1 | /* |
2 | * Copyright (c) 2015-2018 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | #include <string.h> |
30 | |
31 | #include <kern/thread_call.h> |
32 | #include <kern/zalloc.h> |
33 | |
34 | #include <libkern/OSMalloc.h> |
35 | |
36 | #include <net/if.h> |
37 | #include <net/if_var.h> |
38 | #include <net/net_api_stats.h> |
39 | #include <net/necp.h> |
40 | #include <net/network_agent.h> |
41 | #include <net/ntstat.h> |
42 | |
43 | #include <netinet/in_pcb.h> |
44 | #include <netinet/ip.h> |
45 | #include <netinet/ip6.h> |
46 | #include <netinet/mp_pcb.h> |
47 | #include <netinet/tcp_cc.h> |
48 | #include <netinet/tcp_fsm.h> |
49 | #include <netinet/tcp_cache.h> |
50 | #include <netinet6/in6_var.h> |
51 | |
52 | #include <sys/domain.h> |
53 | #include <sys/file_internal.h> |
54 | #include <sys/kauth.h> |
55 | #include <sys/kernel.h> |
56 | #include <sys/malloc.h> |
57 | #include <sys/poll.h> |
58 | #include <sys/priv.h> |
59 | #include <sys/protosw.h> |
60 | #include <sys/queue.h> |
61 | #include <sys/socket.h> |
62 | #include <sys/socketvar.h> |
63 | #include <sys/sysproto.h> |
64 | #include <sys/systm.h> |
65 | #include <sys/types.h> |
66 | #include <sys/codesign.h> |
67 | #include <libkern/section_keywords.h> |
68 | |
69 | |
70 | /* |
71 | * NECP Client Architecture |
72 | * ------------------------------------------------ |
73 | * See <net/necp.c> for a discussion on NECP database architecture. |
74 | * |
75 | * Each client of NECP provides a set of parameters for a connection or network state |
76 | * evaluation, on which NECP policy evaluation is run. This produces a policy result |
77 | * which can be accessed by the originating process, along with events for when policies |
78 | * results have changed. |
79 | * |
80 | * ------------------------------------------------ |
81 | * NECP Client FD |
82 | * ------------------------------------------------ |
83 | * A process opens an NECP file descriptor using necp_open(). This is a very simple |
84 | * file descriptor, upon which the process may do the following operations: |
85 | * - necp_client_action(...), to add/remove/query clients |
86 | * - kqueue, to watch for readable events |
87 | * - close(), to close the client session and release all clients |
88 | * |
89 | * Client objects are allocated structures that hang off of the file descriptor. Each |
90 | * client contains: |
91 | * - Client ID, a UUID that references the client across the system |
92 | * - Parameters, a buffer of TLVs that describe the client's connection parameters, |
93 | * such as the remote and local endpoints, interface requirements, etc. |
94 | * - Result, a buffer of TLVs containing the current policy evaluation for the client. |
95 | * This result will be updated whenever a network change occurs that impacts the |
96 | * policy result for that client. |
97 | * |
98 | * +--------------+ |
99 | * | NECP fd | |
100 | * +--------------+ |
101 | * || |
102 | * ================================== |
103 | * || || || |
104 | * +--------------+ +--------------+ +--------------+ |
105 | * | Client ID | | Client ID | | Client ID | |
106 | * | ---- | | ---- | | ---- | |
107 | * | Parameters | | Parameters | | Parameters | |
108 | * | ---- | | ---- | | ---- | |
109 | * | Result | | Result | | Result | |
110 | * +--------------+ +--------------+ +--------------+ |
111 | * |
112 | * ------------------------------------------------ |
113 | * Client Actions |
114 | * ------------------------------------------------ |
115 | * - Add. Input parameters as a buffer of TLVs, and output a client ID. Allocates a |
116 | * new client structure on the file descriptor. |
117 | * - Remove. Input a client ID. Removes a client structure from the file descriptor. |
118 | * - Copy Parameters. Input a client ID, and output parameter TLVs. |
119 | * - Copy Result. Input a client ID, and output result TLVs. Alternatively, input empty |
120 | * client ID and get next unread client result. |
121 | * - Copy List. List all client IDs. |
122 | * |
123 | * ------------------------------------------------ |
124 | * Client Policy Evaluation |
125 | * ------------------------------------------------ |
126 | * Policies are evaluated for clients upon client creation, and upon update events, |
127 | * which are network/agent/policy changes coalesced by a timer. |
128 | * |
129 | * The policy evaluation goes through the following steps: |
130 | * 1. Parse client parameters. |
131 | * 2. Select a scoped interface if applicable. This involves using require/prohibit |
132 | * parameters, along with the local address, to select the most appropriate interface |
133 | * if not explicitly set by the client parameters. |
134 | * 3. Run NECP application-level policy evalution |
135 | * 4. Set policy result into client result buffer. |
136 | * |
137 | * ------------------------------------------------ |
138 | * Client Observers |
139 | * ------------------------------------------------ |
140 | * If necp_open() is called with the NECP_OPEN_FLAG_OBSERVER flag, and the process |
141 | * passes the necessary privilege check, the fd is allowed to use necp_client_action() |
142 | * to copy client state attached to the file descriptors of other processes, and to |
143 | * list all client IDs on the system. |
144 | */ |
145 | |
146 | extern u_int32_t necp_debug; |
147 | |
148 | static int noop_read(struct fileproc *, struct uio *, int, vfs_context_t); |
149 | static int noop_write(struct fileproc *, struct uio *, int, vfs_context_t); |
150 | static int noop_ioctl(struct fileproc *, unsigned long, caddr_t, |
151 | vfs_context_t); |
152 | static int necpop_select(struct fileproc *, int, void *, vfs_context_t); |
153 | static int necpop_close(struct fileglob *, vfs_context_t); |
154 | static int necpop_kqfilter(struct fileproc *, struct knote *, |
155 | struct kevent_internal_s *kev, vfs_context_t); |
156 | |
157 | // Timer functions |
158 | static int necp_timeout_microseconds = 1000 * 100; // 100ms |
159 | static int necp_timeout_leeway_microseconds = 1000 * 500; // 500ms |
160 | |
161 | static int necp_client_fd_count = 0; |
162 | static int necp_observer_fd_count = 0; |
163 | static int necp_client_count = 0; |
164 | static int necp_socket_flow_count = 0; |
165 | static int necp_if_flow_count = 0; |
166 | static int necp_observer_message_limit = 256; |
167 | |
168 | SYSCTL_INT(_net_necp, NECPCTL_CLIENT_FD_COUNT, client_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_fd_count, 0, "" ); |
169 | SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_FD_COUNT, observer_fd_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_observer_fd_count, 0, "" ); |
170 | SYSCTL_INT(_net_necp, NECPCTL_CLIENT_COUNT, client_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_client_count, 0, "" ); |
171 | SYSCTL_INT(_net_necp, NECPCTL_SOCKET_FLOW_COUNT, socket_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_socket_flow_count, 0, "" ); |
172 | SYSCTL_INT(_net_necp, NECPCTL_IF_FLOW_COUNT, if_flow_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_if_flow_count, 0, "" ); |
173 | SYSCTL_INT(_net_necp, NECPCTL_OBSERVER_MESSAGE_LIMIT, observer_message_limit, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_observer_message_limit, 256, "" ); |
174 | |
175 | #define NECP_MAX_CLIENT_LIST_SIZE 1024 * 1024 // 1MB |
176 | #define NECP_MAX_AGENT_ACTION_SIZE 256 |
177 | |
178 | extern int tvtohz(struct timeval *); |
179 | extern unsigned int get_maxmtu(struct rtentry *); |
180 | |
181 | // Parsed parameters |
182 | #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR 0x00001 |
183 | #define NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR 0x00002 |
184 | #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF 0x00004 |
185 | #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF 0x00008 |
186 | #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE 0x00010 |
187 | #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE 0x00020 |
188 | #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT 0x00040 |
189 | #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT 0x00080 |
190 | #define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT 0x00100 |
191 | #define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT 0x00200 |
192 | #define NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE 0x00400 |
193 | #define NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE 0x00800 |
194 | #define NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE 0x01000 |
195 | #define NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE 0x02000 |
196 | #define NECP_PARSED_PARAMETERS_FIELD_FLAGS 0x04000 |
197 | #define NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL 0x08000 |
198 | #define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID 0x10000 |
199 | #define NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID 0x20000 |
200 | #define NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS 0x40000 |
201 | #define NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT 0x80000 |
202 | |
203 | #define NECP_MAX_PARSED_PARAMETERS 16 |
204 | struct necp_client_parsed_parameters { |
205 | u_int32_t valid_fields; |
206 | u_int32_t flags; |
207 | union necp_sockaddr_union local_addr; |
208 | union necp_sockaddr_union remote_addr; |
209 | u_int32_t required_interface_index; |
210 | char prohibited_interfaces[IFXNAMSIZ][NECP_MAX_PARSED_PARAMETERS]; |
211 | u_int8_t required_interface_type; |
212 | u_int8_t prohibited_interface_types[NECP_MAX_PARSED_PARAMETERS]; |
213 | struct necp_client_parameter_netagent_type required_netagent_types[NECP_MAX_PARSED_PARAMETERS]; |
214 | struct necp_client_parameter_netagent_type prohibited_netagent_types[NECP_MAX_PARSED_PARAMETERS]; |
215 | struct necp_client_parameter_netagent_type preferred_netagent_types[NECP_MAX_PARSED_PARAMETERS]; |
216 | struct necp_client_parameter_netagent_type avoided_netagent_types[NECP_MAX_PARSED_PARAMETERS]; |
217 | uuid_t required_netagents[NECP_MAX_PARSED_PARAMETERS]; |
218 | uuid_t prohibited_netagents[NECP_MAX_PARSED_PARAMETERS]; |
219 | uuid_t preferred_netagents[NECP_MAX_PARSED_PARAMETERS]; |
220 | uuid_t avoided_netagents[NECP_MAX_PARSED_PARAMETERS]; |
221 | u_int16_t ip_protocol; |
222 | pid_t effective_pid; |
223 | uuid_t effective_uuid; |
224 | u_int32_t traffic_class; |
225 | }; |
226 | |
227 | static bool |
228 | necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters, |
229 | u_int *return_ifindex, bool *validate_agents); |
230 | |
231 | static bool |
232 | necp_ifnet_matches_local_address(struct ifnet *ifp, struct sockaddr *sa); |
233 | |
234 | static bool |
235 | necp_ifnet_matches_parameters(struct ifnet *ifp, |
236 | struct necp_client_parsed_parameters *parsed_parameters, |
237 | u_int32_t *preferred_count, |
238 | bool secondary_interface); |
239 | |
240 | static const struct fileops necp_fd_ops = { |
241 | .fo_type = DTYPE_NETPOLICY, |
242 | .fo_read = noop_read, |
243 | .fo_write = noop_write, |
244 | .fo_ioctl = noop_ioctl, |
245 | .fo_select = necpop_select, |
246 | .fo_close = necpop_close, |
247 | .fo_kqfilter = necpop_kqfilter, |
248 | .fo_drain = NULL, |
249 | }; |
250 | |
251 | struct necp_client_assertion { |
252 | LIST_ENTRY(necp_client_assertion) assertion_chain; |
253 | uuid_t asserted_netagent; |
254 | }; |
255 | |
256 | struct { |
257 | struct necp_tlv_header ; |
258 | struct necp_tlv_header ; |
259 | uuid_t ; |
260 | struct necp_tlv_header ; |
261 | u_int32_t ; |
262 | struct necp_tlv_header ; |
263 | struct necp_client_result_interface ; |
264 | } __attribute__((__packed__)); |
265 | |
266 | struct { |
267 | struct necp_tlv_header ; |
268 | struct necp_client_flow_protoctl_event ; |
269 | } __attribute__((__packed__)); |
270 | |
271 | struct { |
272 | struct necp_client_flow_header ; |
273 | struct necp_tlv_header ; |
274 | struct necp_client_result_netagent ; |
275 | struct necp_tlv_header ; |
276 | u_int8_t [NECP_TFO_COOKIE_LEN_MAX]; |
277 | } __attribute__((__packed__)); |
278 | |
279 | |
280 | struct necp_client_flow { |
281 | LIST_ENTRY(necp_client_flow) flow_chain; |
282 | unsigned invalid : 1; |
283 | unsigned nexus : 1; // If true, flow is a nexus; if false, flow is attached to socket |
284 | unsigned socket : 1; |
285 | unsigned viable : 1; |
286 | unsigned assigned : 1; |
287 | unsigned has_protoctl_event : 1; |
288 | unsigned check_tcp_heuristics : 1; |
289 | unsigned _reserved : 1; |
290 | union { |
291 | uuid_t nexus_agent; |
292 | struct { |
293 | void *socket_handle; |
294 | necp_client_flow_cb cb; |
295 | }; |
296 | } u; |
297 | uint32_t interface_index; |
298 | uint16_t interface_flags; |
299 | uint32_t necp_flow_flags; |
300 | struct necp_client_flow_protoctl_event protoctl_event; |
301 | union necp_sockaddr_union local_addr; |
302 | union necp_sockaddr_union remote_addr; |
303 | |
304 | size_t assigned_results_length; |
305 | u_int8_t *assigned_results; |
306 | }; |
307 | |
308 | struct necp_client_flow_registration { |
309 | RB_ENTRY(necp_client_flow_registration) fd_link; |
310 | RB_ENTRY(necp_client_flow_registration) global_link; |
311 | RB_ENTRY(necp_client_flow_registration) client_link; |
312 | LIST_ENTRY(necp_client_flow_registration) collect_stats_chain; |
313 | uuid_t registration_id; |
314 | u_int32_t flags; |
315 | unsigned flow_result_read : 1; |
316 | unsigned defunct : 1; |
317 | void *interface_handle; |
318 | necp_client_flow_cb interface_cb; |
319 | struct necp_client *client; |
320 | LIST_HEAD(_necp_registration_flow_list, necp_client_flow) flow_list; |
321 | u_int64_t last_interface_details __attribute__((aligned(sizeof(u_int64_t)))); |
322 | }; |
323 | |
324 | static int necp_client_flow_id_cmp(struct necp_client_flow_registration *flow0, struct necp_client_flow_registration *flow1); |
325 | |
326 | RB_HEAD(_necp_client_flow_tree, necp_client_flow_registration); |
327 | RB_PROTOTYPE_PREV(_necp_client_flow_tree, necp_client_flow_registration, client_link, necp_client_flow_id_cmp); |
328 | RB_GENERATE_PREV(_necp_client_flow_tree, necp_client_flow_registration, client_link, necp_client_flow_id_cmp); |
329 | |
330 | #define NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT 4 |
331 | #define NECP_CLIENT_MAX_INTERFACE_OPTIONS 16 |
332 | |
333 | #define (NECP_CLIENT_MAX_INTERFACE_OPTIONS - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) |
334 | |
335 | struct necp_client { |
336 | RB_ENTRY(necp_client) link; |
337 | RB_ENTRY(necp_client) global_link; |
338 | |
339 | decl_lck_mtx_data(, lock); |
340 | decl_lck_mtx_data(, route_lock); |
341 | uint32_t reference_count; |
342 | |
343 | uuid_t client_id; |
344 | unsigned result_read : 1; |
345 | unsigned allow_multiple_flows : 1; |
346 | unsigned legacy_client_is_flow : 1; |
347 | |
348 | unsigned background : 1; |
349 | unsigned background_update : 1; |
350 | unsigned platform_binary : 1; |
351 | |
352 | size_t result_length; |
353 | u_int8_t result[NECP_MAX_CLIENT_RESULT_SIZE]; |
354 | |
355 | necp_policy_id policy_id; |
356 | |
357 | u_int16_t ip_protocol; |
358 | int proc_pid; |
359 | |
360 | struct _necp_client_flow_tree flow_registrations; |
361 | LIST_HEAD(_necp_client_assertion_list, necp_client_assertion) assertion_list; |
362 | |
363 | struct rtentry *current_route; |
364 | |
365 | struct necp_client_interface_option interface_options[NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT]; |
366 | struct necp_client_interface_option *; |
367 | u_int8_t interface_option_count; // Number in interface_options + extra_interface_options |
368 | |
369 | struct necp_client_result_netagent failed_trigger_agent; |
370 | |
371 | void *agent_handle; |
372 | |
373 | size_t parameters_length; |
374 | u_int8_t parameters[0]; |
375 | }; |
376 | |
377 | #define NECP_CLIENT_LOCK(_c) lck_mtx_lock(&_c->lock) |
378 | #define NECP_CLIENT_UNLOCK(_c) lck_mtx_unlock(&_c->lock) |
379 | #define NECP_CLIENT_ASSERT_LOCKED(_c) LCK_MTX_ASSERT(&_c->lock, LCK_MTX_ASSERT_OWNED) |
380 | #define NECP_CLIENT_ASSERT_UNLOCKED(_c) LCK_MTX_ASSERT(&_c->lock, LCK_MTX_ASSERT_NOTOWNED) |
381 | |
382 | #define NECP_CLIENT_ROUTE_LOCK(_c) lck_mtx_lock(&_c->route_lock) |
383 | #define NECP_CLIENT_ROUTE_UNLOCK(_c) lck_mtx_unlock(&_c->route_lock) |
384 | |
385 | static void necp_client_retain_locked(struct necp_client *client); |
386 | static void necp_client_retain(struct necp_client *client); |
387 | static bool necp_client_release_locked(struct necp_client *client); |
388 | |
389 | static void |
390 | necp_client_add_assertion(struct necp_client *client, uuid_t netagent_uuid); |
391 | |
392 | static bool |
393 | necp_client_remove_assertion(struct necp_client *client, uuid_t netagent_uuid); |
394 | |
395 | LIST_HEAD(_necp_flow_registration_list, necp_client_flow_registration); |
396 | static struct _necp_flow_registration_list necp_collect_stats_flow_list; |
397 | |
398 | struct necp_flow_defunct { |
399 | LIST_ENTRY(necp_flow_defunct) chain; |
400 | |
401 | uuid_t flow_id; |
402 | uuid_t nexus_agent; |
403 | void *agent_handle; |
404 | int proc_pid; |
405 | }; |
406 | |
407 | LIST_HEAD(_necp_flow_defunct_list, necp_flow_defunct); |
408 | |
409 | static int necp_client_id_cmp(struct necp_client *client0, struct necp_client *client1); |
410 | |
411 | RB_HEAD(_necp_client_tree, necp_client); |
412 | RB_PROTOTYPE_PREV(_necp_client_tree, necp_client, link, necp_client_id_cmp); |
413 | RB_GENERATE_PREV(_necp_client_tree, necp_client, link, necp_client_id_cmp); |
414 | |
415 | RB_HEAD(_necp_client_global_tree, necp_client); |
416 | RB_PROTOTYPE_PREV(_necp_client_global_tree, necp_client, global_link, necp_client_id_cmp); |
417 | RB_GENERATE_PREV(_necp_client_global_tree, necp_client, global_link, necp_client_id_cmp); |
418 | |
419 | RB_HEAD(_necp_fd_flow_tree, necp_client_flow_registration); |
420 | RB_PROTOTYPE_PREV(_necp_fd_flow_tree, necp_client_flow_registration, fd_link, necp_client_flow_id_cmp); |
421 | RB_GENERATE_PREV(_necp_fd_flow_tree, necp_client_flow_registration, fd_link, necp_client_flow_id_cmp); |
422 | |
423 | RB_HEAD(_necp_client_flow_global_tree, necp_client_flow_registration); |
424 | RB_PROTOTYPE_PREV(_necp_client_flow_global_tree, necp_client_flow_registration, global_link, necp_client_flow_id_cmp); |
425 | RB_GENERATE_PREV(_necp_client_flow_global_tree, necp_client_flow_registration, global_link, necp_client_flow_id_cmp); |
426 | |
427 | static struct _necp_client_global_tree necp_client_global_tree; |
428 | static struct _necp_client_flow_global_tree necp_client_flow_global_tree; |
429 | |
430 | struct necp_client_update { |
431 | TAILQ_ENTRY(necp_client_update) chain; |
432 | |
433 | uuid_t client_id; |
434 | |
435 | size_t update_length; |
436 | struct necp_client_observer_update update; |
437 | }; |
438 | |
439 | |
440 | #define NAIF_ATTACHED 0x1 // arena is attached to list |
441 | #define NAIF_REDIRECT 0x2 // arena mmap has been redirected |
442 | #define NAIF_DEFUNCT 0x4 // arena is now defunct |
443 | |
444 | struct necp_fd_data { |
445 | u_int8_t necp_fd_type; |
446 | LIST_ENTRY(necp_fd_data) chain; |
447 | struct _necp_client_tree clients; |
448 | struct _necp_fd_flow_tree flows; |
449 | TAILQ_HEAD(_necp_client_update_list, necp_client_update) update_list; |
450 | int update_count; |
451 | int flags; |
452 | int proc_pid; |
453 | decl_lck_mtx_data(, fd_lock); |
454 | struct selinfo si; |
455 | }; |
456 | |
457 | #define NECP_FD_LOCK(_f) lck_mtx_lock(&_f->fd_lock) |
458 | #define NECP_FD_UNLOCK(_f) lck_mtx_unlock(&_f->fd_lock) |
459 | #define NECP_FD_ASSERT_LOCKED(_f) LCK_MTX_ASSERT(&_f->fd_lock, LCK_MTX_ASSERT_OWNED) |
460 | #define NECP_FD_ASSERT_UNLOCKED(_f) LCK_MTX_ASSERT(&_f->fd_lock, LCK_MTX_ASSERT_NOTOWNED) |
461 | |
462 | static LIST_HEAD(_necp_fd_list, necp_fd_data) necp_fd_list; |
463 | static LIST_HEAD(_necp_fd_observer_list, necp_fd_data) necp_fd_observer_list; |
464 | |
465 | #define NECP_CLIENT_FD_ZONE_MAX 128 |
466 | #define NECP_CLIENT_FD_ZONE_NAME "necp.clientfd" |
467 | |
468 | static unsigned int necp_client_fd_size; /* size of zone element */ |
469 | static struct zone *necp_client_fd_zone; /* zone for necp_fd_data */ |
470 | |
471 | #define NECP_FLOW_ZONE_NAME "necp.flow" |
472 | #define NECP_FLOW_REGISTRATION_ZONE_NAME "necp.flowregistration" |
473 | |
474 | static unsigned int necp_flow_size; /* size of necp_client_flow */ |
475 | static struct mcache *necp_flow_cache; /* cache for necp_client_flow */ |
476 | |
477 | static unsigned int necp_flow_registration_size; /* size of necp_client_flow_registration */ |
478 | static struct mcache *necp_flow_registration_cache; /* cache for necp_client_flow_registration */ |
479 | |
480 | #define NECP_ARENA_INFO_ZONE_MAX 128 |
481 | #define NECP_ARENA_INFO_ZONE_NAME "necp.arenainfo" |
482 | |
483 | |
484 | static lck_grp_attr_t *necp_fd_grp_attr = NULL; |
485 | static lck_attr_t *necp_fd_mtx_attr = NULL; |
486 | static lck_grp_t *necp_fd_mtx_grp = NULL; |
487 | |
488 | decl_lck_rw_data(static, necp_fd_lock); |
489 | decl_lck_rw_data(static, necp_observer_lock); |
490 | decl_lck_rw_data(static, necp_client_tree_lock); |
491 | decl_lck_rw_data(static, necp_flow_tree_lock); |
492 | decl_lck_rw_data(static, necp_collect_stats_list_lock); |
493 | |
494 | #define NECP_STATS_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_collect_stats_list_lock) |
495 | #define NECP_STATS_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_collect_stats_list_lock) |
496 | #define NECP_STATS_LIST_UNLOCK() lck_rw_done(&necp_collect_stats_list_lock) |
497 | |
498 | #define NECP_CLIENT_TREE_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_client_tree_lock) |
499 | #define NECP_CLIENT_TREE_LOCK_SHARED() lck_rw_lock_shared(&necp_client_tree_lock) |
500 | #define NECP_CLIENT_TREE_UNLOCK() lck_rw_done(&necp_client_tree_lock) |
501 | #define NECP_CLIENT_TREE_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_client_tree_lock, LCK_RW_ASSERT_HELD) |
502 | |
503 | #define NECP_FLOW_TREE_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_flow_tree_lock) |
504 | #define NECP_FLOW_TREE_LOCK_SHARED() lck_rw_lock_shared(&necp_flow_tree_lock) |
505 | #define NECP_FLOW_TREE_UNLOCK() lck_rw_done(&necp_flow_tree_lock) |
506 | #define NECP_FLOW_TREE_ASSERT_LOCKED() LCK_RW_ASSERT(&necp_flow_tree_lock, LCK_RW_ASSERT_HELD) |
507 | |
508 | #define NECP_FD_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_fd_lock) |
509 | #define NECP_FD_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_fd_lock) |
510 | #define NECP_FD_LIST_UNLOCK() lck_rw_done(&necp_fd_lock) |
511 | |
512 | #define NECP_OBSERVER_LIST_LOCK_EXCLUSIVE() lck_rw_lock_exclusive(&necp_observer_lock) |
513 | #define NECP_OBSERVER_LIST_LOCK_SHARED() lck_rw_lock_shared(&necp_observer_lock) |
514 | #define NECP_OBSERVER_LIST_UNLOCK() lck_rw_done(&necp_observer_lock) |
515 | |
516 | // Locking Notes |
517 | |
518 | // Take NECP_FD_LIST_LOCK when accessing or modifying the necp_fd_list |
519 | // Take NECP_CLIENT_TREE_LOCK when accessing or modifying the necp_client_global_tree |
520 | // Take NECP_FLOW_TREE_LOCK when accessing or modifying the necp_client_flow_global_tree |
521 | // Take NECP_STATS_LIST_LOCK when accessing or modifying the necp_collect_stats_flow_list |
522 | // Take NECP_FD_LOCK when accessing or modifying an necp_fd_data entry |
523 | // Take NECP_CLIENT_LOCK when accessing or modifying a single necp_client |
524 | // Take NECP_CLIENT_ROUTE_LOCK when accessing or modifying a client's route |
525 | |
526 | // Precedence, where 1 is the first lock that must be taken |
527 | // 1. NECP_FD_LIST_LOCK |
528 | // 2. NECP_FD_LOCK (any) |
529 | // 3. NECP_CLIENT_TREE_LOCK |
530 | // 4. NECP_CLIENT_LOCK (any) |
531 | // 5. NECP_FLOW_TREE_LOCK |
532 | // 6. NECP_STATS_LIST_LOCK |
533 | // 7. NECP_CLIENT_ROUTE_LOCK (any) |
534 | |
535 | static thread_call_t necp_client_update_tcall; |
536 | |
537 | |
538 | /// NECP file descriptor functions |
539 | |
540 | static int |
541 | noop_read(struct fileproc *fp, struct uio *uio, int flags, vfs_context_t ctx) |
542 | { |
543 | #pragma unused(fp, uio, flags, ctx) |
544 | return (ENXIO); |
545 | } |
546 | |
547 | static int |
548 | noop_write(struct fileproc *fp, struct uio *uio, int flags, |
549 | vfs_context_t ctx) |
550 | { |
551 | #pragma unused(fp, uio, flags, ctx) |
552 | return (ENXIO); |
553 | } |
554 | |
555 | static int |
556 | noop_ioctl(struct fileproc *fp, unsigned long com, caddr_t data, |
557 | vfs_context_t ctx) |
558 | { |
559 | #pragma unused(fp, com, data, ctx) |
560 | return (ENOTTY); |
561 | } |
562 | |
563 | static void |
564 | necp_fd_notify(struct necp_fd_data *fd_data, bool locked) |
565 | { |
566 | struct selinfo *si = &fd_data->si; |
567 | |
568 | if (!locked) { |
569 | NECP_FD_LOCK(fd_data); |
570 | } |
571 | |
572 | selwakeup(si); |
573 | |
574 | // use a non-zero hint to tell the notification from the |
575 | // call done in kqueue_scan() which uses 0 |
576 | KNOTE(&si->si_note, 1); // notification |
577 | |
578 | if (!locked) { |
579 | NECP_FD_UNLOCK(fd_data); |
580 | } |
581 | } |
582 | |
583 | static inline bool |
584 | necp_client_has_unread_flows(struct necp_client *client) |
585 | { |
586 | NECP_CLIENT_ASSERT_LOCKED(client); |
587 | struct necp_client_flow_registration *flow_registration = NULL; |
588 | RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) { |
589 | if (!flow_registration->flow_result_read) { |
590 | return true; |
591 | } |
592 | } |
593 | return false; |
594 | } |
595 | |
596 | static int |
597 | necp_fd_poll(struct necp_fd_data *fd_data, int events, void *wql, struct proc *p, int is_kevent) |
598 | { |
599 | #pragma unused(wql, p, is_kevent) |
600 | u_int revents = 0; |
601 | |
602 | u_int want_rx = events & (POLLIN | POLLRDNORM); |
603 | if (want_rx) { |
604 | if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) { |
605 | // Push-mode observers are readable when they have a new update |
606 | if (!TAILQ_EMPTY(&fd_data->update_list)) { |
607 | revents |= want_rx; |
608 | } |
609 | } else { |
610 | // Standard fds are readable when some client is unread |
611 | struct necp_client *client = NULL; |
612 | bool has_unread_clients = FALSE; |
613 | RB_FOREACH(client, _necp_client_tree, &fd_data->clients) { |
614 | NECP_CLIENT_LOCK(client); |
615 | if (!client->result_read || necp_client_has_unread_flows(client)) { |
616 | has_unread_clients = TRUE; |
617 | } |
618 | NECP_CLIENT_UNLOCK(client); |
619 | if (has_unread_clients) { |
620 | break; |
621 | } |
622 | } |
623 | |
624 | if (has_unread_clients) { |
625 | revents |= want_rx; |
626 | } |
627 | } |
628 | } |
629 | |
630 | return (revents); |
631 | } |
632 | |
633 | static inline void |
634 | necp_generate_client_id(uuid_t client_id, bool is_flow) |
635 | { |
636 | uuid_generate_random(client_id); |
637 | |
638 | if (is_flow) { |
639 | client_id[9] |= 0x01; |
640 | } else { |
641 | client_id[9] &= ~0x01; |
642 | } |
643 | } |
644 | |
645 | static inline bool |
646 | necp_client_id_is_flow(uuid_t client_id) |
647 | { |
648 | return (client_id[9] & 0x01); |
649 | } |
650 | |
651 | static struct necp_client * |
652 | necp_find_client_and_lock(uuid_t client_id) |
653 | { |
654 | NECP_CLIENT_TREE_ASSERT_LOCKED(); |
655 | |
656 | struct necp_client *client = NULL; |
657 | |
658 | if (necp_client_id_is_flow(client_id)) { |
659 | NECP_FLOW_TREE_LOCK_SHARED(); |
660 | struct necp_client_flow_registration find; |
661 | uuid_copy(find.registration_id, client_id); |
662 | struct necp_client_flow_registration *flow = RB_FIND(_necp_client_flow_global_tree, &necp_client_flow_global_tree, &find); |
663 | if (flow != NULL) { |
664 | client = flow->client; |
665 | } |
666 | NECP_FLOW_TREE_UNLOCK(); |
667 | } else { |
668 | struct necp_client find; |
669 | uuid_copy(find.client_id, client_id); |
670 | client = RB_FIND(_necp_client_global_tree, &necp_client_global_tree, &find); |
671 | } |
672 | |
673 | if (client != NULL) { |
674 | NECP_CLIENT_LOCK(client); |
675 | } |
676 | |
677 | return (client); |
678 | } |
679 | |
680 | static struct necp_client_flow_registration * |
681 | necp_client_find_flow(struct necp_client *client, uuid_t flow_id) |
682 | { |
683 | NECP_CLIENT_ASSERT_LOCKED(client); |
684 | struct necp_client_flow_registration *flow = NULL; |
685 | |
686 | if (necp_client_id_is_flow(flow_id)) { |
687 | struct necp_client_flow_registration find; |
688 | uuid_copy(find.registration_id, flow_id); |
689 | flow = RB_FIND(_necp_client_flow_tree, &client->flow_registrations, &find); |
