]> git.saurik.com Git - apple/xnu.git/blob - bsd/net/pktap.c
projects / apple / xnu.git / blob
? search:


da700024f7eb0b2c565543f8e96c1ea90675819d
[apple/xnu.git] / bsd / net / pktap.c
1 /*
2 * Copyright (c) 2012-2018 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #include <kern/locks.h>
30 #include <kern/zalloc.h>
31
32 #include <sys/types.h>
33 #include <sys/kernel_types.h>
34 #include <sys/kauth.h>
35 #include <sys/socket.h>
36 #include <sys/socketvar.h>
37 #include <sys/sockio.h>
38 #include <sys/sysctl.h>
39 #include <sys/proc.h>
40
41 #include <net/if.h>
42 #include <net/if_var.h>
43 #include <net/if_types.h>
44 #include <net/bpf.h>
45 #include <net/net_osdep.h>
46 #include <net/pktap.h>
47
48 #include <netinet/in_pcb.h>
49 #include <netinet/tcp.h>
50 #include <netinet/tcp_var.h>
51 #define _IP_VHL
52 #include <netinet/ip.h>
53 #include <netinet/ip_var.h>
54 #include <netinet/udp.h>
55 #include <netinet/udp_var.h>
56
57 #include <netinet/ip6.h>
58 #include <netinet6/in6_pcb.h>
59
60 #include <libkern/OSAtomic.h>
61
62 #include <kern/debug.h>
63
64 #include <sys/mcache.h>
65
66 #include <string.h>
67
68 extern struct inpcbinfo ripcbinfo;
69
70 struct pktap_softc {
71 LIST_ENTRY(pktap_softc) pktp_link;
72 uint32_t pktp_unit;
73 uint32_t pktp_dlt_raw_count;
74 uint32_t pktp_dlt_pkttap_count;
75 struct ifnet *pktp_ifp;
76 struct pktap_filter pktp_filters[PKTAP_MAX_FILTERS];
77 };
78
79 #ifndef PKTAP_DEBUG
80 #define PKTAP_DEBUG 0
81 #endif /* PKTAP_DEBUG */
82
83 #define PKTAP_FILTER_OK 0 /* Packet passes filter checks */
84 #define PKTAP_FILTER_SKIP 1 /* Do not tap this packet */
85
86 static int pktap_inited = 0;
87
88 SYSCTL_DECL(_net_link);
89 SYSCTL_NODE(_net_link, IFT_PKTAP, pktap,
90 CTLFLAG_RW | CTLFLAG_LOCKED, 0, "pktap virtual interface");
91
92 uint32_t pktap_total_tap_count = 0;
93 SYSCTL_UINT(_net_link_pktap, OID_AUTO, total_tap_count,
94 CTLFLAG_RD | CTLFLAG_LOCKED, &pktap_total_tap_count, 0, "");
95
96 static u_int64_t pktap_count_unknown_if_type = 0;
97 SYSCTL_QUAD(_net_link_pktap, OID_AUTO, count_unknown_if_type,
98 CTLFLAG_RD | CTLFLAG_LOCKED, &pktap_count_unknown_if_type, "");
99
100 static int pktap_log = 0;
101 SYSCTL_INT(_net_link_pktap, OID_AUTO, log,
102 CTLFLAG_RW | CTLFLAG_LOCKED, &pktap_log, 0, "");
103
104 #define PKTAP_LOG(mask, fmt, ...) \
105 do { \
106 if ((pktap_log & mask)) \
107 printf("%s:%d " fmt, __FUNCTION__, __LINE__, ##__VA_ARGS__); \
108 } while (false)
109
110 #define PKTP_LOG_FUNC 0x01
111 #define PKTP_LOG_FILTER 0x02
112 #define PKTP_LOG_INPUT 0x04
113 #define PKTP_LOG_OUTPUT 0x08
114 #define PKTP_LOG_ERROR 0x10
115 #define PKTP_LOG_NOPCB 0x20
116
117 /*
118 * pktap_lck_rw protects the global list of pktap interfaces
119 */
120 decl_lck_rw_data(static, pktap_lck_rw_data);
121 static lck_rw_t *pktap_lck_rw = &pktap_lck_rw_data;
122 static lck_grp_t *pktap_lck_grp = NULL;
123 static lck_attr_t *pktap_lck_attr = NULL;
124
125 static LIST_HEAD(pktap_list, pktap_softc) pktap_list =
126 LIST_HEAD_INITIALIZER(pktap_list);
127
128 int pktap_clone_create(struct if_clone *, u_int32_t, void *);
129 int pktap_clone_destroy(struct ifnet *);
130
131 #define PKTAP_MAXUNIT IF_MAXUNIT
132 #define PKTAP_ZONE_MAX_ELEM MIN(IFNETS_MAX, PKTAP_MAXUNIT)
133
134 static struct if_clone pktap_cloner =
135 IF_CLONE_INITIALIZER(PKTAP_IFNAME,
136 pktap_clone_create,
137 pktap_clone_destroy,
138 0,
139 PKTAP_MAXUNIT,
140 PKTAP_ZONE_MAX_ELEM,
141 sizeof(struct pktap_softc));
142
143 errno_t pktap_if_output(ifnet_t, mbuf_t);
144 errno_t pktap_demux(ifnet_t, mbuf_t, char *, protocol_family_t *);
145 errno_t pktap_add_proto(ifnet_t, protocol_family_t,
146 const struct ifnet_demux_desc *, u_int32_t);
147 errno_t pktap_del_proto(ifnet_t, protocol_family_t);
148 errno_t pktap_getdrvspec(ifnet_t, struct ifdrv64 *);
149 errno_t pktap_setdrvspec(ifnet_t, struct ifdrv64 *);
150 errno_t pktap_ioctl(ifnet_t, unsigned long, void *);
151 void pktap_detach(ifnet_t);
152 int pktap_filter_evaluate(struct pktap_softc *, struct ifnet *);
153 void pktap_bpf_tap(struct ifnet *, protocol_family_t, struct mbuf *,
154 u_int32_t, u_int32_t, int);
155 errno_t pktap_tap_callback(ifnet_t, u_int32_t, bpf_tap_mode);
156
157 static void
158 pktap_hexdump(int mask, void *addr, size_t len)
159 {
160 unsigned char *buf = addr;
161 size_t i;
162
163 if (!(pktap_log & mask)) {
164 return;
165 }
166
167 for (i = 0; i < len; i++) {
168 unsigned char h = (buf[i] & 0xf0) >> 4;
169 unsigned char l = buf[i] & 0x0f;
170
171 if (i != 0) {
172 if (i % 32 == 0) {
173 printf("\n");
174 } else if (i % 4 == 0) {
175 printf(" ");
176 }
177 }
178 printf("%c%c",
179 h < 10 ? h + '0' : h - 10 + 'a',
180 l < 10 ? l + '0' : l - 10 + 'a');
181 }
182 if (i % 32 != 0) {
183 printf("\n");
184 }
185 }
186
187 #define _CASSERT_OFFFSETOF_FIELD(s1, s2, f) \
188 _CASSERT(offsetof(struct s1, f) == offsetof(struct s2, f))
189
190 __private_extern__ void
191 pktap_init(void)
192 {
193 int error = 0;
194 lck_grp_attr_t *lck_grp_attr = NULL;
195
196 _CASSERT_OFFFSETOF_FIELD(pktap_header, pktap_v2_hdr, pth_flags);
197
198 /* Make sure we're called only once */
199 VERIFY(pktap_inited == 0);
200
201 pktap_inited = 1;
202
203 lck_grp_attr = lck_grp_attr_alloc_init();
204 pktap_lck_grp = lck_grp_alloc_init("pktap", lck_grp_attr);
