/*
- * Copyright (c) 2015-2018 Apple Inc. All rights reserved.
+ * Copyright (c) 2015-2019 Apple Inc. All rights reserved.
*
* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
*
#include <net/ntstat.h>
#include <netinet/in_pcb.h>
+#include <netinet/in_var.h>
#include <netinet/ip.h>
#include <netinet/ip6.h>
#include <netinet/mp_pcb.h>
#include <sys/codesign.h>
#include <libkern/section_keywords.h>
+#include <os/refcnt.h>
+
/*
* NECP Client Architecture
extern u_int32_t necp_debug;
-static int noop_read(struct fileproc *, struct uio *, int, vfs_context_t);
-static int noop_write(struct fileproc *, struct uio *, int, vfs_context_t);
-static int noop_ioctl(struct fileproc *, unsigned long, caddr_t,
- vfs_context_t);
static int necpop_select(struct fileproc *, int, void *, vfs_context_t);
static int necpop_close(struct fileglob *, vfs_context_t);
-static int necpop_kqfilter(struct fileproc *, struct knote *,
- struct kevent_internal_s *kev, vfs_context_t);
+static int necpop_kqfilter(struct fileproc *, struct knote *, struct kevent_qos_s *);
// Timer functions
static int necp_timeout_microseconds = 1000 * 100; // 100ms
static int necp_if_flow_count = 0;
static int necp_observer_message_limit = 256;
+os_refgrp_decl(static, necp_client_refgrp, "NECPClientRefGroup", NULL);
+
SYSCTL_INT(_net_necp, NECPCTL_CLIENT_FD_COUNT, client_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_fd_count, 0, "");
SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_FD_COUNT, observer_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_observer_fd_count, 0, "");
SYSCTL_INT(_net_necp, NECPCTL_CLIENT_COUNT, client_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_count, 0, "");
SYSCTL_INT(_net_necp, NECPCTL_IF_FLOW_COUNT, if_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_if_flow_count, 0, "");
SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_MESSAGE_LIMIT, observer_message_limit, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_observer_message_limit, 256, "");
-#define NECP_MAX_CLIENT_LIST_SIZE 1024 * 1024 // 1MB
-#define NECP_MAX_AGENT_ACTION_SIZE 256
+#define NECP_MAX_CLIENT_LIST_SIZE 1024 * 1024 // 1MB
+#define NECP_MAX_AGENT_ACTION_SIZE 256
extern int tvtohz(struct timeval *);
extern unsigned int get_maxmtu(struct rtentry *);
// Parsed parameters
-#define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR 0x00001
-#define NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR 0x00002
-#define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF 0x00004
-#define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF 0x00008
-#define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE 0x00010
-#define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE 0x00020
-#define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT 0x00040
-#define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT 0x00080
-#define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT 0x00100
-#define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT 0x00200
-#define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE 0x00400
-#define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE 0x00800
-#define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE 0x01000
-#define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE 0x02000
-#define NECP_PARSED_PARAMETERS_FIELD_FLAGS 0x04000
-#define NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL 0x08000
-#define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID 0x10000
-#define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID 0x20000
-#define NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS 0x40000
-#define NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT 0x80000
-
-#define NECP_MAX_PARSED_PARAMETERS 16
+#define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR 0x00001
+#define NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR 0x00002
+#define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF 0x00004
+#define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF 0x00008
+#define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE 0x00010
+#define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE 0x00020
+#define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT 0x00040
+#define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT 0x00080
+#define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT 0x00100
+#define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT 0x00200
+#define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE 0x00400
+#define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE 0x00800
+#define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE 0x01000
+#define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE 0x02000
+#define NECP_PARSED_PARAMETERS_FIELD_FLAGS 0x04000
+#define NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL 0x08000
+#define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID 0x10000
+#define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID 0x20000
+#define NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS 0x40000
+#define NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT 0x80000
+#define NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID 0x100000
+#define NECP_PARSED_PARAMETERS_FIELD_ETHERTYPE 0x200000
+#define NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL 0x400000
+#define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE 0x800000
+
+
+#define NECP_MAX_INTERFACE_PARAMETERS 16
+#define NECP_MAX_AGENT_PARAMETERS 4
struct necp_client_parsed_parameters {
u_int32_t valid_fields;
u_int32_t flags;
+ u_int64_t delegated_upid;
union necp_sockaddr_union local_addr;
union necp_sockaddr_union remote_addr;
u_int32_t required_interface_index;
- char prohibited_interfaces[IFXNAMSIZ][NECP_MAX_PARSED_PARAMETERS];
+ char prohibited_interfaces[NECP_MAX_INTERFACE_PARAMETERS][IFXNAMSIZ];
u_int8_t required_interface_type;
- u_int8_t prohibited_interface_types[NECP_MAX_PARSED_PARAMETERS];
- struct necp_client_parameter_netagent_type required_netagent_types[NECP_MAX_PARSED_PARAMETERS];
- struct necp_client_parameter_netagent_type prohibited_netagent_types[NECP_MAX_PARSED_PARAMETERS];
- struct necp_client_parameter_netagent_type preferred_netagent_types[NECP_MAX_PARSED_PARAMETERS];
- struct necp_client_parameter_netagent_type avoided_netagent_types[NECP_MAX_PARSED_PARAMETERS];
- uuid_t required_netagents[NECP_MAX_PARSED_PARAMETERS];
- uuid_t prohibited_netagents[NECP_MAX_PARSED_PARAMETERS];
- uuid_t preferred_netagents[NECP_MAX_PARSED_PARAMETERS];
- uuid_t avoided_netagents[NECP_MAX_PARSED_PARAMETERS];
- u_int16_t ip_protocol;
+ u_int8_t local_address_preference;
+ u_int8_t prohibited_interface_types[NECP_MAX_INTERFACE_PARAMETERS];
+ struct necp_client_parameter_netagent_type required_netagent_types[NECP_MAX_AGENT_PARAMETERS];
+ struct necp_client_parameter_netagent_type prohibited_netagent_types[NECP_MAX_AGENT_PARAMETERS];
+ struct necp_client_parameter_netagent_type preferred_netagent_types[NECP_MAX_AGENT_PARAMETERS];
+ struct necp_client_parameter_netagent_type avoided_netagent_types[NECP_MAX_AGENT_PARAMETERS];
+ uuid_t required_netagents[NECP_MAX_AGENT_PARAMETERS];
+ uuid_t prohibited_netagents[NECP_MAX_AGENT_PARAMETERS];
+ uuid_t preferred_netagents[NECP_MAX_AGENT_PARAMETERS];
+ uuid_t avoided_netagents[NECP_MAX_AGENT_PARAMETERS];
+ u_int8_t ip_protocol;
+ u_int8_t transport_protocol;
+ u_int16_t ethertype;
pid_t effective_pid;
uuid_t effective_uuid;
u_int32_t traffic_class;
static bool
necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters,
- u_int *return_ifindex, bool *validate_agents);
+ u_int *return_ifindex, bool *validate_agents);
static bool
necp_ifnet_matches_local_address(struct ifnet *ifp, struct sockaddr *sa);
static bool
necp_ifnet_matches_parameters(struct ifnet *ifp,
- struct necp_client_parsed_parameters *parsed_parameters,
- u_int32_t *preferred_count,
- bool secondary_interface);
+ struct necp_client_parsed_parameters *parsed_parameters,
+ u_int32_t override_flags,
+ u_int32_t *preferred_count,
+ bool secondary_interface,
+ bool require_scoped_field);
static const struct fileops necp_fd_ops = {
- .fo_type = DTYPE_NETPOLICY,
- .fo_read = noop_read,
- .fo_write = noop_write,
- .fo_ioctl = noop_ioctl,
- .fo_select = necpop_select,
- .fo_close = necpop_close,
+ .fo_type = DTYPE_NETPOLICY,
+ .fo_read = fo_no_read,
+ .fo_write = fo_no_write,
+ .fo_ioctl = fo_no_ioctl,
+ .fo_select = necpop_select,
+ .fo_close = necpop_close,
+ .fo_drain = fo_no_drain,
.fo_kqfilter = necpop_kqfilter,
- .fo_drain = NULL,
};
struct necp_client_assertion {
decl_lck_mtx_data(, lock);
decl_lck_mtx_data(, route_lock);
- uint32_t reference_count;
+ os_refcnt_t reference_count;
uuid_t client_id;
unsigned result_read : 1;
unsigned allow_multiple_flows : 1;
unsigned legacy_client_is_flow : 1;
- unsigned background : 1;
- unsigned background_update : 1;
unsigned platform_binary : 1;
size_t result_length;
necp_policy_id policy_id;
- u_int16_t ip_protocol;
+ u_int8_t ip_protocol;
int proc_pid;
+ u_int64_t delegated_upid;
+
struct _necp_client_flow_tree flow_registrations;
LIST_HEAD(_necp_client_assertion_list, necp_client_assertion) assertion_list;
void *agent_handle;
+ uuid_t override_euuid;
+
+
size_t parameters_length;
u_int8_t parameters[0];
};
#define NECP_CLIENT_ROUTE_UNLOCK(_c) lck_mtx_unlock(&_c->route_lock)
static void necp_client_retain_locked(struct necp_client *client);
-static void necp_client_retain(struct necp_client *client);
+
static bool necp_client_release_locked(struct necp_client *client);
+static bool necp_client_release(struct necp_client *client);
static void
necp_client_add_assertion(struct necp_client *client, uuid_t netagent_uuid);
uuid_t nexus_agent;
void *agent_handle;
int proc_pid;
+ u_int32_t flags;
+ struct necp_client_agent_parameters close_parameters;
+ bool has_close_parameters;
};
LIST_HEAD(_necp_flow_defunct_list, necp_flow_defunct);
};
-#define NAIF_ATTACHED 0x1 // arena is attached to list
-#define NAIF_REDIRECT 0x2 // arena mmap has been redirected
-#define NAIF_DEFUNCT 0x4 // arena is now defunct
+#define NAIF_ATTACHED 0x1 // arena is attached to list
+#define NAIF_REDIRECT 0x2 // arena mmap has been redirected
+#define NAIF_DEFUNCT 0x4 // arena is now defunct
struct necp_fd_data {
u_int8_t necp_fd_type;
TAILQ_HEAD(_necp_client_update_list, necp_client_update) update_list;
int update_count;
int flags;
+
+ unsigned background : 1;
+
int proc_pid;
decl_lck_mtx_data(, fd_lock);
struct selinfo si;
static LIST_HEAD(_necp_fd_list, necp_fd_data) necp_fd_list;
static LIST_HEAD(_necp_fd_observer_list, necp_fd_data) necp_fd_observer_list;
-#define NECP_CLIENT_FD_ZONE_MAX 128
-#define NECP_CLIENT_FD_ZONE_NAME "necp.clientfd"
+#define NECP_CLIENT_FD_ZONE_MAX 128
+#define NECP_CLIENT_FD_ZONE_NAME "necp.clientfd"
-static unsigned int necp_client_fd_size; /* size of zone element */
-static struct zone *necp_client_fd_zone; /* zone for necp_fd_data */
+static unsigned int necp_client_fd_size; /* size of zone element */
+static struct zone *necp_client_fd_zone; /* zone for necp_fd_data */
-#define NECP_FLOW_ZONE_NAME "necp.flow"
-#define NECP_FLOW_REGISTRATION_ZONE_NAME "necp.flowregistration"
+#define NECP_FLOW_ZONE_NAME "necp.flow"
+#define NECP_FLOW_REGISTRATION_ZONE_NAME "necp.flowregistration"
-static unsigned int necp_flow_size; /* size of necp_client_flow */
-static struct mcache *necp_flow_cache; /* cache for necp_client_flow */
+static unsigned int necp_flow_size; /* size of necp_client_flow */
+static struct mcache *necp_flow_cache; /* cache for necp_client_flow */
-static unsigned int necp_flow_registration_size; /* size of necp_client_flow_registration */
-static struct mcache *necp_flow_registration_cache; /* cache for necp_client_flow_registration */
+static unsigned int necp_flow_registration_size; /* size of necp_client_flow_registration */
+static struct mcache *necp_flow_registration_cache; /* cache for necp_client_flow_registration */
-#define NECP_ARENA_INFO_ZONE_MAX 128
-#define NECP_ARENA_INFO_ZONE_NAME "necp.arenainfo"
+#define NECP_ARENA_INFO_ZONE_MAX 128
+#define NECP_ARENA_INFO_ZONE_NAME "necp.arenainfo"
-static lck_grp_attr_t *necp_fd_grp_attr = NULL;
-static lck_attr_t *necp_fd_mtx_attr = NULL;
-static lck_grp_t *necp_fd_mtx_grp = NULL;
+static lck_grp_attr_t *necp_fd_grp_attr = NULL;
+static lck_attr_t *necp_fd_mtx_attr = NULL;
+static lck_grp_t *necp_fd_mtx_grp = NULL;
decl_lck_rw_data(static, necp_fd_lock);
decl_lck_rw_data(static, necp_observer_lock);
/// NECP file descriptor functions
-static int
-noop_read(struct fileproc *fp, struct uio *uio, int flags, vfs_context_t ctx)
-{
-#pragma unused(fp, uio, flags, ctx)
- return (ENXIO);
-}
-
-static int
-noop_write(struct fileproc *fp, struct uio *uio, int flags,
- vfs_context_t ctx)
-{
-#pragma unused(fp, uio, flags, ctx)
- return (ENXIO);
-}
-
-static int
-noop_ioctl(struct fileproc *fp, unsigned long com, caddr_t data,
- vfs_context_t ctx)
-{
-#pragma unused(fp, com, data, ctx)
- return (ENOTTY);
-}
-
static void
necp_fd_notify(struct necp_fd_data *fd_data, bool locked)
{
has_unread_clients = TRUE;
}
NECP_CLIENT_UNLOCK(client);
- if (has_unread_clients) {
+ if (has_unread_clients) {
break;
}
}
}
}
- return (revents);
+ return revents;
}
static inline void
static inline bool
necp_client_id_is_flow(uuid_t client_id)
{
- return (client_id[9] & 0x01);
+ return client_id[9] & 0x01;
}
static struct necp_client *
NECP_CLIENT_LOCK(client);
}
- return (client);
+ return client;
}
static struct necp_client_flow_registration *
flow = RB_ROOT(&client->flow_registrations);
}
- return (flow);
+ return flow;
}
static struct necp_client *
client = RB_FIND(_necp_client_tree, &client_fd->clients, &find);
}
- return (client);
+ return client;
}
static struct necp_client *
NECP_CLIENT_LOCK(client);
}
- return (client);
+ return client;
}
static inline int
necp_client_id_cmp(struct necp_client *client0, struct necp_client *client1)
{
- return (uuid_compare(client0->client_id, client1->client_id));
+ return uuid_compare(client0->client_id, client1->client_id);
}
static inline int
necp_client_flow_id_cmp(struct necp_client_flow_registration *flow0, struct necp_client_flow_registration *flow1)
{
- return (uuid_compare(flow0->registration_id, flow1->registration_id));
+ return uuid_compare(flow0->registration_id, flow1->registration_id);
}
static int
necpop_select(struct fileproc *fp, int which, void *wql, vfs_context_t ctx)
{
#pragma unused(fp, which, wql, ctx)
- return (0);
+ return 0;
struct necp_fd_data *fd_data = NULL;
int revents = 0;
int events = 0;
fd_data = (struct necp_fd_data *)fp->f_fglob->fg_data;
if (fd_data == NULL) {
- return (0);
+ return 0;
}
procp = vfs_context_proc(ctx);
switch (which) {
- case FREAD: {
- events = POLLIN;
- break;
- }
+ case FREAD: {
+ events = POLLIN;
+ break;
+ }
- default: {
- return (1);
- }
+ default: {
+ return 1;
+ }
}
NECP_FD_LOCK(fd_data);
revents = necp_fd_poll(fd_data, events, wql, procp, 0);
NECP_FD_UNLOCK(fd_data);
- return ((events & revents) ? 1 : 0);
+ return (events & revents) ? 1 : 0;
}
static void
}
static int
-necp_fd_knrprocess(struct knote *kn, struct filt_process_s *data, struct kevent_internal_s *kev)
+necp_fd_knrprocess(struct knote *kn, struct kevent_qos_s *kev)
{
-#pragma unused(data)
struct necp_fd_data *fd_data;
int revents;
int res;
revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
res = ((revents & POLLIN) != 0);
if (res) {
- *kev = kn->kn_kevent;
+ knote_fill_kevent(kn, kev, 0);
}
NECP_FD_UNLOCK(fd_data);
- return (res);
+ return res;
}
static int
-necp_fd_knrtouch(struct knote *kn, struct kevent_internal_s *kev)
+necp_fd_knrtouch(struct knote *kn, struct kevent_qos_s *kev)
{
#pragma unused(kev)
struct necp_fd_data *fd_data;
revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1);
NECP_FD_UNLOCK(fd_data);
- return ((revents & POLLIN) != 0);
+ return (revents & POLLIN) != 0;
}
SECURITY_READ_ONLY_EARLY(struct filterops) necp_fd_rfiltops = {
static int
necpop_kqfilter(struct fileproc *fp, struct knote *kn,
- __unused struct kevent_internal_s *kev, vfs_context_t ctx)
+ __unused struct kevent_qos_s *kev)
{
-#pragma unused(fp, ctx)
struct necp_fd_data *fd_data = NULL;
int revents;
if (kn->kn_filter != EVFILT_READ) {
NECPLOG(LOG_ERR, "bad filter request %d", kn->kn_filter);
- kn->kn_flags = EV_ERROR;
- kn->kn_data = EINVAL;
- return (0);
+ knote_set_error(kn, EINVAL);
+ return 0;
}
- fd_data = (struct necp_fd_data *)kn->kn_fp->f_fglob->fg_data;
+ fd_data = (struct necp_fd_data *)fp->f_fglob->fg_data;
if (fd_data == NULL) {
NECPLOG0(LOG_ERR, "No channel for kqfilter");
- kn->kn_flags = EV_ERROR;
- kn->kn_data = ENOENT;
- return (0);
+ knote_set_error(kn, ENOENT);
+ return 0;
}
NECP_FD_LOCK(fd_data);
NECP_FD_UNLOCK(fd_data);
- return ((revents & POLLIN) != 0);
+ return (revents & POLLIN) != 0;
}
#define INTERFACE_FLAGS_SHIFT 32
static uint64_t
combine_interface_details(uint32_t interface_index, uint16_t interface_flags)
{
- return (((uint64_t)interface_flags & INTERFACE_FLAGS_MASK) << INTERFACE_FLAGS_SHIFT |
- ((uint64_t)interface_index & INTERFACE_INDEX_MASK) << INTERFACE_INDEX_SHIFT);
+ return ((uint64_t)interface_flags & INTERFACE_FLAGS_MASK) << INTERFACE_FLAGS_SHIFT |
+ ((uint64_t)interface_index & INTERFACE_INDEX_MASK) << INTERFACE_INDEX_SHIFT;
}
static void
necp_defunct_flow_registration(struct necp_client *client,
- struct necp_client_flow_registration *flow_registration,
- struct _necp_flow_defunct_list *defunct_list)
+ struct necp_client_flow_registration *flow_registration,
+ struct _necp_flow_defunct_list *defunct_list)
{
NECP_CLIENT_ASSERT_LOCKED(client);
struct necp_client_flow *search_flow = NULL;
LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
if (search_flow->nexus &&
- !uuid_is_null(search_flow->u.nexus_agent)) {
-
+ !uuid_is_null(search_flow->u.nexus_agent)) {
// Save defunct values for the nexus
if (defunct_list != NULL) {
// Sleeping alloc won't fail; copy only what's necessary
- struct necp_flow_defunct *flow_defunct = _MALLOC(sizeof (struct necp_flow_defunct),
- M_NECP, M_WAITOK | M_ZERO);
+ struct necp_flow_defunct *flow_defunct = _MALLOC(sizeof(struct necp_flow_defunct),
+ M_NECP, M_WAITOK | M_ZERO);
uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent);
uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
- client->client_id :
- flow_registration->registration_id));
+ client->client_id :
+ flow_registration->registration_id));
flow_defunct->proc_pid = client->proc_pid;
flow_defunct->agent_handle = client->agent_handle;
-
+ flow_defunct->flags = flow_registration->flags;
// Add to the list provided by caller
LIST_INSERT_HEAD(defunct_list, flow_defunct, chain);
}
static void
necp_defunct_client_for_policy(struct necp_client *client,
- struct _necp_flow_defunct_list *defunct_list)
+ struct _necp_flow_defunct_list *defunct_list)
{
NECP_CLIENT_ASSERT_LOCKED(client);
{
NECP_CLIENT_ASSERT_LOCKED(client);
- client->reference_count++;
- ASSERT(client->reference_count != 0);
+ os_ref_retain_locked(&client->reference_count);
}
-static void
-necp_client_retain(struct necp_client *client)
-{
- NECP_CLIENT_LOCK(client);
- necp_client_retain_locked(client);
- NECP_CLIENT_UNLOCK(client);
-}
static bool
necp_client_release_locked(struct necp_client *client)
{
NECP_CLIENT_ASSERT_LOCKED(client);
- uint32_t old_ref = client->reference_count;
-
- ASSERT(client->reference_count != 0);
- if (--client->reference_count == 0) {
+ os_ref_count_t count = os_ref_release_locked(&client->reference_count);
+ if (count == 0) {
necp_client_free(client);
}
- return (old_ref == 1);
+ return count == 0;
}
+static bool
+necp_client_release(struct necp_client *client)
+{
+ bool last_ref;
+
+ NECP_CLIENT_LOCK(client);
+ if (!(last_ref = necp_client_release_locked(client))) {
+ NECP_CLIENT_UNLOCK(client);
+ }
+
+ return last_ref;
+}
static void
necp_client_update_observer_add_internal(struct necp_fd_data *observer_fd, struct necp_client *client)
}
struct necp_client_update *client_update = _MALLOC(sizeof(struct necp_client_update) + client->parameters_length,
- M_NECP, M_WAITOK | M_ZERO);
+ M_NECP, M_WAITOK | M_ZERO);
if (client_update != NULL) {
client_update->update_length = sizeof(struct necp_client_observer_update) + client->parameters_length;
uuid_copy(client_update->client_id, client->client_id);
}
struct necp_client_update *client_update = _MALLOC(sizeof(struct necp_client_update) + client->result_length,
- M_NECP, M_WAITOK | M_ZERO);
+ M_NECP, M_WAITOK | M_ZERO);
if (client_update != NULL) {
client_update->update_length = sizeof(struct necp_client_observer_update) + client->result_length;
uuid_copy(client_update->client_id, client->client_id);
}
struct necp_client_update *client_update = _MALLOC(sizeof(struct necp_client_update),
- M_NECP, M_WAITOK | M_ZERO);
+ M_NECP, M_WAITOK | M_ZERO);
if (client_update != NULL) {
client_update->update_length = sizeof(struct necp_client_observer_update);
uuid_copy(client_update->client_id, client->client_id);
static void
necp_destroy_client_flow_registration(struct necp_client *client,
- struct necp_client_flow_registration *flow_registration,
- pid_t pid, bool abort)
+ struct necp_client_flow_registration *flow_registration,
+ pid_t pid, bool abort)
{
NECP_CLIENT_ASSERT_LOCKED(client);
+ bool has_close_parameters = false;
