bsd/net/necp_client.c

   1 /*
   2  * Copyright (c) 2015-2019 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #include <string.h>
  30
  31 #include <kern/thread_call.h>
  32 #include <kern/zalloc.h>
  33
  34 #include <libkern/OSMalloc.h>
  35
  36 #include <net/if.h>
  37 #include <net/if_var.h>
  38 #include <net/net_api_stats.h>
  39 #include <net/necp.h>
  40 #include <net/network_agent.h>
  41 #include <net/ntstat.h>
  42
  43 #include <netinet/in_pcb.h>
  44 #include <netinet/in_var.h>
  45 #include <netinet/ip.h>
  46 #include <netinet/ip6.h>
  47 #include <netinet/mp_pcb.h>
  48 #include <netinet/tcp_cc.h>
  49 #include <netinet/tcp_fsm.h>
  50 #include <netinet/tcp_cache.h>
  51 #include <netinet6/in6_var.h>
  52
  53 #include <sys/domain.h>
  54 #include <sys/file_internal.h>
  55 #include <sys/kauth.h>
  56 #include <sys/kernel.h>
  57 #include <sys/malloc.h>
  58 #include <sys/poll.h>
  59 #include <sys/priv.h>
  60 #include <sys/protosw.h>
  61 #include <sys/queue.h>
  62 #include <sys/socket.h>
  63 #include <sys/socketvar.h>
  64 #include <sys/sysproto.h>
  65 #include <sys/systm.h>
  66 #include <sys/types.h>
  67 #include <sys/codesign.h>
  68 #include <libkern/section_keywords.h>
  69
  70 #include <os/refcnt.h>
  71
  72
  73 /*
  74  * NECP Client Architecture
  75  * ------------------------------------------------
  76  * See <net/necp.c> for a discussion on NECP database architecture.
  77  *
  78  * Each client of NECP provides a set of parameters for a connection or network state
  79  * evaluation, on which NECP policy evaluation is run. This produces a policy result
  80  * which can be accessed by the originating process, along with events for when policies
  81  * results have changed.
  82  *
  83  * ------------------------------------------------
  84  * NECP Client FD
  85  * ------------------------------------------------
  86  * A process opens an NECP file descriptor using necp_open(). This is a very simple
  87  * file descriptor, upon which the process may do the following operations:
  88  *   - necp_client_action(...), to add/remove/query clients
  89  *   - kqueue, to watch for readable events
  90  *   - close(), to close the client session and release all clients
  91  *
  92  * Client objects are allocated structures that hang off of the file descriptor. Each
  93  * client contains:
  94  *   - Client ID, a UUID that references the client across the system
  95  *   - Parameters, a buffer of TLVs that describe the client's connection parameters,
  96  *       such as the remote and local endpoints, interface requirements, etc.
  97  *   - Result, a buffer of TLVs containing the current policy evaluation for the client.
  98  *       This result will be updated whenever a network change occurs that impacts the
  99  *       policy result for that client.
 100  *
 101  *                   +--------------+
 102  *                   |   NECP fd    |
 103  *                   +--------------+
 104  *                          ||
 105  *          ==================================
 106  *          ||              ||              ||
 107  *  +--------------+ +--------------+ +--------------+
 108  *  |   Client ID  | |   Client ID  | |   Client ID  |
 109  *  |     ----     | |     ----     | |     ----     |
 110  *  |  Parameters  | |  Parameters  | |  Parameters  |
 111  *  |     ----     | |     ----     | |     ----     |
 112  *  |    Result    | |    Result    | |    Result    |
 113  *  +--------------+ +--------------+ +--------------+
 114  *
 115  * ------------------------------------------------
 116  * Client Actions
 117  * ------------------------------------------------
 118  *   - Add. Input parameters as a buffer of TLVs, and output a client ID. Allocates a
 119  *       new client structure on the file descriptor.
 120  *   - Remove. Input a client ID. Removes a client structure from the file descriptor.
 121  *   - Copy Parameters. Input a client ID, and output parameter TLVs.
 122  *   - Copy Result. Input a client ID, and output result TLVs. Alternatively, input empty
 123  *       client ID and get next unread client result.
 124  *   - Copy List. List all client IDs.
 125  *
 126  * ------------------------------------------------
 127  * Client Policy Evaluation
 128  * ------------------------------------------------
 129  * Policies are evaluated for clients upon client creation, and upon update events,
 130  * which are network/agent/policy changes coalesced by a timer.
 131  *
 132  * The policy evaluation goes through the following steps:
 133  *   1. Parse client parameters.
 134  *   2. Select a scoped interface if applicable. This involves using require/prohibit
 135  *      parameters, along with the local address, to select the most appropriate interface
 136  *      if not explicitly set by the client parameters.
 137  *   3. Run NECP application-level policy evalution
 138  *   4. Set policy result into client result buffer.
 139  *
 140  * ------------------------------------------------
 141  * Client Observers
 142  * ------------------------------------------------
 143  * If necp_open() is called with the NECP_OPEN_FLAG_OBSERVER flag, and the process
 144  * passes the necessary privilege check, the fd is allowed to use necp_client_action()
 145  * to copy client state attached to the file descriptors of other processes, and to
 146  * list all client IDs on the system.
 147  */
 148
 149 extern u_int32_t necp_debug;
 150
 151 static int necpop_select(struct fileproc *, int, void *, vfs_context_t);
 152 static int necpop_close(struct fileglob *, vfs_context_t);
 153 static int necpop_kqfilter(struct fileproc *, struct knote *, struct kevent_qos_s *);
 154
 155 // Timer functions
 156 static int necp_timeout_microseconds = 1000 * 100; // 100ms
 157 static int necp_timeout_leeway_microseconds = 1000 * 500; // 500ms
 158
 159 static int necp_client_fd_count = 0;
 160 static int necp_observer_fd_count = 0;
 161 static int necp_client_count = 0;
 162 static int necp_socket_flow_count = 0;
 163 static int necp_if_flow_count = 0;
 164 static int necp_observer_message_limit = 256;
 165
 166 os_refgrp_decl(static, necp_client_refgrp, "NECPClientRefGroup", NULL);
 167
 168 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_FD_COUNT, client_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_fd_count, 0, "");
 169 SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_FD_COUNT, observer_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_observer_fd_count, 0, "");
 170 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_COUNT, client_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_count, 0, "");
 171 SYSCTL_INT(_net_necp, NECPCTL_SOCKET_FLOW_COUNT, socket_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_socket_flow_count, 0, "");
 172 SYSCTL_INT(_net_necp, NECPCTL_IF_FLOW_COUNT, if_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_if_flow_count, 0, "");
 173 SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_MESSAGE_LIMIT, observer_message_limit, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_observer_message_limit, 256, "");
 174
 175 #define NECP_MAX_CLIENT_LIST_SIZE               1024 * 1024 // 1MB
 176 #define NECP_MAX_AGENT_ACTION_SIZE              256
 177
 178 extern int tvtohz(struct timeval *);
 179 extern unsigned int get_maxmtu(struct rtentry *);
 180
 181 // Parsed parameters
 182 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR                         0x00001
 183 #define NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR                        0x00002
 184 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF                        0x00004
 185 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF                      0x00008
 186 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE            0x00010
 187 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE          0x00020
 188 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT                     0x00040
 189 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT           0x00080
 190 #define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT            0x00100
 191 #define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT                      0x00200
 192 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE        0x00400
 193 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE      0x00800
 194 #define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE       0x01000
 195 #define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE         0x02000
 196 #define NECP_PARSED_PARAMETERS_FIELD_FLAGS                                      0x04000
 197 #define NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL                        0x08000
 198 #define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID                      0x10000
 199 #define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID                     0x20000
 200 #define NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS                      0x40000
 201 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT                         0x80000
 202 #define NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID                                             0x100000
 203 #define NECP_PARSED_PARAMETERS_FIELD_ETHERTYPE                                             0x200000
 204 #define NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL                        0x400000
 205 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE                                              0x800000
 206
 207
 208 #define NECP_MAX_INTERFACE_PARAMETERS 16
 209 #define NECP_MAX_AGENT_PARAMETERS 4
 210 struct necp_client_parsed_parameters {
 211         u_int32_t valid_fields;
 212         u_int32_t flags;
 213         u_int64_t delegated_upid;
 214         union necp_sockaddr_union local_addr;
 215         union necp_sockaddr_union remote_addr;
 216         u_int32_t required_interface_index;
 217         char prohibited_interfaces[NECP_MAX_INTERFACE_PARAMETERS][IFXNAMSIZ];
 218         u_int8_t required_interface_type;
 219         u_int8_t local_address_preference;
 220         u_int8_t prohibited_interface_types[NECP_MAX_INTERFACE_PARAMETERS];
 221         struct necp_client_parameter_netagent_type required_netagent_types[NECP_MAX_AGENT_PARAMETERS];
 222         struct necp_client_parameter_netagent_type prohibited_netagent_types[NECP_MAX_AGENT_PARAMETERS];
 223         struct necp_client_parameter_netagent_type preferred_netagent_types[NECP_MAX_AGENT_PARAMETERS];
 224         struct necp_client_parameter_netagent_type avoided_netagent_types[NECP_MAX_AGENT_PARAMETERS];
 225         uuid_t required_netagents[NECP_MAX_AGENT_PARAMETERS];
 226         uuid_t prohibited_netagents[NECP_MAX_AGENT_PARAMETERS];
 227         uuid_t preferred_netagents[NECP_MAX_AGENT_PARAMETERS];
 228         uuid_t avoided_netagents[NECP_MAX_AGENT_PARAMETERS];
 229         u_int8_t ip_protocol;
 230         u_int8_t transport_protocol;
 231         u_int16_t ethertype;
 232         pid_t effective_pid;
 233         uuid_t effective_uuid;
 234         u_int32_t traffic_class;
 235 };
 236
 237 static bool
 238 necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters,
 239     u_int *return_ifindex, bool *validate_agents);
 240
 241 static bool
 242 necp_ifnet_matches_local_address(struct ifnet *ifp, struct sockaddr *sa);
 243
 244 static bool
 245 necp_ifnet_matches_parameters(struct ifnet *ifp,
 246     struct necp_client_parsed_parameters *parsed_parameters,
 247     u_int32_t override_flags,
 248     u_int32_t *preferred_count,
 249     bool secondary_interface,
 250     bool require_scoped_field);
 251
 252 static const struct fileops necp_fd_ops = {
 253         .fo_type     = DTYPE_NETPOLICY,
 254         .fo_read     = fo_no_read,
 255         .fo_write    = fo_no_write,
 256         .fo_ioctl    = fo_no_ioctl,
 257         .fo_select   = necpop_select,
 258         .fo_close    = necpop_close,
 259         .fo_drain    = fo_no_drain,
 260         .fo_kqfilter = necpop_kqfilter,
 261 };
 262
 263 struct necp_client_assertion {
 264         LIST_ENTRY(necp_client_assertion) assertion_chain;
 265         uuid_t asserted_netagent;
 266 };
 267
 268 struct necp_client_flow_header {
 269         struct necp_tlv_header outer_header;
 270         struct necp_tlv_header flow_id_tlv_header;
 271         uuid_t flow_id;
 272         struct necp_tlv_header flags_tlv_header;
 273         u_int32_t flags_value;
 274         struct necp_tlv_header interface_tlv_header;
 275         struct necp_client_result_interface interface_value;
 276 } __attribute__((__packed__));
 277
 278 struct necp_client_flow_protoctl_event_header {
 279         struct necp_tlv_header protoctl_tlv_header;
 280         struct necp_client_flow_protoctl_event protoctl_event;
 281 } __attribute__((__packed__));
 282
 283 struct necp_client_nexus_flow_header {
 284         struct necp_client_flow_header flow_header;
 285         struct necp_tlv_header agent_tlv_header;
 286         struct necp_client_result_netagent agent_value;
 287         struct necp_tlv_header tfo_cookie_tlv_header;
 288         u_int8_t tfo_cookie_value[NECP_TFO_COOKIE_LEN_MAX];
 289 } __attribute__((__packed__));
 290
 291
 292 struct necp_client_flow {
 293         LIST_ENTRY(necp_client_flow) flow_chain;
 294         unsigned invalid : 1;
 295         unsigned nexus : 1; // If true, flow is a nexus; if false, flow is attached to socket
 296         unsigned socket : 1;
 297         unsigned viable : 1;
 298         unsigned assigned : 1;
 299         unsigned has_protoctl_event : 1;
 300         unsigned check_tcp_heuristics : 1;
 301         unsigned _reserved : 1;
 302         union {
 303                 uuid_t nexus_agent;
 304                 struct {
 305                         void *socket_handle;
 306                         necp_client_flow_cb cb;
 307                 };
 308         } u;
 309         uint32_t interface_index;
 310         uint16_t interface_flags;
 311         uint32_t necp_flow_flags;
 312         struct necp_client_flow_protoctl_event protoctl_event;
 313         union necp_sockaddr_union local_addr;
 314         union necp_sockaddr_union remote_addr;
 315
 316         size_t assigned_results_length;
 317         u_int8_t *assigned_results;
 318 };
 319
 320 struct necp_client_flow_registration {
 321         RB_ENTRY(necp_client_flow_registration) fd_link;
 322         RB_ENTRY(necp_client_flow_registration) global_link;
 323         RB_ENTRY(necp_client_flow_registration) client_link;
 324         LIST_ENTRY(necp_client_flow_registration) collect_stats_chain;
 325         uuid_t registration_id;
 326         u_int32_t flags;
 327         unsigned flow_result_read : 1;
 328         unsigned defunct : 1;
 329         void *interface_handle;
 330         necp_client_flow_cb interface_cb;
 331         struct necp_client *client;
 332         LIST_HEAD(_necp_registration_flow_list, necp_client_flow) flow_list;
 333         u_int64_t last_interface_details __attribute__((aligned(sizeof(u_int64_t))));
 334 };
 335
 336 static int necp_client_flow_id_cmp(struct necp_client_flow_registration *flow0, struct necp_client_flow_registration *flow1);
 337
 338 RB_HEAD(_necp_client_flow_tree, necp_client_flow_registration);
 339 RB_PROTOTYPE_PREV(_necp_client_flow_tree, necp_client_flow_registration, client_link, necp_client_flow_id_cmp);
 340 RB_GENERATE_PREV(_necp_client_flow_tree, necp_client_flow_registration, client_link, necp_client_flow_id_cmp);
 341
 342 #define NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT 4
 343 #define NECP_CLIENT_MAX_INTERFACE_OPTIONS 16
 344
 345 #define NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT (NECP_CLIENT_MAX_INTERFACE_OPTIONS - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT)
 346
 347 struct necp_client {
 348         RB_ENTRY(necp_client) link;
 349         RB_ENTRY(necp_client) global_link;
 350
 351         decl_lck_mtx_data(, lock);
 352         decl_lck_mtx_data(, route_lock);
 353         os_refcnt_t reference_count;
 354
 355         uuid_t client_id;
 356         unsigned result_read : 1;
 357         unsigned allow_multiple_flows : 1;
 358         unsigned legacy_client_is_flow : 1;
 359
 360         unsigned platform_binary : 1;
 361
 362         size_t result_length;
 363         u_int8_t result[NECP_MAX_CLIENT_RESULT_SIZE];
 364
 365         necp_policy_id policy_id;
 366
 367         u_int8_t ip_protocol;
 368         int proc_pid;
 369
 370         u_int64_t delegated_upid;
 371
 372         struct _necp_client_flow_tree flow_registrations;
 373         LIST_HEAD(_necp_client_assertion_list, necp_client_assertion) assertion_list;
 374
 375         struct rtentry *current_route;
 376
 377         struct necp_client_interface_option interface_options[NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
 378         struct necp_client_interface_option *extra_interface_options;
 379         u_int8_t interface_option_count; // Number in interface_options + extra_interface_options
 380
 381         struct necp_client_result_netagent failed_trigger_agent;
 382
 383         void *agent_handle;
 384
 385
 386         size_t parameters_length;
 387         u_int8_t parameters[0];
 388 };
 389
 390 #define NECP_CLIENT_LOCK(_c) lck_mtx_lock(&_c->lock)
 391 #define NECP_CLIENT_UNLOCK(_c) lck_mtx_unlock(&_c->lock)
 392 #define NECP_CLIENT_ASSERT_LOCKED(_c) LCK_MTX_ASSERT(&_c->lock, LCK_MTX_ASSERT_OWNED)
 393 #define NECP_CLIENT_ASSERT_UNLOCKED(_c) LCK_MTX_ASSERT(&_c->lock, LCK_MTX_ASSERT_NOTOWNED)
 394
 395 #define NECP_CLIENT_ROUTE_LOCK(_c) lck_mtx_lock(&_c->route_lock)
 396 #define NECP_CLIENT_ROUTE_UNLOCK(_c) lck_mtx_unlock(&_c->route_lock)
 397
 398 static void necp_client_retain_locked(struct necp_client *client);
 399
 400 static bool necp_client_release_locked(struct necp_client *client);
 401 static bool necp_client_release(struct necp_client *client);
 402
 403 static void
 404 necp_client_add_assertion(struct necp_client *client, uuid_t netagent_uuid);
 405
 406 static bool
 407 necp_client_remove_assertion(struct necp_client *client, uuid_t netagent_uuid);
 408
 409 LIST_HEAD(_necp_flow_registration_list, necp_client_flow_registration);
 410 static struct _necp_flow_registration_list necp_collect_stats_flow_list;
 411
 412 struct necp_flow_defunct {
 413         LIST_ENTRY(necp_flow_defunct) chain;
 414
 415         uuid_t flow_id;
 416         uuid_t nexus_agent;
 417         void *agent_handle;
 418         int proc_pid;
 419         u_int32_t flags;
 420         struct necp_client_agent_parameters close_parameters;
 421         bool has_close_parameters;
 422 };
 423
 424 LIST_HEAD(_necp_flow_defunct_list, necp_flow_defunct);
 425
 426 static int necp_client_id_cmp(struct necp_client *client0, struct necp_client *client1);
 427
 428 RB_HEAD(_necp_client_tree, necp_client);
 429 RB_PROTOTYPE_PREV(_necp_client_tree, necp_client, link, necp_client_id_cmp);
 430 RB_GENERATE_PREV(_necp_client_tree, necp_client, link, necp_client_id_cmp);
 431
 432 RB_HEAD(_necp_client_global_tree, necp_client);
 433 RB_PROTOTYPE_PREV(_necp_client_global_tree, necp_client, global_link, necp_client_id_cmp);
 434 RB_GENERATE_PREV(_necp_client_global_tree, necp_client, global_link, necp_client_id_cmp);
 435
 436 RB_HEAD(_necp_fd_flow_tree, necp_client_flow_registration);
 437 RB_PROTOTYPE_PREV(_necp_fd_flow_tree, necp_client_flow_registration, fd_link, necp_client_flow_id_cmp);
 438 RB_GENERATE_PREV(_necp_fd_flow_tree, necp_client_flow_registration, fd_link, necp_client_flow_id_cmp);
 439
 440 RB_HEAD(_necp_client_flow_global_tree, necp_client_flow_registration);
 441 RB_PROTOTYPE_PREV(_necp_client_flow_global_tree, necp_client_flow_registration, global_link, necp_client_flow_id_cmp);
 442 RB_GENERATE_PREV(_necp_client_flow_global_tree, necp_client_flow_registration, global_link, necp_client_flow_id_cmp);
 443
 444 static struct _necp_client_global_tree necp_client_global_tree;
 445 static struct _necp_client_flow_global_tree necp_client_flow_global_tree;
 446
 447 struct necp_client_update {
 448         TAILQ_ENTRY(necp_client_update) chain;
 449
 450         uuid_t client_id;
 451
 452         size_t update_length;
 453         struct necp_client_observer_update update;
 454 };
 455
 456
 457 #define NAIF_ATTACHED   0x1     // arena is attached to list
 458 #define NAIF_REDIRECT   0x2     // arena mmap has been redirected
 459 #define NAIF_DEFUNCT    0x4     // arena is now defunct
 460
 461 struct necp_fd_data {
 462         u_int8_t necp_fd_type;
 463         LIST_ENTRY(necp_fd_data) chain;
 464         struct _necp_client_tree clients;
 465         struct _necp_fd_flow_tree flows;
 466         TAILQ_HEAD(_necp_client_update_list, necp_client_update) update_list;
 467         int update_count;
 468         int flags;
 469
 470         unsigned background : 1;
 471
 472         int proc_pid;
 473         decl_lck_mtx_data(, fd_lock);
 474         struct selinfo si;
 475 };
 476
 477 #define NECP_FD_LOCK(_f) lck_mtx_lock(&_f->fd_lock)
 478 #define NECP_FD_UNLOCK(_f) lck_mtx_unlock(&_f->fd_lock)
 479 #define NECP_FD_ASSERT_LOCKED(_f) LCK_MTX_ASSERT(&_f->fd_lock, LCK_MTX_ASSERT_OWNED)
 480 #define NECP_FD_ASSERT_UNLOCKED(_f) LCK_MTX_ASSERT(&_f->fd_lock, LCK_MTX_ASSERT_NOTOWNED)
 481
 482 static LIST_HEAD(_necp_fd_list, necp_fd_data) necp_fd_list;
 483 static LIST_HEAD(_necp_fd_observer_list, necp_fd_data) necp_fd_observer_list;
 484
 485 #define NECP_CLIENT_FD_ZONE_MAX                 128
 486 #define NECP_CLIENT_FD_ZONE_NAME                "necp.clientfd"
 487
 488 static unsigned int necp_client_fd_size;        /* size of zone element */
 489 static struct zone *necp_client_fd_zone;        /* zone for necp_fd_data */
 490
 491 #define NECP_FLOW_ZONE_NAME                                     "necp.flow"
 492 #define NECP_FLOW_REGISTRATION_ZONE_NAME        "necp.flowregistration"
 493
 494 static unsigned int necp_flow_size;             /* size of necp_client_flow */
 495 static struct mcache *necp_flow_cache;  /* cache for necp_client_flow */
 496
 497 static unsigned int necp_flow_registration_size;        /* size of necp_client_flow_registration */
 498 static struct mcache *necp_flow_registration_cache;     /* cache for necp_client_flow_registration */
 499
 500 #define NECP_ARENA_INFO_ZONE_MAX                128
 501 #define NECP_ARENA_INFO_ZONE_NAME               "necp.arenainfo"
 502
 503
 504 static  lck_grp_attr_t  *necp_fd_grp_attr       = NULL;
 505 static  lck_attr_t              *necp_fd_mtx_attr       = NULL;
 506 static  lck_grp_t               *necp_fd_mtx_grp        = NULL;
 507
 508 decl_lck_rw_data(static, necp_fd_lock);
 509 decl_lck_rw_data(static, necp_observer_lock);
 510 decl_lck_rw_data(static, necp_client_tree_lock);
 511 decl_lck_rw_data(static, necp_flow_tree_lock);
 512 decl_lck_rw_data(static, necp_collect_stats_list_lock);
 513
 514 #define NECP_STATS_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_collect_stats_list_lock)
 515 #define NECP_STATS_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_collect_stats_list_lock)
 516 #define NECP_STATS_LIST_UNLOCK() lck_rw_done(&necp_collect_stats_list_lock)
 517
 518 #define NECP_CLIENT_TREE_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_client_tree_lock)
 519 #define NECP_CLIENT_TREE_LOCK_SHARED() lck_rw_lock_shared(&necp_client_tree_lock)
 520 #define NECP_CLIENT_TREE_UNLOCK() lck_rw_done(&necp_client_tree_lock)
 521 #define NECP_CLIENT_TREE_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_client_tree_lock, LCK_RW_ASSERT_HELD)
 522
 523 #define NECP_FLOW_TREE_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_flow_tree_lock)
 524 #define NECP_FLOW_TREE_LOCK_SHARED() lck_rw_lock_shared(&necp_flow_tree_lock)
 525 #define NECP_FLOW_TREE_UNLOCK() lck_rw_done(&necp_flow_tree_lock)
 526 #define NECP_FLOW_TREE_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_flow_tree_lock, LCK_RW_ASSERT_HELD)
 527
 528 #define NECP_FD_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_fd_lock)
 529 #define NECP_FD_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_fd_lock)
 530 #define NECP_FD_LIST_UNLOCK() lck_rw_done(&necp_fd_lock)
 531
 532 #define NECP_OBSERVER_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_observer_lock)
 533 #define NECP_OBSERVER_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_observer_lock)
 534 #define NECP_OBSERVER_LIST_UNLOCK() lck_rw_done(&necp_observer_lock)
 535
 536 // Locking Notes
 537
 538 // Take NECP_FD_LIST_LOCK when accessing or modifying the necp_fd_list
 539 // Take NECP_CLIENT_TREE_LOCK when accessing or modifying the necp_client_global_tree
 540 // Take NECP_FLOW_TREE_LOCK when accessing or modifying the necp_client_flow_global_tree
 541 // Take NECP_STATS_LIST_LOCK when accessing or modifying the necp_collect_stats_flow_list
 542 // Take NECP_FD_LOCK when accessing or modifying an necp_fd_data entry
 543 // Take NECP_CLIENT_LOCK when accessing or modifying a single necp_client
 544 // Take NECP_CLIENT_ROUTE_LOCK when accessing or modifying a client's route
 545
 546 // Precedence, where 1 is the first lock that must be taken
 547 // 1. NECP_FD_LIST_LOCK
 548 // 2. NECP_FD_LOCK (any)
 549 // 3. NECP_CLIENT_TREE_LOCK
 550 // 4. NECP_CLIENT_LOCK (any)
 551 // 5. NECP_FLOW_TREE_LOCK
 552 // 6. NECP_STATS_LIST_LOCK
 553 // 7. NECP_CLIENT_ROUTE_LOCK (any)
 554
 555 static thread_call_t necp_client_update_tcall;
 556
 557
 558 /// NECP file descriptor functions
 559
 560 static void
 561 necp_fd_notify(struct necp_fd_data *fd_data, bool locked)
 562 {
 563         struct selinfo *si = &fd_data->si;
 564
 565         if (!locked) {
 566                 NECP_FD_LOCK(fd_data);
 567         }
 568
 569         selwakeup(si);
 570
 571         // use a non-zero hint to tell the notification from the
 572         // call done in kqueue_scan() which uses 0
 573         KNOTE(&si->si_note, 1); // notification
 574
 575         if (!locked) {
 576                 NECP_FD_UNLOCK(fd_data);
 577         }
 578 }
 579
 580 static inline bool
 581 necp_client_has_unread_flows(struct necp_client *client)
 582 {
 583         NECP_CLIENT_ASSERT_LOCKED(client);
 584         struct necp_client_flow_registration *flow_registration = NULL;
 585         RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
 586                 if (!flow_registration->flow_result_read) {
 587                         return true;
 588                 }
 589         }
 590         return false;
 591 }
 592
 593 static int
 594 necp_fd_poll(struct necp_fd_data *fd_data, int events, void *wql, struct proc *p, int is_kevent)
 595 {
 596 #pragma unused(wql, p, is_kevent)
 597         u_int revents = 0;
 598
 599         u_int want_rx = events & (POLLIN | POLLRDNORM);
 600         if (want_rx) {
 601                 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
 602                         // Push-mode observers are readable when they have a new update
 603                         if (!TAILQ_EMPTY(&fd_data->update_list)) {
 604                                 revents |= want_rx;
 605                         }
 606                 } else {
 607                         // Standard fds are readable when some client is unread
 608                         struct necp_client *client = NULL;
 609                         bool has_unread_clients = FALSE;
 610                         RB_FOREACH(client, _necp_client_tree, &fd_data->clients) {
 611                                 NECP_CLIENT_LOCK(client);
 612                                 if (!client->result_read || necp_client_has_unread_flows(client)) {
 613                                         has_unread_clients = TRUE;
 614                                 }
 615                                 NECP_CLIENT_UNLOCK(client);
 616                                 if (has_unread_clients) {
 617                                         break;
 618                                 }
 619                         }
 620
 621                         if (has_unread_clients) {
 622                                 revents |= want_rx;
 623                         }
 624                 }
 625         }
 626
 627         return revents;
 628 }
 629
 630 static inline void
 631 necp_generate_client_id(uuid_t client_id, bool is_flow)
 632 {
 633         uuid_generate_random(client_id);
 634
 635         if (is_flow) {
 636                 client_id[9] |= 0x01;
 637         } else {
 638                 client_id[9] &= ~0x01;
 639         }
 640 }
 641
 642 static inline bool
 643 necp_client_id_is_flow(uuid_t client_id)
 644 {
 645         return client_id[9] & 0x01;
 646 }
 647
 648 static struct necp_client *
 649 necp_find_client_and_lock(uuid_t client_id)
 650 {
 651         NECP_CLIENT_TREE_ASSERT_LOCKED();
 652
 653         struct necp_client *client = NULL;
 654
 655         if (necp_client_id_is_flow(client_id)) {
 656                 NECP_FLOW_TREE_LOCK_SHARED();
 657                 struct necp_client_flow_registration find;
 658                 uuid_copy(find.registration_id, client_id);
 659                 struct necp_client_flow_registration *flow = RB_FIND(_necp_client_flow_global_tree, &necp_client_flow_global_tree, &find);
 660                 if (flow != NULL) {
 661                         client = flow->client;
 662                 }
 663                 NECP_FLOW_TREE_UNLOCK();
 664         } else {
 665                 struct necp_client find;
 666                 uuid_copy(find.client_id, client_id);
 667                 client = RB_FIND(_necp_client_global_tree, &necp_client_global_tree, &find);
 668         }
 669
 670         if (client != NULL) {
 671                 NECP_CLIENT_LOCK(client);
 672         }
 673
 674         return client;
 675 }
 676
 677 static struct necp_client_flow_registration *
 678 necp_client_find_flow(struct necp_client *client, uuid_t flow_id)
 679 {
 680         NECP_CLIENT_ASSERT_LOCKED(client);
 681         struct necp_client_flow_registration *flow = NULL;
 682
 683         if (necp_client_id_is_flow(flow_id)) {
 684                 struct necp_client_flow_registration find;
 685                 uuid_copy(find.registration_id, flow_id);
 686                 flow = RB_FIND(_necp_client_flow_tree, &client->flow_registrations, &find);
 687         } else {
 688                 flow = RB_ROOT(&client->flow_registrations);
 689         }
 690
 691         return flow;
 692 }
 693
 694 static struct necp_client *
 695 necp_client_fd_find_client_unlocked(struct necp_fd_data *client_fd, uuid_t client_id)
 696 {
 697         NECP_FD_ASSERT_LOCKED(client_fd);
 698         struct necp_client *client = NULL;
 699
 700         if (necp_client_id_is_flow(client_id)) {
 701                 struct necp_client_flow_registration find;
 702                 uuid_copy(find.registration_id, client_id);
 703                 struct necp_client_flow_registration *flow = RB_FIND(_necp_fd_flow_tree, &client_fd->flows, &find);
 704                 if (flow != NULL) {
 705                         client = flow->client;
 706                 }
 707         } else {
 708                 struct necp_client find;
 709                 uuid_copy(find.client_id, client_id);
 710                 client = RB_FIND(_necp_client_tree, &client_fd->clients, &find);
 711         }
 712
 713         return client;
 714 }
 715
 716 static struct necp_client *
 717 necp_client_fd_find_client_and_lock(struct necp_fd_data *client_fd, uuid_t client_id)
 718 {
 719         struct necp_client *client = necp_client_fd_find_client_unlocked(client_fd, client_id);
 720         if (client != NULL) {
 721                 NECP_CLIENT_LOCK(client);
 722         }
 723
 724         return client;
 725 }
 726
 727 static inline int
 728 necp_client_id_cmp(struct necp_client *client0, struct necp_client *client1)
 729 {
 730         return uuid_compare(client0->client_id, client1->client_id);
 731 }
 732
 733 static inline int
 734 necp_client_flow_id_cmp(struct necp_client_flow_registration *flow0, struct necp_client_flow_registration *flow1)
 735 {
 736         return uuid_compare(flow0->registration_id, flow1->registration_id);
 737 }
 738
 739 static int
 740 necpop_select(struct fileproc *fp, int which, void *wql, vfs_context_t ctx)
 741 {
 742 #pragma unused(fp, which, wql, ctx)
 743         return 0;
 744         struct necp_fd_data *fd_data = NULL;
 745         int revents = 0;
 746         int events = 0;
 747         proc_t procp;
 748
 749         fd_data = (struct necp_fd_data *)fp->f_fglob->fg_data;
 750         if (fd_data == NULL) {
 751                 return 0;
 752         }
 753
 754         procp = vfs_context_proc(ctx);
 755
 756         switch (which) {
 757         case FREAD: {
 758                 events = POLLIN;
 759                 break;
 760         }
 761
 762         default: {
 763                 return 1;
 764         }
 765         }
 766
 767         NECP_FD_LOCK(fd_data);
 768         revents = necp_fd_poll(fd_data, events, wql, procp, 0);
 769         NECP_FD_UNLOCK(fd_data);
 770
 771         return (events & revents) ? 1 : 0;
 772 }
 773
 774 static void
 775 necp_fd_knrdetach(struct knote *kn)
 776 {
 777         struct necp_fd_data *fd_data = (struct necp_fd_data *)kn->kn_hook;
 778         struct selinfo *si = &fd_data->si;
 779
 780         NECP_FD_LOCK(fd_data);
 781         KNOTE_DETACH(&si->si_note, kn);
 782         NECP_FD_UNLOCK(fd_data);
 783 }
 784
 785 static int
 786 necp_fd_knread(struct knote *kn, long hint)
 787 {
 788 #pragma unused(kn, hint)
 789         return 1; /* assume we are ready */
 790 }
 791
 792 static int
 793 necp_fd_knrprocess(struct knote *kn, struct kevent_qos_s *kev)
 794 {
 795         struct necp_fd_data *fd_data;
 796         int revents;
 797         int res;
 798
 799         fd_data = (struct necp_fd_data *)kn->kn_hook;
 800
 801         NECP_FD_LOCK(fd_data);
 802         revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
 803         res = ((revents & POLLIN) != 0);
 804         if (res) {
 805                 knote_fill_kevent(kn, kev, 0);
 806         }
 807         NECP_FD_UNLOCK(fd_data);
 808         return res;
 809 }
 810
 811 static int
 812 necp_fd_knrtouch(struct knote *kn, struct kevent_qos_s *kev)
 813 {
 814 #pragma unused(kev)
 815         struct necp_fd_data *fd_data;
 816         int revents;
 817
 818         fd_data = (struct necp_fd_data *)kn->kn_hook;
 819
 820         NECP_FD_LOCK(fd_data);
 821         revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
 822         NECP_FD_UNLOCK(fd_data);
 823
 824         return (revents & POLLIN) != 0;
 825 }
 826
 827 SECURITY_READ_ONLY_EARLY(struct filterops) necp_fd_rfiltops = {
 828         .f_isfd = 1,
 829         .f_detach = necp_fd_knrdetach,
 830         .f_event = necp_fd_knread,
 831         .f_touch = necp_fd_knrtouch,
 832         .f_process = necp_fd_knrprocess,