205 pktap_lck_attr = lck_attr_alloc_init();
206 #if PKTAP_DEBUG
207 lck_attr_setdebug(pktap_lck_attr);
208 #endif /* PKTAP_DEBUG */
209 lck_rw_init(pktap_lck_rw, pktap_lck_grp, pktap_lck_attr);
210 lck_grp_attr_free(lck_grp_attr);
211
212 LIST_INIT(&pktap_list);
213
214 error = if_clone_attach(&pktap_cloner);
215 if (error != 0) {
216 panic("%s: if_clone_attach() failed, error %d\n",
217 __func__, error);
218 }
219 }
220
221 __private_extern__ int
222 pktap_clone_create(struct if_clone *ifc, u_int32_t unit, __unused void *params)
223 {
224 int error = 0;
225 struct pktap_softc *pktap = NULL;
226 struct ifnet_init_eparams if_init;
227
228 PKTAP_LOG(PKTP_LOG_FUNC, "unit %u\n", unit);
229
230 pktap = if_clone_softc_allocate(&pktap_cloner);
231 if (pktap == NULL) {
232 printf("%s: _MALLOC failed\n", __func__);
233 error = ENOMEM;
234 goto done;
235 }
236 pktap->pktp_unit = unit;
237
238 /*
239 * By default accept packet from physical interfaces
240 */
241 pktap->pktp_filters[0].filter_op = PKTAP_FILTER_OP_PASS;
242 pktap->pktp_filters[0].filter_param = PKTAP_FILTER_PARAM_IF_TYPE;
243 pktap->pktp_filters[0].filter_param_if_type = IFT_ETHER;
244
245 #if CONFIG_EMBEDDED
246 pktap->pktp_filters[1].filter_op = PKTAP_FILTER_OP_PASS;
247 pktap->pktp_filters[1].filter_param = PKTAP_FILTER_PARAM_IF_TYPE;
248 pktap->pktp_filters[1].filter_param_if_type = IFT_CELLULAR;
249 #else /* CONFIG_EMBEDDED */
250 pktap->pktp_filters[1].filter_op = PKTAP_FILTER_OP_PASS;
251 pktap->pktp_filters[1].filter_param = PKTAP_FILTER_PARAM_IF_TYPE;
252 pktap->pktp_filters[1].filter_param_if_type = IFT_IEEE1394;
253 #endif /* CONFIG_EMBEDDED */
254
255 #if (DEVELOPMENT || DEBUG)
256 pktap->pktp_filters[2].filter_op = PKTAP_FILTER_OP_PASS;
257 pktap->pktp_filters[2].filter_param = PKTAP_FILTER_PARAM_IF_TYPE;
258 pktap->pktp_filters[2].filter_param_if_type = IFT_OTHER;
259 #endif /* DEVELOPMENT || DEBUG */
260
261 /*
262 * We do not use a set_bpf_tap() function as we rather rely on the more
263 * accurate callback passed to bpf_attach()
264 */
265 bzero(&if_init, sizeof(if_init));
266 if_init.ver = IFNET_INIT_CURRENT_VERSION;
267 if_init.len = sizeof(if_init);
268 if_init.flags = IFNET_INIT_LEGACY;
269 if_init.name = ifc->ifc_name;
270 if_init.unit = unit;
271 if_init.type = IFT_PKTAP;
272 if_init.family = IFNET_FAMILY_LOOPBACK;
273 if_init.output = pktap_if_output;
274 if_init.demux = pktap_demux;
275 if_init.add_proto = pktap_add_proto;
276 if_init.del_proto = pktap_del_proto;
277 if_init.softc = pktap;
278 if_init.ioctl = pktap_ioctl;
279 if_init.detach = pktap_detach;
280
281 error = ifnet_allocate_extended(&if_init, &pktap->pktp_ifp);
282 if (error != 0) {
283 printf("%s: ifnet_allocate failed, error %d\n",
284 __func__, error);
285 goto done;
286 }
287
288 ifnet_set_flags(pktap->pktp_ifp, IFF_UP, IFF_UP);
289
290 error = ifnet_attach(pktap->pktp_ifp, NULL);
291 if (error != 0) {
292 printf("%s: ifnet_attach failed - error %d\n", __func__, error);
293 ifnet_release(pktap->pktp_ifp);
294 goto done;
295 }
296
297 /* Attach DLT_PKTAP as the default DLT */
298 bpf_attach(pktap->pktp_ifp, DLT_PKTAP, sizeof(struct pktap_header),
299 NULL, pktap_tap_callback);
300 bpf_attach(pktap->pktp_ifp, DLT_RAW, 0, NULL, pktap_tap_callback);
301
302 /* Take a reference and add to the global list */
303 ifnet_reference(pktap->pktp_ifp);
304 lck_rw_lock_exclusive(pktap_lck_rw);
305 LIST_INSERT_HEAD(&pktap_list, pktap, pktp_link);
306 lck_rw_done(pktap_lck_rw);
307 done:
308 if (error != 0 && pktap != NULL) {
309 if_clone_softc_deallocate(&pktap_cloner, pktap);
310 }
311 return error;
312 }
313
314 __private_extern__ int
315 pktap_clone_destroy(struct ifnet *ifp)
316 {
317 int error = 0;
318
319 PKTAP_LOG(PKTP_LOG_FUNC, "%s\n", ifp->if_xname);
320
321 (void) ifnet_detach(ifp);
322
323 return error;
324 }
325
326 /*
327 * This function is called whenever a DLT is set on the interface:
328 * - When interface is attached to a BPF device via BIOCSETIF for the
329 * default DLT
330 * - Whenever a new DLT is selected via BIOCSDLT
331 * - When the interface is detached from a BPF device (direction is zero)
332 */
333 __private_extern__ errno_t
334 pktap_tap_callback(ifnet_t ifp, u_int32_t dlt, bpf_tap_mode direction)
335 {
336 struct pktap_softc *pktap;
337
338 pktap = ifp->if_softc;
339 if (pktap == NULL) {
340 printf("%s: if_softc is NULL for ifp %s\n", __func__,
341 ifp->if_xname);
342 goto done;
343 }
344 switch (dlt) {
345 case DLT_RAW:
346 if (direction == 0) {
347 if (pktap->pktp_dlt_raw_count > 0) {
348 pktap->pktp_dlt_raw_count--;
349 OSAddAtomic(-1, &pktap_total_tap_count);
350 }
351 } else {
352 pktap->pktp_dlt_raw_count++;
353 OSAddAtomic(1, &pktap_total_tap_count);
354 }
355 break;
356 case DLT_PKTAP:
357 if (direction == 0) {
358 if (pktap->pktp_dlt_pkttap_count > 0) {
359 pktap->pktp_dlt_pkttap_count--;
360 OSAddAtomic(-1, &pktap_total_tap_count);
361 }
362 } else {
363 pktap->pktp_dlt_pkttap_count++;
364 OSAddAtomic(1, &pktap_total_tap_count);
365 }
366 break;
367 }
368 done:
369 /*
370 * Attachements count must be positive and we're in trouble
371 * if we have more that 2**31 attachements
372 */
373 VERIFY(pktap_total_tap_count >= 0);
374
375 return 0;
376 }
377
378 __private_extern__ errno_t
379 pktap_if_output(ifnet_t ifp, mbuf_t m)