+ struct necp_client_agent_parameters close_parameters = {};
+ memset(close_parameters.u.close_token, 0, sizeof(close_parameters.u.close_token));
struct necp_client_flow *search_flow = NULL;
struct necp_client_flow *temp_flow = NULL;
LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
if (search_flow->nexus &&
- !uuid_is_null(search_flow->u.nexus_agent)) {
+ !uuid_is_null(search_flow->u.nexus_agent)) {
// Note that if we had defuncted the client earlier, this would result in a harmless ENOENT
- int netagent_error = netagent_client_message(search_flow->u.nexus_agent,
- ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
- client->client_id :
- flow_registration->registration_id),
- pid, client->agent_handle,
- (abort ? NETAGENT_MESSAGE_TYPE_ABORT_NEXUS :
- NETAGENT_MESSAGE_TYPE_CLOSE_NEXUS));
+ u_int8_t message_type = (abort ? NETAGENT_MESSAGE_TYPE_ABORT_NEXUS :
+ NETAGENT_MESSAGE_TYPE_CLOSE_NEXUS);
+ if (((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
+ (flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
+ !(flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
+ message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
+ }
+ int netagent_error = netagent_client_message_with_params(search_flow->u.nexus_agent,
+ ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
+ client->client_id :
+ flow_registration->registration_id),
+ pid, client->agent_handle,
+ message_type,
+ has_close_parameters ? &close_parameters : NULL,
+ NULL, 0);
if (netagent_error != 0 && netagent_error != ENOENT) {
- NECPLOG(LOG_ERR, "necp_client_remove close nexus error (%d)", netagent_error);
+ NECPLOG(LOG_ERR, "necp_client_remove close nexus error (%d) MESSAGE TYPE %u", netagent_error, message_type);
}
uuid_clear(search_flow->u.nexus_agent);
}
necp_destroy_client_flow_registration(client, flow_registration, pid, abort);
}
+
// Remove agent assertions
struct necp_client_assertion *search_assertion = NULL;
struct necp_client_assertion *temp_assertion = NULL;
LIST_FOREACH_SAFE(search_assertion, &client->assertion_list, assertion_chain, temp_assertion) {
int netagent_error = netagent_client_message(search_assertion->asserted_netagent, client->client_id, pid,
- client->agent_handle, NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT);
+ client->agent_handle, NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT);
if (netagent_error != 0) {
NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR),
- "necp_client_remove unassert agent error (%d)", netagent_error);
+ "necp_client_remove unassert agent error (%d)", netagent_error);
}
LIST_REMOVE(search_assertion, assertion_chain);
FREE(search_assertion, M_NECP);
}
}
- return (error);
+ return error;
}
/// NECP client utilities
static inline bool
necp_address_is_wildcard(const union necp_sockaddr_union * const addr)
{
- return ((addr->sa.sa_family == AF_INET && addr->sin.sin_addr.s_addr == INADDR_ANY) ||
- (addr->sa.sa_family == AF_INET6 && IN6_IS_ADDR_UNSPECIFIED(&addr->sin6.sin6_addr)));
+ return (addr->sa.sa_family == AF_INET && addr->sin.sin_addr.s_addr == INADDR_ANY) ||
+ (addr->sa.sa_family == AF_INET6 && IN6_IS_ADDR_UNSPECIFIED(&addr->sin6.sin6_addr));
}
static int
if ((*fd_data)->necp_fd_type != necp_fd_type_client) {
// Not a client fd, ignore
+ fp_drop(p, fd, fp, 1);
error = EINVAL;
goto done;
}
done:
proc_fdunlock(p);
- return (error);
+ return error;
}
static struct necp_client_flow *
necp_client_add_interface_flow(struct necp_client_flow_registration *flow_registration,
- uint32_t interface_index)
+ uint32_t interface_index)
{
struct necp_client_flow *new_flow = mcache_alloc(necp_flow_cache, MCR_SLEEP);
if (new_flow == NULL) {
static struct necp_client_flow *
necp_client_add_interface_flow_if_needed(struct necp_client *client,
- struct necp_client_flow_registration *flow_registration,
- uint32_t interface_index)
+ struct necp_client_flow_registration *flow_registration,
+ uint32_t interface_index)
{
if (!client->allow_multiple_flows ||
- interface_index == IFSCOPE_NONE) {
+ interface_index == IFSCOPE_NONE) {
// Interface not set, or client not allowed to use this mode
return NULL;
}
static void
necp_client_add_interface_option_if_needed(struct necp_client *client,
- uint32_t interface_index,
- uint32_t interface_generation,
- uuid_t *nexus_agent)
+ uint32_t interface_index,
+ uint32_t interface_generation,
+ uuid_t *nexus_agent)
{
if (interface_index == IFSCOPE_NONE ||
- (client->interface_option_count != 0 && !client->allow_multiple_flows)) {
+ (client->interface_option_count != 0 && !client->allow_multiple_flows)) {
// Interface not set, or client not allowed to use this mode
return;
}
option->interface_generation = interface_generation;
if (nexus_agent != NULL) {
uuid_copy(option->nexus_agent, *nexus_agent);
+ } else {
+ uuid_clear(option->nexus_agent);
}
client->interface_option_count++;
} else {
option->interface_generation = interface_generation;
if (nexus_agent != NULL) {
uuid_copy(option->nexus_agent, *nexus_agent);
+ } else {
+ uuid_clear(option->nexus_agent);
}
client->interface_option_count++;
}
static bool
necp_client_flow_is_viable(proc_t proc, struct necp_client *client,
- struct necp_client_flow *flow)
+ struct necp_client_flow *flow)
{
struct necp_aggregate_result result;
bool ignore_address = (client->allow_multiple_flows && !flow->nexus && !flow->socket);
flow->necp_flow_flags = 0;
int error = necp_application_find_policy_match_internal(proc, client->parameters,
- (u_int32_t)client->parameters_length,
- &result, &flow->necp_flow_flags,
- flow->interface_index,
- &flow->local_addr, &flow->remote_addr, NULL, ignore_address);
-
- return (error == 0 &&
- result.routed_interface_index != IFSCOPE_NONE &&
- result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP);
+ (u_int32_t)client->parameters_length,
+ &result, &flow->necp_flow_flags, NULL,
+ flow->interface_index,
+ &flow->local_addr, &flow->remote_addr, NULL, NULL,
+ NULL, ignore_address, true, NULL);
+
+ // Check for blocking agents
+ for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
+ if (uuid_is_null(result.netagents[i])) {
+ // Passed end of valid agents
+ break;
+ }
+
+ u_int32_t flags = netagent_get_flags(result.netagents[i]);
+ if ((flags & NETAGENT_FLAG_REGISTERED) &&
+ !(flags & NETAGENT_FLAG_VOLUNTARY) &&
+ !(flags & NETAGENT_FLAG_ACTIVE) &&
+ !(flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY)) {
+ // A required agent is not active, cause the flow to be marked non-viable
+ return false;
+ }
+ }
+
+ return error == 0 &&
+ result.routed_interface_index != IFSCOPE_NONE &&
+ result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP;
}
static void
necp_flow_add_interface_flows(proc_t proc,
- struct necp_client *client,
- struct necp_client_flow_registration *flow_registration,
- bool send_initial)
+ struct necp_client *client,
+ struct necp_client_flow_registration *flow_registration,
+ bool send_initial)
{
// Traverse all interfaces and add a tracking flow if needed
for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) {
static bool
necp_client_update_flows(proc_t proc,
- struct necp_client *client,
- struct _necp_flow_defunct_list *defunct_list)
+ struct necp_client *client,
+ struct _necp_flow_defunct_list *defunct_list)
{
NECP_CLIENT_ASSERT_LOCKED(client);
}
if ((old_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE) !=
- (flow->necp_flow_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE)) {
+ (flow->necp_flow_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE)) {
client_updated = TRUE;
}
if (flow->viable && client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) {
bool flow_viable = flow->viable;
- flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_VIABLE, flow->interface_index, flow->necp_flow_flags, &viable);
+ flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_VIABLE, flow->interface_index, flow->necp_flow_flags, &flow_viable);
flow->viable = flow_viable;
}
if (!flow->viable || flow->invalid) {
if (client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) {
bool flow_viable = flow->viable;
- flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_NONVIABLE, flow->interface_index, flow->necp_flow_flags, &viable);
+ flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_NONVIABLE, flow->interface_index, flow->necp_flow_flags, &flow_viable);
flow->viable = flow_viable;
}
// The callback might change the viable-flag of the
}
}
- return (client_updated);
+ return client_updated;
}
static void
client->interface_option_count = 0;
}
+static inline bool
+necp_netagent_is_required(const struct necp_client_parsed_parameters *parameters,
+ uuid_t *netagent_uuid)
+{
+ // Specific use agents only apply when required
+ bool required = false;
+ if (parameters != NULL) {
+ // Check required agent UUIDs
+ for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
+ if (uuid_is_null(parameters->required_netagents[i])) {
+ break;
+ }
+ if (uuid_compare(parameters->required_netagents[i], *netagent_uuid) == 0) {
+ required = true;
+ break;
+ }
+ }
+
+ if (!required) {
+ // Check required agent types
+ bool fetched_type = false;
+ char netagent_domain[NETAGENT_DOMAINSIZE];
+ char netagent_type[NETAGENT_TYPESIZE];
+ memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
+ memset(&netagent_type, 0, NETAGENT_TYPESIZE);
+
+ for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
+ if (strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
+ strlen(parameters->required_netagent_types[i].netagent_type) == 0) {
+ break;
+ }
+
+ if (!fetched_type) {
+ if (netagent_get_agent_domain_and_type(*netagent_uuid, netagent_domain, netagent_type)) {
+ fetched_type = TRUE;
+ } else {
+ break;
+ }
+ }
+
+ if ((strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
+ strncmp(netagent_domain, parameters->required_netagent_types[i].netagent_domain, NETAGENT_DOMAINSIZE) == 0) &&
+ (strlen(parameters->required_netagent_types[i].netagent_type) == 0 ||
+ strncmp(netagent_type, parameters->required_netagent_types[i].netagent_type, NETAGENT_TYPESIZE) == 0)) {
+ required = true;
+ break;
+ }
+ }
+ }
+ }
+
+ return required;
+}
+
static bool
necp_netagent_applies_to_client(struct necp_client *client,
- const struct necp_client_parsed_parameters *parameters,
- uuid_t *netagent_uuid, bool allow_nexus,
- uint32_t interface_index, uint32_t interface_generation)
+ const struct necp_client_parsed_parameters *parameters,
+ uuid_t *netagent_uuid, bool allow_nexus,
+ uint32_t interface_index, uint32_t interface_generation)
{
#pragma unused(interface_index, interface_generation)
bool applies = FALSE;
u_int32_t flags = netagent_get_flags(*netagent_uuid);
if (!(flags & NETAGENT_FLAG_REGISTERED)) {
// Unregistered agents never apply
- return (applies);
+ return applies;
}
- if (!allow_nexus &&
- (flags & NETAGENT_FLAG_NEXUS_PROVIDER)) {
- // Hide nexus providers unless allowed
- // Direct interfaces and direct policies are allowed to use a nexus
- // Delegate interfaces or re-scoped interfaces are not allowed
- return (applies);
+ const bool is_nexus_agent = ((flags & NETAGENT_FLAG_NEXUS_PROVIDER) ||
+ (flags & NETAGENT_FLAG_NEXUS_LISTENER) ||
+ (flags & NETAGENT_FLAG_CUSTOM_ETHER_NEXUS) ||
+ (flags & NETAGENT_FLAG_CUSTOM_IP_NEXUS) ||
+ (flags & NETAGENT_FLAG_INTERPOSE_NEXUS));
+ if (is_nexus_agent) {
+ if (!allow_nexus) {
+ // Hide nexus providers unless allowed
+ // Direct interfaces and direct policies are allowed to use a nexus
+ // Delegate interfaces or re-scoped interfaces are not allowed
+ return applies;
+ }
+
+ if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) &&
+ !(flags & NETAGENT_FLAG_CUSTOM_ETHER_NEXUS)) {
+ // Client requested a custom ether nexus, but this nexus isn't one
+ return applies;
+ }
+
+ if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP) &&
+ !(flags & NETAGENT_FLAG_CUSTOM_IP_NEXUS)) {
+ // Client requested a custom IP nexus, but this nexus isn't one
+ return applies;
+ }
+
+ if ((parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) &&
+ !(flags & NETAGENT_FLAG_INTERPOSE_NEXUS)) {
+ // Client requested an interpose nexus, but this nexus isn't one
+ return applies;
+ }
+
+ if (!(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) &&
+ !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP) &&
+ !(parameters->flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) &&
+ !(flags & NETAGENT_FLAG_NEXUS_PROVIDER)) {
+ // Client requested default parameters, but this nexus isn't generic
+ return applies;
+ }
}
if (uuid_compare(client->failed_trigger_agent.netagent_uuid, *netagent_uuid) == 0) {
if (client->failed_trigger_agent.generation == netagent_get_generation(*netagent_uuid)) {
// If this agent was triggered, and failed, and hasn't changed, keep hiding it
- return (applies);
+ return applies;
} else {
// Mismatch generation, clear out old trigger
uuid_clear(client->failed_trigger_agent.netagent_uuid);
if (flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY) {
// Specific use agents only apply when required
- bool required = FALSE;
- if (parameters != NULL) {
- // Check required agent UUIDs
- for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) {
- if (uuid_is_null(parameters->required_netagents[i])) {
- break;
- }
- if (uuid_compare(parameters->required_netagents[i], *netagent_uuid) == 0) {
- required = TRUE;
- break;
- }
- }
-
- if (!required) {
- // Check required agent types
- bool fetched_type = FALSE;
- char netagent_domain[NETAGENT_DOMAINSIZE];
- char netagent_type[NETAGENT_TYPESIZE];
- memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE);
- memset(&netagent_type, 0, NETAGENT_TYPESIZE);
-
- for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) {
- if (strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
- strlen(parameters->required_netagent_types[i].netagent_type) == 0) {
- break;
- }
-
- if (!fetched_type) {
- if (netagent_get_agent_domain_and_type(*netagent_uuid, netagent_domain, netagent_type)) {
- fetched_type = TRUE;
- } else {
- break;
- }
- }
-
- if ((strlen(parameters->required_netagent_types[i].netagent_domain) == 0 ||
- strncmp(netagent_domain, parameters->required_netagent_types[i].netagent_domain, NETAGENT_DOMAINSIZE) == 0) &&
- (strlen(parameters->required_netagent_types[i].netagent_type) == 0 ||
- strncmp(netagent_type, parameters->required_netagent_types[i].netagent_type, NETAGENT_TYPESIZE) == 0)) {
- required = TRUE;
- break;
- }
- }
- }
- }
-
- applies = required;
+ applies = necp_netagent_is_required(parameters, netagent_uuid);
} else {
applies = TRUE;
}
- return (applies);
+ return applies;
}
static void
necp_client_add_agent_interface_options(struct necp_client *client,
- const struct necp_client_parsed_parameters *parsed_parameters,
- ifnet_t ifp)
+ const struct necp_client_parsed_parameters *parsed_parameters,
+ ifnet_t ifp)
{
if (ifp != NULL && ifp->if_agentids != NULL) {
for (u_int32_t i = 0; i < ifp->if_agentcount; i++) {
}
// Relies on the side effect that nexus agents that apply will create flows
(void)necp_netagent_applies_to_client(client, parsed_parameters, &ifp->if_agentids[i], TRUE,
- ifp->if_index, ifnet_get_generation(ifp));
+ ifp->if_index, ifnet_get_generation(ifp));
+ }
+ }
+}
+
+static void
+necp_client_add_browse_interface_options(struct necp_client *client,
+ const struct necp_client_parsed_parameters *parsed_parameters,
+ ifnet_t ifp)
+{
+ if (ifp != NULL && ifp->if_agentids != NULL) {
+ for (u_int32_t i = 0; i < ifp->if_agentcount; i++) {
+ if (uuid_is_null(ifp->if_agentids[i])) {
+ continue;
+ }
+
+ u_int32_t flags = netagent_get_flags(ifp->if_agentids[i]);
+ if ((flags & NETAGENT_FLAG_REGISTERED) &&
+ (flags & NETAGENT_FLAG_ACTIVE) &&
+ (flags & NETAGENT_FLAG_SUPPORTS_BROWSE) &&
+ (!(flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY) ||
+ necp_netagent_is_required(parsed_parameters, &ifp->if_agentids[i]))) {
+ necp_client_add_interface_option_if_needed(client, ifp->if_index, ifnet_get_generation(ifp), &ifp->if_agentids[i]);
+
+ // Finding one is enough
+ break;
+ }
}
}
}
necp_client_address_is_valid(struct sockaddr *address)
{
if (address->sa_family == AF_INET) {
- return (address->sa_len == sizeof(struct sockaddr_in));
+ return address->sa_len == sizeof(struct sockaddr_in);
} else if (address->sa_family == AF_INET6) {
- return (address->sa_len == sizeof(struct sockaddr_in6));
+ return address->sa_len == sizeof(struct sockaddr_in6);
} else {
- return (FALSE);
+ return FALSE;
}
}
+static inline bool
+necp_client_endpoint_is_unspecified(struct necp_client_endpoint *endpoint)
+{
+ if (necp_client_address_is_valid(&endpoint->u.sa)) {
+ if (endpoint->u.sa.sa_family == AF_INET) {
+ return endpoint->u.sin.sin_addr.s_addr == INADDR_ANY;
+ } else if (endpoint->u.sa.sa_family == AF_INET6) {
+ return IN6_IS_ADDR_UNSPECIFIED(&endpoint->u.sin6.sin6_addr);
+ } else {
+ return TRUE;
+ }
+ } else {
+ return TRUE;
+ }
+}
+
+
static int
necp_client_parse_parameters(u_int8_t *parameters,
- u_int32_t parameters_size,
- struct necp_client_parsed_parameters *parsed_parameters)
+ u_int32_t parameters_size,
+ struct necp_client_parsed_parameters *parsed_parameters)
{
int error = 0;
size_t offset = 0;
u_int32_t num_prohibited_agent_types = 0;
u_int32_t num_preferred_agent_types = 0;
u_int32_t num_avoided_agent_types = 0;
+ u_int8_t *resolver_tag = NULL;
+ u_int32_t resolver_tag_length = 0;
+ u_int8_t *client_hostname = NULL;
+ u_int32_t hostname_length = 0;
+ uuid_t parent_id = {};
if (parsed_parameters == NULL) {
- return (EINVAL);
+ return EINVAL;
}
memset(parsed_parameters, 0, sizeof(struct necp_client_parsed_parameters));
u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
if (value != NULL) {
switch (type) {
- case NECP_CLIENT_PARAMETER_BOUND_INTERFACE: {
- if (length <= IFXNAMSIZ && length > 0) {
- ifnet_t bound_interface = NULL;
- char interface_name[IFXNAMSIZ];
- memcpy(interface_name, value, length);
- interface_name[length - 1] = 0; // Make sure the string is NULL terminated
- if (ifnet_find_by_name(interface_name, &bound_interface) == 0) {
- parsed_parameters->required_interface_index = bound_interface->if_index;
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF;
- ifnet_release(bound_interface);
- }
+ case NECP_CLIENT_PARAMETER_BOUND_INTERFACE: {
+ if (length <= IFXNAMSIZ && length > 0) {
+ ifnet_t bound_interface = NULL;
+ char interface_name[IFXNAMSIZ];
+ memcpy(interface_name, value, length);
+ interface_name[length - 1] = 0; // Make sure the string is NULL terminated
+ if (ifnet_find_by_name(interface_name, &bound_interface) == 0) {
+ parsed_parameters->required_interface_index = bound_interface->if_index;
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF;
+ ifnet_release(bound_interface);
}
- break;
}
- case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: {
- if (length >= sizeof(struct necp_policy_condition_addr)) {
- struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
- if (necp_client_address_is_valid(&address_struct->address.sa)) {
- memcpy(&parsed_parameters->local_addr, &address_struct->address, sizeof(address_struct->address));
- if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
- }
- if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
- (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
- }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: {
+ if (length >= sizeof(struct necp_policy_condition_addr)) {
+ struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
+ if (necp_client_address_is_valid(&address_struct->address.sa)) {
+ memcpy(&parsed_parameters->local_addr, &address_struct->address, sizeof(address_struct->address));
+ if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
}
- }
- break;
- }
- case NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT: {
- if (length >= sizeof(struct necp_client_endpoint)) {
- struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
- if (necp_client_address_is_valid(&endpoint->u.sa)) {
- memcpy(&parsed_parameters->local_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
- if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
- }
- if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
- (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
- }
+ if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
+ (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
}
}
- break;
}
- case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
- if (length >= sizeof(struct necp_policy_condition_addr)) {
- struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
- if (necp_client_address_is_valid(&address_struct->address.sa)) {
- memcpy(&parsed_parameters->remote_addr, &address_struct->address, sizeof(address_struct->address));
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT: {
+ if (length >= sizeof(struct necp_client_endpoint)) {
+ struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
+ if (necp_client_address_is_valid(&endpoint->u.sa)) {
+ memcpy(&parsed_parameters->local_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
+ if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) {
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR;
}
- }
- break;
- }
- case NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT: {
- if (length >= sizeof(struct necp_client_endpoint)) {
- struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
- if (necp_client_address_is_valid(&endpoint->u.sa)) {
- memcpy(&parsed_parameters->remote_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
