1 | /* |
2 | * Copyright (c) 2022 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | #include <skywalk/os_skywalk_private.h> |
30 | #include <IOKit/IOBSD.h> |
31 | |
32 | static int |
33 | nxioctl_check_entitlement(u_long cmd) |
34 | { |
35 | boolean_t entitled = FALSE; |
36 | |
37 | if (kauth_cred_issuser(cred: kauth_cred_get())) { |
38 | return 0; |
39 | } |
40 | switch (cmd) { |
41 | case NXIOC_ADD_TRAFFIC_RULE_INET: |
42 | case NXIOC_REMOVE_TRAFFIC_RULE: |
43 | entitled = IOCurrentTaskHasEntitlement( |
44 | NXCTL_TRAFFIC_RULE_WRITE_ENTITLEMENT); |
45 | break; |
46 | case NXIOC_GET_TRAFFIC_RULES: |
47 | entitled = IOCurrentTaskHasEntitlement( |
48 | NXCTL_TRAFFIC_RULE_READ_ENTITLEMENT); |
49 | break; |
50 | default: |
51 | SK_ERR("invalid command %x" , cmd); |
52 | return ENOTSUP; |
53 | } |
54 | return entitled ? 0 : EPERM; |
55 | } |
56 | |
57 | int |
58 | nxioctl(struct nxctl *nxctl, u_long cmd, caddr_t data, proc_t procp) |
59 | { |
60 | int err; |
61 | |
62 | if ((err = nxioctl_check_entitlement(cmd)) != 0) { |
63 | return err; |
64 | } |
65 | switch (cmd) { |
66 | case NXIOC_ADD_TRAFFIC_RULE_INET: |
67 | return nxioctl_add_traffic_rule_inet(nxctl, data, procp); |
68 | case NXIOC_REMOVE_TRAFFIC_RULE: |
69 | return nxioctl_remove_traffic_rule(nxctl, data, procp); |
70 | case NXIOC_GET_TRAFFIC_RULES: |
71 | return nxioctl_get_traffic_rules(nxctl, data, procp); |
72 | default: |
73 | SK_ERR("invalid command %x" , cmd); |
74 | return ENOTSUP; |
75 | } |
76 | } |
77 | |