690 | } else { |
691 | flow = RB_ROOT(&client->flow_registrations); |
692 | } |
693 | |
694 | return (flow); |
695 | } |
696 | |
697 | static struct necp_client * |
698 | necp_client_fd_find_client_unlocked(struct necp_fd_data *client_fd, uuid_t client_id) |
699 | { |
700 | NECP_FD_ASSERT_LOCKED(client_fd); |
701 | struct necp_client *client = NULL; |
702 | |
703 | if (necp_client_id_is_flow(client_id)) { |
704 | struct necp_client_flow_registration find; |
705 | uuid_copy(find.registration_id, client_id); |
706 | struct necp_client_flow_registration *flow = RB_FIND(_necp_fd_flow_tree, &client_fd->flows, &find); |
707 | if (flow != NULL) { |
708 | client = flow->client; |
709 | } |
710 | } else { |
711 | struct necp_client find; |
712 | uuid_copy(find.client_id, client_id); |
713 | client = RB_FIND(_necp_client_tree, &client_fd->clients, &find); |
714 | } |
715 | |
716 | return (client); |
717 | } |
718 | |
719 | static struct necp_client * |
720 | necp_client_fd_find_client_and_lock(struct necp_fd_data *client_fd, uuid_t client_id) |
721 | { |
722 | struct necp_client *client = necp_client_fd_find_client_unlocked(client_fd, client_id); |
723 | if (client != NULL) { |
724 | NECP_CLIENT_LOCK(client); |
725 | } |
726 | |
727 | return (client); |
728 | } |
729 | |
730 | static inline int |
731 | necp_client_id_cmp(struct necp_client *client0, struct necp_client *client1) |
732 | { |
733 | return (uuid_compare(client0->client_id, client1->client_id)); |
734 | } |
735 | |
736 | static inline int |
737 | necp_client_flow_id_cmp(struct necp_client_flow_registration *flow0, struct necp_client_flow_registration *flow1) |
738 | { |
739 | return (uuid_compare(flow0->registration_id, flow1->registration_id)); |
740 | } |
741 | |
742 | static int |
743 | necpop_select(struct fileproc *fp, int which, void *wql, vfs_context_t ctx) |
744 | { |
745 | #pragma unused(fp, which, wql, ctx) |
746 | return (0); |
747 | struct necp_fd_data *fd_data = NULL; |
748 | int revents = 0; |
749 | int events = 0; |
750 | proc_t procp; |
751 | |
752 | fd_data = (struct necp_fd_data *)fp->f_fglob->fg_data; |
753 | if (fd_data == NULL) { |
754 | return (0); |
755 | } |
756 | |
757 | procp = vfs_context_proc(ctx); |
758 | |
759 | switch (which) { |
760 | case FREAD: { |
761 | events = POLLIN; |
762 | break; |
763 | } |
764 | |
765 | default: { |
766 | return (1); |
767 | } |
768 | } |
769 | |
770 | NECP_FD_LOCK(fd_data); |
771 | revents = necp_fd_poll(fd_data, events, wql, procp, 0); |
772 | NECP_FD_UNLOCK(fd_data); |
773 | |
774 | return ((events & revents) ? 1 : 0); |
775 | } |
776 | |
777 | static void |
778 | necp_fd_knrdetach(struct knote *kn) |
779 | { |
780 | struct necp_fd_data *fd_data = (struct necp_fd_data *)kn->kn_hook; |
781 | struct selinfo *si = &fd_data->si; |
782 | |
783 | NECP_FD_LOCK(fd_data); |
784 | KNOTE_DETACH(&si->si_note, kn); |
785 | NECP_FD_UNLOCK(fd_data); |
786 | } |
787 | |
788 | static int |
789 | necp_fd_knread(struct knote *kn, long hint) |
790 | { |
791 | #pragma unused(kn, hint) |
792 | return 1; /* assume we are ready */ |
793 | } |
794 | |
795 | static int |
796 | necp_fd_knrprocess(struct knote *kn, struct filt_process_s *data, struct kevent_internal_s *kev) |
797 | { |
798 | #pragma unused(data) |
799 | struct necp_fd_data *fd_data; |
800 | int revents; |
801 | int res; |
802 | |
803 | fd_data = (struct necp_fd_data *)kn->kn_hook; |
804 | |
805 | NECP_FD_LOCK(fd_data); |
806 | revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1); |
807 | res = ((revents & POLLIN) != 0); |
808 | if (res) { |
809 | *kev = kn->kn_kevent; |
810 | } |
811 | NECP_FD_UNLOCK(fd_data); |
812 | return (res); |
813 | } |
814 | |
815 | static int |
816 | necp_fd_knrtouch(struct knote *kn, struct kevent_internal_s *kev) |
817 | { |
818 | #pragma unused(kev) |
819 | struct necp_fd_data *fd_data; |
820 | int revents; |
821 | |
822 | fd_data = (struct necp_fd_data *)kn->kn_hook; |
823 | |
824 | NECP_FD_LOCK(fd_data); |
825 | revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1); |
826 | NECP_FD_UNLOCK(fd_data); |
827 | |
828 | return ((revents & POLLIN) != 0); |
829 | } |
830 | |
831 | SECURITY_READ_ONLY_EARLY(struct filterops) necp_fd_rfiltops = { |
832 | .f_isfd = 1, |
833 | .f_detach = necp_fd_knrdetach, |
834 | .f_event = necp_fd_knread, |
835 | .f_touch = necp_fd_knrtouch, |
836 | .f_process = necp_fd_knrprocess, |
837 | }; |
838 | |
839 | static int |
840 | necpop_kqfilter(struct fileproc *fp, struct knote *kn, |
841 | __unused struct kevent_internal_s *kev, vfs_context_t ctx) |
842 | { |
843 | #pragma unused(fp, ctx) |
844 | struct necp_fd_data *fd_data = NULL; |
845 | int revents; |
846 | |
847 | if (kn->kn_filter != EVFILT_READ) { |
848 | NECPLOG(LOG_ERR, "bad filter request %d" , kn->kn_filter); |
849 | kn->kn_flags = EV_ERROR; |
850 | kn->kn_data = EINVAL; |
851 | return (0); |
852 | } |
853 | |
854 | fd_data = (struct necp_fd_data *)kn->kn_fp->f_fglob->fg_data; |
855 | if (fd_data == NULL) { |
856 | NECPLOG0(LOG_ERR, "No channel for kqfilter" ); |
857 | kn->kn_flags = EV_ERROR; |
858 | kn->kn_data = ENOENT; |
859 | return (0); |
860 | } |
861 | |
862 | NECP_FD_LOCK(fd_data); |
863 | kn->kn_filtid = EVFILTID_NECP_FD; |
864 | kn->kn_hook = fd_data; |
865 | KNOTE_ATTACH(&fd_data->si.si_note, kn); |
866 | |
867 | revents = necp_fd_poll(fd_data, POLLIN, NULL, current_proc(), 1); |
868 | |
869 | NECP_FD_UNLOCK(fd_data); |
870 | |
871 | return ((revents & POLLIN) != 0); |
872 | } |
873 | |
874 | #define INTERFACE_FLAGS_SHIFT 32 |
875 | #define INTERFACE_FLAGS_MASK 0xffff |
876 | #define INTERFACE_INDEX_SHIFT 0 |
877 | #define INTERFACE_INDEX_MASK 0xffffffff |
878 | |
879 | static uint64_t |
880 | combine_interface_details(uint32_t interface_index, uint16_t interface_flags) |
881 | { |
882 | return (((uint64_t)interface_flags & INTERFACE_FLAGS_MASK) << INTERFACE_FLAGS_SHIFT | |
883 | ((uint64_t)interface_index & INTERFACE_INDEX_MASK) << INTERFACE_INDEX_SHIFT); |
884 | } |
885 | |
886 | |
887 | static void |
888 | necp_defunct_flow_registration(struct necp_client *client, |
889 | struct necp_client_flow_registration *flow_registration, |
890 | struct _necp_flow_defunct_list *defunct_list) |
891 | { |
892 | NECP_CLIENT_ASSERT_LOCKED(client); |
893 | |
894 | if (!flow_registration->defunct) { |
895 | bool needs_defunct = false; |
896 | struct necp_client_flow *search_flow = NULL; |
897 | LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) { |
898 | if (search_flow->nexus && |
899 | !uuid_is_null(search_flow->u.nexus_agent)) { |
900 | |
901 | // Save defunct values for the nexus |
902 | if (defunct_list != NULL) { |
903 | // Sleeping alloc won't fail; copy only what's necessary |
904 | struct necp_flow_defunct *flow_defunct = _MALLOC(sizeof (struct necp_flow_defunct), |
905 | M_NECP, M_WAITOK | M_ZERO); |
906 | uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent); |
907 | uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ? |
908 | client->client_id : |
909 | flow_registration->registration_id)); |
910 | flow_defunct->proc_pid = client->proc_pid; |
911 | flow_defunct->agent_handle = client->agent_handle; |
912 | |
913 | // Add to the list provided by caller |
914 | LIST_INSERT_HEAD(defunct_list, flow_defunct, chain); |
915 | } |
916 | |
917 | needs_defunct = true; |
918 | } |
919 | } |
920 | |
921 | if (needs_defunct) { |
922 | |
923 | // Only set defunct if there was some assigned flow |
924 | flow_registration->defunct = true; |
925 | } |
926 | } |
927 | } |
928 | |
929 | static void |
930 | necp_defunct_client_for_policy(struct necp_client *client, |
931 | struct _necp_flow_defunct_list *defunct_list) |
932 | { |
933 | NECP_CLIENT_ASSERT_LOCKED(client); |
934 | |
935 | struct necp_client_flow_registration *flow_registration = NULL; |
936 | RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) { |
937 | necp_defunct_flow_registration(client, flow_registration, defunct_list); |
938 | } |
939 | } |
940 | |
941 | static void |
942 | necp_client_free(struct necp_client *client) |
943 | { |
944 | NECP_CLIENT_ASSERT_LOCKED(client); |
945 | |
946 | NECP_CLIENT_UNLOCK(client); |
947 | |
948 | FREE(client->extra_interface_options, M_NECP); |
949 | client->extra_interface_options = NULL; |
950 | |
951 | lck_mtx_destroy(&client->route_lock, necp_fd_mtx_grp); |
952 | lck_mtx_destroy(&client->lock, necp_fd_mtx_grp); |
953 | |
954 | FREE(client, M_NECP); |
955 | } |
956 | |
957 | static void |
958 | necp_client_retain_locked(struct necp_client *client) |
959 | { |
960 | NECP_CLIENT_ASSERT_LOCKED(client); |
961 | |
962 | client->reference_count++; |
963 | ASSERT(client->reference_count != 0); |
964 | } |
965 | |
966 | static void |
967 | necp_client_retain(struct necp_client *client) |
968 | { |
969 | NECP_CLIENT_LOCK(client); |
970 | necp_client_retain_locked(client); |
971 | NECP_CLIENT_UNLOCK(client); |
972 | } |
973 | |
974 | static bool |
975 | necp_client_release_locked(struct necp_client *client) |
976 | { |
977 | NECP_CLIENT_ASSERT_LOCKED(client); |
978 | |
979 | uint32_t old_ref = client->reference_count; |
980 | |
981 | ASSERT(client->reference_count != 0); |
982 | if (--client->reference_count == 0) { |
983 | necp_client_free(client); |
984 | } |
985 | |
986 | return (old_ref == 1); |
987 | } |
988 | |
989 | |
990 | static void |
991 | necp_client_update_observer_add_internal(struct necp_fd_data *observer_fd, struct necp_client *client) |
992 | { |
993 | NECP_FD_LOCK(observer_fd); |
994 | |
995 | if (observer_fd->update_count >= necp_observer_message_limit) { |
996 | NECP_FD_UNLOCK(observer_fd); |
997 | return; |
998 | } |
999 | |
1000 | struct necp_client_update *client_update = _MALLOC(sizeof(struct necp_client_update) + client->parameters_length, |
1001 | M_NECP, M_WAITOK | M_ZERO); |
1002 | if (client_update != NULL) { |
1003 | client_update->update_length = sizeof(struct necp_client_observer_update) + client->parameters_length; |
1004 | uuid_copy(client_update->client_id, client->client_id); |
1005 | client_update->update.update_type = NECP_CLIENT_UPDATE_TYPE_PARAMETERS; |
1006 | memcpy(client_update->update.tlv_buffer, client->parameters, client->parameters_length); |
1007 | TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain); |
1008 | observer_fd->update_count++; |
1009 | |
1010 | necp_fd_notify(observer_fd, true); |
1011 | } |
1012 | |
1013 | NECP_FD_UNLOCK(observer_fd); |
1014 | } |
1015 | |
1016 | static void |
1017 | necp_client_update_observer_update_internal(struct necp_fd_data *observer_fd, struct necp_client *client) |
1018 | { |
1019 | NECP_FD_LOCK(observer_fd); |
1020 | |
1021 | if (observer_fd->update_count >= necp_observer_message_limit) { |
1022 | NECP_FD_UNLOCK(observer_fd); |
1023 | return; |
1024 | } |
1025 | |
1026 | struct necp_client_update *client_update = _MALLOC(sizeof(struct necp_client_update) + client->result_length, |
1027 | M_NECP, M_WAITOK | M_ZERO); |
1028 | if (client_update != NULL) { |
1029 | client_update->update_length = sizeof(struct necp_client_observer_update) + client->result_length; |
1030 | uuid_copy(client_update->client_id, client->client_id); |
1031 | client_update->update.update_type = NECP_CLIENT_UPDATE_TYPE_RESULT; |
1032 | memcpy(client_update->update.tlv_buffer, client->result, client->result_length); |
1033 | TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain); |
1034 | observer_fd->update_count++; |
1035 | |
1036 | necp_fd_notify(observer_fd, true); |
1037 | } |
1038 | |
1039 | NECP_FD_UNLOCK(observer_fd); |
1040 | } |
1041 | |
1042 | static void |
1043 | necp_client_update_observer_remove_internal(struct necp_fd_data *observer_fd, struct necp_client *client) |
1044 | { |
1045 | NECP_FD_LOCK(observer_fd); |
1046 | |
1047 | if (observer_fd->update_count >= necp_observer_message_limit) { |
1048 | NECP_FD_UNLOCK(observer_fd); |
1049 | return; |
1050 | } |
1051 | |
1052 | struct necp_client_update *client_update = _MALLOC(sizeof(struct necp_client_update), |
1053 | M_NECP, M_WAITOK | M_ZERO); |
1054 | if (client_update != NULL) { |
1055 | client_update->update_length = sizeof(struct necp_client_observer_update); |
1056 | uuid_copy(client_update->client_id, client->client_id); |
1057 | client_update->update.update_type = NECP_CLIENT_UPDATE_TYPE_REMOVE; |
1058 | TAILQ_INSERT_TAIL(&observer_fd->update_list, client_update, chain); |
1059 | observer_fd->update_count++; |
1060 | |
1061 | necp_fd_notify(observer_fd, true); |
1062 | } |
1063 | |
1064 | NECP_FD_UNLOCK(observer_fd); |
1065 | } |
1066 | |
1067 | static void |
1068 | necp_client_update_observer_add(struct necp_client *client) |
1069 | { |
1070 | NECP_OBSERVER_LIST_LOCK_SHARED(); |
1071 | |
1072 | if (LIST_EMPTY(&necp_fd_observer_list)) { |
1073 | // No observers, bail |
1074 | NECP_OBSERVER_LIST_UNLOCK(); |
1075 | return; |
1076 | } |
1077 | |
1078 | struct necp_fd_data *observer_fd = NULL; |
1079 | LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) { |
1080 | necp_client_update_observer_add_internal(observer_fd, client); |
1081 | } |
1082 | |
1083 | NECP_OBSERVER_LIST_UNLOCK(); |
1084 | } |
1085 | |
1086 | static void |
1087 | necp_client_update_observer_update(struct necp_client *client) |
1088 | { |
1089 | NECP_OBSERVER_LIST_LOCK_SHARED(); |
1090 | |
1091 | if (LIST_EMPTY(&necp_fd_observer_list)) { |
1092 | // No observers, bail |
1093 | NECP_OBSERVER_LIST_UNLOCK(); |
1094 | return; |
1095 | } |
1096 | |
1097 | struct necp_fd_data *observer_fd = NULL; |
1098 | LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) { |
1099 | necp_client_update_observer_update_internal(observer_fd, client); |
1100 | } |
1101 | |
1102 | NECP_OBSERVER_LIST_UNLOCK(); |
1103 | } |
1104 | |
1105 | static void |
1106 | necp_client_update_observer_remove(struct necp_client *client) |
1107 | { |
1108 | NECP_OBSERVER_LIST_LOCK_SHARED(); |
1109 | |
1110 | if (LIST_EMPTY(&necp_fd_observer_list)) { |
1111 | // No observers, bail |
1112 | NECP_OBSERVER_LIST_UNLOCK(); |
1113 | return; |
1114 | } |
1115 | |
1116 | struct necp_fd_data *observer_fd = NULL; |
1117 | LIST_FOREACH(observer_fd, &necp_fd_observer_list, chain) { |
1118 | necp_client_update_observer_remove_internal(observer_fd, client); |
1119 | } |
1120 | |
1121 | NECP_OBSERVER_LIST_UNLOCK(); |
1122 | } |
1123 | |
1124 | static void |
1125 | necp_destroy_client_flow_registration(struct necp_client *client, |
1126 | struct necp_client_flow_registration *flow_registration, |
1127 | pid_t pid, bool abort) |
1128 | { |
1129 | NECP_CLIENT_ASSERT_LOCKED(client); |
1130 | |
1131 | |
1132 | struct necp_client_flow *search_flow = NULL; |
1133 | struct necp_client_flow *temp_flow = NULL; |
1134 | LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) { |
1135 | if (search_flow->nexus && |
1136 | !uuid_is_null(search_flow->u.nexus_agent)) { |
1137 | // Note that if we had defuncted the client earlier, this would result in a harmless ENOENT |
1138 | int netagent_error = netagent_client_message(search_flow->u.nexus_agent, |
1139 | ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ? |
1140 | client->client_id : |
1141 | flow_registration->registration_id), |
1142 | pid, client->agent_handle, |
1143 | (abort ? NETAGENT_MESSAGE_TYPE_ABORT_NEXUS : |
1144 | NETAGENT_MESSAGE_TYPE_CLOSE_NEXUS)); |
1145 | if (netagent_error != 0 && netagent_error != ENOENT) { |
1146 | NECPLOG(LOG_ERR, "necp_client_remove close nexus error (%d)" , netagent_error); |
1147 | } |
1148 | uuid_clear(search_flow->u.nexus_agent); |
1149 | } |
1150 | if (search_flow->assigned_results != NULL) { |
1151 | FREE(search_flow->assigned_results, M_NETAGENT); |
1152 | search_flow->assigned_results = NULL; |
1153 | } |
1154 | LIST_REMOVE(search_flow, flow_chain); |
1155 | if (search_flow->socket) { |
1156 | OSDecrementAtomic(&necp_socket_flow_count); |
1157 | } else { |
1158 | OSDecrementAtomic(&necp_if_flow_count); |
1159 | } |
1160 | mcache_free(necp_flow_cache, search_flow); |
1161 | } |
1162 | |
1163 | RB_REMOVE(_necp_client_flow_tree, &client->flow_registrations, flow_registration); |
1164 | flow_registration->client = NULL; |
1165 | |
1166 | mcache_free(necp_flow_registration_cache, flow_registration); |
1167 | } |
1168 | |
1169 | static void |
1170 | necp_destroy_client(struct necp_client *client, pid_t pid, bool abort) |
1171 | { |
1172 | NECP_CLIENT_ASSERT_UNLOCKED(client); |
1173 | |
1174 | necp_client_update_observer_remove(client); |
1175 | |
1176 | NECP_CLIENT_LOCK(client); |
1177 | |
1178 | // Free route |
1179 | NECP_CLIENT_ROUTE_LOCK(client); |
1180 | if (client->current_route != NULL) { |
1181 | rtfree(client->current_route); |
1182 | client->current_route = NULL; |
1183 | } |
1184 | NECP_CLIENT_ROUTE_UNLOCK(client); |
1185 | |
1186 | // Remove flow assignments |
1187 | struct necp_client_flow_registration *flow_registration = NULL; |
1188 | struct necp_client_flow_registration *temp_flow_registration = NULL; |
1189 | RB_FOREACH_SAFE(flow_registration, _necp_client_flow_tree, &client->flow_registrations, temp_flow_registration) { |
1190 | necp_destroy_client_flow_registration(client, flow_registration, pid, abort); |
1191 | } |
1192 | |
1193 | // Remove agent assertions |
1194 | struct necp_client_assertion *search_assertion = NULL; |
1195 | struct necp_client_assertion *temp_assertion = NULL; |
1196 | LIST_FOREACH_SAFE(search_assertion, &client->assertion_list, assertion_chain, temp_assertion) { |
1197 | int netagent_error = netagent_client_message(search_assertion->asserted_netagent, client->client_id, pid, |
1198 | client->agent_handle, NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT); |
1199 | if (netagent_error != 0) { |
1200 | NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR), |
1201 | "necp_client_remove unassert agent error (%d)" , netagent_error); |
1202 | } |
1203 | LIST_REMOVE(search_assertion, assertion_chain); |
1204 | FREE(search_assertion, M_NECP); |
1205 | } |
1206 | |
1207 | if (!necp_client_release_locked(client)) { |
1208 | NECP_CLIENT_UNLOCK(client); |
1209 | } |
1210 | |
1211 | OSDecrementAtomic(&necp_client_count); |
1212 | } |
1213 | |
1214 | static int |
1215 | necpop_close(struct fileglob *fg, vfs_context_t ctx) |
1216 | { |
1217 | #pragma unused(ctx) |
1218 | struct necp_fd_data *fd_data = NULL; |
1219 | int error = 0; |
1220 | |
1221 | fd_data = (struct necp_fd_data *)fg->fg_data; |
1222 | fg->fg_data = NULL; |
1223 | |
1224 | if (fd_data != NULL) { |
1225 | struct _necp_client_tree clients_to_close; |
1226 | RB_INIT(&clients_to_close); |
1227 | |
1228 | // Remove from list quickly |
1229 | if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) { |
1230 | NECP_OBSERVER_LIST_LOCK_EXCLUSIVE(); |
1231 | LIST_REMOVE(fd_data, chain); |
1232 | NECP_OBSERVER_LIST_UNLOCK(); |
1233 | } else { |
1234 | NECP_FD_LIST_LOCK_EXCLUSIVE(); |
1235 | LIST_REMOVE(fd_data, chain); |
1236 | NECP_FD_LIST_UNLOCK(); |
1237 | } |
1238 | |
1239 | NECP_FD_LOCK(fd_data); |
1240 | pid_t pid = fd_data->proc_pid; |
1241 | |
1242 | struct necp_client_flow_registration *flow_registration = NULL; |
1243 | struct necp_client_flow_registration *temp_flow_registration = NULL; |
1244 | RB_FOREACH_SAFE(flow_registration, _necp_fd_flow_tree, &fd_data->flows, temp_flow_registration) { |
1245 | NECP_FLOW_TREE_LOCK_EXCLUSIVE(); |
1246 | RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration); |
1247 | NECP_FLOW_TREE_UNLOCK(); |
1248 | RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration); |
1249 | } |
1250 | |
1251 | struct necp_client *client = NULL; |
1252 | struct necp_client *temp_client = NULL; |
1253 | RB_FOREACH_SAFE(client, _necp_client_tree, &fd_data->clients, temp_client) { |
1254 | NECP_CLIENT_TREE_LOCK_EXCLUSIVE(); |
1255 | RB_REMOVE(_necp_client_global_tree, &necp_client_global_tree, client); |
1256 | NECP_CLIENT_TREE_UNLOCK(); |
1257 | RB_REMOVE(_necp_client_tree, &fd_data->clients, client); |
1258 | RB_INSERT(_necp_client_tree, &clients_to_close, client); |
1259 | } |
1260 | |
1261 | struct necp_client_update *client_update = NULL; |
1262 | struct necp_client_update *temp_update = NULL; |
1263 | TAILQ_FOREACH_SAFE(client_update, &fd_data->update_list, chain, temp_update) { |
1264 | // Flush pending updates |
1265 | TAILQ_REMOVE(&fd_data->update_list, client_update, chain); |
1266 | FREE(client_update, M_NECP); |
1267 | } |
1268 | fd_data->update_count = 0; |
1269 | |
1270 | |
1271 | NECP_FD_UNLOCK(fd_data); |
1272 | |
1273 | selthreadclear(&fd_data->si); |
1274 | |
1275 | lck_mtx_destroy(&fd_data->fd_lock, necp_fd_mtx_grp); |
1276 | |
1277 | if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) { |
1278 | OSDecrementAtomic(&necp_observer_fd_count); |
1279 | } else { |
1280 | OSDecrementAtomic(&necp_client_fd_count); |
1281 | } |
1282 | |
1283 | zfree(necp_client_fd_zone, fd_data); |
1284 | fd_data = NULL; |
1285 | |
1286 | RB_FOREACH_SAFE(client, _necp_client_tree, &clients_to_close, temp_client) { |
1287 | RB_REMOVE(_necp_client_tree, &clients_to_close, client); |
1288 | necp_destroy_client(client, pid, true); |
1289 | } |
1290 | } |
1291 | |
1292 | return (error); |
1293 | } |
1294 | |
1295 | /// NECP client utilities |
1296 | |
1297 | static inline bool |
1298 | necp_address_is_wildcard(const union necp_sockaddr_union * const addr) |
1299 | { |
1300 | return ((addr->sa.sa_family == AF_INET && addr->sin.sin_addr.s_addr == INADDR_ANY) || |
1301 | (addr->sa.sa_family == AF_INET6 && IN6_IS_ADDR_UNSPECIFIED(&addr->sin6.sin6_addr))); |
1302 | } |
1303 | |
1304 | static int |
1305 | necp_find_fd_data(int fd, struct necp_fd_data **fd_data) |
1306 | { |
1307 | proc_t p = current_proc(); |
1308 | struct fileproc *fp = NULL; |
1309 | int error = 0; |
1310 | |
1311 | proc_fdlock_spin(p); |
1312 | if ((error = fp_lookup(p, fd, &fp, 1)) != 0) { |
1313 | goto done; |
1314 | } |
1315 | if (fp->f_fglob->fg_ops->fo_type != DTYPE_NETPOLICY) { |
1316 | fp_drop(p, fd, fp, 1); |
1317 | error = ENODEV; |
1318 | goto done; |
1319 | } |
1320 | *fd_data = (struct necp_fd_data *)fp->f_fglob->fg_data; |
1321 | |
1322 | if ((*fd_data)->necp_fd_type != necp_fd_type_client) { |
1323 | // Not a client fd, ignore |
1324 | error = EINVAL; |
1325 | goto done; |
1326 | } |
1327 | |
1328 | done: |
1329 | proc_fdunlock(p); |
1330 | return (error); |
1331 | } |
1332 | |
1333 | |
1334 | static struct necp_client_flow * |
1335 | necp_client_add_interface_flow(struct necp_client_flow_registration *flow_registration, |
1336 | uint32_t interface_index) |
1337 | { |
1338 | struct necp_client_flow *new_flow = mcache_alloc(necp_flow_cache, MCR_SLEEP); |
1339 | if (new_flow == NULL) { |
1340 | NECPLOG0(LOG_ERR, "Failed to allocate interface flow" ); |
1341 | return NULL; |
1342 | } |
1343 | |
1344 | memset(new_flow, 0, sizeof(*new_flow)); |
1345 | |
1346 | // Neither nexus nor socket |
1347 | new_flow->interface_index = interface_index; |
1348 | new_flow->u.socket_handle = flow_registration->interface_handle; |
1349 | new_flow->u.cb = flow_registration->interface_cb; |
1350 | |
1351 | OSIncrementAtomic(&necp_if_flow_count); |
1352 | |
1353 | LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain); |
1354 | |
1355 | return new_flow; |
1356 | } |
1357 | |
1358 | static struct necp_client_flow * |
1359 | necp_client_add_interface_flow_if_needed(struct necp_client *client, |
1360 | struct necp_client_flow_registration *flow_registration, |
1361 | uint32_t interface_index) |
1362 | { |
1363 | if (!client->allow_multiple_flows || |
1364 | interface_index == IFSCOPE_NONE) { |
1365 | // Interface not set, or client not allowed to use this mode |
1366 | return NULL; |
1367 | } |
1368 | |
1369 | struct necp_client_flow *flow = NULL; |
1370 | LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) { |
1371 | if (!flow->nexus && !flow->socket && flow->interface_index == interface_index) { |
1372 | // Already have the flow |
1373 | flow->invalid = FALSE; |
1374 | flow->u.socket_handle = flow_registration->interface_handle; |
1375 | flow->u.cb = flow_registration->interface_cb; |
1376 | return NULL; |
1377 | } |
1378 | } |
1379 | return necp_client_add_interface_flow(flow_registration, interface_index); |
1380 | } |
1381 | |
1382 | static void |
1383 | necp_client_add_interface_option_if_needed(struct necp_client *client, |
1384 | uint32_t interface_index, |
1385 | uint32_t interface_generation, |
1386 | uuid_t *nexus_agent) |
1387 | { |
1388 | if (interface_index == IFSCOPE_NONE || |
1389 | (client->interface_option_count != 0 && !client->allow_multiple_flows)) { |
1390 | // Interface not set, or client not allowed to use this mode |
1391 | return; |
1392 | } |
1393 | |
1394 | if (client->interface_option_count >= NECP_CLIENT_MAX_INTERFACE_OPTIONS) { |
1395 | // Cannot take any more interface options |
1396 | return; |
1397 | } |
1398 | |
1399 | // Check if already present |
1400 | for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) { |
1401 | if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) { |
1402 | struct necp_client_interface_option *option = &client->interface_options[option_i]; |
1403 | if (option->interface_index == interface_index) { |
1404 | if (nexus_agent == NULL) { |
1405 | return; |
1406 | } |
1407 | if (uuid_compare(option->nexus_agent, *nexus_agent) == 0) { |
1408 | return; |
1409 | } |
1410 | if (uuid_is_null(option->nexus_agent)) { |
1411 | uuid_copy(option->nexus_agent, *nexus_agent); |
1412 | return; |
1413 | } |
1414 | // If we get to this point, this is a new nexus flow |
1415 | } |
1416 | } else { |
1417 | struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT]; |
1418 | if (option->interface_index == interface_index) { |
1419 | if (nexus_agent == NULL) { |
1420 | return; |
1421 | } |
1422 | if (uuid_compare(option->nexus_agent, *nexus_agent) == 0) { |
1423 | return; |
1424 | } |
1425 | if (uuid_is_null(option->nexus_agent)) { |
1426 | uuid_copy(option->nexus_agent, *nexus_agent); |
1427 | return; |
1428 | } |
1429 | // If we get to this point, this is a new nexus flow |
1430 | } |
1431 | } |
1432 | } |
1433 | |
1434 | // Add a new entry |
1435 | if (client->interface_option_count < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) { |
1436 | // Add to static |
1437 | struct necp_client_interface_option *option = &client->interface_options[client->interface_option_count]; |
1438 | option->interface_index = interface_index; |
1439 | option->interface_generation = interface_generation; |
1440 | if (nexus_agent != NULL) { |
1441 | uuid_copy(option->nexus_agent, *nexus_agent); |
1442 | } |
1443 | client->interface_option_count++; |
1444 | } else { |
1445 | // Add to extra |
1446 | if (client->extra_interface_options == NULL) { |
1447 | client->extra_interface_options = _MALLOC(sizeof(struct necp_client_interface_option) * NECP_CLIENT_INTERFACE_OPTION_EXTRA_COUNT, M_NECP, M_WAITOK | M_ZERO); |
1448 | } |
1449 | if (client->extra_interface_options != NULL) { |
1450 | struct necp_client_interface_option *option = &client->extra_interface_options[client->interface_option_count - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT]; |
1451 | option->interface_index = interface_index; |
1452 | option->interface_generation = interface_generation; |
1453 | if (nexus_agent != NULL) { |
1454 | uuid_copy(option->nexus_agent, *nexus_agent); |
1455 | } |
1456 | client->interface_option_count++; |
1457 | } |
1458 | } |
1459 | } |
1460 | |
1461 | static bool |
1462 | necp_client_flow_is_viable(proc_t proc, struct necp_client *client, |
1463 | struct necp_client_flow *flow) |
1464 | { |
1465 | struct necp_aggregate_result result; |
1466 | bool ignore_address = (client->allow_multiple_flows && !flow->nexus && !flow->socket); |
1467 | |
1468 | flow->necp_flow_flags = 0; |
1469 | int error = necp_application_find_policy_match_internal(proc, client->parameters, |
1470 | (u_int32_t)client->parameters_length, |
1471 | &result, &flow->necp_flow_flags, |
1472 | flow->interface_index, |
1473 | &flow->local_addr, &flow->remote_addr, NULL, ignore_address); |
1474 | |
1475 | return (error == 0 && |
1476 | result.routed_interface_index != IFSCOPE_NONE && |
1477 | result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP); |
1478 | } |
1479 | |
1480 | static void |
1481 | necp_flow_add_interface_flows(proc_t proc, |
1482 | struct necp_client *client, |
1483 | struct necp_client_flow_registration *flow_registration, |
1484 | bool send_initial) |
1485 | { |
1486 | // Traverse all interfaces and add a tracking flow if needed |
1487 | for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) { |
