters.effective_pid;
7140 } else {
7141 flow_info.nfi_effective_pid = flow_info.nfi_owner_pid;
7142 }
7143 proc_name(flow_info.nfi_owner_pid, flow_info.nfi_owner_name, MAXCOMLEN);
7144 proc_name(flow_info.nfi_effective_pid, flow_info.nfi_effective_name, MAXCOMLEN);
7145
7146 if (parsed_parameters.local_addr.sa.sa_family == AF_UNSPEC) {
7147 // Treat no local address as a wildcard IPv6
7148 // parsed_parameters is already initialized to all zeros
7149 parsed_parameters.local_addr.sin6.sin6_family = AF_INET6;
7150 parsed_parameters.local_addr.sin6.sin6_len = sizeof(struct sockaddr_in6);
7151 }
7152
7153 switch (parsed_parameters.local_addr.sa.sa_family) {
7154 case AF_INET: {
7155 memcpy(&flow_info.nfi_laddr, &parsed_parameters.local_addr.sa, parsed_parameters.local_addr.sa.sa_len);
7156 netns_addr = (uint32_t *)&parsed_parameters.local_addr.sin.sin_addr;
7157 netns_addr_len = 4;
7158 break;
7159 }
7160 case AF_INET6: {
7161 memcpy(&flow_info.nfi_laddr, &parsed_parameters.local_addr.sa, parsed_parameters.local_addr.sa.sa_len);
7162 netns_addr = (uint32_t *)&parsed_parameters.local_addr.sin6.sin6_addr;
7163 netns_addr_len = 16;
7164 break;
7165 }
7166
7167 default: {
7168 NECPLOG(LOG_ERR, "necp_client_add listener invalid address family (%d)", parsed_parameters.local_addr.sa.sa_family);
7169 error = EINVAL;
7170 goto done;
7171 }
7172 }
7173 if ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
7174 (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_REUSE_LOCAL)) {
7175 netns_flags |= NETNS_REUSEPORT;
7176 }
7177 if (parsed_parameters.local_addr.sin.sin_port == 0) {
7178 error = netns_reserve_ephemeral(&client->port_reservation, netns_addr, netns_addr_len, parsed_parameters.ip_protocol,
7179 &parsed_parameters.local_addr.sin.sin_port, netns_flags, &flow_info);
7180 if (error) {
7181 NECPLOG(LOG_ERR, "necp_client_add netns_reserve_ephemeral error (%d)", error);
7182 goto done;
7183 }
7184
7185 // Update the parameter TLVs with the assigned port
7186 necp_client_update_local_port_parameters(client->parameters, (u_int32_t)client->parameters_length, parsed_parameters.local_addr.sin.sin_port);
7187 } else {
7188 error = netns_reserve(&client->port_reservation, netns_addr, netns_addr_len, parsed_parameters.ip_protocol,
7189 parsed_parameters.local_addr.sin.sin_port, netns_flags, &flow_info);
7190 if (error) {
7191 NECPLOG(LOG_ERR, "necp_client_add netns_reserve error (%d)", error);
7192 goto done;
7193 }
7194 }
7195 }
7196
7197 struct necp_client *parent = NULL;
7198 uuid_t parent_client_id;
7199 uuid_clear(parent_client_id);
7200 struct necp_client_nexus_parameters parent_parameters = {};
7201 uint16_t num_flow_regs = 0;
7202 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_PARENT_UUID) {
7203 // The parent "should" be found on fd_data without having to search across the whole necp_fd_list
7204 // It would be nice to do this a little further down where there's another instance of NECP_FD_LOCK
7205 // but the logic here depends on the parse paramters
7206 NECP_FD_LOCK(fd_data);
7207 parent = necp_client_fd_find_client_unlocked(fd_data, parsed_parameters.parent_uuid);
7208 if (parent != NULL) {
7209 necp_client_inherit_from_parent(client, parent);
7210 necp_client_copy_parameters_locked(client, &parent_parameters);
7211 uuid_copy(parent_client_id, parsed_parameters.parent_uuid);
7212 struct necp_client_flow_registration *flow_registration = NULL;
7213 RB_FOREACH(flow_registration, _necp_client_flow_tree, &parent->flow_registrations) {
7214 num_flow_regs++;
7215 }
7216 }
7217 NECP_FD_UNLOCK(fd_data);
7218 if (parent == NULL) {
7219 NECPLOG0(LOG_ERR, "necp_client_add, no necp_client_inherit_from_parent as can't find parent on fd_data");
7220 }
7221 }
7222 if (parse_error == 0 && parent != NULL && parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLOW_DEMUX_PATTERN) {
7223 do {
7224 if (parsed_parameters.demux_patterns[0].len == 0) {
7225 NECPLOG0(LOG_INFO, "necp_client_add, child does not have a demux pattern");
7226 break;
7227 }
7228
7229 if (uuid_is_null(parent_client_id)) {
7230 NECPLOG0(LOG_INFO, "necp_client_add, parent ID is null");
7231 break;
7232 }
7233
7234 if (num_flow_regs > 1) {
7235 NECPLOG0(LOG_INFO, "necp_client_add, multiple parent flows not supported");
7236 break;
7237 }
7238 if (parsed_parameters.ip_protocol != IPPROTO_UDP) {
7239 NECPLOG(LOG_INFO, "necp_client_add, flow demux pattern not supported for %d protocol",
7240 parsed_parameters.ip_protocol);
7241 break;
7242 }
7243 if (parsed_parameters.ip_protocol != parent_parameters.transport_protocol) {
7244 NECPLOG0(LOG_INFO, "necp_client_add, parent/child ip protocol mismatch");
7245 break;
7246 }
7247 if (parsed_parameters.local_addr.sa.sa_family != AF_INET && parsed_parameters.local_addr.sa.sa_family != AF_INET6) {
7248 NECPLOG(LOG_INFO, "necp_client_add, flow demux pattern not supported for %d family",
7249 parsed_parameters.local_addr.sa.sa_family);
7250 break;
7251 }
7252 if (parsed_parameters.local_addr.sa.sa_family != parsed_parameters.remote_addr.sa.sa_family) {
7253 NECPLOG0(LOG_INFO, "necp_client_add, local/remote address family mismatch");
7254 break;
7255 }
7256 if (parsed_parameters.local_addr.sa.sa_family != parent_parameters.local_addr.sa.sa_family) {
7257 NECPLOG0(LOG_INFO, "necp_client_add, parent/child address family mismatch");
7258 break;
7259 }
7260 if (memcmp(&parsed_parameters.local_addr.sa, &parent_parameters.local_addr.sa, parsed_parameters.local_addr.sa.sa_len)) {
7261 NECPLOG0(LOG_INFO, "necp_client_add, parent/child local address mismatch");
7262 break;
7263 }
7264 if (memcmp(&parsed_parameters.remote_addr.sa, &parent_parameters.remote_addr.sa, parsed_parameters.remote_addr.sa.sa_len)) {
7265 NECPLOG0(LOG_INFO, "necp_client_add, parent/child remote address mismatch");
7266 break;
7267 }
7268 if (parsed_parameters.local_addr.sin.sin_port != parent_parameters.local_addr.sin.sin_port) {
7269 NECPLOG0(LOG_INFO, "necp_client_add, parent/child local port mismatch");
7270 break;
7271 }
7272 if (parsed_parameters.remote_addr.sin.sin_port != parent_parameters.remote_addr.sin.sin_port) {
7273 NECPLOG0(LOG_INFO, "necp_client_add, parent/child remote port mismatch");
7274 break;
7275 }
7276 client->validated_parent = 1;
7277 uuid_copy(client->parent_client_id, parent_client_id);
7278 } while (false);
7279 }
7280
7281 #endif /* !SKYWALK */
7282
7283 necp_client_update_observer_add(client);
7284
7285 NECP_FD_LOCK(fd_data);
7286 RB_INSERT(_necp_client_tree, &fd_data->clients, client);
7287 OSIncrementAtomic(&necp_client_count);
7288 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
7289 RB_INSERT(_necp_client_global_tree, &necp_client_global_tree, client);
7290 NECP_CLIENT_TREE_UNLOCK();
7291
7292 // Prime the client result
7293 NECP_CLIENT_LOCK(client);
7294 (void)necp_update_client_result(current_proc(), fd_data, client, NULL);
7295 necp_client_retain_locked(client);
7296 NECP_CLIENT_UNLOCK(client);
7297 NECP_FD_UNLOCK(fd_data);
7298 // Now everything is set, it's safe to plumb this in to NetworkStatistics
7299 uint32_t ntstat_properties = 0;
7300 necp_find_conn_netstat_data(client, &ntstat_properties, NULL, NULL, NULL, NULL, NULL);
7301
7302 client->nstat_context = nstat_provider_stats_open((nstat_provider_context)client,
7303 NSTAT_PROVIDER_CONN_USERLAND, (u_int64_t)ntstat_properties, necp_request_conn_netstats, necp_find_conn_extension_info);
7304 necp_client_release(client);
7305 done:
7306 if (error != 0 && client != NULL) {
7307 necp_client_free(client);
7308 client = NULL;
7309 }
7310 *retval = error;
7311
7312 return error;
7313 }
7314
7315 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_claim(struct proc * p,struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7316 necp_client_claim(struct proc *p, struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7317 {
7318 int error = 0;
7319 uuid_t client_id = {};
7320 struct necp_client *client = NULL;
7321
7322 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
7323 error = EINVAL;
7324 goto done;
7325 }
7326
7327 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
7328 if (error) {
7329 NECPLOG(LOG_ERR, "necp_client_claim copyin client_id error (%d)", error);
7330 goto done;
7331 }
7332
7333 if (necp_client_id_is_flow(client_id)) {
7334 NECPLOG0(LOG_ERR, "necp_client_claim cannot claim from flow UUID");
7335 error = EINVAL;
7336 goto done;
7337 }
7338
7339 u_int64_t upid = proc_uniqueid(p);
7340
7341 NECP_FD_LIST_LOCK_SHARED();
7342
7343 struct necp_fd_data *find_fd = NULL;
7344 LIST_FOREACH(find_fd, &necp_fd_list, chain) {
7345 NECP_FD_LOCK(find_fd);
7346 struct necp_client *find_client = necp_client_fd_find_client_and_lock(find_fd, client_id);
7347 if (find_client != NULL) {
7348 if (find_client->delegated_upid == upid &&
7349 RB_EMPTY(&find_client->flow_registrations)) {
7350 // Matched the client to claim; remove from the old fd
7351 client = find_client;
7352 RB_REMOVE(_necp_client_tree, &find_fd->clients, client);
7353 necp_client_retain_locked(client);
7354 }
7355 NECP_CLIENT_UNLOCK(find_client);
7356 }
7357 NECP_FD_UNLOCK(find_fd);
7358
7359 if (client != NULL) {
7360 break;
7361 }
7362 }
7363
7364 NECP_FD_LIST_UNLOCK();
7365
7366 if (client == NULL) {
7367 error = ENOENT;
7368 goto done;
7369 }
7370
7371 client->proc_pid = fd_data->proc_pid; // Transfer client to claiming pid
7372 client->agent_handle = (void *)fd_data;
7373 client->platform_binary = ((csproc_get_platform_binary(p) == 0) ? 0 : 1);
7374
7375 NECP_CLIENT_LOG(client, "Claiming client");
7376
7377 // Add matched client to our fd and re-run result
7378 NECP_FD_LOCK(fd_data);
7379 RB_INSERT(_necp_client_tree, &fd_data->clients, client);
7380 NECP_CLIENT_LOCK(client);
7381 (void)necp_update_client_result(current_proc(), fd_data, client, NULL);
7382 NECP_CLIENT_UNLOCK(client);
7383 NECP_FD_UNLOCK(fd_data);
7384
7385 necp_client_release(client);
7386
7387 done:
7388 *retval = error;
7389
7390 return error;
7391 }
7392
7393 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_remove(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7394 necp_client_remove(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7395 {
7396 int error = 0;
7397 uuid_t client_id = {};
7398 struct ifnet_stats_per_flow flow_ifnet_stats = {};
7399 const size_t buffer_size = uap->buffer_size;
7400
7401 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
7402 error = EINVAL;
7403 goto done;
7404 }
7405
7406 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
7407 if (error) {
7408 NECPLOG(LOG_ERR, "necp_client_remove copyin client_id error (%d)", error);
7409 goto done;
7410 }
7411
7412 if (uap->buffer != 0 && buffer_size == sizeof(flow_ifnet_stats)) {
7413 error = copyin(uap->buffer, &flow_ifnet_stats, buffer_size);
7414 if (error) {
7415 NECPLOG(LOG_ERR, "necp_client_remove flow_ifnet_stats copyin error (%d)", error);
7416 // Not fatal; make sure to zero-out stats in case of partial copy
7417 memset(&flow_ifnet_stats, 0, sizeof(flow_ifnet_stats));
7418 error = 0;
7419 }
7420 } else if (uap->buffer != 0) {
7421 NECPLOG(LOG_ERR, "necp_client_remove unexpected parameters length (%zu)", buffer_size);
7422 }
7423
7424 NECP_FD_LOCK(fd_data);
7425
7426 pid_t pid = fd_data->proc_pid;
7427 struct necp_client *client = necp_client_fd_find_client_unlocked(fd_data, client_id);
7428
7429 NECP_CLIENT_LOG(client, "Removing client");
7430
7431 if (client != NULL) {
7432 // Remove any flow registrations that match
7433 struct necp_client_flow_registration *flow_registration = NULL;
7434 struct necp_client_flow_registration *temp_flow_registration = NULL;
7435 RB_FOREACH_SAFE(flow_registration, _necp_fd_flow_tree, &fd_data->flows, temp_flow_registration) {
7436 if (flow_registration->client == client) {
7437 #if SKYWALK
7438 necp_destroy_flow_stats(fd_data, flow_registration, NULL, TRUE);
7439 #endif /* SKYWALK */
7440 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
7441 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
7442 NECP_FLOW_TREE_UNLOCK();
7443 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
7444 }
7445 }
7446 #if SKYWALK
7447 if (client->nstat_context != NULL) {
7448 // Main path, we expect stats to be in existance at this point
7449 nstat_provider_stats_close(client->nstat_context);
7450 client->nstat_context = NULL;
7451 } else {
7452 NECPLOG0(LOG_ERR, "necp_client_remove ntstat shutdown finds nstat_context NULL");
7453 }
7454 #endif /* SKYWALK */
7455 // Remove client from lists
7456 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
7457 RB_REMOVE(_necp_client_global_tree, &necp_client_global_tree, client);
7458 NECP_CLIENT_TREE_UNLOCK();
7459 RB_REMOVE(_necp_client_tree, &fd_data->clients, client);
7460 }
7461
7462 #if SKYWALK
7463 // If the currently-active arena is idle (has no more flows referring to it), or if there are defunct
7464 // arenas lingering in the list, schedule a threadcall to do the clean up. The idle check is done
7465 // by checking if the reference count is 3: one held by this client (will be released below when we
7466 // destroy it) when it's non-NULL; the rest held by stats_arena_{active,list}.
7467 if ((fd_data->stats_arena_active != NULL && fd_data->stats_arena_active->nai_use_count == 3) ||
7468 (fd_data->stats_arena_active == NULL && !LIST_EMPTY(&fd_data->stats_arena_list))) {
7469 uint64_t deadline = 0;
7470 uint64_t leeway = 0;
7471 clock_interval_to_deadline(necp_close_arenas_timeout_microseconds, NSEC_PER_USEC, &deadline);
7472 clock_interval_to_absolutetime_interval(necp_close_arenas_timeout_leeway_microseconds, NSEC_PER_USEC, &leeway);
7473
7474 thread_call_enter_delayed_with_leeway(necp_close_empty_arenas_tcall, NULL,
7475 deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
7476 }
7477 #endif /* SKYWALK */
7478
7479 NECP_FD_UNLOCK(fd_data);
7480
7481 if (client != NULL) {
7482 ASSERT(error == 0);
7483 necp_destroy_client(client, pid, true);
7484 } else {
7485 error = ENOENT;
7486 NECPLOG(LOG_ERR, "necp_client_remove invalid client_id (%d)", error);
7487 }
7488 done:
7489 *retval = error;
7490
7491 return error;
7492 }
7493
7494 static struct necp_client_flow_registration *
necp_client_fd_find_flow(struct necp_fd_data * client_fd,uuid_t flow_id)7495 necp_client_fd_find_flow(struct necp_fd_data *client_fd, uuid_t flow_id)
7496 {
7497 NECP_FD_ASSERT_LOCKED(client_fd);
7498 struct necp_client_flow_registration *flow = NULL;
7499
7500 if (necp_client_id_is_flow(flow_id)) {
7501 struct necp_client_flow_registration find;
7502 uuid_copy(find.registration_id, flow_id);
7503 flow = RB_FIND(_necp_fd_flow_tree, &client_fd->flows, &find);
7504 }
7505
7506 return flow;
7507 }
7508
7509 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_remove_flow(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7510 necp_client_remove_flow(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7511 {
7512 int error = 0;
7513 uuid_t flow_id = {};
7514 struct ifnet_stats_per_flow flow_ifnet_stats = {};
7515 const size_t buffer_size = uap->buffer_size;
7516
7517 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
7518 error = EINVAL;
7519 NECPLOG(LOG_ERR, "necp_client_remove_flow invalid client_id (length %zu)", (size_t)uap->client_id_len);
7520 goto done;
7521 }
7522
7523 error = copyin(uap->client_id, flow_id, sizeof(uuid_t));
7524 if (error) {
7525 NECPLOG(LOG_ERR, "necp_client_remove_flow copyin client_id error (%d)", error);
7526 goto done;
7527 }
7528
7529 if (uap->buffer != 0 && buffer_size == sizeof(flow_ifnet_stats)) {
7530 error = copyin(uap->buffer, &flow_ifnet_stats, buffer_size);
7531 if (error) {
7532 NECPLOG(LOG_ERR, "necp_client_remove flow_ifnet_stats copyin error (%d)", error);
7533 // Not fatal
7534 }
7535 } else if (uap->buffer != 0) {
7536 NECPLOG(LOG_ERR, "necp_client_remove unexpected parameters length (%zu)", buffer_size);
7537 }
7538
7539 NECP_FD_LOCK(fd_data);
7540 struct necp_client *client = NULL;
7541 struct necp_client_flow_registration *flow_registration = necp_client_fd_find_flow(fd_data, flow_id);
7542 if (flow_registration != NULL) {
7543 #if SKYWALK
7544 // Cleanup stats per flow
7545 necp_destroy_flow_stats(fd_data, flow_registration, &flow_ifnet_stats, TRUE);
7546 #endif /* SKYWALK */
7547 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
7548 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
7549 NECP_FLOW_TREE_UNLOCK();
7550 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
7551
7552 client = flow_registration->client;
7553 if (client != NULL) {
7554 necp_client_retain(client);
7555 }
7556 }
7557 NECP_FD_UNLOCK(fd_data);
7558
7559 NECP_CLIENT_FLOW_LOG(client, flow_registration, "removing flow");
7560
7561 if (flow_registration != NULL && client != NULL) {
7562 NECP_CLIENT_LOCK(client);
7563 if (flow_registration->client == client) {
7564 necp_destroy_client_flow_registration(client, flow_registration, fd_data->proc_pid, false);
7565 }
7566 necp_client_release_locked(client);
7567 NECP_CLIENT_UNLOCK(client);
7568 }
7569
7570 done:
7571 *retval = error;
7572 if (error != 0) {
7573 NECPLOG(LOG_ERR, "Remove flow error (%d)", error);
7574 }
7575
