]> git.saurik.com Git - apple/xnu.git/blob - bsd/net/necp_client.c
projects / apple / xnu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
xnu-7195.101.1.tar.gz
[apple/xnu.git] / bsd / net / necp_client.c
1 /*
2 * Copyright (c) 2015-2020 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #include <string.h>
30
31 #include <kern/thread_call.h>
32 #include <kern/zalloc.h>
33
34 #include <net/if.h>
35 #include <net/if_var.h>
36 #include <net/net_api_stats.h>
37 #include <net/necp.h>
38 #include <net/network_agent.h>
39 #include <net/ntstat.h>
40
41 #include <netinet/in_pcb.h>
42 #include <netinet/in_var.h>
43 #include <netinet/ip.h>
44 #include <netinet/ip6.h>
45 #include <netinet/mp_pcb.h>
46 #include <netinet/tcp_cc.h>
47 #include <netinet/tcp_fsm.h>
48 #include <netinet/tcp_cache.h>
49 #include <netinet6/in6_var.h>
50
51 #include <sys/domain.h>
52 #include <sys/file_internal.h>
53 #include <sys/kauth.h>
54 #include <sys/kernel.h>
55 #include <sys/malloc.h>
56 #include <sys/poll.h>
57 #include <sys/priv.h>
58 #include <sys/protosw.h>
59 #include <sys/queue.h>
60 #include <sys/socket.h>
61 #include <sys/socketvar.h>
62 #include <sys/sysproto.h>
63 #include <sys/systm.h>
64 #include <sys/types.h>
65 #include <sys/codesign.h>
66 #include <libkern/section_keywords.h>
67
68 #include <os/refcnt.h>
69
70
71 /*
72 * NECP Client Architecture
73 * ------------------------------------------------
74 * See <net/necp.c> for a discussion on NECP database architecture.
75 *
76 * Each client of NECP provides a set of parameters for a connection or network state
77 * evaluation, on which NECP policy evaluation is run. This produces a policy result
78 * which can be accessed by the originating process, along with events for when policies
79 * results have changed.
80 *
81 * ------------------------------------------------
82 * NECP Client FD
83 * ------------------------------------------------
84 * A process opens an NECP file descriptor using necp_open(). This is a very simple
85 * file descriptor, upon which the process may do the following operations:
86 * - necp_client_action(...), to add/remove/query clients
87 * - kqueue, to watch for readable events
88 * - close(), to close the client session and release all clients
89 *
90 * Client objects are allocated structures that hang off of the file descriptor. Each
91 * client contains:
92 * - Client ID, a UUID that references the client across the system
93 * - Parameters, a buffer of TLVs that describe the client's connection parameters,
94 * such as the remote and local endpoints, interface requirements, etc.
95 * - Result, a buffer of TLVs containing the current policy evaluation for the client.
96 * This result will be updated whenever a network change occurs that impacts the
97 * policy result for that client.
98 *
99 * +--------------+
100 * | NECP fd |
101 * +--------------+
102 * ||
103 * ==================================
104 * || || ||
105 * +--------------+ +--------------+ +--------------+
106 * | Client ID | | Client ID | | Client ID |
107 * | ---- | | ---- | | ---- |
108 * | Parameters | | Parameters | | Parameters |
109 * | ---- | | ---- | | ---- |
110 * | Result | | Result | | Result |
111 * +--------------+ +--------------+ +--------------+
112 *
113 * ------------------------------------------------
114 * Client Actions
115 * ------------------------------------------------
116 * - Add. Input parameters as a buffer of TLVs, and output a client ID. Allocates a
117 * new client structure on the file descriptor.
118 * - Remove. Input a client ID. Removes a client structure from the file descriptor.
119 * - Copy Parameters. Input a client ID, and output parameter TLVs.
120 * - Copy Result. Input a client ID, and output result TLVs. Alternatively, input empty
121 * client ID and get next unread client result.
122 * - Copy List. List all client IDs.
123 *
124 * ------------------------------------------------
125 * Client Policy Evaluation
126 * ------------------------------------------------
127 * Policies are evaluated for clients upon client creation, and upon update events,
128 * which are network/agent/policy changes coalesced by a timer.
129 *
130 * The policy evaluation goes through the following steps:
131 * 1. Parse client parameters.
132 * 2. Select a scoped interface if applicable. This involves using require/prohibit
133 * parameters, along with the local address, to select the most appropriate interface
134 * if not explicitly set by the client parameters.
135 * 3. Run NECP application-level policy evalution
136 * 4. Set policy result into client result buffer.
137 *
138 * ------------------------------------------------
139 * Client Observers
140 * ------------------------------------------------
141 * If necp_open() is called with the NECP_OPEN_FLAG_OBSERVER flag, and the process
142 * passes the necessary privilege check, the fd is allowed to use necp_client_action()
143 * to copy client state attached to the file descriptors of other processes, and to
144 * list all client IDs on the system.
145 */
146
147 extern u_int32_t necp_debug;
148
149 static int necpop_select(struct fileproc *, int, void *, vfs_context_t);
150 static int necpop_close(struct fileglob *, vfs_context_t);
151 static int necpop_kqfilter(struct fileproc *, struct knote *, struct kevent_qos_s *);
152
153 // Timer functions
154 static int necp_timeout_microseconds = 1000 * 100; // 100ms
155 static int necp_timeout_leeway_microseconds = 1000 * 500; // 500ms
156
157 static int necp_client_fd_count = 0;
158 static int necp_observer_fd_count = 0;
159 static int necp_client_count = 0;
160 static int necp_socket_flow_count = 0;
161 static int necp_if_flow_count = 0;
162 static int necp_observer_message_limit = 256;
163
164 os_refgrp_decl(static, necp_client_refgrp, "NECPClientRefGroup", NULL);
165
166 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_FD_COUNT, client_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_fd_count, 0, "");
167 SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_FD_COUNT, observer_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_observer_fd_count, 0, "");
168 SYSCTL_INT(_net_necp, NECPCTL_CLIENT_COUNT, client_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_count, 0, "");
169 SYSCTL_INT(_net_necp, NECPCTL_SOCKET_FLOW_COUNT, socket_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_socket_flow_count, 0, "");
170 SYSCTL_INT(_net_necp, NECPCTL_IF_FLOW_COUNT, if_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_if_flow_count, 0, "");
171 SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_MESSAGE_LIMIT, observer_message_limit, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_observer_message_limit, 256, "");
172
173 #define NECP_MAX_CLIENT_LIST_SIZE 1024 * 1024 // 1MB
174 #define NECP_MAX_AGENT_ACTION_SIZE 256
175
176 extern int tvtohz(struct timeval *);
177 extern unsigned int get_maxmtu(struct rtentry *);
178
179 // Parsed parameters
180 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR 0x00001
181 #define NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR 0x00002
182 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF 0x00004
183 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF 0x00008
184 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE 0x00010
185 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE 0x00020
186 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT 0x00040
187 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT 0x00080
188 #define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT 0x00100
189 #define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT 0x00200
190 #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE 0x00400
191 #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE 0x00800
192 #define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE 0x01000
193 #define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE 0x02000
194 #define NECP_PARSED_PARAMETERS_FIELD_FLAGS 0x04000
195 #define NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL 0x08000
196 #define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID 0x10000
197 #define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID 0x20000
198 #define NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS 0x40000
199 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT 0x80000
200 #define NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID 0x100000
201 #define NECP_PARSED_PARAMETERS_FIELD_ETHERTYPE 0x200000
202 #define NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL 0x400000
203 #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE 0x800000
204
205
206 #define NECP_MAX_INTERFACE_PARAMETERS 16
207 #define NECP_MAX_AGENT_PARAMETERS 4
208 struct necp_client_parsed_parameters {
209 u_int32_t valid_fields;
210 u_int32_t flags;
211 u_int64_t delegated_upid;
212 union necp_sockaddr_union local_addr;
213 union necp_sockaddr_union remote_addr;
214 u_int32_t required_interface_index;
215 char prohibited_interfaces[NECP_MAX_INTERFACE_PARAMETERS][IFXNAMSIZ];
216 u_int8_t required_interface_type;
217 u_int8_t local_address_preference;
218 u_int8_t prohibited_interface_types[NECP_MAX_INTERFACE_PARAMETERS];
219 struct necp_client_parameter_netagent_type required_netagent_types[NECP_MAX_AGENT_PARAMETERS];
220 struct necp_client_parameter_netagent_type prohibited_netagent_types[NECP_MAX_AGENT_PARAMETERS];
221 struct necp_client_parameter_netagent_type preferred_netagent_types[NECP_MAX_AGENT_PARAMETERS];
222 struct necp_client_parameter_netagent_type avoided_netagent_types[NECP_MAX_AGENT_PARAMETERS];
223 uuid_t required_netagents[NECP_MAX_AGENT_PARAMETERS];
224 uuid_t prohibited_netagents[NECP_MAX_AGENT_PARAMETERS];
225 uuid_t preferred_netagents[NECP_MAX_AGENT_PARAMETERS];
226 uuid_t avoided_netagents[NECP_MAX_AGENT_PARAMETERS];
227 u_int8_t ip_protocol;
228 u_int8_t transport_protocol;
229 u_int16_t ethertype;
230 pid_t effective_pid;
231 uuid_t effective_uuid;
232 u_int32_t traffic_class;
233 };
234
235 static bool
236 necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters,
237 u_int *return_ifindex, bool *validate_agents);
238
239 static bool
240 necp_ifnet_matches_local_address(struct ifnet *ifp, struct sockaddr *sa);
241
242 static bool
243 necp_ifnet_matches_parameters(struct ifnet *ifp,
244 struct necp_client_parsed_parameters *parsed_parameters,
245 u_int32_t override_flags,
246 u_int32_t *preferred_count,
247 bool secondary_interface,
248 bool require_scoped_field);
249
250 static const struct fileops necp_fd_ops = {
251 .fo_type = DTYPE_NETPOLICY,
252 .fo_read = fo_no_read,
253 .fo_write = fo_no_write,
254 .fo_ioctl = fo_no_ioctl,
255 .fo_select = necpop_select,
256 .fo_close = necpop_close,
257 .fo_drain = fo_no_drain,
258 .fo_kqfilter = necpop_kqfilter,
259 };
260
261 struct necp_client_assertion {
262 LIST_ENTRY(necp_client_assertion) assertion_chain;
263 uuid_t asserted_netagent;
264 };
265
266 struct necp_client_flow_header {
267 struct necp_tlv_header outer_header;
268 struct necp_tlv_header flow_id_tlv_header;
269 uuid_t flow_id;
270 struct necp_tlv_header flags_tlv_header;
271 u_int32_t flags_value;
272 struct necp_tlv_header interface_tlv_header;
273 struct necp_client_result_interface interface_value;
274 } __attribute__((__packed__));
275
276 struct necp_client_flow_protoctl_event_header {
277 struct necp_tlv_header protoctl_tlv_header;
278 struct necp_client_flow_protoctl_event protoctl_event;
279 } __attribute__((__packed__));
280
281 struct necp_client_nexus_flow_header {
282 struct necp_client_flow_header flow_header;
283 struct necp_tlv_header agent_tlv_header;
284 struct necp_client_result_netagent agent_value;
285 struct necp_tlv_header tfo_cookie_tlv_header;
286 u_int8_t tfo_cookie_value[NECP_TFO_COOKIE_LEN_MAX];
287 } __attribute__((__packed__));
288
289
290 struct necp_client_flow {
291 LIST_ENTRY(necp_client_flow) flow_chain;
292 unsigned invalid : 1;
293 unsigned nexus : 1; // If true, flow is a nexus; if false, flow is attached to socket
294 unsigned socket : 1;
295 unsigned viable : 1;
296 unsigned assigned : 1;
297 unsigned has_protoctl_event : 1;
298 unsigned check_tcp_heuristics : 1;
299 unsigned _reserved : 1;
300 union {
301 uuid_t nexus_agent;
302 struct {
303 void *socket_handle;
304 necp_client_flow_cb cb;
305 };
306 } u;
307 uint32_t interface_index;
308 u_short delegated_interface_index;
309 uint16_t interface_flags;
310 uint32_t necp_flow_flags;
311 struct necp_client_flow_protoctl_event protoctl_event;
312 union necp_sockaddr_union local_addr;
313 union necp_sockaddr_union remote_addr;
314
315 size_t assigned_results_length;
316 u_int8_t *assigned_results;
317 };
318
319 struct necp_client_flow_registration {
320 RB_ENTRY(necp_client_flow_registration) fd_link;
321 RB_ENTRY(necp_client_flow_registration) global_link;
322 RB_ENTRY(necp_client_flow_registration) client_link;
323 LIST_ENTRY(necp_client_flow_registration) collect_stats_chain;
324 uuid_t registration_id;
325 u_int32_t flags;
326 unsigned flow_result_read : 1;
327 unsigned defunct : 1;
328 void *interface_handle;
329 necp_client_flow_cb interface_cb;
330 struct necp_client *client;
331 LIST_HEAD(_necp_registration_flow_list, necp_client_flow) flow_list;
332 u_int64_t last_interface_details __attribute__((aligned(sizeof(u_int64_t))));
333 };
334
335 static int necp_client_flow_id_cmp(struct necp_client_flow_registration *flow0, struct necp_client_flow_registration *flow1);
336
337 RB_HEAD(_necp_client_flow_tree, necp_client_flow_registration);
338 RB_PROTOTYPE_PREV(_necp_client_flow_tree, necp_client_flow_registration, client_link, necp_client_flow_id_cmp);
339 RB_GENERATE_PREV(_necp_client_flow_tree, necp_client_flow_registration, client_link, necp_client_flow_id_cmp);
340
341 #define NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT 4
342 #define NECP_CLIENT_MAX_INTERFACE_OPTIONS 16
343
344 #define NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT (NECP_CLIENT_MAX_INTERFACE_OPTIONS - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT)
345
346 struct necp_client {
347 RB_ENTRY(necp_client) link;
348 RB_ENTRY(necp_client) global_link;
349
350 decl_lck_mtx_data(, lock);
351 decl_lck_mtx_data(, route_lock);
352 os_refcnt_t reference_count;
353
354 uuid_t client_id;
355 unsigned result_read : 1;
356 unsigned allow_multiple_flows : 1;
357 unsigned legacy_client_is_flow : 1;
358
359 unsigned platform_binary : 1;
360
361 size_t result_length;
362 u_int8_t result[NECP_MAX_CLIENT_RESULT_SIZE];
363
364 necp_policy_id policy_id;
365
366 u_int8_t ip_protocol;
367 int proc_pid;
368
369 u_int64_t delegated_upid;
370
371 struct _necp_client_flow_tree flow_registrations;
372 LIST_HEAD(_necp_client_assertion_list, necp_client_assertion) assertion_list;
373
374 struct rtentry *current_route;
375
376 struct necp_client_interface_option interface_options[NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
377 struct necp_client_interface_option *extra_interface_options;
378 u_int8_t interface_option_count; // Number in interface_options + extra_interface_options
379
380 struct necp_client_result_netagent failed_trigger_agent;
381
382 void *agent_handle;
383
384 uuid_t override_euuid;
385
386
387 size_t parameters_length;
388 u_int8_t parameters[0];
389 };
390
391 #define NECP_CLIENT_LOCK(_c) lck_mtx_lock(&_c->lock)
392 #define NECP_CLIENT_UNLOCK(_c) lck_mtx_unlock(&_c->lock)
393 #define NECP_CLIENT_ASSERT_LOCKED(_c) LCK_MTX_ASSERT(&_c->lock, LCK_MTX_ASSERT_OWNED)
394 #define NECP_CLIENT_ASSERT_UNLOCKED(_c) LCK_MTX_ASSERT(&_c->lock, LCK_MTX_ASSERT_NOTOWNED)
395
396 #define NECP_CLIENT_ROUTE_LOCK(_c) lck_mtx_lock(&_c->route_lock)
397 #define NECP_CLIENT_ROUTE_UNLOCK(_c) lck_mtx_unlock(&_c->route_lock)
398
399 static void necp_client_retain_locked(struct necp_client *client);
400 static void necp_client_retain(struct necp_client *client);
401
402 static bool necp_client_release_locked(struct necp_client *client);
403 static bool necp_client_release(struct necp_client *client);
404
405 static void
406 necp_client_add_assertion(struct necp_client *client, uuid_t netagent_uuid);
407
408 static bool
409 necp_client_remove_assertion(struct necp_client *client, uuid_t netagent_uuid);
410
411 LIST_HEAD(_necp_flow_registration_list, necp_client_flow_registration);
412 static struct _necp_flow_registration_list necp_collect_stats_flow_list;
413
414 struct necp_flow_defunct {
415 LIST_ENTRY(necp_flow_defunct) chain;
416
417 uuid_t flow_id;
418 uuid_t nexus_agent;
419 void *agent_handle;
420 int proc_pid;
421 u_int32_t flags;
422 struct necp_client_agent_parameters close_parameters;
423 bool has_close_parameters;
424 };
425
426 LIST_HEAD(_necp_flow_defunct_list, necp_flow_defunct);
427
428 static int necp_client_id_cmp(struct necp_client *client0, struct necp_client *client1);
429
430 RB_HEAD(_necp_client_tree, necp_client);
431 RB_PROTOTYPE_PREV(_necp_client_tree, necp_client, link, necp_client_id_cmp);
432 RB_GENERATE_PREV(_necp_client_tree, necp_client, link, necp_client_id_cmp);
433
434 RB_HEAD(_necp_client_global_tree, necp_client);
435 RB_PROTOTYPE_PREV(_necp_client_global_tree, necp_client, global_link, necp_client_id_cmp);
436 RB_GENERATE_PREV(_necp_client_global_tree, necp_client, global_link, necp_client_id_cmp);
437
438 RB_HEAD(_necp_fd_flow_tree, necp_client_flow_registration);
439 RB_PROTOTYPE_PREV(_necp_fd_flow_tree, necp_client_flow_registration, fd_link, necp_client_flow_id_cmp);
440 RB_GENERATE_PREV(_necp_fd_flow_tree, necp_client_flow_registration, fd_link, necp_client_flow_id_cmp);
441
442 RB_HEAD(_necp_client_flow_global_tree, necp_client_flow_registration);
443 RB_PROTOTYPE_PREV(_necp_client_flow_global_tree, necp_client_flow_registration, global_link, necp_client_flow_id_cmp);
444 RB_GENERATE_PREV(_necp_client_flow_global_tree, necp_client_flow_registration, global_link, necp_client_flow_id_cmp);
445
446 static struct _necp_client_global_tree necp_client_global_tree;
447 static struct _necp_client_flow_global_tree necp_client_flow_global_tree;
448
449 struct necp_client_update {
450 TAILQ_ENTRY(necp_client_update) chain;
451
452 uuid_t client_id;
453
454 size_t update_length;
455 struct necp_client_observer_update update;
456 };
457
458
459 #define NAIF_ATTACHED 0x1 // arena is attached to list
460 #define NAIF_REDIRECT 0x2 // arena mmap has been redirected
461 #define NAIF_DEFUNCT 0x4 // arena is now defunct
462
463 struct necp_fd_data {
464 u_int8_t necp_fd_type;
465 LIST_ENTRY(necp_fd_data) chain;
466 struct _necp_client_tree clients;
467 struct _necp_fd_flow_tree flows;
468 TAILQ_HEAD(_necp_client_update_list, necp_client_update) update_list;
469 int update_count;
470 int flags;
471
472 unsigned background : 1;
473
474 int proc_pid;
475 decl_lck_mtx_data(, fd_lock);
476 struct selinfo si;
477 };
478
479 #define NECP_FD_LOCK(_f) lck_mtx_lock(&_f->fd_lock)
480 #define NECP_FD_UNLOCK(_f) lck_mtx_unlock(&_f->fd_lock)
481 #define NECP_FD_ASSERT_LOCKED(_f) LCK_MTX_ASSERT(&_f->fd_lock, LCK_MTX_ASSERT_OWNED)
482 #define NECP_FD_ASSERT_UNLOCKED(_f) LCK_MTX_ASSERT(&_f->fd_lock, LCK_MTX_ASSERT_NOTOWNED)
483
484 static LIST_HEAD(_necp_fd_list, necp_fd_data) necp_fd_list;
485 static LIST_HEAD(_necp_fd_observer_list, necp_fd_data) necp_fd_observer_list;
486
487 static ZONE_DECLARE(necp_client_fd_zone, "necp.clientfd",
488 sizeof(struct necp_fd_data), ZC_NONE);
489
490 #define NECP_FLOW_ZONE_NAME "necp.flow"
491 #define NECP_FLOW_REGISTRATION_ZONE_NAME "necp.flowregistration"
492
493 static unsigned int necp_flow_size; /* size of necp_client_flow */
494 static struct mcache *necp_flow_cache; /* cache for necp_client_flow */
495
496 static unsigned int necp_flow_registration_size; /* size of necp_client_flow_registration */
497 static struct mcache *necp_flow_registration_cache; /* cache for necp_client_flow_registration */
498
499
500 static lck_grp_attr_t *necp_fd_grp_attr = NULL;
501 static lck_attr_t *necp_fd_mtx_attr = NULL;
502 static lck_grp_t *necp_fd_mtx_grp = NULL;
503
504 decl_lck_rw_data(static, necp_fd_lock);
505 decl_lck_rw_data(static, necp_observer_lock);
506 decl_lck_rw_data(static, necp_client_tree_lock);
507 decl_lck_rw_data(static, necp_flow_tree_lock);
508 decl_lck_rw_data(static, necp_collect_stats_list_lock);
509
510 #define NECP_STATS_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_collect_stats_list_lock)
511 #define NECP_STATS_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_collect_stats_list_lock)
512 #define NECP_STATS_LIST_UNLOCK() lck_rw_done(&necp_collect_stats_list_lock)
513
514 #define NECP_CLIENT_TREE_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_client_tree_lock)
515 #define NECP_CLIENT_TREE_LOCK_SHARED() lck_rw_lock_shared(&necp_client_tree_lock)
516 #define NECP_CLIENT_TREE_UNLOCK() lck_rw_done(&necp_client_tree_lock)
517 #define NECP_CLIENT_TREE_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_client_tree_lock, LCK_RW_ASSERT_HELD)
518
519 #define NECP_FLOW_TREE_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_flow_tree_lock)
520 #define NECP_FLOW_TREE_LOCK_SHARED() lck_rw_lock_shared(&necp_flow_tree_lock)
521 #define NECP_FLOW_TREE_UNLOCK() lck_rw_done(&necp_flow_tree_lock)
522 #define NECP_FLOW_TREE_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_flow_tree_lock, LCK_RW_ASSERT_HELD)
523
524 #define NECP_FD_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_fd_lock)
525 #define NECP_FD_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_fd_lock)
526 #define NECP_FD_LIST_UNLOCK() lck_rw_done(&necp_fd_lock)
527
528 #define NECP_OBSERVER_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_observer_lock)
529 #define NECP_OBSERVER_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_observer_lock)
530 #define NECP_OBSERVER_LIST_UNLOCK() lck_rw_done(&necp_observer_lock)
531
532 // Locking Notes
533
534 // Take NECP_FD_LIST_LOCK when accessing or modifying the necp_fd_list
535 // Take NECP_CLIENT_TREE_LOCK when accessing or modifying the necp_client_global_tree
536 // Take NECP_FLOW_TREE_LOCK when accessing or modifying the necp_client_flow_global_tree
537 // Take NECP_STATS_LIST_LOCK when accessing or modifying the necp_collect_stats_flow_list
538 // Take NECP_FD_LOCK when accessing or modifying an necp_fd_data entry
539 // Take NECP_CLIENT_LOCK when accessing or modifying a single necp_client
540 // Take NECP_CLIENT_ROUTE_LOCK when accessing or modifying a client's route
541
542 // Precedence, where 1 is the first lock that must be taken
543 // 1. NECP_FD_LIST_LOCK
544 // 2. NECP_FD_LOCK (any)
545 // 3. NECP_CLIENT_TREE_LOCK
546 // 4. NECP_CLIENT_LOCK (any)
547 // 5. NECP_FLOW_TREE_LOCK
548 // 6. NECP_STATS_LIST_LOCK
549 // 7. NECP_CLIENT_ROUTE_LOCK (any)
550
551 static thread_call_t necp_client_update_tcall;
552
553
554 /// NECP file descriptor functions
555
556 static void
557 necp_fd_notify(struct necp_fd_data *fd_data, bool locked)
558 {
559 struct selinfo *si = &fd_data->si;
560
561 if (!locked) {
562 NECP_FD_LOCK(fd_data);
563 }
564
565 selwakeup(si);
566
567 // use a non-zero hint to tell the notification from the
568 // call done in kqueue_scan() which uses 0
569 KNOTE(&si->si_note, 1); // notification
570
571 if (!locked) {
572 NECP_FD_UNLOCK(fd_data);
573 }
574 }
575
576 static inline bool
577 necp_client_has_unread_flows(struct necp_client *client)
578 {
579 NECP_CLIENT_ASSERT_LOCKED(client);
580 struct necp_client_flow_registration *flow_registration = NULL;
581 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
582 if (!flow_registration->flow_result_read) {
583 return true;
584 }
585 }
586 return false;
587 }
588
589 static int
590 necp_fd_poll(struct necp_fd_data *fd_data, int events, void *wql, struct proc *p, int is_kevent)
591 {
592 #pragma unused(wql, p, is_kevent)
593 u_int revents = 0;
594
595 u_int want_rx = events & (POLLIN | POLLRDNORM);
596 if (want_rx) {
597 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
598 // Push-mode observers are readable when they have a new update
599 if (!TAILQ_EMPTY(&fd_data->update_list)) {
600 revents |= want_rx;
601 }
602 } else {
603 // Standard fds are readable when some client is unread
604 struct necp_client *client = NULL;
605 bool has_unread_clients = FALSE;
606 RB_FOREACH(client, _necp_client_tree, &fd_data->clients) {
607 NECP_CLIENT_LOCK(client);
608 if (!client->result_read || necp_client_has_unread_flows(client)) {
609 has_unread_clients = TRUE;
610 }
611 NECP_CLIENT_UNLOCK(client);
612 if (has_unread_clients) {
613 break;
614 }
615 }
616
617 if (has_unread_clients) {
618 revents |= want_rx;
619 }
620 }
621 }
622
623 return revents;
624 }
625
626 static inline void
627 necp_generate_client_id(uuid_t client_id, bool is_flow)
628 {
629 uuid_generate_random(client_id);
630
631 if (is_flow) {
632 client_id[9] |= 0x01;
633 } else {
634 client_id[9] &= ~0x01;
635 }
636 }
637
638 static inline bool
639 necp_client_id_is_flow(uuid_t client_id)
640 {
641 return client_id[9] & 0x01;
642 }
643
644 static struct necp_client *
645 necp_find_client_and_lock(uuid_t client_id)
646 {
647 NECP_CLIENT_TREE_ASSERT_LOCKED();
648
649 struct necp_client *client = NULL;
650
651 if (necp_client_id_is_flow(client_id)) {
652 NECP_FLOW_TREE_LOCK_SHARED();
653 struct necp_client_flow_registration find;
654 uuid_copy(find.registration_id, client_id);
655 struct necp_client_flow_registration *flow = RB_FIND(_necp_client_flow_global_tree, &necp_client_flow_global_tree, &find);
656 if (flow != NULL) {
657 client = flow->client;
658 }
659 NECP_FLOW_TREE_UNLOCK();
660 } else {
661 struct necp_client find;
662 uuid_copy(find.client_id, client_id);
663 client = RB_FIND(_necp_client_global_tree, &necp_client_global_tree, &find);
664 }
665
666 if (client != NULL) {
667 NECP_CLIENT_LOCK(client);
668 }
669
670 return client;
671 }
672
673 static struct necp_client_flow_registration *
674 necp_client_find_flow(struct necp_client *client, uuid_t flow_id)
675 {
676 NECP_CLIENT_ASSERT_LOCKED(client);
677 struct necp_client_flow_registration *flow = NULL;
678
679 if (necp_client_id_is_flow(flow_id)) {
680 struct necp_client_flow_registration find;
681 uuid_copy(find.registration_id, flow_id);
682 flow = RB_FIND(_necp_client_flow_tree, &client->flow_registrations, &find);
683 } else {
684 flow = RB_ROOT(&client->flow_registrations);
685 }
686
687 return flow;
688 }
689
690 static struct necp_client *
691 necp_client_fd_find_client_unlocked(struct necp_fd_data *client_fd, uuid_t client_id)
692 {
693 NECP_FD_ASSERT_LOCKED(client_fd);
694 struct necp_client *client = NULL;
695
696 if (necp_client_id_is_flow(client_id)) {
697 struct necp_client_flow_registration find;
698 uuid_copy(find.registration_id, client_id);
699 struct necp_client_flow_registration *flow = RB_FIND(_necp_fd_flow_tree, &client_fd->flows, &find);
700 if (flow != NULL) {
701 client = flow->client;
702 }
703 } else {
704 struct necp_client find;
705 uuid_copy(find.client_id, client_id);
706 client = RB_FIND(_necp_client_tree, &client_fd->clients, &find);
707 }
708
709 return client;
710 }
711
712 static struct necp_client *
713 necp_client_fd_find_client_and_lock(struct necp_fd_data *client_fd, uuid_t client_id)
714 {
715 struct necp_client *client = necp_client_fd_find_client_unlocked(client_fd, client_id);
716 if (client != NULL) {
717 NECP_CLIENT_LOCK(client);
718 }
719
720 return client;
721 }
722
723 static inline int
724 necp_client_id_cmp(struct necp_client *client0, struct necp_client *client1)
725 {
726 return uuid_compare(client0->client_id, client1->client_id);
727 }
728
729 static inline int
730 necp_client_flow_id_cmp(struct necp_client_flow_registration *flow0, struct necp_client_flow_registration *flow1)
731 {
732 return uuid_compare(flow0->registration_id, flow1->registration_id);
733 }
734
735 static int
736 necpop_select(struct fileproc *fp, int which, void *wql, vfs_context_t ctx)
737 {
738 #pragma unused(fp, which, wql, ctx)
739 return 0;
740 struct necp_fd_data *fd_data = NULL;
741 int revents = 0;
742 int events = 0;
743 proc_t procp;
744
745 fd_data = (struct necp_fd_data *)fp->fp_glob->fg_data;
746 if (fd_data == NULL) {
747 return 0;
748 }
749
750 procp = vfs_context_proc(ctx);
751
752 switch (which) {
753 case FREAD: {
754 events = POLLIN;
755 break;
756 }
757
758 default: {
759 return 1;
760 }
761 }
762
763 NECP_FD_LOCK(fd_data);
764 revents = necp_fd_poll(fd_data, events, wql, procp, 0);
765 NECP_FD_UNLOCK(fd_data);
766
767 return (events & revents) ? 1 : 0;
768 }
769
770 static void
771 necp_fd_knrdetach(struct knote *kn)
772 {
773 struct necp_fd_data *fd_data = (struct necp_fd_data *)kn->kn_hook;
774 struct selinfo *si = &fd_data->si;
775
776 NECP_FD_LOCK(fd_data);
777 KNOTE_DETACH(&si->si_note, kn);
778 NECP_FD_UNLOCK(fd_data);
779 }
780
781 static int
782 necp_fd_knread(struct knote *kn, long hint)
783 {
784 #pragma unused(kn, hint)
785 return 1; /* assume we are ready */
786 }
787
788 static int
789 necp_fd_knrprocess(struct knote *kn, struct kevent_qos_s *kev)
790 {
791 struct necp_fd_data *fd_data;
792 int revents;
793 int res;
794
795 fd_data = (struct necp_fd_data *)kn->kn_hook;
796
797 NECP_FD_LOCK(fd_data);
798 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
799 res = ((revents & POLLIN) != 0);
800 if (res) {
801 knote_fill_kevent(kn, kev, 0);
802 }
803 NECP_FD_UNLOCK(fd_data);
804 return res;
805 }
806
807 static int
808 necp_fd_knrtouch(struct knote *kn, struct kevent_qos_s *kev)
809 {
810 #pragma unused(kev)
811 struct necp_fd_data *fd_data;
812 int revents;
813
814 fd_data = (struct necp_fd_data *)kn->kn_hook;
815
816 NECP_FD_LOCK(fd_data);
817 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
818 NECP_FD_UNLOCK(fd_data);
819
820 return (revents & POLLIN) != 0;
821 }
822
823 SECURITY_READ_ONLY_EARLY(struct filterops) necp_fd_rfiltops = {
824 .f_isfd = 1,
825 .f_detach = necp_fd_knrdetach,
826 .f_event = necp_fd_knread,
827 .f_touch = necp_fd_knrtouch,
828 .f_process = necp_fd_knrprocess,
829 };
830
831 static int
832 necpop_kqfilter(struct fileproc *fp, struct knote *kn,
