1/*
2 * Copyright (c) 2012-2018 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29#include <kern/locks.h>
30#include <kern/zalloc.h>
31
32#include <sys/types.h>
33#include <sys/kernel_types.h>
34#include <sys/kauth.h>
35#include <sys/socket.h>
36#include <sys/socketvar.h>
37#include <sys/sockio.h>
38#include <sys/sysctl.h>
39#include <sys/proc.h>
40
41#include <net/if.h>
42#include <net/if_var.h>
43#include <net/if_types.h>
44#include <net/bpf.h>
45#include <net/net_osdep.h>
46#include <net/pktap.h>
47
48#include <netinet/in_pcb.h>
49#include <netinet/tcp.h>
50#include <netinet/tcp_var.h>
51#define _IP_VHL
52#include <netinet/ip.h>
53#include <netinet/ip_var.h>
54#include <netinet/udp.h>
55#include <netinet/udp_var.h>
56
57#include <netinet/ip6.h>
58#include <netinet6/in6_pcb.h>
59
60#include <libkern/OSAtomic.h>
61
62#include <kern/debug.h>
63
64#include <sys/mcache.h>
65
66#include <string.h>
67
68extern struct inpcbinfo ripcbinfo;
69
70struct pktap_softc {
71 LIST_ENTRY(pktap_softc) pktp_link;
72 uint32_t pktp_unit;
73 uint32_t pktp_dlt_raw_count;
74 uint32_t pktp_dlt_pkttap_count;
75 struct ifnet *pktp_ifp;
76 struct pktap_filter pktp_filters[PKTAP_MAX_FILTERS];
77};
78
79#ifndef PKTAP_DEBUG
80#define PKTAP_DEBUG 0
81#endif /* PKTAP_DEBUG */
82
83#define PKTAP_FILTER_OK 0 /* Packet passes filter checks */
84#define PKTAP_FILTER_SKIP 1 /* Do not tap this packet */
85
86static int pktap_inited = 0;
87
88SYSCTL_DECL(_net_link);
89SYSCTL_NODE(_net_link, IFT_PKTAP, pktap,
90 CTLFLAG_RW |CTLFLAG_LOCKED, 0, "pktap virtual interface");
91
92uint32_t pktap_total_tap_count = 0;
93SYSCTL_UINT(_net_link_pktap, OID_AUTO, total_tap_count,
94 CTLFLAG_RD | CTLFLAG_LOCKED, &pktap_total_tap_count, 0, "");
95
96static u_int64_t pktap_count_unknown_if_type = 0;
97SYSCTL_QUAD(_net_link_pktap, OID_AUTO, count_unknown_if_type,
98 CTLFLAG_RD | CTLFLAG_LOCKED, &pktap_count_unknown_if_type, "");
99
100static int pktap_log = 0;
101SYSCTL_INT(_net_link_pktap, OID_AUTO, log,
102 CTLFLAG_RW | CTLFLAG_LOCKED, &pktap_log, 0, "");
103
104#define PKTAP_LOG(mask, fmt, ...) \
105do { \
106 if ((pktap_log & mask)) \
107 printf("%s:%d " fmt, __FUNCTION__, __LINE__, ##__VA_ARGS__); \
108} while (false)
109
110#define PKTP_LOG_FUNC 0x01
111#define PKTP_LOG_FILTER 0x02
112#define PKTP_LOG_INPUT 0x04
113#define PKTP_LOG_OUTPUT 0x08
114#define PKTP_LOG_ERROR 0x10
115#define PKTP_LOG_NOPCB 0x20
116
117/*
118 * pktap_lck_rw protects the global list of pktap interfaces
119 */
120decl_lck_rw_data(static, pktap_lck_rw_data);
121static lck_rw_t *pktap_lck_rw = &pktap_lck_rw_data;
122static lck_grp_t *pktap_lck_grp = NULL;
123static lck_attr_t *pktap_lck_attr = NULL;
124
125static LIST_HEAD(pktap_list, pktap_softc) pktap_list =
126 LIST_HEAD_INITIALIZER(pktap_list);
127
128int pktap_clone_create(struct if_clone *, u_int32_t, void *);
129int pktap_clone_destroy(struct ifnet *);
130
131#define PKTAP_MAXUNIT IF_MAXUNIT
132#define PKTAP_ZONE_MAX_ELEM MIN(IFNETS_MAX, PKTAP_MAXUNIT)
133
134static struct if_clone pktap_cloner =
135 IF_CLONE_INITIALIZER(PKTAP_IFNAME,
136 pktap_clone_create,
137 pktap_clone_destroy,
138 0,
139 PKTAP_MAXUNIT,
140 PKTAP_ZONE_MAX_ELEM,
141 sizeof(struct pktap_softc));
142
143errno_t pktap_if_output(ifnet_t, mbuf_t);
144errno_t pktap_demux(ifnet_t, mbuf_t, char *, protocol_family_t *);
145errno_t pktap_add_proto(ifnet_t, protocol_family_t,
146 const struct ifnet_demux_desc *, u_int32_t);
147errno_t pktap_del_proto(ifnet_t, protocol_family_t);
148errno_t pktap_getdrvspec(ifnet_t, struct ifdrv64 *);
149errno_t pktap_setdrvspec(ifnet_t, struct ifdrv64 *);
150errno_t pktap_ioctl(ifnet_t, unsigned long, void *);
151void pktap_detach(ifnet_t);
152int pktap_filter_evaluate(struct pktap_softc *, struct ifnet *);
153void pktap_bpf_tap(struct ifnet *, protocol_family_t, struct mbuf *,
154 u_int32_t, u_int32_t, int);
155errno_t pktap_tap_callback(ifnet_t, u_int32_t, bpf_tap_mode);
156
157static void
158pktap_hexdump(int mask, void *addr, size_t len)
159{
160 unsigned char *buf = addr;
161 size_t i;
162
163 if (!(pktap_log & mask))
164 return;
165
166 for (i = 0; i < len; i++) {
167 unsigned char h = (buf[i] & 0xf0) >> 4;
168 unsigned char l = buf[i] & 0x0f;
169
170 if (i != 0) {
171 if (i % 32 == 0)
172 printf("\n");
173 else if (i % 4 == 0)
174 printf(" ");
175 }
176 printf("%c%c",
177 h < 10 ? h + '0' : h - 10 + 'a',
178 l < 10 ? l + '0' : l - 10 + 'a');
179 }
180 if (i % 32 != 0)
181 printf("\n");
182}
183
184#define _CASSERT_OFFFSETOF_FIELD(s1, s2, f) \
185 _CASSERT(offsetof(struct s1, f) == offsetof(struct s2, f))
186
187__private_extern__ void
188pktap_init(void)
189{
190 int error = 0;
191 lck_grp_attr_t *lck_grp_attr = NULL;
192
193 _CASSERT_OFFFSETOF_FIELD(pktap_header, pktap_v2_hdr, pth_flags);
194
195 /* Make sure we're called only once */
196 VERIFY(pktap_inited == 0);
197
198 pktap_inited = 1;
199
200 lck_grp_attr = lck_grp_attr_alloc_init();
201 pktap_lck_grp = lck_grp_alloc_init("pktap", lck_grp_attr);
202 pktap_lck_attr = lck_attr_alloc_init();
203#if PKTAP_DEBUG
204 lck_attr_setdebug(pktap_lck_attr);
205#endif /* PKTAP_DEBUG */
206 lck_rw_init(pktap_lck_rw, pktap_lck_grp, pktap_lck_attr);
207 lck_grp_attr_free(lck_grp_attr);
208
209 LIST_INIT(&pktap_list);
210
211 error = if_clone_attach(&pktap_cloner);
212 if (error != 0)
213 panic("%s: if_clone_attach() failed, error %d\n",