380 {
381 PKTAP_LOG(PKTP_LOG_FUNC, "%s\n", ifp->if_xname);
382 mbuf_freem(m);
383 return ENOTSUP;
384 }
385
386 __private_extern__ errno_t
387 pktap_demux(ifnet_t ifp, __unused mbuf_t m, __unused char *header,
388 __unused protocol_family_t *ppf)
389 {
390 PKTAP_LOG(PKTP_LOG_FUNC, "%s\n", ifp->if_xname);
391 return ENOTSUP;
392 }
393
394 __private_extern__ errno_t
395 pktap_add_proto(__unused ifnet_t ifp, protocol_family_t pf,
396 __unused const struct ifnet_demux_desc *dmx, __unused u_int32_t cnt)
397 {
398 PKTAP_LOG(PKTP_LOG_FUNC, "%s pf %u\n", ifp->if_xname, pf);
399 return 0;
400 }
401
402 __private_extern__ errno_t
403 pktap_del_proto(__unused ifnet_t ifp, __unused protocol_family_t pf)
404 {
405 PKTAP_LOG(PKTP_LOG_FUNC, "%s pf %u\n", ifp->if_xname, pf);
406 return 0;
407 }
408
409 __private_extern__ errno_t
410 pktap_getdrvspec(ifnet_t ifp, struct ifdrv64 *ifd)
411 {
412 errno_t error = 0;
413 struct pktap_softc *pktap;
414 int i;
415
416 PKTAP_LOG(PKTP_LOG_FUNC, "%s\n", ifp->if_xname);
417
418 pktap = ifp->if_softc;
419 if (pktap == NULL) {
420 error = ENOENT;
421 printf("%s: pktap NULL - error %d\n", __func__, error);
422 goto done;
423 }
424
425 switch (ifd->ifd_cmd) {
426 case PKTP_CMD_FILTER_GET: {
427 struct x_pktap_filter x_filters[PKTAP_MAX_FILTERS];
428
429 bzero(&x_filters, sizeof(x_filters));
430
431 if (ifd->ifd_len < PKTAP_MAX_FILTERS * sizeof(struct x_pktap_filter)) {
432 printf("%s: PKTP_CMD_FILTER_GET ifd_len %llu too small - error %d\n",
433 __func__, ifd->ifd_len, error);
434 error = EINVAL;
435 break;
436 }
437 for (i = 0; i < PKTAP_MAX_FILTERS; i++) {
438 struct pktap_filter *pktap_filter = pktap->pktp_filters + i;
439 struct x_pktap_filter *x_filter = x_filters + i;
440
441 x_filter->filter_op = pktap_filter->filter_op;
442 x_filter->filter_param = pktap_filter->filter_param;
443
444 if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_TYPE) {
445 x_filter->filter_param_if_type = pktap_filter->filter_param_if_type;
446 } else if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_NAME) {
447 strlcpy(x_filter->filter_param_if_name,
448 pktap_filter->filter_param_if_name,
449 sizeof(x_filter->filter_param_if_name));
450 }
451 }
452 error = copyout(x_filters, ifd->ifd_data,
453 PKTAP_MAX_FILTERS * sizeof(struct x_pktap_filter));
454 if (error) {
455 printf("%s: PKTP_CMD_FILTER_GET copyout - error %d\n", __func__, error);
456 goto done;
457 }
458 break;
459 }
460 case PKTP_CMD_TAP_COUNT: {
461 uint32_t tap_count = pktap->pktp_dlt_raw_count + pktap->pktp_dlt_pkttap_count;
462
463 if (ifd->ifd_len < sizeof(tap_count)) {
464 printf("%s: PKTP_CMD_TAP_COUNT ifd_len %llu too small - error %d\n",
465 __func__, ifd->ifd_len, error);
466 error = EINVAL;
467 break;
468 }
469 error = copyout(&tap_count, ifd->ifd_data, sizeof(tap_count));
470 if (error) {
471 printf("%s: PKTP_CMD_TAP_COUNT copyout - error %d\n", __func__, error);
472 goto done;
473 }
474 break;
475 }
476 default:
477 error = EINVAL;
478 break;
479 }
480
481 done:
482 return error;
483 }
484
485 __private_extern__ errno_t
486 pktap_setdrvspec(ifnet_t ifp, struct ifdrv64 *ifd)
487 {
488 errno_t error = 0;
489 struct pktap_softc *pktap;
490
491 PKTAP_LOG(PKTP_LOG_FUNC, "%s\n", ifp->if_xname);
492
493 pktap = ifp->if_softc;
494 if (pktap == NULL) {
495 error = ENOENT;
496 printf("%s: pktap NULL - error %d\n", __func__, error);
497 goto done;
498 }
499
500 switch (ifd->ifd_cmd) {
501 case PKTP_CMD_FILTER_SET: {
502 struct x_pktap_filter user_filters[PKTAP_MAX_FILTERS];
503 int i;
504 int got_op_none = 0;
505
506 if (ifd->ifd_len != PKTAP_MAX_FILTERS * sizeof(struct x_pktap_filter)) {
507 printf("%s: PKTP_CMD_FILTER_SET bad ifd_len %llu - error %d\n",
508 __func__, ifd->ifd_len, error);
509 error = EINVAL;
510 break;
511 }
512 error = copyin(ifd->ifd_data, &user_filters, ifd->ifd_len);
513 if (error) {
514 printf("%s: copyin - error %d\n", __func__, error);
515 goto done;
516 }
517 /*
518 * Validate user provided parameters
519 */
520 for (i = 0; i < PKTAP_MAX_FILTERS; i++) {
521 struct x_pktap_filter *x_filter = user_filters + i;
522
523 switch (x_filter->filter_op) {
524 case PKTAP_FILTER_OP_NONE:
525 /* Following entries must be PKTAP_FILTER_OP_NONE */
526 got_op_none = 1;
527 break;
528 case PKTAP_FILTER_OP_PASS:
529 case PKTAP_FILTER_OP_SKIP:
530 /* Invalid after PKTAP_FILTER_OP_NONE */
531 if (got_op_none) {
532 error = EINVAL;
533 break;
534 }
535 break;
536 default:
537 error = EINVAL;
538 break;
539 }
540 if (error != 0) {
541 break;
542 }
543
544 switch (x_filter->filter_param) {
545 case PKTAP_FILTER_OP_NONE:
546 if (x_filter->filter_op != PKTAP_FILTER_OP_NONE) {
547 error = EINVAL;
548 break;
549 }
550 break;
551
552 /*
553 * Do not allow to tap a pktap from a pktap
554 */
555 case PKTAP_FILTER_PARAM_IF_TYPE:
556 if (x_filter->filter_param_if_type == IFT_PKTAP ||
557 x_filter->filter_param_if_type > 0xff) {
558 error = EINVAL;
559 break;
560 }
561 break;
562
563 case PKTAP_FILTER_PARAM_IF_NAME:
564 if (strncmp(x_filter->filter_param_if_name, PKTAP_IFNAME,
565 strlen(PKTAP_IFNAME)) == 0) {
566 error = EINVAL;
567 break;
568 }
569 break;
570
571 default:
572 error = EINVAL;
573 break;
574 }
575 if (error != 0) {
576 break;
577 }
578 }
579 if (error != 0) {
580 break;
581 }
582 for (i = 0; i < PKTAP_MAX_FILTERS; i++) {