1488 | if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) { |
1489 | struct necp_client_interface_option *option = &client->interface_options[option_i]; |
1490 | struct necp_client_flow *flow = necp_client_add_interface_flow_if_needed(client, flow_registration, option->interface_index); |
1491 | if (flow != NULL && send_initial) { |
1492 | flow->viable = necp_client_flow_is_viable(proc, client, flow); |
1493 | if (flow->viable && flow->u.cb) { |
1494 | bool viable = flow->viable; |
1495 | flow->u.cb(flow_registration->interface_handle, NECP_CLIENT_CBACTION_INITIAL, flow->interface_index, flow->necp_flow_flags, &viable); |
1496 | flow->viable = viable; |
1497 | } |
1498 | } |
1499 | } else { |
1500 | struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT]; |
1501 | struct necp_client_flow *flow = necp_client_add_interface_flow_if_needed(client, flow_registration, option->interface_index); |
1502 | if (flow != NULL && send_initial) { |
1503 | flow->viable = necp_client_flow_is_viable(proc, client, flow); |
1504 | if (flow->viable && flow->u.cb) { |
1505 | bool viable = flow->viable; |
1506 | flow->u.cb(flow_registration->interface_handle, NECP_CLIENT_CBACTION_INITIAL, flow->interface_index, flow->necp_flow_flags, &viable); |
1507 | flow->viable = viable; |
1508 | } |
1509 | } |
1510 | } |
1511 | } |
1512 | } |
1513 | |
1514 | static bool |
1515 | necp_client_update_flows(proc_t proc, |
1516 | struct necp_client *client, |
1517 | struct _necp_flow_defunct_list *defunct_list) |
1518 | { |
1519 | NECP_CLIENT_ASSERT_LOCKED(client); |
1520 | |
1521 | bool client_updated = FALSE; |
1522 | struct necp_client_flow *flow = NULL; |
1523 | struct necp_client_flow *temp_flow = NULL; |
1524 | struct necp_client_flow_registration *flow_registration = NULL; |
1525 | RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) { |
1526 | if (flow_registration->interface_cb != NULL) { |
1527 | // Add any interface flows that are not already tracked |
1528 | necp_flow_add_interface_flows(proc, client, flow_registration, false); |
1529 | } |
1530 | |
1531 | LIST_FOREACH_SAFE(flow, &flow_registration->flow_list, flow_chain, temp_flow) { |
1532 | // Check policy result for flow |
1533 | int old_flags = flow->necp_flow_flags; |
1534 | bool viable = necp_client_flow_is_viable(proc, client, flow); |
1535 | |
1536 | // TODO: Defunct nexus flows that are blocked by policy |
1537 | |
1538 | if (flow->viable != viable) { |
1539 | flow->viable = viable; |
1540 | client_updated = TRUE; |
1541 | } |
1542 | |
1543 | if ((old_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE) != |
1544 | (flow->necp_flow_flags & NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE)) { |
1545 | client_updated = TRUE; |
1546 | } |
1547 | |
1548 | if (flow->viable && client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) { |
1549 | bool flow_viable = flow->viable; |
1550 | flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_VIABLE, flow->interface_index, flow->necp_flow_flags, &viable); |
1551 | flow->viable = flow_viable; |
1552 | } |
1553 | |
1554 | if (!flow->viable || flow->invalid) { |
1555 | if (client_updated && (flow->socket || (!flow->socket && !flow->nexus)) && flow->u.cb) { |
1556 | bool flow_viable = flow->viable; |
1557 | flow->u.cb(flow->u.socket_handle, NECP_CLIENT_CBACTION_NONVIABLE, flow->interface_index, flow->necp_flow_flags, &viable); |
1558 | flow->viable = flow_viable; |
1559 | } |
1560 | // The callback might change the viable-flag of the |
1561 | // flow depending on its policy. Thus, we need to |
1562 | // check the flags again after the callback. |
1563 | } |
1564 | |
1565 | (void)defunct_list; |
1566 | |
1567 | // Handle flows that no longer match |
1568 | if (!flow->viable || flow->invalid) { |
1569 | // Drop them as long as they aren't assigned data |
1570 | if (!flow->nexus && !flow->assigned) { |
1571 | if (flow->assigned_results != NULL) { |
1572 | FREE(flow->assigned_results, M_NETAGENT); |
1573 | flow->assigned_results = NULL; |
1574 | client_updated = TRUE; |
1575 | } |
1576 | LIST_REMOVE(flow, flow_chain); |
1577 | if (flow->socket) { |
1578 | OSDecrementAtomic(&necp_socket_flow_count); |
1579 | } else { |
1580 | OSDecrementAtomic(&necp_if_flow_count); |
1581 | } |
1582 | mcache_free(necp_flow_cache, flow); |
1583 | } |
1584 | } |
1585 | } |
1586 | } |
1587 | |
1588 | return (client_updated); |
1589 | } |
1590 | |
1591 | static void |
1592 | necp_client_mark_all_nonsocket_flows_as_invalid(struct necp_client *client) |
1593 | { |
1594 | struct necp_client_flow_registration *flow_registration = NULL; |
1595 | struct necp_client_flow *flow = NULL; |
1596 | RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) { |
1597 | LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) { |
1598 | if (!flow->socket) { // Socket flows are not marked as invalid |
1599 | flow->invalid = TRUE; |
1600 | } |
1601 | } |
1602 | } |
1603 | |
1604 | // Reset option count every update |
1605 | client->interface_option_count = 0; |
1606 | } |
1607 | |
1608 | static bool |
1609 | necp_netagent_applies_to_client(struct necp_client *client, |
1610 | const struct necp_client_parsed_parameters *parameters, |
1611 | uuid_t *netagent_uuid, bool allow_nexus, |
1612 | uint32_t interface_index, uint32_t interface_generation) |
1613 | { |
1614 | #pragma unused(interface_index, interface_generation) |
1615 | bool applies = FALSE; |
1616 | u_int32_t flags = netagent_get_flags(*netagent_uuid); |
1617 | if (!(flags & NETAGENT_FLAG_REGISTERED)) { |
1618 | // Unregistered agents never apply |
1619 | return (applies); |
1620 | } |
1621 | |
1622 | if (!allow_nexus && |
1623 | (flags & NETAGENT_FLAG_NEXUS_PROVIDER)) { |
1624 | // Hide nexus providers unless allowed |
1625 | // Direct interfaces and direct policies are allowed to use a nexus |
1626 | // Delegate interfaces or re-scoped interfaces are not allowed |
1627 | return (applies); |
1628 | } |
1629 | |
1630 | if (uuid_compare(client->failed_trigger_agent.netagent_uuid, *netagent_uuid) == 0) { |
1631 | if (client->failed_trigger_agent.generation == netagent_get_generation(*netagent_uuid)) { |
1632 | // If this agent was triggered, and failed, and hasn't changed, keep hiding it |
1633 | return (applies); |
1634 | } else { |
1635 | // Mismatch generation, clear out old trigger |
1636 | uuid_clear(client->failed_trigger_agent.netagent_uuid); |
1637 | client->failed_trigger_agent.generation = 0; |
1638 | } |
1639 | } |
1640 | |
1641 | if (flags & NETAGENT_FLAG_SPECIFIC_USE_ONLY) { |
1642 | // Specific use agents only apply when required |
1643 | bool required = FALSE; |
1644 | if (parameters != NULL) { |
1645 | // Check required agent UUIDs |
1646 | for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) { |
1647 | if (uuid_is_null(parameters->required_netagents[i])) { |
1648 | break; |
1649 | } |
1650 | if (uuid_compare(parameters->required_netagents[i], *netagent_uuid) == 0) { |
1651 | required = TRUE; |
1652 | break; |
1653 | } |
1654 | } |
1655 | |
1656 | if (!required) { |
1657 | // Check required agent types |
1658 | bool fetched_type = FALSE; |
1659 | char netagent_domain[NETAGENT_DOMAINSIZE]; |
1660 | char netagent_type[NETAGENT_TYPESIZE]; |
1661 | memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE); |
1662 | memset(&netagent_type, 0, NETAGENT_TYPESIZE); |
1663 | |
1664 | for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) { |
1665 | if (strlen(parameters->required_netagent_types[i].netagent_domain) == 0 || |
1666 | strlen(parameters->required_netagent_types[i].netagent_type) == 0) { |
1667 | break; |
1668 | } |
1669 | |
1670 | if (!fetched_type) { |
1671 | if (netagent_get_agent_domain_and_type(*netagent_uuid, netagent_domain, netagent_type)) { |
1672 | fetched_type = TRUE; |
1673 | } else { |
1674 | break; |
1675 | } |
1676 | } |
1677 | |
1678 | if ((strlen(parameters->required_netagent_types[i].netagent_domain) == 0 || |
1679 | strncmp(netagent_domain, parameters->required_netagent_types[i].netagent_domain, NETAGENT_DOMAINSIZE) == 0) && |
1680 | (strlen(parameters->required_netagent_types[i].netagent_type) == 0 || |
1681 | strncmp(netagent_type, parameters->required_netagent_types[i].netagent_type, NETAGENT_TYPESIZE) == 0)) { |
1682 | required = TRUE; |
1683 | break; |
1684 | } |
1685 | } |
1686 | } |
1687 | } |
1688 | |
1689 | applies = required; |
1690 | } else { |
1691 | applies = TRUE; |
1692 | } |
1693 | |
1694 | |
1695 | return (applies); |
1696 | } |
1697 | |
1698 | static void |
1699 | necp_client_add_agent_interface_options(struct necp_client *client, |
1700 | const struct necp_client_parsed_parameters *parsed_parameters, |
1701 | ifnet_t ifp) |
1702 | { |
1703 | if (ifp != NULL && ifp->if_agentids != NULL) { |
1704 | for (u_int32_t i = 0; i < ifp->if_agentcount; i++) { |
1705 | if (uuid_is_null(ifp->if_agentids[i])) { |
1706 | continue; |
1707 | } |
1708 | // Relies on the side effect that nexus agents that apply will create flows |
1709 | (void)necp_netagent_applies_to_client(client, parsed_parameters, &ifp->if_agentids[i], TRUE, |
1710 | ifp->if_index, ifnet_get_generation(ifp)); |
1711 | } |
1712 | } |
1713 | } |
1714 | |
1715 | static inline bool |
1716 | necp_client_address_is_valid(struct sockaddr *address) |
1717 | { |
1718 | if (address->sa_family == AF_INET) { |
1719 | return (address->sa_len == sizeof(struct sockaddr_in)); |
1720 | } else if (address->sa_family == AF_INET6) { |
1721 | return (address->sa_len == sizeof(struct sockaddr_in6)); |
1722 | } else { |
1723 | return (FALSE); |
1724 | } |
1725 | } |
1726 | |
1727 | static int |
1728 | necp_client_parse_parameters(u_int8_t *parameters, |
1729 | u_int32_t parameters_size, |
1730 | struct necp_client_parsed_parameters *parsed_parameters) |
1731 | { |
1732 | int error = 0; |
1733 | size_t offset = 0; |
1734 | |
1735 | u_int32_t num_prohibited_interfaces = 0; |
1736 | u_int32_t num_prohibited_interface_types = 0; |
1737 | u_int32_t num_required_agents = 0; |
1738 | u_int32_t num_prohibited_agents = 0; |
1739 | u_int32_t num_preferred_agents = 0; |
1740 | u_int32_t num_avoided_agents = 0; |
1741 | u_int32_t num_required_agent_types = 0; |
1742 | u_int32_t num_prohibited_agent_types = 0; |
1743 | u_int32_t num_preferred_agent_types = 0; |
1744 | u_int32_t num_avoided_agent_types = 0; |
1745 | |
1746 | if (parsed_parameters == NULL) { |
1747 | return (EINVAL); |
1748 | } |
1749 | |
1750 | memset(parsed_parameters, 0, sizeof(struct necp_client_parsed_parameters)); |
1751 | |
1752 | while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) { |
1753 | u_int8_t type = necp_buffer_get_tlv_type(parameters, offset); |
1754 | u_int32_t length = necp_buffer_get_tlv_length(parameters, offset); |
1755 | |
1756 | if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) { |
1757 | // If the length is larger than what can fit in the remaining parameters size, bail |
1758 | NECPLOG(LOG_ERR, "Invalid TLV length (%u)" , length); |
1759 | break; |
1760 | } |
1761 | |
1762 | if (length > 0) { |
1763 | u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL); |
1764 | if (value != NULL) { |
1765 | switch (type) { |
1766 | case NECP_CLIENT_PARAMETER_BOUND_INTERFACE: { |
1767 | if (length <= IFXNAMSIZ && length > 0) { |
1768 | ifnet_t bound_interface = NULL; |
1769 | char interface_name[IFXNAMSIZ]; |
1770 | memcpy(interface_name, value, length); |
1771 | interface_name[length - 1] = 0; // Make sure the string is NULL terminated |
1772 | if (ifnet_find_by_name(interface_name, &bound_interface) == 0) { |
1773 | parsed_parameters->required_interface_index = bound_interface->if_index; |
1774 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF; |
1775 | ifnet_release(bound_interface); |
1776 | } |
1777 | } |
1778 | break; |
1779 | } |
1780 | case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: { |
1781 | if (length >= sizeof(struct necp_policy_condition_addr)) { |
1782 | struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value; |
1783 | if (necp_client_address_is_valid(&address_struct->address.sa)) { |
1784 | memcpy(&parsed_parameters->local_addr, &address_struct->address, sizeof(address_struct->address)); |
1785 | if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) { |
1786 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR; |
1787 | } |
1788 | if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) || |
1789 | (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) { |
1790 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT; |
1791 | } |
1792 | } |
1793 | } |
1794 | break; |
1795 | } |
1796 | case NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT: { |
1797 | if (length >= sizeof(struct necp_client_endpoint)) { |
1798 | struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value; |
1799 | if (necp_client_address_is_valid(&endpoint->u.sa)) { |
1800 | memcpy(&parsed_parameters->local_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union)); |
1801 | if (!necp_address_is_wildcard(&parsed_parameters->local_addr)) { |
1802 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR; |
1803 | } |
1804 | if ((parsed_parameters->local_addr.sa.sa_family == AF_INET && parsed_parameters->local_addr.sin.sin_port) || |
1805 | (parsed_parameters->local_addr.sa.sa_family == AF_INET6 && parsed_parameters->local_addr.sin6.sin6_port)) { |
1806 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_LOCAL_PORT; |
1807 | } |
1808 | } |
1809 | } |
1810 | break; |
1811 | } |
1812 | case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: { |
1813 | if (length >= sizeof(struct necp_policy_condition_addr)) { |
1814 | struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value; |
1815 | if (necp_client_address_is_valid(&address_struct->address.sa)) { |
1816 | memcpy(&parsed_parameters->remote_addr, &address_struct->address, sizeof(address_struct->address)); |
1817 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR; |
1818 | } |
1819 | } |
1820 | break; |
1821 | } |
1822 | case NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT: { |
1823 | if (length >= sizeof(struct necp_client_endpoint)) { |
1824 | struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value; |
1825 | if (necp_client_address_is_valid(&endpoint->u.sa)) { |
1826 | memcpy(&parsed_parameters->remote_addr, &endpoint->u.sa, sizeof(union necp_sockaddr_union)); |
1827 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REMOTE_ADDR; |
1828 | } |
1829 | } |
1830 | break; |
1831 | } |
1832 | case NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE: { |
1833 | if (num_prohibited_interfaces >= NECP_MAX_PARSED_PARAMETERS) { |
1834 | break; |
1835 | } |
1836 | if (length <= IFXNAMSIZ && length > 0) { |
1837 | memcpy(parsed_parameters->prohibited_interfaces[num_prohibited_interfaces], value, length); |
1838 | parsed_parameters->prohibited_interfaces[num_prohibited_interfaces][length - 1] = 0; // Make sure the string is NULL terminated |
1839 | num_prohibited_interfaces++; |
1840 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF; |
1841 | } |
1842 | break; |
1843 | } |
1844 | case NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE: { |
1845 | if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) { |
1846 | break; |
1847 | } |
1848 | if (length >= sizeof(u_int8_t)) { |
1849 | memcpy(&parsed_parameters->required_interface_type, value, sizeof(u_int8_t)); |
1850 | if (parsed_parameters->required_interface_type) { |
1851 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE; |
1852 | } |
1853 | } |
1854 | break; |
1855 | } |
1856 | case NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE: { |
1857 | if (num_prohibited_interface_types >= NECP_MAX_PARSED_PARAMETERS) { |
1858 | break; |
1859 | } |
1860 | if (length >= sizeof(u_int8_t)) { |
1861 | memcpy(&parsed_parameters->prohibited_interface_types[num_prohibited_interface_types], value, sizeof(u_int8_t)); |
1862 | num_prohibited_interface_types++; |
1863 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE; |
1864 | } |
1865 | break; |
1866 | } |
1867 | case NECP_CLIENT_PARAMETER_REQUIRE_AGENT: { |
1868 | if (num_required_agents >= NECP_MAX_PARSED_PARAMETERS) { |
1869 | break; |
1870 | } |
1871 | if (length >= sizeof(uuid_t)) { |
1872 | memcpy(&parsed_parameters->required_netagents[num_required_agents], value, sizeof(uuid_t)); |
1873 | num_required_agents++; |
1874 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT; |
1875 | } |
1876 | break; |
1877 | } |
1878 | case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT: { |
1879 | if (num_prohibited_agents >= NECP_MAX_PARSED_PARAMETERS) { |
1880 | break; |
1881 | } |
1882 | if (length >= sizeof(uuid_t)) { |
1883 | memcpy(&parsed_parameters->prohibited_netagents[num_prohibited_agents], value, sizeof(uuid_t)); |
1884 | num_prohibited_agents++; |
1885 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT; |
1886 | } |
1887 | break; |
1888 | } |
1889 | case NECP_CLIENT_PARAMETER_PREFER_AGENT: { |
1890 | if (num_preferred_agents >= NECP_MAX_PARSED_PARAMETERS) { |
1891 | break; |
1892 | } |
1893 | if (length >= sizeof(uuid_t)) { |
1894 | memcpy(&parsed_parameters->preferred_netagents[num_preferred_agents], value, sizeof(uuid_t)); |
1895 | num_preferred_agents++; |
1896 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT; |
1897 | } |
1898 | break; |
1899 | } |
1900 | case NECP_CLIENT_PARAMETER_AVOID_AGENT: { |
1901 | if (num_avoided_agents >= NECP_MAX_PARSED_PARAMETERS) { |
1902 | break; |
1903 | } |
1904 | if (length >= sizeof(uuid_t)) { |
1905 | memcpy(&parsed_parameters->avoided_netagents[num_avoided_agents], value, sizeof(uuid_t)); |
1906 | num_avoided_agents++; |
1907 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT; |
1908 | } |
1909 | break; |
1910 | } |
1911 | case NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE: { |
1912 | if (num_required_agent_types >= NECP_MAX_PARSED_PARAMETERS) { |
1913 | break; |
1914 | } |
1915 | if (length >= sizeof(struct necp_client_parameter_netagent_type)) { |
1916 | memcpy(&parsed_parameters->required_netagent_types[num_required_agent_types], value, sizeof(struct necp_client_parameter_netagent_type)); |
1917 | num_required_agent_types++; |
1918 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE; |
1919 | } |
1920 | break; |
1921 | } |
1922 | case NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE: { |
1923 | if (num_prohibited_agent_types >= NECP_MAX_PARSED_PARAMETERS) { |
1924 | break; |
1925 | } |
1926 | if (length >= sizeof(struct necp_client_parameter_netagent_type)) { |
1927 | memcpy(&parsed_parameters->prohibited_netagent_types[num_prohibited_agent_types], value, sizeof(struct necp_client_parameter_netagent_type)); |
1928 | num_prohibited_agent_types++; |
1929 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE; |
1930 | } |
1931 | break; |
1932 | } |
1933 | case NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE: { |
1934 | if (num_preferred_agent_types >= NECP_MAX_PARSED_PARAMETERS) { |
1935 | break; |
1936 | } |
1937 | if (length >= sizeof(struct necp_client_parameter_netagent_type)) { |
1938 | memcpy(&parsed_parameters->preferred_netagent_types[num_preferred_agent_types], value, sizeof(struct necp_client_parameter_netagent_type)); |
1939 | num_preferred_agent_types++; |
1940 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE; |
1941 | } |
1942 | break; |
1943 | } |
1944 | case NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE: { |
1945 | if (num_avoided_agent_types >= NECP_MAX_PARSED_PARAMETERS) { |
1946 | break; |
1947 | } |
1948 | if (length >= sizeof(struct necp_client_parameter_netagent_type)) { |
1949 | memcpy(&parsed_parameters->avoided_netagent_types[num_avoided_agent_types], value, sizeof(struct necp_client_parameter_netagent_type)); |
1950 | num_avoided_agent_types++; |
1951 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE; |
1952 | } |
1953 | break; |
1954 | } |
1955 | case NECP_CLIENT_PARAMETER_FLAGS: { |
1956 | if (length >= sizeof(u_int32_t)) { |
1957 | memcpy(&parsed_parameters->flags, value, sizeof(parsed_parameters->flags)); |
1958 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_FLAGS; |
1959 | } |
1960 | break; |
1961 | } |
1962 | case NECP_CLIENT_PARAMETER_IP_PROTOCOL: { |
1963 | if (length >= sizeof(parsed_parameters->ip_protocol)) { |
1964 | memcpy(&parsed_parameters->ip_protocol, value, sizeof(parsed_parameters->ip_protocol)); |
1965 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_IP_PROTOCOL; |
1966 | } |
1967 | break; |
1968 | } |
1969 | case NECP_CLIENT_PARAMETER_PID: { |
1970 | if (length >= sizeof(parsed_parameters->effective_pid)) { |
1971 | memcpy(&parsed_parameters->effective_pid, value, sizeof(parsed_parameters->effective_pid)); |
1972 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID; |
1973 | } |
1974 | break; |
1975 | } |
1976 | case NECP_CLIENT_PARAMETER_APPLICATION: { |
1977 | if (length >= sizeof(parsed_parameters->effective_uuid)) { |
1978 | memcpy(&parsed_parameters->effective_uuid, value, sizeof(parsed_parameters->effective_uuid)); |
1979 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_UUID; |
1980 | } |
1981 | break; |
1982 | } |
1983 | case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: { |
1984 | if (length >= sizeof(parsed_parameters->traffic_class)) { |
1985 | memcpy(&parsed_parameters->traffic_class, value, sizeof(parsed_parameters->traffic_class)); |
1986 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_TRAFFIC_CLASS; |
1987 | } |
1988 | break; |
1989 | } |
1990 | default: { |
1991 | break; |
1992 | } |
1993 | } |
1994 | } |
1995 | } |
1996 | |
1997 | offset += sizeof(struct necp_tlv_header) + length; |
1998 | } |
1999 | |
2000 | return (error); |
2001 | } |
2002 | |
2003 | static int |
2004 | necp_client_parse_result(u_int8_t *result, |
2005 | u_int32_t result_size, |
2006 | union necp_sockaddr_union *local_address, |
2007 | union necp_sockaddr_union *remote_address, |
2008 | void **flow_stats) |
2009 | { |
2010 | #pragma unused(flow_stats) |
2011 | int error = 0; |
2012 | size_t offset = 0; |
2013 | |
2014 | while ((offset + sizeof(struct necp_tlv_header)) <= result_size) { |
2015 | u_int8_t type = necp_buffer_get_tlv_type(result, offset); |
2016 | u_int32_t length = necp_buffer_get_tlv_length(result, offset); |
2017 | |
2018 | if (length > 0 && (offset + sizeof(struct necp_tlv_header) + length) <= result_size) { |
2019 | u_int8_t *value = necp_buffer_get_tlv_value(result, offset, NULL); |
2020 | if (value != NULL) { |
2021 | switch (type) { |
2022 | case NECP_CLIENT_RESULT_LOCAL_ENDPOINT: { |
2023 | if (length >= sizeof(struct necp_client_endpoint)) { |
2024 | struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value; |
2025 | if (local_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) { |
2026 | memcpy(local_address, &endpoint->u.sa, endpoint->u.sa.sa_len); |
2027 | } |
2028 | } |
2029 | break; |
2030 | } |
2031 | case NECP_CLIENT_RESULT_REMOTE_ENDPOINT: { |
2032 | if (length >= sizeof(struct necp_client_endpoint)) { |
2033 | struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value; |
2034 | if (remote_address != NULL && necp_client_address_is_valid(&endpoint->u.sa)) { |
2035 | memcpy(remote_address, &endpoint->u.sa, endpoint->u.sa.sa_len); |
2036 | } |
2037 | } |
2038 | break; |
2039 | } |
2040 | default: { |
2041 | break; |
2042 | } |
2043 | } |
2044 | } |
2045 | } |
2046 | |
2047 | offset += sizeof(struct necp_tlv_header) + length; |
2048 | } |
2049 | |
2050 | return (error); |
2051 | } |
2052 | |
2053 | static struct necp_client_flow_registration * |
2054 | necp_client_create_flow_registration(struct necp_fd_data *fd_data, struct necp_client *client) |
2055 | { |
2056 | NECP_FD_ASSERT_LOCKED(fd_data); |
2057 | NECP_CLIENT_ASSERT_LOCKED(client); |
2058 | |
2059 | struct necp_client_flow_registration *new_registration = mcache_alloc(necp_flow_registration_cache, MCR_SLEEP); |
2060 | if (new_registration == NULL) { |
2061 | return NULL; |
2062 | } |
2063 | |
2064 | memset(new_registration, 0, sizeof(*new_registration)); |
2065 | |
2066 | new_registration->last_interface_details = combine_interface_details(IFSCOPE_NONE, NSTAT_IFNET_IS_UNKNOWN_TYPE); |
2067 | |
2068 | necp_generate_client_id(new_registration->registration_id, true); |
2069 | LIST_INIT(&new_registration->flow_list); |
2070 | |
2071 | // Add registration to client list |
2072 | RB_INSERT(_necp_client_flow_tree, &client->flow_registrations, new_registration); |
2073 | |
2074 | // Add registration to fd list |
2075 | RB_INSERT(_necp_fd_flow_tree, &fd_data->flows, new_registration); |
2076 | |
2077 | // Add registration to global tree for lookup |
2078 | NECP_FLOW_TREE_LOCK_EXCLUSIVE(); |
2079 | RB_INSERT(_necp_client_flow_global_tree, &necp_client_flow_global_tree, new_registration); |
2080 | NECP_FLOW_TREE_UNLOCK(); |
2081 | |
2082 | new_registration->client = client; |
2083 | |
2084 | // Start out assuming there is nothing to read from the flow |
2085 | new_registration->flow_result_read = true; |
2086 | |
2087 | return new_registration; |
2088 | } |
2089 | |
2090 | static void |
2091 | necp_client_add_socket_flow(struct necp_client_flow_registration *flow_registration, |
2092 | struct inpcb *inp) |
2093 | { |
2094 | struct necp_client_flow *new_flow = mcache_alloc(necp_flow_cache, MCR_SLEEP); |
2095 | if (new_flow == NULL) { |
2096 | NECPLOG0(LOG_ERR, "Failed to allocate socket flow" ); |
2097 | return; |
2098 | } |
2099 | |
2100 | memset(new_flow, 0, sizeof(*new_flow)); |
2101 | |
2102 | new_flow->socket = TRUE; |
2103 | new_flow->u.socket_handle = inp; |
2104 | new_flow->u.cb = inp->necp_cb; |
2105 | |
2106 | OSIncrementAtomic(&necp_socket_flow_count); |
2107 | |
2108 | LIST_INSERT_HEAD(&flow_registration->flow_list, new_flow, flow_chain); |
2109 | } |
2110 | |
2111 | int |
2112 | necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp) |
2113 | { |
2114 | int error = 0; |
2115 | struct necp_fd_data *client_fd = NULL; |
2116 | bool found_client = FALSE; |
2117 | |
2118 | NECP_FD_LIST_LOCK_SHARED(); |
2119 | LIST_FOREACH(client_fd, &necp_fd_list, chain) { |
2120 | NECP_FD_LOCK(client_fd); |
2121 | struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id); |
2122 | if (client != NULL) { |
2123 | if (!pid || client->proc_pid == pid) { |
2124 | struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id); |
2125 | if (flow_registration != NULL) { |
2126 | // Found the right client and flow registration, add a new flow |
2127 | found_client = TRUE; |
2128 | necp_client_add_socket_flow(flow_registration, inp); |
2129 | } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) { |
2130 | // No flows yet on this client, add a new registration |
2131 | flow_registration = necp_client_create_flow_registration(client_fd, client); |
2132 | if (flow_registration == NULL) { |
2133 | error = ENOMEM; |
2134 | } else { |
2135 | // Add a new flow |
2136 | found_client = TRUE; |
2137 | necp_client_add_socket_flow(flow_registration, inp); |
2138 | } |
2139 | } |
2140 | } |
2141 | |
2142 | NECP_CLIENT_UNLOCK(client); |
2143 | } |
2144 | NECP_FD_UNLOCK(client_fd); |
2145 | |
2146 | if (found_client) { |
2147 | break; |
2148 | } |
2149 | } |
2150 | NECP_FD_LIST_UNLOCK(); |
2151 | |
2152 | if (!found_client) { |
2153 | error = ENOENT; |
2154 | } else { |
2155 | // Count the sockets that have the NECP client UUID set |
2156 | struct socket *so = inp->inp_socket; |
2157 | if (!(so->so_flags1 & SOF1_HAS_NECP_CLIENT_UUID)) { |
2158 | so->so_flags1 |= SOF1_HAS_NECP_CLIENT_UUID; |
2159 | INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_necp_clientuuid_total); |
2160 | } |
2161 | } |
2162 | |
2163 | return (error); |
2164 | } |
2165 | |
2166 | static void |
2167 | necp_client_add_multipath_interface_flows(struct necp_client_flow_registration *flow_registration, |
2168 | struct necp_client *client, |
2169 | struct mppcb *mpp) |
2170 | { |
2171 | flow_registration->interface_handle = mpp; |
2172 | flow_registration->interface_cb = mpp->necp_cb; |
2173 | |
2174 | proc_t proc = proc_find(client->proc_pid); |
2175 | if (proc == PROC_NULL) { |
2176 | return; |
2177 | } |
2178 | |
2179 | // Traverse all interfaces and add a tracking flow if needed |
2180 | necp_flow_add_interface_flows(proc, client, flow_registration, true); |
2181 | |
2182 | proc_rele(proc); |
2183 | proc = PROC_NULL; |
2184 | } |
2185 | |
2186 | int |
2187 | necp_client_register_multipath_cb(pid_t pid, uuid_t client_id, struct mppcb *mpp) |
2188 | { |