214 __func__, error);
215}
216
217__private_extern__ int
218pktap_clone_create(struct if_clone *ifc, u_int32_t unit, __unused void *params)
219{
220 int error = 0;
221 struct pktap_softc *pktap = NULL;
222 struct ifnet_init_eparams if_init;
223
224 PKTAP_LOG(PKTP_LOG_FUNC, "unit %u\n", unit);
225
226 pktap = if_clone_softc_allocate(&pktap_cloner);
227 if (pktap == NULL) {
228 printf("%s: _MALLOC failed\n", __func__);
229 error = ENOMEM;
230 goto done;
231 }
232 pktap->pktp_unit = unit;
233
234 /*
235 * By default accept packet from physical interfaces
236 */
237 pktap->pktp_filters[0].filter_op = PKTAP_FILTER_OP_PASS;
238 pktap->pktp_filters[0].filter_param = PKTAP_FILTER_PARAM_IF_TYPE;
239 pktap->pktp_filters[0].filter_param_if_type = IFT_ETHER;
240
241#if CONFIG_EMBEDDED
242 pktap->pktp_filters[1].filter_op = PKTAP_FILTER_OP_PASS;
243 pktap->pktp_filters[1].filter_param = PKTAP_FILTER_PARAM_IF_TYPE;
244 pktap->pktp_filters[1].filter_param_if_type = IFT_CELLULAR;
245#else /* CONFIG_EMBEDDED */
246 pktap->pktp_filters[1].filter_op = PKTAP_FILTER_OP_PASS;
247 pktap->pktp_filters[1].filter_param = PKTAP_FILTER_PARAM_IF_TYPE;
248 pktap->pktp_filters[1].filter_param_if_type = IFT_IEEE1394;
249#endif /* CONFIG_EMBEDDED */
250
251#if (DEVELOPMENT || DEBUG)
252 pktap->pktp_filters[2].filter_op = PKTAP_FILTER_OP_PASS;
253 pktap->pktp_filters[2].filter_param = PKTAP_FILTER_PARAM_IF_TYPE;
254 pktap->pktp_filters[2].filter_param_if_type = IFT_OTHER;
255#endif /* DEVELOPMENT || DEBUG */
256
257 /*
258 * We do not use a set_bpf_tap() function as we rather rely on the more
259 * accurate callback passed to bpf_attach()
260 */
261 bzero(&if_init, sizeof(if_init));
262 if_init.ver = IFNET_INIT_CURRENT_VERSION;
263 if_init.len = sizeof (if_init);
264 if_init.flags = IFNET_INIT_LEGACY;
265 if_init.name = ifc->ifc_name;
266 if_init.unit = unit;
267 if_init.type = IFT_PKTAP;
268 if_init.family = IFNET_FAMILY_LOOPBACK;
269 if_init.output = pktap_if_output;
270 if_init.demux = pktap_demux;
271 if_init.add_proto = pktap_add_proto;
272 if_init.del_proto = pktap_del_proto;
273 if_init.softc = pktap;
274 if_init.ioctl = pktap_ioctl;
275 if_init.detach = pktap_detach;
276
277 error = ifnet_allocate_extended(&if_init, &pktap->pktp_ifp);
278 if (error != 0) {
279 printf("%s: ifnet_allocate failed, error %d\n",
280 __func__, error);
281 goto done;
282 }
283
284 ifnet_set_flags(pktap->pktp_ifp, IFF_UP, IFF_UP);
285
286 error = ifnet_attach(pktap->pktp_ifp, NULL);
287 if (error != 0) {
288 printf("%s: ifnet_attach failed - error %d\n", __func__, error);
289 ifnet_release(pktap->pktp_ifp);
290 goto done;
291 }
292
293 /* Attach DLT_PKTAP as the default DLT */
294 bpf_attach(pktap->pktp_ifp, DLT_PKTAP, sizeof(struct pktap_header),
295 NULL, pktap_tap_callback);
296 bpf_attach(pktap->pktp_ifp, DLT_RAW, 0, NULL, pktap_tap_callback);
297
298 /* Take a reference and add to the global list */
299 ifnet_reference(pktap->pktp_ifp);
300 lck_rw_lock_exclusive(pktap_lck_rw);
301 LIST_INSERT_HEAD(&pktap_list, pktap, pktp_link);
302 lck_rw_done(pktap_lck_rw);
303done:
304 if (error != 0 && pktap != NULL)
305 if_clone_softc_deallocate(&pktap_cloner, pktap);
306 return (error);
307}
308
309__private_extern__ int
310pktap_clone_destroy(struct ifnet *ifp)
311{
312 int error = 0;
313
314 PKTAP_LOG(PKTP_LOG_FUNC, "%s\n", ifp->if_xname);
315
316 (void) ifnet_detach(ifp);
317
318 return (error);
319}
320
321/*
322 * This function is called whenever a DLT is set on the interface:
323 * - When interface is attached to a BPF device via BIOCSETIF for the
324 * default DLT
325 * - Whenever a new DLT is selected via BIOCSDLT
326 * - When the interface is detached from a BPF device (direction is zero)
327 */
328__private_extern__ errno_t
329pktap_tap_callback(ifnet_t ifp, u_int32_t dlt, bpf_tap_mode direction)
330{
331 struct pktap_softc *pktap;
332
333 pktap = ifp->if_softc;
334 if (pktap == NULL) {
335 printf("%s: if_softc is NULL for ifp %s\n", __func__,
336 ifp->if_xname);
337 goto done;
338 }
339 switch (dlt) {
340 case DLT_RAW:
341 if (direction == 0) {
342 if (pktap->pktp_dlt_raw_count > 0) {
343 pktap->pktp_dlt_raw_count--;
344 OSAddAtomic(-1, &pktap_total_tap_count);
345
346 }
347 } else {
348 pktap->pktp_dlt_raw_count++;
349 OSAddAtomic(1, &pktap_total_tap_count);
350 }
351 break;
352 case DLT_PKTAP:
353 if (direction == 0) {
354 if (pktap->pktp_dlt_pkttap_count > 0) {
355 pktap->pktp_dlt_pkttap_count--;
356 OSAddAtomic(-1, &pktap_total_tap_count);
357 }
358 } else {
359 pktap->pktp_dlt_pkttap_count++;
360 OSAddAtomic(1, &pktap_total_tap_count);
361 }
362 break;
363 }
364done:
365 /*
366 * Attachements count must be positive and we're in trouble
367 * if we have more that 2**31 attachements
368 */
369 VERIFY(pktap_total_tap_count >= 0);
370
371 return (0);
372}
373
374__private_extern__ errno_t
375pktap_if_output(ifnet_t ifp, mbuf_t m)
376{
377 PKTAP_LOG(PKTP_LOG_FUNC, "%s\n", ifp->if_xname);
378 mbuf_freem(m);
379 return (ENOTSUP);
380}
381
382__private_extern__ errno_t
383pktap_demux(ifnet_t ifp, __unused mbuf_t m, __unused char *header,
384 __unused protocol_family_t *ppf)
385{
386 PKTAP_LOG(PKTP_LOG_FUNC, "%s\n", ifp->if_xname);
387 return (ENOTSUP);
388}
389
390__private_extern__ errno_t
391pktap_add_proto(__unused ifnet_t ifp, protocol_family_t pf,
392 __unused const struct ifnet_demux_desc *dmx, __unused u_int32_t cnt)