833 __unused struct kevent_qos_s *kev)
834 {
835 struct necp_fd_data *fd_data = NULL;
836 int revents;
837
838 if (kn->kn_filter != EVFILT_READ) {
839 NECPLOG(LOG_ERR, "bad filter request %d", kn->kn_filter);
840 knote_set_error(kn, EINVAL);
841 return 0;
842 }
843
844 fd_data = (struct necp_fd_data *)fp->fp_glob->fg_data;
845 if (fd_data == NULL) {
846 NECPLOG0(LOG_ERR, "No channel for kqfilter");
847 knote_set_error(kn, ENOENT);
848 return 0;
849 }
850
851 NECP_FD_LOCK(fd_data);
852 kn->kn_filtid = EVFILTID_NECP_FD;
853 kn->kn_hook = fd_data;
854 KNOTE_ATTACH(&fd_data->si.si_note, kn);
855
856 revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
857
858 NECP_FD_UNLOCK(fd_data);
859
860 return (revents & POLLIN) != 0;
861 }
862
863 #define INTERFACE_FLAGS_SHIFT 32
864 #define INTERFACE_FLAGS_MASK 0xffff
865 #define INTERFACE_INDEX_SHIFT 0
866 #define INTERFACE_INDEX_MASK 0xffffffff
867
868 static uint64_t
869 combine_interface_details(uint32_t interface_index, uint16_t interface_flags)
870 {
871 return ((uint64_t)interface_flags & INTERFACE_FLAGS_MASK) << INTERFACE_FLAGS_SHIFT |
872 ((uint64_t)interface_index & INTERFACE_INDEX_MASK) << INTERFACE_INDEX_SHIFT;
873 }
874
875
876 static void
877 necp_defunct_flow_registration(struct necp_client *client,
878 struct necp_client_flow_registration *flow_registration,
879 struct _necp_flow_defunct_list *defunct_list)
880 {
881 NECP_CLIENT_ASSERT_LOCKED(client);
882
883 if (!flow_registration->defunct) {
884 bool needs_defunct = false;
885 struct necp_client_flow *search_flow = NULL;
886 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
887 if (search_flow->nexus &&
888 !uuid_is_null(search_flow->u.nexus_agent)) {
889 // Save defunct values for the nexus
890 if (defunct_list != NULL) {
891 // Sleeping alloc won't fail; copy only what's necessary
892 struct necp_flow_defunct *flow_defunct = _MALLOC(sizeof(struct necp_flow_defunct),
893 M_NECP, M_WAITOK | M_ZERO);
894 uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent);
895 uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
896 client->client_id :
897 flow_registration->registration_id));
898 flow_defunct->proc_pid = client->proc_pid;
899 flow_defunct->agent_handle = client->agent_handle;
900 flow_defunct->flags = flow_registration->flags;
901 // Add to the list provided by caller
902 LIST_INSERT_HEAD(defunct_list, flow_defunct, chain);
903 }
904
905 needs_defunct = true;
906 }
907 }
908
909 if (needs_defunct) {
910
911 // Only set defunct if there was some assigned flow
912 flow_registration->defunct = true;
913 }
914 }
915 }
916
917 static void
918 necp_defunct_client_for_policy(struct necp_client *client,
919 struct _necp_flow_defunct_list *defunct_list)
920 {
921 NECP_CLIENT_ASSERT_LOCKED(client);
922
923 struct necp_client_flow_registration *flow_registration = NULL;
924 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
925 necp_defunct_flow_registration(client, flow_registration, defunct_list);
926 }
927 }
928
929 static void
930 necp_client_free(struct necp_client *client)
931 {
932 NECP_CLIENT_ASSERT_LOCKED(client);
933
934 NECP_CLIENT_UNLOCK(client);
935
936 FREE(client->extra_interface_options, M_NECP);
937 client->extra_interface_options = NULL;
938
939 lck_mtx_destroy(&client->route_lock, necp_fd_mtx_grp);
940 lck_mtx_destroy(&client->lock, necp_fd_mtx_grp);
941
942 FREE(client, M_NECP);
943 }
944
945 static void
946 necp_client_retain_locked(struct necp_client *client)
947 {
948 NECP_CLIENT_ASSERT_LOCKED(client);
949
950 os_ref_retain_locked(&client->reference_count);
951 }
952
953 static void
954 necp_client_retain(struct necp_client *client)
955 {
956 NECP_CLIENT_LOCK(client);
957 necp_client_retain_locked(client);
958 NECP_CLIENT_UNLOCK(client);
959 }
960
961 static bool
962 necp_client_release_locked(struct necp_client *client)
963 {
964 NECP_CLIENT_ASSERT_LOCKED(client);
965
966 os_ref_count_t count = os_ref_release_locked(&client->reference_count);
967 if (count == 0) {
968 necp_client_free(client);
969 }
970
971 return count == 0;
972 }
973
974 static bool
975 necp_client_release(struct necp_client *client)
976 {
977 bool last_ref;
978
979 NECP_CLIENT_LOCK(client);
980 if (!(last_ref = necp_client_release_locked(client))) {
981 NECP_CLIENT_UNLOCK(client);
982 }
983
984 return last_ref;
985 }
986
987 static void
988 necp_client_update_observer_add_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
989 {
990 NECP_FD_LOCK(observer_fd);
991
992 if (observer_fd->update_count >= necp_observer_message_limit) {
993 NECP_FD_UNLOCK(observer_fd);
994 return;
995 }
996
997 struct necp_client_update *client_update = _MALLOC(sizeof(struct necp_client_update) + client->parameters_length,
998 M_NECP, M_WAITOK | M_ZERO);
999 if (client_update != NULL) {
1000 client_update->update_length = sizeof(struct necp_client_observer_update) + client->parameters_length;
1001 uuid_copy(client_update->client_id, client->client_id);
1002 client_update->update.update_type = NECP_CLIENT_UPDATE_TYPE_PARAMETERS;
1003 memcpy(client_update->update.tlv_buffer, client->parameters, client->parameters_length);
1004 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1005 observer_fd->update_count++;
1006
1007 necp_fd_notify(observer_fd, true);
1008 }
1009
1010 NECP_FD_UNLOCK(observer_fd);
1011 }
1012
1013 static void
1014 necp_client_update_observer_update_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1015 {
1016 NECP_FD_LOCK(observer_fd);
1017
1018 if (observer_fd->update_count >= necp_observer_message_limit) {
1019 NECP_FD_UNLOCK(observer_fd);
1020 return;
1021 }
1022
1023 struct necp_client_update *client_update = _MALLOC(sizeof(struct necp_client_update) + client->result_length,
1024 M_NECP, M_WAITOK | M_ZERO);
1025 if (client_update != NULL) {
1026 client_update->update_length = sizeof(struct necp_client_observer_update) + client->result_length;
1027 uuid_copy(client_update->client_id, client->client_id);
1028 client_update->update.update_type = NECP_CLIENT_UPDATE_TYPE_RESULT;
1029 memcpy(client_update->update.tlv_buffer, client->result, client->result_length);
1030 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1031 observer_fd->update_count++;
1032
1033 necp_fd_notify(observer_fd, true);
1034 }
1035
1036 NECP_FD_UNLOCK(observer_fd);
1037 }
1038
1039 static void
1040 necp_client_update_observer_remove_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
1041 {
1042 NECP_FD_LOCK(observer_fd);
1043
1044 if (observer_fd->update_count >= necp_observer_message_limit) {
1045 NECP_FD_UNLOCK(observer_fd);
1046 return;
1047 }
1048
1049 struct necp_client_update *client_update = _MALLOC(sizeof(struct necp_client_update),
1050 M_NECP, M_WAITOK | M_ZERO);
1051 if (client_update != NULL) {
1052 client_update->update_length = sizeof(struct necp_client_observer_update);
1053 uuid_copy(client_update->client_id, client->client_id);
1054 client_update->update.update_type = NECP_CLIENT_UPDATE_TYPE_REMOVE;
1055 TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain);
1056 observer_fd->update_count++;
1057
1058 necp_fd_notify(observer_fd, true);
1059 }
1060
1061 NECP_FD_UNLOCK(observer_fd);
1062 }
1063
1064 static void
1065 necp_client_update_observer_add(struct necp_client *client)
1066 {
1067 NECP_OBSERVER_LIST_LOCK_SHARED();
1068
1069 if (LIST_EMPTY(&necp_fd_observer_list)) {
1070 // No observers, bail
1071 NECP_OBSERVER_LIST_UNLOCK();
1072 return;
1073 }
1074
1075 struct necp_fd_data *observer_fd = NULL;
1076 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1077 necp_client_update_observer_add_internal(observer_fd, client);
1078 }
1079
1080 NECP_OBSERVER_LIST_UNLOCK();
1081 }
1082
1083 static void
1084 necp_client_update_observer_update(struct necp_client *client)
1085 {
1086 NECP_OBSERVER_LIST_LOCK_SHARED();
1087
1088 if (LIST_EMPTY(&necp_fd_observer_list)) {
1089 // No observers, bail
1090 NECP_OBSERVER_LIST_UNLOCK();
1091 return;
1092 }
1093
1094 struct necp_fd_data *observer_fd = NULL;
1095 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1096 necp_client_update_observer_update_internal(observer_fd, client);
1097 }
1098
1099 NECP_OBSERVER_LIST_UNLOCK();
1100 }
1101
1102 static void
1103 necp_client_update_observer_remove(struct necp_client *client)
1104 {
1105 NECP_OBSERVER_LIST_LOCK_SHARED();
1106
1107 if (LIST_EMPTY(&necp_fd_observer_list)) {
1108 // No observers, bail
1109 NECP_OBSERVER_LIST_UNLOCK();
1110 return;
1111 }
1112
1113 struct necp_fd_data *observer_fd = NULL;
1114 LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) {
1115 necp_client_update_observer_remove_internal(observer_fd, client);
1116 }
1117
1118 NECP_OBSERVER_LIST_UNLOCK();
1119 }
1120
1121 static void
1122 necp_destroy_client_flow_registration(struct necp_client *client,
1123 struct necp_client_flow_registration *flow_registration,
1124 pid_t pid, bool abort)
1125 {
1126 NECP_CLIENT_ASSERT_LOCKED(client);
1127
1128 bool has_close_parameters = false;
1129 struct necp_client_agent_parameters close_parameters = {};
1130 memset(close_parameters.u.close_token, 0, sizeof(close_parameters.u.close_token));
1131
1132 struct necp_client_flow *search_flow = NULL;
1133 struct necp_client_flow *temp_flow = NULL;
1134 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
1135 if (search_flow->nexus &&
1136 !uuid_is_null(search_flow->u.nexus_agent)) {
1137 // Don't unregister for defunct flows
1138 if (!flow_registration->defunct) {
1139 u_int8_t message_type = (abort ? NETAGENT_MESSAGE_TYPE_ABORT_NEXUS :
1140 NETAGENT_MESSAGE_TYPE_CLOSE_NEXUS);
1141 if (((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
1142 (flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
1143 !(flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
1144 message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
1145 }
1146 int netagent_error = netagent_client_message_with_params(search_flow->u.nexus_agent,
1147 ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
1148 client->client_id :
1149 flow_registration->registration_id),
1150 pid, client->agent_handle,
1151 message_type,
1152 has_close_parameters ? &close_parameters : NULL,
1153 NULL, 0);
1154 if (netagent_error != 0 && netagent_error != ENOENT) {
1155 NECPLOG(LOG_ERR, "necp_client_remove close nexus error (%d) MESSAGE TYPE %u", netagent_error, message_type);
1156 }
1157 }
1158 uuid_clear(search_flow->u.nexus_agent);
1159 }
1160 if (search_flow->assigned_results != NULL) {
1161 FREE(search_flow->assigned_results, M_NETAGENT);
1162 search_flow->assigned_results = NULL;
1163 }
1164 LIST_REMOVE(search_flow, flow_chain);
1165 if (search_flow->socket) {
1166 OSDecrementAtomic(&necp_socket_flow_count);
1167 } else {
1168 OSDecrementAtomic(&necp_if_flow_count);
1169 }
1170 mcache_free(necp_flow_cache, search_flow);
1171 }
1172
1173 RB_REMOVE(_necp_client_flow_tree, &client->flow_registrations, flow_registration);
1174 flow_registration->client = NULL;
1175
1176 mcache_free(necp_flow_registration_cache, flow_registration);
1177 }
1178
1179 static void
1180 necp_destroy_client(struct necp_client *client, pid_t pid, bool abort)
1181 {
1182 NECP_CLIENT_ASSERT_UNLOCKED(client);
1183
1184 necp_client_update_observer_remove(client);
1185
1186 NECP_CLIENT_LOCK(client);
1187
1188 // Free route
1189 NECP_CLIENT_ROUTE_LOCK(client);
1190 if (client->current_route != NULL) {
1191 rtfree(client->current_route);
1192 client->current_route = NULL;
1193 }
1194 NECP_CLIENT_ROUTE_UNLOCK(client);
1195
1196 // Remove flow assignments
1197 struct necp_client_flow_registration *flow_registration = NULL;
1198 struct necp_client_flow_registration *temp_flow_registration = NULL;
1199 RB_FOREACH_SAFE(flow_registration, _necp_client_flow_tree, &client->flow_registrations, temp_flow_registration) {
1200 necp_destroy_client_flow_registration(client, flow_registration, pid, abort);
1201 }
1202
1203
1204 // Remove agent assertions
1205 struct necp_client_assertion *search_assertion = NULL;
1206 struct necp_client_assertion *temp_assertion = NULL;
1207 LIST_FOREACH_SAFE(search_assertion, &client->assertion_list, assertion_chain, temp_assertion) {
1208 int netagent_error = netagent_client_message(search_assertion->asserted_netagent, client->client_id, pid,
1209 client->agent_handle, NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT);
1210 if (netagent_error != 0) {
1211 NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR),
1212 "necp_client_remove unassert agent error (%d)", netagent_error);
1213 }
1214 LIST_REMOVE(search_assertion, assertion_chain);
1215 FREE(search_assertion, M_NECP);
1216 }
1217
1218 if (!necp_client_release_locked(client)) {
1219 NECP_CLIENT_UNLOCK(client);
1220 }
1221
1222 OSDecrementAtomic(&necp_client_count);
1223 }
1224
1225 static bool
1226 necp_defunct_client_fd_locked_inner(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, bool destroy_stats);
1227
1228 static void
1229 necp_process_defunct_list(struct _necp_flow_defunct_list *defunct_list)
1230 {
1231 if (!LIST_EMPTY(defunct_list)) {
1232 struct necp_flow_defunct *flow_defunct = NULL;
1233 struct necp_flow_defunct *temp_flow_defunct = NULL;
1234
1235 // For each newly defunct client, send a message to the nexus to remove the flow
1236 LIST_FOREACH_SAFE(flow_defunct, defunct_list, chain, temp_flow_defunct) {
1237 if (!uuid_is_null(flow_defunct->nexus_agent)) {
1238 u_int8_t message_type = NETAGENT_MESSAGE_TYPE_ABORT_NEXUS;
1239 if (((flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
1240 (flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
1241 !(flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
1242 message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
1243 }
1244 int netagent_error = netagent_client_message_with_params(flow_defunct->nexus_agent,
1245 flow_defunct->flow_id,
1246 flow_defunct->proc_pid,
1247 flow_defunct->agent_handle,
1248 message_type,
1249 flow_defunct->has_close_parameters ? &flow_defunct->close_parameters : NULL,
1250 NULL, 0);
1251 if (netagent_error != 0) {
1252 char namebuf[MAXCOMLEN + 1];
1253 (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
1254 proc_name(flow_defunct->proc_pid, namebuf, sizeof(namebuf));
1255 NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR), "necp_update_client abort nexus error (%d) for pid %d %s", netagent_error, flow_defunct->proc_pid, namebuf);
1256 }
1257 }
1258 LIST_REMOVE(flow_defunct, chain);
1259 FREE(flow_defunct, M_NECP);
1260 }
1261 }
1262 ASSERT(LIST_EMPTY(defunct_list));
1263 }
1264
1265 static int
1266 necpop_close(struct fileglob *fg, vfs_context_t ctx)
1267 {
1268 #pragma unused(ctx)
1269 struct necp_fd_data *fd_data = NULL;
1270 int error = 0;
1271
1272 fd_data = (struct necp_fd_data *)fg->fg_data;
1273 fg->fg_data = NULL;
1274
1275 if (fd_data != NULL) {
1276 struct _necp_client_tree clients_to_close;
1277 RB_INIT(&clients_to_close);
1278
1279 // Remove from list quickly
1280 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
1281 NECP_OBSERVER_LIST_LOCK_EXCLUSIVE();
1282 LIST_REMOVE(fd_data, chain);
1283 NECP_OBSERVER_LIST_UNLOCK();
1284 } else {
1285 NECP_FD_LIST_LOCK_EXCLUSIVE();
1286 LIST_REMOVE(fd_data, chain);
1287 NECP_FD_LIST_UNLOCK();
1288 }
1289
1290 NECP_FD_LOCK(fd_data);
1291 pid_t pid = fd_data->proc_pid;
1292
1293 struct _necp_flow_defunct_list defunct_list;
1294 LIST_INIT(&defunct_list);
1295
1296 (void)necp_defunct_client_fd_locked_inner(fd_data, &defunct_list, false);
1297
1298 struct necp_client_flow_registration *flow_registration = NULL;
1299 struct necp_client_flow_registration *temp_flow_registration = NULL;
1300 RB_FOREACH_SAFE(flow_registration, _necp_fd_flow_tree, &fd_data->flows, temp_flow_registration) {
1301 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
1302 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
1303 NECP_FLOW_TREE_UNLOCK();
1304 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
1305 }
1306
1307 struct necp_client *client = NULL;
1308 struct necp_client *temp_client = NULL;
1309 RB_FOREACH_SAFE(client, _necp_client_tree, &fd_data->clients, temp_client) {
1310 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
1311 RB_REMOVE(_necp_client_global_tree, &necp_client_global_tree, client);
1312 NECP_CLIENT_TREE_UNLOCK();
1313 RB_REMOVE(_necp_client_tree, &fd_data->clients, client);
1314 RB_INSERT(_necp_client_tree, &clients_to_close, client);
1315 }
1316
1317 struct necp_client_update *client_update = NULL;
1318 struct necp_client_update *temp_update = NULL;
1319 TAILQ_FOREACH_SAFE(client_update, &fd_data->update_list, chain, temp_update) {
1320 // Flush pending updates
1321 TAILQ_REMOVE(&fd_data->update_list, client_update, chain);
1322 FREE(client_update, M_NECP);
1323 }
1324 fd_data->update_count = 0;
1325
1326
1327 NECP_FD_UNLOCK(fd_data);
1328
1329 selthreadclear(&fd_data->si);
1330
1331 lck_mtx_destroy(&fd_data->fd_lock, necp_fd_mtx_grp);
1332
1333 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
1334 OSDecrementAtomic(&necp_observer_fd_count);
1335 } else {
1336 OSDecrementAtomic(&necp_client_fd_count);
1337 }
1338
1339 zfree(necp_client_fd_zone, fd_data);
1340 fd_data = NULL;
1341
1342 RB_FOREACH_SAFE(client, _necp_client_tree, &clients_to_close, temp_client) {
1343 RB_REMOVE(_necp_client_tree, &clients_to_close, client);
1344 necp_destroy_client(client, pid, true);
1345 }
1346
1347 necp_process_defunct_list(&defunct_list);
1348 }
1349
1350 return error;
1351 }
1352
1353 /// NECP client utilities
1354
1355 static inline bool
1356 necp_address_is_wildcard(const union necp_sockaddr_union * const addr)
1357 {
1358 return (addr->sa.sa_family == AF_INET && addr->sin.sin_addr.s_addr == INADDR_ANY) ||
1359 (addr->sa.sa_family == AF_INET6 && IN6_IS_ADDR_UNSPECIFIED(&addr->sin6.sin6_addr));
1360 }
1361
1362 static int
1363 necp_find_fd_data(struct proc *p, int fd,
1364 struct fileproc **fpp, struct necp_fd_data **fd_data)
1365 {
1366 struct fileproc *fp;
1367 int error = fp_get_ftype(p, fd, DTYPE_NETPOLICY, ENODEV, &fp);
1368
1369 if (error == 0) {
1370 *fd_data = (struct necp_fd_data *)fp->fp_glob->fg_data;
1371 *fpp = fp;
1372
1373 if ((*fd_data)->necp_fd_type != necp_fd_type_client) {
1374 // Not a client fd, ignore
1375 fp_drop(p, fd, fp, 0);
1376 error = EINVAL;
1377 }
1378 }
1379 return error;
1380 }
1381
1382 static void
1383 necp_client_add_nexus_flow(struct necp_client_flow_registration *flow_registration,
1384 uuid_t nexus_agent,
1385 uint32_t interface_index,
1386 uint16_t interface_flags)
1387 {
1388 struct necp_client_flow *new_flow = mcache_alloc(necp_flow_cache, MCR_SLEEP);
1389 if (new_flow == NULL) {
1390 NECPLOG0(LOG_ERR, "Failed to allocate nexus flow");
1391 return;
1392 }
1393
1394 memset(new_flow, 0, sizeof(*new_flow));
1395
1396 new_flow->nexus = TRUE;
1397 uuid_copy(new_flow->u.nexus_agent, nexus_agent);
1398 new_flow->interface_index = interface_index;
1399 new_flow->interface_flags = interface_flags;
1400 new_flow->check_tcp_heuristics = TRUE;
1401
1402
1403 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
1404
1405 }
1406
1407 static void
1408 necp_client_add_nexus_flow_if_needed(struct necp_client_flow_registration *flow_registration,
1409 uuid_t nexus_agent,
1410 uint32_t interface_index)
1411 {
1412 struct necp_client_flow *flow = NULL;
1413 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1414 if (flow->nexus &&
1415 uuid_compare(flow->u.nexus_agent, nexus_agent) == 0) {
1416 return;
1417 }
1418 }
1419
1420 uint16_t interface_flags = 0;
1421 ifnet_t ifp = NULL;
1422 ifnet_head_lock_shared();
1423 if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
1424 ifp = ifindex2ifnet[interface_index];
1425 if (ifp != NULL) {
1426 ifnet_lock_shared(ifp);
1427 interface_flags = nstat_ifnet_to_flags(ifp);
1428 ifnet_lock_done(ifp);
1429 }
1430 }
1431 ifnet_head_done();
1432 necp_client_add_nexus_flow(flow_registration, nexus_agent, interface_index, interface_flags);
1433 }
1434
1435 static struct necp_client_flow *
1436 necp_client_add_interface_flow(struct necp_client_flow_registration *flow_registration,
1437 uint32_t interface_index)
1438 {
1439 struct necp_client_flow *new_flow = mcache_alloc(necp_flow_cache, MCR_SLEEP);
1440 if (new_flow == NULL) {
1441 NECPLOG0(LOG_ERR, "Failed to allocate interface flow");
1442 return NULL;
1443 }
1444
1445 memset(new_flow, 0, sizeof(*new_flow));
1446
1447 // Neither nexus nor socket
1448 new_flow->interface_index = interface_index;
1449 new_flow->u.socket_handle = flow_registration->interface_handle;
1450 new_flow->u.cb = flow_registration->interface_cb;
1451
1452 OSIncrementAtomic(&necp_if_flow_count);
1453
1454 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
1455
1456 return new_flow;
1457 }
1458
1459 static struct necp_client_flow *
1460 necp_client_add_interface_flow_if_needed(struct necp_client *client,
1461 struct necp_client_flow_registration *flow_registration,
1462 uint32_t interface_index)
1463 {
1464 if (!client->allow_multiple_flows ||
1465 interface_index == IFSCOPE_NONE) {
1466 // Interface not set, or client not allowed to use this mode
1467 return NULL;
1468 }
1469
1470 struct necp_client_flow *flow = NULL;
1471 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1472 if (!flow->nexus && !flow->socket && flow->interface_index == interface_index) {
1473 // Already have the flow
1474 flow->invalid = FALSE;
1475 flow->u.socket_handle = flow_registration->interface_handle;
1476 flow->u.cb = flow_registration->interface_cb;
1477 return NULL;
1478 }
1479 }
1480 return necp_client_add_interface_flow(flow_registration, interface_index);
1481 }
1482
1483 static void
1484 necp_client_add_interface_option_if_needed(struct necp_client *client,
1485 uint32_t interface_index,
1486 uint32_t interface_generation,
1487 uuid_t *nexus_agent,
1488 bool network_provider)
1489 {
1490 if ((interface_index == IFSCOPE_NONE && !network_provider) ||
1491 (client->interface_option_count != 0 && !client->allow_multiple_flows)) {
1492 // Interface or agent not set, or client not allowed to use this mode
1493 return;
1494 }
1495
1496 if (client->interface_option_count >= NECP_CLIENT_MAX_INTERFACE_OPTIONS) {
1497 // Cannot take any more interface options
1498 return;
1499 }
1500
1501 // Check if already present
1502 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
1503 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
1504 struct necp_client_interface_option *option = &client->interface_options[option_i];
1505 if (option->interface_index == interface_index) {
1506 if (nexus_agent == NULL) {
1507 return;
1508 }
1509 if (uuid_compare(option->nexus_agent, *nexus_agent) == 0) {
1510 return;
1511 }
1512 if (uuid_is_null(option->nexus_agent)) {
1513 uuid_copy(option->nexus_agent, *nexus_agent);
1514 return;
1515 }
1516 // If we get to this point, this is a new nexus flow
1517 }
1518 } else {
1519 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
1520 if (option->interface_index == interface_index) {
1521 if (nexus_agent == NULL) {
1522 return;
1523 }
1524 if (uuid_compare(option->nexus_agent, *nexus_agent) == 0) {
1525 return;
1526 }
1527 if (uuid_is_null(option->nexus_agent)) {
1528 uuid_copy(option->nexus_agent, *nexus_agent);
1529 return;
1530 }
1531 // If we get to this point, this is a new nexus flow
1532 }
1533 }
1534 }
1535
1536 // Add a new entry
1537 if (client->interface_option_count < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
1538 // Add to static
1539 struct necp_client_interface_option *option = &client->interface_options[client->interface_option_count];
1540 option->interface_index = interface_index;
1541 option->interface_generation = interface_generation;
1542 if (nexus_agent != NULL) {
1543 uuid_copy(option->nexus_agent, *nexus_agent);
1544 } else {
1545 uuid_clear(option->nexus_agent);
1546 }
1547 client->interface_option_count++;
1548 } else {
1549 // Add to extra
1550 if (client->extra_interface_options == NULL) {
1551 client->extra_interface_options = _MALLOC(sizeof(struct necp_client_interface_option) * NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT, M_NECP, M_WAITOK | M_ZERO);
1552 }
1553 if (client->extra_interface_options != NULL) {
1554 struct necp_client_interface_option *option = &client->extra_interface_options[client->interface_option_count - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
1555 option->interface_index = interface_index;
1556 option->interface_generation = interface_generation;
1557 if (nexus_agent != NULL) {
1558 uuid_copy(option->nexus_agent, *nexus_agent);
1559 } else {
1560 uuid_clear(option->nexus_agent);
1561 }
1562 client->interface_option_count++;
1563 }
1564 }
1565 }
1566
1567 static bool
1568 necp_client_flow_is_viable(proc_t proc, struct necp_client *client,
1569 struct necp_client_flow *flow)
1570 {
1571 struct necp_aggregate_result result;
1572 bool ignore_address = (client->allow_multiple_flows && !flow->nexus && !flow->socket);
1573
1574 flow->necp_flow_flags = 0;
1575 int error = necp_application_find_policy_match_internal(proc, client->parameters,
1576 (u_int32_t)client->parameters_length,
1577 &result, &flow->necp_flow_flags, NULL,
1578 flow->interface_index,
1579 &flow->local_addr, &flow->remote_addr, NULL, NULL,
1580 NULL, ignore_address, true, NULL);
1581
1582 // Check for blocking agents
1583 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
1584 if (uuid_is_null(result.netagents[i])) {
1585 // Passed end of valid agents
1586 break;
1587 }
1588
1589 u_int32_t flags = netagent_get_flags(result.netagents[i]);
1590 if ((flags & NETAGENT_FLAG_REGISTERED) &&
1591 !(flags & NETAGENT_FLAG_VOLUNTARY) &&
1592 !(flags & NETAGENT_FLAG_ACTIVE) &&
1593 !(flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY)) {
1594 // A required agent is not active, cause the flow to be marked non-viable
1595 return false;
1596 }
1597 }
1598
1599 if (flow->interface_index != IFSCOPE_NONE) {
1600 ifnet_head_lock_shared();
1601
1602 struct ifnet *ifp = ifindex2ifnet[flow->interface_index];
1603 if (ifp && ifp->if_delegated.ifp != IFSCOPE_NONE) {
1604 flow->delegated_interface_index = ifp->if_delegated.ifp->if_index;
1605 }
1606
1607 ifnet_head_done();
1608 }
1609
1610 return error == 0 &&
1611 result.routed_interface_index != IFSCOPE_NONE &&
1612 result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP;
1613 }
1614
1615 static void
1616 necp_flow_add_interface_flows(proc_t proc,
1617 struct necp_client *client,
1618 struct necp_client_flow_registration *flow_registration,
1619 bool send_initial)
1620 {
1621 // Traverse all interfaces and add a tracking flow if needed
1622 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
1623 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
1624 struct necp_client_interface_option *option = &client->interface_options[option_i];
1625 struct necp_client_flow *flow = necp_client_add_interface_flow_if_needed(client, flow_registration, option->interface_index);
1626 if (flow != NULL && send_initial) {
1627 flow->viable = necp_client_flow_is_viable(proc, client, flow);
1628 if (flow->viable && flow->u.cb) {
1629 bool viable = flow->viable;
1630 flow->u.cb(flow_registration->interface_handle, NECP_CLIENT_CBACTION_INITIAL, flow->interface_index, flow->necp_flow_flags, &viable);
1631 flow->viable = viable;
1632 }
1633 }
1634 } else {
1635 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
1636 struct necp_client_flow *flow = necp_client_add_interface_flow_if_needed(client, flow_registration, option->interface_index);
1637 if (flow != NULL && send_initial) {
1638 flow->viable = necp_client_flow_is_viable(proc, client, flow);
1639 if (flow->viable && flow->u.cb) {
1640 bool viable = flow->viable;
1641 flow->u.cb(flow_registration->interface_handle, NECP_CLIENT_CBACTION_INITIAL, flow->interface_index, flow->necp_flow_flags, &viable);
1642 flow->viable = viable;
1643 }
1644 }
1645 }
1646 }
1647 }
1648
1649 static bool
1650 necp_client_update_flows(proc_t proc,
1651 struct necp_client *client,
1652 struct _necp_flow_defunct_list *defunct_list)
1653 {
1654 NECP_CLIENT_ASSERT_LOCKED(client);
1655
1656 bool any_client_updated = FALSE;
1657 struct necp_client_flow *flow = NULL;
1658 struct necp_client_flow *temp_flow = NULL;
1659 struct necp_client_flow_registration *flow_registration = NULL;
1660 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
1661 if (flow_registration->interface_cb != NULL) {
1662 // Add any interface flows that are not already tracked
1663 necp_flow_add_interface_flows(proc, client, flow_registration, false);
1664 }
1665
1666 LIST_FOREACH_SAFE(flow, &flow_registration->flow_list, flow_chain, temp_flow) {
1667 bool client_updated = FALSE;
1668
1669 // Check policy result for flow
1670 u_short old_delegated_ifindex = flow->delegated_interface_index;
1671
1672 int old_flags = flow->necp_flow_flags;
1673 bool viable = necp_client_flow_is_viable(proc, client, flow);
1674
1675 // TODO: Defunct nexus flows that are blocked by policy
1676
1677 if (flow->viable != viable) {
1678 flow->viable = viable;
1679 client_updated = TRUE;
1680 }
1681
1682 if ((old_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE) !=
1683 (flow->necp_flow_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE)) {
1684 client_updated = TRUE;
1685 }
1686
1687 if (flow->delegated_interface_index != old_delegated_ifindex) {
1688 client_updated = TRUE;
1689 }
1690
1691 if (flow->viable && client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) {
1692 bool flow_viable = flow->viable;
1693 flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_VIABLE, flow->interface_index, flow->necp_flow_flags, &flow_viable);
1694 flow->viable = flow_viable;
1695 }
1696
1697 if (!flow->viable || flow->invalid) {
1698 if (client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) {
1699 bool flow_viable = flow->viable;
1700 flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_NONVIABLE, flow->interface_index, flow->necp_flow_flags, &flow_viable);
1701 flow->viable = flow_viable;
1702 }
1703 // The callback might change the viable-flag of the
1704 // flow depending on its policy. Thus, we need to
1705 // check the flags again after the callback.