2189 | int error = 0; |
2190 | struct necp_fd_data *client_fd = NULL; |
2191 | bool found_client = FALSE; |
2192 | |
2193 | NECP_FD_LIST_LOCK_SHARED(); |
2194 | LIST_FOREACH(client_fd, &necp_fd_list, chain) { |
2195 | NECP_FD_LOCK(client_fd); |
2196 | struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id); |
2197 | if (client != NULL) { |
2198 | if (!pid || client->proc_pid == pid) { |
2199 | struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id); |
2200 | if (flow_registration != NULL) { |
2201 | // Found the right client and flow registration, add a new flow |
2202 | found_client = TRUE; |
2203 | necp_client_add_multipath_interface_flows(flow_registration, client, mpp); |
2204 | } else if (RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) { |
2205 | // No flows yet on this client, add a new registration |
2206 | flow_registration = necp_client_create_flow_registration(client_fd, client); |
2207 | if (flow_registration == NULL) { |
2208 | error = ENOMEM; |
2209 | } else { |
2210 | // Add a new flow |
2211 | found_client = TRUE; |
2212 | necp_client_add_multipath_interface_flows(flow_registration, client, mpp); |
2213 | } |
2214 | } |
2215 | } |
2216 | |
2217 | NECP_CLIENT_UNLOCK(client); |
2218 | } |
2219 | NECP_FD_UNLOCK(client_fd); |
2220 | |
2221 | if (found_client) { |
2222 | break; |
2223 | } |
2224 | } |
2225 | NECP_FD_LIST_UNLOCK(); |
2226 | |
2227 | if (!found_client && error == 0) { |
2228 | error = ENOENT; |
2229 | } |
2230 | |
2231 | return (error); |
2232 | } |
2233 | |
2234 | #define NETAGENT_DOMAIN_RADIO_MANAGER "WirelessRadioManager" |
2235 | #define NETAGENT_TYPE_RADIO_MANAGER "WirelessRadioManager:BB Manager" |
2236 | |
2237 | static int |
2238 | necp_client_lookup_bb_radio_manager(struct necp_client *client, |
2239 | uuid_t netagent_uuid) |
2240 | { |
2241 | char netagent_domain[NETAGENT_DOMAINSIZE]; |
2242 | char netagent_type[NETAGENT_TYPESIZE]; |
2243 | struct necp_aggregate_result result; |
2244 | proc_t proc; |
2245 | int error; |
2246 | |
2247 | proc = proc_find(client->proc_pid); |
2248 | if (proc == PROC_NULL) { |
2249 | return ESRCH; |
2250 | } |
2251 | |
2252 | error = necp_application_find_policy_match_internal(proc, client->parameters, (u_int32_t)client->parameters_length, |
2253 | &result, NULL, 0, NULL, NULL, NULL, true); |
2254 | |
2255 | proc_rele(proc); |
2256 | proc = PROC_NULL; |
2257 | |
2258 | if (error) { |
2259 | return error; |
2260 | } |
2261 | |
2262 | for (int i = 0; i < NECP_MAX_NETAGENTS; i++) { |
2263 | if (uuid_is_null(result.netagents[i])) { |
2264 | // Passed end of valid agents |
2265 | break; |
2266 | } |
2267 | |
2268 | memset(&netagent_domain, 0, NETAGENT_DOMAINSIZE); |
2269 | memset(&netagent_type, 0, NETAGENT_TYPESIZE); |
2270 | if (netagent_get_agent_domain_and_type(result.netagents[i], netagent_domain, netagent_type) == FALSE) { |
2271 | continue; |
2272 | } |
2273 | |
2274 | if (strncmp(netagent_domain, NETAGENT_DOMAIN_RADIO_MANAGER, NETAGENT_DOMAINSIZE) != 0) { |
2275 | continue; |
2276 | } |
2277 | |
2278 | if (strncmp(netagent_type, NETAGENT_TYPE_RADIO_MANAGER, NETAGENT_TYPESIZE) != 0) { |
2279 | continue; |
2280 | } |
2281 | |
2282 | uuid_copy(netagent_uuid, result.netagents[i]); |
2283 | |
2284 | break; |
2285 | } |
2286 | |
2287 | return 0; |
2288 | } |
2289 | |
2290 | static int |
2291 | necp_client_assert_bb_radio_manager_common(struct necp_client *client, bool assert) |
2292 | { |
2293 | uuid_t netagent_uuid; |
2294 | uint8_t assert_type; |
2295 | int error; |
2296 | |
2297 | error = necp_client_lookup_bb_radio_manager(client, netagent_uuid); |
2298 | if (error) { |
2299 | NECPLOG0(LOG_ERR, "BB radio manager agent not found" ); |
2300 | return error; |
2301 | } |
2302 | |
2303 | // Before unasserting, verify that the assertion was already taken |
2304 | if (assert == FALSE) { |
2305 | assert_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT; |
2306 | |
2307 | if (!necp_client_remove_assertion(client, netagent_uuid)) { |
2308 | return EINVAL; |
2309 | } |
2310 | } else { |
2311 | assert_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT; |
2312 | } |
2313 | |
2314 | error = netagent_client_message(netagent_uuid, client->client_id, client->proc_pid, client->agent_handle, assert_type); |
2315 | if (error) { |
2316 | NECPLOG0(LOG_ERR, "netagent_client_message failed" ); |
2317 | return error; |
2318 | } |
2319 | |
2320 | // Only save the assertion if the action succeeded |
2321 | if (assert == TRUE) { |
2322 | necp_client_add_assertion(client, netagent_uuid); |
2323 | } |
2324 | |
2325 | return 0; |
2326 | } |
2327 | |
2328 | int |
2329 | necp_client_assert_bb_radio_manager(uuid_t client_id, bool assert) |
2330 | { |
2331 | struct necp_client *client; |
2332 | int error = 0; |
2333 | |
2334 | NECP_CLIENT_TREE_LOCK_SHARED(); |
2335 | |
2336 | client = necp_find_client_and_lock(client_id); |
2337 | |
2338 | if (client) { |
2339 | // Found the right client! |
2340 | error = necp_client_assert_bb_radio_manager_common(client, assert); |
2341 | |
2342 | NECP_CLIENT_UNLOCK(client); |
2343 | } else { |
2344 | NECPLOG0(LOG_ERR, "Couldn't find client" ); |
2345 | error = ENOENT; |
2346 | } |
2347 | |
2348 | NECP_CLIENT_TREE_UNLOCK(); |
2349 | |
2350 | return (error); |
2351 | } |
2352 | |
2353 | static int |
2354 | necp_client_unregister_socket_flow(uuid_t client_id, void *handle) |
2355 | { |
2356 | int error = 0; |
2357 | struct necp_fd_data *client_fd = NULL; |
2358 | bool found_client = FALSE; |
2359 | bool client_updated = FALSE; |
2360 | |
2361 | NECP_FD_LIST_LOCK_SHARED(); |
2362 | LIST_FOREACH(client_fd, &necp_fd_list, chain) { |
2363 | NECP_FD_LOCK(client_fd); |
2364 | |
2365 | struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id); |
2366 | if (client != NULL) { |
2367 | struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id); |
2368 | if (flow_registration != NULL) { |
2369 | // Found the right client and flow! |
2370 | found_client = TRUE; |
2371 | |
2372 | // Remove flow assignment |
2373 | struct necp_client_flow *search_flow = NULL; |
2374 | struct necp_client_flow *temp_flow = NULL; |
2375 | LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) { |
2376 | if (search_flow->socket && search_flow->u.socket_handle == handle) { |
2377 | if (search_flow->assigned_results != NULL) { |
2378 | FREE(search_flow->assigned_results, M_NETAGENT); |
2379 | search_flow->assigned_results = NULL; |
2380 | } |
2381 | client_updated = TRUE; |
2382 | flow_registration->flow_result_read = FALSE; |
2383 | LIST_REMOVE(search_flow, flow_chain); |
2384 | OSDecrementAtomic(&necp_socket_flow_count); |
2385 | mcache_free(necp_flow_cache, search_flow); |
2386 | } |
2387 | } |
2388 | } |
2389 | |
2390 | NECP_CLIENT_UNLOCK(client); |
2391 | } |
2392 | |
2393 | if (client_updated) { |
2394 | necp_fd_notify(client_fd, true); |
2395 | } |
2396 | NECP_FD_UNLOCK(client_fd); |
2397 | |
2398 | if (found_client) { |
2399 | break; |
2400 | } |
2401 | } |
2402 | NECP_FD_LIST_UNLOCK(); |
2403 | |
2404 | if (!found_client) { |
2405 | error = ENOENT; |
2406 | } |
2407 | |
2408 | return (error); |
2409 | } |
2410 | |
2411 | static int |
2412 | necp_client_unregister_multipath_cb(uuid_t client_id, void *handle) |
2413 | { |
2414 | int error = 0; |
2415 | bool found_client = FALSE; |
2416 | |
2417 | NECP_CLIENT_TREE_LOCK_SHARED(); |
2418 | |
2419 | struct necp_client *client = necp_find_client_and_lock(client_id); |
2420 | if (client != NULL) { |
2421 | struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id); |
2422 | if (flow_registration != NULL) { |
2423 | // Found the right client and flow! |
2424 | found_client = TRUE; |
2425 | |
2426 | // Remove flow assignment |
2427 | struct necp_client_flow *search_flow = NULL; |
2428 | struct necp_client_flow *temp_flow = NULL; |
2429 | LIST_FOREACH_SAFE(search_flow, &flow_registration->flow_list, flow_chain, temp_flow) { |
2430 | if (!search_flow->socket && !search_flow->nexus && |
2431 | search_flow->u.socket_handle == handle) { |
2432 | search_flow->u.socket_handle = NULL; |
2433 | search_flow->u.cb = NULL; |
2434 | } |
2435 | } |
2436 | |
2437 | flow_registration->interface_handle = NULL; |
2438 | flow_registration->interface_cb = NULL; |
2439 | } |
2440 | |
2441 | NECP_CLIENT_UNLOCK(client); |
2442 | } |
2443 | |
2444 | NECP_CLIENT_TREE_UNLOCK(); |
2445 | |
2446 | if (!found_client) { |
2447 | error = ENOENT; |
2448 | } |
2449 | |
2450 | return (error); |
2451 | } |
2452 | |
2453 | int |
2454 | necp_client_assign_from_socket(pid_t pid, uuid_t client_id, struct inpcb *inp) |
2455 | { |
2456 | int error = 0; |
2457 | struct necp_fd_data *client_fd = NULL; |
2458 | bool found_client = FALSE; |
2459 | bool client_updated = FALSE; |
2460 | |
2461 | NECP_FD_LIST_LOCK_SHARED(); |
2462 | LIST_FOREACH(client_fd, &necp_fd_list, chain) { |
2463 | if (pid && client_fd->proc_pid != pid) { |
2464 | continue; |
2465 | } |
2466 | |
2467 | proc_t proc = proc_find(client_fd->proc_pid); |
2468 | if (proc == PROC_NULL) { |
2469 | continue; |
2470 | } |
2471 | |
2472 | NECP_FD_LOCK(client_fd); |
2473 | |
2474 | struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id); |
2475 | if (client != NULL) { |
2476 | struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id); |
2477 | if (flow_registration == NULL && RB_EMPTY(&client->flow_registrations) && !necp_client_id_is_flow(client_id)) { |
2478 | // No flows yet on this client, add a new registration |
2479 | flow_registration = necp_client_create_flow_registration(client_fd, client); |
2480 | if (flow_registration == NULL) { |
2481 | error = ENOMEM; |
2482 | } |
2483 | } |
2484 | if (flow_registration != NULL) { |
2485 | // Found the right client and flow! |
2486 | found_client = TRUE; |
2487 | |
2488 | struct necp_client_flow *flow = NULL; |
2489 | LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) { |
2490 | if (flow->socket && flow->u.socket_handle == inp) { |
2491 | // Release prior results and route |
2492 | if (flow->assigned_results != NULL) { |
2493 | FREE(flow->assigned_results, M_NETAGENT); |
2494 | flow->assigned_results = NULL; |
2495 | } |
2496 | |
2497 | ifnet_t ifp = NULL; |
2498 | if ((inp->inp_flags & INP_BOUND_IF) && inp->inp_boundifp) { |
2499 | ifp = inp->inp_boundifp; |
2500 | } else { |
2501 | ifp = inp->inp_last_outifp; |
2502 | } |
2503 | |
2504 | if (ifp != NULL) { |
2505 | flow->interface_index = ifp->if_index; |
2506 | } else { |
2507 | flow->interface_index = IFSCOPE_NONE; |
2508 | } |
2509 | |
2510 | if (inp->inp_vflag & INP_IPV4) { |
2511 | flow->local_addr.sin.sin_family = AF_INET; |
2512 | flow->local_addr.sin.sin_len = sizeof(struct sockaddr_in); |
2513 | flow->local_addr.sin.sin_port = inp->inp_lport; |
2514 | memcpy(&flow->local_addr.sin.sin_addr, &inp->inp_laddr, sizeof(struct in_addr)); |
2515 | |
2516 | flow->remote_addr.sin.sin_family = AF_INET; |
2517 | flow->remote_addr.sin.sin_len = sizeof(struct sockaddr_in); |
2518 | flow->remote_addr.sin.sin_port = inp->inp_fport; |
2519 | memcpy(&flow->remote_addr.sin.sin_addr, &inp->inp_faddr, sizeof(struct in_addr)); |
2520 | } else if (inp->inp_vflag & INP_IPV6) { |
2521 | in6_ip6_to_sockaddr(&inp->in6p_laddr, inp->inp_lport, &flow->local_addr.sin6, sizeof(flow->local_addr)); |
2522 | in6_ip6_to_sockaddr(&inp->in6p_faddr, inp->inp_fport, &flow->remote_addr.sin6, sizeof(flow->remote_addr)); |
2523 | } |
2524 | |
2525 | flow->viable = necp_client_flow_is_viable(proc, client, flow); |
2526 | |
2527 | uuid_t empty_uuid; |
2528 | uuid_clear(empty_uuid); |
2529 | flow->assigned = TRUE; |
2530 | flow->assigned_results = necp_create_nexus_assign_message(empty_uuid, 0, NULL, 0, |
2531 | (struct necp_client_endpoint *)&flow->local_addr, |
2532 | (struct necp_client_endpoint *)&flow->remote_addr, |
2533 | 0, NULL, &flow->assigned_results_length); |
2534 | flow_registration->flow_result_read = FALSE; |
2535 | client_updated = TRUE; |
2536 | break; |
2537 | } |
2538 | } |
2539 | } |
2540 | |
2541 | NECP_CLIENT_UNLOCK(client); |
2542 | } |
2543 | if (client_updated) { |
2544 | necp_fd_notify(client_fd, true); |
2545 | } |
2546 | NECP_FD_UNLOCK(client_fd); |
2547 | |
2548 | proc_rele(proc); |
2549 | proc = PROC_NULL; |
2550 | |
2551 | if (found_client) { |
2552 | break; |
2553 | } |
2554 | } |
2555 | NECP_FD_LIST_UNLOCK(); |
2556 | |
2557 | if (error == 0) { |
2558 | if (!found_client) { |
2559 | error = ENOENT; |
2560 | } else if (!client_updated) { |
2561 | error = EINVAL; |
2562 | } |
2563 | } |
2564 | |
2565 | return (error); |
2566 | } |
2567 | |
2568 | int |
2569 | necp_update_flow_protoctl_event(uuid_t netagent_uuid, uuid_t client_id, |
2570 | uint32_t protoctl_event_code, uint32_t protoctl_event_val, |
2571 | uint32_t protoctl_event_tcp_seq_number) |
2572 | { |
2573 | int error = 0; |
2574 | struct necp_fd_data *client_fd = NULL; |
2575 | bool found_client = FALSE; |
2576 | bool client_updated = FALSE; |
2577 | |
2578 | NECP_FD_LIST_LOCK_SHARED(); |
2579 | LIST_FOREACH(client_fd, &necp_fd_list, chain) { |
2580 | proc_t proc = proc_find(client_fd->proc_pid); |
2581 | if (proc == PROC_NULL) { |
2582 | continue; |
2583 | } |
2584 | |
2585 | NECP_FD_LOCK(client_fd); |
2586 | |
2587 | struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id); |
2588 | if (client != NULL) { |
2589 | struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id); |
2590 | if (flow_registration != NULL) { |
2591 | // Found the right client and flow! |
2592 | found_client = TRUE; |
2593 | |
2594 | struct necp_client_flow *flow = NULL; |
2595 | LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) { |
2596 | // Verify that the client nexus agent matches |
2597 | if (flow->nexus && |
2598 | uuid_compare(flow->u.nexus_agent, |
2599 | netagent_uuid) == 0) { |
2600 | flow->has_protoctl_event = TRUE; |
2601 | flow->protoctl_event.protoctl_event_code = protoctl_event_code; |
2602 | flow->protoctl_event.protoctl_event_val = protoctl_event_val; |
2603 | flow->protoctl_event.protoctl_event_tcp_seq_num = protoctl_event_tcp_seq_number; |
2604 | flow_registration->flow_result_read = FALSE; |
2605 | client_updated = TRUE; |
2606 | break; |
2607 | } |
2608 | } |
2609 | } |
2610 | |
2611 | NECP_CLIENT_UNLOCK(client); |
2612 | } |
2613 | |
2614 | if (client_updated) { |
2615 | necp_fd_notify(client_fd, true); |
2616 | } |
2617 | |
2618 | NECP_FD_UNLOCK(client_fd); |
2619 | proc_rele(proc); |
2620 | proc = PROC_NULL; |
2621 | |
2622 | if (found_client) { |
2623 | break; |
2624 | } |
2625 | } |
2626 | NECP_FD_LIST_UNLOCK(); |
2627 | |
2628 | if (!found_client) { |
2629 | error = ENOENT; |
2630 | } else if (!client_updated) { |
2631 | error = EINVAL; |
2632 | } |
2633 | return (error); |
2634 | } |
2635 | |
2636 | static bool |
2637 | necp_assign_client_result_locked(struct proc *proc, |
2638 | struct necp_fd_data *client_fd, |
2639 | struct necp_client *client, |
2640 | struct necp_client_flow_registration *flow_registration, |
2641 | uuid_t netagent_uuid, |
2642 | u_int8_t *assigned_results, |
2643 | size_t assigned_results_length, |
2644 | bool notify_fd) |
2645 | { |
2646 | bool client_updated = FALSE; |
2647 | |
2648 | NECP_FD_ASSERT_LOCKED(client_fd); |
2649 | NECP_CLIENT_ASSERT_LOCKED(client); |
2650 | |
2651 | struct necp_client_flow *flow = NULL; |
2652 | LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) { |
2653 | // Verify that the client nexus agent matches |
2654 | if (flow->nexus && |
2655 | uuid_compare(flow->u.nexus_agent, netagent_uuid) == 0) { |
2656 | // Release prior results and route |
2657 | if (flow->assigned_results != NULL) { |
2658 | FREE(flow->assigned_results, M_NETAGENT); |
2659 | flow->assigned_results = NULL; |
2660 | } |
2661 | |
2662 | void *nexus_stats = NULL; |
2663 | if (assigned_results != NULL && assigned_results_length > 0) { |
2664 | int error = necp_client_parse_result(assigned_results, (u_int32_t)assigned_results_length, |
2665 | &flow->local_addr, &flow->remote_addr, &nexus_stats); |
2666 | VERIFY(error == 0); |
2667 | } |
2668 | |
2669 | flow->viable = necp_client_flow_is_viable(proc, client, flow); |
2670 | |
2671 | flow->assigned = TRUE; |
2672 | flow->assigned_results = assigned_results; |
2673 | flow->assigned_results_length = assigned_results_length; |
2674 | flow_registration->flow_result_read = FALSE; |
2675 | client_updated = TRUE; |
2676 | break; |
2677 | } |
2678 | } |
2679 | |
2680 | if (client_updated && notify_fd) { |
2681 | necp_fd_notify(client_fd, true); |
2682 | } |
2683 | |
2684 | // if not updated, client must free assigned_results |
2685 | return (client_updated); |
2686 | } |
2687 | |
2688 | int |
2689 | necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id, |
2690 | u_int8_t *assigned_results, size_t assigned_results_length) |
2691 | { |
2692 | int error = 0; |
2693 | struct necp_fd_data *client_fd = NULL; |
2694 | bool found_client = FALSE; |
2695 | bool client_updated = FALSE; |
2696 | |
2697 | NECP_FD_LIST_LOCK_SHARED(); |
2698 | |
2699 | LIST_FOREACH(client_fd, &necp_fd_list, chain) { |
2700 | proc_t proc = proc_find(client_fd->proc_pid); |
2701 | if (proc == PROC_NULL) { |
2702 | continue; |
2703 | } |
2704 | |
2705 | NECP_FD_LOCK(client_fd); |
2706 | struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id); |
2707 | if (client != NULL) { |
2708 | struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id); |
2709 | if (flow_registration != NULL) { |
2710 | // Found the right client and flow! |
2711 | found_client = TRUE; |
2712 | if (necp_assign_client_result_locked(proc, client_fd, client, flow_registration, netagent_uuid, |
2713 | assigned_results, assigned_results_length, true)) { |
2714 | client_updated = TRUE; |
2715 | } |
2716 | } |
2717 | |
2718 | NECP_CLIENT_UNLOCK(client); |
2719 | } |
2720 | NECP_FD_UNLOCK(client_fd); |
2721 | |
2722 | proc_rele(proc); |
2723 | proc = PROC_NULL; |
2724 | |
2725 | if (found_client) { |
2726 | break; |
2727 | } |
2728 | } |
2729 | |
2730 | NECP_FD_LIST_UNLOCK(); |
2731 | |
2732 | // upon error, client must free assigned_results |
2733 | if (!found_client) { |
2734 | error = ENOENT; |
2735 | } else if (!client_updated) { |
2736 | error = EINVAL; |
2737 | } |
2738 | |
2739 | return (error); |
2740 | } |
2741 | |
2742 | /// Client updating |
2743 | |
2744 | static bool |
2745 | necp_update_parsed_parameters(struct necp_client_parsed_parameters *parsed_parameters, |
2746 | struct necp_aggregate_result *result) |
2747 | { |
2748 | if (parsed_parameters == NULL || |
2749 | result == NULL) { |
2750 | return (false); |
2751 | } |
2752 | |
2753 | bool updated = false; |
2754 | for (int i = 0; i < NECP_MAX_NETAGENTS; i++) { |
2755 | if (uuid_is_null(result->netagents[i])) { |
2756 | // Passed end of valid agents |
2757 | break; |
2758 | } |
2759 | |
2760 | if (!(result->netagent_use_flags[i] & NECP_AGENT_USE_FLAG_SCOPE)) { |
2761 | // Not a scoped agent, ignore |
2762 | continue; |
2763 | } |
2764 | |
2765 | // This is a scoped agent. Add it to the required agents. |
2766 | if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) { |
2767 | // Already some required agents, add this at the end |
2768 | for (int j = 0; j < NECP_MAX_PARSED_PARAMETERS; j++) { |
2769 | if (uuid_compare(parsed_parameters->required_netagents[j], result->netagents[i]) == 0) { |
2770 | // Already required, break |
2771 | break; |
2772 | } |
2773 | if (uuid_is_null(parsed_parameters->required_netagents[j])) { |
2774 | // Add here |
2775 | memcpy(&parsed_parameters->required_netagents[j], result->netagents[i], sizeof(uuid_t)); |
2776 | updated = true; |
2777 | break; |
2778 | } |
2779 | } |
2780 | } else { |
2781 | // No required agents yet, add this one |
2782 | parsed_parameters->valid_fields |= NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT; |
2783 | memcpy(&parsed_parameters->required_netagents[0], result->netagents[i], sizeof(uuid_t)); |
2784 | updated = true; |
2785 | } |
2786 | |
2787 | // Remove requirements for agents of the same type |
2788 | if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) { |
2789 | char remove_agent_domain[NETAGENT_DOMAINSIZE] = { 0 }; |
2790 | char remove_agent_type[NETAGENT_TYPESIZE] = { 0 }; |
2791 | if (netagent_get_agent_domain_and_type(result->netagents[i], remove_agent_domain, remove_agent_type)) { |
2792 | for (int j = 0; j < NECP_MAX_PARSED_PARAMETERS; j++) { |
2793 | if (strlen(parsed_parameters->required_netagent_types[j].netagent_domain) == 0 && |
2794 | strlen(parsed_parameters->required_netagent_types[j].netagent_type) == 0) { |
2795 | break; |
2796 | } |
2797 | |
2798 | if (strncmp(parsed_parameters->required_netagent_types[j].netagent_domain, remove_agent_domain, NETAGENT_DOMAINSIZE) == 0 && |
2799 | strncmp(parsed_parameters->required_netagent_types[j].netagent_type, remove_agent_type, NETAGENT_TYPESIZE) == 0) { |
2800 | |
2801 | updated = true; |
2802 | |
2803 | if (j == NECP_MAX_PARSED_PARAMETERS - 1) { |
2804 | // Last field, just clear and break |
2805 | memset(&parsed_parameters->required_netagent_types[NECP_MAX_PARSED_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type)); |
2806 | break; |
2807 | } else { |
2808 | // Move the parameters down, clear the last entry |
2809 | memmove(&parsed_parameters->required_netagent_types[j], |
2810 | &parsed_parameters->required_netagent_types[j + 1], |
2811 | sizeof(struct necp_client_parameter_netagent_type) * (NECP_MAX_PARSED_PARAMETERS - (j + 1))); |
2812 | memset(&parsed_parameters->required_netagent_types[NECP_MAX_PARSED_PARAMETERS - 1], 0, sizeof(struct necp_client_parameter_netagent_type)); |
2813 | // Continue, don't increment but look at the new shifted item instead |
2814 | continue; |
2815 | } |
2816 | } |
2817 | |
2818 | // Increment j to look at the next agent type parameter |
2819 | j++; |
2820 | } |
2821 | } |
2822 | } |
2823 | } |
2824 | |
2825 | if (updated && |
2826 | parsed_parameters->required_interface_index != IFSCOPE_NONE && |
2827 | (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IF) == 0) { |
2828 | // A required interface index was added after the fact. Clear it. |
2829 | parsed_parameters->required_interface_index = IFSCOPE_NONE; |
2830 | } |
2831 | |
2832 | |
2833 | return (updated); |
2834 | } |
2835 | |
2836 | static inline bool |
2837 | necp_agent_types_match(const char *agent_domain1, const char *agent_type1, |
2838 | const char *agent_domain2, const char *agent_type2) |
2839 | { |
2840 | return ((strlen(agent_domain1) == 0 || |
2841 | strncmp(agent_domain2, agent_domain1, NETAGENT_DOMAINSIZE) == 0) && |
2842 | (strlen(agent_type1) == 0 || |
2843 | strncmp(agent_type2, agent_type1, NETAGENT_TYPESIZE) == 0)); |
2844 | } |
2845 | |
2846 | static inline bool |
2847 | necp_calculate_client_result(proc_t proc, |
2848 | struct necp_client *client, |
2849 | struct necp_client_parsed_parameters *parsed_parameters, |
2850 | struct necp_aggregate_result *result, |
2851 | u_int32_t *flags) |
2852 | { |
2853 | struct rtentry *route = NULL; |
2854 | |
2855 | // Check parameters to find best interface |
2856 | bool validate_agents = false; |
2857 | u_int matching_if_index = 0; |
2858 | if (necp_find_matching_interface_index(parsed_parameters, &matching_if_index, &validate_agents)) { |
2859 | if (matching_if_index != 0) { |
2860 | parsed_parameters->required_interface_index = matching_if_index; |
2861 | } |
2862 | // Interface found or not needed, match policy. |
2863 | memset(result, 0, sizeof(*result)); |
2864 | int error = necp_application_find_policy_match_internal(proc, client->parameters, |
2865 | (u_int32_t)client->parameters_length, |
2866 | result, flags, matching_if_index, |
2867 | NULL, NULL, &route, false); |
2868 | if (error != 0) { |
2869 | if (route != NULL) { |
2870 | rtfree(route); |
2871 | } |
2872 | return (FALSE); |
2873 | } |
2874 | |
2875 | if (validate_agents) { |
2876 | bool requirement_failed = FALSE; |
2877 | if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) { |
2878 | for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) { |
2879 | if (uuid_is_null(parsed_parameters->required_netagents[i])) { |
2880 | break; |
2881 | } |
2882 | |
2883 | bool requirement_found = FALSE; |
2884 | for (int j = 0; j < NECP_MAX_NETAGENTS; j++) { |
2885 | if (uuid_is_null(result->netagents[j])) { |
2886 | break; |
2887 | } |
2888 | |
2889 | if (uuid_compare(parsed_parameters->required_netagents[i], result->netagents[j]) == 0) { |
2890 | requirement_found = TRUE; |
2891 | break; |
2892 | } |
2893 | } |
2894 | |
2895 | if (!requirement_found) { |
2896 | requirement_failed = TRUE; |
2897 | break; |
2898 | } |
2899 | } |
2900 | } |
2901 | |
2902 | if (!requirement_failed && parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) { |
2903 | for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) { |
2904 | if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 && |
2905 | strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) { |
2906 | break; |
2907 | } |
2908 | |
2909 | bool requirement_found = FALSE; |
2910 | for (int j = 0; j < NECP_MAX_NETAGENTS; j++) { |
2911 | if (uuid_is_null(result->netagents[j])) { |
2912 | break; |
2913 | } |
2914 | |
2915 | char policy_agent_domain[NETAGENT_DOMAINSIZE] = { 0 }; |
2916 | char policy_agent_type[NETAGENT_TYPESIZE] = { 0 }; |
2917 | |
2918 | if (netagent_get_agent_domain_and_type(result->netagents[j], policy_agent_domain, policy_agent_type)) { |
2919 | if (necp_agent_types_match(parsed_parameters->required_netagent_types[i].netagent_domain, |
2920 | parsed_parameters->required_netagent_types[i].netagent_type, |
2921 | policy_agent_domain, policy_agent_type)) { |
2922 | requirement_found = TRUE; |
2923 | break; |
2924 | } |
2925 | } |
2926 | } |
2927 | |
2928 | if (!requirement_found) { |
2929 | requirement_failed = TRUE; |
2930 | break; |
2931 | } |
2932 | } |
2933 | } |
2934 | |
2935 | if (requirement_failed) { |
2936 | // Agent requirement failed. Clear out the whole result, make everything fail. |
2937 | memset(result, 0, sizeof(*result)); |
2938 | if (route != NULL) { |
2939 | rtfree(route); |
2940 | } |
2941 | return (TRUE); |
2942 | } |
2943 | } |
2944 | |
2945 | // Reset current route |
2946 | NECP_CLIENT_ROUTE_LOCK(client); |
2947 | if (client->current_route != NULL) { |
2948 | rtfree(client->current_route); |
2949 | } |
2950 | client->current_route = route; |
2951 | NECP_CLIENT_ROUTE_UNLOCK(client); |
2952 | } else { |
2953 | // Interface not found. Clear out the whole result, make everything fail. |
2954 | memset(result, 0, sizeof(*result)); |
2955 | } |
2956 | |
2957 | return (TRUE); |
2958 | } |
2959 | |
2960 | static bool |
2961 | necp_update_client_result(proc_t proc, |
2962 | struct necp_fd_data *client_fd, |
2963 | struct necp_client *client, |
2964 | struct _necp_flow_defunct_list *defunct_list) |
2965 | { |
2966 | struct necp_client_result_netagent netagent; |
2967 | struct necp_aggregate_result result; |
2968 | struct necp_client_parsed_parameters *parsed_parameters = NULL; |
2969 | u_int32_t flags = 0; |
2970 | |
2971 | NECP_CLIENT_ASSERT_LOCKED(client); |
2972 | |
2973 | MALLOC(parsed_parameters, struct necp_client_parsed_parameters *, sizeof(*parsed_parameters), M_NECP, (M_WAITOK | M_ZERO)); |
2974 | if (parsed_parameters == NULL) { |
2975 | NECPLOG0(LOG_ERR, "Failed to allocate parsed parameters" ); |
2976 | return (FALSE); |
2977 | } |
2978 | |
2979 | // Nexus flows will be brought back if they are still valid |
2980 | necp_client_mark_all_nonsocket_flows_as_invalid(client); |
2981 | |
2982 | int error = necp_client_parse_parameters(client->parameters, (u_int32_t)client->parameters_length, parsed_parameters); |
2983 | if (error != 0) { |
2984 | FREE(parsed_parameters, M_NECP); |
2985 | return (FALSE); |
2986 | } |
2987 | |
2988 | // Update saved IP protocol |
2989 | client->ip_protocol = parsed_parameters->ip_protocol; |
2990 | |
2991 | // Calculate the policy result |
2992 | if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags)) { |
2993 | FREE(parsed_parameters, M_NECP); |
2994 | return (FALSE); |
2995 | } |
2996 | |
2997 | if (necp_update_parsed_parameters(parsed_parameters, &result)) { |
2998 | // Changed the parameters based on result, try again (only once) |
2999 | if (!necp_calculate_client_result(proc, client, parsed_parameters, &result, &flags)) { |
3000 | FREE(parsed_parameters, M_NECP); |
3001 | return (FALSE); |
3002 | } |
3003 | } |
3004 | |
3005 | // Save the last policy id on the client |
3006 | client->policy_id = result.policy_id; |
3007 | |