583 struct pktap_filter *pktap_filter = pktap->pktp_filters + i;
584 struct x_pktap_filter *x_filter = user_filters + i;
585
586 pktap_filter->filter_op = x_filter->filter_op;
587 pktap_filter->filter_param = x_filter->filter_param;
588
589 if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_TYPE) {
590 pktap_filter->filter_param_if_type = x_filter->filter_param_if_type;
591 } else if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_NAME) {
592 size_t len;
593
594 strlcpy(pktap_filter->filter_param_if_name,
595 x_filter->filter_param_if_name,
596 sizeof(pktap_filter->filter_param_if_name));
597 /*
598 * If name does not end with a number then it's a "wildcard" match
599 * where we compare the prefix of the interface name
600 */
601 len = strlen(pktap_filter->filter_param_if_name);
602 if (pktap_filter->filter_param_if_name[len] < '0' ||
603 pktap_filter->filter_param_if_name[len] > '9') {
604 pktap_filter->filter_ifname_prefix_len = len;
605 }
606 }
607 }
608 break;
609 }
610 default:
611 error = EINVAL;
612 break;
613 }
614
615 done:
616 return error;
617 }
618
619 __private_extern__ errno_t
620 pktap_ioctl(ifnet_t ifp, unsigned long cmd, void *data)
621 {
622 errno_t error = 0;
623
624 PKTAP_LOG(PKTP_LOG_FUNC, "%s\n", ifp->if_xname);
625
626 if ((cmd & IOC_IN)) {
627 error = kauth_authorize_generic(kauth_cred_get(), KAUTH_GENERIC_ISSUSER);
628 if (error) {
629 PKTAP_LOG(PKTP_LOG_ERROR,
630 "%s: kauth_authorize_generic(KAUTH_GENERIC_ISSUSER) - error %d\n",
631 __func__, error);
632 goto done;
633 }
634 }
635
636 switch (cmd) {
637 case SIOCGDRVSPEC32: {
638 struct ifdrv64 ifd;
639 struct ifdrv32 *ifd32 = (struct ifdrv32 *)data;
640
641 memcpy(ifd.ifd_name, ifd32->ifd_name, sizeof(ifd.ifd_name));
642 ifd.ifd_cmd = ifd32->ifd_cmd;
643 ifd.ifd_len = ifd32->ifd_len;
644 ifd.ifd_data = ifd32->ifd_data;
645
646 error = pktap_getdrvspec(ifp, &ifd);
647
648 break;
649 }
650 case SIOCGDRVSPEC64: {
651 struct ifdrv64 *ifd64 = (struct ifdrv64 *)data;
652
653 error = pktap_getdrvspec(ifp, ifd64);
654
655 break;
656 }
657 case SIOCSDRVSPEC32: {
658 struct ifdrv64 ifd;
659 struct ifdrv32 *ifd32 = (struct ifdrv32 *)data;
660
661 memcpy(ifd.ifd_name, ifd32->ifd_name, sizeof(ifd.ifd_name));
662 ifd.ifd_cmd = ifd32->ifd_cmd;
663 ifd.ifd_len = ifd32->ifd_len;
664 ifd.ifd_data = ifd32->ifd_data;
665
666 error = pktap_setdrvspec(ifp, &ifd);
667 break;
668 }
669 case SIOCSDRVSPEC64: {
670 struct ifdrv64 *ifd64 = (struct ifdrv64 *)data;
671
672 error = pktap_setdrvspec(ifp, ifd64);
673
674 break;
675 }
676 default:
677 error = ENOTSUP;
678 break;
679 }
680 done:
681 return error;
682 }
683
684 __private_extern__ void
685 pktap_detach(ifnet_t ifp)
686 {
687 struct pktap_softc *pktap;
688
689 PKTAP_LOG(PKTP_LOG_FUNC, "%s\n", ifp->if_xname);
690
691 lck_rw_lock_exclusive(pktap_lck_rw);
692
693 pktap = ifp->if_softc;
694 ifp->if_softc = NULL;
695 LIST_REMOVE(pktap, pktp_link);
696
697 lck_rw_done(pktap_lck_rw);
698
699 /* Drop reference as it's no more on the global list */
700 ifnet_release(ifp);
701
702 if_clone_softc_deallocate(&pktap_cloner, pktap);
703 /* This is for the reference taken by ifnet_attach() */
704 (void) ifnet_release(ifp);
705 }
706
707 __private_extern__ int
708 pktap_filter_evaluate(struct pktap_softc *pktap, struct ifnet *ifp)
709 {
710 int i;
711 int result = PKTAP_FILTER_SKIP; /* Need positive matching rule to pass */
712 int match = 0;
713
714 for (i = 0; i < PKTAP_MAX_FILTERS; i++) {
715 struct pktap_filter *pktap_filter = pktap->pktp_filters + i;
716 size_t len = pktap_filter->filter_ifname_prefix_len != 0 ?
717 pktap_filter->filter_ifname_prefix_len : PKTAP_IFXNAMESIZE;
718
719 switch (pktap_filter->filter_op) {
720 case PKTAP_FILTER_OP_NONE:
721 match = 1;
722 break;
723
724 case PKTAP_FILTER_OP_PASS:
725 if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_TYPE) {
726 if (pktap_filter->filter_param_if_type == 0 ||
727 ifp->if_type == pktap_filter->filter_param_if_type) {
728 result = PKTAP_FILTER_OK;
729 match = 1;
730 PKTAP_LOG(PKTP_LOG_FILTER, "pass %s match type %u\n",
731 ifp->if_xname, pktap_filter->filter_param_if_type);
732 break;
733 }
734 }
735 if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_NAME) {
736 if (strncmp(ifp->if_xname, pktap_filter->filter_param_if_name,
737 len) == 0) {
738 result = PKTAP_FILTER_OK;
739 match = 1;
740 PKTAP_LOG(PKTP_LOG_FILTER, "pass %s match name %s\n",
741 ifp->if_xname, pktap_filter->filter_param_if_name);
742 break;
743 }
744 }
745 break;
746
747 case PKTAP_FILTER_OP_SKIP:
748 if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_TYPE) {
749 if (pktap_filter->filter_param_if_type == 0 ||
750 ifp->if_type == pktap_filter->filter_param_if_type) {
751 result = PKTAP_FILTER_SKIP;
752 match = 1;
753 PKTAP_LOG(PKTP_LOG_FILTER, "skip %s match type %u\n",
754 ifp->if_xname, pktap_filter->filter_param_if_type);
755 break;
756 }
757 }
758 if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_NAME) {
759 if (strncmp(ifp->if_xname, pktap_filter->filter_param_if_name,
760 len) == 0) {
761 result = PKTAP_FILTER_SKIP;
762 match = 1;
763 PKTAP_LOG(PKTP_LOG_FILTER, "skip %s match name %s\n",
764 ifp->if_xname, pktap_filter->filter_param_if_name);
765 break;
766 }
767 }
768 break;
769 }
770 if (match) {
771 break;
772 }