1706 }
1707
1708 (void)defunct_list;
1709
1710 // Handle flows that no longer match
1711 if (!flow->viable || flow->invalid) {
1712 // Drop them as long as they aren't assigned data
1713 if (!flow->nexus && !flow->assigned) {
1714 if (flow->assigned_results != NULL) {
1715 FREE(flow->assigned_results, M_NETAGENT);
1716 flow->assigned_results = NULL;
1717 client_updated = TRUE;
1718 }
1719 LIST_REMOVE(flow, flow_chain);
1720 if (flow->socket) {
1721 OSDecrementAtomic(&necp_socket_flow_count);
1722 } else {
1723 OSDecrementAtomic(&necp_if_flow_count);
1724 }
1725 mcache_free(necp_flow_cache, flow);
1726 }
1727 }
1728
1729 any_client_updated |= client_updated;
1730 }
1731 }
1732
1733 return any_client_updated;
1734 }
1735
1736 static void
1737 necp_client_mark_all_nonsocket_flows_as_invalid(struct necp_client *client)
1738 {
1739 struct necp_client_flow_registration *flow_registration = NULL;
1740 struct necp_client_flow *flow = NULL;
1741 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
1742 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
1743 if (!flow->socket) { // Socket flows are not marked as invalid
1744 flow->invalid = TRUE;
1745 }
1746 }
1747 }
1748
1749 // Reset option count every update
1750 client->interface_option_count = 0;
1751 }
1752
1753 static inline bool
1754 necp_netagent_is_required(const struct necp_client_parsed_parameters *parameters,
1755 uuid_t *netagent_uuid)
1756 {
1757 // Specific use agents only apply when required
1758 bool required = false;
1759 if (parameters != NULL) {
1760 // Check required agent UUIDs
1761 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
1762 if (uuid_is_null(parameters->required_netagents[i])) {
1763 break;
1764 }
1765 if (uuid_compare(parameters->required_netagents[i], *netagent_uuid) == 0) {
1766 required = true;
1767 break;
1768 }
1769 }
1770
1771 if (!required) {
1772 // Check required agent types
1773 bool fetched_type = false;
1774 char netagent_domain[NETAGENT_DOMAINSIZE];
1775 char netagent_type[NETAGENT_TYPESIZE];
1776 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
1777 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
1778
1779 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
1780 if (strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
1781 strlen(parameters->required_netagent_types[i].netagent_type) == 0) {
1782 break;
1783 }
1784
1785 if (!fetched_type) {
1786 if (netagent_get_agent_domain_and_type(*netagent_uuid, netagent_domain, netagent_type)) {
1787 fetched_type = TRUE;
1788 } else {
1789 break;
1790 }
1791 }
1792
1793 if ((strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
1794 strncmp(netagent_domain, parameters->required_netagent_types[i].netagent_domain, NETAGENT_DOMAINSIZE) == 0) &&
1795 (strlen(parameters->required_netagent_types[i].netagent_type) == 0 ||
1796 strncmp(netagent_type, parameters->required_netagent_types[i].netagent_type, NETAGENT_TYPESIZE) == 0)) {
1797 required = true;
1798 break;
1799 }
1800 }
1801 }
1802 }
1803
1804 return required;
1805 }
1806
1807 static bool
1808 necp_netagent_applies_to_client(struct necp_client *client,
1809 const struct necp_client_parsed_parameters *parameters,
1810 uuid_t *netagent_uuid, bool allow_nexus,
1811 uint32_t interface_index, uint32_t interface_generation)
1812 {
1813 #pragma unused(interface_index, interface_generation)
1814 bool applies = FALSE;
1815 u_int32_t flags = netagent_get_flags(*netagent_uuid);
1816 if (!(flags & NETAGENT_FLAG_REGISTERED)) {
1817 // Unregistered agents never apply
1818 return applies;
1819 }
1820
1821 const bool is_nexus_agent = ((flags & NETAGENT_FLAG_NEXUS_PROVIDER) ||
1822 (flags & NETAGENT_FLAG_NEXUS_LISTENER) ||
1823 (flags & NETAGENT_FLAG_CUSTOM_ETHER_NEXUS) ||
1824 (flags & NETAGENT_FLAG_CUSTOM_IP_NEXUS) ||
1825 (flags & NETAGENT_FLAG_INTERPOSE_NEXUS));
1826 if (is_nexus_agent) {
1827 if (!allow_nexus) {
1828 // Hide nexus providers unless allowed
1829 // Direct interfaces and direct policies are allowed to use a nexus
1830 // Delegate interfaces or re-scoped interfaces are not allowed
1831 return applies;
1832 }
1833
1834 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) &&
1835 !(flags & NETAGENT_FLAG_CUSTOM_ETHER_NEXUS)) {
1836 // Client requested a custom ether nexus, but this nexus isn't one
1837 return applies;
1838 }
1839
1840 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP) &&
1841 !(flags & NETAGENT_FLAG_CUSTOM_IP_NEXUS)) {
1842 // Client requested a custom IP nexus, but this nexus isn't one
1843 return applies;
1844 }
1845
1846 if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) &&
1847 !(flags & NETAGENT_FLAG_INTERPOSE_NEXUS)) {
1848 // Client requested an interpose nexus, but this nexus isn't one
1849 return applies;
1850 }
1851
1852 if (!(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) &&
1853 !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP) &&
1854 !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) &&
1855 !(flags & NETAGENT_FLAG_NEXUS_PROVIDER)) {
1856 // Client requested default parameters, but this nexus isn't generic
1857 return applies;
1858 }
1859 }
1860
1861 if (uuid_compare(client->failed_trigger_agent.netagent_uuid, *netagent_uuid) == 0) {
1862 if (client->failed_trigger_agent.generation == netagent_get_generation(*netagent_uuid)) {
1863 // If this agent was triggered, and failed, and hasn't changed, keep hiding it
1864 return applies;
1865 } else {
1866 // Mismatch generation, clear out old trigger
1867 uuid_clear(client->failed_trigger_agent.netagent_uuid);
1868 client->failed_trigger_agent.generation = 0;
1869 }
1870 }
1871
1872 if (flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY) {
1873 // Specific use agents only apply when required
1874 applies = necp_netagent_is_required(parameters, netagent_uuid);
1875 } else {
1876 applies = TRUE;
1877 }
1878
1879
1880 return applies;
1881 }
1882
1883 static void
1884 necp_client_add_agent_interface_options(struct necp_client *client,
1885 const struct necp_client_parsed_parameters *parsed_parameters,
1886 ifnet_t ifp)
1887 {
1888 if (ifp != NULL && ifp->if_agentids != NULL) {
1889 for (u_int32_t i = 0; i < ifp->if_agentcount; i++) {
1890 if (uuid_is_null(ifp->if_agentids[i])) {
1891 continue;
1892 }
1893 // Relies on the side effect that nexus agents that apply will create flows
1894 (void)necp_netagent_applies_to_client(client, parsed_parameters, &ifp->if_agentids[i], TRUE,
1895 ifp->if_index, ifnet_get_generation(ifp));
1896 }
1897 }
1898 }
1899
1900 static void
1901 necp_client_add_browse_interface_options(struct necp_client *client,
1902 const struct necp_client_parsed_parameters *parsed_parameters,
1903 ifnet_t ifp)
1904 {
1905 if (ifp != NULL && ifp->if_agentids != NULL) {
1906 for (u_int32_t i = 0; i < ifp->if_agentcount; i++) {
1907 if (uuid_is_null(ifp->if_agentids[i])) {
1908 continue;
1909 }
1910
1911 u_int32_t flags = netagent_get_flags(ifp->if_agentids[i]);
1912 if ((flags & NETAGENT_FLAG_REGISTERED) &&
1913 (flags & NETAGENT_FLAG_ACTIVE) &&
1914 (flags & NETAGENT_FLAG_SUPPORTS_BROWSE) &&
1915 (!(flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY) ||
1916 necp_netagent_is_required(parsed_parameters, &ifp->if_agentids[i]))) {
1917 necp_client_add_interface_option_if_needed(client, ifp->if_index, ifnet_get_generation(ifp),
1918 &ifp->if_agentids[i], (flags & NETAGENT_FLAG_NETWORK_PROVIDER));
1919
1920 // Finding one is enough
1921 break;
1922 }
1923 }
1924 }
1925 }
1926
1927 static inline bool
1928 necp_client_address_is_valid(struct sockaddr *address)
1929 {
1930 if (address->sa_family == AF_INET) {
1931 return address->sa_len == sizeof(struct sockaddr_in);
1932 } else if (address->sa_family == AF_INET6) {
1933 return address->sa_len == sizeof(struct sockaddr_in6);
1934 } else {
1935 return FALSE;
1936 }
1937 }
1938
1939 static inline bool
1940 necp_client_endpoint_is_unspecified(struct necp_client_endpoint *endpoint)
1941 {
1942 if (necp_client_address_is_valid(&endpoint->u.sa)) {
1943 if (endpoint->u.sa.sa_family == AF_INET) {
1944 return endpoint->u.sin.sin_addr.s_addr == INADDR_ANY;
1945 } else if (endpoint->u.sa.sa_family == AF_INET6) {
1946 return IN6_IS_ADDR_UNSPECIFIED(&endpoint->u.sin6.sin6_addr);
1947 } else {
1948 return TRUE;
1949 }
1950 } else {
1951 return TRUE;
1952 }
1953 }
1954
1955
1956 static int
1957 necp_client_parse_parameters(u_int8_t *parameters,
1958 u_int32_t parameters_size,
1959 struct necp_client_parsed_parameters *parsed_parameters)
1960 {
1961 int error = 0;
1962 size_t offset = 0;
1963
1964 u_int32_t num_prohibited_interfaces = 0;
1965 u_int32_t num_prohibited_interface_types = 0;
1966 u_int32_t num_required_agents = 0;
1967 u_int32_t num_prohibited_agents = 0;
1968 u_int32_t num_preferred_agents = 0;
1969 u_int32_t num_avoided_agents = 0;
1970 u_int32_t num_required_agent_types = 0;
1971 u_int32_t num_prohibited_agent_types = 0;
1972 u_int32_t num_preferred_agent_types = 0;
1973 u_int32_t num_avoided_agent_types = 0;
1974 u_int8_t *resolver_tag = NULL;
1975 u_int32_t resolver_tag_length = 0;
1976 u_int8_t *client_hostname = NULL;
1977 u_int32_t hostname_length = 0;
1978 uuid_t parent_id = {};
1979
1980 if (parsed_parameters == NULL) {
1981 return EINVAL;
1982 }
1983
1984 memset(parsed_parameters, 0, sizeof(struct necp_client_parsed_parameters));
1985
1986 while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) {
1987 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
1988 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
1989
1990 if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) {
1991 // If the length is larger than what can fit in the remaining parameters size, bail
1992 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
1993 break;
1994 }
1995
1996 if (length > 0) {
1997 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
1998 if (value != NULL) {
1999 switch (type) {
2000 case NECP_CLIENT_PARAMETER_BOUND_INTERFACE: {
2001 if (length <= IFXNAMSIZ && length > 0) {
2002 ifnet_t bound_interface = NULL;
2003 char interface_name[IFXNAMSIZ];
2004 memcpy(interface_name, value, length);
2005 interface_name[length - 1] = 0; // Make sure the string is NULL terminated
2006 if (ifnet_find_by_name(interface_name, &bound_interface) == 0) {
2007 parsed_parameters->required_interface_index = bound_interface->if_index;
2008 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF;
2009 ifnet_release(bound_interface);
2010 }
2011 }
2012 break;
2013 }
2014 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: {
2015 if (length >= sizeof(struct necp_policy_condition_addr)) {
2016 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
2017 if (necp_client_address_is_valid(&address_struct->address.sa)) {
2018 memcpy(&parsed_parameters->local_addr, &address_struct->address, sizeof(address_struct->address));
2019 if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
2020 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
2021 }
2022 if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
2023 (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
2024 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
2025 }
2026 }
2027 }
2028 break;
2029 }
2030 case NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT: {
2031 if (length >= sizeof(struct necp_client_endpoint)) {
2032 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2033 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2034 memcpy(&parsed_parameters->local_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
2035 if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
2036 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
2037 }
2038 if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
2039 (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
2040 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
2041 }
2042 }
2043 }
2044 break;
2045 }
2046 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
2047 if (length >= sizeof(struct necp_policy_condition_addr)) {
2048 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
2049 if (necp_client_address_is_valid(&address_struct->address.sa)) {
2050 memcpy(&parsed_parameters->remote_addr, &address_struct->address, sizeof(address_struct->address));
2051 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
2052 }
2053 }
2054 break;
2055 }
2056 case NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT: {
2057 if (length >= sizeof(struct necp_client_endpoint)) {
2058 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2059 if (necp_client_address_is_valid(&endpoint->u.sa)) {
2060 memcpy(&parsed_parameters->remote_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
2061 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
2062 }
2063 }
2064 break;
2065 }
2066 case NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE: {
2067 if (num_prohibited_interfaces >= NECP_MAX_INTERFACE_PARAMETERS) {
2068 break;
2069 }
2070 if (length <= IFXNAMSIZ && length > 0) {
2071 memcpy(parsed_parameters->prohibited_interfaces[num_prohibited_interfaces], value, length);
2072 parsed_parameters->prohibited_interfaces[num_prohibited_interfaces][length - 1] = 0; // Make sure the string is NULL terminated
2073 num_prohibited_interfaces++;
2074 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF;
2075 }
2076 break;
2077 }
2078 case NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE: {
2079 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) {
2080 break;
2081 }
2082 if (length >= sizeof(u_int8_t)) {
2083 memcpy(&parsed_parameters->required_interface_type, value, sizeof(u_int8_t));
2084 if (parsed_parameters->required_interface_type) {
2085 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE;
2086 }
2087 }
2088 break;
2089 }
2090 case NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE: {
2091 if (num_prohibited_interface_types >= NECP_MAX_INTERFACE_PARAMETERS) {
2092 break;
2093 }
2094 if (length >= sizeof(u_int8_t)) {
2095 memcpy(&parsed_parameters->prohibited_interface_types[num_prohibited_interface_types], value, sizeof(u_int8_t));
2096 num_prohibited_interface_types++;
2097 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE;
2098 }
2099 break;
2100 }
2101 case NECP_CLIENT_PARAMETER_REQUIRE_AGENT: {
2102 if (num_required_agents >= NECP_MAX_AGENT_PARAMETERS) {
2103 break;
2104 }
2105 if (length >= sizeof(uuid_t)) {
2106 memcpy(&parsed_parameters->required_netagents[num_required_agents], value, sizeof(uuid_t));
2107 num_required_agents++;
2108 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT;
2109 }
2110 break;
2111 }
2112 case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT: {
2113 if (num_prohibited_agents >= NECP_MAX_AGENT_PARAMETERS) {
2114 break;
2115 }
2116 if (length >= sizeof(uuid_t)) {
2117 memcpy(&parsed_parameters->prohibited_netagents[num_prohibited_agents], value, sizeof(uuid_t));
2118 num_prohibited_agents++;
2119 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT;
2120 }
2121 break;
2122 }
2123 case NECP_CLIENT_PARAMETER_PREFER_AGENT: {
2124 if (num_preferred_agents >= NECP_MAX_AGENT_PARAMETERS) {
2125 break;
2126 }
2127 if (length >= sizeof(uuid_t)) {
2128 memcpy(&parsed_parameters->preferred_netagents[num_preferred_agents], value, sizeof(uuid_t));
2129 num_preferred_agents++;
2130 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT;
2131 }
2132 break;
2133 }
2134 case NECP_CLIENT_PARAMETER_AVOID_AGENT: {
2135 if (num_avoided_agents >= NECP_MAX_AGENT_PARAMETERS) {
2136 break;
2137 }
2138 if (length >= sizeof(uuid_t)) {
2139 memcpy(&parsed_parameters->avoided_netagents[num_avoided_agents], value, sizeof(uuid_t));
2140 num_avoided_agents++;
2141 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT;
2142 }
2143 break;
2144 }
2145 case NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE: {
2146 if (num_required_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2147 break;
2148 }
2149 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2150 memcpy(&parsed_parameters->required_netagent_types[num_required_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2151 num_required_agent_types++;
2152 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE;
2153 }
2154 break;
2155 }
2156 case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE: {
2157 if (num_prohibited_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2158 break;
2159 }
2160 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2161 memcpy(&parsed_parameters->prohibited_netagent_types[num_prohibited_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2162 num_prohibited_agent_types++;
2163 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE;
2164 }
2165 break;
2166 }
2167 case NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE: {
2168 if (num_preferred_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2169 break;
2170 }
2171 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2172 memcpy(&parsed_parameters->preferred_netagent_types[num_preferred_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2173 num_preferred_agent_types++;
2174 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE;
2175 }
2176 break;
2177 }
2178 case NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE: {
2179 if (num_avoided_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
2180 break;
2181 }
2182 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
2183 memcpy(&parsed_parameters->avoided_netagent_types[num_avoided_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
2184 num_avoided_agent_types++;
2185 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE;
2186 }
2187 break;
2188 }
2189 case NECP_CLIENT_PARAMETER_FLAGS: {
2190 if (length >= sizeof(u_int32_t)) {
2191 memcpy(&parsed_parameters->flags, value, sizeof(parsed_parameters->flags));
2192 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_FLAGS;
2193 }
2194 break;
2195 }
2196 case NECP_CLIENT_PARAMETER_IP_PROTOCOL: {
2197 if (length == sizeof(u_int16_t)) {
2198 u_int16_t large_ip_protocol = 0;
2199 memcpy(&large_ip_protocol, value, sizeof(large_ip_protocol));
2200 parsed_parameters->ip_protocol = (u_int8_t)large_ip_protocol;
2201 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL;
2202 } else if (length >= sizeof(parsed_parameters->ip_protocol)) {
2203 memcpy(&parsed_parameters->ip_protocol, value, sizeof(parsed_parameters->ip_protocol));
2204 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL;
2205 }
2206 break;
2207 }
2208 case NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL: {
2209 if (length >= sizeof(parsed_parameters->transport_protocol)) {
2210 memcpy(&parsed_parameters->transport_protocol, value, sizeof(parsed_parameters->transport_protocol));
2211 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL;
2212 }
2213 break;
2214 }
2215 case NECP_CLIENT_PARAMETER_PID: {
2216 if (length >= sizeof(parsed_parameters->effective_pid)) {
2217 memcpy(&parsed_parameters->effective_pid, value, sizeof(parsed_parameters->effective_pid));
2218 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID;
2219 }
2220 break;
2221 }
2222 case NECP_CLIENT_PARAMETER_DELEGATED_UPID: {
2223 if (length >= sizeof(parsed_parameters->delegated_upid)) {
2224 memcpy(&parsed_parameters->delegated_upid, value, sizeof(parsed_parameters->delegated_upid));
2225 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID;
2226 }
2227 break;
2228 }
2229 case NECP_CLIENT_PARAMETER_ETHERTYPE: {
2230 if (length >= sizeof(parsed_parameters->ethertype)) {
2231 memcpy(&parsed_parameters->ethertype, value, sizeof(parsed_parameters->ethertype));
2232 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_ETHERTYPE;
2233 }
2234 break;
2235 }
2236 case NECP_CLIENT_PARAMETER_APPLICATION: {
2237 if (length >= sizeof(parsed_parameters->effective_uuid)) {
2238 memcpy(&parsed_parameters->effective_uuid, value, sizeof(parsed_parameters->effective_uuid));
2239 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID;
2240 }
2241 break;
2242 }
2243 case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: {
2244 if (length >= sizeof(parsed_parameters->traffic_class)) {
2245 memcpy(&parsed_parameters->traffic_class, value, sizeof(parsed_parameters->traffic_class));
2246 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS;
2247 }
2248 break;
2249 }
2250 case NECP_CLIENT_PARAMETER_RESOLVER_TAG: {
2251 if (length > 0) {
2252 resolver_tag = (u_int8_t *)value;
2253 resolver_tag_length = length;
2254 }
2255 break;
2256 }
2257 case NECP_CLIENT_PARAMETER_DOMAIN: {
2258 if (length > 0) {
2259 client_hostname = (u_int8_t *)value;
2260 hostname_length = length;
2261 }
2262 break;
2263 }
2264 case NECP_CLIENT_PARAMETER_PARENT_ID: {
2265 if (length == sizeof(parent_id)) {
2266 uuid_copy(parent_id, value);
2267 }
2268 break;
2269 }
2270 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE: {
2271 if (length >= sizeof(parsed_parameters->local_address_preference)) {
2272 memcpy(&parsed_parameters->local_address_preference, value, sizeof(parsed_parameters->local_address_preference));
2273 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE;
2274 }
2275 break;
2276 }
2277 default: {
2278 break;
2279 }
2280 }
2281 }
2282 }
2283
2284 offset += sizeof(struct necp_tlv_header) + length;
2285 }
2286
2287 if (resolver_tag != NULL) {
2288 union necp_sockaddr_union remote_addr;
2289 memcpy(&remote_addr, &parsed_parameters->remote_addr, sizeof(remote_addr));
2290 remote_addr.sin.sin_port = 0;
2291 const bool validated = necp_validate_resolver_answer(parent_id,
2292 client_hostname, hostname_length,
2293 (u_int8_t *)&remote_addr, sizeof(remote_addr),
2294 resolver_tag, resolver_tag_length);
2295 if (!validated) {
2296 error = EAUTH;
2297 NECPLOG(LOG_ERR, "Failed to validate answer for hostname %s", client_hostname);
2298 }
2299 }
2300
2301 return error;
2302 }
2303
2304 static int
2305 necp_client_parse_result(u_int8_t *result,
2306 u_int32_t result_size,
2307 union necp_sockaddr_union *local_address,
2308 union necp_sockaddr_union *remote_address,
2309 void **flow_stats)
2310 {
2311 #pragma unused(flow_stats)
2312 int error = 0;
2313 size_t offset = 0;
2314
2315 while ((offset + sizeof(struct necp_tlv_header)) <= result_size) {
2316 u_int8_t type = necp_buffer_get_tlv_type(result, offset);
2317 u_int32_t length = necp_buffer_get_tlv_length(result, offset);
2318
2319 if (length > 0 && (offset + sizeof(struct necp_tlv_header) + length) <= result_size) {
2320 u_int8_t *value = necp_buffer_get_tlv_value(result, offset, NULL);
2321 if (value != NULL) {
2322 switch (type) {
2323 case NECP_CLIENT_RESULT_LOCAL_ENDPOINT: {
2324 if (length >= sizeof(struct necp_client_endpoint)) {
2325 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2326 if (local_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
2327 memcpy(local_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
2328 }
2329 }
2330 break;
2331 }
2332 case NECP_CLIENT_RESULT_REMOTE_ENDPOINT: {
2333 if (length >= sizeof(struct necp_client_endpoint)) {
2334 struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
2335 if (remote_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
2336 memcpy(remote_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
2337 }
2338 }
2339 break;
2340 }
2341 default: {
2342 break;
2343 }
2344 }
2345 }
2346 }
2347
2348 offset += sizeof(struct necp_tlv_header) + length;
2349 }
2350
2351 return error;
2352 }
2353
2354 static struct necp_client_flow_registration *
2355 necp_client_create_flow_registration(struct necp_fd_data *fd_data, struct necp_client *client)
2356 {
2357 NECP_FD_ASSERT_LOCKED(fd_data);
2358 NECP_CLIENT_ASSERT_LOCKED(client);
2359
2360 struct necp_client_flow_registration *new_registration = mcache_alloc(necp_flow_registration_cache, MCR_SLEEP);
2361 if (new_registration == NULL) {
2362 return NULL;
2363 }
2364
2365 memset(new_registration, 0, sizeof(*new_registration));
2366
2367 new_registration->last_interface_details = combine_interface_details(IFSCOPE_NONE, NSTAT_IFNET_IS_UNKNOWN_TYPE);
2368
2369 necp_generate_client_id(new_registration->registration_id, true);
2370 LIST_INIT(&new_registration->flow_list);
2371
2372 // Add registration to client list
2373 RB_INSERT(_necp_client_flow_tree, &client->flow_registrations, new_registration);
2374
2375 // Add registration to fd list
2376 RB_INSERT(_necp_fd_flow_tree, &fd_data->flows, new_registration);
2377
2378 // Add registration to global tree for lookup
2379 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
2380 RB_INSERT(_necp_client_flow_global_tree, &necp_client_flow_global_tree, new_registration);
2381 NECP_FLOW_TREE_UNLOCK();
2382
2383 new_registration->client = client;
2384
2385 // Start out assuming there is nothing to read from the flow
2386 new_registration->flow_result_read = true;
2387
2388 return new_registration;
2389 }
2390
2391 static void
2392 necp_client_add_socket_flow(struct necp_client_flow_registration *flow_registration,
2393 struct inpcb *inp)
2394 {
2395 struct necp_client_flow *new_flow = mcache_alloc(necp_flow_cache, MCR_SLEEP);
2396 if (new_flow == NULL) {
2397 NECPLOG0(LOG_ERR, "Failed to allocate socket flow");
2398 return;
2399 }
2400
2401 memset(new_flow, 0, sizeof(*new_flow));
2402
2403 new_flow->socket = TRUE;
2404 new_flow->u.socket_handle = inp;
2405 new_flow->u.cb = inp->necp_cb;
2406
2407 OSIncrementAtomic(&necp_socket_flow_count);
2408
2409 LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
2410 }
2411
2412 static int
2413 necp_client_register_socket_inner(pid_t pid, uuid_t client_id, struct inpcb *inp, bool is_listener)
2414 {
2415 int error = 0;
2416 struct necp_fd_data *client_fd = NULL;
2417 bool found_client = FALSE;
2418
2419 NECP_FD_LIST_LOCK_SHARED();
2420 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
2421 NECP_FD_LOCK(client_fd);
2422 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
2423 if (client != NULL) {
2424 if (!pid || client->proc_pid == pid) {
2425 if (is_listener) {
2426 found_client = TRUE;
2427 } else {
2428 // Find client flow and assign from socket
2429 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
2430 if (flow_registration != NULL) {
2431 // Found the right client and flow registration, add a new flow
2432 found_client = TRUE;
2433 necp_client_add_socket_flow(flow_registration, inp);
2434 } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
2435 // No flows yet on this client, add a new registration
2436 flow_registration = necp_client_create_flow_registration(client_fd, client);
2437 if (flow_registration == NULL) {
2438 error = ENOMEM;
2439 } else {
2440 // Add a new flow
2441 found_client = TRUE;
2442 necp_client_add_socket_flow(flow_registration, inp);
2443 }
2444 }
2445 }
2446 }
2447
2448 NECP_CLIENT_UNLOCK(client);
2449 }
2450 NECP_FD_UNLOCK(client_fd);
2451
2452 if (found_client) {
2453 break;
2454 }
2455 }
2456 NECP_FD_LIST_UNLOCK();
2457
2458 if (!found_client) {
2459 error = ENOENT;
2460 } else {
2461 // Count the sockets that have the NECP client UUID set
2462 struct socket *so = inp->inp_socket;
2463 if (!(so->so_flags1 & SOF1_HAS_NECP_CLIENT_UUID)) {
2464 so->so_flags1 |= SOF1_HAS_NECP_CLIENT_UUID;
2465 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_necp_clientuuid_total);
2466 }
2467 }
2468
2469 return error;
2470 }
2471
2472 int
2473 necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp)
2474 {
2475 return necp_client_register_socket_inner(pid, client_id, inp, false);
2476 }
2477
2478 int
2479 necp_client_register_socket_listener(pid_t pid, uuid_t client_id, struct inpcb *inp)
2480 {
2481 return necp_client_register_socket_inner(pid, client_id, inp, true);
2482 }
2483
2484
2485 static void
2486 necp_client_add_multipath_interface_flows(struct necp_client_flow_registration *flow_registration,
2487 struct necp_client *client,
2488 struct mppcb *mpp)
2489 {
2490 flow_registration->interface_handle = mpp;
2491 flow_registration->interface_cb = mpp->necp_cb;
2492
2493 proc_t proc = proc_find(client->proc_pid);
2494 if (proc == PROC_NULL) {
2495 return;
2496 }
2497
2498 // Traverse all interfaces and add a tracking flow if needed
2499 necp_flow_add_interface_flows(proc, client, flow_registration, true);
2500
2501 proc_rele(proc);
2502 proc = PROC_NULL;
2503 }
2504
2505 int
2506 necp_client_register_multipath_cb(pid_t pid, uuid_t client_id, struct mppcb *mpp)
2507 {
2508 int error = 0;
2509 struct necp_fd_data *client_fd = NULL;
2510 bool found_client = FALSE;
2511
2512 NECP_FD_LIST_LOCK_SHARED();
2513 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
2514 NECP_FD_LOCK(client_fd);
2515 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
2516 if (client != NULL) {
2517 if (!pid || client->proc_pid == pid) {
2518 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
2519 if (flow_registration != NULL) {
2520 // Found the right client and flow registration, add a new flow
2521 found_client = TRUE;
2522 necp_client_add_multipath_interface_flows(flow_registration, client, mpp);
2523 } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
2524 // No flows yet on this client, add a new registration
2525 flow_registration = necp_client_create_flow_registration(client_fd, client);
2526 if (flow_registration == NULL) {
2527 error = ENOMEM;
2528 } else {
2529 // Add a new flow
2530 found_client = TRUE;
2531 necp_client_add_multipath_interface_flows(flow_registration, client, mpp);
2532 }
2533 }
2534 }
2535
2536 NECP_CLIENT_UNLOCK(client);
2537 }
2538 NECP_FD_UNLOCK(client_fd);
2539
2540 if (found_client) {
2541 break;
2542 }
2543 }
2544 NECP_FD_LIST_UNLOCK();
2545
2546 if (!found_client && error == 0) {
2547 error = ENOENT;
2548 }
2549
2550 return error;
2551 }
2552
2553 #define NETAGENT_DOMAIN_RADIO_MANAGER "WirelessRadioManager"
2554 #define NETAGENT_TYPE_RADIO_MANAGER "WirelessRadioManager:BB Manager"
2555
2556 static int
2557 necp_client_lookup_bb_radio_manager(struct necp_client *client,
2558 uuid_t netagent_uuid)
2559 {
2560 char netagent_domain[NETAGENT_DOMAINSIZE];
2561 char netagent_type[NETAGENT_TYPESIZE];
2562 struct necp_aggregate_result result;
2563 proc_t proc;
2564 int error;
2565
2566 proc = proc_find(client->proc_pid);
2567 if (proc == PROC_NULL) {
2568 return ESRCH;
2569 }
2570
2571 error = necp_application_find_policy_match_internal(proc, client->parameters, (u_int32_t)client->parameters_length,
2572 &result, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL, true, true, NULL);
2573
2574 proc_rele(proc);
2575 proc = PROC_NULL;
2576
2577 if (error) {
2578 return error;
2579 }
2580
2581 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
2582 if (uuid_is_null(result.netagents[i])) {
2583 // Passed end of valid agents
2584 break;
2585 }
2586
2587 memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
2588 memset(&netagent_type, 0, NETAGENT_TYPESIZE);
2589 if (netagent_get_agent_domain_and_type(result.netagents[i], netagent_domain, netagent_type) == FALSE) {
2590 continue;
2591 }
2592
2593 if (strncmp(netagent_domain, NETAGENT_DOMAIN_RADIO_MANAGER, NETAGENT_DOMAINSIZE) != 0) {
2594 continue;
2595 }
2596
2597 if (strncmp(netagent_type, NETAGENT_TYPE_RADIO_MANAGER, NETAGENT_TYPESIZE) != 0) {
2598 continue;
2599 }
2600
2601 uuid_copy(netagent_uuid, result.netagents[i]);
2602
2603 break;
2604 }
2605
2606 return 0;
2607 }
2608
2609 static int
2610 necp_client_assert_bb_radio_manager_common(struct necp_client *client, bool assert)
2611 {
2612 uuid_t netagent_uuid;
2613 uint8_t assert_type;
2614 int error;
2615
2616 error = necp_client_lookup_bb_radio_manager(client, netagent_uuid);
2617 if (error) {
2618 NECPLOG0(LOG_ERR, "BB radio manager agent not found");
2619 return error;
2620 }
2621
2622 // Before unasserting, verify that the assertion was already taken
2623 if (assert == FALSE) {
2624 assert_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
2625
2626 if (!necp_client_remove_assertion(client, netagent_uuid)) {
2627 return EINVAL;
2628 }
2629 } else {
2630 assert_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT;
2631 }
2632
2633 error = netagent_client_message(netagent_uuid, client->client_id, client->proc_pid, client->agent_handle, assert_type);
2634 if (error) {
2635 NECPLOG0(LOG_ERR, "netagent_client_message failed");
2636 return error;
2637 }
2638
2639 // Only save the assertion if the action succeeded
2640 if (assert == TRUE) {
2641 necp_client_add_assertion(client, netagent_uuid);
2642 }
2643
2644 return 0;
2645 }
2646
2647 int
2648 necp_client_assert_bb_radio_manager(uuid_t client_id, bool assert)
2649 {
2650 struct necp_client *client;
2651 int error = 0;
2652
2653 NECP_CLIENT_TREE_LOCK_SHARED();
2654
2655 client = necp_find_client_and_lock(client_id);
2656
2657 if (client) {
2658 // Found the right client!