3008 | if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_MULTIPATH) || |
3009 | ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) && |
3010 | result.routing_result != NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED)) { |
3011 | client->allow_multiple_flows = TRUE; |
3012 | } else { |
3013 | client->allow_multiple_flows = FALSE; |
3014 | } |
3015 | |
3016 | // If the original request was scoped, and the policy result matches, make sure the result is scoped |
3017 | if ((result.routing_result == NECP_KERNEL_POLICY_RESULT_NONE || |
3018 | result.routing_result == NECP_KERNEL_POLICY_RESULT_PASS) && |
3019 | result.routed_interface_index != IFSCOPE_NONE && |
3020 | parsed_parameters->required_interface_index == result.routed_interface_index) { |
3021 | result.routing_result = NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED; |
3022 | result.routing_result_parameter.scoped_interface_index = result.routed_interface_index; |
3023 | } |
3024 | |
3025 | if (defunct_list != NULL && |
3026 | result.routing_result == NECP_KERNEL_POLICY_RESULT_DROP) { |
3027 | // If we are forced to drop the client, defunct it if it has flows |
3028 | necp_defunct_client_for_policy(client, defunct_list); |
3029 | } |
3030 | |
3031 | // Recalculate flags |
3032 | if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) { |
3033 | // Listeners are valid as long as they aren't dropped |
3034 | if (result.routing_result != NECP_KERNEL_POLICY_RESULT_DROP) { |
3035 | flags |= NECP_CLIENT_RESULT_FLAG_SATISFIED; |
3036 | } |
3037 | } else if (result.routed_interface_index != 0) { |
3038 | // Clients without flows determine viability based on having some routable interface |
3039 | flags |= NECP_CLIENT_RESULT_FLAG_SATISFIED; |
3040 | } |
3041 | |
3042 | bool updated = FALSE; |
3043 | u_int8_t *cursor = client->result; |
3044 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FLAGS, sizeof(flags), &flags, &updated, client->result, sizeof(client->result)); |
3045 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_CLIENT_ID, sizeof(uuid_t), client->client_id, &updated, |
3046 | client->result, sizeof(client->result)); |
3047 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT, sizeof(result.routing_result), &result.routing_result, &updated, |
3048 | client->result, sizeof(client->result)); |
3049 | if (result.routing_result_parameter.tunnel_interface_index != 0) { |
3050 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER, |
3051 | sizeof(result.routing_result_parameter), &result.routing_result_parameter, &updated, |
3052 | client->result, sizeof(client->result)); |
3053 | } |
3054 | if (result.filter_control_unit != 0) { |
3055 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT, |
3056 | sizeof(result.filter_control_unit), &result.filter_control_unit, &updated, |
3057 | client->result, sizeof(client->result)); |
3058 | } |
3059 | if (result.routed_interface_index != 0) { |
3060 | u_int routed_interface_index = result.routed_interface_index; |
3061 | if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL && |
3062 | parsed_parameters->required_interface_index != IFSCOPE_NONE && |
3063 | parsed_parameters->required_interface_index != result.routed_interface_index) { |
3064 | routed_interface_index = parsed_parameters->required_interface_index; |
3065 | } |
3066 | |
3067 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_INDEX, |
3068 | sizeof(routed_interface_index), &routed_interface_index, &updated, |
3069 | client->result, sizeof(client->result)); |
3070 | } |
3071 | if (client_fd && client_fd->flags & NECP_OPEN_FLAG_BACKGROUND) { |
3072 | u_int32_t effective_traffic_class = SO_TC_BK_SYS; |
3073 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS, |
3074 | sizeof(effective_traffic_class), &effective_traffic_class, &updated, |
3075 | client->result, sizeof(client->result)); |
3076 | } |
3077 | if (client->background_update) { |
3078 | u_int32_t background = client->background; |
3079 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG, |
3080 | sizeof(background), &background, &updated, |
3081 | client->result, sizeof(client->result)); |
3082 | if (updated) { |
3083 | client->background_update = 0; |
3084 | } |
3085 | } |
3086 | NECP_CLIENT_ROUTE_LOCK(client); |
3087 | if (client->current_route != NULL) { |
3088 | const u_int32_t route_mtu = get_maxmtu(client->current_route); |
3089 | if (route_mtu != 0) { |
3090 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_EFFECTIVE_MTU, |
3091 | sizeof(route_mtu), &route_mtu, &updated, |
3092 | client->result, sizeof(client->result)); |
3093 | } |
3094 | } |
3095 | NECP_CLIENT_ROUTE_UNLOCK(client); |
3096 | |
3097 | if (result.mss_recommended != 0) { |
3098 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_RECOMMENDED_MSS, |
3099 | sizeof(result.mss_recommended), &result.mss_recommended, &updated, |
3100 | client->result, sizeof(client->result)); |
3101 | } |
3102 | |
3103 | for (int i = 0; i < NECP_MAX_NETAGENTS; i++) { |
3104 | if (uuid_is_null(result.netagents[i])) { |
3105 | break; |
3106 | } |
3107 | uuid_copy(netagent.netagent_uuid, result.netagents[i]); |
3108 | netagent.generation = netagent_get_generation(netagent.netagent_uuid); |
3109 | if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE, 0, 0)) { |
3110 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated, |
3111 | client->result, sizeof(client->result)); |
3112 | } |
3113 | } |
3114 | |
3115 | ifnet_head_lock_shared(); |
3116 | ifnet_t direct_interface = NULL; |
3117 | ifnet_t delegate_interface = NULL; |
3118 | ifnet_t original_scoped_interface = NULL; |
3119 | |
3120 | if (result.routed_interface_index != IFSCOPE_NONE && result.routed_interface_index <= (u_int32_t)if_index) { |
3121 | direct_interface = ifindex2ifnet[result.routed_interface_index]; |
3122 | } else if (parsed_parameters->required_interface_index != IFSCOPE_NONE && |
3123 | parsed_parameters->required_interface_index <= (u_int32_t)if_index) { |
3124 | // If the request was scoped, but the route didn't match, still grab the agents |
3125 | direct_interface = ifindex2ifnet[parsed_parameters->required_interface_index]; |
3126 | } else if (result.routed_interface_index == IFSCOPE_NONE && |
3127 | result.routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED && |
3128 | result.routing_result_parameter.scoped_interface_index != IFSCOPE_NONE) { |
3129 | direct_interface = ifindex2ifnet[result.routing_result_parameter.scoped_interface_index]; |
3130 | } |
3131 | if (direct_interface != NULL) { |
3132 | delegate_interface = direct_interface->if_delegated.ifp; |
3133 | } |
3134 | if (result.routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL && |
3135 | parsed_parameters->required_interface_index != IFSCOPE_NONE && |
3136 | parsed_parameters->required_interface_index != result.routing_result_parameter.tunnel_interface_index && |
3137 | parsed_parameters->required_interface_index <= (u_int32_t)if_index) { |
3138 | original_scoped_interface = ifindex2ifnet[parsed_parameters->required_interface_index]; |
3139 | } |
3140 | // Add interfaces |
3141 | if (original_scoped_interface != NULL) { |
3142 | struct necp_client_result_interface interface_struct; |
3143 | interface_struct.index = original_scoped_interface->if_index; |
3144 | interface_struct.generation = ifnet_get_generation(original_scoped_interface); |
3145 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated, |
3146 | client->result, sizeof(client->result)); |
3147 | } |
3148 | if (direct_interface != NULL) { |
3149 | struct necp_client_result_interface interface_struct; |
3150 | interface_struct.index = direct_interface->if_index; |
3151 | interface_struct.generation = ifnet_get_generation(direct_interface); |
3152 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated, |
3153 | client->result, sizeof(client->result)); |
3154 | |
3155 | // Set the delta time since interface up/down |
3156 | struct timeval updown_delta = {}; |
3157 | if (ifnet_updown_delta(direct_interface, &updown_delta) == 0) { |
3158 | u_int32_t delta = updown_delta.tv_sec; |
3159 | bool ignore_updated = FALSE; |
3160 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_TIME_DELTA, |
3161 | sizeof(delta), &delta, &ignore_updated, |
3162 | client->result, sizeof(client->result)); |
3163 | } |
3164 | } |
3165 | if (delegate_interface != NULL) { |
3166 | struct necp_client_result_interface interface_struct; |
3167 | interface_struct.index = delegate_interface->if_index; |
3168 | interface_struct.generation = ifnet_get_generation(delegate_interface); |
3169 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE, sizeof(interface_struct), &interface_struct, &updated, |
3170 | client->result, sizeof(client->result)); |
3171 | } |
3172 | |
3173 | // Update multipath/listener interface flows |
3174 | if (parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_MULTIPATH) { |
3175 | // Get multipath interface options from ordered list |
3176 | struct ifnet *multi_interface = NULL; |
3177 | TAILQ_FOREACH(multi_interface, &ifnet_ordered_head, if_ordered_link) { |
3178 | if (necp_ifnet_matches_parameters(multi_interface, parsed_parameters, NULL, true)) { |
3179 | // Add multipath interface flows for kernel MPTCP |
3180 | necp_client_add_interface_option_if_needed(client, multi_interface->if_index, |
3181 | ifnet_get_generation(multi_interface), NULL); |
3182 | |
3183 | // Add nexus agents for multipath |
3184 | necp_client_add_agent_interface_options(client, parsed_parameters, multi_interface); |
3185 | } |
3186 | } |
3187 | } else if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) && |
3188 | result.routing_result != NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) { |
3189 | // Get listener interface options from global list |
3190 | struct ifnet *listen_interface = NULL; |
3191 | TAILQ_FOREACH(listen_interface, &ifnet_head, if_link) { |
3192 | if (necp_ifnet_matches_parameters(listen_interface, parsed_parameters, NULL, true)) { |
3193 | // Add nexus agents for listeners |
3194 | necp_client_add_agent_interface_options(client, parsed_parameters, listen_interface); |
3195 | } |
3196 | } |
3197 | } |
3198 | |
3199 | // Add agents |
3200 | if (original_scoped_interface != NULL) { |
3201 | ifnet_lock_shared(original_scoped_interface); |
3202 | if (original_scoped_interface->if_agentids != NULL) { |
3203 | for (u_int32_t i = 0; i < original_scoped_interface->if_agentcount; i++) { |
3204 | if (uuid_is_null(original_scoped_interface->if_agentids[i])) { |
3205 | continue; |
3206 | } |
3207 | uuid_copy(netagent.netagent_uuid, original_scoped_interface->if_agentids[i]); |
3208 | netagent.generation = netagent_get_generation(netagent.netagent_uuid); |
3209 | if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE, |
3210 | original_scoped_interface->if_index, ifnet_get_generation(original_scoped_interface))) { |
3211 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated, |
3212 | client->result, sizeof(client->result)); |
3213 | } |
3214 | } |
3215 | } |
3216 | ifnet_lock_done(original_scoped_interface); |
3217 | } |
3218 | if (direct_interface != NULL) { |
3219 | ifnet_lock_shared(direct_interface); |
3220 | if (direct_interface->if_agentids != NULL) { |
3221 | for (u_int32_t i = 0; i < direct_interface->if_agentcount; i++) { |
3222 | if (uuid_is_null(direct_interface->if_agentids[i])) { |
3223 | continue; |
3224 | } |
3225 | uuid_copy(netagent.netagent_uuid, direct_interface->if_agentids[i]); |
3226 | netagent.generation = netagent_get_generation(netagent.netagent_uuid); |
3227 | if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, TRUE, |
3228 | direct_interface->if_index, ifnet_get_generation(direct_interface))) { |
3229 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated, |
3230 | client->result, sizeof(client->result)); |
3231 | } |
3232 | } |
3233 | } |
3234 | ifnet_lock_done(direct_interface); |
3235 | } |
3236 | if (delegate_interface != NULL) { |
3237 | ifnet_lock_shared(delegate_interface); |
3238 | if (delegate_interface->if_agentids != NULL) { |
3239 | for (u_int32_t i = 0; i < delegate_interface->if_agentcount; i++) { |
3240 | if (uuid_is_null(delegate_interface->if_agentids[i])) { |
3241 | continue; |
3242 | } |
3243 | uuid_copy(netagent.netagent_uuid, delegate_interface->if_agentids[i]); |
3244 | netagent.generation = netagent_get_generation(netagent.netagent_uuid); |
3245 | if (necp_netagent_applies_to_client(client, parsed_parameters, &netagent.netagent_uuid, FALSE, |
3246 | delegate_interface->if_index, ifnet_get_generation(delegate_interface))) { |
3247 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_NETAGENT, sizeof(netagent), &netagent, &updated, |
3248 | client->result, sizeof(client->result)); |
3249 | } |
3250 | } |
3251 | } |
3252 | ifnet_lock_done(delegate_interface); |
3253 | } |
3254 | ifnet_head_done(); |
3255 | |
3256 | // Add interface options |
3257 | for (u_int32_t option_i = 0; option_i < client->interface_option_count; option_i++) { |
3258 | if (option_i < NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT) { |
3259 | struct necp_client_interface_option *option = &client->interface_options[option_i]; |
3260 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated, |
3261 | client->result, sizeof(client->result)); |
3262 | } else { |
3263 | struct necp_client_interface_option *option = &client->extra_interface_options[option_i - NECP_CLIENT_INTERFACE_OPTION_STATIC_COUNT]; |
3264 | cursor = necp_buffer_write_tlv_if_different(cursor, NECP_CLIENT_RESULT_INTERFACE_OPTION, sizeof(*option), option, &updated, |
3265 | client->result, sizeof(client->result)); |
3266 | } |
3267 | } |
3268 | |
3269 | size_t new_result_length = (cursor - client->result); |
3270 | if (new_result_length != client->result_length) { |
3271 | client->result_length = new_result_length; |
3272 | updated = TRUE; |
3273 | } |
3274 | |
3275 | // Update flow viability/flags |
3276 | if (necp_client_update_flows(proc, client, defunct_list)) { |
3277 | updated = TRUE; |
3278 | } |
3279 | |
3280 | if (updated) { |
3281 | client->result_read = FALSE; |
3282 | necp_client_update_observer_update(client); |
3283 | } |
3284 | |
3285 | FREE(parsed_parameters, M_NECP); |
3286 | return (updated); |
3287 | } |
3288 | |
3289 | static inline void |
3290 | necp_defunct_client_fd_locked(struct necp_fd_data *client_fd, struct _necp_flow_defunct_list *defunct_list, struct proc *proc) |
3291 | { |
3292 | #pragma unused(proc) |
3293 | bool updated_result = FALSE; |
3294 | struct necp_client *client = NULL; |
3295 | |
3296 | NECP_FD_ASSERT_LOCKED(client_fd); |
3297 | |
3298 | RB_FOREACH(client, _necp_client_tree, &client_fd->clients) { |
3299 | struct necp_client_flow_registration *flow_registration = NULL; |
3300 | |
3301 | NECP_CLIENT_LOCK(client); |
3302 | |
3303 | // Prepare close events to be sent to the nexus to effectively remove the flows |
3304 | struct necp_client_flow *search_flow = NULL; |
3305 | RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) { |
3306 | LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) { |
3307 | if (search_flow->nexus && |
3308 | !uuid_is_null(search_flow->u.nexus_agent)) { |
3309 | |
3310 | struct necp_flow_defunct *flow_defunct; |
3311 | |
3312 | // Sleeping alloc won't fail; copy only what's necessary |
3313 | flow_defunct = _MALLOC(sizeof (struct necp_flow_defunct), M_NECP, M_WAITOK | M_ZERO); |
3314 | uuid_copy(flow_defunct->nexus_agent, search_flow->u.nexus_agent); |
3315 | uuid_copy(flow_defunct->flow_id, ((flow_registration->flags & NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID) ? |
3316 | client->client_id : |
3317 | flow_registration->registration_id)); |
3318 | flow_defunct->proc_pid = client->proc_pid; |
3319 | flow_defunct->agent_handle = client->agent_handle; |
3320 | |
3321 | // Add to the list provided by caller |
3322 | LIST_INSERT_HEAD(defunct_list, flow_defunct, chain); |
3323 | |
3324 | flow_registration->defunct = true; |
3325 | flow_registration->flow_result_read = false; |
3326 | updated_result = true; |
3327 | } |
3328 | } |
3329 | } |
3330 | NECP_CLIENT_UNLOCK(client); |
3331 | } |
3332 | |
3333 | |
3334 | if (updated_result) { |
3335 | necp_fd_notify(client_fd, true); |
3336 | } |
3337 | } |
3338 | |
3339 | static inline void |
3340 | necp_update_client_fd_locked(struct necp_fd_data *client_fd, |
3341 | proc_t proc, |
3342 | struct _necp_flow_defunct_list *defunct_list) |
3343 | { |
3344 | struct necp_client *client = NULL; |
3345 | bool updated_result = FALSE; |
3346 | NECP_FD_ASSERT_LOCKED(client_fd); |
3347 | RB_FOREACH(client, _necp_client_tree, &client_fd->clients) { |
3348 | NECP_CLIENT_LOCK(client); |
3349 | if (necp_update_client_result(proc, client_fd, client, defunct_list)) { |
3350 | updated_result = TRUE; |
3351 | } |
3352 | NECP_CLIENT_UNLOCK(client); |
3353 | } |
3354 | if (updated_result) { |
3355 | necp_fd_notify(client_fd, true); |
3356 | } |
3357 | } |
3358 | |
3359 | |
3360 | static void |
3361 | necp_update_all_clients_callout(__unused thread_call_param_t dummy, |
3362 | __unused thread_call_param_t arg) |
3363 | { |
3364 | struct necp_fd_data *client_fd = NULL; |
3365 | |
3366 | struct _necp_flow_defunct_list defunct_list; |
3367 | LIST_INIT(&defunct_list); |
3368 | |
3369 | NECP_FD_LIST_LOCK_SHARED(); |
3370 | |
3371 | LIST_FOREACH(client_fd, &necp_fd_list, chain) { |
3372 | proc_t proc = proc_find(client_fd->proc_pid); |
3373 | if (proc == PROC_NULL) { |
3374 | continue; |
3375 | } |
3376 | |
3377 | // Update all clients on one fd |
3378 | NECP_FD_LOCK(client_fd); |
3379 | necp_update_client_fd_locked(client_fd, proc, &defunct_list); |
3380 | NECP_FD_UNLOCK(client_fd); |
3381 | |
3382 | proc_rele(proc); |
3383 | proc = PROC_NULL; |
3384 | } |
3385 | |
3386 | NECP_FD_LIST_UNLOCK(); |
3387 | |
3388 | // Handle the case in which some clients became newly defunct |
3389 | if (!LIST_EMPTY(&defunct_list)) { |
3390 | struct necp_flow_defunct *flow_defunct = NULL; |
3391 | struct necp_flow_defunct *temp_flow_defunct = NULL; |
3392 | |
3393 | // For each newly defunct client, send a message to the nexus to remove the flow |
3394 | LIST_FOREACH_SAFE(flow_defunct, &defunct_list, chain, temp_flow_defunct) { |
3395 | if (!uuid_is_null(flow_defunct->nexus_agent)) { |
3396 | int netagent_error = netagent_client_message(flow_defunct->nexus_agent, |
3397 | flow_defunct->flow_id, |
3398 | flow_defunct->proc_pid, |
3399 | flow_defunct->agent_handle, |
3400 | NETAGENT_MESSAGE_TYPE_ABORT_NEXUS); |
3401 | if (netagent_error != 0) { |
3402 | char namebuf[MAXCOMLEN+1]; |
3403 | (void) strlcpy(namebuf, "unknown" , sizeof (namebuf)); |
3404 | proc_name(flow_defunct->proc_pid, namebuf, sizeof (namebuf)); |
3405 | NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR), "necp_update_client abort nexus error (%d) for pid %d %s" , netagent_error, flow_defunct->proc_pid, namebuf); |
3406 | } |
3407 | } |
3408 | LIST_REMOVE(flow_defunct, chain); |
3409 | FREE(flow_defunct, M_NECP); |
3410 | } |
3411 | } |
3412 | ASSERT(LIST_EMPTY(&defunct_list)); |
3413 | } |
3414 | |
3415 | void |
3416 | necp_update_all_clients(void) |
3417 | { |
3418 | if (necp_client_update_tcall == NULL) { |
3419 | // Don't try to update clients if the module is not initialized |
3420 | return; |
3421 | } |
3422 | |
3423 | uint64_t deadline = 0; |
3424 | uint64_t leeway = 0; |
3425 | clock_interval_to_deadline(necp_timeout_microseconds, NSEC_PER_USEC, &deadline); |
3426 | clock_interval_to_absolutetime_interval(necp_timeout_leeway_microseconds, NSEC_PER_USEC, &leeway); |
3427 | |
3428 | thread_call_enter_delayed_with_leeway(necp_client_update_tcall, NULL, |
3429 | deadline, leeway, THREAD_CALL_DELAY_LEEWAY); |
3430 | } |
3431 | |
3432 | void |
3433 | necp_set_client_as_background(proc_t proc, |
3434 | struct fileproc *fp, |
3435 | bool background) |
3436 | { |
3437 | bool updated_result = FALSE; |
3438 | struct necp_client *client = NULL; |
3439 | |
3440 | if (proc == PROC_NULL) { |
3441 | NECPLOG0(LOG_ERR, "NULL proc" ); |
3442 | return; |
3443 | } |
3444 | |
3445 | if (fp == NULL) { |
3446 | NECPLOG0(LOG_ERR, "NULL fp" ); |
3447 | return; |
3448 | } |
3449 | |
3450 | struct necp_fd_data *client_fd = (struct necp_fd_data *)fp->f_fglob->fg_data; |
3451 | if (client_fd == NULL) { |
3452 | NECPLOG0(LOG_ERR, "Could not find client structure for backgrounded client" ); |
3453 | return; |
3454 | } |
3455 | |
3456 | if (client_fd->necp_fd_type != necp_fd_type_client) { |
3457 | // Not a client fd, ignore |
3458 | NECPLOG0(LOG_ERR, "Not a client fd, ignore" ); |
3459 | return; |
3460 | } |
3461 | |
3462 | NECP_FD_LOCK(client_fd); |
3463 | |
3464 | RB_FOREACH(client, _necp_client_tree, &client_fd->clients) { |
3465 | NECP_CLIENT_LOCK(client); |
3466 | |
3467 | bool has_assigned_flow = FALSE; |
3468 | struct necp_client_flow_registration *flow_registration = NULL; |
3469 | struct necp_client_flow *search_flow = NULL; |
3470 | RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) { |
3471 | LIST_FOREACH(search_flow, &flow_registration->flow_list, flow_chain) { |
3472 | if (search_flow->assigned) { |
3473 | has_assigned_flow = TRUE; |
3474 | break; |
3475 | } |
3476 | } |
3477 | } |
3478 | |
3479 | if (has_assigned_flow) { |
3480 | client->background = background; |
3481 | client->background_update = TRUE; |
3482 | updated_result = TRUE; |
3483 | } |
3484 | |
3485 | NECP_CLIENT_UNLOCK(client); |
3486 | } |
3487 | if (updated_result) { |
3488 | necp_update_client_fd_locked(client_fd, proc, NULL); |
3489 | } |
3490 | NECP_FD_UNLOCK(client_fd); |
3491 | } |
3492 | |
3493 | void |
3494 | necp_fd_memstatus(proc_t proc, uint32_t status, |
3495 | struct necp_fd_data *client_fd) |
3496 | { |
3497 | #pragma unused(proc, status, client_fd) |
3498 | ASSERT(proc != PROC_NULL); |
3499 | ASSERT(client_fd != NULL); |
3500 | |
3501 | // Nothing to reap for the process or client for now, |
3502 | // but this is where we would trigger that in future. |
3503 | } |
3504 | |
3505 | void |
3506 | necp_fd_defunct(proc_t proc, struct necp_fd_data *client_fd) |
3507 | { |
3508 | struct _necp_flow_defunct_list defunct_list; |
3509 | |
3510 | ASSERT(proc != PROC_NULL); |
3511 | ASSERT(client_fd != NULL); |
3512 | |
3513 | if (client_fd->necp_fd_type != necp_fd_type_client) { |
3514 | // Not a client fd, ignore |
3515 | return; |
3516 | } |
3517 | |
3518 | // Our local temporary list |
3519 | LIST_INIT(&defunct_list); |
3520 | |
3521 | // Need to hold lock so ntstats defunct the same set of clients |
3522 | NECP_FD_LOCK(client_fd); |
3523 | necp_defunct_client_fd_locked(client_fd, &defunct_list, proc); |
3524 | NECP_FD_UNLOCK(client_fd); |
3525 | |
3526 | if (!LIST_EMPTY(&defunct_list)) { |
3527 | struct necp_flow_defunct *flow_defunct = NULL; |
3528 | struct necp_flow_defunct *temp_flow_defunct = NULL; |
3529 | |
3530 | // For each defunct client, remove flow from the nexus |
3531 | LIST_FOREACH_SAFE(flow_defunct, &defunct_list, chain, temp_flow_defunct) { |
3532 | if (!uuid_is_null(flow_defunct->nexus_agent)) { |
3533 | int netagent_error = netagent_client_message(flow_defunct->nexus_agent, |
3534 | flow_defunct->flow_id, |
3535 | flow_defunct->proc_pid, |
3536 | flow_defunct->agent_handle, |
3537 | NETAGENT_MESSAGE_TYPE_ABORT_NEXUS); |
3538 | if (netagent_error != 0) { |
3539 | NECPLOG((netagent_error == ENOENT ? LOG_DEBUG : LOG_ERR), "necp_defunct_client abort nexus error (%d)" , netagent_error); |
3540 | } |
3541 | } |
3542 | LIST_REMOVE(flow_defunct, chain); |
3543 | FREE(flow_defunct, M_NECP); |
3544 | } |
3545 | } |
3546 | ASSERT(LIST_EMPTY(&defunct_list)); |
3547 | } |
3548 | |
3549 | static void |
3550 | necp_client_remove_agent_from_result(struct necp_client *client, uuid_t netagent_uuid) |
3551 | { |
3552 | size_t offset = 0; |
3553 | |
3554 | u_int8_t *result_buffer = client->result; |
3555 | while ((offset + sizeof(struct necp_tlv_header)) <= client->result_length) { |
3556 | u_int8_t type = necp_buffer_get_tlv_type(result_buffer, offset); |
3557 | u_int32_t length = necp_buffer_get_tlv_length(result_buffer, offset); |
3558 | |
3559 | size_t tlv_total_length = (sizeof(struct necp_tlv_header) + length); |
3560 | if (type == NECP_CLIENT_RESULT_NETAGENT && |
3561 | length == sizeof(struct necp_client_result_netagent) && |
3562 | (offset + tlv_total_length) <= client->result_length) { |
3563 | struct necp_client_result_netagent *value = ((struct necp_client_result_netagent *)(void *) |
3564 | necp_buffer_get_tlv_value(result_buffer, offset, NULL)); |
3565 | if (uuid_compare(value->netagent_uuid, netagent_uuid) == 0) { |
3566 | // Found a netagent to remove |
3567 | // Shift bytes down to remove the tlv, and adjust total length |
3568 | // Don't adjust the current offset |
3569 | memmove(result_buffer + offset, |
3570 | result_buffer + offset + tlv_total_length, |
3571 | client->result_length - (offset + tlv_total_length)); |
3572 | client->result_length -= tlv_total_length; |
3573 | memset(result_buffer + client->result_length, 0, sizeof(client->result) - client->result_length); |
3574 | continue; |
3575 | } |
3576 | } |
3577 | |
3578 | offset += tlv_total_length; |
3579 | } |
3580 | } |
3581 | |
3582 | void |
3583 | necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid, u_int32_t agent_generation) |
3584 | { |
3585 | struct necp_fd_data *client_fd = NULL; |
3586 | |
3587 | NECP_FD_LIST_LOCK_SHARED(); |
3588 | |
3589 | LIST_FOREACH(client_fd, &necp_fd_list, chain) { |
3590 | bool updated_result = FALSE; |
3591 | NECP_FD_LOCK(client_fd); |
3592 | struct necp_client *client = necp_client_fd_find_client_and_lock(client_fd, client_id); |
3593 | if (client != NULL) { |
3594 | client->failed_trigger_agent.generation = agent_generation; |
3595 | uuid_copy(client->failed_trigger_agent.netagent_uuid, remove_netagent_uuid); |
3596 | if (!uuid_is_null(remove_netagent_uuid)) { |
3597 | necp_client_remove_agent_from_result(client, remove_netagent_uuid); |
3598 | } |
3599 | client->result_read = FALSE; |
3600 | // Found the client, break |
3601 | updated_result = TRUE; |
3602 | NECP_CLIENT_UNLOCK(client); |
3603 | } |
3604 | if (updated_result) { |
3605 | necp_fd_notify(client_fd, true); |
3606 | } |
3607 | NECP_FD_UNLOCK(client_fd); |
3608 | if (updated_result) { |
3609 | // Found the client, break |
3610 | break; |
3611 | } |
3612 | } |
3613 | |
3614 | NECP_FD_LIST_UNLOCK(); |
3615 | } |
3616 | |
3617 | |
3618 | /// Interface matching |
3619 | |
3620 | #define NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \ |
3621 | NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF | \ |
3622 | NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \ |
3623 | NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE | \ |
3624 | NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \ |
3625 | NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT | \ |
3626 | NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \ |
3627 | NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \ |
3628 | NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \ |
3629 | NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE | \ |
3630 | NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \ |
3631 | NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE) |
3632 | |
3633 | #define NECP_PARSED_PARAMETERS_SCOPED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \ |
3634 | NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE | \ |
3635 | NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT | \ |
3636 | NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \ |
3637 | NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \ |
3638 | NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE | \ |
3639 | NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \ |
3640 | NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE) |
3641 | |
3642 | #define NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS (NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR | \ |
3643 | NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) |
3644 | |
3645 | #define NECP_PARSED_PARAMETERS_PREFERRED_FIELDS (NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT | \ |
3646 | NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT | \ |
3647 | NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE | \ |
3648 | NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE) |
3649 | |
3650 | static bool |
3651 | necp_ifnet_matches_type(struct ifnet *ifp, u_int8_t interface_type, bool check_delegates) |
3652 | { |