+ if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) ||
+ (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) {
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT;
}
}
- break;
}
- case NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE: {
- if (num_prohibited_interfaces >= NECP_MAX_PARSED_PARAMETERS) {
- break;
- }
- if (length <= IFXNAMSIZ && length > 0) {
- memcpy(parsed_parameters->prohibited_interfaces[num_prohibited_interfaces], value, length);
- parsed_parameters->prohibited_interfaces[num_prohibited_interfaces][length - 1] = 0; // Make sure the string is NULL terminated
- num_prohibited_interfaces++;
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF;
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
+ if (length >= sizeof(struct necp_policy_condition_addr)) {
+ struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
+ if (necp_client_address_is_valid(&address_struct->address.sa)) {
+ memcpy(&parsed_parameters->remote_addr, &address_struct->address, sizeof(address_struct->address));
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
}
- break;
}
- case NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE: {
- if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) {
- break;
- }
- if (length >= sizeof(u_int8_t)) {
- memcpy(&parsed_parameters->required_interface_type, value, sizeof(u_int8_t));
- if (parsed_parameters->required_interface_type) {
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE;
- }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT: {
+ if (length >= sizeof(struct necp_client_endpoint)) {
+ struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
+ if (necp_client_address_is_valid(&endpoint->u.sa)) {
+ memcpy(&parsed_parameters->remote_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union));
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
}
- break;
}
- case NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE: {
- if (num_prohibited_interface_types >= NECP_MAX_PARSED_PARAMETERS) {
- break;
- }
- if (length >= sizeof(u_int8_t)) {
- memcpy(&parsed_parameters->prohibited_interface_types[num_prohibited_interface_types], value, sizeof(u_int8_t));
- num_prohibited_interface_types++;
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE;
- }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE: {
+ if (num_prohibited_interfaces >= NECP_MAX_INTERFACE_PARAMETERS) {
break;
}
- case NECP_CLIENT_PARAMETER_REQUIRE_AGENT: {
- if (num_required_agents >= NECP_MAX_PARSED_PARAMETERS) {
- break;
- }
- if (length >= sizeof(uuid_t)) {
- memcpy(&parsed_parameters->required_netagents[num_required_agents], value, sizeof(uuid_t));
- num_required_agents++;
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT;
- }
- break;
+ if (length <= IFXNAMSIZ && length > 0) {
+ memcpy(parsed_parameters->prohibited_interfaces[num_prohibited_interfaces], value, length);
+ parsed_parameters->prohibited_interfaces[num_prohibited_interfaces][length - 1] = 0; // Make sure the string is NULL terminated
+ num_prohibited_interfaces++;
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF;
}
- case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT: {
- if (num_prohibited_agents >= NECP_MAX_PARSED_PARAMETERS) {
- break;
- }
- if (length >= sizeof(uuid_t)) {
- memcpy(&parsed_parameters->prohibited_netagents[num_prohibited_agents], value, sizeof(uuid_t));
- num_prohibited_agents++;
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT;
- }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE: {
+ if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) {
break;
}
- case NECP_CLIENT_PARAMETER_PREFER_AGENT: {
- if (num_preferred_agents >= NECP_MAX_PARSED_PARAMETERS) {
- break;
- }
- if (length >= sizeof(uuid_t)) {
- memcpy(&parsed_parameters->preferred_netagents[num_preferred_agents], value, sizeof(uuid_t));
- num_preferred_agents++;
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT;
+ if (length >= sizeof(u_int8_t)) {
+ memcpy(&parsed_parameters->required_interface_type, value, sizeof(u_int8_t));
+ if (parsed_parameters->required_interface_type) {
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE;
}
- break;
}
- case NECP_CLIENT_PARAMETER_AVOID_AGENT: {
- if (num_avoided_agents >= NECP_MAX_PARSED_PARAMETERS) {
- break;
- }
- if (length >= sizeof(uuid_t)) {
- memcpy(&parsed_parameters->avoided_netagents[num_avoided_agents], value, sizeof(uuid_t));
- num_avoided_agents++;
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT;
- }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE: {
+ if (num_prohibited_interface_types >= NECP_MAX_INTERFACE_PARAMETERS) {
break;
}
- case NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE: {
- if (num_required_agent_types >= NECP_MAX_PARSED_PARAMETERS) {
- break;
- }
- if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
- memcpy(&parsed_parameters->required_netagent_types[num_required_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
- num_required_agent_types++;
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE;
- }
- break;
+ if (length >= sizeof(u_int8_t)) {
+ memcpy(&parsed_parameters->prohibited_interface_types[num_prohibited_interface_types], value, sizeof(u_int8_t));
+ num_prohibited_interface_types++;
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE;
}
- case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE: {
- if (num_prohibited_agent_types >= NECP_MAX_PARSED_PARAMETERS) {
- break;
- }
- if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
- memcpy(&parsed_parameters->prohibited_netagent_types[num_prohibited_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
- num_prohibited_agent_types++;
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE;
- }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_REQUIRE_AGENT: {
+ if (num_required_agents >= NECP_MAX_AGENT_PARAMETERS) {
break;
}
- case NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE: {
- if (num_preferred_agent_types >= NECP_MAX_PARSED_PARAMETERS) {
- break;
- }
- if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
- memcpy(&parsed_parameters->preferred_netagent_types[num_preferred_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
- num_preferred_agent_types++;
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE;
- }
- break;
+ if (length >= sizeof(uuid_t)) {
+ memcpy(&parsed_parameters->required_netagents[num_required_agents], value, sizeof(uuid_t));
+ num_required_agents++;
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT;
}
- case NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE: {
- if (num_avoided_agent_types >= NECP_MAX_PARSED_PARAMETERS) {
- break;
- }
- if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
- memcpy(&parsed_parameters->avoided_netagent_types[num_avoided_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
- num_avoided_agent_types++;
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE;
- }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT: {
+ if (num_prohibited_agents >= NECP_MAX_AGENT_PARAMETERS) {
break;
}
- case NECP_CLIENT_PARAMETER_FLAGS: {
- if (length >= sizeof(u_int32_t)) {
- memcpy(&parsed_parameters->flags, value, sizeof(parsed_parameters->flags));
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_FLAGS;
- }
+ if (length >= sizeof(uuid_t)) {
+ memcpy(&parsed_parameters->prohibited_netagents[num_prohibited_agents], value, sizeof(uuid_t));
+ num_prohibited_agents++;
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT;
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_PREFER_AGENT: {
+ if (num_preferred_agents >= NECP_MAX_AGENT_PARAMETERS) {
break;
}
- case NECP_CLIENT_PARAMETER_IP_PROTOCOL: {
- if (length >= sizeof(parsed_parameters->ip_protocol)) {
- memcpy(&parsed_parameters->ip_protocol, value, sizeof(parsed_parameters->ip_protocol));
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL;
- }
+ if (length >= sizeof(uuid_t)) {
+ memcpy(&parsed_parameters->preferred_netagents[num_preferred_agents], value, sizeof(uuid_t));
+ num_preferred_agents++;
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT;
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_AVOID_AGENT: {
+ if (num_avoided_agents >= NECP_MAX_AGENT_PARAMETERS) {
break;
}
- case NECP_CLIENT_PARAMETER_PID: {
- if (length >= sizeof(parsed_parameters->effective_pid)) {
- memcpy(&parsed_parameters->effective_pid, value, sizeof(parsed_parameters->effective_pid));
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID;
- }
+ if (length >= sizeof(uuid_t)) {
+ memcpy(&parsed_parameters->avoided_netagents[num_avoided_agents], value, sizeof(uuid_t));
+ num_avoided_agents++;
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT;
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE: {
+ if (num_required_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
break;
}
- case NECP_CLIENT_PARAMETER_APPLICATION: {
- if (length >= sizeof(parsed_parameters->effective_uuid)) {
- memcpy(&parsed_parameters->effective_uuid, value, sizeof(parsed_parameters->effective_uuid));
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID;
- }
+ if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
+ memcpy(&parsed_parameters->required_netagent_types[num_required_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
+ num_required_agent_types++;
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE;
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE: {
+ if (num_prohibited_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
break;
}
- case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: {
- if (length >= sizeof(parsed_parameters->traffic_class)) {
- memcpy(&parsed_parameters->traffic_class, value, sizeof(parsed_parameters->traffic_class));
- parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS;
- }
+ if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
+ memcpy(&parsed_parameters->prohibited_netagent_types[num_prohibited_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
+ num_prohibited_agent_types++;
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE;
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE: {
+ if (num_preferred_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
break;
}
- default: {
+ if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
+ memcpy(&parsed_parameters->preferred_netagent_types[num_preferred_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
+ num_preferred_agent_types++;
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE;
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE: {
+ if (num_avoided_agent_types >= NECP_MAX_AGENT_PARAMETERS) {
break;
}
+ if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
+ memcpy(&parsed_parameters->avoided_netagent_types[num_avoided_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
+ num_avoided_agent_types++;
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE;
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_FLAGS: {
+ if (length >= sizeof(u_int32_t)) {
+ memcpy(&parsed_parameters->flags, value, sizeof(parsed_parameters->flags));
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_FLAGS;
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_IP_PROTOCOL: {
+ if (length == sizeof(u_int16_t)) {
+ u_int16_t large_ip_protocol = 0;
+ memcpy(&large_ip_protocol, value, sizeof(large_ip_protocol));
+ parsed_parameters->ip_protocol = (u_int8_t)large_ip_protocol;
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL;
+ } else if (length >= sizeof(parsed_parameters->ip_protocol)) {
+ memcpy(&parsed_parameters->ip_protocol, value, sizeof(parsed_parameters->ip_protocol));
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL;
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL: {
+ if (length >= sizeof(parsed_parameters->transport_protocol)) {
+ memcpy(&parsed_parameters->transport_protocol, value, sizeof(parsed_parameters->transport_protocol));
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL;
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_PID: {
+ if (length >= sizeof(parsed_parameters->effective_pid)) {
+ memcpy(&parsed_parameters->effective_pid, value, sizeof(parsed_parameters->effective_pid));
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID;
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_DELEGATED_UPID: {
+ if (length >= sizeof(parsed_parameters->delegated_upid)) {
+ memcpy(&parsed_parameters->delegated_upid, value, sizeof(parsed_parameters->delegated_upid));
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_DELEGATED_UPID;
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_ETHERTYPE: {
+ if (length >= sizeof(parsed_parameters->ethertype)) {
+ memcpy(&parsed_parameters->ethertype, value, sizeof(parsed_parameters->ethertype));
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_ETHERTYPE;
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_APPLICATION: {
+ if (length >= sizeof(parsed_parameters->effective_uuid)) {
+ memcpy(&parsed_parameters->effective_uuid, value, sizeof(parsed_parameters->effective_uuid));
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID;
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: {
+ if (length >= sizeof(parsed_parameters->traffic_class)) {
+ memcpy(&parsed_parameters->traffic_class, value, sizeof(parsed_parameters->traffic_class));
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS;
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_RESOLVER_TAG: {
+ if (length > 0) {
+ resolver_tag = (u_int8_t *)value;
+ resolver_tag_length = length;
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_DOMAIN: {
+ if (length > 0) {
+ client_hostname = (u_int8_t *)value;
+ hostname_length = length;
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_PARENT_ID: {
+ if (length == sizeof(parent_id)) {
+ uuid_copy(parent_id, value);
+ }
+ break;
+ }
+ case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE: {
+ if (length >= sizeof(parsed_parameters->local_address_preference)) {
+ memcpy(&parsed_parameters->local_address_preference, value, sizeof(parsed_parameters->local_address_preference));
+ parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE;
+ }
+ break;
+ }
+ default: {
+ break;
+ }
}
}
}
offset += sizeof(struct necp_tlv_header) + length;
}
- return (error);
+ if (resolver_tag != NULL) {
+ union necp_sockaddr_union remote_addr;
+ memcpy(&remote_addr, &parsed_parameters->remote_addr, sizeof(remote_addr));
+ remote_addr.sin.sin_port = 0;
+ const bool validated = necp_validate_resolver_answer(parent_id,
+ client_hostname, hostname_length,
+ (u_int8_t *)&remote_addr, sizeof(remote_addr),
+ resolver_tag, resolver_tag_length);
+ if (!validated) {
+ error = EAUTH;
+ NECPLOG(LOG_ERR, "Failed to validate answer for hostname %s", client_hostname);
+ }
+ }
+
+ return error;
}
static int
necp_client_parse_result(u_int8_t *result,
- u_int32_t result_size,
- union necp_sockaddr_union *local_address,
- union necp_sockaddr_union *remote_address,
- void **flow_stats)
+ u_int32_t result_size,
+ union necp_sockaddr_union *local_address,
+ union necp_sockaddr_union *remote_address,
+ void **flow_stats)
{
#pragma unused(flow_stats)
int error = 0;
u_int8_t *value = necp_buffer_get_tlv_value(result, offset, NULL);
if (value != NULL) {
switch (type) {
- case NECP_CLIENT_RESULT_LOCAL_ENDPOINT: {
- if (length >= sizeof(struct necp_client_endpoint)) {
- struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
- if (local_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
- memcpy(local_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
- }
+ case NECP_CLIENT_RESULT_LOCAL_ENDPOINT: {
+ if (length >= sizeof(struct necp_client_endpoint)) {
+ struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
+ if (local_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
+ memcpy(local_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
}
- break;
}
- case NECP_CLIENT_RESULT_REMOTE_ENDPOINT: {
- if (length >= sizeof(struct necp_client_endpoint)) {
- struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
- if (remote_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
- memcpy(remote_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
- }
+ break;
+ }
+ case NECP_CLIENT_RESULT_REMOTE_ENDPOINT: {
+ if (length >= sizeof(struct necp_client_endpoint)) {
+ struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value;
+ if (remote_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) {
+ memcpy(remote_address, &endpoint->u.sa, endpoint->u.sa.sa_len);
}
- break;
- }
- default: {
- break;
}
+ break;
+ }
+ default: {
+ break;
+ }
}
}
}
offset += sizeof(struct necp_tlv_header) + length;
}
- return (error);
+ return error;
}
static struct necp_client_flow_registration *
static void
necp_client_add_socket_flow(struct necp_client_flow_registration *flow_registration,
- struct inpcb *inp)
+ struct inpcb *inp)
{
struct necp_client_flow *new_flow = mcache_alloc(necp_flow_cache, MCR_SLEEP);
if (new_flow == NULL) {
LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain);
}
-int
-necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp)
+static int
+necp_client_register_socket_inner(pid_t pid, uuid_t client_id, struct inpcb *inp, bool is_listener)
{
int error = 0;
struct necp_fd_data *client_fd = NULL;
struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id);
if (client != NULL) {
if (!pid || client->proc_pid == pid) {
- struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
- if (flow_registration != NULL) {
- // Found the right client and flow registration, add a new flow
+ if (is_listener) {
found_client = TRUE;
- necp_client_add_socket_flow(flow_registration, inp);
- } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
- // No flows yet on this client, add a new registration
- flow_registration = necp_client_create_flow_registration(client_fd, client);
- if (flow_registration == NULL) {
- error = ENOMEM;
- } else {
- // Add a new flow
+ } else {
+ // Find client flow and assign from socket
+ struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id);
+ if (flow_registration != NULL) {
+ // Found the right client and flow registration, add a new flow
found_client = TRUE;
necp_client_add_socket_flow(flow_registration, inp);
+ } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) {
+ // No flows yet on this client, add a new registration
+ flow_registration = necp_client_create_flow_registration(client_fd, client);
+ if (flow_registration == NULL) {
+ error = ENOMEM;
+ } else {
+ // Add a new flow
+ found_client = TRUE;
+ necp_client_add_socket_flow(flow_registration, inp);
+ }
}
}
}
}
}
- return (error);
+ return error;
+}
+
+int
+necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp)
+{
+ return necp_client_register_socket_inner(pid, client_id, inp, false);
+}
+
+int
+necp_client_register_socket_listener(pid_t pid, uuid_t client_id, struct inpcb *inp)
+{
+ return necp_client_register_socket_inner(pid, client_id, inp, true);
}
+
static void
necp_client_add_multipath_interface_flows(struct necp_client_flow_registration *flow_registration,
- struct necp_client *client,
- struct mppcb *mpp)
+ struct necp_client *client,
+ struct mppcb *mpp)
{
flow_registration->interface_handle = mpp;
flow_registration->interface_cb = mpp->necp_cb;
error = ENOENT;
}
- return (error);
+ return error;
}
-#define NETAGENT_DOMAIN_RADIO_MANAGER "WirelessRadioManager"
-#define NETAGENT_TYPE_RADIO_MANAGER "WirelessRadioManager:BB Manager"
+#define NETAGENT_DOMAIN_RADIO_MANAGER "WirelessRadioManager"
+#define NETAGENT_TYPE_RADIO_MANAGER "WirelessRadioManager:BB Manager"
static int
necp_client_lookup_bb_radio_manager(struct necp_client *client,
- uuid_t netagent_uuid)
+ uuid_t netagent_uuid)
{
char netagent_domain[NETAGENT_DOMAINSIZE];
char netagent_type[NETAGENT_TYPESIZE];
}
error = necp_application_find_policy_match_internal(proc, client->parameters, (u_int32_t)client->parameters_length,
- &result, NULL, 0, NULL, NULL, NULL, true);
+ &result, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL, true, true, NULL);
proc_rele(proc);
proc = PROC_NULL;
NECP_CLIENT_TREE_UNLOCK();
- return (error);
+ return error;
}
static int
error = ENOENT;
}
- return (error);
+ return error;
}
static int
struct necp_client_flow *temp_flow = NULL;
LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) {
if (!search_flow->socket && !search_flow->nexus &&
- search_flow->u.socket_handle == handle) {
+ search_flow->u.socket_handle == handle) {
search_flow->u.socket_handle = NULL;
search_flow->u.cb = NULL;
}
error = ENOENT;
}
- return (error);
+ return error;
}
int
uuid_clear(empty_uuid);
flow->assigned = TRUE;
flow->assigned_results = necp_create_nexus_assign_message(empty_uuid, 0, NULL, 0,
- (struct necp_client_endpoint *)&flow->local_addr,
- (struct necp_client_endpoint *)&flow->remote_addr,
- 0, NULL, &flow->assigned_results_length);
+ (struct necp_client_endpoint *)&flow->local_addr,
+ (struct necp_client_endpoint *)&flow->remote_addr,
+ NULL, 0, NULL, &flow->assigned_results_length);
flow_registration->flow_result_read = FALSE;
client_updated = TRUE;
break;
}
}
- return (error);
+ return error;
+}
+
+bool
+necp_socket_is_allowed_to_recv_on_interface(struct inpcb *inp, ifnet_t interface)
+{
+ if (interface == NULL ||
+ inp == NULL ||
+ !(inp->inp_flags2 & INP2_EXTERNAL_PORT) ||
+ uuid_is_null(inp->necp_client_uuid)) {
+ // If there's no interface or client ID to check,
+ // or if this is not a listener, pass.