773 }
774
775 if (match == 0) {
776 PKTAP_LOG(PKTP_LOG_FILTER, "%s no match\n",
777 ifp->if_xname);
778 }
779 return result;
780 }
781
782 static void
783 pktap_set_procinfo(struct pktap_header *hdr, struct so_procinfo *soprocinfo)
784 {
785 hdr->pth_pid = soprocinfo->spi_pid;
786 if (hdr->pth_comm[0] == 0) {
787 proc_name(soprocinfo->spi_pid, hdr->pth_comm, MAXCOMLEN);
788 }
789 if (soprocinfo->spi_pid != 0) {
790 uuid_copy(hdr->pth_uuid, soprocinfo->spi_uuid);
791 }
792
793 if (soprocinfo->spi_delegated != 0) {
794 hdr->pth_flags |= PTH_FLAG_PROC_DELEGATED;
795 hdr->pth_epid = soprocinfo->spi_epid;
796 if (hdr->pth_ecomm[0] == 0) {
797 proc_name(soprocinfo->spi_epid, hdr->pth_ecomm, MAXCOMLEN);
798 }
799 uuid_copy(hdr->pth_euuid, soprocinfo->spi_euuid);
800 }
801 }
802
803 __private_extern__ void
804 pktap_finalize_proc_info(struct pktap_header *hdr)
805 {
806 int found;
807 struct so_procinfo soprocinfo;
808
809 if (!(hdr->pth_flags & PTH_FLAG_DELAY_PKTAP)) {
810 return;
811 }
812
813 if (hdr->pth_ipproto == IPPROTO_TCP) {
814 found = inp_findinpcb_procinfo(&tcbinfo, hdr->pth_flowid,
815 &soprocinfo);
816 } else if (hdr->pth_ipproto == IPPROTO_UDP) {
817 found = inp_findinpcb_procinfo(&udbinfo, hdr->pth_flowid,
818 &soprocinfo);
819 } else {
820 found = inp_findinpcb_procinfo(&ripcbinfo, hdr->pth_flowid,
821 &soprocinfo);
822 }
823
824 if (found == 1) {
825 pktap_set_procinfo(hdr, &soprocinfo);
826 }
827 }
828
829 static void
830 pktap_v2_set_procinfo(struct pktap_v2_hdr *pktap_v2_hdr,
831 struct so_procinfo *soprocinfo)
832 {
833 pktap_v2_hdr->pth_pid = soprocinfo->spi_pid;
834
835 if (soprocinfo->spi_pid != 0 && soprocinfo->spi_pid != -1) {
836 if (pktap_v2_hdr->pth_comm_offset != 0) {
837 char *ptr = ((char *)pktap_v2_hdr) +
838 pktap_v2_hdr->pth_comm_offset;
839
840 proc_name(soprocinfo->spi_pid,
841 ptr, PKTAP_MAX_COMM_SIZE);
842 }
843 if (pktap_v2_hdr->pth_uuid_offset != 0) {
844 uuid_t *ptr = (uuid_t *) (((char *)pktap_v2_hdr) +
845 pktap_v2_hdr->pth_uuid_offset);
846
847 uuid_copy(*ptr, soprocinfo->spi_uuid);
848 }
849 }
850
851 if (!(pktap_v2_hdr->pth_flags & PTH_FLAG_PROC_DELEGATED)) {
852 return;
853 }
854
855 /*
856 * The effective UUID may be set independently from the effective pid
857 */
858 if (soprocinfo->spi_delegated != 0) {
859 pktap_v2_hdr->pth_flags |= PTH_FLAG_PROC_DELEGATED;
860 pktap_v2_hdr->pth_e_pid = soprocinfo->spi_epid;
861
862 if (soprocinfo->spi_pid != 0 && soprocinfo->spi_pid != -1 &&
863 pktap_v2_hdr->pth_e_comm_offset != 0) {
864 char *ptr = ((char *)pktap_v2_hdr) +
865 pktap_v2_hdr->pth_e_comm_offset;
866
867 proc_name(soprocinfo->spi_epid,
868 ptr, PKTAP_MAX_COMM_SIZE);
869 }
870 if (pktap_v2_hdr->pth_e_uuid_offset != 0) {
871 uuid_t *ptr = (uuid_t *) (((char *)pktap_v2_hdr) +
872 pktap_v2_hdr->pth_e_uuid_offset);
873
874 uuid_copy(*ptr, soprocinfo->spi_euuid);
875 }
876 }
877 }
878
879 __private_extern__ void
880 pktap_v2_finalize_proc_info(struct pktap_v2_hdr *pktap_v2_hdr)
881 {
882 int found;
883 struct so_procinfo soprocinfo;
884
885 if (!(pktap_v2_hdr->pth_flags & PTH_FLAG_DELAY_PKTAP)) {
886 return;
887 }
888
889 if (pktap_v2_hdr->pth_ipproto == IPPROTO_TCP) {
890 found = inp_findinpcb_procinfo(&tcbinfo,
891 pktap_v2_hdr->pth_flowid, &soprocinfo);
892 } else if (pktap_v2_hdr->pth_ipproto == IPPROTO_UDP) {
893 found = inp_findinpcb_procinfo(&udbinfo,
894 pktap_v2_hdr->pth_flowid, &soprocinfo);
895 } else {
896 found = inp_findinpcb_procinfo(&ripcbinfo,
897 pktap_v2_hdr->pth_flowid, &soprocinfo);
898 }
899 if (found == 1) {
900 pktap_v2_set_procinfo(pktap_v2_hdr, &soprocinfo);
901 }
902 }
903
904 __private_extern__ void
905 pktap_fill_proc_info(struct pktap_header *hdr, protocol_family_t proto,
906 struct mbuf *m, u_int32_t pre, int outgoing, struct ifnet *ifp)
907 {
908 /*
909 * Getting the pid and procname is expensive
910 * For outgoing, do the lookup only if there's an
911 * associated socket as indicated by the flowhash
912 */
913 if (outgoing != 0 && m->m_pkthdr.pkt_flowsrc == FLOWSRC_INPCB) {
914 /*
915 * To avoid lock ordering issues we delay the proc UUID lookup
916 * to the BPF read as we cannot
917 * assume the socket lock is unlocked on output
918 */
919 hdr->pth_flags |= PTH_FLAG_DELAY_PKTAP;
920 hdr->pth_flags |= PTH_FLAG_SOCKET;
921 hdr->pth_flowid = m->m_pkthdr.pkt_flowid;
922
923 if (m->m_pkthdr.pkt_flags & PKTF_FLOW_RAWSOCK) {
924 hdr->pth_ipproto = IPPROTO_RAW;
925 } else {
926 hdr->pth_ipproto = m->m_pkthdr.pkt_proto;
927 }
928
929 if (hdr->pth_ipproto == IPPROTO_TCP) {
930 hdr->pth_pid = m->m_pkthdr.tx_tcp_pid;
931 hdr->pth_epid = m->m_pkthdr.tx_tcp_e_pid;
932 } else if (hdr->pth_ipproto == IPPROTO_UDP) {
933 hdr->pth_pid = m->m_pkthdr.tx_udp_pid;
934 hdr->pth_epid = m->m_pkthdr.tx_udp_e_pid;
935 } else if (hdr->pth_ipproto == IPPROTO_RAW) {
936 hdr->pth_pid = m->m_pkthdr.tx_rawip_pid;
937 hdr->pth_epid = m->m_pkthdr.tx_rawip_e_pid;
938 }
939
940 if (hdr->pth_pid != 0 && hdr->pth_pid != -1) {
941 proc_name(hdr->pth_pid, hdr->pth_comm, MAXCOMLEN);
942 } else {
943 hdr->pth_pid = -1;
944 }
945
946 if (hdr->pth_epid != 0 && hdr->pth_epid != -1) {
947 hdr->pth_flags |= PTH_FLAG_PROC_DELEGATED;
948 proc_name(hdr->pth_epid, hdr->pth_ecomm, MAXCOMLEN);
949 } else {
950 hdr->pth_epid = -1;
951 }
952
953 if (m->m_pkthdr.pkt_flags & PKTF_NEW_FLOW) {