7576 return error;
7577 }
7578
7579 // Don't inline the function since it includes necp_client_parsed_parameters on the stack
7580 static __attribute__((noinline)) int
necp_client_check_tcp_heuristics(struct necp_client * client,struct necp_client_flow * flow,u_int32_t * flags,u_int8_t * tfo_cookie,u_int8_t * tfo_cookie_len)7581 necp_client_check_tcp_heuristics(struct necp_client *client, struct necp_client_flow *flow, u_int32_t *flags, u_int8_t *tfo_cookie, u_int8_t *tfo_cookie_len)
7582 {
7583 struct necp_client_parsed_parameters parsed_parameters;
7584 int error = 0;
7585
7586 error = necp_client_parse_parameters(client, client->parameters,
7587 (u_int32_t)client->parameters_length,
7588 &parsed_parameters);
7589 if (error) {
7590 NECPLOG(LOG_ERR, "necp_client_parse_parameters error (%d)", error);
7591 return error;
7592 }
7593
7594 if ((flow->remote_addr.sa.sa_family != AF_INET &&
7595 flow->remote_addr.sa.sa_family != AF_INET6) ||
7596 (flow->local_addr.sa.sa_family != AF_INET &&
7597 flow->local_addr.sa.sa_family != AF_INET6)) {
7598 return EINVAL;
7599 }
7600
7601 NECP_CLIENT_ROUTE_LOCK(client);
7602
7603 if (client->current_route == NULL) {
7604 error = ENOENT;
7605 goto do_unlock;
7606 }
7607
7608 bool check_ecn = false;
7609 do {
7610 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) ==
7611 NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) {
7612 check_ecn = true;
7613 break;
7614 }
7615
7616 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) ==
7617 NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) {
7618 break;
7619 }
7620
7621 if (client->current_route != NULL) {
7622 if (client->current_route->rt_ifp->if_eflags & IFEF_ECN_ENABLE) {
7623 check_ecn = true;
7624 break;
7625 }
7626 if (client->current_route->rt_ifp->if_eflags & IFEF_ECN_DISABLE) {
7627 break;
7628 }
7629 }
7630
7631 bool inbound = ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) == 0);
7632 if ((inbound && tcp_ecn_inbound == 1) ||
7633 (!inbound && tcp_ecn_outbound == 1)) {
7634 check_ecn = true;
7635 }
7636 } while (false);
7637
7638 if (check_ecn) {
7639 if (tcp_heuristic_do_ecn_with_address(client->current_route->rt_ifp,
7640 (union sockaddr_in_4_6 *)&flow->local_addr)) {
7641 *flags |= NECP_CLIENT_RESULT_FLAG_ECN_ENABLED;
7642 }
7643 }
7644
7645 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) ==
7646 NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) {
7647 if (!tcp_heuristic_do_tfo_with_address(client->current_route->rt_ifp,
7648 (union sockaddr_in_4_6 *)&flow->local_addr,
7649 (union sockaddr_in_4_6 *)&flow->remote_addr,
7650 tfo_cookie, tfo_cookie_len)) {
7651 *flags |= NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED;
7652 *tfo_cookie_len = 0;
7653 }
7654 } else {
7655 *flags |= NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED;
7656 *tfo_cookie_len = 0;
7657 }
7658 do_unlock:
7659 NECP_CLIENT_ROUTE_UNLOCK(client);
7660
7661 return error;
7662 }
7663
7664 static size_t
necp_client_calculate_flow_tlv_size(struct necp_client_flow_registration * flow_registration)7665 necp_client_calculate_flow_tlv_size(struct necp_client_flow_registration *flow_registration)
7666 {
7667 size_t assigned_results_size = 0;
7668 struct necp_client_flow *flow = NULL;
7669 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
7670 if (flow->assigned || !necp_client_endpoint_is_unspecified((struct necp_client_endpoint *)&flow->remote_addr)) {
7671 size_t header_length = 0;
7672 if (flow->nexus) {
7673 header_length = sizeof(struct necp_client_nexus_flow_header);
7674 } else {
7675 header_length = sizeof(struct necp_client_flow_header);
7676 }
7677 assigned_results_size += (header_length + flow->assigned_results_length);
7678
7679 if (flow->has_protoctl_event) {
7680 assigned_results_size += sizeof(struct necp_client_flow_protoctl_event_header);
7681 }
7682 }
7683 }
7684 return assigned_results_size;
7685 }
7686
7687 static int
necp_client_fillout_flow_tlvs(struct necp_client * client,bool client_is_observed,struct necp_client_flow_registration * flow_registration,struct necp_client_action_args * uap,size_t * assigned_results_cursor)7688 necp_client_fillout_flow_tlvs(struct necp_client *client,
7689 bool client_is_observed,
7690 struct necp_client_flow_registration *flow_registration,
7691 struct necp_client_action_args *uap,
7692 size_t *assigned_results_cursor)
7693 {
7694 int error = 0;
7695 struct necp_client_flow *flow = NULL;
7696 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
7697 if (flow->assigned || !necp_client_endpoint_is_unspecified((struct necp_client_endpoint *)&flow->remote_addr)) {
7698 // Write TLV headers
7699 struct necp_client_nexus_flow_header header = {};
7700 u_int32_t length = 0;
7701 u_int32_t flags = 0;
7702 u_int8_t tfo_cookie_len = 0;
7703 u_int8_t type = 0;
7704
7705 type = NECP_CLIENT_RESULT_FLOW_ID;
7706 length = sizeof(header.flow_header.flow_id);
7707 memcpy(&header.flow_header.flow_id_tlv_header.type, &type, sizeof(type));
7708 memcpy(&header.flow_header.flow_id_tlv_header.length, &length, sizeof(length));
7709 uuid_copy(header.flow_header.flow_id, flow_registration->registration_id);
7710
7711 if (flow->nexus) {
7712 if (flow->check_tcp_heuristics) {
7713 u_int8_t tfo_cookie[NECP_TFO_COOKIE_LEN_MAX];
7714 tfo_cookie_len = NECP_TFO_COOKIE_LEN_MAX;
7715
7716 if (necp_client_check_tcp_heuristics(client, flow, &flags,
7717 tfo_cookie, &tfo_cookie_len) != 0) {
7718 tfo_cookie_len = 0;
7719 } else {
7720 flow->check_tcp_heuristics = FALSE;
7721
7722 if (tfo_cookie_len != 0) {
7723 type = NECP_CLIENT_RESULT_TFO_COOKIE;
7724 length = tfo_cookie_len;
7725 memcpy(&header.tfo_cookie_tlv_header.type, &type, sizeof(type));
7726 memcpy(&header.tfo_cookie_tlv_header.length, &length, sizeof(length));
7727 memcpy(&header.tfo_cookie_value, tfo_cookie, tfo_cookie_len);
7728 }
7729 }
7730 }
7731 }
7732
7733 size_t header_length = 0;
7734 if (flow->nexus) {
7735 if (tfo_cookie_len != 0) {
7736 header_length = sizeof(struct necp_client_nexus_flow_header) - (NECP_TFO_COOKIE_LEN_MAX - tfo_cookie_len);
7737 } else {
7738 header_length = sizeof(struct necp_client_nexus_flow_header) - sizeof(struct necp_tlv_header) - NECP_TFO_COOKIE_LEN_MAX;
7739 }
7740 } else {
7741 header_length = sizeof(struct necp_client_flow_header);
7742 }
7743
7744 type = NECP_CLIENT_RESULT_FLAGS;
7745 length = sizeof(header.flow_header.flags_value);
7746 memcpy(&header.flow_header.flags_tlv_header.type, &type, sizeof(type));
7747 memcpy(&header.flow_header.flags_tlv_header.length, &length, sizeof(length));
7748 if (flow->assigned) {
7749 flags |= NECP_CLIENT_RESULT_FLAG_FLOW_ASSIGNED;
7750 }
7751 if (flow->viable) {
7752 flags |= NECP_CLIENT_RESULT_FLAG_FLOW_VIABLE;
7753 }
7754 if (flow_registration->defunct) {
7755 flags |= NECP_CLIENT_RESULT_FLAG_DEFUNCT;
7756 }
7757 flags |= flow->necp_flow_flags;
7758 memcpy(&header.flow_header.flags_value, &flags, sizeof(flags));
7759
7760 type = NECP_CLIENT_RESULT_INTERFACE;
7761 length = sizeof(header.flow_header.interface_value);
7762 memcpy(&header.flow_header.interface_tlv_header.type, &type, sizeof(type));
7763 memcpy(&header.flow_header.interface_tlv_header.length, &length, sizeof(length));
7764
7765 struct necp_client_result_interface interface_struct;
7766 interface_struct.generation = 0;
7767 interface_struct.index = flow->interface_index;
7768
7769 memcpy(&header.flow_header.interface_value, &interface_struct, sizeof(interface_struct));
7770 if (flow->nexus) {
7771 type = NECP_CLIENT_RESULT_NETAGENT;
7772 length = sizeof(header.agent_value);
7773 memcpy(&header.agent_tlv_header.type, &type, sizeof(type));
7774 memcpy(&header.agent_tlv_header.length, &length, sizeof(length));
7775
7776 struct necp_client_result_netagent agent_struct;
7777 uuid_copy(agent_struct.netagent_uuid, flow->u.nexus_agent);
7778 agent_struct.generation = netagent_get_generation(agent_struct.netagent_uuid);
7779
7780 memcpy(&header.agent_value, &agent_struct, sizeof(agent_struct));
7781 }
7782
7783 // Don't include outer TLV header in length field
7784 type = NECP_CLIENT_RESULT_FLOW;
7785 length = (header_length - sizeof(struct necp_tlv_header) + flow->assigned_results_length);
7786 if (flow->has_protoctl_event) {
7787 length += sizeof(struct necp_client_flow_protoctl_event_header);
7788 }
7789 memcpy(&header.flow_header.outer_header.type, &type, sizeof(type));
7790 memcpy(&header.flow_header.outer_header.length, &length, sizeof(length));
7791
7792 error = copyout(&header, uap->buffer + client->result_length + *assigned_results_cursor, header_length);
7793 if (error) {
7794 NECPLOG(LOG_ERR, "necp_client_copy assigned results tlv_header copyout error (%d)", error);
7795 return error;
7796 }
7797 *assigned_results_cursor += header_length;
7798
7799 if (flow->assigned_results && flow->assigned_results_length) {
7800 // Write inner TLVs
7801 error = copyout(flow->assigned_results, uap->buffer + client->result_length + *assigned_results_cursor,
7802 flow->assigned_results_length);
7803 if (error) {
7804 NECPLOG(LOG_ERR, "necp_client_copy assigned results copyout error (%d)", error);
7805 return error;
7806 }
7807 }
7808 *assigned_results_cursor += flow->assigned_results_length;
7809
7810 /* Read the protocol event and reset it */
7811 if (flow->has_protoctl_event) {
7812 struct necp_client_flow_protoctl_event_header protoctl_event_header = {};
7813
7814 type = NECP_CLIENT_RESULT_PROTO_CTL_EVENT;
7815 length = sizeof(protoctl_event_header.protoctl_event);
7816
7817 memcpy(&protoctl_event_header.protoctl_tlv_header.type, &type, sizeof(type));
7818 memcpy(&protoctl_event_header.protoctl_tlv_header.length, &length, sizeof(length));
7819 memcpy(&protoctl_event_header.protoctl_event, &flow->protoctl_event,
7820 sizeof(flow->protoctl_event));
7821
7822 error = copyout(&protoctl_event_header, uap->buffer + client->result_length + *assigned_results_cursor,
7823 sizeof(protoctl_event_header));
7824
7825 if (error) {
7826 NECPLOG(LOG_ERR, "necp_client_copy protocol control event results"
7827 " tlv_header copyout error (%d)", error);
7828 return error;
7829 }
7830 *assigned_results_cursor += sizeof(protoctl_event_header);
7831 flow->has_protoctl_event = FALSE;
7832 flow->protoctl_event.protoctl_event_code = 0;
7833 flow->protoctl_event.protoctl_event_val = 0;
7834 flow->protoctl_event.protoctl_event_tcp_seq_num = 0;
7835 }
7836 }
7837 }
7838 if (!client_is_observed) {
7839 flow_registration->flow_result_read = TRUE;
7840 }
7841 return 0;
7842 }
7843
7844 static int
necp_client_copy_internal(struct necp_client * client,uuid_t client_id,bool client_is_observed,struct necp_client_action_args * uap,int * retval)7845 necp_client_copy_internal(struct necp_client *client, uuid_t client_id, bool client_is_observed, struct necp_client_action_args *uap, int *retval)
7846 {
7847 NECP_CLIENT_ASSERT_LOCKED(client);
7848 int error = 0;
7849 // Copy results out
7850 if (uap->action == NECP_CLIENT_ACTION_COPY_PARAMETERS) {
7851 if (uap->buffer_size < client->parameters_length) {
7852 return EINVAL;
7853 }
7854 error = copyout(client->parameters, uap->buffer, client->parameters_length);
7855 if (error) {
7856 NECPLOG(LOG_ERR, "necp_client_copy parameters copyout error (%d)", error);
7857 return error;
7858 }
7859 *retval = client->parameters_length;
7860 } else if (uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT &&
7861 client->result_read && client->group_members_read && !necp_client_has_unread_flows(client)) {
7862 // Copy updates only, but nothing to read
7863 // Just return 0 for bytes read
7864 *retval = 0;
7865 } else if (uap->action == NECP_CLIENT_ACTION_COPY_RESULT ||
7866 uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
7867 size_t assigned_results_size = client->assigned_group_members_length;
7868
7869 bool some_flow_is_defunct = false;
7870 struct necp_client_flow_registration *single_flow_registration = NULL;
7871 if (necp_client_id_is_flow(client_id)) {
7872 single_flow_registration = necp_client_find_flow(client, client_id);
7873 if (single_flow_registration != NULL) {
7874 assigned_results_size += necp_client_calculate_flow_tlv_size(single_flow_registration);
7875 }
7876 } else {
7877 // This request is for the client, so copy everything
7878 struct necp_client_flow_registration *flow_registration = NULL;
7879 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
7880 if (flow_registration->defunct) {
7881 some_flow_is_defunct = true;
7882 }
7883 assigned_results_size += necp_client_calculate_flow_tlv_size(flow_registration);
7884 }
7885 }
7886 if (uap->buffer_size < (client->result_length + assigned_results_size)) {
7887 return EINVAL;
7888 }
7889
7890 u_int32_t original_flags = 0;
7891 bool flags_updated = false;
7892 if (some_flow_is_defunct && client->legacy_client_is_flow) {
7893 // If our client expects the defunct flag in the client, add it now
7894 u_int32_t client_flags = 0;
7895 u_int32_t value_size = 0;
7896 u_int8_t *flags_pointer = necp_buffer_get_tlv_value(client->result, 0, &value_size);
7897 if (flags_pointer != NULL && value_size == sizeof(client_flags)) {
7898 memcpy(&client_flags, flags_pointer, value_size);
7899 original_flags = client_flags;
7900 client_flags |= NECP_CLIENT_RESULT_FLAG_DEFUNCT;
7901 (void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS,
7902 sizeof(client_flags), &client_flags, &flags_updated,
7903 client->result, sizeof(client->result));
7904 }
7905 }
7906
7907 error = copyout(client->result, uap->buffer, client->result_length);
7908
7909 if (flags_updated) {
7910 // Revert stored flags
7911 (void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS,
7912 sizeof(original_flags), &original_flags, &flags_updated,
7913 client->result, sizeof(client->result));
7914 }
7915
7916 if (error != 0) {
7917 NECPLOG(LOG_ERR, "necp_client_copy result copyout error (%d)", error);
7918 return error;
7919 }
7920
7921 if (client->assigned_group_members != NULL && client->assigned_group_members_length > 0) {
7922 error = copyout(client->assigned_group_members, uap->buffer + client->result_length, client->assigned_group_members_length);
7923 if (error != 0) {
7924 NECPLOG(LOG_ERR, "necp_client_copy group members copyout error (%d)", error);
7925 return error;
7926 }
7927 }
7928
7929 size_t assigned_results_cursor = client->assigned_group_members_length; // Start with an offset based on the group members
7930 if (necp_client_id_is_flow(client_id)) {
7931 if (single_flow_registration != NULL) {
7932 error = necp_client_fillout_flow_tlvs(client, client_is_observed, single_flow_registration, uap, &assigned_results_cursor);
7933 if (error != 0) {
7934 return error;
7935 }
7936 }
7937 } else {
7938 // This request is for the client, so copy everything
7939 struct necp_client_flow_registration *flow_registration = NULL;
7940 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
7941 error = necp_client_fillout_flow_tlvs(client, client_is_observed, flow_registration, uap, &assigned_results_cursor);
7942 if (error != 0) {
7943 return error;
7944 }
7945 }
7946 }
7947
7948 *retval = client->result_length + assigned_results_cursor;
7949
7950 if (!client_is_observed) {
7951 client->result_read = TRUE;
7952 client->group_members_read = TRUE;
7953 }
7954 }
7955
7956 return 0;
7957 }
7958
7959 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)7960 necp_client_copy(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
7961 {
7962 int error = 0;
7963 struct necp_client *client = NULL;
7964 uuid_t client_id;
7965 uuid_clear(client_id);
7966
7967 *retval = 0;
7968
7969 if (uap->buffer_size == 0 || uap->buffer == 0) {
7970 return EINVAL;
7971 }
7972
7973 if (uap->action != NECP_CLIENT_ACTION_COPY_PARAMETERS &&
7974 uap->action != NECP_CLIENT_ACTION_COPY_RESULT &&
7975 uap->action != NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
7976 return EINVAL;
7977 }
7978
7979 if (uap->client_id) {
7980 if (uap->client_id_len != sizeof(uuid_t)) {
7981 NECPLOG(LOG_ERR, "Incorrect length (got %zu, expected %zu)", (size_t)uap->client_id_len, sizeof(uuid_t));
7982 return ERANGE;
7983 }
7984
7985 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
7986 if (error) {
7987 NECPLOG(LOG_ERR, "necp_client_copy client_id copyin error (%d)", error);
7988 return error;
7989 }
7990 }
7991
7992 const bool is_wildcard = (bool)uuid_is_null(client_id);
7993
7994 NECP_FD_LOCK(fd_data);
7995
7996 bool send_in_process_flow_divert_message = false;
7997 if (is_wildcard) {
7998 if (uap->action == NECP_CLIENT_ACTION_COPY_RESULT || uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
7999 struct necp_client *find_client = NULL;
8000 RB_FOREACH(find_client, _necp_client_tree, &fd_data->clients) {
8001 NECP_CLIENT_LOCK(find_client);
8002 if (!find_client->result_read || !find_client->group_members_read || necp_client_has_unread_flows(find_client)) {
8003 client = find_client;
8004 // Leave the client locked, and break
8005 break;
8006 }
8007 NECP_CLIENT_UNLOCK(find_client);
8008 }
8009
8010 if (client == NULL && fd_data->request_in_process_flow_divert) {
8011 // No client found that needs update. Check for an event requesting in-process flow divert.
