]> git.saurik.com Git - apple/xnu.git/blame - bsd/net/necp.c
projects / apple / xnu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
xnu-4903.270.47.tar.gz
[apple/xnu.git] / bsd / net / necp.c
CommitLineData
fe8ab488 1/*
d9a64523 2 * Copyright (c) 2013-2018 Apple Inc. All rights reserved.
fe8ab488
A		 3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29#include <string.h>
30#include <sys/systm.h>
31#include <sys/types.h>
fe8ab488
A		 32#include <sys/queue.h>
33#include <sys/malloc.h>
34#include <libkern/OSMalloc.h>
35#include <sys/kernel.h>
36#include <sys/kern_control.h>
37#include <sys/mbuf.h>
38#include <sys/kpi_mbuf.h>
39#include <sys/proc_uuid_policy.h>
40#include <net/if.h>
3e170ce0 41#include <sys/domain.h>
fe8ab488
A		 42#include <sys/protosw.h>
43#include <sys/socket.h>
44#include <sys/socketvar.h>
d26ffc64 45#include <sys/coalition.h>
fe8ab488
A		 46#include <netinet/ip.h>
47#include <netinet/ip6.h>
48#include <netinet/tcp.h>
3e170ce0 49#include <netinet/tcp_var.h>
5ba3f43e 50#include <netinet/tcp_cache.h>
fe8ab488
A		 51#include <netinet/udp.h>
52#include <netinet/in_pcb.h>
39037602 53#include <netinet/in_tclass.h>
3e170ce0 54#include <netinet6/esp.h>
fe8ab488
A		 55#include <net/flowhash.h>
56#include <net/if_var.h>
57#include <sys/kauth.h>
58#include <sys/sysctl.h>
59#include <sys/sysproto.h>
60#include <sys/priv.h>
3e170ce0 61#include <sys/kern_event.h>
5ba3f43e 62#include <sys/file_internal.h>
39037602 63#include <IOKit/IOBSD.h>
3e170ce0 64#include <net/network_agent.h>
fe8ab488
A		 65#include <net/necp.h>
66
67/*
68 * NECP - Network Extension Control Policy database
69 * ------------------------------------------------
70 * The goal of this module is to allow clients connecting via a
71 * kernel control socket to create high-level policy sessions, which
72 * are ingested into low-level kernel policies that control and tag
73 * traffic at the application, socket, and IP layers.
74 *
75 * ------------------------------------------------
76 * Sessions
77 * ------------------------------------------------
78 * Each session owns a list of session policies, each of which can
79 * specify any combination of conditions and a single result. Each
80 * session also has a priority level (such as High, Default, or Low)
81 * which is requested by the client. Based on the requested level,
82 * a session order value is assigned to the session, which will be used
83 * to sort kernel policies generated by the session. The session client
84 * can specify the sub-order for each policy it creates which will be
85 * used to further sort the kernel policies.
86 *
87 * Kernel Control Socket --> 1 necp_session --> list of necp_session_policy structs
88 *
89 * ------------------------------------------------
90 * Kernel Policies
91 * ------------------------------------------------
92 * Whenever a session send the Apply command, its policies are ingested
93 * and generate kernel policies. There are two phases of kernel policy
94 * ingestion.
95 *
96 * 1. The session policy is parsed to create kernel policies at the socket
97 * and IP layers, when applicable. For example, a policy that requires
98 * all traffic from App1 to Pass will generate a socket kernel policy to
99 * match App1 and mark packets with ID1, and also an IP policy to match
100 * ID1 and let the packet pass. This is handled in necp_apply_policy. The
101 * resulting kernel policies are added to the global socket and IP layer
102 * policy lists.
103 * necp_session_policy --> necp_kernel_socket_policy and necp_kernel_ip_output_policy
104 * || ||
105 * \/ \/
106 * necp_kernel_socket_policies necp_kernel_ip_output_policies
107 *
108 * 2. Once the global lists of kernel policies have been filled out, each
109 * list is traversed to create optimized sub-lists ("Maps") which are used during
110 * data-path evaluation. IP policies are sent into necp_kernel_ip_output_policies_map,
111 * which hashes incoming packets based on marked socket-layer policies, and removes
39037602 112 * duplicate or overlapping policies. Socket policies are sent into two maps,
fe8ab488
A		 113 * necp_kernel_socket_policies_map and necp_kernel_socket_policies_app_layer_map.