3653 | struct ifnet *check_ifp = ifp; |
3654 | while (check_ifp) { |
3655 | if (if_functional_type(check_ifp, TRUE) == interface_type) { |
3656 | return (TRUE); |
3657 | } |
3658 | if (!check_delegates) { |
3659 | break; |
3660 | } |
3661 | check_ifp = check_ifp->if_delegated.ifp; |
3662 | |
3663 | } |
3664 | return (FALSE); |
3665 | } |
3666 | |
3667 | static bool |
3668 | necp_ifnet_matches_name(struct ifnet *ifp, const char *interface_name, bool check_delegates) |
3669 | { |
3670 | struct ifnet *check_ifp = ifp; |
3671 | while (check_ifp) { |
3672 | if (strncmp(check_ifp->if_xname, interface_name, IFXNAMSIZ) == 0) { |
3673 | return (TRUE); |
3674 | } |
3675 | if (!check_delegates) { |
3676 | break; |
3677 | } |
3678 | check_ifp = check_ifp->if_delegated.ifp; |
3679 | } |
3680 | return (FALSE); |
3681 | } |
3682 | |
3683 | static bool |
3684 | necp_ifnet_matches_agent(struct ifnet *ifp, uuid_t *agent_uuid, bool check_delegates) |
3685 | { |
3686 | struct ifnet *check_ifp = ifp; |
3687 | |
3688 | while (check_ifp != NULL) { |
3689 | ifnet_lock_shared(check_ifp); |
3690 | if (check_ifp->if_agentids != NULL) { |
3691 | for (u_int32_t index = 0; index < check_ifp->if_agentcount; index++) { |
3692 | if (uuid_compare(check_ifp->if_agentids[index], *agent_uuid) == 0) { |
3693 | ifnet_lock_done(check_ifp); |
3694 | return (TRUE); |
3695 | } |
3696 | } |
3697 | } |
3698 | ifnet_lock_done(check_ifp); |
3699 | |
3700 | if (!check_delegates) { |
3701 | break; |
3702 | } |
3703 | check_ifp = check_ifp->if_delegated.ifp; |
3704 | } |
3705 | return (FALSE); |
3706 | } |
3707 | |
3708 | static bool |
3709 | necp_ifnet_matches_agent_type(struct ifnet *ifp, const char *agent_domain, const char *agent_type, bool check_delegates) |
3710 | { |
3711 | struct ifnet *check_ifp = ifp; |
3712 | |
3713 | while (check_ifp != NULL) { |
3714 | ifnet_lock_shared(check_ifp); |
3715 | if (check_ifp->if_agentids != NULL) { |
3716 | for (u_int32_t index = 0; index < check_ifp->if_agentcount; index++) { |
3717 | if (uuid_is_null(check_ifp->if_agentids[index])) { |
3718 | continue; |
3719 | } |
3720 | |
3721 | char if_agent_domain[NETAGENT_DOMAINSIZE] = { 0 }; |
3722 | char if_agent_type[NETAGENT_TYPESIZE] = { 0 }; |
3723 | |
3724 | if (netagent_get_agent_domain_and_type(check_ifp->if_agentids[index], if_agent_domain, if_agent_type)) { |
3725 | if (necp_agent_types_match(agent_domain, agent_type, if_agent_domain, if_agent_type)) { |
3726 | ifnet_lock_done(check_ifp); |
3727 | return (TRUE); |
3728 | } |
3729 | } |
3730 | } |
3731 | } |
3732 | ifnet_lock_done(check_ifp); |
3733 | |
3734 | if (!check_delegates) { |
3735 | break; |
3736 | } |
3737 | check_ifp = check_ifp->if_delegated.ifp; |
3738 | } |
3739 | return (FALSE); |
3740 | } |
3741 | |
3742 | static bool |
3743 | necp_ifnet_matches_local_address(struct ifnet *ifp, struct sockaddr *sa) |
3744 | { |
3745 | struct ifaddr *ifa = NULL; |
3746 | bool matched_local_address = FALSE; |
3747 | |
3748 | // Transform sa into the ifaddr form |
3749 | // IPv6 Scope IDs are always embedded in the ifaddr list |
3750 | struct sockaddr_storage address; |
3751 | u_int ifscope = IFSCOPE_NONE; |
3752 | (void)sa_copy(sa, &address, &ifscope); |
3753 | SIN(&address)->sin_port = 0; |
3754 | if (address.ss_family == AF_INET6) { |
3755 | SIN6(&address)->sin6_scope_id = 0; |
3756 | } |
3757 | |
3758 | ifa = ifa_ifwithaddr_scoped_locked((struct sockaddr *)&address, ifp->if_index); |
3759 | matched_local_address = (ifa != NULL); |
3760 | |
3761 | if (ifa) { |
3762 | ifaddr_release(ifa); |
3763 | } |
3764 | |
3765 | return (matched_local_address); |
3766 | } |
3767 | |
3768 | static bool |
3769 | necp_interface_type_is_primary_eligible(u_int8_t interface_type) |
3770 | { |
3771 | switch (interface_type) { |
3772 | // These types can never be primary, so a client requesting these types is allowed |
3773 | // to match an interface that isn't currently eligible to be primary (has default |
3774 | // route, dns, etc) |
3775 | case IFRTYPE_FUNCTIONAL_WIFI_AWDL: |
3776 | case IFRTYPE_FUNCTIONAL_INTCOPROC: |
3777 | return false; |
3778 | default: |
3779 | break; |
3780 | } |
3781 | return true; |
3782 | } |
3783 | |
3784 | #define NECP_IFP_IS_ON_ORDERED_LIST(_ifp) ((_ifp)->if_ordered_link.tqe_next != NULL || (_ifp)->if_ordered_link.tqe_prev != NULL) |
3785 | |
3786 | // Secondary interface flag indicates that the interface is being |
3787 | // used for multipath or a listener as an extra path |
3788 | static bool |
3789 | necp_ifnet_matches_parameters(struct ifnet *ifp, |
3790 | struct necp_client_parsed_parameters *parsed_parameters, |
3791 | u_int32_t *preferred_count, |
3792 | bool secondary_interface) |
3793 | { |
3794 | if (preferred_count) { |
3795 | *preferred_count = 0; |
3796 | } |
3797 | |
3798 | if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_LOCAL_ADDR) { |
3799 | if (!necp_ifnet_matches_local_address(ifp, &parsed_parameters->local_addr.sa)) { |
3800 | return (FALSE); |
3801 | } |
3802 | } |
3803 | |
3804 | if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) { |
3805 | if ((parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) && |
3806 | IFNET_IS_EXPENSIVE(ifp)) { |
3807 | return (FALSE); |
3808 | } |
3809 | } |
3810 | |
3811 | if ((!secondary_interface || // Enforce interface type if this is the primary interface |
3812 | !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_FLAGS) || // or if there are no flags |
3813 | !(parsed_parameters->flags & NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE)) && // or if the flags don't give an exception |
3814 | (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE) && |
3815 | !necp_ifnet_matches_type(ifp, parsed_parameters->required_interface_type, FALSE)) { |
3816 | return (FALSE); |
3817 | } |
3818 | |
3819 | if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IFTYPE) { |
3820 | for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) { |
3821 | if (parsed_parameters->prohibited_interface_types[i] == 0) { |
3822 | break; |
3823 | } |
3824 | |
3825 | if (necp_ifnet_matches_type(ifp, parsed_parameters->prohibited_interface_types[i], TRUE)) { |
3826 | return (FALSE); |
3827 | } |
3828 | } |
3829 | } |
3830 | |
3831 | if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_IF) { |
3832 | for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) { |
3833 | if (strlen(parsed_parameters->prohibited_interfaces[i]) == 0) { |
3834 | break; |
3835 | } |
3836 | |
3837 | if (necp_ifnet_matches_name(ifp, parsed_parameters->prohibited_interfaces[i], TRUE)) { |
3838 | return (FALSE); |
3839 | } |
3840 | } |
3841 | } |
3842 | |
3843 | if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT) { |
3844 | for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) { |
3845 | if (uuid_is_null(parsed_parameters->required_netagents[i])) { |
3846 | break; |
3847 | } |
3848 | |
3849 | if (!necp_ifnet_matches_agent(ifp, &parsed_parameters->required_netagents[i], FALSE)) { |
3850 | return (FALSE); |
3851 | } |
3852 | } |
3853 | } |
3854 | |
3855 | if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT) { |
3856 | for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) { |
3857 | if (uuid_is_null(parsed_parameters->prohibited_netagents[i])) { |
3858 | break; |
3859 | } |
3860 | |
3861 | if (necp_ifnet_matches_agent(ifp, &parsed_parameters->prohibited_netagents[i], TRUE)) { |
3862 | return (FALSE); |
3863 | } |
3864 | } |
3865 | } |
3866 | |
3867 | if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_AGENT_TYPE) { |
3868 | for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) { |
3869 | if (strlen(parsed_parameters->required_netagent_types[i].netagent_domain) == 0 && |
3870 | strlen(parsed_parameters->required_netagent_types[i].netagent_type) == 0) { |
3871 | break; |
3872 | } |
3873 | |
3874 | if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->required_netagent_types[i].netagent_domain, parsed_parameters->required_netagent_types[i].netagent_type, FALSE)) { |
3875 | return (FALSE); |
3876 | } |
3877 | } |
3878 | } |
3879 | |
3880 | if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PROHIBITED_AGENT_TYPE) { |
3881 | for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) { |
3882 | if (strlen(parsed_parameters->prohibited_netagent_types[i].netagent_domain) == 0 && |
3883 | strlen(parsed_parameters->prohibited_netagent_types[i].netagent_type) == 0) { |
3884 | break; |
3885 | } |
3886 | |
3887 | if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->prohibited_netagent_types[i].netagent_domain, parsed_parameters->prohibited_netagent_types[i].netagent_type, TRUE)) { |
3888 | return (FALSE); |
3889 | } |
3890 | } |
3891 | } |
3892 | |
3893 | // Checked preferred properties |
3894 | if (preferred_count) { |
3895 | if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT) { |
3896 | for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) { |
3897 | if (uuid_is_null(parsed_parameters->preferred_netagents[i])) { |
3898 | break; |
3899 | } |
3900 | |
3901 | if (necp_ifnet_matches_agent(ifp, &parsed_parameters->preferred_netagents[i], TRUE)) { |
3902 | (*preferred_count)++; |
3903 | } |
3904 | } |
3905 | } |
3906 | |
3907 | if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_PREFERRED_AGENT_TYPE) { |
3908 | for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) { |
3909 | if (strlen(parsed_parameters->preferred_netagent_types[i].netagent_domain) == 0 && |
3910 | strlen(parsed_parameters->preferred_netagent_types[i].netagent_type) == 0) { |
3911 | break; |
3912 | } |
3913 | |
3914 | if (necp_ifnet_matches_agent_type(ifp, parsed_parameters->preferred_netagent_types[i].netagent_domain, parsed_parameters->preferred_netagent_types[i].netagent_type, TRUE)) { |
3915 | (*preferred_count)++; |
3916 | } |
3917 | } |
3918 | } |
3919 | |
3920 | if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT) { |
3921 | for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) { |
3922 | if (uuid_is_null(parsed_parameters->avoided_netagents[i])) { |
3923 | break; |
3924 | } |
3925 | |
3926 | if (!necp_ifnet_matches_agent(ifp, &parsed_parameters->avoided_netagents[i], TRUE)) { |
3927 | (*preferred_count)++; |
3928 | } |
3929 | } |
3930 | } |
3931 | |
3932 | if (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_AVOIDED_AGENT_TYPE) { |
3933 | for (int i = 0; i < NECP_MAX_PARSED_PARAMETERS; i++) { |
3934 | if (strlen(parsed_parameters->avoided_netagent_types[i].netagent_domain) == 0 && |
3935 | strlen(parsed_parameters->avoided_netagent_types[i].netagent_type) == 0) { |
3936 | break; |
3937 | } |
3938 | |
3939 | if (!necp_ifnet_matches_agent_type(ifp, parsed_parameters->avoided_netagent_types[i].netagent_domain, |
3940 | parsed_parameters->avoided_netagent_types[i].netagent_type, TRUE)) { |
3941 | (*preferred_count)++; |
3942 | } |
3943 | } |
3944 | } |
3945 | } |
3946 | |
3947 | return (TRUE); |
3948 | } |
3949 | |
3950 | static bool |
3951 | necp_find_matching_interface_index(struct necp_client_parsed_parameters *parsed_parameters, |
3952 | u_int *return_ifindex, bool *validate_agents) |
3953 | { |
3954 | struct ifnet *ifp = NULL; |
3955 | u_int32_t best_preferred_count = 0; |
3956 | bool has_preferred_fields = FALSE; |
3957 | *return_ifindex = 0; |
3958 | |
3959 | if (parsed_parameters->required_interface_index != 0) { |
3960 | *return_ifindex = parsed_parameters->required_interface_index; |
3961 | return (TRUE); |
3962 | } |
3963 | |
3964 | if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_INTERESTING_IFNET_FIELDS)) { |
3965 | return (TRUE); |
3966 | } |
3967 | |
3968 | has_preferred_fields = (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS); |
3969 | |
3970 | // We have interesting parameters to parse and find a matching interface |
3971 | ifnet_head_lock_shared(); |
3972 | |
3973 | if (!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS)) { |
3974 | // We do have fields to match, but they are only prohibitory |
3975 | // If the first interface in the list matches, or there are no ordered interfaces, we don't need to scope |
3976 | ifp = TAILQ_FIRST(&ifnet_ordered_head); |
3977 | if (ifp == NULL || necp_ifnet_matches_parameters(ifp, parsed_parameters, NULL, false)) { |
3978 | // Don't set return_ifindex, so the client doesn't need to scope |
3979 | ifnet_head_done(); |
3980 | return (TRUE); |
3981 | } |
3982 | } |
3983 | |
3984 | // First check the ordered interface list |
3985 | TAILQ_FOREACH(ifp, &ifnet_ordered_head, if_ordered_link) { |
3986 | u_int32_t preferred_count = 0; |
3987 | if (necp_ifnet_matches_parameters(ifp, parsed_parameters, &preferred_count, false)) { |
3988 | if (preferred_count > best_preferred_count || |
3989 | *return_ifindex == 0) { |
3990 | |
3991 | // Everything matched, and is most preferred. Return this interface. |
3992 | *return_ifindex = ifp->if_index; |
3993 | best_preferred_count = preferred_count; |
3994 | |
3995 | if (!has_preferred_fields) { |
3996 | break; |
3997 | } |
3998 | } |
3999 | } |
4000 | } |
4001 | |
4002 | // Then check the remaining interfaces |
4003 | if ((parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_FIELDS) && |
4004 | ((!(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_FIELD_REQUIRED_IFTYPE)) || |
4005 | !necp_interface_type_is_primary_eligible(parsed_parameters->required_interface_type)) && |
4006 | *return_ifindex == 0) { |
4007 | TAILQ_FOREACH(ifp, &ifnet_head, if_link) { |
4008 | u_int32_t preferred_count = 0; |
4009 | if (NECP_IFP_IS_ON_ORDERED_LIST(ifp)) { |
4010 | // This interface was in the ordered list, skip |
4011 | continue; |
4012 | } |
4013 | if (necp_ifnet_matches_parameters(ifp, parsed_parameters, &preferred_count, false)) { |
4014 | if (preferred_count > best_preferred_count || |
4015 | *return_ifindex == 0) { |
4016 | |
4017 | // Everything matched, and is most preferred. Return this interface. |
4018 | *return_ifindex = ifp->if_index; |
4019 | best_preferred_count = preferred_count; |
4020 | |
4021 | if (!has_preferred_fields) { |
4022 | break; |
4023 | } |
4024 | } |
4025 | } |
4026 | } |
4027 | } |
4028 | |
4029 | ifnet_head_done(); |
4030 | |
4031 | if ((parsed_parameters->valid_fields == (parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_PREFERRED_FIELDS)) && |
4032 | best_preferred_count == 0) { |
4033 | // If only has preferred fields, and nothing was found, clear the interface index and return TRUE |
4034 | *return_ifindex = 0; |
4035 | return (TRUE); |
4036 | } |
4037 | |
4038 | if (*return_ifindex == 0 && |
4039 | !(parsed_parameters->valid_fields & NECP_PARSED_PARAMETERS_SCOPED_IFNET_FIELDS)) { |
4040 | // Has required fields, but not including specific interface fields. Pass for now, and check |
4041 | // to see if agents are satisfied by policy. |
4042 | *validate_agents = TRUE; |
4043 | return (TRUE); |
4044 | } |
4045 | |
4046 | return (*return_ifindex != 0); |
4047 | } |
4048 | |
4049 | |
4050 | static int |
4051 | necp_skywalk_priv_check_cred(proc_t p, kauth_cred_t cred) |
4052 | { |
4053 | #pragma unused(p, cred) |
4054 | return (0); |
4055 | } |
4056 | |
4057 | /// System calls |
4058 | |
4059 | int |
4060 | necp_open(struct proc *p, struct necp_open_args *uap, int *retval) |
4061 | { |
4062 | #pragma unused(retval) |
4063 | int error = 0; |
4064 | struct necp_fd_data *fd_data = NULL; |
4065 | struct fileproc *fp = NULL; |
4066 | int fd = -1; |
4067 | |
4068 | if (uap->flags & NECP_OPEN_FLAG_OBSERVER || |
4069 | uap->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) { |
4070 | if (necp_skywalk_priv_check_cred(p, kauth_cred_get()) != 0 && |
4071 | priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NETWORK_STATISTICS, 0) != 0) { |
4072 | NECPLOG0(LOG_ERR, "Client does not hold necessary entitlement to observe other NECP clients" ); |
4073 | error = EACCES; |
4074 | goto done; |
4075 | } |
4076 | } |
4077 | |
4078 | error = falloc(p, &fp, &fd, vfs_context_current()); |
4079 | if (error != 0) { |
4080 | goto done; |
4081 | } |
4082 | |
4083 | if ((fd_data = zalloc(necp_client_fd_zone)) == NULL) { |
4084 | error = ENOMEM; |
4085 | goto done; |
4086 | } |
4087 | |
4088 | memset(fd_data, 0, sizeof(*fd_data)); |
4089 | |
4090 | fd_data->necp_fd_type = necp_fd_type_client; |
4091 | fd_data->flags = uap->flags; |
4092 | RB_INIT(&fd_data->clients); |
4093 | RB_INIT(&fd_data->flows); |
4094 | TAILQ_INIT(&fd_data->update_list); |
4095 | lck_mtx_init(&fd_data->fd_lock, necp_fd_mtx_grp, necp_fd_mtx_attr); |
4096 | klist_init(&fd_data->si.si_note); |
4097 | fd_data->proc_pid = proc_pid(p); |
4098 | |
4099 | fp->f_fglob->fg_flag = FREAD; |
4100 | fp->f_fglob->fg_ops = &necp_fd_ops; |
4101 | fp->f_fglob->fg_data = fd_data; |
4102 | |
4103 | proc_fdlock(p); |
4104 | |
4105 | *fdflags(p, fd) |= (UF_EXCLOSE | UF_FORKCLOSE); |
4106 | procfdtbl_releasefd(p, fd, NULL); |
4107 | fp_drop(p, fd, fp, 1); |
4108 | |
4109 | *retval = fd; |
4110 | |
4111 | if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) { |
4112 | NECP_OBSERVER_LIST_LOCK_EXCLUSIVE(); |
4113 | LIST_INSERT_HEAD(&necp_fd_observer_list, fd_data, chain); |
4114 | OSIncrementAtomic(&necp_observer_fd_count); |
4115 | NECP_OBSERVER_LIST_UNLOCK(); |
4116 | |
4117 | // Walk all existing clients and add them |
4118 | NECP_CLIENT_TREE_LOCK_SHARED(); |
4119 | struct necp_client *existing_client = NULL; |
4120 | RB_FOREACH(existing_client, _necp_client_global_tree, &necp_client_global_tree) { |
4121 | NECP_CLIENT_LOCK(existing_client); |
4122 | necp_client_update_observer_add_internal(fd_data, existing_client); |
4123 | necp_client_update_observer_update_internal(fd_data, existing_client); |
4124 | NECP_CLIENT_UNLOCK(existing_client); |
4125 | } |
4126 | NECP_CLIENT_TREE_UNLOCK(); |
4127 | } else { |
4128 | NECP_FD_LIST_LOCK_EXCLUSIVE(); |
4129 | LIST_INSERT_HEAD(&necp_fd_list, fd_data, chain); |
4130 | OSIncrementAtomic(&necp_client_fd_count); |
4131 | NECP_FD_LIST_UNLOCK(); |
4132 | } |
4133 | |
4134 | proc_fdunlock(p); |
4135 | |
4136 | done: |
4137 | if (error != 0) { |
4138 | if (fp != NULL) { |
4139 | fp_free(p, fd, fp); |
4140 | fp = NULL; |
4141 | } |
4142 | if (fd_data != NULL) { |
4143 | zfree(necp_client_fd_zone, fd_data); |
4144 | fd_data = NULL; |
4145 | } |
4146 | } |
4147 | |
4148 | return (error); |
4149 | } |
4150 | |
4151 | static int |
4152 | necp_client_add(struct proc *p, struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval) |
4153 | { |
4154 | int error = 0; |
4155 | struct necp_client *client = NULL; |
4156 | |
4157 | if (fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER) { |
4158 | NECPLOG0(LOG_ERR, "NECP client observers with push enabled may not add their own clients" ); |
4159 | return (EINVAL); |
4160 | } |
4161 | |
4162 | if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) || |
4163 | uap->buffer_size == 0 || uap->buffer_size > NECP_MAX_CLIENT_PARAMETERS_SIZE || uap->buffer == 0) { |
4164 | return (EINVAL); |
4165 | } |
4166 | |
4167 | if ((client = _MALLOC(sizeof(struct necp_client) + uap->buffer_size, M_NECP, |
4168 | M_WAITOK | M_ZERO)) == NULL) { |
4169 | error = ENOMEM; |
4170 | goto done; |
4171 | } |
4172 | |
4173 | error = copyin(uap->buffer, client->parameters, uap->buffer_size); |
4174 | if (error) { |
4175 | NECPLOG(LOG_ERR, "necp_client_add parameters copyin error (%d)" , error); |
4176 | goto done; |
4177 | } |
4178 | |
4179 | lck_mtx_init(&client->lock, necp_fd_mtx_grp, necp_fd_mtx_attr); |
4180 | lck_mtx_init(&client->route_lock, necp_fd_mtx_grp, necp_fd_mtx_attr); |
4181 | necp_client_retain(client); // Hold our reference until close |
4182 | |
4183 | client->parameters_length = uap->buffer_size; |
4184 | client->proc_pid = fd_data->proc_pid; // Save off proc pid in case the client will persist past fd |
4185 | client->agent_handle = (void *)fd_data; |
4186 | client->platform_binary = ((csproc_get_platform_binary(p) == 0) ? 0 : 1); |
4187 | |
4188 | necp_generate_client_id(client->client_id, false); |
4189 | LIST_INIT(&client->assertion_list); |
4190 | RB_INIT(&client->flow_registrations); |
4191 | |
4192 | error = copyout(client->client_id, uap->client_id, sizeof(uuid_t)); |
4193 | if (error) { |
4194 | NECPLOG(LOG_ERR, "necp_client_add client_id copyout error (%d)" , error); |
4195 | goto done; |
4196 | } |
4197 | |
4198 | necp_client_update_observer_add(client); |
4199 | |
4200 | NECP_FD_LOCK(fd_data); |
4201 | RB_INSERT(_necp_client_tree, &fd_data->clients, client); |
4202 | OSIncrementAtomic(&necp_client_count); |
4203 | NECP_CLIENT_TREE_LOCK_EXCLUSIVE(); |
4204 | RB_INSERT(_necp_client_global_tree, &necp_client_global_tree, client); |
4205 | NECP_CLIENT_TREE_UNLOCK(); |
4206 | |
4207 | // Prime the client result |
4208 | NECP_CLIENT_LOCK(client); |
4209 | (void)necp_update_client_result(current_proc(), fd_data, client, NULL); |
4210 | NECP_CLIENT_UNLOCK(client); |
4211 | NECP_FD_UNLOCK(fd_data); |
4212 | done: |
4213 | if (error != 0) { |
4214 | if (client != NULL) { |
4215 | FREE(client, M_NECP); |
4216 | client = NULL; |
4217 | } |
4218 | } |
4219 | *retval = error; |
4220 | |
4221 | return (error); |
4222 | } |
4223 | |
4224 | static int |
4225 | necp_client_remove(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval) |
4226 | { |
4227 | int error = 0; |
4228 | uuid_t client_id = {}; |
4229 | struct ifnet_stats_per_flow flow_ifnet_stats = {}; |
4230 | |
4231 | if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) { |
4232 | error = EINVAL; |
4233 | goto done; |
4234 | } |
4235 | |
4236 | error = copyin(uap->client_id, client_id, sizeof(uuid_t)); |
4237 | if (error) { |
4238 | NECPLOG(LOG_ERR, "necp_client_remove copyin client_id error (%d)" , error); |
4239 | goto done; |
4240 | } |
4241 | |
4242 | if (uap->buffer != 0 && uap->buffer_size == sizeof(flow_ifnet_stats)) { |
4243 | error = copyin(uap->buffer, &flow_ifnet_stats, uap->buffer_size); |
4244 | if (error) { |
4245 | NECPLOG(LOG_ERR, "necp_client_remove flow_ifnet_stats copyin error (%d)" , error); |
4246 | // Not fatal; make sure to zero-out stats in case of partial copy |
4247 | memset(&flow_ifnet_stats, 0, sizeof (flow_ifnet_stats)); |
4248 | error = 0; |
4249 | } |
4250 | } else if (uap->buffer != 0) { |
4251 | NECPLOG(LOG_ERR, "necp_client_remove unexpected parameters length (%zu)" , uap->buffer_size); |
4252 | } |
4253 | |
4254 | NECP_FD_LOCK(fd_data); |
4255 | |
4256 | pid_t pid = fd_data->proc_pid; |
4257 | struct necp_client *client = necp_client_fd_find_client_unlocked(fd_data, client_id); |
4258 | if (client != NULL) { |
4259 | // Remove any flow registrations that match |
4260 | struct necp_client_flow_registration *flow_registration = NULL; |
4261 | struct necp_client_flow_registration *temp_flow_registration = NULL; |
4262 | RB_FOREACH_SAFE(flow_registration, _necp_fd_flow_tree, &fd_data->flows, temp_flow_registration) { |
4263 | if (flow_registration->client == client) { |
4264 | NECP_FLOW_TREE_LOCK_EXCLUSIVE(); |
4265 | RB_REMOVE(_necp_client_flow_global_tree, &necp_client_flow_global_tree, flow_registration); |
4266 | NECP_FLOW_TREE_UNLOCK(); |
4267 | RB_REMOVE(_necp_fd_flow_tree, &fd_data->flows, flow_registration); |
4268 | } |
4269 | } |
4270 | // Remove client from lists |
4271 | NECP_CLIENT_TREE_LOCK_EXCLUSIVE(); |
4272 | RB_REMOVE(_necp_client_global_tree, &necp_client_global_tree, client); |
4273 | NECP_CLIENT_TREE_UNLOCK(); |
4274 | RB_REMOVE(_necp_client_tree, &fd_data->clients, client); |
4275 | } |
4276 | |
4277 | |
4278 | NECP_FD_UNLOCK(fd_data); |
4279 | |
4280 | if (client != NULL) { |
4281 | ASSERT(error == 0); |
4282 | necp_destroy_client(client, pid, true); |
4283 | } else { |
4284 | error = ENOENT; |
4285 | NECPLOG(LOG_ERR, "necp_client_remove invalid client_id (%d)" , error); |
4286 | } |
4287 | done: |
4288 | *retval = error; |
4289 | |
4290 | return (error); |
4291 | } |
4292 | |
4293 | |
4294 | static int |
4295 | necp_client_check_tcp_heuristics(struct necp_client *client, struct necp_client_flow *flow, u_int32_t *flags, u_int8_t *tfo_cookie, u_int8_t *tfo_cookie_len) |
4296 | { |
4297 | struct necp_client_parsed_parameters parsed_parameters; |
4298 | int error = 0; |
4299 | |
4300 | error = necp_client_parse_parameters(client->parameters, |
4301 | (u_int32_t)client->parameters_length, |
4302 | &parsed_parameters); |
4303 | if (error) { |
4304 | NECPLOG(LOG_ERR, "necp_client_parse_parameters error (%d)" , error); |
4305 | return (error); |
4306 | } |
4307 | |
4308 | if ((flow->remote_addr.sa.sa_family != AF_INET && |
4309 | flow->remote_addr.sa.sa_family != AF_INET6) || |
4310 | (flow->local_addr.sa.sa_family != AF_INET && |
4311 | flow->local_addr.sa.sa_family != AF_INET6)) { |
4312 | return (EINVAL); |
4313 | } |
4314 | |
4315 | NECP_CLIENT_ROUTE_LOCK(client); |
4316 | |
4317 | if (client->current_route == NULL) { |
4318 | error = ENOENT; |
4319 | goto do_unlock; |
4320 | } |
4321 | |
4322 | bool check_ecn = false; |
4323 | do { |
4324 | if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) == |
4325 | NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE) { |
4326 | check_ecn = true; |
4327 | break; |
4328 | } |
4329 | |
4330 | if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) == |
4331 | NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE) { |
4332 | break; |
4333 | } |
4334 | |
4335 | if (client->current_route != NULL) { |
4336 | if (client->current_route->rt_ifp->if_eflags & IFEF_ECN_ENABLE) { |
4337 | check_ecn = true; |
4338 | break; |
4339 | } |
4340 | if (client->current_route->rt_ifp->if_eflags & IFEF_ECN_DISABLE) { |
4341 | break; |
4342 | } |
4343 | } |
4344 | |
4345 | bool inbound = ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) == 0); |
4346 | if ((inbound && tcp_ecn_inbound == 1) || |
4347 | (!inbound && tcp_ecn_outbound == 1)) { |
4348 | check_ecn = true; |
4349 | } |
4350 | } while (false); |
4351 | |
4352 | if (check_ecn) { |
4353 | if (tcp_heuristic_do_ecn_with_address(client->current_route->rt_ifp, |
4354 | (union sockaddr_in_4_6 *)&flow->local_addr)) { |
4355 | *flags |= NECP_CLIENT_RESULT_FLAG_ECN_ENABLED; |
4356 | } |
4357 | } |
4358 | |
4359 | if ((parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) == |
4360 | NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE) { |
4361 | |
4362 | if (!tcp_heuristic_do_tfo_with_address(client->current_route->rt_ifp, |
4363 | (union sockaddr_in_4_6 *)&flow->local_addr, |
4364 | (union sockaddr_in_4_6 *)&flow->remote_addr, |
4365 | tfo_cookie, tfo_cookie_len)) { |
4366 | *flags |= NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED; |
4367 | *tfo_cookie_len = 0; |
4368 | } |
4369 | } else { |
4370 | *flags |= NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED; |
4371 | *tfo_cookie_len = 0; |
4372 | } |
4373 | do_unlock: |
4374 | NECP_CLIENT_ROUTE_UNLOCK(client); |
4375 | |
4376 | return (error); |
4377 | } |
4378 | |
4379 | static size_t |
4380 | necp_client_calculate_flow_tlv_size(struct necp_client_flow_registration *flow_registration) |
4381 | { |
4382 | size_t assigned_results_size = 0; |
4383 | struct necp_client_flow *flow = NULL; |
4384 | LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) { |
4385 | if (flow->assigned) { |
4386 | size_t = 0; |
4387 | if (flow->nexus) { |
4388 | header_length = sizeof(struct necp_client_nexus_flow_header); |
4389 | } else { |
4390 | header_length = sizeof(struct necp_client_flow_header); |
4391 | } |
4392 | assigned_results_size += (header_length + flow->assigned_results_length); |
4393 | |
4394 | if (flow->has_protoctl_event) { |
4395 | assigned_results_size += sizeof(struct necp_client_flow_protoctl_event_header); |
4396 | } |
4397 | } |
4398 | } |
4399 | return assigned_results_size; |
4400 | } |
4401 | |
4402 | static int |
4403 | necp_client_fillout_flow_tlvs(struct necp_client *client, |
4404 | bool client_is_observed, |
4405 | struct necp_client_flow_registration *flow_registration, |
4406 | struct necp_client_action_args *uap, |
4407 | size_t *assigned_results_cursor) |
4408 | { |
4409 | int error = 0; |
4410 | struct necp_client_flow *flow = NULL; |
4411 | LIST_FOREACH(flow, &flow_registration->flow_list, flow_chain) { |
4412 | if (flow->assigned) { |
4413 | // Write TLV headers |
4414 | struct necp_client_nexus_flow_header = {}; |
4415 | u_int32_t length = 0; |
4416 | u_int32_t flags = 0; |
4417 | u_int8_t tfo_cookie_len = 0; |
4418 | u_int8_t type = 0; |
4419 | |
4420 | type = NECP_CLIENT_RESULT_FLOW_ID; |
4421 | length = sizeof(header.flow_header.flow_id); |
4422 | memcpy(&header.flow_header.flow_id_tlv_header.type, &type, sizeof(type)); |