8012 send_in_process_flow_divert_message = true;
8013 }
8014 }
8015 } else {
8016 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8017 }
8018
8019 if (client != NULL) {
8020 if (!send_in_process_flow_divert_message) {
8021 // If client is set, it is locked
8022 error = necp_client_copy_internal(client, client_id, FALSE, uap, retval);
8023 }
8024 NECP_CLIENT_UNLOCK(client);
8025 }
8026
8027 if (send_in_process_flow_divert_message) {
8028 fd_data->request_in_process_flow_divert = false;
8029
8030 struct necp_tlv_header request_tlv = {
8031 .type = NECP_CLIENT_RESULT_REQUEST_IN_PROCESS_FLOW_DIVERT,
8032 .length = 0,
8033 };
8034 if (uap->buffer_size < sizeof(request_tlv)) {
8035 error = EINVAL;
8036 } else {
8037 error = copyout(&request_tlv, uap->buffer, sizeof(request_tlv));
8038 if (error) {
8039 NECPLOG(LOG_ERR, "necp_client_copy request flow divert TLV copyout error (%d)", error);
8040 } else {
8041 *retval = sizeof(request_tlv);
8042 }
8043 }
8044 }
8045
8046 // Unlock our own fd before moving on or returning
8047 NECP_FD_UNLOCK(fd_data);
8048
8049 if (client == NULL && !send_in_process_flow_divert_message) {
8050 if (fd_data->flags & NECP_OPEN_FLAG_OBSERVER) {
8051 // Observers are allowed to lookup clients on other fds
8052
8053 // Lock tree
8054 NECP_CLIENT_TREE_LOCK_SHARED();
8055
8056 bool found_client = FALSE;
8057
8058 client = necp_find_client_and_lock(client_id);
8059 if (client != NULL) {
8060 // Matched, copy out data
8061 found_client = TRUE;
8062 error = necp_client_copy_internal(client, client_id, TRUE, uap, retval);
8063 NECP_CLIENT_UNLOCK(client);
8064 }
8065
8066 // Unlock tree
8067 NECP_CLIENT_TREE_UNLOCK();
8068
8069 // No client found, fail
8070 if (!found_client) {
8071 return ENOENT;
8072 }
8073 } else {
8074 // No client found, and not allowed to search other fds, fail
8075 return ENOENT;
8076 }
8077 }
8078
8079 return error;
8080 }
8081
8082 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_client_update(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8083 necp_client_copy_client_update(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8084 {
8085 int error = 0;
8086
8087 *retval = 0;
8088
8089 if (!(fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER)) {
8090 NECPLOG0(LOG_ERR, "NECP fd is not observer, cannot copy client update");
8091 return EINVAL;
8092 }
8093
8094 if (uap->client_id_len != sizeof(uuid_t) || uap->client_id == 0) {
8095 NECPLOG0(LOG_ERR, "Client id invalid, cannot copy client update");
8096 return EINVAL;
8097 }
8098
8099 if (uap->buffer_size == 0 || uap->buffer == 0) {
8100 NECPLOG0(LOG_ERR, "Buffer invalid, cannot copy client update");
8101 return EINVAL;
8102 }
8103
8104 NECP_FD_LOCK(fd_data);
8105 struct necp_client_update *client_update = TAILQ_FIRST(&fd_data->update_list);
8106 if (client_update != NULL) {
8107 TAILQ_REMOVE(&fd_data->update_list, client_update, chain);
8108 VERIFY(fd_data->update_count > 0);
8109 fd_data->update_count--;
8110 }
8111 NECP_FD_UNLOCK(fd_data);
8112
8113 if (client_update != NULL) {
8114 error = copyout(client_update->client_id, uap->client_id, sizeof(uuid_t));
8115 if (error) {
8116 NECPLOG(LOG_ERR, "Copy client update copyout client id error (%d)", error);
8117 } else {
8118 if (uap->buffer_size < client_update->update_length) {
8119 NECPLOG(LOG_ERR, "Buffer size cannot hold update (%zu < %zu)", (size_t)uap->buffer_size, client_update->update_length);
8120 error = EINVAL;
8121 } else {
8122 error = copyout(client_update->update, uap->buffer, client_update->update_length);
8123 if (error) {
8124 NECPLOG(LOG_ERR, "Copy client update copyout error (%d)", error);
8125 } else {
8126 *retval = client_update->update_length;
8127 }
8128 }
8129 }
8130
8131 necp_client_update_free(client_update);
8132 client_update = NULL;
8133 } else {
8134 error = ENOENT;
8135 }
8136
8137 return error;
8138 }
8139
8140 static int
necp_client_copy_parameters_locked(struct necp_client * client,struct necp_client_nexus_parameters * parameters)8141 necp_client_copy_parameters_locked(struct necp_client *client,
8142 struct necp_client_nexus_parameters *parameters)
8143 {
8144 VERIFY(parameters != NULL);
8145
8146 struct necp_client_parsed_parameters parsed_parameters = {};
8147 int error = necp_client_parse_parameters(client, client->parameters, (u_int32_t)client->parameters_length, &parsed_parameters);
8148
8149 parameters->pid = client->proc_pid;
8150 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID) {
8151 parameters->epid = parsed_parameters.effective_pid;
8152 } else {
8153 parameters->epid = parameters->pid;
8154 }
8155 #if SKYWALK
8156 parameters->port_reservation = client->port_reservation;
8157 #endif /* !SKYWALK */
8158 memcpy(¶meters->local_addr, &parsed_parameters.local_addr, sizeof(parameters->local_addr));
8159 memcpy(¶meters->remote_addr, &parsed_parameters.remote_addr, sizeof(parameters->remote_addr));
8160 parameters->ip_protocol = parsed_parameters.ip_protocol;
8161 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL) {
8162 parameters->transport_protocol = parsed_parameters.transport_protocol;
8163 } else {
8164 parameters->transport_protocol = parsed_parameters.ip_protocol;
8165 }
8166 parameters->ethertype = parsed_parameters.ethertype;
8167 parameters->traffic_class = parsed_parameters.traffic_class;
8168 if (uuid_is_null(client->override_euuid)) {
8169 uuid_copy(parameters->euuid, parsed_parameters.effective_uuid);
8170 } else {
8171 uuid_copy(parameters->euuid, client->override_euuid);
8172 }
8173 parameters->is_listener = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) ? 1 : 0;
8174 parameters->is_interpose = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) ? 1 : 0;
8175 parameters->is_custom_ether = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) ? 1 : 0;
8176 parameters->policy_id = client->policy_id;
8177
8178 // parse client result flag
8179 u_int32_t client_result_flags = 0;
8180 u_int32_t value_size = 0;
8181 u_int8_t *flags_pointer = NULL;
8182 flags_pointer = necp_buffer_get_tlv_value(client->result, 0, &value_size);
8183 if (flags_pointer && value_size == sizeof(client_result_flags)) {
8184 memcpy(&client_result_flags, flags_pointer, value_size);
8185 }
8186 parameters->allow_qos_marking = (client_result_flags & NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING) ? 1 : 0;
8187
8188 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE) {
8189 if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_DEFAULT) {
8190 parameters->override_address_selection = false;
8191 } else if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_TEMPORARY) {
8192 parameters->override_address_selection = true;
8193 parameters->use_stable_address = false;
8194 } else if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_STABLE) {
8195 parameters->override_address_selection = true;
8196 parameters->use_stable_address = true;
8197 }
8198 } else {
8199 parameters->override_address_selection = false;
8200 }
8201
8202 if ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
8203 (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_NO_WAKE_FROM_SLEEP)) {
8204 parameters->no_wake_from_sleep = true;
8205 }
8206
8207 if ((parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
8208 (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_REUSE_LOCAL)) {
8209 parameters->reuse_port = true;
8210 }
8211
8212 #if SKYWALK
8213 if (!parameters->is_listener) {
8214 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLOW_DEMUX_PATTERN) {
8215 if (parsed_parameters.demux_patterns[0].len == 0) {
8216 parameters->is_demuxable_parent = 1;
8217 } else {
8218 if (client->validated_parent) {
8219 ASSERT(!uuid_is_null(client->parent_client_id));
8220
8221 NECP_CLIENT_TREE_LOCK_SHARED();
8222 struct necp_client *parent = necp_find_client_and_lock(client->parent_client_id);
8223 if (parent != NULL) {
8224 struct necp_client_flow_registration *parent_flow_registration = NULL;
8225 RB_FOREACH(parent_flow_registration, _necp_client_flow_tree, &parent->flow_registrations) {
8226 uuid_copy(parameters->parent_flow_uuid, parent_flow_registration->registration_id);
8227 break;
8228 }
8229
8230 NECP_CLIENT_UNLOCK(parent);
8231 }
8232 NECP_CLIENT_TREE_UNLOCK();
8233
8234 if (parsed_parameters.demux_pattern_count > 0) {
8235 for (int i = 0; i < parsed_parameters.demux_pattern_count; i++) {
8236 memcpy(¶meters->demux_patterns[i], &parsed_parameters.demux_patterns[i], sizeof(struct necp_demux_pattern));
8237 }
8238 parameters->demux_pattern_count = parsed_parameters.demux_pattern_count;
8239 }
8240 }
8241 }
8242 }
8243 }
8244 #endif // SKYWALK
8245
8246 return error;
8247 }
8248
8249 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_list(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8250 necp_client_list(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8251 {
8252 int error = 0;
8253 struct necp_client *find_client = NULL;
8254 uuid_t *list = NULL;
8255 u_int32_t requested_client_count = 0;
8256 u_int32_t client_count = 0;
8257 size_t copy_buffer_size = 0;
8258
8259 if (uap->buffer_size < sizeof(requested_client_count) || uap->buffer == 0) {
8260 error = EINVAL;
8261 goto done;
8262 }
8263
8264 if (!(fd_data->flags & NECP_OPEN_FLAG_OBSERVER)) {
8265 NECPLOG0(LOG_ERR, "Client does not hold necessary entitlement to list other NECP clients");
8266 error = EACCES;
8267 goto done;
8268 }
8269
8270 error = copyin(uap->buffer, &requested_client_count, sizeof(requested_client_count));
8271 if (error) {
8272 goto done;
8273 }
8274
8275 if (os_mul_overflow(sizeof(uuid_t), requested_client_count, ©_buffer_size)) {
8276 error = ERANGE;
8277 goto done;
8278 }
8279
8280 if (uap->buffer_size - sizeof(requested_client_count) != copy_buffer_size) {
8281 error = EINVAL;
8282 goto done;
8283 }
8284
8285 if (copy_buffer_size > NECP_MAX_CLIENT_LIST_SIZE) {
8286 error = EINVAL;
8287 goto done;
8288 }
8289
8290 if (requested_client_count > 0) {
8291 if ((list = (uuid_t*)kalloc_data(copy_buffer_size, Z_WAITOK | Z_ZERO)) == NULL) {
8292 error = ENOMEM;
8293 goto done;
8294 }
8295 }
8296
8297 // Lock tree
8298 NECP_CLIENT_TREE_LOCK_SHARED();
8299
8300 find_client = NULL;
8301 RB_FOREACH(find_client, _necp_client_global_tree, &necp_client_global_tree) {
8302 NECP_CLIENT_LOCK(find_client);
8303 if (!uuid_is_null(find_client->client_id)) {
8304 if (client_count < requested_client_count) {
8305 uuid_copy(list[client_count], find_client->client_id);
8306 }
8307 client_count++;
8308 }
8309 NECP_CLIENT_UNLOCK(find_client);
8310 }
8311
8312 // Unlock tree
8313 NECP_CLIENT_TREE_UNLOCK();
8314
8315 error = copyout(&client_count, uap->buffer, sizeof(client_count));
8316 if (error) {
8317 NECPLOG(LOG_ERR, "necp_client_list buffer copyout error (%d)", error);
8318 goto done;
8319 }
8320
8321 if (requested_client_count > 0 &&
8322 client_count > 0 &&
8323 list != NULL) {
8324 error = copyout(list, uap->buffer + sizeof(client_count), copy_buffer_size);
8325 if (error) {
8326 NECPLOG(LOG_ERR, "necp_client_list client count copyout error (%d)", error);
8327 goto done;
8328 }
8329 }
8330 done:
8331 if (list != NULL) {
8332 kfree_data(list, copy_buffer_size);
8333 }
8334 *retval = error;
8335
8336 return error;
8337 }
8338
8339 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_add_flow(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8340 necp_client_add_flow(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8341 {
8342 int error = 0;
8343 struct necp_client *client = NULL;
8344 uuid_t client_id;
8345 struct necp_client_nexus_parameters parameters = {};
8346 struct proc *proc = PROC_NULL;
8347 struct necp_client_add_flow *add_request = NULL;
8348 struct necp_client_add_flow *allocated_add_request = NULL;
8349 struct necp_client_add_flow_default default_add_request = {};
8350 const size_t buffer_size = uap->buffer_size;
8351
8352 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
8353 error = EINVAL;
8354 NECPLOG(LOG_ERR, "necp_client_add_flow invalid client_id (length %zu)", (size_t)uap->client_id_len);
8355 goto done;
8356 }
8357
8358 if (uap->buffer == 0 || buffer_size < sizeof(struct necp_client_add_flow) ||
8359 buffer_size > sizeof(struct necp_client_add_flow_default) * 4) {
8360 error = EINVAL;
8361 NECPLOG(LOG_ERR, "necp_client_add_flow invalid buffer (length %zu)", buffer_size);
8362 goto done;
8363 }
8364
8365 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8366 if (error) {
8367 NECPLOG(LOG_ERR, "necp_client_add_flow copyin client_id error (%d)", error);
8368 goto done;
8369 }
8370
8371 if (buffer_size <= sizeof(struct necp_client_add_flow_default)) {
8372 // Fits in default size
8373 error = copyin(uap->buffer, &default_add_request, buffer_size);
8374 if (error) {
8375 NECPLOG(LOG_ERR, "necp_client_add_flow copyin default_add_request error (%d)", error);
8376 goto done;
8377 }
8378
8379 add_request = (struct necp_client_add_flow *)&default_add_request;
8380 } else {
8381 allocated_add_request = (struct necp_client_add_flow *)kalloc_data(buffer_size, Z_WAITOK | Z_ZERO);
8382 if (allocated_add_request == NULL) {
8383 error = ENOMEM;
8384 goto done;
8385 }
8386
8387 error = copyin(uap->buffer, allocated_add_request, buffer_size);
8388 if (error) {
8389 NECPLOG(LOG_ERR, "necp_client_add_flow copyin default_add_request error (%d)", error);
8390 goto done;
8391 }
8392
8393 add_request = allocated_add_request;
8394 }
8395
8396 NECP_FD_LOCK(fd_data);
8397 pid_t pid = fd_data->proc_pid;
8398 proc = proc_find(pid);
8399 if (proc == PROC_NULL) {
8400 NECP_FD_UNLOCK(fd_data);
8401 NECPLOG(LOG_ERR, "necp_client_add_flow process not found for pid %d error (%d)", pid, error);
8402 error = ESRCH;
8403 goto done;
8404 }
8405
8406 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8407 if (client == NULL) {
8408 error = ENOENT;
8409 NECP_FD_UNLOCK(fd_data);
8410 goto done;
8411 }
8412
8413 // Using ADD_FLOW indicates that the client supports multiple flows per client
8414 client->legacy_client_is_flow = false;
8415
8416 necp_client_retain_locked(client);
8417 necp_client_copy_parameters_locked(client, ¶meters);
8418
8419 struct necp_client_flow_registration *new_registration = necp_client_create_flow_registration(fd_data, client);
8420 if (new_registration == NULL) {
8421 error = ENOMEM;
8422 NECP_CLIENT_UNLOCK(client);
8423 NECP_FD_UNLOCK(fd_data);
8424 NECPLOG0(LOG_ERR, "Failed to allocate flow registration");
8425 goto done;
8426 }
8427
8428 new_registration->flags = add_request->flags;
8429
8430 // Copy new ID out to caller
8431 uuid_copy(add_request->registration_id, new_registration->registration_id);
8432
8433 NECP_CLIENT_FLOW_LOG(client, new_registration, "adding flow");
8434
8435 size_t trailer_offset = (sizeof(struct necp_client_add_flow) +
8436 add_request->stats_request_count * sizeof(struct necp_client_flow_stats));
8437
8438 // Copy override address
8439 struct sockaddr *override_address = NULL;
8440 if (add_request->flags & NECP_CLIENT_FLOW_FLAGS_OVERRIDE_ADDRESS) {
8441 size_t offset_of_address = trailer_offset;
8442 if (buffer_size >= offset_of_address + sizeof(struct sockaddr_in)) {
8443 override_address = (struct sockaddr *)(((uint8_t *)add_request) + offset_of_address);
8444 if (buffer_size >= offset_of_address + override_address->sa_len &&
8445 override_address->sa_len <= sizeof(parameters.remote_addr)) {
8446 memcpy(¶meters.remote_addr, override_address, override_address->sa_len);
8447 trailer_offset += override_address->sa_len;
8448 } else {
8449 override_address = NULL;
8450 }
8451 }
8452 }
8453
8454 // Copy override IP protocol
8455 if (add_request->flags & NECP_CLIENT_FLOW_FLAGS_OVERRIDE_IP_PROTOCOL) {
8456 size_t offset_of_ip_protocol = trailer_offset;
8457 if (buffer_size >= offset_of_ip_protocol + sizeof(uint8_t)) {
8458 uint8_t *ip_protocol_p = (uint8_t *)(((uint8_t *)add_request) + offset_of_ip_protocol);
8459 memcpy(¶meters.ip_protocol, ip_protocol_p, sizeof(uint8_t));
8460 }
8461 }
8462
8463 #if SKYWALK
8464 if (add_request->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS) {
8465 void *assigned_results = NULL;
8466 size_t assigned_results_length = 0;
8467 uint32_t interface_index = 0;
8468
8469 // Validate that the nexus UUID is assigned
8470 bool found_nexus = false;
8471 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
8472 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
8473 struct necp_client_interface_option *option = &client->interface_options[option_i];
8474 if (uuid_compare(option->nexus_agent, add_request->agent_uuid) == 0) {
8475 interface_index = option->interface_index;
8476 found_nexus = true;
8477 break;
8478 }
8479 } else {
8480 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
8481 if (uuid_compare(option->nexus_agent, add_request->agent_uuid) == 0) {
8482 interface_index = option->interface_index;
8483 found_nexus = true;
8484 break;
8485 }
8486 }
8487 }
8488
8489 if (!found_nexus) {
8490 NECPLOG0(LOG_ERR, "Requested nexus not found");
8491 } else {
8492 necp_client_add_nexus_flow_if_needed(new_registration, add_request->agent_uuid, interface_index);
8493
8494 error = netagent_client_message_with_params(add_request->agent_uuid,
8495 ((new_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
8496 client->client_id :
8497 new_registration->registration_id),
8498 pid, client->agent_handle,
8499 NETAGENT_MESSAGE_TYPE_REQUEST_NEXUS,
8500 (struct necp_client_agent_parameters *)¶meters,
8501 &assigned_results, &assigned_results_length);
8502 if (error != 0) {
8503 VERIFY(assigned_results == NULL);
8504 VERIFY(assigned_results_length == 0);
8505 NECPLOG(LOG_ERR, "netagent_client_message error (%d)", error);
8506 } else if (assigned_results != NULL) {
8507 if (!necp_assign_client_result_locked(proc, fd_data, client, new_registration, add_request->agent_uuid,
8508 assigned_results, assigned_results_length, false, false)) {
8509 kfree_data(assigned_results, assigned_results_length);
8510 }
8511 } else if (override_address != NULL) {
8512 // Save the overridden address in the flow. Find the correct flow,
8513 // and assign just the address TLV. Don't set the assigned flag.
8514 struct necp_client_flow *flow = NULL;
8515 LIST_FOREACH(flow, &new_registration->flow_list, flow_chain) {
8516 if (flow->nexus &&
8517 uuid_compare(flow->u.nexus_agent, add_request->agent_uuid) == 0) {
8518 if (flow->assigned_results == NULL) {
8519 memcpy(&flow->remote_addr, override_address, override_address->sa_len);
8520 uuid_t empty_uuid;
8521 uuid_clear(empty_uuid);
8522 flow->assigned_results = necp_create_nexus_assign_message(empty_uuid, 0, NULL, 0,
8523 (struct necp_client_endpoint *)&flow->local_addr,
8524 (struct necp_client_endpoint *)&flow->remote_addr,
8525 NULL, 0, NULL, &flow->assigned_results_length);
8526 }
8527 break;
8528 }
8529 }
8530 }
8531 }
8532 }
8533
8534 // Don't request stats if nexus creation fails
8535 if (error == 0 && add_request->stats_request_count > 0 && necp_arena_initialize(fd_data, true) == 0) {
8536 struct necp_client_flow_stats *stats_request = (struct necp_client_flow_stats *)&add_request->stats_requests[0];
8537 struct necp_stats_bufreq bufreq = {};
8538
8539 NECP_CLIENT_FLOW_LOG(client, new_registration, "Initializing stats");
8540
8541 bufreq.necp_stats_bufreq_id = NECP_CLIENT_STATISTICS_BUFREQ_ID;
8542 bufreq.necp_stats_bufreq_type = stats_request->stats_type;
8543 bufreq.necp_stats_bufreq_ver = stats_request->stats_version;
8544 bufreq.necp_stats_bufreq_size = stats_request->stats_size;
8545 bufreq.necp_stats_bufreq_uaddr = stats_request->stats_addr;
8546 (void)necp_stats_initialize(fd_data, client, new_registration, &bufreq);
8547 stats_request->stats_type = bufreq.necp_stats_bufreq_type;
8548 stats_request->stats_version = bufreq.necp_stats_bufreq_ver;
8549 stats_request->stats_size = bufreq.necp_stats_bufreq_size;
8550 stats_request->stats_addr = bufreq.necp_stats_bufreq_uaddr;
8551 }
8552 #endif /* !SKYWALK */
8553
8554 if (error == 0 &&
8555 (add_request->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE ||
8556 add_request->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) {
8557 uint32_t interface_index = IFSCOPE_NONE;
8558 ifnet_head_lock_shared();
8559 struct ifnet *interface = NULL;
8560 TAILQ_FOREACH(interface, &ifnet_head, if_link) {
8561 ifnet_lock_shared(interface);
8562 if (interface->if_agentids != NULL) {
8563 for (u_int32_t i = 0; i < interface->if_agentcount; i++) {
8564 if (uuid_compare(interface->if_agentids[i], add_request->agent_uuid) == 0) {
8565 interface_index = interface->if_index;
8566 break;
8567 }
8568 }
8569 }
8570 ifnet_lock_done(interface);
8571 if (interface_index != IFSCOPE_NONE) {
8572 break;
8573 }
8574 }
8575 ifnet_head_done();
8576
8577 necp_client_add_nexus_flow_if_needed(new_registration, add_request->agent_uuid, interface_index);
8578
8579 error = netagent_client_message_with_params(add_request->agent_uuid,
8580 ((new_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
8581 client->client_id :
8582 new_registration->registration_id),
8583 pid, client->agent_handle,
8584 NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT,
8585 (struct necp_client_agent_parameters *)¶meters,
8586 NULL, NULL);
8587 if (error != 0) {
8588 NECPLOG(LOG_ERR, "netagent_client_message error (%d)", error);
8589 }
8590 }
8591
8592 if (error != 0) {
8593 // Encountered an error in adding the flow, destroy the flow registration
8594 #if SKYWALK
8595 necp_destroy_flow_stats(fd_data, new_registration, NULL, false);
8596 #endif /* SKYWALK */
8597 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
8598 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, new_registration);
8599 NECP_FLOW_TREE_UNLOCK();
8600 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, new_registration);
8601 necp_destroy_client_flow_registration(client, new_registration, fd_data->proc_pid, true);
8602 new_registration = NULL;
8603 }
8604
8605 NECP_CLIENT_UNLOCK(client);
8606 NECP_FD_UNLOCK(fd_data);
8607
8608 necp_client_release(client);
8609
8610 if (error != 0) {
8611 goto done;
8612 }
8613
8614 // Copy the request back out to the caller with assigned fields
8615 error = copyout(add_request, uap->buffer, buffer_size);
8616 if (error != 0) {
8617 NECPLOG(LOG_ERR, "necp_client_add_flow copyout add_request error (%d)", error);
8618 }
8619
8620 done:
8621 *retval = error;
8622 if (error != 0) {
8623 NECPLOG(LOG_ERR, "Add flow error (%d)", error);
8624 }
8625
8626 if (allocated_add_request != NULL) {
8627 kfree_data(allocated_add_request, buffer_size);
8628 }
8629
8630 if (proc != PROC_NULL) {
8631 proc_rele(proc);
8632 }
8633 return error;
8634 }
8635
8636 #if SKYWALK
8637
8638 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_request_nexus(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8639 necp_client_request_nexus(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8640 {
8641 int error = 0;
8642 struct necp_client *client = NULL;
8643 uuid_t client_id;
8644 struct necp_client_nexus_parameters parameters = {};
8645 struct proc *proc = PROC_NULL;
8646 const size_t buffer_size = uap->buffer_size;
8647
8648 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
8649 error = EINVAL;
8650 goto done;
8651 }
8652
8653 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8654 if (error) {
8655 NECPLOG(LOG_ERR, "necp_client_request_nexus copyin client_id error (%d)", error);
8656 goto done;
8657 }
8658
8659 NECP_FD_LOCK(fd_data);
8660 pid_t pid = fd_data->proc_pid;
8661 proc = proc_find(pid);
8662 if (proc == PROC_NULL) {
8663 NECP_FD_UNLOCK(fd_data);
8664 NECPLOG(LOG_ERR, "necp_client_request_nexus process not found for pid %d error (%d)", pid, error);
8665 error = ESRCH;
8666 goto done;
8667 }
8668
8669 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8670 if (client == NULL) {
8671 NECP_FD_UNLOCK(fd_data);
8672 error = ENOENT;
8673 goto done;
8674 }
8675
8676 // Using REQUEST_NEXUS indicates that the client only supports one flow per client
8677 client->legacy_client_is_flow = true;
8678
8679 necp_client_retain_locked(client);
8680 necp_client_copy_parameters_locked(client, ¶meters);
8681
8682 do {
8683 void *assigned_results = NULL;
8684 size_t assigned_results_length = 0;
8685 uuid_t nexus_uuid;
8686 uint32_t interface_index = 0;
8687
8688 // Validate that the nexus UUID is assigned
8689 bool found_nexus = false;
8690 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
8691 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
8692 struct necp_client_interface_option *option = &client->interface_options[option_i];
8693 if (!uuid_is_null(option->nexus_agent)) {
8694 uuid_copy(nexus_uuid, option->nexus_agent);
8695 interface_index = option->interface_index;
8696 found_nexus = true;
8697 break;
8698 }
8699 } else {
8700 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
8701 if (!uuid_is_null(option->nexus_agent)) {
8702 uuid_copy(nexus_uuid, option->nexus_agent);
8703 interface_index = option->interface_index;
8704 found_nexus = true;
8705 break;
8706 }
8707 }
8708 }
8709
8710 if (!found_nexus) {
8711 NECP_CLIENT_UNLOCK(client);
8712 NECP_FD_UNLOCK(fd_data);
8713 necp_client_release(client);
8714 // Break the loop
8715 error = ENETDOWN;
8716 goto done;
8717 }
8718
8719 struct necp_client_flow_registration *new_registration = necp_client_create_flow_registration(fd_data, client);
8720 if (new_registration == NULL) {
8721 error = ENOMEM;
8722 NECP_CLIENT_UNLOCK(client);
8723 NECP_FD_UNLOCK(fd_data);
8724 necp_client_release(client);
8725 NECPLOG0(LOG_ERR, "Failed to allocate flow registration");
8726 goto done;
8727 }
8728
8729 new_registration->flags = (NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS | NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID);
8730
8731 necp_client_add_nexus_flow_if_needed(new_registration, nexus_uuid, interface_index);
8732
8733 // Note: Any clients using "request_nexus" are not flow-registration aware.