393{
394 PKTAP_LOG(PKTP_LOG_FUNC, "%s pf %u\n", ifp->if_xname, pf);
395 return (0);
396}
397
398__private_extern__ errno_t
399pktap_del_proto(__unused ifnet_t ifp, __unused protocol_family_t pf)
400{
401 PKTAP_LOG(PKTP_LOG_FUNC, "%s pf %u\n", ifp->if_xname, pf);
402 return (0);
403}
404
405__private_extern__ errno_t
406pktap_getdrvspec(ifnet_t ifp, struct ifdrv64 *ifd)
407{
408 errno_t error = 0;
409 struct pktap_softc *pktap;
410 int i;
411
412 PKTAP_LOG(PKTP_LOG_FUNC, "%s\n", ifp->if_xname);
413
414 pktap = ifp->if_softc;
415 if (pktap == NULL) {
416 error = ENOENT;
417 printf("%s: pktap NULL - error %d\n", __func__, error);
418 goto done;
419 }
420
421 switch (ifd->ifd_cmd) {
422 case PKTP_CMD_FILTER_GET: {
423 struct x_pktap_filter x_filters[PKTAP_MAX_FILTERS];
424
425 bzero(&x_filters, sizeof(x_filters));
426
427 if (ifd->ifd_len < PKTAP_MAX_FILTERS * sizeof(struct x_pktap_filter)) {
428 printf("%s: PKTP_CMD_FILTER_GET ifd_len %llu too small - error %d\n",
429 __func__, ifd->ifd_len, error);
430 error = EINVAL;
431 break;
432 }
433 for (i = 0; i < PKTAP_MAX_FILTERS; i++) {
434 struct pktap_filter *pktap_filter = pktap->pktp_filters + i;
435 struct x_pktap_filter *x_filter = x_filters + i;
436
437 x_filter->filter_op = pktap_filter->filter_op;
438 x_filter->filter_param = pktap_filter->filter_param;
439
440 if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_TYPE)
441 x_filter->filter_param_if_type = pktap_filter->filter_param_if_type;
442 else if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_NAME)
443 strlcpy(x_filter->filter_param_if_name,
444 pktap_filter->filter_param_if_name,
445 sizeof(x_filter->filter_param_if_name));
446 }
447 error = copyout(x_filters, ifd->ifd_data,
448 PKTAP_MAX_FILTERS * sizeof(struct x_pktap_filter));
449 if (error) {
450 printf("%s: PKTP_CMD_FILTER_GET copyout - error %d\n", __func__, error);
451 goto done;
452 }
453 break;
454 }
455 case PKTP_CMD_TAP_COUNT: {
456 uint32_t tap_count = pktap->pktp_dlt_raw_count + pktap->pktp_dlt_pkttap_count;
457
458 if (ifd->ifd_len < sizeof(tap_count)) {
459 printf("%s: PKTP_CMD_TAP_COUNT ifd_len %llu too small - error %d\n",
460 __func__, ifd->ifd_len, error);
461 error = EINVAL;
462 break;
463 }
464 error = copyout(&tap_count, ifd->ifd_data, sizeof(tap_count));
465 if (error) {
466 printf("%s: PKTP_CMD_TAP_COUNT copyout - error %d\n", __func__, error);
467 goto done;
468 }
469 break;
470 }
471 default:
472 error = EINVAL;
473 break;
474 }
475
476done:
477 return (error);
478}
479
480__private_extern__ errno_t
481pktap_setdrvspec(ifnet_t ifp, struct ifdrv64 *ifd)
482{
483 errno_t error = 0;
484 struct pktap_softc *pktap;
485
486 PKTAP_LOG(PKTP_LOG_FUNC, "%s\n", ifp->if_xname);
487
488 pktap = ifp->if_softc;
489 if (pktap == NULL) {
490 error = ENOENT;
491 printf("%s: pktap NULL - error %d\n", __func__, error);
492 goto done;
493 }
494
495 switch (ifd->ifd_cmd) {
496 case PKTP_CMD_FILTER_SET: {
497 struct x_pktap_filter user_filters[PKTAP_MAX_FILTERS];
498 int i;
499 int got_op_none = 0;
500
501 if (ifd->ifd_len != PKTAP_MAX_FILTERS * sizeof(struct x_pktap_filter)) {
502 printf("%s: PKTP_CMD_FILTER_SET bad ifd_len %llu - error %d\n",
503 __func__, ifd->ifd_len, error);
504 error = EINVAL;
505 break;
506 }
507 error = copyin(ifd->ifd_data, &user_filters, ifd->ifd_len);
508 if (error) {
509 printf("%s: copyin - error %d\n", __func__, error);
510 goto done;
511 }
512 /*
513 * Validate user provided parameters
514 */
515 for (i = 0; i < PKTAP_MAX_FILTERS; i++) {
516 struct x_pktap_filter *x_filter = user_filters + i;
517
518 switch (x_filter->filter_op) {
519 case PKTAP_FILTER_OP_NONE:
520 /* Following entries must be PKTAP_FILTER_OP_NONE */
521 got_op_none = 1;
522 break;
523 case PKTAP_FILTER_OP_PASS:
524 case PKTAP_FILTER_OP_SKIP:
525 /* Invalid after PKTAP_FILTER_OP_NONE */
526 if (got_op_none) {
527 error = EINVAL;
528 break;
529 }
530 break;
531 default:
532 error = EINVAL;
533 break;
534 }
535 if (error != 0)
536 break;
537
538 switch (x_filter->filter_param) {
539 case PKTAP_FILTER_OP_NONE:
540 if (x_filter->filter_op != PKTAP_FILTER_OP_NONE) {
541 error = EINVAL;
542 break;
543 }
544 break;
545
546 /*
547 * Do not allow to tap a pktap from a pktap
548 */
549 case PKTAP_FILTER_PARAM_IF_TYPE:
550 if (x_filter->filter_param_if_type == IFT_PKTAP ||
551 x_filter->filter_param_if_type > 0xff) {
552 error = EINVAL;
553 break;
554 }
555 break;
556
557 case PKTAP_FILTER_PARAM_IF_NAME:
558 if (strncmp(x_filter->filter_param_if_name, PKTAP_IFNAME,
559 strlen(PKTAP_IFNAME)) == 0) {
560 error = EINVAL;
561 break;
562 }
563 break;
564
565 default:
566 error = EINVAL;
567 break;
568 }
569 if (error != 0)
570 break;
571 }
572 if (error != 0)
573 break;
574 for (i = 0; i < PKTAP_MAX_FILTERS; i++) {
575 struct pktap_filter *pktap_filter = pktap->pktp_filters + i;
576 struct x_pktap_filter *x_filter = user_filters + i;
577
578 pktap_filter->filter_op = x_filter->filter_op;
579 pktap_filter->filter_param = x_filter->filter_param;
580
581 if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_TYPE)
582 pktap_filter->filter_param_if_type = x_filter->filter_param_if_type;
583 else if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_NAME) {
584 size_t len;
585
586 strlcpy(pktap_filter->filter_param_if_name,
587 x_filter->filter_param_if_name,
588 sizeof(pktap_filter->filter_param_if_name));
589 /*