 833 };
 834
 835 static int
 836 necpop_kqfilter(struct fileproc *fp, struct knote *kn,
 837     __unused struct kevent_qos_s *kev)
 838 {
 839         struct necp_fd_data *fd_data = NULL;
 840         int revents;
 841
 842         if (kn->kn_filter != EVFILT_READ) {
 843                 NECPLOG(LOG_ERR, "bad filter request %d", kn->kn_filter);
 844                 knote_set_error(kn, EINVAL);
 845                 return 0;
 846         }
 847
 848         fd_data = (struct necp_fd_data *)fp->f_fglob->fg_data;
 849         if (fd_data == NULL) {
 850                 NECPLOG0(LOG_ERR, "No channel for kqfilter");
 851                 knote_set_error(kn, ENOENT);
 852                 return 0;
 853         }
 854
 855         NECP_FD_LOCK(fd_data);
 856         kn->kn_filtid = EVFILTID_NECP_FD;
 857         kn->kn_hook = fd_data;
 858         KNOTE_ATTACH(&fd_data->si.si_note, kn);
 859
 860         revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
 861
 862         NECP_FD_UNLOCK(fd_data);
 863
 864         return (revents & POLLIN) != 0;
 865 }
 866
 867 #define INTERFACE_FLAGS_SHIFT   32
 868 #define INTERFACE_FLAGS_MASK    0xffff
 869 #define INTERFACE_INDEX_SHIFT   0
 870 #define INTERFACE_INDEX_MASK    0xffffffff
 871
 872 static uint64_t
 873 combine_interface_details(uint32_t interface_index, uint16_t interface_flags)
 874 {
 875         return ((uint64_t)interface_flags & INTERFACE_FLAGS_MASK) << INTERFACE_FLAGS_SHIFT |
 876                ((uint64_t)interface_index & INTERFACE_INDEX_MASK) << INTERFACE_INDEX_SHIFT;
 877 }
 878
 879
 880 static void
 881 necp_defunct_flow_registration(struct necp_client *client,
 882     struct necp_client_flow_registration *flow_registration,
 883     struct _necp_flow_defunct_list *defunct_list)
 884 {
 885         NECP_CLIENT_ASSERT_LOCKED(client);
 886
 887         if (!flow_registration->defunct) {
 888                 bool needs_defunct = false;
 889                 struct necp_client_flow *search_flow = NULL;
 890                 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
 891                         if (search_flow->nexus &&
 892                             !uuid_is_null(search_flow->u.nexus_agent)) {
 893                                 // Save defunct values for the nexus
 894                                 if (defunct_list != NULL) {
 895                                         // Sleeping alloc won't fail; copy only what's necessary
 896                                         struct necp_flow_defunct *flow_defunct = _MALLOC(sizeof(struct necp_flow_defunct),
 897                                             M_NECP, M_WAITOK | M_ZERO);
 898                                         uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent);
 899                                         uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
 900                                             client->client_id :
 901                                             flow_registration->registration_id));
 902                                         flow_defunct->proc_pid = client->proc_pid;
 903                                         flow_defunct->agent_handle = client->agent_handle;
 904                                         flow_defunct->flags = flow_registration->flags;
 905                                         // Add to the list provided by caller
 906                                         LIST_INSERT_HEAD(defunct_list, flow_defunct, chain);
 907                                 }
 908
 909                                 needs_defunct = true;
 910                         }
 911                 }
 912
 913                 if (needs_defunct) {
 914
 915                         // Only set defunct if there was some assigned flow
 916                         flow_registration->defunct = true;
 917                 }
 918         }
 919 }
 920
 921 static void
 922 necp_defunct_client_for_policy(struct necp_client *client,
 923     struct _necp_flow_defunct_list *defunct_list)
 924 {
 925         NECP_CLIENT_ASSERT_LOCKED(client);
 926
 927         struct necp_client_flow_registration *flow_registration = NULL;
 928         RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
 929                 necp_defunct_flow_registration(client, flow_registration, defunct_list);
 930         }
 931 }
 932
 933 static void
 934 necp_client_free(struct necp_client *client)
 935 {
 936         NECP_CLIENT_ASSERT_LOCKED(client);
 937
 938         NECP_CLIENT_UNLOCK(client);
 939
 940         FREE(client->extra_interface_options, M_NECP);
 941         client->extra_interface_options = NULL;
 942
 943         lck_mtx_destroy(&client->route_lock, necp_fd_mtx_grp);
 944         lck_mtx_destroy(&client->lock, necp_fd_mtx_grp);
 945
 946         FREE(client, M_NECP);
 947 }
 948
 949 static void
 950 necp_client_retain_locked(struct necp_client *client)
 951 {
 952         NECP_CLIENT_ASSERT_LOCKED(client);
 953
 954         os_ref_retain_locked(&client->reference_count);
 955 }
 956
 957
 958 static bool
 959 necp_client_release_locked(struct necp_client *client)
 960 {
 961         NECP_CLIENT_ASSERT_LOCKED(client);
 962
 963         os_ref_count_t count = os_ref_release_locked(&client->reference_count);
 964         if (count == 0) {
 965                 necp_client_free(client);
 966         }
 967
 968         return count == 0;
 969 }
 970
 971 static bool
 972 necp_client_release(struct necp_client *client)
 973 {
 974         bool last_ref;
 975
 976         NECP_CLIENT_LOCK(client);
 977         if (!(last_ref = necp_client_release_locked(client))) {
 978                 NECP_CLIENT_UNLOCK(client);
 979         }
 980
 981         return last_ref;
 982 }
 983
 984 static void
 985 necp_client_update_observer_add_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
 986 {
 987         NECP_FD_LOCK(observer_fd);
 988
 989         if (observer_fd->update_count >= necp_observer_message_limit) {
 990                 NECP_FD_UNLOCK(observer_fd);
 991                 return;
 992         }
 993
 994         struct necp_client_update *client_update = _MALLOC(sizeof(struct necp_client_update) + client->parameters_length,
 995             M_NECP, M_WAITOK | M_ZERO);
 996         if (client_update != NULL) {
 997                 client_update->update_length = sizeof(struct necp_client_observer_update) + client->parameters_length;
 998                 uuid_copy(client_update->client_id, client->client_id);
 999                 client_update->update.update_type = NECP_CLIENT_UPDATE_TYPE_PARAMETERS;
1000                 memcpy(client_update->update.tlv_buffer, client->parameters, client->parameters_length);
1001                 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1002                 observer_fd->update_count++;
1003
1004                 necp_fd_notify(observer_fd, true);
1005         }
1006
1007         NECP_FD_UNLOCK(observer_fd);
1008 }
1009
1010 static void
1011 necp_client_update_observer_update_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1012 {
1013         NECP_FD_LOCK(observer_fd);
1014
1015         if (observer_fd->update_count >= necp_observer_message_limit) {
1016                 NECP_FD_UNLOCK(observer_fd);
1017                 return;
1018         }
1019
1020         struct necp_client_update *client_update = _MALLOC(sizeof(struct necp_client_update) + client->result_length,
1021             M_NECP, M_WAITOK | M_ZERO);
1022         if (client_update != NULL) {
1023                 client_update->update_length = sizeof(struct necp_client_observer_update) + client->result_length;
1024                 uuid_copy(client_update->client_id, client->client_id);
1025                 client_update->update.update_type = NECP_CLIENT_UPDATE_TYPE_RESULT;
1026                 memcpy(client_update->update.tlv_buffer, client->result, client->result_length);
1027                 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1028                 observer_fd->update_count++;
1029
1030                 necp_fd_notify(observer_fd, true);
1031         }
1032
1033         NECP_FD_UNLOCK(observer_fd);
1034 }
1035
1036 static void
1037 necp_client_update_observer_remove_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1038 {
1039         NECP_FD_LOCK(observer_fd);
1040
1041         if (observer_fd->update_count >= necp_observer_message_limit) {
1042                 NECP_FD_UNLOCK(observer_fd);
1043                 return;
1044         }
1045
1046         struct necp_client_update *client_update = _MALLOC(sizeof(struct necp_client_update),
1047             M_NECP, M_WAITOK | M_ZERO);
1048         if (client_update != NULL) {
1049                 client_update->update_length = sizeof(struct necp_client_observer_update);
1050                 uuid_copy(client_update->client_id, client->client_id);
1051                 client_update->update.update_type = NECP_CLIENT_UPDATE_TYPE_REMOVE;
1052                 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1053                 observer_fd->update_count++;
1054
1055                 necp_fd_notify(observer_fd, true);
1056         }
1057
1058         NECP_FD_UNLOCK(observer_fd);
1059 }
1060
1061 static void
1062 necp_client_update_observer_add(struct necp_client *client)
1063 {
1064         NECP_OBSERVER_LIST_LOCK_SHARED();
1065
1066         if (LIST_EMPTY(&necp_fd_observer_list)) {
1067                 // No observers, bail
1068                 NECP_OBSERVER_LIST_UNLOCK();
1069                 return;
1070         }
1071
1072         struct necp_fd_data *observer_fd = NULL;
1073         LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1074                 necp_client_update_observer_add_internal(observer_fd, client);
1075         }
1076
1077         NECP_OBSERVER_LIST_UNLOCK();
1078 }
1079
1080 static void
1081 necp_client_update_observer_update(struct necp_client *client)
1082 {
1083         NECP_OBSERVER_LIST_LOCK_SHARED();
1084
1085         if (LIST_EMPTY(&necp_fd_observer_list)) {
1086                 // No observers, bail
1087                 NECP_OBSERVER_LIST_UNLOCK();
1088                 return;
1089         }
1090
1091         struct necp_fd_data *observer_fd = NULL;
1092         LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1093                 necp_client_update_observer_update_internal(observer_fd, client);
1094         }
1095
1096         NECP_OBSERVER_LIST_UNLOCK();
1097 }
1098
1099 static void
1100 necp_client_update_observer_remove(struct necp_client *client)
1101 {
1102         NECP_OBSERVER_LIST_LOCK_SHARED();
1103
1104         if (LIST_EMPTY(&necp_fd_observer_list)) {
1105                 // No observers, bail
1106                 NECP_OBSERVER_LIST_UNLOCK();
1107                 return;
1108         }
1109
1110         struct necp_fd_data *observer_fd = NULL;
1111         LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1112                 necp_client_update_observer_remove_internal(observer_fd, client);
1113         }
1114
1115         NECP_OBSERVER_LIST_UNLOCK();
1116 }
1117
1118 static void
1119 necp_destroy_client_flow_registration(struct necp_client *client,
1120     struct necp_client_flow_registration *flow_registration,
1121     pid_t pid, bool abort)
1122 {
1123         NECP_CLIENT_ASSERT_LOCKED(client);
1124
1125         bool has_close_parameters = false;
1126         struct necp_client_agent_parameters close_parameters = {};
1127         memset(close_parameters.u.close_token, 0, sizeof(close_parameters.u.close_token));
1128
1129         struct necp_client_flow *search_flow = NULL;
1130         struct necp_client_flow *temp_flow = NULL;
1131         LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
1132                 if (search_flow->nexus &&
1133                     !uuid_is_null(search_flow->u.nexus_agent)) {
1134                         // Note that if we had defuncted the client earlier, this would result in a harmless ENOENT
1135                         u_int8_t message_type = (abort ? NETAGENT_MESSAGE_TYPE_ABORT_NEXUS :
1136                             NETAGENT_MESSAGE_TYPE_CLOSE_NEXUS);
1137                         if (((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
1138                             (flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
1139                             !(flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
1140                                 message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
1141                         }
1142                         int netagent_error = netagent_client_message_with_params(search_flow->u.nexus_agent,
1143                             ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
1144                             client->client_id :
1145                             flow_registration->registration_id),
1146                             pid, client->agent_handle,
1147                             message_type,
1148                             has_close_parameters ? &close_parameters : NULL,
1149                             NULL, 0);
1150                         if (netagent_error != 0 && netagent_error != ENOENT) {
1151                                 NECPLOG(LOG_ERR, "necp_client_remove close nexus error (%d) MESSAGE TYPE %u", netagent_error, message_type);
1152                         }
1153                         uuid_clear(search_flow->u.nexus_agent);
1154                 }
1155                 if (search_flow->assigned_results != NULL) {
1156                         FREE(search_flow->assigned_results, M_NETAGENT);
1157                         search_flow->assigned_results = NULL;
1158                 }
1159                 LIST_REMOVE(search_flow, flow_chain);
1160                 if (search_flow->socket) {
1161                         OSDecrementAtomic(&necp_socket_flow_count);
1162                 } else {
1163                         OSDecrementAtomic(&necp_if_flow_count);
1164                 }
1165                 mcache_free(necp_flow_cache, search_flow);
1166         }
1167
1168         RB_REMOVE(_necp_client_flow_tree, &client->flow_registrations, flow_registration);
1169         flow_registration->client = NULL;
1170
1171         mcache_free(necp_flow_registration_cache, flow_registration);
1172 }
1173
1174 static void
1175 necp_destroy_client(struct necp_client *client, pid_t pid, bool abort)
1176 {
1177         NECP_CLIENT_ASSERT_UNLOCKED(client);
1178
1179         necp_client_update_observer_remove(client);
1180
1181         NECP_CLIENT_LOCK(client);
1182
1183         // Free route
1184         NECP_CLIENT_ROUTE_LOCK(client);
1185         if (client->current_route != NULL) {
1186                 rtfree(client->current_route);
1187                 client->current_route = NULL;
1188         }
1189         NECP_CLIENT_ROUTE_UNLOCK(client);
1190
1191         // Remove flow assignments
1192         struct necp_client_flow_registration *flow_registration = NULL;
1193         struct necp_client_flow_registration *temp_flow_registration = NULL;
1194         RB_FOREACH_SAFE(flow_registration, _necp_client_flow_tree, &client->flow_registrations, temp_flow_registration) {
1195                 necp_destroy_client_flow_registration(client, flow_registration, pid, abort);
1196         }
1197
1198
1199         // Remove agent assertions
1200         struct necp_client_assertion *search_assertion = NULL;
1201         struct necp_client_assertion *temp_assertion = NULL;
1202         LIST_FOREACH_SAFE(search_assertion, &client->assertion_list, assertion_chain, temp_assertion) {
1203                 int netagent_error = netagent_client_message(search_assertion->asserted_netagent, client->client_id, pid,
1204                     client->agent_handle, NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT);
1205                 if (netagent_error != 0) {
1206                         NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR),
1207                             "necp_client_remove unassert agent error (%d)", netagent_error);
1208                 }
1209                 LIST_REMOVE(search_assertion, assertion_chain);
1210                 FREE(search_assertion, M_NECP);
1211         }
1212
1213         if (!necp_client_release_locked(client)) {
1214                 NECP_CLIENT_UNLOCK(client);
1215         }
1216
1217         OSDecrementAtomic(&necp_client_count);
1218 }
1219
1220 static int
1221 necpop_close(struct fileglob *fg, vfs_context_t ctx)
1222 {
1223 #pragma unused(ctx)
1224         struct necp_fd_data *fd_data = NULL;
1225         int error = 0;
1226
1227         fd_data = (struct necp_fd_data *)fg->fg_data;
1228         fg->fg_data = NULL;
1229
1230         if (fd_data != NULL) {
1231                 struct _necp_client_tree clients_to_close;
1232                 RB_INIT(&clients_to_close);
1233
1234                 // Remove from list quickly
1235                 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
1236                         NECP_OBSERVER_LIST_LOCK_EXCLUSIVE();
1237                         LIST_REMOVE(fd_data, chain);
1238                         NECP_OBSERVER_LIST_UNLOCK();
1239                 } else {
1240                         NECP_FD_LIST_LOCK_EXCLUSIVE();
1241                         LIST_REMOVE(fd_data, chain);
1242                         NECP_FD_LIST_UNLOCK();
1243                 }
1244
1245                 NECP_FD_LOCK(fd_data);
1246                 pid_t pid = fd_data->proc_pid;
1247
1248                 struct necp_client_flow_registration *flow_registration = NULL;
1249                 struct necp_client_flow_registration *temp_flow_registration = NULL;
1250                 RB_FOREACH_SAFE(flow_registration, _necp_fd_flow_tree, &fd_data->flows, temp_flow_registration) {
1251                         NECP_FLOW_TREE_LOCK_EXCLUSIVE();
1252                         RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
1253                         NECP_FLOW_TREE_UNLOCK();
1254                         RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
1255                 }
1256
1257                 struct necp_client *client = NULL;
1258                 struct necp_client *temp_client = NULL;
1259                 RB_FOREACH_SAFE(client, _necp_client_tree, &fd_data->clients, temp_client) {
1260                         NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
1261                         RB_REMOVE(_necp_client_global_tree, &necp_client_global_tree, client);
1262                         NECP_CLIENT_TREE_UNLOCK();
1263                         RB_REMOVE(_necp_client_tree, &fd_data->clients, client);
1264                         RB_INSERT(_necp_client_tree, &clients_to_close, client);
1265                 }
1266
1267                 struct necp_client_update *client_update = NULL;
1268                 struct necp_client_update *temp_update = NULL;
1269                 TAILQ_FOREACH_SAFE(client_update, &fd_data->update_list, chain, temp_update) {
1270                         // Flush pending updates
1271                         TAILQ_REMOVE(&fd_data->update_list, client_update, chain);
1272                         FREE(client_update, M_NECP);
1273                 }
1274                 fd_data->update_count = 0;
1275
1276
1277                 NECP_FD_UNLOCK(fd_data);
1278
1279                 selthreadclear(&fd_data->si);
1280
1281                 lck_mtx_destroy(&fd_data->fd_lock, necp_fd_mtx_grp);
1282
1283                 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
1284                         OSDecrementAtomic(&necp_observer_fd_count);
1285                 } else {
1286                         OSDecrementAtomic(&necp_client_fd_count);
1287                 }
1288
1289                 zfree(necp_client_fd_zone, fd_data);
1290                 fd_data = NULL;
1291
1292                 RB_FOREACH_SAFE(client, _necp_client_tree, &clients_to_close, temp_client) {
1293                         RB_REMOVE(_necp_client_tree, &clients_to_close, client);
1294                         necp_destroy_client(client, pid, true);
1295                 }
1296         }
1297
1298         return error;
1299 }
1300
1301 /// NECP client utilities
1302
1303 static inline bool
1304 necp_address_is_wildcard(const union necp_sockaddr_union * const addr)
1305 {
1306         return (addr->sa.sa_family == AF_INET && addr->sin.sin_addr.s_addr == INADDR_ANY) ||
1307                (addr->sa.sa_family == AF_INET6 && IN6_IS_ADDR_UNSPECIFIED(&addr->sin6.sin6_addr));
1308 }
1309
1310 static int
1311 necp_find_fd_data(int fd, struct necp_fd_data **fd_data)
1312 {
1313         proc_t p = current_proc();
1314         struct fileproc *fp = NULL;
1315         int error = 0;
1316
1317         proc_fdlock_spin(p);
1318         if ((error = fp_lookup(p, fd, &fp, 1)) != 0) {
1319                 goto done;
1320         }
1321         if (fp->f_fglob->fg_ops->fo_type != DTYPE_NETPOLICY) {
1322                 fp_drop(p, fd, fp, 1);
1323                 error = ENODEV;
1324                 goto done;
1325         }
1326         *fd_data = (struct necp_fd_data *)fp->f_fglob->fg_data;
1327
1328         if ((*fd_data)->necp_fd_type != necp_fd_type_client) {
1329                 // Not a client fd, ignore
1330                 fp_drop(p, fd, fp, 1);
1331                 error = EINVAL;
1332                 goto done;
1333         }
1334
1335 done:
1336         proc_fdunlock(p);
1337         return error;
1338 }
1339
1340
1341 static struct necp_client_flow *
1342 necp_client_add_interface_flow(struct necp_client_flow_registration *flow_registration,
1343     uint32_t interface_index)
1344 {
1345         struct necp_client_flow *new_flow = mcache_alloc(necp_flow_cache, MCR_SLEEP);
1346         if (new_flow == NULL) {
1347                 NECPLOG0(LOG_ERR, "Failed to allocate interface flow");
1348                 return NULL;
1349         }
1350
1351         memset(new_flow, 0, sizeof(*new_flow));
1352
1353         // Neither nexus nor socket
1354         new_flow->interface_index = interface_index;
1355         new_flow->u.socket_handle = flow_registration->interface_handle;
1356         new_flow->u.cb = flow_registration->interface_cb;
1357
1358         OSIncrementAtomic(&necp_if_flow_count);
1359
1360         LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
1361
1362         return new_flow;
1363 }
1364
1365 static struct necp_client_flow *
1366 necp_client_add_interface_flow_if_needed(struct necp_client *client,
1367     struct necp_client_flow_registration *flow_registration,
1368     uint32_t interface_index)
1369 {
1370         if (!client->allow_multiple_flows ||
1371             interface_index == IFSCOPE_NONE) {
1372                 // Interface not set, or client not allowed to use this mode
1373                 return NULL;
1374         }
1375
1376         struct necp_client_flow *flow = NULL;
1377         LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1378                 if (!flow->nexus && !flow->socket && flow->interface_index == interface_index) {
1379                         // Already have the flow
1380                         flow->invalid = FALSE;
1381                         flow->u.socket_handle = flow_registration->interface_handle;
1382                         flow->u.cb = flow_registration->interface_cb;
1383                         return NULL;
1384                 }
1385         }
1386         return necp_client_add_interface_flow(flow_registration, interface_index);
1387 }
1388
1389 static void
1390 necp_client_add_interface_option_if_needed(struct necp_client *client,
1391     uint32_t interface_index,
1392     uint32_t interface_generation,
1393     uuid_t *nexus_agent)
1394 {
1395         if (interface_index == IFSCOPE_NONE ||
1396             (client->interface_option_count != 0 && !client->allow_multiple_flows)) {
1397                 // Interface not set, or client not allowed to use this mode
1398                 return;
1399         }
1400
1401         if (client->interface_option_count >= NECP_CLIENT_MAX_INTERFACE_OPTIONS) {
1402                 // Cannot take any more interface options
1403                 return;
1404         }
1405
1406         // Check if already present
1407         for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
1408                 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
1409                         struct necp_client_interface_option *option = &client->interface_options[option_i];
1410                         if (option->interface_index == interface_index) {
1411                                 if (nexus_agent == NULL) {
1412                                         return;
1413                                 }
1414                                 if (uuid_compare(option->nexus_agent, *nexus_agent) == 0) {
1415                                         return;
1416                                 }
1417                                 if (uuid_is_null(option->nexus_agent)) {
1418                                         uuid_copy(option->nexus_agent, *nexus_agent);
1419                                         return;
1420                                 }
1421                                 // If we get to this point, this is a new nexus flow
1422                         }
1423                 } else {
1424                         struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
1425                         if (option->interface_index == interface_index) {
1426                                 if (nexus_agent == NULL) {
1427                                         return;
1428                                 }
1429                                 if (uuid_compare(option->nexus_agent, *nexus_agent) == 0) {
1430                                         return;
1431                                 }
1432                                 if (uuid_is_null(option->nexus_agent)) {
1433                                         uuid_copy(option->nexus_agent, *nexus_agent);
1434                                         return;
1435                                 }
1436                                 // If we get to this point, this is a new nexus flow
1437                         }
1438                 }
1439         }
1440
1441         // Add a new entry
1442         if (client->interface_option_count < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
1443                 // Add to static
1444                 struct necp_client_interface_option *option = &client->interface_options[client->interface_option_count];
1445                 option->interface_index = interface_index;
1446                 option->interface_generation = interface_generation;
1447                 if (nexus_agent != NULL) {
1448                         uuid_copy(option->nexus_agent, *nexus_agent);
1449                 } else {
1450                         uuid_clear(option->nexus_agent);
1451                 }
1452                 client->interface_option_count++;
1453         } else {
1454                 // Add to extra
1455                 if (client->extra_interface_options == NULL) {
1456                         client->extra_interface_options = _MALLOC(sizeof(struct necp_client_interface_option) * NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT, M_NECP, M_WAITOK | M_ZERO);
1457                 }
1458                 if (client->extra_interface_options != NULL) {
1459                         struct necp_client_interface_option *option = &client->extra_interface_options[client->interface_option_count - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
1460                         option->interface_index = interface_index;
1461                         option->interface_generation = interface_generation;
1462                         if (nexus_agent != NULL) {
1463                                 uuid_copy(option->nexus_agent, *nexus_agent);
1464                         } else {
1465                                 uuid_clear(option->nexus_agent);
1466                         }
1467                         client->interface_option_count++;
1468                 }
1469         }
1470 }
1471
1472 static bool
1473 necp_client_flow_is_viable(proc_t proc, struct necp_client *client,
1474     struct necp_client_flow *flow)
1475 {
1476         struct necp_aggregate_result result;
1477         bool ignore_address = (client->allow_multiple_flows && !flow->nexus && !flow->socket);
1478
1479         flow->necp_flow_flags = 0;
1480         int error = necp_application_find_policy_match_internal(proc, client->parameters,
1481             (u_int32_t)client->parameters_length,
1482             &result, &flow->necp_flow_flags, NULL,
1483             flow->interface_index,
1484             &flow->local_addr, &flow->remote_addr, NULL, NULL,
1485             NULL, ignore_address, true);
1486
1487         // Check for blocking agents
1488         for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
1489                 if (uuid_is_null(result.netagents[i])) {
1490                         // Passed end of valid agents
1491                         break;
1492                 }
1493
1494                 u_int32_t flags = netagent_get_flags(result.netagents[i]);
1495                 if ((flags & NETAGENT_FLAG_REGISTERED) &&
1496                     !(flags & NETAGENT_FLAG_VOLUNTARY) &&
1497                     !(flags & NETAGENT_FLAG_ACTIVE) &&
1498                     !(flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY)) {
1499                         // A required agent is not active, cause the flow to be marked non-viable
1500                         return false;
1501                 }
1502         }
1503
1504         return error == 0 &&
1505                result.routed_interface_index != IFSCOPE_NONE &&
1506                result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP;
1507 }
1508
1509 static void
1510 necp_flow_add_interface_flows(proc_t proc,
1511     struct necp_client *client,
1512     struct necp_client_flow_registration *flow_registration,
1513     bool send_initial)
1514 {
1515         // Traverse all interfaces and add a tracking flow if needed
1516         for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
1517                 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
1518                         struct necp_client_interface_option *option = &client->interface_options[option_i];
1519                         struct necp_client_flow *flow = necp_client_add_interface_flow_if_needed(client, flow_registration, option->interface_index);
1520                         if (flow != NULL && send_initial) {
1521                                 flow->viable = necp_client_flow_is_viable(proc, client, flow);
1522                                 if (flow->viable && flow->u.cb) {
1523                                         bool viable = flow->viable;
1524                                         flow->u.cb(flow_registration->interface_handle, NECP_CLIENT_CBACTION_INITIAL, flow->interface_index, flow->necp_flow_flags, &viable);
1525                                         flow->viable = viable;
1526                                 }
1527                         }
1528                 } else {
1529                         struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
1530                         struct necp_client_flow *flow = necp_client_add_interface_flow_if_needed(client, flow_registration, option->interface_index);
1531                         if (flow != NULL && send_initial) {
1532                                 flow->viable = necp_client_flow_is_viable(proc, client, flow);
1533                                 if (flow->viable && flow->u.cb) {
1534                                         bool viable = flow->viable;
1535                                         flow->u.cb(flow_registration->interface_handle, NECP_CLIENT_CBACTION_INITIAL, flow->interface_index, flow->necp_flow_flags, &viable);
1536                                         flow->viable = viable;
1537                                 }
1538                         }
1539                 }
1540         }
1541 }
1542
1543 static bool
1544 necp_client_update_flows(proc_t proc,
1545     struct necp_client *client,
1546     struct _necp_flow_defunct_list *defunct_list)
1547 {
1548         NECP_CLIENT_ASSERT_LOCKED(client);
1549
1550         bool client_updated = FALSE;
1551         struct necp_client_flow *flow = NULL;
1552         struct necp_client_flow *temp_flow = NULL;
1553         struct necp_client_flow_registration *flow_registration = NULL;
1554         RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
1555                 if (flow_registration->interface_cb != NULL) {
1556                         // Add any interface flows that are not already tracked
1557                         necp_flow_add_interface_flows(proc, client, flow_registration, false);
1558                 }
1559
1560                 LIST_FOREACH_SAFE(flow, &flow_registration->flow_list, flow_chain, temp_flow) {
1561                         // Check policy result for flow
1562                         int old_flags = flow->necp_flow_flags;
1563                         bool viable = necp_client_flow_is_viable(proc, client, flow);
1564
1565                         // TODO: Defunct nexus flows that are blocked by policy
1566
1567                         if (flow->viable != viable) {
1568                                 flow->viable = viable;
1569                                 client_updated = TRUE;
1570                         }
1571
1572                         if ((old_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE) !=
1573                             (flow->necp_flow_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE)) {
1574                                 client_updated = TRUE;
1575                         }
1576
1577                         if (flow->viable && client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) {
1578                                 bool flow_viable = flow->viable;
1579                                 flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_VIABLE, flow->interface_index, flow->necp_flow_flags, &flow_viable);
1580                                 flow->viable = flow_viable;
1581                         }
1582
1583                         if (!flow->viable || flow->invalid) {
1584                                 if (client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) {
1585                                         bool flow_viable = flow->viable;
1586                                         flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_NONVIABLE, flow->interface_index, flow->necp_flow_flags, &flow_viable);
1587                                         flow->viable = flow_viable;
1588                                 }
1589                                 // The callback might change the viable-flag of the
1590                                 // flow depending on its policy. Thus, we need to
1591                                 // check the flags again after the callback.