8734 // Register the Client ID rather than the Registration ID with the nexus, since
8735 // the client will send traffic based on the client ID.
8736 error = netagent_client_message_with_params(nexus_uuid,
8737 ((new_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
8738 client->client_id :
8739 new_registration->registration_id),
8740 pid, client->agent_handle,
8741 NETAGENT_MESSAGE_TYPE_REQUEST_NEXUS,
8742 (struct necp_client_agent_parameters *)¶meters,
8743 &assigned_results, &assigned_results_length);
8744 if (error) {
8745 NECP_CLIENT_UNLOCK(client);
8746 NECP_FD_UNLOCK(fd_data);
8747 necp_client_release(client);
8748 VERIFY(assigned_results == NULL);
8749 VERIFY(assigned_results_length == 0);
8750 NECPLOG(LOG_ERR, "netagent_client_message error (%d)", error);
8751 goto done;
8752 }
8753
8754 if (assigned_results != NULL) {
8755 if (!necp_assign_client_result_locked(proc, fd_data, client, new_registration, nexus_uuid,
8756 assigned_results, assigned_results_length, false, false)) {
8757 kfree_data(assigned_results, assigned_results_length);
8758 }
8759 }
8760
8761 if (uap->buffer != 0 && buffer_size == sizeof(struct necp_stats_bufreq) &&
8762 necp_arena_initialize(fd_data, true) == 0) {
8763 struct necp_stats_bufreq bufreq = {};
8764 int copy_error = copyin(uap->buffer, &bufreq, buffer_size);
8765 if (copy_error) {
8766 NECPLOG(LOG_ERR, "necp_client_request_nexus copyin bufreq error (%d)", copy_error);
8767 } else {
8768 (void)necp_stats_initialize(fd_data, client, new_registration, &bufreq);
8769 copy_error = copyout(&bufreq, uap->buffer, buffer_size);
8770 if (copy_error != 0) {
8771 NECPLOG(LOG_ERR, "necp_client_request_nexus copyout bufreq error (%d)", copy_error);
8772 }
8773 }
8774 }
8775 } while (false);
8776
8777 NECP_CLIENT_UNLOCK(client);
8778 NECP_FD_UNLOCK(fd_data);
8779
8780 necp_client_release(client);
8781
8782 done:
8783 *retval = error;
8784 if (error != 0) {
8785 NECPLOG(LOG_ERR, "Request nexus error (%d)", error);
8786 }
8787
8788 if (proc != PROC_NULL) {
8789 proc_rele(proc);
8790 }
8791 return error;
8792 }
8793 #endif /* !SKYWALK */
8794
8795 static void
necp_client_add_assertion(struct necp_client * client,uuid_t netagent_uuid)8796 necp_client_add_assertion(struct necp_client *client, uuid_t netagent_uuid)
8797 {
8798 struct necp_client_assertion *new_assertion = NULL;
8799
8800 new_assertion = kalloc_type(struct necp_client_assertion,
8801 Z_WAITOK | Z_NOFAIL);
8802
8803 uuid_copy(new_assertion->asserted_netagent, netagent_uuid);
8804
8805 LIST_INSERT_HEAD(&client->assertion_list, new_assertion, assertion_chain);
8806 }
8807
8808 static bool
necp_client_remove_assertion(struct necp_client * client,uuid_t netagent_uuid)8809 necp_client_remove_assertion(struct necp_client *client, uuid_t netagent_uuid)
8810 {
8811 struct necp_client_assertion *found_assertion = NULL;
8812 struct necp_client_assertion *search_assertion = NULL;
8813 LIST_FOREACH(search_assertion, &client->assertion_list, assertion_chain) {
8814 if (uuid_compare(search_assertion->asserted_netagent, netagent_uuid) == 0) {
8815 found_assertion = search_assertion;
8816 break;
8817 }
8818 }
8819
8820 if (found_assertion == NULL) {
8821 NECPLOG0(LOG_ERR, "Netagent uuid not previously asserted");
8822 return false;
8823 }
8824
8825 LIST_REMOVE(found_assertion, assertion_chain);
8826 kfree_type(struct necp_client_assertion, found_assertion);
8827 return true;
8828 }
8829
8830 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_agent_action(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)8831 necp_client_agent_action(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
8832 {
8833 int error = 0;
8834 struct necp_client *client = NULL;
8835 uuid_t client_id;
8836 bool acted_on_agent = FALSE;
8837 u_int8_t *parameters = NULL;
8838 const size_t buffer_size = uap->buffer_size;
8839
8840 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
8841 buffer_size == 0 || uap->buffer == 0) {
8842 NECPLOG0(LOG_ERR, "necp_client_agent_action invalid parameters");
8843 error = EINVAL;
8844 goto done;
8845 }
8846
8847 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
8848 if (error) {
8849 NECPLOG(LOG_ERR, "necp_client_agent_action copyin client_id error (%d)", error);
8850 goto done;
8851 }
8852
8853 if (buffer_size > NECP_MAX_AGENT_ACTION_SIZE) {
8854 NECPLOG(LOG_ERR, "necp_client_agent_action invalid buffer size (>%u)", NECP_MAX_AGENT_ACTION_SIZE);
8855 error = EINVAL;
8856 goto done;
8857 }
8858
8859 if ((parameters = (u_int8_t *)kalloc_data(buffer_size, Z_WAITOK | Z_ZERO)) == NULL) {
8860 NECPLOG0(LOG_ERR, "necp_client_agent_action malloc failed");
8861 error = ENOMEM;
8862 goto done;
8863 }
8864
8865 error = copyin(uap->buffer, parameters, buffer_size);
8866 if (error) {
8867 NECPLOG(LOG_ERR, "necp_client_agent_action parameters copyin error (%d)", error);
8868 goto done;
8869 }
8870
8871 NECP_FD_LOCK(fd_data);
8872 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
8873 if (client != NULL) {
8874 size_t offset = 0;
8875 while ((offset + sizeof(struct necp_tlv_header)) <= buffer_size) {
8876 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
8877 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
8878
8879 if (length > (buffer_size - (offset + sizeof(struct necp_tlv_header)))) {
8880 // If the length is larger than what can fit in the remaining parameters size, bail
8881 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
8882 break;
8883 }
8884
8885 if (length >= sizeof(uuid_t)) {
8886 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
8887 if (value == NULL) {
8888 NECPLOG0(LOG_ERR, "Invalid TLV value");
8889 break;
8890 }
8891 if (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT ||
8892 type == NECP_CLIENT_PARAMETER_ASSERT_AGENT ||
8893 type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
8894 uuid_t agent_uuid;
8895 uuid_copy(agent_uuid, value);
8896 u_int8_t netagent_message_type = 0;
8897 if (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT) {
8898 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_TRIGGER;
8899 } else if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
8900 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT;
8901 } else if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
8902 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
8903 }
8904
8905 // Before unasserting, verify that the assertion was already taken
8906 if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
8907 if (!necp_client_remove_assertion(client, agent_uuid)) {
8908 error = ENOENT;
8909 break;
8910 }
8911 }
8912
8913 struct necp_client_nexus_parameters parsed_parameters = {};
8914 necp_client_copy_parameters_locked(client, &parsed_parameters);
8915
8916 error = netagent_client_message_with_params(agent_uuid,
8917 client_id,
8918 fd_data->proc_pid,
8919 client->agent_handle,
8920 netagent_message_type,
8921 (struct necp_client_agent_parameters *)&parsed_parameters,
8922 NULL, NULL);
8923 if (error == 0) {
8924 acted_on_agent = TRUE;
8925 } else {
8926 break;
8927 }
8928
8929 // Only save the assertion if the action succeeded
8930 if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
8931 necp_client_add_assertion(client, agent_uuid);
8932 }
8933 } else if (type == NECP_CLIENT_PARAMETER_AGENT_ADD_GROUP_MEMBERS ||
8934 type == NECP_CLIENT_PARAMETER_AGENT_REMOVE_GROUP_MEMBERS) {
8935 uuid_t agent_uuid;
8936 uuid_copy(agent_uuid, value);
8937 u_int8_t netagent_message_type = 0;
8938 if (type == NECP_CLIENT_PARAMETER_AGENT_ADD_GROUP_MEMBERS) {
8939 netagent_message_type = NETAGENT_MESSAGE_TYPE_ADD_GROUP_MEMBERS;
8940 } else if (type == NECP_CLIENT_PARAMETER_AGENT_REMOVE_GROUP_MEMBERS) {
8941 netagent_message_type = NETAGENT_MESSAGE_TYPE_REMOVE_GROUP_MEMBERS;
8942 }
8943
8944 struct necp_client_group_members group_members = {};
8945 group_members.group_members_length = (length - sizeof(uuid_t));
8946 group_members.group_members = (value + sizeof(uuid_t));
8947 error = netagent_client_message_with_params(agent_uuid,
8948 client_id,
8949 fd_data->proc_pid,
8950 client->agent_handle,
8951 netagent_message_type,
8952 (struct necp_client_agent_parameters *)&group_members,
8953 NULL, NULL);
8954 if (error == 0) {
8955 acted_on_agent = TRUE;
8956 } else {
8957 break;
8958 }
8959 } else if (type == NECP_CLIENT_PARAMETER_REPORT_AGENT_ERROR) {
8960 uuid_t agent_uuid;
8961 uuid_copy(agent_uuid, value);
8962 struct necp_client_agent_parameters agent_params = {};
8963 if ((length - sizeof(uuid_t)) >= sizeof(agent_params.u.error.error)) {
8964 memcpy(&agent_params.u.error.error,
8965 (value + sizeof(uuid_t)),
8966 sizeof(agent_params.u.error.error));
8967 }
8968 bool agent_reported = false;
8969 for (int agent_i = 0; agent_i < NECP_FD_REPORTED_AGENT_COUNT; agent_i++) {
8970 if (uuid_compare(agent_uuid, fd_data->reported_agents.agent_uuid[agent_i]) == 0) {
8971 // Found a match, already reported
8972 agent_reported = true;
8973 break;
8974 }
8975 }
8976 agent_params.u.error.force_report = !agent_reported;
8977 if (!agent_reported) {
8978 // Save this agent as having been reported
8979 bool saved_agent_uuid = false;
8980 for (int agent_i = 0; agent_i < NECP_FD_REPORTED_AGENT_COUNT; agent_i++) {
8981 if (uuid_is_null(fd_data->reported_agents.agent_uuid[agent_i])) {
8982 uuid_copy(fd_data->reported_agents.agent_uuid[agent_i], agent_uuid);
8983 saved_agent_uuid = true;
8984 break;
8985 }
8986 }
8987 if (!saved_agent_uuid) {
8988 // Reported agent UUIDs full, move over and insert at the end
8989 for (int agent_i = 0; agent_i < NECP_FD_REPORTED_AGENT_COUNT; agent_i++) {
8990 if (agent_i + 1 < NECP_FD_REPORTED_AGENT_COUNT) {
8991 uuid_copy(fd_data->reported_agents.agent_uuid[agent_i], fd_data->reported_agents.agent_uuid[agent_i + 1]);
8992 } else {
8993 uuid_copy(fd_data->reported_agents.agent_uuid[agent_i], agent_uuid);
8994 }
8995 }
8996 }
8997 }
8998 error = netagent_client_message_with_params(agent_uuid,
8999 client_id,
9000 fd_data->proc_pid,
9001 client->agent_handle,
9002 NETAGENT_MESSAGE_TYPE_CLIENT_ERROR,
9003 &agent_params,
9004 NULL, NULL);
9005 if (error == 0) {
9006 acted_on_agent = TRUE;
9007 } else {
9008 break;
9009 }
9010 }
9011 }
9012
9013 offset += sizeof(struct necp_tlv_header) + length;
9014 }
9015
9016 NECP_CLIENT_UNLOCK(client);
9017 }
9018 NECP_FD_UNLOCK(fd_data);
9019
9020 if (!acted_on_agent &&
9021 error == 0) {
9022 error = ENOENT;
9023 }
9024 done:
9025 *retval = error;
9026 if (parameters != NULL) {
9027 kfree_data(parameters, buffer_size);
9028 parameters = NULL;
9029 }
9030
9031 return error;
9032 }
9033
9034 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_agent(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9035 necp_client_copy_agent(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9036 {
9037 int error = 0;
9038 uuid_t agent_uuid;
9039 const size_t buffer_size = uap->buffer_size;
9040
9041 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
9042 buffer_size == 0 || uap->buffer == 0) {
9043 NECPLOG0(LOG_ERR, "necp_client_copy_agent bad input");
9044 error = EINVAL;
9045 goto done;
9046 }
9047
9048 error = copyin(uap->client_id, agent_uuid, sizeof(uuid_t));
9049 if (error) {
9050 NECPLOG(LOG_ERR, "necp_client_copy_agent copyin agent_uuid error (%d)", error);
9051 goto done;
9052 }
9053
9054 error = netagent_copyout(agent_uuid, uap->buffer, buffer_size);
9055 if (error) {
9056 // netagent_copyout already logs appropriate errors
9057 goto done;
9058 }
9059 done:
9060 *retval = error;
9061
9062 return error;
9063 }
9064
9065 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_agent_use(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9066 necp_client_agent_use(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9067 {
9068 int error = 0;
9069 struct necp_client *client = NULL;
9070 uuid_t client_id;
9071 struct necp_agent_use_parameters parameters = {};
9072 const size_t buffer_size = uap->buffer_size;
9073
9074 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
9075 buffer_size != sizeof(parameters) || uap->buffer == 0) {
9076 error = EINVAL;
9077 goto done;
9078 }
9079
9080 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
9081 if (error) {
9082 NECPLOG(LOG_ERR, "Copyin client_id error (%d)", error);
9083 goto done;
9084 }
9085
9086 error = copyin(uap->buffer, ¶meters, buffer_size);
9087 if (error) {
9088 NECPLOG(LOG_ERR, "Parameters copyin error (%d)", error);
9089 goto done;
9090 }
9091
9092 NECP_FD_LOCK(fd_data);
9093 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
9094 if (client != NULL) {
9095 error = netagent_use(parameters.agent_uuid, ¶meters.out_use_count);
9096 NECP_CLIENT_UNLOCK(client);
9097 } else {
9098 error = ENOENT;
9099 }
9100
9101 NECP_FD_UNLOCK(fd_data);
9102
9103 if (error == 0) {
9104 error = copyout(¶meters, uap->buffer, buffer_size);
9105 if (error) {
9106 NECPLOG(LOG_ERR, "Parameters copyout error (%d)", error);
9107 goto done;
9108 }
9109 }
9110
9111 done:
9112 *retval = error;
9113
9114 return error;
9115 }
9116
9117 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_acquire_agent_token(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9118 necp_client_acquire_agent_token(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9119 {
9120 int error = 0;
9121 uuid_t agent_uuid = {};
9122 const size_t buffer_size = uap->buffer_size;
9123
9124 *retval = 0;
9125
9126 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
9127 buffer_size == 0 || uap->buffer == 0) {
9128 NECPLOG0(LOG_ERR, "necp_client_copy_agent bad input");
9129 error = EINVAL;
9130 goto done;
9131 }
9132
9133 error = copyin(uap->client_id, agent_uuid, sizeof(uuid_t));
9134 if (error) {
9135 NECPLOG(LOG_ERR, "necp_client_copy_agent copyin agent_uuid error (%d)", error);
9136 goto done;
9137 }
9138
9139 error = netagent_acquire_token(agent_uuid, uap->buffer, buffer_size, retval);
9140 done:
9141 return error;
9142 }
9143
9144 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_interface(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9145 necp_client_copy_interface(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9146 {
9147 int error = 0;
9148 u_int32_t interface_index = 0;
9149 struct necp_interface_details interface_details = {};
9150
9151 if (uap->client_id == 0 || uap->client_id_len != sizeof(u_int32_t) ||
9152 uap->buffer_size < sizeof(interface_details) ||
9153 uap->buffer == 0) {
9154 NECPLOG0(LOG_ERR, "necp_client_copy_interface bad input");
9155 error = EINVAL;
9156 goto done;
9157 }
9158
9159 error = copyin(uap->client_id, &interface_index, sizeof(u_int32_t));
9160 if (error) {
9161 NECPLOG(LOG_ERR, "necp_client_copy_interface copyin interface_index error (%d)", error);
9162 goto done;
9163 }
9164
9165 if (interface_index == 0) {
9166 error = ENOENT;
9167 NECPLOG(LOG_ERR, "necp_client_copy_interface bad interface_index (%d)", interface_index);
9168 goto done;
9169 }
9170
9171 lck_mtx_lock(rnh_lock);
9172 ifnet_head_lock_shared();
9173 ifnet_t interface = NULL;
9174 if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
9175 interface = ifindex2ifnet[interface_index];
9176 }
9177
9178 if (interface != NULL) {
9179 if (interface->if_xname != NULL) {
9180 strlcpy((char *)&interface_details.name, interface->if_xname, sizeof(interface_details.name));
9181 }
9182 interface_details.index = interface->if_index;
9183 interface_details.generation = ifnet_get_generation(interface);
9184 if (interface->if_delegated.ifp != NULL) {
9185 interface_details.delegate_index = interface->if_delegated.ifp->if_index;
9186 }
9187 interface_details.functional_type = if_functional_type(interface, TRUE);
9188 if (IFNET_IS_EXPENSIVE(interface)) {
9189 interface_details.flags |= NECP_INTERFACE_FLAG_EXPENSIVE;
9190 }
9191 if (IFNET_IS_CONSTRAINED(interface)) {
9192 interface_details.flags |= NECP_INTERFACE_FLAG_CONSTRAINED;
9193 }
9194 if ((interface->if_eflags & IFEF_TXSTART) == IFEF_TXSTART) {
9195 interface_details.flags |= NECP_INTERFACE_FLAG_TXSTART;
9196 }
9197 if ((interface->if_eflags & IFEF_NOACKPRI) == IFEF_NOACKPRI) {
9198 interface_details.flags |= NECP_INTERFACE_FLAG_NOACKPRI;
9199 }
9200 if ((interface->if_eflags & IFEF_3CA) == IFEF_3CA) {
9201 interface_details.flags |= NECP_INTERFACE_FLAG_3CARRIERAGG;
9202 }
9203 if (IFNET_IS_LOW_POWER(interface)) {
9204 interface_details.flags |= NECP_INTERFACE_FLAG_IS_LOW_POWER;
9205 }
9206 if (interface->if_xflags & IFXF_MPK_LOG) {
9207 interface_details.flags |= NECP_INTERFACE_FLAG_MPK_LOG;
9208 }
9209 if (interface->if_flags & IFF_MULTICAST) {
9210 interface_details.flags |= NECP_INTERFACE_FLAG_SUPPORTS_MULTICAST;
9211 }
9212 if (IS_INTF_CLAT46(interface)) {
9213 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_NAT64;
9214 }
9215 interface_details.mtu = interface->if_mtu;
9216 #if SKYWALK
9217 fsw_get_tso_capabilities(interface, &interface_details.tso_max_segment_size_v4,
9218 &interface_details.tso_max_segment_size_v6);
9219
9220 interface_details.hwcsum_flags = interface->if_hwassist & IFNET_CHECKSUMF;
9221 #endif /* SKYWALK */
9222
9223 u_int8_t ipv4_signature_len = sizeof(interface_details.ipv4_signature.signature);
9224 u_int16_t ipv4_signature_flags;
9225 if (ifnet_get_netsignature(interface, AF_INET, &ipv4_signature_len, &ipv4_signature_flags,
9226 (u_int8_t *)&interface_details.ipv4_signature) != 0) {
9227 ipv4_signature_len = 0;
9228 }
9229 interface_details.ipv4_signature.signature_len = ipv4_signature_len;
9230
9231 // Check for default scoped routes for IPv4 and IPv6
9232 union necp_sockaddr_union default_address;
9233 struct rtentry *v4Route = NULL;
9234 memset(&default_address, 0, sizeof(default_address));
9235 default_address.sa.sa_family = AF_INET;
9236 default_address.sa.sa_len = sizeof(struct sockaddr_in);