590 * If name does not end with a number then it's a "wildcard" match
591 * where we compare the prefix of the interface name
592 */
593 len = strlen(pktap_filter->filter_param_if_name);
594 if (pktap_filter->filter_param_if_name[len] < '0' ||
595 pktap_filter->filter_param_if_name[len] > '9')
596 pktap_filter->filter_ifname_prefix_len = len;
597 }
598 }
599 break;
600 }
601 default:
602 error = EINVAL;
603 break;
604 }
605
606done:
607 return (error);
608}
609
610__private_extern__ errno_t
611pktap_ioctl(ifnet_t ifp, unsigned long cmd, void *data)
612{
613 errno_t error = 0;
614
615 PKTAP_LOG(PKTP_LOG_FUNC, "%s\n", ifp->if_xname);
616
617 if ((cmd & IOC_IN)) {
618 error = kauth_authorize_generic(kauth_cred_get(), KAUTH_GENERIC_ISSUSER);
619 if (error) {
620 PKTAP_LOG(PKTP_LOG_ERROR,
621 "%s: kauth_authorize_generic(KAUTH_GENERIC_ISSUSER) - error %d\n",
622 __func__, error);
623 goto done;
624 }
625 }
626
627 switch (cmd) {
628 case SIOCGDRVSPEC32: {
629 struct ifdrv64 ifd;
630 struct ifdrv32 *ifd32 = (struct ifdrv32 *)data;
631
632 memcpy(ifd.ifd_name, ifd32->ifd_name, sizeof(ifd.ifd_name));
633 ifd.ifd_cmd = ifd32->ifd_cmd;
634 ifd.ifd_len = ifd32->ifd_len;
635 ifd.ifd_data = ifd32->ifd_data;
636
637 error = pktap_getdrvspec(ifp, &ifd);
638
639 break;
640 }
641 case SIOCGDRVSPEC64: {
642 struct ifdrv64 *ifd64 = (struct ifdrv64 *)data;
643
644 error = pktap_getdrvspec(ifp, ifd64);
645
646 break;
647 }
648 case SIOCSDRVSPEC32: {
649 struct ifdrv64 ifd;
650 struct ifdrv32 *ifd32 = (struct ifdrv32 *)data;
651
652 memcpy(ifd.ifd_name, ifd32->ifd_name, sizeof(ifd.ifd_name));
653 ifd.ifd_cmd = ifd32->ifd_cmd;
654 ifd.ifd_len = ifd32->ifd_len;
655 ifd.ifd_data = ifd32->ifd_data;
656
657 error = pktap_setdrvspec(ifp, &ifd);
658 break;
659 }
660 case SIOCSDRVSPEC64: {
661 struct ifdrv64 *ifd64 = (struct ifdrv64 *)data;
662
663 error = pktap_setdrvspec(ifp, ifd64);
664
665 break;
666 }
667 default:
668 error = ENOTSUP;
669 break;
670 }
671done:
672 return (error);
673}
674
675__private_extern__ void
676pktap_detach(ifnet_t ifp)
677{
678 struct pktap_softc *pktap;
679
680 PKTAP_LOG(PKTP_LOG_FUNC, "%s\n", ifp->if_xname);
681
682 lck_rw_lock_exclusive(pktap_lck_rw);
683
684 pktap = ifp->if_softc;
685 ifp->if_softc = NULL;
686 LIST_REMOVE(pktap, pktp_link);
687
688 lck_rw_done(pktap_lck_rw);
689
690 /* Drop reference as it's no more on the global list */
691 ifnet_release(ifp);
692
693 if_clone_softc_deallocate(&pktap_cloner, pktap);
694 /* This is for the reference taken by ifnet_attach() */
695 (void) ifnet_release(ifp);
696}
697
698__private_extern__ int
699pktap_filter_evaluate(struct pktap_softc *pktap, struct ifnet *ifp)
700{
701 int i;
702 int result = PKTAP_FILTER_SKIP; /* Need positive matching rule to pass */
703 int match = 0;
704
705 for (i = 0; i < PKTAP_MAX_FILTERS; i++) {
706 struct pktap_filter *pktap_filter = pktap->pktp_filters + i;
707 size_t len = pktap_filter->filter_ifname_prefix_len != 0 ?
708 pktap_filter->filter_ifname_prefix_len : PKTAP_IFXNAMESIZE;
709
710 switch (pktap_filter->filter_op) {
711 case PKTAP_FILTER_OP_NONE:
712 match = 1;
713 break;
714
715 case PKTAP_FILTER_OP_PASS:
716 if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_TYPE) {
717 if (pktap_filter->filter_param_if_type == 0 ||
718 ifp->if_type == pktap_filter->filter_param_if_type) {
719 result = PKTAP_FILTER_OK;
720 match = 1;
721 PKTAP_LOG(PKTP_LOG_FILTER, "pass %s match type %u\n",
722 ifp->if_xname, pktap_filter->filter_param_if_type);
723 break;
724 }
725 }
726 if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_NAME) {
727 if (strncmp(ifp->if_xname, pktap_filter->filter_param_if_name,
728 len) == 0) {
729 result = PKTAP_FILTER_OK;
730 match = 1;
731 PKTAP_LOG(PKTP_LOG_FILTER, "pass %s match name %s\n",
732 ifp->if_xname, pktap_filter->filter_param_if_name);
733 break;
734 }
735 }
736 break;
737
738 case PKTAP_FILTER_OP_SKIP:
739 if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_TYPE) {
740 if (pktap_filter->filter_param_if_type == 0 ||
741 ifp->if_type == pktap_filter->filter_param_if_type) {
742 result = PKTAP_FILTER_SKIP;
743 match = 1;
744 PKTAP_LOG(PKTP_LOG_FILTER, "skip %s match type %u\n",
745 ifp->if_xname, pktap_filter->filter_param_if_type);
746 break;
747 }
748 }
749 if (pktap_filter->filter_param == PKTAP_FILTER_PARAM_IF_NAME) {
750 if (strncmp(ifp->if_xname, pktap_filter->filter_param_if_name,
751 len) == 0) {
752 result = PKTAP_FILTER_SKIP;
753 match = 1;
754 PKTAP_LOG(PKTP_LOG_FILTER, "skip %s match name %s\n",
755 ifp->if_xname, pktap_filter->filter_param_if_name);
756 break;
757 }
758 }
759 break;
760 }
761 if (match)
762 break;
763 }
764
765 if (match == 0) {
766 PKTAP_LOG(PKTP_LOG_FILTER, "%s no match\n",
767 ifp->if_xname);
768 }
769 return (result);
770}
771
772static void
773pktap_set_procinfo(struct pktap_header *hdr, struct so_procinfo *soprocinfo)
774{
775 hdr->pth_pid = soprocinfo->spi_pid;
776 if (hdr->pth_comm[0] == 0)
777 proc_name(soprocinfo->spi_pid, hdr->pth_comm, MAXCOMLEN);
778 if (soprocinfo->spi_pid != 0)
779 uuid_copy(hdr->pth_uuid, soprocinfo->spi_uuid);
780
781 if (soprocinfo->spi_delegated != 0) {
782 hdr->pth_flags |= PTH_FLAG_PROC_DELEGATED;
783 hdr->pth_epid = soprocinfo->spi_epid;
784 if (hdr->pth_ecomm[0] == 0)
785 proc_name(soprocinfo->spi_epid, hdr->pth_ecomm, MAXCOMLEN);
786 uuid_copy(hdr->pth_euuid, soprocinfo->spi_euuid);
787 }