1592                         }
1593
1594                         (void)defunct_list;
1595
1596                         // Handle flows that no longer match
1597                         if (!flow->viable || flow->invalid) {
1598                                 // Drop them as long as they aren't assigned data
1599                                 if (!flow->nexus && !flow->assigned) {
1600                                         if (flow->assigned_results != NULL) {
1601                                                 FREE(flow->assigned_results, M_NETAGENT);
1602                                                 flow->assigned_results = NULL;
1603                                                 client_updated = TRUE;
1604                                         }
1605                                         LIST_REMOVE(flow, flow_chain);
1606                                         if (flow->socket) {
1607                                                 OSDecrementAtomic(&necp_socket_flow_count);
1608                                         } else {
1609                                                 OSDecrementAtomic(&necp_if_flow_count);
1610                                         }
1611                                         mcache_free(necp_flow_cache, flow);
1612                                 }
1613                         }
1614                 }
1615         }
1616
1617         return client_updated;
1618 }
1619
1620 static void
1621 necp_client_mark_all_nonsocket_flows_as_invalid(struct necp_client *client)
1622 {
1623         struct necp_client_flow_registration *flow_registration = NULL;
1624         struct necp_client_flow *flow = NULL;
1625         RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
1626                 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1627                         if (!flow->socket) { // Socket flows are not marked as invalid
1628                                 flow->invalid = TRUE;
1629                         }
1630                 }
1631         }
1632
1633         // Reset option count every update
1634         client->interface_option_count = 0;
1635 }
1636
1637 static bool
1638 necp_netagent_applies_to_client(struct necp_client *client,
1639     const struct necp_client_parsed_parameters *parameters,
1640     uuid_t *netagent_uuid, bool allow_nexus,
1641     uint32_t interface_index, uint32_t interface_generation)
1642 {
1643 #pragma unused(interface_index, interface_generation)
1644         bool applies = FALSE;
1645         u_int32_t flags = netagent_get_flags(*netagent_uuid);
1646         if (!(flags & NETAGENT_FLAG_REGISTERED)) {
1647                 // Unregistered agents never apply
1648                 return applies;
1649         }
1650
1651         const bool is_nexus_agent = ((flags & NETAGENT_FLAG_NEXUS_PROVIDER) ||
1652             (flags & NETAGENT_FLAG_NEXUS_LISTENER) ||
1653             (flags & NETAGENT_FLAG_CUSTOM_ETHER_NEXUS) ||
1654             (flags & NETAGENT_FLAG_CUSTOM_IP_NEXUS) ||
1655             (flags & NETAGENT_FLAG_INTERPOSE_NEXUS));
1656         if (is_nexus_agent) {
1657                 if (!allow_nexus) {
1658                         // Hide nexus providers unless allowed
1659                         // Direct interfaces and direct policies are allowed to use a nexus
1660                         // Delegate interfaces or re-scoped interfaces are not allowed
1661                         return applies;
1662                 }
1663
1664                 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) &&
1665                     !(flags & NETAGENT_FLAG_CUSTOM_ETHER_NEXUS)) {
1666                         // Client requested a custom ether nexus, but this nexus isn't one
1667                         return applies;
1668                 }
1669
1670                 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP) &&
1671                     !(flags & NETAGENT_FLAG_CUSTOM_IP_NEXUS)) {
1672                         // Client requested a custom IP nexus, but this nexus isn't one
1673                         return applies;
1674                 }
1675
1676                 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) &&
1677                     !(flags & NETAGENT_FLAG_INTERPOSE_NEXUS)) {
1678                         // Client requested an interpose nexus, but this nexus isn't one
1679                         return applies;
1680                 }
1681
1682                 if (!(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) &&
1683                     !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP) &&
1684                     !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) &&
1685                     !(flags & NETAGENT_FLAG_NEXUS_PROVIDER)) {
1686                         // Client requested default parameters, but this nexus isn't generic
1687                         return applies;
1688                 }
1689         }
1690
1691         if (uuid_compare(client->failed_trigger_agent.netagent_uuid, *netagent_uuid) == 0) {
1692                 if (client->failed_trigger_agent.generation == netagent_get_generation(*netagent_uuid)) {
1693                         // If this agent was triggered, and failed, and hasn't changed, keep hiding it
1694                         return applies;
1695                 } else {
1696                         // Mismatch generation, clear out old trigger
1697                         uuid_clear(client->failed_trigger_agent.netagent_uuid);
1698                         client->failed_trigger_agent.generation = 0;
1699                 }
1700         }
1701
1702         if (flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY) {
1703                 // Specific use agents only apply when required
1704                 bool required = FALSE;
1705                 if (parameters != NULL) {
1706                         // Check required agent UUIDs
1707                         for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
1708                                 if (uuid_is_null(parameters->required_netagents[i])) {
1709                                         break;
1710                                 }
1711                                 if (uuid_compare(parameters->required_netagents[i], *netagent_uuid) == 0) {
1712                                         required = TRUE;
1713                                         break;
1714                                 }
1715                         }
1716
1717                         if (!required) {
1718                                 // Check required agent types
1719                                 bool fetched_type = FALSE;
1720                                 char netagent_domain[NETAGENT_DOMAINSIZE];
1721                                 char netagent_type[NETAGENT_TYPESIZE];
1722                                 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
1723                                 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
1724
1725                                 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
1726                                         if (strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
1727                                             strlen(parameters->required_netagent_types[i].netagent_type) == 0) {
1728                                                 break;
1729                                         }
1730
1731                                         if (!fetched_type) {
1732                                                 if (netagent_get_agent_domain_and_type(*netagent_uuid, netagent_domain, netagent_type)) {
1733                                                         fetched_type = TRUE;
1734                                                 } else {
1735                                                         break;
1736                                                 }
1737                                         }
1738
1739                                         if ((strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
1740                                             strncmp(netagent_domain, parameters->required_netagent_types[i].netagent_domain, NETAGENT_DOMAINSIZE) == 0) &&
1741                                             (strlen(parameters->required_netagent_types[i].netagent_type) == 0 ||
1742                                             strncmp(netagent_type, parameters->required_netagent_types[i].netagent_type, NETAGENT_TYPESIZE) == 0)) {
1743                                                 required = TRUE;
1744                                                 break;
1745                                         }
1746                                 }
1747                         }
1748                 }
1749
1750                 applies = required;
1751         } else {
1752                 applies = TRUE;
1753         }
1754
1755
1756         return applies;
1757 }
1758
1759 static void
1760 necp_client_add_agent_interface_options(struct necp_client *client,
1761     const struct necp_client_parsed_parameters *parsed_parameters,
1762     ifnet_t ifp)
1763 {
1764         if (ifp != NULL && ifp->if_agentids != NULL) {
1765                 for (u_int32_t i = 0; i < ifp->if_agentcount; i++) {
1766                         if (uuid_is_null(ifp->if_agentids[i])) {
1767                                 continue;
1768                         }
1769                         // Relies on the side effect that nexus agents that apply will create flows
1770                         (void)necp_netagent_applies_to_client(client, parsed_parameters, &ifp->if_agentids[i], TRUE,
1771                             ifp->if_index, ifnet_get_generation(ifp));
1772                 }
1773         }
1774 }
1775
1776 static inline bool
1777 necp_client_address_is_valid(struct sockaddr *address)
1778 {
1779         if (address->sa_family == AF_INET) {
1780                 return address->sa_len == sizeof(struct sockaddr_in);
1781         } else if (address->sa_family == AF_INET6) {
1782                 return address->sa_len == sizeof(struct sockaddr_in6);
1783         } else {
1784                 return FALSE;
1785         }
1786 }
1787
1788 static inline bool
1789 necp_client_endpoint_is_unspecified(struct necp_client_endpoint *endpoint)
1790 {
1791         if (necp_client_address_is_valid(&endpoint->u.sa)) {
1792                 if (endpoint->u.sa.sa_family == AF_INET) {
1793                         return endpoint->u.sin.sin_addr.s_addr == INADDR_ANY;
1794                 } else if (endpoint->u.sa.sa_family == AF_INET6) {
1795                         return IN6_IS_ADDR_UNSPECIFIED(&endpoint->u.sin6.sin6_addr);
1796                 } else {
1797                         return TRUE;
1798                 }
1799         } else {
1800                 return TRUE;
1801         }
1802 }
1803
1804
1805 static int
1806 necp_client_parse_parameters(u_int8_t *parameters,
1807     u_int32_t parameters_size,
1808     struct necp_client_parsed_parameters *parsed_parameters)
1809 {
1810         int error = 0;
1811         size_t offset = 0;
1812
1813         u_int32_t num_prohibited_interfaces = 0;
1814         u_int32_t num_prohibited_interface_types = 0;
1815         u_int32_t num_required_agents = 0;
1816         u_int32_t num_prohibited_agents = 0;
1817         u_int32_t num_preferred_agents = 0;
1818         u_int32_t num_avoided_agents = 0;
1819         u_int32_t num_required_agent_types = 0;
1820         u_int32_t num_prohibited_agent_types = 0;
1821         u_int32_t num_preferred_agent_types = 0;
1822         u_int32_t num_avoided_agent_types = 0;
1823         u_int8_t *resolver_tag = NULL;
1824         u_int32_t resolver_tag_length = 0;
1825         u_int8_t *client_hostname = NULL;
1826         u_int32_t hostname_length = 0;
1827         uuid_t parent_id = {};
1828
1829         if (parsed_parameters == NULL) {
1830                 return EINVAL;
1831         }
1832
1833         memset(parsed_parameters, 0, sizeof(struct necp_client_parsed_parameters));
1834
1835         while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
1836                 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
1837                 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
1838
1839                 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
1840                         // If the length is larger than what can fit in the remaining parameters size, bail
1841                         NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
1842                         break;
1843                 }
1844
1845                 if (length > 0) {
1846                         u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
1847                         if (value != NULL) {
1848                                 switch (type) {
1849                                 case NECP_CLIENT_PARAMETER_BOUND_INTERFACE: {
1850                                         if (length <= IFXNAMSIZ && length > 0) {
1851                                                 ifnet_t bound_interface = NULL;
1852                                                 char interface_name[IFXNAMSIZ];
1853                                                 memcpy(interface_name, value, length);
1854                                                 interface_name[length - 1] = 0;         // Make sure the string is NULL terminated
1855                                                 if (ifnet_find_by_name(interface_name, &bound_interface) == 0) {
1856                                                         parsed_parameters->required_interface_index = bound_interface->if_index;
1857                                                         parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF;
1858                                                         ifnet_release(bound_interface);
1859                                                 }
1860                                         }
1861                                         break;
1862                                 }
1863                                 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: {
1864                                         if (length >= sizeof(struct necp_policy_condition_addr)) {
1865                                                 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
1866                                                 if (necp_client_address_is_valid(&address_struct->address.sa)) {
1867                                                         memcpy(&parsed_parameters->local_addr, &address_struct->address, sizeof(address_struct->address));
1868                                                         if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
1869                                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
1870                                                         }
1871                                                         if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
1872                                                             (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
1873                                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
1874                                                         }
1875                                                 }
1876                                         }
1877                                         break;
1878                                 }
1879                                 case NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT: {
1880                                         if (length >= sizeof(struct necp_client_endpoint)) {
1881                                                 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
1882                                                 if (necp_client_address_is_valid(&endpoint->u.sa)) {
1883                                                         memcpy(&parsed_parameters->local_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
1884                                                         if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
1885                                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
1886                                                         }
1887                                                         if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
1888                                                             (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
1889                                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
1890                                                         }
1891                                                 }
1892                                         }
1893                                         break;
1894                                 }
1895                                 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
1896                                         if (length >= sizeof(struct necp_policy_condition_addr)) {
1897                                                 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
1898                                                 if (necp_client_address_is_valid(&address_struct->address.sa)) {
1899                                                         memcpy(&parsed_parameters->remote_addr, &address_struct->address, sizeof(address_struct->address));
1900                                                         parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
1901                                                 }
1902                                         }
1903                                         break;
1904                                 }
1905                                 case NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT: {
1906                                         if (length >= sizeof(struct necp_client_endpoint)) {
1907                                                 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
1908                                                 if (necp_client_address_is_valid(&endpoint->u.sa)) {
1909                                                         memcpy(&parsed_parameters->remote_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
1910                                                         parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
1911                                                 }
1912                                         }
1913                                         break;
1914                                 }
1915                                 case NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE: {
1916                                         if (num_prohibited_interfaces >= NECP_MAX_INTERFACE_PARAMETERS) {
1917                                                 break;
1918                                         }
1919                                         if (length <= IFXNAMSIZ && length > 0) {
1920                                                 memcpy(parsed_parameters->prohibited_interfaces[num_prohibited_interfaces], value, length);
1921                                                 parsed_parameters->prohibited_interfaces[num_prohibited_interfaces][length - 1] = 0;         // Make sure the string is NULL terminated
1922                                                 num_prohibited_interfaces++;
1923                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF;
1924                                         }
1925                                         break;
1926                                 }
1927                                 case NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE: {
1928                                         if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) {
1929                                                 break;
1930                                         }
1931                                         if (length >= sizeof(u_int8_t)) {
1932                                                 memcpy(&parsed_parameters->required_interface_type, value, sizeof(u_int8_t));
1933                                                 if (parsed_parameters->required_interface_type) {
1934                                                         parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE;
1935                                                 }
1936                                         }
1937                                         break;
1938                                 }
1939                                 case NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE: {
1940                                         if (num_prohibited_interface_types >= NECP_MAX_INTERFACE_PARAMETERS) {
1941                                                 break;
1942                                         }
1943                                         if (length >= sizeof(u_int8_t)) {
1944                                                 memcpy(&parsed_parameters->prohibited_interface_types[num_prohibited_interface_types], value, sizeof(u_int8_t));
1945                                                 num_prohibited_interface_types++;
1946                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE;
1947                                         }
1948                                         break;
1949                                 }
1950                                 case NECP_CLIENT_PARAMETER_REQUIRE_AGENT: {
1951                                         if (num_required_agents >= NECP_MAX_AGENT_PARAMETERS) {
1952                                                 break;
1953                                         }
1954                                         if (length >= sizeof(uuid_t)) {
1955                                                 memcpy(&parsed_parameters->required_netagents[num_required_agents], value, sizeof(uuid_t));
1956                                                 num_required_agents++;
1957                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT;
1958                                         }
1959                                         break;
1960                                 }
1961                                 case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT: {
1962                                         if (num_prohibited_agents >= NECP_MAX_AGENT_PARAMETERS) {
1963                                                 break;
1964                                         }
1965                                         if (length >= sizeof(uuid_t)) {
1966                                                 memcpy(&parsed_parameters->prohibited_netagents[num_prohibited_agents], value, sizeof(uuid_t));
1967                                                 num_prohibited_agents++;
1968                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT;
1969                                         }
1970                                         break;
1971                                 }
1972                                 case NECP_CLIENT_PARAMETER_PREFER_AGENT: {
1973                                         if (num_preferred_agents >= NECP_MAX_AGENT_PARAMETERS) {
1974                                                 break;
1975                                         }
1976                                         if (length >= sizeof(uuid_t)) {
1977                                                 memcpy(&parsed_parameters->preferred_netagents[num_preferred_agents], value, sizeof(uuid_t));
1978                                                 num_preferred_agents++;
1979                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT;
1980                                         }
1981                                         break;
1982                                 }
1983                                 case NECP_CLIENT_PARAMETER_AVOID_AGENT: {
1984                                         if (num_avoided_agents >= NECP_MAX_AGENT_PARAMETERS) {
1985                                                 break;
1986                                         }
1987                                         if (length >= sizeof(uuid_t)) {
1988                                                 memcpy(&parsed_parameters->avoided_netagents[num_avoided_agents], value, sizeof(uuid_t));
1989                                                 num_avoided_agents++;
1990                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT;
1991                                         }
1992                                         break;
1993                                 }
1994                                 case NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE: {
1995                                         if (num_required_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
1996                                                 break;
1997                                         }
1998                                         if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
1999                                                 memcpy(&parsed_parameters->required_netagent_types[num_required_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2000                                                 num_required_agent_types++;
2001                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE;
2002                                         }
2003                                         break;
2004                                 }
2005                                 case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE: {
2006                                         if (num_prohibited_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2007                                                 break;
2008                                         }
2009                                         if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2010                                                 memcpy(&parsed_parameters->prohibited_netagent_types[num_prohibited_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2011                                                 num_prohibited_agent_types++;
2012                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE;
2013                                         }
2014                                         break;
2015                                 }
2016                                 case NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE: {
2017                                         if (num_preferred_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2018                                                 break;
2019                                         }
2020                                         if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2021                                                 memcpy(&parsed_parameters->preferred_netagent_types[num_preferred_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2022                                                 num_preferred_agent_types++;
2023                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE;
2024                                         }
2025                                         break;
2026                                 }
2027                                 case NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE: {
2028                                         if (num_avoided_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2029                                                 break;
2030                                         }
2031                                         if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2032                                                 memcpy(&parsed_parameters->avoided_netagent_types[num_avoided_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2033                                                 num_avoided_agent_types++;
2034                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE;
2035                                         }
2036                                         break;
2037                                 }
2038                                 case NECP_CLIENT_PARAMETER_FLAGS: {
2039                                         if (length >= sizeof(u_int32_t)) {
2040                                                 memcpy(&parsed_parameters->flags, value, sizeof(parsed_parameters->flags));
2041                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_FLAGS;
2042                                         }
2043                                         break;
2044                                 }
2045                                 case NECP_CLIENT_PARAMETER_IP_PROTOCOL: {
2046                                         if (length == sizeof(u_int16_t)) {
2047                                                 u_int16_t large_ip_protocol = 0;
2048                                                 memcpy(&large_ip_protocol, value, sizeof(large_ip_protocol));
2049                                                 parsed_parameters->ip_protocol = (u_int8_t)large_ip_protocol;
2050                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL;
2051                                         } else if (length >= sizeof(parsed_parameters->ip_protocol)) {
2052                                                 memcpy(&parsed_parameters->ip_protocol, value, sizeof(parsed_parameters->ip_protocol));
2053                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL;
2054                                         }
2055                                         break;
2056                                 }
2057                                 case NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL: {
2058                                         if (length >= sizeof(parsed_parameters->transport_protocol)) {
2059                                                 memcpy(&parsed_parameters->transport_protocol, value, sizeof(parsed_parameters->transport_protocol));
2060                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL;
2061                                         }
2062                                         break;
2063                                 }
2064                                 case NECP_CLIENT_PARAMETER_PID: {
2065                                         if (length >= sizeof(parsed_parameters->effective_pid)) {
2066                                                 memcpy(&parsed_parameters->effective_pid, value, sizeof(parsed_parameters->effective_pid));
2067                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID;
2068                                         }
2069                                         break;
2070                                 }
2071                                 case NECP_CLIENT_PARAMETER_DELEGATED_UPID: {
2072                                         if (length >= sizeof(parsed_parameters->delegated_upid)) {
2073                                                 memcpy(&parsed_parameters->delegated_upid, value, sizeof(parsed_parameters->delegated_upid));
2074                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID;
2075                                         }
2076                                         break;
2077                                 }
2078                                 case NECP_CLIENT_PARAMETER_ETHERTYPE: {
2079                                         if (length >= sizeof(parsed_parameters->ethertype)) {
2080                                                 memcpy(&parsed_parameters->ethertype, value, sizeof(parsed_parameters->ethertype));
2081                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_ETHERTYPE;
2082                                         }
2083                                         break;
2084                                 }
2085                                 case NECP_CLIENT_PARAMETER_APPLICATION: {
2086                                         if (length >= sizeof(parsed_parameters->effective_uuid)) {
2087                                                 memcpy(&parsed_parameters->effective_uuid, value, sizeof(parsed_parameters->effective_uuid));
2088                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID;
2089                                         }
2090                                         break;
2091                                 }
2092                                 case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: {
2093                                         if (length >= sizeof(parsed_parameters->traffic_class)) {
2094                                                 memcpy(&parsed_parameters->traffic_class, value, sizeof(parsed_parameters->traffic_class));
2095                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS;
2096                                         }
2097                                         break;
2098                                 }
2099                                 case NECP_CLIENT_PARAMETER_RESOLVER_TAG: {
2100                                         if (length > 0) {
2101                                                 resolver_tag = (u_int8_t *)value;
2102                                                 resolver_tag_length = length;
2103                                         }
2104                                         break;
2105                                 }
2106                                 case NECP_CLIENT_PARAMETER_DOMAIN: {
2107                                         if (length > 0) {
2108                                                 client_hostname = (u_int8_t *)value;
2109                                                 hostname_length = length;
2110                                         }
2111                                         break;
2112                                 }
2113                                 case NECP_CLIENT_PARAMETER_PARENT_ID: {
2114                                         if (length == sizeof(parent_id)) {
2115                                                 uuid_copy(parent_id, value);
2116                                         }
2117                                         break;
2118                                 }
2119                                 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE: {
2120                                         if (length >= sizeof(parsed_parameters->local_address_preference)) {
2121                                                 memcpy(&parsed_parameters->local_address_preference, value, sizeof(parsed_parameters->local_address_preference));
2122                                                 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE;
2123                                         }
2124                                         break;
2125                                 }
2126                                 default: {
2127                                         break;
2128                                 }
2129                                 }
2130                         }
2131                 }
2132
2133                 offset += sizeof(struct necp_tlv_header) + length;
2134         }
2135
2136         if (resolver_tag != NULL) {
2137                 union necp_sockaddr_union remote_addr;
2138                 memcpy(&remote_addr, &parsed_parameters->remote_addr, sizeof(remote_addr));
2139                 remote_addr.sin.sin_port = 0;
2140                 const bool validated = necp_validate_resolver_answer(parent_id,
2141                     client_hostname, hostname_length,
2142                     (u_int8_t *)&remote_addr, sizeof(remote_addr),
2143                     resolver_tag, resolver_tag_length);
2144                 if (!validated) {
2145                         error = EAUTH;
2146                         NECPLOG(LOG_ERR, "Failed to validate answer for hostname %s", client_hostname);
2147                 }
2148         }
2149
2150         return error;
2151 }
2152
2153 static int
2154 necp_client_parse_result(u_int8_t *result,
2155     u_int32_t result_size,
2156     union necp_sockaddr_union *local_address,
2157     union necp_sockaddr_union *remote_address,
2158     void **flow_stats)
2159 {
2160 #pragma unused(flow_stats)
2161         int error = 0;
2162         size_t offset = 0;
2163
2164         while ((offset + sizeof(struct necp_tlv_header)) <= result_size) {
2165                 u_int8_t type = necp_buffer_get_tlv_type(result, offset);
2166                 u_int32_t length = necp_buffer_get_tlv_length(result, offset);
2167
2168                 if (length > 0 && (offset + sizeof(struct necp_tlv_header) + length) <= result_size) {
2169                         u_int8_t *value = necp_buffer_get_tlv_value(result, offset, NULL);
2170                         if (value != NULL) {
2171                                 switch (type) {
2172                                 case NECP_CLIENT_RESULT_LOCAL_ENDPOINT: {
2173                                         if (length >= sizeof(struct necp_client_endpoint)) {
2174                                                 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2175                                                 if (local_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
2176                                                         memcpy(local_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
2177                                                 }
2178                                         }
2179                                         break;
2180                                 }
2181                                 case NECP_CLIENT_RESULT_REMOTE_ENDPOINT: {
2182                                         if (length >= sizeof(struct necp_client_endpoint)) {
2183                                                 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2184                                                 if (remote_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
2185                                                         memcpy(remote_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
2186                                                 }
2187                                         }
2188                                         break;
2189                                 }
2190                                 default: {
2191                                         break;
2192                                 }
2193                                 }
2194                         }
2195                 }
2196
2197                 offset += sizeof(struct necp_tlv_header) + length;
2198         }
2199
2200         return error;
2201 }
2202
2203 static struct necp_client_flow_registration *
2204 necp_client_create_flow_registration(struct necp_fd_data *fd_data, struct necp_client *client)
2205 {
2206         NECP_FD_ASSERT_LOCKED(fd_data);
2207         NECP_CLIENT_ASSERT_LOCKED(client);
2208
2209         struct necp_client_flow_registration *new_registration = mcache_alloc(necp_flow_registration_cache, MCR_SLEEP);
2210         if (new_registration == NULL) {
2211                 return NULL;
2212         }
2213
2214         memset(new_registration, 0, sizeof(*new_registration));
2215
2216         new_registration->last_interface_details = combine_interface_details(IFSCOPE_NONE, NSTAT_IFNET_IS_UNKNOWN_TYPE);
2217
2218         necp_generate_client_id(new_registration->registration_id, true);
2219         LIST_INIT(&new_registration->flow_list);
2220
2221         // Add registration to client list
2222         RB_INSERT(_necp_client_flow_tree, &client->flow_registrations, new_registration);
2223
2224         // Add registration to fd list
2225         RB_INSERT(_necp_fd_flow_tree, &fd_data->flows, new_registration);
2226
2227         // Add registration to global tree for lookup
2228         NECP_FLOW_TREE_LOCK_EXCLUSIVE();
2229         RB_INSERT(_necp_client_flow_global_tree, &necp_client_flow_global_tree, new_registration);
2230         NECP_FLOW_TREE_UNLOCK();
2231
2232         new_registration->client = client;
2233
2234         // Start out assuming there is nothing to read from the flow
2235         new_registration->flow_result_read = true;
2236
2237         return new_registration;
2238 }
2239
2240 static void
2241 necp_client_add_socket_flow(struct necp_client_flow_registration *flow_registration,
2242     struct inpcb *inp)
2243 {
2244         struct necp_client_flow *new_flow = mcache_alloc(necp_flow_cache, MCR_SLEEP);
2245         if (new_flow == NULL) {
2246                 NECPLOG0(LOG_ERR, "Failed to allocate socket flow");
2247                 return;
2248         }
2249
2250         memset(new_flow, 0, sizeof(*new_flow));
2251
2252         new_flow->socket = TRUE;
2253         new_flow->u.socket_handle = inp;
2254         new_flow->u.cb = inp->necp_cb;
2255
2256         OSIncrementAtomic(&necp_socket_flow_count);
2257
2258         LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
2259 }
2260
2261 static int
2262 necp_client_register_socket_inner(pid_t pid, uuid_t client_id, struct inpcb *inp, bool is_listener)
2263 {
2264         int error = 0;
2265         struct necp_fd_data *client_fd = NULL;
2266         bool found_client = FALSE;
2267
2268         NECP_FD_LIST_LOCK_SHARED();
2269         LIST_FOREACH(client_fd, &necp_fd_list, chain) {
2270                 NECP_FD_LOCK(client_fd);
2271                 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
2272                 if (client != NULL) {
2273                         if (!pid || client->proc_pid == pid) {
2274                                 if (is_listener) {
2275                                         found_client = TRUE;
2276                                 } else {
2277                                         // Find client flow and assign from socket
2278                                         struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
2279                                         if (flow_registration != NULL) {
2280                                                 // Found the right client and flow registration, add a new flow
2281                                                 found_client = TRUE;
2282                                                 necp_client_add_socket_flow(flow_registration, inp);
2283                                         } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
2284                                                 // No flows yet on this client, add a new registration
2285                                                 flow_registration = necp_client_create_flow_registration(client_fd, client);
2286                                                 if (flow_registration == NULL) {
2287                                                         error = ENOMEM;
2288                                                 } else {
2289                                                         // Add a new flow
2290                                                         found_client = TRUE;
2291                                                         necp_client_add_socket_flow(flow_registration, inp);
2292                                                 }
2293                                         }
2294                                 }
2295                         }
2296
2297                         NECP_CLIENT_UNLOCK(client);
2298                 }
2299                 NECP_FD_UNLOCK(client_fd);
2300
2301                 if (found_client) {
2302                         break;
2303                 }
2304         }
2305         NECP_FD_LIST_UNLOCK();
2306
2307         if (!found_client) {
2308                 error = ENOENT;
2309         } else {
2310                 // Count the sockets that have the NECP client UUID set
2311                 struct socket *so = inp->inp_socket;
2312                 if (!(so->so_flags1 & SOF1_HAS_NECP_CLIENT_UUID)) {
2313                         so->so_flags1 |= SOF1_HAS_NECP_CLIENT_UUID;
2314                         INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_necp_clientuuid_total);
2315                 }
2316         }
2317
2318         return error;
2319 }
2320
2321 int
2322 necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp)
2323 {
2324         return necp_client_register_socket_inner(pid, client_id, inp, false);
2325 }
2326
2327 int
2328 necp_client_register_socket_listener(pid_t pid, uuid_t client_id, struct inpcb *inp)
2329 {
2330         return necp_client_register_socket_inner(pid, client_id, inp, true);
2331 }
2332
2333
2334 static void
2335 necp_client_add_multipath_interface_flows(struct necp_client_flow_registration *flow_registration,
2336     struct necp_client *client,
2337     struct mppcb *mpp)
2338 {
2339         flow_registration->interface_handle = mpp;
2340         flow_registration->interface_cb = mpp->necp_cb;
2341
2342         proc_t proc = proc_find(client->proc_pid);
2343         if (proc == PROC_NULL) {
2344                 return;
2345         }
2346
2347         // Traverse all interfaces and add a tracking flow if needed
2348         necp_flow_add_interface_flows(proc, client, flow_registration, true);
2349
2350         proc_rele(proc);
2351         proc = PROC_NULL;
2352 }
2353
2354 int
2355 necp_client_register_multipath_cb(pid_t pid, uuid_t client_id, struct mppcb *mpp)
2356 {
2357         int error = 0;
2358         struct necp_fd_data *client_fd = NULL;
2359         bool found_client = FALSE;
2360
2361         NECP_FD_LIST_LOCK_SHARED();
2362         LIST_FOREACH(client_fd, &necp_fd_list, chain) {
2363                 NECP_FD_LOCK(client_fd);
2364                 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
2365                 if (client != NULL) {
2366                         if (!pid || client->proc_pid == pid) {
2367                                 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
2368                                 if (flow_registration != NULL) {
2369                                         // Found the right client and flow registration, add a new flow
2370                                         found_client = TRUE;
2371                                         necp_client_add_multipath_interface_flows(flow_registration, client, mpp);
2372                                 } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
2373                                         // No flows yet on this client, add a new registration
2374                                         flow_registration = necp_client_create_flow_registration(client_fd, client);
2375                                         if (flow_registration == NULL) {
2376                                                 error = ENOMEM;
2377                                         } else {
2378                                                 // Add a new flow
2379                                                 found_client = TRUE;
2380                                                 necp_client_add_multipath_interface_flows(flow_registration, client, mpp);
2381                                         }
2382                                 }
2383                         }
2384
2385                         NECP_CLIENT_UNLOCK(client);
2386                 }
2387                 NECP_FD_UNLOCK(client_fd);
2388
2389                 if (found_client) {
2390                         break;
2391                 }
2392         }
2393         NECP_FD_LIST_UNLOCK();
2394
2395         if (!found_client && error == 0) {
2396                 error = ENOENT;
2397         }
2398
2399         return error;
2400 }
2401
2402 #define NETAGENT_DOMAIN_RADIO_MANAGER   "WirelessRadioManager"
2403 #define NETAGENT_TYPE_RADIO_MANAGER     "WirelessRadioManager:BB Manager"
2404
2405 static int
2406 necp_client_lookup_bb_radio_manager(struct necp_client *client,
2407     uuid_t netagent_uuid)
2408 {
2409         char netagent_domain[NETAGENT_DOMAINSIZE];
2410         char netagent_type[NETAGENT_TYPESIZE];
2411         struct necp_aggregate_result result;
2412         proc_t proc;
2413         int error;
2414
2415         proc = proc_find(client->proc_pid);
2416         if (proc == PROC_NULL) {
2417                 return ESRCH;
2418         }
2419
2420         error = necp_application_find_policy_match_internal(proc, client->parameters, (u_int32_t)client->parameters_length,
2421             &result, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL, true, true);
2422
2423         proc_rele(proc);
2424         proc = PROC_NULL;
2425
2426         if (error) {
2427                 return error;
2428         }
2429
2430         for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
2431                 if (uuid_is_null(result.netagents[i])) {
2432                         // Passed end of valid agents
2433                         break;
2434                 }
2435
2436                 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
2437                 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
2438                 if (netagent_get_agent_domain_and_type(result.netagents[i], netagent_domain, netagent_type) == FALSE) {
2439                         continue;
2440                 }
2441
2442                 if (strncmp(netagent_domain, NETAGENT_DOMAIN_RADIO_MANAGER, NETAGENT_DOMAINSIZE) != 0) {
2443                         continue;
2444                 }
2445
2446                 if (strncmp(netagent_type, NETAGENT_TYPE_RADIO_MANAGER, NETAGENT_TYPESIZE) != 0) {
2447                         continue;
2448                 }
2449
2450                 uuid_copy(netagent_uuid, result.netagents[i]);
2451
2452                 break;
2453         }
2454
2455         return 0;
2456 }
2457
2458 static int
2459 necp_client_assert_bb_radio_manager_common(struct necp_client *client, bool assert)
2460 {
2461         uuid_t netagent_uuid;
2462         uint8_t assert_type;
2463         int error;
2464
2465         error = necp_client_lookup_bb_radio_manager(client, netagent_uuid);
2466         if (error) {
2467                 NECPLOG0(LOG_ERR, "BB radio manager agent not found");
2468                 return error;
2469         }
2470
2471         // Before unasserting, verify that the assertion was already taken
2472         if (assert == FALSE) {
2473                 assert_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
2474
2475                 if (!necp_client_remove_assertion(client, netagent_uuid)) {
2476                         return EINVAL;
2477                 }
2478         } else {
2479                 assert_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT;
2480         }
2481
2482         error = netagent_client_message(netagent_uuid, client->client_id, client->proc_pid, client->agent_handle, assert_type);
2483         if (error) {
2484                 NECPLOG0(LOG_ERR, "netagent_client_message failed");
2485                 return error;
2486         }
2487
2488         // Only save the assertion if the action succeeded
2489         if (assert == TRUE) {
2490                 necp_client_add_assertion(client, netagent_uuid);
2491         }
2492
2493         return 0;
2494 }
2495
2496 int
2497 necp_client_assert_bb_radio_manager(uuid_t client_id, bool assert)
2498 {
2499         struct necp_client *client;
2500         int error = 0;
2501
2502         NECP_CLIENT_TREE_LOCK_SHARED();
2503
2504         client = necp_find_client_and_lock(client_id);
2505
2506         if (client) {
2507                 // Found the right client!