2659 error = necp_client_assert_bb_radio_manager_common(client, assert);
2660
2661 NECP_CLIENT_UNLOCK(client);
2662 } else {
2663 NECPLOG0(LOG_ERR, "Couldn't find client");
2664 error = ENOENT;
2665 }
2666
2667 NECP_CLIENT_TREE_UNLOCK();
2668
2669 return error;
2670 }
2671
2672 static int
2673 necp_client_unregister_socket_flow(uuid_t client_id, void *handle)
2674 {
2675 int error = 0;
2676 struct necp_fd_data *client_fd = NULL;
2677 bool found_client = FALSE;
2678 bool client_updated = FALSE;
2679
2680 NECP_FD_LIST_LOCK_SHARED();
2681 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
2682 NECP_FD_LOCK(client_fd);
2683
2684 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
2685 if (client != NULL) {
2686 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
2687 if (flow_registration != NULL) {
2688 // Found the right client and flow!
2689 found_client = TRUE;
2690
2691 // Remove flow assignment
2692 struct necp_client_flow *search_flow = NULL;
2693 struct necp_client_flow *temp_flow = NULL;
2694 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
2695 if (search_flow->socket && search_flow->u.socket_handle == handle) {
2696 if (search_flow->assigned_results != NULL) {
2697 FREE(search_flow->assigned_results, M_NETAGENT);
2698 search_flow->assigned_results = NULL;
2699 }
2700 client_updated = TRUE;
2701 flow_registration->flow_result_read = FALSE;
2702 LIST_REMOVE(search_flow, flow_chain);
2703 OSDecrementAtomic(&necp_socket_flow_count);
2704 mcache_free(necp_flow_cache, search_flow);
2705 }
2706 }
2707 }
2708
2709 NECP_CLIENT_UNLOCK(client);
2710 }
2711
2712 if (client_updated) {
2713 necp_fd_notify(client_fd, true);
2714 }
2715 NECP_FD_UNLOCK(client_fd);
2716
2717 if (found_client) {
2718 break;
2719 }
2720 }
2721 NECP_FD_LIST_UNLOCK();
2722
2723 if (!found_client) {
2724 error = ENOENT;
2725 }
2726
2727 return error;
2728 }
2729
2730 static int
2731 necp_client_unregister_multipath_cb(uuid_t client_id, void *handle)
2732 {
2733 int error = 0;
2734 bool found_client = FALSE;
2735
2736 NECP_CLIENT_TREE_LOCK_SHARED();
2737
2738 struct necp_client *client = necp_find_client_and_lock(client_id);
2739 if (client != NULL) {
2740 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
2741 if (flow_registration != NULL) {
2742 // Found the right client and flow!
2743 found_client = TRUE;
2744
2745 // Remove flow assignment
2746 struct necp_client_flow *search_flow = NULL;
2747 struct necp_client_flow *temp_flow = NULL;
2748 LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
2749 if (!search_flow->socket && !search_flow->nexus &&
2750 search_flow->u.socket_handle == handle) {
2751 search_flow->u.socket_handle = NULL;
2752 search_flow->u.cb = NULL;
2753 }
2754 }
2755
2756 flow_registration->interface_handle = NULL;
2757 flow_registration->interface_cb = NULL;
2758 }
2759
2760 NECP_CLIENT_UNLOCK(client);
2761 }
2762
2763 NECP_CLIENT_TREE_UNLOCK();
2764
2765 if (!found_client) {
2766 error = ENOENT;
2767 }
2768
2769 return error;
2770 }
2771
2772 int
2773 necp_client_assign_from_socket(pid_t pid, uuid_t client_id, struct inpcb *inp)
2774 {
2775 int error = 0;
2776 struct necp_fd_data *client_fd = NULL;
2777 bool found_client = FALSE;
2778 bool client_updated = FALSE;
2779
2780 NECP_FD_LIST_LOCK_SHARED();
2781 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
2782 if (pid && client_fd->proc_pid != pid) {
2783 continue;
2784 }
2785
2786 proc_t proc = proc_find(client_fd->proc_pid);
2787 if (proc == PROC_NULL) {
2788 continue;
2789 }
2790
2791 NECP_FD_LOCK(client_fd);
2792
2793 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
2794 if (client != NULL) {
2795 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
2796 if (flow_registration == NULL && RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
2797 // No flows yet on this client, add a new registration
2798 flow_registration = necp_client_create_flow_registration(client_fd, client);
2799 if (flow_registration == NULL) {
2800 error = ENOMEM;
2801 }
2802 }
2803 if (flow_registration != NULL) {
2804 // Found the right client and flow!
2805 found_client = TRUE;
2806
2807 struct necp_client_flow *flow = NULL;
2808 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
2809 if (flow->socket && flow->u.socket_handle == inp) {
2810 // Release prior results and route
2811 if (flow->assigned_results != NULL) {
2812 FREE(flow->assigned_results, M_NETAGENT);
2813 flow->assigned_results = NULL;
2814 }
2815
2816 ifnet_t ifp = NULL;
2817 if ((inp->inp_flags & INP_BOUND_IF) && inp->inp_boundifp) {
2818 ifp = inp->inp_boundifp;
2819 } else {
2820 ifp = inp->inp_last_outifp;
2821 }
2822
2823 if (ifp != NULL) {
2824 flow->interface_index = ifp->if_index;
2825 } else {
2826 flow->interface_index = IFSCOPE_NONE;
2827 }
2828
2829 if (inp->inp_vflag & INP_IPV4) {
2830 flow->local_addr.sin.sin_family = AF_INET;
2831 flow->local_addr.sin.sin_len = sizeof(struct sockaddr_in);
2832 flow->local_addr.sin.sin_port = inp->inp_lport;
2833 memcpy(&flow->local_addr.sin.sin_addr, &inp->inp_laddr, sizeof(struct in_addr));
2834
2835 flow->remote_addr.sin.sin_family = AF_INET;
2836 flow->remote_addr.sin.sin_len = sizeof(struct sockaddr_in);
2837 flow->remote_addr.sin.sin_port = inp->inp_fport;
2838 memcpy(&flow->remote_addr.sin.sin_addr, &inp->inp_faddr, sizeof(struct in_addr));
2839 } else if (inp->inp_vflag & INP_IPV6) {
2840 in6_ip6_to_sockaddr(&inp->in6p_laddr, inp->inp_lport, &flow->local_addr.sin6, sizeof(flow->local_addr));
2841 in6_ip6_to_sockaddr(&inp->in6p_faddr, inp->inp_fport, &flow->remote_addr.sin6, sizeof(flow->remote_addr));
2842 }
2843
2844 flow->viable = necp_client_flow_is_viable(proc, client, flow);
2845
2846 uuid_t empty_uuid;
2847 uuid_clear(empty_uuid);
2848 flow->assigned = TRUE;
2849 flow->assigned_results = necp_create_nexus_assign_message(empty_uuid, 0, NULL, 0,
2850 (struct necp_client_endpoint *)&flow->local_addr,
2851 (struct necp_client_endpoint *)&flow->remote_addr,
2852 NULL, 0, NULL, &flow->assigned_results_length);
2853 flow_registration->flow_result_read = FALSE;
2854 client_updated = TRUE;
2855 break;
2856 }
2857 }
2858 }
2859
2860 NECP_CLIENT_UNLOCK(client);
2861 }
2862 if (client_updated) {
2863 necp_fd_notify(client_fd, true);
2864 }
2865 NECP_FD_UNLOCK(client_fd);
2866
2867 proc_rele(proc);
2868 proc = PROC_NULL;
2869
2870 if (found_client) {
2871 break;
2872 }
2873 }
2874 NECP_FD_LIST_UNLOCK();
2875
2876 if (error == 0) {
2877 if (!found_client) {
2878 error = ENOENT;
2879 } else if (!client_updated) {
2880 error = EINVAL;
2881 }
2882 }
2883
2884 return error;
2885 }
2886
2887 bool
2888 necp_socket_is_allowed_to_recv_on_interface(struct inpcb *inp, ifnet_t interface)
2889 {
2890 if (interface == NULL ||
2891 inp == NULL ||
2892 !(inp->inp_flags2 & INP2_EXTERNAL_PORT) ||
2893 uuid_is_null(inp->necp_client_uuid)) {
2894 // If there's no interface or client ID to check,
2895 // or if this is not a listener, pass.
2896 // Outbound connections will have already been
2897 // validated for policy.
2898 return TRUE;
2899 }
2900
2901 // Only filter out listener sockets (no remote address specified)
2902 if ((inp->inp_vflag & INP_IPV4) &&
2903 inp->inp_faddr.s_addr != INADDR_ANY) {
2904 return TRUE;
2905 }
2906 if ((inp->inp_vflag & INP_IPV6) &&
2907 !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
2908 return TRUE;
2909 }
2910
2911 bool allowed = TRUE;
2912
2913 NECP_CLIENT_TREE_LOCK_SHARED();
2914
2915 struct necp_client *client = necp_find_client_and_lock(inp->necp_client_uuid);
2916 if (client != NULL) {
2917 struct necp_client_parsed_parameters *parsed_parameters = NULL;
2918
2919 MALLOC(parsed_parameters, struct necp_client_parsed_parameters *, sizeof(*parsed_parameters), M_NECP, (M_WAITOK | M_ZERO));
2920 if (parsed_parameters != NULL) {
2921 int error = necp_client_parse_parameters(client->parameters, (u_int32_t)client->parameters_length, parsed_parameters);
2922 if (error == 0) {
2923 if (!necp_ifnet_matches_parameters(interface, parsed_parameters, 0, NULL, true, false)) {
2924 allowed = FALSE;
2925 }
2926 }
2927 FREE(parsed_parameters, M_NECP);
2928 }
2929
2930 NECP_CLIENT_UNLOCK(client);
2931 }
2932
2933 NECP_CLIENT_TREE_UNLOCK();
2934
2935 return allowed;
2936 }
2937
2938 int
2939 necp_update_flow_protoctl_event(uuid_t netagent_uuid, uuid_t client_id,
2940 uint32_t protoctl_event_code, uint32_t protoctl_event_val,
2941 uint32_t protoctl_event_tcp_seq_number)
2942 {
2943 int error = 0;
2944 struct necp_fd_data *client_fd = NULL;
2945 bool found_client = FALSE;
2946 bool client_updated = FALSE;
2947
2948 NECP_FD_LIST_LOCK_SHARED();
2949 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
2950 proc_t proc = proc_find(client_fd->proc_pid);
2951 if (proc == PROC_NULL) {
2952 continue;
2953 }
2954
2955 NECP_FD_LOCK(client_fd);
2956
2957 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
2958 if (client != NULL) {
2959 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
2960 if (flow_registration != NULL) {
2961 // Found the right client and flow!
2962 found_client = TRUE;
2963
2964 struct necp_client_flow *flow = NULL;
2965 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
2966 // Verify that the client nexus agent matches
2967 if ((flow->nexus && uuid_compare(flow->u.nexus_agent, netagent_uuid) == 0) ||
2968 flow->socket) {
2969 flow->has_protoctl_event = TRUE;
2970 flow->protoctl_event.protoctl_event_code = protoctl_event_code;
2971 flow->protoctl_event.protoctl_event_val = protoctl_event_val;
2972 flow->protoctl_event.protoctl_event_tcp_seq_num = protoctl_event_tcp_seq_number;
2973 flow_registration->flow_result_read = FALSE;
2974 client_updated = TRUE;
2975 break;
2976 }
2977 }
2978 }
2979
2980 NECP_CLIENT_UNLOCK(client);
2981 }
2982
2983 if (client_updated) {
2984 necp_fd_notify(client_fd, true);
2985 }
2986
2987 NECP_FD_UNLOCK(client_fd);
2988 proc_rele(proc);
2989 proc = PROC_NULL;
2990
2991 if (found_client) {
2992 break;
2993 }
2994 }
2995 NECP_FD_LIST_UNLOCK();
2996
2997 if (!found_client) {
2998 error = ENOENT;
2999 } else if (!client_updated) {
3000 error = EINVAL;
3001 }
3002 return error;
3003 }
3004
3005 static bool
3006 necp_assign_client_result_locked(struct proc *proc,
3007 struct necp_fd_data *client_fd,
3008 struct necp_client *client,
3009 struct necp_client_flow_registration *flow_registration,
3010 uuid_t netagent_uuid,
3011 u_int8_t *assigned_results,
3012 size_t assigned_results_length,
3013 bool notify_fd)
3014 {
3015 bool client_updated = FALSE;
3016
3017 NECP_FD_ASSERT_LOCKED(client_fd);
3018 NECP_CLIENT_ASSERT_LOCKED(client);
3019
3020 struct necp_client_flow *flow = NULL;
3021 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
3022 // Verify that the client nexus agent matches
3023 if (flow->nexus &&
3024 uuid_compare(flow->u.nexus_agent, netagent_uuid) == 0) {
3025 // Release prior results and route
3026 if (flow->assigned_results != NULL) {
3027 FREE(flow->assigned_results, M_NETAGENT);
3028 flow->assigned_results = NULL;
3029 }
3030
3031 void *nexus_stats = NULL;
3032 if (assigned_results != NULL && assigned_results_length > 0) {
3033 int error = necp_client_parse_result(assigned_results, (u_int32_t)assigned_results_length,
3034 &flow->local_addr, &flow->remote_addr, &nexus_stats);
3035 VERIFY(error == 0);
3036 }
3037
3038 flow->viable = necp_client_flow_is_viable(proc, client, flow);
3039
3040 flow->assigned = TRUE;
3041 flow->assigned_results = assigned_results;
3042 flow->assigned_results_length = assigned_results_length;
3043 flow_registration->flow_result_read = FALSE;
3044 client_updated = TRUE;
3045 break;
3046 }
3047 }
3048
3049 if (client_updated && notify_fd) {
3050 necp_fd_notify(client_fd, true);
3051 }
3052
3053 // if not updated, client must free assigned_results
3054 return client_updated;
3055 }
3056
3057 int
3058 necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id,
3059 u_int8_t *assigned_results, size_t assigned_results_length)
3060 {
3061 int error = 0;
3062 struct necp_fd_data *client_fd = NULL;
3063 bool found_client = FALSE;
3064 bool client_updated = FALSE;
3065
3066 NECP_FD_LIST_LOCK_SHARED();
3067
3068 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3069 proc_t proc = proc_find(client_fd->proc_pid);
3070 if (proc == PROC_NULL) {
3071 continue;
3072 }
3073
3074 NECP_FD_LOCK(client_fd);
3075 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
3076 if (client != NULL) {
3077 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
3078 if (flow_registration != NULL) {
3079 // Found the right client and flow!
3080 found_client = TRUE;
3081 if (necp_assign_client_result_locked(proc, client_fd, client, flow_registration, netagent_uuid,
3082 assigned_results, assigned_results_length, true)) {
3083 client_updated = TRUE;
3084 }
3085 }
3086
3087 NECP_CLIENT_UNLOCK(client);
3088 }
3089 NECP_FD_UNLOCK(client_fd);
3090
3091 proc_rele(proc);
3092 proc = PROC_NULL;
3093
3094 if (found_client) {
3095 break;
3096 }
3097 }
3098
3099 NECP_FD_LIST_UNLOCK();
3100
3101 // upon error, client must free assigned_results
3102 if (!found_client) {
3103 error = ENOENT;
3104 } else if (!client_updated) {
3105 error = EINVAL;
3106 }
3107
3108 return error;
3109 }
3110
3111 /// Client updating
3112
3113 static bool
3114 necp_update_parsed_parameters(struct necp_client_parsed_parameters *parsed_parameters,
3115 struct necp_aggregate_result *result)
3116 {
3117 if (parsed_parameters == NULL ||
3118 result == NULL) {
3119 return false;
3120 }
3121
3122 bool updated = false;
3123 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
3124 if (uuid_is_null(result->netagents[i])) {
3125 // Passed end of valid agents
3126 break;
3127 }
3128
3129 if (!(result->netagent_use_flags[i] & NECP_AGENT_USE_FLAG_SCOPE)) {
3130 // Not a scoped agent, ignore
3131 continue;
3132 }
3133
3134 // This is a scoped agent. Add it to the required agents.
3135 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
3136 // Already some required agents, add this at the end
3137 for (int j = 0; j < NECP_MAX_AGENT_PARAMETERS; j++) {
3138 if (uuid_compare(parsed_parameters->required_netagents[j], result->netagents[i]) == 0) {
3139 // Already required, break
3140 break;
3141 }
3142 if (uuid_is_null(parsed_parameters->required_netagents[j])) {
3143 // Add here
3144 memcpy(&parsed_parameters->required_netagents[j], result->netagents[i], sizeof(uuid_t));
3145 updated = true;
3146 break;
3147 }
3148 }
3149 } else {
3150 // No required agents yet, add this one
3151 parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT;
3152 memcpy(&parsed_parameters->required_netagents[0], result->netagents[i], sizeof(uuid_t));
3153 updated = true;
3154 }
3155
3156 // Remove requirements for agents of the same type
3157 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
3158 char remove_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
3159 char remove_agent_type[NETAGENT_TYPESIZE] = { 0 };
3160 if (netagent_get_agent_domain_and_type(result->netagents[i], remove_agent_domain, remove_agent_type)) {
3161 for (int j = 0; j < NECP_MAX_AGENT_PARAMETERS; j++) {
3162 if (strlen(parsed_parameters->required_netagent_types[j].netagent_domain) == 0 &&
3163 strlen(parsed_parameters->required_netagent_types[j].netagent_type) == 0) {
3164 break;
3165 }
3166
3167 if (strncmp(parsed_parameters->required_netagent_types[j].netagent_domain, remove_agent_domain, NETAGENT_DOMAINSIZE) == 0 &&
3168 strncmp(parsed_parameters->required_netagent_types[j].netagent_type, remove_agent_type, NETAGENT_TYPESIZE) == 0) {
3169 updated = true;
3170
3171 if (j == NECP_MAX_AGENT_PARAMETERS - 1) {
3172 // Last field, just clear and break
3173 memset(&parsed_parameters->required_netagent_types[NECP_MAX_AGENT_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
3174 break;
3175 } else {
3176 // Move the parameters down, clear the last entry
3177 memmove(&parsed_parameters->required_netagent_types[j],
3178 &parsed_parameters->required_netagent_types[j + 1],
3179 sizeof(struct necp_client_parameter_netagent_type) * (NECP_MAX_AGENT_PARAMETERS - (j + 1)));
3180 memset(&parsed_parameters->required_netagent_types[NECP_MAX_AGENT_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
3181 // Continue, don't increment but look at the new shifted item instead
3182 continue;
3183 }
3184 }
3185
3186 // Increment j to look at the next agent type parameter
3187 j++;
3188 }
3189 }
3190 }
3191 }
3192
3193 if (updated &&
3194 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
3195 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) {
3196 // A required interface index was added after the fact. Clear it.
3197 parsed_parameters->required_interface_index = IFSCOPE_NONE;
3198 }
3199
3200
3201 return updated;
3202 }
3203
3204 static inline bool
3205 necp_agent_types_match(const char *agent_domain1, const char *agent_type1,
3206 const char *agent_domain2, const char *agent_type2)
3207 {
3208 return (strlen(agent_domain1) == 0 ||
3209 strncmp(agent_domain2, agent_domain1, NETAGENT_DOMAINSIZE) == 0) &&
3210 (strlen(agent_type1) == 0 ||
3211 strncmp(agent_type2, agent_type1, NETAGENT_TYPESIZE) == 0);
3212 }
3213
3214 static inline bool
3215 necp_calculate_client_result(proc_t proc,
3216 struct necp_client *client,
3217 struct necp_client_parsed_parameters *parsed_parameters,
3218 struct necp_aggregate_result *result,
3219 u_int32_t *flags,
3220 u_int32_t *reason,
3221 struct necp_client_endpoint *v4_gateway,
3222 struct necp_client_endpoint *v6_gateway,
3223 uuid_t *override_euuid)
3224 {
3225 struct rtentry *route = NULL;
3226
3227 // Check parameters to find best interface
3228 bool validate_agents = false;
3229 u_int matching_if_index = 0;
3230 if (necp_find_matching_interface_index(parsed_parameters, &matching_if_index, &validate_agents)) {
3231 if (matching_if_index != 0) {
3232 parsed_parameters->required_interface_index = matching_if_index;
3233 }
3234 // Interface found or not needed, match policy.
3235 memset(result, 0, sizeof(*result));
3236 int error = necp_application_find_policy_match_internal(proc, client->parameters,
3237 (u_int32_t)client->parameters_length,
3238 result, flags, reason, matching_if_index,
3239 NULL, NULL,
3240 v4_gateway, v6_gateway,
3241 &route, false, true,
3242 override_euuid);
3243 if (error != 0) {
3244 if (route != NULL) {
3245 rtfree(route);
3246 }
3247 return FALSE;
3248 }
3249
3250 if (validate_agents) {
3251 bool requirement_failed = FALSE;
3252 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
3253 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
3254 if (uuid_is_null(parsed_parameters->required_netagents[i])) {
3255 break;
3256 }
3257
3258 bool requirement_found = FALSE;
3259 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
3260 if (uuid_is_null(result->netagents[j])) {
3261 break;
3262 }
3263
3264 if (uuid_compare(parsed_parameters->required_netagents[i], result->netagents[j]) == 0) {
3265 requirement_found = TRUE;
3266 break;
3267 }
3268 }
3269
3270 if (!requirement_found) {
3271 requirement_failed = TRUE;
3272 break;
3273 }
3274 }
3275 }
3276
3277 if (!requirement_failed && parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
3278 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
3279 if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 &&
3280 strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
3281 break;
3282 }
3283
3284 bool requirement_found = FALSE;
3285 for (int j = 0; j < NECP_MAX_NETAGENTS; j++) {
3286 if (uuid_is_null(result->netagents[j])) {
3287 break;
3288 }
3289
3290 char policy_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
3291 char policy_agent_type[NETAGENT_TYPESIZE] = { 0 };
3292
3293 if (netagent_get_agent_domain_and_type(result->netagents[j], policy_agent_domain, policy_agent_type)) {
3294 if (necp_agent_types_match(parsed_parameters->required_netagent_types[i].netagent_domain,
3295 parsed_parameters->required_netagent_types[i].netagent_type,
3296 policy_agent_domain, policy_agent_type)) {
3297 requirement_found = TRUE;
3298 break;
3299 }
3300 }
3301 }
3302
3303 if (!requirement_found) {
3304 requirement_failed = TRUE;
3305 break;
3306 }
3307 }
3308 }
3309
3310 if (requirement_failed) {
3311 // Agent requirement failed. Clear out the whole result, make everything fail.
3312 memset(result, 0, sizeof(*result));
3313 if (route != NULL) {
3314 rtfree(route);
3315 }
3316 return TRUE;
3317 }
3318 }
3319
3320 // Reset current route
3321 NECP_CLIENT_ROUTE_LOCK(client);
3322 if (client->current_route != NULL) {
3323 rtfree(client->current_route);
3324 }
3325 client->current_route = route;
3326 NECP_CLIENT_ROUTE_UNLOCK(client);
3327 } else {
3328 // Interface not found. Clear out the whole result, make everything fail.