954 hdr->pth_flags |= PTH_FLAG_NEW_FLOW;
955 }
956 } else if (outgoing == 0) {
957 int found = 0;
958 struct so_procinfo soprocinfo;
959 struct inpcb *inp = NULL;
960
961 memset(&soprocinfo, 0, sizeof(struct so_procinfo));
962
963 if (proto == PF_INET) {
964 struct ip ip;
965 errno_t error;
966 size_t hlen;
967 struct in_addr faddr, laddr;
968 u_short fport = 0, lport = 0;
969 struct inpcbinfo *pcbinfo = NULL;
970 int wildcard = 0;
971
972 error = mbuf_copydata(m, pre, sizeof(struct ip), &ip);
973 if (error != 0) {
974 PKTAP_LOG(PKTP_LOG_ERROR,
975 "mbuf_copydata tcp v4 failed for %s\n",
976 hdr->pth_ifname);
977 goto done;
978 }
979 hlen = IP_VHL_HL(ip.ip_vhl) << 2;
980
981 faddr = ip.ip_src;
982 laddr = ip.ip_dst;
983
984 if (ip.ip_p == IPPROTO_TCP) {
985 struct tcphdr th;
986
987 error = mbuf_copydata(m, pre + hlen,
988 sizeof(struct tcphdr), &th);
989 if (error != 0) {
990 goto done;
991 }
992
993 fport = th.th_sport;
994 lport = th.th_dport;
995
996 pcbinfo = &tcbinfo;
997 } else if (ip.ip_p == IPPROTO_UDP) {
998 struct udphdr uh;
999
1000 error = mbuf_copydata(m, pre + hlen,
1001 sizeof(struct udphdr), &uh);
1002 if (error != 0) {
1003 PKTAP_LOG(PKTP_LOG_ERROR,
1004 "mbuf_copydata udp v4 failed for %s\n",
1005 hdr->pth_ifname);
1006 goto done;
1007 }
1008 fport = uh.uh_sport;
1009 lport = uh.uh_dport;
1010
1011 pcbinfo = &udbinfo;
1012 wildcard = 1;
1013 }
1014 if (pcbinfo != NULL) {
1015 inp = in_pcblookup_hash(pcbinfo, faddr, fport,
1016 laddr, lport, wildcard, outgoing ? NULL : ifp);
1017
1018 if (inp == NULL && hdr->pth_iftype != IFT_LOOP) {
1019 PKTAP_LOG(PKTP_LOG_NOPCB,
1020 "in_pcblookup_hash no pcb %s\n",
1021 hdr->pth_ifname);
1022 }
1023 } else {
1024 PKTAP_LOG(PKTP_LOG_NOPCB,
1025 "unknown ip_p %u on %s\n",
1026 ip.ip_p, hdr->pth_ifname);
1027 pktap_hexdump(PKTP_LOG_NOPCB, &ip, sizeof(struct ip));
1028 }
1029 } else if (proto == PF_INET6) {
1030 struct ip6_hdr ip6;
1031 errno_t error;
1032 struct in6_addr *faddr;
1033 struct in6_addr *laddr;
1034 u_short fport = 0, lport = 0;
1035 struct inpcbinfo *pcbinfo = NULL;
1036 int wildcard = 0;
1037
1038 error = mbuf_copydata(m, pre, sizeof(struct ip6_hdr), &ip6);
1039 if (error != 0) {
1040 goto done;
1041 }
1042
1043 faddr = &ip6.ip6_src;
1044 laddr = &ip6.ip6_dst;
1045
1046 if (ip6.ip6_nxt == IPPROTO_TCP) {
1047 struct tcphdr th;
1048
1049 error = mbuf_copydata(m, pre + sizeof(struct ip6_hdr),
1050 sizeof(struct tcphdr), &th);
1051 if (error != 0) {
1052 PKTAP_LOG(PKTP_LOG_ERROR,
1053 "mbuf_copydata tcp v6 failed for %s\n",
1054 hdr->pth_ifname);
1055 goto done;
1056 }
1057
1058 fport = th.th_sport;
1059 lport = th.th_dport;
1060
1061 pcbinfo = &tcbinfo;
1062 } else if (ip6.ip6_nxt == IPPROTO_UDP) {
1063 struct udphdr uh;
1064
1065 error = mbuf_copydata(m, pre + sizeof(struct ip6_hdr),
1066 sizeof(struct udphdr), &uh);
1067 if (error != 0) {
1068 PKTAP_LOG(PKTP_LOG_ERROR,
1069 "mbuf_copydata udp v6 failed for %s\n",
1070 hdr->pth_ifname);
1071 goto done;
1072 }
1073
1074 fport = uh.uh_sport;
1075 lport = uh.uh_dport;
1076
1077 pcbinfo = &udbinfo;
1078 wildcard = 1;
1079 }
1080 if (pcbinfo != NULL) {
1081 inp = in6_pcblookup_hash(pcbinfo, faddr, fport,
1082 laddr, lport, wildcard, outgoing ? NULL : ifp);
1083
1084 if (inp == NULL && hdr->pth_iftype != IFT_LOOP) {
1085 PKTAP_LOG(PKTP_LOG_NOPCB,
1086 "in6_pcblookup_hash no pcb %s\n",
1087 hdr->pth_ifname);
1088 }
1089 } else {
1090 PKTAP_LOG(PKTP_LOG_NOPCB,
1091 "unknown ip6.ip6_nxt %u on %s\n",
1092 ip6.ip6_nxt, hdr->pth_ifname);
1093 pktap_hexdump(PKTP_LOG_NOPCB, &ip6, sizeof(struct ip6_hdr));
1094 }
1095 }
1096 if (inp != NULL) {
1097 hdr->pth_flags |= PTH_FLAG_SOCKET;
1098 if (inp->inp_state != INPCB_STATE_DEAD && inp->inp_socket != NULL) {
1099 found = 1;
1100 inp_get_soprocinfo(inp, &soprocinfo);
1101 }
1102 in_pcb_checkstate(inp, WNT_RELEASE, 0);
1103 }
1104 done:
1105 /*
1106 * -1 means PID not found
1107 */
1108 hdr->pth_pid = -1;
1109 hdr->pth_epid = -1;
1110
1111 if (found != 0) {
1112 pktap_set_procinfo(hdr, &soprocinfo);
1113 }
1114 }
1115 }
1116
1117 __private_extern__ void
1118 pktap_bpf_tap(struct ifnet *ifp, protocol_family_t proto, struct mbuf *m,
1119 u_int32_t pre, u_int32_t post, int outgoing)
1120 {
1121 struct pktap_softc *pktap;
1122 void (*bpf_tap_func)(ifnet_t, u_int32_t, mbuf_t, void *, size_t) =
1123 outgoing ? bpf_tap_out : bpf_tap_in;
1124
1125 /*
1126 * Skip the coprocessor interface
1127 */
1128 if (!intcoproc_unrestricted && IFNET_IS_INTCOPROC(ifp)) {
1129 return;
1130 }
1131
1132 lck_rw_lock_shared(pktap_lck_rw);
1133
1134 /*
1135 * No need to take the ifnet_lock as the struct ifnet field if_bpf is
1136 * protected by the BPF subsystem
1137 */
1138 LIST_FOREACH(pktap, &pktap_list, pktp_link) {
1139 int filter_result;
1140
1141 filter_result = pktap_filter_evaluate(pktap, ifp);
1142 if (filter_result == PKTAP_FILTER_SKIP) {
1143 continue;
1144 }
1145
1146 if (pktap->pktp_dlt_raw_count > 0) {
1147 /* We accept only IPv4 and IPv6 packets for the raw DLT */
1148 if ((proto == AF_INET || proto == AF_INET6) &&
1149 !(m->m_pkthdr.pkt_flags & PKTF_INET_RESOLVE)) {
1150 /*
1151 * We can play just with the length of the first mbuf in the
1152 * chain because bpf_tap_imp() disregard the packet length
1153 * of the mbuf packet header.