2508                 error = necp_client_assert_bb_radio_manager_common(client, assert);
2509
2510                 NECP_CLIENT_UNLOCK(client);
2511         } else {
2512                 NECPLOG0(LOG_ERR, "Couldn't find client");
2513                 error = ENOENT;
2514         }
2515
2516         NECP_CLIENT_TREE_UNLOCK();
2517
2518         return error;
2519 }
2520
2521 static int
2522 necp_client_unregister_socket_flow(uuid_t client_id, void *handle)
2523 {
2524         int error = 0;
2525         struct necp_fd_data *client_fd = NULL;
2526         bool found_client = FALSE;
2527         bool client_updated = FALSE;
2528
2529         NECP_FD_LIST_LOCK_SHARED();
2530         LIST_FOREACH(client_fd, &necp_fd_list, chain) {
2531                 NECP_FD_LOCK(client_fd);
2532
2533                 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
2534                 if (client != NULL) {
2535                         struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
2536                         if (flow_registration != NULL) {
2537                                 // Found the right client and flow!
2538                                 found_client = TRUE;
2539
2540                                 // Remove flow assignment
2541                                 struct necp_client_flow *search_flow = NULL;
2542                                 struct necp_client_flow *temp_flow = NULL;
2543                                 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
2544                                         if (search_flow->socket && search_flow->u.socket_handle == handle) {
2545                                                 if (search_flow->assigned_results != NULL) {
2546                                                         FREE(search_flow->assigned_results, M_NETAGENT);
2547                                                         search_flow->assigned_results = NULL;
2548                                                 }
2549                                                 client_updated = TRUE;
2550                                                 flow_registration->flow_result_read = FALSE;
2551                                                 LIST_REMOVE(search_flow, flow_chain);
2552                                                 OSDecrementAtomic(&necp_socket_flow_count);
2553                                                 mcache_free(necp_flow_cache, search_flow);
2554                                         }
2555                                 }
2556                         }
2557
2558                         NECP_CLIENT_UNLOCK(client);
2559                 }
2560
2561                 if (client_updated) {
2562                         necp_fd_notify(client_fd, true);
2563                 }
2564                 NECP_FD_UNLOCK(client_fd);
2565
2566                 if (found_client) {
2567                         break;
2568                 }
2569         }
2570         NECP_FD_LIST_UNLOCK();
2571
2572         if (!found_client) {
2573                 error = ENOENT;
2574         }
2575
2576         return error;
2577 }
2578
2579 static int
2580 necp_client_unregister_multipath_cb(uuid_t client_id, void *handle)
2581 {
2582         int error = 0;
2583         bool found_client = FALSE;
2584
2585         NECP_CLIENT_TREE_LOCK_SHARED();
2586
2587         struct necp_client *client = necp_find_client_and_lock(client_id);
2588         if (client != NULL) {
2589                 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
2590                 if (flow_registration != NULL) {
2591                         // Found the right client and flow!
2592                         found_client = TRUE;
2593
2594                         // Remove flow assignment
2595                         struct necp_client_flow *search_flow = NULL;
2596                         struct necp_client_flow *temp_flow = NULL;
2597                         LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
2598                                 if (!search_flow->socket && !search_flow->nexus &&
2599                                     search_flow->u.socket_handle == handle) {
2600                                         search_flow->u.socket_handle = NULL;
2601                                         search_flow->u.cb = NULL;
2602                                 }
2603                         }
2604
2605                         flow_registration->interface_handle = NULL;
2606                         flow_registration->interface_cb = NULL;
2607                 }
2608
2609                 NECP_CLIENT_UNLOCK(client);
2610         }
2611
2612         NECP_CLIENT_TREE_UNLOCK();
2613
2614         if (!found_client) {
2615                 error = ENOENT;
2616         }
2617
2618         return error;
2619 }
2620
2621 int
2622 necp_client_assign_from_socket(pid_t pid, uuid_t client_id, struct inpcb *inp)
2623 {
2624         int error = 0;
2625         struct necp_fd_data *client_fd = NULL;
2626         bool found_client = FALSE;
2627         bool client_updated = FALSE;
2628
2629         NECP_FD_LIST_LOCK_SHARED();
2630         LIST_FOREACH(client_fd, &necp_fd_list, chain) {
2631                 if (pid && client_fd->proc_pid != pid) {
2632                         continue;
2633                 }
2634
2635                 proc_t proc = proc_find(client_fd->proc_pid);
2636                 if (proc == PROC_NULL) {
2637                         continue;
2638                 }
2639
2640                 NECP_FD_LOCK(client_fd);
2641
2642                 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
2643                 if (client != NULL) {
2644                         struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
2645                         if (flow_registration == NULL && RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
2646                                 // No flows yet on this client, add a new registration
2647                                 flow_registration = necp_client_create_flow_registration(client_fd, client);
2648                                 if (flow_registration == NULL) {
2649                                         error = ENOMEM;
2650                                 }
2651                         }
2652                         if (flow_registration != NULL) {
2653                                 // Found the right client and flow!
2654                                 found_client = TRUE;
2655
2656                                 struct necp_client_flow *flow = NULL;
2657                                 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
2658                                         if (flow->socket && flow->u.socket_handle == inp) {
2659                                                 // Release prior results and route
2660                                                 if (flow->assigned_results != NULL) {
2661                                                         FREE(flow->assigned_results, M_NETAGENT);
2662                                                         flow->assigned_results = NULL;
2663                                                 }
2664
2665                                                 ifnet_t ifp = NULL;
2666                                                 if ((inp->inp_flags & INP_BOUND_IF) && inp->inp_boundifp) {
2667                                                         ifp = inp->inp_boundifp;
2668                                                 } else {
2669                                                         ifp = inp->inp_last_outifp;
2670                                                 }
2671
2672                                                 if (ifp != NULL) {
2673                                                         flow->interface_index = ifp->if_index;
2674                                                 } else {
2675                                                         flow->interface_index = IFSCOPE_NONE;
2676                                                 }
2677
2678                                                 if (inp->inp_vflag & INP_IPV4) {
2679                                                         flow->local_addr.sin.sin_family = AF_INET;
2680                                                         flow->local_addr.sin.sin_len = sizeof(struct sockaddr_in);
2681                                                         flow->local_addr.sin.sin_port = inp->inp_lport;
2682                                                         memcpy(&flow->local_addr.sin.sin_addr, &inp->inp_laddr, sizeof(struct in_addr));
2683
2684                                                         flow->remote_addr.sin.sin_family = AF_INET;
2685                                                         flow->remote_addr.sin.sin_len = sizeof(struct sockaddr_in);
2686                                                         flow->remote_addr.sin.sin_port = inp->inp_fport;
2687                                                         memcpy(&flow->remote_addr.sin.sin_addr, &inp->inp_faddr, sizeof(struct in_addr));
2688                                                 } else if (inp->inp_vflag & INP_IPV6) {
2689                                                         in6_ip6_to_sockaddr(&inp->in6p_laddr, inp->inp_lport, &flow->local_addr.sin6, sizeof(flow->local_addr));
2690                                                         in6_ip6_to_sockaddr(&inp->in6p_faddr, inp->inp_fport, &flow->remote_addr.sin6, sizeof(flow->remote_addr));
2691                                                 }
2692
2693                                                 flow->viable = necp_client_flow_is_viable(proc, client, flow);
2694
2695                                                 uuid_t empty_uuid;
2696                                                 uuid_clear(empty_uuid);
2697                                                 flow->assigned = TRUE;
2698                                                 flow->assigned_results = necp_create_nexus_assign_message(empty_uuid, 0, NULL, 0,
2699                                                     (struct necp_client_endpoint *)&flow->local_addr,
2700                                                     (struct necp_client_endpoint *)&flow->remote_addr,
2701                                                     NULL, 0, NULL, &flow->assigned_results_length);
2702                                                 flow_registration->flow_result_read = FALSE;
2703                                                 client_updated = TRUE;
2704                                                 break;
2705                                         }
2706                                 }
2707                         }
2708
2709                         NECP_CLIENT_UNLOCK(client);
2710                 }
2711                 if (client_updated) {
2712                         necp_fd_notify(client_fd, true);
2713                 }
2714                 NECP_FD_UNLOCK(client_fd);
2715
2716                 proc_rele(proc);
2717                 proc = PROC_NULL;
2718
2719                 if (found_client) {
2720                         break;
2721                 }
2722         }
2723         NECP_FD_LIST_UNLOCK();
2724
2725         if (error == 0) {
2726                 if (!found_client) {
2727                         error = ENOENT;
2728                 } else if (!client_updated) {
2729                         error = EINVAL;
2730                 }
2731         }
2732
2733         return error;
2734 }
2735
2736 bool
2737 necp_socket_is_allowed_to_recv_on_interface(struct inpcb *inp, ifnet_t interface)
2738 {
2739         if (interface == NULL ||
2740             inp == NULL ||
2741             !(inp->inp_flags2 & INP2_EXTERNAL_PORT) ||
2742             uuid_is_null(inp->necp_client_uuid)) {
2743                 // If there's no interface or client ID to check,
2744                 // or if this is not a listener, pass.
2745                 // Outbound connections will have already been
2746                 // validated for policy.
2747                 return TRUE;
2748         }
2749
2750         // Only filter out listener sockets (no remote address specified)
2751         if ((inp->inp_vflag & INP_IPV4) &&
2752             inp->inp_faddr.s_addr != INADDR_ANY) {
2753                 return TRUE;
2754         }
2755         if ((inp->inp_vflag & INP_IPV6) &&
2756             !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
2757                 return TRUE;
2758         }
2759
2760         bool allowed = TRUE;
2761
2762         NECP_CLIENT_TREE_LOCK_SHARED();
2763
2764         struct necp_client *client = necp_find_client_and_lock(inp->necp_client_uuid);
2765         if (client != NULL) {
2766                 struct necp_client_parsed_parameters *parsed_parameters = NULL;
2767
2768                 MALLOC(parsed_parameters, struct necp_client_parsed_parameters *, sizeof(*parsed_parameters), M_NECP, (M_WAITOK | M_ZERO));
2769                 if (parsed_parameters != NULL) {
2770                         int error = necp_client_parse_parameters(client->parameters, (u_int32_t)client->parameters_length, parsed_parameters);
2771                         if (error == 0) {
2772                                 if (!necp_ifnet_matches_parameters(interface, parsed_parameters, 0, NULL, true, false)) {
2773                                         allowed = FALSE;
2774                                 }
2775                         }
2776                         FREE(parsed_parameters, M_NECP);
2777                 }
2778
2779                 NECP_CLIENT_UNLOCK(client);
2780         }
2781
2782         NECP_CLIENT_TREE_UNLOCK();
2783
2784         return allowed;
2785 }
2786
2787 int
2788 necp_update_flow_protoctl_event(uuid_t netagent_uuid, uuid_t client_id,
2789     uint32_t protoctl_event_code, uint32_t protoctl_event_val,
2790     uint32_t protoctl_event_tcp_seq_number)
2791 {
2792         int error = 0;
2793         struct necp_fd_data *client_fd = NULL;
2794         bool found_client = FALSE;
2795         bool client_updated = FALSE;
2796
2797         NECP_FD_LIST_LOCK_SHARED();
2798         LIST_FOREACH(client_fd, &necp_fd_list, chain) {
2799                 proc_t proc = proc_find(client_fd->proc_pid);
2800                 if (proc == PROC_NULL) {
2801                         continue;
2802                 }
2803
2804                 NECP_FD_LOCK(client_fd);
2805
2806                 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
2807                 if (client != NULL) {
2808                         struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
2809                         if (flow_registration != NULL) {
2810                                 // Found the right client and flow!
2811                                 found_client = TRUE;
2812
2813                                 struct necp_client_flow *flow = NULL;
2814                                 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
2815                                         // Verify that the client nexus agent matches
2816                                         if (flow->nexus &&
2817                                             uuid_compare(flow->u.nexus_agent,
2818                                             netagent_uuid) == 0) {
2819                                                 flow->has_protoctl_event = TRUE;
2820                                                 flow->protoctl_event.protoctl_event_code = protoctl_event_code;
2821                                                 flow->protoctl_event.protoctl_event_val = protoctl_event_val;
2822                                                 flow->protoctl_event.protoctl_event_tcp_seq_num = protoctl_event_tcp_seq_number;
2823                                                 flow_registration->flow_result_read = FALSE;
2824                                                 client_updated = TRUE;
2825                                                 break;
2826                                         }
2827                                 }
2828                         }
2829
2830                         NECP_CLIENT_UNLOCK(client);
2831                 }
2832
2833                 if (client_updated) {
2834                         necp_fd_notify(client_fd, true);
2835                 }
2836
2837                 NECP_FD_UNLOCK(client_fd);
2838                 proc_rele(proc);
2839                 proc = PROC_NULL;
2840
2841                 if (found_client) {
2842                         break;
2843                 }
2844         }
2845         NECP_FD_LIST_UNLOCK();
2846
2847         if (!found_client) {
2848                 error = ENOENT;
2849         } else if (!client_updated) {
2850                 error = EINVAL;
2851         }
2852         return error;
2853 }
2854
2855 static bool
2856 necp_assign_client_result_locked(struct proc *proc,
2857     struct necp_fd_data *client_fd,
2858     struct necp_client *client,
2859     struct necp_client_flow_registration *flow_registration,
2860     uuid_t netagent_uuid,
2861     u_int8_t *assigned_results,
2862     size_t assigned_results_length,
2863     bool notify_fd)
2864 {
2865         bool client_updated = FALSE;
2866
2867         NECP_FD_ASSERT_LOCKED(client_fd);
2868         NECP_CLIENT_ASSERT_LOCKED(client);
2869
2870         struct necp_client_flow *flow = NULL;
2871         LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
2872                 // Verify that the client nexus agent matches
2873                 if (flow->nexus &&
2874                     uuid_compare(flow->u.nexus_agent, netagent_uuid) == 0) {
2875                         // Release prior results and route
2876                         if (flow->assigned_results != NULL) {
2877                                 FREE(flow->assigned_results, M_NETAGENT);
2878                                 flow->assigned_results = NULL;
2879                         }
2880
2881                         void *nexus_stats = NULL;
2882                         if (assigned_results != NULL && assigned_results_length > 0) {
2883                                 int error = necp_client_parse_result(assigned_results, (u_int32_t)assigned_results_length,
2884                                     &flow->local_addr, &flow->remote_addr, &nexus_stats);
2885                                 VERIFY(error == 0);
2886                         }
2887
2888                         flow->viable = necp_client_flow_is_viable(proc, client, flow);
2889
2890                         flow->assigned = TRUE;
2891                         flow->assigned_results = assigned_results;
2892                         flow->assigned_results_length = assigned_results_length;
2893                         flow_registration->flow_result_read = FALSE;
2894                         client_updated = TRUE;
2895                         break;
2896                 }
2897         }
2898
2899         if (client_updated && notify_fd) {
2900                 necp_fd_notify(client_fd, true);
2901         }
2902
2903         // if not updated, client must free assigned_results
2904         return client_updated;
2905 }
2906
2907 int
2908 necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id,
2909     u_int8_t *assigned_results, size_t assigned_results_length)
2910 {
2911         int error = 0;
2912         struct necp_fd_data *client_fd = NULL;
2913         bool found_client = FALSE;
2914         bool client_updated = FALSE;
2915
2916         NECP_FD_LIST_LOCK_SHARED();
2917
2918         LIST_FOREACH(client_fd, &necp_fd_list, chain) {
2919                 proc_t proc = proc_find(client_fd->proc_pid);
2920                 if (proc == PROC_NULL) {
2921                         continue;
2922                 }
2923
2924                 NECP_FD_LOCK(client_fd);
2925                 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
2926                 if (client != NULL) {
2927                         struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
2928                         if (flow_registration != NULL) {
2929                                 // Found the right client and flow!
2930                                 found_client = TRUE;
2931                                 if (necp_assign_client_result_locked(proc, client_fd, client, flow_registration, netagent_uuid,
2932                                     assigned_results, assigned_results_length, true)) {
2933                                         client_updated = TRUE;
2934                                 }
2935                         }
2936
2937                         NECP_CLIENT_UNLOCK(client);
2938                 }
2939                 NECP_FD_UNLOCK(client_fd);
2940
2941                 proc_rele(proc);
2942                 proc = PROC_NULL;
2943
2944                 if (found_client) {
2945                         break;
2946                 }
2947         }
2948
2949         NECP_FD_LIST_UNLOCK();
2950
2951         // upon error, client must free assigned_results
2952         if (!found_client) {
2953                 error = ENOENT;
2954         } else if (!client_updated) {
2955                 error = EINVAL;
2956         }
2957
2958         return error;
2959 }
2960
2961 /// Client updating
2962
2963 static bool
2964 necp_update_parsed_parameters(struct necp_client_parsed_parameters *parsed_parameters,
2965     struct necp_aggregate_result *result)
2966 {
2967         if (parsed_parameters == NULL ||
2968             result == NULL) {
2969                 return false;
2970         }
2971
2972         bool updated = false;
2973         for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
2974                 if (uuid_is_null(result->netagents[i])) {
2975                         // Passed end of valid agents
2976                         break;
2977                 }
2978
2979                 if (!(result->netagent_use_flags[i] & NECP_AGENT_USE_FLAG_SCOPE)) {
2980                         // Not a scoped agent, ignore
2981                         continue;
2982                 }
2983
2984                 // This is a scoped agent. Add it to the required agents.
2985                 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
2986                         // Already some required agents, add this at the end
2987                         for (int j = 0; j < NECP_MAX_AGENT_PARAMETERS; j++) {
2988                                 if (uuid_compare(parsed_parameters->required_netagents[j], result->netagents[i]) == 0) {
2989                                         // Already required, break
2990                                         break;
2991                                 }
2992                                 if (uuid_is_null(parsed_parameters->required_netagents[j])) {
2993                                         // Add here
2994                                         memcpy(&parsed_parameters->required_netagents[j], result->netagents[i], sizeof(uuid_t));
2995                                         updated = true;
2996                                         break;
2997                                 }
2998                         }
2999                 } else {
3000                         // No required agents yet, add this one
3001                         parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT;
3002                         memcpy(&parsed_parameters->required_netagents[0], result->netagents[i], sizeof(uuid_t));
3003                         updated = true;
3004                 }
3005
3006                 // Remove requirements for agents of the same type
3007                 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
3008                         char remove_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
3009                         char remove_agent_type[NETAGENT_TYPESIZE] = { 0 };
3010                         if (netagent_get_agent_domain_and_type(result->netagents[i], remove_agent_domain, remove_agent_type)) {
3011                                 for (int j = 0; j < NECP_MAX_AGENT_PARAMETERS; j++) {
3012                                         if (strlen(parsed_parameters->required_netagent_types[j].netagent_domain) == 0 &&
3013                                             strlen(parsed_parameters->required_netagent_types[j].netagent_type) == 0) {
3014                                                 break;
3015                                         }
3016
3017                                         if (strncmp(parsed_parameters->required_netagent_types[j].netagent_domain, remove_agent_domain, NETAGENT_DOMAINSIZE) == 0 &&
3018                                             strncmp(parsed_parameters->required_netagent_types[j].netagent_type, remove_agent_type, NETAGENT_TYPESIZE) == 0) {
3019                                                 updated = true;
3020
3021                                                 if (j == NECP_MAX_AGENT_PARAMETERS - 1) {
3022                                                         // Last field, just clear and break
3023                                                         memset(&parsed_parameters->required_netagent_types[NECP_MAX_AGENT_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
3024                                                         break;
3025                                                 } else {
3026                                                         // Move the parameters down, clear the last entry
3027                                                         memmove(&parsed_parameters->required_netagent_types[j],
3028                                                             &parsed_parameters->required_netagent_types[j + 1],
3029                                                             sizeof(struct necp_client_parameter_netagent_type) * (NECP_MAX_AGENT_PARAMETERS - (j + 1)));
3030                                                         memset(&parsed_parameters->required_netagent_types[NECP_MAX_AGENT_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
3031                                                         // Continue, don't increment but look at the new shifted item instead
3032                                                         continue;
3033                                                 }
3034                                         }
3035
3036                                         // Increment j to look at the next agent type parameter
3037                                         j++;
3038                                 }
3039                         }
3040                 }
3041         }
3042
3043         if (updated &&
3044             parsed_parameters->required_interface_index != IFSCOPE_NONE &&
3045             (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) {
3046                 // A required interface index was added after the fact. Clear it.
3047                 parsed_parameters->required_interface_index = IFSCOPE_NONE;
3048         }
3049
3050
3051         return updated;
3052 }
3053
3054 static inline bool
3055 necp_agent_types_match(const char *agent_domain1, const char *agent_type1,
3056     const char *agent_domain2, const char *agent_type2)
3057 {
3058         return (strlen(agent_domain1) == 0 ||
3059                strncmp(agent_domain2, agent_domain1, NETAGENT_DOMAINSIZE) == 0) &&
3060                (strlen(agent_type1) == 0 ||
3061                strncmp(agent_type2, agent_type1, NETAGENT_TYPESIZE) == 0);
3062 }
3063
3064 static inline bool
3065 necp_calculate_client_result(proc_t proc,
3066     struct necp_client *client,
3067     struct necp_client_parsed_parameters *parsed_parameters,
3068     struct necp_aggregate_result *result,
3069     u_int32_t *flags,
3070     u_int32_t *reason,
3071     struct necp_client_endpoint *v4_gateway,
3072     struct necp_client_endpoint *v6_gateway)
3073 {
3074         struct rtentry *route = NULL;
3075
3076         // Check parameters to find best interface
3077         bool validate_agents = false;
3078         u_int matching_if_index = 0;
3079         if (necp_find_matching_interface_index(parsed_parameters, &matching_if_index, &validate_agents)) {
3080                 if (matching_if_index != 0) {
3081                         parsed_parameters->required_interface_index = matching_if_index;
3082                 }
3083                 // Interface found or not needed, match policy.
3084                 memset(result, 0, sizeof(*result));
3085                 int error = necp_application_find_policy_match_internal(proc, client->parameters,
3086                     (u_int32_t)client->parameters_length,
3087                     result, flags, reason, matching_if_index,
3088                     NULL, NULL,
3089                     v4_gateway, v6_gateway,
3090                     &route, false, true);
3091                 if (error != 0) {
3092                         if (route != NULL) {
3093                                 rtfree(route);
3094                         }
3095                         return FALSE;
3096                 }
3097
3098                 if (validate_agents) {
3099                         bool requirement_failed = FALSE;
3100                         if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
3101                                 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
3102                                         if (uuid_is_null(parsed_parameters->required_netagents[i])) {
3103                                                 break;
3104                                         }
3105
3106                                         bool requirement_found = FALSE;
3107                                         for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
3108                                                 if (uuid_is_null(result->netagents[j])) {
3109                                                         break;
3110                                                 }
3111
3112                                                 if (uuid_compare(parsed_parameters->required_netagents[i], result->netagents[j]) == 0) {
3113                                                         requirement_found = TRUE;
3114                                                         break;
3115                                                 }
3116                                         }
3117
3118                                         if (!requirement_found) {
3119                                                 requirement_failed = TRUE;
3120                                                 break;
3121                                         }
3122                                 }
3123                         }
3124
3125                         if (!requirement_failed && parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
3126                                 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
3127                                         if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 &&
3128                                             strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
3129                                                 break;
3130                                         }
3131
3132                                         bool requirement_found = FALSE;
3133                                         for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
3134                                                 if (uuid_is_null(result->netagents[j])) {
3135                                                         break;
3136                                                 }
3137
3138                                                 char policy_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
3139                                                 char policy_agent_type[NETAGENT_TYPESIZE] = { 0 };
3140
3141                                                 if (netagent_get_agent_domain_and_type(result->netagents[j], policy_agent_domain, policy_agent_type)) {
3142                                                         if (necp_agent_types_match(parsed_parameters->required_netagent_types[i].netagent_domain,
3143                                                             parsed_parameters->required_netagent_types[i].netagent_type,
3144                                                             policy_agent_domain, policy_agent_type)) {
3145                                                                 requirement_found = TRUE;
3146                                                                 break;
3147                                                         }
3148                                                 }
3149                                         }
3150
3151                                         if (!requirement_found) {
3152                                                 requirement_failed = TRUE;
3153                                                 break;
3154                                         }
3155                                 }
3156                         }
3157
3158                         if (requirement_failed) {
3159                                 // Agent requirement failed. Clear out the whole result, make everything fail.
3160                                 memset(result, 0, sizeof(*result));
3161                                 if (route != NULL) {
3162                                         rtfree(route);
3163                                 }
3164                                 return TRUE;
3165                         }
3166                 }
3167
3168                 // Reset current route
3169                 NECP_CLIENT_ROUTE_LOCK(client);
3170                 if (client->current_route != NULL) {
3171                         rtfree(client->current_route);
3172                 }
3173                 client->current_route = route;
3174                 NECP_CLIENT_ROUTE_UNLOCK(client);
3175         } else {
3176                 // Interface not found. Clear out the whole result, make everything fail.
