MacMonitor/Sources/Telemetry/Network/MMNetworkSocketsProvider.m

#import "MMNetworkSocketsProvider.h"
#import <libproc.h>
#import <sys/proc_info.h>
#import <arpa/inet.h>

@implementation MMNetworkSocketsProvider

- (instancetype)init {
    self = [super init];
    return self;
}

- (MMTelemetryDomain)domain {
    return MMTelemetryDomainNetwork;
}

- (NSString *)providerIdentifier {
    return @"com.i3omb.macmonitor.telemetry.network.sockets";
}

- (BOOL)isAvailable {
    return YES;
}

static NSString *tcpStateString(int state) {
    switch (state) {
        case 0: return @"CLOSED";
        case 1: return @"LISTEN";
        case 2: return @"SYN_SENT";
        case 3: return @"SYN_RCVD";
        case 4: return @"ESTABLISHED";
        case 5: return @"CLOSE_WAIT";
        case 6: return @"FIN_WAIT_1";
        case 7: return @"CLOSING";
        case 8: return @"LAST_ACK";
        case 9: return @"FIN_WAIT_2";
        case 10: return @"TIME_WAIT";
        default: return @"UNKNOWN";
    }
}

+ (NSDictionary<NSString *, id> *)calculateSocketSummaryWithSocketList:(NSArray<NSDictionary<NSString *, id> *> *)sockets {
    NSUInteger tcpCount = 0;
    NSUInteger udpCount = 0;
    NSUInteger listenCount = 0;
    NSUInteger establishedCount = 0;
    
    for (NSDictionary<NSString *, id> *sock in sockets) {
        NSString *proto = sock[@"protocol"];
        NSString *state = sock[@"state"];
        
        if ([proto isEqualToString:@"TCP"]) {
            tcpCount++;
            if ([state isEqualToString:@"LISTEN"]) {
                listenCount++;
            } else if ([state isEqualToString:@"ESTABLISHED"]) {
                establishedCount++;
            }
        } else if ([proto isEqualToString:@"UDP"]) {
            udpCount++;
        }
    }
    
    return @{
        @"socketCount": @(sockets.count),
        @"tcpCount": @(tcpCount),
        @"udpCount": @(udpCount),
        @"listenCount": @(listenCount),
        @"establishedCount": @(establishedCount),
        @"sockets": sockets
    };
}

- (nullable NSDictionary<NSString *, id> *)sampleTelemetryWithError:(NSError **)error {
    int pids[2048];
    int bytes = proc_listpids(PROC_ALL_PIDS, 0, pids, sizeof(pids));
    int pidCount = bytes / sizeof(int);
    
    NSMutableArray<NSDictionary<NSString *, id> *> *sockets = [NSMutableArray array];
    
    for (int i = 0; i < pidCount; i++) {
        pid_t pid = pids[i];
        if (pid <= 0) continue;
        
        int sz = proc_pidinfo(pid, PROC_PIDLISTFDS, 0, NULL, 0);
        if (sz <= 0) continue;
        
        struct proc_fdinfo *fds = malloc(sz);
        if (!fds) continue;
        
        int actual = proc_pidinfo(pid, PROC_PIDLISTFDS, 0, fds, sz);
        int fdCount = actual / sizeof(struct proc_fdinfo);
        
        char procNameBuf[256] = {0};
        BOOL procNameFetched = NO;
        
        for (int j = 0; j < fdCount; j++) {
            if (fds[j].proc_fdtype == PROX_FDTYPE_SOCKET) {
                struct socket_fdinfo si;
                if (proc_pidfdinfo(pid, fds[j].proc_fd, PROC_PIDFDSOCKETINFO, &si, sizeof(si)) == sizeof(si)) {
                    int family = si.psi.soi_family;
                    if (family == AF_INET || family == AF_INET6) {
                        if (!procNameFetched) {
                            proc_name(pid, procNameBuf, sizeof(procNameBuf));
                            procNameFetched = YES;
                        }
                        
                        char localIP[INET6_ADDRSTRLEN] = {0};
                        char remoteIP[INET6_ADDRSTRLEN] = {0};
                        int lport = 0, rport = 0;
                        NSString *familyStr = (family == AF_INET) ? @"IPv4" : @"IPv6";
                        NSString *proto = (si.psi.soi_type == SOCK_STREAM) ? @"TCP" : @"UDP";
                        NSString *state = @"NONE";
                        
                        if (family == AF_INET) {
                            inet_ntop(AF_INET, &si.psi.soi_proto.pri_in.insi_laddr.ina_46.i46a_addr4, localIP, sizeof(localIP));
                            inet_ntop(AF_INET, &si.psi.soi_proto.pri_in.insi_faddr.ina_46.i46a_addr4, remoteIP, sizeof(remoteIP));
                            lport = ntohs(si.psi.soi_proto.pri_in.insi_lport);
                            rport = ntohs(si.psi.soi_proto.pri_in.insi_fport);
                        } else {
                            inet_ntop(AF_INET6, &si.psi.soi_proto.pri_in.insi_laddr.ina_6, localIP, sizeof(localIP));
                            inet_ntop(AF_INET6, &si.psi.soi_proto.pri_in.insi_faddr.ina_6, remoteIP, sizeof(remoteIP));
                            lport = ntohs(si.psi.soi_proto.pri_in.insi_lport);
                            rport = ntohs(si.psi.soi_proto.pri_in.insi_fport);
                        }
                        
                        if (si.psi.soi_type == SOCK_STREAM) {
                            state = tcpStateString(si.psi.soi_proto.pri_tcp.tcpsi_state);
                        }
                        
                        [sockets addObject:@{
                            @"pid": @(pid),
                            @"processName": [NSString stringWithUTF8String:procNameBuf],
                            @"protocol": proto,
                            @"family": familyStr,
                            @"localAddress": [NSString stringWithUTF8String:localIP],
                            @"localPort": @(lport),
                            @"remoteAddress": [NSString stringWithUTF8String:remoteIP],
                            @"remotePort": @(rport),
                            @"state": state
                        }];
                    }
                }
            }
        }
        free(fds);
    }
    
    return [MMNetworkSocketsProvider calculateSocketSummaryWithSocketList:sockets];
}

@end