1 | /* |
2 | * Copyright (c) 2012-2018 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | #include <kern/locks.h> |
30 | #include <kern/zalloc.h> |
31 | |
32 | #include <sys/types.h> |
33 | #include <sys/kernel_types.h> |
34 | #include <sys/kauth.h> |
35 | #include <sys/socket.h> |
36 | #include <sys/socketvar.h> |
37 | #include <sys/sockio.h> |
38 | #include <sys/sysctl.h> |
39 | #include <sys/proc.h> |
40 | |
41 | #include <net/if.h> |
42 | #include <net/if_var.h> |
43 | #include <net/if_types.h> |
44 | #include <net/bpf.h> |
45 | #include <net/net_osdep.h> |
46 | #include <net/pktap.h> |
47 | |
48 | #include <netinet/in_pcb.h> |
49 | #include <netinet/tcp.h> |
50 | #include <netinet/tcp_var.h> |
51 | #define _IP_VHL |
52 | #include <netinet/ip.h> |
53 | #include <netinet/ip_var.h> |
54 | #include <netinet/udp.h> |
55 | #include <netinet/udp_var.h> |
56 | |
57 | #include <netinet/ip6.h> |
58 | #include <netinet6/in6_pcb.h> |
59 | |
60 | #include <libkern/OSAtomic.h> |
61 | |
62 | #include <kern/debug.h> |
63 | |
64 | #include <sys/mcache.h> |
65 | |
66 | #include <string.h> |
67 | |
68 | extern struct inpcbinfo ripcbinfo; |
69 | |
70 | struct pktap_softc { |
71 | LIST_ENTRY(pktap_softc) pktp_link; |
72 | uint32_t pktp_unit; |
73 | uint32_t pktp_dlt_raw_count; |
74 | uint32_t pktp_dlt_pkttap_count; |
75 | struct ifnet *pktp_ifp; |
76 | struct pktap_filter pktp_filters[PKTAP_MAX_FILTERS]; |
77 | }; |
78 | |
79 | #ifndef PKTAP_DEBUG |
80 | #define PKTAP_DEBUG 0 |
81 | #endif /* PKTAP_DEBUG */ |
82 | |
83 | #define PKTAP_FILTER_OK 0 /* Packet passes filter checks */ |
84 | #define PKTAP_FILTER_SKIP 1 /* Do not tap this packet */ |
85 | |
86 | static int pktap_inited = 0; |
87 | |
88 | SYSCTL_DECL(_net_link); |
89 | SYSCTL_NODE(_net_link, IFT_PKTAP, pktap, |
90 | CTLFLAG_RW |CTLFLAG_LOCKED, 0, "pktap virtual interface" ); |
91 | |
92 | uint32_t pktap_total_tap_count = 0; |
93 | SYSCTL_UINT(_net_link_pktap, OID_AUTO, total_tap_count, |
94 | CTLFLAG_RD | CTLFLAG_LOCKED, &pktap_total_tap_count, 0, "" ); |
95 | |
96 | static u_int64_t pktap_count_unknown_if_type = 0; |
97 | SYSCTL_QUAD(_net_link_pktap, OID_AUTO, count_unknown_if_type, |
98 | CTLFLAG_RD | CTLFLAG_LOCKED, &pktap_count_unknown_if_type, "" ); |
99 | |
100 | static int pktap_log = 0; |
101 | SYSCTL_INT(_net_link_pktap, OID_AUTO, log, |
102 | CTLFLAG_RW | CTLFLAG_LOCKED, &pktap_log, 0, "" ); |
103 | |
104 | #define PKTAP_LOG(mask, fmt, ...) \ |
105 | do { \ |
106 | if ((pktap_log & mask)) \ |
107 | printf("%s:%d " fmt, __FUNCTION__, __LINE__, ##__VA_ARGS__); \ |
108 | } while (false) |
109 | |
110 | #define PKTP_LOG_FUNC 0x01 |
111 | #define PKTP_LOG_FILTER 0x02 |
112 | #define PKTP_LOG_INPUT 0x04 |
113 | #define PKTP_LOG_OUTPUT 0x08 |
114 | #define PKTP_LOG_ERROR 0x10 |
115 | #define PKTP_LOG_NOPCB 0x20 |
116 | |
117 | /* |
118 | * pktap_lck_rw protects the global list of pktap interfaces |
119 | */ |
120 | decl_lck_rw_data(static, pktap_lck_rw_data); |
121 | static lck_rw_t *pktap_lck_rw = &pktap_lck_rw_data; |
122 | static lck_grp_t *pktap_lck_grp = NULL; |
123 | static lck_attr_t *pktap_lck_attr = NULL; |
124 | |
125 | static LIST_HEAD(pktap_list, pktap_softc) pktap_list = |
126 | LIST_HEAD_INITIALIZER(pktap_list); |
127 | |
128 | int pktap_clone_create(struct if_clone *, u_int32_t, void *); |
129 | int pktap_clone_destroy(struct ifnet *); |
130 | |
131 | #define PKTAP_MAXUNIT IF_MAXUNIT |
132 | #define PKTAP_ZONE_MAX_ELEM MIN(IFNETS_MAX, PKTAP_MAXUNIT) |
133 | |
134 | static struct if_clone pktap_cloner = |
135 | IF_CLONE_INITIALIZER(PKTAP_IFNAME, |
136 | pktap_clone_create, |
137 | pktap_clone_destroy, |
138 | 0, |
139 | PKTAP_MAXUNIT, |
140 | PKTAP_ZONE_MAX_ELEM, |
141 | sizeof(struct pktap_softc)); |
142 | |
143 | errno_t pktap_if_output(ifnet_t, mbuf_t); |
144 | errno_t pktap_demux(ifnet_t, mbuf_t, char *, protocol_family_t *); |
145 | errno_t pktap_add_proto(ifnet_t, protocol_family_t, |
146 | const struct ifnet_demux_desc *, u_int32_t); |
147 | errno_t pktap_del_proto(ifnet_t, protocol_family_t); |
148 | errno_t pktap_getdrvspec(ifnet_t, struct ifdrv64 *); |
149 | errno_t pktap_setdrvspec(ifnet_t, struct ifdrv64 *); |
150 | errno_t pktap_ioctl(ifnet_t, unsigned long, void *); |
151 | void pktap_detach(ifnet_t); |
152 | int pktap_filter_evaluate(struct pktap_softc *, struct ifnet *); |
153 | void pktap_bpf_tap(struct ifnet *, protocol_family_t, struct mbuf *, |
154 | u_int32_t, u_int32_t, int); |
155 | errno_t pktap_tap_callback(ifnet_t, u_int32_t, bpf_tap_mode); |
156 | |
157 | static void |
158 | pktap_hexdump(int mask, void *addr, size_t len) |
159 | { |
160 | unsigned char *buf = addr; |
161 | size_t i; |
162 | |
163 | if (!(pktap_log & mask)) |
164 | return; |
165 | |
166 | for (i = 0; i < len; i++) { |
167 | unsigned char h = (buf[i] & 0xf0) >> 4; |
168 | unsigned char l = buf[i] & 0x0f; |
169 | |
170 | if (i != 0) { |
171 | if (i % 32 == 0) |
172 | printf("\n" ); |
173 | else if (i % 4 == 0) |
174 | printf(" " ); |
175 | } |
176 | printf("%c%c" , |
177 | h < 10 ? h + '0' : h - 10 + 'a', |
178 | l < 10 ? l + '0' : l - 10 + 'a'); |
179 | } |
180 | if (i % 32 != 0) |
181 | printf("\n" ); |
182 | } |
183 | |
184 | #define _CASSERT_OFFFSETOF_FIELD(s1, s2, f) \ |
185 | _CASSERT(offsetof(struct s1, f) == offsetof(struct s2, f)) |
186 | |
187 | __private_extern__ void |
188 | pktap_init(void) |
189 | { |
190 | int error = 0; |
191 | lck_grp_attr_t *lck_grp_attr = NULL; |
192 | |
193 | _CASSERT_OFFFSETOF_FIELD(pktap_header, pktap_v2_hdr, pth_flags); |
194 | |
195 | /* Make sure we're called only once */ |
196 | VERIFY(pktap_inited == 0); |
197 | |
198 | pktap_inited = 1; |
199 | |
200 | lck_grp_attr = lck_grp_attr_alloc_init(); |
201 | pktap_lck_grp = lck_grp_alloc_init("pktap" , lck_grp_attr); |
202 | pktap_lck_attr = lck_attr_alloc_init(); |
203 | #if PKTAP_DEBUG |
204 | lck_attr_setdebug(pktap_lck_attr); |
205 | #endif /* PKTAP_DEBUG */ |
206 | lck_rw_init(pktap_lck_rw, pktap_lck_grp, pktap_lck_attr); |
207 | lck_grp_attr_free(lck_grp_attr); |
208 | |
209 | LIST_INIT(&pktap_list); |
210 | |