9237 v4Route = rtalloc1_scoped_locked((struct sockaddr *)&default_address, 0, 0,
9238 interface->if_index);
9239 if (v4Route != NULL) {
9240 if (v4Route->rt_ifp != NULL && !IS_INTF_CLAT46(v4Route->rt_ifp)) {
9241 interface_details.flags |= NECP_INTERFACE_FLAG_IPV4_ROUTABLE;
9242 }
9243 rtfree_locked(v4Route);
9244 v4Route = NULL;
9245 }
9246
9247 struct rtentry *v6Route = NULL;
9248 memset(&default_address, 0, sizeof(default_address));
9249 default_address.sa.sa_family = AF_INET6;
9250 default_address.sa.sa_len = sizeof(struct sockaddr_in6);
9251 v6Route = rtalloc1_scoped_locked((struct sockaddr *)&default_address, 0, 0,
9252 interface->if_index);
9253 if (v6Route != NULL) {
9254 if (v6Route->rt_ifp != NULL) {
9255 interface_details.flags |= NECP_INTERFACE_FLAG_IPV6_ROUTABLE;
9256 }
9257 rtfree_locked(v6Route);
9258 v6Route = NULL;
9259 }
9260
9261 u_int8_t ipv6_signature_len = sizeof(interface_details.ipv6_signature.signature);
9262 u_int16_t ipv6_signature_flags;
9263 if (ifnet_get_netsignature(interface, AF_INET6, &ipv6_signature_len, &ipv6_signature_flags,
9264 (u_int8_t *)&interface_details.ipv6_signature) != 0) {
9265 ipv6_signature_len = 0;
9266 }
9267 interface_details.ipv6_signature.signature_len = ipv6_signature_len;
9268
9269 ifnet_lock_shared(interface);
9270 struct ifaddr *ifa = NULL;
9271 TAILQ_FOREACH(ifa, &interface->if_addrhead, ifa_link) {
9272 IFA_LOCK(ifa);
9273 if (ifa->ifa_addr->sa_family == AF_INET) {
9274 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_NETMASK;
9275 interface_details.ipv4_netmask = ((struct in_ifaddr *)ifa)->ia_sockmask.sin_addr.s_addr;
9276 if (interface->if_flags & IFF_BROADCAST) {
9277 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_BROADCAST;
9278 interface_details.ipv4_broadcast = ((struct in_ifaddr *)ifa)->ia_broadaddr.sin_addr.s_addr;
9279 }
9280 }
9281 IFA_UNLOCK(ifa);
9282 }
9283
9284 interface_details.radio_type = interface->if_radio_type;
9285 if (interface_details.radio_type == 0 && interface->if_delegated.ifp) {
9286 interface_details.radio_type = interface->if_delegated.ifp->if_radio_type;
9287 }
9288 ifnet_lock_done(interface);
9289 }
9290
9291 ifnet_head_done();
9292 lck_mtx_unlock(rnh_lock);
9293
9294 // If the client is using an older version of the struct, copy that length
9295 error = copyout(&interface_details, uap->buffer, sizeof(interface_details));
9296 if (error) {
9297 NECPLOG(LOG_ERR, "necp_client_copy_interface copyout error (%d)", error);
9298 goto done;
9299 }
9300 done:
9301 *retval = error;
9302
9303 return error;
9304 }
9305
9306 #if SKYWALK
9307
9308 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_get_interface_address(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9309 necp_client_get_interface_address(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9310 {
9311 int error = 0;
9312 u_int32_t interface_index = IFSCOPE_NONE;
9313 struct sockaddr_storage address = {};
9314 const size_t buffer_size = uap->buffer_size;
9315
9316 if (uap->client_id == 0 || uap->client_id_len != sizeof(u_int32_t) ||
9317 buffer_size < sizeof(struct sockaddr_in) ||
9318 buffer_size > sizeof(struct sockaddr_storage) ||
9319 uap->buffer == 0) {
9320 NECPLOG0(LOG_ERR, "necp_client_get_interface_address bad input");
9321 error = EINVAL;
9322 goto done;
9323 }
9324
9325 error = copyin(uap->client_id, &interface_index, sizeof(u_int32_t));
9326 if (error) {
9327 NECPLOG(LOG_ERR, "necp_client_get_interface_address copyin interface_index error (%d)", error);
9328 goto done;
9329 }
9330
9331 if (interface_index == IFSCOPE_NONE) {
9332 error = ENOENT;
9333 NECPLOG(LOG_ERR, "necp_client_get_interface_address bad interface_index (%d)", interface_index);
9334 goto done;
9335 }
9336
9337 error = copyin(uap->buffer, &address, buffer_size);
9338 if (error) {
9339 NECPLOG(LOG_ERR, "necp_client_get_interface_address copyin address error (%d)", error);
9340 goto done;
9341 }
9342
9343 if (address.ss_family != AF_INET && address.ss_family != AF_INET6) {
9344 error = EINVAL;
9345 NECPLOG(LOG_ERR, "necp_client_get_interface_address invalid address family (%u)", address.ss_family);
9346 goto done;
9347 }
9348
9349 if (address.ss_len != buffer_size) {
9350 error = EINVAL;
9351 NECPLOG(LOG_ERR, "necp_client_get_interface_address invalid address length (%u)", address.ss_len);
9352 goto done;
9353 }
9354
9355 ifnet_head_lock_shared();
9356 ifnet_t ifp = NULL;
9357 if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
9358 ifp = ifindex2ifnet[interface_index];
9359 }
9360 ifnet_head_done();
9361 if (ifp == NULL) {
9362 error = ENOENT;
9363 NECPLOG0(LOG_ERR, "necp_client_get_interface_address no matching interface found");
9364 goto done;
9365 }
9366
9367 struct rtentry *rt = rtalloc1_scoped((struct sockaddr *)&address, 0, 0, interface_index);
9368 if (rt == NULL) {
9369 error = EINVAL;
9370 NECPLOG0(LOG_ERR, "necp_client_get_interface_address route lookup failed");
9371 goto done;
9372 }
9373
9374 uint32_t gencount = 0;
9375 struct sockaddr_storage local_address = {};
9376 error = flow_route_select_laddr((union sockaddr_in_4_6 *)&local_address,
9377 (union sockaddr_in_4_6 *)&address, ifp, rt, &gencount, 1);
9378 rtfree(rt);
9379 rt = NULL;
9380
9381 if (error) {
9382 NECPLOG(LOG_ERR, "necp_client_get_interface_address local address selection failed (%d)", error);
9383 goto done;
9384 }
9385
9386 if (local_address.ss_len > buffer_size) {
9387 error = EMSGSIZE;
9388 NECPLOG(LOG_ERR, "necp_client_get_interface_address local address too long for buffer (%u)",
9389 local_address.ss_len);
9390 goto done;
9391 }
9392
9393 error = copyout(&local_address, uap->buffer, local_address.ss_len);
9394 if (error) {
9395 NECPLOG(LOG_ERR, "necp_client_get_interface_address copyout error (%d)", error);
9396 goto done;
9397 }
9398 done:
9399 *retval = error;
9400
9401 return error;
9402 }
9403
9404 extern char *proc_name_address(void *p);
9405
9406 int
necp_stats_ctor(struct skmem_obj_info * oi,struct skmem_obj_info * oim,void * arg,uint32_t skmflag)9407 necp_stats_ctor(struct skmem_obj_info *oi, struct skmem_obj_info *oim,
9408 void *arg, uint32_t skmflag)
9409 {
9410 #pragma unused(arg, skmflag)
9411 struct necp_all_kstats *kstats = SKMEM_OBJ_ADDR(oi);
9412
9413 ASSERT(oim != NULL && SKMEM_OBJ_ADDR(oim) != NULL);
9414 ASSERT(SKMEM_OBJ_SIZE(oi) == SKMEM_OBJ_SIZE(oim));
9415
9416 kstats->necp_stats_ustats = SKMEM_OBJ_ADDR(oim);
9417
9418 return 0;
9419 }
9420
9421 int
necp_stats_dtor(void * addr,void * arg)9422 necp_stats_dtor(void *addr, void *arg)
9423 {
9424 #pragma unused(addr, arg)
9425 struct necp_all_kstats *kstats = addr;
9426
9427 kstats->necp_stats_ustats = NULL;
9428
9429 return 0;
9430 }
9431
9432 static void
necp_fd_insert_stats_arena(struct necp_fd_data * fd_data,struct necp_arena_info * nai)9433 necp_fd_insert_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai)
9434 {
9435 NECP_FD_ASSERT_LOCKED(fd_data);
9436 VERIFY(!(nai->nai_flags & NAIF_ATTACHED));
9437 VERIFY(nai->nai_chain.le_next == NULL && nai->nai_chain.le_prev == NULL);
9438
9439 LIST_INSERT_HEAD(&fd_data->stats_arena_list, nai, nai_chain);
9440 nai->nai_flags |= NAIF_ATTACHED;
9441 necp_arena_info_retain(nai); // for the list
9442 }
9443
9444 static void
necp_fd_remove_stats_arena(struct necp_fd_data * fd_data,struct necp_arena_info * nai)9445 necp_fd_remove_stats_arena(struct necp_fd_data *fd_data, struct necp_arena_info *nai)
9446 {
9447 #pragma unused(fd_data)
9448 NECP_FD_ASSERT_LOCKED(fd_data);
9449 VERIFY(nai->nai_flags & NAIF_ATTACHED);
9450 VERIFY(nai->nai_use_count >= 1);
9451
9452 LIST_REMOVE(nai, nai_chain);
9453 nai->nai_flags &= ~NAIF_ATTACHED;
9454 nai->nai_chain.le_next = NULL;
9455 nai->nai_chain.le_prev = NULL;
9456 necp_arena_info_release(nai); // for the list
9457 }
9458
9459 static struct necp_arena_info *
necp_fd_mredirect_stats_arena(struct necp_fd_data * fd_data,struct proc * proc)9460 necp_fd_mredirect_stats_arena(struct necp_fd_data *fd_data, struct proc *proc)
9461 {
9462 struct necp_arena_info *nai, *nai_ret = NULL;
9463
9464 NECP_FD_ASSERT_LOCKED(fd_data);
9465
9466 // Redirect currently-active stats arena and remove it from the active state;
9467 // upon process resumption, new flow request would trigger the creation of
9468 // another active arena.
9469 if ((nai = fd_data->stats_arena_active) != NULL) {
9470 boolean_t need_defunct = FALSE;
9471
9472 ASSERT(!(nai->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT)));
9473 VERIFY(nai->nai_use_count >= 2);
9474 ASSERT(nai->nai_arena != NULL);
9475 ASSERT(nai->nai_mmap.ami_mapref != NULL);
9476
9477 int err = skmem_arena_mredirect(nai->nai_arena, &nai->nai_mmap, proc, &need_defunct);
9478 VERIFY(err == 0);
9479 // must be TRUE since we don't mmap the arena more than once
9480 VERIFY(need_defunct == TRUE);
9481
9482 nai->nai_flags |= NAIF_REDIRECT;
9483 nai_ret = nai; // return to caller
9484
9485 necp_arena_info_release(nai); // for fd_data
9486 fd_data->stats_arena_active = nai = NULL;
9487 }
9488
9489 #if (DEVELOPMENT || DEBUG)
9490 // make sure this list now contains nothing but redirected/defunct arenas
9491 LIST_FOREACH(nai, &fd_data->stats_arena_list, nai_chain) {
9492 ASSERT(nai->nai_use_count >= 1);
9493 ASSERT(nai->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT));
9494 }
9495 #endif /* (DEVELOPMENT || DEBUG) */
9496
9497 return nai_ret;
9498 }
9499
9500 static void
necp_arena_info_retain(struct necp_arena_info * nai)9501 necp_arena_info_retain(struct necp_arena_info *nai)
9502 {
9503 nai->nai_use_count++;
9504 VERIFY(nai->nai_use_count != 0);
9505 }
9506
9507 static void
necp_arena_info_release(struct necp_arena_info * nai)9508 necp_arena_info_release(struct necp_arena_info *nai)
9509 {
9510 VERIFY(nai->nai_use_count > 0);
9511 if (--nai->nai_use_count == 0) {
9512 necp_arena_info_free(nai);
9513 }
9514 }
9515
9516 static struct necp_arena_info *
necp_arena_info_alloc(void)9517 necp_arena_info_alloc(void)
9518 {
9519 return zalloc_flags(necp_arena_info_zone, Z_WAITOK | Z_ZERO);
9520 }
9521
9522 static void
necp_arena_info_free(struct necp_arena_info * nai)9523 necp_arena_info_free(struct necp_arena_info *nai)
9524 {
9525 VERIFY(nai->nai_chain.le_next == NULL && nai->nai_chain.le_prev == NULL);
9526 VERIFY(nai->nai_use_count == 0);
9527
9528 // NOTE: destroying the arena requires that all outstanding objects
9529 // that were allocated have been freed, else it will assert.
9530 if (nai->nai_arena != NULL) {
9531 skmem_arena_munmap(nai->nai_arena, &nai->nai_mmap);
9532 skmem_arena_release(nai->nai_arena);
9533 OSDecrementAtomic(&necp_arena_count);
9534 nai->nai_arena = NULL;
9535 nai->nai_roff = 0;
9536 }
9537
9538 ASSERT(nai->nai_arena == NULL);
9539 ASSERT(nai->nai_mmap.ami_mapref == NULL);
9540 ASSERT(nai->nai_mmap.ami_arena == NULL);
9541 ASSERT(nai->nai_mmap.ami_maptask == TASK_NULL);
9542
9543 zfree(necp_arena_info_zone, nai);
9544 }
9545
9546 static int
necp_arena_create(struct necp_fd_data * fd_data,size_t obj_size,size_t obj_cnt,struct proc * p)9547 necp_arena_create(struct necp_fd_data *fd_data, size_t obj_size, size_t obj_cnt, struct proc *p)
9548 {
9549 struct skmem_region_params srp_ustats = {};
9550 struct skmem_region_params srp_kstats = {};
9551 struct necp_arena_info *nai;
9552 char name[32];
9553 int error = 0;
9554
9555 NECP_FD_ASSERT_LOCKED(fd_data);
9556 ASSERT(fd_data->stats_arena_active == NULL);
9557 ASSERT(p != PROC_NULL);
9558 ASSERT(proc_pid(p) == fd_data->proc_pid);
9559
9560 // inherit the default parameters for the stats region
9561 srp_ustats = *skmem_get_default(SKMEM_REGION_USTATS);
9562 srp_kstats = *skmem_get_default(SKMEM_REGION_KSTATS);
9563
9564 // enable multi-segment mode
9565 srp_ustats.srp_cflags &= ~SKMEM_REGION_CR_MONOLITHIC;
9566 srp_kstats.srp_cflags &= ~SKMEM_REGION_CR_MONOLITHIC;
9567
9568 // configure and adjust the region parameters
9569 srp_ustats.srp_r_obj_cnt = srp_kstats.srp_r_obj_cnt = obj_cnt;
9570 srp_ustats.srp_r_obj_size = srp_kstats.srp_r_obj_size = obj_size;
9571 skmem_region_params_config(&srp_ustats);
9572 skmem_region_params_config(&srp_kstats);
9573
9574 nai = necp_arena_info_alloc();
9575
9576 nai->nai_proc_pid = fd_data->proc_pid;
9577 (void) snprintf(name, sizeof(name), "stats-%u.%s.%d", fd_data->stats_arena_gencnt, proc_name_address(p), fd_data->proc_pid);
9578 nai->nai_arena = skmem_arena_create_for_necp(name, &srp_ustats, &srp_kstats, &error);
9579 ASSERT(nai->nai_arena != NULL || error != 0);
9580 if (error != 0) {
9581 NECPLOG(LOG_ERR, "failed to create stats arena for pid %d\n", fd_data->proc_pid);
9582 } else {
9583 OSIncrementAtomic(&necp_arena_count);
9584
9585 // Get region offsets from base of mmap span; the arena
9586 // doesn't need to be mmap'd at this point, since we simply
9587 // compute the relative offset.
9588 nai->nai_roff = skmem_arena_get_region_offset(nai->nai_arena, SKMEM_REGION_USTATS);
9589
9590 // map to the task/process; upon success, the base address of the region
9591 // will be returned in nai_mmap.ami_mapaddr; this can be communicated to
9592 // the process.
9593 error = skmem_arena_mmap(nai->nai_arena, p, &nai->nai_mmap);
9594 if (error != 0) {
9595 NECPLOG(LOG_ERR, "failed to map stats arena for pid %d\n", fd_data->proc_pid);
9596 }
9597 }
9598
9599 if (error == 0) {
9600 fd_data->stats_arena_active = nai;
9601 necp_arena_info_retain(nai); // for fd_data
9602 necp_fd_insert_stats_arena(fd_data, nai);
9603 ++fd_data->stats_arena_gencnt;
9604 } else {
9605 necp_arena_info_free(nai);
9606 }
9607
9608 return error;
9609 }
9610
9611 static int
necp_arena_stats_obj_alloc(struct necp_fd_data * fd_data,mach_vm_offset_t * off,struct necp_arena_info ** stats_arena,void ** kstats_kaddr,boolean_t cansleep)9612 necp_arena_stats_obj_alloc(struct necp_fd_data *fd_data,
9613 mach_vm_offset_t *off,
9614 struct necp_arena_info **stats_arena,
9615 void **kstats_kaddr,
9616 boolean_t cansleep)
9617 {
9618 struct skmem_cache *kstats_cp = NULL;
9619 void *ustats_obj = NULL;
9620 void *kstats_obj = NULL;
9621 struct necp_all_kstats *kstats = NULL;
9622 struct skmem_obj_info kstats_oi = {};
9623
9624 ASSERT(off != NULL);
9625 ASSERT(stats_arena != NULL && *stats_arena == NULL);
9626 ASSERT(kstats_kaddr != NULL && *kstats_kaddr == NULL);
9627
9628 NECP_FD_ASSERT_LOCKED(fd_data);
9629 ASSERT(fd_data->stats_arena_active != NULL);
9630 ASSERT(fd_data->stats_arena_active->nai_arena != NULL);
9631
9632 kstats_cp = skmem_arena_necp(fd_data->stats_arena_active->nai_arena)->arc_kstats_cache;
9633 if ((kstats_obj = skmem_cache_alloc(kstats_cp, (cansleep ? SKMEM_SLEEP : SKMEM_NOSLEEP))) == NULL) {
9634 return ENOMEM;
9635 }
9636
9637 kstats = (struct necp_all_kstats*)kstats_obj;
9638 ustats_obj = kstats->necp_stats_ustats;
9639
9640 skmem_cache_get_obj_info(kstats_cp, kstats_obj, &kstats_oi, NULL);
9641 ASSERT(SKMEM_OBJ_SIZE(&kstats_oi) >= sizeof(struct necp_all_stats));
9642 // reset all stats counters
9643 bzero(ustats_obj, SKMEM_OBJ_SIZE(&kstats_oi));
9644 bzero(&kstats->necp_stats_comm, sizeof(struct necp_all_stats));
9645 *stats_arena = fd_data->stats_arena_active;
9646 *kstats_kaddr = kstats_obj;
9647 // kstats and ustats are mirrored and have the same offset
9648 *off = fd_data->stats_arena_active->nai_roff + SKMEM_OBJ_ROFF(&kstats_oi);
9649
9650 return 0;
9651 }
9652
9653 static void
necp_arena_stats_obj_free(struct necp_fd_data * fd_data,struct necp_arena_info * stats_arena,void ** kstats_kaddr,mach_vm_address_t * ustats_uaddr)9654 necp_arena_stats_obj_free(struct necp_fd_data *fd_data, struct necp_arena_info *stats_arena, void **kstats_kaddr, mach_vm_address_t *ustats_uaddr)
9655 {
9656 #pragma unused(fd_data)
9657 NECP_FD_ASSERT_LOCKED(fd_data);
9658
9659 ASSERT(stats_arena != NULL);
9660 ASSERT(stats_arena->nai_arena != NULL);
9661 ASSERT(kstats_kaddr != NULL && *kstats_kaddr != NULL);
9662 ASSERT(ustats_uaddr != NULL);
9663
9664 skmem_cache_free(skmem_arena_necp(stats_arena->nai_arena)->arc_kstats_cache, *kstats_kaddr);
9665 *kstats_kaddr = NULL;
9666 *ustats_uaddr = 0;
9667 }
9668
9669 // This routine returns the KVA of the sysctls object, as well as the
9670 // offset of that object relative to the mmap base address for the
9671 // task/process.
9672 static void *
necp_arena_sysctls_obj(struct necp_fd_data * fd_data,mach_vm_offset_t * off,size_t * size)9673 necp_arena_sysctls_obj(struct necp_fd_data *fd_data, mach_vm_offset_t *off, size_t *size)
9674 {
9675 void *objaddr;
9676
9677 NECP_FD_ASSERT_LOCKED(fd_data);
9678 ASSERT(fd_data->sysctl_arena != NULL);
9679
9680 // kernel virtual address of the sysctls object
9681 objaddr = skmem_arena_system_sysctls_obj_addr(fd_data->sysctl_arena);
9682 ASSERT(objaddr != NULL);
9683
9684 // Return the relative offset of the sysctls object; there is
9685 // only 1 object in the entire sysctls region, and therefore the
9686 // object's offset is simply the region's offset in the arena.
9687 // (sysctl_mmap.ami_mapaddr + offset) is the address of this object
9688 // in the task/process.
9689 if (off != NULL) {
9690 *off = fd_data->system_sysctls_roff;
9691 }
9692
9693 if (size != NULL) {
9694 *size = skmem_arena_system_sysctls_obj_size(fd_data->sysctl_arena);
9695 ASSERT(*size != 0);
9696 }
9697
9698 return objaddr;
9699 }
9700
9701 static void
necp_stats_arenas_destroy(struct necp_fd_data * fd_data,boolean_t closing)9702 necp_stats_arenas_destroy(struct necp_fd_data *fd_data, boolean_t closing)
9703 {
9704 struct necp_arena_info *nai, *nai_tmp;
9705
9706 NECP_FD_ASSERT_LOCKED(fd_data);
9707
9708 // If reaping (not closing), release reference only for idle active arena; the reference
9709 // count must be 2 by now, when it's not being referred to by any clients/flows.
