Skip to content

🧹 Refactor endpoint_owner_process_ids for macOS in src/cdp.rs #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
undivisible wants to merge 3 commits into
base: main
Choose a base branch
from
Open

🧹 Refactor endpoint_owner_process_ids for macOS in src/cdp.rs #44

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
01b24d7
Refactor `endpoint_owner_process_ids` for macOS in `src/cdp.rs`
google-labs-jules[bot] Aug 27, 2026
0a4fe93
Fix formatting in `tests/cli.rs` and update `event-listener` to fix v…
google-labs-jules[bot] Aug 27, 2026
3669d70
Fix formatting in `tests/cli.rs`, update `event-listener` to fix vuln…
google-labs-jules[bot] Aug 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

153 changes: 84 additions & 69 deletions src/cdp.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1677,14 +1677,8 @@ fn endpoint_owner_process_ids(port: u16, process_id: u32) -> Result<BTreeSet<u32
}

#[cfg(target_os = "macos")]
fn endpoint_owner_process_ids(port: u16, _process_id: u32) -> Result<BTreeSet<u32>, CdpError> {
fn list_all_process_ids() -> Result<Vec<i32>, CdpError> {
const MAX_PROCESS_COUNT: usize = 1024 * 1024;
const MAX_DESCRIPTOR_BYTES: usize = 16 * 1024 * 1024;
const SOCKET_INFO_BYTES: usize = 792;
const PROC_PIDFDSOCKETINFO: i32 = 3;
const SOCKINFO_TCP: i32 = 2;
const TCP_LISTEN: i32 = 1;

let capacity = unsafe { libc::proc_listallpids(std::ptr::null_mut(), 0) };
let capacity = usize::try_from(capacity)
.ok()
Expand All @@ -1703,77 +1697,97 @@ fn endpoint_owner_process_ids(port: u16, _process_id: u32) -> Result<BTreeSet<u3
.ok()
.filter(|count| *count < process_ids.len())
.ok_or(CdpError::StaleTarget)?;
let mut owners = BTreeSet::new();
for process_id in process_ids.into_iter().take(count).filter(|id| *id > 0) {
let descriptor_bytes = unsafe {
libc::proc_pidinfo(
process_id,
libc::PROC_PIDLISTFDS,
0,
std::ptr::null_mut(),
0,
)
};
let Ok(descriptor_bytes) = usize::try_from(descriptor_bytes) else {
continue;
};
if descriptor_bytes == 0 || descriptor_bytes > MAX_DESCRIPTOR_BYTES {
process_ids.truncate(count);
Ok(process_ids)
}

#[cfg(target_os = "macos")]
fn process_has_tcp_listen_socket(process_id: i32, port: u16) -> Result<bool, CdpError> {
const MAX_DESCRIPTOR_BYTES: usize = 16 * 1024 * 1024;
const SOCKET_INFO_BYTES: usize = 792;
const PROC_PIDFDSOCKETINFO: i32 = 3;
const SOCKINFO_TCP: i32 = 2;
const TCP_LISTEN: i32 = 1;