788}
789
790__private_extern__ void
791pktap_finalize_proc_info(struct pktap_header *hdr)
792{
793 int found;
794 struct so_procinfo soprocinfo;
795
796 if (!(hdr->pth_flags & PTH_FLAG_DELAY_PKTAP))
797 return;
798
799 if (hdr->pth_ipproto == IPPROTO_TCP)
800 found = inp_findinpcb_procinfo(&tcbinfo, hdr->pth_flowid,
801 &soprocinfo);
802 else if (hdr->pth_ipproto == IPPROTO_UDP)
803 found = inp_findinpcb_procinfo(&udbinfo, hdr->pth_flowid,
804 &soprocinfo);
805 else
806 found = inp_findinpcb_procinfo(&ripcbinfo, hdr->pth_flowid,
807 &soprocinfo);
808
809 if (found == 1)
810 pktap_set_procinfo(hdr, &soprocinfo);
811}
812
813static void
814pktap_v2_set_procinfo(struct pktap_v2_hdr *pktap_v2_hdr,
815 struct so_procinfo *soprocinfo)
816{
817 pktap_v2_hdr->pth_pid = soprocinfo->spi_pid;
818
819 if (soprocinfo->spi_pid != 0 && soprocinfo->spi_pid != -1) {
820 if (pktap_v2_hdr->pth_comm_offset != 0) {
821 char *ptr = ((char *)pktap_v2_hdr) +
822 pktap_v2_hdr->pth_comm_offset;
823
824 proc_name(soprocinfo->spi_pid,
825 ptr, PKTAP_MAX_COMM_SIZE);
826 }
827 if (pktap_v2_hdr->pth_uuid_offset != 0) {
828 uuid_t *ptr = (uuid_t *) (((char *)pktap_v2_hdr) +
829 pktap_v2_hdr->pth_uuid_offset);
830
831 uuid_copy(*ptr, soprocinfo->spi_uuid);
832 }
833 }
834
835 if (!(pktap_v2_hdr->pth_flags & PTH_FLAG_PROC_DELEGATED))
836 return;
837
838 /*
839 * The effective UUID may be set independently from the effective pid
840 */
841 if (soprocinfo->spi_delegated != 0) {
842 pktap_v2_hdr->pth_flags |= PTH_FLAG_PROC_DELEGATED;
843 pktap_v2_hdr->pth_e_pid = soprocinfo->spi_epid;
844
845 if (soprocinfo->spi_pid != 0 && soprocinfo->spi_pid != -1 &&
846 pktap_v2_hdr->pth_e_comm_offset != 0) {
847 char *ptr = ((char *)pktap_v2_hdr) +
848 pktap_v2_hdr->pth_e_comm_offset;
849
850 proc_name(soprocinfo->spi_epid,
851 ptr, PKTAP_MAX_COMM_SIZE);
852 }
853 if (pktap_v2_hdr->pth_e_uuid_offset != 0) {
854 uuid_t *ptr = (uuid_t *) (((char *)pktap_v2_hdr) +
855 pktap_v2_hdr->pth_e_uuid_offset);
856
857 uuid_copy(*ptr, soprocinfo->spi_euuid);
858 }
859 }
860}
861
862__private_extern__ void
863pktap_v2_finalize_proc_info(struct pktap_v2_hdr *pktap_v2_hdr)
864{
865 int found;
866 struct so_procinfo soprocinfo;
867
868 if (!(pktap_v2_hdr->pth_flags & PTH_FLAG_DELAY_PKTAP))
869 return;
870
871 if (pktap_v2_hdr->pth_ipproto == IPPROTO_TCP) {
872 found = inp_findinpcb_procinfo(&tcbinfo,
873 pktap_v2_hdr->pth_flowid, &soprocinfo);
874 } else if (pktap_v2_hdr->pth_ipproto == IPPROTO_UDP) {
875 found = inp_findinpcb_procinfo(&udbinfo,
876 pktap_v2_hdr->pth_flowid, &soprocinfo);
877 } else {
878 found = inp_findinpcb_procinfo(&ripcbinfo,
879 pktap_v2_hdr->pth_flowid, &soprocinfo);
880 }
881 if (found == 1) {
882 pktap_v2_set_procinfo(pktap_v2_hdr, &soprocinfo);
883 }
884}
885
886__private_extern__ void
887pktap_fill_proc_info(struct pktap_header *hdr, protocol_family_t proto,
888 struct mbuf *m, u_int32_t pre, int outgoing, struct ifnet *ifp)
889{
890 /*
891 * Getting the pid and procname is expensive
892 * For outgoing, do the lookup only if there's an
893 * associated socket as indicated by the flowhash
894 */
895 if (outgoing != 0 && m->m_pkthdr.pkt_flowsrc == FLOWSRC_INPCB) {
896 /*
897 * To avoid lock ordering issues we delay the proc UUID lookup
898 * to the BPF read as we cannot
899 * assume the socket lock is unlocked on output
900 */
901 hdr->pth_flags |= PTH_FLAG_DELAY_PKTAP;
902 hdr->pth_flags |= PTH_FLAG_SOCKET;
903 hdr->pth_flowid = m->m_pkthdr.pkt_flowid;
904
905 if (m->m_pkthdr.pkt_flags & PKTF_FLOW_RAWSOCK) {
906 hdr->pth_ipproto = IPPROTO_RAW;
907 } else {
908 hdr->pth_ipproto = m->m_pkthdr.pkt_proto;
909 }
910
911 if (hdr->pth_ipproto == IPPROTO_TCP) {
912 hdr->pth_pid = m->m_pkthdr.tx_tcp_pid;
913 hdr->pth_epid = m->m_pkthdr.tx_tcp_e_pid;
914 } else if (hdr->pth_ipproto == IPPROTO_UDP) {
915 hdr->pth_pid = m->m_pkthdr.tx_udp_pid;
916 hdr->pth_epid = m->m_pkthdr.tx_udp_e_pid;
917 } else if (hdr->pth_ipproto == IPPROTO_RAW) {
918 hdr->pth_pid = m->m_pkthdr.tx_rawip_pid;
919 hdr->pth_epid = m->m_pkthdr.tx_rawip_e_pid;
920 }
921
922 if (hdr->pth_pid != 0 && hdr->pth_pid != -1) {
923 proc_name(hdr->pth_pid, hdr->pth_comm, MAXCOMLEN);
924 } else {
925 hdr->pth_pid = -1;
926 }
927
928 if (hdr->pth_epid != 0 && hdr->pth_epid != -1) {
929 hdr->pth_flags|= PTH_FLAG_PROC_DELEGATED;
930 proc_name(hdr->pth_epid, hdr->pth_ecomm, MAXCOMLEN);
931 } else {
932 hdr->pth_epid = -1;
933 }
934
935 if (m->m_pkthdr.pkt_flags & PKTF_NEW_FLOW) {
936 hdr->pth_flags |= PTH_FLAG_NEW_FLOW;
937 }
938 } else if (outgoing == 0) {
939 int found = 0;
940 struct so_procinfo soprocinfo;
941 struct inpcb *inp = NULL;
942
943 memset(&soprocinfo, 0, sizeof(struct so_procinfo));
944
945 if (proto == PF_INET) {
946 struct ip ip;
947 errno_t error;
948 size_t hlen;
949 struct in_addr faddr, laddr;
950 u_short fport = 0, lport = 0;
951 struct inpcbinfo *pcbinfo = NULL;
952 int wildcard = 0;
953
954 error = mbuf_copydata(m, pre, sizeof(struct ip), &ip);
955 if (error != 0) {
956 PKTAP_LOG(PKTP_LOG_ERROR,
957 "mbuf_copydata tcp v4 failed for %s\n",
958 hdr->pth_ifname);
959 goto done;
960 }
961 hlen = IP_VHL_HL(ip.ip_vhl) << 2;
962
963 faddr = ip.ip_src;
964 laddr = ip.ip_dst;
965
966 if (ip.ip_p == IPPROTO_TCP) {
967 struct tcphdr th;
968
969 error = mbuf_copydata(m, pre + hlen,
970 sizeof(struct tcphdr), &th);
971 if (error != 0)
972 goto done;
973