9710 if ((nai = fd_data->stats_arena_active) != NULL && (closing || nai->nai_use_count == 2)) {
9711 VERIFY(nai->nai_use_count >= 2);
9712 necp_arena_info_release(nai); // for fd_data
9713 fd_data->stats_arena_active = NULL;
9714 }
9715
9716 // clean up any defunct arenas left in the list
9717 LIST_FOREACH_SAFE(nai, &fd_data->stats_arena_list, nai_chain, nai_tmp) {
9718 // If reaping, release reference if the list holds the last one
9719 if (closing || nai->nai_use_count == 1) {
9720 VERIFY(nai->nai_use_count >= 1);
9721 // callee unchains nai (and may free it)
9722 necp_fd_remove_stats_arena(fd_data, nai);
9723 }
9724 }
9725 }
9726
9727 static void
necp_sysctl_arena_destroy(struct necp_fd_data * fd_data)9728 necp_sysctl_arena_destroy(struct necp_fd_data *fd_data)
9729 {
9730 NECP_FD_ASSERT_LOCKED(fd_data);
9731
9732 // NOTE: destroying the arena requires that all outstanding objects
9733 // that were allocated have been freed, else it will assert.
9734 if (fd_data->sysctl_arena != NULL) {
9735 skmem_arena_munmap(fd_data->sysctl_arena, &fd_data->sysctl_mmap);
9736 skmem_arena_release(fd_data->sysctl_arena);
9737 OSDecrementAtomic(&necp_sysctl_arena_count);
9738 fd_data->sysctl_arena = NULL;
9739 fd_data->system_sysctls_roff = 0;
9740 }
9741 }
9742
9743 static int
necp_arena_initialize(struct necp_fd_data * fd_data,bool locked)9744 necp_arena_initialize(struct necp_fd_data *fd_data, bool locked)
9745 {
9746 int error = 0;
9747 size_t stats_obj_size = MAX(sizeof(struct necp_all_stats), sizeof(struct necp_all_kstats));
9748
9749 if (!locked) {
9750 NECP_FD_LOCK(fd_data);
9751 }
9752 if (fd_data->stats_arena_active == NULL) {
9753 error = necp_arena_create(fd_data, stats_obj_size,
9754 NECP_MAX_PER_PROCESS_CLIENT_STATISTICS_STRUCTS,
9755 current_proc());
9756 }
9757 if (!locked) {
9758 NECP_FD_UNLOCK(fd_data);
9759 }
9760
9761 return error;
9762 }
9763
9764 static int
necp_sysctl_arena_initialize(struct necp_fd_data * fd_data,bool locked)9765 necp_sysctl_arena_initialize(struct necp_fd_data *fd_data, bool locked)
9766 {
9767 int error = 0;
9768
9769 if (!locked) {
9770 NECP_FD_LOCK(fd_data);
9771 }
9772
9773 NECP_FD_ASSERT_LOCKED(fd_data);
9774
9775 if (fd_data->sysctl_arena == NULL) {
9776 char name[32];
9777 struct proc *p = current_proc();
9778
9779 ASSERT(p != PROC_NULL);
9780 ASSERT(proc_pid(p) == fd_data->proc_pid);
9781
9782 (void) snprintf(name, sizeof(name), "sysctl.%s.%d", proc_name_address(p), fd_data->proc_pid);
9783 fd_data->sysctl_arena = skmem_arena_create_for_system(name, &error);
9784 ASSERT(fd_data->sysctl_arena != NULL || error != 0);
9785 if (error != 0) {
9786 NECPLOG(LOG_ERR, "failed to create arena for pid %d\n", fd_data->proc_pid);
9787 } else {
9788 OSIncrementAtomic(&necp_sysctl_arena_count);
9789
9790 // Get region offsets from base of mmap span; the arena
9791 // doesn't need to be mmap'd at this point, since we simply
9792 // compute the relative offset.
9793 fd_data->system_sysctls_roff = skmem_arena_get_region_offset(fd_data->sysctl_arena, SKMEM_REGION_SYSCTLS);
9794
9795 // map to the task/process; upon success, the base address of the region
9796 // will be returned in nai_mmap.ami_mapaddr; this can be communicated to
9797 // the process.
9798 error = skmem_arena_mmap(fd_data->sysctl_arena, p, &fd_data->sysctl_mmap);
9799 if (error != 0) {
9800 NECPLOG(LOG_ERR, "failed to map sysctl arena for pid %d\n", fd_data->proc_pid);
9801 necp_sysctl_arena_destroy(fd_data);
9802 }
9803 }
9804 }
9805
9806 if (!locked) {
9807 NECP_FD_UNLOCK(fd_data);
9808 }
9809
9810 return error;
9811 }
9812
9813 static int
necp_client_stats_bufreq(struct necp_fd_data * fd_data,struct necp_client * client,struct necp_client_flow_registration * flow_registration,struct necp_stats_bufreq * bufreq,struct necp_stats_hdr * out_header)9814 necp_client_stats_bufreq(struct necp_fd_data *fd_data,
9815 struct necp_client *client,
9816 struct necp_client_flow_registration *flow_registration,
9817 struct necp_stats_bufreq *bufreq,
9818 struct necp_stats_hdr *out_header)
9819 {
9820 int error = 0;
9821 NECP_CLIENT_ASSERT_LOCKED(client);
9822 NECP_FD_ASSERT_LOCKED(fd_data);
9823
9824 if ((bufreq->necp_stats_bufreq_id == NECP_CLIENT_STATISTICS_BUFREQ_ID) &&
9825 ((bufreq->necp_stats_bufreq_type == NECP_CLIENT_STATISTICS_TYPE_TCP &&
9826 bufreq->necp_stats_bufreq_ver == NECP_CLIENT_STATISTICS_TYPE_TCP_CURRENT_VER) ||
9827 (bufreq->necp_stats_bufreq_type == NECP_CLIENT_STATISTICS_TYPE_UDP &&
9828 bufreq->necp_stats_bufreq_ver == NECP_CLIENT_STATISTICS_TYPE_UDP_CURRENT_VER) ||
9829 (bufreq->necp_stats_bufreq_type == NECP_CLIENT_STATISTICS_TYPE_QUIC &&
9830 bufreq->necp_stats_bufreq_ver == NECP_CLIENT_STATISTICS_TYPE_QUIC_CURRENT_VER)) &&
9831 (bufreq->necp_stats_bufreq_size == sizeof(struct necp_all_stats))) {
9832 // There should be one and only one stats allocation per client.
9833 // If asked more than once, we just repeat ourselves.
9834 if (flow_registration->ustats_uaddr == 0) {
9835 mach_vm_offset_t off;
9836 ASSERT(flow_registration->stats_arena == NULL);
9837 ASSERT(flow_registration->kstats_kaddr == NULL);
9838 ASSERT(flow_registration->ustats_uaddr == 0);
9839 error = necp_arena_stats_obj_alloc(fd_data, &off, &flow_registration->stats_arena, &flow_registration->kstats_kaddr, FALSE);
9840 if (error == 0) {
9841 // upon success, hold a reference for the client; this is released when the client is removed/closed
9842 ASSERT(flow_registration->stats_arena != NULL);
9843 necp_arena_info_retain(flow_registration->stats_arena);
9844
9845 // compute user address based on mapping info and object offset
9846 flow_registration->ustats_uaddr = flow_registration->stats_arena->nai_mmap.ami_mapaddr + off;
9847
9848 // add to collect_stats list
9849 NECP_STATS_LIST_LOCK_EXCLUSIVE();
9850 necp_client_retain_locked(client); // Add a reference to the client
9851 LIST_INSERT_HEAD(&necp_collect_stats_flow_list, flow_registration, collect_stats_chain);
9852 NECP_STATS_LIST_UNLOCK();
9853 necp_schedule_collect_stats_clients(FALSE);
9854 } else {
9855 ASSERT(flow_registration->stats_arena == NULL);
9856 ASSERT(flow_registration->kstats_kaddr == NULL);
9857 }
9858 }
9859 if (flow_registration->ustats_uaddr != 0) {
9860 ASSERT(error == 0);
9861 ASSERT(flow_registration->stats_arena != NULL);
9862 ASSERT(flow_registration->kstats_kaddr != NULL);
9863
9864 struct necp_all_kstats *kstats = (struct necp_all_kstats *)flow_registration->kstats_kaddr;
9865 kstats->necp_stats_ustats->all_stats_u.tcp_stats.necp_tcp_hdr.necp_stats_type = bufreq->necp_stats_bufreq_type;
9866 kstats->necp_stats_ustats->all_stats_u.tcp_stats.necp_tcp_hdr.necp_stats_ver = bufreq->necp_stats_bufreq_ver;
9867
9868 if (out_header) {
9869 out_header->necp_stats_type = bufreq->necp_stats_bufreq_type;
9870 out_header->necp_stats_ver = bufreq->necp_stats_bufreq_ver;
9871 }
9872
9873 bufreq->necp_stats_bufreq_uaddr = flow_registration->ustats_uaddr;
9874 }
9875 } else {
9876 error = EINVAL;
9877 }
9878
9879 return error;
9880 }
9881
9882 static int
necp_client_stats_initial(struct necp_client_flow_registration * flow_registration,uint32_t stats_type,uint32_t stats_ver)9883 necp_client_stats_initial(struct necp_client_flow_registration *flow_registration, uint32_t stats_type, uint32_t stats_ver)
9884 {
9885 // An attempted create
9886 assert(flow_registration->stats_handler_context == NULL);
9887 assert(flow_registration->stats_arena);
9888 assert(flow_registration->ustats_uaddr);
9889 assert(flow_registration->kstats_kaddr);
9890
9891 int error = 0;
9892 uint64_t ntstat_properties = necp_find_netstat_initial_properties(flow_registration->client);
9893
9894 switch (stats_type) {
9895 case NECP_CLIENT_STATISTICS_TYPE_TCP: {
9896 if (stats_ver == NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1) {
9897 flow_registration->stats_handler_context = ntstat_userland_stats_open((userland_stats_provider_context *)flow_registration,
9898 NSTAT_PROVIDER_TCP_USERLAND, ntstat_properties, necp_request_tcp_netstats, necp_find_extension_info);
9899 if (flow_registration->stats_handler_context == NULL) {
9900 error = EIO;
9901 }
9902 } else {
9903 error = ENOTSUP;
9904 }
9905 break;
9906 }
9907 case NECP_CLIENT_STATISTICS_TYPE_UDP: {
9908 if (stats_ver == NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1) {
9909 flow_registration->stats_handler_context = ntstat_userland_stats_open((userland_stats_provider_context *)flow_registration,
9910 NSTAT_PROVIDER_UDP_USERLAND, ntstat_properties, necp_request_udp_netstats, necp_find_extension_info);
9911 if (flow_registration->stats_handler_context == NULL) {
9912 error = EIO;
9913 }
9914 } else {
9915 error = ENOTSUP;
9916 }
9917 break;
9918 }
9919 case NECP_CLIENT_STATISTICS_TYPE_QUIC: {
9920 if (stats_ver == NECP_CLIENT_STATISTICS_TYPE_QUIC_VER_1 && flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS) {
9921 flow_registration->stats_handler_context = ntstat_userland_stats_open((userland_stats_provider_context *)flow_registration,
9922 NSTAT_PROVIDER_QUIC_USERLAND, ntstat_properties, necp_request_quic_netstats, necp_find_extension_info);
9923 if (flow_registration->stats_handler_context == NULL) {
9924 error = EIO;
9925 }
9926 } else {
9927 error = ENOTSUP;
9928 }
9929 break;
9930 }
9931 default: {
9932 error = ENOTSUP;
9933 break;
9934 }
9935 }
9936 return error;
9937 }
9938
9939 static int
necp_stats_initialize(struct necp_fd_data * fd_data,struct necp_client * client,struct necp_client_flow_registration * flow_registration,struct necp_stats_bufreq * bufreq)9940 necp_stats_initialize(struct necp_fd_data *fd_data,
9941 struct necp_client *client,
9942 struct necp_client_flow_registration *flow_registration,
9943 struct necp_stats_bufreq *bufreq)
9944 {
9945 int error = 0;
9946 struct necp_stats_hdr stats_hdr = {};
9947
9948 NECP_CLIENT_ASSERT_LOCKED(client);
9949 NECP_FD_ASSERT_LOCKED(fd_data);
9950 VERIFY(fd_data->stats_arena_active != NULL);
9951 VERIFY(fd_data->stats_arena_active->nai_arena != NULL);
9952 VERIFY(!(fd_data->stats_arena_active->nai_flags & (NAIF_REDIRECT | NAIF_DEFUNCT)));
9953
9954 if (bufreq == NULL) {
9955 return EINVAL;
9956 }
9957
9958 // Setup stats region
9959 error = necp_client_stats_bufreq(fd_data, client, flow_registration, bufreq, &stats_hdr);
9960 if (error) {
9961 return error;
9962 }
9963 // Notify ntstat about new flow
9964 if (flow_registration->stats_handler_context == NULL) {
9965 error = necp_client_stats_initial(flow_registration, stats_hdr.necp_stats_type, stats_hdr.necp_stats_ver);
9966 if (flow_registration->stats_handler_context != NULL) {
9967 ntstat_userland_stats_event(flow_registration->stats_handler_context, NECP_CLIENT_STATISTICS_EVENT_INIT);
9968 }
9969 NECP_CLIENT_FLOW_LOG(client, flow_registration, "Initialized stats <error %d>", error);
9970 }
9971
9972 return error;
9973 }
9974
9975 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_map_sysctls(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)9976 necp_client_map_sysctls(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
9977 {
9978 int result = 0;
9979 if (!retval) {
9980 retval = &result;
9981 }
9982
9983 do {
9984 mach_vm_address_t uaddr = 0;
9985 if (uap->buffer_size != sizeof(uaddr)) {
9986 *retval = EINVAL;
9987 break;
9988 }
9989
9990 *retval = necp_sysctl_arena_initialize(fd_data, false);
9991 if (*retval != 0) {
9992 break;
9993 }
9994
9995 mach_vm_offset_t off = 0;
9996 void *location = NULL;
9997 NECP_FD_LOCK(fd_data);
9998 location = necp_arena_sysctls_obj(fd_data, &off, NULL);
9999 NECP_FD_UNLOCK(fd_data);
10000
10001 if (location == NULL) {
10002 *retval = ENOENT;
10003 break;
10004 }
10005
10006 uaddr = fd_data->sysctl_mmap.ami_mapaddr + off;
10007 *retval = copyout(&uaddr, uap->buffer, sizeof(uaddr));
10008 } while (false);
10009
10010 return *retval;
10011 }
10012
10013 #endif /* !SKYWALK */
10014
10015 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_route_statistics(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)10016 necp_client_copy_route_statistics(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
10017 {
10018 int error = 0;
10019 struct necp_client *client = NULL;
10020 uuid_t client_id;
10021
10022 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
10023 uap->buffer_size < sizeof(struct necp_stat_counts) || uap->buffer == 0) {
10024 NECPLOG0(LOG_ERR, "necp_client_copy_route_statistics bad input");
10025 error = EINVAL;
10026 goto done;
10027 }
10028
10029 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
10030 if (error) {
10031 NECPLOG(LOG_ERR, "necp_client_copy_route_statistics copyin client_id error (%d)", error);
10032 goto done;
10033 }
10034
10035 // Lock
10036 NECP_FD_LOCK(fd_data);
10037 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
10038 if (client != NULL) {
10039 NECP_CLIENT_ROUTE_LOCK(client);
10040 struct necp_stat_counts route_stats = {};
10041 if (client->current_route != NULL && client->current_route->rt_stats != NULL) {
10042 struct nstat_counts *rt_stats = client->current_route->rt_stats;
10043 route_stats.necp_stat_rxpackets = os_atomic_load(&rt_stats->nstat_rxpackets, relaxed);
10044 route_stats.necp_stat_rxbytes = os_atomic_load(&rt_stats->nstat_rxbytes, relaxed);
10045 route_stats.necp_stat_txpackets = os_atomic_load(&rt_stats->nstat_txpackets, relaxed);
10046 route_stats.necp_stat_txbytes = os_atomic_load(&rt_stats->nstat_txbytes, relaxed);
10047 route_stats.necp_stat_rxduplicatebytes = rt_stats->nstat_rxduplicatebytes;
10048 route_stats.necp_stat_rxoutoforderbytes = rt_stats->nstat_rxoutoforderbytes;
10049 route_stats.necp_stat_txretransmit = rt_stats->nstat_txretransmit;
10050 route_stats.necp_stat_connectattempts = rt_stats->nstat_connectattempts;
10051 route_stats.necp_stat_connectsuccesses = rt_stats->nstat_connectsuccesses;
10052 route_stats.necp_stat_min_rtt = rt_stats->nstat_min_rtt;
10053 route_stats.necp_stat_avg_rtt = rt_stats->nstat_avg_rtt;
10054 route_stats.necp_stat_var_rtt = rt_stats->nstat_var_rtt;
10055 route_stats.necp_stat_route_flags = client->current_route->rt_flags;
10056 }
10057
10058 // Unlock before copying out
10059 NECP_CLIENT_ROUTE_UNLOCK(client);
10060 NECP_CLIENT_UNLOCK(client);
10061 NECP_FD_UNLOCK(fd_data);
10062
10063 error = copyout(&route_stats, uap->buffer, sizeof(route_stats));
10064 if (error) {
10065 NECPLOG(LOG_ERR, "necp_client_copy_route_statistics copyout error (%d)", error);
10066 }
10067 } else {
10068 // Unlock
10069 NECP_FD_UNLOCK(fd_data);
10070 error = ENOENT;
10071 }
10072
10073
10074 done:
10075 *retval = error;
10076 return error;
10077 }
10078
10079 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_update_cache(struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)10080 necp_client_update_cache(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
10081 {
10082 int error = 0;
10083 struct necp_client *client = NULL;
10084 uuid_t client_id;
10085
10086 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
10087 error = EINVAL;
10088 goto done;
10089 }
10090
10091 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
10092 if (error) {
10093 NECPLOG(LOG_ERR, "necp_client_update_cache copyin client_id error (%d)", error);
10094 goto done;
10095 }
10096
10097 NECP_FD_LOCK(fd_data);
10098 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
10099 if (client == NULL) {
10100 NECP_FD_UNLOCK(fd_data);
10101 error = ENOENT;
10102 goto done;
10103 }
10104
10105 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
10106 if (flow_registration == NULL) {
10107 NECP_CLIENT_UNLOCK(client);
10108 NECP_FD_UNLOCK(fd_data);
10109 error = ENOENT;
10110 goto done;
10111 }
10112
10113 NECP_CLIENT_ROUTE_LOCK(client);
10114 // This needs to be changed when TFO/ECN is supported by multiple flows
10115 struct necp_client_flow *flow = LIST_FIRST(&flow_registration->flow_list);
10116 if (flow == NULL ||
10117 (flow->remote_addr.sa.sa_family != AF_INET &&
10118 flow->remote_addr.sa.sa_family != AF_INET6) ||
10119 (flow->local_addr.sa.sa_family != AF_INET &&
10120 flow->local_addr.sa.sa_family != AF_INET6)) {
10121 error = EINVAL;
10122 NECPLOG(LOG_ERR, "necp_client_update_cache no flow error (%d)", error);
10123 goto done_unlock;
10124 }
10125
10126 necp_cache_buffer cache_buffer;
10127 memset(&cache_buffer, 0, sizeof(cache_buffer));
10128
10129 if (uap->buffer_size != sizeof(necp_cache_buffer) ||
10130 uap->buffer == USER_ADDR_NULL) {
10131 error = EINVAL;
10132 goto done_unlock;
10133 }
10134
10135 error = copyin(uap->buffer, &cache_buffer, sizeof(cache_buffer));
10136 if (error) {
10137 NECPLOG(LOG_ERR, "necp_client_update_cache copyin cache buffer error (%d)", error);
10138 goto done_unlock;
10139 }
10140
10141 if (cache_buffer.necp_cache_buf_type == NECP_CLIENT_CACHE_TYPE_ECN &&
10142 cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_ECN_VER_1) {
10143 if (cache_buffer.necp_cache_buf_size != sizeof(necp_tcp_ecn_cache) ||
10144 cache_buffer.necp_cache_buf_addr == USER_ADDR_NULL) {
10145 error = EINVAL;
10146 goto done_unlock;
10147 }
10148
10149 necp_tcp_ecn_cache ecn_cache_buffer;
10150 memset(&ecn_cache_buffer, 0, sizeof(ecn_cache_buffer));
10151
10152 error = copyin(cache_buffer.necp_cache_buf_addr, &ecn_cache_buffer, sizeof(necp_tcp_ecn_cache));
10153 if (error) {
10154 NECPLOG(LOG_ERR, "necp_client_update_cache copyin ecn cache buffer error (%d)", error);
10155 goto done_unlock;
10156 }
10157
10158 if (client->current_route != NULL && client->current_route->rt_ifp != NULL) {
10159 if (!client->platform_binary) {
10160 ecn_cache_buffer.necp_tcp_ecn_heuristics_success = 0;
10161 }
10162 tcp_heuristics_ecn_update(&ecn_cache_buffer, client->current_route->rt_ifp,
10163 (union sockaddr_in_4_6 *)&flow->local_addr);
10164 }
10165 } else if (cache_buffer.necp_cache_buf_type == NECP_CLIENT_CACHE_TYPE_TFO &&
10166 cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_TFO_VER_1) {
10167 if (cache_buffer.necp_cache_buf_size != sizeof(necp_tcp_tfo_cache) ||
10168 cache_buffer.necp_cache_buf_addr == USER_ADDR_NULL) {