3177                 memset(result, 0, sizeof(*result));
3178         }
3179
3180         return TRUE;
3181 }
3182
3183 #define NECP_PARSED_PARAMETERS_REQUIRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF |             \
3184                                                                                                 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE |          \
3185                                                                                                 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT |           \
3186                                                                                                 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE)
3187
3188 static bool
3189 necp_update_client_result(proc_t proc,
3190     struct necp_fd_data *client_fd,
3191     struct necp_client *client,
3192     struct _necp_flow_defunct_list *defunct_list)
3193 {
3194         struct necp_client_result_netagent netagent;
3195         struct necp_aggregate_result result;
3196         struct necp_client_parsed_parameters *parsed_parameters = NULL;
3197         u_int32_t flags = 0;
3198         u_int32_t reason = 0;
3199
3200         NECP_CLIENT_ASSERT_LOCKED(client);
3201
3202         MALLOC(parsed_parameters, struct necp_client_parsed_parameters *, sizeof(*parsed_parameters), M_NECP, (M_WAITOK | M_ZERO));
3203         if (parsed_parameters == NULL) {
3204                 NECPLOG0(LOG_ERR, "Failed to allocate parsed parameters");
3205                 return FALSE;
3206         }
3207
3208         // Nexus flows will be brought back if they are still valid
3209         necp_client_mark_all_nonsocket_flows_as_invalid(client);
3210
3211         int error = necp_client_parse_parameters(client->parameters, (u_int32_t)client->parameters_length, parsed_parameters);
3212         if (error != 0) {
3213                 FREE(parsed_parameters, M_NECP);
3214                 return FALSE;
3215         }
3216
3217         // Update saved IP protocol
3218         client->ip_protocol = parsed_parameters->ip_protocol;
3219
3220         // Calculate the policy result
3221         struct necp_client_endpoint v4_gateway = {};
3222         struct necp_client_endpoint v6_gateway = {};
3223         if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags, &reason, &v4_gateway, &v6_gateway)) {
3224                 FREE(parsed_parameters, M_NECP);
3225                 return FALSE;
3226         }
3227
3228         if (necp_update_parsed_parameters(parsed_parameters, &result)) {
3229                 // Changed the parameters based on result, try again (only once)
3230                 if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags, &reason, &v4_gateway, &v6_gateway)) {
3231                         FREE(parsed_parameters, M_NECP);
3232                         return FALSE;
3233                 }
3234         }
3235
3236         if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
3237             parsed_parameters->required_interface_index != IFSCOPE_NONE &&
3238             (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) {
3239                 // Listener should not apply required interface index if
3240                 parsed_parameters->required_interface_index = IFSCOPE_NONE;
3241         }
3242
3243         // Save the last policy id on the client
3244         client->policy_id = result.policy_id;
3245
3246         if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_MULTIPATH) ||
3247             ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
3248             result.routing_result != NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED)) {
3249                 client->allow_multiple_flows = TRUE;
3250         } else {
3251                 client->allow_multiple_flows = FALSE;
3252         }
3253
3254         // If the original request was scoped, and the policy result matches, make sure the result is scoped
3255         if ((result.routing_result == NECP_KERNEL_POLICY_RESULT_NONE ||
3256             result.routing_result == NECP_KERNEL_POLICY_RESULT_PASS) &&
3257             result.routed_interface_index != IFSCOPE_NONE &&
3258             parsed_parameters->required_interface_index == result.routed_interface_index) {
3259                 result.routing_result = NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED;
3260                 result.routing_result_parameter.scoped_interface_index = result.routed_interface_index;
3261         }
3262
3263         if (defunct_list != NULL &&
3264             result.routing_result == NECP_KERNEL_POLICY_RESULT_DROP) {
3265                 // If we are forced to drop the client, defunct it if it has flows
3266                 necp_defunct_client_for_policy(client, defunct_list);
3267         }
3268
3269         // Recalculate flags
3270         if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
3271                 // Listeners are valid as long as they aren't dropped
3272                 if (result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP) {
3273                         flags |= NECP_CLIENT_RESULT_FLAG_SATISFIED;
3274                 }
3275         } else if (result.routed_interface_index != 0) {
3276                 // Clients without flows determine viability based on having some routable interface
3277                 flags |= NECP_CLIENT_RESULT_FLAG_SATISFIED;
3278         }
3279
3280         bool updated = FALSE;
3281         u_int8_t *cursor = client->result;
3282         cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FLAGS, sizeof(flags), &flags, &updated, client->result, sizeof(client->result));
3283         if (reason != 0) {
3284                 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_REASON, sizeof(reason), &reason, &updated, client->result, sizeof(client->result));
3285         }
3286         cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_CLIENT_ID, sizeof(uuid_t), client->client_id, &updated,
3287             client->result, sizeof(client->result));
3288         cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT, sizeof(result.routing_result), &result.routing_result, &updated,
3289             client->result, sizeof(client->result));
3290         if (result.routing_result_parameter.tunnel_interface_index != 0) {
3291                 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER,
3292                     sizeof(result.routing_result_parameter), &result.routing_result_parameter, &updated,
3293                     client->result, sizeof(client->result));
3294         }
3295         if (result.filter_control_unit != 0) {
3296                 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT,
3297                     sizeof(result.filter_control_unit), &result.filter_control_unit, &updated,
3298                     client->result, sizeof(client->result));
3299         }
3300         if (result.routed_interface_index != 0) {
3301                 u_int routed_interface_index = result.routed_interface_index;
3302                 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
3303                     (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_REQUIRED_FIELDS) &&
3304                     parsed_parameters->required_interface_index != IFSCOPE_NONE &&
3305                     parsed_parameters->required_interface_index != result.routed_interface_index) {
3306                         routed_interface_index = parsed_parameters->required_interface_index;
3307                 }
3308
3309                 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_INDEX,
3310                     sizeof(routed_interface_index), &routed_interface_index, &updated,
3311                     client->result, sizeof(client->result));
3312         }
3313         if (client_fd && client_fd->flags & NECP_OPEN_FLAG_BACKGROUND) {
3314                 u_int32_t effective_traffic_class = SO_TC_BK_SYS;
3315                 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS,
3316                     sizeof(effective_traffic_class), &effective_traffic_class, &updated,
3317                     client->result, sizeof(client->result));
3318         }
3319
3320         if (client_fd->background) {
3321                 bool has_assigned_flow = FALSE;
3322                 struct necp_client_flow_registration *flow_registration = NULL;
3323                 struct necp_client_flow *search_flow = NULL;
3324                 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
3325                         LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
3326                                 if (search_flow->assigned) {
3327                                         has_assigned_flow = TRUE;
3328                                         break;
3329                                 }
3330                         }
3331                 }
3332
3333                 if (has_assigned_flow) {
3334                         u_int32_t background = client_fd->background;
3335                         cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG,
3336                             sizeof(background), &background, &updated,
3337                             client->result, sizeof(client->result));
3338                 }
3339         }
3340
3341         bool write_v4_gateway = !necp_client_endpoint_is_unspecified(&v4_gateway);
3342         bool write_v6_gateway = !necp_client_endpoint_is_unspecified(&v6_gateway);
3343
3344         NECP_CLIENT_ROUTE_LOCK(client);
3345         if (client->current_route != NULL) {
3346                 const u_int32_t route_mtu = get_maxmtu(client->current_route);
3347                 if (route_mtu != 0) {
3348                         cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_MTU,
3349                             sizeof(route_mtu), &route_mtu, &updated,
3350                             client->result, sizeof(client->result));
3351                 }
3352                 bool has_remote_addr = parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
3353                 if (has_remote_addr && client->current_route->rt_gateway != NULL) {
3354                         if (client->current_route->rt_gateway->sa_family == AF_INET) {
3355                                 write_v6_gateway = false;
3356                         } else if (client->current_route->rt_gateway->sa_family == AF_INET6) {
3357                                 write_v4_gateway = false;
3358                         }
3359                 }
3360         }
3361         NECP_CLIENT_ROUTE_UNLOCK(client);
3362
3363         if (write_v4_gateway) {
3364                 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_GATEWAY,
3365                     sizeof(struct necp_client_endpoint), &v4_gateway, &updated,
3366                     client->result, sizeof(client->result));
3367         }
3368
3369         if (write_v6_gateway) {
3370                 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_GATEWAY,
3371                     sizeof(struct necp_client_endpoint), &v6_gateway, &updated,
3372                     client->result, sizeof(client->result));
3373         }
3374
3375         if (result.mss_recommended != 0) {
3376                 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_RECOMMENDED_MSS,
3377                     sizeof(result.mss_recommended), &result.mss_recommended, &updated,
3378                     client->result, sizeof(client->result));
3379         }
3380
3381         for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
3382                 if (uuid_is_null(result.netagents[i])) {
3383                         break;
3384                 }
3385                 uuid_copy(netagent.netagent_uuid, result.netagents[i]);
3386                 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
3387                 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE, 0, 0)) {
3388                         cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
3389                             client->result, sizeof(client->result));
3390                 }
3391         }
3392
3393         ifnet_head_lock_shared();
3394         ifnet_t direct_interface = NULL;
3395         ifnet_t delegate_interface = NULL;
3396         ifnet_t original_scoped_interface = NULL;
3397
3398         if (result.routed_interface_index != IFSCOPE_NONE && result.routed_interface_index <= (u_int32_t)if_index) {
3399                 direct_interface = ifindex2ifnet[result.routed_interface_index];
3400         } else if (parsed_parameters->required_interface_index != IFSCOPE_NONE &&
3401             parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
3402                 // If the request was scoped, but the route didn't match, still grab the agents
3403                 direct_interface = ifindex2ifnet[parsed_parameters->required_interface_index];
3404         } else if (result.routed_interface_index == IFSCOPE_NONE &&
3405             result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED &&
3406             result.routing_result_parameter.scoped_interface_index != IFSCOPE_NONE) {
3407                 direct_interface = ifindex2ifnet[result.routing_result_parameter.scoped_interface_index];
3408         }
3409         if (direct_interface != NULL) {
3410                 delegate_interface = direct_interface->if_delegated.ifp;
3411         }
3412         if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
3413             (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_REQUIRED_FIELDS) &&
3414             parsed_parameters->required_interface_index != IFSCOPE_NONE &&
3415             parsed_parameters->required_interface_index != result.routing_result_parameter.tunnel_interface_index &&
3416             parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
3417                 original_scoped_interface = ifindex2ifnet[parsed_parameters->required_interface_index];
3418         }
3419         // Add interfaces
3420         if (original_scoped_interface != NULL) {
3421                 struct necp_client_result_interface interface_struct;
3422                 interface_struct.index = original_scoped_interface->if_index;
3423                 interface_struct.generation = ifnet_get_generation(original_scoped_interface);
3424                 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
3425                     client->result, sizeof(client->result));
3426         }
3427         if (direct_interface != NULL) {
3428                 struct necp_client_result_interface interface_struct;
3429                 interface_struct.index = direct_interface->if_index;
3430                 interface_struct.generation = ifnet_get_generation(direct_interface);
3431                 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
3432                     client->result, sizeof(client->result));
3433
3434                 // Set the delta time since interface up/down
3435                 struct timeval updown_delta = {};
3436                 if (ifnet_updown_delta(direct_interface, &updown_delta) == 0) {
3437                         u_int32_t delta = updown_delta.tv_sec;
3438                         bool ignore_updated = FALSE;
3439                         cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_TIME_DELTA,
3440                             sizeof(delta), &delta, &ignore_updated,
3441                             client->result, sizeof(client->result));
3442                 }
3443         }
3444         if (delegate_interface != NULL) {
3445                 struct necp_client_result_interface interface_struct;
3446                 interface_struct.index = delegate_interface->if_index;
3447                 interface_struct.generation = ifnet_get_generation(delegate_interface);
3448                 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
3449                     client->result, sizeof(client->result));
3450         }
3451
3452         // Update multipath/listener interface flows
3453         if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_MULTIPATH) {
3454                 // Get multipath interface options from ordered list
3455                 struct ifnet *multi_interface = NULL;
3456                 TAILQ_FOREACH(multi_interface, &ifnet_ordered_head, if_ordered_link) {
3457                         if (necp_ifnet_matches_parameters(multi_interface, parsed_parameters, 0, NULL, true, false)) {
3458                                 // Add multipath interface flows for kernel MPTCP
3459                                 necp_client_add_interface_option_if_needed(client, multi_interface->if_index,
3460                                     ifnet_get_generation(multi_interface), NULL);
3461
3462                                 // Add nexus agents for multipath
3463                                 necp_client_add_agent_interface_options(client, parsed_parameters, multi_interface);
3464                         }
3465                 }
3466         } else if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
3467                 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) {
3468                         if (direct_interface != NULL) {
3469                                 // If scoped, only listen on that interface
3470                                 // Add nexus agents for listeners
3471                                 necp_client_add_agent_interface_options(client, parsed_parameters, direct_interface);
3472
3473                                 // Add interface option in case it is not a nexus
3474                                 necp_client_add_interface_option_if_needed(client, direct_interface->if_index,
3475                                     ifnet_get_generation(direct_interface), NULL);
3476                         }
3477                 } else {
3478                         // Get listener interface options from global list
3479                         struct ifnet *listen_interface = NULL;
3480                         TAILQ_FOREACH(listen_interface, &ifnet_head, if_link) {
3481                                 if ((listen_interface->if_flags & (IFF_UP | IFF_RUNNING)) &&
3482                                     necp_ifnet_matches_parameters(listen_interface, parsed_parameters, 0, NULL, true, false)) {
3483                                         // Add nexus agents for listeners
3484                                         necp_client_add_agent_interface_options(client, parsed_parameters, listen_interface);
3485                                 }
3486                         }
3487                 }
3488         }
3489
3490         // Add agents
3491         if (original_scoped_interface != NULL) {
3492                 ifnet_lock_shared(original_scoped_interface);
3493                 if (original_scoped_interface->if_agentids != NULL) {
3494                         for (u_int32_t i = 0; i < original_scoped_interface->if_agentcount; i++) {
3495                                 if (uuid_is_null(original_scoped_interface->if_agentids[i])) {
3496                                         continue;
3497                                 }
3498                                 uuid_copy(netagent.netagent_uuid, original_scoped_interface->if_agentids[i]);
3499                                 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
3500                                 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE,
3501                                     original_scoped_interface->if_index, ifnet_get_generation(original_scoped_interface))) {
3502                                         cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
3503                                             client->result, sizeof(client->result));
3504                                 }
3505                         }
3506                 }
3507                 ifnet_lock_done(original_scoped_interface);
3508         }
3509         if (direct_interface != NULL) {
3510                 ifnet_lock_shared(direct_interface);
3511                 if (direct_interface->if_agentids != NULL) {
3512                         for (u_int32_t i = 0; i < direct_interface->if_agentcount; i++) {
3513                                 if (uuid_is_null(direct_interface->if_agentids[i])) {
3514                                         continue;
3515                                 }
3516                                 uuid_copy(netagent.netagent_uuid, direct_interface->if_agentids[i]);
3517                                 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
3518                                 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE,
3519                                     direct_interface->if_index, ifnet_get_generation(direct_interface))) {
3520                                         cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
3521                                             client->result, sizeof(client->result));
3522                                 }
3523                         }
3524                 }
3525                 ifnet_lock_done(direct_interface);
3526         }
3527         if (delegate_interface != NULL) {
3528                 ifnet_lock_shared(delegate_interface);
3529                 if (delegate_interface->if_agentids != NULL) {
3530                         for (u_int32_t i = 0; i < delegate_interface->if_agentcount; i++) {
3531                                 if (uuid_is_null(delegate_interface->if_agentids[i])) {
3532                                         continue;
3533                                 }
3534                                 uuid_copy(netagent.netagent_uuid, delegate_interface->if_agentids[i]);
3535                                 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
3536                                 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE,
3537                                     delegate_interface->if_index, ifnet_get_generation(delegate_interface))) {
3538                                         cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
3539                                             client->result, sizeof(client->result));
3540                                 }
3541                         }
3542                 }
3543                 ifnet_lock_done(delegate_interface);
3544         }
3545         ifnet_head_done();
3546
3547         // Add interface options
3548         for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
3549                 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
3550                         struct necp_client_interface_option *option = &client->interface_options[option_i];
3551                         cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated,
3552                             client->result, sizeof(client->result));
3553                 } else {
3554                         struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
3555                         cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated,
3556                             client->result, sizeof(client->result));
3557                 }
3558         }
3559
3560         size_t new_result_length = (cursor - client->result);
3561         if (new_result_length != client->result_length) {
3562                 client->result_length = new_result_length;
3563                 updated = TRUE;
3564         }
3565
3566         // Update flow viability/flags
3567         if (necp_client_update_flows(proc, client, defunct_list)) {
3568                 updated = TRUE;
3569         }
3570
3571         if (updated) {
3572                 client->result_read = FALSE;
3573                 necp_client_update_observer_update(client);
3574         }
3575
3576         FREE(parsed_parameters, M_NECP);
3577         return updated;
3578 }
3579
3580 static inline void
3581 necp_defunct_client_fd_locked(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, struct proc *proc)
3582 {
3583 #pragma unused(proc)
3584         bool updated_result = FALSE;
3585         struct necp_client *client = NULL;
3586
3587         NECP_FD_ASSERT_LOCKED(client_fd);
3588
3589         RB_FOREACH(client, _necp_client_tree, &client_fd->clients) {
3590                 struct necp_client_flow_registration *flow_registration = NULL;
3591
3592                 NECP_CLIENT_LOCK(client);
3593
3594                 // Prepare close events to be sent to the nexus to effectively remove the flows
3595                 struct necp_client_flow *search_flow = NULL;
3596                 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
3597                         LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
3598                                 if (search_flow->nexus &&
3599                                     !uuid_is_null(search_flow->u.nexus_agent)) {
3600                                         // Sleeping alloc won't fail; copy only what's necessary
3601                                         struct necp_flow_defunct *flow_defunct = _MALLOC(sizeof(struct necp_flow_defunct), M_NECP, M_WAITOK | M_ZERO);
3602                                         uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent);
3603                                         uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
3604                                             client->client_id :
3605                                             flow_registration->registration_id));
3606                                         flow_defunct->proc_pid = client->proc_pid;
3607                                         flow_defunct->agent_handle = client->agent_handle;
3608                                         flow_defunct->flags = flow_registration->flags;
3609                                         // Add to the list provided by caller
3610                                         LIST_INSERT_HEAD(defunct_list, flow_defunct, chain);
3611
3612                                         flow_registration->defunct = true;
3613                                         flow_registration->flow_result_read = false;
3614                                         updated_result = true;
3615                                 }
3616                         }
3617                 }
3618                 NECP_CLIENT_UNLOCK(client);
3619         }
3620
3621
3622         if (updated_result) {
3623                 necp_fd_notify(client_fd, true);
3624         }
3625 }
3626
3627 static inline void
3628 necp_update_client_fd_locked(struct necp_fd_data *client_fd,
3629     proc_t proc,
3630     struct _necp_flow_defunct_list *defunct_list)
3631 {
3632         struct necp_client *client = NULL;
3633         bool updated_result = FALSE;
3634         NECP_FD_ASSERT_LOCKED(client_fd);
3635         RB_FOREACH(client, _necp_client_tree, &client_fd->clients) {
3636                 NECP_CLIENT_LOCK(client);
3637                 if (necp_update_client_result(proc, client_fd, client, defunct_list)) {
3638                         updated_result = TRUE;
3639                 }
3640                 NECP_CLIENT_UNLOCK(client);
3641         }
3642         if (updated_result) {
3643                 necp_fd_notify(client_fd, true);
3644         }
3645 }
3646
3647
3648 static void
3649 necp_update_all_clients_callout(__unused thread_call_param_t dummy,
3650     __unused thread_call_param_t arg)
3651 {
3652         struct necp_fd_data *client_fd = NULL;
3653
3654         struct _necp_flow_defunct_list defunct_list;
3655         LIST_INIT(&defunct_list);
3656
3657         NECP_FD_LIST_LOCK_SHARED();
3658
3659         LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3660                 proc_t proc = proc_find(client_fd->proc_pid);
3661                 if (proc == PROC_NULL) {
3662                         continue;
3663                 }
3664
3665                 // Update all clients on one fd
3666                 NECP_FD_LOCK(client_fd);
3667                 necp_update_client_fd_locked(client_fd, proc, &defunct_list);
3668                 NECP_FD_UNLOCK(client_fd);
3669
3670                 proc_rele(proc);
3671                 proc = PROC_NULL;
3672         }
3673
3674         NECP_FD_LIST_UNLOCK();
3675
3676         // Handle the case in which some clients became newly defunct
3677         if (!LIST_EMPTY(&defunct_list)) {
3678                 struct necp_flow_defunct *flow_defunct = NULL;
3679                 struct necp_flow_defunct *temp_flow_defunct = NULL;
3680
3681                 // For each newly defunct client, send a message to the nexus to remove the flow
3682                 LIST_FOREACH_SAFE(flow_defunct, &defunct_list, chain, temp_flow_defunct) {
3683                         if (!uuid_is_null(flow_defunct->nexus_agent)) {
3684                                 u_int8_t message_type = NETAGENT_MESSAGE_TYPE_ABORT_NEXUS;
3685                                 if (((flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
3686                                     (flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
3687                                     !(flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
3688                                         message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
3689                                 }
3690                                 int netagent_error = netagent_client_message_with_params(flow_defunct->nexus_agent,
3691                                     flow_defunct->flow_id,
3692                                     flow_defunct->proc_pid,
3693                                     flow_defunct->agent_handle,
3694                                     message_type,
3695                                     flow_defunct->has_close_parameters ? &flow_defunct->close_parameters : NULL,
3696                                     NULL, 0);
3697                                 if (netagent_error != 0) {
3698                                         char namebuf[MAXCOMLEN + 1];
3699                                         (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
3700                                         proc_name(flow_defunct->proc_pid, namebuf, sizeof(namebuf));
3701                                         NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR), "necp_update_client abort nexus error (%d) for pid %d %s", netagent_error, flow_defunct->proc_pid, namebuf);
3702                                 }
3703                         }
3704                         LIST_REMOVE(flow_defunct, chain);
3705                         FREE(flow_defunct, M_NECP);
3706                 }
3707         }
3708         ASSERT(LIST_EMPTY(&defunct_list));
3709 }
3710
3711 void
3712 necp_update_all_clients(void)
3713 {
3714         necp_update_all_clients_immediately_if_needed(false);
3715 }
3716
3717 void
3718 necp_update_all_clients_immediately_if_needed(bool should_update_immediately)
3719 {
3720         if (necp_client_update_tcall == NULL) {
3721                 // Don't try to update clients if the module is not initialized
3722                 return;
3723         }
3724
3725         uint64_t deadline = 0;
3726         uint64_t leeway = 0;
3727
3728         uint32_t timeout_to_use = necp_timeout_microseconds;
3729         uint32_t leeway_to_use = necp_timeout_leeway_microseconds;
3730         if (should_update_immediately) {
3731                 timeout_to_use = 1000 * 10; // 10ms
3732                 leeway_to_use = 1000 * 10; // 10ms;
3733         }
3734
3735         clock_interval_to_deadline(timeout_to_use, NSEC_PER_USEC, &deadline);
3736         clock_interval_to_absolutetime_interval(leeway_to_use, NSEC_PER_USEC, &leeway);
3737
3738         thread_call_enter_delayed_with_leeway(necp_client_update_tcall, NULL,
3739             deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
3740 }
3741
3742 bool
3743 necp_set_client_as_background(proc_t proc,
3744     struct fileproc *fp,
3745     bool background)
3746 {
3747         if (proc == PROC_NULL) {
3748                 NECPLOG0(LOG_ERR, "NULL proc");
3749                 return FALSE;
3750         }
3751
3752         if (fp == NULL) {
3753                 NECPLOG0(LOG_ERR, "NULL fp");
3754                 return FALSE;
3755         }
3756
3757         struct necp_fd_data *client_fd = (struct necp_fd_data *)fp->f_fglob->fg_data;
3758         if (client_fd == NULL) {
3759                 NECPLOG0(LOG_ERR, "Could not find client structure for backgrounded client");
3760                 return FALSE;
3761         }
3762
3763         if (client_fd->necp_fd_type != necp_fd_type_client) {
3764                 // Not a client fd, ignore
3765                 NECPLOG0(LOG_ERR, "Not a client fd, ignore");
3766                 return FALSE;
3767         }
3768
3769         client_fd->background = background;
3770
3771         return TRUE;
3772 }
3773
3774 void
3775 necp_fd_memstatus(proc_t proc, uint32_t status,
3776     struct necp_fd_data *client_fd)
3777 {
3778 #pragma unused(proc, status, client_fd)
3779         ASSERT(proc != PROC_NULL);
3780         ASSERT(client_fd != NULL);
3781
3782         // Nothing to reap for the process or client for now,
3783         // but this is where we would trigger that in future.
3784 }
3785
3786 void
3787 necp_fd_defunct(proc_t proc, struct necp_fd_data *client_fd)
3788 {
3789         struct _necp_flow_defunct_list defunct_list;
3790
3791         ASSERT(proc != PROC_NULL);
3792         ASSERT(client_fd != NULL);
3793
3794         if (client_fd->necp_fd_type != necp_fd_type_client) {
3795                 // Not a client fd, ignore
3796                 return;
3797         }
3798
3799         // Our local temporary list
3800         LIST_INIT(&defunct_list);
3801
3802         // Need to hold lock so ntstats defunct the same set of clients
3803         NECP_FD_LOCK(client_fd);
3804         necp_defunct_client_fd_locked(client_fd, &defunct_list, proc);
3805         NECP_FD_UNLOCK(client_fd);
3806
3807         if (!LIST_EMPTY(&defunct_list)) {
3808                 struct necp_flow_defunct *flow_defunct = NULL;
3809                 struct necp_flow_defunct *temp_flow_defunct = NULL;
3810
3811                 // For each defunct client, remove flow from the nexus
3812                 LIST_FOREACH_SAFE(flow_defunct, &defunct_list, chain, temp_flow_defunct) {
3813                         if (!uuid_is_null(flow_defunct->nexus_agent)) {
3814                                 u_int8_t message_type = NETAGENT_MESSAGE_TYPE_ABORT_NEXUS;
3815                                 if (((flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
3816                                     (flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
3817                                     !(flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
3818                                         message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
3819                                 }
3820                                 int netagent_error = netagent_client_message_with_params(flow_defunct->nexus_agent,
3821                                     flow_defunct->flow_id,
3822                                     flow_defunct->proc_pid,
3823                                     flow_defunct->agent_handle,
3824                                     message_type,
3825                                     flow_defunct->has_close_parameters ? &flow_defunct->close_parameters : NULL,
3826                                     NULL, 0);
3827                                 if (netagent_error != 0) {
3828                                         NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR), "necp_defunct_client abort nexus error (%d)", netagent_error);
3829                                 }
3830                         }
3831                         LIST_REMOVE(flow_defunct, chain);
3832                         FREE(flow_defunct, M_NECP);
3833                 }
3834         }
3835         ASSERT(LIST_EMPTY(&defunct_list));
3836 }
3837
3838 static void
3839 necp_client_remove_agent_from_result(struct necp_client *client, uuid_t netagent_uuid)
3840 {
3841         size_t offset = 0;
3842
3843         u_int8_t *result_buffer = client->result;
3844         while ((offset + sizeof(struct necp_tlv_header)) <= client->result_length) {
3845                 u_int8_t type = necp_buffer_get_tlv_type(result_buffer, offset);
3846                 u_int32_t length = necp_buffer_get_tlv_length(result_buffer, offset);
3847
3848                 size_t tlv_total_length = (sizeof(struct necp_tlv_header) + length);
3849                 if (type == NECP_CLIENT_RESULT_NETAGENT &&
3850                     length == sizeof(struct necp_client_result_netagent) &&
3851                     (offset + tlv_total_length) <= client->result_length) {
3852                         struct necp_client_result_netagent *value = ((struct necp_client_result_netagent *)(void *)
3853                             necp_buffer_get_tlv_value(result_buffer, offset, NULL));
3854                         if (uuid_compare(value->netagent_uuid, netagent_uuid) == 0) {
3855                                 // Found a netagent to remove
3856                                 // Shift bytes down to remove the tlv, and adjust total length
3857                                 // Don't adjust the current offset
3858                                 memmove(result_buffer + offset,
3859                                     result_buffer + offset + tlv_total_length,
3860                                     client->result_length - (offset + tlv_total_length));
3861                                 client->result_length -= tlv_total_length;
3862                                 memset(result_buffer + client->result_length, 0, sizeof(client->result) - client->result_length);
3863                                 continue;
3864                         }
3865                 }
3866
3867                 offset += tlv_total_length;
3868         }
3869 }
3870
3871 void
3872 necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid, u_int32_t agent_generation)
3873 {
3874         struct necp_fd_data *client_fd = NULL;
3875
3876         NECP_FD_LIST_LOCK_SHARED();
3877
3878         LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3879                 bool updated_result = FALSE;
3880                 NECP_FD_LOCK(client_fd);
3881                 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3882                 if (client != NULL) {
3883                         client->failed_trigger_agent.generation = agent_generation;
3884                         uuid_copy(client->failed_trigger_agent.netagent_uuid, remove_netagent_uuid);
3885                         if (!uuid_is_null(remove_netagent_uuid)) {
3886                                 necp_client_remove_agent_from_result(client, remove_netagent_uuid);
3887                         }
3888                         client->result_read = FALSE;
3889                         // Found the client, break
3890                         updated_result = TRUE;
3891                         NECP_CLIENT_UNLOCK(client);
3892                 }
3893                 if (updated_result) {
3894                         necp_fd_notify(client_fd, true);
3895                 }
3896                 NECP_FD_UNLOCK(client_fd);
3897                 if (updated_result) {
3898                         // Found the client, break
3899                         break;
3900                 }
3901         }
3902
3903         NECP_FD_LIST_UNLOCK();
3904 }
3905
3906
3907 /// Interface matching
3908
3909 #define NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR |                              \
3910                                                                                                                  NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF |                   \
3911                                                                                                                  NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE |                 \
3912                                                                                                                  NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE |               \
3913                                                                                                                  NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT |                  \
3914                                                                                                                  NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT |                \
3915                                                                                                                  NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT |                 \
3916                                                                                                                  NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT |                   \
3917                                                                                                                  NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE |             \
3918                                                                                                                  NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE |   \
3919                                                                                                                  NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE |    \
3920                                                                                                                  NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
3921
3922 #define NECP_PARSED_PARAMETERS_SCOPED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR |                 \
3923                                                                                           NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE |                \
3924                                                                                           NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT |         \
3925                                                                                           NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT |                \
3926                                                                                           NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE |    \
3927                                                                                           NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE)
3928
3929 #define NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR |           \
3930                                                                                                         NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)
3931
3932 #define NECP_PARSED_PARAMETERS_PREFERRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT |                 \
3933                                                                                                  NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT |                   \
3934                                                                                                  NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE |    \
3935                                                                                                  NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
3936
3937 static bool
3938 necp_ifnet_matches_type(struct ifnet *ifp, u_int8_t interface_type, bool check_delegates)
3939 {
3940         struct ifnet *check_ifp = ifp;
3941         while (check_ifp) {
3942                 if (if_functional_type(check_ifp, TRUE) == interface_type) {
3943                         return TRUE;
3944                 }
3945                 if (!check_delegates) {
3946                         break;
3947                 }
3948                 check_ifp = check_ifp->if_delegated.ifp;
3949         }
3950         return FALSE;
3951 }
3952
3953 static bool
3954 necp_ifnet_matches_name(struct ifnet *ifp, const char *interface_name, bool check_delegates)
3955 {
3956         struct ifnet *check_ifp = ifp;
3957         while (check_ifp) {
3958                 if (strncmp(check_ifp->if_xname, interface_name, IFXNAMSIZ) == 0) {
3959                         return TRUE;
3960                 }
3961                 if (!check_delegates) {
3962                         break;
3963                 }
3964                 check_ifp = check_ifp->if_delegated.ifp;
3965         }
3966         return FALSE;
3967 }
3968
3969 static bool
3970 necp_ifnet_matches_agent(struct ifnet *ifp, uuid_t *agent_uuid, bool check_delegates)
3971 {
3972         struct ifnet *check_ifp = ifp;
3973
3974         while (check_ifp != NULL) {
3975                 ifnet_lock_shared(check_ifp);
3976                 if (check_ifp->if_agentids != NULL) {
3977                         for (u_int32_t index = 0; index < check_ifp->if_agentcount; index++) {
3978                                 if (uuid_compare(check_ifp->if_agentids[index], *agent_uuid) == 0) {
3979                                         ifnet_lock_done(check_ifp);
3980                                         return TRUE;
3981                                 }
3982                         }
3983                 }
3984                 ifnet_lock_done(check_ifp);
3985
3986                 if (!check_delegates) {
3987                         break;
3988                 }
3989                 check_ifp = check_ifp->if_delegated.ifp;
3990         }
3991         return FALSE;
3992 }
3993
3994 static bool
3995 necp_ifnet_matches_agent_type(struct ifnet *ifp, const char *agent_domain, const char *agent_type, bool check_delegates)
3996 {
3997         struct ifnet *check_ifp = ifp;
3998
3999         while (check_ifp != NULL) {
4000                 ifnet_lock_shared(check_ifp);
4001                 if (check_ifp->if_agentids != NULL) {
4002                         for (u_int32_t index = 0; index < check_ifp->if_agentcount; index++) {
4003                                 if (uuid_is_null(check_ifp->if_agentids[index])) {
4004                                         continue;
4005                                 }
4006
4007                                 char if_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
4008                                 char if_agent_type[NETAGENT_TYPESIZE] = { 0 };
4009
4010                                 if (netagent_get_agent_domain_and_type(check_ifp->if_agentids[index], if_agent_domain, if_agent_type)) {
4011                                         if (necp_agent_types_match(agent_domain, agent_type, if_agent_domain, if_agent_type)) {
4012                                                 ifnet_lock_done(check_ifp);
4013                                                 return TRUE;
4014                                         }
4015                                 }
4016                         }
4017                 }
4018                 ifnet_lock_done(check_ifp);
4019
4020                 if (!check_delegates) {
4021                         break;
4022                 }
4023                 check_ifp = check_ifp->if_delegated.ifp;
4024         }
4025         return FALSE;
4026 }
4027
4028 static bool
4029 necp_ifnet_matches_local_address(struct ifnet *ifp, struct sockaddr *sa)
4030 {
4031         struct ifaddr *ifa = NULL;
4032         bool matched_local_address = FALSE;
4033
4034         // Transform sa into the ifaddr form
4035         // IPv6 Scope IDs are always embedded in the ifaddr list
4036         struct sockaddr_storage address;
4037         u_int ifscope = IFSCOPE_NONE;
4038         (void)sa_copy(sa, &address, &ifscope);
4039         SIN(&address)->sin_port = 0;
4040         if (address.ss_family == AF_INET6) {
4041                 SIN6(&address)->sin6_scope_id = 0;
4042         }
4043
4044         ifa = ifa_ifwithaddr_scoped_locked((struct sockaddr *)&address, ifp->if_index);
4045         matched_local_address = (ifa != NULL);
4046
4047         if (ifa) {
4048                 ifaddr_release(ifa);
4049         }
4050
4051         return matched_local_address;
4052 }
4053
4054 static bool
4055 necp_interface_type_is_primary_eligible(u_int8_t interface_type)
4056 {
4057         switch (interface_type) {
4058         // These types can never be primary, so a client requesting these types is allowed
4059         // to match an interface that isn't currently eligible to be primary (has default
4060         // route, dns, etc)
4061         case IFRTYPE_FUNCTIONAL_WIFI_AWDL:
4062         case IFRTYPE_FUNCTIONAL_INTCOPROC:
4063                 return false;
4064         default:
4065                 break;
4066         }
4067         return true;
4068 }
4069
4070 #define NECP_IFP_IS_ON_ORDERED_LIST(_ifp) ((_ifp)->if_ordered_link.tqe_next != NULL || (_ifp)->if_ordered_link.tqe_prev != NULL)
4071
4072 // Secondary interface flag indicates that the interface is being
4073 // used for multipath or a listener as an extra path
4074 static bool
4075 necp_ifnet_matches_parameters(struct ifnet *ifp,
4076     struct necp_client_parsed_parameters *parsed_parameters,
4077     u_int32_t override_flags,
4078     u_int32_t *preferred_count,
4079     bool secondary_interface,
4080     bool require_scoped_field)
4081 {
4082         bool matched_some_scoped_field = FALSE;
4083
4084         if (preferred_count) {
4085                 *preferred_count = 0;
4086         }
4087
4088         if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) {
4089                 if (parsed_parameters->required_interface_index != ifp->if_index) {
4090                         return FALSE;
4091                 }
4092         }
4093
4094         if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR) {
4095                 if (!necp_ifnet_matches_local_address(ifp, &parsed_parameters->local_addr.sa)) {
4096                         return FALSE;
4097                 }
4098                 if (require_scoped_field) {
4099                         matched_some_scoped_field = TRUE;
4100                 }
4101         }
4102
4103         if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) {
4104                 if (override_flags != 0) {
4105                         if ((override_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) &&
4106                             IFNET_IS_EXPENSIVE(ifp)) {
4107                                 return FALSE;
4108                         }
4109                         if ((override_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED) &&
4110                             IFNET_IS_CONSTRAINED(ifp)) {
4111                                 return FALSE;
4112                         }
4113                 } else {
4114                         if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) &&
4115                             IFNET_IS_EXPENSIVE(ifp)) {
4116                                 return FALSE;
4117                         }
4118                         if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED) &&
4119                             IFNET_IS_CONSTRAINED(ifp)) {
4120                                 return FALSE;
4121                         }
4122                 }
4123         }
4124
4125         if ((!secondary_interface || // Enforce interface type if this is the primary interface
4126             !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) ||      // or if there are no flags
4127             !(parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE)) &&      // or if the flags don't give an exception
4128             (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) &&
4129             !necp_ifnet_matches_type(ifp, parsed_parameters->required_interface_type, FALSE)) {
4130                 return FALSE;
4131         }
4132
4133         if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) {
4134                 if (require_scoped_field) {
4135                         matched_some_scoped_field = TRUE;
4136                 }
4137         }
4138
4139         if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE) {
4140                 for (int i = 0; i < NECP_MAX_INTERFACE_PARAMETERS; i++) {
4141                         if (parsed_parameters->prohibited_interface_types[i] == 0) {
4142                                 break;
4143                         }
4144
4145                         if (necp_ifnet_matches_type(ifp, parsed_parameters->prohibited_interface_types[i], TRUE)) {
4146                                 return FALSE;
4147                         }
4148                 }
4149         }
4150
4151         if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF) {
4152                 for (int i = 0; i < NECP_MAX_INTERFACE_PARAMETERS; i++) {
4153                         if (strlen(parsed_parameters->prohibited_interfaces[i]) == 0) {
4154                                 break;
4155                         }
4156
4157                         if (necp_ifnet_matches_name(ifp, parsed_parameters->prohibited_interfaces[i], TRUE)) {
4158                                 return FALSE;
4159                         }
4160                 }
4161         }
4162
4163         if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
4164                 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4165                         if (uuid_is_null(parsed_parameters->required_netagents[i])) {
4166                                 break;
4167                         }
4168
4169                         if (!necp_ifnet_matches_agent(ifp, &parsed_parameters->required_netagents[i], FALSE)) {
4170                                 return FALSE;
4171                         }
4172
4173                         if (require_scoped_field) {
4174                                 matched_some_scoped_field = TRUE;
4175                         }
4176                 }
4177         }
4178
4179         if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT) {
4180                 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4181                         if (uuid_is_null(parsed_parameters->prohibited_netagents[i])) {
4182                                 break;
4183                         }
4184
4185                         if (necp_ifnet_matches_agent(ifp, &parsed_parameters->prohibited_netagents[i], TRUE)) {
4186                                 return FALSE;
4187                         }
4188                 }
4189         }
4190
4191         if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
4192                 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4193                         if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 &&
4194                             strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
4195                                 break;
4196                         }
4197
4198                         if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->required_netagent_types[i].netagent_domain, parsed_parameters->required_netagent_types[i].netagent_type, FALSE)) {
4199                                 return FALSE;
4200                         }
4201
4202                         if (require_scoped_field) {
4203                                 matched_some_scoped_field = TRUE;
4204                         }
4205                 }
4206         }
4207
4208         if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE) {
4209                 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4210                         if (strlen(parsed_parameters->prohibited_netagent_types[i].netagent_domain) == 0 &&
4211                             strlen(parsed_parameters->prohibited_netagent_types[i].netagent_type) == 0) {
4212                                 break;
4213                         }
4214
4215                         if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->prohibited_netagent_types[i].netagent_domain, parsed_parameters->prohibited_netagent_types[i].netagent_type, TRUE)) {
4216                                 return FALSE;
4217                         }
4218                 }
4219         }
4220
4221         // Checked preferred properties
4222         if (preferred_count) {
4223                 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT) {
4224                         for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4225                                 if (uuid_is_null(parsed_parameters->preferred_netagents[i])) {
4226                                         break;
4227                                 }
4228
4229                                 if (necp_ifnet_matches_agent(ifp, &parsed_parameters->preferred_netagents[i], TRUE)) {
4230                                         (*preferred_count)++;
4231                                         if (require_scoped_field) {
4232                                                 matched_some_scoped_field = TRUE;
4233                                         }
4234                                 }
4235                         }
4236                 }
4237
4238                 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE) {
4239                         for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4240                                 if (strlen(parsed_parameters->preferred_netagent_types[i].netagent_domain) == 0 &&
4241                                     strlen(parsed_parameters->preferred_netagent_types[i].netagent_type) == 0) {
4242                                         break;
4243                                 }
4244
4245                                 if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->preferred_netagent_types[i].netagent_domain, parsed_parameters->preferred_netagent_types[i].netagent_type, TRUE)) {
4246                                         (*preferred_count)++;
4247                                         if (require_scoped_field) {
4248                                                 matched_some_scoped_field = TRUE;
4249                                         }
4250                                 }
4251                         }
4252                 }
4253
4254                 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT) {
4255                         for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4256                                 if (uuid_is_null(parsed_parameters->avoided_netagents[i])) {
4257                                         break;
4258                                 }
4259
4260                                 if (!necp_ifnet_matches_agent(ifp, &parsed_parameters->avoided_netagents[i], TRUE)) {
4261                                         (*preferred_count)++;
4262                                 }
4263                         }
4264                 }
4265
4266                 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE) {
4267                         for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4268                                 if (strlen(parsed_parameters->avoided_netagent_types[i].netagent_domain) == 0 &&
4269                                     strlen(parsed_parameters->avoided_netagent_types[i].netagent_type) == 0) {
4270                                         break;
4271                                 }
4272
4273                                 if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->avoided_netagent_types[i].netagent_domain,
4274                                     parsed_parameters->avoided_netagent_types[i].netagent_type, TRUE)) {
4275                                         (*preferred_count)++;
4276                                 }
4277                         }
4278                 }
4279         }
4280
4281         if (require_scoped_field) {
4282                 return matched_some_scoped_field;
4283         }
4284
4285         return TRUE;
4286 }
4287
4288 static bool
4289 necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters,
4290     u_int *return_ifindex, bool *validate_agents)
4291 {
4292         struct ifnet *ifp = NULL;
4293         u_int32_t best_preferred_count = 0;
4294         bool has_preferred_fields = FALSE;
4295         *return_ifindex = 0;
4296
4297         if (parsed_parameters->required_interface_index != 0) {
4298                 *return_ifindex = parsed_parameters->required_interface_index;
4299                 return TRUE;
4300         }
4301
4302         // Check and save off flags
4303         u_int32_t flags = 0;
4304         bool has_prohibit_flags = FALSE;
4305         if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) {
4306                 flags = parsed_parameters->flags;
4307                 has_prohibit_flags = (parsed_parameters->flags &
4308                     (NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE |
4309                     NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED));
4310         }
4311
4312         if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS) &&
4313             !has_prohibit_flags) {
4314                 return TRUE;
4315         }
4316
4317         has_preferred_fields = (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS);
4318
4319         // We have interesting parameters to parse and find a matching interface
4320         ifnet_head_lock_shared();
4321
4322         if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS) &&
4323             !has_preferred_fields) {
4324                 // We do have fields to match, but they are only prohibitory
4325                 // If the first interface in the list matches, or there are no ordered interfaces, we don't need to scope
4326                 ifp = TAILQ_FIRST(&ifnet_ordered_head);
4327                 if (ifp == NULL || necp_ifnet_matches_parameters(ifp, parsed_parameters, 0, NULL, false, false)) {
4328                         // Don't set return_ifindex, so the client doesn't need to scope
4329                         ifnet_head_done();
4330                         return TRUE;
4331                 }
4332         }
4333
4334         // First check the ordered interface list
4335         TAILQ_FOREACH(ifp, &ifnet_ordered_head, if_ordered_link) {
4336                 u_int32_t preferred_count = 0;
4337                 if (necp_ifnet_matches_parameters(ifp, parsed_parameters, flags, &preferred_count, false, false)) {
4338                         if (preferred_count > best_preferred_count ||
4339                             *return_ifindex == 0) {
4340                                 // Everything matched, and is most preferred. Return this interface.