114 * The app layer map is used for policy checks coming in from user space, and is one
115 * list with duplicate and overlapping policies removed. The socket map hashes based
116 * on app UUID, and removes duplicate and overlapping policies.
117 * necp_kernel_socket_policy --> necp_kernel_socket_policies_app_layer_map
118 * |-> necp_kernel_socket_policies_map
119 *
120 * necp_kernel_ip_output_policies --> necp_kernel_ip_output_policies_map
121 *
122 * ------------------------------------------------
123 * Drop All Level
124 * ------------------------------------------------
125 * The Drop All Level is a sysctl that controls the level at which policies are allowed
126 * to override a global drop rule. If the value is 0, no drop rule is applied. If the value
127 * is 1, all traffic is dropped. If the value is greater than 1, all kernel policies created
128 * by a session with a priority level better than (numerically less than) the
129 * Drop All Level will allow matching traffic to not be dropped. The Drop All Level is
130 * dynamically interpreted into necp_drop_all_order, which specifies the equivalent assigned
131 * session orders to be dropped.
132 */
133
134u_int32_t necp_drop_all_order = 0;
135u_int32_t necp_drop_all_level = 0;
136
137u_int32_t necp_pass_loopback = 1; // 0=Off, 1=On
138u_int32_t necp_pass_keepalives = 1; // 0=Off, 1=On
139
140u_int32_t necp_debug = 0; // 0=None, 1=Basic, 2=EveryMatch
141
3e170ce0 142u_int32_t necp_session_count = 0;
fe8ab488 143
0a7de745
A		 144#define LIST_INSERT_SORTED_ASCENDING(head, elm, field, sortfield, tmpelm) do { \
145 if (LIST_EMPTY((head)) || (LIST_FIRST(head)->sortfield >= (elm)->sortfield)) { \
146 LIST_INSERT_HEAD((head), elm, field); \
147 } else { \
148 LIST_FOREACH(tmpelm, head, field) { \
149 if (LIST_NEXT(tmpelm, field) == NULL || LIST_NEXT(tmpelm, field)->sortfield >= (elm)->sortfield) { \
150 LIST_INSERT_AFTER(tmpelm, elm, field); \
151 break; \
152 } \
153 } \
154 } \
fe8ab488
A		 155} while (0)
156
0a7de745
A		 157#define LIST_INSERT_SORTED_TWICE_ASCENDING(head, elm, field, firstsortfield, secondsortfield, tmpelm) do { \
158 if (LIST_EMPTY((head)) || (LIST_FIRST(head)->firstsortfield > (elm)->firstsortfield) || ((LIST_FIRST(head)->firstsortfield == (elm)->firstsortfield) && (LIST_FIRST(head)->secondsortfield >= (elm)->secondsortfield))) { \
159 LIST_INSERT_HEAD((head), elm, field); \
160 } else { \
161 LIST_FOREACH(tmpelm, head, field) { \
162 if (LIST_NEXT(tmpelm, field) == NULL || (LIST_NEXT(tmpelm, field)->firstsortfield > (elm)->firstsortfield) || ((LIST_NEXT(tmpelm, field)->firstsortfield == (elm)->firstsortfield) && (LIST_NEXT(tmpelm, field)->secondsortfield >= (elm)->secondsortfield))) { \
163 LIST_INSERT_AFTER(tmpelm, elm, field); \
164 break; \
165 } \
166 } \
167 } \
fe8ab488
A		 168} while (0)
169
0a7de745
A		 170#define LIST_INSERT_SORTED_THRICE_ASCENDING(head, elm, field, firstsortfield, secondsortfield, thirdsortfield, tmpelm) do { \
171 if (LIST_EMPTY((head)) || (LIST_FIRST(head)->firstsortfield > (elm)->firstsortfield) || ((LIST_FIRST(head)->firstsortfield == (elm)->firstsortfield) && (LIST_FIRST(head)->secondsortfield >= (elm)->secondsortfield)) || ((LIST_FIRST(head)->firstsortfield == (elm)->firstsortfield) && (LIST_FIRST(head)->secondsortfield == (elm)->secondsortfield) && (LIST_FIRST(head)->thirdsortfield >= (elm)->thirdsortfield))) { \