10169 error = EINVAL;
10170 goto done_unlock;
10171 }
10172
10173 necp_tcp_tfo_cache tfo_cache_buffer;
10174 memset(&tfo_cache_buffer, 0, sizeof(tfo_cache_buffer));
10175
10176 error = copyin(cache_buffer.necp_cache_buf_addr, &tfo_cache_buffer, sizeof(necp_tcp_tfo_cache));
10177 if (error) {
10178 NECPLOG(LOG_ERR, "necp_client_update_cache copyin tfo cache buffer error (%d)", error);
10179 goto done_unlock;
10180 }
10181
10182 if (client->current_route != NULL && client->current_route->rt_ifp != NULL) {
10183 if (!client->platform_binary) {
10184 tfo_cache_buffer.necp_tcp_tfo_heuristics_success = 0;
10185 }
10186 tcp_heuristics_tfo_update(&tfo_cache_buffer, client->current_route->rt_ifp,
10187 (union sockaddr_in_4_6 *)&flow->local_addr,
10188 (union sockaddr_in_4_6 *)&flow->remote_addr);
10189 }
10190 } else {
10191 error = EINVAL;
10192 }
10193 done_unlock:
10194 NECP_CLIENT_ROUTE_UNLOCK(client);
10195 NECP_CLIENT_UNLOCK(client);
10196 NECP_FD_UNLOCK(fd_data);
10197 done:
10198 *retval = error;
10199 return error;
10200 }
10201
10202 // Most results will fit into this size
10203 struct necp_client_signable_default {
10204 uuid_t client_id;
10205 u_int32_t sign_type;
10206 u_int8_t signable_data[NECP_CLIENT_ACTION_SIGN_DEFAULT_DATA_LENGTH];
10207 } __attribute__((__packed__));
10208
10209 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_sign(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)10210 necp_client_sign(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
10211 {
10212 int error = 0;
10213 u_int8_t tag[NECP_CLIENT_ACTION_SIGN_TAG_LENGTH] = {};
10214 struct necp_client_signable *signable = NULL;
10215 struct necp_client_signable *allocated_signable = NULL;
10216 struct necp_client_signable_default default_signable = {};
10217 size_t tag_size = sizeof(tag);
10218
10219 const size_t signable_length = uap->client_id_len;
10220 const size_t return_tag_length = uap->buffer_size;
10221
10222 *retval = 0;
10223
10224 const bool has_resolver_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_VALIDATED_RESOLVER, 0) == 0);
10225 if (!has_resolver_entitlement) {
10226 NECPLOG0(LOG_ERR, "Process does not hold the necessary entitlement to sign resolver answers");
10227 error = EPERM;
10228 goto done;
10229 }
10230
10231 if (uap->client_id == 0 || signable_length < sizeof(*signable) || signable_length > NECP_CLIENT_ACTION_SIGN_MAX_TOTAL_LENGTH) {
10232 error = EINVAL;
10233 goto done;
10234 }
10235
10236 if (uap->buffer == 0 || return_tag_length != NECP_CLIENT_ACTION_SIGN_TAG_LENGTH) {
10237 error = EINVAL;
10238 goto done;
10239 }
10240
10241 if (signable_length <= sizeof(default_signable)) {
10242 signable = (struct necp_client_signable *)&default_signable;
10243 } else {
10244 if ((allocated_signable = (struct necp_client_signable *)kalloc_data(signable_length, Z_WAITOK | Z_ZERO)) == NULL) {
10245 NECPLOG(LOG_ERR, "necp_client_sign allocate signable %zu failed", signable_length);
10246 error = ENOMEM;
10247 goto done;
10248 }
10249 signable = allocated_signable;
10250 }
10251
10252 error = copyin(uap->client_id, signable, signable_length);
10253 if (error) {
10254 NECPLOG(LOG_ERR, "necp_client_sign copyin signable error (%d)", error);
10255 goto done;
10256 }
10257
10258 size_t data_length = 0;
10259 switch (signable->sign_type) {
10260 case NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER:
10261 case NECP_CLIENT_SIGN_TYPE_SYSTEM_RESOLVER_ANSWER: {
10262 data_length = (sizeof(struct necp_client_host_resolver_answer) - sizeof(struct necp_client_signable));
10263 if (signable_length < (sizeof(struct necp_client_signable) + data_length)) {
10264 error = EINVAL;
10265 goto done;
10266 }
10267 struct necp_client_host_resolver_answer *signable_struct = (struct necp_client_host_resolver_answer *)signable;
10268 if (signable_struct->hostname_length > NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH ||
10269 signable_length != (sizeof(struct necp_client_signable) + data_length + signable_struct->hostname_length)) {
10270 error = EINVAL;
10271 goto done;
10272 }
10273 data_length += signable_struct->hostname_length;
10274 break;
10275 }
10276 case NECP_CLIENT_SIGN_TYPE_BROWSE_RESULT:
10277 case NECP_CLIENT_SIGN_TYPE_SYSTEM_BROWSE_RESULT: {
10278 data_length = (sizeof(struct necp_client_browse_result) - sizeof(struct necp_client_signable));
10279 if (signable_length < (sizeof(struct necp_client_signable) + data_length)) {
10280 error = EINVAL;
10281 goto done;
10282 }
10283 struct necp_client_browse_result *signable_struct = (struct necp_client_browse_result *)signable;
10284 if (signable_struct->service_length > NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH ||
10285 signable_length != (sizeof(struct necp_client_signable) + data_length + signable_struct->service_length)) {
10286 error = EINVAL;
10287 goto done;
10288 }
10289 data_length += signable_struct->service_length;
10290 break;
10291 }
10292 case NECP_CLIENT_SIGN_TYPE_SERVICE_RESOLVER_ANSWER:
10293 case NECP_CLIENT_SIGN_TYPE_SYSTEM_SERVICE_RESOLVER_ANSWER: {
10294 data_length = (sizeof(struct necp_client_service_resolver_answer) - sizeof(struct necp_client_signable));
10295 if (signable_length < (sizeof(struct necp_client_signable) + data_length)) {
10296 error = EINVAL;
10297 goto done;
10298 }
10299 struct necp_client_service_resolver_answer *signable_struct = (struct necp_client_service_resolver_answer *)signable;
10300 if (signable_struct->service_length > NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH ||
10301 signable_struct->hostname_length > NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH ||
10302 signable_length != (sizeof(struct necp_client_signable) + data_length + signable_struct->service_length + signable_struct->hostname_length)) {
10303 error = EINVAL;
10304 goto done;
10305 }
10306 data_length += signable_struct->service_length;
10307 data_length += signable_struct->hostname_length;
10308 break;
10309 }
10310 default: {
10311 NECPLOG(LOG_ERR, "necp_client_sign unknown signable type (%u)", signable->sign_type);
10312 error = EINVAL;
10313 goto done;
10314 }
10315 }
10316
10317 error = necp_sign_resolver_answer(signable->client_id, signable->sign_type,
10318 signable->signable_data, data_length,
10319 tag, &tag_size);
10320 if (tag_size != sizeof(tag)) {
10321 NECPLOG(LOG_ERR, "necp_client_sign unexpected tag size %zu", tag_size);
10322 error = EINVAL;
10323 goto done;
10324 }
10325 error = copyout(tag, uap->buffer, tag_size);
10326 if (error) {
10327 NECPLOG(LOG_ERR, "necp_client_sign copyout error (%d)", error);
10328 goto done;
10329 }
10330
10331 done:
10332 if (allocated_signable != NULL) {
10333 kfree_data(allocated_signable, signable_length);
10334 allocated_signable = NULL;
10335 }
10336 *retval = error;
10337 return error;
10338 }
10339
10340 // Most results will fit into this size
10341 struct necp_client_validatable_default {
10342 struct necp_client_signature signature;
10343 struct necp_client_signable_default signable;
10344 } __attribute__((__packed__));
10345
10346 static NECP_CLIENT_ACTION_FUNCTION int
necp_client_validate(__unused struct necp_fd_data * fd_data,struct necp_client_action_args * uap,int * retval)10347 necp_client_validate(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
10348 {
10349 int error = 0;
10350 struct necp_client_validatable *validatable = NULL;
10351 struct necp_client_validatable *allocated_validatable = NULL;
10352 struct necp_client_validatable_default default_validatable = {};
10353
10354 const size_t validatable_length = uap->client_id_len;
10355
10356 *retval = 0;
10357
10358 const bool has_resolver_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_VALIDATED_RESOLVER, 0) == 0);
10359 if (!has_resolver_entitlement) {
10360 NECPLOG0(LOG_ERR, "Process does not hold the necessary entitlement to directly validate resolver answers");
10361 error = EPERM;
10362 goto done;
10363 }
10364
10365 if (uap->client_id == 0 || validatable_length < sizeof(*validatable) ||
10366 validatable_length > (NECP_CLIENT_ACTION_SIGN_MAX_TOTAL_LENGTH + NECP_CLIENT_ACTION_SIGN_TAG_LENGTH)) {
10367 error = EINVAL;
10368 goto done;
10369 }
10370
10371 if (validatable_length <= sizeof(default_validatable)) {
10372 validatable = (struct necp_client_validatable *)&default_validatable;
10373 } else {
10374 if ((allocated_validatable = (struct necp_client_validatable *)kalloc_data(validatable_length, Z_WAITOK | Z_ZERO)) == NULL) {
10375 NECPLOG(LOG_ERR, "necp_client_validate allocate struct %zu failed", validatable_length);
10376 error = ENOMEM;
10377 goto done;
10378 }
10379 validatable = allocated_validatable;
10380 }
10381
10382 error = copyin(uap->client_id, validatable, validatable_length);
10383 if (error) {
10384 NECPLOG(LOG_ERR, "necp_client_validate copyin error (%d)", error);
10385 goto done;
10386 }
10387
10388 const bool validated = necp_validate_resolver_answer(validatable->signable.client_id, validatable->signable.sign_type,
10389 validatable->signable.signable_data, validatable_length - sizeof(struct necp_client_validatable),
10390 validatable->signature.signed_tag, sizeof(validatable->signature.signed_tag));
10391 if (!validated) {
10392 // Return EAUTH to indicate that the signature failed
10393 error = EAUTH;
10394 }
10395
10396 done:
10397 if (allocated_validatable != NULL) {
10398 kfree_data(allocated_validatable, validatable_length);
10399 allocated_validatable = NULL;
10400 }
10401 *retval = error;
10402 return error;
10403 }
10404
10405 int
necp_client_action(struct proc * p,struct necp_client_action_args * uap,int * retval)10406 necp_client_action(struct proc *p, struct necp_client_action_args *uap, int *retval)
10407 {
10408 struct fileproc *fp;
10409 int error = 0;
10410 int return_value = 0;
10411 struct necp_fd_data *fd_data = NULL;
10412
10413 error = necp_find_fd_data(p, uap->necp_fd, &fp, &fd_data);
10414 if (error != 0) {
10415 NECPLOG(LOG_ERR, "necp_client_action find fd error (%d)", error);
10416 return error;
10417 }
10418
10419 u_int32_t action = uap->action;
10420
10421 #if CONFIG_MACF
10422 error = mac_necp_check_client_action(p, fp->fp_glob, action);
10423 if (error) {
10424 return_value = error;
10425 goto done;
10426 }
10427 #endif /* MACF */
10428
10429 switch (action) {
10430 case NECP_CLIENT_ACTION_ADD: {
10431 return_value = necp_client_add(p, fd_data, uap, retval);
10432 break;
10433 }
10434 case NECP_CLIENT_ACTION_CLAIM: {
10435 return_value = necp_client_claim(p, fd_data, uap, retval);
10436 break;
10437 }
10438 case NECP_CLIENT_ACTION_REMOVE: {
10439 return_value = necp_client_remove(fd_data, uap, retval);
10440 break;
10441 }
10442 case NECP_CLIENT_ACTION_COPY_PARAMETERS:
10443 case NECP_CLIENT_ACTION_COPY_RESULT:
10444 case NECP_CLIENT_ACTION_COPY_UPDATED_RESULT: {
10445 return_value = necp_client_copy(fd_data, uap, retval);
10446 break;
10447 }
10448 case NECP_CLIENT_ACTION_COPY_LIST: {
10449 return_value = necp_client_list(fd_data, uap, retval);
10450 break;
10451 }
10452 case NECP_CLIENT_ACTION_ADD_FLOW: {
10453 return_value = necp_client_add_flow(fd_data, uap, retval);
10454 break;
10455 }
10456 case NECP_CLIENT_ACTION_REMOVE_FLOW: {
10457 return_value = necp_client_remove_flow(fd_data, uap, retval);
10458 break;
10459 }
10460 #if SKYWALK
10461 case NECP_CLIENT_ACTION_REQUEST_NEXUS_INSTANCE: {
10462 return_value = necp_client_request_nexus(fd_data, uap, retval);
10463 break;
10464 }
10465 #endif /* !SKYWALK */
10466 case NECP_CLIENT_ACTION_AGENT: {
10467 return_value = necp_client_agent_action(fd_data, uap, retval);
10468 break;
10469 }
10470 case NECP_CLIENT_ACTION_COPY_AGENT: {
10471 return_value = necp_client_copy_agent(fd_data, uap, retval);
10472 break;
10473 }
10474 case NECP_CLIENT_ACTION_AGENT_USE: {
10475 return_value = necp_client_agent_use(fd_data, uap, retval);
10476 break;
10477 }
10478 case NECP_CLIENT_ACTION_ACQUIRE_AGENT_TOKEN: {
10479 return_value = necp_client_acquire_agent_token(fd_data, uap, retval);
10480 break;
10481 }
10482 case NECP_CLIENT_ACTION_COPY_INTERFACE: {
10483 return_value = necp_client_copy_interface(fd_data, uap, retval);
10484 break;
10485 }
10486 #if SKYWALK
10487 case NECP_CLIENT_ACTION_GET_INTERFACE_ADDRESS: {
10488 return_value = necp_client_get_interface_address(fd_data, uap, retval);
10489 break;
10490 }
10491 case NECP_CLIENT_ACTION_SET_STATISTICS: {
10492 return_value = ENOTSUP;
10493 break;
10494 }
10495 case NECP_CLIENT_ACTION_MAP_SYSCTLS: {
10496 return_value = necp_client_map_sysctls(fd_data, uap, retval);
10497 break;
10498 }
10499 #endif /* !SKYWALK */
10500 case NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS: {
10501 return_value = necp_client_copy_route_statistics(fd_data, uap, retval);
10502 break;
10503 }
10504 case NECP_CLIENT_ACTION_UPDATE_CACHE: {
10505 return_value = necp_client_update_cache(fd_data, uap, retval);
10506 break;
10507 }
10508 case NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE: {
10509 return_value = necp_client_copy_client_update(fd_data, uap, retval);
10510 break;
10511 }
10512 case NECP_CLIENT_ACTION_SIGN: {
10513 return_value = necp_client_sign(fd_data, uap, retval);
10514 break;
10515 }
10516 case NECP_CLIENT_ACTION_VALIDATE: {
10517 return_value = necp_client_validate(fd_data, uap, retval);
10518 break;
10519 }
10520 default: {
10521 NECPLOG(LOG_ERR, "necp_client_action unknown action (%u)", action);
10522 return_value = EINVAL;
10523 break;
10524 }
10525 }
10526
10527 done:
10528 fp_drop(p, uap->necp_fd, fp, 0);
10529 return return_value;
10530 }
10531
10532 #define NECP_MAX_MATCH_POLICY_PARAMETER_SIZE 1024
10533
10534 int
necp_match_policy(struct proc * p,struct necp_match_policy_args * uap,int32_t * retval)10535 necp_match_policy(struct proc *p, struct necp_match_policy_args *uap, int32_t *retval)
10536 {
10537 #pragma unused(retval)
10538 u_int8_t *parameters = NULL;
10539 struct necp_aggregate_result returned_result;
10540 int error = 0;
10541
10542 if (uap == NULL) {
10543 error = EINVAL;
10544 goto done;
10545 }
10546
10547 if (uap->parameters == 0 || uap->parameters_size == 0 || uap->parameters_size > NECP_MAX_MATCH_POLICY_PARAMETER_SIZE || uap->returned_result == 0) {
10548 error = EINVAL;
10549 goto done;
10550 }
10551
10552 parameters = (u_int8_t *)kalloc_data(uap->parameters_size, Z_WAITOK | Z_ZERO);
10553 if (parameters == NULL) {
10554 error = ENOMEM;
10555 goto done;
10556 }
10557 // Copy parameters in
10558 error = copyin(uap->parameters, parameters, uap->parameters_size);
10559 if (error) {
10560 goto done;
10561 }
10562
10563 error = necp_application_find_policy_match_internal(p, parameters, uap->parameters_size,
10564 &returned_result, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL, false, false, NULL);
10565 if (error) {
10566 goto done;
10567 }
10568
10569 // Copy return value back
10570 error = copyout(&returned_result, uap->returned_result, sizeof(struct necp_aggregate_result));
10571 if (error) {
10572 goto done;
10573 }
10574 done:
10575 if (parameters != NULL) {
10576 kfree_data(parameters, uap->parameters_size);
10577 }
10578 return error;
10579 }
10580
10581 /// Socket operations
10582
10583 static errno_t
necp_set_socket_attribute(u_int8_t * buffer,size_t buffer_length,u_int8_t type,char ** buffer_p,bool * single_tlv)10584 necp_set_socket_attribute(u_int8_t *buffer, size_t buffer_length, u_int8_t type, char **buffer_p, bool *single_tlv)
10585 {
10586 int error = 0;
10587 int cursor = 0;
10588 size_t string_size = 0;
10589 char *local_string = NULL;
10590 u_int8_t *value = NULL;
10591 char *buffer_to_free = NULL;
10592
10593 cursor = necp_buffer_find_tlv(buffer, buffer_length, 0, type, NULL, 0);
10594 if (cursor < 0) {
10595 // This will clear out the parameter
10596 goto done;
10597 }
10598
10599 string_size = necp_buffer_get_tlv_length(buffer, cursor);
10600 if (single_tlv != NULL && (buffer_length == sizeof(struct necp_tlv_header) + string_size)) {
10601 *single_tlv = true;
10602 }
10603 if (string_size == 0 || string_size > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) {
10604 // This will clear out the parameter
10605 goto done;
10606 }
10607
10608 local_string = (char *)kalloc_data(string_size + 1, Z_WAITOK | Z_ZERO);
10609 if (local_string == NULL) {
10610 NECPLOG(LOG_ERR, "Failed to allocate a socket attribute buffer (size %zu)", string_size);
10611 goto fail;
10612 }
10613
10614 value = necp_buffer_get_tlv_value(buffer, cursor, NULL);
10615 if (value == NULL) {
10616 NECPLOG0(LOG_ERR, "Failed to get socket attribute");
10617 goto fail;
10618 }
10619
10620 memcpy(local_string, value, string_size);
10621 local_string[string_size] = 0;
10622
10623 done:
10624 buffer_to_free = *buffer_p;
10625
10626 // Protect switching of buffer pointer
10627 necp_lock_socket_attributes();
10628 *buffer_p = local_string;
10629 necp_unlock_socket_attributes();
10630
10631 if (buffer_to_free != NULL) {
10632 kfree_data_addr(buffer_to_free);
10633 }
10634 return 0;
10635 fail:
10636 if (local_string != NULL) {
10637 kfree_data(local_string, string_size + 1);
10638 }
10639 return error;
10640 }
10641
10642 errno_t
necp_set_socket_attributes(struct inp_necp_attributes * attributes,struct sockopt * sopt)10643 necp_set_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt)
10644 {
10645 int error = 0;
10646 u_int8_t *buffer = NULL;
10647 bool single_tlv = false;
10648 size_t valsize = sopt->sopt_valsize;
10649 if (valsize == 0 ||
10650 valsize > ((sizeof(struct necp_tlv_header) + NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) * 4)) {
10651 goto done;
10652 }
10653
10654 buffer = (u_int8_t *)kalloc_data(valsize, Z_WAITOK | Z_ZERO);
10655 if (buffer == NULL) {
10656 goto done;
10657 }
10658
10659 error = sooptcopyin(sopt, buffer, valsize, 0);
10660 if (error) {
10661 goto done;
10662 }
10663
10664 // If NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT is being set/cleared separately from the other attributes,
10665 // do not clear other attributes.