3329 memset(result, 0, sizeof(*result));
3330 }
3331
3332 return TRUE;
3333 }
3334
3335 #define NECP_PARSED_PARAMETERS_REQUIRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF | \
3336 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
3337 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
3338 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE)
3339
3340 static bool
3341 necp_update_client_result(proc_t proc,
3342 struct necp_fd_data *client_fd,
3343 struct necp_client *client,
3344 struct _necp_flow_defunct_list *defunct_list)
3345 {
3346 struct necp_client_result_netagent netagent;
3347 struct necp_aggregate_result result;
3348 struct necp_client_parsed_parameters *parsed_parameters = NULL;
3349 u_int32_t flags = 0;
3350 u_int32_t reason = 0;
3351
3352 NECP_CLIENT_ASSERT_LOCKED(client);
3353
3354 MALLOC(parsed_parameters, struct necp_client_parsed_parameters *, sizeof(*parsed_parameters), M_NECP, (M_WAITOK | M_ZERO));
3355 if (parsed_parameters == NULL) {
3356 NECPLOG0(LOG_ERR, "Failed to allocate parsed parameters");
3357 return FALSE;
3358 }
3359
3360 // Nexus flows will be brought back if they are still valid
3361 necp_client_mark_all_nonsocket_flows_as_invalid(client);
3362
3363 int error = necp_client_parse_parameters(client->parameters, (u_int32_t)client->parameters_length, parsed_parameters);
3364 if (error != 0) {
3365 FREE(parsed_parameters, M_NECP);
3366 return FALSE;
3367 }
3368
3369 // Update saved IP protocol
3370 client->ip_protocol = parsed_parameters->ip_protocol;
3371
3372 // Calculate the policy result
3373 struct necp_client_endpoint v4_gateway = {};
3374 struct necp_client_endpoint v6_gateway = {};
3375 uuid_t override_euuid;
3376 uuid_clear(override_euuid);
3377 if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags, &reason, &v4_gateway, &v6_gateway, &override_euuid)) {
3378 FREE(parsed_parameters, M_NECP);
3379 return FALSE;
3380 }
3381
3382 if (necp_update_parsed_parameters(parsed_parameters, &result)) {
3383 // Changed the parameters based on result, try again (only once)
3384 if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags, &reason, &v4_gateway, &v6_gateway, &override_euuid)) {
3385 FREE(parsed_parameters, M_NECP);
3386 return FALSE;
3387 }
3388 }
3389
3390 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
3391 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
3392 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) {
3393 // Listener should not apply required interface index if
3394 parsed_parameters->required_interface_index = IFSCOPE_NONE;
3395 }
3396
3397 // Save the last policy id on the client
3398 client->policy_id = result.policy_id;
3399 uuid_copy(client->override_euuid, override_euuid);
3400
3401 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_MULTIPATH) ||
3402 (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) ||
3403 ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
3404 result.routing_result != NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED)) {
3405 client->allow_multiple_flows = TRUE;
3406 } else {
3407 client->allow_multiple_flows = FALSE;
3408 }
3409
3410 // If the original request was scoped, and the policy result matches, make sure the result is scoped
3411 if ((result.routing_result == NECP_KERNEL_POLICY_RESULT_NONE ||
3412 result.routing_result == NECP_KERNEL_POLICY_RESULT_PASS) &&
3413 result.routed_interface_index != IFSCOPE_NONE &&
3414 parsed_parameters->required_interface_index == result.routed_interface_index) {
3415 result.routing_result = NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED;
3416 result.routing_result_parameter.scoped_interface_index = result.routed_interface_index;
3417 }
3418
3419 if (defunct_list != NULL &&
3420 result.routing_result == NECP_KERNEL_POLICY_RESULT_DROP) {
3421 // If we are forced to drop the client, defunct it if it has flows
3422 necp_defunct_client_for_policy(client, defunct_list);
3423 }
3424
3425 // Recalculate flags
3426 if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
3427 // Listeners are valid as long as they aren't dropped
3428 if (result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP) {
3429 flags |= NECP_CLIENT_RESULT_FLAG_SATISFIED;
3430 }
3431 } else if (result.routed_interface_index != 0) {
3432 // Clients without flows determine viability based on having some routable interface
3433 flags |= NECP_CLIENT_RESULT_FLAG_SATISFIED;
3434 }
3435
3436 bool updated = FALSE;
3437 u_int8_t *cursor = client->result;
3438 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FLAGS, sizeof(flags), &flags, &updated, client->result, sizeof(client->result));
3439 if (reason != 0) {
3440 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_REASON, sizeof(reason), &reason, &updated, client->result, sizeof(client->result));
3441 }
3442 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_CLIENT_ID, sizeof(uuid_t), client->client_id, &updated,
3443 client->result, sizeof(client->result));
3444 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT, sizeof(result.routing_result), &result.routing_result, &updated,
3445 client->result, sizeof(client->result));
3446 if (result.routing_result_parameter.tunnel_interface_index != 0) {
3447 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER,
3448 sizeof(result.routing_result_parameter), &result.routing_result_parameter, &updated,
3449 client->result, sizeof(client->result));
3450 }
3451 if (result.filter_control_unit != 0) {
3452 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT,
3453 sizeof(result.filter_control_unit), &result.filter_control_unit, &updated,
3454 client->result, sizeof(client->result));
3455 }
3456 if (result.flow_divert_aggregate_unit != 0) {
3457 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FLOW_DIVERT_AGGREGATE_UNIT,
3458 sizeof(result.flow_divert_aggregate_unit), &result.flow_divert_aggregate_unit, &updated,
3459 client->result, sizeof(client->result));
3460 }
3461 if (result.routed_interface_index != 0) {
3462 u_int routed_interface_index = result.routed_interface_index;
3463 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
3464 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_REQUIRED_FIELDS) &&
3465 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
3466 parsed_parameters->required_interface_index != result.routed_interface_index) {
3467 routed_interface_index = parsed_parameters->required_interface_index;
3468 }
3469
3470 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_INDEX,
3471 sizeof(routed_interface_index), &routed_interface_index, &updated,
3472 client->result, sizeof(client->result));
3473 }
3474 if (client_fd && client_fd->flags & NECP_OPEN_FLAG_BACKGROUND) {
3475 u_int32_t effective_traffic_class = SO_TC_BK_SYS;
3476 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS,
3477 sizeof(effective_traffic_class), &effective_traffic_class, &updated,
3478 client->result, sizeof(client->result));
3479 }
3480
3481 if (client_fd->background) {
3482 bool has_assigned_flow = FALSE;
3483 struct necp_client_flow_registration *flow_registration = NULL;
3484 struct necp_client_flow *search_flow = NULL;
3485 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
3486 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
3487 if (search_flow->assigned) {
3488 has_assigned_flow = TRUE;
3489 break;
3490 }
3491 }
3492 }
3493
3494 if (has_assigned_flow) {
3495 u_int32_t background = client_fd->background;
3496 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG,
3497 sizeof(background), &background, &updated,
3498 client->result, sizeof(client->result));
3499 }
3500 }
3501
3502 bool write_v4_gateway = !necp_client_endpoint_is_unspecified(&v4_gateway);
3503 bool write_v6_gateway = !necp_client_endpoint_is_unspecified(&v6_gateway);
3504
3505 NECP_CLIENT_ROUTE_LOCK(client);
3506 if (client->current_route != NULL) {
3507 const u_int32_t route_mtu = get_maxmtu(client->current_route);
3508 if (route_mtu != 0) {
3509 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_MTU,
3510 sizeof(route_mtu), &route_mtu, &updated,
3511 client->result, sizeof(client->result));
3512 }
3513 bool has_remote_addr = parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
3514 if (has_remote_addr && client->current_route->rt_gateway != NULL) {
3515 if (client->current_route->rt_gateway->sa_family == AF_INET) {
3516 write_v6_gateway = false;
3517 } else if (client->current_route->rt_gateway->sa_family == AF_INET6) {
3518 write_v4_gateway = false;
3519 }
3520 }
3521 }
3522 NECP_CLIENT_ROUTE_UNLOCK(client);
3523
3524 if (write_v4_gateway) {
3525 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_GATEWAY,
3526 sizeof(struct necp_client_endpoint), &v4_gateway, &updated,
3527 client->result, sizeof(client->result));
3528 }
3529
3530 if (write_v6_gateway) {
3531 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_GATEWAY,
3532 sizeof(struct necp_client_endpoint), &v6_gateway, &updated,
3533 client->result, sizeof(client->result));
3534 }
3535
3536 for (int i = 0; i < NAT64_MAX_NUM_PREFIXES; i++) {
3537 if (result.nat64_prefixes[i].prefix_len != 0) {
3538 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NAT64,
3539 sizeof(result.nat64_prefixes), result.nat64_prefixes, &updated,
3540 client->result, sizeof(client->result));
3541 break;
3542 }
3543 }
3544
3545 if (result.mss_recommended != 0) {
3546 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_RECOMMENDED_MSS,
3547 sizeof(result.mss_recommended), &result.mss_recommended, &updated,
3548 client->result, sizeof(client->result));
3549 }
3550
3551 for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
3552 if (uuid_is_null(result.netagents[i])) {
3553 break;
3554 }
3555 uuid_copy(netagent.netagent_uuid, result.netagents[i]);
3556 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
3557 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE, 0, 0)) {
3558 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
3559 client->result, sizeof(client->result));
3560 }
3561 }
3562
3563 ifnet_head_lock_shared();
3564 ifnet_t direct_interface = NULL;
3565 ifnet_t delegate_interface = NULL;
3566 ifnet_t original_scoped_interface = NULL;
3567
3568 if (result.routed_interface_index != IFSCOPE_NONE && result.routed_interface_index <= (u_int32_t)if_index) {
3569 direct_interface = ifindex2ifnet[result.routed_interface_index];
3570 } else if (parsed_parameters->required_interface_index != IFSCOPE_NONE &&
3571 parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
3572 // If the request was scoped, but the route didn't match, still grab the agents
3573 direct_interface = ifindex2ifnet[parsed_parameters->required_interface_index];
3574 } else if (result.routed_interface_index == IFSCOPE_NONE &&
3575 result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED &&
3576 result.routing_result_parameter.scoped_interface_index != IFSCOPE_NONE) {
3577 direct_interface = ifindex2ifnet[result.routing_result_parameter.scoped_interface_index];
3578 }
3579 if (direct_interface != NULL) {
3580 delegate_interface = direct_interface->if_delegated.ifp;
3581 }
3582 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
3583 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_REQUIRED_FIELDS) &&
3584 parsed_parameters->required_interface_index != IFSCOPE_NONE &&
3585 parsed_parameters->required_interface_index != result.routing_result_parameter.tunnel_interface_index &&
3586 parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
3587 original_scoped_interface = ifindex2ifnet[parsed_parameters->required_interface_index];
3588 }
3589 // Add interfaces
3590 if (original_scoped_interface != NULL) {
3591 struct necp_client_result_interface interface_struct;
3592 interface_struct.index = original_scoped_interface->if_index;
3593 interface_struct.generation = ifnet_get_generation(original_scoped_interface);
3594 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
3595 client->result, sizeof(client->result));
3596 }
3597 if (direct_interface != NULL) {
3598 struct necp_client_result_interface interface_struct;
3599 interface_struct.index = direct_interface->if_index;
3600 interface_struct.generation = ifnet_get_generation(direct_interface);
3601 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
3602 client->result, sizeof(client->result));
3603
3604 // Set the delta time since interface up/down
3605 struct timeval updown_delta = {};
3606 if (ifnet_updown_delta(direct_interface, &updown_delta) == 0) {
3607 u_int32_t delta = updown_delta.tv_sec;
3608 bool ignore_updated = FALSE;
3609 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_TIME_DELTA,
3610 sizeof(delta), &delta, &ignore_updated,
3611 client->result, sizeof(client->result));
3612 }
3613 }
3614 if (delegate_interface != NULL) {
3615 struct necp_client_result_interface interface_struct;
3616 interface_struct.index = delegate_interface->if_index;
3617 interface_struct.generation = ifnet_get_generation(delegate_interface);
3618 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
3619 client->result, sizeof(client->result));
3620 }
3621
3622 // Update multipath/listener interface flows
3623 if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_MULTIPATH) {
3624 // Get multipath interface options from ordered list
3625 struct ifnet *multi_interface = NULL;
3626 TAILQ_FOREACH(multi_interface, &ifnet_ordered_head, if_ordered_link) {
3627 if (necp_ifnet_matches_parameters(multi_interface, parsed_parameters, 0, NULL, true, false)) {
3628 // Add multipath interface flows for kernel MPTCP
3629 necp_client_add_interface_option_if_needed(client, multi_interface->if_index,
3630 ifnet_get_generation(multi_interface), NULL, false);
3631
3632 // Add nexus agents for multipath
3633 necp_client_add_agent_interface_options(client, parsed_parameters, multi_interface);
3634 }
3635 }
3636 } else if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
3637 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) {
3638 if (direct_interface != NULL) {
3639 // If scoped, only listen on that interface
3640 // Add nexus agents for listeners
3641 necp_client_add_agent_interface_options(client, parsed_parameters, direct_interface);
3642
3643 // Add interface option in case it is not a nexus
3644 necp_client_add_interface_option_if_needed(client, direct_interface->if_index,
3645 ifnet_get_generation(direct_interface), NULL, false);
3646 }
3647 } else {
3648 // Get listener interface options from global list
3649 struct ifnet *listen_interface = NULL;
3650 TAILQ_FOREACH(listen_interface, &ifnet_head, if_link) {
3651 if ((listen_interface->if_flags & (IFF_UP | IFF_RUNNING)) &&
3652 necp_ifnet_matches_parameters(listen_interface, parsed_parameters, 0, NULL, true, false)) {
3653 // Add nexus agents for listeners
3654 necp_client_add_agent_interface_options(client, parsed_parameters, listen_interface);
3655 }
3656 }
3657 }
3658 } else if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) {
3659 if (result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) {
3660 if (direct_interface != NULL) {
3661 // Add browse option if it has an agent
3662 necp_client_add_browse_interface_options(client, parsed_parameters, direct_interface);
3663 }
3664 } else {
3665 // Get browse interface options from global list
3666 struct ifnet *browse_interface = NULL;
3667 TAILQ_FOREACH(browse_interface, &ifnet_head, if_link) {
3668 if (necp_ifnet_matches_parameters(browse_interface, parsed_parameters, 0, NULL, true, false)) {
3669 necp_client_add_browse_interface_options(client, parsed_parameters, browse_interface);
3670 }
3671 }
3672 }
3673 }
3674
3675 // Add agents
3676 if (original_scoped_interface != NULL) {
3677 ifnet_lock_shared(original_scoped_interface);
3678 if (original_scoped_interface->if_agentids != NULL) {
3679 for (u_int32_t i = 0; i < original_scoped_interface->if_agentcount; i++) {
3680 if (uuid_is_null(original_scoped_interface->if_agentids[i])) {
3681 continue;
3682 }
3683 uuid_copy(netagent.netagent_uuid, original_scoped_interface->if_agentids[i]);
3684 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
3685 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE,
3686 original_scoped_interface->if_index, ifnet_get_generation(original_scoped_interface))) {
3687 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
3688 client->result, sizeof(client->result));
3689 }
3690 }
3691 }
3692 ifnet_lock_done(original_scoped_interface);
3693 }
3694 if (direct_interface != NULL) {
3695 ifnet_lock_shared(direct_interface);
3696 if (direct_interface->if_agentids != NULL) {
3697 for (u_int32_t i = 0; i < direct_interface->if_agentcount; i++) {
3698 if (uuid_is_null(direct_interface->if_agentids[i])) {
3699 continue;
3700 }
3701 uuid_copy(netagent.netagent_uuid, direct_interface->if_agentids[i]);
3702 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
3703 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE,
3704 direct_interface->if_index, ifnet_get_generation(direct_interface))) {
3705 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
3706 client->result, sizeof(client->result));
3707 }
3708 }
3709 }
3710 ifnet_lock_done(direct_interface);
3711 }
3712 if (delegate_interface != NULL) {
3713 ifnet_lock_shared(delegate_interface);
3714 if (delegate_interface->if_agentids != NULL) {
3715 for (u_int32_t i = 0; i < delegate_interface->if_agentcount; i++) {
3716 if (uuid_is_null(delegate_interface->if_agentids[i])) {
3717 continue;
3718 }
3719 uuid_copy(netagent.netagent_uuid, delegate_interface->if_agentids[i]);
3720 netagent.generation = netagent_get_generation(netagent.netagent_uuid);
3721 if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE,
3722 delegate_interface->if_index, ifnet_get_generation(delegate_interface))) {
3723 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
3724 client->result, sizeof(client->result));
3725 }
3726 }
3727 }
3728 ifnet_lock_done(delegate_interface);
3729 }
3730 ifnet_head_done();
3731
3732 // Add interface options
3733 for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
3734 if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
3735 struct necp_client_interface_option *option = &client->interface_options[option_i];
3736 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated,
3737 client->result, sizeof(client->result));
3738 } else {
3739 struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
3740 cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated,
3741 client->result, sizeof(client->result));
3742 }
3743 }
3744
3745 size_t new_result_length = (cursor - client->result);
3746 if (new_result_length != client->result_length) {
3747 client->result_length = new_result_length;
3748 updated = TRUE;
3749 }
3750
3751 // Update flow viability/flags
3752 if (necp_client_update_flows(proc, client, defunct_list)) {
3753 updated = TRUE;
3754 }
3755
3756 if (updated) {
3757 client->result_read = FALSE;
3758 necp_client_update_observer_update(client);
3759 }
3760
3761 FREE(parsed_parameters, M_NECP);
3762 return updated;
3763 }
3764
3765 static bool
3766 necp_defunct_client_fd_locked_inner(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, bool destroy_stats)
3767 {
3768 bool updated_result = FALSE;
3769 struct necp_client *client = NULL;
3770
3771 NECP_FD_ASSERT_LOCKED(client_fd);
3772
3773 RB_FOREACH(client, _necp_client_tree, &client_fd->clients) {
3774 struct necp_client_flow_registration *flow_registration = NULL;
3775
3776 NECP_CLIENT_LOCK(client);
3777
3778 // Prepare close events to be sent to the nexus to effectively remove the flows
3779 struct necp_client_flow *search_flow = NULL;
3780 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
3781 LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
3782 if (search_flow->nexus &&
3783 !uuid_is_null(search_flow->u.nexus_agent)) {
3784 // Sleeping alloc won't fail; copy only what's necessary
3785 struct necp_flow_defunct *flow_defunct = _MALLOC(sizeof(struct necp_flow_defunct), M_NECP, M_WAITOK | M_ZERO);
3786 uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent);
3787 uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
3788 client->client_id :
3789 flow_registration->registration_id));
3790 flow_defunct->proc_pid = client->proc_pid;
3791 flow_defunct->agent_handle = client->agent_handle;
3792 flow_defunct->flags = flow_registration->flags;
3793 // Add to the list provided by caller
3794 LIST_INSERT_HEAD(defunct_list, flow_defunct, chain);
3795
3796 flow_registration->defunct = true;
3797 flow_registration->flow_result_read = false;
3798 updated_result = true;
3799 }
3800 }
3801 }
3802 if (destroy_stats) {
3803 }
3804 NECP_CLIENT_UNLOCK(client);
3805 }
3806
3807 return updated_result;
3808 }
3809
3810 static inline void
3811 necp_defunct_client_fd_locked(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, struct proc *proc)
3812 {
3813 #pragma unused(proc)
3814 bool updated_result = FALSE;
3815
3816 NECP_FD_ASSERT_LOCKED(client_fd);
3817
3818 updated_result = necp_defunct_client_fd_locked_inner(client_fd, defunct_list, true);
3819
3820
3821 if (updated_result) {
3822 necp_fd_notify(client_fd, true);
3823 }
3824 }
3825
3826 static inline void
3827 necp_update_client_fd_locked(struct necp_fd_data *client_fd,
3828 proc_t proc,
3829 struct _necp_flow_defunct_list *defunct_list)
3830 {
3831 struct necp_client *client = NULL;
3832 bool updated_result = FALSE;
3833 NECP_FD_ASSERT_LOCKED(client_fd);
3834 RB_FOREACH(client, _necp_client_tree, &client_fd->clients) {
3835 NECP_CLIENT_LOCK(client);
3836 if (necp_update_client_result(proc, client_fd, client, defunct_list)) {
3837 updated_result = TRUE;
3838 }
3839 NECP_CLIENT_UNLOCK(client);
3840 }
3841 if (updated_result) {
3842 necp_fd_notify(client_fd, true);
3843 }
3844 }
3845
3846
3847 static void
3848 necp_update_all_clients_callout(__unused thread_call_param_t dummy,
3849 __unused thread_call_param_t arg)
3850 {
3851 struct necp_fd_data *client_fd = NULL;
3852
3853 struct _necp_flow_defunct_list defunct_list;
3854 LIST_INIT(&defunct_list);
3855
3856 NECP_FD_LIST_LOCK_SHARED();
3857
3858 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
3859 proc_t proc = proc_find(client_fd->proc_pid);
3860 if (proc == PROC_NULL) {
3861 continue;
3862 }
3863
3864 // Update all clients on one fd
3865 NECP_FD_LOCK(client_fd);
3866 necp_update_client_fd_locked(client_fd, proc, &defunct_list);
3867 NECP_FD_UNLOCK(client_fd);
3868
3869 proc_rele(proc);
3870 proc = PROC_NULL;
3871 }
3872
3873 NECP_FD_LIST_UNLOCK();
3874
3875 // Handle the case in which some clients became newly defunct
3876 necp_process_defunct_list(&defunct_list);
3877 }
3878
3879 void
3880 necp_update_all_clients(void)
3881 {
3882 necp_update_all_clients_immediately_if_needed(false);
3883 }
3884
3885 void
3886 necp_update_all_clients_immediately_if_needed(bool should_update_immediately)
3887 {
3888 if (necp_client_update_tcall == NULL) {
3889 // Don't try to update clients if the module is not initialized
3890 return;
3891 }
3892
3893 uint64_t deadline = 0;
3894 uint64_t leeway = 0;
3895
3896 uint32_t timeout_to_use = necp_timeout_microseconds;
3897 uint32_t leeway_to_use = necp_timeout_leeway_microseconds;
3898 if (should_update_immediately) {
3899 timeout_to_use = 1000 * 10; // 10ms
3900 leeway_to_use = 1000 * 10; // 10ms;
3901 }
3902
3903 clock_interval_to_deadline(timeout_to_use, NSEC_PER_USEC, &deadline);
3904 clock_interval_to_absolutetime_interval(leeway_to_use, NSEC_PER_USEC, &leeway);
3905
3906 thread_call_enter_delayed_with_leeway(necp_client_update_tcall, NULL,
3907 deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
3908 }
3909
3910 bool
3911 necp_set_client_as_background(proc_t proc,
3912 struct fileproc *fp,
3913 bool background)
3914 {
3915 if (proc == PROC_NULL) {
3916 NECPLOG0(LOG_ERR, "NULL proc");
3917 return FALSE;
3918 }
3919
3920 if (fp == NULL) {
3921 NECPLOG0(LOG_ERR, "NULL fp");
3922 return FALSE;
3923 }
3924
3925 struct necp_fd_data *client_fd = (struct necp_fd_data *)fp->fp_glob->fg_data;
3926 if (client_fd == NULL) {
3927 NECPLOG0(LOG_ERR, "Could not find client structure for backgrounded client");
3928 return FALSE;
3929 }
3930
3931 if (client_fd->necp_fd_type != necp_fd_type_client) {
3932 // Not a client fd, ignore
3933 NECPLOG0(LOG_ERR, "Not a client fd, ignore");
3934 return FALSE;
3935 }
3936
3937 client_fd->background = background;
3938
3939 return TRUE;
3940 }
3941
3942 void
3943 necp_fd_memstatus(proc_t proc, uint32_t status,
3944 struct necp_fd_data *client_fd)
3945 {
3946 #pragma unused(proc, status, client_fd)
3947 ASSERT(proc != PROC_NULL);
3948 ASSERT(client_fd != NULL);
3949
3950 // Nothing to reap for the process or client for now,
3951 // but this is where we would trigger that in future.
3952 }
3953
3954 void
3955 necp_fd_defunct(proc_t proc, struct necp_fd_data *client_fd)
3956 {
3957 struct _necp_flow_defunct_list defunct_list;
3958
3959 ASSERT(proc != PROC_NULL);
3960 ASSERT(client_fd != NULL);
3961
3962 if (client_fd->necp_fd_type != necp_fd_type_client) {
3963 // Not a client fd, ignore
3964 return;
3965 }
3966
3967 // Our local temporary list
3968 LIST_INIT(&defunct_list);
3969
3970 // Need to hold lock so ntstats defunct the same set of clients
3971 NECP_FD_LOCK(client_fd);
3972 necp_defunct_client_fd_locked(client_fd, &defunct_list, proc);
3973 NECP_FD_UNLOCK(client_fd);
3974
3975 necp_process_defunct_list(&defunct_list);
3976 }
3977
3978 static void
3979 necp_client_remove_agent_from_result(struct necp_client *client, uuid_t netagent_uuid)
3980 {
3981 size_t offset = 0;
3982
3983 u_int8_t *result_buffer = client->result;
3984 while ((offset + sizeof(struct necp_tlv_header)) <= client->result_length) {
3985 u_int8_t type = necp_buffer_get_tlv_type(result_buffer, offset);
3986 u_int32_t length = necp_buffer_get_tlv_length(result_buffer, offset);
3987
3988 size_t tlv_total_length = (sizeof(struct necp_tlv_header) + length);
3989 if (type == NECP_CLIENT_RESULT_NETAGENT &&
3990 length == sizeof(struct necp_client_result_netagent) &&
3991 (offset + tlv_total_length) <= client->result_length) {
3992 struct necp_client_result_netagent *value = ((struct necp_client_result_netagent *)(void *)
3993 necp_buffer_get_tlv_value(result_buffer, offset, NULL));
3994 if (uuid_compare(value->netagent_uuid, netagent_uuid) == 0) {
3995 // Found a netagent to remove
3996 // Shift bytes down to remove the tlv, and adjust total length
3997 // Don't adjust the current offset
3998 memmove(result_buffer + offset,
3999 result_buffer + offset + tlv_total_length,
4000 client->result_length - (offset + tlv_total_length));
4001 client->result_length -= tlv_total_length;
4002 memset(result_buffer + client->result_length, 0, sizeof(client->result) - client->result_length);
4003 continue;
4004 }
4005 }
4006
4007 offset += tlv_total_length;
4008 }
4009 }
4010
4011 void
4012 necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid, u_int32_t agent_generation)
4013 {
4014 struct necp_fd_data *client_fd = NULL;
4015
4016 NECP_FD_LIST_LOCK_SHARED();
4017
4018 LIST_FOREACH(client_fd, &necp_fd_list, chain) {
4019 bool updated_result = FALSE;
4020 NECP_FD_LOCK(client_fd);
4021 struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
4022 if (client != NULL) {
4023 client->failed_trigger_agent.generation = agent_generation;
4024 uuid_copy(client->failed_trigger_agent.netagent_uuid, remove_netagent_uuid);
4025 if (!uuid_is_null(remove_netagent_uuid)) {
4026 necp_client_remove_agent_from_result(client, remove_netagent_uuid);
4027 }
4028 client->result_read = FALSE;
4029 // Found the client, break
4030 updated_result = TRUE;
4031 NECP_CLIENT_UNLOCK(client);
4032 }
4033 if (updated_result) {
4034 necp_fd_notify(client_fd, true);
4035 }
4036 NECP_FD_UNLOCK(client_fd);
4037 if (updated_result) {
4038 // Found the client, break
4039 break;
4040 }
4041 }
4042
4043 NECP_FD_LIST_UNLOCK();
4044 }
4045
4046
4047 /// Interface matching
4048
4049 #define NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
4050 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF | \
4051 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
4052 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE | \
4053 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
4054 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT | \
4055 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
4056 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \
4057 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \
4058 NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE | \
4059 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \
4060 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
4061
4062 #define NECP_PARSED_PARAMETERS_SCOPED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
4063 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
4064 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
4065 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
4066 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \
4067 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE)
4068
4069 #define NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
4070 NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)
4071
4072 #define NECP_PARSED_PARAMETERS_PREFERRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
4073 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \
4074 NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \
4075 NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
4076
4077 static bool
4078 necp_ifnet_matches_type(struct ifnet *ifp, u_int8_t interface_type, bool check_delegates)
4079 {
4080 struct ifnet *check_ifp = ifp;
4081 while (check_ifp) {
4082 if (if_functional_type(check_ifp, TRUE) == interface_type) {
4083 return TRUE;
4084 }
4085 if (!check_delegates) {
4086 break;
4087 }
4088 check_ifp = check_ifp->if_delegated.ifp;
4089 }
4090 return FALSE;
4091 }
4092
4093 static bool
4094 necp_ifnet_matches_name(struct ifnet *ifp, const char *interface_name, bool check_delegates)
4095 {
4096 struct ifnet *check_ifp = ifp;
4097 while (check_ifp) {
4098 if (strncmp(check_ifp->if_xname, interface_name, IFXNAMSIZ) == 0) {
4099 return TRUE;
4100 }
4101 if (!check_delegates) {
4102 break;
4103 }
4104 check_ifp = check_ifp->if_delegated.ifp;
4105 }
4106 return FALSE;
4107 }
4108
4109 static bool
4110 necp_ifnet_matches_agent(struct ifnet *ifp, uuid_t *agent_uuid, bool check_delegates)
4111 {
4112 struct ifnet *check_ifp = ifp;
4113
4114 while (check_ifp != NULL) {
4115 ifnet_lock_shared(check_ifp);
4116 if (check_ifp->if_agentids != NULL) {
4117 for (u_int32_t index = 0; index < check_ifp->if_agentcount; index++) {
4118 if (uuid_compare(check_ifp->if_agentids[index], *agent_uuid) == 0) {
4119 ifnet_lock_done(check_ifp);
4120 return TRUE;
4121 }
4122 }
4123 }
4124 ifnet_lock_done(check_ifp);
4125
4126 if (!check_delegates) {
4127 break;
4128 }
4129 check_ifp = check_ifp->if_delegated.ifp;
4130 }
4131 return FALSE;
4132 }
4133
4134 static bool
4135 necp_ifnet_matches_agent_type(struct ifnet *ifp, const char *agent_domain, const char *agent_type, bool check_delegates)
4136 {
4137 struct ifnet *check_ifp = ifp;
4138
4139 while (check_ifp != NULL) {
4140 ifnet_lock_shared(check_ifp);
4141 if (check_ifp->if_agentids != NULL) {
4142 for (u_int32_t index = 0; index < check_ifp->if_agentcount; index++) {
4143 if (uuid_is_null(check_ifp->if_agentids[index])) {
4144 continue;
4145 }
4146
4147 char if_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
4148 char if_agent_type[NETAGENT_TYPESIZE] = { 0 };
4149
4150 if (netagent_get_agent_domain_and_type(check_ifp->if_agentids[index], if_agent_domain, if_agent_type)) {
4151 if (necp_agent_types_match(agent_domain, agent_type, if_agent_domain, if_agent_type)) {
4152 ifnet_lock_done(check_ifp);
4153 return TRUE;
4154 }
4155 }
4156 }
4157 }
4158 ifnet_lock_done(check_ifp);
4159
4160 if (!check_delegates) {
4161 break;
4162 }
4163 check_ifp = check_ifp->if_delegated.ifp;
4164 }
4165 return FALSE;
4166 }
4167
4168 static bool
4169 necp_ifnet_matches_local_address(struct ifnet *ifp, struct sockaddr *sa)
4170 {
4171 struct ifaddr *ifa = NULL;
4172 bool matched_local_address = FALSE;
4173
4174 // Transform sa into the ifaddr form
4175 // IPv6 Scope IDs are always embedded in the ifaddr list
4176 struct sockaddr_storage address;
4177 u_int ifscope = IFSCOPE_NONE;
4178 (void)sa_copy(sa, &address, &ifscope);
4179 SIN(&address)->sin_port = 0;
4180 if (address.ss_family == AF_INET6) {
4181 SIN6(&address)->sin6_scope_id = 0;
4182 }
4183
4184 ifa = ifa_ifwithaddr_scoped_locked((struct sockaddr *)&address, ifp->if_index);
4185 matched_local_address = (ifa != NULL);
4186
4187 if (ifa) {
4188 ifaddr_release(ifa);
4189 }
4190
4191 return matched_local_address;
4192 }
4193
4194 static bool
4195 necp_interface_type_is_primary_eligible(u_int8_t interface_type)
4196 {
4197 switch (interface_type) {
4198 // These types can never be primary, so a client requesting these types is allowed
4199 // to match an interface that isn't currently eligible to be primary (has default
4200 // route, dns, etc)
4201 case IFRTYPE_FUNCTIONAL_WIFI_AWDL:
4202 case IFRTYPE_FUNCTIONAL_INTCOPROC:
4203 return false;
4204 default:
4205 break;
4206 }
4207 return true;
4208 }
4209
4210 #define NECP_IFP_IS_ON_ORDERED_LIST(_ifp) ((_ifp)->if_ordered_link.tqe_next != NULL || (_ifp)->if_ordered_link.tqe_prev != NULL)
4211
4212 // Secondary interface flag indicates that the interface is being
4213 // used for multipath or a listener as an extra path
4214 static bool
4215 necp_ifnet_matches_parameters(struct ifnet *ifp,
4216 struct necp_client_parsed_parameters *parsed_parameters,
4217 u_int32_t override_flags,
4218 u_int32_t *preferred_count,
4219 bool secondary_interface,
4220 bool require_scoped_field)
4221 {
4222 bool matched_some_scoped_field = FALSE;
4223
4224 if (preferred_count) {
4225 *preferred_count = 0;
4226 }
4227
4228 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) {
4229 if (parsed_parameters->required_interface_index != ifp->if_index) {
4230 return FALSE;
4231 }
4232 }
4233
4234 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR) {
4235 if (!necp_ifnet_matches_local_address(ifp, &parsed_parameters->local_addr.sa)) {
4236 return FALSE;
4237 }
4238 if (require_scoped_field) {
4239 matched_some_scoped_field = TRUE;
4240 }
4241 }
4242
4243 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) {
4244 if (override_flags != 0) {
4245 if ((override_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) &&
4246 IFNET_IS_EXPENSIVE(ifp)) {
4247 return FALSE;
4248 }
4249 if ((override_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED) &&
4250 IFNET_IS_CONSTRAINED(ifp)) {
4251 return FALSE;
4252 }
4253 } else {
4254 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) &&
4255 IFNET_IS_EXPENSIVE(ifp)) {
4256 return FALSE;
4257 }
4258 if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED) &&
4259 IFNET_IS_CONSTRAINED(ifp)) {
4260 return FALSE;
4261 }
4262 }
4263 }
4264
4265 if ((!secondary_interface || // Enforce interface type if this is the primary interface
4266 !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) || // or if there are no flags
4267 !(parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE)) && // or if the flags don't give an exception
4268 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) &&
4269 !necp_ifnet_matches_type(ifp, parsed_parameters->required_interface_type, FALSE)) {
4270 return FALSE;
4271 }
4272
4273 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) {
4274 if (require_scoped_field) {
4275 matched_some_scoped_field = TRUE;
4276 }
4277 }
4278
4279 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE) {
4280 for (int i = 0; i < NECP_MAX_INTERFACE_PARAMETERS; i++) {
4281 if (parsed_parameters->prohibited_interface_types[i] == 0) {
4282 break;
4283 }
4284
4285 if (necp_ifnet_matches_type(ifp, parsed_parameters->prohibited_interface_types[i], TRUE)) {
4286 return FALSE;
4287 }
4288 }
4289 }
4290
4291 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF) {
4292 for (int i = 0; i < NECP_MAX_INTERFACE_PARAMETERS; i++) {
4293 if (strlen(parsed_parameters->prohibited_interfaces[i]) == 0) {
4294 break;
4295 }
4296
4297 if (necp_ifnet_matches_name(ifp, parsed_parameters->prohibited_interfaces[i], TRUE)) {
4298 return FALSE;
4299 }
4300 }
4301 }
4302
4303 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
4304 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4305 if (uuid_is_null(parsed_parameters->required_netagents[i])) {
4306 break;
4307 }
4308
4309 if (!necp_ifnet_matches_agent(ifp, &parsed_parameters->required_netagents[i], FALSE)) {
4310 return FALSE;
4311 }
4312
4313 if (require_scoped_field) {
4314 matched_some_scoped_field = TRUE;
4315 }
4316 }
4317 }
4318
4319 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT) {
4320 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4321 if (uuid_is_null(parsed_parameters->prohibited_netagents[i])) {
4322 break;
4323 }
4324
4325 if (necp_ifnet_matches_agent(ifp, &parsed_parameters->prohibited_netagents[i], TRUE)) {
4326 return FALSE;
4327 }
4328 }
4329 }
4330
4331 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
4332 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4333 if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 &&
4334 strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
4335 break;
4336 }
4337
4338 if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->required_netagent_types[i].netagent_domain, parsed_parameters->required_netagent_types[i].netagent_type, FALSE)) {
4339 return FALSE;
4340 }
4341
4342 if (require_scoped_field) {
4343 matched_some_scoped_field = TRUE;
4344 }
4345 }
4346 }
4347
4348 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE) {
4349 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4350 if (strlen(parsed_parameters->prohibited_netagent_types[i].netagent_domain) == 0 &&
4351 strlen(parsed_parameters->prohibited_netagent_types[i].netagent_type) == 0) {
4352 break;
4353 }
4354
4355 if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->prohibited_netagent_types[i].netagent_domain, parsed_parameters->prohibited_netagent_types[i].netagent_type, TRUE)) {
4356 return FALSE;
4357 }
4358 }
4359 }
4360
4361 // Checked preferred properties
4362 if (preferred_count) {
4363 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT) {
4364 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4365 if (uuid_is_null(parsed_parameters->preferred_netagents[i])) {
4366 break;
4367 }
4368
4369 if (necp_ifnet_matches_agent(ifp, &parsed_parameters->preferred_netagents[i], TRUE)) {
4370 (*preferred_count)++;
4371 if (require_scoped_field) {
4372 matched_some_scoped_field = TRUE;
4373 }
4374 }
4375 }
4376 }
4377
4378 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE) {
4379 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4380 if (strlen(parsed_parameters->preferred_netagent_types[i].netagent_domain) == 0 &&
4381 strlen(parsed_parameters->preferred_netagent_types[i].netagent_type) == 0) {
4382 break;
4383 }
4384
4385 if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->preferred_netagent_types[i].netagent_domain, parsed_parameters->preferred_netagent_types[i].netagent_type, TRUE)) {
4386 (*preferred_count)++;
4387 if (require_scoped_field) {
4388 matched_some_scoped_field = TRUE;
4389 }
4390 }
4391 }
4392 }
4393
4394 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT) {
4395 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4396 if (uuid_is_null(parsed_parameters->avoided_netagents[i])) {
4397 break;
4398 }
4399
4400 if (!necp_ifnet_matches_agent(ifp, &parsed_parameters->avoided_netagents[i], TRUE)) {
4401 (*preferred_count)++;
4402 }
4403 }
4404 }
4405
4406 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE) {
4407 for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
4408 if (strlen(parsed_parameters->avoided_netagent_types[i].netagent_domain) == 0 &&
4409 strlen(parsed_parameters->avoided_netagent_types[i].netagent_type) == 0) {
4410 break;
4411 }
4412
4413 if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->avoided_netagent_types[i].netagent_domain,
4414 parsed_parameters->avoided_netagent_types[i].netagent_type, TRUE)) {
4415 (*preferred_count)++;
4416 }
4417 }
4418 }
4419 }
4420
4421 if (require_scoped_field) {
4422 return matched_some_scoped_field;
4423 }
4424
4425 return TRUE;
4426 }
4427
4428 static bool
4429 necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters,
4430 u_int *return_ifindex, bool *validate_agents)
4431 {
4432 struct ifnet *ifp = NULL;
4433 u_int32_t best_preferred_count = 0;
4434 bool has_preferred_fields = FALSE;
4435 *return_ifindex = 0;
4436
4437 if (parsed_parameters->required_interface_index != 0) {
4438 *return_ifindex = parsed_parameters->required_interface_index;
4439 return TRUE;
4440 }
4441
4442 // Check and save off flags
4443 u_int32_t flags = 0;
4444 bool has_prohibit_flags = FALSE;
4445 if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) {
4446 flags = parsed_parameters->flags;
4447 has_prohibit_flags = (parsed_parameters->flags &
4448 (NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE |
4449 NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED));
4450 }
4451
4452 if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS) &&
4453 !has_prohibit_flags) {
4454 return TRUE;
4455 }
4456
4457 has_preferred_fields = (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS);
4458
4459 // We have interesting parameters to parse and find a matching interface
4460 ifnet_head_lock_shared();
4461
4462 if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS) &&
4463 !has_preferred_fields) {
4464 // We do have fields to match, but they are only prohibitory
4465 // If the first interface in the list matches, or there are no ordered interfaces, we don't need to scope
4466 ifp = TAILQ_FIRST(&ifnet_ordered_head);
4467 if (ifp == NULL || necp_ifnet_matches_parameters(ifp, parsed_parameters, 0, NULL, false, false)) {
4468 // Don't set return_ifindex, so the client doesn't need to scope
4469 ifnet_head_done();
4470 return TRUE;
4471 }
4472 }
4473
4474 // First check the ordered interface list
4475 TAILQ_FOREACH(ifp, &ifnet_ordered_head, if_ordered_link) {
4476 u_int32_t preferred_count = 0;
4477 if (necp_ifnet_matches_parameters(ifp, parsed_parameters, flags, &preferred_count, false, false)) {
4478 if (preferred_count > best_preferred_count ||
4479 *return_ifindex == 0) {
4480 // Everything matched, and is most preferred. Return this interface.
4481 *return_ifindex = ifp->if_index;
4482 best_preferred_count = preferred_count;
4483
4484 if (!has_preferred_fields) {
4485 break;
4486 }
4487 }
4488 }
4489
4490 if (has_prohibit_flags &&
4491 ifp == TAILQ_FIRST(&ifnet_ordered_head)) {
4492 // This was the first interface. From here on, if the
4493 // client prohibited either expensive or constrained,
4494 // don't allow either as a secondary interface option.