172 LIST_INSERT_HEAD((head), elm, field); \
173 } else { \
174 LIST_FOREACH(tmpelm, head, field) { \
175 if (LIST_NEXT(tmpelm, field) == NULL || (LIST_NEXT(tmpelm, field)->firstsortfield > (elm)->firstsortfield) || ((LIST_NEXT(tmpelm, field)->firstsortfield == (elm)->firstsortfield) && (LIST_NEXT(tmpelm, field)->secondsortfield >= (elm)->secondsortfield)) || ((LIST_NEXT(tmpelm, field)->firstsortfield == (elm)->firstsortfield) && (LIST_NEXT(tmpelm, field)->secondsortfield == (elm)->secondsortfield) && (LIST_NEXT(tmpelm, field)->thirdsortfield >= (elm)->thirdsortfield))) { \
176 LIST_INSERT_AFTER(tmpelm, elm, field); \
177 break; \
178 } \
179 } \
180 } \
fe8ab488
A		 181} while (0)
182
0a7de745
A		 183#define IS_NECP_ROUTE_RULE_ALLOW_OR_DENY(x) ((x) == NECP_ROUTE_RULE_DENY_INTERFACE || (x) == NECP_ROUTE_RULE_ALLOW_INTERFACE)
184
185#define NECP_KERNEL_CONDITION_ALL_INTERFACES 0x000001
186#define NECP_KERNEL_CONDITION_BOUND_INTERFACE 0x000002
187#define NECP_KERNEL_CONDITION_PROTOCOL 0x000004
188#define NECP_KERNEL_CONDITION_LOCAL_START 0x000008
189#define NECP_KERNEL_CONDITION_LOCAL_END 0x000010
190#define NECP_KERNEL_CONDITION_LOCAL_PREFIX 0x000020
191#define NECP_KERNEL_CONDITION_REMOTE_START 0x000040
192#define NECP_KERNEL_CONDITION_REMOTE_END 0x000080
193#define NECP_KERNEL_CONDITION_REMOTE_PREFIX 0x000100
194#define NECP_KERNEL_CONDITION_APP_ID 0x000200
195#define NECP_KERNEL_CONDITION_REAL_APP_ID 0x000400
196#define NECP_KERNEL_CONDITION_DOMAIN 0x000800
197#define NECP_KERNEL_CONDITION_ACCOUNT_ID 0x001000
198#define NECP_KERNEL_CONDITION_POLICY_ID 0x002000
199#define NECP_KERNEL_CONDITION_PID 0x004000
200#define NECP_KERNEL_CONDITION_UID 0x008000
201#define NECP_KERNEL_CONDITION_LAST_INTERFACE 0x010000 // Only set from packets looping between interfaces
202#define NECP_KERNEL_CONDITION_TRAFFIC_CLASS 0x020000
203#define NECP_KERNEL_CONDITION_ENTITLEMENT 0x040000
204#define NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT 0x080000
205#define NECP_KERNEL_CONDITION_AGENT_TYPE 0x100000
206
207#define NECP_MAX_POLICY_RESULT_SIZE 512
208#define NECP_MAX_ROUTE_RULES_ARRAY_SIZE 1024
209#define NECP_MAX_CONDITIONS_ARRAY_SIZE 4096
210#define NECP_MAX_POLICY_LIST_COUNT 1024
5ba3f43e
A		 211
212// Cap the policy size at the max result + conditions size, with room for extra TLVs
0a7de745 213#define NECP_MAX_POLICY_SIZE (1024 + NECP_MAX_POLICY_RESULT_SIZE + NECP_MAX_CONDITIONS_ARRAY_SIZE)
fe8ab488
A		 214
215struct necp_service_registration {
0a7de745
A		 216 LIST_ENTRY(necp_service_registration) session_chain;
217 LIST_ENTRY(necp_service_registration) kernel_chain;
218 u_int32_t service_id;
fe8ab488
A		 219};
220
221struct necp_session {
0a7de745
A		 222 u_int8_t necp_fd_type;
223 u_int32_t control_unit;
224 u_int32_t session_priority; // Descriptive priority rating
225 u_int32_t session_order;
fe8ab488 226
0a7de745 227 necp_policy_id last_policy_id;
d9a64523 228
5ba3f43e
A		 229 decl_lck_mtx_data(, lock);
230
0a7de745
A		 231 bool proc_locked; // Messages must come from proc_uuid
232 uuid_t proc_uuid;
233 int proc_pid;
fe8ab488 234