211 | error = if_clone_attach(&pktap_cloner); |
212 | if (error != 0) |
213 | panic("%s: if_clone_attach() failed, error %d\n" , |
214 | __func__, error); |
215 | } |
216 | |
217 | __private_extern__ int |
218 | pktap_clone_create(struct if_clone *ifc, u_int32_t unit, __unused void *params) |
219 | { |
220 | int error = 0; |
221 | struct pktap_softc *pktap = NULL; |
222 | struct ifnet_init_eparams if_init; |
223 | |
224 | PKTAP_LOG(PKTP_LOG_FUNC, "unit %u\n" , unit); |
225 | |
226 | pktap = if_clone_softc_allocate(&pktap_cloner); |
227 | if (pktap == NULL) { |
228 | printf("%s: _MALLOC failed\n" , __func__); |
229 | error = ENOMEM; |
230 | goto done; |
231 | } |
232 | pktap->pktp_unit = unit; |
233 | |
234 | /* |
235 | * By default accept packet from physical interfaces |
236 | */ |
237 | pktap->pktp_filters[0].filter_op = PKTAP_FILTER_OP_PASS; |
238 | pktap->pktp_filters[0].filter_param = PKTAP_FILTER_PARAM_IF_TYPE; |
239 | pktap->pktp_filters[0].filter_param_if_type = IFT_ETHER; |
240 | |
241 | #if CONFIG_EMBEDDED |
242 | pktap->pktp_filters[1].filter_op = PKTAP_FILTER_OP_PASS; |
243 | pktap->pktp_filters[1].filter_param = PKTAP_FILTER_PARAM_IF_TYPE; |
244 | pktap->pktp_filters[1].filter_param_if_type = IFT_CELLULAR; |
245 | #else /* CONFIG_EMBEDDED */ |
246 | pktap->pktp_filters[1].filter_op = PKTAP_FILTER_OP_PASS; |
247 | pktap->pktp_filters[1].filter_param = PKTAP_FILTER_PARAM_IF_TYPE; |
248 | pktap->pktp_filters[1].filter_param_if_type = IFT_IEEE1394; |
249 | #endif /* CONFIG_EMBEDDED */ |
250 | |
251 | #if (DEVELOPMENT || DEBUG) |
252 | pktap->pktp_filters[2].filter_op = PKTAP_FILTER_OP_PASS; |
253 | pktap->pktp_filters[2].filter_param = PKTAP_FILTER_PARAM_IF_TYPE; |
254 | pktap->pktp_filters[2].filter_param_if_type = IFT_OTHER; |
255 | #endif /* DEVELOPMENT || DEBUG */ |
256 | |
257 | /* |
258 | * We do not use a set_bpf_tap() function as we rather rely on the more |
259 | * accurate callback passed to bpf_attach() |
260 | */ |
261 | bzero(&if_init, sizeof(if_init)); |
262 | if_init.ver = IFNET_INIT_CURRENT_VERSION; |
263 | if_init.len = sizeof (if_init); |
264 | if_init.flags = IFNET_INIT_LEGACY; |
265 | if_init.name = ifc->ifc_name; |
266 | if_init.unit = unit; |
267 | if_init.type = IFT_PKTAP; |
268 | if_init.family = IFNET_FAMILY_LOOPBACK; |
269 | if_init.output = pktap_if_output; |
270 | if_init.demux = pktap_demux; |
271 | if_init.add_proto = pktap_add_proto; |
272 | if_init.del_proto = pktap_del_proto; |
273 | if_init.softc = pktap; |
274 | if_init.ioctl = pktap_ioctl; |
275 | if_init.detach = pktap_detach; |
276 | |
277 | error = ifnet_allocate_extended(&if_init, &pktap->pktp_ifp); |
278 | if (error != 0) { |
279 | printf("%s: ifnet_allocate failed, error %d\n" , |
280 | __func__, error); |
281 | goto done; |
282 | } |
283 | |
284 | ifnet_set_flags(pktap->pktp_ifp, IFF_UP, IFF_UP); |
285 | |
286 | error = ifnet_attach(pktap->pktp_ifp, NULL); |
287 | if (error != 0) { |
288 | printf("%s: ifnet_attach failed - error %d\n" , __func__, error); |
289 | ifnet_release(pktap->pktp_ifp); |
290 | goto done; |
291 | } |
292 | |
293 | /* Attach DLT_PKTAP as the default DLT */ |
294 | bpf_attach(pktap->pktp_ifp, DLT_PKTAP, sizeof(struct pktap_header), |
295 | NULL, pktap_tap_callback); |
296 | bpf_attach(pktap->pktp_ifp, DLT_RAW, 0, NULL, pktap_tap_callback); |
297 | |
298 | /* Take a reference and add to the global list */ |
299 | ifnet_reference(pktap->pktp_ifp); |
300 | lck_rw_lock_exclusive(pktap_lck_rw); |
301 | LIST_INSERT_HEAD(&pktap_list, pktap, pktp_link); |
302 | lck_rw_done(pktap_lck_rw); |
303 | done: |
304 | if (error != 0 && pktap != NULL) |
305 | if_clone_softc_deallocate(&pktap_cloner, pktap); |
306 | return (error); |
307 | } |
308 | |
309 | __private_extern__ int |
310 | pktap_clone_destroy(struct ifnet *ifp) |
311 | { |
312 | int error = 0; |
313 | |
314 | PKTAP_LOG(PKTP_LOG_FUNC, "%s\n" , ifp->if_xname); |
315 | |
316 | (void) ifnet_detach(ifp); |
317 | |
318 | return (error); |
319 | } |
320 | |
321 | /* |
322 | * This function is called whenever a DLT is set on the interface: |
323 | * - When interface is attached to a BPF device via BIOCSETIF for the |
324 | * default DLT |
325 | * - Whenever a new DLT is selected via BIOCSDLT |
326 | * - When the interface is detached from a BPF device (direction is zero) |
327 | */ |
328 | __private_extern__ errno_t |
329 | pktap_tap_callback(ifnet_t ifp, u_int32_t dlt, bpf_tap_mode direction) |
330 | { |
331 | struct pktap_softc *pktap; |
332 | |
333 | pktap = ifp->if_softc; |
334 | if (pktap == NULL) { |
335 | printf("%s: if_softc is NULL for ifp %s\n" , __func__, |
336 | ifp->if_xname); |
337 | goto done; |
338 | } |
339 | switch (dlt) { |
340 | case DLT_RAW: |
341 | if (direction == 0) { |
342 | if (pktap->pktp_dlt_raw_count > 0) { |
343 | pktap->pktp_dlt_raw_count--; |
344 | OSAddAtomic(-1, &pktap_total_tap_count); |
345 | |
346 | } |
347 | } else { |
348 | pktap->pktp_dlt_raw_count++; |
349 | OSAddAtomic(1, &pktap_total_tap_count); |
350 | } |
351 | break; |
352 | case DLT_PKTAP: |
353 | if (direction == 0) { |
354 | if (pktap->pktp_dlt_pkttap_count > 0) { |
355 | pktap->pktp_dlt_pkttap_count--; |
356 | OSAddAtomic(-1, &pktap_total_tap_count); |
357 | } |
358 | } else { |
359 | pktap->pktp_dlt_pkttap_count++; |
360 | OSAddAtomic(1, &pktap_total_tap_count); |
361 | } |
362 | break; |
363 | } |
364 | done: |
365 | /* |
366 | * Attachements count must be positive and we're in trouble |
367 | * if we have more that 2**31 attachements |
368 | */ |
369 | VERIFY(pktap_total_tap_count >= 0); |
370 | |
371 | return (0); |
372 | } |
373 | |
374 | __private_extern__ errno_t |
375 | pktap_if_output(ifnet_t ifp, mbuf_t m) |
376 | { |
377 | PKTAP_LOG(PKTP_LOG_FUNC, "%s\n" , ifp->if_xname); |
378 | mbuf_freem(m); |
379 | return (ENOTSUP); |
380 | } |
381 | |
382 | __private_extern__ errno_t |
383 | pktap_demux(ifnet_t ifp, __unused mbuf_t m, __unused char *, |
384 | __unused protocol_family_t *ppf) |
385 | { |
386 | PKTAP_LOG(PKTP_LOG_FUNC, "%s\n" , ifp->if_xname); |
387 | return (ENOTSUP); |
388 | } |