10666 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT, &attributes->inp_domain_context, &single_tlv);
10667 if (error) {
10668 NECPLOG0(LOG_ERR, "Could not set domain context TLV for socket attributes");
10669 goto done;
10670 }
10671 if (single_tlv == true) {
10672 goto done;
10673 }
10674
10675 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN, &attributes->inp_domain, NULL);
10676 if (error) {
10677 NECPLOG0(LOG_ERR, "Could not set domain TLV for socket attributes");
10678 goto done;
10679 }
10680
10681 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN_OWNER, &attributes->inp_domain_owner, NULL);
10682 if (error) {
10683 NECPLOG0(LOG_ERR, "Could not set domain owner TLV for socket attributes");
10684 goto done;
10685 }
10686
10687 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_TRACKER_DOMAIN, &attributes->inp_tracker_domain, NULL);
10688 if (error) {
10689 NECPLOG0(LOG_ERR, "Could not set tracker domain TLV for socket attributes");
10690 goto done;
10691 }
10692
10693 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_ACCOUNT, &attributes->inp_account, NULL);
10694 if (error) {
10695 NECPLOG0(LOG_ERR, "Could not set account TLV for socket attributes");
10696 goto done;
10697 }
10698
10699 done:
10700 NECP_SOCKET_ATTRIBUTE_LOG("NECP ATTRIBUTES SOCKET - domain <%s> owner <%s> context <%s> tracker domain <%s> account <%s>",
10701 attributes->inp_domain,
10702 attributes->inp_domain_owner,
10703 attributes->inp_domain_context,
10704 attributes->inp_tracker_domain,
10705 attributes->inp_account);
10706
10707 if (necp_debug) {
10708 NECPLOG(LOG_DEBUG, "Set on socket: Domain %s, Domain owner %s, Domain context %s, Tracker domain %s, Account %s",
10709 attributes->inp_domain,
10710 attributes->inp_domain_owner,
10711 attributes->inp_domain_context,
10712 attributes->inp_tracker_domain,
10713 attributes->inp_account);
10714 }
10715
10716 if (buffer != NULL) {
10717 kfree_data(buffer, valsize);
10718 }
10719
10720 return error;
10721 }
10722
10723 errno_t
necp_get_socket_attributes(struct inp_necp_attributes * attributes,struct sockopt * sopt)10724 necp_get_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt)
10725 {
10726 int error = 0;
10727 u_int8_t *buffer = NULL;
10728 u_int8_t *cursor = NULL;
10729 size_t valsize = 0;
10730
10731 if (attributes->inp_domain != NULL) {
10732 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_domain);
10733 }
10734 if (attributes->inp_domain_owner != NULL) {
10735 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_domain_owner);
10736 }
10737 if (attributes->inp_domain_context != NULL) {
10738 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_domain_context);
10739 }
10740 if (attributes->inp_tracker_domain != NULL) {
10741 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_tracker_domain);
10742 }
10743 if (attributes->inp_account != NULL) {
10744 valsize += sizeof(struct necp_tlv_header) + strlen(attributes->inp_account);
10745 }
10746 if (valsize == 0) {
10747 goto done;
10748 }
10749
10750 buffer = (u_int8_t *)kalloc_data(valsize, Z_WAITOK | Z_ZERO);
10751 if (buffer == NULL) {
10752 goto done;
10753 }
10754
10755 cursor = buffer;
10756 if (attributes->inp_domain != NULL) {
10757 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN, strlen(attributes->inp_domain), attributes->inp_domain,
10758 buffer, valsize);
10759 }
10760
10761 if (attributes->inp_domain_owner != NULL) {
10762 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN_OWNER, strlen(attributes->inp_domain_owner), attributes->inp_domain_owner,
10763 buffer, valsize);
10764 }
10765
10766 if (attributes->inp_domain_context != NULL) {
10767 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT, strlen(attributes->inp_domain_context), attributes->inp_domain_context,
10768 buffer, valsize);
10769 }
10770
10771 if (attributes->inp_tracker_domain != NULL) {
10772 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_TRACKER_DOMAIN, strlen(attributes->inp_tracker_domain), attributes->inp_tracker_domain,
10773 buffer, valsize);
10774 }
10775
10776 if (attributes->inp_account != NULL) {
10777 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_ACCOUNT, strlen(attributes->inp_account), attributes->inp_account,
10778 buffer, valsize);
10779 }
10780
10781 error = sooptcopyout(sopt, buffer, valsize);
10782 if (error) {
10783 goto done;
10784 }
10785 done:
10786 if (buffer != NULL) {
10787 kfree_data(buffer, valsize);
10788 }
10789
10790 return error;
10791 }
10792
10793 int
necp_set_socket_resolver_signature(struct inpcb * inp,struct sockopt * sopt)10794 necp_set_socket_resolver_signature(struct inpcb *inp, struct sockopt *sopt)
10795 {
10796 const size_t valsize = sopt->sopt_valsize;
10797 if (valsize > NECP_CLIENT_ACTION_SIGN_MAX_TOTAL_LENGTH + NECP_CLIENT_ACTION_SIGN_TAG_LENGTH) {
10798 return EINVAL;
10799 }
10800
10801 necp_lock_socket_attributes();
10802 if (inp->inp_resolver_signature != NULL) {
10803 kfree_data(inp->inp_resolver_signature, inp->inp_resolver_signature_length);
10804 }
10805 inp->inp_resolver_signature_length = 0;
10806
10807 int error = 0;
10808 if (valsize > 0) {
10809 inp->inp_resolver_signature = kalloc_data(valsize, Z_WAITOK | Z_ZERO);
10810 if ((error = sooptcopyin(sopt, inp->inp_resolver_signature, valsize,
10811 valsize)) != 0) {
10812 // Free the signature buffer if the copyin failed
10813 kfree_data(inp->inp_resolver_signature, valsize);
10814 } else {
10815 inp->inp_resolver_signature_length = valsize;
10816 }
10817 }
10818 necp_unlock_socket_attributes();
10819
10820 return error;
10821 }
10822
10823 int
necp_get_socket_resolver_signature(struct inpcb * inp,struct sockopt * sopt)10824 necp_get_socket_resolver_signature(struct inpcb *inp, struct sockopt *sopt)
10825 {
10826 int error = 0;
10827 necp_lock_socket_attributes();
10828 if (inp->inp_resolver_signature == NULL ||
10829 inp->inp_resolver_signature_length == 0) {
10830 error = ENOENT;
10831 } else {
10832 error = sooptcopyout(sopt, inp->inp_resolver_signature,
10833 inp->inp_resolver_signature_length);
10834 }
10835 necp_unlock_socket_attributes();
10836 return error;
10837 }
10838
10839 bool
necp_socket_has_resolver_signature(struct inpcb * inp)10840 necp_socket_has_resolver_signature(struct inpcb *inp)
10841 {
10842 necp_lock_socket_attributes();
10843 bool has_signature = (inp->inp_resolver_signature != NULL && inp->inp_resolver_signature_length != 0);
10844 necp_unlock_socket_attributes();
10845 return has_signature;
10846 }
10847
10848 bool
necp_socket_resolver_signature_matches_address(struct inpcb * inp,union necp_sockaddr_union * address)10849 necp_socket_resolver_signature_matches_address(struct inpcb *inp, union necp_sockaddr_union *address)
10850 {
10851 bool matches_address = false;
10852 necp_lock_socket_attributes();
10853 if (inp->inp_resolver_signature != NULL && inp->inp_resolver_signature_length > 0 && address->sa.sa_len > 0) {
10854 struct necp_client_validatable *validatable = (struct necp_client_validatable *)inp->inp_resolver_signature;
10855 if (inp->inp_resolver_signature_length > sizeof(struct necp_client_validatable) &&
10856 validatable->signable.sign_type == NECP_CLIENT_SIGN_TYPE_SYSTEM_RESOLVER_ANSWER) {
10857 size_t data_length = inp->inp_resolver_signature_length - sizeof(struct necp_client_validatable);
10858 if (data_length >= (sizeof(struct necp_client_host_resolver_answer) - sizeof(struct necp_client_signable))) {
10859 struct necp_client_host_resolver_answer *answer_struct = (struct necp_client_host_resolver_answer *)&validatable->signable;
10860 if (data_length == (sizeof(struct necp_client_host_resolver_answer) + answer_struct->hostname_length - sizeof(struct necp_client_signable)) &&
10861 answer_struct->address_answer.sa.sa_family == address->sa.sa_family &&
10862 answer_struct->address_answer.sa.sa_len == address->sa.sa_len &&
10863 (answer_struct->address_answer.sin.sin_port == 0 ||
10864 answer_struct->address_answer.sin.sin_port == address->sin.sin_port) &&
10865 ((answer_struct->address_answer.sa.sa_family == AF_INET &&
10866 answer_struct->address_answer.sin.sin_addr.s_addr == address->sin.sin_addr.s_addr) ||
10867 (answer_struct->address_answer.sa.sa_family == AF_INET6 &&
10868 memcmp(&answer_struct->address_answer.sin6.sin6_addr, &address->sin6.sin6_addr, sizeof(struct in6_addr)) == 0))) {
10869 // Address matches
10870 const bool validated = necp_validate_resolver_answer(validatable->signable.client_id,
10871 validatable->signable.sign_type,
10872 validatable->signable.signable_data, data_length,
10873 validatable->signature.signed_tag, sizeof(validatable->signature.signed_tag));
10874 if (validated) {
10875 // Answer is validated
10876 matches_address = true;
10877 }
10878 }
10879 }
10880 }
10881 }
10882 necp_unlock_socket_attributes();
10883 return matches_address;
10884 }
10885
10886 /*
10887 * necp_set_socket_domain_attributes
10888 * Called from soconnectlock/soconnectxlock to directly set the tracker domain and owner for
10889 * a newly marked tracker socket.
10890 */
10891 errno_t
necp_set_socket_domain_attributes(struct socket * so,const char * domain,const char * domain_owner)10892 necp_set_socket_domain_attributes(struct socket *so, const char *domain, const char *domain_owner)
10893 {
10894 int error = 0;
10895 struct inpcb *inp = NULL;
10896 u_int8_t *buffer = NULL;
10897 size_t valsize = 0;
10898 char *buffer_to_free = NULL;
10899
10900 if (SOCK_DOM(so) != PF_INET && SOCK_DOM(so) != PF_INET6) {
10901 error = EINVAL;
10902 goto fail;
10903 }
10904
10905 // Set domain (required)
10906
10907 valsize = strlen(domain);
10908 if (valsize == 0 || valsize > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) {
10909 error = EINVAL;
10910 goto fail;
10911 }
10912
10913 buffer = (u_int8_t *)kalloc_data(valsize + 1, Z_WAITOK | Z_ZERO);
10914 if (buffer == NULL) {
10915 error = ENOMEM;
10916 goto fail;
10917 }
10918 bcopy(domain, buffer, valsize);
10919 buffer[valsize] = 0;
10920
10921 inp = sotoinpcb(so);
10922 // Do not overwrite a previously set domain if tracker domain is different.
10923 if (inp->inp_necp_attributes.inp_domain != NULL) {
10924 if (strlen(inp->inp_necp_attributes.inp_domain) != strlen(domain) ||
10925 strncmp(inp->inp_necp_attributes.inp_domain, domain, strlen(domain)) != 0) {
10926 buffer_to_free = inp->inp_necp_attributes.inp_tracker_domain;
10927 // Protect switching of buffer pointer
10928 necp_lock_socket_attributes();
10929 inp->inp_necp_attributes.inp_tracker_domain = (char *)buffer;
10930 necp_unlock_socket_attributes();
10931 if (buffer_to_free != NULL) {
10932 kfree_data_addr(buffer_to_free);
10933 }
10934 } else {
10935 kfree_data_addr(buffer);
10936 }
10937 } else {
10938 // Protect switching of buffer pointer
10939 necp_lock_socket_attributes();
10940 inp->inp_necp_attributes.inp_domain = (char *)buffer;
10941 necp_unlock_socket_attributes();
10942 }
10943 buffer = NULL;
10944
10945 // set domain_owner (required only for tracker)
10946 if (!(so->so_flags1 & SOF1_KNOWN_TRACKER)) {
10947 goto done;
10948 }
10949
10950 valsize = strlen(domain_owner);
10951 if (valsize == 0 || valsize > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) {
10952 error = EINVAL;
10953 goto fail;
10954 }
10955
10956 buffer = (u_int8_t *)kalloc_data(valsize + 1, Z_WAITOK | Z_ZERO);
10957 if (buffer == NULL) {
10958 error = ENOMEM;
10959 goto fail;
10960 }
10961 bcopy(domain_owner, buffer, valsize);
10962 buffer[valsize] = 0;
10963
10964 inp = sotoinpcb(so);
10965
10966 buffer_to_free = inp->inp_necp_attributes.inp_domain_owner;
10967 // Protect switching of buffer pointer
10968 necp_lock_socket_attributes();
10969 inp->inp_necp_attributes.inp_domain_owner = (char *)buffer;
10970 necp_unlock_socket_attributes();
10971 buffer = NULL;
10972
10973 if (buffer_to_free != NULL) {
10974 kfree_data_addr(buffer_to_free);
10975 }
10976
10977 done:
10978 NECP_SOCKET_PARAMS_LOG(so, "NECP ATTRIBUTES SOCKET - domain <%s> owner <%s> context <%s> tracker domain <%s> account <%s> "
10979 "<so flags - is_tracker %X non-app-initiated %X app-approved-domain %X",
10980 inp->inp_necp_attributes.inp_domain,
10981 inp->inp_necp_attributes.inp_domain_owner,
10982 inp->inp_necp_attributes.inp_domain_context,
10983 inp->inp_necp_attributes.inp_tracker_domain,
10984 inp->inp_necp_attributes.inp_account,
10985 so->so_flags1 & SOF1_KNOWN_TRACKER,
10986 so->so_flags1 & SOF1_TRACKER_NON_APP_INITIATED,
10987 so->so_flags1 & SOF1_APPROVED_APP_DOMAIN);
10988
10989 if (necp_debug) {
10990 NECPLOG(LOG_DEBUG, "Set on socket: Domain <%s> Domain owner <%s> Domain context <%s> Tracker domain <%s> Account <%s> ",
10991 inp->inp_necp_attributes.inp_domain,
10992 inp->inp_necp_attributes.inp_domain_owner,
10993 inp->inp_necp_attributes.inp_domain_context,
10994 inp->inp_necp_attributes.inp_tracker_domain,
10995 inp->inp_necp_attributes.inp_account);
10996 }
10997 fail:
10998 if (buffer != NULL) {
10999 kfree_data(buffer, valsize + 1);
11000 }
11001 return error;
11002 }
11003
11004 void *
necp_create_nexus_assign_message(uuid_t nexus_instance,nexus_port_t nexus_port,void * key,uint32_t key_length,struct necp_client_endpoint * local_endpoint,struct necp_client_endpoint * remote_endpoint,struct ether_addr * local_ether_addr,u_int32_t flow_adv_index,void * flow_stats,size_t * message_length)11005 necp_create_nexus_assign_message(uuid_t nexus_instance, nexus_port_t nexus_port, void *key, uint32_t key_length,
11006 struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint, struct ether_addr *local_ether_addr,
11007 u_int32_t flow_adv_index, void *flow_stats, size_t *message_length)
11008 {
11009 u_int8_t *buffer = NULL;
11010 u_int8_t *cursor = NULL;
11011 size_t valsize = 0;
11012 bool has_nexus_assignment = FALSE;
11013
11014 if (!uuid_is_null(nexus_instance)) {
11015 has_nexus_assignment = TRUE;
11016 valsize += sizeof(struct necp_tlv_header) + sizeof(uuid_t);
11017 valsize += sizeof(struct necp_tlv_header) + sizeof(nexus_port_t);
11018 }
11019 if (flow_adv_index != NECP_FLOWADV_IDX_INVALID) {
11020 valsize += sizeof(struct necp_tlv_header) + sizeof(u_int32_t);
11021 }
11022 if (key != NULL && key_length > 0) {
11023 valsize += sizeof(struct necp_tlv_header) + key_length;
11024 }
11025 if (local_endpoint != NULL) {
11026 valsize += sizeof(struct necp_tlv_header) + sizeof(struct necp_client_endpoint);
11027 }
11028 if (remote_endpoint != NULL) {
11029 valsize += sizeof(struct necp_tlv_header) + sizeof(struct necp_client_endpoint);
11030 }
11031 if (local_ether_addr != NULL) {
11032 valsize += sizeof(struct necp_tlv_header) + sizeof(struct ether_addr);
11033 }
11034 if (flow_stats != NULL) {
11035 valsize += sizeof(struct necp_tlv_header) + sizeof(void *);
11036 }
11037 if (valsize == 0) {
11038 return NULL;
11039 }
11040
11041 buffer = kalloc_data(valsize, Z_WAITOK | Z_ZERO);
11042 if (buffer == NULL) {
11043 return NULL;
11044 }
11045
11046 cursor = buffer;
11047 if (has_nexus_assignment) {
11048 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_INSTANCE, sizeof(uuid_t), nexus_instance, buffer, valsize);
11049 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_PORT, sizeof(nexus_port_t), &nexus_port, buffer, valsize);
11050 }
11051 if (flow_adv_index != NECP_FLOWADV_IDX_INVALID) {
11052 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_PORT_FLOW_INDEX, sizeof(u_int32_t), &flow_adv_index, buffer, valsize);
11053 }
11054 if (key != NULL && key_length > 0) {
11055 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_PARAMETER_NEXUS_KEY, key_length, key, buffer, valsize);
11056 }
11057 if (local_endpoint != NULL) {
11058 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_LOCAL_ENDPOINT, sizeof(struct necp_client_endpoint), local_endpoint, buffer, valsize);
11059 }
11060 if (remote_endpoint != NULL) {
11061 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_REMOTE_ENDPOINT, sizeof(struct necp_client_endpoint), remote_endpoint, buffer, valsize);
11062 }
11063 if (local_ether_addr != NULL) {
11064 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_LOCAL_ETHER_ADDR, sizeof(struct ether_addr), local_ether_addr, buffer, valsize);
11065 }
11066 if (flow_stats != NULL) {
11067 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_FLOW_STATS, sizeof(void *), &flow_stats, buffer, valsize);
11068 }
11069
11070 *message_length = valsize;
11071
11072 return buffer;
11073 }
11074
11075 void
necp_inpcb_remove_cb(struct inpcb * inp)11076 necp_inpcb_remove_cb(struct inpcb *inp)
11077 {
11078 if (!uuid_is_null(inp->necp_client_uuid)) {
11079 necp_client_unregister_socket_flow(inp->necp_client_uuid, inp);
11080 uuid_clear(inp->necp_client_uuid);
11081 }
11082 }
11083
11084 void
necp_inpcb_dispose(struct inpcb * inp)11085 necp_inpcb_dispose(struct inpcb *inp)
11086 {
11087 necp_inpcb_remove_cb(inp); // Clear out socket registrations if not yet done
11088 if (inp->inp_necp_attributes.inp_domain != NULL) {
11089 kfree_data_addr(inp->inp_necp_attributes.inp_domain);
11090 inp->inp_necp_attributes.inp_domain = NULL;
11091 }
11092 if (inp->inp_necp_attributes.inp_account != NULL) {
11093 kfree_data_addr(inp->inp_necp_attributes.inp_account);
11094 inp->inp_necp_attributes.inp_account = NULL;
11095 }
11096 if (inp->inp_necp_attributes.inp_domain_owner != NULL) {
11097 kfree_data_addr(inp->inp_necp_attributes.inp_domain_owner);
11098 inp->inp_necp_attributes.inp_domain_owner = NULL;
11099 }
11100 if (inp->inp_necp_attributes.inp_domain_context != NULL) {
11101 kfree_data_addr(inp->inp_necp_attributes.inp_domain_context);
11102 inp->inp_necp_attributes.inp_domain_context = NULL;
11103 }
11104 if (inp->inp_necp_attributes.inp_tracker_domain != NULL) {
11105 kfree_data_addr(inp->inp_necp_attributes.inp_tracker_domain);
11106 inp->inp_necp_attributes.inp_tracker_domain = NULL;
11107 }
11108 if (inp->inp_resolver_signature != NULL) {
11109 kfree_data(inp->inp_resolver_signature, inp->inp_resolver_signature_length);
11110 }
11111 inp->inp_resolver_signature_length = 0;
11112 }
11113
11114 void
necp_mppcb_dispose(struct mppcb * mpp)11115 necp_mppcb_dispose(struct mppcb *mpp)
11116 {
11117 if (!uuid_is_null(mpp->necp_client_uuid)) {
11118 necp_client_unregister_multipath_cb(mpp->necp_client_uuid, mpp);
11119 uuid_clear(mpp->necp_client_uuid);
11120 }
11121
11122 if (mpp->inp_necp_attributes.inp_domain != NULL) {
11123 kfree_data_addr(mpp->inp_necp_attributes.inp_domain);
11124 mpp->inp_necp_attributes.inp_domain = NULL;
11125 }
11126 if (mpp->inp_necp_attributes.inp_account != NULL) {
11127 kfree_data_addr(mpp->inp_necp_attributes.inp_account);
11128 mpp->inp_necp_attributes.inp_account = NULL;
11129 }
11130 if (mpp->inp_necp_attributes.inp_domain_owner != NULL) {
11131 kfree_data_addr(mpp->inp_necp_attributes.inp_domain_owner);
11132 mpp->inp_necp_attributes.inp_domain_owner = NULL;
11133 }
11134 if (mpp->inp_necp_attributes.inp_tracker_domain != NULL) {
11135 kfree_data_addr(mpp->inp_necp_attributes.inp_tracker_domain);
11136 mpp->inp_necp_attributes.inp_tracker_domain = NULL;
11137 }
11138 }
11139
11140 /// Module init
11141
11142 void
necp_client_init(void)11143 necp_client_init(void)
11144 {
11145 necp_client_update_tcall = thread_call_allocate_with_options(necp_update_all_clients_callout, NULL,
11146 THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
11147 VERIFY(necp_client_update_tcall != NULL);
11148 #if SKYWALK
11149
11150 necp_client_collect_stats_tcall = thread_call_allocate_with_options(necp_collect_stats_client_callout, NULL,
11151 THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
11152 VERIFY(necp_client_collect_stats_tcall != NULL);
11153
11154 necp_close_empty_arenas_tcall = thread_call_allocate_with_options(necp_close_empty_arenas_callout, NULL,
11155 THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
11156 VERIFY(necp_close_empty_arenas_tcall != NULL);
11157 #endif /* SKYWALK */
11158
11159 LIST_INIT(&necp_fd_list);
11160 LIST_INIT(&necp_fd_observer_list);
11161 LIST_INIT(&necp_collect_stats_flow_list);
11162
11163 RB_INIT(&necp_client_global_tree);
11164 RB_INIT(&necp_client_flow_global_tree);
11165 }
11166
11167 #if SKYWALK
11168 pid_t
necp_client_get_proc_pid_from_arena_info(struct skmem_arena_mmap_info * arena_info)11169 necp_client_get_proc_pid_from_arena_info(struct skmem_arena_mmap_info *arena_info)
11170 {
11171 ASSERT((arena_info->ami_arena->ar_type == SKMEM_ARENA_TYPE_NECP) || (arena_info->ami_arena->ar_type == SKMEM_ARENA_TYPE_SYSTEM));
11172
11173 if (arena_info->ami_arena->ar_type == SKMEM_ARENA_TYPE_NECP) {
11174 struct necp_arena_info *nai = container_of(arena_info, struct necp_arena_info, nai_mmap);
11175 return nai->nai_proc_pid;
11176 } else {
11177 struct necp_fd_data *fd_data = container_of(arena_info, struct necp_fd_data, sysctl_mmap);
11178 return fd_data->proc_pid;
11179 }
11180 }
11181 #endif /* !SKYWALK */
11182