+ // Outbound connections will have already been
+ // validated for policy.
+ return TRUE;
+ }
+
+ // Only filter out listener sockets (no remote address specified)
+ if ((inp->inp_vflag & INP_IPV4) &&
+ inp->inp_faddr.s_addr != INADDR_ANY) {
+ return TRUE;
+ }
+ if ((inp->inp_vflag & INP_IPV6) &&
+ !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
+ return TRUE;
+ }
+
+ bool allowed = TRUE;
+
+ NECP_CLIENT_TREE_LOCK_SHARED();
+
+ struct necp_client *client = necp_find_client_and_lock(inp->necp_client_uuid);
+ if (client != NULL) {
+ struct necp_client_parsed_parameters *parsed_parameters = NULL;
+
+ MALLOC(parsed_parameters, struct necp_client_parsed_parameters *, sizeof(*parsed_parameters), M_NECP, (M_WAITOK | M_ZERO));
+ if (parsed_parameters != NULL) {
+ int error = necp_client_parse_parameters(client->parameters, (u_int32_t)client->parameters_length, parsed_parameters);
+ if (error == 0) {
+ if (!necp_ifnet_matches_parameters(interface, parsed_parameters, 0, NULL, true, false)) {
+ allowed = FALSE;
+ }
+ }
+ FREE(parsed_parameters, M_NECP);
+ }
+
+ NECP_CLIENT_UNLOCK(client);
+ }
+
+ NECP_CLIENT_TREE_UNLOCK();
+
+ return allowed;
}
int
LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
// Verify that the client nexus agent matches
if (flow->nexus &&
- uuid_compare(flow->u.nexus_agent,
- netagent_uuid) == 0) {
+ uuid_compare(flow->u.nexus_agent,
+ netagent_uuid) == 0) {
flow->has_protoctl_event = TRUE;
flow->protoctl_event.protoctl_event_code = protoctl_event_code;
flow->protoctl_event.protoctl_event_val = protoctl_event_val;
} else if (!client_updated) {
error = EINVAL;
}
- return (error);
+ return error;
}
static bool
necp_assign_client_result_locked(struct proc *proc,
- struct necp_fd_data *client_fd,
- struct necp_client *client,
- struct necp_client_flow_registration *flow_registration,
- uuid_t netagent_uuid,
- u_int8_t *assigned_results,
- size_t assigned_results_length,
- bool notify_fd)
+ struct necp_fd_data *client_fd,
+ struct necp_client *client,
+ struct necp_client_flow_registration *flow_registration,
+ uuid_t netagent_uuid,
+ u_int8_t *assigned_results,
+ size_t assigned_results_length,
+ bool notify_fd)
{
bool client_updated = FALSE;
LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) {
// Verify that the client nexus agent matches
if (flow->nexus &&
- uuid_compare(flow->u.nexus_agent, netagent_uuid) == 0) {
+ uuid_compare(flow->u.nexus_agent, netagent_uuid) == 0) {
// Release prior results and route
if (flow->assigned_results != NULL) {
FREE(flow->assigned_results, M_NETAGENT);
void *nexus_stats = NULL;
if (assigned_results != NULL && assigned_results_length > 0) {
int error = necp_client_parse_result(assigned_results, (u_int32_t)assigned_results_length,
- &flow->local_addr, &flow->remote_addr, &nexus_stats);
+ &flow->local_addr, &flow->remote_addr, &nexus_stats);
VERIFY(error == 0);
}
}
// if not updated, client must free assigned_results
- return (client_updated);
+ return client_updated;
}
int
necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id,
- u_int8_t *assigned_results, size_t assigned_results_length)
+ u_int8_t *assigned_results, size_t assigned_results_length)
{
int error = 0;
struct necp_fd_data *client_fd = NULL;
// Found the right client and flow!
found_client = TRUE;
if (necp_assign_client_result_locked(proc, client_fd, client, flow_registration, netagent_uuid,
- assigned_results, assigned_results_length, true)) {
+ assigned_results, assigned_results_length, true)) {
client_updated = TRUE;
}
}
error = EINVAL;
}
- return (error);
+ return error;
}
/// Client updating
static bool
necp_update_parsed_parameters(struct necp_client_parsed_parameters *parsed_parameters,
- struct necp_aggregate_result *result)
+ struct necp_aggregate_result *result)
{
if (parsed_parameters == NULL ||
- result == NULL) {
- return (false);
+ result == NULL) {
+ return false;
}
bool updated = false;
// This is a scoped agent. Add it to the required agents.
if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
// Already some required agents, add this at the end
- for (int j = 0; j < NECP_MAX_PARSED_PARAMETERS; j++) {
+ for (int j = 0; j < NECP_MAX_AGENT_PARAMETERS; j++) {
if (uuid_compare(parsed_parameters->required_netagents[j], result->netagents[i]) == 0) {
// Already required, break
break;
char remove_agent_domain[NETAGENT_DOMAINSIZE] = { 0 };
char remove_agent_type[NETAGENT_TYPESIZE] = { 0 };
if (netagent_get_agent_domain_and_type(result->netagents[i], remove_agent_domain, remove_agent_type)) {
- for (int j = 0; j < NECP_MAX_PARSED_PARAMETERS; j++) {
+ for (int j = 0; j < NECP_MAX_AGENT_PARAMETERS; j++) {
if (strlen(parsed_parameters->required_netagent_types[j].netagent_domain) == 0 &&
- strlen(parsed_parameters->required_netagent_types[j].netagent_type) == 0) {
+ strlen(parsed_parameters->required_netagent_types[j].netagent_type) == 0) {
break;
}
if (strncmp(parsed_parameters->required_netagent_types[j].netagent_domain, remove_agent_domain, NETAGENT_DOMAINSIZE) == 0 &&
- strncmp(parsed_parameters->required_netagent_types[j].netagent_type, remove_agent_type, NETAGENT_TYPESIZE) == 0) {
-
+ strncmp(parsed_parameters->required_netagent_types[j].netagent_type, remove_agent_type, NETAGENT_TYPESIZE) == 0) {
updated = true;
- if (j == NECP_MAX_PARSED_PARAMETERS - 1) {
+ if (j == NECP_MAX_AGENT_PARAMETERS - 1) {
// Last field, just clear and break
- memset(&parsed_parameters->required_netagent_types[NECP_MAX_PARSED_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
+ memset(&parsed_parameters->required_netagent_types[NECP_MAX_AGENT_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
break;
} else {
// Move the parameters down, clear the last entry
memmove(&parsed_parameters->required_netagent_types[j],
- &parsed_parameters->required_netagent_types[j + 1],
- sizeof(struct necp_client_parameter_netagent_type) * (NECP_MAX_PARSED_PARAMETERS - (j + 1)));
- memset(&parsed_parameters->required_netagent_types[NECP_MAX_PARSED_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
+ &parsed_parameters->required_netagent_types[j + 1],
+ sizeof(struct necp_client_parameter_netagent_type) * (NECP_MAX_AGENT_PARAMETERS - (j + 1)));
+ memset(&parsed_parameters->required_netagent_types[NECP_MAX_AGENT_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type));
// Continue, don't increment but look at the new shifted item instead
continue;
}
}
if (updated &&
- parsed_parameters->required_interface_index != IFSCOPE_NONE &&
- (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) {
+ parsed_parameters->required_interface_index != IFSCOPE_NONE &&
+ (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) {
// A required interface index was added after the fact. Clear it.
parsed_parameters->required_interface_index = IFSCOPE_NONE;
}
- return (updated);
+ return updated;
}
static inline bool
necp_agent_types_match(const char *agent_domain1, const char *agent_type1,
- const char *agent_domain2, const char *agent_type2)
+ const char *agent_domain2, const char *agent_type2)
{
- return ((strlen(agent_domain1) == 0 ||
- strncmp(agent_domain2, agent_domain1, NETAGENT_DOMAINSIZE) == 0) &&
- (strlen(agent_type1) == 0 ||
- strncmp(agent_type2, agent_type1, NETAGENT_TYPESIZE) == 0));
+ return (strlen(agent_domain1) == 0 ||
+ strncmp(agent_domain2, agent_domain1, NETAGENT_DOMAINSIZE) == 0) &&
+ (strlen(agent_type1) == 0 ||
+ strncmp(agent_type2, agent_type1, NETAGENT_TYPESIZE) == 0);
}
static inline bool
necp_calculate_client_result(proc_t proc,
- struct necp_client *client,
- struct necp_client_parsed_parameters *parsed_parameters,
- struct necp_aggregate_result *result,
- u_int32_t *flags)
+ struct necp_client *client,
+ struct necp_client_parsed_parameters *parsed_parameters,
+ struct necp_aggregate_result *result,
+ u_int32_t *flags,
+ u_int32_t *reason,
+ struct necp_client_endpoint *v4_gateway,
+ struct necp_client_endpoint *v6_gateway,
+ uuid_t *override_euuid)
{
struct rtentry *route = NULL;
// Interface found or not needed, match policy.
memset(result, 0, sizeof(*result));
int error = necp_application_find_policy_match_internal(proc, client->parameters,
- (u_int32_t)client->parameters_length,
- result, flags, matching_if_index,
- NULL, NULL, &route, false);
+ (u_int32_t)client->parameters_length,
+ result, flags, reason, matching_if_index,
+ NULL, NULL,
+ v4_gateway, v6_gateway,
+ &route, false, true,
+ override_euuid);
if (error != 0) {
if (route != NULL) {
rtfree(route);
}
- return (FALSE);
+ return FALSE;
}
if (validate_agents) {
bool requirement_failed = FALSE;
if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
- for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) {
+ for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
if (uuid_is_null(parsed_parameters->required_netagents[i])) {
break;
}
}
if (!requirement_failed && parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
- for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) {
+ for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 &&
- strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
+ strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
break;
}
if (netagent_get_agent_domain_and_type(result->netagents[j], policy_agent_domain, policy_agent_type)) {
if (necp_agent_types_match(parsed_parameters->required_netagent_types[i].netagent_domain,
- parsed_parameters->required_netagent_types[i].netagent_type,
- policy_agent_domain, policy_agent_type)) {
+ parsed_parameters->required_netagent_types[i].netagent_type,
+ policy_agent_domain, policy_agent_type)) {
requirement_found = TRUE;
break;
}
if (route != NULL) {
rtfree(route);
}
- return (TRUE);
+ return TRUE;
}
}
memset(result, 0, sizeof(*result));
}
- return (TRUE);
+ return TRUE;
}
+#define NECP_PARSED_PARAMETERS_REQUIRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF | \
+ NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
+ NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
+ NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE)
+
static bool
necp_update_client_result(proc_t proc,
- struct necp_fd_data *client_fd,
- struct necp_client *client,
- struct _necp_flow_defunct_list *defunct_list)
+ struct necp_fd_data *client_fd,
+ struct necp_client *client,
+ struct _necp_flow_defunct_list *defunct_list)
{
struct necp_client_result_netagent netagent;
struct necp_aggregate_result result;
struct necp_client_parsed_parameters *parsed_parameters = NULL;
u_int32_t flags = 0;
+ u_int32_t reason = 0;
NECP_CLIENT_ASSERT_LOCKED(client);
MALLOC(parsed_parameters, struct necp_client_parsed_parameters *, sizeof(*parsed_parameters), M_NECP, (M_WAITOK | M_ZERO));
if (parsed_parameters == NULL) {
- NECPLOG0(LOG_ERR, "Failed to allocate parsed parameters");
- return (FALSE);
+ NECPLOG0(LOG_ERR, "Failed to allocate parsed parameters");
+ return FALSE;
}
// Nexus flows will be brought back if they are still valid
int error = necp_client_parse_parameters(client->parameters, (u_int32_t)client->parameters_length, parsed_parameters);
if (error != 0) {
FREE(parsed_parameters, M_NECP);
- return (FALSE);
+ return FALSE;
}
// Update saved IP protocol
client->ip_protocol = parsed_parameters->ip_protocol;
// Calculate the policy result
- if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags)) {
+ struct necp_client_endpoint v4_gateway = {};
+ struct necp_client_endpoint v6_gateway = {};
+ uuid_t override_euuid;
+ uuid_clear(override_euuid);
+ if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags, &reason, &v4_gateway, &v6_gateway, &override_euuid)) {
FREE(parsed_parameters, M_NECP);
- return (FALSE);
+ return FALSE;
}
if (necp_update_parsed_parameters(parsed_parameters, &result)) {
// Changed the parameters based on result, try again (only once)
- if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags)) {
+ if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags, &reason, &v4_gateway, &v6_gateway, &override_euuid)) {
FREE(parsed_parameters, M_NECP);
- return (FALSE);
+ return FALSE;
}
}
+ if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
+ parsed_parameters->required_interface_index != IFSCOPE_NONE &&
+ (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) {
+ // Listener should not apply required interface index if
+ parsed_parameters->required_interface_index = IFSCOPE_NONE;
+ }
+
// Save the last policy id on the client
client->policy_id = result.policy_id;
+ uuid_copy(client->override_euuid, override_euuid);
if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_MULTIPATH) ||
- ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
- result.routing_result != NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED)) {
+ (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) ||
+ ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
+ result.routing_result != NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED)) {
client->allow_multiple_flows = TRUE;
} else {
client->allow_multiple_flows = FALSE;
// If the original request was scoped, and the policy result matches, make sure the result is scoped
if ((result.routing_result == NECP_KERNEL_POLICY_RESULT_NONE ||
- result.routing_result == NECP_KERNEL_POLICY_RESULT_PASS) &&
- result.routed_interface_index != IFSCOPE_NONE &&
- parsed_parameters->required_interface_index == result.routed_interface_index) {
+ result.routing_result == NECP_KERNEL_POLICY_RESULT_PASS) &&
+ result.routed_interface_index != IFSCOPE_NONE &&
+ parsed_parameters->required_interface_index == result.routed_interface_index) {
result.routing_result = NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED;
result.routing_result_parameter.scoped_interface_index = result.routed_interface_index;
}
if (defunct_list != NULL &&
- result.routing_result == NECP_KERNEL_POLICY_RESULT_DROP) {
+ result.routing_result == NECP_KERNEL_POLICY_RESULT_DROP) {
// If we are forced to drop the client, defunct it if it has flows
necp_defunct_client_for_policy(client, defunct_list);
}
bool updated = FALSE;
u_int8_t *cursor = client->result;
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FLAGS, sizeof(flags), &flags, &updated, client->result, sizeof(client->result));
+ if (reason != 0) {
+ cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_REASON, sizeof(reason), &reason, &updated, client->result, sizeof(client->result));
+ }
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_CLIENT_ID, sizeof(uuid_t), client->client_id, &updated,
- client->result, sizeof(client->result));
+ client->result, sizeof(client->result));
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT, sizeof(result.routing_result), &result.routing_result, &updated,
- client->result, sizeof(client->result));
+ client->result, sizeof(client->result));
if (result.routing_result_parameter.tunnel_interface_index != 0) {
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER,
- sizeof(result.routing_result_parameter), &result.routing_result_parameter, &updated,
- client->result, sizeof(client->result));
+ sizeof(result.routing_result_parameter), &result.routing_result_parameter, &updated,
+ client->result, sizeof(client->result));
}
if (result.filter_control_unit != 0) {
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT,
- sizeof(result.filter_control_unit), &result.filter_control_unit, &updated,
- client->result, sizeof(client->result));
+ sizeof(result.filter_control_unit), &result.filter_control_unit, &updated,
+ client->result, sizeof(client->result));
}
if (result.routed_interface_index != 0) {
u_int routed_interface_index = result.routed_interface_index;
if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
- parsed_parameters->required_interface_index != IFSCOPE_NONE &&
- parsed_parameters->required_interface_index != result.routed_interface_index) {
+ (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_REQUIRED_FIELDS) &&
+ parsed_parameters->required_interface_index != IFSCOPE_NONE &&
+ parsed_parameters->required_interface_index != result.routed_interface_index) {
routed_interface_index = parsed_parameters->required_interface_index;
}
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_INDEX,
- sizeof(routed_interface_index), &routed_interface_index, &updated,
- client->result, sizeof(client->result));
+ sizeof(routed_interface_index), &routed_interface_index, &updated,
+ client->result, sizeof(client->result));
}
if (client_fd && client_fd->flags & NECP_OPEN_FLAG_BACKGROUND) {
u_int32_t effective_traffic_class = SO_TC_BK_SYS;
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS,
- sizeof(effective_traffic_class), &effective_traffic_class, &updated,
- client->result, sizeof(client->result));
+ sizeof(effective_traffic_class), &effective_traffic_class, &updated,
+ client->result, sizeof(client->result));
}
- if (client->background_update) {
- u_int32_t background = client->background;
- cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG,
- sizeof(background), &background, &updated,
- client->result, sizeof(client->result));
- if (updated) {
- client->background_update = 0;
+
+ if (client_fd->background) {
+ bool has_assigned_flow = FALSE;
+ struct necp_client_flow_registration *flow_registration = NULL;
+ struct necp_client_flow *search_flow = NULL;
+ RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
+ LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
+ if (search_flow->assigned) {
+ has_assigned_flow = TRUE;
+ break;
+ }
+ }
+ }
+
+ if (has_assigned_flow) {
+ u_int32_t background = client_fd->background;
+ cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG,
+ sizeof(background), &background, &updated,
+ client->result, sizeof(client->result));
}
}
+
+ bool write_v4_gateway = !necp_client_endpoint_is_unspecified(&v4_gateway);
+ bool write_v6_gateway = !necp_client_endpoint_is_unspecified(&v6_gateway);
+
NECP_CLIENT_ROUTE_LOCK(client);
if (client->current_route != NULL) {
const u_int32_t route_mtu = get_maxmtu(client->current_route);
if (route_mtu != 0) {
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_MTU,
- sizeof(route_mtu), &route_mtu, &updated,
- client->result, sizeof(client->result));