389 | |
390 | __private_extern__ errno_t |
391 | pktap_add_proto(__unused ifnet_t ifp, protocol_family_t pf, |
392 | __unused const struct ifnet_demux_desc *dmx, __unused u_int32_t cnt) |
393 | { |
394 | PKTAP_LOG(PKTP_LOG_FUNC, "%s pf %u\n" , ifp->if_xname, pf); |
395 | return (0); |
396 | } |
397 | |
398 | __private_extern__ errno_t |
399 | pktap_del_proto(__unused ifnet_t ifp, __unused protocol_family_t pf) |
400 | { |
401 | PKTAP_LOG(PKTP_LOG_FUNC, "%s pf %u\n" , ifp->if_xname, pf); |
402 | return (0); |
403 | } |
404 | |
405 | __private_extern__ errno_t |
406 | pktap_getdrvspec(ifnet_t ifp, struct ifdrv64 *ifd) |
407 | { |
408 | errno_t error = 0; |
409 | struct pktap_softc *pktap; |
410 | int i; |
411 | |
412 | PKTAP_LOG(PKTP_LOG_FUNC, "%s\n" , ifp->if_xname); |
413 | |
414 | pktap = ifp->if_softc; |
415 | if (pktap == NULL) { |
416 | error = ENOENT; |
417 | printf("%s: pktap NULL - error %d\n" , __func__, error); |
418 | goto done; |
419 | } |
420 | |
421 | switch (ifd->ifd_cmd) { |
422 | case PKTP_CMD_FILTER_GET: { |
423 | struct x_pktap_filter x_filters[PKTAP_MAX_FILTERS]; |
424 | |
425 | bzero(&x_filters, sizeof(x_filters)); |
426 | |
427 | if (ifd->ifd_len < PKTAP_MAX_FILTERS * sizeof(struct x_pktap_filter)) { |
428 | printf("%s: PKTP_CMD_FILTER_GET ifd_len %llu too small - error %d\n" , |
429 | __func__, ifd->ifd_len, error); |
430 | error = EINVAL; |
431 | break; |
432 | } |
433 | for (i = 0; i < PKTAP_MAX_FILTERS; i++) { |
434 | struct pktap_filter *pktap_filter = pktap->pktp_filters + i; |
435 | struct x_pktap_filter *x_filter = x_filters + i; |
436 | |
437 | x_filter->filter_op = pktap_filter->filter_op; |
438 | x_filter->filter_param = pktap_filter->filter_param; |
439 | |
440 | if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_TYPE) |
441 | x_filter->filter_param_if_type = pktap_filter->filter_param_if_type; |
442 | else if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_NAME) |
443 | strlcpy(x_filter->filter_param_if_name, |
444 | pktap_filter->filter_param_if_name, |
445 | sizeof(x_filter->filter_param_if_name)); |
446 | } |
447 | error = copyout(x_filters, ifd->ifd_data, |
448 | PKTAP_MAX_FILTERS * sizeof(struct x_pktap_filter)); |
449 | if (error) { |
450 | printf("%s: PKTP_CMD_FILTER_GET copyout - error %d\n" , __func__, error); |
451 | goto done; |
452 | } |
453 | break; |
454 | } |
455 | case PKTP_CMD_TAP_COUNT: { |
456 | uint32_t tap_count = pktap->pktp_dlt_raw_count + pktap->pktp_dlt_pkttap_count; |
457 | |
458 | if (ifd->ifd_len < sizeof(tap_count)) { |
459 | printf("%s: PKTP_CMD_TAP_COUNT ifd_len %llu too small - error %d\n" , |
460 | __func__, ifd->ifd_len, error); |
461 | error = EINVAL; |
462 | break; |
463 | } |
464 | error = copyout(&tap_count, ifd->ifd_data, sizeof(tap_count)); |
465 | if (error) { |
466 | printf("%s: PKTP_CMD_TAP_COUNT copyout - error %d\n" , __func__, error); |
467 | goto done; |
468 | } |
469 | break; |
470 | } |
471 | default: |
472 | error = EINVAL; |
473 | break; |
474 | } |
475 | |
476 | done: |
477 | return (error); |
478 | } |
479 | |
480 | __private_extern__ errno_t |
481 | pktap_setdrvspec(ifnet_t ifp, struct ifdrv64 *ifd) |
482 | { |
483 | errno_t error = 0; |
484 | struct pktap_softc *pktap; |
485 | |
486 | PKTAP_LOG(PKTP_LOG_FUNC, "%s\n" , ifp->if_xname); |
487 | |
488 | pktap = ifp->if_softc; |
489 | if (pktap == NULL) { |
490 | error = ENOENT; |
491 | printf("%s: pktap NULL - error %d\n" , __func__, error); |
492 | goto done; |
493 | } |
494 | |
495 | switch (ifd->ifd_cmd) { |
496 | case PKTP_CMD_FILTER_SET: { |
497 | struct x_pktap_filter user_filters[PKTAP_MAX_FILTERS]; |
498 | int i; |
499 | int got_op_none = 0; |
500 | |
501 | if (ifd->ifd_len != PKTAP_MAX_FILTERS * sizeof(struct x_pktap_filter)) { |
502 | printf("%s: PKTP_CMD_FILTER_SET bad ifd_len %llu - error %d\n" , |
503 | __func__, ifd->ifd_len, error); |
504 | error = EINVAL; |
505 | break; |
506 | } |
507 | error = copyin(ifd->ifd_data, &user_filters, ifd->ifd_len); |
508 | if (error) { |
509 | printf("%s: copyin - error %d\n" , __func__, error); |
510 | goto done; |
511 | } |
512 | /* |
513 | * Validate user provided parameters |
514 | */ |
515 | for (i = 0; i < PKTAP_MAX_FILTERS; i++) { |
516 | struct x_pktap_filter *x_filter = user_filters + i; |
517 | |
518 | switch (x_filter->filter_op) { |
519 | case PKTAP_FILTER_OP_NONE: |
520 | /* Following entries must be PKTAP_FILTER_OP_NONE */ |
521 | got_op_none = 1; |
522 | break; |
523 | case PKTAP_FILTER_OP_PASS: |
524 | case PKTAP_FILTER_OP_SKIP: |
525 | /* Invalid after PKTAP_FILTER_OP_NONE */ |
526 | if (got_op_none) { |
527 | error = EINVAL; |
528 | break; |
529 | } |
530 | break; |
531 | default: |
532 | error = EINVAL; |
533 | break; |
534 | } |
535 | if (error != 0) |
536 | break; |
537 | |
538 | switch (x_filter->filter_param) { |
539 | case PKTAP_FILTER_OP_NONE: |
540 | if (x_filter->filter_op != PKTAP_FILTER_OP_NONE) { |
541 | error = EINVAL; |
542 | break; |
543 | } |
544 | break; |
545 | |
546 | /* |
547 | * Do not allow to tap a pktap from a pktap |
548 | */ |
549 | case PKTAP_FILTER_PARAM_IF_TYPE: |
550 | if (x_filter->filter_param_if_type == IFT_PKTAP || |
551 | x_filter->filter_param_if_type > 0xff) { |
552 | error = EINVAL; |
553 | break; |
554 | } |
555 | break; |
556 | |
557 | case PKTAP_FILTER_PARAM_IF_NAME: |
558 | if (strncmp(x_filter->filter_param_if_name, PKTAP_IFNAME, |
559 | strlen(PKTAP_IFNAME)) == 0) { |
560 | error = EINVAL; |
561 | break; |
562 | } |
563 | break; |
564 | |
565 | default: |
566 | error = EINVAL; |
567 | break; |
568 | } |
569 | if (error != 0) |
570 | break; |
571 | } |
572 | if (error != 0) |
573 | break; |
574 | for (i = 0; i < PKTAP_MAX_FILTERS; i++) { |
575 | struct pktap_filter *pktap_filter = pktap->pktp_filters + i; |
576 | struct x_pktap_filter *x_filter = user_filters + i; |
577 | |
578 | pktap_filter->filter_op = x_filter->filter_op; |
579 | pktap_filter->filter_param = x_filter->filter_param; |
580 | |
581 | if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_TYPE) |
582 | pktap_filter->filter_param_if_type = x_filter->filter_param_if_type; |