4423 | memcpy(&header.flow_header.flow_id_tlv_header.length, &length, sizeof(length)); |
4424 | uuid_copy(header.flow_header.flow_id, flow_registration->registration_id); |
4425 | |
4426 | if (flow->nexus) { |
4427 | if (flow->check_tcp_heuristics) { |
4428 | u_int8_t tfo_cookie[NECP_TFO_COOKIE_LEN_MAX]; |
4429 | tfo_cookie_len = NECP_TFO_COOKIE_LEN_MAX; |
4430 | |
4431 | if (necp_client_check_tcp_heuristics(client, flow, &flags, |
4432 | tfo_cookie, &tfo_cookie_len) != 0) { |
4433 | tfo_cookie_len = 0; |
4434 | } else { |
4435 | flow->check_tcp_heuristics = FALSE; |
4436 | |
4437 | if (tfo_cookie_len != 0) { |
4438 | type = NECP_CLIENT_RESULT_TFO_COOKIE; |
4439 | length = tfo_cookie_len; |
4440 | memcpy(&header.tfo_cookie_tlv_header.type, &type, sizeof(type)); |
4441 | memcpy(&header.tfo_cookie_tlv_header.length, &length, sizeof(length)); |
4442 | memcpy(&header.tfo_cookie_value, tfo_cookie, tfo_cookie_len); |
4443 | } |
4444 | } |
4445 | } |
4446 | } |
4447 | |
4448 | size_t = 0; |
4449 | if (flow->nexus) { |
4450 | if (tfo_cookie_len != 0) { |
4451 | header_length = sizeof(struct necp_client_nexus_flow_header) - (NECP_TFO_COOKIE_LEN_MAX - tfo_cookie_len); |
4452 | } else { |
4453 | header_length = sizeof(struct necp_client_nexus_flow_header) - sizeof(struct necp_tlv_header) - NECP_TFO_COOKIE_LEN_MAX; |
4454 | } |
4455 | } else { |
4456 | header_length = sizeof(struct necp_client_flow_header); |
4457 | } |
4458 | |
4459 | type = NECP_CLIENT_RESULT_FLAGS; |
4460 | length = sizeof(header.flow_header.flags_value); |
4461 | memcpy(&header.flow_header.flags_tlv_header.type, &type, sizeof(type)); |
4462 | memcpy(&header.flow_header.flags_tlv_header.length, &length, sizeof(length)); |
4463 | if (flow->assigned) { |
4464 | flags |= NECP_CLIENT_RESULT_FLAG_FLOW_ASSIGNED; |
4465 | } |
4466 | if (flow->viable) { |
4467 | flags |= NECP_CLIENT_RESULT_FLAG_FLOW_VIABLE; |
4468 | } |
4469 | if (flow_registration->defunct) { |
4470 | flags |= NECP_CLIENT_RESULT_FLAG_DEFUNCT; |
4471 | } |
4472 | flags |= flow->necp_flow_flags; |
4473 | memcpy(&header.flow_header.flags_value, &flags, sizeof(flags)); |
4474 | |
4475 | type = NECP_CLIENT_RESULT_INTERFACE; |
4476 | length = sizeof(header.flow_header.interface_value); |
4477 | memcpy(&header.flow_header.interface_tlv_header.type, &type, sizeof(type)); |
4478 | memcpy(&header.flow_header.interface_tlv_header.length, &length, sizeof(length)); |
4479 | |
4480 | struct necp_client_result_interface interface_struct; |
4481 | interface_struct.generation = 0; |
4482 | interface_struct.index = flow->interface_index; |
4483 | |
4484 | memcpy(&header.flow_header.interface_value, &interface_struct, sizeof(interface_struct)); |
4485 | if (flow->nexus) { |
4486 | type = NECP_CLIENT_RESULT_NETAGENT; |
4487 | length = sizeof(header.agent_value); |
4488 | memcpy(&header.agent_tlv_header.type, &type, sizeof(type)); |
4489 | memcpy(&header.agent_tlv_header.length, &length, sizeof(length)); |
4490 | |
4491 | struct necp_client_result_netagent agent_struct; |
4492 | agent_struct.generation = 0; |
4493 | uuid_copy(agent_struct.netagent_uuid, flow->u.nexus_agent); |
4494 | |
4495 | memcpy(&header.agent_value, &agent_struct, sizeof(agent_struct)); |
4496 | } |
4497 | |
4498 | // Don't include outer TLV header in length field |
4499 | type = NECP_CLIENT_RESULT_FLOW; |
4500 | length = (header_length - sizeof(struct necp_tlv_header) + flow->assigned_results_length); |
4501 | if (flow->has_protoctl_event) { |
4502 | length += sizeof(struct necp_client_flow_protoctl_event_header); |
4503 | } |
4504 | memcpy(&header.flow_header.outer_header.type, &type, sizeof(type)); |
4505 | memcpy(&header.flow_header.outer_header.length, &length, sizeof(length)); |
4506 | |
4507 | error = copyout(&header, uap->buffer + client->result_length + *assigned_results_cursor, header_length); |
4508 | if (error) { |
4509 | NECPLOG(LOG_ERR, "necp_client_copy assigned results tlv_header copyout error (%d)" , error); |
4510 | return (error); |
4511 | } |
4512 | *assigned_results_cursor += header_length; |
4513 | |
4514 | if (flow->assigned_results && flow->assigned_results_length) { |
4515 | // Write inner TLVs |
4516 | error = copyout(flow->assigned_results, uap->buffer + client->result_length + *assigned_results_cursor, |
4517 | flow->assigned_results_length); |
4518 | if (error) { |
4519 | NECPLOG(LOG_ERR, "necp_client_copy assigned results copyout error (%d)" , error); |
4520 | return (error); |
4521 | } |
4522 | } |
4523 | *assigned_results_cursor += flow->assigned_results_length; |
4524 | |
4525 | /* Read the protocol event and reset it */ |
4526 | if (flow->has_protoctl_event) { |
4527 | struct necp_client_flow_protoctl_event_header = {}; |
4528 | |
4529 | type = NECP_CLIENT_RESULT_PROTO_CTL_EVENT; |
4530 | length = sizeof(protoctl_event_header.protoctl_event); |
4531 | |
4532 | memcpy(&protoctl_event_header.protoctl_tlv_header.type, &type, sizeof(type)); |
4533 | memcpy(&protoctl_event_header.protoctl_tlv_header.length, &length, sizeof(length)); |
4534 | memcpy(&protoctl_event_header.protoctl_event, &flow->protoctl_event, |
4535 | sizeof(flow->protoctl_event)); |
4536 | |
4537 | error = copyout(&protoctl_event_header, uap->buffer + client->result_length + *assigned_results_cursor, |
4538 | sizeof(protoctl_event_header)); |
4539 | |
4540 | if (error) { |
4541 | NECPLOG(LOG_ERR, "necp_client_copy protocol control event results" |
4542 | " tlv_header copyout error (%d)" , error); |
4543 | return (error); |
4544 | } |
4545 | *assigned_results_cursor += sizeof(protoctl_event_header); |
4546 | flow->has_protoctl_event = FALSE; |
4547 | flow->protoctl_event.protoctl_event_code = 0; |
4548 | flow->protoctl_event.protoctl_event_val = 0; |
4549 | flow->protoctl_event.protoctl_event_tcp_seq_num = 0; |
4550 | } |
4551 | } |
4552 | } |
4553 | if (!client_is_observed) { |
4554 | flow_registration->flow_result_read = TRUE; |
4555 | } |
4556 | return (0); |
4557 | } |
4558 | |
4559 | static int |
4560 | necp_client_copy_internal(struct necp_client *client, uuid_t client_id, bool client_is_observed, struct necp_client_action_args *uap, int *retval) |
4561 | { |
4562 | NECP_CLIENT_ASSERT_LOCKED(client); |
4563 | int error = 0; |
4564 | // Copy results out |
4565 | if (uap->action == NECP_CLIENT_ACTION_COPY_PARAMETERS) { |
4566 | if (uap->buffer_size < client->parameters_length) { |
4567 | return (EINVAL); |
4568 | } |
4569 | error = copyout(client->parameters, uap->buffer, client->parameters_length); |
4570 | if (error) { |
4571 | NECPLOG(LOG_ERR, "necp_client_copy parameters copyout error (%d)" , error); |
4572 | return (error); |
4573 | } |
4574 | *retval = client->parameters_length; |
4575 | } else if (uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT && |
4576 | client->result_read && !necp_client_has_unread_flows(client)) { |
4577 | // Copy updates only, but nothing to read |
4578 | // Just return 0 for bytes read |
4579 | *retval = 0; |
4580 | } else if (uap->action == NECP_CLIENT_ACTION_COPY_RESULT || |
4581 | uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) { |
4582 | size_t assigned_results_size = 0; |
4583 | |
4584 | bool some_flow_is_defunct = false; |
4585 | struct necp_client_flow_registration *single_flow_registration = NULL; |
4586 | if (necp_client_id_is_flow(client_id)) { |
4587 | single_flow_registration = necp_client_find_flow(client, client_id); |
4588 | if (single_flow_registration != NULL) { |
4589 | assigned_results_size += necp_client_calculate_flow_tlv_size(single_flow_registration); |
4590 | } |
4591 | } else { |
4592 | // This request is for the client, so copy everything |
4593 | struct necp_client_flow_registration *flow_registration = NULL; |
4594 | RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) { |
4595 | if (flow_registration->defunct) { |
4596 | some_flow_is_defunct = true; |
4597 | } |
4598 | assigned_results_size += necp_client_calculate_flow_tlv_size(flow_registration); |
4599 | } |
4600 | } |
4601 | if (uap->buffer_size < (client->result_length + assigned_results_size)) { |
4602 | return (EINVAL); |
4603 | } |
4604 | |
4605 | u_int32_t original_flags = 0; |
4606 | bool flags_updated = false; |
4607 | if (some_flow_is_defunct && client->legacy_client_is_flow) { |
4608 | // If our client expects the defunct flag in the client, add it now |
4609 | u_int32_t client_flags = 0; |
4610 | u_int32_t value_size = 0; |
4611 | u_int8_t *flags_pointer = necp_buffer_get_tlv_value(client->result, 0, &value_size); |
4612 | if (flags_pointer != NULL && value_size == sizeof(client_flags)) { |
4613 | memcpy(&client_flags, flags_pointer, value_size); |
4614 | original_flags = client_flags; |
4615 | client_flags |= NECP_CLIENT_RESULT_FLAG_DEFUNCT; |
4616 | (void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS, |
4617 | sizeof(client_flags), &client_flags, &flags_updated, |
4618 | client->result, sizeof(client->result)); |
4619 | } |
4620 | } |
4621 | |
4622 | error = copyout(client->result, uap->buffer, client->result_length); |
4623 | |
4624 | if (flags_updated) { |
4625 | // Revert stored flags |
4626 | (void)necp_buffer_write_tlv_if_different(client->result, NECP_CLIENT_RESULT_FLAGS, |
4627 | sizeof(original_flags), &original_flags, &flags_updated, |
4628 | client->result, sizeof(client->result)); |
4629 | } |
4630 | |
4631 | if (error) { |
4632 | NECPLOG(LOG_ERR, "necp_client_copy result copyout error (%d)" , error); |
4633 | return (error); |
4634 | } |
4635 | |
4636 | size_t assigned_results_cursor = 0; |
4637 | if (necp_client_id_is_flow(client_id)) { |
4638 | if (single_flow_registration != NULL) { |
4639 | error = necp_client_fillout_flow_tlvs(client, client_is_observed, single_flow_registration, uap, &assigned_results_cursor); |
4640 | if (error != 0) { |
4641 | return (error); |
4642 | } |
4643 | } |
4644 | } else { |
4645 | // This request is for the client, so copy everything |
4646 | struct necp_client_flow_registration *flow_registration = NULL; |
4647 | RB_FOREACH(flow_registration, _necp_client_flow_tree, &client->flow_registrations) { |
4648 | error = necp_client_fillout_flow_tlvs(client, client_is_observed, flow_registration, uap, &assigned_results_cursor); |
4649 | if (error != 0) { |
4650 | return (error); |
4651 | } |
4652 | } |
4653 | } |
4654 | |
4655 | *retval = client->result_length + assigned_results_cursor; |
4656 | |
4657 | if (!client_is_observed) { |
4658 | client->result_read = TRUE; |
4659 | } |
4660 | } |
4661 | |
4662 | return (0); |
4663 | } |
4664 | |
4665 | static int |
4666 | necp_client_copy(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval) |
4667 | { |
4668 | int error = 0; |
4669 | struct necp_client *client = NULL; |
4670 | uuid_t client_id; |
4671 | uuid_clear(client_id); |
4672 | |
4673 | *retval = 0; |
4674 | |
4675 | if (uap->buffer_size == 0 || uap->buffer == 0) { |
4676 | return (EINVAL); |
4677 | } |
4678 | |
4679 | if (uap->action != NECP_CLIENT_ACTION_COPY_PARAMETERS && |
4680 | uap->action != NECP_CLIENT_ACTION_COPY_RESULT && |
4681 | uap->action != NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) { |
4682 | return (EINVAL); |
4683 | } |
4684 | |
4685 | if (uap->client_id) { |
4686 | if (uap->client_id_len != sizeof(uuid_t)) { |
4687 | NECPLOG(LOG_ERR, "Incorrect length (got %d, expected %d)" , uap->client_id_len, sizeof(uuid_t)); |
4688 | return (ERANGE); |
4689 | } |
4690 | |
4691 | error = copyin(uap->client_id, client_id, sizeof(uuid_t)); |
4692 | if (error) { |
4693 | NECPLOG(LOG_ERR, "necp_client_copy client_id copyin error (%d)" , error); |
4694 | return (error); |
4695 | } |
4696 | } |
4697 | |
4698 | const bool is_wildcard = (bool)uuid_is_null(client_id); |
4699 | |
4700 | NECP_FD_LOCK(fd_data); |
4701 | |
4702 | if (is_wildcard) { |
4703 | if (uap->action == NECP_CLIENT_ACTION_COPY_RESULT || uap->action == NECP_CLIENT_ACTION_COPY_UPDATED_RESULT) { |
4704 | struct necp_client *find_client = NULL; |
4705 | RB_FOREACH(find_client, _necp_client_tree, &fd_data->clients) { |
4706 | NECP_CLIENT_LOCK(find_client); |
4707 | if (!find_client->result_read || necp_client_has_unread_flows(find_client)) { |
4708 | client = find_client; |
4709 | // Leave the client locked, and break |
4710 | break; |
4711 | } |
4712 | NECP_CLIENT_UNLOCK(find_client); |
4713 | } |
4714 | } |
4715 | } else { |
4716 | client = necp_client_fd_find_client_and_lock(fd_data, client_id); |
4717 | } |
4718 | |
4719 | if (client != NULL) { |
4720 | // If client is set, it is locked |
4721 | error = necp_client_copy_internal(client, client_id, FALSE, uap, retval); |
4722 | NECP_CLIENT_UNLOCK(client); |
4723 | } |
4724 | |
4725 | // Unlock our own fd before moving on or returning |
4726 | NECP_FD_UNLOCK(fd_data); |
4727 | |
4728 | if (client == NULL) { |
4729 | if (fd_data->flags & NECP_OPEN_FLAG_OBSERVER) { |
4730 | // Observers are allowed to lookup clients on other fds |
4731 | |
4732 | // Lock tree |
4733 | NECP_CLIENT_TREE_LOCK_SHARED(); |
4734 | |
4735 | bool found_client = FALSE; |
4736 | |
4737 | client = necp_find_client_and_lock(client_id); |
4738 | if (client != NULL) { |
4739 | // Matched, copy out data |
4740 | found_client = TRUE; |
4741 | error = necp_client_copy_internal(client, client_id, TRUE, uap, retval); |
4742 | NECP_CLIENT_UNLOCK(client); |
4743 | } |
4744 | |
4745 | // Unlock tree |
4746 | NECP_CLIENT_TREE_UNLOCK(); |
4747 | |
4748 | // No client found, fail |
4749 | if (!found_client) { |
4750 | return (ENOENT); |
4751 | } |
4752 | } else { |
4753 | // No client found, and not allowed to search other fds, fail |
4754 | return (ENOENT); |
4755 | } |
4756 | } |
4757 | |
4758 | return (error); |
4759 | } |
4760 | |
4761 | static int |
4762 | necp_client_copy_client_update(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval) |
4763 | { |
4764 | int error = 0; |
4765 | |
4766 | *retval = 0; |
4767 | |
4768 | if (!(fd_data->flags & NECP_OPEN_FLAG_PUSH_OBSERVER)) { |
4769 | NECPLOG0(LOG_ERR, "NECP fd is not observer, cannot copy client update" ); |
4770 | return (EINVAL); |
4771 | } |
4772 | |
4773 | if (uap->client_id_len != sizeof(uuid_t) || uap->client_id == 0) { |
4774 | NECPLOG0(LOG_ERR, "Client id invalid, cannot copy client update" ); |
4775 | return (EINVAL); |
4776 | } |
4777 | |
4778 | if (uap->buffer_size == 0 || uap->buffer == 0) { |
4779 | NECPLOG0(LOG_ERR, "Buffer invalid, cannot copy client update" ); |
4780 | return (EINVAL); |
4781 | } |
4782 | |
4783 | NECP_FD_LOCK(fd_data); |
4784 | struct necp_client_update *client_update = TAILQ_FIRST(&fd_data->update_list); |
4785 | if (client_update != NULL) { |
4786 | TAILQ_REMOVE(&fd_data->update_list, client_update, chain); |
4787 | VERIFY(fd_data->update_count > 0); |
4788 | fd_data->update_count--; |
4789 | } |
4790 | NECP_FD_UNLOCK(fd_data); |
4791 | |
4792 | if (client_update != NULL) { |
4793 | error = copyout(client_update->client_id, uap->client_id, sizeof(uuid_t)); |
4794 | if (error) { |
4795 | NECPLOG(LOG_ERR, "Copy client update copyout client id error (%d)" , error); |
4796 | } else { |
4797 | if (uap->buffer_size < client_update->update_length) { |
4798 | NECPLOG(LOG_ERR, "Buffer size cannot hold update (%zu < %zu)" , uap->buffer_size, client_update->update_length); |
4799 | error = EINVAL; |
4800 | } else { |
4801 | error = copyout(&client_update->update, uap->buffer, client_update->update_length); |
4802 | if (error) { |
4803 | NECPLOG(LOG_ERR, "Copy client update copyout error (%d)" , error); |
4804 | } else { |
4805 | *retval = client_update->update_length; |
4806 | } |
4807 | } |
4808 | } |
4809 | |
4810 | FREE(client_update, M_NECP); |
4811 | client_update = NULL; |
4812 | } else { |
4813 | error = ENOENT; |
4814 | } |
4815 | |
4816 | return (error); |
4817 | } |
4818 | |
4819 | static int |
4820 | necp_client_copy_parameters_locked(struct necp_client *client, |
4821 | struct necp_client_nexus_parameters *parameters) |
4822 | { |
4823 | VERIFY(parameters != NULL); |
4824 | |
4825 | struct necp_client_parsed_parameters parsed_parameters = {}; |
4826 | int error = necp_client_parse_parameters(client->parameters, (u_int32_t)client->parameters_length, &parsed_parameters); |
4827 | |
4828 | parameters->pid = client->proc_pid; |
4829 | if (parsed_parameters.valid_fields & NECP_PARSED_PARAMETERS_FIELD_EFFECTIVE_PID) { |
4830 | parameters->epid = parsed_parameters.effective_pid; |
4831 | } else { |
4832 | parameters->epid = parameters->pid; |
4833 | } |
4834 | memcpy(¶meters->local_addr, &parsed_parameters.local_addr, sizeof(parameters->local_addr)); |
4835 | memcpy(¶meters->remote_addr, &parsed_parameters.remote_addr, sizeof(parameters->remote_addr)); |
4836 | parameters->ip_protocol = parsed_parameters.ip_protocol; |
4837 | parameters->traffic_class = parsed_parameters.traffic_class; |
4838 | uuid_copy(parameters->euuid, parsed_parameters.effective_uuid); |
4839 | parameters->is_listener = (parsed_parameters.flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) ? 1 : 0; |
4840 | parameters->policy_id = client->policy_id; |
4841 | |
4842 | // parse client result flag |
4843 | u_int32_t client_result_flags = 0; |
4844 | u_int32_t value_size = 0; |
4845 | u_int8_t *flags_pointer = NULL; |
4846 | flags_pointer = necp_buffer_get_tlv_value(client->result, 0, &value_size); |
4847 | if (flags_pointer && value_size == sizeof(client_result_flags)) { |
4848 | memcpy(&client_result_flags, flags_pointer, value_size); |
4849 | } |
4850 | parameters->allow_qos_marking = (client_result_flags & NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING) ? 1 : 0; |
4851 | |
4852 | return (error); |
4853 | } |
4854 | |
4855 | static int |
4856 | necp_client_list(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval) |
4857 | { |
4858 | int error = 0; |
4859 | struct necp_client *find_client = NULL; |
4860 | uuid_t *list = NULL; |
4861 | u_int32_t requested_client_count = 0; |
4862 | u_int32_t client_count = 0; |
4863 | size_t copy_buffer_size = 0; |
4864 | |
4865 | if (uap->buffer_size < sizeof(requested_client_count) || uap->buffer == 0) { |
4866 | error = EINVAL; |
4867 | goto done; |
4868 | } |
4869 | |
4870 | if (!(fd_data->flags & NECP_OPEN_FLAG_OBSERVER)) { |
4871 | NECPLOG0(LOG_ERR, "Client does not hold necessary entitlement to list other NECP clients" ); |
4872 | error = EACCES; |
4873 | goto done; |
4874 | } |
4875 | |
4876 | error = copyin(uap->buffer, &requested_client_count, sizeof(requested_client_count)); |
4877 | if (error) { |
4878 | goto done; |
4879 | } |
4880 | |
4881 | if (os_mul_overflow(sizeof(uuid_t), requested_client_count, ©_buffer_size)) { |
4882 | error = ERANGE; |
4883 | goto done; |
4884 | } |
4885 | |
4886 | if (uap->buffer_size - sizeof(requested_client_count) != copy_buffer_size) { |
4887 | error = EINVAL; |
4888 | goto done; |
4889 | } |
4890 | |
4891 | if (copy_buffer_size > NECP_MAX_CLIENT_LIST_SIZE) { |
4892 | error = EINVAL; |
4893 | goto done; |
4894 | } |
4895 | |
4896 | if (requested_client_count > 0) { |
4897 | if ((list = _MALLOC(copy_buffer_size, M_NECP, M_WAITOK | M_ZERO)) == NULL) { |
4898 | error = ENOMEM; |
4899 | goto done; |
4900 | } |
4901 | } |
4902 | |
4903 | // Lock tree |
4904 | NECP_CLIENT_TREE_LOCK_SHARED(); |
4905 | |
4906 | find_client = NULL; |
4907 | RB_FOREACH(find_client, _necp_client_global_tree, &necp_client_global_tree) { |
4908 | NECP_CLIENT_LOCK(find_client); |
4909 | if (!uuid_is_null(find_client->client_id)) { |
4910 | if (client_count < requested_client_count) { |
4911 | uuid_copy(list[client_count], find_client->client_id); |
4912 | } |
4913 | client_count++; |
4914 | } |
4915 | NECP_CLIENT_UNLOCK(find_client); |
4916 | } |
4917 | |
4918 | // Unlock tree |
4919 | NECP_CLIENT_TREE_UNLOCK(); |
4920 | |
4921 | error = copyout(&client_count, uap->buffer, sizeof(client_count)); |
4922 | if (error) { |
4923 | NECPLOG(LOG_ERR, "necp_client_list buffer copyout error (%d)" , error); |
4924 | goto done; |
4925 | } |
4926 | |
4927 | if (requested_client_count > 0 && |
4928 | client_count > 0 && |
4929 | list != NULL) { |
4930 | error = copyout(list, uap->buffer + sizeof(client_count), copy_buffer_size); |
4931 | if (error) { |
4932 | NECPLOG(LOG_ERR, "necp_client_list client count copyout error (%d)" , error); |
4933 | goto done; |
4934 | } |
4935 | } |
4936 | done: |
4937 | if (list != NULL) { |
4938 | FREE(list, M_NECP); |
4939 | } |
4940 | *retval = error; |
4941 | |
4942 | return (error); |
4943 | } |
4944 | |
4945 | |
4946 | static void |
4947 | necp_client_add_assertion(struct necp_client *client, uuid_t netagent_uuid) |
4948 | { |
4949 | struct necp_client_assertion *new_assertion = NULL; |
4950 | |
4951 | MALLOC(new_assertion, struct necp_client_assertion *, sizeof(*new_assertion), M_NECP, M_WAITOK); |
4952 | if (new_assertion == NULL) { |
4953 | NECPLOG0(LOG_ERR, "Failed to allocate assertion" ); |
4954 | return; |
4955 | } |
4956 | |
4957 | uuid_copy(new_assertion->asserted_netagent, netagent_uuid); |
4958 | |
4959 | LIST_INSERT_HEAD(&client->assertion_list, new_assertion, assertion_chain); |
4960 | } |
4961 | |
4962 | static bool |
4963 | necp_client_remove_assertion(struct necp_client *client, uuid_t netagent_uuid) |
4964 | { |
4965 | struct necp_client_assertion *found_assertion = NULL; |
4966 | struct necp_client_assertion *search_assertion = NULL; |
4967 | LIST_FOREACH(search_assertion, &client->assertion_list, assertion_chain) { |
4968 | if (uuid_compare(search_assertion->asserted_netagent, netagent_uuid) == 0) { |
4969 | found_assertion = search_assertion; |
4970 | break; |
4971 | } |
4972 | } |
4973 | |
4974 | if (found_assertion == NULL) { |
4975 | NECPLOG0(LOG_ERR, "Netagent uuid not previously asserted" ); |
4976 | return false; |
4977 | } |
4978 | |
4979 | LIST_REMOVE(found_assertion, assertion_chain); |
4980 | FREE(found_assertion, M_NECP); |
4981 | return true; |
4982 | } |
4983 | |
4984 | static int |
4985 | necp_client_agent_action(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval) |
4986 | { |
4987 | int error = 0; |
4988 | struct necp_client *client = NULL; |
4989 | uuid_t client_id; |
4990 | bool acted_on_agent = FALSE; |
4991 | u_int8_t *parameters = NULL; |
4992 | size_t parameters_size = uap->buffer_size; |
4993 | |
4994 | if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) || |
4995 | uap->buffer_size == 0 || uap->buffer == 0) { |
4996 | NECPLOG0(LOG_ERR, "necp_client_agent_action invalid parameters" ); |
4997 | error = EINVAL; |
4998 | goto done; |
4999 | } |
5000 | |
5001 | error = copyin(uap->client_id, client_id, sizeof(uuid_t)); |
5002 | if (error) { |
5003 | NECPLOG(LOG_ERR, "necp_client_agent_action copyin client_id error (%d)" , error); |
5004 | goto done; |
5005 | } |
5006 | |
5007 | if (uap->buffer_size > NECP_MAX_AGENT_ACTION_SIZE) { |
5008 | NECPLOG(LOG_ERR, "necp_client_agent_action invalid buffer size (>%u)" , NECP_MAX_AGENT_ACTION_SIZE); |
5009 | error = EINVAL; |
5010 | goto done; |
5011 | } |
5012 | |
5013 | if ((parameters = _MALLOC(uap->buffer_size, M_NECP, M_WAITOK | M_ZERO)) == NULL) { |
5014 | NECPLOG0(LOG_ERR, "necp_client_agent_action malloc failed" ); |
5015 | error = ENOMEM; |
5016 | goto done; |
5017 | } |
5018 | |
5019 | error = copyin(uap->buffer, parameters, uap->buffer_size); |
5020 | if (error) { |
5021 | NECPLOG(LOG_ERR, "necp_client_agent_action parameters copyin error (%d)" , error); |
5022 | goto done; |
5023 | } |
5024 | |
5025 | NECP_FD_LOCK(fd_data); |
5026 | client = necp_client_fd_find_client_and_lock(fd_data, client_id); |
5027 | if (client != NULL) { |
5028 | size_t offset = 0; |
5029 | while ((offset + sizeof(struct necp_tlv_header)) <= parameters_size) { |
5030 | u_int8_t type = necp_buffer_get_tlv_type(parameters, offset); |
5031 | u_int32_t length = necp_buffer_get_tlv_length(parameters, offset); |
5032 | |
5033 | if (length > (parameters_size - (offset + sizeof(struct necp_tlv_header)))) { |
5034 | // If the length is larger than what can fit in the remaining parameters size, bail |
5035 | NECPLOG(LOG_ERR, "Invalid TLV length (%u)" , length); |
5036 | break; |
5037 | } |
5038 | |
5039 | if (length > 0) { |
5040 | u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL); |
5041 | if (length >= sizeof(uuid_t) && |
5042 | value != NULL && |
5043 | (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT || |
5044 | type == NECP_CLIENT_PARAMETER_ASSERT_AGENT || |
5045 | type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT)) { |
5046 | |
5047 | uuid_t agent_uuid; |
5048 | uuid_copy(agent_uuid, value); |
5049 | u_int8_t netagent_message_type = 0; |
5050 | if (type == NECP_CLIENT_PARAMETER_TRIGGER_AGENT) { |
5051 | netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_TRIGGER; |
5052 | } else if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) { |
5053 | netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_ASSERT; |
5054 | } else if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) { |
5055 | netagent_message_type = NETAGENT_MESSAGE_TYPE_CLIENT_UNASSERT; |
5056 | } |
5057 | |
5058 | // Before unasserting, verify that the assertion was already taken |
5059 | if (type == NECP_CLIENT_PARAMETER_UNASSERT_AGENT) { |
5060 | if (!necp_client_remove_assertion(client, agent_uuid)) { |
5061 | error = ENOENT; |
5062 | break; |
5063 | } |
5064 | } |
5065 | |
5066 | struct necp_client_nexus_parameters parsed_parameters = {}; |
5067 | necp_client_copy_parameters_locked(client, &parsed_parameters); |
5068 | |
5069 | error = netagent_client_message_with_params(agent_uuid, |
5070 | client_id, |
5071 | fd_data->proc_pid, |
5072 | client->agent_handle, |
5073 | netagent_message_type, |
5074 | &parsed_parameters, |
5075 | NULL, NULL); |
5076 | if (error == 0) { |
5077 | acted_on_agent = TRUE; |
5078 | } else { |
5079 | break; |
5080 | } |
5081 | |
5082 | // Only save the assertion if the action succeeded |
5083 | if (type == NECP_CLIENT_PARAMETER_ASSERT_AGENT) { |
5084 | necp_client_add_assertion(client, agent_uuid); |
5085 | } |
5086 | } |
5087 | } |
5088 | |
5089 | offset += sizeof(struct necp_tlv_header) + length; |
5090 | } |
5091 | |
5092 | NECP_CLIENT_UNLOCK(client); |
5093 | } |
5094 | NECP_FD_UNLOCK(fd_data); |
5095 | |
5096 | if (!acted_on_agent && |
5097 | error == 0) { |
5098 | error = ENOENT; |
5099 | } |
5100 | done: |
5101 | *retval = error; |
5102 | if (parameters != NULL) { |
5103 | FREE(parameters, M_NECP); |
5104 | parameters = NULL; |
5105 | } |
5106 | |
5107 | return (error); |
5108 | } |
5109 | |
5110 | static int |
5111 | necp_client_copy_agent(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval) |
5112 | { |
5113 | int error = 0; |
5114 | uuid_t agent_uuid; |
5115 | |
5116 | if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) || |
5117 | uap->buffer_size == 0 || uap->buffer == 0) { |
5118 | NECPLOG0(LOG_ERR, "necp_client_copy_agent bad input" ); |
5119 | error = EINVAL; |
5120 | goto done; |
5121 | } |
5122 | |
5123 | error = copyin(uap->client_id, agent_uuid, sizeof(uuid_t)); |
5124 | if (error) { |
5125 | NECPLOG(LOG_ERR, "necp_client_copy_agent copyin agent_uuid error (%d)" , error); |
5126 | goto done; |
5127 | } |
5128 | |
5129 | error = netagent_copyout(agent_uuid, uap->buffer, uap->buffer_size); |
5130 | if (error) { |
5131 | // netagent_copyout already logs appropriate errors |
5132 | goto done; |
5133 | } |
5134 | done: |
5135 | *retval = error; |
5136 | |
5137 | return (error); |
5138 | } |
5139 | |
5140 | static int |
5141 | necp_client_agent_use(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval) |
5142 | { |
5143 | int error = 0; |
5144 | struct necp_client *client = NULL; |
5145 | uuid_t client_id; |
5146 | struct necp_agent_use_parameters parameters; |
5147 | |
5148 | if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) || |
5149 | uap->buffer_size != sizeof(parameters) || uap->buffer == 0) { |
5150 | error = EINVAL; |
5151 | goto done; |
5152 | } |
5153 | |
5154 | error = copyin(uap->client_id, client_id, sizeof(uuid_t)); |
5155 | if (error) { |
5156 | NECPLOG(LOG_ERR, "Copyin client_id error (%d)" , error); |
5157 | goto done; |
5158 | } |
5159 | |
5160 | error = copyin(uap->buffer, ¶meters, uap->buffer_size); |
5161 | if (error) { |
5162 | NECPLOG(LOG_ERR, "Parameters copyin error (%d)" , error); |
5163 | goto done; |
5164 | } |
5165 | |
5166 | NECP_FD_LOCK(fd_data); |
5167 | client = necp_client_fd_find_client_and_lock(fd_data, client_id); |
5168 | if (client != NULL) { |
5169 | error = netagent_use(parameters.agent_uuid, ¶meters.out_use_count); |