4341                                 *return_ifindex = ifp->if_index;
4342                                 best_preferred_count = preferred_count;
4343
4344                                 if (!has_preferred_fields) {
4345                                         break;
4346                                 }
4347                         }
4348                 }
4349
4350                 if (has_prohibit_flags &&
4351                     ifp == TAILQ_FIRST(&ifnet_ordered_head)) {
4352                         // This was the first interface. From here on, if the
4353                         // client prohibited either expensive or constrained,
4354                         // don't allow either as a secondary interface option.
4355                         flags |= (NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE |
4356                             NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED);
4357                 }
4358         }
4359
4360         bool is_listener = ((parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
4361             (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER));
4362
4363         // Then check the remaining interfaces
4364         if ((parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS) &&
4365             ((!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)) ||
4366             !necp_interface_type_is_primary_eligible(parsed_parameters->required_interface_type) ||
4367             (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR) ||
4368             is_listener) &&
4369             (*return_ifindex == 0 || has_preferred_fields)) {
4370                 TAILQ_FOREACH(ifp, &ifnet_head, if_link) {
4371                         u_int32_t preferred_count = 0;
4372                         if (NECP_IFP_IS_ON_ORDERED_LIST(ifp)) {
4373                                 // This interface was in the ordered list, skip
4374                                 continue;
4375                         }
4376                         if (necp_ifnet_matches_parameters(ifp, parsed_parameters, flags, &preferred_count, false, true)) {
4377                                 if (preferred_count > best_preferred_count ||
4378                                     *return_ifindex == 0) {
4379                                         // Everything matched, and is most preferred. Return this interface.
4380                                         *return_ifindex = ifp->if_index;
4381                                         best_preferred_count = preferred_count;
4382
4383                                         if (!has_preferred_fields) {
4384                                                 break;
4385                                         }
4386                                 }
4387                         }
4388                 }
4389         }
4390
4391         ifnet_head_done();
4392
4393         if ((parsed_parameters->valid_fields == (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS)) &&
4394             best_preferred_count == 0) {
4395                 // If only has preferred fields, and nothing was found, clear the interface index and return TRUE
4396                 *return_ifindex = 0;
4397                 return TRUE;
4398         }
4399
4400         if (*return_ifindex == 0 &&
4401             !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS)) {
4402                 // Has required fields, but not including specific interface fields. Pass for now, and check
4403                 // to see if agents are satisfied by policy.
4404                 *validate_agents = TRUE;
4405                 return TRUE;
4406         }
4407
4408         return *return_ifindex != 0;
4409 }
4410
4411
4412 static int
4413 necp_skywalk_priv_check_cred(proc_t p, kauth_cred_t cred)
4414 {
4415 #pragma unused(p, cred)
4416         return 0;
4417 }
4418
4419 /// System calls
4420
4421 int
4422 necp_open(struct proc *p, struct necp_open_args *uap, int *retval)
4423 {
4424 #pragma unused(retval)
4425         int error = 0;
4426         struct necp_fd_data *fd_data = NULL;
4427         struct fileproc *fp = NULL;
4428         int fd = -1;
4429
4430         if (uap->flags & NECP_OPEN_FLAG_OBSERVER ||
4431             uap->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
4432                 if (necp_skywalk_priv_check_cred(p, kauth_cred_get()) != 0 &&
4433                     priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NETWORK_STATISTICS, 0) != 0) {
4434                         NECPLOG0(LOG_ERR, "Client does not hold necessary entitlement to observe other NECP clients");
4435                         error = EACCES;
4436                         goto done;
4437                 }
4438         }
4439
4440         error = falloc(p, &fp, &fd, vfs_context_current());
4441         if (error != 0) {
4442                 goto done;
4443         }
4444
4445         if ((fd_data = zalloc(necp_client_fd_zone)) == NULL) {
4446                 error = ENOMEM;
4447                 goto done;
4448         }
4449
4450         memset(fd_data, 0, sizeof(*fd_data));
4451
4452         fd_data->necp_fd_type = necp_fd_type_client;
4453         fd_data->flags = uap->flags;
4454         RB_INIT(&fd_data->clients);
4455         RB_INIT(&fd_data->flows);
4456         TAILQ_INIT(&fd_data->update_list);
4457         lck_mtx_init(&fd_data->fd_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
4458         klist_init(&fd_data->si.si_note);
4459         fd_data->proc_pid = proc_pid(p);
4460
4461         fp->f_fglob->fg_flag = FREAD;
4462         fp->f_fglob->fg_ops = &necp_fd_ops;
4463         fp->f_fglob->fg_data = fd_data;
4464
4465         proc_fdlock(p);
4466
4467         *fdflags(p, fd) |= (UF_EXCLOSE | UF_FORKCLOSE);
4468         procfdtbl_releasefd(p, fd, NULL);
4469         fp_drop(p, fd, fp, 1);
4470
4471         *retval = fd;
4472
4473         if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
4474                 NECP_OBSERVER_LIST_LOCK_EXCLUSIVE();
4475                 LIST_INSERT_HEAD(&necp_fd_observer_list, fd_data, chain);
4476                 OSIncrementAtomic(&necp_observer_fd_count);
4477                 NECP_OBSERVER_LIST_UNLOCK();
4478
4479                 // Walk all existing clients and add them
4480                 NECP_CLIENT_TREE_LOCK_SHARED();
4481                 struct necp_client *existing_client = NULL;
4482                 RB_FOREACH(existing_client, _necp_client_global_tree, &necp_client_global_tree) {
4483                         NECP_CLIENT_LOCK(existing_client);
4484                         necp_client_update_observer_add_internal(fd_data, existing_client);
4485                         necp_client_update_observer_update_internal(fd_data, existing_client);
4486                         NECP_CLIENT_UNLOCK(existing_client);
4487                 }
4488                 NECP_CLIENT_TREE_UNLOCK();
4489         } else {
4490                 NECP_FD_LIST_LOCK_EXCLUSIVE();
4491                 LIST_INSERT_HEAD(&necp_fd_list, fd_data, chain);
4492                 OSIncrementAtomic(&necp_client_fd_count);
4493                 NECP_FD_LIST_UNLOCK();
4494         }
4495
4496         proc_fdunlock(p);
4497
4498 done:
4499         if (error != 0) {
4500                 if (fp != NULL) {
4501                         fp_free(p, fd, fp);
4502                         fp = NULL;
4503                 }
4504                 if (fd_data != NULL) {
4505                         zfree(necp_client_fd_zone, fd_data);
4506                         fd_data = NULL;
4507                 }
4508         }
4509
4510         return error;
4511 }
4512
4513 // All functions called directly from necp_client_action() to handle one of the
4514 // types should be marked with NECP_CLIENT_ACTION_FUNCTION. This ensures that
4515 // necp_client_action() does not inline all the actions into a single function.
4516 #define NECP_CLIENT_ACTION_FUNCTION __attribute__((noinline))
4517
4518 static NECP_CLIENT_ACTION_FUNCTION int
4519 necp_client_add(struct proc *p, struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
4520 {
4521         int error = 0;
4522         struct necp_client *client = NULL;
4523
4524         if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
4525                 NECPLOG0(LOG_ERR, "NECP client observers with push enabled may not add their own clients");
4526                 return EINVAL;
4527         }
4528
4529         if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
4530             uap->buffer_size == 0 || uap->buffer_size > NECP_MAX_CLIENT_PARAMETERS_SIZE || uap->buffer == 0) {
4531                 return EINVAL;
4532         }
4533
4534         if ((client = _MALLOC(sizeof(struct necp_client) + uap->buffer_size, M_NECP,
4535             M_WAITOK | M_ZERO)) == NULL) {
4536                 error = ENOMEM;
4537                 goto done;
4538         }
4539
4540         error = copyin(uap->buffer, client->parameters, uap->buffer_size);
4541         if (error) {
4542                 NECPLOG(LOG_ERR, "necp_client_add parameters copyin error (%d)", error);
4543                 goto done;
4544         }
4545
4546         lck_mtx_init(&client->lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
4547         lck_mtx_init(&client->route_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
4548
4549         os_ref_init(&client->reference_count, &necp_client_refgrp); // Hold our reference until close
4550
4551         client->parameters_length = uap->buffer_size;
4552         client->proc_pid = fd_data->proc_pid; // Save off proc pid in case the client will persist past fd
4553         client->agent_handle = (void *)fd_data;
4554         client->platform_binary = ((csproc_get_platform_binary(p) == 0) ? 0 : 1);
4555
4556         necp_generate_client_id(client->client_id, false);
4557         LIST_INIT(&client->assertion_list);
4558         RB_INIT(&client->flow_registrations);
4559
4560         error = copyout(client->client_id, uap->client_id, sizeof(uuid_t));
4561         if (error) {
4562                 NECPLOG(LOG_ERR, "necp_client_add client_id copyout error (%d)", error);
4563                 goto done;
4564         }
4565
4566
4567         necp_client_update_observer_add(client);
4568
4569         NECP_FD_LOCK(fd_data);
4570         RB_INSERT(_necp_client_tree, &fd_data->clients, client);
4571         OSIncrementAtomic(&necp_client_count);
4572         NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
4573         RB_INSERT(_necp_client_global_tree, &necp_client_global_tree, client);
4574         NECP_CLIENT_TREE_UNLOCK();
4575
4576         // Prime the client result
4577         NECP_CLIENT_LOCK(client);
4578         (void)necp_update_client_result(current_proc(), fd_data, client, NULL);
4579         NECP_CLIENT_UNLOCK(client);
4580         NECP_FD_UNLOCK(fd_data);
4581 done:
4582         if (error != 0) {
4583                 if (client != NULL) {
4584                         FREE(client, M_NECP);
4585                         client = NULL;
4586                 }
4587         }
4588         *retval = error;
4589
4590         return error;
4591 }
4592
4593 static NECP_CLIENT_ACTION_FUNCTION int
4594 necp_client_claim(struct proc *p, struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
4595 {
4596         int error = 0;
4597         uuid_t client_id = {};
4598         struct necp_client *client = NULL;
4599
4600         if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
4601                 error = EINVAL;
4602                 goto done;
4603         }
4604
4605         error = copyin(uap->client_id, client_id, sizeof(uuid_t));
4606         if (error) {
4607                 NECPLOG(LOG_ERR, "necp_client_claim copyin client_id error (%d)", error);
4608                 goto done;
4609         }
4610
4611         u_int64_t upid = proc_uniqueid(p);
4612
4613         NECP_FD_LIST_LOCK_SHARED();
4614
4615         struct necp_fd_data *find_fd = NULL;
4616         LIST_FOREACH(find_fd, &necp_fd_list, chain) {
4617                 NECP_FD_LOCK(find_fd);
4618                 struct necp_client *find_client = necp_client_fd_find_client_and_lock(find_fd, client_id);
4619                 if (find_client != NULL) {
4620                         if (find_client->delegated_upid == upid) {
4621                                 // Matched the client to claim; remove from the old fd
4622                                 client = find_client;
4623                                 RB_REMOVE(_necp_client_tree, &find_fd->clients, client);
4624                                 necp_client_retain_locked(client);
4625                         }
4626                         NECP_CLIENT_UNLOCK(find_client);
4627                 }
4628                 NECP_FD_UNLOCK(find_fd);
4629
4630                 if (client != NULL) {
4631                         break;
4632                 }
4633         }
4634
4635         NECP_FD_LIST_UNLOCK();
4636
4637         if (client == NULL) {
4638                 error = ENOENT;
4639                 goto done;
4640         }
4641
4642         client->proc_pid = fd_data->proc_pid; // Transfer client to claiming pid
4643
4644         // Add matched client to our fd and re-run result
4645         NECP_FD_LOCK(fd_data);
4646         RB_INSERT(_necp_client_tree, &fd_data->clients, client);
4647         NECP_CLIENT_LOCK(client);
4648         (void)necp_update_client_result(current_proc(), fd_data, client, NULL);
4649         NECP_CLIENT_UNLOCK(client);
4650         NECP_FD_UNLOCK(fd_data);
4651
4652         necp_client_release(client);
4653
4654 done:
4655         *retval = error;
4656
4657         return error;
4658 }
4659
4660 static NECP_CLIENT_ACTION_FUNCTION int
4661 necp_client_remove(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
4662 {
4663         int error = 0;
4664         uuid_t client_id = {};
4665         struct ifnet_stats_per_flow flow_ifnet_stats = {};
4666
4667         if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
4668                 error = EINVAL;
4669                 goto done;
4670         }
4671
4672         error = copyin(uap->client_id, client_id, sizeof(uuid_t));
4673         if (error) {
4674                 NECPLOG(LOG_ERR, "necp_client_remove copyin client_id error (%d)", error);
4675                 goto done;
4676         }
4677
4678         if (uap->buffer != 0 && uap->buffer_size == sizeof(flow_ifnet_stats)) {
4679                 error = copyin(uap->buffer, &flow_ifnet_stats, uap->buffer_size);
4680                 if (error) {
4681                         NECPLOG(LOG_ERR, "necp_client_remove flow_ifnet_stats copyin error (%d)", error);
4682                         // Not fatal; make sure to zero-out stats in case of partial copy
4683                         memset(&flow_ifnet_stats, 0, sizeof(flow_ifnet_stats));
4684                         error = 0;
4685                 }
4686         } else if (uap->buffer != 0) {
4687                 NECPLOG(LOG_ERR, "necp_client_remove unexpected parameters length (%zu)", uap->buffer_size);
4688         }
4689
4690         NECP_FD_LOCK(fd_data);
4691
4692         pid_t pid = fd_data->proc_pid;
4693         struct necp_client *client = necp_client_fd_find_client_unlocked(fd_data, client_id);
4694         if (client != NULL) {
4695                 // Remove any flow registrations that match
4696                 struct necp_client_flow_registration *flow_registration = NULL;
4697                 struct necp_client_flow_registration *temp_flow_registration = NULL;
4698                 RB_FOREACH_SAFE(flow_registration, _necp_fd_flow_tree, &fd_data->flows, temp_flow_registration) {
4699                         if (flow_registration->client == client) {
4700                                 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
4701                                 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
4702                                 NECP_FLOW_TREE_UNLOCK();
4703                                 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
4704                         }
4705                 }
4706                 // Remove client from lists
4707                 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
4708                 RB_REMOVE(_necp_client_global_tree, &necp_client_global_tree, client);
4709                 NECP_CLIENT_TREE_UNLOCK();
4710                 RB_REMOVE(_necp_client_tree, &fd_data->clients, client);
4711         }
4712
4713
4714         NECP_FD_UNLOCK(fd_data);
4715
4716         if (client != NULL) {
4717                 ASSERT(error == 0);
4718                 necp_destroy_client(client, pid, true);
4719         } else {
4720                 error = ENOENT;
4721                 NECPLOG(LOG_ERR, "necp_client_remove invalid client_id (%d)", error);
4722         }
4723 done:
4724         *retval = error;
4725
4726         return error;
4727 }
4728
4729
4730 // Don't inline the function since it includes necp_client_parsed_parameters on the stack
4731 static __attribute__((noinline)) int
4732 necp_client_check_tcp_heuristics(struct necp_client *client, struct necp_client_flow *flow, u_int32_t *flags, u_int8_t *tfo_cookie, u_int8_t *tfo_cookie_len)
4733 {
4734         struct necp_client_parsed_parameters parsed_parameters;
4735         int error = 0;
4736
4737         error = necp_client_parse_parameters(client->parameters,
4738             (u_int32_t)client->parameters_length,
4739             &parsed_parameters);
4740         if (error) {
4741                 NECPLOG(LOG_ERR, "necp_client_parse_parameters error (%d)", error);
4742                 return error;
4743         }
4744
4745         if ((flow->remote_addr.sa.sa_family != AF_INET &&
4746             flow->remote_addr.sa.sa_family != AF_INET6) ||
4747             (flow->local_addr.sa.sa_family != AF_INET &&
4748             flow->local_addr.sa.sa_family != AF_INET6)) {
4749                 return EINVAL;
4750         }
4751
4752         NECP_CLIENT_ROUTE_LOCK(client);
4753
4754         if (client->current_route == NULL) {
4755                 error = ENOENT;
4756                 goto do_unlock;
4757         }
4758
4759         bool check_ecn = false;
4760         do {
4761                 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) ==
4762                     NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) {
4763                         check_ecn = true;
4764                         break;
4765                 }
4766
4767                 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) ==
4768                     NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) {
4769                         break;
4770                 }
4771
4772                 if (client->current_route != NULL) {
4773                         if (client->current_route->rt_ifp->if_eflags & IFEF_ECN_ENABLE) {
4774                                 check_ecn = true;
4775                                 break;
4776                         }
4777                         if (client->current_route->rt_ifp->if_eflags & IFEF_ECN_DISABLE) {
4778                                 break;
4779                         }
4780                 }
4781
4782                 bool inbound = ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) == 0);
4783                 if ((inbound && tcp_ecn_inbound == 1) ||
4784                     (!inbound && tcp_ecn_outbound == 1)) {
4785                         check_ecn = true;
4786                 }
4787         } while (false);
4788
4789         if (check_ecn) {
4790                 if (tcp_heuristic_do_ecn_with_address(client->current_route->rt_ifp,
4791                     (union sockaddr_in_4_6 *)&flow->local_addr)) {
4792                         *flags |= NECP_CLIENT_RESULT_FLAG_ECN_ENABLED;
4793                 }
4794         }
4795
4796         if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) ==
4797             NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) {
4798                 if (!tcp_heuristic_do_tfo_with_address(client->current_route->rt_ifp,
4799                     (union sockaddr_in_4_6 *)&flow->local_addr,
4800                     (union sockaddr_in_4_6 *)&flow->remote_addr,
4801                     tfo_cookie, tfo_cookie_len)) {
4802                         *flags |= NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED;
4803                         *tfo_cookie_len = 0;
4804                 }
4805         } else {
4806                 *flags |= NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED;
4807                 *tfo_cookie_len = 0;
4808         }
4809 do_unlock:
4810         NECP_CLIENT_ROUTE_UNLOCK(client);
4811
4812         return error;
4813 }
4814
4815 static size_t
4816 necp_client_calculate_flow_tlv_size(struct necp_client_flow_registration *flow_registration)
4817 {
4818         size_t assigned_results_size = 0;
4819         struct necp_client_flow *flow = NULL;
4820         LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
4821                 if (flow->assigned) {
4822                         size_t header_length = 0;
4823                         if (flow->nexus) {
4824                                 header_length = sizeof(struct necp_client_nexus_flow_header);
4825                         } else {
4826                                 header_length = sizeof(struct necp_client_flow_header);
4827                         }
4828                         assigned_results_size += (header_length + flow->assigned_results_length);
4829
4830                         if (flow->has_protoctl_event) {
4831                                 assigned_results_size += sizeof(struct necp_client_flow_protoctl_event_header);
4832                         }
4833                 }
4834         }
4835         return assigned_results_size;
4836 }
4837
4838 static int
4839 necp_client_fillout_flow_tlvs(struct necp_client *client,
4840     bool client_is_observed,
4841     struct necp_client_flow_registration *flow_registration,
4842     struct necp_client_action_args *uap,
4843     size_t *assigned_results_cursor)
4844 {
4845         int error = 0;
4846         struct necp_client_flow *flow = NULL;
4847         LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
4848                 if (flow->assigned) {
4849                         // Write TLV headers
4850                         struct necp_client_nexus_flow_header header = {};
4851                         u_int32_t length = 0;
4852                         u_int32_t flags = 0;
4853                         u_int8_t tfo_cookie_len = 0;
4854                         u_int8_t type = 0;
4855
4856                         type = NECP_CLIENT_RESULT_FLOW_ID;
4857                         length = sizeof(header.flow_header.flow_id);
4858                         memcpy(&header.flow_header.flow_id_tlv_header.type, &type, sizeof(type));
4859                         memcpy(&header.flow_header.flow_id_tlv_header.length, &length, sizeof(length));
4860                         uuid_copy(header.flow_header.flow_id, flow_registration->registration_id);
4861
4862                         if (flow->nexus) {
4863                                 if (flow->check_tcp_heuristics) {
4864                                         u_int8_t tfo_cookie[NECP_TFO_COOKIE_LEN_MAX];
4865                                         tfo_cookie_len = NECP_TFO_COOKIE_LEN_MAX;
4866
4867                                         if (necp_client_check_tcp_heuristics(client, flow, &flags,
4868                                             tfo_cookie, &tfo_cookie_len) != 0) {
4869                                                 tfo_cookie_len = 0;
4870                                         } else {
4871                                                 flow->check_tcp_heuristics = FALSE;
4872
4873                                                 if (tfo_cookie_len != 0) {
4874                                                         type = NECP_CLIENT_RESULT_TFO_COOKIE;
4875                                                         length = tfo_cookie_len;
4876                                                         memcpy(&header.tfo_cookie_tlv_header.type, &type, sizeof(type));
4877                                                         memcpy(&header.tfo_cookie_tlv_header.length, &length, sizeof(length));
4878                                                         memcpy(&header.tfo_cookie_value, tfo_cookie, tfo_cookie_len);
4879                                                 }
4880                                         }
4881                                 }
4882                         }
4883
4884                         size_t header_length = 0;
4885                         if (flow->nexus) {
4886                                 if (tfo_cookie_len != 0) {
4887                                         header_length = sizeof(struct necp_client_nexus_flow_header) - (NECP_TFO_COOKIE_LEN_MAX - tfo_cookie_len);
4888                                 } else {
4889                                         header_length = sizeof(struct necp_client_nexus_flow_header) - sizeof(struct necp_tlv_header) - NECP_TFO_COOKIE_LEN_MAX;
4890                                 }
4891                         } else {
4892                                 header_length = sizeof(struct necp_client_flow_header);
4893                         }
4894
4895                         type = NECP_CLIENT_RESULT_FLAGS;
4896                         length = sizeof(header.flow_header.flags_value);
4897                         memcpy(&header.flow_header.flags_tlv_header.type, &type, sizeof(type));
4898                         memcpy(&header.flow_header.flags_tlv_header.length, &length, sizeof(length));
4899                         if (flow->assigned) {
4900                                 flags |= NECP_CLIENT_RESULT_FLAG_FLOW_ASSIGNED;
4901                         }
4902                         if (flow->viable) {
4903                                 flags |= NECP_CLIENT_RESULT_FLAG_FLOW_VIABLE;
4904                         }
4905                         if (flow_registration->defunct) {
4906                                 flags |= NECP_CLIENT_RESULT_FLAG_DEFUNCT;
4907                         }
4908                         flags |= flow->necp_flow_flags;
4909                         memcpy(&header.flow_header.flags_value, &flags, sizeof(flags));
4910
4911                         type = NECP_CLIENT_RESULT_INTERFACE;
4912                         length = sizeof(header.flow_header.interface_value);
4913                         memcpy(&header.flow_header.interface_tlv_header.type, &type, sizeof(type));
4914                         memcpy(&header.flow_header.interface_tlv_header.length, &length, sizeof(length));
4915
4916                         struct necp_client_result_interface interface_struct;
4917                         interface_struct.generation = 0;
4918                         interface_struct.index = flow->interface_index;
4919
4920                         memcpy(&header.flow_header.interface_value, &interface_struct, sizeof(interface_struct));
4921                         if (flow->nexus) {
4922                                 type = NECP_CLIENT_RESULT_NETAGENT;
4923                                 length = sizeof(header.agent_value);
4924                                 memcpy(&header.agent_tlv_header.type, &type, sizeof(type));
4925                                 memcpy(&header.agent_tlv_header.length, &length, sizeof(length));
4926
4927                                 struct necp_client_result_netagent agent_struct;
4928                                 agent_struct.generation = 0;
4929                                 uuid_copy(agent_struct.netagent_uuid, flow->u.nexus_agent);
4930
4931                                 memcpy(&header.agent_value, &agent_struct, sizeof(agent_struct));
4932                         }
4933
4934                         // Don't include outer TLV header in length field
4935                         type = NECP_CLIENT_RESULT_FLOW;
4936                         length = (header_length - sizeof(struct necp_tlv_header) + flow->assigned_results_length);
4937                         if (flow->has_protoctl_event) {
4938                                 length += sizeof(struct necp_client_flow_protoctl_event_header);
4939                         }
4940                         memcpy(&header.flow_header.outer_header.type, &type, sizeof(type));
4941                         memcpy(&header.flow_header.outer_header.length, &length, sizeof(length));
4942
4943                         error = copyout(&header, uap->buffer + client->result_length + *assigned_results_cursor, header_length);
4944                         if (error) {
4945                                 NECPLOG(LOG_ERR, "necp_client_copy assigned results tlv_header copyout error (%d)", error);
4946                                 return error;
4947                         }
4948                         *assigned_results_cursor += header_length;
4949
4950                         if (flow->assigned_results && flow->assigned_results_length) {
4951                                 // Write inner TLVs
4952                                 error = copyout(flow->assigned_results, uap->buffer + client->result_length + *assigned_results_cursor,
4953                                     flow->assigned_results_length);
4954                                 if (error) {
4955                                         NECPLOG(LOG_ERR, "necp_client_copy assigned results copyout error (%d)", error);
4956                                         return error;
4957                                 }
4958                         }
4959                         *assigned_results_cursor += flow->assigned_results_length;
4960
4961                         /* Read the protocol event and reset it */
4962                         if (flow->has_protoctl_event) {
4963                                 struct necp_client_flow_protoctl_event_header protoctl_event_header = {};
4964
4965                                 type = NECP_CLIENT_RESULT_PROTO_CTL_EVENT;
4966                                 length = sizeof(protoctl_event_header.protoctl_event);
4967
4968                                 memcpy(&protoctl_event_header.protoctl_tlv_header.type, &type, sizeof(type));
4969                                 memcpy(&protoctl_event_header.protoctl_tlv_header.length, &length, sizeof(length));
4970                                 memcpy(&protoctl_event_header.protoctl_event, &flow->protoctl_event,
4971                                     sizeof(flow->protoctl_event));
4972
4973                                 error = copyout(&protoctl_event_header, uap->buffer + client->result_length + *assigned_results_cursor,
4974                                     sizeof(protoctl_event_header));
4975
4976                                 if (error) {
4977                                         NECPLOG(LOG_ERR, "necp_client_copy protocol control event results"
4978                                             " tlv_header copyout error (%d)", error);
4979                                         return error;
4980                                 }
4981                                 *assigned_results_cursor += sizeof(protoctl_event_header);
4982                                 flow->has_protoctl_event = FALSE;
4983                                 flow->protoctl_event.protoctl_event_code = 0;
4984                                 flow->protoctl_event.protoctl_event_val = 0;
4985                                 flow->protoctl_event.protoctl_event_tcp_seq_num = 0;
4986                         }
4987                 }
4988         }
4989         if (!client_is_observed) {
4990                 flow_registration->flow_result_read = TRUE;
4991         }
4992         return 0;
4993 }
4994
4995 static int
4996 necp_client_copy_internal(struct necp_client *client, uuid_t client_id, bool client_is_observed, struct necp_client_action_args *uap, int *retval)
4997 {
4998         NECP_CLIENT_ASSERT_LOCKED(client);
4999         int error = 0;
5000         // Copy results out
5001         if (uap->action == NECP_CLIENT_ACTION_COPY_PARAMETERS) {
5002                 if (uap->buffer_size < client->parameters_length) {
5003                         return EINVAL;
5004                 }
5005                 error = copyout(client->parameters, uap->buffer, client->parameters_length);
5006                 if (error) {
5007                         NECPLOG(LOG_ERR, "necp_client_copy parameters copyout error (%d)", error);
5008                         return error;
5009                 }
5010                 *retval = client->parameters_length;
5011         } else if (uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT &&
5012             client->result_read && !necp_client_has_unread_flows(client)) {
5013                 // Copy updates only, but nothing to read
5014                 // Just return 0 for bytes read
5015                 *retval = 0;
5016         } else if (uap->action == NECP_CLIENT_ACTION_COPY_RESULT ||
5017             uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
5018                 size_t assigned_results_size = 0;
5019
5020                 bool some_flow_is_defunct = false;
5021                 struct necp_client_flow_registration *single_flow_registration = NULL;
5022                 if (necp_client_id_is_flow(client_id)) {
5023                         single_flow_registration = necp_client_find_flow(client, client_id);
5024                         if (single_flow_registration != NULL) {
5025                                 assigned_results_size += necp_client_calculate_flow_tlv_size(single_flow_registration);
5026                         }
5027                 } else {
5028                         // This request is for the client, so copy everything
5029                         struct necp_client_flow_registration *flow_registration = NULL;
5030                         RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