583 | else if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_NAME) { |
584 | size_t len; |
585 | |
586 | strlcpy(pktap_filter->filter_param_if_name, |
587 | x_filter->filter_param_if_name, |
588 | sizeof(pktap_filter->filter_param_if_name)); |
589 | /* |
590 | * If name does not end with a number then it's a "wildcard" match |
591 | * where we compare the prefix of the interface name |
592 | */ |
593 | len = strlen(pktap_filter->filter_param_if_name); |
594 | if (pktap_filter->filter_param_if_name[len] < '0' || |
595 | pktap_filter->filter_param_if_name[len] > '9') |
596 | pktap_filter->filter_ifname_prefix_len = len; |
597 | } |
598 | } |
599 | break; |
600 | } |
601 | default: |
602 | error = EINVAL; |
603 | break; |
604 | } |
605 | |
606 | done: |
607 | return (error); |
608 | } |
609 | |
610 | __private_extern__ errno_t |
611 | pktap_ioctl(ifnet_t ifp, unsigned long cmd, void *data) |
612 | { |
613 | errno_t error = 0; |
614 | |
615 | PKTAP_LOG(PKTP_LOG_FUNC, "%s\n" , ifp->if_xname); |
616 | |
617 | if ((cmd & IOC_IN)) { |
618 | error = kauth_authorize_generic(kauth_cred_get(), KAUTH_GENERIC_ISSUSER); |
619 | if (error) { |
620 | PKTAP_LOG(PKTP_LOG_ERROR, |
621 | "%s: kauth_authorize_generic(KAUTH_GENERIC_ISSUSER) - error %d\n" , |
622 | __func__, error); |
623 | goto done; |
624 | } |
625 | } |
626 | |
627 | switch (cmd) { |
628 | case SIOCGDRVSPEC32: { |
629 | struct ifdrv64 ifd; |
630 | struct ifdrv32 *ifd32 = (struct ifdrv32 *)data; |
631 | |
632 | memcpy(ifd.ifd_name, ifd32->ifd_name, sizeof(ifd.ifd_name)); |
633 | ifd.ifd_cmd = ifd32->ifd_cmd; |
634 | ifd.ifd_len = ifd32->ifd_len; |
635 | ifd.ifd_data = ifd32->ifd_data; |
636 | |
637 | error = pktap_getdrvspec(ifp, &ifd); |
638 | |
639 | break; |
640 | } |
641 | case SIOCGDRVSPEC64: { |
642 | struct ifdrv64 *ifd64 = (struct ifdrv64 *)data; |
643 | |
644 | error = pktap_getdrvspec(ifp, ifd64); |
645 | |
646 | break; |
647 | } |
648 | case SIOCSDRVSPEC32: { |
649 | struct ifdrv64 ifd; |
650 | struct ifdrv32 *ifd32 = (struct ifdrv32 *)data; |
651 | |
652 | memcpy(ifd.ifd_name, ifd32->ifd_name, sizeof(ifd.ifd_name)); |
653 | ifd.ifd_cmd = ifd32->ifd_cmd; |
654 | ifd.ifd_len = ifd32->ifd_len; |
655 | ifd.ifd_data = ifd32->ifd_data; |
656 | |
657 | error = pktap_setdrvspec(ifp, &ifd); |
658 | break; |
659 | } |
660 | case SIOCSDRVSPEC64: { |
661 | struct ifdrv64 *ifd64 = (struct ifdrv64 *)data; |
662 | |
663 | error = pktap_setdrvspec(ifp, ifd64); |
664 | |
665 | break; |
666 | } |
667 | default: |
668 | error = ENOTSUP; |
669 | break; |
670 | } |
671 | done: |
672 | return (error); |
673 | } |
674 | |
675 | __private_extern__ void |
676 | pktap_detach(ifnet_t ifp) |
677 | { |
678 | struct pktap_softc *pktap; |
679 | |
680 | PKTAP_LOG(PKTP_LOG_FUNC, "%s\n" , ifp->if_xname); |
681 | |
682 | lck_rw_lock_exclusive(pktap_lck_rw); |
683 | |
684 | pktap = ifp->if_softc; |
685 | ifp->if_softc = NULL; |
686 | LIST_REMOVE(pktap, pktp_link); |
687 | |
688 | lck_rw_done(pktap_lck_rw); |
689 | |
690 | /* Drop reference as it's no more on the global list */ |
691 | ifnet_release(ifp); |
692 | |
693 | if_clone_softc_deallocate(&pktap_cloner, pktap); |
694 | /* This is for the reference taken by ifnet_attach() */ |
695 | (void) ifnet_release(ifp); |
696 | } |
697 | |
698 | __private_extern__ int |
699 | pktap_filter_evaluate(struct pktap_softc *pktap, struct ifnet *ifp) |
700 | { |
701 | int i; |
702 | int result = PKTAP_FILTER_SKIP; /* Need positive matching rule to pass */ |
703 | int match = 0; |
704 | |
705 | for (i = 0; i < PKTAP_MAX_FILTERS; i++) { |
706 | struct pktap_filter *pktap_filter = pktap->pktp_filters + i; |
707 | size_t len = pktap_filter->filter_ifname_prefix_len != 0 ? |
708 | pktap_filter->filter_ifname_prefix_len : PKTAP_IFXNAMESIZE; |
709 | |
710 | switch (pktap_filter->filter_op) { |
711 | case PKTAP_FILTER_OP_NONE: |
712 | match = 1; |
713 | break; |
714 | |
715 | case PKTAP_FILTER_OP_PASS: |
716 | if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_TYPE) { |
717 | if (pktap_filter->filter_param_if_type == 0 || |
718 | ifp->if_type == pktap_filter->filter_param_if_type) { |
719 | result = PKTAP_FILTER_OK; |
720 | match = 1; |
721 | PKTAP_LOG(PKTP_LOG_FILTER, "pass %s match type %u\n" , |
722 | ifp->if_xname, pktap_filter->filter_param_if_type); |
723 | break; |
724 | } |
725 | } |
726 | if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_NAME) { |
727 | if (strncmp(ifp->if_xname, pktap_filter->filter_param_if_name, |
728 | len) == 0) { |
729 | result = PKTAP_FILTER_OK; |
730 | match = 1; |
731 | PKTAP_LOG(PKTP_LOG_FILTER, "pass %s match name %s\n" , |
732 | ifp->if_xname, pktap_filter->filter_param_if_name); |
733 | break; |
734 | } |
735 | } |
736 | break; |
737 | |
738 | case PKTAP_FILTER_OP_SKIP: |
739 | if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_TYPE) { |
740 | if (pktap_filter->filter_param_if_type == 0 || |
741 | ifp->if_type == pktap_filter->filter_param_if_type) { |
742 | result = PKTAP_FILTER_SKIP; |
743 | match = 1; |
744 | PKTAP_LOG(PKTP_LOG_FILTER, "skip %s match type %u\n" , |
745 | ifp->if_xname, pktap_filter->filter_param_if_type); |
746 | break; |
747 | } |
748 | } |
749 | if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_NAME) { |
750 | if (strncmp(ifp->if_xname, pktap_filter->filter_param_if_name, |
751 | len) == 0) { |
752 | result = PKTAP_FILTER_SKIP; |
753 | match = 1; |
754 | PKTAP_LOG(PKTP_LOG_FILTER, "skip %s match name %s\n" , |
755 | ifp->if_xname, pktap_filter->filter_param_if_name); |
756 | break; |
757 | } |
758 | } |
759 | break; |
760 | } |
761 | if (match) |
762 | break; |
763 | } |
764 | |
765 | if (match == 0) { |
766 | PKTAP_LOG(PKTP_LOG_FILTER, "%s no match\n" , |
767 | ifp->if_xname); |
768 | } |
769 | return (result); |
770 | } |
771 | |
772 | static void |
773 | pktap_set_procinfo(struct pktap_header *hdr, struct so_procinfo *soprocinfo) |
774 | { |
775 | hdr->pth_pid = soprocinfo->spi_pid; |
776 | if (hdr->pth_comm[0] == 0) |
777 | proc_name(soprocinfo->spi_pid, hdr->pth_comm, MAXCOMLEN); |