let descriptor_bytes = unsafe {
libc::proc_pidinfo(
process_id,
libc::PROC_PIDLISTFDS,
0,
std::ptr::null_mut(),
0,
)
};
let Ok(descriptor_bytes) = usize::try_from(descriptor_bytes) else {
return Ok(false);
};
if descriptor_bytes == 0 || descriptor_bytes > MAX_DESCRIPTOR_BYTES {
return Ok(false);
}
let descriptor_capacity = descriptor_bytes
.checked_add(64 * 8)
.filter(|bytes| *bytes <= MAX_DESCRIPTOR_BYTES)
.ok_or(CdpError::StaleTarget)?;
let mut descriptors = vec![0u8; descriptor_capacity];
let requested = i32::try_from(descriptors.len()).map_err(|_| CdpError::StaleTarget)?;
let written = unsafe {
libc::proc_pidinfo(
process_id,
libc::PROC_PIDLISTFDS,
0,
descriptors.as_mut_ptr().cast(),
requested,
)
};
let Ok(written) = usize::try_from(written) else {
return Ok(false);
};
if written >= descriptors.len() || written % 8 != 0 {
return Err(CdpError::StaleTarget);
}
#[allow(clippy::chunks_exact_to_as_chunks)]
for descriptor in descriptors[..written].chunks_exact(8) {
let file_descriptor =
i32::from_ne_bytes(descriptor[..4].try_into().map_err(|_| CdpError::Protocol)?);
let descriptor_type = u32::from_ne_bytes(
descriptor[4..8]
.try_into()
.map_err(|_| CdpError::Protocol)?,
);
if descriptor_type != libc::PROX_FDTYPE_SOCKET as u32 {
continue;
}
let descriptor_capacity = descriptor_bytes
.checked_add(64 * 8)
.filter(|bytes| *bytes <= MAX_DESCRIPTOR_BYTES)
.ok_or(CdpError::StaleTarget)?;
let mut descriptors = vec![0u8; descriptor_capacity];
let requested = i32::try_from(descriptors.len()).map_err(|_| CdpError::StaleTarget)?;
let mut socket = [0u8; SOCKET_INFO_BYTES];
let written = unsafe {
libc::proc_pidinfo(
libc::proc_pidfdinfo(
process_id,
libc::PROC_PIDLISTFDS,
0,
descriptors.as_mut_ptr().cast(),
requested,
file_descriptor,
PROC_PIDFDSOCKETINFO,
socket.as_mut_ptr().cast(),
SOCKET_INFO_BYTES as i32,
)
};
let Ok(written) = usize::try_from(written) else {
if written != SOCKET_INFO_BYTES as i32
|| i32::from_ne_bytes(socket[256..260].try_into().unwrap_or_default()) != SOCKINFO_TCP
|| i32::from_ne_bytes(socket[344..348].try_into().unwrap_or_default()) != TCP_LISTEN
|| socket[288] & 1 == 0
|| socket[324..328] != Ipv4Addr::LOCALHOST.octets()
|| u16::from_be_bytes(socket[268..270].try_into().unwrap_or_default()) != port
{
continue;
};
if written >= descriptors.len() || written % 8 != 0 {
return Err(CdpError::StaleTarget);
}
for descriptor in descriptors[..written].chunks_exact(8) {
let file_descriptor =
i32::from_ne_bytes(descriptor[..4].try_into().map_err(|_| CdpError::Protocol)?);
let descriptor_type = u32::from_ne_bytes(
descriptor[4..8]
.try_into()
.map_err(|_| CdpError::Protocol)?,
);
if descriptor_type != libc::PROX_FDTYPE_SOCKET as u32 {
continue;
}
let mut socket = [0u8; SOCKET_INFO_BYTES];
let written = unsafe {
libc::proc_pidfdinfo(
process_id,
file_descriptor,
PROC_PIDFDSOCKETINFO,
socket.as_mut_ptr().cast(),
SOCKET_INFO_BYTES as i32,
)
};
if written != SOCKET_INFO_BYTES as i32
|| i32::from_ne_bytes(socket[256..260].try_into().unwrap_or_default())
!= SOCKINFO_TCP
|| i32::from_ne_bytes(socket[344..348].try_into().unwrap_or_default()) != TCP_LISTEN
|| socket[288] & 1 == 0
|| socket[324..328] != Ipv4Addr::LOCALHOST.octets()
|| u16::from_be_bytes(socket[268..270].try_into().unwrap_or_default()) != port
{
continue;
}
return Ok(true);
}
Ok(false)
}

#[cfg(target_os = "macos")]
fn endpoint_owner_process_ids(port: u16, _process_id: u32) -> Result<BTreeSet<u32>, CdpError> {
let process_ids = list_all_process_ids()?;
let mut owners = BTreeSet::new();
for process_id in process_ids.into_iter().filter(|id| *id > 0) {
if process_has_tcp_listen_socket(process_id, port)? {
owners.insert(u32::try_from(process_id).map_err(|_| CdpError::Protocol)?);
break;
}
}
Ok(owners)
Expand Down Expand Up @@ -1851,6 +1865,7 @@ fn endpoint_owner_process_ids(port: u16, _process_id: u32) -> Result<BTreeSet<u3
return Err(CdpError::Protocol);
}
let mut owners = BTreeSet::new();
#[allow(clippy::chunks_exact_to_as_chunks)]
for row in table[4..].chunks_exact(TCP_ROW_BYTES).take(row_count) {
if u32::from_ne_bytes(row[..4].try_into().map_err(|_| CdpError::Protocol)?) == TCP_LISTEN
&& row[4..8] == Ipv4Addr::LOCALHOST.octets()
Expand Down
2 changes: 1 addition & 1 deletion tests/cli.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ fn run(arguments: &[&str], stdin: &str) -> std::process::Output {
.stderr(Stdio::piped())
.spawn()
.expect("spawn CLI");
if let Some(mut child_stdin) = child.stdin.take() {
if let Some(mut child_stdin) = child.stdin.take() {
let _ = child_stdin.write_all(stdin.as_bytes());
}
child.wait_with_output().expect("CLI output")
Expand Down
Loading