0a7de745 235 bool dirty;
fe8ab488 236 LIST_HEAD(_policies, necp_session_policy) policies;
3e170ce0 237
fe8ab488 238 LIST_HEAD(_services, necp_service_registration) services;
5ba3f43e
A		 239
240 TAILQ_ENTRY(necp_session) chain;
fe8ab488
A		 241};
242
5ba3f43e
A		 243#define NECP_SESSION_LOCK(_s) lck_mtx_lock(&_s->lock)
244#define NECP_SESSION_UNLOCK(_s) lck_mtx_unlock(&_s->lock)
245
246static TAILQ_HEAD(_necp_session_list, necp_session) necp_session_list;
247
fe8ab488
A		 248struct necp_socket_info {
249 pid_t pid;
250 uid_t uid;
251 union necp_sockaddr_union local_addr;
252 union necp_sockaddr_union remote_addr;
253 u_int32_t bound_interface_index;
254 u_int32_t traffic_class;
255 u_int16_t protocol;
256 u_int32_t application_id;
257 u_int32_t real_application_id;
258 u_int32_t account_id;
259 char *domain;
260 errno_t cred_result;
261};
262
0a7de745
A		 263static kern_ctl_ref necp_kctlref;
264static u_int32_t necp_family;
265static OSMallocTag necp_malloc_tag;
266static lck_grp_attr_t *necp_kernel_policy_grp_attr = NULL;
267static lck_attr_t *necp_kernel_policy_mtx_attr = NULL;
268static lck_grp_t *necp_kernel_policy_mtx_grp = NULL;
fe8ab488
A		 269decl_lck_rw_data(static, necp_kernel_policy_lock);
270
0a7de745
A		 271static lck_grp_attr_t *necp_route_rule_grp_attr = NULL;
272static lck_attr_t *necp_route_rule_mtx_attr = NULL;
273static lck_grp_t *necp_route_rule_mtx_grp = NULL;
3e170ce0
A		 274decl_lck_rw_data(static, necp_route_rule_lock);
275
fe8ab488
A		 276/*
277 * On modification, invalidate cached lookups by bumping the generation count.
278 * Other calls will need to take the slowpath of taking
279 * the subsystem lock.
280 */
281static volatile int32_t necp_kernel_socket_policies_gencount;
0a7de745
A		 282#define BUMP_KERNEL_SOCKET_POLICIES_GENERATION_COUNT() do { \
283 if (OSIncrementAtomic(&necp_kernel_socket_policies_gencount) == (INT32_MAX - 1)) { \
284 necp_kernel_socket_policies_gencount = 1; \
285 } \
fe8ab488
A		 286} while (0)
287
288static u_int32_t necp_kernel_application_policies_condition_mask;
289static size_t necp_kernel_application_policies_count;
290static u_int32_t necp_kernel_socket_policies_condition_mask;
291static size_t necp_kernel_socket_policies_count;
292static size_t necp_kernel_socket_policies_non_app_count;
293static LIST_HEAD(_necpkernelsocketconnectpolicies, necp_kernel_socket_policy) necp_kernel_socket_policies;
0a7de745
A		 294#define NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS 5
295#define NECP_SOCKET_MAP_APP_ID_TO_BUCKET(appid) (appid ? (appid%(NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS - 1) + 1) : 0)
fe8ab488
A		 296static struct necp_kernel_socket_policy **necp_kernel_socket_policies_map[NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS];
297static struct necp_kernel_socket_policy **necp_kernel_socket_policies_app_layer_map;
298/*
299 * A note on policy 'maps': these are used for boosting efficiency when matching policies. For each dimension of the map,
300 * such as an ID, the 0 bucket is reserved for sockets/packets that do not have this parameter, while the other
301 * buckets lead to an array of policy pointers that form the list applicable when the (parameter%(NUM_BUCKETS - 1) + 1) == bucket_index.