778 | if (soprocinfo->spi_pid != 0) |
779 | uuid_copy(hdr->pth_uuid, soprocinfo->spi_uuid); |
780 | |
781 | if (soprocinfo->spi_delegated != 0) { |
782 | hdr->pth_flags |= PTH_FLAG_PROC_DELEGATED; |
783 | hdr->pth_epid = soprocinfo->spi_epid; |
784 | if (hdr->pth_ecomm[0] == 0) |
785 | proc_name(soprocinfo->spi_epid, hdr->pth_ecomm, MAXCOMLEN); |
786 | uuid_copy(hdr->pth_euuid, soprocinfo->spi_euuid); |
787 | } |
788 | } |
789 | |
790 | __private_extern__ void |
791 | pktap_finalize_proc_info(struct pktap_header *hdr) |
792 | { |
793 | int found; |
794 | struct so_procinfo soprocinfo; |
795 | |
796 | if (!(hdr->pth_flags & PTH_FLAG_DELAY_PKTAP)) |
797 | return; |
798 | |
799 | if (hdr->pth_ipproto == IPPROTO_TCP) |
800 | found = inp_findinpcb_procinfo(&tcbinfo, hdr->pth_flowid, |
801 | &soprocinfo); |
802 | else if (hdr->pth_ipproto == IPPROTO_UDP) |
803 | found = inp_findinpcb_procinfo(&udbinfo, hdr->pth_flowid, |
804 | &soprocinfo); |
805 | else |
806 | found = inp_findinpcb_procinfo(&ripcbinfo, hdr->pth_flowid, |
807 | &soprocinfo); |
808 | |
809 | if (found == 1) |
810 | pktap_set_procinfo(hdr, &soprocinfo); |
811 | } |
812 | |
813 | static void |
814 | pktap_v2_set_procinfo(struct pktap_v2_hdr *pktap_v2_hdr, |
815 | struct so_procinfo *soprocinfo) |
816 | { |
817 | pktap_v2_hdr->pth_pid = soprocinfo->spi_pid; |
818 | |
819 | if (soprocinfo->spi_pid != 0 && soprocinfo->spi_pid != -1) { |
820 | if (pktap_v2_hdr->pth_comm_offset != 0) { |
821 | char *ptr = ((char *)pktap_v2_hdr) + |
822 | pktap_v2_hdr->pth_comm_offset; |
823 | |
824 | proc_name(soprocinfo->spi_pid, |
825 | ptr, PKTAP_MAX_COMM_SIZE); |
826 | } |
827 | if (pktap_v2_hdr->pth_uuid_offset != 0) { |
828 | uuid_t *ptr = (uuid_t *) (((char *)pktap_v2_hdr) + |
829 | pktap_v2_hdr->pth_uuid_offset); |
830 | |
831 | uuid_copy(*ptr, soprocinfo->spi_uuid); |
832 | } |
833 | } |
834 | |
835 | if (!(pktap_v2_hdr->pth_flags & PTH_FLAG_PROC_DELEGATED)) |
836 | return; |
837 | |
838 | /* |
839 | * The effective UUID may be set independently from the effective pid |
840 | */ |
841 | if (soprocinfo->spi_delegated != 0) { |
842 | pktap_v2_hdr->pth_flags |= PTH_FLAG_PROC_DELEGATED; |
843 | pktap_v2_hdr->pth_e_pid = soprocinfo->spi_epid; |
844 | |
845 | if (soprocinfo->spi_pid != 0 && soprocinfo->spi_pid != -1 && |
846 | pktap_v2_hdr->pth_e_comm_offset != 0) { |
847 | char *ptr = ((char *)pktap_v2_hdr) + |
848 | pktap_v2_hdr->pth_e_comm_offset; |
849 | |
850 | proc_name(soprocinfo->spi_epid, |
851 | ptr, PKTAP_MAX_COMM_SIZE); |
852 | } |
853 | if (pktap_v2_hdr->pth_e_uuid_offset != 0) { |
854 | uuid_t *ptr = (uuid_t *) (((char *)pktap_v2_hdr) + |
855 | pktap_v2_hdr->pth_e_uuid_offset); |
856 | |
857 | uuid_copy(*ptr, soprocinfo->spi_euuid); |
858 | } |
859 | } |
860 | } |
861 | |
862 | __private_extern__ void |
863 | pktap_v2_finalize_proc_info(struct pktap_v2_hdr *pktap_v2_hdr) |
864 | { |
865 | int found; |
866 | struct so_procinfo soprocinfo; |
867 | |
868 | if (!(pktap_v2_hdr->pth_flags & PTH_FLAG_DELAY_PKTAP)) |
869 | return; |
870 | |
871 | if (pktap_v2_hdr->pth_ipproto == IPPROTO_TCP) { |
872 | found = inp_findinpcb_procinfo(&tcbinfo, |
873 | pktap_v2_hdr->pth_flowid, &soprocinfo); |
874 | } else if (pktap_v2_hdr->pth_ipproto == IPPROTO_UDP) { |
875 | found = inp_findinpcb_procinfo(&udbinfo, |
876 | pktap_v2_hdr->pth_flowid, &soprocinfo); |
877 | } else { |
878 | found = inp_findinpcb_procinfo(&ripcbinfo, |
879 | pktap_v2_hdr->pth_flowid, &soprocinfo); |
880 | } |
881 | if (found == 1) { |
882 | pktap_v2_set_procinfo(pktap_v2_hdr, &soprocinfo); |
883 | } |
884 | } |
885 | |
886 | __private_extern__ void |
887 | pktap_fill_proc_info(struct pktap_header *hdr, protocol_family_t proto, |
888 | struct mbuf *m, u_int32_t pre, int outgoing, struct ifnet *ifp) |
889 | { |
890 | /* |
891 | * Getting the pid and procname is expensive |
892 | * For outgoing, do the lookup only if there's an |
893 | * associated socket as indicated by the flowhash |
894 | */ |
895 | if (outgoing != 0 && m->m_pkthdr.pkt_flowsrc == FLOWSRC_INPCB) { |
896 | /* |
897 | * To avoid lock ordering issues we delay the proc UUID lookup |
898 | * to the BPF read as we cannot |
899 | * assume the socket lock is unlocked on output |
900 | */ |
901 | hdr->pth_flags |= PTH_FLAG_DELAY_PKTAP; |
902 | hdr->pth_flags |= PTH_FLAG_SOCKET; |
903 | hdr->pth_flowid = m->m_pkthdr.pkt_flowid; |
904 | |
905 | if (m->m_pkthdr.pkt_flags & PKTF_FLOW_RAWSOCK) { |
906 | hdr->pth_ipproto = IPPROTO_RAW; |
907 | } else { |
908 | hdr->pth_ipproto = m->m_pkthdr.pkt_proto; |
909 | } |
910 | |
911 | if (hdr->pth_ipproto == IPPROTO_TCP) { |
912 | hdr->pth_pid = m->m_pkthdr.tx_tcp_pid; |
913 | hdr->pth_epid = m->m_pkthdr.tx_tcp_e_pid; |
914 | } else if (hdr->pth_ipproto == IPPROTO_UDP) { |
915 | hdr->pth_pid = m->m_pkthdr.tx_udp_pid; |
916 | hdr->pth_epid = m->m_pkthdr.tx_udp_e_pid; |
917 | } else if (hdr->pth_ipproto == IPPROTO_RAW) { |
918 | hdr->pth_pid = m->m_pkthdr.tx_rawip_pid; |
919 | hdr->pth_epid = m->m_pkthdr.tx_rawip_e_pid; |
920 | } |
921 | |
922 | if (hdr->pth_pid != 0 && hdr->pth_pid != -1) { |
923 | proc_name(hdr->pth_pid, hdr->pth_comm, MAXCOMLEN); |
924 | } else { |
925 | hdr->pth_pid = -1; |
926 | } |
927 | |
928 | if (hdr->pth_epid != 0 && hdr->pth_epid != -1) { |
929 | hdr->pth_flags|= PTH_FLAG_PROC_DELEGATED; |
930 | proc_name(hdr->pth_epid, hdr->pth_ecomm, MAXCOMLEN); |
931 | } else { |
932 | hdr->pth_epid = -1; |
933 | } |
934 | |
935 | if (m->m_pkthdr.pkt_flags & PKTF_NEW_FLOW) { |
936 | hdr->pth_flags |= PTH_FLAG_NEW_FLOW; |
937 | } |
938 | } else if (outgoing == 0) { |
939 | int found = 0; |
940 | struct so_procinfo soprocinfo; |
941 | struct inpcb *inp = NULL; |
942 | |
943 | memset(&soprocinfo, 0, sizeof(struct so_procinfo)); |
944 | |
945 | if (proto == PF_INET) { |
946 | struct ip ip; |
947 | errno_t error; |
948 | size_t hlen; |
949 | struct in_addr faddr, laddr; |
950 | u_short fport = 0, lport = 0; |
951 | struct inpcbinfo *pcbinfo = NULL; |
952 | int wildcard = 0; |
953 | |
954 | error = mbuf_copydata(m, pre, sizeof(struct ip), &ip); |