5031                                 if (flow_registration->defunct) {
5032                                         some_flow_is_defunct = true;
5033                                 }
5034                                 assigned_results_size += necp_client_calculate_flow_tlv_size(flow_registration);
5035                         }
5036                 }
5037                 if (uap->buffer_size < (client->result_length + assigned_results_size)) {
5038                         return EINVAL;
5039                 }
5040
5041                 u_int32_t original_flags = 0;
5042                 bool flags_updated = false;
5043                 if (some_flow_is_defunct && client->legacy_client_is_flow) {
5044                         // If our client expects the defunct flag in the client, add it now
5045                         u_int32_t client_flags = 0;
5046                         u_int32_t value_size = 0;
5047                         u_int8_t *flags_pointer = necp_buffer_get_tlv_value(client->result, 0, &value_size);
5048                         if (flags_pointer != NULL && value_size == sizeof(client_flags)) {
5049                                 memcpy(&client_flags, flags_pointer, value_size);
5050                                 original_flags = client_flags;
5051                                 client_flags |= NECP_CLIENT_RESULT_FLAG_DEFUNCT;
5052                                 (void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS,
5053                                     sizeof(client_flags), &client_flags, &flags_updated,
5054                                     client->result, sizeof(client->result));
5055                         }
5056                 }
5057
5058                 error = copyout(client->result, uap->buffer, client->result_length);
5059
5060                 if (flags_updated) {
5061                         // Revert stored flags
5062                         (void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS,
5063                             sizeof(original_flags), &original_flags, &flags_updated,
5064                             client->result, sizeof(client->result));
5065                 }
5066
5067                 if (error) {
5068                         NECPLOG(LOG_ERR, "necp_client_copy result copyout error (%d)", error);
5069                         return error;
5070                 }
5071
5072                 size_t assigned_results_cursor = 0;
5073                 if (necp_client_id_is_flow(client_id)) {
5074                         if (single_flow_registration != NULL) {
5075                                 error = necp_client_fillout_flow_tlvs(client, client_is_observed, single_flow_registration, uap, &assigned_results_cursor);
5076                                 if (error != 0) {
5077                                         return error;
5078                                 }
5079                         }
5080                 } else {
5081                         // This request is for the client, so copy everything
5082                         struct necp_client_flow_registration *flow_registration = NULL;
5083                         RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
5084                                 error = necp_client_fillout_flow_tlvs(client, client_is_observed, flow_registration, uap, &assigned_results_cursor);
5085                                 if (error != 0) {
5086                                         return error;
5087                                 }
5088                         }
5089                 }
5090
5091                 *retval = client->result_length + assigned_results_cursor;
5092
5093                 if (!client_is_observed) {
5094                         client->result_read = TRUE;
5095                 }
5096         }
5097
5098         return 0;
5099 }
5100
5101 static NECP_CLIENT_ACTION_FUNCTION int
5102 necp_client_copy(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
5103 {
5104         int error = 0;
5105         struct necp_client *client = NULL;
5106         uuid_t client_id;
5107         uuid_clear(client_id);
5108
5109         *retval = 0;
5110
5111         if (uap->buffer_size == 0 || uap->buffer == 0) {
5112                 return EINVAL;
5113         }
5114
5115         if (uap->action != NECP_CLIENT_ACTION_COPY_PARAMETERS &&
5116             uap->action != NECP_CLIENT_ACTION_COPY_RESULT &&
5117             uap->action != NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
5118                 return EINVAL;
5119         }
5120
5121         if (uap->client_id) {
5122                 if (uap->client_id_len != sizeof(uuid_t)) {
5123                         NECPLOG(LOG_ERR, "Incorrect length (got %d, expected %d)", uap->client_id_len, sizeof(uuid_t));
5124                         return ERANGE;
5125                 }
5126
5127                 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
5128                 if (error) {
5129                         NECPLOG(LOG_ERR, "necp_client_copy client_id copyin error (%d)", error);
5130                         return error;
5131                 }
5132         }
5133
5134         const bool is_wildcard = (bool)uuid_is_null(client_id);
5135
5136         NECP_FD_LOCK(fd_data);
5137
5138         if (is_wildcard) {
5139                 if (uap->action == NECP_CLIENT_ACTION_COPY_RESULT || uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
5140                         struct necp_client *find_client = NULL;
5141                         RB_FOREACH(find_client, _necp_client_tree, &fd_data->clients) {
5142                                 NECP_CLIENT_LOCK(find_client);
5143                                 if (!find_client->result_read || necp_client_has_unread_flows(find_client)) {
5144                                         client = find_client;
5145                                         // Leave the client locked, and break
5146                                         break;
5147                                 }
5148                                 NECP_CLIENT_UNLOCK(find_client);
5149                         }
5150                 }
5151         } else {
5152                 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
5153         }
5154
5155         if (client != NULL) {
5156                 // If client is set, it is locked
5157                 error = necp_client_copy_internal(client, client_id, FALSE, uap, retval);
5158                 NECP_CLIENT_UNLOCK(client);
5159         }
5160
5161         // Unlock our own fd before moving on or returning
5162         NECP_FD_UNLOCK(fd_data);
5163
5164         if (client == NULL) {
5165                 if (fd_data->flags & NECP_OPEN_FLAG_OBSERVER) {
5166                         // Observers are allowed to lookup clients on other fds
5167
5168                         // Lock tree
5169                         NECP_CLIENT_TREE_LOCK_SHARED();
5170
5171                         bool found_client = FALSE;
5172
5173                         client = necp_find_client_and_lock(client_id);
5174                         if (client != NULL) {
5175                                 // Matched, copy out data
5176                                 found_client = TRUE;
5177                                 error = necp_client_copy_internal(client, client_id, TRUE, uap, retval);
5178                                 NECP_CLIENT_UNLOCK(client);
5179                         }
5180
5181                         // Unlock tree
5182                         NECP_CLIENT_TREE_UNLOCK();
5183
5184                         // No client found, fail
5185                         if (!found_client) {
5186                                 return ENOENT;
5187                         }
5188                 } else {
5189                         // No client found, and not allowed to search other fds, fail
5190                         return ENOENT;
5191                 }
5192         }
5193
5194         return error;
5195 }
5196
5197 static NECP_CLIENT_ACTION_FUNCTION int
5198 necp_client_copy_client_update(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
5199 {
5200         int error = 0;
5201
5202         *retval = 0;
5203
5204         if (!(fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER)) {
5205                 NECPLOG0(LOG_ERR, "NECP fd is not observer, cannot copy client update");
5206                 return EINVAL;
5207         }
5208
5209         if (uap->client_id_len != sizeof(uuid_t) || uap->client_id == 0) {
5210                 NECPLOG0(LOG_ERR, "Client id invalid, cannot copy client update");
5211                 return EINVAL;
5212         }
5213
5214         if (uap->buffer_size == 0 || uap->buffer == 0) {
5215                 NECPLOG0(LOG_ERR, "Buffer invalid, cannot copy client update");
5216                 return EINVAL;
5217         }
5218
5219         NECP_FD_LOCK(fd_data);
5220         struct necp_client_update *client_update = TAILQ_FIRST(&fd_data->update_list);
5221         if (client_update != NULL) {
5222                 TAILQ_REMOVE(&fd_data->update_list, client_update, chain);
5223                 VERIFY(fd_data->update_count > 0);
5224                 fd_data->update_count--;
5225         }
5226         NECP_FD_UNLOCK(fd_data);
5227
5228         if (client_update != NULL) {
5229                 error = copyout(client_update->client_id, uap->client_id, sizeof(uuid_t));
5230                 if (error) {
5231                         NECPLOG(LOG_ERR, "Copy client update copyout client id error (%d)", error);
5232                 } else {
5233                         if (uap->buffer_size < client_update->update_length) {
5234                                 NECPLOG(LOG_ERR, "Buffer size cannot hold update (%zu < %zu)", uap->buffer_size, client_update->update_length);
5235                                 error = EINVAL;
5236                         } else {
5237                                 error = copyout(&client_update->update, uap->buffer, client_update->update_length);
5238                                 if (error) {
5239                                         NECPLOG(LOG_ERR, "Copy client update copyout error (%d)", error);
5240                                 } else {
5241                                         *retval = client_update->update_length;
5242                                 }
5243                         }
5244                 }
5245
5246                 FREE(client_update, M_NECP);
5247                 client_update = NULL;
5248         } else {
5249                 error = ENOENT;
5250         }
5251
5252         return error;
5253 }
5254
5255 static int
5256 necp_client_copy_parameters_locked(struct necp_client *client,
5257     struct necp_client_nexus_parameters *parameters)
5258 {
5259         VERIFY(parameters != NULL);
5260
5261         struct necp_client_parsed_parameters parsed_parameters = {};
5262         int error = necp_client_parse_parameters(client->parameters, (u_int32_t)client->parameters_length, &parsed_parameters);
5263
5264         parameters->pid = client->proc_pid;
5265         if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID) {
5266                 parameters->epid = parsed_parameters.effective_pid;
5267         } else {
5268                 parameters->epid = parameters->pid;
5269         }
5270         memcpy(&parameters->local_addr, &parsed_parameters.local_addr, sizeof(parameters->local_addr));
5271         memcpy(&parameters->remote_addr, &parsed_parameters.remote_addr, sizeof(parameters->remote_addr));
5272         parameters->ip_protocol = parsed_parameters.ip_protocol;
5273         if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL) {
5274                 parameters->transport_protocol = parsed_parameters.transport_protocol;
5275         } else {
5276                 parameters->transport_protocol = parsed_parameters.ip_protocol;
5277         }
5278         parameters->ethertype = parsed_parameters.ethertype;
5279         parameters->traffic_class = parsed_parameters.traffic_class;
5280         uuid_copy(parameters->euuid, parsed_parameters.effective_uuid);
5281         parameters->is_listener = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) ? 1 : 0;
5282         parameters->is_interpose = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) ? 1 : 0;
5283         parameters->is_custom_ether = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) ? 1 : 0;
5284         parameters->policy_id = client->policy_id;
5285
5286         // parse client result flag
5287         u_int32_t client_result_flags = 0;
5288         u_int32_t value_size = 0;
5289         u_int8_t *flags_pointer = NULL;
5290         flags_pointer = necp_buffer_get_tlv_value(client->result, 0, &value_size);
5291         if (flags_pointer && value_size == sizeof(client_result_flags)) {
5292                 memcpy(&client_result_flags, flags_pointer, value_size);
5293         }
5294         parameters->allow_qos_marking = (client_result_flags & NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING) ? 1 : 0;
5295
5296         if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE) {
5297                 if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_DEFAULT) {
5298                         parameters->override_address_selection = false;
5299                 } else if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_TEMPORARY) {
5300                         parameters->override_address_selection = true;
5301                         parameters->use_stable_address = false;
5302                 } else if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_STABLE) {
5303                         parameters->override_address_selection = true;
5304                         parameters->use_stable_address = true;
5305                 }
5306         } else {
5307                 parameters->override_address_selection = false;
5308         }
5309
5310         return error;
5311 }
5312
5313 static NECP_CLIENT_ACTION_FUNCTION int
5314 necp_client_list(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
5315 {
5316         int error = 0;
5317         struct necp_client *find_client = NULL;
5318         uuid_t *list = NULL;
5319         u_int32_t requested_client_count = 0;
5320         u_int32_t client_count = 0;
5321         size_t copy_buffer_size = 0;
5322
5323         if (uap->buffer_size < sizeof(requested_client_count) || uap->buffer == 0) {
5324                 error = EINVAL;
5325                 goto done;
5326         }
5327
5328         if (!(fd_data->flags & NECP_OPEN_FLAG_OBSERVER)) {
5329                 NECPLOG0(LOG_ERR, "Client does not hold necessary entitlement to list other NECP clients");
5330                 error = EACCES;
5331                 goto done;
5332         }
5333
5334         error = copyin(uap->buffer, &requested_client_count, sizeof(requested_client_count));
5335         if (error) {
5336                 goto done;
5337         }
5338
5339         if (os_mul_overflow(sizeof(uuid_t), requested_client_count, &copy_buffer_size)) {
5340                 error = ERANGE;
5341                 goto done;
5342         }
5343
5344         if (uap->buffer_size - sizeof(requested_client_count) != copy_buffer_size) {
5345                 error = EINVAL;
5346                 goto done;
5347         }
5348
5349         if (copy_buffer_size > NECP_MAX_CLIENT_LIST_SIZE) {
5350                 error = EINVAL;
5351                 goto done;
5352         }
5353
5354         if (requested_client_count > 0) {
5355                 if ((list = _MALLOC(copy_buffer_size, M_NECP, M_WAITOK | M_ZERO)) == NULL) {
5356                         error = ENOMEM;
5357                         goto done;
5358                 }
5359         }
5360
5361         // Lock tree
5362         NECP_CLIENT_TREE_LOCK_SHARED();
5363
5364         find_client = NULL;
5365         RB_FOREACH(find_client, _necp_client_global_tree, &necp_client_global_tree) {
5366                 NECP_CLIENT_LOCK(find_client);
5367                 if (!uuid_is_null(find_client->client_id)) {
5368                         if (client_count < requested_client_count) {
5369                                 uuid_copy(list[client_count], find_client->client_id);
5370                         }
5371                         client_count++;
5372                 }
5373                 NECP_CLIENT_UNLOCK(find_client);
5374         }
5375
5376         // Unlock tree
5377         NECP_CLIENT_TREE_UNLOCK();
5378
5379         error = copyout(&client_count, uap->buffer, sizeof(client_count));
5380         if (error) {
5381                 NECPLOG(LOG_ERR, "necp_client_list buffer copyout error (%d)", error);
5382                 goto done;
5383         }
5384
5385         if (requested_client_count > 0 &&
5386             client_count > 0 &&
5387             list != NULL) {
5388                 error = copyout(list, uap->buffer + sizeof(client_count), copy_buffer_size);
5389                 if (error) {
5390                         NECPLOG(LOG_ERR, "necp_client_list client count copyout error (%d)", error);
5391                         goto done;
5392                 }
5393         }
5394 done:
5395         if (list != NULL) {
5396                 FREE(list, M_NECP);
5397         }
5398         *retval = error;
5399
5400         return error;
5401 }
5402
5403
5404 static void
5405 necp_client_add_assertion(struct necp_client *client, uuid_t netagent_uuid)
5406 {
5407         struct necp_client_assertion *new_assertion = NULL;
5408
5409         MALLOC(new_assertion, struct necp_client_assertion *, sizeof(*new_assertion), M_NECP, M_WAITOK);
5410         if (new_assertion == NULL) {
5411                 NECPLOG0(LOG_ERR, "Failed to allocate assertion");
5412                 return;
5413         }
5414
5415         uuid_copy(new_assertion->asserted_netagent, netagent_uuid);
5416
5417         LIST_INSERT_HEAD(&client->assertion_list, new_assertion, assertion_chain);
5418 }
5419
5420 static bool
5421 necp_client_remove_assertion(struct necp_client *client, uuid_t netagent_uuid)
5422 {
5423         struct necp_client_assertion *found_assertion = NULL;
5424         struct necp_client_assertion *search_assertion = NULL;
5425         LIST_FOREACH(search_assertion, &client->assertion_list, assertion_chain) {
5426                 if (uuid_compare(search_assertion->asserted_netagent, netagent_uuid) == 0) {
5427                         found_assertion = search_assertion;
5428                         break;
5429                 }
5430         }
5431
5432         if (found_assertion == NULL) {
5433                 NECPLOG0(LOG_ERR, "Netagent uuid not previously asserted");
5434                 return false;
5435         }
5436
5437         LIST_REMOVE(found_assertion, assertion_chain);
5438         FREE(found_assertion, M_NECP);
5439         return true;
5440 }
5441
5442 static NECP_CLIENT_ACTION_FUNCTION int
5443 necp_client_agent_action(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
5444 {
5445         int error = 0;
5446         struct necp_client *client = NULL;
5447         uuid_t client_id;
5448         bool acted_on_agent = FALSE;
5449         u_int8_t *parameters = NULL;
5450         size_t parameters_size = uap->buffer_size;
5451
5452         if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
5453             uap->buffer_size == 0 || uap->buffer == 0) {
5454                 NECPLOG0(LOG_ERR, "necp_client_agent_action invalid parameters");
5455                 error = EINVAL;
5456                 goto done;
5457         }
5458
5459         error = copyin(uap->client_id, client_id, sizeof(uuid_t));
5460         if (error) {
5461                 NECPLOG(LOG_ERR, "necp_client_agent_action copyin client_id error (%d)", error);
5462                 goto done;
5463         }
5464
5465         if (uap->buffer_size > NECP_MAX_AGENT_ACTION_SIZE) {
5466                 NECPLOG(LOG_ERR, "necp_client_agent_action invalid buffer size (>%u)", NECP_MAX_AGENT_ACTION_SIZE);
5467                 error = EINVAL;
5468                 goto done;
5469         }
5470
5471         if ((parameters = _MALLOC(uap->buffer_size, M_NECP, M_WAITOK | M_ZERO)) == NULL) {
5472                 NECPLOG0(LOG_ERR, "necp_client_agent_action malloc failed");
5473                 error = ENOMEM;
5474                 goto done;
5475         }
5476
5477         error = copyin(uap->buffer, parameters, uap->buffer_size);
5478         if (error) {
5479                 NECPLOG(LOG_ERR, "necp_client_agent_action parameters copyin error (%d)", error);
5480                 goto done;
5481         }
5482
5483         NECP_FD_LOCK(fd_data);
5484         client = necp_client_fd_find_client_and_lock(fd_data, client_id);
5485         if (client != NULL) {
5486                 size_t offset = 0;
5487                 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
5488                         u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
5489                         u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
5490
5491                         if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
5492                                 // If the length is larger than what can fit in the remaining parameters size, bail
5493                                 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
5494                                 break;
5495                         }
5496
5497                         if (length > 0) {
5498                                 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
5499                                 if (length >= sizeof(uuid_t) &&
5500                                     value != NULL &&
5501                                     (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT ||
5502                                     type == NECP_CLIENT_PARAMETER_ASSERT_AGENT ||
5503                                     type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT)) {
5504                                         uuid_t agent_uuid;
5505                                         uuid_copy(agent_uuid, value);
5506                                         u_int8_t netagent_message_type = 0;
5507                                         if (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT) {
5508                                                 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_TRIGGER;
5509                                         } else if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
5510                                                 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT;
5511                                         } else if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
5512                                                 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
5513                                         }
5514
5515                                         // Before unasserting, verify that the assertion was already taken
5516                                         if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
5517                                                 if (!necp_client_remove_assertion(client, agent_uuid)) {
5518                                                         error = ENOENT;
5519                                                         break;
5520                                                 }
5521                                         }
5522
5523                                         struct necp_client_nexus_parameters parsed_parameters = {};
5524                                         necp_client_copy_parameters_locked(client, &parsed_parameters);
5525
5526                                         error = netagent_client_message_with_params(agent_uuid,
5527                                             client_id,
5528                                             fd_data->proc_pid,
5529                                             client->agent_handle,
5530                                             netagent_message_type,
5531                                             (struct necp_client_agent_parameters *)&parsed_parameters,
5532                                             NULL, NULL);
5533                                         if (error == 0) {
5534                                                 acted_on_agent = TRUE;
5535                                         } else {
5536                                                 break;
5537                                         }
5538
5539                                         // Only save the assertion if the action succeeded
5540                                         if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
5541                                                 necp_client_add_assertion(client, agent_uuid);
5542                                         }
5543                                 }
5544                         }
5545
5546                         offset += sizeof(struct necp_tlv_header) + length;
5547                 }
5548
5549                 NECP_CLIENT_UNLOCK(client);
5550         }
5551         NECP_FD_UNLOCK(fd_data);
5552
5553         if (!acted_on_agent &&
5554             error == 0) {
5555                 error = ENOENT;
5556         }
5557 done:
5558         *retval = error;
5559         if (parameters != NULL) {
5560                 FREE(parameters, M_NECP);
5561                 parameters = NULL;
5562         }
5563
5564         return error;
5565 }
5566
5567 static NECP_CLIENT_ACTION_FUNCTION int
5568 necp_client_copy_agent(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
5569 {
5570         int error = 0;
5571         uuid_t agent_uuid;
5572
5573         if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
5574             uap->buffer_size == 0 || uap->buffer == 0) {
5575                 NECPLOG0(LOG_ERR, "necp_client_copy_agent bad input");
5576                 error = EINVAL;
5577                 goto done;
5578         }
5579
5580         error = copyin(uap->client_id, agent_uuid, sizeof(uuid_t));
5581         if (error) {
5582                 NECPLOG(LOG_ERR, "necp_client_copy_agent copyin agent_uuid error (%d)", error);
5583                 goto done;
5584         }
5585
5586         error = netagent_copyout(agent_uuid, uap->buffer, uap->buffer_size);
5587         if (error) {
5588                 // netagent_copyout already logs appropriate errors
5589                 goto done;
5590         }
5591 done:
5592         *retval = error;
5593
5594         return error;
5595 }
5596
5597 static NECP_CLIENT_ACTION_FUNCTION int
5598 necp_client_agent_use(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
5599 {
5600         int error = 0;
5601         struct necp_client *client = NULL;
5602         uuid_t client_id;
5603         struct necp_agent_use_parameters parameters;
5604
5605         if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
5606             uap->buffer_size != sizeof(parameters) || uap->buffer == 0) {
5607                 error = EINVAL;
5608                 goto done;
5609         }
5610
5611         error = copyin(uap->client_id, client_id, sizeof(uuid_t));
5612         if (error) {
5613                 NECPLOG(LOG_ERR, "Copyin client_id error (%d)", error);
5614                 goto done;
5615         }
5616
5617         error = copyin(uap->buffer, &parameters, uap->buffer_size);
5618         if (error) {
5619                 NECPLOG(LOG_ERR, "Parameters copyin error (%d)", error);
5620                 goto done;
5621         }
5622
5623         NECP_FD_LOCK(fd_data);
5624         client = necp_client_fd_find_client_and_lock(fd_data, client_id);
5625         if (client != NULL) {
5626                 error = netagent_use(parameters.agent_uuid, &parameters.out_use_count);
5627                 NECP_CLIENT_UNLOCK(client);
5628         } else {
5629                 error = ENOENT;
5630         }
5631
5632         NECP_FD_UNLOCK(fd_data);
5633
5634         if (error == 0) {
5635                 error = copyout(&parameters, uap->buffer, uap->buffer_size);
5636                 if (error) {
5637                         NECPLOG(LOG_ERR, "Parameters copyout error (%d)", error);
5638                         goto done;
5639                 }
5640         }
5641
5642 done:
5643         *retval = error;
5644
5645         return error;
5646 }
5647
5648 struct necp_interface_details_legacy {
5649         char name[IFXNAMSIZ];
5650         u_int32_t index;
5651         u_int32_t generation;
5652         u_int32_t functional_type;
5653         u_int32_t delegate_index;
5654         u_int32_t flags; // see NECP_INTERFACE_FLAG_*
5655         u_int32_t mtu;
5656         struct necp_interface_signature ipv4_signature;
5657         struct necp_interface_signature ipv6_signature;
5658 };
5659
5660 static NECP_CLIENT_ACTION_FUNCTION int
5661 necp_client_copy_interface(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
5662 {
5663         int error = 0;
5664         u_int32_t interface_index = 0;
5665         struct necp_interface_details interface_details = {};
5666
5667         if (uap->client_id == 0 || uap->client_id_len != sizeof(u_int32_t) ||
5668             uap->buffer_size < sizeof(struct necp_interface_details_legacy) ||
5669             uap->buffer == 0) {
5670                 NECPLOG0(LOG_ERR, "necp_client_copy_interface bad input");
5671                 error = EINVAL;
5672                 goto done;
5673         }
5674
5675         error = copyin(uap->client_id, &interface_index, sizeof(u_int32_t));
5676         if (error) {
5677                 NECPLOG(LOG_ERR, "necp_client_copy_interface copyin interface_index error (%d)", error);
5678                 goto done;
5679         }
5680
5681         if (interface_index == 0) {
5682                 error = ENOENT;
5683                 NECPLOG(LOG_ERR, "necp_client_copy_interface bad interface_index (%d)", interface_index);
5684                 goto done;
5685         }
5686
5687         ifnet_head_lock_shared();
5688         ifnet_t interface = NULL;
5689         if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
5690                 interface = ifindex2ifnet[interface_index];
5691         }
5692
5693         if (interface != NULL) {
5694                 if (interface->if_xname != NULL) {
5695                         strlcpy((char *)&interface_details.name, interface->if_xname, sizeof(interface_details.name));
5696                 }
5697                 interface_details.index = interface->if_index;
5698                 interface_details.generation = ifnet_get_generation(interface);
5699                 if (interface->if_delegated.ifp != NULL) {
5700                         interface_details.delegate_index = interface->if_delegated.ifp->if_index;
5701                 }
5702                 interface_details.functional_type = if_functional_type(interface, TRUE);
5703                 if (IFNET_IS_EXPENSIVE(interface)) {
5704                         interface_details.flags |= NECP_INTERFACE_FLAG_EXPENSIVE;
5705                 }
5706                 if (IFNET_IS_CONSTRAINED(interface)) {
5707                         interface_details.flags |= NECP_INTERFACE_FLAG_CONSTRAINED;
5708                 }
5709                 if ((interface->if_eflags & IFEF_TXSTART) == IFEF_TXSTART) {
5710                         interface_details.flags |= NECP_INTERFACE_FLAG_TXSTART;
5711                 }
5712                 if ((interface->if_eflags & IFEF_NOACKPRI) == IFEF_NOACKPRI) {
5713                         interface_details.flags |= NECP_INTERFACE_FLAG_NOACKPRI;
5714                 }
5715                 if ((interface->if_eflags & IFEF_3CA) == IFEF_3CA) {
5716                         interface_details.flags |= NECP_INTERFACE_FLAG_3CARRIERAGG;
5717                 }
5718                 if (IFNET_IS_LOW_POWER(interface)) {
5719                         interface_details.flags |= NECP_INTERFACE_FLAG_IS_LOW_POWER;
5720                 }
5721                 if (interface->if_xflags & IFXF_MPK_LOG) {
5722                         interface_details.flags |= NECP_INTERFACE_FLAG_MPK_LOG;
5723                 }
5724                 interface_details.mtu = interface->if_mtu;
5725
5726                 u_int8_t ipv4_signature_len = sizeof(interface_details.ipv4_signature.signature);
5727                 u_int16_t ipv4_signature_flags;
5728                 if (ifnet_get_netsignature(interface, AF_INET, &ipv4_signature_len, &ipv4_signature_flags,
5729                     (u_int8_t *)&interface_details.ipv4_signature) != 0) {
5730                         ipv4_signature_len = 0;
5731                 }
5732                 interface_details.ipv4_signature.signature_len = ipv4_signature_len;
5733
5734                 u_int8_t ipv6_signature_len = sizeof(interface_details.ipv6_signature.signature);
5735                 u_int16_t ipv6_signature_flags;
5736                 if (ifnet_get_netsignature(interface, AF_INET6, &ipv6_signature_len, &ipv6_signature_flags,
5737                     (u_int8_t *)&interface_details.ipv6_signature) != 0) {
5738                         ipv6_signature_len = 0;
5739                 }
5740                 interface_details.ipv6_signature.signature_len = ipv6_signature_len;
5741
5742                 ifnet_lock_shared(interface);
5743                 struct ifaddr *ifa = NULL;
5744                 TAILQ_FOREACH(ifa, &interface->if_addrhead, ifa_link) {
5745                         IFA_LOCK(ifa);
5746                         if (ifa->ifa_addr->sa_family == AF_INET) {
5747                                 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_NETMASK;
5748                                 interface_details.ipv4_netmask = ((struct in_ifaddr *)ifa)->ia_sockmask.sin_addr.s_addr;
5749                                 if (interface->if_flags & IFF_BROADCAST) {
5750                                         interface_details.flags |= NECP_INTERFACE_FLAG_HAS_BROADCAST;
5751                                         interface_details.ipv4_broadcast = ((struct in_ifaddr *)ifa)->ia_broadaddr.sin_addr.s_addr;