974 fport = th.th_sport;
975 lport = th.th_dport;
976
977 pcbinfo = &tcbinfo;
978 } else if (ip.ip_p == IPPROTO_UDP) {
979 struct udphdr uh;
980
981 error = mbuf_copydata(m, pre + hlen,
982 sizeof(struct udphdr), &uh);
983 if (error != 0) {
984 PKTAP_LOG(PKTP_LOG_ERROR,
985 "mbuf_copydata udp v4 failed for %s\n",
986 hdr->pth_ifname);
987 goto done;
988 }
989 fport = uh.uh_sport;
990 lport = uh.uh_dport;
991
992 pcbinfo = &udbinfo;
993 wildcard = 1;
994 }
995 if (pcbinfo != NULL) {
996 inp = in_pcblookup_hash(pcbinfo, faddr, fport,
997 laddr, lport, wildcard, outgoing ? NULL : ifp);
998
999 if (inp == NULL && hdr->pth_iftype != IFT_LOOP)
1000 PKTAP_LOG(PKTP_LOG_NOPCB,
1001 "in_pcblookup_hash no pcb %s\n",
1002 hdr->pth_ifname);
1003 } else {
1004 PKTAP_LOG(PKTP_LOG_NOPCB,
1005 "unknown ip_p %u on %s\n",
1006 ip.ip_p, hdr->pth_ifname);
1007 pktap_hexdump(PKTP_LOG_NOPCB, &ip, sizeof(struct ip));
1008 }
1009 } else if (proto == PF_INET6) {
1010 struct ip6_hdr ip6;
1011 errno_t error;
1012 struct in6_addr *faddr;
1013 struct in6_addr *laddr;
1014 u_short fport = 0, lport = 0;
1015 struct inpcbinfo *pcbinfo = NULL;
1016 int wildcard = 0;
1017
1018 error = mbuf_copydata(m, pre, sizeof(struct ip6_hdr), &ip6);
1019 if (error != 0)
1020 goto done;
1021
1022 faddr = &ip6.ip6_src;
1023 laddr = &ip6.ip6_dst;
1024
1025 if (ip6.ip6_nxt == IPPROTO_TCP) {
1026 struct tcphdr th;
1027
1028 error = mbuf_copydata(m, pre + sizeof(struct ip6_hdr),
1029 sizeof(struct tcphdr), &th);
1030 if (error != 0) {
1031 PKTAP_LOG(PKTP_LOG_ERROR,
1032 "mbuf_copydata tcp v6 failed for %s\n",
1033 hdr->pth_ifname);
1034 goto done;
1035 }
1036
1037 fport = th.th_sport;
1038 lport = th.th_dport;
1039
1040 pcbinfo = &tcbinfo;
1041 } else if (ip6.ip6_nxt == IPPROTO_UDP) {
1042 struct udphdr uh;
1043
1044 error = mbuf_copydata(m, pre + sizeof(struct ip6_hdr),
1045 sizeof(struct udphdr), &uh);
1046 if (error != 0) {
1047 PKTAP_LOG(PKTP_LOG_ERROR,
1048 "mbuf_copydata udp v6 failed for %s\n",
1049 hdr->pth_ifname);
1050 goto done;
1051 }
1052
1053 fport = uh.uh_sport;
1054 lport = uh.uh_dport;
1055
1056 pcbinfo = &udbinfo;
1057 wildcard = 1;
1058 }
1059 if (pcbinfo != NULL) {
1060 inp = in6_pcblookup_hash(pcbinfo, faddr, fport,
1061 laddr, lport, wildcard, outgoing ? NULL : ifp);
1062
1063 if (inp == NULL && hdr->pth_iftype != IFT_LOOP)
1064 PKTAP_LOG(PKTP_LOG_NOPCB,
1065 "in6_pcblookup_hash no pcb %s\n",
1066 hdr->pth_ifname);
1067 } else {
1068 PKTAP_LOG(PKTP_LOG_NOPCB,
1069 "unknown ip6.ip6_nxt %u on %s\n",
1070 ip6.ip6_nxt, hdr->pth_ifname);
1071 pktap_hexdump(PKTP_LOG_NOPCB, &ip6, sizeof(struct ip6_hdr));
1072 }
1073 }
1074 if (inp != NULL) {
1075 hdr->pth_flags |= PTH_FLAG_SOCKET;
1076 if (inp->inp_state != INPCB_STATE_DEAD && inp->inp_socket != NULL) {
1077 found = 1;
1078 inp_get_soprocinfo(inp, &soprocinfo);
1079 }
1080 in_pcb_checkstate(inp, WNT_RELEASE, 0);
1081 }
1082done:
1083 /*
1084 * -1 means PID not found
1085 */
1086 hdr->pth_pid = -1;
1087 hdr->pth_epid = -1;
1088
1089 if (found != 0)
1090 pktap_set_procinfo(hdr, &soprocinfo);
1091}
1092}
1093
1094__private_extern__ void
1095pktap_bpf_tap(struct ifnet *ifp, protocol_family_t proto, struct mbuf *m,
1096 u_int32_t pre, u_int32_t post, int outgoing)
1097{
1098 struct pktap_softc *pktap;
1099 void (*bpf_tap_func)(ifnet_t, u_int32_t, mbuf_t, void *, size_t) =
1100 outgoing ? bpf_tap_out : bpf_tap_in;
1101
1102 /*
1103 * Skip the coprocessor interface
1104 */
1105 if (!intcoproc_unrestricted && IFNET_IS_INTCOPROC(ifp))
1106 return;
1107
1108 lck_rw_lock_shared(pktap_lck_rw);
1109
1110 /*
1111 * No need to take the ifnet_lock as the struct ifnet field if_bpf is
1112 * protected by the BPF subsystem
1113 */
1114 LIST_FOREACH(pktap, &pktap_list, pktp_link) {
1115 int filter_result;
1116
1117 filter_result = pktap_filter_evaluate(pktap, ifp);
1118 if (filter_result == PKTAP_FILTER_SKIP)
1119 continue;
1120
1121 if (pktap->pktp_dlt_raw_count > 0) {
1122 /* We accept only IPv4 and IPv6 packets for the raw DLT */
1123 if ((proto == AF_INET ||proto == AF_INET6) &&
1124 !(m->m_pkthdr.pkt_flags & PKTF_INET_RESOLVE)) {
1125 /*
1126 * We can play just with the length of the first mbuf in the
1127 * chain because bpf_tap_imp() disregard the packet length
1128 * of the mbuf packet header.
1129 */
1130 if (mbuf_setdata(m, m->m_data + pre, m->m_len - pre) == 0) {
1131 bpf_tap_func(pktap->pktp_ifp, DLT_RAW, m, NULL, 0);
1132 mbuf_setdata(m, m->m_data - pre, m->m_len + pre);
1133 }
1134 }
1135 }
1136
1137 if (pktap->pktp_dlt_pkttap_count > 0) {
1138 struct {
1139 struct pktap_header hdr;
1140 u_int32_t proto;
1141 } hdr_buffer;
1142 struct pktap_header *hdr = &hdr_buffer.hdr;
1143 size_t hdr_size = sizeof(struct pktap_header);
1144 int unknown_if_type = 0;
1145 size_t data_adjust = 0;
1146 u_int32_t pre_adjust = 0;
1147
1148 /* Verify the structure is packed */
1149 _CASSERT(sizeof(hdr_buffer) == sizeof(struct pktap_header) + sizeof(u_int32_t));
1150
1151 bzero(&hdr_buffer, sizeof(hdr_buffer));
1152 hdr->pth_length = sizeof(struct pktap_header);
1153 hdr->pth_type_next = PTH_TYPE_PACKET;
1154
1155 /*
1156 * Set DLT of packet based on interface type
1157 */
1158 switch (ifp->if_type) {
1159 case IFT_LOOP:
1160 case IFT_GIF:
1161 case IFT_STF:
1162 case IFT_CELLULAR:
1163 /*
1164 * Packets from pdp interfaces have no loopback
1165 * header that contain the protocol number.