955 | if (error != 0) { |
956 | PKTAP_LOG(PKTP_LOG_ERROR, |
957 | "mbuf_copydata tcp v4 failed for %s\n" , |
958 | hdr->pth_ifname); |
959 | goto done; |
960 | } |
961 | hlen = IP_VHL_HL(ip.ip_vhl) << 2; |
962 | |
963 | faddr = ip.ip_src; |
964 | laddr = ip.ip_dst; |
965 | |
966 | if (ip.ip_p == IPPROTO_TCP) { |
967 | struct tcphdr th; |
968 | |
969 | error = mbuf_copydata(m, pre + hlen, |
970 | sizeof(struct tcphdr), &th); |
971 | if (error != 0) |
972 | goto done; |
973 | |
974 | fport = th.th_sport; |
975 | lport = th.th_dport; |
976 | |
977 | pcbinfo = &tcbinfo; |
978 | } else if (ip.ip_p == IPPROTO_UDP) { |
979 | struct udphdr uh; |
980 | |
981 | error = mbuf_copydata(m, pre + hlen, |
982 | sizeof(struct udphdr), &uh); |
983 | if (error != 0) { |
984 | PKTAP_LOG(PKTP_LOG_ERROR, |
985 | "mbuf_copydata udp v4 failed for %s\n" , |
986 | hdr->pth_ifname); |
987 | goto done; |
988 | } |
989 | fport = uh.uh_sport; |
990 | lport = uh.uh_dport; |
991 | |
992 | pcbinfo = &udbinfo; |
993 | wildcard = 1; |
994 | } |
995 | if (pcbinfo != NULL) { |
996 | inp = in_pcblookup_hash(pcbinfo, faddr, fport, |
997 | laddr, lport, wildcard, outgoing ? NULL : ifp); |
998 | |
999 | if (inp == NULL && hdr->pth_iftype != IFT_LOOP) |
1000 | PKTAP_LOG(PKTP_LOG_NOPCB, |
1001 | "in_pcblookup_hash no pcb %s\n" , |
1002 | hdr->pth_ifname); |
1003 | } else { |
1004 | PKTAP_LOG(PKTP_LOG_NOPCB, |
1005 | "unknown ip_p %u on %s\n" , |
1006 | ip.ip_p, hdr->pth_ifname); |
1007 | pktap_hexdump(PKTP_LOG_NOPCB, &ip, sizeof(struct ip)); |
1008 | } |
1009 | } else if (proto == PF_INET6) { |
1010 | struct ip6_hdr ip6; |
1011 | errno_t error; |
1012 | struct in6_addr *faddr; |
1013 | struct in6_addr *laddr; |
1014 | u_short fport = 0, lport = 0; |
1015 | struct inpcbinfo *pcbinfo = NULL; |
1016 | int wildcard = 0; |
1017 | |
1018 | error = mbuf_copydata(m, pre, sizeof(struct ip6_hdr), &ip6); |
1019 | if (error != 0) |
1020 | goto done; |
1021 | |
1022 | faddr = &ip6.ip6_src; |
1023 | laddr = &ip6.ip6_dst; |
1024 | |
1025 | if (ip6.ip6_nxt == IPPROTO_TCP) { |
1026 | struct tcphdr th; |
1027 | |
1028 | error = mbuf_copydata(m, pre + sizeof(struct ip6_hdr), |
1029 | sizeof(struct tcphdr), &th); |
1030 | if (error != 0) { |
1031 | PKTAP_LOG(PKTP_LOG_ERROR, |
1032 | "mbuf_copydata tcp v6 failed for %s\n" , |
1033 | hdr->pth_ifname); |
1034 | goto done; |
1035 | } |
1036 | |
1037 | fport = th.th_sport; |
1038 | lport = th.th_dport; |
1039 | |
1040 | pcbinfo = &tcbinfo; |
1041 | } else if (ip6.ip6_nxt == IPPROTO_UDP) { |
1042 | struct udphdr uh; |
1043 | |
1044 | error = mbuf_copydata(m, pre + sizeof(struct ip6_hdr), |
1045 | sizeof(struct udphdr), &uh); |
1046 | if (error != 0) { |
1047 | PKTAP_LOG(PKTP_LOG_ERROR, |
1048 | "mbuf_copydata udp v6 failed for %s\n" , |
1049 | hdr->pth_ifname); |
1050 | goto done; |
1051 | } |
1052 | |
1053 | fport = uh.uh_sport; |
1054 | lport = uh.uh_dport; |
1055 | |
1056 | pcbinfo = &udbinfo; |
1057 | wildcard = 1; |
1058 | } |
1059 | if (pcbinfo != NULL) { |
1060 | inp = in6_pcblookup_hash(pcbinfo, faddr, fport, |
1061 | laddr, lport, wildcard, outgoing ? NULL : ifp); |
1062 | |
1063 | if (inp == NULL && hdr->pth_iftype != IFT_LOOP) |
1064 | PKTAP_LOG(PKTP_LOG_NOPCB, |
1065 | "in6_pcblookup_hash no pcb %s\n" , |
1066 | hdr->pth_ifname); |
1067 | } else { |
1068 | PKTAP_LOG(PKTP_LOG_NOPCB, |
1069 | "unknown ip6.ip6_nxt %u on %s\n" , |
1070 | ip6.ip6_nxt, hdr->pth_ifname); |
1071 | pktap_hexdump(PKTP_LOG_NOPCB, &ip6, sizeof(struct ip6_hdr)); |
1072 | } |
1073 | } |
1074 | if (inp != NULL) { |
1075 | hdr->pth_flags |= PTH_FLAG_SOCKET; |
1076 | if (inp->inp_state != INPCB_STATE_DEAD && inp->inp_socket != NULL) { |
1077 | found = 1; |
1078 | inp_get_soprocinfo(inp, &soprocinfo); |
1079 | } |
1080 | in_pcb_checkstate(inp, WNT_RELEASE, 0); |
1081 | } |
1082 | done: |
1083 | /* |
1084 | * -1 means PID not found |
1085 | */ |
1086 | hdr->pth_pid = -1; |
1087 | hdr->pth_epid = -1; |
1088 | |
1089 | if (found != 0) |
1090 | pktap_set_procinfo(hdr, &soprocinfo); |
1091 | } |
1092 | } |
1093 | |
1094 | __private_extern__ void |
1095 | pktap_bpf_tap(struct ifnet *ifp, protocol_family_t proto, struct mbuf *m, |
1096 | u_int32_t pre, u_int32_t post, int outgoing) |
1097 | { |
1098 | struct pktap_softc *pktap; |
1099 | void (*bpf_tap_func)(ifnet_t, u_int32_t, mbuf_t, void *, size_t) = |
1100 | outgoing ? bpf_tap_out : bpf_tap_in; |
1101 | |
1102 | /* |
1103 | * Skip the coprocessor interface |
1104 | */ |
1105 | if (!intcoproc_unrestricted && IFNET_IS_INTCOPROC(ifp)) |
1106 | return; |
1107 | |
1108 | lck_rw_lock_shared(pktap_lck_rw); |
1109 | |
1110 | /* |
1111 | * No need to take the ifnet_lock as the struct ifnet field if_bpf is |
1112 | * protected by the BPF subsystem |
1113 | */ |
1114 | LIST_FOREACH(pktap, &pktap_list, pktp_link) { |
1115 | int filter_result; |
1116 | |
1117 | filter_result = pktap_filter_evaluate(pktap, ifp); |
1118 | if (filter_result == PKTAP_FILTER_SKIP) |
1119 | continue; |
1120 | |
1121 | if (pktap->pktp_dlt_raw_count > 0) { |
1122 | /* We accept only IPv4 and IPv6 packets for the raw DLT */ |
1123 | if ((proto == AF_INET ||proto == AF_INET6) && |
1124 | !(m->m_pkthdr.pkt_flags & PKTF_INET_RESOLVE)) { |
1125 | /* |
1126 | * We can play just with the length of the first mbuf in the |
1127 | * chain because bpf_tap_imp() disregard the packet length |
1128 | * of the mbuf packet header. |
1129 | */ |
1130 | if (mbuf_setdata(m, m->m_data + pre, m->m_len - pre) == 0) { |
1131 | bpf_tap_func(pktap->pktp_ifp, DLT_RAW, m, NULL, 0); |
1132 | mbuf_setdata(m, m->m_data - pre, m->m_len + pre); |
1133 | } |
1134 | } |
1135 | } |
1136 | |
1137 | if (pktap->pktp_dlt_pkttap_count > 0) { |
1138 | struct { |
1139 | struct pktap_header hdr; |
1140 | u_int32_t proto; |
1141 | } hdr_buffer; |
1142 | struct pktap_header *hdr = &hdr_buffer.hdr; |
1143 | size_t hdr_size = sizeof(struct pktap_header); |
1144 | int unknown_if_type = 0; |
1145 | size_t data_adjust = 0; |
1146 | u_int32_t pre_adjust = 0; |
1147 | |
1148 | /* Verify the structure is packed */ |