4495 flags |= (NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE |
4496 NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED);
4497 }
4498 }
4499
4500 bool is_listener = ((parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
4501 (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER));
4502
4503 // Then check the remaining interfaces
4504 if ((parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS) &&
4505 ((!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)) ||
4506 !necp_interface_type_is_primary_eligible(parsed_parameters->required_interface_type) ||
4507 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR) ||
4508 is_listener) &&
4509 (*return_ifindex == 0 || has_preferred_fields)) {
4510 TAILQ_FOREACH(ifp, &ifnet_head, if_link) {
4511 u_int32_t preferred_count = 0;
4512 if (NECP_IFP_IS_ON_ORDERED_LIST(ifp)) {
4513 // This interface was in the ordered list, skip
4514 continue;
4515 }
4516 if (necp_ifnet_matches_parameters(ifp, parsed_parameters, flags, &preferred_count, false, true)) {
4517 if (preferred_count > best_preferred_count ||
4518 *return_ifindex == 0) {
4519 // Everything matched, and is most preferred. Return this interface.
4520 *return_ifindex = ifp->if_index;
4521 best_preferred_count = preferred_count;
4522
4523 if (!has_preferred_fields) {
4524 break;
4525 }
4526 }
4527 }
4528 }
4529 }
4530
4531 ifnet_head_done();
4532
4533 if (has_preferred_fields && best_preferred_count == 0 &&
4534 ((parsed_parameters->valid_fields & (NECP_PARSED_PARAMETERS_SCOPED_FIELDS | NECP_PARSED_PARAMETERS_PREFERRED_FIELDS)) ==
4535 (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS))) {
4536 // If only has preferred ifnet fields, and nothing was found, clear the interface index and return TRUE
4537 *return_ifindex = 0;
4538 return TRUE;
4539 }
4540
4541 if (*return_ifindex == 0 &&
4542 !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS)) {
4543 // Has required fields, but not including specific interface fields. Pass for now, and check
4544 // to see if agents are satisfied by policy.
4545 *validate_agents = TRUE;
4546 return TRUE;
4547 }
4548
4549 return *return_ifindex != 0;
4550 }
4551
4552
4553 static int
4554 necp_skywalk_priv_check_cred(proc_t p, kauth_cred_t cred)
4555 {
4556 #pragma unused(p, cred)
4557 return 0;
4558 }
4559
4560 /// System calls
4561
4562 int
4563 necp_open(struct proc *p, struct necp_open_args *uap, int *retval)
4564 {
4565 #pragma unused(retval)
4566 int error = 0;
4567 struct necp_fd_data *fd_data = NULL;
4568 struct fileproc *fp = NULL;
4569 int fd = -1;
4570
4571 if (uap->flags & NECP_OPEN_FLAG_OBSERVER ||
4572 uap->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
4573 if (necp_skywalk_priv_check_cred(p, kauth_cred_get()) != 0 &&
4574 priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NETWORK_STATISTICS, 0) != 0) {
4575 NECPLOG0(LOG_ERR, "Client does not hold necessary entitlement to observe other NECP clients");
4576 error = EACCES;
4577 goto done;
4578 }
4579 }
4580
4581 error = falloc(p, &fp, &fd, vfs_context_current());
4582 if (error != 0) {
4583 goto done;
4584 }
4585
4586 if ((fd_data = zalloc(necp_client_fd_zone)) == NULL) {
4587 error = ENOMEM;
4588 goto done;
4589 }
4590
4591 memset(fd_data, 0, sizeof(*fd_data));
4592
4593 fd_data->necp_fd_type = necp_fd_type_client;
4594 fd_data->flags = uap->flags;
4595 RB_INIT(&fd_data->clients);
4596 RB_INIT(&fd_data->flows);
4597 TAILQ_INIT(&fd_data->update_list);
4598 lck_mtx_init(&fd_data->fd_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
4599 klist_init(&fd_data->si.si_note);
4600 fd_data->proc_pid = proc_pid(p);
4601
4602 fp->fp_glob->fg_flag = FREAD;
4603 fp->fp_glob->fg_ops = &necp_fd_ops;
4604 fp->fp_glob->fg_data = fd_data;
4605
4606 proc_fdlock(p);
4607
4608 *fdflags(p, fd) |= (UF_EXCLOSE | UF_FORKCLOSE);
4609 procfdtbl_releasefd(p, fd, NULL);
4610 fp_drop(p, fd, fp, 1);
4611
4612 *retval = fd;
4613
4614 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
4615 NECP_OBSERVER_LIST_LOCK_EXCLUSIVE();
4616 LIST_INSERT_HEAD(&necp_fd_observer_list, fd_data, chain);
4617 OSIncrementAtomic(&necp_observer_fd_count);
4618 NECP_OBSERVER_LIST_UNLOCK();
4619
4620 // Walk all existing clients and add them
4621 NECP_CLIENT_TREE_LOCK_SHARED();
4622 struct necp_client *existing_client = NULL;
4623 RB_FOREACH(existing_client, _necp_client_global_tree, &necp_client_global_tree) {
4624 NECP_CLIENT_LOCK(existing_client);
4625 necp_client_update_observer_add_internal(fd_data, existing_client);
4626 necp_client_update_observer_update_internal(fd_data, existing_client);
4627 NECP_CLIENT_UNLOCK(existing_client);
4628 }
4629 NECP_CLIENT_TREE_UNLOCK();
4630 } else {
4631 NECP_FD_LIST_LOCK_EXCLUSIVE();
4632 LIST_INSERT_HEAD(&necp_fd_list, fd_data, chain);
4633 OSIncrementAtomic(&necp_client_fd_count);
4634 NECP_FD_LIST_UNLOCK();
4635 }
4636
4637 proc_fdunlock(p);
4638
4639 done:
4640 if (error != 0) {
4641 if (fp != NULL) {
4642 fp_free(p, fd, fp);
4643 fp = NULL;
4644 }
4645 if (fd_data != NULL) {
4646 zfree(necp_client_fd_zone, fd_data);
4647 fd_data = NULL;
4648 }
4649 }
4650
4651 return error;
4652 }
4653
4654 // All functions called directly from necp_client_action() to handle one of the
4655 // types should be marked with NECP_CLIENT_ACTION_FUNCTION. This ensures that
4656 // necp_client_action() does not inline all the actions into a single function.
4657 #define NECP_CLIENT_ACTION_FUNCTION __attribute__((noinline))
4658
4659 static NECP_CLIENT_ACTION_FUNCTION int
4660 necp_client_add(struct proc *p, struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
4661 {
4662 int error = 0;
4663 struct necp_client *client = NULL;
4664 const size_t buffer_size = uap->buffer_size;
4665
4666 if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
4667 NECPLOG0(LOG_ERR, "NECP client observers with push enabled may not add their own clients");
4668 return EINVAL;
4669 }
4670
4671 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
4672 buffer_size == 0 || buffer_size > NECP_MAX_CLIENT_PARAMETERS_SIZE || uap->buffer == 0) {
4673 return EINVAL;
4674 }
4675
4676 if ((client = _MALLOC(sizeof(struct necp_client) + buffer_size, M_NECP,
4677 M_WAITOK | M_ZERO)) == NULL) {
4678 error = ENOMEM;
4679 goto done;
4680 }
4681
4682 error = copyin(uap->buffer, client->parameters, buffer_size);
4683 if (error) {
4684 NECPLOG(LOG_ERR, "necp_client_add parameters copyin error (%d)", error);
4685 goto done;
4686 }
4687
4688 lck_mtx_init(&client->lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
4689 lck_mtx_init(&client->route_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
4690
4691 os_ref_init(&client->reference_count, &necp_client_refgrp); // Hold our reference until close
4692
4693 client->parameters_length = buffer_size;
4694 client->proc_pid = fd_data->proc_pid; // Save off proc pid in case the client will persist past fd
4695 client->agent_handle = (void *)fd_data;
4696 client->platform_binary = ((csproc_get_platform_binary(p) == 0) ? 0 : 1);
4697
4698 necp_generate_client_id(client->client_id, false);
4699 LIST_INIT(&client->assertion_list);
4700 RB_INIT(&client->flow_registrations);
4701
4702 error = copyout(client->client_id, uap->client_id, sizeof(uuid_t));
4703 if (error) {
4704 NECPLOG(LOG_ERR, "necp_client_add client_id copyout error (%d)", error);
4705 goto done;
4706 }
4707
4708
4709 necp_client_update_observer_add(client);
4710
4711 NECP_FD_LOCK(fd_data);
4712 RB_INSERT(_necp_client_tree, &fd_data->clients, client);
4713 OSIncrementAtomic(&necp_client_count);
4714 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
4715 RB_INSERT(_necp_client_global_tree, &necp_client_global_tree, client);
4716 NECP_CLIENT_TREE_UNLOCK();
4717
4718 // Prime the client result
4719 NECP_CLIENT_LOCK(client);
4720 (void)necp_update_client_result(current_proc(), fd_data, client, NULL);
4721 NECP_CLIENT_UNLOCK(client);
4722 NECP_FD_UNLOCK(fd_data);
4723 done:
4724 if (error != 0) {
4725 if (client != NULL) {
4726 FREE(client, M_NECP);
4727 client = NULL;
4728 }
4729 }
4730 *retval = error;
4731
4732 return error;
4733 }
4734
4735 static NECP_CLIENT_ACTION_FUNCTION int
4736 necp_client_claim(struct proc *p, struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
4737 {
4738 int error = 0;
4739 uuid_t client_id = {};
4740 struct necp_client *client = NULL;
4741
4742 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
4743 error = EINVAL;
4744 goto done;
4745 }
4746
4747 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
4748 if (error) {
4749 NECPLOG(LOG_ERR, "necp_client_claim copyin client_id error (%d)", error);
4750 goto done;
4751 }
4752
4753 u_int64_t upid = proc_uniqueid(p);
4754
4755 NECP_FD_LIST_LOCK_SHARED();
4756
4757 struct necp_fd_data *find_fd = NULL;
4758 LIST_FOREACH(find_fd, &necp_fd_list, chain) {
4759 NECP_FD_LOCK(find_fd);
4760 struct necp_client *find_client = necp_client_fd_find_client_and_lock(find_fd, client_id);
4761 if (find_client != NULL) {
4762 if (find_client->delegated_upid == upid) {
4763 // Matched the client to claim; remove from the old fd
4764 client = find_client;
4765 RB_REMOVE(_necp_client_tree, &find_fd->clients, client);
4766 necp_client_retain_locked(client);
4767 }
4768 NECP_CLIENT_UNLOCK(find_client);
4769 }
4770 NECP_FD_UNLOCK(find_fd);
4771
4772 if (client != NULL) {
4773 break;
4774 }
4775 }
4776
4777 NECP_FD_LIST_UNLOCK();
4778
4779 if (client == NULL) {
4780 error = ENOENT;
4781 goto done;
4782 }
4783
4784 client->proc_pid = fd_data->proc_pid; // Transfer client to claiming pid
4785 client->agent_handle = (void *)fd_data;
4786 client->platform_binary = ((csproc_get_platform_binary(p) == 0) ? 0 : 1);
4787
4788 // Add matched client to our fd and re-run result
4789 NECP_FD_LOCK(fd_data);
4790 RB_INSERT(_necp_client_tree, &fd_data->clients, client);
4791 NECP_CLIENT_LOCK(client);
4792 (void)necp_update_client_result(current_proc(), fd_data, client, NULL);
4793 NECP_CLIENT_UNLOCK(client);
4794 NECP_FD_UNLOCK(fd_data);
4795
4796 necp_client_release(client);
4797
4798 done:
4799 *retval = error;
4800
4801 return error;
4802 }
4803
4804 static NECP_CLIENT_ACTION_FUNCTION int
4805 necp_client_remove(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
4806 {
4807 int error = 0;
4808 uuid_t client_id = {};
4809 struct ifnet_stats_per_flow flow_ifnet_stats = {};
4810 const size_t buffer_size = uap->buffer_size;
4811
4812 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
4813 error = EINVAL;
4814 goto done;
4815 }
4816
4817 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
4818 if (error) {
4819 NECPLOG(LOG_ERR, "necp_client_remove copyin client_id error (%d)", error);
4820 goto done;
4821 }
4822
4823 if (uap->buffer != 0 && buffer_size == sizeof(flow_ifnet_stats)) {
4824 error = copyin(uap->buffer, &flow_ifnet_stats, buffer_size);
4825 if (error) {
4826 NECPLOG(LOG_ERR, "necp_client_remove flow_ifnet_stats copyin error (%d)", error);
4827 // Not fatal; make sure to zero-out stats in case of partial copy
4828 memset(&flow_ifnet_stats, 0, sizeof(flow_ifnet_stats));
4829 error = 0;
4830 }
4831 } else if (uap->buffer != 0) {
4832 NECPLOG(LOG_ERR, "necp_client_remove unexpected parameters length (%zu)", buffer_size);
4833 }
4834
4835 NECP_FD_LOCK(fd_data);
4836
4837 pid_t pid = fd_data->proc_pid;
4838 struct necp_client *client = necp_client_fd_find_client_unlocked(fd_data, client_id);
4839 if (client != NULL) {
4840 // Remove any flow registrations that match
4841 struct necp_client_flow_registration *flow_registration = NULL;
4842 struct necp_client_flow_registration *temp_flow_registration = NULL;
4843 RB_FOREACH_SAFE(flow_registration, _necp_fd_flow_tree, &fd_data->flows, temp_flow_registration) {
4844 if (flow_registration->client == client) {
4845 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
4846 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
4847 NECP_FLOW_TREE_UNLOCK();
4848 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
4849 }
4850 }
4851 // Remove client from lists
4852 NECP_CLIENT_TREE_LOCK_EXCLUSIVE();
4853 RB_REMOVE(_necp_client_global_tree, &necp_client_global_tree, client);
4854 NECP_CLIENT_TREE_UNLOCK();
4855 RB_REMOVE(_necp_client_tree, &fd_data->clients, client);
4856 }
4857
4858
4859 NECP_FD_UNLOCK(fd_data);
4860
4861 if (client != NULL) {
4862 ASSERT(error == 0);
4863 necp_destroy_client(client, pid, true);
4864 } else {
4865 error = ENOENT;
4866 NECPLOG(LOG_ERR, "necp_client_remove invalid client_id (%d)", error);
4867 }
4868 done:
4869 *retval = error;
4870
4871 return error;
4872 }
4873
4874 static struct necp_client_flow_registration *
4875 necp_client_fd_find_flow(struct necp_fd_data *client_fd, uuid_t flow_id)
4876 {
4877 NECP_FD_ASSERT_LOCKED(client_fd);
4878 struct necp_client_flow_registration *flow = NULL;
4879
4880 if (necp_client_id_is_flow(flow_id)) {
4881 struct necp_client_flow_registration find;
4882 uuid_copy(find.registration_id, flow_id);
4883 flow = RB_FIND(_necp_fd_flow_tree, &client_fd->flows, &find);
4884 }
4885
4886 return flow;
4887 }
4888
4889 static NECP_CLIENT_ACTION_FUNCTION int
4890 necp_client_remove_flow(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
4891 {
4892 int error = 0;
4893 uuid_t flow_id = {};
4894 struct ifnet_stats_per_flow flow_ifnet_stats = {};
4895 const size_t buffer_size = uap->buffer_size;
4896
4897 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
4898 error = EINVAL;
4899 NECPLOG(LOG_ERR, "necp_client_remove_flow invalid client_id (length %zu)", (size_t)uap->client_id_len);
4900 goto done;
4901 }
4902
4903 error = copyin(uap->client_id, flow_id, sizeof(uuid_t));
4904 if (error) {
4905 NECPLOG(LOG_ERR, "necp_client_remove_flow copyin client_id error (%d)", error);
4906 goto done;
4907 }
4908
4909 if (uap->buffer != 0 && buffer_size == sizeof(flow_ifnet_stats)) {
4910 error = copyin(uap->buffer, &flow_ifnet_stats, buffer_size);
4911 if (error) {
4912 NECPLOG(LOG_ERR, "necp_client_remove flow_ifnet_stats copyin error (%d)", error);
4913 // Not fatal
4914 }
4915 } else if (uap->buffer != 0) {
4916 NECPLOG(LOG_ERR, "necp_client_remove unexpected parameters length (%zu)", buffer_size);
4917 }
4918
4919 NECP_FD_LOCK(fd_data);
4920 struct necp_client *client = NULL;
4921 struct necp_client_flow_registration *flow_registration = necp_client_fd_find_flow(fd_data, flow_id);
4922 if (flow_registration != NULL) {
4923 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
4924 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration);
4925 NECP_FLOW_TREE_UNLOCK();
4926 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration);
4927
4928 client = flow_registration->client;
4929 if (client != NULL) {
4930 necp_client_retain(client);
4931 }
4932 }
4933 NECP_FD_UNLOCK(fd_data);
4934
4935 if (flow_registration != NULL && client != NULL) {
4936 NECP_CLIENT_LOCK(client);
4937 if (flow_registration->client == client) {
4938 necp_destroy_client_flow_registration(client, flow_registration, fd_data->proc_pid, false);
4939 }
4940 necp_client_release_locked(client);
4941 NECP_CLIENT_UNLOCK(client);
4942 }
4943
4944 done:
4945 *retval = error;
4946 if (error != 0) {
4947 NECPLOG(LOG_ERR, "Remove flow error (%d)", error);
4948 }
4949
4950 return error;
4951 }
4952
4953 // Don't inline the function since it includes necp_client_parsed_parameters on the stack
4954 static __attribute__((noinline)) int
4955 necp_client_check_tcp_heuristics(struct necp_client *client, struct necp_client_flow *flow, u_int32_t *flags, u_int8_t *tfo_cookie, u_int8_t *tfo_cookie_len)
4956 {
4957 struct necp_client_parsed_parameters parsed_parameters;
4958 int error = 0;
4959
4960 error = necp_client_parse_parameters(client->parameters,
4961 (u_int32_t)client->parameters_length,
4962 &parsed_parameters);
4963 if (error) {
4964 NECPLOG(LOG_ERR, "necp_client_parse_parameters error (%d)", error);
4965 return error;
4966 }
4967
4968 if ((flow->remote_addr.sa.sa_family != AF_INET &&
4969 flow->remote_addr.sa.sa_family != AF_INET6) ||
4970 (flow->local_addr.sa.sa_family != AF_INET &&
4971 flow->local_addr.sa.sa_family != AF_INET6)) {
4972 return EINVAL;
4973 }
4974
4975 NECP_CLIENT_ROUTE_LOCK(client);
4976
4977 if (client->current_route == NULL) {
4978 error = ENOENT;
4979 goto do_unlock;
4980 }
4981
4982 bool check_ecn = false;
4983 do {
4984 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) ==
4985 NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) {
4986 check_ecn = true;
4987 break;
4988 }
4989
4990 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) ==
4991 NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) {
4992 break;
4993 }
4994
4995 if (client->current_route != NULL) {
4996 if (client->current_route->rt_ifp->if_eflags & IFEF_ECN_ENABLE) {
4997 check_ecn = true;
4998 break;
4999 }
5000 if (client->current_route->rt_ifp->if_eflags & IFEF_ECN_DISABLE) {
5001 break;
5002 }
5003 }
5004
5005 bool inbound = ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) == 0);
5006 if ((inbound && tcp_ecn_inbound == 1) ||
5007 (!inbound && tcp_ecn_outbound == 1)) {
5008 check_ecn = true;
5009 }
5010 } while (false);
5011
5012 if (check_ecn) {
5013 if (tcp_heuristic_do_ecn_with_address(client->current_route->rt_ifp,
5014 (union sockaddr_in_4_6 *)&flow->local_addr)) {
5015 *flags |= NECP_CLIENT_RESULT_FLAG_ECN_ENABLED;
5016 }
5017 }
5018
5019 if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) ==
5020 NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) {
5021 if (!tcp_heuristic_do_tfo_with_address(client->current_route->rt_ifp,
5022 (union sockaddr_in_4_6 *)&flow->local_addr,
5023 (union sockaddr_in_4_6 *)&flow->remote_addr,
5024 tfo_cookie, tfo_cookie_len)) {
5025 *flags |= NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED;
5026 *tfo_cookie_len = 0;
5027 }
5028 } else {
5029 *flags |= NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED;
5030 *tfo_cookie_len = 0;
5031 }
5032 do_unlock:
5033 NECP_CLIENT_ROUTE_UNLOCK(client);
5034
5035 return error;
5036 }
5037
5038 static size_t
5039 necp_client_calculate_flow_tlv_size(struct necp_client_flow_registration *flow_registration)
5040 {
5041 size_t assigned_results_size = 0;
5042 struct necp_client_flow *flow = NULL;
5043 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
5044 if (flow->assigned) {
5045 size_t header_length = 0;
5046 if (flow->nexus) {
5047 header_length = sizeof(struct necp_client_nexus_flow_header);
5048 } else {
5049 header_length = sizeof(struct necp_client_flow_header);
5050 }
5051 assigned_results_size += (header_length + flow->assigned_results_length);
5052
5053 if (flow->has_protoctl_event) {
5054 assigned_results_size += sizeof(struct necp_client_flow_protoctl_event_header);
5055 }
5056 }
5057 }
5058 return assigned_results_size;
5059 }
5060
5061 static int
5062 necp_client_fillout_flow_tlvs(struct necp_client *client,
5063 bool client_is_observed,
5064 struct necp_client_flow_registration *flow_registration,
5065 struct necp_client_action_args *uap,
5066 size_t *assigned_results_cursor)
5067 {
5068 int error = 0;
5069 struct necp_client_flow *flow = NULL;
5070 LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
5071 if (flow->assigned) {
5072 // Write TLV headers
5073 struct necp_client_nexus_flow_header header = {};
5074 u_int32_t length = 0;
5075 u_int32_t flags = 0;
5076 u_int8_t tfo_cookie_len = 0;
5077 u_int8_t type = 0;
5078
5079 type = NECP_CLIENT_RESULT_FLOW_ID;
5080 length = sizeof(header.flow_header.flow_id);
5081 memcpy(&header.flow_header.flow_id_tlv_header.type, &type, sizeof(type));
5082 memcpy(&header.flow_header.flow_id_tlv_header.length, &length, sizeof(length));
5083 uuid_copy(header.flow_header.flow_id, flow_registration->registration_id);
5084
5085 if (flow->nexus) {
5086 if (flow->check_tcp_heuristics) {
5087 u_int8_t tfo_cookie[NECP_TFO_COOKIE_LEN_MAX];
5088 tfo_cookie_len = NECP_TFO_COOKIE_LEN_MAX;
5089
5090 if (necp_client_check_tcp_heuristics(client, flow, &flags,
5091 tfo_cookie, &tfo_cookie_len) != 0) {
5092 tfo_cookie_len = 0;
5093 } else {
5094 flow->check_tcp_heuristics = FALSE;
5095
5096 if (tfo_cookie_len != 0) {
5097 type = NECP_CLIENT_RESULT_TFO_COOKIE;
5098 length = tfo_cookie_len;
5099 memcpy(&header.tfo_cookie_tlv_header.type, &type, sizeof(type));
5100 memcpy(&header.tfo_cookie_tlv_header.length, &length, sizeof(length));
5101 memcpy(&header.tfo_cookie_value, tfo_cookie, tfo_cookie_len);
5102 }
5103 }
5104 }
5105 }
5106
5107 size_t header_length = 0;
5108 if (flow->nexus) {
5109 if (tfo_cookie_len != 0) {
5110 header_length = sizeof(struct necp_client_nexus_flow_header) - (NECP_TFO_COOKIE_LEN_MAX - tfo_cookie_len);
5111 } else {
5112 header_length = sizeof(struct necp_client_nexus_flow_header) - sizeof(struct necp_tlv_header) - NECP_TFO_COOKIE_LEN_MAX;
5113 }
5114 } else {
5115 header_length = sizeof(struct necp_client_flow_header);
5116 }
5117
5118 type = NECP_CLIENT_RESULT_FLAGS;
5119 length = sizeof(header.flow_header.flags_value);
5120 memcpy(&header.flow_header.flags_tlv_header.type, &type, sizeof(type));
5121 memcpy(&header.flow_header.flags_tlv_header.length, &length, sizeof(length));
5122 if (flow->assigned) {
5123 flags |= NECP_CLIENT_RESULT_FLAG_FLOW_ASSIGNED;
5124 }
5125 if (flow->viable) {
5126 flags |= NECP_CLIENT_RESULT_FLAG_FLOW_VIABLE;
5127 }
5128 if (flow_registration->defunct) {
5129 flags |= NECP_CLIENT_RESULT_FLAG_DEFUNCT;
5130 }
5131 flags |= flow->necp_flow_flags;
5132 memcpy(&header.flow_header.flags_value, &flags, sizeof(flags));
5133
5134 type = NECP_CLIENT_RESULT_INTERFACE;
5135 length = sizeof(header.flow_header.interface_value);
5136 memcpy(&header.flow_header.interface_tlv_header.type, &type, sizeof(type));
5137 memcpy(&header.flow_header.interface_tlv_header.length, &length, sizeof(length));
5138
5139 struct necp_client_result_interface interface_struct;
5140 interface_struct.generation = 0;
5141 interface_struct.index = flow->interface_index;
5142
5143 memcpy(&header.flow_header.interface_value, &interface_struct, sizeof(interface_struct));
5144 if (flow->nexus) {
5145 type = NECP_CLIENT_RESULT_NETAGENT;
5146 length = sizeof(header.agent_value);
5147 memcpy(&header.agent_tlv_header.type, &type, sizeof(type));
5148 memcpy(&header.agent_tlv_header.length, &length, sizeof(length));
5149
5150 struct necp_client_result_netagent agent_struct;
5151 agent_struct.generation = 0;
5152 uuid_copy(agent_struct.netagent_uuid, flow->u.nexus_agent);
5153
5154 memcpy(&header.agent_value, &agent_struct, sizeof(agent_struct));
5155 }
5156
5157 // Don't include outer TLV header in length field
5158 type = NECP_CLIENT_RESULT_FLOW;
5159 length = (header_length - sizeof(struct necp_tlv_header) + flow->assigned_results_length);
5160 if (flow->has_protoctl_event) {
5161 length += sizeof(struct necp_client_flow_protoctl_event_header);
5162 }
5163 memcpy(&header.flow_header.outer_header.type, &type, sizeof(type));
5164 memcpy(&header.flow_header.outer_header.length, &length, sizeof(length));
5165
5166 error = copyout(&header, uap->buffer + client->result_length + *assigned_results_cursor, header_length);
5167 if (error) {
5168 NECPLOG(LOG_ERR, "necp_client_copy assigned results tlv_header copyout error (%d)", error);
5169 return error;
5170 }
5171 *assigned_results_cursor += header_length;
5172
5173 if (flow->assigned_results && flow->assigned_results_length) {
5174 // Write inner TLVs
5175 error = copyout(flow->assigned_results, uap->buffer + client->result_length + *assigned_results_cursor,
5176 flow->assigned_results_length);
5177 if (error) {
5178 NECPLOG(LOG_ERR, "necp_client_copy assigned results copyout error (%d)", error);
5179 return error;
5180 }
5181 }
5182 *assigned_results_cursor += flow->assigned_results_length;
5183
5184 /* Read the protocol event and reset it */
5185 if (flow->has_protoctl_event) {
5186 struct necp_client_flow_protoctl_event_header protoctl_event_header = {};
5187
5188 type = NECP_CLIENT_RESULT_PROTO_CTL_EVENT;
5189 length = sizeof(protoctl_event_header.protoctl_event);
5190
5191 memcpy(&protoctl_event_header.protoctl_tlv_header.type, &type, sizeof(type));
5192 memcpy(&protoctl_event_header.protoctl_tlv_header.length, &length, sizeof(length));
5193 memcpy(&protoctl_event_header.protoctl_event, &flow->protoctl_event,
5194 sizeof(flow->protoctl_event));
5195
5196 error = copyout(&protoctl_event_header, uap->buffer + client->result_length + *assigned_results_cursor,
5197 sizeof(protoctl_event_header));
5198
5199 if (error) {
5200 NECPLOG(LOG_ERR, "necp_client_copy protocol control event results"
5201 " tlv_header copyout error (%d)", error);
5202 return error;
5203 }
5204 *assigned_results_cursor += sizeof(protoctl_event_header);
5205 flow->has_protoctl_event = FALSE;
5206 flow->protoctl_event.protoctl_event_code = 0;
5207 flow->protoctl_event.protoctl_event_val = 0;
5208 flow->protoctl_event.protoctl_event_tcp_seq_num = 0;
5209 }
5210 }
5211 }
5212 if (!client_is_observed) {
5213 flow_registration->flow_result_read = TRUE;
5214 }
5215 return 0;
5216 }
5217
5218 static int
5219 necp_client_copy_internal(struct necp_client *client, uuid_t client_id, bool client_is_observed, struct necp_client_action_args *uap, int *retval)
5220 {
5221 NECP_CLIENT_ASSERT_LOCKED(client);
5222 int error = 0;
5223 // Copy results out
5224 if (uap->action == NECP_CLIENT_ACTION_COPY_PARAMETERS) {
5225 if (uap->buffer_size < client->parameters_length) {
5226 return EINVAL;
5227 }
5228 error = copyout(client->parameters, uap->buffer, client->parameters_length);
5229 if (error) {
5230 NECPLOG(LOG_ERR, "necp_client_copy parameters copyout error (%d)", error);
5231 return error;
5232 }
5233 *retval = client->parameters_length;
5234 } else if (uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT &&
5235 client->result_read && !necp_client_has_unread_flows(client)) {
5236 // Copy updates only, but nothing to read
5237 // Just return 0 for bytes read
5238 *retval = 0;
5239 } else if (uap->action == NECP_CLIENT_ACTION_COPY_RESULT ||
5240 uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
5241 size_t assigned_results_size = 0;
5242
5243 bool some_flow_is_defunct = false;
5244 struct necp_client_flow_registration *single_flow_registration = NULL;
5245 if (necp_client_id_is_flow(client_id)) {
5246 single_flow_registration = necp_client_find_flow(client, client_id);
5247 if (single_flow_registration != NULL) {
5248 assigned_results_size += necp_client_calculate_flow_tlv_size(single_flow_registration);
5249 }
5250 } else {
5251 // This request is for the client, so copy everything
5252 struct necp_client_flow_registration *flow_registration = NULL;
5253 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
5254 if (flow_registration->defunct) {
5255 some_flow_is_defunct = true;
5256 }
5257 assigned_results_size += necp_client_calculate_flow_tlv_size(flow_registration);
5258 }
5259 }
5260 if (uap->buffer_size < (client->result_length + assigned_results_size)) {
5261 return EINVAL;
5262 }
5263
5264 u_int32_t original_flags = 0;
5265 bool flags_updated = false;
5266 if (some_flow_is_defunct && client->legacy_client_is_flow) {
5267 // If our client expects the defunct flag in the client, add it now
5268 u_int32_t client_flags = 0;
5269 u_int32_t value_size = 0;
5270 u_int8_t *flags_pointer = necp_buffer_get_tlv_value(client->result, 0, &value_size);
5271 if (flags_pointer != NULL && value_size == sizeof(client_flags)) {
5272 memcpy(&client_flags, flags_pointer, value_size);
5273 original_flags = client_flags;
5274 client_flags |= NECP_CLIENT_RESULT_FLAG_DEFUNCT;
5275 (void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS,
5276 sizeof(client_flags), &client_flags, &flags_updated,
5277 client->result, sizeof(client->result));
5278 }
5279 }
5280
5281 error = copyout(client->result, uap->buffer, client->result_length);
5282
5283 if (flags_updated) {
5284 // Revert stored flags
5285 (void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS,
5286 sizeof(original_flags), &original_flags, &flags_updated,
5287 client->result, sizeof(client->result));
5288 }
5289
5290 if (error) {
5291 NECPLOG(LOG_ERR, "necp_client_copy result copyout error (%d)", error);
5292 return error;
5293 }
5294
5295 size_t assigned_results_cursor = 0;
5296 if (necp_client_id_is_flow(client_id)) {
5297 if (single_flow_registration != NULL) {