+ sizeof(route_mtu), &route_mtu, &updated,
+ client->result, sizeof(client->result));
+ }
+ bool has_remote_addr = parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR;
+ if (has_remote_addr && client->current_route->rt_gateway != NULL) {
+ if (client->current_route->rt_gateway->sa_family == AF_INET) {
+ write_v6_gateway = false;
+ } else if (client->current_route->rt_gateway->sa_family == AF_INET6) {
+ write_v4_gateway = false;
+ }
}
}
NECP_CLIENT_ROUTE_UNLOCK(client);
+ if (write_v4_gateway) {
+ cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_GATEWAY,
+ sizeof(struct necp_client_endpoint), &v4_gateway, &updated,
+ client->result, sizeof(client->result));
+ }
+
+ if (write_v6_gateway) {
+ cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_GATEWAY,
+ sizeof(struct necp_client_endpoint), &v6_gateway, &updated,
+ client->result, sizeof(client->result));
+ }
+
if (result.mss_recommended != 0) {
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_RECOMMENDED_MSS,
- sizeof(result.mss_recommended), &result.mss_recommended, &updated,
- client->result, sizeof(client->result));
+ sizeof(result.mss_recommended), &result.mss_recommended, &updated,
+ client->result, sizeof(client->result));
}
for (int i = 0; i < NECP_MAX_NETAGENTS; i++) {
netagent.generation = netagent_get_generation(netagent.netagent_uuid);
if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE, 0, 0)) {
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
- client->result, sizeof(client->result));
+ client->result, sizeof(client->result));
}
}
if (result.routed_interface_index != IFSCOPE_NONE && result.routed_interface_index <= (u_int32_t)if_index) {
direct_interface = ifindex2ifnet[result.routed_interface_index];
} else if (parsed_parameters->required_interface_index != IFSCOPE_NONE &&
- parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
+ parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
// If the request was scoped, but the route didn't match, still grab the agents
direct_interface = ifindex2ifnet[parsed_parameters->required_interface_index];
} else if (result.routed_interface_index == IFSCOPE_NONE &&
- result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED &&
- result.routing_result_parameter.scoped_interface_index != IFSCOPE_NONE) {
+ result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED &&
+ result.routing_result_parameter.scoped_interface_index != IFSCOPE_NONE) {
direct_interface = ifindex2ifnet[result.routing_result_parameter.scoped_interface_index];
}
if (direct_interface != NULL) {
delegate_interface = direct_interface->if_delegated.ifp;
}
if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
- parsed_parameters->required_interface_index != IFSCOPE_NONE &&
- parsed_parameters->required_interface_index != result.routing_result_parameter.tunnel_interface_index &&
- parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
+ (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_REQUIRED_FIELDS) &&
+ parsed_parameters->required_interface_index != IFSCOPE_NONE &&
+ parsed_parameters->required_interface_index != result.routing_result_parameter.tunnel_interface_index &&
+ parsed_parameters->required_interface_index <= (u_int32_t)if_index) {
original_scoped_interface = ifindex2ifnet[parsed_parameters->required_interface_index];
}
// Add interfaces
interface_struct.index = original_scoped_interface->if_index;
interface_struct.generation = ifnet_get_generation(original_scoped_interface);
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
- client->result, sizeof(client->result));
+ client->result, sizeof(client->result));
}
if (direct_interface != NULL) {
struct necp_client_result_interface interface_struct;
interface_struct.index = direct_interface->if_index;
interface_struct.generation = ifnet_get_generation(direct_interface);
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
- client->result, sizeof(client->result));
+ client->result, sizeof(client->result));
// Set the delta time since interface up/down
struct timeval updown_delta = {};
u_int32_t delta = updown_delta.tv_sec;
bool ignore_updated = FALSE;
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_TIME_DELTA,
- sizeof(delta), &delta, &ignore_updated,
- client->result, sizeof(client->result));
+ sizeof(delta), &delta, &ignore_updated,
+ client->result, sizeof(client->result));
}
}
if (delegate_interface != NULL) {
interface_struct.index = delegate_interface->if_index;
interface_struct.generation = ifnet_get_generation(delegate_interface);
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated,
- client->result, sizeof(client->result));
+ client->result, sizeof(client->result));
}
// Update multipath/listener interface flows
// Get multipath interface options from ordered list
struct ifnet *multi_interface = NULL;
TAILQ_FOREACH(multi_interface, &ifnet_ordered_head, if_ordered_link) {
- if (necp_ifnet_matches_parameters(multi_interface, parsed_parameters, NULL, true)) {
+ if (necp_ifnet_matches_parameters(multi_interface, parsed_parameters, 0, NULL, true, false)) {
// Add multipath interface flows for kernel MPTCP
necp_client_add_interface_option_if_needed(client, multi_interface->if_index,
- ifnet_get_generation(multi_interface), NULL);
+ ifnet_get_generation(multi_interface), NULL);
// Add nexus agents for multipath
necp_client_add_agent_interface_options(client, parsed_parameters, multi_interface);
}
}
- } else if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) &&
- result.routing_result != NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) {
- // Get listener interface options from global list
- struct ifnet *listen_interface = NULL;
- TAILQ_FOREACH(listen_interface, &ifnet_head, if_link) {
- if (necp_ifnet_matches_parameters(listen_interface, parsed_parameters, NULL, true)) {
+ } else if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) {
+ if (result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) {
+ if (direct_interface != NULL) {
+ // If scoped, only listen on that interface
// Add nexus agents for listeners
- necp_client_add_agent_interface_options(client, parsed_parameters, listen_interface);
+ necp_client_add_agent_interface_options(client, parsed_parameters, direct_interface);
+
+ // Add interface option in case it is not a nexus
+ necp_client_add_interface_option_if_needed(client, direct_interface->if_index,
+ ifnet_get_generation(direct_interface), NULL);
+ }
+ } else {
+ // Get listener interface options from global list
+ struct ifnet *listen_interface = NULL;
+ TAILQ_FOREACH(listen_interface, &ifnet_head, if_link) {
+ if ((listen_interface->if_flags & (IFF_UP | IFF_RUNNING)) &&
+ necp_ifnet_matches_parameters(listen_interface, parsed_parameters, 0, NULL, true, false)) {
+ // Add nexus agents for listeners
+ necp_client_add_agent_interface_options(client, parsed_parameters, listen_interface);
+ }
+ }
+ }
+ } else if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_BROWSE) {
+ if (result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) {
+ if (direct_interface != NULL) {
+ // Add browse option if it has an agent
+ necp_client_add_browse_interface_options(client, parsed_parameters, direct_interface);
+ }
+ } else {
+ // Get browse interface options from global list
+ struct ifnet *browse_interface = NULL;
+ TAILQ_FOREACH(browse_interface, &ifnet_head, if_link) {
+ if (necp_ifnet_matches_parameters(browse_interface, parsed_parameters, 0, NULL, true, false)) {
+ necp_client_add_browse_interface_options(client, parsed_parameters, browse_interface);
+ }
}
}
}
uuid_copy(netagent.netagent_uuid, original_scoped_interface->if_agentids[i]);
netagent.generation = netagent_get_generation(netagent.netagent_uuid);
if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE,
- original_scoped_interface->if_index, ifnet_get_generation(original_scoped_interface))) {
+ original_scoped_interface->if_index, ifnet_get_generation(original_scoped_interface))) {
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
- client->result, sizeof(client->result));
+ client->result, sizeof(client->result));
}
}
}
uuid_copy(netagent.netagent_uuid, direct_interface->if_agentids[i]);
netagent.generation = netagent_get_generation(netagent.netagent_uuid);
if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE,
- direct_interface->if_index, ifnet_get_generation(direct_interface))) {
+ direct_interface->if_index, ifnet_get_generation(direct_interface))) {
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
- client->result, sizeof(client->result));
+ client->result, sizeof(client->result));
}
}
}
uuid_copy(netagent.netagent_uuid, delegate_interface->if_agentids[i]);
netagent.generation = netagent_get_generation(netagent.netagent_uuid);
if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE,
- delegate_interface->if_index, ifnet_get_generation(delegate_interface))) {
+ delegate_interface->if_index, ifnet_get_generation(delegate_interface))) {
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated,
- client->result, sizeof(client->result));
+ client->result, sizeof(client->result));
}
}
}
if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) {
struct necp_client_interface_option *option = &client->interface_options[option_i];
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated,
- client->result, sizeof(client->result));
+ client->result, sizeof(client->result));
} else {
struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT];
cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated,
- client->result, sizeof(client->result));
+ client->result, sizeof(client->result));
}
}
}
FREE(parsed_parameters, M_NECP);
- return (updated);
+ return updated;
}
static inline void
RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
if (search_flow->nexus &&
- !uuid_is_null(search_flow->u.nexus_agent)) {
-
- struct necp_flow_defunct *flow_defunct;
-
+ !uuid_is_null(search_flow->u.nexus_agent)) {
// Sleeping alloc won't fail; copy only what's necessary
- flow_defunct = _MALLOC(sizeof (struct necp_flow_defunct), M_NECP, M_WAITOK | M_ZERO);
+ struct necp_flow_defunct *flow_defunct = _MALLOC(sizeof(struct necp_flow_defunct), M_NECP, M_WAITOK | M_ZERO);
uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent);
uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ?
- client->client_id :
- flow_registration->registration_id));
+ client->client_id :
+ flow_registration->registration_id));
flow_defunct->proc_pid = client->proc_pid;
flow_defunct->agent_handle = client->agent_handle;
-
+ flow_defunct->flags = flow_registration->flags;
// Add to the list provided by caller
LIST_INSERT_HEAD(defunct_list, flow_defunct, chain);
static inline void
necp_update_client_fd_locked(struct necp_fd_data *client_fd,
- proc_t proc,
- struct _necp_flow_defunct_list *defunct_list)
+ proc_t proc,
+ struct _necp_flow_defunct_list *defunct_list)
{
struct necp_client *client = NULL;
bool updated_result = FALSE;
static void
necp_update_all_clients_callout(__unused thread_call_param_t dummy,
- __unused thread_call_param_t arg)
+ __unused thread_call_param_t arg)
{
struct necp_fd_data *client_fd = NULL;
// For each newly defunct client, send a message to the nexus to remove the flow
LIST_FOREACH_SAFE(flow_defunct, &defunct_list, chain, temp_flow_defunct) {
if (!uuid_is_null(flow_defunct->nexus_agent)) {
- int netagent_error = netagent_client_message(flow_defunct->nexus_agent,
- flow_defunct->flow_id,
- flow_defunct->proc_pid,
- flow_defunct->agent_handle,
- NETAGENT_MESSAGE_TYPE_ABORT_NEXUS);
+ u_int8_t message_type = NETAGENT_MESSAGE_TYPE_ABORT_NEXUS;
+ if (((flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
+ (flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
+ !(flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
+ message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
+ }
+ int netagent_error = netagent_client_message_with_params(flow_defunct->nexus_agent,
+ flow_defunct->flow_id,
+ flow_defunct->proc_pid,
+ flow_defunct->agent_handle,
+ message_type,
+ flow_defunct->has_close_parameters ? &flow_defunct->close_parameters : NULL,
+ NULL, 0);
if (netagent_error != 0) {
- char namebuf[MAXCOMLEN+1];
- (void) strlcpy(namebuf, "unknown", sizeof (namebuf));
- proc_name(flow_defunct->proc_pid, namebuf, sizeof (namebuf));
+ char namebuf[MAXCOMLEN + 1];
+ (void) strlcpy(namebuf, "unknown", sizeof(namebuf));
+ proc_name(flow_defunct->proc_pid, namebuf, sizeof(namebuf));
NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR), "necp_update_client abort nexus error (%d) for pid %d %s", netagent_error, flow_defunct->proc_pid, namebuf);
}
}
void
necp_update_all_clients(void)
+{
+ necp_update_all_clients_immediately_if_needed(false);
+}
+
+void
+necp_update_all_clients_immediately_if_needed(bool should_update_immediately)
{
if (necp_client_update_tcall == NULL) {
// Don't try to update clients if the module is not initialized
uint64_t deadline = 0;
uint64_t leeway = 0;
- clock_interval_to_deadline(necp_timeout_microseconds, NSEC_PER_USEC, &deadline);
- clock_interval_to_absolutetime_interval(necp_timeout_leeway_microseconds, NSEC_PER_USEC, &leeway);
+
+ uint32_t timeout_to_use = necp_timeout_microseconds;
+ uint32_t leeway_to_use = necp_timeout_leeway_microseconds;
+ if (should_update_immediately) {
+ timeout_to_use = 1000 * 10; // 10ms
+ leeway_to_use = 1000 * 10; // 10ms;
+ }
+
+ clock_interval_to_deadline(timeout_to_use, NSEC_PER_USEC, &deadline);
+ clock_interval_to_absolutetime_interval(leeway_to_use, NSEC_PER_USEC, &leeway);
thread_call_enter_delayed_with_leeway(necp_client_update_tcall, NULL,
- deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
+ deadline, leeway, THREAD_CALL_DELAY_LEEWAY);
}
-void
+bool
necp_set_client_as_background(proc_t proc,
- struct fileproc *fp,
- bool background)
+ struct fileproc *fp,
+ bool background)
{
- bool updated_result = FALSE;
- struct necp_client *client = NULL;
-
if (proc == PROC_NULL) {
NECPLOG0(LOG_ERR, "NULL proc");
- return;
+ return FALSE;
}
if (fp == NULL) {
NECPLOG0(LOG_ERR, "NULL fp");
- return;
+ return FALSE;
}
struct necp_fd_data *client_fd = (struct necp_fd_data *)fp->f_fglob->fg_data;
if (client_fd == NULL) {
NECPLOG0(LOG_ERR, "Could not find client structure for backgrounded client");
- return;
+ return FALSE;
}
if (client_fd->necp_fd_type != necp_fd_type_client) {
// Not a client fd, ignore
NECPLOG0(LOG_ERR, "Not a client fd, ignore");
- return;
+ return FALSE;
}
- NECP_FD_LOCK(client_fd);
-
- RB_FOREACH(client, _necp_client_tree, &client_fd->clients) {
- NECP_CLIENT_LOCK(client);
-
- bool has_assigned_flow = FALSE;
- struct necp_client_flow_registration *flow_registration = NULL;
- struct necp_client_flow *search_flow = NULL;
- RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
- LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) {
- if (search_flow->assigned) {
- has_assigned_flow = TRUE;
- break;
- }
- }
- }
-
- if (has_assigned_flow) {
- client->background = background;
- client->background_update = TRUE;
- updated_result = TRUE;
- }
+ client_fd->background = background;
- NECP_CLIENT_UNLOCK(client);
- }
- if (updated_result) {
- necp_update_client_fd_locked(client_fd, proc, NULL);
- }
- NECP_FD_UNLOCK(client_fd);
+ return TRUE;
}
void
// For each defunct client, remove flow from the nexus
LIST_FOREACH_SAFE(flow_defunct, &defunct_list, chain, temp_flow_defunct) {
if (!uuid_is_null(flow_defunct->nexus_agent)) {
- int netagent_error = netagent_client_message(flow_defunct->nexus_agent,
- flow_defunct->flow_id,
- flow_defunct->proc_pid,
- flow_defunct->agent_handle,
- NETAGENT_MESSAGE_TYPE_ABORT_NEXUS);
+ u_int8_t message_type = NETAGENT_MESSAGE_TYPE_ABORT_NEXUS;
+ if (((flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_BROWSE) ||
+ (flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_RESOLVE)) &&
+ !(flow_defunct->flags & NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS)) {
+ message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
+ }
+ int netagent_error = netagent_client_message_with_params(flow_defunct->nexus_agent,
+ flow_defunct->flow_id,
+ flow_defunct->proc_pid,
+ flow_defunct->agent_handle,
+ message_type,
+ flow_defunct->has_close_parameters ? &flow_defunct->close_parameters : NULL,
+ NULL, 0);
if (netagent_error != 0) {
NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR), "necp_defunct_client abort nexus error (%d)", netagent_error);
}
size_t tlv_total_length = (sizeof(struct necp_tlv_header) + length);
if (type == NECP_CLIENT_RESULT_NETAGENT &&
- length == sizeof(struct necp_client_result_netagent) &&
- (offset + tlv_total_length) <= client->result_length) {
+ length == sizeof(struct necp_client_result_netagent) &&
+ (offset + tlv_total_length) <= client->result_length) {
struct necp_client_result_netagent *value = ((struct necp_client_result_netagent *)(void *)
- necp_buffer_get_tlv_value(result_buffer, offset, NULL));
+ necp_buffer_get_tlv_value(result_buffer, offset, NULL));
if (uuid_compare(value->netagent_uuid, netagent_uuid) == 0) {
// Found a netagent to remove
// Shift bytes down to remove the tlv, and adjust total length
// Don't adjust the current offset
memmove(result_buffer + offset,
- result_buffer + offset + tlv_total_length,
- client->result_length - (offset + tlv_total_length));
+ result_buffer + offset + tlv_total_length,
+ client->result_length - (offset + tlv_total_length));
client->result_length -= tlv_total_length;
memset(result_buffer + client->result_length, 0, sizeof(client->result) - client->result_length);
continue;
/// Interface matching
-#define NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
- NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF | \
- NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
- NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE | \
- NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
- NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT | \
- NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
- NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \
- NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \
- NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE | \
- NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \
- NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
-
-#define NECP_PARSED_PARAMETERS_SCOPED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
- NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
- NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
- NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
- NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \
- NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \
- NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \
- NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
-
-#define NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
- NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)
-
-#define NECP_PARSED_PARAMETERS_PREFERRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
- NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \
- NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \
- NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
+#define NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
+ NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF | \
+ NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
+ NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE | \
+ NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
+ NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT | \
+ NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
+ NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \
+ NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \
+ NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE | \
+ NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \
+ NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
+
+#define NECP_PARSED_PARAMETERS_SCOPED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
+ NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \
+ NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \
+ NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
+ NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \
+ NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE)
+
+#define NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \
+ NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)
+
+#define NECP_PARSED_PARAMETERS_PREFERRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \
+ NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \
+ NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \
+ NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE)
static bool
necp_ifnet_matches_type(struct ifnet *ifp, u_int8_t interface_type, bool check_delegates)
struct ifnet *check_ifp = ifp;
while (check_ifp) {
if (if_functional_type(check_ifp, TRUE) == interface_type) {
- return (TRUE);
+ return TRUE;
}
if (!check_delegates) {
break;
}
check_ifp = check_ifp->if_delegated.ifp;
-
}
- return (FALSE);
+ return FALSE;
}
static bool
struct ifnet *check_ifp = ifp;
while (check_ifp) {
if (strncmp(check_ifp->if_xname, interface_name, IFXNAMSIZ) == 0) {
- return (TRUE);
+ return TRUE;
}
if (!check_delegates) {
break;
}
check_ifp = check_ifp->if_delegated.ifp;
}
- return (FALSE);
+ return FALSE;
}
static bool
for (u_int32_t index = 0; index < check_ifp->if_agentcount; index++) {
if (uuid_compare(check_ifp->if_agentids[index], *agent_uuid) == 0) {
ifnet_lock_done(check_ifp);
- return (TRUE);
+ return TRUE;
}
}
}
}
check_ifp = check_ifp->if_delegated.ifp;
}
- return (FALSE);
+ return FALSE;
}
static bool
if (netagent_get_agent_domain_and_type(check_ifp->if_agentids[index], if_agent_domain, if_agent_type)) {
if (necp_agent_types_match(agent_domain, agent_type, if_agent_domain, if_agent_type)) {
ifnet_lock_done(check_ifp);
- return (TRUE);
+ return TRUE;
}
}
}
}
check_ifp = check_ifp->if_delegated.ifp;
}
- return (FALSE);
+ return FALSE;
}
static bool
ifaddr_release(ifa);
}
- return (matched_local_address);
+ return matched_local_address;
}
static bool
necp_interface_type_is_primary_eligible(u_int8_t interface_type)
{
switch (interface_type) {
- // These types can never be primary, so a client requesting these types is allowed
- // to match an interface that isn't currently eligible to be primary (has default
- // route, dns, etc)
- case IFRTYPE_FUNCTIONAL_WIFI_AWDL:
- case IFRTYPE_FUNCTIONAL_INTCOPROC:
- return false;
- default:
- break;
+ // These types can never be primary, so a client requesting these types is allowed
+ // to match an interface that isn't currently eligible to be primary (has default
+ // route, dns, etc)
+ case IFRTYPE_FUNCTIONAL_WIFI_AWDL:
+ case IFRTYPE_FUNCTIONAL_INTCOPROC:
+ return false;
+ default:
+ break;
}
return true;
}
// used for multipath or a listener as an extra path
static bool
necp_ifnet_matches_parameters(struct ifnet *ifp,
- struct necp_client_parsed_parameters *parsed_parameters,
- u_int32_t *preferred_count,
- bool secondary_interface)
+ struct necp_client_parsed_parameters *parsed_parameters,
+ u_int32_t override_flags,
+ u_int32_t *preferred_count,
+ bool secondary_interface,
+ bool require_scoped_field)
{
+ bool matched_some_scoped_field = FALSE;
+
if (preferred_count) {
*preferred_count = 0;
}
+ if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) {
+ if (parsed_parameters->required_interface_index != ifp->if_index) {
+ return FALSE;
+ }
+ }
+
if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR) {
if (!necp_ifnet_matches_local_address(ifp, &parsed_parameters->local_addr.sa)) {
- return (FALSE);
+ return FALSE;
+ }
+ if (require_scoped_field) {
+ matched_some_scoped_field = TRUE;
}
}
if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) {
- if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) &&
- IFNET_IS_EXPENSIVE(ifp)) {
- return (FALSE);
+ if (override_flags != 0) {
+ if ((override_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) &&
+ IFNET_IS_EXPENSIVE(ifp)) {
+ return FALSE;
+ }
+ if ((override_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED) &&
+ IFNET_IS_CONSTRAINED(ifp)) {
+ return FALSE;
+ }
+ } else {
+ if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) &&
+ IFNET_IS_EXPENSIVE(ifp)) {
+ return FALSE;
+ }
+ if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED) &&
+ IFNET_IS_CONSTRAINED(ifp)) {
+ return FALSE;
+ }
}
}
if ((!secondary_interface || // Enforce interface type if this is the primary interface
- !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) || // or if there are no flags
- !(parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE)) && // or if the flags don't give an exception
+ !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) || // or if there are no flags
+ !(parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE)) && // or if the flags don't give an exception
(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) &&
- !necp_ifnet_matches_type(ifp, parsed_parameters->required_interface_type, FALSE)) {
- return (FALSE);
+ !necp_ifnet_matches_type(ifp, parsed_parameters->required_interface_type, FALSE)) {
+ return FALSE;
+ }
+
+ if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) {
+ if (require_scoped_field) {
+ matched_some_scoped_field = TRUE;
+ }
}
if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE) {
- for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) {
+ for (int i = 0; i < NECP_MAX_INTERFACE_PARAMETERS; i++) {
if (parsed_parameters->prohibited_interface_types[i] == 0) {
break;
}
if (necp_ifnet_matches_type(ifp, parsed_parameters->prohibited_interface_types[i], TRUE)) {
- return (FALSE);
+ return FALSE;
}
}
}
if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF) {
- for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) {
+ for (int i = 0; i < NECP_MAX_INTERFACE_PARAMETERS; i++) {
if (strlen(parsed_parameters->prohibited_interfaces[i]) == 0) {
break;
}
if (necp_ifnet_matches_name(ifp, parsed_parameters->prohibited_interfaces[i], TRUE)) {
- return (FALSE);
+ return FALSE;
}
}
}
if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) {
- for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) {
+ for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
if (uuid_is_null(parsed_parameters->required_netagents[i])) {
break;
}
if (!necp_ifnet_matches_agent(ifp, &parsed_parameters->required_netagents[i], FALSE)) {
- return (FALSE);
+ return FALSE;
+ }
+
+ if (require_scoped_field) {
+ matched_some_scoped_field = TRUE;
}
}
}
if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT) {
- for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) {
+ for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
if (uuid_is_null(parsed_parameters->prohibited_netagents[i])) {
break;
}
if (necp_ifnet_matches_agent(ifp, &parsed_parameters->prohibited_netagents[i], TRUE)) {
- return (FALSE);
+ return FALSE;
}
}
}
if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) {
- for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) {
+ for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 &&
- strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
+ strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) {
break;
}
if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->required_netagent_types[i].netagent_domain, parsed_parameters->required_netagent_types[i].netagent_type, FALSE)) {
- return (FALSE);
+ return FALSE;
+ }
+
+ if (require_scoped_field) {
+ matched_some_scoped_field = TRUE;
}
}
}
if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE) {
- for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) {
+ for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
if (strlen(parsed_parameters->prohibited_netagent_types[i].netagent_domain) == 0 &&
- strlen(parsed_parameters->prohibited_netagent_types[i].netagent_type) == 0) {
+ strlen(parsed_parameters->prohibited_netagent_types[i].netagent_type) == 0) {
break;
}
if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->prohibited_netagent_types[i].netagent_domain, parsed_parameters->prohibited_netagent_types[i].netagent_type, TRUE)) {
- return (FALSE);
+ return FALSE;
}
}
}
// Checked preferred properties
if (preferred_count) {
if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT) {
- for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) {
+ for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
if (uuid_is_null(parsed_parameters->preferred_netagents[i])) {
break;
}
if (necp_ifnet_matches_agent(ifp, &parsed_parameters->preferred_netagents[i], TRUE)) {
(*preferred_count)++;
+ if (require_scoped_field) {
+ matched_some_scoped_field = TRUE;
+ }
}
}
}
if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE) {
- for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) {
+ for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
if (strlen(parsed_parameters->preferred_netagent_types[i].netagent_domain) == 0 &&
- strlen(parsed_parameters->preferred_netagent_types[i].netagent_type) == 0) {
+ strlen(parsed_parameters->preferred_netagent_types[i].netagent_type) == 0) {
break;
}
if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->preferred_netagent_types[i].netagent_domain, parsed_parameters->preferred_netagent_types[i].netagent_type, TRUE)) {
(*preferred_count)++;
+ if (require_scoped_field) {
+ matched_some_scoped_field = TRUE;
+ }
}
}
}
if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT) {
- for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) {
+ for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
if (uuid_is_null(parsed_parameters->avoided_netagents[i])) {
break;
}
}
if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE) {
- for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) {
+ for (int i = 0; i < NECP_MAX_AGENT_PARAMETERS; i++) {
if (strlen(parsed_parameters->avoided_netagent_types[i].netagent_domain) == 0 &&
- strlen(parsed_parameters->avoided_netagent_types[i].netagent_type) == 0) {
+ strlen(parsed_parameters->avoided_netagent_types[i].netagent_type) == 0) {
break;
}
if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->avoided_netagent_types[i].netagent_domain,
- parsed_parameters->avoided_netagent_types[i].netagent_type, TRUE)) {
+ parsed_parameters->avoided_netagent_types[i].netagent_type, TRUE)) {
(*preferred_count)++;
}
}
}
}
- return (TRUE);
+ if (require_scoped_field) {
+ return matched_some_scoped_field;
+ }
+
+ return TRUE;
}
static bool
necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters,
- u_int *return_ifindex, bool *validate_agents)
+ u_int *return_ifindex, bool *validate_agents)
{
struct ifnet *ifp = NULL;
u_int32_t best_preferred_count = 0;
if (parsed_parameters->required_interface_index != 0) {
*return_ifindex = parsed_parameters->required_interface_index;
- return (TRUE);
+ return TRUE;
+ }
+
+ // Check and save off flags
+ u_int32_t flags = 0;
+ bool has_prohibit_flags = FALSE;
+ if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) {
+ flags = parsed_parameters->flags;
+ has_prohibit_flags = (parsed_parameters->flags &
+ (NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE |
+ NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED));
}
- if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS)) {
- return (TRUE);
+ if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS) &&
+ !has_prohibit_flags) {
+ return TRUE;
}
has_preferred_fields = (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS);
// We have interesting parameters to parse and find a matching interface
ifnet_head_lock_shared();
- if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS)) {
+ if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS) &&
+ !has_preferred_fields) {
// We do have fields to match, but they are only prohibitory
// If the first interface in the list matches, or there are no ordered interfaces, we don't need to scope
ifp = TAILQ_FIRST(&ifnet_ordered_head);
- if (ifp == NULL || necp_ifnet_matches_parameters(ifp, parsed_parameters, NULL, false)) {
+ if (ifp == NULL || necp_ifnet_matches_parameters(ifp, parsed_parameters, 0, NULL, false, false)) {
// Don't set return_ifindex, so the client doesn't need to scope
ifnet_head_done();
- return (TRUE);
+ return TRUE;
}
}
// First check the ordered interface list
TAILQ_FOREACH(ifp, &ifnet_ordered_head, if_ordered_link) {
u_int32_t preferred_count = 0;
- if (necp_ifnet_matches_parameters(ifp, parsed_parameters, &preferred_count, false)) {
+ if (necp_ifnet_matches_parameters(ifp, parsed_parameters, flags, &preferred_count, false, false)) {
if (preferred_count > best_preferred_count ||
- *return_ifindex == 0) {
-
+ *return_ifindex == 0) {
// Everything matched, and is most preferred. Return this interface.
*return_ifindex = ifp->if_index;
best_preferred_count = preferred_count;
}
}
}
+
+ if (has_prohibit_flags &&
+ ifp == TAILQ_FIRST(&ifnet_ordered_head)) {
+ // This was the first interface. From here on, if the
+ // client prohibited either expensive or constrained,
+ // don't allow either as a secondary interface option.
+ flags |= (NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE |
+ NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED);
+ }
}
+ bool is_listener = ((parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) &&
+ (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER));
+
// Then check the remaining interfaces
if ((parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS) &&
- ((!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)) ||
- !necp_interface_type_is_primary_eligible(parsed_parameters->required_interface_type)) &&
- *return_ifindex == 0) {
+ ((!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)) ||
+ !necp_interface_type_is_primary_eligible(parsed_parameters->required_interface_type) ||
+ (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR) ||
+ is_listener) &&
+ (*return_ifindex == 0 || has_preferred_fields)) {
TAILQ_FOREACH(ifp, &ifnet_head, if_link) {
u_int32_t preferred_count = 0;
if (NECP_IFP_IS_ON_ORDERED_LIST(ifp)) {
// This interface was in the ordered list, skip
continue;
}
- if (necp_ifnet_matches_parameters(ifp, parsed_parameters, &preferred_count, false)) {
+ if (necp_ifnet_matches_parameters(ifp, parsed_parameters, flags, &preferred_count, false, true)) {
if (preferred_count > best_preferred_count ||
- *return_ifindex == 0) {
-
+ *return_ifindex == 0) {
// Everything matched, and is most preferred. Return this interface.
*return_ifindex = ifp->if_index;
best_preferred_count = preferred_count;
ifnet_head_done();
if ((parsed_parameters->valid_fields == (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS)) &&
- best_preferred_count == 0) {
+ best_preferred_count == 0) {
// If only has preferred fields, and nothing was found, clear the interface index and return TRUE
*return_ifindex = 0;
- return (TRUE);
+ return TRUE;
}
if (*return_ifindex == 0 &&
- !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS)) {
+ !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS)) {
// Has required fields, but not including specific interface fields. Pass for now, and check
// to see if agents are satisfied by policy.
*validate_agents = TRUE;
- return (TRUE);
+ return TRUE;
}
- return (*return_ifindex != 0);
+ return *return_ifindex != 0;
}
necp_skywalk_priv_check_cred(proc_t p, kauth_cred_t cred)
{
#pragma unused(p, cred)
- return (0);
+ return 0;
}
/// System calls
int fd = -1;
if (uap->flags & NECP_OPEN_FLAG_OBSERVER ||
- uap->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
+ uap->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
if (necp_skywalk_priv_check_cred(p, kauth_cred_get()) != 0 &&
- priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NETWORK_STATISTICS, 0) != 0) {
+ priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NETWORK_STATISTICS, 0) != 0) {
NECPLOG0(LOG_ERR, "Client does not hold necessary entitlement to observe other NECP clients");
error = EACCES;
goto done;
}
}
- return (error);
+ return error;
}
-static int
+// All functions called directly from necp_client_action() to handle one of the
+// types should be marked with NECP_CLIENT_ACTION_FUNCTION. This ensures that
+// necp_client_action() does not inline all the actions into a single function.