1149 | _CASSERT(sizeof(hdr_buffer) == sizeof(struct pktap_header) + sizeof(u_int32_t)); |
1150 | |
1151 | bzero(&hdr_buffer, sizeof(hdr_buffer)); |
1152 | hdr->pth_length = sizeof(struct pktap_header); |
1153 | hdr->pth_type_next = PTH_TYPE_PACKET; |
1154 | |
1155 | /* |
1156 | * Set DLT of packet based on interface type |
1157 | */ |
1158 | switch (ifp->if_type) { |
1159 | case IFT_LOOP: |
1160 | case IFT_GIF: |
1161 | case IFT_STF: |
1162 | case IFT_CELLULAR: |
1163 | /* |
1164 | * Packets from pdp interfaces have no loopback |
1165 | * header that contain the protocol number. |
1166 | * As BPF just concatenate the header and the |
1167 | * packet content in a single buffer, |
1168 | * stash the protocol after the pktap header |
1169 | * and adjust the size of the header accordingly |
1170 | */ |
1171 | hdr->pth_dlt = DLT_NULL; |
1172 | if (pre == 0) { |
1173 | hdr_buffer.proto = proto; |
1174 | hdr_size = sizeof(hdr_buffer); |
1175 | pre_adjust = sizeof(hdr_buffer.proto); |
1176 | } |
1177 | break; |
1178 | case IFT_ETHER: |
1179 | case IFT_BRIDGE: |
1180 | case IFT_L2VLAN: |
1181 | case IFT_IEEE8023ADLAG: |
1182 | hdr->pth_dlt = DLT_EN10MB; |
1183 | break; |
1184 | case IFT_PPP: |
1185 | hdr->pth_dlt = DLT_PPP; |
1186 | break; |
1187 | case IFT_IEEE1394: |
1188 | hdr->pth_dlt = DLT_APPLE_IP_OVER_IEEE1394; |
1189 | break; |
1190 | case IFT_OTHER: |
1191 | if (ifp->if_subfamily == IFNET_SUBFAMILY_IPSEC || |
1192 | ifp->if_subfamily == IFNET_SUBFAMILY_UTUN) { |
1193 | /* |
1194 | * For utun: |
1195 | * - incoming packets do not have the prefix set to four |
1196 | * - some packets are as small as two bytes! |
1197 | */ |
1198 | if (m_pktlen(m) < 4) |
1199 | goto done; |
1200 | if (proto != AF_INET && proto != AF_INET6) |
1201 | goto done; |
1202 | if (proto == AF_INET && (size_t) m_pktlen(m) - 4 < sizeof(struct ip)) |
1203 | goto done; |
1204 | if (proto == AF_INET6 && (size_t) m_pktlen(m) - 4 < sizeof(struct ip6_hdr)) |
1205 | goto done; |
1206 | |
1207 | /* |
1208 | * Handle two cases: |
1209 | * - The old utun encapsulation with the protocol family in network order |
1210 | * - A raw IPv4 or IPv6 packet |
1211 | */ |
1212 | uint8_t data = *(uint8_t *)mbuf_data(m); |
1213 | if ((data >> 4) == 4 || (data >> 4) == 6) { |
1214 | pre = 4; |
1215 | } else { |
1216 | /* |
1217 | * Skip the protocol in the mbuf as it's in network order |
1218 | */ |
1219 | pre = 4; |
1220 | data_adjust = 4; |
1221 | } |
1222 | } |
1223 | hdr->pth_dlt = DLT_NULL; |
1224 | hdr_buffer.proto = proto; |
1225 | hdr_size = sizeof(hdr_buffer); |
1226 | break; |
1227 | default: |
1228 | if (pre == 0) |
1229 | hdr->pth_dlt = DLT_RAW; |
1230 | else |
1231 | unknown_if_type = 1; |
1232 | break; |
1233 | } |
1234 | if (unknown_if_type) { |
1235 | PKTAP_LOG(PKTP_LOG_FUNC, |
1236 | "unknown if_type %u for %s\n" , |
1237 | ifp->if_type, ifp->if_xname); |
1238 | pktap_count_unknown_if_type += 1; |
1239 | } else { |
1240 | strlcpy(hdr->pth_ifname, ifp->if_xname, |
1241 | sizeof(hdr->pth_ifname)); |
1242 | hdr->pth_flags |= outgoing ? PTH_FLAG_DIR_OUT : PTH_FLAG_DIR_IN; |
1243 | hdr->pth_protocol_family = proto; |
1244 | hdr->pth_frame_pre_length = pre + pre_adjust; |
1245 | hdr->pth_frame_post_length = post; |
1246 | hdr->pth_iftype = ifp->if_type; |
1247 | hdr->pth_ifunit = ifp->if_unit; |
1248 | |
1249 | if (m->m_pkthdr.pkt_flags & PKTF_KEEPALIVE) |
1250 | hdr->pth_flags |= PTH_FLAG_KEEP_ALIVE; |
1251 | if (m->m_pkthdr.pkt_flags & PKTF_TCP_REXMT) |
1252 | hdr->pth_flags |= PTH_FLAG_REXMIT; |
1253 | |
1254 | pktap_fill_proc_info(hdr, proto, m, pre, outgoing, ifp); |
1255 | |
1256 | hdr->pth_svc = so_svc2tc(m->m_pkthdr.pkt_svc); |
1257 | |
1258 | if (data_adjust == 0) { |
1259 | bpf_tap_func(pktap->pktp_ifp, DLT_PKTAP, m, hdr, hdr_size); |
1260 | } else { |
1261 | /* |
1262 | * We can play just with the length of the first mbuf in the |
1263 | * chain because bpf_tap_imp() disregard the packet length |
1264 | * of the mbuf packet header. |
1265 | */ |
1266 | if (mbuf_setdata(m, m->m_data + data_adjust, m->m_len - data_adjust) == 0) { |
1267 | bpf_tap_func(pktap->pktp_ifp, DLT_PKTAP, m, hdr, hdr_size); |
1268 | mbuf_setdata(m, m->m_data - data_adjust, m->m_len + data_adjust); |
1269 | } |
1270 | } |
1271 | } |
1272 | } |
1273 | } |
1274 | done: |
1275 | lck_rw_done(pktap_lck_rw); |
1276 | } |
1277 | |
1278 | __private_extern__ void |
1279 | pktap_input(struct ifnet *ifp, protocol_family_t proto, struct mbuf *m, |
1280 | char *) |
1281 | { |
1282 | char *hdr; |
1283 | char *start; |
1284 | |
1285 | /* Fast path */ |
1286 | if (pktap_total_tap_count == 0) |
1287 | return; |
1288 | |
1289 | hdr = (char *)mbuf_data(m); |
1290 | start = (char *)mbuf_datastart(m); |
1291 | /* Make sure the frame header is fully contained in the mbuf */ |
1292 | if (frame_header != NULL && frame_header >= start && frame_header <= hdr) { |
1293 | size_t o_len = m->m_len; |
1294 | u_int32_t pre = hdr - frame_header; |
1295 | |
1296 | if (mbuf_setdata(m, frame_header, o_len + pre) == 0) { |
1297 | PKTAP_LOG(PKTP_LOG_INPUT, "ifp %s proto %u pre %u post %u\n" , |
1298 | ifp->if_xname, proto, pre, 0); |
1299 | |
1300 | pktap_bpf_tap(ifp, proto, m, pre, 0, 0); |
1301 | mbuf_setdata(m, hdr, o_len); |
1302 | } |
1303 | } else { |
1304 | PKTAP_LOG(PKTP_LOG_INPUT, "ifp %s proto %u pre %u post %u\n" , |
1305 | ifp->if_xname, proto, 0, 0); |
1306 | |
1307 | pktap_bpf_tap(ifp, proto, m, 0, 0, 0); |
1308 | } |
1309 | } |
1310 | |
1311 | __private_extern__ void |
1312 | pktap_output(struct ifnet *ifp, protocol_family_t proto, struct mbuf *m, |
1313 | u_int32_t pre, u_int32_t post) |
1314 | { |
1315 | /* Fast path */ |
1316 | if (pktap_total_tap_count == 0) |
1317 | return; |
1318 | |
1319 | PKTAP_LOG(PKTP_LOG_OUTPUT, "ifp %s proto %u pre %u post %u\n" , |
1320 | ifp->if_xname, proto, pre, post); |
1321 | |
1322 | pktap_bpf_tap(ifp, proto, m, pre, post, 1); |
1323 | } |
1324 | |
1325 | |
1326 | void |
1327 | (struct bpf_packet *bpf_pkt, bool truncate) |
1328 | { |
1329 | struct pktap_header *; |
1330 | size_t ; |
1331 | struct pktap_buffer_v2_hdr_extra ; |