1166 * As BPF just concatenate the header and the
1167 * packet content in a single buffer,
1168 * stash the protocol after the pktap header
1169 * and adjust the size of the header accordingly
1170 */
1171 hdr->pth_dlt = DLT_NULL;
1172 if (pre == 0) {
1173 hdr_buffer.proto = proto;
1174 hdr_size = sizeof(hdr_buffer);
1175 pre_adjust = sizeof(hdr_buffer.proto);
1176 }
1177 break;
1178 case IFT_ETHER:
1179 case IFT_BRIDGE:
1180 case IFT_L2VLAN:
1181 case IFT_IEEE8023ADLAG:
1182 hdr->pth_dlt = DLT_EN10MB;
1183 break;
1184 case IFT_PPP:
1185 hdr->pth_dlt = DLT_PPP;
1186 break;
1187 case IFT_IEEE1394:
1188 hdr->pth_dlt = DLT_APPLE_IP_OVER_IEEE1394;
1189 break;
1190 case IFT_OTHER:
1191 if (ifp->if_subfamily == IFNET_SUBFAMILY_IPSEC ||
1192 ifp->if_subfamily == IFNET_SUBFAMILY_UTUN) {
1193 /*
1194 * For utun:
1195 * - incoming packets do not have the prefix set to four
1196 * - some packets are as small as two bytes!
1197 */
1198 if (m_pktlen(m) < 4)
1199 goto done;
1200 if (proto != AF_INET && proto != AF_INET6)
1201 goto done;
1202 if (proto == AF_INET && (size_t) m_pktlen(m) - 4 < sizeof(struct ip))
1203 goto done;
1204 if (proto == AF_INET6 && (size_t) m_pktlen(m) - 4 < sizeof(struct ip6_hdr))
1205 goto done;
1206
1207 /*
1208 * Handle two cases:
1209 * - The old utun encapsulation with the protocol family in network order
1210 * - A raw IPv4 or IPv6 packet
1211 */
1212 uint8_t data = *(uint8_t *)mbuf_data(m);
1213 if ((data >> 4) == 4 || (data >> 4) == 6) {
1214 pre = 4;
1215 } else {
1216 /*
1217 * Skip the protocol in the mbuf as it's in network order
1218 */
1219 pre = 4;
1220 data_adjust = 4;
1221 }
1222 }
1223 hdr->pth_dlt = DLT_NULL;
1224 hdr_buffer.proto = proto;
1225 hdr_size = sizeof(hdr_buffer);
1226 break;
1227 default:
1228 if (pre == 0)
1229 hdr->pth_dlt = DLT_RAW;
1230 else
1231 unknown_if_type = 1;
1232 break;
1233 }
1234 if (unknown_if_type) {
1235 PKTAP_LOG(PKTP_LOG_FUNC,
1236 "unknown if_type %u for %s\n",
1237 ifp->if_type, ifp->if_xname);
1238 pktap_count_unknown_if_type += 1;
1239 } else {
1240 strlcpy(hdr->pth_ifname, ifp->if_xname,
1241 sizeof(hdr->pth_ifname));
1242 hdr->pth_flags |= outgoing ? PTH_FLAG_DIR_OUT : PTH_FLAG_DIR_IN;
1243 hdr->pth_protocol_family = proto;
1244 hdr->pth_frame_pre_length = pre + pre_adjust;
1245 hdr->pth_frame_post_length = post;
1246 hdr->pth_iftype = ifp->if_type;
1247 hdr->pth_ifunit = ifp->if_unit;
1248
1249 if (m->m_pkthdr.pkt_flags & PKTF_KEEPALIVE)
1250 hdr->pth_flags |= PTH_FLAG_KEEP_ALIVE;
1251 if (m->m_pkthdr.pkt_flags & PKTF_TCP_REXMT)
1252 hdr->pth_flags |= PTH_FLAG_REXMIT;
1253
1254 pktap_fill_proc_info(hdr, proto, m, pre, outgoing, ifp);
1255
1256 hdr->pth_svc = so_svc2tc(m->m_pkthdr.pkt_svc);
1257
1258 if (data_adjust == 0) {
1259 bpf_tap_func(pktap->pktp_ifp, DLT_PKTAP, m, hdr, hdr_size);
1260 } else {
1261 /*
1262 * We can play just with the length of the first mbuf in the
1263 * chain because bpf_tap_imp() disregard the packet length
1264 * of the mbuf packet header.
1265 */
1266 if (mbuf_setdata(m, m->m_data + data_adjust, m->m_len - data_adjust) == 0) {
1267 bpf_tap_func(pktap->pktp_ifp, DLT_PKTAP, m, hdr, hdr_size);
1268 mbuf_setdata(m, m->m_data - data_adjust, m->m_len + data_adjust);
1269 }
1270 }
1271 }
1272 }
1273 }
1274done:
1275 lck_rw_done(pktap_lck_rw);
1276}
1277
1278__private_extern__ void
1279pktap_input(struct ifnet *ifp, protocol_family_t proto, struct mbuf *m,
1280 char *frame_header)
1281{
1282 char *hdr;
1283 char *start;
1284
1285 /* Fast path */
1286 if (pktap_total_tap_count == 0)
1287 return;
1288
1289 hdr = (char *)mbuf_data(m);
1290 start = (char *)mbuf_datastart(m);
1291 /* Make sure the frame header is fully contained in the mbuf */
1292 if (frame_header != NULL && frame_header >= start && frame_header <= hdr) {
1293 size_t o_len = m->m_len;
1294 u_int32_t pre = hdr - frame_header;
1295
1296 if (mbuf_setdata(m, frame_header, o_len + pre) == 0) {
1297 PKTAP_LOG(PKTP_LOG_INPUT, "ifp %s proto %u pre %u post %u\n",
1298 ifp->if_xname, proto, pre, 0);
1299
1300 pktap_bpf_tap(ifp, proto, m, pre, 0, 0);
1301 mbuf_setdata(m, hdr, o_len);
1302 }
1303 } else {
1304 PKTAP_LOG(PKTP_LOG_INPUT, "ifp %s proto %u pre %u post %u\n",
1305 ifp->if_xname, proto, 0, 0);
1306
1307 pktap_bpf_tap(ifp, proto, m, 0, 0, 0);
1308 }
1309}
1310
1311__private_extern__ void
1312pktap_output(struct ifnet *ifp, protocol_family_t proto, struct mbuf *m,
1313 u_int32_t pre, u_int32_t post)
1314{
1315 /* Fast path */
1316 if (pktap_total_tap_count == 0)
1317 return;
1318
1319 PKTAP_LOG(PKTP_LOG_OUTPUT, "ifp %s proto %u pre %u post %u\n",
1320 ifp->if_xname, proto, pre, post);
1321
1322 pktap_bpf_tap(ifp, proto, m, pre, post, 1);
1323}
1324
1325
1326void
1327convert_to_pktap_header_to_v2(struct bpf_packet *bpf_pkt, bool truncate)
1328{
1329 struct pktap_header *pktap_header;
1330 size_t extra_src_size;
1331 struct pktap_buffer_v2_hdr_extra pktap_buffer_v2_hdr_extra;
1332 struct pktap_v2_hdr_space *pktap_v2_hdr_space;
1333 struct pktap_v2_hdr *pktap_v2_hdr;
1334 uint8_t *ptr;
1335
1336 pktap_header = (struct pktap_header *)bpf_pkt->bpfp_header;
1337
1338 if (pktap_header->pth_type_next != PTH_TYPE_PACKET) {
1339 return;
1340 }