+#define NECP_CLIENT_ACTION_FUNCTION __attribute__((noinline))
+
+static NECP_CLIENT_ACTION_FUNCTION int
necp_client_add(struct proc *p, struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
{
int error = 0;
if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) {
NECPLOG0(LOG_ERR, "NECP client observers with push enabled may not add their own clients");
- return (EINVAL);
+ return EINVAL;
}
if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
- uap->buffer_size == 0 || uap->buffer_size > NECP_MAX_CLIENT_PARAMETERS_SIZE || uap->buffer == 0) {
- return (EINVAL);
+ uap->buffer_size == 0 || uap->buffer_size > NECP_MAX_CLIENT_PARAMETERS_SIZE || uap->buffer == 0) {
+ return EINVAL;
}
if ((client = _MALLOC(sizeof(struct necp_client) + uap->buffer_size, M_NECP,
- M_WAITOK | M_ZERO)) == NULL) {
+ M_WAITOK | M_ZERO)) == NULL) {
error = ENOMEM;
goto done;
}
lck_mtx_init(&client->lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
lck_mtx_init(&client->route_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
- necp_client_retain(client); // Hold our reference until close
+
+ os_ref_init(&client->reference_count, &necp_client_refgrp); // Hold our reference until close
client->parameters_length = uap->buffer_size;
client->proc_pid = fd_data->proc_pid; // Save off proc pid in case the client will persist past fd
goto done;
}
+
necp_client_update_observer_add(client);
NECP_FD_LOCK(fd_data);
}
*retval = error;
- return (error);
+ return error;
}
-static int
+static NECP_CLIENT_ACTION_FUNCTION int
+necp_client_claim(struct proc *p, struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
+{
+ int error = 0;
+ uuid_t client_id = {};
+ struct necp_client *client = NULL;
+
+ if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) {
+ error = EINVAL;
+ goto done;
+ }
+
+ error = copyin(uap->client_id, client_id, sizeof(uuid_t));
+ if (error) {
+ NECPLOG(LOG_ERR, "necp_client_claim copyin client_id error (%d)", error);
+ goto done;
+ }
+
+ u_int64_t upid = proc_uniqueid(p);
+
+ NECP_FD_LIST_LOCK_SHARED();
+
+ struct necp_fd_data *find_fd = NULL;
+ LIST_FOREACH(find_fd, &necp_fd_list, chain) {
+ NECP_FD_LOCK(find_fd);
+ struct necp_client *find_client = necp_client_fd_find_client_and_lock(find_fd, client_id);
+ if (find_client != NULL) {
+ if (find_client->delegated_upid == upid) {
+ // Matched the client to claim; remove from the old fd
+ client = find_client;
+ RB_REMOVE(_necp_client_tree, &find_fd->clients, client);
+ necp_client_retain_locked(client);
+ }
+ NECP_CLIENT_UNLOCK(find_client);
+ }
+ NECP_FD_UNLOCK(find_fd);
+
+ if (client != NULL) {
+ break;
+ }
+ }
+
+ NECP_FD_LIST_UNLOCK();
+
+ if (client == NULL) {
+ error = ENOENT;
+ goto done;
+ }
+
+ client->proc_pid = fd_data->proc_pid; // Transfer client to claiming pid
+
+ // Add matched client to our fd and re-run result
+ NECP_FD_LOCK(fd_data);
+ RB_INSERT(_necp_client_tree, &fd_data->clients, client);
+ NECP_CLIENT_LOCK(client);
+ (void)necp_update_client_result(current_proc(), fd_data, client, NULL);
+ NECP_CLIENT_UNLOCK(client);
+ NECP_FD_UNLOCK(fd_data);
+
+ necp_client_release(client);
+
+done:
+ *retval = error;
+
+ return error;
+}
+
+static NECP_CLIENT_ACTION_FUNCTION int
necp_client_remove(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
{
int error = 0;
if (error) {
NECPLOG(LOG_ERR, "necp_client_remove flow_ifnet_stats copyin error (%d)", error);
// Not fatal; make sure to zero-out stats in case of partial copy
- memset(&flow_ifnet_stats, 0, sizeof (flow_ifnet_stats));
+ memset(&flow_ifnet_stats, 0, sizeof(flow_ifnet_stats));
error = 0;
}
} else if (uap->buffer != 0) {
done:
*retval = error;
- return (error);
+ return error;
}
-static int
+// Don't inline the function since it includes necp_client_parsed_parameters on the stack
+static __attribute__((noinline)) int
necp_client_check_tcp_heuristics(struct necp_client *client, struct necp_client_flow *flow, u_int32_t *flags, u_int8_t *tfo_cookie, u_int8_t *tfo_cookie_len)
{
struct necp_client_parsed_parameters parsed_parameters;
int error = 0;
error = necp_client_parse_parameters(client->parameters,
- (u_int32_t)client->parameters_length,
- &parsed_parameters);
+ (u_int32_t)client->parameters_length,
+ &parsed_parameters);
if (error) {
NECPLOG(LOG_ERR, "necp_client_parse_parameters error (%d)", error);
- return (error);
+ return error;
}
if ((flow->remote_addr.sa.sa_family != AF_INET &&
- flow->remote_addr.sa.sa_family != AF_INET6) ||
- (flow->local_addr.sa.sa_family != AF_INET &&
- flow->local_addr.sa.sa_family != AF_INET6)) {
- return (EINVAL);
+ flow->remote_addr.sa.sa_family != AF_INET6) ||
+ (flow->local_addr.sa.sa_family != AF_INET &&
+ flow->local_addr.sa.sa_family != AF_INET6)) {
+ return EINVAL;
}
NECP_CLIENT_ROUTE_LOCK(client);
if (client->current_route == NULL) {
- error = ENOENT;
- goto do_unlock;
+ error = ENOENT;
+ goto do_unlock;
}
bool check_ecn = false;
do {
if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) ==
- NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) {
+ NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) {
check_ecn = true;
break;
}
if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) ==
- NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) {
+ NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) {
break;
}
bool inbound = ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) == 0);
if ((inbound && tcp_ecn_inbound == 1) ||
- (!inbound && tcp_ecn_outbound == 1)) {
+ (!inbound && tcp_ecn_outbound == 1)) {
check_ecn = true;
}
} while (false);
if (check_ecn) {
if (tcp_heuristic_do_ecn_with_address(client->current_route->rt_ifp,
- (union sockaddr_in_4_6 *)&flow->local_addr)) {
+ (union sockaddr_in_4_6 *)&flow->local_addr)) {
*flags |= NECP_CLIENT_RESULT_FLAG_ECN_ENABLED;
}
}
if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) ==
- NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) {
-
+ NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) {
if (!tcp_heuristic_do_tfo_with_address(client->current_route->rt_ifp,
- (union sockaddr_in_4_6 *)&flow->local_addr,
- (union sockaddr_in_4_6 *)&flow->remote_addr,
- tfo_cookie, tfo_cookie_len)) {
+ (union sockaddr_in_4_6 *)&flow->local_addr,
+ (union sockaddr_in_4_6 *)&flow->remote_addr,
+ tfo_cookie, tfo_cookie_len)) {
*flags |= NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED;
*tfo_cookie_len = 0;
}
do_unlock:
NECP_CLIENT_ROUTE_UNLOCK(client);
- return (error);
+ return error;
}
static size_t
static int
necp_client_fillout_flow_tlvs(struct necp_client *client,
- bool client_is_observed,
- struct necp_client_flow_registration *flow_registration,
- struct necp_client_action_args *uap,
- size_t *assigned_results_cursor)
+ bool client_is_observed,
+ struct necp_client_flow_registration *flow_registration,
+ struct necp_client_action_args *uap,
+ size_t *assigned_results_cursor)
{
int error = 0;
struct necp_client_flow *flow = NULL;
tfo_cookie_len = NECP_TFO_COOKIE_LEN_MAX;
if (necp_client_check_tcp_heuristics(client, flow, &flags,
- tfo_cookie, &tfo_cookie_len) != 0) {
+ tfo_cookie, &tfo_cookie_len) != 0) {
tfo_cookie_len = 0;
} else {
flow->check_tcp_heuristics = FALSE;
error = copyout(&header, uap->buffer + client->result_length + *assigned_results_cursor, header_length);
if (error) {
NECPLOG(LOG_ERR, "necp_client_copy assigned results tlv_header copyout error (%d)", error);
- return (error);
+ return error;
}
*assigned_results_cursor += header_length;
if (flow->assigned_results && flow->assigned_results_length) {
// Write inner TLVs
error = copyout(flow->assigned_results, uap->buffer + client->result_length + *assigned_results_cursor,
- flow->assigned_results_length);
+ flow->assigned_results_length);
if (error) {
NECPLOG(LOG_ERR, "necp_client_copy assigned results copyout error (%d)", error);
- return (error);
+ return error;
}
}
*assigned_results_cursor += flow->assigned_results_length;
memcpy(&protoctl_event_header.protoctl_tlv_header.type, &type, sizeof(type));
memcpy(&protoctl_event_header.protoctl_tlv_header.length, &length, sizeof(length));
memcpy(&protoctl_event_header.protoctl_event, &flow->protoctl_event,
- sizeof(flow->protoctl_event));
+ sizeof(flow->protoctl_event));
error = copyout(&protoctl_event_header, uap->buffer + client->result_length + *assigned_results_cursor,
- sizeof(protoctl_event_header));
+ sizeof(protoctl_event_header));
if (error) {
NECPLOG(LOG_ERR, "necp_client_copy protocol control event results"
- " tlv_header copyout error (%d)", error);
- return (error);
+ " tlv_header copyout error (%d)", error);
+ return error;
}
*assigned_results_cursor += sizeof(protoctl_event_header);
flow->has_protoctl_event = FALSE;
if (!client_is_observed) {
flow_registration->flow_result_read = TRUE;
}
- return (0);
+ return 0;
}
static int
// Copy results out
if (uap->action == NECP_CLIENT_ACTION_COPY_PARAMETERS) {
if (uap->buffer_size < client->parameters_length) {
- return (EINVAL);
+ return EINVAL;
}
error = copyout(client->parameters, uap->buffer, client->parameters_length);
if (error) {
NECPLOG(LOG_ERR, "necp_client_copy parameters copyout error (%d)", error);
- return (error);
+ return error;
}
*retval = client->parameters_length;
} else if (uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT &&
- client->result_read && !necp_client_has_unread_flows(client)) {
+ client->result_read && !necp_client_has_unread_flows(client)) {
// Copy updates only, but nothing to read
// Just return 0 for bytes read
*retval = 0;
} else if (uap->action == NECP_CLIENT_ACTION_COPY_RESULT ||
- uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
+ uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
size_t assigned_results_size = 0;
bool some_flow_is_defunct = false;
}
}
if (uap->buffer_size < (client->result_length + assigned_results_size)) {
- return (EINVAL);
+ return EINVAL;
}
u_int32_t original_flags = 0;
original_flags = client_flags;
client_flags |= NECP_CLIENT_RESULT_FLAG_DEFUNCT;
(void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS,
- sizeof(client_flags), &client_flags, &flags_updated,
- client->result, sizeof(client->result));
+ sizeof(client_flags), &client_flags, &flags_updated,
+ client->result, sizeof(client->result));
}
}
if (flags_updated) {
// Revert stored flags
(void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS,
- sizeof(original_flags), &original_flags, &flags_updated,
- client->result, sizeof(client->result));
+ sizeof(original_flags), &original_flags, &flags_updated,
+ client->result, sizeof(client->result));
}
if (error) {
NECPLOG(LOG_ERR, "necp_client_copy result copyout error (%d)", error);
- return (error);
+ return error;
}
size_t assigned_results_cursor = 0;
if (single_flow_registration != NULL) {
error = necp_client_fillout_flow_tlvs(client, client_is_observed, single_flow_registration, uap, &assigned_results_cursor);
if (error != 0) {
- return (error);
+ return error;
}
}
} else {
RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) {
error = necp_client_fillout_flow_tlvs(client, client_is_observed, flow_registration, uap, &assigned_results_cursor);
if (error != 0) {
- return (error);
+ return error;
}
}
}
}
}
- return (0);
+ return 0;
}
-static int
+static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
{
int error = 0;
*retval = 0;
if (uap->buffer_size == 0 || uap->buffer == 0) {
- return (EINVAL);
+ return EINVAL;
}
if (uap->action != NECP_CLIENT_ACTION_COPY_PARAMETERS &&
- uap->action != NECP_CLIENT_ACTION_COPY_RESULT &&
- uap->action != NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
- return (EINVAL);
+ uap->action != NECP_CLIENT_ACTION_COPY_RESULT &&
+ uap->action != NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) {
+ return EINVAL;
}
if (uap->client_id) {
if (uap->client_id_len != sizeof(uuid_t)) {
NECPLOG(LOG_ERR, "Incorrect length (got %d, expected %d)", uap->client_id_len, sizeof(uuid_t));
- return (ERANGE);
+ return ERANGE;
}
error = copyin(uap->client_id, client_id, sizeof(uuid_t));
if (error) {
NECPLOG(LOG_ERR, "necp_client_copy client_id copyin error (%d)", error);
- return (error);
+ return error;
}
}
// No client found, fail
if (!found_client) {
- return (ENOENT);
+ return ENOENT;
}
} else {
// No client found, and not allowed to search other fds, fail
- return (ENOENT);
+ return ENOENT;
}
}
- return (error);
+ return error;
}
-static int
+static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_client_update(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
{
int error = 0;
if (!(fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER)) {
NECPLOG0(LOG_ERR, "NECP fd is not observer, cannot copy client update");
- return (EINVAL);
+ return EINVAL;
}
if (uap->client_id_len != sizeof(uuid_t) || uap->client_id == 0) {
NECPLOG0(LOG_ERR, "Client id invalid, cannot copy client update");
- return (EINVAL);
+ return EINVAL;
}
if (uap->buffer_size == 0 || uap->buffer == 0) {
NECPLOG0(LOG_ERR, "Buffer invalid, cannot copy client update");
- return (EINVAL);
+ return EINVAL;
}
NECP_FD_LOCK(fd_data);
error = ENOENT;
}
- return (error);
+ return error;
}
static int
necp_client_copy_parameters_locked(struct necp_client *client,
- struct necp_client_nexus_parameters *parameters)
+ struct necp_client_nexus_parameters *parameters)
{
VERIFY(parameters != NULL);
memcpy(¶meters->local_addr, &parsed_parameters.local_addr, sizeof(parameters->local_addr));
memcpy(¶meters->remote_addr, &parsed_parameters.remote_addr, sizeof(parameters->remote_addr));
parameters->ip_protocol = parsed_parameters.ip_protocol;
+ if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_TRANSPORT_PROTOCOL) {
+ parameters->transport_protocol = parsed_parameters.transport_protocol;
+ } else {
+ parameters->transport_protocol = parsed_parameters.ip_protocol;
+ }
+ parameters->ethertype = parsed_parameters.ethertype;
parameters->traffic_class = parsed_parameters.traffic_class;
- uuid_copy(parameters->euuid, parsed_parameters.effective_uuid);
+ if (uuid_is_null(client->override_euuid)) {
+ uuid_copy(parameters->euuid, parsed_parameters.effective_uuid);
+ } else {
+ uuid_copy(parameters->euuid, client->override_euuid);
+ }
parameters->is_listener = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) ? 1 : 0;
+ parameters->is_interpose = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) ? 1 : 0;
+ parameters->is_custom_ether = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER) ? 1 : 0;
parameters->policy_id = client->policy_id;
// parse client result flag
}
parameters->allow_qos_marking = (client_result_flags & NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING) ? 1 : 0;
- return (error);
+ if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR_PREFERENCE) {
+ if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_DEFAULT) {
+ parameters->override_address_selection = false;
+ } else if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_TEMPORARY) {
+ parameters->override_address_selection = true;
+ parameters->use_stable_address = false;
+ } else if (parsed_parameters.local_address_preference == NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_STABLE) {
+ parameters->override_address_selection = true;
+ parameters->use_stable_address = true;
+ }
+ } else {
+ parameters->override_address_selection = false;
+ }
+
+ return error;
}
-static int
+static NECP_CLIENT_ACTION_FUNCTION int
necp_client_list(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
{
int error = 0;
}
if (requested_client_count > 0 &&
- client_count > 0 &&
- list != NULL) {
+ client_count > 0 &&
+ list != NULL) {
error = copyout(list, uap->buffer + sizeof(client_count), copy_buffer_size);
if (error) {
NECPLOG(LOG_ERR, "necp_client_list client count copyout error (%d)", error);
}
*retval = error;
- return (error);
+ return error;
}
return true;
}
-static int
+static NECP_CLIENT_ACTION_FUNCTION int
necp_client_agent_action(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
{
int error = 0;
size_t parameters_size = uap->buffer_size;
if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
- uap->buffer_size == 0 || uap->buffer == 0) {
+ uap->buffer_size == 0 || uap->buffer == 0) {
NECPLOG0(LOG_ERR, "necp_client_agent_action invalid parameters");
error = EINVAL;
goto done;
if (length > 0) {
u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
if (length >= sizeof(uuid_t) &&
- value != NULL &&
- (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT ||
- type == NECP_CLIENT_PARAMETER_ASSERT_AGENT ||
- type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT)) {
-
- uuid_t agent_uuid;
- uuid_copy(agent_uuid, value);
- u_int8_t netagent_message_type = 0;
- if (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT) {
- netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_TRIGGER;
- } else if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
- netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT;
- } else if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
- netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
- }
-
- // Before unasserting, verify that the assertion was already taken
- if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
- if (!necp_client_remove_assertion(client, agent_uuid)) {
- error = ENOENT;
- break;
- }
- }
+ value != NULL &&
+ (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT ||
+ type == NECP_CLIENT_PARAMETER_ASSERT_AGENT ||
+ type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT)) {
+ uuid_t agent_uuid;
+ uuid_copy(agent_uuid, value);
+ u_int8_t netagent_message_type = 0;
+ if (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT) {
+ netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_TRIGGER;
+ } else if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
+ netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT;
+ } else if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
+ netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT;
+ }
- struct necp_client_nexus_parameters parsed_parameters = {};
- necp_client_copy_parameters_locked(client, &parsed_parameters);
-
- error = netagent_client_message_with_params(agent_uuid,
- client_id,
- fd_data->proc_pid,
- client->agent_handle,
- netagent_message_type,
- &parsed_parameters,
- NULL, NULL);
- if (error == 0) {
- acted_on_agent = TRUE;
- } else {
+ // Before unasserting, verify that the assertion was already taken
+ if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) {
+ if (!necp_client_remove_assertion(client, agent_uuid)) {
+ error = ENOENT;
break;
}
+ }
- // Only save the assertion if the action succeeded
- if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
- necp_client_add_assertion(client, agent_uuid);
- }
+ struct necp_client_nexus_parameters parsed_parameters = {};
+ necp_client_copy_parameters_locked(client, &parsed_parameters);
+
+ error = netagent_client_message_with_params(agent_uuid,
+ client_id,
+ fd_data->proc_pid,
+ client->agent_handle,
+ netagent_message_type,
+ (struct necp_client_agent_parameters *)&parsed_parameters,
+ NULL, NULL);
+ if (error == 0) {
+ acted_on_agent = TRUE;
+ } else {
+ break;
}
+
+ // Only save the assertion if the action succeeded
+ if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) {
+ necp_client_add_assertion(client, agent_uuid);
+ }
+ }
}
offset += sizeof(struct necp_tlv_header) + length;
NECP_FD_UNLOCK(fd_data);
if (!acted_on_agent &&
- error == 0) {
+ error == 0) {
error = ENOENT;
}
done:
parameters = NULL;
}
- return (error);
+ return error;
}
-static int
+static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_agent(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
{
int error = 0;
uuid_t agent_uuid;
if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
- uap->buffer_size == 0 || uap->buffer == 0) {
+ uap->buffer_size == 0 || uap->buffer == 0) {
NECPLOG0(LOG_ERR, "necp_client_copy_agent bad input");
error = EINVAL;
goto done;
done:
*retval = error;
- return (error);
+ return error;
}
-static int
+static NECP_CLIENT_ACTION_FUNCTION int
necp_client_agent_use(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
{
int error = 0;
struct necp_agent_use_parameters parameters;
if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
- uap->buffer_size != sizeof(parameters) || uap->buffer == 0) {
+ uap->buffer_size != sizeof(parameters) || uap->buffer == 0) {
error = EINVAL;
goto done;
}
done:
*retval = error;
- return (error);
+ return error;
}
-static int