1332 | struct pktap_v2_hdr_space *pktap_v2_hdr_space; |
1333 | struct pktap_v2_hdr *pktap_v2_hdr; |
1334 | uint8_t *ptr; |
1335 | |
1336 | pktap_header = (struct pktap_header *)bpf_pkt->bpfp_header; |
1337 | |
1338 | if (pktap_header->pth_type_next != PTH_TYPE_PACKET) { |
1339 | return; |
1340 | } |
1341 | |
1342 | VERIFY(bpf_pkt->bpfp_header_length >= sizeof(struct pktap_header)); |
1343 | |
1344 | /* |
1345 | * extra_src_size is the length of the optional link layer header |
1346 | */ |
1347 | extra_src_size = bpf_pkt->bpfp_header_length - |
1348 | sizeof(struct pktap_header); |
1349 | |
1350 | VERIFY(extra_src_size <= sizeof(union pktap_header_extra)); |
1351 | |
1352 | pktap_v2_hdr_space = &pktap_buffer_v2_hdr_extra.hdr_space; |
1353 | pktap_v2_hdr = &pktap_v2_hdr_space->pth_hdr; |
1354 | ptr = (uint8_t *) (pktap_v2_hdr + 1); |
1355 | |
1356 | COPY_PKTAP_COMMON_FIELDS_TO_V2(pktap_v2_hdr, pktap_header); |
1357 | |
1358 | /* |
1359 | * When truncating don't bother with the process UUIDs |
1360 | */ |
1361 | if (!truncate) { |
1362 | if ((pktap_header->pth_flags & PTH_FLAG_DELAY_PKTAP)) { |
1363 | pktap_v2_hdr->pth_uuid_offset = pktap_v2_hdr->pth_length; |
1364 | pktap_v2_hdr->pth_length += sizeof(uuid_t); |
1365 | uuid_clear(*(uuid_t *)ptr); |
1366 | ptr += sizeof(uuid_t); |
1367 | VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1)); |
1368 | } else if (!uuid_is_null(pktap_header->pth_uuid)) { |
1369 | pktap_v2_hdr->pth_uuid_offset = pktap_v2_hdr->pth_length; |
1370 | uuid_copy(*(uuid_t *)ptr, pktap_header->pth_uuid); |
1371 | pktap_v2_hdr->pth_length += sizeof(uuid_t); |
1372 | ptr += sizeof(uuid_t); |
1373 | VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1)); |
1374 | } |
1375 | |
1376 | if ((pktap_header->pth_flags & PTH_FLAG_DELAY_PKTAP)) { |
1377 | if (pktap_header->pth_flags & PTH_FLAG_PROC_DELEGATED) { |
1378 | pktap_v2_hdr->pth_e_uuid_offset = pktap_v2_hdr->pth_length; |
1379 | uuid_clear(*(uuid_t *)ptr); |
1380 | pktap_v2_hdr->pth_length += sizeof(uuid_t); |
1381 | ptr += sizeof(uuid_t); |
1382 | VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1)); |
1383 | } |
1384 | } else if(!uuid_is_null(pktap_header->pth_euuid)) { |
1385 | pktap_v2_hdr->pth_e_uuid_offset = pktap_v2_hdr->pth_length; |
1386 | uuid_copy(*(uuid_t *)ptr, pktap_header->pth_euuid); |
1387 | pktap_v2_hdr->pth_length += sizeof(uuid_t); |
1388 | ptr += sizeof(uuid_t); |
1389 | VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1)); |
1390 | } |
1391 | } |
1392 | |
1393 | if (pktap_header->pth_ifname[0] != 0) { |
1394 | size_t strsize; |
1395 | |
1396 | pktap_v2_hdr->pth_ifname_offset = pktap_v2_hdr->pth_length; |
1397 | |
1398 | /* |
1399 | * Note: strlcpy() returns the length of the string so we need |
1400 | * to add one for the end-of-string |
1401 | */ |
1402 | strsize = 1 + strlcpy((char *)ptr, pktap_header->pth_ifname, |
1403 | sizeof(pktap_v2_hdr_space->pth_ifname)); |
1404 | pktap_v2_hdr->pth_length += strsize; |
1405 | ptr += strsize; |
1406 | VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1)); |
1407 | } |
1408 | |
1409 | /* |
1410 | * Do not waste space with the process name if we do not have a pid |
1411 | */ |
1412 | if (pktap_header->pth_pid != 0 && pktap_header->pth_pid != -1) { |
1413 | if (pktap_header->pth_comm[0] != 0) { |
1414 | size_t strsize; |
1415 | |
1416 | pktap_v2_hdr->pth_comm_offset = pktap_v2_hdr->pth_length; |
1417 | |
1418 | strsize = 1 + strlcpy((char *)ptr, pktap_header->pth_comm, |
1419 | sizeof(pktap_v2_hdr_space->pth_comm)); |
1420 | pktap_v2_hdr->pth_length += strsize; |
1421 | ptr += strsize; |
1422 | VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1)); |
1423 | } else if ((pktap_header->pth_flags & PTH_FLAG_DELAY_PKTAP)) { |
1424 | size_t strsize = sizeof(pktap_v2_hdr_space->pth_comm); |
1425 | |
1426 | pktap_v2_hdr->pth_comm_offset = pktap_v2_hdr->pth_length; |
1427 | |
1428 | *ptr = 0; /* empty string by default */ |
1429 | pktap_v2_hdr->pth_length += strsize; |
1430 | ptr += strsize; |
1431 | VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1)); |
1432 | } |
1433 | } |
1434 | |
1435 | /* |
1436 | * Do not waste space with the effective process name if we do not have |
1437 | * an effective pid or it's the same as the pid |
1438 | */ |
1439 | if (pktap_header->pth_epid != 0 && pktap_header->pth_epid != -1 && |
1440 | pktap_header->pth_epid != pktap_header->pth_pid) { |
1441 | if (pktap_header->pth_ecomm[0] != 0) { |
1442 | size_t strsize; |
1443 | |
1444 | pktap_v2_hdr->pth_e_comm_offset = pktap_v2_hdr->pth_length; |
1445 | |
1446 | strsize = 1 + strlcpy((char *)ptr, pktap_header->pth_ecomm, |
1447 | sizeof(pktap_v2_hdr_space->pth_e_comm)); |
1448 | pktap_v2_hdr->pth_length += strsize; |
1449 | ptr += strsize; |
1450 | VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1)); |
1451 | } else if ((pktap_header->pth_flags & PTH_FLAG_DELAY_PKTAP)) { |
1452 | size_t strsize = sizeof(pktap_v2_hdr_space->pth_e_comm); |
1453 | |
1454 | pktap_v2_hdr->pth_e_comm_offset = pktap_v2_hdr->pth_length; |
1455 | *ptr = 0; /* empty string by default */ |
1456 | pktap_v2_hdr->pth_length += strsize; |
1457 | ptr += strsize; |
1458 | VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1)); |
1459 | } |
1460 | } |
1461 | |
1462 | if (extra_src_size > 0) { |
1463 | char * = (char *)(pktap_header + 1); |
1464 | char * = ((char *)pktap_v2_hdr) + |
1465 | pktap_v2_hdr->pth_length; |
1466 | |
1467 | VERIFY(pktap_v2_hdr->pth_length + extra_src_size <= |
1468 | sizeof(struct pktap_buffer_v2_hdr_extra)); |
1469 | |
1470 | memcpy(extra_dst_ptr, extra_src_ptr, extra_src_size); |
1471 | } |
1472 | |
1473 | VERIFY(pktap_v2_hdr->pth_length + extra_src_size <= |
1474 | bpf_pkt->bpfp_header_length); |
1475 | |
1476 | memcpy(bpf_pkt->bpfp_header, pktap_v2_hdr, |
1477 | pktap_v2_hdr->pth_length + extra_src_size); |
1478 | |
1479 | bpf_pkt->bpfp_total_length += pktap_v2_hdr->pth_length - |
1480 | sizeof(struct pktap_header); |
1481 | bpf_pkt->bpfp_header_length += pktap_v2_hdr->pth_length - |
1482 | sizeof(struct pktap_header); |
1483 | } |
1484 | |
1485 | |