5752                                 }
5753                         }
5754                         IFA_UNLOCK(ifa);
5755                 }
5756                 ifnet_lock_done(interface);
5757         }
5758
5759         ifnet_head_done();
5760
5761         // If the client is using an older version of the struct, copy that length
5762         size_t copy_length = sizeof(interface_details);
5763         if (uap->buffer_size < sizeof(struct necp_interface_details_legacy)) {
5764                 copy_length = sizeof(struct necp_interface_details_legacy);
5765         }
5766         error = copyout(&interface_details, uap->buffer, copy_length);
5767         if (error) {
5768                 NECPLOG(LOG_ERR, "necp_client_copy_interface copyout error (%d)", error);
5769                 goto done;
5770         }
5771 done:
5772         *retval = error;
5773
5774         return error;
5775 }
5776
5777
5778 static NECP_CLIENT_ACTION_FUNCTION int
5779 necp_client_copy_route_statistics(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
5780 {
5781         int error = 0;
5782         struct necp_client *client = NULL;
5783         uuid_t client_id;
5784
5785         if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
5786             uap->buffer_size < sizeof(struct necp_stat_counts) || uap->buffer == 0) {
5787                 NECPLOG0(LOG_ERR, "necp_client_copy_route_statistics bad input");
5788                 error = EINVAL;
5789                 goto done;
5790         }
5791
5792         error = copyin(uap->client_id, client_id, sizeof(uuid_t));
5793         if (error) {
5794                 NECPLOG(LOG_ERR, "necp_client_copy_route_statistics copyin client_id error (%d)", error);
5795                 goto done;
5796         }
5797
5798         // Lock
5799         NECP_FD_LOCK(fd_data);
5800         client = necp_client_fd_find_client_and_lock(fd_data, client_id);
5801         if (client != NULL) {
5802                 NECP_CLIENT_ROUTE_LOCK(client);
5803                 struct necp_stat_counts route_stats = {};
5804                 if (client->current_route != NULL && client->current_route->rt_stats != NULL) {
5805                         struct nstat_counts     *rt_stats = client->current_route->rt_stats;
5806                         atomic_get_64(route_stats.necp_stat_rxpackets, &rt_stats->nstat_rxpackets);
5807                         atomic_get_64(route_stats.necp_stat_rxbytes, &rt_stats->nstat_rxbytes);
5808                         atomic_get_64(route_stats.necp_stat_txpackets, &rt_stats->nstat_txpackets);
5809                         atomic_get_64(route_stats.necp_stat_txbytes, &rt_stats->nstat_txbytes);
5810                         route_stats.necp_stat_rxduplicatebytes = rt_stats->nstat_rxduplicatebytes;
5811                         route_stats.necp_stat_rxoutoforderbytes = rt_stats->nstat_rxoutoforderbytes;
5812                         route_stats.necp_stat_txretransmit = rt_stats->nstat_txretransmit;
5813                         route_stats.necp_stat_connectattempts = rt_stats->nstat_connectattempts;
5814                         route_stats.necp_stat_connectsuccesses = rt_stats->nstat_connectsuccesses;
5815                         route_stats.necp_stat_min_rtt = rt_stats->nstat_min_rtt;
5816                         route_stats.necp_stat_avg_rtt = rt_stats->nstat_avg_rtt;
5817                         route_stats.necp_stat_var_rtt = rt_stats->nstat_var_rtt;
5818                         route_stats.necp_stat_route_flags = client->current_route->rt_flags;
5819                 }
5820
5821                 // Unlock before copying out
5822                 NECP_CLIENT_ROUTE_UNLOCK(client);
5823                 NECP_CLIENT_UNLOCK(client);
5824                 NECP_FD_UNLOCK(fd_data);
5825
5826                 error = copyout(&route_stats, uap->buffer, sizeof(route_stats));
5827                 if (error) {
5828                         NECPLOG(LOG_ERR, "necp_client_copy_route_statistics copyout error (%d)", error);
5829                 }
5830         } else {
5831                 // Unlock
5832                 NECP_FD_UNLOCK(fd_data);
5833                 error = ENOENT;
5834         }
5835
5836
5837 done:
5838         *retval = error;
5839         return error;
5840 }
5841
5842 static NECP_CLIENT_ACTION_FUNCTION int
5843 necp_client_update_cache(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
5844 {
5845         int error = 0;
5846         struct necp_client *client = NULL;
5847         uuid_t client_id;
5848
5849         if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
5850                 error = EINVAL;
5851                 goto done;
5852         }
5853
5854         error = copyin(uap->client_id, client_id, sizeof(uuid_t));
5855         if (error) {
5856                 NECPLOG(LOG_ERR, "necp_client_update_cache copyin client_id error (%d)", error);
5857                 goto done;
5858         }
5859
5860         NECP_FD_LOCK(fd_data);
5861         client = necp_client_fd_find_client_and_lock(fd_data, client_id);
5862         if (client == NULL) {
5863                 NECP_FD_UNLOCK(fd_data);
5864                 error = ENOENT;
5865                 goto done;
5866         }
5867
5868         struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
5869         if (flow_registration == NULL) {
5870                 NECP_CLIENT_UNLOCK(client);
5871                 NECP_FD_UNLOCK(fd_data);
5872                 error = ENOENT;
5873                 goto done;
5874         }
5875
5876         NECP_CLIENT_ROUTE_LOCK(client);
5877         // This needs to be changed when TFO/ECN is supported by multiple flows
5878         struct necp_client_flow *flow = LIST_FIRST(&flow_registration->flow_list);
5879         if (flow == NULL ||
5880             (flow->remote_addr.sa.sa_family != AF_INET &&
5881             flow->remote_addr.sa.sa_family != AF_INET6) ||
5882             (flow->local_addr.sa.sa_family != AF_INET &&
5883             flow->local_addr.sa.sa_family != AF_INET6)) {
5884                 error = EINVAL;
5885                 NECPLOG(LOG_ERR, "necp_client_update_cache no flow error (%d)", error);
5886                 goto done_unlock;
5887         }
5888
5889         necp_cache_buffer cache_buffer;
5890         memset(&cache_buffer, 0, sizeof(cache_buffer));
5891
5892         if (uap->buffer_size != sizeof(necp_cache_buffer) ||
5893             uap->buffer == USER_ADDR_NULL) {
5894                 error = EINVAL;
5895                 goto done_unlock;
5896         }
5897
5898         error = copyin(uap->buffer, &cache_buffer, sizeof(cache_buffer));
5899         if (error) {
5900                 NECPLOG(LOG_ERR, "necp_client_update_cache copyin cache buffer error (%d)", error);
5901                 goto done_unlock;
5902         }
5903
5904         if (cache_buffer.necp_cache_buf_type == NECP_CLIENT_CACHE_TYPE_ECN &&
5905             cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_ECN_VER_1) {
5906                 if (cache_buffer.necp_cache_buf_size != sizeof(necp_tcp_ecn_cache) ||
5907                     cache_buffer.necp_cache_buf_addr == USER_ADDR_NULL) {
5908                         error = EINVAL;
5909                         goto done_unlock;
5910                 }
5911
5912                 necp_tcp_ecn_cache ecn_cache_buffer;
5913                 memset(&ecn_cache_buffer, 0, sizeof(ecn_cache_buffer));
5914
5915                 error = copyin(cache_buffer.necp_cache_buf_addr, &ecn_cache_buffer, sizeof(necp_tcp_ecn_cache));
5916                 if (error) {
5917                         NECPLOG(LOG_ERR, "necp_client_update_cache copyin ecn cache buffer error (%d)", error);
5918                         goto done_unlock;
5919                 }
5920
5921                 if (client->current_route != NULL && client->current_route->rt_ifp != NULL) {
5922                         if (!client->platform_binary) {
5923                                 ecn_cache_buffer.necp_tcp_ecn_heuristics_success = 0;
5924                         }
5925                         tcp_heuristics_ecn_update(&ecn_cache_buffer, client->current_route->rt_ifp,
5926                             (union sockaddr_in_4_6 *)&flow->local_addr);
5927                 }
5928         } else if (cache_buffer.necp_cache_buf_type == NECP_CLIENT_CACHE_TYPE_TFO &&
5929             cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_TFO_VER_1) {
5930                 if (cache_buffer.necp_cache_buf_size != sizeof(necp_tcp_tfo_cache) ||
5931                     cache_buffer.necp_cache_buf_addr == USER_ADDR_NULL) {
5932                         error = EINVAL;
5933                         goto done_unlock;
5934                 }
5935
5936                 necp_tcp_tfo_cache tfo_cache_buffer;
5937                 memset(&tfo_cache_buffer, 0, sizeof(tfo_cache_buffer));
5938
5939                 error = copyin(cache_buffer.necp_cache_buf_addr, &tfo_cache_buffer, sizeof(necp_tcp_tfo_cache));
5940                 if (error) {
5941                         NECPLOG(LOG_ERR, "necp_client_update_cache copyin tfo cache buffer error (%d)", error);
5942                         goto done_unlock;
5943                 }
5944
5945                 if (client->current_route != NULL && client->current_route->rt_ifp != NULL) {
5946                         if (!client->platform_binary) {
5947                                 tfo_cache_buffer.necp_tcp_tfo_heuristics_success = 0;
5948                         }
5949                         tcp_heuristics_tfo_update(&tfo_cache_buffer, client->current_route->rt_ifp,
5950                             (union sockaddr_in_4_6 *)&flow->local_addr,
5951                             (union sockaddr_in_4_6 *)&flow->remote_addr);
5952                 }
5953         } else {
5954                 error = EINVAL;
5955         }
5956 done_unlock:
5957         NECP_CLIENT_ROUTE_UNLOCK(client);
5958         NECP_CLIENT_UNLOCK(client);
5959         NECP_FD_UNLOCK(fd_data);
5960 done:
5961         *retval = error;
5962         return error;
5963 }
5964
5965 #define NECP_CLIENT_ACTION_SIGN_DEFAULT_HOSTNAME_LENGTH 64
5966 #define NECP_CLIENT_ACTION_SIGN_MAX_HOSTNAME_LENGTH 1024
5967
5968 #define NECP_CLIENT_ACTION_SIGN_TAG_LENGTH 32
5969
5970 static NECP_CLIENT_ACTION_FUNCTION int
5971 necp_client_sign(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
5972 {
5973         int error = 0;
5974         u_int32_t hostname_length = 0;
5975         u_int8_t tag[NECP_CLIENT_ACTION_SIGN_TAG_LENGTH] = {};
5976         struct necp_client_signable signable = {};
5977         union necp_sockaddr_union address_answer = {};
5978         u_int8_t *client_hostname = NULL;
5979         u_int8_t *allocated_hostname = NULL;
5980         u_int8_t default_hostname[NECP_CLIENT_ACTION_SIGN_DEFAULT_HOSTNAME_LENGTH] = "";
5981         uint32_t tag_size = sizeof(tag);
5982
5983         *retval = 0;
5984
5985         const bool has_resolver_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_VALIDATED_RESOLVER, 0) == 0);
5986         if (!has_resolver_entitlement) {
5987                 NECPLOG0(LOG_ERR, "Process does not hold the necessary entitlement to sign resolver answers");
5988                 error = EPERM;
5989                 goto done;
5990         }
5991
5992         if (uap->client_id == 0 || uap->client_id_len < sizeof(struct necp_client_signable)) {
5993                 error = EINVAL;
5994                 goto done;
5995         }
5996
5997         if (uap->buffer == 0 || uap->buffer_size != NECP_CLIENT_ACTION_SIGN_TAG_LENGTH) {
5998                 error = EINVAL;
5999                 goto done;
6000         }
6001
6002         error = copyin(uap->client_id, &signable, sizeof(signable));
6003         if (error) {
6004                 NECPLOG(LOG_ERR, "necp_client_sign copyin signable error (%d)", error);
6005                 goto done;
6006         }
6007
6008         if (signable.sign_type != NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER) {
6009                 NECPLOG(LOG_ERR, "necp_client_sign unknown signable type (%u)", signable.sign_type);
6010                 error = EINVAL;
6011                 goto done;
6012         }
6013
6014         if (uap->client_id_len < sizeof(struct necp_client_resolver_answer)) {
6015                 error = EINVAL;
6016                 goto done;
6017         }
6018
6019         error = copyin(uap->client_id + sizeof(signable), &address_answer, sizeof(address_answer));
6020         if (error) {
6021                 NECPLOG(LOG_ERR, "necp_client_sign copyin address_answer error (%d)", error);
6022                 goto done;
6023         }
6024
6025         error = copyin(uap->client_id + sizeof(signable) + sizeof(address_answer), &hostname_length, sizeof(hostname_length));
6026         if (error) {
6027                 NECPLOG(LOG_ERR, "necp_client_sign copyin hostname_length error (%d)", error);
6028                 goto done;
6029         }
6030
6031         if (hostname_length > NECP_CLIENT_ACTION_SIGN_MAX_HOSTNAME_LENGTH) {
6032                 error = EINVAL;
6033                 goto done;
6034         }
6035
6036         if (hostname_length > NECP_CLIENT_ACTION_SIGN_DEFAULT_HOSTNAME_LENGTH) {
6037                 if ((allocated_hostname = _MALLOC(hostname_length, M_NECP, M_WAITOK | M_ZERO)) == NULL) {
6038                         NECPLOG(LOG_ERR, "necp_client_sign malloc hostname %u failed", hostname_length);
6039                         error = ENOMEM;
6040                         goto done;
6041                 }
6042
6043                 client_hostname = allocated_hostname;
6044         } else {
6045                 client_hostname = default_hostname;
6046         }
6047
6048         error = copyin(uap->client_id + sizeof(signable) + sizeof(address_answer) + sizeof(hostname_length), client_hostname, hostname_length);
6049         if (error) {
6050                 NECPLOG(LOG_ERR, "necp_client_sign copyin hostname error (%d)", error);
6051                 goto done;
6052         }
6053
6054         address_answer.sin.sin_port = 0;
6055         error = necp_sign_resolver_answer(signable.client_id, client_hostname, hostname_length,
6056             (u_int8_t *)&address_answer, sizeof(address_answer),
6057             tag, &tag_size);
6058         if (tag_size != sizeof(tag)) {
6059                 NECPLOG(LOG_ERR, "necp_client_sign unexpected tag size %u", tag_size);
6060                 error = EINVAL;
6061                 goto done;
6062         }
6063         error = copyout(tag, uap->buffer, tag_size);
6064         if (error) {
6065                 NECPLOG(LOG_ERR, "necp_client_sign copyout error (%d)", error);
6066                 goto done;
6067         }
6068
6069 done:
6070         if (allocated_hostname != NULL) {
6071                 FREE(allocated_hostname, M_NECP);
6072                 allocated_hostname = NULL;
6073         }
6074         *retval = error;
6075         return error;
6076 }
6077
6078 int
6079 necp_client_action(struct proc *p, struct necp_client_action_args *uap, int *retval)
6080 {
6081 #pragma unused(p)
6082         int error = 0;
6083         int return_value = 0;
6084         struct necp_fd_data *fd_data = NULL;
6085         error = necp_find_fd_data(uap->necp_fd, &fd_data);
6086         if (error != 0) {
6087                 NECPLOG(LOG_ERR, "necp_client_action find fd error (%d)", error);
6088                 return error;
6089         }
6090
6091         u_int32_t action = uap->action;
6092         switch (action) {
6093         case NECP_CLIENT_ACTION_ADD: {
6094                 return_value = necp_client_add(p, fd_data, uap, retval);
6095                 break;
6096         }
6097         case NECP_CLIENT_ACTION_CLAIM: {
6098                 return_value = necp_client_claim(p, fd_data, uap, retval);
6099                 break;
6100         }
6101         case NECP_CLIENT_ACTION_REMOVE: {
6102                 return_value = necp_client_remove(fd_data, uap, retval);
6103                 break;
6104         }
6105         case NECP_CLIENT_ACTION_COPY_PARAMETERS:
6106         case NECP_CLIENT_ACTION_COPY_RESULT:
6107         case NECP_CLIENT_ACTION_COPY_UPDATED_RESULT: {
6108                 return_value = necp_client_copy(fd_data, uap, retval);
6109                 break;
6110         }
6111         case NECP_CLIENT_ACTION_COPY_LIST: {
6112                 return_value = necp_client_list(fd_data, uap, retval);
6113                 break;
6114         }
6115         case NECP_CLIENT_ACTION_AGENT: {
6116                 return_value = necp_client_agent_action(fd_data, uap, retval);
6117                 break;
6118         }
6119         case NECP_CLIENT_ACTION_COPY_AGENT: {
6120                 return_value = necp_client_copy_agent(fd_data, uap, retval);
6121                 break;
6122         }
6123         case NECP_CLIENT_ACTION_AGENT_USE: {
6124                 return_value = necp_client_agent_use(fd_data, uap, retval);
6125                 break;
6126         }
6127         case NECP_CLIENT_ACTION_COPY_INTERFACE: {
6128                 return_value = necp_client_copy_interface(fd_data, uap, retval);
6129                 break;
6130         }
6131         case NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS: {
6132                 return_value = necp_client_copy_route_statistics(fd_data, uap, retval);
6133                 break;
6134         }
6135         case NECP_CLIENT_ACTION_UPDATE_CACHE: {
6136                 return_value = necp_client_update_cache(fd_data, uap, retval);
6137                 break;
6138         }
6139         case NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE: {
6140                 return_value = necp_client_copy_client_update(fd_data, uap, retval);
6141                 break;
6142         }
6143         case NECP_CLIENT_ACTION_SIGN: {
6144                 return_value = necp_client_sign(fd_data, uap, retval);
6145                 break;
6146         }
6147         default: {
6148                 NECPLOG(LOG_ERR, "necp_client_action unknown action (%u)", action);
6149                 return_value = EINVAL;
6150                 break;
6151         }
6152         }
6153
6154         file_drop(uap->necp_fd);
6155
6156         return return_value;
6157 }
6158
6159 #define NECP_MAX_MATCH_POLICY_PARAMETER_SIZE 1024
6160
6161 int
6162 necp_match_policy(struct proc *p, struct necp_match_policy_args *uap, int32_t *retval)
6163 {
6164 #pragma unused(retval)
6165         u_int8_t *parameters = NULL;
6166         struct necp_aggregate_result returned_result;
6167         int error = 0;
6168
6169         if (uap == NULL) {
6170                 error = EINVAL;
6171                 goto done;
6172         }
6173
6174         if (uap->parameters == 0 || uap->parameters_size == 0 || uap->parameters_size > NECP_MAX_MATCH_POLICY_PARAMETER_SIZE || uap->returned_result == 0) {
6175                 error = EINVAL;
6176                 goto done;
6177         }
6178
6179         MALLOC(parameters, u_int8_t *, uap->parameters_size, M_NECP, M_WAITOK | M_ZERO);
6180         if (parameters == NULL) {
6181                 error = ENOMEM;
6182                 goto done;
6183         }
6184         // Copy parameters in
6185         error = copyin(uap->parameters, parameters, uap->parameters_size);
6186         if (error) {
6187                 goto done;
6188         }
6189
6190         error = necp_application_find_policy_match_internal(p, parameters, uap->parameters_size,
6191             &returned_result, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL, false, false);
6192         if (error) {
6193                 goto done;
6194         }
6195
6196         // Copy return value back
6197         error = copyout(&returned_result, uap->returned_result, sizeof(struct necp_aggregate_result));
6198         if (error) {
6199                 goto done;
6200         }
6201 done:
6202         if (parameters != NULL) {
6203                 FREE(parameters, M_NECP);
6204         }
6205         return error;
6206 }
6207
6208 /// Socket operations
6209 #define NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH 253
6210
6211 static bool
6212 necp_set_socket_attribute(u_int8_t *buffer, size_t buffer_length, u_int8_t type, char **buffer_p)
6213 {
6214         int error = 0;
6215         int cursor = 0;
6216         size_t string_size = 0;
6217         char *local_string = NULL;
6218         u_int8_t *value = NULL;
6219
6220         cursor = necp_buffer_find_tlv(buffer, buffer_length, 0, type, NULL, 0);
6221         if (cursor < 0) {
6222                 // This will clear out the parameter
6223                 goto done;
6224         }
6225
6226         string_size = necp_buffer_get_tlv_length(buffer, cursor);
6227         if (string_size == 0 || string_size > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) {
6228                 // This will clear out the parameter
6229                 goto done;
6230         }
6231
6232         MALLOC(local_string, char *, string_size + 1, M_NECP, M_WAITOK | M_ZERO);
6233         if (local_string == NULL) {
6234                 NECPLOG(LOG_ERR, "Failed to allocate a socket attribute buffer (size %d)", string_size);
6235                 goto fail;
6236         }
6237
6238         value = necp_buffer_get_tlv_value(buffer, cursor, NULL);
6239         if (value == NULL) {
6240                 NECPLOG0(LOG_ERR, "Failed to get socket attribute");
6241                 goto fail;
6242         }
6243
6244         memcpy(local_string, value, string_size);
6245         local_string[string_size] = 0;
6246
6247 done:
6248         if (*buffer_p != NULL) {
6249                 FREE(*buffer_p, M_NECP);
6250                 *buffer_p = NULL;
6251         }
6252
6253         *buffer_p = local_string;
6254         return 0;
6255 fail:
6256         if (local_string != NULL) {
6257                 FREE(local_string, M_NECP);
6258         }
6259         return error;
6260 }
6261
6262 errno_t
6263 necp_set_socket_attributes(struct socket *so, struct sockopt *sopt)
6264 {
6265         int error = 0;
6266         u_int8_t *buffer = NULL;
6267         struct inpcb *inp = NULL;
6268
6269         if ((SOCK_DOM(so) != PF_INET
6270 #if INET6
6271             && SOCK_DOM(so) != PF_INET6
6272 #endif
6273             )) {
6274                 error = EINVAL;
6275                 goto done;
6276         }
6277
6278         inp = sotoinpcb(so);
6279
6280         size_t valsize = sopt->sopt_valsize;
6281         if (valsize == 0 ||
6282             valsize > ((sizeof(struct necp_tlv_header) + NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) * 2)) {
6283                 goto done;
6284         }
6285
6286         MALLOC(buffer, u_int8_t *, valsize, M_NECP, M_WAITOK | M_ZERO);
6287         if (buffer == NULL) {
6288                 goto done;
6289         }
6290
6291         error = sooptcopyin(sopt, buffer, valsize, 0);
6292         if (error) {
6293                 goto done;
6294         }
6295
6296         error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN, &inp->inp_necp_attributes.inp_domain);
6297         if (error) {
6298                 NECPLOG0(LOG_ERR, "Could not set domain TLV for socket attributes");
6299                 goto done;
6300         }
6301
6302         error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_ACCOUNT, &inp->inp_necp_attributes.inp_account);
6303         if (error) {
6304                 NECPLOG0(LOG_ERR, "Could not set account TLV for socket attributes");
6305                 goto done;
6306         }
6307
6308         if (necp_debug) {
6309                 NECPLOG(LOG_DEBUG, "Set on socket: Domain %s, Account %s", inp->inp_necp_attributes.inp_domain, inp->inp_necp_attributes.inp_account);
6310         }
6311 done:
6312         if (buffer != NULL) {
6313                 FREE(buffer, M_NECP);
6314         }
6315
6316         return error;
6317 }
6318
6319 errno_t
6320 necp_get_socket_attributes(struct socket *so, struct sockopt *sopt)
6321 {
6322         int error = 0;
6323         u_int8_t *buffer = NULL;
6324         u_int8_t *cursor = NULL;
6325         size_t valsize = 0;
6326         struct inpcb *inp = NULL;
6327
6328         if ((SOCK_DOM(so) != PF_INET
6329 #if INET6
6330             && SOCK_DOM(so) != PF_INET6
6331 #endif
6332             )) {
6333                 error = EINVAL;
6334                 goto done;
6335         }
6336
6337         inp = sotoinpcb(so);
6338         if (inp->inp_necp_attributes.inp_domain != NULL) {
6339                 valsize += sizeof(struct necp_tlv_header) + strlen(inp->inp_necp_attributes.inp_domain);
6340         }
6341         if (inp->inp_necp_attributes.inp_account != NULL) {
6342                 valsize += sizeof(struct necp_tlv_header) + strlen(inp->inp_necp_attributes.inp_account);
6343         }
6344         if (valsize == 0) {
6345                 goto done;
6346         }
6347
6348         MALLOC(buffer, u_int8_t *, valsize, M_NECP, M_WAITOK | M_ZERO);
6349         if (buffer == NULL) {
6350                 goto done;
6351         }
6352
6353         cursor = buffer;
6354         if (inp->inp_necp_attributes.inp_domain != NULL) {
6355                 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN, strlen(inp->inp_necp_attributes.inp_domain), inp->inp_necp_attributes.inp_domain,
6356                     buffer, valsize);
6357         }
6358
6359         if (inp->inp_necp_attributes.inp_account != NULL) {
6360                 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_ACCOUNT, strlen(inp->inp_necp_attributes.inp_account), inp->inp_necp_attributes.inp_account,
6361                     buffer, valsize);
6362         }
6363
6364         error = sooptcopyout(sopt, buffer, valsize);
6365         if (error) {
6366                 goto done;
6367         }
6368 done:
6369         if (buffer != NULL) {
6370                 FREE(buffer, M_NECP);
6371         }
6372
6373         return error;
6374 }
6375
6376 void *
6377 necp_create_nexus_assign_message(uuid_t nexus_instance, u_int32_t nexus_port, void *key, uint32_t key_length,
6378     struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint, struct ether_addr *local_ether_addr,
6379     u_int32_t flow_adv_index, void *flow_stats, size_t *message_length)
6380 {
6381         u_int8_t *buffer = NULL;
6382         u_int8_t *cursor = NULL;
6383         size_t valsize = 0;
6384         bool has_nexus_assignment = FALSE;
6385
6386         if (!uuid_is_null(nexus_instance)) {
6387                 has_nexus_assignment = TRUE;
6388                 valsize += sizeof(struct necp_tlv_header) + sizeof(uuid_t);
6389                 valsize += sizeof(struct necp_tlv_header) + sizeof(u_int32_t);
6390         }
6391         if (flow_adv_index != NECP_FLOWADV_IDX_INVALID) {
6392                 valsize += sizeof(struct necp_tlv_header) + sizeof(u_int32_t);
6393         }
6394         if (key != NULL && key_length > 0) {
6395                 valsize += sizeof(struct necp_tlv_header) + key_length;
6396         }
6397         if (local_endpoint != NULL) {
6398                 valsize += sizeof(struct necp_tlv_header) + sizeof(struct necp_client_endpoint);
6399         }
6400         if (remote_endpoint != NULL) {
6401                 valsize += sizeof(struct necp_tlv_header) + sizeof(struct necp_client_endpoint);
6402         }
6403         if (local_ether_addr != NULL) {
6404                 valsize += sizeof(struct necp_tlv_header) + sizeof(struct ether_addr);
6405         }
6406         if (flow_stats != NULL) {
6407                 valsize += sizeof(struct necp_tlv_header) + sizeof(void *);
6408         }
6409         if (valsize == 0) {
6410                 return NULL;
6411         }
6412
6413         MALLOC(buffer, u_int8_t *, valsize, M_NETAGENT, M_WAITOK | M_ZERO); // Use M_NETAGENT area, since it is expected upon free
6414         if (buffer == NULL) {
6415                 return NULL;
6416         }
6417
6418         cursor = buffer;
6419         if (has_nexus_assignment) {
6420                 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_INSTANCE, sizeof(uuid_t), nexus_instance, buffer, valsize);
6421                 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_PORT, sizeof(u_int32_t), &nexus_port, buffer, valsize);
6422         }
6423         if (flow_adv_index != NECP_FLOWADV_IDX_INVALID) {
6424                 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_PORT_FLOW_INDEX, sizeof(u_int32_t), &flow_adv_index, buffer, valsize);
6425         }
6426         if (key != NULL && key_length > 0) {
6427                 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_PARAMETER_NEXUS_KEY, key_length, key, buffer, valsize);
6428         }
6429         if (local_endpoint != NULL) {
6430                 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_LOCAL_ENDPOINT, sizeof(struct necp_client_endpoint), local_endpoint, buffer, valsize);
6431         }
6432         if (remote_endpoint != NULL) {
6433                 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_REMOTE_ENDPOINT, sizeof(struct necp_client_endpoint), remote_endpoint, buffer, valsize);
6434         }
6435         if (local_ether_addr != NULL) {
6436                 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_LOCAL_ETHER_ADDR, sizeof(struct ether_addr), local_ether_addr, buffer, valsize);
6437         }
6438         if (flow_stats != NULL) {
6439                 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_FLOW_STATS, sizeof(void *), &flow_stats, buffer, valsize);
6440         }
6441
6442         *message_length = valsize;
6443
6444         return buffer;
6445 }
6446
6447 void
6448 necp_inpcb_remove_cb(struct inpcb *inp)
6449 {
6450         if (!uuid_is_null(inp->necp_client_uuid)) {
6451                 necp_client_unregister_socket_flow(inp->necp_client_uuid, inp);
6452                 uuid_clear(inp->necp_client_uuid);
6453         }
6454 }
6455
6456 void
6457 necp_inpcb_dispose(struct inpcb *inp)
6458 {
6459         necp_inpcb_remove_cb(inp); // Clear out socket registrations if not yet done
6460         if (inp->inp_necp_attributes.inp_domain != NULL) {
6461                 FREE(inp->inp_necp_attributes.inp_domain, M_NECP);
6462                 inp->inp_necp_attributes.inp_domain = NULL;
6463         }
6464         if (inp->inp_necp_attributes.inp_account != NULL) {
6465                 FREE(inp->inp_necp_attributes.inp_account, M_NECP);
6466                 inp->inp_necp_attributes.inp_account = NULL;
6467         }
6468 }
6469
6470 void
6471 necp_mppcb_dispose(struct mppcb *mpp)
6472 {
6473         if (!uuid_is_null(mpp->necp_client_uuid)) {
6474                 necp_client_unregister_multipath_cb(mpp->necp_client_uuid, mpp);
6475                 uuid_clear(mpp->necp_client_uuid);
6476         }
6477 }
6478
6479 /// Module init
6480
6481 errno_t
6482 necp_client_init(void)
6483 {
6484         necp_fd_grp_attr = lck_grp_attr_alloc_init();
6485         if (necp_fd_grp_attr == NULL) {
6486                 panic("lck_grp_attr_alloc_init failed\n");
6487                 /* NOTREACHED */
6488         }
6489
6490         necp_fd_mtx_grp = lck_grp_alloc_init("necp_fd", necp_fd_grp_attr);
6491         if (necp_fd_mtx_grp == NULL) {
6492                 panic("lck_grp_alloc_init failed\n");
6493                 /* NOTREACHED */
6494         }
6495
6496         necp_fd_mtx_attr = lck_attr_alloc_init();
6497         if (necp_fd_mtx_attr == NULL) {
6498                 panic("lck_attr_alloc_init failed\n");
6499                 /* NOTREACHED */
6500         }
6501
6502         necp_client_fd_size = sizeof(struct necp_fd_data);
6503         necp_client_fd_zone = zinit(necp_client_fd_size,
6504             NECP_CLIENT_FD_ZONE_MAX * necp_client_fd_size,
6505             0, NECP_CLIENT_FD_ZONE_NAME);
6506         if (necp_client_fd_zone == NULL) {
6507                 panic("zinit(necp_client_fd) failed\n");
6508                 /* NOTREACHED */
6509         }
6510
6511         necp_flow_size = sizeof(struct necp_client_flow);
6512         necp_flow_cache = mcache_create(NECP_FLOW_ZONE_NAME, necp_flow_size, sizeof(uint64_t), 0, MCR_SLEEP);
6513         if (necp_flow_cache == NULL) {
6514                 panic("mcache_create(necp_flow_cache) failed\n");
6515                 /* NOTREACHED */
6516         }
6517
6518         necp_flow_registration_size = sizeof(struct necp_client_flow_registration);
6519         necp_flow_registration_cache = mcache_create(NECP_FLOW_REGISTRATION_ZONE_NAME, necp_flow_registration_size, sizeof(uint64_t), 0, MCR_SLEEP);
6520         if (necp_flow_registration_cache == NULL) {
6521                 panic("mcache_create(necp_client_flow_registration) failed\n");
6522                 /* NOTREACHED */
6523         }
6524
6525         necp_client_update_tcall = thread_call_allocate_with_options(necp_update_all_clients_callout, NULL,
6526             THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
6527         VERIFY(necp_client_update_tcall != NULL);
6528
6529         lck_rw_init(&necp_fd_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
6530         lck_rw_init(&necp_observer_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
6531         lck_rw_init(&necp_client_tree_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
6532         lck_rw_init(&necp_flow_tree_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
6533         lck_rw_init(&necp_collect_stats_list_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
6534
6535         LIST_INIT(&necp_fd_list);
6536         LIST_INIT(&necp_fd_observer_list);
6537         LIST_INIT(&necp_collect_stats_flow_list);
6538
6539         RB_INIT(&necp_client_global_tree);
6540         RB_INIT(&necp_client_flow_global_tree);
6541
6542         return 0;
6543 }
6544
6545 void
6546 necp_client_reap_caches(boolean_t purge)
6547 {
6548         mcache_reap_now(necp_flow_cache, purge);
6549         mcache_reap_now(necp_flow_registration_cache, purge);
6550 }
6551