302 *
303 * For example, a packet with policy ID of 7, when there are 4 ID buckets, will map to bucket (7%3 + 1) = 2.
304 */
305
306static u_int32_t necp_kernel_ip_output_policies_condition_mask;
307static size_t necp_kernel_ip_output_policies_count;
308static size_t necp_kernel_ip_output_policies_non_id_count;
309static LIST_HEAD(_necpkernelipoutputpolicies, necp_kernel_ip_output_policy) necp_kernel_ip_output_policies;
0a7de745
A		 310#define NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS 5
311#define NECP_IP_OUTPUT_MAP_ID_TO_BUCKET(id) (id ? (id%(NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS - 1) + 1) : 0)
fe8ab488
A		 312static struct necp_kernel_ip_output_policy **necp_kernel_ip_output_policies_map[NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS];
313
5ba3f43e 314static struct necp_session *necp_create_session(void);
fe8ab488
A		 315static void necp_delete_session(struct necp_session *session);
316
5ba3f43e 317static necp_policy_id necp_handle_policy_add(struct necp_session *session, u_int32_t message_id, mbuf_t packet,
0a7de745 318 u_int8_t *tlv_buffer, size_t tlv_buffer_length, int offset, int *error);
fe8ab488
A		 319static void necp_handle_policy_get(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset);
320static void necp_handle_policy_delete(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset);
321static void necp_handle_policy_apply_all(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset);
322static void necp_handle_policy_list_all(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset);
323static void necp_handle_policy_delete_all(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset);
5ba3f43e 324static int necp_handle_policy_dump_all(struct necp_session *session, u_int32_t message_id, mbuf_t packet,
0a7de745 325 user_addr_t out_buffer, size_t out_buffer_length, int offset);
fe8ab488
A		 326static void necp_handle_set_session_priority(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset);
327static void necp_handle_lock_session_to_proc(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset);
328static void necp_handle_register_service(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset);
329static void necp_handle_unregister_service(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset);
330
39037602
A		 331#define MAX_RESULT_STRING_LEN 64
332static inline const char * necp_get_result_description(char *result_string, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter);
333
3e170ce0 334static struct necp_session_policy *necp_policy_create(struct necp_session *session, necp_policy_order order, u_int8_t *conditions_array, u_int32_t conditions_array_size, u_int8_t *route_rules_array, u_int32_t route_rules_array_size, u_int8_t *result, u_int32_t result_size);
fe8ab488
A		 335static struct necp_session_policy *necp_policy_find(struct necp_session *session, necp_policy_id policy_id);
336static bool necp_policy_mark_for_deletion(struct necp_session *session, struct necp_session_policy *policy);
337static bool necp_policy_mark_all_for_deletion(struct necp_session *session);
338static bool necp_policy_delete(struct necp_session *session, struct necp_session_policy *policy);
339static void necp_policy_apply_all(struct necp_session *session);
340
d9a64523 341static necp_kernel_policy_id necp_kernel_socket_policy_add(necp_policy_order order, u_int32_t session_order, int session_pid, u_int32_t condition_mask, u_int32_t condition_negated_mask, necp_app_id cond_app_id, necp_app_id cond_real_app_id, char *cond_custom_entitlement, u_int32_t cond_account_id, char *domain, pid_t cond_pid, uid_t cond_uid, ifnet_t cond_bound_interface, struct necp_policy_condition_tc_range cond_traffic_class, u_int16_t cond_protocol, union necp_sockaddr_union *cond_local_start, union necp_sockaddr_union *cond_local_end, u_int8_t cond_local_prefix, union necp_sockaddr_union *cond_remote_start, union necp_sockaddr_union *cond_remote_end, u_int8_t cond_remote_prefix, struct necp_policy_condition_agent_type *cond_agent_type, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter);