5170 | NECP_CLIENT_UNLOCK(client); |
5171 | } else { |
5172 | error = ENOENT; |
5173 | } |
5174 | |
5175 | NECP_FD_UNLOCK(fd_data); |
5176 | |
5177 | if (error == 0) { |
5178 | error = copyout(¶meters, uap->buffer, uap->buffer_size); |
5179 | if (error) { |
5180 | NECPLOG(LOG_ERR, "Parameters copyout error (%d)" , error); |
5181 | goto done; |
5182 | } |
5183 | } |
5184 | |
5185 | done: |
5186 | *retval = error; |
5187 | |
5188 | return (error); |
5189 | } |
5190 | |
5191 | static int |
5192 | necp_client_copy_interface(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval) |
5193 | { |
5194 | int error = 0; |
5195 | u_int32_t interface_index = 0; |
5196 | struct necp_interface_details interface_details; |
5197 | |
5198 | if (uap->client_id == 0 || uap->client_id_len != sizeof(u_int32_t) || |
5199 | uap->buffer_size < sizeof(interface_details) || uap->buffer == 0) { |
5200 | NECPLOG0(LOG_ERR, "necp_client_copy_interface bad input" ); |
5201 | error = EINVAL; |
5202 | goto done; |
5203 | } |
5204 | |
5205 | error = copyin(uap->client_id, &interface_index, sizeof(u_int32_t)); |
5206 | if (error) { |
5207 | NECPLOG(LOG_ERR, "necp_client_copy_interface copyin interface_index error (%d)" , error); |
5208 | goto done; |
5209 | } |
5210 | |
5211 | if (interface_index == 0) { |
5212 | error = ENOENT; |
5213 | NECPLOG(LOG_ERR, "necp_client_copy_interface bad interface_index (%d)" , interface_index); |
5214 | goto done; |
5215 | } |
5216 | |
5217 | memset(&interface_details, 0, sizeof(interface_details)); |
5218 | |
5219 | ifnet_head_lock_shared(); |
5220 | ifnet_t interface = NULL; |
5221 | if (interface_index != IFSCOPE_NONE && interface_index <= (u_int32_t)if_index) { |
5222 | interface = ifindex2ifnet[interface_index]; |
5223 | } |
5224 | |
5225 | if (interface != NULL) { |
5226 | if (interface->if_xname != NULL) { |
5227 | strlcpy((char *)&interface_details.name, interface->if_xname, sizeof(interface_details.name)); |
5228 | } |
5229 | interface_details.index = interface->if_index; |
5230 | interface_details.generation = ifnet_get_generation(interface); |
5231 | if (interface->if_delegated.ifp != NULL) { |
5232 | interface_details.delegate_index = interface->if_delegated.ifp->if_index; |
5233 | } |
5234 | interface_details.functional_type = if_functional_type(interface, TRUE); |
5235 | if (IFNET_IS_EXPENSIVE(interface)) { |
5236 | interface_details.flags |= NECP_INTERFACE_FLAG_EXPENSIVE; |
5237 | } |
5238 | if ((interface->if_eflags & IFEF_TXSTART) == IFEF_TXSTART) { |
5239 | interface_details.flags |= NECP_INTERFACE_FLAG_TXSTART; |
5240 | } |
5241 | if ((interface->if_eflags & IFEF_NOACKPRI) == IFEF_NOACKPRI) { |
5242 | interface_details.flags |= NECP_INTERFACE_FLAG_NOACKPRI; |
5243 | } |
5244 | if ((interface->if_eflags & IFEF_3CA) == IFEF_3CA) { |
5245 | interface_details.flags |= NECP_INTERFACE_FLAG_3CARRIERAGG; |
5246 | } |
5247 | if (IFNET_IS_LOW_POWER(interface)) { |
5248 | interface_details.flags |= NECP_INTERFACE_FLAG_IS_LOW_POWER; |
5249 | } |
5250 | interface_details.mtu = interface->if_mtu; |
5251 | |
5252 | u_int8_t ipv4_signature_len = sizeof(interface_details.ipv4_signature.signature); |
5253 | u_int16_t ipv4_signature_flags; |
5254 | if (ifnet_get_netsignature(interface, AF_INET, &ipv4_signature_len, &ipv4_signature_flags, |
5255 | (u_int8_t *)&interface_details.ipv4_signature) != 0) { |
5256 | ipv4_signature_len = 0; |
5257 | } |
5258 | interface_details.ipv4_signature.signature_len = ipv4_signature_len; |
5259 | |
5260 | u_int8_t ipv6_signature_len = sizeof(interface_details.ipv6_signature.signature); |
5261 | u_int16_t ipv6_signature_flags; |
5262 | if (ifnet_get_netsignature(interface, AF_INET6, &ipv6_signature_len, &ipv6_signature_flags, |
5263 | (u_int8_t *)&interface_details.ipv6_signature) != 0) { |
5264 | ipv6_signature_len = 0; |
5265 | } |
5266 | interface_details.ipv6_signature.signature_len = ipv6_signature_len; |
5267 | } |
5268 | |
5269 | ifnet_head_done(); |
5270 | |
5271 | error = copyout(&interface_details, uap->buffer, sizeof(interface_details)); |
5272 | if (error) { |
5273 | NECPLOG(LOG_ERR, "necp_client_copy_interface copyout error (%d)" , error); |
5274 | goto done; |
5275 | } |
5276 | done: |
5277 | *retval = error; |
5278 | |
5279 | return (error); |
5280 | } |
5281 | |
5282 | |
5283 | static int |
5284 | necp_client_copy_route_statistics(__unused struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval) |
5285 | { |
5286 | int error = 0; |
5287 | struct necp_client *client = NULL; |
5288 | uuid_t client_id; |
5289 | |
5290 | if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t) || |
5291 | uap->buffer_size < sizeof(struct necp_stat_counts) || uap->buffer == 0) { |
5292 | NECPLOG0(LOG_ERR, "necp_client_copy_route_statistics bad input" ); |
5293 | error = EINVAL; |
5294 | goto done; |
5295 | } |
5296 | |
5297 | error = copyin(uap->client_id, client_id, sizeof(uuid_t)); |
5298 | if (error) { |
5299 | NECPLOG(LOG_ERR, "necp_client_copy_route_statistics copyin client_id error (%d)" , error); |
5300 | goto done; |
5301 | } |
5302 | |
5303 | // Lock |
5304 | NECP_FD_LOCK(fd_data); |
5305 | client = necp_client_fd_find_client_and_lock(fd_data, client_id); |
5306 | if (client != NULL) { |
5307 | NECP_CLIENT_ROUTE_LOCK(client); |
5308 | struct necp_stat_counts route_stats = {}; |
5309 | if (client->current_route != NULL && client->current_route->rt_stats != NULL) { |
5310 | struct nstat_counts *rt_stats = client->current_route->rt_stats; |
5311 | atomic_get_64(route_stats.necp_stat_rxpackets, &rt_stats->nstat_rxpackets); |
5312 | atomic_get_64(route_stats.necp_stat_rxbytes, &rt_stats->nstat_rxbytes); |
5313 | atomic_get_64(route_stats.necp_stat_txpackets, &rt_stats->nstat_txpackets); |
5314 | atomic_get_64(route_stats.necp_stat_txbytes, &rt_stats->nstat_txbytes); |
5315 | route_stats.necp_stat_rxduplicatebytes = rt_stats->nstat_rxduplicatebytes; |
5316 | route_stats.necp_stat_rxoutoforderbytes = rt_stats->nstat_rxoutoforderbytes; |
5317 | route_stats.necp_stat_txretransmit = rt_stats->nstat_txretransmit; |
5318 | route_stats.necp_stat_connectattempts = rt_stats->nstat_connectattempts; |
5319 | route_stats.necp_stat_connectsuccesses = rt_stats->nstat_connectsuccesses; |
5320 | route_stats.necp_stat_min_rtt = rt_stats->nstat_min_rtt; |
5321 | route_stats.necp_stat_avg_rtt = rt_stats->nstat_avg_rtt; |
5322 | route_stats.necp_stat_var_rtt = rt_stats->nstat_var_rtt; |
5323 | route_stats.necp_stat_route_flags = client->current_route->rt_flags; |
5324 | } |
5325 | |
5326 | // Unlock before copying out |
5327 | NECP_CLIENT_ROUTE_UNLOCK(client); |
5328 | NECP_CLIENT_UNLOCK(client); |
5329 | NECP_FD_UNLOCK(fd_data); |
5330 | |
5331 | error = copyout(&route_stats, uap->buffer, sizeof(route_stats)); |
5332 | if (error) { |
5333 | NECPLOG(LOG_ERR, "necp_client_copy_route_statistics copyout error (%d)" , error); |
5334 | } |
5335 | } else { |
5336 | // Unlock |
5337 | NECP_FD_UNLOCK(fd_data); |
5338 | error = ENOENT; |
5339 | } |
5340 | |
5341 | |
5342 | done: |
5343 | *retval = error; |
5344 | return (error); |
5345 | } |
5346 | |
5347 | static int |
5348 | necp_client_update_cache(struct necp_fd_data *fd_data, struct necp_client_action_args *uap, int *retval) |
5349 | { |
5350 | int error = 0; |
5351 | struct necp_client *client = NULL; |
5352 | uuid_t client_id; |
5353 | |
5354 | if (uap->client_id == 0 || uap->client_id_len != sizeof(uuid_t)) { |
5355 | error = EINVAL; |
5356 | goto done; |
5357 | } |
5358 | |
5359 | error = copyin(uap->client_id, client_id, sizeof(uuid_t)); |
5360 | if (error) { |
5361 | NECPLOG(LOG_ERR, "necp_client_update_cache copyin client_id error (%d)" , error); |
5362 | goto done; |
5363 | } |
5364 | |
5365 | NECP_FD_LOCK(fd_data); |
5366 | client = necp_client_fd_find_client_and_lock(fd_data, client_id); |
5367 | if (client == NULL) { |
5368 | NECP_FD_UNLOCK(fd_data); |
5369 | error = ENOENT; |
5370 | goto done; |
5371 | } |
5372 | |
5373 | struct necp_client_flow_registration *flow_registration = necp_client_find_flow(client, client_id); |
5374 | if (flow_registration == NULL) { |
5375 | NECP_CLIENT_UNLOCK(client); |
5376 | NECP_FD_UNLOCK(fd_data); |
5377 | error = ENOENT; |
5378 | goto done; |
5379 | } |
5380 | |
5381 | NECP_CLIENT_ROUTE_LOCK(client); |
5382 | // This needs to be changed when TFO/ECN is supported by multiple flows |
5383 | struct necp_client_flow *flow = LIST_FIRST(&flow_registration->flow_list); |
5384 | if (flow == NULL || |
5385 | (flow->remote_addr.sa.sa_family != AF_INET && |
5386 | flow->remote_addr.sa.sa_family != AF_INET6) || |
5387 | (flow->local_addr.sa.sa_family != AF_INET && |
5388 | flow->local_addr.sa.sa_family != AF_INET6)) { |
5389 | error = EINVAL; |
5390 | NECPLOG(LOG_ERR, "necp_client_update_cache no flow error (%d)" , error); |
5391 | goto done_unlock; |
5392 | } |
5393 | |
5394 | necp_cache_buffer cache_buffer; |
5395 | memset(&cache_buffer, 0, sizeof(cache_buffer)); |
5396 | |
5397 | if (uap->buffer_size != sizeof(necp_cache_buffer) || |
5398 | uap->buffer == USER_ADDR_NULL) { |
5399 | error = EINVAL; |
5400 | goto done_unlock; |
5401 | } |
5402 | |
5403 | error = copyin(uap->buffer, &cache_buffer, sizeof(cache_buffer)); |
5404 | if (error) { |
5405 | NECPLOG(LOG_ERR, "necp_client_update_cache copyin cache buffer error (%d)" , error); |
5406 | goto done_unlock; |
5407 | } |
5408 | |
5409 | if (cache_buffer.necp_cache_buf_type == NECP_CLIENT_CACHE_TYPE_ECN && |
5410 | cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_ECN_VER_1) { |
5411 | if (cache_buffer.necp_cache_buf_size != sizeof(necp_tcp_ecn_cache) || |
5412 | cache_buffer.necp_cache_buf_addr == USER_ADDR_NULL) { |
5413 | error = EINVAL; |
5414 | goto done_unlock; |
5415 | } |
5416 | |
5417 | necp_tcp_ecn_cache ecn_cache_buffer; |
5418 | memset(&ecn_cache_buffer, 0, sizeof(ecn_cache_buffer)); |
5419 | |
5420 | error = copyin(cache_buffer.necp_cache_buf_addr, &ecn_cache_buffer, sizeof(necp_tcp_ecn_cache)); |
5421 | if (error) { |
5422 | NECPLOG(LOG_ERR, "necp_client_update_cache copyin ecn cache buffer error (%d)" , error); |
5423 | goto done_unlock; |
5424 | } |
5425 | |
5426 | if (client->current_route != NULL && client->current_route->rt_ifp != NULL) { |
5427 | if (!client->platform_binary) { |
5428 | ecn_cache_buffer.necp_tcp_ecn_heuristics_success = 0; |
5429 | } |
5430 | tcp_heuristics_ecn_update(&ecn_cache_buffer, client->current_route->rt_ifp, |
5431 | (union sockaddr_in_4_6 *)&flow->local_addr); |
5432 | } |
5433 | } else if (cache_buffer.necp_cache_buf_type == NECP_CLIENT_CACHE_TYPE_TFO && |
5434 | cache_buffer.necp_cache_buf_ver == NECP_CLIENT_CACHE_TYPE_TFO_VER_1) { |
5435 | if (cache_buffer.necp_cache_buf_size != sizeof(necp_tcp_tfo_cache) || |
5436 | cache_buffer.necp_cache_buf_addr == USER_ADDR_NULL) { |
5437 | error = EINVAL; |
5438 | goto done_unlock; |
5439 | } |
5440 | |
5441 | necp_tcp_tfo_cache tfo_cache_buffer; |
5442 | memset(&tfo_cache_buffer, 0, sizeof(tfo_cache_buffer)); |
5443 | |
5444 | error = copyin(cache_buffer.necp_cache_buf_addr, &tfo_cache_buffer, sizeof(necp_tcp_tfo_cache)); |
5445 | if (error) { |
5446 | NECPLOG(LOG_ERR, "necp_client_update_cache copyin tfo cache buffer error (%d)" , error); |
5447 | goto done_unlock; |
5448 | } |
5449 | |
5450 | if (client->current_route != NULL && client->current_route->rt_ifp != NULL) { |
5451 | if (!client->platform_binary) { |
5452 | tfo_cache_buffer.necp_tcp_tfo_heuristics_success = 0; |
5453 | } |
5454 | tcp_heuristics_tfo_update(&tfo_cache_buffer, client->current_route->rt_ifp, |
5455 | (union sockaddr_in_4_6 *)&flow->local_addr, |
5456 | (union sockaddr_in_4_6 *)&flow->remote_addr); |
5457 | } |
5458 | } else { |
5459 | error = EINVAL; |
5460 | } |
5461 | done_unlock: |
5462 | NECP_CLIENT_ROUTE_UNLOCK(client); |
5463 | NECP_CLIENT_UNLOCK(client); |
5464 | NECP_FD_UNLOCK(fd_data); |
5465 | done: |
5466 | *retval = error; |
5467 | return (error); |
5468 | } |
5469 | |
5470 | int |
5471 | necp_client_action(struct proc *p, struct necp_client_action_args *uap, int *retval) |
5472 | { |
5473 | #pragma unused(p) |
5474 | int error = 0; |
5475 | int return_value = 0; |
5476 | struct necp_fd_data *fd_data = NULL; |
5477 | error = necp_find_fd_data(uap->necp_fd, &fd_data); |
5478 | if (error != 0) { |
5479 | NECPLOG(LOG_ERR, "necp_client_action find fd error (%d)" , error); |
5480 | return (error); |
5481 | } |
5482 | |
5483 | u_int32_t action = uap->action; |
5484 | switch (action) { |
5485 | case NECP_CLIENT_ACTION_ADD: { |
5486 | return_value = necp_client_add(p, fd_data, uap, retval); |
5487 | break; |
5488 | } |
5489 | case NECP_CLIENT_ACTION_REMOVE: { |
5490 | return_value = necp_client_remove(fd_data, uap, retval); |
5491 | break; |
5492 | } |
5493 | case NECP_CLIENT_ACTION_COPY_PARAMETERS: |
5494 | case NECP_CLIENT_ACTION_COPY_RESULT: |
5495 | case NECP_CLIENT_ACTION_COPY_UPDATED_RESULT: { |
5496 | return_value = necp_client_copy(fd_data, uap, retval); |
5497 | break; |
5498 | } |
5499 | case NECP_CLIENT_ACTION_COPY_LIST: { |
5500 | return_value = necp_client_list(fd_data, uap, retval); |
5501 | break; |
5502 | } |
5503 | case NECP_CLIENT_ACTION_AGENT: { |
5504 | return_value = necp_client_agent_action(fd_data, uap, retval); |
5505 | break; |
5506 | } |
5507 | case NECP_CLIENT_ACTION_COPY_AGENT: { |
5508 | return_value = necp_client_copy_agent(fd_data, uap, retval); |
5509 | break; |
5510 | } |
5511 | case NECP_CLIENT_ACTION_AGENT_USE: { |
5512 | return_value = necp_client_agent_use(fd_data, uap, retval); |
5513 | break; |
5514 | } |
5515 | case NECP_CLIENT_ACTION_COPY_INTERFACE: { |
5516 | return_value = necp_client_copy_interface(fd_data, uap, retval); |
5517 | break; |
5518 | } |
5519 | case NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS: { |
5520 | return_value = necp_client_copy_route_statistics(fd_data, uap, retval); |
5521 | break; |
5522 | } |
5523 | case NECP_CLIENT_ACTION_UPDATE_CACHE: { |
5524 | return_value = necp_client_update_cache(fd_data, uap, retval); |
5525 | break; |
5526 | } |
5527 | case NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE: { |
5528 | return_value = necp_client_copy_client_update(fd_data, uap, retval); |
5529 | break; |
5530 | } |
5531 | default: { |
5532 | NECPLOG(LOG_ERR, "necp_client_action unknown action (%u)" , action); |
5533 | return_value = EINVAL; |
5534 | break; |
5535 | } |
5536 | } |
5537 | |
5538 | file_drop(uap->necp_fd); |
5539 | |
5540 | return (return_value); |
5541 | } |
5542 | |
5543 | #define NECP_MAX_MATCH_POLICY_PARAMETER_SIZE 1024 |
5544 | |
5545 | int |
5546 | necp_match_policy(struct proc *p, struct necp_match_policy_args *uap, int32_t *retval) |
5547 | { |
5548 | #pragma unused(retval) |
5549 | u_int8_t *parameters = NULL; |
5550 | struct necp_aggregate_result returned_result; |
5551 | int error = 0; |
5552 | |
5553 | if (uap == NULL) { |
5554 | error = EINVAL; |
5555 | goto done; |
5556 | } |
5557 | |
5558 | if (uap->parameters == 0 || uap->parameters_size == 0 || uap->parameters_size > NECP_MAX_MATCH_POLICY_PARAMETER_SIZE || uap->returned_result == 0) { |
5559 | error = EINVAL; |
5560 | goto done; |
5561 | } |
5562 | |
5563 | MALLOC(parameters, u_int8_t *, uap->parameters_size, M_NECP, M_WAITOK | M_ZERO); |
5564 | if (parameters == NULL) { |
5565 | error = ENOMEM; |
5566 | goto done; |
5567 | } |
5568 | // Copy parameters in |
5569 | error = copyin(uap->parameters, parameters, uap->parameters_size); |
5570 | if (error) { |
5571 | goto done; |
5572 | } |
5573 | |
5574 | error = necp_application_find_policy_match_internal(p, parameters, uap->parameters_size, |
5575 | &returned_result, NULL, 0, NULL, NULL, NULL, false); |
5576 | if (error) { |
5577 | goto done; |
5578 | } |
5579 | |
5580 | // Copy return value back |
5581 | error = copyout(&returned_result, uap->returned_result, sizeof(struct necp_aggregate_result)); |
5582 | if (error) { |
5583 | goto done; |
5584 | } |
5585 | done: |
5586 | if (parameters != NULL) { |
5587 | FREE(parameters, M_NECP); |
5588 | } |
5589 | return (error); |
5590 | } |
5591 | |
5592 | /// Socket operations |
5593 | #define NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH 253 |
5594 | |
5595 | static bool |
5596 | necp_set_socket_attribute(u_int8_t *buffer, size_t buffer_length, u_int8_t type, char **buffer_p) |
5597 | { |
5598 | int error = 0; |
5599 | int cursor = 0; |
5600 | size_t string_size = 0; |
5601 | char *local_string = NULL; |
5602 | u_int8_t *value = NULL; |
5603 | |
5604 | cursor = necp_buffer_find_tlv(buffer, buffer_length, 0, type, 0); |
5605 | if (cursor < 0) { |
5606 | // This will clear out the parameter |
5607 | goto done; |
5608 | } |
5609 | |
5610 | string_size = necp_buffer_get_tlv_length(buffer, cursor); |
5611 | if (string_size == 0 || string_size > NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) { |
5612 | // This will clear out the parameter |
5613 | goto done; |
5614 | } |
5615 | |
5616 | MALLOC(local_string, char *, string_size + 1, M_NECP, M_WAITOK | M_ZERO); |
5617 | if (local_string == NULL) { |
5618 | NECPLOG(LOG_ERR, "Failed to allocate a socket attribute buffer (size %d)" , string_size); |
5619 | goto fail; |
5620 | } |
5621 | |
5622 | value = necp_buffer_get_tlv_value(buffer, cursor, NULL); |
5623 | if (value == NULL) { |
5624 | NECPLOG0(LOG_ERR, "Failed to get socket attribute" ); |
5625 | goto fail; |
5626 | } |
5627 | |
5628 | memcpy(local_string, value, string_size); |
5629 | local_string[string_size] = 0; |
5630 | |
5631 | done: |
5632 | if (*buffer_p != NULL) { |
5633 | FREE(*buffer_p, M_NECP); |
5634 | *buffer_p = NULL; |
5635 | } |
5636 | |
5637 | *buffer_p = local_string; |
5638 | return (0); |
5639 | fail: |
5640 | if (local_string != NULL) { |
5641 | FREE(local_string, M_NECP); |
5642 | } |
5643 | return (error); |
5644 | } |
5645 | |
5646 | errno_t |
5647 | necp_set_socket_attributes(struct socket *so, struct sockopt *sopt) |
5648 | { |
5649 | int error = 0; |
5650 | u_int8_t *buffer = NULL; |
5651 | struct inpcb *inp = NULL; |
5652 | |
5653 | if ((SOCK_DOM(so) != PF_INET |
5654 | #if INET6 |
5655 | && SOCK_DOM(so) != PF_INET6 |
5656 | #endif |
5657 | )) { |
5658 | error = EINVAL; |
5659 | goto done; |
5660 | } |
5661 | |
5662 | inp = sotoinpcb(so); |
5663 | |
5664 | size_t valsize = sopt->sopt_valsize; |
5665 | if (valsize == 0 || |
5666 | valsize > ((sizeof(struct necp_tlv_header) + NECP_MAX_SOCKET_ATTRIBUTE_STRING_LENGTH) * 2)) { |
5667 | goto done; |
5668 | } |
5669 | |
5670 | MALLOC(buffer, u_int8_t *, valsize, M_NECP, M_WAITOK | M_ZERO); |
5671 | if (buffer == NULL) { |
5672 | goto done; |
5673 | } |
5674 | |
5675 | error = sooptcopyin(sopt, buffer, valsize, 0); |
5676 | if (error) { |
5677 | goto done; |
5678 | } |
5679 | |
5680 | error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_DOMAIN, &inp->inp_necp_attributes.inp_domain); |
5681 | if (error) { |
5682 | NECPLOG0(LOG_ERR, "Could not set domain TLV for socket attributes" ); |
5683 | goto done; |
5684 | } |
5685 | |
5686 | error = necp_set_socket_attribute(buffer, valsize, NECP_TLV_ATTRIBUTE_ACCOUNT, &inp->inp_necp_attributes.inp_account); |
5687 | if (error) { |
5688 | NECPLOG0(LOG_ERR, "Could not set account TLV for socket attributes" ); |
5689 | goto done; |
5690 | } |
5691 | |
5692 | if (necp_debug) { |
5693 | NECPLOG(LOG_DEBUG, "Set on socket: Domain %s, Account %s" , inp->inp_necp_attributes.inp_domain, inp->inp_necp_attributes.inp_account); |
5694 | } |
5695 | done: |
5696 | if (buffer != NULL) { |
5697 | FREE(buffer, M_NECP); |
5698 | } |
5699 | |
5700 | return (error); |
5701 | } |
5702 | |
5703 | errno_t |
5704 | necp_get_socket_attributes(struct socket *so, struct sockopt *sopt) |
5705 | { |
5706 | int error = 0; |
5707 | u_int8_t *buffer = NULL; |
5708 | u_int8_t *cursor = NULL; |
5709 | size_t valsize = 0; |
5710 | struct inpcb *inp = NULL; |
5711 | |
5712 | if ((SOCK_DOM(so) != PF_INET |
5713 | #if INET6 |
5714 | && SOCK_DOM(so) != PF_INET6 |
5715 | #endif |
5716 | )) { |
5717 | error = EINVAL; |
5718 | goto done; |
5719 | } |
5720 | |
5721 | inp = sotoinpcb(so); |
5722 | if (inp->inp_necp_attributes.inp_domain != NULL) { |
5723 | valsize += sizeof(struct necp_tlv_header) + strlen(inp->inp_necp_attributes.inp_domain); |
5724 | } |
5725 | if (inp->inp_necp_attributes.inp_account != NULL) { |
5726 | valsize += sizeof(struct necp_tlv_header) + strlen(inp->inp_necp_attributes.inp_account); |
5727 | } |
5728 | if (valsize == 0) { |
5729 | goto done; |
5730 | } |
5731 | |
5732 | MALLOC(buffer, u_int8_t *, valsize, M_NECP, M_WAITOK | M_ZERO); |
5733 | if (buffer == NULL) { |
5734 | goto done; |
5735 | } |
5736 | |
5737 | cursor = buffer; |
5738 | if (inp->inp_necp_attributes.inp_domain != NULL) { |
5739 | cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_DOMAIN, strlen(inp->inp_necp_attributes.inp_domain), inp->inp_necp_attributes.inp_domain, |
5740 | buffer, valsize); |
5741 | } |
5742 | |
5743 | if (inp->inp_necp_attributes.inp_account != NULL) { |
5744 | cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ATTRIBUTE_ACCOUNT, strlen(inp->inp_necp_attributes.inp_account), inp->inp_necp_attributes.inp_account, |
5745 | buffer, valsize); |
5746 | } |
5747 | |
5748 | error = sooptcopyout(sopt, buffer, valsize); |
5749 | if (error) { |
5750 | goto done; |
5751 | } |
5752 | done: |
5753 | if (buffer != NULL) { |
5754 | FREE(buffer, M_NECP); |
5755 | } |
5756 | |
5757 | return (error); |
5758 | } |
5759 | |
5760 | void * |
5761 | necp_create_nexus_assign_message(uuid_t nexus_instance, u_int32_t nexus_port, void *key, uint32_t key_length, |
5762 | struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint, |
5763 | u_int32_t flow_adv_index, void *flow_stats, size_t *message_length) |
5764 | { |
5765 | u_int8_t *buffer = NULL; |
5766 | u_int8_t *cursor = NULL; |
5767 | size_t valsize = 0; |
5768 | bool has_nexus_assignment = FALSE; |
5769 | |
5770 | |
5771 | if (!uuid_is_null(nexus_instance)) { |
5772 | has_nexus_assignment = TRUE; |
5773 | valsize += sizeof(struct necp_tlv_header) + sizeof(uuid_t); |
5774 | valsize += sizeof(struct necp_tlv_header) + sizeof(u_int32_t); |
5775 | } |
5776 | if (flow_adv_index != NECP_FLOWADV_IDX_INVALID) { |
5777 | valsize += sizeof(struct necp_tlv_header) + sizeof(u_int32_t); |
5778 | } |
5779 | if (key != NULL && key_length > 0) { |
5780 | valsize += sizeof(struct necp_tlv_header) + key_length; |
5781 | } |
5782 | if (local_endpoint != NULL) { |
5783 | valsize += sizeof(struct necp_tlv_header) + sizeof(struct necp_client_endpoint); |
5784 | } |
5785 | if (remote_endpoint != NULL) { |
5786 | valsize += sizeof(struct necp_tlv_header) + sizeof(struct necp_client_endpoint); |
5787 | } |
5788 | if (flow_stats != NULL) { |
5789 | valsize += sizeof(struct necp_tlv_header) + sizeof(void *); |
5790 | } |
5791 | if (valsize == 0) { |
5792 | return (NULL); |
5793 | } |
5794 | |
5795 | MALLOC(buffer, u_int8_t *, valsize, M_NETAGENT, M_WAITOK | M_ZERO); // Use M_NETAGENT area, since it is expected upon free |
5796 | if (buffer == NULL) { |
5797 | return (NULL); |
5798 | } |
5799 | |
5800 | cursor = buffer; |
5801 | if (has_nexus_assignment) { |
5802 | cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_INSTANCE, sizeof(uuid_t), nexus_instance, buffer, valsize); |
5803 | cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_PORT, sizeof(u_int32_t), &nexus_port, buffer, valsize); |
5804 | } |
5805 | if (flow_adv_index != NECP_FLOWADV_IDX_INVALID) { |
5806 | cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_PORT_FLOW_INDEX, sizeof(u_int32_t), &flow_adv_index, buffer, valsize); |
5807 | } |
5808 | if (key != NULL && key_length > 0) { |
5809 | cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_PARAMETER_NEXUS_KEY, key_length, key, buffer, valsize); |
5810 | } |
5811 | if (local_endpoint != NULL) { |
5812 | cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_LOCAL_ENDPOINT, sizeof(struct necp_client_endpoint), local_endpoint, buffer, valsize); |
5813 | } |
5814 | if (remote_endpoint != NULL) { |
5815 | cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_REMOTE_ENDPOINT, sizeof(struct necp_client_endpoint), remote_endpoint, buffer, valsize); |
5816 | } |
5817 | if (flow_stats != NULL) { |
5818 | cursor = necp_buffer_write_tlv(cursor, NECP_CLIENT_RESULT_NEXUS_FLOW_STATS, sizeof(void *), &flow_stats, buffer, valsize); |
5819 | } |
5820 | |
5821 | *message_length = valsize; |
5822 | |
5823 | return (buffer); |
5824 | } |
5825 | |
5826 | void |
5827 | necp_inpcb_remove_cb(struct inpcb *inp) |
5828 | { |
5829 | if (!uuid_is_null(inp->necp_client_uuid)) { |
5830 | necp_client_unregister_socket_flow(inp->necp_client_uuid, inp); |
5831 | uuid_clear(inp->necp_client_uuid); |
5832 | } |
5833 | } |
5834 | |
5835 | void |
5836 | necp_inpcb_dispose(struct inpcb *inp) |
5837 | { |
5838 | necp_inpcb_remove_cb(inp); // Clear out socket registrations if not yet done |
5839 | if (inp->inp_necp_attributes.inp_domain != NULL) { |
5840 | FREE(inp->inp_necp_attributes.inp_domain, M_NECP); |
5841 | inp->inp_necp_attributes.inp_domain = NULL; |
5842 | } |
5843 | if (inp->inp_necp_attributes.inp_account != NULL) { |
5844 | FREE(inp->inp_necp_attributes.inp_account, M_NECP); |
5845 | inp->inp_necp_attributes.inp_account = NULL; |
5846 | } |
5847 | } |
5848 | |
5849 | void |
5850 | necp_mppcb_dispose(struct mppcb *mpp) |
5851 | { |
5852 | if (!uuid_is_null(mpp->necp_client_uuid)) { |
5853 | necp_client_unregister_multipath_cb(mpp->necp_client_uuid, mpp); |
5854 | uuid_clear(mpp->necp_client_uuid); |
5855 | } |
5856 | } |
5857 | |
5858 | /// Module init |
5859 | |
5860 | errno_t |
5861 | necp_client_init(void) |
5862 | { |
5863 | necp_fd_grp_attr = lck_grp_attr_alloc_init(); |
5864 | if (necp_fd_grp_attr == NULL) { |
5865 | panic("lck_grp_attr_alloc_init failed\n" ); |
5866 | /* NOTREACHED */ |
5867 | } |
5868 | |
5869 | necp_fd_mtx_grp = lck_grp_alloc_init("necp_fd" , necp_fd_grp_attr); |
5870 | if (necp_fd_mtx_grp == NULL) { |
5871 | panic("lck_grp_alloc_init failed\n" ); |
5872 | /* NOTREACHED */ |
5873 | } |
5874 | |
5875 | necp_fd_mtx_attr = lck_attr_alloc_init(); |
5876 | if (necp_fd_mtx_attr == NULL) { |
5877 | panic("lck_attr_alloc_init failed\n" ); |
5878 | /* NOTREACHED */ |
5879 | } |
5880 | |
5881 | necp_client_fd_size = sizeof(struct necp_fd_data); |
5882 | necp_client_fd_zone = zinit(necp_client_fd_size, |
5883 | NECP_CLIENT_FD_ZONE_MAX * necp_client_fd_size, |
5884 | 0, NECP_CLIENT_FD_ZONE_NAME); |
5885 | if (necp_client_fd_zone == NULL) { |
5886 | panic("zinit(necp_client_fd) failed\n" ); |
5887 | /* NOTREACHED */ |
5888 | } |
5889 | |
5890 | necp_flow_size = sizeof(struct necp_client_flow); |
5891 | necp_flow_cache = mcache_create(NECP_FLOW_ZONE_NAME, necp_flow_size, sizeof (uint64_t), 0, MCR_SLEEP); |
5892 | if (necp_flow_cache == NULL) { |
5893 | panic("mcache_create(necp_flow_cache) failed\n" ); |
5894 | /* NOTREACHED */ |
5895 | } |
5896 | |
5897 | necp_flow_registration_size = sizeof(struct necp_client_flow_registration); |
5898 | necp_flow_registration_cache = mcache_create(NECP_FLOW_REGISTRATION_ZONE_NAME, necp_flow_registration_size, sizeof (uint64_t), 0, MCR_SLEEP); |
5899 | if (necp_flow_registration_cache == NULL) { |
5900 | panic("mcache_create(necp_client_flow_registration) failed\n" ); |
5901 | /* NOTREACHED */ |
5902 | } |
5903 | |
5904 | necp_client_update_tcall = thread_call_allocate_with_options(necp_update_all_clients_callout, NULL, |
5905 | THREAD_CALL_PRIORITY_KERNEL, THREAD_CALL_OPTIONS_ONCE); |
5906 | VERIFY(necp_client_update_tcall != NULL); |
5907 | |
5908 | lck_rw_init(&necp_fd_lock, necp_fd_mtx_grp, necp_fd_mtx_attr); |
5909 | lck_rw_init(&necp_observer_lock, necp_fd_mtx_grp, necp_fd_mtx_attr); |
5910 | lck_rw_init(&necp_client_tree_lock, necp_fd_mtx_grp, necp_fd_mtx_attr); |
5911 | lck_rw_init(&necp_flow_tree_lock, necp_fd_mtx_grp, necp_fd_mtx_attr); |
5912 | lck_rw_init(&necp_collect_stats_list_lock, necp_fd_mtx_grp, necp_fd_mtx_attr); |
5913 | |
5914 | LIST_INIT(&necp_fd_list); |
5915 | LIST_INIT(&necp_fd_observer_list); |
5916 | LIST_INIT(&necp_collect_stats_flow_list); |
5917 | |
5918 | RB_INIT(&necp_client_global_tree); |
5919 | RB_INIT(&necp_client_flow_global_tree); |
5920 | |
5921 | return (0); |
5922 | } |
5923 | |
5924 | void |
5925 | necp_client_reap_caches(boolean_t purge) |
5926 | { |
5927 | mcache_reap_now(necp_flow_cache, purge); |
5928 | mcache_reap_now(necp_flow_registration_cache, purge); |
5929 | } |
5930 | |
5931 | |