5298 error = necp_client_fillout_flow_tlvs(client, client_is_observed, single_flow_registration, uap, &assigned_results_cursor);
5299 if (error != 0) {
5300 return error;
5301 }
5302 }
5303 } else {
5304 // This request is for the client, so copy everything
5305 struct necp_client_flow_registration *flow_registration = NULL;
5306 RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
5307 error = necp_client_fillout_flow_tlvs(client, client_is_observed, flow_registration, uap, &assigned_results_cursor);
5308 if (error != 0) {
5309 return error;
5310 }
5311 }
5312 }
5313
5314 *retval = client->result_length + assigned_results_cursor;
5315
5316 if (!client_is_observed) {
5317 client->result_read = TRUE;
5318 }
5319 }
5320
5321 return 0;
5322 }
5323
5324 static NECP_CLIENT_ACTION_FUNCTION int
5325 necp_client_copy(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
5326 {
5327 int error = 0;
5328 struct necp_client *client = NULL;
5329 uuid_t client_id;
5330 uuid_clear(client_id);
5331
5332 *retval = 0;
5333
5334 if (uap->buffer_size == 0 || uap->buffer == 0) {
5335 return EINVAL;
5336 }
5337
5338 if (uap->action != NECP_CLIENT_ACTION_COPY_PARAMETERS &&
5339 uap->action != NECP_CLIENT_ACTION_COPY_RESULT &&
5340 uap->action != NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
5341 return EINVAL;
5342 }
5343
5344 if (uap->client_id) {
5345 if (uap->client_id_len != sizeof(uuid_t)) {
5346 NECPLOG(LOG_ERR, "Incorrect length (got %zu, expected %zu)", (size_t)uap->client_id_len, sizeof(uuid_t));
5347 return ERANGE;
5348 }
5349
5350 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
5351 if (error) {
5352 NECPLOG(LOG_ERR, "necp_client_copy client_id copyin error (%d)", error);
5353 return error;
5354 }
5355 }
5356
5357 const bool is_wildcard = (bool)uuid_is_null(client_id);
5358
5359 NECP_FD_LOCK(fd_data);
5360
5361 if (is_wildcard) {
5362 if (uap->action == NECP_CLIENT_ACTION_COPY_RESULT || uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
5363 struct necp_client *find_client = NULL;
5364 RB_FOREACH(find_client, _necp_client_tree, &fd_data->clients) {
5365 NECP_CLIENT_LOCK(find_client);
5366 if (!find_client->result_read || necp_client_has_unread_flows(find_client)) {
5367 client = find_client;
5368 // Leave the client locked, and break
5369 break;
5370 }
5371 NECP_CLIENT_UNLOCK(find_client);
5372 }
5373 }
5374 } else {
5375 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
5376 }
5377
5378 if (client != NULL) {
5379 // If client is set, it is locked
5380 error = necp_client_copy_internal(client, client_id, FALSE, uap, retval);
5381 NECP_CLIENT_UNLOCK(client);
5382 }
5383
5384 // Unlock our own fd before moving on or returning
5385 NECP_FD_UNLOCK(fd_data);
5386
5387 if (client == NULL) {
5388 if (fd_data->flags & NECP_OPEN_FLAG_OBSERVER) {
5389 // Observers are allowed to lookup clients on other fds
5390
5391 // Lock tree
5392 NECP_CLIENT_TREE_LOCK_SHARED();
5393
5394 bool found_client = FALSE;
5395
5396 client = necp_find_client_and_lock(client_id);
5397 if (client != NULL) {
5398 // Matched, copy out data
5399 found_client = TRUE;
5400 error = necp_client_copy_internal(client, client_id, TRUE, uap, retval);
5401 NECP_CLIENT_UNLOCK(client);
5402 }
5403
5404 // Unlock tree
5405 NECP_CLIENT_TREE_UNLOCK();
5406
5407 // No client found, fail
5408 if (!found_client) {
5409 return ENOENT;
5410 }
5411 } else {
5412 // No client found, and not allowed to search other fds, fail
5413 return ENOENT;
5414 }
5415 }
5416
5417 return error;
5418 }
5419
5420 static NECP_CLIENT_ACTION_FUNCTION int
5421 necp_client_copy_client_update(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
5422 {
5423 int error = 0;
5424
5425 *retval = 0;
5426
5427 if (!(fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER)) {
5428 NECPLOG0(LOG_ERR, "NECP fd is not observer, cannot copy client update");
5429 return EINVAL;
5430 }
5431
5432 if (uap->client_id_len != sizeof(uuid_t) || uap->client_id == 0) {
5433 NECPLOG0(LOG_ERR, "Client id invalid, cannot copy client update");
5434 return EINVAL;
5435 }
5436
5437 if (uap->buffer_size == 0 || uap->buffer == 0) {
5438 NECPLOG0(LOG_ERR, "Buffer invalid, cannot copy client update");
5439 return EINVAL;
5440 }
5441
5442 NECP_FD_LOCK(fd_data);
5443 struct necp_client_update *client_update = TAILQ_FIRST(&fd_data->update_list);
5444 if (client_update != NULL) {
5445 TAILQ_REMOVE(&fd_data->update_list, client_update, chain);
5446 VERIFY(fd_data->update_count > 0);
5447 fd_data->update_count--;
5448 }
5449 NECP_FD_UNLOCK(fd_data);
5450
5451 if (client_update != NULL) {
5452 error = copyout(client_update->client_id, uap->client_id, sizeof(uuid_t));
5453 if (error) {
5454 NECPLOG(LOG_ERR, "Copy client update copyout client id error (%d)", error);
5455 } else {
5456 if (uap->buffer_size < client_update->update_length) {
5457 NECPLOG(LOG_ERR, "Buffer size cannot hold update (%zu < %zu)", (size_t)uap->buffer_size, client_update->update_length);
5458 error = EINVAL;
5459 } else {
5460 error = copyout(&client_update->update, uap->buffer, client_update->update_length);
5461 if (error) {
5462 NECPLOG(LOG_ERR, "Copy client update copyout error (%d)", error);
5463 } else {
5464 *retval = client_update->update_length;
5465 }
5466 }
5467 }
5468
5469 FREE(client_update, M_NECP);
5470 client_update = NULL;
5471 } else {
5472 error = ENOENT;
5473 }
5474
5475 return error;
5476 }
5477
5478 static int
5479 necp_client_copy_parameters_locked(struct necp_client *client,
5480 struct necp_client_nexus_parameters *parameters)
5481 {
5482 VERIFY(parameters != NULL);
5483
5484 struct necp_client_parsed_parameters parsed_parameters = {};
5485 int error = necp_client_parse_parameters(client->parameters, (u_int32_t)client->parameters_length, &parsed_parameters);
5486
5487 parameters->pid = client->proc_pid;
5488 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID) {
5489 parameters->epid = parsed_parameters.effective_pid;
5490 } else {
5491 parameters->epid = parameters->pid;
5492 }
5493 memcpy(&parameters->local_addr, &parsed_parameters.local_addr, sizeof(parameters->local_addr));
5494 memcpy(&parameters->remote_addr, &parsed_parameters.remote_addr, sizeof(parameters->remote_addr));
5495 parameters->ip_protocol = parsed_parameters.ip_protocol;
5496 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL) {
5497 parameters->transport_protocol = parsed_parameters.transport_protocol;
5498 } else {
5499 parameters->transport_protocol = parsed_parameters.ip_protocol;
5500 }
5501 parameters->ethertype = parsed_parameters.ethertype;
5502 parameters->traffic_class = parsed_parameters.traffic_class;
5503 if (uuid_is_null(client->override_euuid)) {
5504 uuid_copy(parameters->euuid, parsed_parameters.effective_uuid);
5505 } else {
5506 uuid_copy(parameters->euuid, client->override_euuid);
5507 }
5508 parameters->is_listener = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) ? 1 : 0;
5509 parameters->is_interpose = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) ? 1 : 0;
5510 parameters->is_custom_ether = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) ? 1 : 0;
5511 parameters->policy_id = client->policy_id;
5512
5513 // parse client result flag
5514 u_int32_t client_result_flags = 0;
5515 u_int32_t value_size = 0;
5516 u_int8_t *flags_pointer = NULL;
5517 flags_pointer = necp_buffer_get_tlv_value(client->result, 0, &value_size);
5518 if (flags_pointer && value_size == sizeof(client_result_flags)) {
5519 memcpy(&client_result_flags, flags_pointer, value_size);
5520 }
5521 parameters->allow_qos_marking = (client_result_flags & NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING) ? 1 : 0;
5522
5523 if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE) {
5524 if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_DEFAULT) {
5525 parameters->override_address_selection = false;
5526 } else if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_TEMPORARY) {
5527 parameters->override_address_selection = true;
5528 parameters->use_stable_address = false;
5529 } else if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_STABLE) {
5530 parameters->override_address_selection = true;
5531 parameters->use_stable_address = true;
5532 }
5533 } else {
5534 parameters->override_address_selection = false;
5535 }
5536
5537 return error;
5538 }
5539
5540 static NECP_CLIENT_ACTION_FUNCTION int
5541 necp_client_list(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
5542 {
5543 int error = 0;
5544 struct necp_client *find_client = NULL;
5545 uuid_t *list = NULL;
5546 u_int32_t requested_client_count = 0;
5547 u_int32_t client_count = 0;
5548 size_t copy_buffer_size = 0;
5549
5550 if (uap->buffer_size < sizeof(requested_client_count) || uap->buffer == 0) {
5551 error = EINVAL;
5552 goto done;
5553 }
5554
5555 if (!(fd_data->flags & NECP_OPEN_FLAG_OBSERVER)) {
5556 NECPLOG0(LOG_ERR, "Client does not hold necessary entitlement to list other NECP clients");
5557 error = EACCES;
5558 goto done;
5559 }
5560
5561 error = copyin(uap->buffer, &requested_client_count, sizeof(requested_client_count));
5562 if (error) {
5563 goto done;
5564 }
5565
5566 if (os_mul_overflow(sizeof(uuid_t), requested_client_count, &copy_buffer_size)) {
5567 error = ERANGE;
5568 goto done;
5569 }
5570
5571 if (uap->buffer_size - sizeof(requested_client_count) != copy_buffer_size) {
5572 error = EINVAL;
5573 goto done;
5574 }
5575
5576 if (copy_buffer_size > NECP_MAX_CLIENT_LIST_SIZE) {
5577 error = EINVAL;
5578 goto done;
5579 }
5580
5581 if (requested_client_count > 0) {
5582 if ((list = _MALLOC(copy_buffer_size, M_NECP, M_WAITOK | M_ZERO)) == NULL) {
5583 error = ENOMEM;
5584 goto done;
5585 }
5586 }
5587
5588 // Lock tree
5589 NECP_CLIENT_TREE_LOCK_SHARED();
5590
5591 find_client = NULL;
5592 RB_FOREACH(find_client, _necp_client_global_tree, &necp_client_global_tree) {
5593 NECP_CLIENT_LOCK(find_client);
5594 if (!uuid_is_null(find_client->client_id)) {
5595 if (client_count < requested_client_count) {
5596 uuid_copy(list[client_count], find_client->client_id);
5597 }
5598 client_count++;
5599 }
5600 NECP_CLIENT_UNLOCK(find_client);
5601 }
5602
5603 // Unlock tree
5604 NECP_CLIENT_TREE_UNLOCK();
5605
5606 error = copyout(&client_count, uap->buffer, sizeof(client_count));
5607 if (error) {
5608 NECPLOG(LOG_ERR, "necp_client_list buffer copyout error (%d)", error);
5609 goto done;
5610 }
5611
5612 if (requested_client_count > 0 &&
5613 client_count > 0 &&
5614 list != NULL) {
5615 error = copyout(list, uap->buffer + sizeof(client_count), copy_buffer_size);
5616 if (error) {
5617 NECPLOG(LOG_ERR, "necp_client_list client count copyout error (%d)", error);
5618 goto done;
5619 }
5620 }
5621 done:
5622 if (list != NULL) {
5623 FREE(list, M_NECP);
5624 }
5625 *retval = error;
5626
5627 return error;
5628 }
5629
5630 static NECP_CLIENT_ACTION_FUNCTION int
5631 necp_client_add_flow(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
5632 {
5633 int error = 0;
5634 struct necp_client *client = NULL;
5635 uuid_t client_id;
5636 struct necp_client_nexus_parameters parameters = {};
5637 struct proc *proc = PROC_NULL;
5638 struct necp_client_add_flow *add_request = NULL;
5639 struct necp_client_add_flow *allocated_add_request = NULL;
5640 struct necp_client_add_flow_default default_add_request = {};
5641 const size_t buffer_size = uap->buffer_size;
5642
5643 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
5644 error = EINVAL;
5645 NECPLOG(LOG_ERR, "necp_client_add_flow invalid client_id (length %zu)", (size_t)uap->client_id_len);
5646 goto done;
5647 }
5648
5649 if (uap->buffer == 0 || buffer_size < sizeof(struct necp_client_add_flow) ||
5650 buffer_size > sizeof(struct necp_client_add_flow_default) * 4) {
5651 error = EINVAL;
5652 NECPLOG(LOG_ERR, "necp_client_add_flow invalid buffer (length %zu)", buffer_size);
5653 goto done;
5654 }
5655
5656 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
5657 if (error) {
5658 NECPLOG(LOG_ERR, "necp_client_add_flow copyin client_id error (%d)", error);
5659 goto done;
5660 }
5661
5662 if (buffer_size <= sizeof(struct necp_client_add_flow_default)) {
5663 // Fits in default size
5664 error = copyin(uap->buffer, &default_add_request, buffer_size);
5665 if (error) {
5666 NECPLOG(LOG_ERR, "necp_client_add_flow copyin default_add_request error (%d)", error);
5667 goto done;
5668 }
5669
5670 add_request = (struct necp_client_add_flow *)&default_add_request;
5671 } else {
5672 allocated_add_request = _MALLOC(buffer_size, M_NECP, M_WAITOK | M_ZERO);
5673 if (allocated_add_request == NULL) {
5674 error = ENOMEM;
5675 goto done;
5676 }
5677
5678 error = copyin(uap->buffer, allocated_add_request, buffer_size);
5679 if (error) {
5680 NECPLOG(LOG_ERR, "necp_client_add_flow copyin default_add_request error (%d)", error);
5681 goto done;
5682 }
5683
5684 add_request = (struct necp_client_add_flow *)allocated_add_request;
5685 }
5686
5687 NECP_FD_LOCK(fd_data);
5688 pid_t pid = fd_data->proc_pid;
5689 proc = proc_find(pid);
5690 if (proc == PROC_NULL) {
5691 NECP_FD_UNLOCK(fd_data);
5692 NECPLOG(LOG_ERR, "necp_client_add_flow process not found for pid %d error (%d)", pid, error);
5693 error = ESRCH;
5694 goto done;
5695 }
5696
5697 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
5698 if (client == NULL) {
5699 error = ENOENT;
5700 NECP_FD_UNLOCK(fd_data);
5701 goto done;
5702 }
5703
5704 // Using ADD_FLOW indicates that the client supports multiple flows per client
5705 client->legacy_client_is_flow = false;
5706
5707 necp_client_retain_locked(client);
5708 necp_client_copy_parameters_locked(client, &parameters);
5709
5710 struct necp_client_flow_registration *new_registration = necp_client_create_flow_registration(fd_data, client);
5711 if (new_registration == NULL) {
5712 error = ENOMEM;
5713 NECP_CLIENT_UNLOCK(client);
5714 NECP_FD_UNLOCK(fd_data);
5715 NECPLOG0(LOG_ERR, "Failed to allocate flow registration");
5716 goto done;
5717 }
5718
5719 new_registration->flags = add_request->flags;
5720
5721 // Copy new ID out to caller
5722 uuid_copy(add_request->registration_id, new_registration->registration_id);
5723
5724 // Copy override address
5725 if (add_request->flags & NECP_CLIENT_FLOW_FLAGS_OVERRIDE_ADDRESS) {
5726 size_t offset_of_address = (sizeof(struct necp_client_add_flow) +
5727 add_request->stats_request_count * sizeof(struct necp_client_flow_stats));
5728 if (buffer_size >= offset_of_address + sizeof(struct sockaddr_in)) {
5729 struct sockaddr *override_address = (struct sockaddr *)(((uint8_t *)add_request) + offset_of_address);
5730 if (buffer_size >= offset_of_address + override_address->sa_len &&
5731 override_address->sa_len <= sizeof(parameters.remote_addr)) {
5732 memcpy(&parameters.remote_addr, override_address, override_address->sa_len);
5733 }
5734 }
5735 }
5736
5737
5738 if (error == 0 &&
5739 (add_request->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE ||
5740 add_request->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) {
5741 uint32_t interface_index = IFSCOPE_NONE;
5742 ifnet_head_lock_shared();
5743 struct ifnet *interface = NULL;
5744 TAILQ_FOREACH(interface, &ifnet_head, if_link) {
5745 ifnet_lock_shared(interface);
5746 if (interface->if_agentids != NULL) {
5747 for (u_int32_t i = 0; i < interface->if_agentcount; i++) {
5748 if (uuid_compare(interface->if_agentids[i], add_request->agent_uuid) == 0) {
5749 interface_index = interface->if_index;
5750 break;
5751 }
5752 }
5753 }
5754 ifnet_lock_done(interface);
5755 if (interface_index != IFSCOPE_NONE) {
5756 break;
5757 }
5758 }
5759 ifnet_head_done();
5760
5761 necp_client_add_nexus_flow_if_needed(new_registration, add_request->agent_uuid, interface_index);
5762
5763 error = netagent_client_message_with_params(add_request->agent_uuid,
5764 ((new_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
5765 client->client_id :
5766 new_registration->registration_id),
5767 pid, client->agent_handle,
5768 NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT,
5769 (struct necp_client_agent_parameters *)&parameters,
5770 NULL, NULL);
5771 if (error != 0) {
5772 NECPLOG(LOG_ERR, "netagent_client_message error (%d)", error);
5773 }
5774 }
5775
5776 if (error != 0) {
5777 // Encountered an error in adding the flow, destroy the flow registration
5778 NECP_FLOW_TREE_LOCK_EXCLUSIVE();
5779 RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, new_registration);
5780 NECP_FLOW_TREE_UNLOCK();
5781 RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, new_registration);
5782 necp_destroy_client_flow_registration(client, new_registration, fd_data->proc_pid, true);
5783 new_registration = NULL;
5784 }
5785
5786 NECP_CLIENT_UNLOCK(client);
5787 NECP_FD_UNLOCK(fd_data);
5788
5789 necp_client_release(client);
5790
5791 if (error != 0) {
5792 goto done;
5793 }
5794
5795 // Copy the request back out to the caller with assigned fields
5796 error = copyout(add_request, uap->buffer, buffer_size);
5797 if (error != 0) {
5798 NECPLOG(LOG_ERR, "necp_client_add_flow copyout add_request error (%d)", error);
5799 }
5800
5801 done:
5802 *retval = error;
5803 if (error != 0) {
5804 NECPLOG(LOG_ERR, "Add flow error (%d)", error);
5805 }
5806
5807 if (allocated_add_request != NULL) {
5808 FREE(allocated_add_request, M_NECP);
5809 }
5810
5811 if (proc != PROC_NULL) {
5812 proc_rele(proc);
5813 }
5814 return error;
5815 }
5816
5817
5818 static void
5819 necp_client_add_assertion(struct necp_client *client, uuid_t netagent_uuid)
5820 {
5821 struct necp_client_assertion *new_assertion = NULL;
5822
5823 MALLOC(new_assertion, struct necp_client_assertion *, sizeof(*new_assertion), M_NECP, M_WAITOK);
5824 if (new_assertion == NULL) {
5825 NECPLOG0(LOG_ERR, "Failed to allocate assertion");
5826 return;
5827 }
5828
5829 uuid_copy(new_assertion->asserted_netagent, netagent_uuid);
5830
5831 LIST_INSERT_HEAD(&client->assertion_list, new_assertion, assertion_chain);
5832 }
5833
5834 static bool
5835 necp_client_remove_assertion(struct necp_client *client, uuid_t netagent_uuid)
5836 {
5837 struct necp_client_assertion *found_assertion = NULL;
5838 struct necp_client_assertion *search_assertion = NULL;
5839 LIST_FOREACH(search_assertion, &client->assertion_list, assertion_chain) {
5840 if (uuid_compare(search_assertion->asserted_netagent, netagent_uuid) == 0) {
5841 found_assertion = search_assertion;
5842 break;
5843 }
5844 }
5845
5846 if (found_assertion == NULL) {
5847 NECPLOG0(LOG_ERR, "Netagent uuid not previously asserted");
5848 return false;
5849 }
5850
5851 LIST_REMOVE(found_assertion, assertion_chain);
5852 FREE(found_assertion, M_NECP);
5853 return true;
5854 }
5855
5856 static NECP_CLIENT_ACTION_FUNCTION int
5857 necp_client_agent_action(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
5858 {
5859 int error = 0;
5860 struct necp_client *client = NULL;
5861 uuid_t client_id;
5862 bool acted_on_agent = FALSE;
5863 u_int8_t *parameters = NULL;
5864 const size_t buffer_size = uap->buffer_size;
5865
5866 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
5867 buffer_size == 0 || uap->buffer == 0) {
5868 NECPLOG0(LOG_ERR, "necp_client_agent_action invalid parameters");
5869 error = EINVAL;
5870 goto done;
5871 }
5872
5873 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
5874 if (error) {
5875 NECPLOG(LOG_ERR, "necp_client_agent_action copyin client_id error (%d)", error);
5876 goto done;
5877 }
5878
5879 if (buffer_size > NECP_MAX_AGENT_ACTION_SIZE) {
5880 NECPLOG(LOG_ERR, "necp_client_agent_action invalid buffer size (>%u)", NECP_MAX_AGENT_ACTION_SIZE);
5881 error = EINVAL;
5882 goto done;
5883 }
5884
5885 if ((parameters = _MALLOC(buffer_size, M_NECP, M_WAITOK | M_ZERO)) == NULL) {
5886 NECPLOG0(LOG_ERR, "necp_client_agent_action malloc failed");
5887 error = ENOMEM;
5888 goto done;
5889 }
5890
5891 error = copyin(uap->buffer, parameters, buffer_size);
5892 if (error) {
5893 NECPLOG(LOG_ERR, "necp_client_agent_action parameters copyin error (%d)", error);
5894 goto done;
5895 }
5896
5897 NECP_FD_LOCK(fd_data);
5898 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
5899 if (client != NULL) {
5900 size_t offset = 0;
5901 while ((offset + sizeof(struct necp_tlv_header)) <= buffer_size) {
5902 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
5903 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
5904
5905 if (length > (buffer_size - (offset + sizeof(struct necp_tlv_header)))) {
5906 // If the length is larger than what can fit in the remaining parameters size, bail
5907 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
5908 break;
5909 }
5910
5911 if (length > 0) {
5912 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
5913 if (length >= sizeof(uuid_t) &&
5914 value != NULL &&
5915 (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT ||
5916 type == NECP_CLIENT_PARAMETER_ASSERT_AGENT ||
5917 type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT)) {
5918 uuid_t agent_uuid;
5919 uuid_copy(agent_uuid, value);
5920 u_int8_t netagent_message_type = 0;
5921 if (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT) {
5922 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_TRIGGER;
5923 } else if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
5924 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT;
5925 } else if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
5926 netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
5927 }
5928
5929 // Before unasserting, verify that the assertion was already taken
5930 if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
5931 if (!necp_client_remove_assertion(client, agent_uuid)) {
5932 error = ENOENT;
5933 break;
5934 }
5935 }
5936
5937 struct necp_client_nexus_parameters parsed_parameters = {};
5938 necp_client_copy_parameters_locked(client, &parsed_parameters);
5939
5940 error = netagent_client_message_with_params(agent_uuid,
5941 client_id,
5942 fd_data->proc_pid,
5943 client->agent_handle,
5944 netagent_message_type,
5945 (struct necp_client_agent_parameters *)&parsed_parameters,
5946 NULL, NULL);
5947 if (error == 0) {
5948 acted_on_agent = TRUE;
5949 } else {
5950 break;
5951 }
5952
5953 // Only save the assertion if the action succeeded
5954 if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
5955 necp_client_add_assertion(client, agent_uuid);
5956 }
5957 }
5958 }
5959
5960 offset += sizeof(struct necp_tlv_header) + length;
5961 }
5962
5963 NECP_CLIENT_UNLOCK(client);
5964 }
5965 NECP_FD_UNLOCK(fd_data);
5966
5967 if (!acted_on_agent &&
5968 error == 0) {
5969 error = ENOENT;
5970 }
5971 done:
5972 *retval = error;
5973 if (parameters != NULL) {
5974 FREE(parameters, M_NECP);
5975 parameters = NULL;
5976 }
5977
5978 return error;
5979 }
5980
5981 static NECP_CLIENT_ACTION_FUNCTION int
5982 necp_client_copy_agent(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
5983 {
5984 int error = 0;
5985 uuid_t agent_uuid;
5986 const size_t buffer_size = uap->buffer_size;
5987
5988 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
5989 buffer_size == 0 || uap->buffer == 0) {
5990 NECPLOG0(LOG_ERR, "necp_client_copy_agent bad input");
5991 error = EINVAL;
5992 goto done;
5993 }
5994
5995 error = copyin(uap->client_id, agent_uuid, sizeof(uuid_t));
5996 if (error) {
5997 NECPLOG(LOG_ERR, "necp_client_copy_agent copyin agent_uuid error (%d)", error);
5998 goto done;
5999 }
6000
6001 error = netagent_copyout(agent_uuid, uap->buffer, buffer_size);
6002 if (error) {
6003 // netagent_copyout already logs appropriate errors
6004 goto done;
6005 }
6006 done:
6007 *retval = error;
6008
6009 return error;
6010 }
6011
6012 static NECP_CLIENT_ACTION_FUNCTION int
6013 necp_client_agent_use(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
6014 {
6015 int error = 0;
6016 struct necp_client *client = NULL;
6017 uuid_t client_id;
6018 struct necp_agent_use_parameters parameters = {};
6019 const size_t buffer_size = uap->buffer_size;
6020
6021 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
6022 buffer_size != sizeof(parameters) || uap->buffer == 0) {
6023 error = EINVAL;
6024 goto done;
6025 }
6026
6027 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
6028 if (error) {
6029 NECPLOG(LOG_ERR, "Copyin client_id error (%d)", error);
6030 goto done;
6031 }
6032
6033 error = copyin(uap->buffer, &parameters, buffer_size);
6034 if (error) {
6035 NECPLOG(LOG_ERR, "Parameters copyin error (%d)", error);
6036 goto done;
6037 }
6038
6039 NECP_FD_LOCK(fd_data);
6040 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
6041 if (client != NULL) {
6042 error = netagent_use(parameters.agent_uuid, &parameters.out_use_count);
6043 NECP_CLIENT_UNLOCK(client);
6044 } else {
6045 error = ENOENT;
6046 }
6047
6048 NECP_FD_UNLOCK(fd_data);
6049
6050 if (error == 0) {
6051 error = copyout(&parameters, uap->buffer, buffer_size);
6052 if (error) {
6053 NECPLOG(LOG_ERR, "Parameters copyout error (%d)", error);
6054 goto done;
6055 }
6056 }
6057
6058 done:
6059 *retval = error;
6060
6061 return error;
6062 }
6063
6064 static NECP_CLIENT_ACTION_FUNCTION int
6065 necp_client_copy_interface(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
6066 {
6067 int error = 0;
6068 u_int32_t interface_index = 0;
6069 struct necp_interface_details interface_details = {};
6070
6071 if (uap->client_id == 0 || uap->client_id_len != sizeof(u_int32_t) ||
6072 uap->buffer_size < sizeof(interface_details) ||
6073 uap->buffer == 0) {
6074 NECPLOG0(LOG_ERR, "necp_client_copy_interface bad input");
6075 error = EINVAL;
6076 goto done;
6077 }
6078
6079 error = copyin(uap->client_id, &interface_index, sizeof(u_int32_t));
6080 if (error) {
6081 NECPLOG(LOG_ERR, "necp_client_copy_interface copyin interface_index error (%d)", error);
6082 goto done;
6083 }
6084
6085 if (interface_index == 0) {
6086 error = ENOENT;
6087 NECPLOG(LOG_ERR, "necp_client_copy_interface bad interface_index (%d)", interface_index);
6088 goto done;
6089 }
6090
6091 lck_mtx_lock(rnh_lock);
6092 ifnet_head_lock_shared();
6093 ifnet_t interface = NULL;
6094 if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
6095 interface = ifindex2ifnet[interface_index];
6096 }
6097
6098 if (interface != NULL) {
6099 if (interface->if_xname != NULL) {
6100 strlcpy((char *)&interface_details.name, interface->if_xname, sizeof(interface_details.name));
6101 }
6102 interface_details.index = interface->if_index;
6103 interface_details.generation = ifnet_get_generation(interface);
6104 if (interface->if_delegated.ifp != NULL) {
6105 interface_details.delegate_index = interface->if_delegated.ifp->if_index;
6106 }
6107 interface_details.functional_type = if_functional_type(interface, TRUE);
6108 if (IFNET_IS_EXPENSIVE(interface)) {
6109 interface_details.flags |= NECP_INTERFACE_FLAG_EXPENSIVE;
6110 }
6111 if (IFNET_IS_CONSTRAINED(interface)) {
6112 interface_details.flags |= NECP_INTERFACE_FLAG_CONSTRAINED;
6113 }
6114 if ((interface->if_eflags & IFEF_TXSTART) == IFEF_TXSTART) {
6115 interface_details.flags |= NECP_INTERFACE_FLAG_TXSTART;
6116 }
6117 if ((interface->if_eflags & IFEF_NOACKPRI) == IFEF_NOACKPRI) {
6118 interface_details.flags |= NECP_INTERFACE_FLAG_NOACKPRI;
6119 }
6120 if ((interface->if_eflags & IFEF_3CA) == IFEF_3CA) {
6121 interface_details.flags |= NECP_INTERFACE_FLAG_3CARRIERAGG;
6122 }
6123 if (IFNET_IS_LOW_POWER(interface)) {
6124 interface_details.flags |= NECP_INTERFACE_FLAG_IS_LOW_POWER;
6125 }
6126 if (interface->if_xflags & IFXF_MPK_LOG) {
6127 interface_details.flags |= NECP_INTERFACE_FLAG_MPK_LOG;
6128 }
6129 if (interface->if_flags & IFF_MULTICAST) {
6130 interface_details.flags |= NECP_INTERFACE_FLAG_SUPPORTS_MULTICAST;
6131 }
6132 if (IS_INTF_CLAT46(interface)) {
6133 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_NAT64;
6134 }
6135 interface_details.mtu = interface->if_mtu;
6136
6137 u_int8_t ipv4_signature_len = sizeof(interface_details.ipv4_signature.signature);
6138 u_int16_t ipv4_signature_flags;
6139 if (ifnet_get_netsignature(interface, AF_INET, &ipv4_signature_len, &ipv4_signature_flags,
6140 (u_int8_t *)&interface_details.ipv4_signature) != 0) {
6141 ipv4_signature_len = 0;
6142 }
6143 interface_details.ipv4_signature.signature_len = ipv4_signature_len;
6144
6145 // Check for default scoped routes for IPv4 and IPv6
6146 union necp_sockaddr_union default_address;
6147 struct rtentry *v4Route = NULL;
6148 memset(&default_address, 0, sizeof(default_address));