1341
1342 VERIFY(bpf_pkt->bpfp_header_length >= sizeof(struct pktap_header));
1343
1344 /*
1345 * extra_src_size is the length of the optional link layer header
1346 */
1347 extra_src_size = bpf_pkt->bpfp_header_length -
1348 sizeof(struct pktap_header);
1349
1350 VERIFY(extra_src_size <= sizeof(union pktap_header_extra));
1351
1352 pktap_v2_hdr_space = &pktap_buffer_v2_hdr_extra.hdr_space;
1353 pktap_v2_hdr = &pktap_v2_hdr_space->pth_hdr;
1354 ptr = (uint8_t *) (pktap_v2_hdr + 1);
1355
1356 COPY_PKTAP_COMMON_FIELDS_TO_V2(pktap_v2_hdr, pktap_header);
1357
1358 /*
1359 * When truncating don't bother with the process UUIDs
1360 */
1361 if (!truncate) {
1362 if ((pktap_header->pth_flags & PTH_FLAG_DELAY_PKTAP)) {
1363 pktap_v2_hdr->pth_uuid_offset = pktap_v2_hdr->pth_length;
1364 pktap_v2_hdr->pth_length += sizeof(uuid_t);
1365 uuid_clear(*(uuid_t *)ptr);
1366 ptr += sizeof(uuid_t);
1367 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1368 } else if (!uuid_is_null(pktap_header->pth_uuid)) {
1369 pktap_v2_hdr->pth_uuid_offset = pktap_v2_hdr->pth_length;
1370 uuid_copy(*(uuid_t *)ptr, pktap_header->pth_uuid);
1371 pktap_v2_hdr->pth_length += sizeof(uuid_t);
1372 ptr += sizeof(uuid_t);
1373 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1374 }
1375
1376 if ((pktap_header->pth_flags & PTH_FLAG_DELAY_PKTAP)) {
1377 if (pktap_header->pth_flags & PTH_FLAG_PROC_DELEGATED) {
1378 pktap_v2_hdr->pth_e_uuid_offset = pktap_v2_hdr->pth_length;
1379 uuid_clear(*(uuid_t *)ptr);
1380 pktap_v2_hdr->pth_length += sizeof(uuid_t);
1381 ptr += sizeof(uuid_t);
1382 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1383 }
1384 } else if(!uuid_is_null(pktap_header->pth_euuid)) {
1385 pktap_v2_hdr->pth_e_uuid_offset = pktap_v2_hdr->pth_length;
1386 uuid_copy(*(uuid_t *)ptr, pktap_header->pth_euuid);
1387 pktap_v2_hdr->pth_length += sizeof(uuid_t);
1388 ptr += sizeof(uuid_t);
1389 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1390 }
1391 }
1392
1393 if (pktap_header->pth_ifname[0] != 0) {
1394 size_t strsize;
1395
1396 pktap_v2_hdr->pth_ifname_offset = pktap_v2_hdr->pth_length;
1397
1398 /*
1399 * Note: strlcpy() returns the length of the string so we need
1400 * to add one for the end-of-string
1401 */
1402 strsize = 1 + strlcpy((char *)ptr, pktap_header->pth_ifname,
1403 sizeof(pktap_v2_hdr_space->pth_ifname));
1404 pktap_v2_hdr->pth_length += strsize;
1405 ptr += strsize;
1406 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1407 }
1408
1409 /*
1410 * Do not waste space with the process name if we do not have a pid
1411 */
1412 if (pktap_header->pth_pid != 0 && pktap_header->pth_pid != -1) {
1413 if (pktap_header->pth_comm[0] != 0) {
1414 size_t strsize;
1415
1416 pktap_v2_hdr->pth_comm_offset = pktap_v2_hdr->pth_length;
1417
1418 strsize = 1 + strlcpy((char *)ptr, pktap_header->pth_comm,
1419 sizeof(pktap_v2_hdr_space->pth_comm));
1420 pktap_v2_hdr->pth_length += strsize;
1421 ptr += strsize;
1422 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1423 } else if ((pktap_header->pth_flags & PTH_FLAG_DELAY_PKTAP)) {
1424 size_t strsize = sizeof(pktap_v2_hdr_space->pth_comm);
1425
1426 pktap_v2_hdr->pth_comm_offset = pktap_v2_hdr->pth_length;
1427
1428 *ptr = 0; /* empty string by default */
1429 pktap_v2_hdr->pth_length += strsize;
1430 ptr += strsize;
1431 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1432 }
1433 }
1434
1435 /*
1436 * Do not waste space with the effective process name if we do not have
1437 * an effective pid or it's the same as the pid
1438 */
1439 if (pktap_header->pth_epid != 0 && pktap_header->pth_epid != -1 &&
1440 pktap_header->pth_epid != pktap_header->pth_pid) {
1441 if (pktap_header->pth_ecomm[0] != 0) {
1442 size_t strsize;
1443
1444 pktap_v2_hdr->pth_e_comm_offset = pktap_v2_hdr->pth_length;
1445
1446 strsize = 1 + strlcpy((char *)ptr, pktap_header->pth_ecomm,
1447 sizeof(pktap_v2_hdr_space->pth_e_comm));
1448 pktap_v2_hdr->pth_length += strsize;
1449 ptr += strsize;
1450 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1451 } else if ((pktap_header->pth_flags & PTH_FLAG_DELAY_PKTAP)) {
1452 size_t strsize = sizeof(pktap_v2_hdr_space->pth_e_comm);
1453
1454 pktap_v2_hdr->pth_e_comm_offset = pktap_v2_hdr->pth_length;
1455 *ptr = 0; /* empty string by default */
1456 pktap_v2_hdr->pth_length += strsize;
1457 ptr += strsize;
1458 VERIFY((void *)ptr < (void *)(pktap_v2_hdr_space + 1));
1459 }
1460 }
1461
1462 if (extra_src_size > 0) {
1463 char *extra_src_ptr = (char *)(pktap_header + 1);
1464 char *extra_dst_ptr = ((char *)pktap_v2_hdr) +
1465 pktap_v2_hdr->pth_length;
1466
1467 VERIFY(pktap_v2_hdr->pth_length + extra_src_size <=
1468 sizeof(struct pktap_buffer_v2_hdr_extra));
1469
1470 memcpy(extra_dst_ptr, extra_src_ptr, extra_src_size);
1471 }
1472
1473 VERIFY(pktap_v2_hdr->pth_length + extra_src_size <=
1474 bpf_pkt->bpfp_header_length);
1475
1476 memcpy(bpf_pkt->bpfp_header, pktap_v2_hdr,
1477 pktap_v2_hdr->pth_length + extra_src_size);
1478
1479 bpf_pkt->bpfp_total_length += pktap_v2_hdr->pth_length -
1480 sizeof(struct pktap_header);
1481 bpf_pkt->bpfp_header_length += pktap_v2_hdr->pth_length -
1482 sizeof(struct pktap_header);
1483}
1484
1485