+struct necp_interface_details_legacy {
+ char name[IFXNAMSIZ];
+ u_int32_t index;
+ u_int32_t generation;
+ u_int32_t functional_type;
+ u_int32_t delegate_index;
+ u_int32_t flags; // see NECP_INTERFACE_FLAG_*
+ u_int32_t mtu;
+ struct necp_interface_signature ipv4_signature;
+ struct necp_interface_signature ipv6_signature;
+};
+
+static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_interface(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
{
int error = 0;
u_int32_t interface_index = 0;
- struct necp_interface_details interface_details;
+ struct necp_interface_details interface_details = {};
if (uap->client_id == 0 || uap->client_id_len != sizeof(u_int32_t) ||
- uap->buffer_size < sizeof(interface_details) || uap->buffer == 0) {
+ uap->buffer_size < sizeof(struct necp_interface_details_legacy) ||
+ uap->buffer == 0) {
NECPLOG0(LOG_ERR, "necp_client_copy_interface bad input");
error = EINVAL;
goto done;
goto done;
}
- memset(&interface_details, 0, sizeof(interface_details));
-
ifnet_head_lock_shared();
ifnet_t interface = NULL;
if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) {
if (IFNET_IS_EXPENSIVE(interface)) {
interface_details.flags |= NECP_INTERFACE_FLAG_EXPENSIVE;
}
+ if (IFNET_IS_CONSTRAINED(interface)) {
+ interface_details.flags |= NECP_INTERFACE_FLAG_CONSTRAINED;
+ }
if ((interface->if_eflags & IFEF_TXSTART) == IFEF_TXSTART) {
interface_details.flags |= NECP_INTERFACE_FLAG_TXSTART;
}
if (IFNET_IS_LOW_POWER(interface)) {
interface_details.flags |= NECP_INTERFACE_FLAG_IS_LOW_POWER;
}
+ if (interface->if_xflags & IFXF_MPK_LOG) {
+ interface_details.flags |= NECP_INTERFACE_FLAG_MPK_LOG;
+ }
interface_details.mtu = interface->if_mtu;
u_int8_t ipv4_signature_len = sizeof(interface_details.ipv4_signature.signature);
u_int16_t ipv4_signature_flags;
if (ifnet_get_netsignature(interface, AF_INET, &ipv4_signature_len, &ipv4_signature_flags,
- (u_int8_t *)&interface_details.ipv4_signature) != 0) {
+ (u_int8_t *)&interface_details.ipv4_signature) != 0) {
ipv4_signature_len = 0;
}
interface_details.ipv4_signature.signature_len = ipv4_signature_len;
u_int8_t ipv6_signature_len = sizeof(interface_details.ipv6_signature.signature);
u_int16_t ipv6_signature_flags;
if (ifnet_get_netsignature(interface, AF_INET6, &ipv6_signature_len, &ipv6_signature_flags,
- (u_int8_t *)&interface_details.ipv6_signature) != 0) {
+ (u_int8_t *)&interface_details.ipv6_signature) != 0) {
ipv6_signature_len = 0;
}
interface_details.ipv6_signature.signature_len = ipv6_signature_len;
+
+ ifnet_lock_shared(interface);
+ struct ifaddr *ifa = NULL;
+ TAILQ_FOREACH(ifa, &interface->if_addrhead, ifa_link) {
+ IFA_LOCK(ifa);
+ if (ifa->ifa_addr->sa_family == AF_INET) {
+ interface_details.flags |= NECP_INTERFACE_FLAG_HAS_NETMASK;
+ interface_details.ipv4_netmask = ((struct in_ifaddr *)ifa)->ia_sockmask.sin_addr.s_addr;
+ if (interface->if_flags & IFF_BROADCAST) {
+ interface_details.flags |= NECP_INTERFACE_FLAG_HAS_BROADCAST;
+ interface_details.ipv4_broadcast = ((struct in_ifaddr *)ifa)->ia_broadaddr.sin_addr.s_addr;
+ }
+ }
+ IFA_UNLOCK(ifa);
+ }
+ ifnet_lock_done(interface);
}
ifnet_head_done();
- error = copyout(&interface_details, uap->buffer, sizeof(interface_details));
+ // If the client is using an older version of the struct, copy that length
+ size_t copy_length = sizeof(interface_details);
+ if (uap->buffer_size < sizeof(struct necp_interface_details_legacy)) {
+ copy_length = sizeof(struct necp_interface_details_legacy);
+ }
+ error = copyout(&interface_details, uap->buffer, copy_length);
if (error) {
NECPLOG(LOG_ERR, "necp_client_copy_interface copyout error (%d)", error);
goto done;
done:
*retval = error;
- return (error);
+ return error;
}
-static int
+static NECP_CLIENT_ACTION_FUNCTION int
necp_client_copy_route_statistics(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
{
int error = 0;
uuid_t client_id;
if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) ||
- uap->buffer_size < sizeof(struct necp_stat_counts) || uap->buffer == 0) {
+ uap->buffer_size < sizeof(struct necp_stat_counts) || uap->buffer == 0) {
NECPLOG0(LOG_ERR, "necp_client_copy_route_statistics bad input");
error = EINVAL;
goto done;
NECP_CLIENT_ROUTE_LOCK(client);
struct necp_stat_counts route_stats = {};
if (client->current_route != NULL && client->current_route->rt_stats != NULL) {
- struct nstat_counts *rt_stats = client->current_route->rt_stats;
+ struct nstat_counts *rt_stats = client->current_route->rt_stats;
atomic_get_64(route_stats.necp_stat_rxpackets, &rt_stats->nstat_rxpackets);
atomic_get_64(route_stats.necp_stat_rxbytes, &rt_stats->nstat_rxbytes);
atomic_get_64(route_stats.necp_stat_txpackets, &rt_stats->nstat_txpackets);
done:
*retval = error;
- return (error);
+ return error;
}
-static int
+static NECP_CLIENT_ACTION_FUNCTION int
necp_client_update_cache(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
{
int error = 0;
// This needs to be changed when TFO/ECN is supported by multiple flows
struct necp_client_flow *flow = LIST_FIRST(&flow_registration->flow_list);
if (flow == NULL ||
- (flow->remote_addr.sa.sa_family != AF_INET &&
- flow->remote_addr.sa.sa_family != AF_INET6) ||
- (flow->local_addr.sa.sa_family != AF_INET &&
- flow->local_addr.sa.sa_family != AF_INET6)) {
+ (flow->remote_addr.sa.sa_family != AF_INET &&
+ flow->remote_addr.sa.sa_family != AF_INET6) ||
+ (flow->local_addr.sa.sa_family != AF_INET &&
+ flow->local_addr.sa.sa_family != AF_INET6)) {
error = EINVAL;
NECPLOG(LOG_ERR, "necp_client_update_cache no flow error (%d)", error);
goto done_unlock;
memset(&cache_buffer, 0, sizeof(cache_buffer));
if (uap->buffer_size != sizeof(necp_cache_buffer) ||
- uap->buffer == USER_ADDR_NULL) {
+ uap->buffer == USER_ADDR_NULL) {
error = EINVAL;
goto done_unlock;
}
if (client->current_route != NULL && client->current_route->rt_ifp != NULL) {
if (!client->platform_binary) {
- ecn_cache_buffer.necp_tcp_ecn_heuristics_success = 0;
+ ecn_cache_buffer.necp_tcp_ecn_heuristics_success = 0;
}
tcp_heuristics_ecn_update(&ecn_cache_buffer, client->current_route->rt_ifp,
- (union sockaddr_in_4_6 *)&flow->local_addr);
+ (union sockaddr_in_4_6 *)&flow->local_addr);
}
} else if (cache_buffer.necp_cache_buf_type == NECP_CLIENT_CACHE_TYPE_TFO &&
- cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_TFO_VER_1) {
+ cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_TFO_VER_1) {
if (cache_buffer.necp_cache_buf_size != sizeof(necp_tcp_tfo_cache) ||
cache_buffer.necp_cache_buf_addr == USER_ADDR_NULL) {
error = EINVAL;
if (client->current_route != NULL && client->current_route->rt_ifp != NULL) {
if (!client->platform_binary) {
- tfo_cache_buffer.necp_tcp_tfo_heuristics_success = 0;
+ tfo_cache_buffer.necp_tcp_tfo_heuristics_success = 0;
}
tcp_heuristics_tfo_update(&tfo_cache_buffer, client->current_route->rt_ifp,
- (union sockaddr_in_4_6 *)&flow->local_addr,
- (union sockaddr_in_4_6 *)&flow->remote_addr);
+ (union sockaddr_in_4_6 *)&flow->local_addr,
+ (union sockaddr_in_4_6 *)&flow->remote_addr);
}
} else {
- error = EINVAL;
+ error = EINVAL;
}
done_unlock:
NECP_CLIENT_ROUTE_UNLOCK(client);
NECP_FD_UNLOCK(fd_data);
done:
*retval = error;
- return (error);
+ return error;
+}
+
+#define NECP_CLIENT_ACTION_SIGN_DEFAULT_HOSTNAME_LENGTH 64
+#define NECP_CLIENT_ACTION_SIGN_MAX_HOSTNAME_LENGTH 1024
+
+#define NECP_CLIENT_ACTION_SIGN_TAG_LENGTH 32
+
+static NECP_CLIENT_ACTION_FUNCTION int
+necp_client_sign(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval)
+{
+ int error = 0;
+ u_int32_t hostname_length = 0;
+ u_int8_t tag[NECP_CLIENT_ACTION_SIGN_TAG_LENGTH] = {};
+ struct necp_client_signable signable = {};
+ union necp_sockaddr_union address_answer = {};
+ u_int8_t *client_hostname = NULL;
+ u_int8_t *allocated_hostname = NULL;
+ u_int8_t default_hostname[NECP_CLIENT_ACTION_SIGN_DEFAULT_HOSTNAME_LENGTH] = "";
+ uint32_t tag_size = sizeof(tag);
+
+ *retval = 0;
+
+ const bool has_resolver_entitlement = (priv_check_cred(kauth_cred_get(), PRIV_NET_VALIDATED_RESOLVER, 0) == 0);
+ if (!has_resolver_entitlement) {
+ NECPLOG0(LOG_ERR, "Process does not hold the necessary entitlement to sign resolver answers");
+ error = EPERM;
+ goto done;
+ }
+
+ if (uap->client_id == 0 || uap->client_id_len < sizeof(struct necp_client_signable)) {
+ error = EINVAL;
+ goto done;
+ }
+
+ if (uap->buffer == 0 || uap->buffer_size != NECP_CLIENT_ACTION_SIGN_TAG_LENGTH) {
+ error = EINVAL;
+ goto done;
+ }
+
+ error = copyin(uap->client_id, &signable, sizeof(signable));
+ if (error) {
+ NECPLOG(LOG_ERR, "necp_client_sign copyin signable error (%d)", error);
+ goto done;
+ }
+
+ if (signable.sign_type != NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER) {
+ NECPLOG(LOG_ERR, "necp_client_sign unknown signable type (%u)", signable.sign_type);
+ error = EINVAL;
+ goto done;
+ }
+
+ if (uap->client_id_len < sizeof(struct necp_client_resolver_answer)) {
+ error = EINVAL;
+ goto done;
+ }
+
+ error = copyin(uap->client_id + sizeof(signable), &address_answer, sizeof(address_answer));
+ if (error) {
+ NECPLOG(LOG_ERR, "necp_client_sign copyin address_answer error (%d)", error);
+ goto done;
+ }
+
+ error = copyin(uap->client_id + sizeof(signable) + sizeof(address_answer), &hostname_length, sizeof(hostname_length));
+ if (error) {
+ NECPLOG(LOG_ERR, "necp_client_sign copyin hostname_length error (%d)", error);
+ goto done;
+ }
+
+ if (hostname_length > NECP_CLIENT_ACTION_SIGN_MAX_HOSTNAME_LENGTH) {
+ error = EINVAL;
+ goto done;
+ }
+
+ if (hostname_length > NECP_CLIENT_ACTION_SIGN_DEFAULT_HOSTNAME_LENGTH) {
+ if ((allocated_hostname = _MALLOC(hostname_length, M_NECP, M_WAITOK | M_ZERO)) == NULL) {
+ NECPLOG(LOG_ERR, "necp_client_sign malloc hostname %u failed", hostname_length);
+ error = ENOMEM;
+ goto done;
+ }
+
+ client_hostname = allocated_hostname;
+ } else {
+ client_hostname = default_hostname;
+ }
+
+ error = copyin(uap->client_id + sizeof(signable) + sizeof(address_answer) + sizeof(hostname_length), client_hostname, hostname_length);
+ if (error) {
+ NECPLOG(LOG_ERR, "necp_client_sign copyin hostname error (%d)", error);
+ goto done;
+ }
+
+ address_answer.sin.sin_port = 0;
+ error = necp_sign_resolver_answer(signable.client_id, client_hostname, hostname_length,
+ (u_int8_t *)&address_answer, sizeof(address_answer),
+ tag, &tag_size);
+ if (tag_size != sizeof(tag)) {
+ NECPLOG(LOG_ERR, "necp_client_sign unexpected tag size %u", tag_size);
+ error = EINVAL;
+ goto done;
+ }
+ error = copyout(tag, uap->buffer, tag_size);
+ if (error) {
+ NECPLOG(LOG_ERR, "necp_client_sign copyout error (%d)", error);
+ goto done;
+ }
+
+done:
+ if (allocated_hostname != NULL) {
+ FREE(allocated_hostname, M_NECP);
+ allocated_hostname = NULL;
+ }
+ *retval = error;
+ return error;
}
int
error = necp_find_fd_data(uap->necp_fd, &fd_data);
if (error != 0) {
NECPLOG(LOG_ERR, "necp_client_action find fd error (%d)", error);
- return (error);
+ return error;
}
u_int32_t action = uap->action;
switch (action) {
- case NECP_CLIENT_ACTION_ADD: {
- return_value = necp_client_add(p, fd_data, uap, retval);
- break;
- }
- case NECP_CLIENT_ACTION_REMOVE: {
- return_value = necp_client_remove(fd_data, uap, retval);
- break;
- }
- case NECP_CLIENT_ACTION_COPY_PARAMETERS:
- case NECP_CLIENT_ACTION_COPY_RESULT:
- case NECP_CLIENT_ACTION_COPY_UPDATED_RESULT: {
- return_value = necp_client_copy(fd_data, uap, retval);
- break;
- }
- case NECP_CLIENT_ACTION_COPY_LIST: {
- return_value = necp_client_list(fd_data, uap, retval);
- break;
- }
- case NECP_CLIENT_ACTION_AGENT: {
- return_value = necp_client_agent_action(fd_data, uap, retval);
- break;
- }
- case NECP_CLIENT_ACTION_COPY_AGENT: {
- return_value = necp_client_copy_agent(fd_data, uap, retval);
- break;
- }
- case NECP_CLIENT_ACTION_AGENT_USE: {
- return_value = necp_client_agent_use(fd_data, uap, retval);
- break;
- }
- case NECP_CLIENT_ACTION_COPY_INTERFACE: {
- return_value = necp_client_copy_interface(fd_data, uap, retval);
- break;
- }
- case NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS: {
- return_value = necp_client_copy_route_statistics(fd_data, uap, retval);
- break;
- }
- case NECP_CLIENT_ACTION_UPDATE_CACHE: {
- return_value = necp_client_update_cache(fd_data, uap, retval);
- break;
- }
- case NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE: {
- return_value = necp_client_copy_client_update(fd_data, uap, retval);
- break;
- }
- default: {
- NECPLOG(LOG_ERR, "necp_client_action unknown action (%u)", action);
- return_value = EINVAL;
- break;
- }
+ case NECP_CLIENT_ACTION_ADD: {
+ return_value = necp_client_add(p, fd_data, uap, retval);
+ break;
+ }
+ case NECP_CLIENT_ACTION_CLAIM: {
+ return_value = necp_client_claim(p, fd_data, uap, retval);
+ break;
+ }
+ case NECP_CLIENT_ACTION_REMOVE: {
+ return_value = necp_client_remove(fd_data, uap, retval);
+ break;
+ }
+ case NECP_CLIENT_ACTION_COPY_PARAMETERS:
+ case NECP_CLIENT_ACTION_COPY_RESULT:
+ case NECP_CLIENT_ACTION_COPY_UPDATED_RESULT: {
+ return_value = necp_client_copy(fd_data, uap, retval);
+ break;
+ }
+ case NECP_CLIENT_ACTION_COPY_LIST: {
+ return_value = necp_client_list(fd_data, uap, retval);
+ break;
+ }
+ case NECP_CLIENT_ACTION_AGENT: {
+ return_value = necp_client_agent_action(fd_data, uap, retval);
+ break;
+ }
+ case NECP_CLIENT_ACTION_COPY_AGENT: {
+ return_value = necp_client_copy_agent(fd_data, uap, retval);
+ break;
+ }
+ case NECP_CLIENT_ACTION_AGENT_USE: {
+ return_value = necp_client_agent_use(fd_data, uap, retval);
+ break;
+ }
+ case NECP_CLIENT_ACTION_COPY_INTERFACE: {
+ return_value = necp_client_copy_interface(fd_data, uap, retval);
+ break;
+ }
+ case NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS: {
+ return_value = necp_client_copy_route_statistics(fd_data, uap, retval);
+ break;
+ }
+ case NECP_CLIENT_ACTION_UPDATE_CACHE: {
+ return_value = necp_client_update_cache(fd_data, uap, retval);
+ break;
+ }
+ case NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE: {
+ return_value = necp_client_copy_client_update(fd_data, uap, retval);
+ break;
+ }
+ case NECP_CLIENT_ACTION_SIGN: {
+ return_value = necp_client_sign(fd_data, uap, retval);
+ break;
+ }
+ default: {
+ NECPLOG(LOG_ERR, "necp_client_action unknown action (%u)", action);
+ return_value = EINVAL;
+ break;
+ }
}
file_drop(uap->necp_fd);
- return (return_value);
+ return return_value;
}
#define NECP_MAX_MATCH_POLICY_PARAMETER_SIZE 1024
}
error = necp_application_find_policy_match_internal(p, parameters, uap->parameters_size,
- &returned_result, NULL, 0, NULL, NULL, NULL, false);
+ &returned_result, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL, false, false, NULL);
if (error) {
goto done;
}
if (parameters != NULL) {
FREE(parameters, M_NECP);
}
- return (error);
+ return error;
}
/// Socket operations
char *local_string = NULL;
u_int8_t *value = NULL;
- cursor = necp_buffer_find_tlv(buffer, buffer_length, 0, type, 0);
+ cursor = necp_buffer_find_tlv(buffer, buffer_length, 0, type, NULL, 0);
if (cursor < 0) {
// This will clear out the parameter
goto done;
}
*buffer_p = local_string;
- return (0);
+ return 0;
fail:
if (local_string != NULL) {
FREE(local_string, M_NECP);
}
- return (error);
+ return error;
}
errno_t
if ((SOCK_DOM(so) != PF_INET
#if INET6
- && SOCK_DOM(so) != PF_INET6
+ && SOCK_DOM(so) != PF_INET6
#endif
- )) {
+ )) {
error = EINVAL;
goto done;
}
size_t valsize = sopt->sopt_valsize;
if (valsize == 0 ||
- valsize > ((sizeof(struct necp_tlv_header) + NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) * 2)) {
+ valsize > ((sizeof(struct necp_tlv_header) + NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) * 2)) {
goto done;
}
FREE(buffer, M_NECP);
}
- return (error);
+ return error;
}
errno_t
if ((SOCK_DOM(so) != PF_INET
#if INET6
- && SOCK_DOM(so) != PF_INET6
+ && SOCK_DOM(so) != PF_INET6
#endif
- )) {
+ )) {
error = EINVAL;
goto done;
}
cursor = buffer;
if (inp->inp_necp_attributes.inp_domain != NULL) {
cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN, strlen(inp->inp_necp_attributes.inp_domain), inp->inp_necp_attributes.inp_domain,
- buffer, valsize);
+ buffer, valsize);
}
if (inp->inp_necp_attributes.inp_account != NULL) {
cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_ACCOUNT, strlen(inp->inp_necp_attributes.inp_account), inp->inp_necp_attributes.inp_account,
- buffer, valsize);
+ buffer, valsize);
}
error = sooptcopyout(sopt, buffer, valsize);
FREE(buffer, M_NECP);
}
- return (error);
+ return error;
}
void *
necp_create_nexus_assign_message(uuid_t nexus_instance, u_int32_t nexus_port, void *key, uint32_t key_length,
- struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint,
- u_int32_t flow_adv_index, void *flow_stats, size_t *message_length)
+ struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint, struct ether_addr *local_ether_addr,
+ u_int32_t flow_adv_index, void *flow_stats, size_t *message_length)
{
u_int8_t *buffer = NULL;
u_int8_t *cursor = NULL;
size_t valsize = 0;
bool has_nexus_assignment = FALSE;
-
if (!uuid_is_null(nexus_instance)) {
has_nexus_assignment = TRUE;
valsize += sizeof(struct necp_tlv_header) + sizeof(uuid_t);
if (remote_endpoint != NULL) {
valsize += sizeof(struct necp_tlv_header) + sizeof(struct necp_client_endpoint);
}
+ if (local_ether_addr != NULL) {
+ valsize += sizeof(struct necp_tlv_header) + sizeof(struct ether_addr);
+ }
if (flow_stats != NULL) {
valsize += sizeof(struct necp_tlv_header) + sizeof(void *);
}
if (valsize == 0) {
- return (NULL);
+ return NULL;
}
MALLOC(buffer, u_int8_t *, valsize, M_NETAGENT, M_WAITOK | M_ZERO); // Use M_NETAGENT area, since it is expected upon free
if (buffer == NULL) {
- return (NULL);
+ return NULL;
}
cursor = buffer;
if (remote_endpoint != NULL) {
cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_REMOTE_ENDPOINT, sizeof(struct necp_client_endpoint), remote_endpoint, buffer, valsize);
}
+ if (local_ether_addr != NULL) {
+ cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_LOCAL_ETHER_ADDR, sizeof(struct ether_addr), local_ether_addr, buffer, valsize);
+ }
if (flow_stats != NULL) {
cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_FLOW_STATS, sizeof(void *), &flow_stats, buffer, valsize);
}
*message_length = valsize;
- return (buffer);
+ return buffer;
}
void
necp_client_fd_size = sizeof(struct necp_fd_data);
necp_client_fd_zone = zinit(necp_client_fd_size,
- NECP_CLIENT_FD_ZONE_MAX * necp_client_fd_size,
- 0, NECP_CLIENT_FD_ZONE_NAME);
+ NECP_CLIENT_FD_ZONE_MAX * necp_client_fd_size,
+ 0, NECP_CLIENT_FD_ZONE_NAME);
if (necp_client_fd_zone == NULL) {
panic("zinit(necp_client_fd) failed\n");
/* NOTREACHED */
}
necp_flow_size = sizeof(struct necp_client_flow);
- necp_flow_cache = mcache_create(NECP_FLOW_ZONE_NAME, necp_flow_size, sizeof (uint64_t), 0, MCR_SLEEP);
+ necp_flow_cache = mcache_create(NECP_FLOW_ZONE_NAME, necp_flow_size, sizeof(uint64_t), 0, MCR_SLEEP);
if (necp_flow_cache == NULL) {
panic("mcache_create(necp_flow_cache) failed\n");
/* NOTREACHED */
}
necp_flow_registration_size = sizeof(struct necp_client_flow_registration);
- necp_flow_registration_cache = mcache_create(NECP_FLOW_REGISTRATION_ZONE_NAME, necp_flow_registration_size, sizeof (uint64_t), 0, MCR_SLEEP);
+ necp_flow_registration_cache = mcache_create(NECP_FLOW_REGISTRATION_ZONE_NAME, necp_flow_registration_size, sizeof(uint64_t), 0, MCR_SLEEP);
if (necp_flow_registration_cache == NULL) {
panic("mcache_create(necp_client_flow_registration) failed\n");
/* NOTREACHED */
}
necp_client_update_tcall = thread_call_allocate_with_options(necp_update_all_clients_callout, NULL,
- THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
+ THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE);
VERIFY(necp_client_update_tcall != NULL);
lck_rw_init(&necp_fd_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
lck_rw_init(&necp_observer_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
lck_rw_init(&necp_client_tree_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
- lck_rw_init(&necp_flow_tree_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
+ lck_rw_init(&necp_flow_tree_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
lck_rw_init(&necp_collect_stats_list_lock, necp_fd_mtx_grp, necp_fd_mtx_attr);
LIST_INIT(&necp_fd_list);
RB_INIT(&necp_client_global_tree);
RB_INIT(&necp_client_flow_global_tree);
- return (0);
+ return 0;
}
void
projects / apple / xnu.git / blobdiff