6149 default_address.sa.sa_family = AF_INET;
6150 default_address.sa.sa_len = sizeof(struct sockaddr_in);
6151 v4Route = rtalloc1_scoped_locked((struct sockaddr *)&default_address, 0, 0,
6152 interface->if_index);
6153 if (v4Route != NULL) {
6154 if (v4Route->rt_ifp != NULL && !IS_INTF_CLAT46(v4Route->rt_ifp)) {
6155 interface_details.flags |= NECP_INTERFACE_FLAG_IPV4_ROUTABLE;
6156 }
6157 rtfree_locked(v4Route);
6158 v4Route = NULL;
6159 }
6160
6161 struct rtentry *v6Route = NULL;
6162 memset(&default_address, 0, sizeof(default_address));
6163 default_address.sa.sa_family = AF_INET6;
6164 default_address.sa.sa_len = sizeof(struct sockaddr_in6);
6165 v6Route = rtalloc1_scoped_locked((struct sockaddr *)&default_address, 0, 0,
6166 interface->if_index);
6167 if (v6Route != NULL) {
6168 if (v6Route->rt_ifp != NULL) {
6169 interface_details.flags |= NECP_INTERFACE_FLAG_IPV6_ROUTABLE;
6170 }
6171 rtfree_locked(v6Route);
6172 v6Route = NULL;
6173 }
6174
6175 u_int8_t ipv6_signature_len = sizeof(interface_details.ipv6_signature.signature);
6176 u_int16_t ipv6_signature_flags;
6177 if (ifnet_get_netsignature(interface, AF_INET6, &ipv6_signature_len, &ipv6_signature_flags,
6178 (u_int8_t *)&interface_details.ipv6_signature) != 0) {
6179 ipv6_signature_len = 0;
6180 }
6181 interface_details.ipv6_signature.signature_len = ipv6_signature_len;
6182
6183 ifnet_lock_shared(interface);
6184 struct ifaddr *ifa = NULL;
6185 TAILQ_FOREACH(ifa, &interface->if_addrhead, ifa_link) {
6186 IFA_LOCK(ifa);
6187 if (ifa->ifa_addr->sa_family == AF_INET) {
6188 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_NETMASK;
6189 interface_details.ipv4_netmask = ((struct in_ifaddr *)ifa)->ia_sockmask.sin_addr.s_addr;
6190 if (interface->if_flags & IFF_BROADCAST) {
6191 interface_details.flags |= NECP_INTERFACE_FLAG_HAS_BROADCAST;
6192 interface_details.ipv4_broadcast = ((struct in_ifaddr *)ifa)->ia_broadaddr.sin_addr.s_addr;
6193 }
6194 }
6195 IFA_UNLOCK(ifa);
6196 }
6197 ifnet_lock_done(interface);
6198 }
6199
6200 ifnet_head_done();
6201 lck_mtx_unlock(rnh_lock);
6202
6203 // If the client is using an older version of the struct, copy that length
6204 error = copyout(&interface_details, uap->buffer, sizeof(interface_details));
6205 if (error) {
6206 NECPLOG(LOG_ERR, "necp_client_copy_interface copyout error (%d)", error);
6207 goto done;
6208 }
6209 done:
6210 *retval = error;
6211
6212 return error;
6213 }
6214
6215
6216 static NECP_CLIENT_ACTION_FUNCTION int
6217 necp_client_copy_route_statistics(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
6218 {
6219 int error = 0;
6220 struct necp_client *client = NULL;
6221 uuid_t client_id;
6222
6223 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
6224 uap->buffer_size < sizeof(struct necp_stat_counts) || uap->buffer == 0) {
6225 NECPLOG0(LOG_ERR, "necp_client_copy_route_statistics bad input");
6226 error = EINVAL;
6227 goto done;
6228 }
6229
6230 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
6231 if (error) {
6232 NECPLOG(LOG_ERR, "necp_client_copy_route_statistics copyin client_id error (%d)", error);
6233 goto done;
6234 }
6235
6236 // Lock
6237 NECP_FD_LOCK(fd_data);
6238 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
6239 if (client != NULL) {
6240 NECP_CLIENT_ROUTE_LOCK(client);
6241 struct necp_stat_counts route_stats = {};
6242 if (client->current_route != NULL && client->current_route->rt_stats != NULL) {
6243 struct nstat_counts *rt_stats = client->current_route->rt_stats;
6244 atomic_get_64(route_stats.necp_stat_rxpackets, &rt_stats->nstat_rxpackets);
6245 atomic_get_64(route_stats.necp_stat_rxbytes, &rt_stats->nstat_rxbytes);
6246 atomic_get_64(route_stats.necp_stat_txpackets, &rt_stats->nstat_txpackets);
6247 atomic_get_64(route_stats.necp_stat_txbytes, &rt_stats->nstat_txbytes);
6248 route_stats.necp_stat_rxduplicatebytes = rt_stats->nstat_rxduplicatebytes;
6249 route_stats.necp_stat_rxoutoforderbytes = rt_stats->nstat_rxoutoforderbytes;
6250 route_stats.necp_stat_txretransmit = rt_stats->nstat_txretransmit;
6251 route_stats.necp_stat_connectattempts = rt_stats->nstat_connectattempts;
6252 route_stats.necp_stat_connectsuccesses = rt_stats->nstat_connectsuccesses;
6253 route_stats.necp_stat_min_rtt = rt_stats->nstat_min_rtt;
6254 route_stats.necp_stat_avg_rtt = rt_stats->nstat_avg_rtt;
6255 route_stats.necp_stat_var_rtt = rt_stats->nstat_var_rtt;
6256 route_stats.necp_stat_route_flags = client->current_route->rt_flags;
6257 }
6258
6259 // Unlock before copying out
6260 NECP_CLIENT_ROUTE_UNLOCK(client);
6261 NECP_CLIENT_UNLOCK(client);
6262 NECP_FD_UNLOCK(fd_data);
6263
6264 error = copyout(&route_stats, uap->buffer, sizeof(route_stats));
6265 if (error) {
6266 NECPLOG(LOG_ERR, "necp_client_copy_route_statistics copyout error (%d)", error);
6267 }
6268 } else {
6269 // Unlock
6270 NECP_FD_UNLOCK(fd_data);
6271 error = ENOENT;
6272 }
6273
6274
6275 done:
6276 *retval = error;
6277 return error;
6278 }
6279
6280 static NECP_CLIENT_ACTION_FUNCTION int
6281 necp_client_update_cache(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
6282 {
6283 int error = 0;
6284 struct necp_client *client = NULL;
6285 uuid_t client_id;
6286
6287 if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
6288 error = EINVAL;
6289 goto done;
6290 }
6291
6292 error = copyin(uap->client_id, client_id, sizeof(uuid_t));
6293 if (error) {
6294 NECPLOG(LOG_ERR, "necp_client_update_cache copyin client_id error (%d)", error);
6295 goto done;
6296 }
6297
6298 NECP_FD_LOCK(fd_data);
6299 client = necp_client_fd_find_client_and_lock(fd_data, client_id);
6300 if (client == NULL) {
6301 NECP_FD_UNLOCK(fd_data);
6302 error = ENOENT;
6303 goto done;
6304 }
6305
6306 struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
6307 if (flow_registration == NULL) {
6308 NECP_CLIENT_UNLOCK(client);
6309 NECP_FD_UNLOCK(fd_data);
6310 error = ENOENT;
6311 goto done;
6312 }
6313
6314 NECP_CLIENT_ROUTE_LOCK(client);
6315 // This needs to be changed when TFO/ECN is supported by multiple flows
6316 struct necp_client_flow *flow = LIST_FIRST(&flow_registration->flow_list);
6317 if (flow == NULL ||
6318 (flow->remote_addr.sa.sa_family != AF_INET &&
6319 flow->remote_addr.sa.sa_family != AF_INET6) ||
6320 (flow->local_addr.sa.sa_family != AF_INET &&
6321 flow->local_addr.sa.sa_family != AF_INET6)) {
6322 error = EINVAL;
6323 NECPLOG(LOG_ERR, "necp_client_update_cache no flow error (%d)", error);
6324 goto done_unlock;
6325 }
6326
6327 necp_cache_buffer cache_buffer;
6328 memset(&cache_buffer, 0, sizeof(cache_buffer));
6329
6330 if (uap->buffer_size != sizeof(necp_cache_buffer) ||
6331 uap->buffer == USER_ADDR_NULL) {
6332 error = EINVAL;
6333 goto done_unlock;
6334 }
6335
6336 error = copyin(uap->buffer, &cache_buffer, sizeof(cache_buffer));
6337 if (error) {
6338 NECPLOG(LOG_ERR, "necp_client_update_cache copyin cache buffer error (%d)", error);
6339 goto done_unlock;
6340 }
6341
6342 if (cache_buffer.necp_cache_buf_type == NECP_CLIENT_CACHE_TYPE_ECN &&
6343 cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_ECN_VER_1) {
6344 if (cache_buffer.necp_cache_buf_size != sizeof(necp_tcp_ecn_cache) ||
6345 cache_buffer.necp_cache_buf_addr == USER_ADDR_NULL) {
6346 error = EINVAL;
6347 goto done_unlock;
6348 }
6349
6350 necp_tcp_ecn_cache ecn_cache_buffer;
6351 memset(&ecn_cache_buffer, 0, sizeof(ecn_cache_buffer));
6352
6353 error = copyin(cache_buffer.necp_cache_buf_addr, &ecn_cache_buffer, sizeof(necp_tcp_ecn_cache));
6354 if (error) {
6355 NECPLOG(LOG_ERR, "necp_client_update_cache copyin ecn cache buffer error (%d)", error);
6356 goto done_unlock;
6357 }
6358
6359 if (client->current_route != NULL && client->current_route->rt_ifp != NULL) {
6360 if (!client->platform_binary) {
6361 ecn_cache_buffer.necp_tcp_ecn_heuristics_success = 0;
6362 }
6363 tcp_heuristics_ecn_update(&ecn_cache_buffer, client->current_route->rt_ifp,
6364 (union sockaddr_in_4_6 *)&flow->local_addr);
6365 }
6366 } else if (cache_buffer.necp_cache_buf_type == NECP_CLIENT_CACHE_TYPE_TFO &&
6367 cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_TFO_VER_1) {
6368 if (cache_buffer.necp_cache_buf_size != sizeof(necp_tcp_tfo_cache) ||
6369 cache_buffer.necp_cache_buf_addr == USER_ADDR_NULL) {
6370 error = EINVAL;
6371 goto done_unlock;
6372 }
6373
6374 necp_tcp_tfo_cache tfo_cache_buffer;
6375 memset(&tfo_cache_buffer, 0, sizeof(tfo_cache_buffer));
6376
6377 error = copyin(cache_buffer.necp_cache_buf_addr, &tfo_cache_buffer, sizeof(necp_tcp_tfo_cache));
6378 if (error) {
6379 NECPLOG(LOG_ERR, "necp_client_update_cache copyin tfo cache buffer error (%d)", error);
6380 goto done_unlock;
6381 }
6382
6383 if (client->current_route != NULL && client->current_route->rt_ifp != NULL) {
6384 if (!client->platform_binary) {
6385 tfo_cache_buffer.necp_tcp_tfo_heuristics_success = 0;
6386 }
6387 tcp_heuristics_tfo_update(&tfo_cache_buffer, client->current_route->rt_ifp,
6388 (union sockaddr_in_4_6 *)&flow->local_addr,
6389 (union sockaddr_in_4_6 *)&flow->remote_addr);
6390 }
6391 } else {
6392 error = EINVAL;
6393 }
6394 done_unlock:
6395 NECP_CLIENT_ROUTE_UNLOCK(client);
6396 NECP_CLIENT_UNLOCK(client);
6397 NECP_FD_UNLOCK(fd_data);
6398 done:
6399 *retval = error;
6400 return error;
6401 }
6402
6403 #define NECP_CLIENT_ACTION_SIGN_DEFAULT_HOSTNAME_LENGTH 64
6404 #define NECP_CLIENT_ACTION_SIGN_MAX_HOSTNAME_LENGTH 1024
6405
6406 #define NECP_CLIENT_ACTION_SIGN_TAG_LENGTH 32
6407
6408 static NECP_CLIENT_ACTION_FUNCTION int
6409 necp_client_sign(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
6410 {
6411 int error = 0;
6412 u_int32_t hostname_length = 0;
6413 u_int8_t tag[NECP_CLIENT_ACTION_SIGN_TAG_LENGTH] = {};
6414 struct necp_client_signable signable = {};
6415 union necp_sockaddr_union address_answer = {};
6416 u_int8_t *client_hostname = NULL;
6417 u_int8_t *allocated_hostname = NULL;
6418 u_int8_t default_hostname[NECP_CLIENT_ACTION_SIGN_DEFAULT_HOSTNAME_LENGTH] = "";
6419 uint32_t tag_size = sizeof(tag);
6420
6421 *retval = 0;
6422
6423 const bool has_resolver_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_VALIDATED_RESOLVER, 0) == 0);
6424 if (!has_resolver_entitlement) {
6425 NECPLOG0(LOG_ERR, "Process does not hold the necessary entitlement to sign resolver answers");
6426 error = EPERM;
6427 goto done;
6428 }
6429
6430 if (uap->client_id == 0 || uap->client_id_len < sizeof(struct necp_client_signable)) {
6431 error = EINVAL;
6432 goto done;
6433 }
6434
6435 if (uap->buffer == 0 || uap->buffer_size != NECP_CLIENT_ACTION_SIGN_TAG_LENGTH) {
6436 error = EINVAL;
6437 goto done;
6438 }
6439
6440 error = copyin(uap->client_id, &signable, sizeof(signable));
6441 if (error) {
6442 NECPLOG(LOG_ERR, "necp_client_sign copyin signable error (%d)", error);
6443 goto done;
6444 }
6445
6446 if (signable.sign_type != NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER) {
6447 NECPLOG(LOG_ERR, "necp_client_sign unknown signable type (%u)", signable.sign_type);
6448 error = EINVAL;
6449 goto done;
6450 }
6451
6452 if (uap->client_id_len < sizeof(struct necp_client_resolver_answer)) {
6453 error = EINVAL;
6454 goto done;
6455 }
6456
6457 error = copyin(uap->client_id + sizeof(signable), &address_answer, sizeof(address_answer));
6458 if (error) {
6459 NECPLOG(LOG_ERR, "necp_client_sign copyin address_answer error (%d)", error);
6460 goto done;
6461 }
6462
6463 error = copyin(uap->client_id + sizeof(signable) + sizeof(address_answer), &hostname_length, sizeof(hostname_length));
6464 if (error) {
6465 NECPLOG(LOG_ERR, "necp_client_sign copyin hostname_length error (%d)", error);
6466 goto done;
6467 }
6468
6469 if (hostname_length > NECP_CLIENT_ACTION_SIGN_MAX_HOSTNAME_LENGTH) {
6470 error = EINVAL;
6471 goto done;
6472 }
6473
6474 if (hostname_length > NECP_CLIENT_ACTION_SIGN_DEFAULT_HOSTNAME_LENGTH) {
6475 if ((allocated_hostname = _MALLOC(hostname_length, M_NECP, M_WAITOK | M_ZERO)) == NULL) {
6476 NECPLOG(LOG_ERR, "necp_client_sign malloc hostname %u failed", hostname_length);
6477 error = ENOMEM;
6478 goto done;
6479 }
6480
6481 client_hostname = allocated_hostname;
6482 } else {
6483 client_hostname = default_hostname;
6484 }
6485
6486 error = copyin(uap->client_id + sizeof(signable) + sizeof(address_answer) + sizeof(hostname_length), client_hostname, hostname_length);
6487 if (error) {
6488 NECPLOG(LOG_ERR, "necp_client_sign copyin hostname error (%d)", error);
6489 goto done;
6490 }
6491
6492 address_answer.sin.sin_port = 0;
6493 error = necp_sign_resolver_answer(signable.client_id, client_hostname, hostname_length,
6494 (u_int8_t *)&address_answer, sizeof(address_answer),
6495 tag, &tag_size);
6496 if (tag_size != sizeof(tag)) {
6497 NECPLOG(LOG_ERR, "necp_client_sign unexpected tag size %u", tag_size);
6498 error = EINVAL;
6499 goto done;
6500 }
6501 error = copyout(tag, uap->buffer, tag_size);
6502 if (error) {
6503 NECPLOG(LOG_ERR, "necp_client_sign copyout error (%d)", error);
6504 goto done;
6505 }
6506
6507 done:
6508 if (allocated_hostname != NULL) {
6509 FREE(allocated_hostname, M_NECP);
6510 allocated_hostname = NULL;
6511 }
6512 *retval = error;
6513 return error;
6514 }
6515
6516 int
6517 necp_client_action(struct proc *p, struct necp_client_action_args *uap, int *retval)
6518 {
6519 struct fileproc *fp;
6520 int error = 0;
6521 int return_value = 0;
6522 struct necp_fd_data *fd_data = NULL;
6523
6524 error = necp_find_fd_data(p, uap->necp_fd, &fp, &fd_data);
6525 if (error != 0) {
6526 NECPLOG(LOG_ERR, "necp_client_action find fd error (%d)", error);
6527 return error;
6528 }
6529
6530 u_int32_t action = uap->action;
6531 switch (action) {
6532 case NECP_CLIENT_ACTION_ADD: {
6533 return_value = necp_client_add(p, fd_data, uap, retval);
6534 break;
6535 }
6536 case NECP_CLIENT_ACTION_CLAIM: {
6537 return_value = necp_client_claim(p, fd_data, uap, retval);
6538 break;
6539 }
6540 case NECP_CLIENT_ACTION_REMOVE: {
6541 return_value = necp_client_remove(fd_data, uap, retval);
6542 break;
6543 }
6544 case NECP_CLIENT_ACTION_COPY_PARAMETERS:
6545 case NECP_CLIENT_ACTION_COPY_RESULT:
6546 case NECP_CLIENT_ACTION_COPY_UPDATED_RESULT: {
6547 return_value = necp_client_copy(fd_data, uap, retval);
6548 break;
6549 }
6550 case NECP_CLIENT_ACTION_COPY_LIST: {
6551 return_value = necp_client_list(fd_data, uap, retval);
6552 break;
6553 }
6554 case NECP_CLIENT_ACTION_ADD_FLOW: {
6555 return_value = necp_client_add_flow(fd_data, uap, retval);
6556 break;
6557 }
6558 case NECP_CLIENT_ACTION_REMOVE_FLOW: {
6559 return_value = necp_client_remove_flow(fd_data, uap, retval);
6560 break;
6561 }
6562 case NECP_CLIENT_ACTION_AGENT: {
6563 return_value = necp_client_agent_action(fd_data, uap, retval);
6564 break;
6565 }
6566 case NECP_CLIENT_ACTION_COPY_AGENT: {
6567 return_value = necp_client_copy_agent(fd_data, uap, retval);
6568 break;
6569 }
6570 case NECP_CLIENT_ACTION_AGENT_USE: {
6571 return_value = necp_client_agent_use(fd_data, uap, retval);
6572 break;
6573 }
6574 case NECP_CLIENT_ACTION_COPY_INTERFACE: {
6575 return_value = necp_client_copy_interface(fd_data, uap, retval);
6576 break;
6577 }
6578 case NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS: {
6579 return_value = necp_client_copy_route_statistics(fd_data, uap, retval);
6580 break;
6581 }
6582 case NECP_CLIENT_ACTION_UPDATE_CACHE: {
6583 return_value = necp_client_update_cache(fd_data, uap, retval);
6584 break;
6585 }
6586 case NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE: {
6587 return_value = necp_client_copy_client_update(fd_data, uap, retval);
6588 break;
6589 }
6590 case NECP_CLIENT_ACTION_SIGN: {
6591 return_value = necp_client_sign(fd_data, uap, retval);
6592 break;
6593 }
6594 default: {
6595 NECPLOG(LOG_ERR, "necp_client_action unknown action (%u)", action);
6596 return_value = EINVAL;
6597 break;
6598 }
6599 }
6600
6601 fp_drop(p, uap->necp_fd, fp, 0);
6602 return return_value;
6603 }
6604
6605 #define NECP_MAX_MATCH_POLICY_PARAMETER_SIZE 1024
6606
6607 int
6608 necp_match_policy(struct proc *p, struct necp_match_policy_args *uap, int32_t *retval)
6609 {
6610 #pragma unused(retval)
6611 u_int8_t *parameters = NULL;
6612 struct necp_aggregate_result returned_result;
6613 int error = 0;
6614
6615 if (uap == NULL) {
6616 error = EINVAL;
6617 goto done;
6618 }
6619
6620 if (uap->parameters == 0 || uap->parameters_size == 0 || uap->parameters_size > NECP_MAX_MATCH_POLICY_PARAMETER_SIZE || uap->returned_result == 0) {
6621 error = EINVAL;
6622 goto done;
6623 }
6624
6625 MALLOC(parameters, u_int8_t *, uap->parameters_size, M_NECP, M_WAITOK | M_ZERO);
6626 if (parameters == NULL) {
6627 error = ENOMEM;
6628 goto done;
6629 }
6630 // Copy parameters in
6631 error = copyin(uap->parameters, parameters, uap->parameters_size);
6632 if (error) {
6633 goto done;
6634 }
6635
6636 error = necp_application_find_policy_match_internal(p, parameters, uap->parameters_size,
6637 &returned_result, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL, false, false, NULL);
6638 if (error) {
6639 goto done;
6640 }
6641
6642 // Copy return value back
6643 error = copyout(&returned_result, uap->returned_result, sizeof(struct necp_aggregate_result));
6644 if (error) {
6645 goto done;
6646 }
6647 done:
6648 if (parameters != NULL) {
6649 FREE(parameters, M_NECP);
6650 }
6651 return error;
6652 }
6653
6654 /// Socket operations
6655 #define NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH 253
6656
6657 static bool
6658 necp_set_socket_attribute(u_int8_t *buffer, size_t buffer_length, u_int8_t type, char **buffer_p)
6659 {
6660 int error = 0;
6661 int cursor = 0;
6662 size_t string_size = 0;
6663 char *local_string = NULL;
6664 u_int8_t *value = NULL;
6665
6666 cursor = necp_buffer_find_tlv(buffer, buffer_length, 0, type, NULL, 0);
6667 if (cursor < 0) {
6668 // This will clear out the parameter
6669 goto done;
6670 }
6671
6672 string_size = necp_buffer_get_tlv_length(buffer, cursor);
6673 if (string_size == 0 || string_size > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) {
6674 // This will clear out the parameter
6675 goto done;
6676 }
6677
6678 MALLOC(local_string, char *, string_size + 1, M_NECP, M_WAITOK | M_ZERO);
6679 if (local_string == NULL) {
6680 NECPLOG(LOG_ERR, "Failed to allocate a socket attribute buffer (size %zu)", string_size);
6681 goto fail;
6682 }
6683
6684 value = necp_buffer_get_tlv_value(buffer, cursor, NULL);
6685 if (value == NULL) {
6686 NECPLOG0(LOG_ERR, "Failed to get socket attribute");
6687 goto fail;
6688 }
6689
6690 memcpy(local_string, value, string_size);
6691 local_string[string_size] = 0;
6692
6693 done:
6694 if (*buffer_p != NULL) {
6695 FREE(*buffer_p, M_NECP);
6696 *buffer_p = NULL;
6697 }
6698
6699 *buffer_p = local_string;
6700 return 0;
6701 fail:
6702 if (local_string != NULL) {
6703 FREE(local_string, M_NECP);
6704 }
6705 return error;
6706 }
6707
6708 errno_t
6709 necp_set_socket_attributes(struct socket *so, struct sockopt *sopt)
6710 {
6711 int error = 0;
6712 u_int8_t *buffer = NULL;
6713 struct inpcb *inp = NULL;
6714
6715 if (SOCK_DOM(so) != PF_INET && SOCK_DOM(so) != PF_INET6) {
6716 error = EINVAL;
6717 goto done;
6718 }
6719
6720 inp = sotoinpcb(so);
6721
6722 size_t valsize = sopt->sopt_valsize;
6723 if (valsize == 0 ||
6724 valsize > ((sizeof(struct necp_tlv_header) + NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) * 2)) {
6725 goto done;
6726 }
6727
6728 MALLOC(buffer, u_int8_t *, valsize, M_NECP, M_WAITOK | M_ZERO);
6729 if (buffer == NULL) {
6730 goto done;
6731 }
6732
6733 error = sooptcopyin(sopt, buffer, valsize, 0);
6734 if (error) {
6735 goto done;
6736 }
6737
6738 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN, &inp->inp_necp_attributes.inp_domain);
6739 if (error) {
6740 NECPLOG0(LOG_ERR, "Could not set domain TLV for socket attributes");
6741 goto done;
6742 }
6743
6744 error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_ACCOUNT, &inp->inp_necp_attributes.inp_account);
6745 if (error) {
6746 NECPLOG0(LOG_ERR, "Could not set account TLV for socket attributes");
6747 goto done;
6748 }
6749
6750 if (necp_debug) {
6751 NECPLOG(LOG_DEBUG, "Set on socket: Domain %s, Account %s", inp->inp_necp_attributes.inp_domain, inp->inp_necp_attributes.inp_account);
6752 }
6753 done:
6754 if (buffer != NULL) {
6755 FREE(buffer, M_NECP);
6756 }
6757
6758 return error;
6759 }
6760
6761 errno_t
6762 necp_get_socket_attributes(struct socket *so, struct sockopt *sopt)
6763 {
6764 int error = 0;
6765 u_int8_t *buffer = NULL;
6766 u_int8_t *cursor = NULL;
6767 size_t valsize = 0;
6768 struct inpcb *inp = NULL;
6769
6770 if (SOCK_DOM(so) != PF_INET && SOCK_DOM(so) != PF_INET6) {
6771 error = EINVAL;
6772 goto done;
6773 }
6774
6775 inp = sotoinpcb(so);
6776 if (inp->inp_necp_attributes.inp_domain != NULL) {
6777 valsize += sizeof(struct necp_tlv_header) + strlen(inp->inp_necp_attributes.inp_domain);
6778 }
6779 if (inp->inp_necp_attributes.inp_account != NULL) {
6780 valsize += sizeof(struct necp_tlv_header) + strlen(inp->inp_necp_attributes.inp_account);
6781 }
6782 if (valsize == 0) {
6783 goto done;
6784 }
6785
6786 MALLOC(buffer, u_int8_t *, valsize, M_NECP, M_WAITOK | M_ZERO);
6787 if (buffer == NULL) {
6788 goto done;
6789 }
6790
6791 cursor = buffer;
6792 if (inp->inp_necp_attributes.inp_domain != NULL) {
6793 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN, strlen(inp->inp_necp_attributes.inp_domain), inp->inp_necp_attributes.inp_domain,
6794 buffer, valsize);
6795 }
6796
6797 if (inp->inp_necp_attributes.inp_account != NULL) {
6798 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_ACCOUNT, strlen(inp->inp_necp_attributes.inp_account), inp->inp_necp_attributes.inp_account,
6799 buffer, valsize);
6800 }
6801
6802 error = sooptcopyout(sopt, buffer, valsize);
6803 if (error) {
6804 goto done;
6805 }
6806 done:
6807 if (buffer != NULL) {
6808 FREE(buffer, M_NECP);
6809 }
6810
6811 return error;
6812 }
6813
6814 void *
6815 necp_create_nexus_assign_message(uuid_t nexus_instance, u_int32_t nexus_port, void *key, uint32_t key_length,
6816 struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint, struct ether_addr *local_ether_addr,
6817 u_int32_t flow_adv_index, void *flow_stats, size_t *message_length)
6818 {
6819 u_int8_t *buffer = NULL;
6820 u_int8_t *cursor = NULL;
6821 size_t valsize = 0;
6822 bool has_nexus_assignment = FALSE;
6823
6824 if (!uuid_is_null(nexus_instance)) {
6825 has_nexus_assignment = TRUE;
6826 valsize += sizeof(struct necp_tlv_header) + sizeof(uuid_t);
6827 valsize += sizeof(struct necp_tlv_header) + sizeof(u_int32_t);
6828 }
6829 if (flow_adv_index != NECP_FLOWADV_IDX_INVALID) {
6830 valsize += sizeof(struct necp_tlv_header) + sizeof(u_int32_t);
6831 }
6832 if (key != NULL && key_length > 0) {
6833 valsize += sizeof(struct necp_tlv_header) + key_length;
6834 }
6835 if (local_endpoint != NULL) {
6836 valsize += sizeof(struct necp_tlv_header) + sizeof(struct necp_client_endpoint);
6837 }
6838 if (remote_endpoint != NULL) {
6839 valsize += sizeof(struct necp_tlv_header) + sizeof(struct necp_client_endpoint);
6840 }
6841 if (local_ether_addr != NULL) {
6842 valsize += sizeof(struct necp_tlv_header) + sizeof(struct ether_addr);
6843 }
6844 if (flow_stats != NULL) {
6845 valsize += sizeof(struct necp_tlv_header) + sizeof(void *);
6846 }
6847 if (valsize == 0) {
6848 return NULL;
6849 }
6850
6851 MALLOC(buffer, u_int8_t *, valsize, M_NETAGENT, M_WAITOK | M_ZERO); // Use M_NETAGENT area, since it is expected upon free
6852 if (buffer == NULL) {
6853 return NULL;
6854 }
6855
6856 cursor = buffer;
6857 if (has_nexus_assignment) {
6858 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_INSTANCE, sizeof(uuid_t), nexus_instance, buffer, valsize);
6859 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_PORT, sizeof(u_int32_t), &nexus_port, buffer, valsize);
6860 }
6861 if (flow_adv_index != NECP_FLOWADV_IDX_INVALID) {
6862 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_PORT_FLOW_INDEX, sizeof(u_int32_t), &flow_adv_index, buffer, valsize);
6863 }
6864 if (key != NULL && key_length > 0) {
6865 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_PARAMETER_NEXUS_KEY, key_length, key, buffer, valsize);
6866 }
6867 if (local_endpoint != NULL) {
6868 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_LOCAL_ENDPOINT, sizeof(struct necp_client_endpoint), local_endpoint, buffer, valsize);
6869 }
6870 if (remote_endpoint != NULL) {
6871 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_REMOTE_ENDPOINT, sizeof(struct necp_client_endpoint), remote_endpoint, buffer, valsize);
6872 }
6873 if (local_ether_addr != NULL) {
6874 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_LOCAL_ETHER_ADDR, sizeof(struct ether_addr), local_ether_addr, buffer, valsize);
6875 }
6876 if (flow_stats != NULL) {
6877 cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_FLOW_STATS, sizeof(void *), &flow_stats, buffer, valsize);
6878 }
6879
6880 *message_length = valsize;
6881
6882 return buffer;
6883 }
6884
6885 void
6886 necp_inpcb_remove_cb(struct inpcb *inp)
6887 {
6888 if (!uuid_is_null(inp->necp_client_uuid)) {
6889 necp_client_unregister_socket_flow(inp->necp_client_uuid, inp);
6890 uuid_clear(inp->necp_client_uuid);
6891 }
6892 }
6893
6894 void
6895 necp_inpcb_dispose(struct inpcb *inp)
6896 {
6897 necp_inpcb_remove_cb(inp); // Clear out socket registrations if not yet done
6898 if (inp->inp_necp_attributes.inp_domain != NULL) {
6899 FREE(inp->inp_necp_attributes.inp_domain, M_NECP);
6900 inp->inp_necp_attributes.inp_domain = NULL;
6901 }
6902 if (inp->inp_necp_attributes.inp_account != NULL) {
6903 FREE(inp->inp_necp_attributes.inp_account, M_NECP);
6904 inp->inp_necp_attributes.inp_account = NULL;
6905 }
6906 }
6907
6908 void
6909 necp_mppcb_dispose(struct mppcb *mpp)
6910 {
6911 if (!uuid_is_null(mpp->necp_client_uuid)) {
6912 necp_client_unregister_multipath_cb(mpp->necp_client_uuid, mpp);
6913 uuid_clear(mpp->necp_client_uuid);
6914 }
6915 }
6916
6917 /// Module init
6918
6919 errno_t
6920 necp_client_init(void)
6921 {
6922 necp_fd_grp_attr = lck_grp_attr_alloc_init();
6923 if (necp_fd_grp_attr == NULL) {
6924 panic("lck_grp_attr_alloc_init failed\n");
6925 /* NOTREACHED */
6926 }
6927
6928 necp_fd_mtx_grp = lck_grp_alloc_init("necp_fd", necp_fd_grp_attr);
6929 if (necp_fd_mtx_grp == NULL) {
6930 panic("lck_grp_alloc_init failed\n");
6931 /* NOTREACHED */
6932 }
6933
6934 necp_fd_mtx_attr = lck_attr_alloc_init();
6935 if (necp_fd_mtx_attr == NULL) {
6936 panic("lck_attr_alloc_init failed\n");
6937 /* NOTREACHED */
6938 }
6939
6940 necp_flow_size = sizeof(struct necp_client_flow);
6941 necp_flow_cache = mcache_create(NECP_FLOW_ZONE_NAME, necp_flow_size, sizeof(uint64_t), 0, MCR_SLEEP);
6942 if (necp_flow_cache == NULL) {
6943 panic("mcache_create(necp_flow_cache) failed\n");
6944 /* NOTREACHED */
6945 }
6946
6947 necp_flow_registration_size = sizeof(struct necp_client_flow_registration);
6948 necp_flow_registration_cache = mcache_create(NECP_FLOW_REGISTRATION_ZONE_NAME, necp_flow_registration_size, sizeof(uint64_t), 0, MCR_SLEEP);
6949 if (necp_flow_registration_cache == NULL) {
6950 panic("mcache_create(necp_client_flow_registration) failed\n");
6951 /* NOTREACHED */
6952 }
6953
6954 necp_client_update_tcall = thread_call_allocate_with_options(necp_update_all_clients_callout, NULL,
6955 THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
6956 VERIFY(necp_client_update_tcall != NULL);
6957
6958 lck_rw_init(&necp_fd_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
6959 lck_rw_init(&necp_observer_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
6960 lck_rw_init(&necp_client_tree_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
6961 lck_rw_init(&necp_flow_tree_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
6962 lck_rw_init(&necp_collect_stats_list_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
6963
6964 LIST_INIT(&necp_fd_list);
6965 LIST_INIT(&necp_fd_observer_list);
6966 LIST_INIT(&necp_collect_stats_flow_list);
6967
6968 RB_INIT(&necp_client_global_tree);
6969 RB_INIT(&necp_client_flow_global_tree);
6970
6971 return 0;
6972 }
6973
6974 void
6975 necp_client_reap_caches(boolean_t purge)
6976 {
6977 mcache_reap_now(necp_flow_cache, purge);
6978 mcache_reap_now(necp_flow_registration_cache, purge);
6979 }
6980
mirror of XNU