1154 */
1155 if (mbuf_setdata(m, m->m_data + pre, m->m_len - pre) == 0) {
1156 bpf_tap_func(pktap->pktp_ifp, DLT_RAW, m, NULL, 0);
1157 mbuf_setdata(m, m->m_data - pre, m->m_len + pre);
1158 }
1159 }
1160 }
1161
1162 if (pktap->pktp_dlt_pkttap_count > 0) {
1163 struct {
1164 struct pktap_header hdr;
1165 u_int32_t proto;
1166 } hdr_buffer;
1167 struct pktap_header *hdr = &hdr_buffer.hdr;
1168 size_t hdr_size = sizeof(struct pktap_header);
1169 int unknown_if_type = 0;
1170 size_t data_adjust = 0;
1171 u_int32_t pre_adjust = 0;
1172
1173 /* Verify the structure is packed */
1174 _CASSERT(sizeof(hdr_buffer) == sizeof(struct pktap_header) + sizeof(u_int32_t));
1175
1176 bzero(&hdr_buffer, sizeof(hdr_buffer));
1177 hdr->pth_length = sizeof(struct pktap_header);
1178 hdr->pth_type_next = PTH_TYPE_PACKET;
1179
1180 /*
1181 * Set DLT of packet based on interface type
1182 */
1183 switch (ifp->if_type) {
1184 case IFT_LOOP:
1185 case IFT_GIF:
1186 case IFT_STF:
1187 case IFT_CELLULAR:
1188 /*
1189 * Packets from pdp interfaces have no loopback
1190 * header that contain the protocol number.
1191 * As BPF just concatenate the header and the
1192 * packet content in a single buffer,
1193 * stash the protocol after the pktap header
1194 * and adjust the size of the header accordingly
1195 */
1196 hdr->pth_dlt = DLT_NULL;
1197 if (pre == 0) {
1198 hdr_buffer.proto = proto;
1199 hdr_size = sizeof(hdr_buffer);
1200 pre_adjust = sizeof(hdr_buffer.proto);
1201 }
1202 break;
1203 case IFT_ETHER:
1204 case IFT_BRIDGE:
1205 case IFT_L2VLAN:
1206 case IFT_IEEE8023ADLAG:
1207 hdr->pth_dlt = DLT_EN10MB;
1208 break;
1209 case IFT_PPP:
1210 hdr->pth_dlt = DLT_PPP;
1211 break;
1212 case IFT_IEEE1394:
1213 hdr->pth_dlt = DLT_APPLE_IP_OVER_IEEE1394;
1214 break;
1215 case IFT_OTHER:
1216 if (ifp->if_subfamily == IFNET_SUBFAMILY_IPSEC ||
1217 ifp->if_subfamily == IFNET_SUBFAMILY_UTUN) {
1218 /*
1219 * For utun:
1220 * - incoming packets do not have the prefix set to four
1221 * - some packets are as small as two bytes!
1222 */
1223 if (m_pktlen(m) < 4) {
1224 goto done;
1225 }
1226 if (proto != AF_INET && proto != AF_INET6) {
1227 goto done;
1228 }
1229 if (proto == AF_INET && (size_t) m_pktlen(m) - 4 < sizeof(struct ip)) {
1230 goto done;
1231 }
1232 if (proto == AF_INET6 && (size_t) m_pktlen(m) - 4 < sizeof(struct ip6_hdr)) {
1233 goto done;
1234 }
1235
1236 /*
1237 * Handle two cases:
1238 * - The old utun encapsulation with the protocol family in network order
1239 * - A raw IPv4 or IPv6 packet
1240 */
1241 uint8_t data = *(uint8_t *)mbuf_data(m);
1242 if ((data >> 4) == 4 || (data >> 4) == 6) {
1243 pre = 4;
1244 } else {
1245 /*
1246 * Skip the protocol in the mbuf as it's in network order
1247 */
1248 pre = 4;
1249 data_adjust = 4;
1250 }
1251 }
1252 hdr->pth_dlt = DLT_NULL;
1253 hdr_buffer.proto = proto;
1254 hdr_size = sizeof(hdr_buffer);
1255 break;
1256 default:
1257 if (pre == 0) {
1258 hdr->pth_dlt = DLT_RAW;
1259 } else {
1260 unknown_if_type = 1;
1261 }
1262 break;
1263 }
1264 if (unknown_if_type) {
1265 PKTAP_LOG(PKTP_LOG_FUNC,
1266 "unknown if_type %u for %s\n",
1267 ifp->if_type, ifp->if_xname);
1268 pktap_count_unknown_if_type += 1;
1269 } else {
1270 strlcpy(hdr->pth_ifname, ifp->if_xname,
1271 sizeof(hdr->pth_ifname));
1272 hdr->pth_flags |= outgoing ? PTH_FLAG_DIR_OUT : PTH_FLAG_DIR_IN;
1273 hdr->pth_protocol_family = proto;
1274 hdr->pth_frame_pre_length = pre + pre_adjust;
1275 hdr->pth_frame_post_length = post;
1276 hdr->pth_iftype = ifp->if_type;
1277 hdr->pth_ifunit = ifp->if_unit;
1278
1279 if (m->m_pkthdr.pkt_flags & PKTF_KEEPALIVE) {
1280 hdr->pth_flags |= PTH_FLAG_KEEP_ALIVE;
1281 }
1282 if (m->m_pkthdr.pkt_flags & PKTF_TCP_REXMT) {
1283 hdr->pth_flags |= PTH_FLAG_REXMIT;
1284 }
1285
1286 pktap_fill_proc_info(hdr, proto, m, pre, outgoing, ifp);
1287
1288 hdr->pth_svc = so_svc2tc(m->m_pkthdr.pkt_svc);
1289
1290 if (data_adjust == 0) {
1291 bpf_tap_func(pktap->pktp_ifp, DLT_PKTAP, m, hdr, hdr_size);
1292 } else {
1293 /*
1294 * We can play just with the length of the first mbuf in the
1295 * chain because bpf_tap_imp() disregard the packet length
1296 * of the mbuf packet header.
1297 */
1298 if (mbuf_setdata(m, m->m_data + data_adjust, m->m_len - data_adjust) == 0) {
1299 bpf_tap_func(pktap->pktp_ifp, DLT_PKTAP, m, hdr, hdr_size);
1300 mbuf_setdata(m, m->m_data - data_adjust, m->m_len + data_adjust);
1301 }
1302 }
1303 }
1304 }
1305 }
1306 done:
1307 lck_rw_done(pktap_lck_rw);
1308 }
1309
1310 __private_extern__ void
1311 pktap_input(struct ifnet *ifp, protocol_family_t proto, struct mbuf *m,
1312 char *frame_header)
1313 {
1314 char *hdr;
1315 char *start;
1316
1317 /* Fast path */
1318 if (pktap_total_tap_count == 0) {
1319 return;
1320 }
1321
1322 hdr = (char *)mbuf_data(m);
1323 start = (char *)mbuf_datastart(m);
1324 /* Make sure the frame header is fully contained in the mbuf */
1325 if (frame_header != NULL && frame_header >= start && frame_header <= hdr) {
1326 size_t o_len = m->m_len;
1327 u_int32_t pre = hdr - frame_header;
1328
1329 if (mbuf_setdata(m, frame_header, o_len + pre) == 0) {
1330 PKTAP_LOG(PKTP_LOG_INPUT, "ifp %s proto %u pre %u post %u\n",
1331 ifp->if_xname, proto, pre, 0);
1332
1333 pktap_bpf_tap(ifp, proto, m, pre, 0, 0);
1334 mbuf_setdata(m, hdr, o_len);
1335 }
1336 } else {
1337 PKTAP_LOG(PKTP_LOG_INPUT, "ifp %s proto %u pre %u post %u\n",
1338 ifp->if_xname, proto, 0, 0);
1339
1340 pktap_bpf_tap(ifp, proto, m, 0, 0, 0);
1341 }
1342 }
1343
1344 __private_extern__ void
1345 pktap_output(struct ifnet *ifp, protocol_family_t proto, struct mbuf *m,
1346 u_int32_t pre, u_int32_t post)
1347 {
1348 /* Fast path */
1349 if (pktap_total_tap_count == 0) {
1350 return;
1351 }
1352
1353 PKTAP_LOG(PKTP_LOG_OUTPUT, "ifp %s proto %u pre %u post %u\n",
