[PATCH v4 1/2] nsiproxy.sys: Use the pcblist64 sysctl to enumerate TCP connections on macOS.

[Tim Clem]

From: Tim Clem

The handles returned by libproc (namely struct socket_info's soi_pcb)
use all 64 bits, but the ones from the pcblist sysctl are truncated
to 32. That makes find_owning_pid fail. The pcblist64 sysctl was
added in macOS 10.6 and returns handles that match those from
libproc.
---
 dlls/nsiproxy.sys/tcp.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/dlls/nsiproxy.sys/tcp.c b/dlls/nsiproxy.sys/tcp.c
index 5734c4d9ee0..f9aa516e9f9 100644
--- a/dlls/nsiproxy.sys/tcp.c
+++ b/dlls/nsiproxy.sys/tcp.c
@@ -625,12 +625,24 @@ static NTSTATUS tcp_conns_enumerate_all( UINT filter, struct nsi_tcp_conn_key *k
     }
 #elif defined(HAVE_SYS_SYSCTL_H) && defined(TCPCTL_PCBLIST) && defined(HAVE_STRUCT_XINPGEN)
     {
-        int mib[] = { CTL_NET, PF_INET, IPPROTO_TCP, TCPCTL_PCBLIST };
         size_t len = 0;
         char *buf = NULL;
         struct xinpgen *xig, *orig_xig;

-        if (sysctl( mib, ARRAY_SIZE(mib), NULL, &len, NULL, 0 ) < 0)
+#ifdef __APPLE__
+        static int mib[CTL_MAXNAME];
+        static size_t mib_len = 0;
+        if (mib_len == 0)
+        {
+            mib_len = CTL_MAXNAME;
+            sysctlnametomib( "net.inet.tcp.pcblist64", mib, &mib_len );
+        }
+#else
+        int mib[] = { CTL_NET, PF_INET, IPPROTO_TCP, TCPCTL_PCBLIST };
+        size_t mib_len = ARRAY_SIZE(mib);
+#endif
+
+        if (sysctl( mib, mib_len, NULL, &len, NULL, 0 ) < 0)
         {
             ERR( "Failure to read net.inet.tcp.pcblist via sysctl\n" );
             status = STATUS_NOT_SUPPORTED;
@@ -644,7 +656,7 @@ static NTSTATUS tcp_conns_enumerate_all( UINT filter, struct nsi_tcp_conn_key *k
             goto err;
         }

-        if (sysctl( mib, ARRAY_SIZE(mib), buf, &len, NULL, 0 ) < 0)
+        if (sysctl( mib, mib_len, buf, &len, NULL, 0 ) < 0)
         {
             ERR( "Failure to read net.inet.tcp.pcblist via sysctl\n" );
             status = STATUS_NOT_SUPPORTED;
@@ -664,7 +676,11 @@ static NTSTATUS tcp_conns_enumerate_all( UINT filter, struct nsi_tcp_conn_key *k
              xig->xig_len > sizeof(struct xinpgen);
              xig = (struct xinpgen *)((char *)xig + xig->xig_len))
         {
-#if __FreeBSD_version >= 1200026
+#ifdef __APPLE__
+            struct xtcpcb64 *tcp = (struct xtcpcb64 *)xig;
+            struct xinpcb64 *in = &tcp->xt_inpcb;
+            struct xsocket64 *sock = &in->xi_socket;
+#elif __FreeBSD_version >= 1200026
             struct xtcpcb *tcp = (struct xtcpcb *)xig;
             struct xinpcb *in = &tcp->xt_inp;
             struct xsocket *sock = &in->xi_socket;