1354 ifp->if_xname, proto, pre, post);
1355
1356 pktap_bpf_tap(ifp, proto, m, pre, post, 1);
1357 }
1358
1359
1360 void
1361 convert_to_pktap_header_to_v2(struct bpf_packet *bpf_pkt, bool truncate)
1362 {
1363 struct pktap_header *pktap_header;
1364 size_t extra_src_size;
1365 struct pktap_buffer_v2_hdr_extra pktap_buffer_v2_hdr_extra;
1366 struct pktap_v2_hdr_space *pktap_v2_hdr_space;
1367 struct pktap_v2_hdr *pktap_v2_hdr;
1368 uint8_t *ptr;
1369
1370 pktap_header = (struct pktap_header *)bpf_pkt->bpfp_header;
1371
1372 if (pktap_header->pth_type_next != PTH_TYPE_PACKET) {
1373 return;
1374 }
1375
1376 VERIFY(bpf_pkt->bpfp_header_length >= sizeof(struct pktap_header));
1377
1378 /*
1379 * extra_src_size is the length of the optional link layer header
1380 */
1381 extra_src_size = bpf_pkt->bpfp_header_length -
1382 sizeof(struct pktap_header);
1383
1384 VERIFY(extra_src_size <= sizeof(union pktap_header_extra));
1385
1386 pktap_v2_hdr_space = &pktap_buffer_v2_hdr_extra.hdr_space;
1387 pktap_v2_hdr = &pktap_v2_hdr_space->pth_hdr;
1388 ptr = (uint8_t *) (pktap_v2_hdr + 1);
1389
1390 COPY_PKTAP_COMMON_FIELDS_TO_V2(pktap_v2_hdr, pktap_header);
1391
1392 /*
1393 * When truncating don't bother with the process UUIDs
1394 */
1395 if (!truncate) {
1396 if ((pktap_header->pth_flags & PTH_FLAG_DELAY_PKTAP)) {
1397 pktap_v2_hdr->pth_uuid_offset = pktap_v2_hdr->pth_length;
1398 pktap_v2_hdr->pth_length += sizeof(uuid_t);
1399 uuid_clear(*(uuid_t *)ptr);
1400 ptr += sizeof(uuid_t);
1401 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1402 } else if (!uuid_is_null(pktap_header->pth_uuid)) {
1403 pktap_v2_hdr->pth_uuid_offset = pktap_v2_hdr->pth_length;
1404 uuid_copy(*(uuid_t *)ptr, pktap_header->pth_uuid);
1405 pktap_v2_hdr->pth_length += sizeof(uuid_t);
1406 ptr += sizeof(uuid_t);
1407 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1408 }
1409
1410 if ((pktap_header->pth_flags & PTH_FLAG_DELAY_PKTAP)) {
1411 if (pktap_header->pth_flags & PTH_FLAG_PROC_DELEGATED) {
1412 pktap_v2_hdr->pth_e_uuid_offset = pktap_v2_hdr->pth_length;
1413 uuid_clear(*(uuid_t *)ptr);
1414 pktap_v2_hdr->pth_length += sizeof(uuid_t);
1415 ptr += sizeof(uuid_t);
1416 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1417 }
1418 } else if (!uuid_is_null(pktap_header->pth_euuid)) {
1419 pktap_v2_hdr->pth_e_uuid_offset = pktap_v2_hdr->pth_length;
1420 uuid_copy(*(uuid_t *)ptr, pktap_header->pth_euuid);
1421 pktap_v2_hdr->pth_length += sizeof(uuid_t);
1422 ptr += sizeof(uuid_t);
1423 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1424 }
1425 }
1426
1427 if (pktap_header->pth_ifname[0] != 0) {
1428 size_t strsize;
1429
1430 pktap_v2_hdr->pth_ifname_offset = pktap_v2_hdr->pth_length;
1431
1432 /*
1433 * Note: strlcpy() returns the length of the string so we need
1434 * to add one for the end-of-string
1435 */
1436 strsize = 1 + strlcpy((char *)ptr, pktap_header->pth_ifname,
1437 sizeof(pktap_v2_hdr_space->pth_ifname));
1438 pktap_v2_hdr->pth_length += strsize;
1439 ptr += strsize;
1440 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1441 }
1442
1443 /*
1444 * Do not waste space with the process name if we do not have a pid
1445 */
1446 if (pktap_header->pth_pid != 0 && pktap_header->pth_pid != -1) {
1447 if (pktap_header->pth_comm[0] != 0) {
1448 size_t strsize;
1449
1450 pktap_v2_hdr->pth_comm_offset = pktap_v2_hdr->pth_length;
1451
1452 strsize = 1 + strlcpy((char *)ptr, pktap_header->pth_comm,
1453 sizeof(pktap_v2_hdr_space->pth_comm));
1454 pktap_v2_hdr->pth_length += strsize;
1455 ptr += strsize;
1456 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1457 } else if ((pktap_header->pth_flags & PTH_FLAG_DELAY_PKTAP)) {
1458 size_t strsize = sizeof(pktap_v2_hdr_space->pth_comm);
1459
1460 pktap_v2_hdr->pth_comm_offset = pktap_v2_hdr->pth_length;
1461
1462 *ptr = 0; /* empty string by default */
1463 pktap_v2_hdr->pth_length += strsize;
1464 ptr += strsize;
1465 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1466 }
1467 }
1468
1469 /*
1470 * Do not waste space with the effective process name if we do not have
1471 * an effective pid or it's the same as the pid
1472 */
1473 if (pktap_header->pth_epid != 0 && pktap_header->pth_epid != -1 &&
1474 pktap_header->pth_epid != pktap_header->pth_pid) {
1475 if (pktap_header->pth_ecomm[0] != 0) {
1476 size_t strsize;
1477
1478 pktap_v2_hdr->pth_e_comm_offset = pktap_v2_hdr->pth_length;
1479
1480 strsize = 1 + strlcpy((char *)ptr, pktap_header->pth_ecomm,
1481 sizeof(pktap_v2_hdr_space->pth_e_comm));
1482 pktap_v2_hdr->pth_length += strsize;
1483 ptr += strsize;
1484 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1485 } else if ((pktap_header->pth_flags & PTH_FLAG_DELAY_PKTAP)) {
1486 size_t strsize = sizeof(pktap_v2_hdr_space->pth_e_comm);
1487
1488 pktap_v2_hdr->pth_e_comm_offset = pktap_v2_hdr->pth_length;
1489 *ptr = 0; /* empty string by default */
1490 pktap_v2_hdr->pth_length += strsize;
1491 ptr += strsize;
1492 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1493 }
1494 }
1495
1496 if (extra_src_size > 0) {
1497 char *extra_src_ptr = (char *)(pktap_header + 1);
1498 char *extra_dst_ptr = ((char *)pktap_v2_hdr) +
1499 pktap_v2_hdr->pth_length;
1500
1501 VERIFY(pktap_v2_hdr->pth_length + extra_src_size <=
1502 sizeof(struct pktap_buffer_v2_hdr_extra));
1503
1504 memcpy(extra_dst_ptr, extra_src_ptr, extra_src_size);
1505 }
1506
1507 VERIFY(pktap_v2_hdr->pth_length + extra_src_size <=
1508 bpf_pkt->bpfp_header_length);
1509
1510 memcpy(bpf_pkt->bpfp_header, pktap_v2_hdr,
1511 pktap_v2_hdr->pth_length + extra_src_size);
1512
1513 bpf_pkt->bpfp_total_length += pktap_v2_hdr->pth_length -
1514 sizeof(struct pktap_header);
1515 bpf_pkt->bpfp_header_length += pktap_v2_hdr->pth_length -
1516 sizeof(struct pktap_header);
1517 }
mirror of XNU