fe8ab488
A		 342static bool necp_kernel_socket_policy_delete(necp_kernel_policy_id policy_id);
343static bool necp_kernel_socket_policies_reprocess(void);
344static bool necp_kernel_socket_policies_update_uuid_table(void);
d9a64523 345static inline struct necp_kernel_socket_policy *necp_socket_find_policy_match_with_info_locked(struct necp_kernel_socket_policy **policy_search_array, struct necp_socket_info *info, necp_kernel_policy_filter *return_filter, u_int32_t *return_route_rule_id, necp_kernel_policy_result *return_service_action, necp_kernel_policy_service *return_service, u_int32_t *return_netagent_array, u_int32_t *return_netagent_use_flags_array, size_t netagent_array_count, struct necp_client_parameter_netagent_type *required_agent_types, u_int32_t num_required_agent_types, proc_t proc, necp_kernel_policy_id *skip_policy_id);
fe8ab488 346
d9a64523 347static necp_kernel_policy_id necp_kernel_ip_output_policy_add(necp_policy_order order, necp_policy_order suborder, u_int32_t session_order, int session_pid, u_int32_t condition_mask, u_int32_t condition_negated_mask, necp_kernel_policy_id cond_policy_id, ifnet_t cond_bound_interface, u_int32_t cond_last_interface_index, u_int16_t cond_protocol, union necp_sockaddr_union *cond_local_start, union necp_sockaddr_union *cond_local_end, u_int8_t cond_local_prefix, union necp_sockaddr_union *cond_remote_start, union necp_sockaddr_union *cond_remote_end, u_int8_t cond_remote_prefix, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter);
fe8ab488
A		 348static bool necp_kernel_ip_output_policy_delete(necp_kernel_policy_id policy_id);
349static bool necp_kernel_ip_output_policies_reprocess(void);
350
351static bool necp_is_addr_in_range(struct sockaddr *addr, struct sockaddr *range_start, struct sockaddr *range_end);
352static bool necp_is_range_in_range(struct sockaddr *inner_range_start, struct sockaddr *inner_range_end, struct sockaddr *range_start, struct sockaddr *range_end);
353static bool necp_is_addr_in_subnet(struct sockaddr *addr, struct sockaddr *subnet_addr, u_int8_t subnet_prefix);
354static int necp_addr_compare(struct sockaddr *sa1, struct sockaddr *sa2, int check_port);
355static bool necp_buffer_compare_with_bit_prefix(u_int8_t *p1, u_int8_t *p2, u_int32_t bits);
356static bool necp_is_loopback(struct sockaddr *local_addr, struct sockaddr *remote_addr, struct inpcb *inp, struct mbuf *packet);
743345f9 357static bool necp_is_intcoproc(struct inpcb *inp, struct mbuf *packet);
fe8ab488
A		 358
359struct necp_uuid_id_mapping {
360 LIST_ENTRY(necp_uuid_id_mapping) chain;
0a7de745
A		 361 uuid_t uuid;
362 u_int32_t id;
363 u_int32_t refcount;
364 u_int32_t table_refcount; // Add to UUID policy table count
fe8ab488
A		 365};
366static size_t necp_num_uuid_app_id_mappings;
367static bool necp_uuid_app_id_mappings_dirty;
0a7de745 368#define NECP_UUID_APP_ID_HASH_SIZE 64
fe8ab488
A		 369static u_long necp_uuid_app_id_hash_mask;
370static u_long necp_uuid_app_id_hash_num_buckets;
0a7de745
A		 371static LIST_HEAD(necp_uuid_id_mapping_head, necp_uuid_id_mapping) * necp_uuid_app_id_hashtbl, necp_uuid_service_id_list; // App map is real hash table, service map is just mapping
372#define APPUUIDHASH(uuid) (&necp_uuid_app_id_hashtbl[uuid[0] & necp_uuid_app_id_hash_mask]) // Assume first byte of UUIDs are evenly distributed
fe8ab488
A		 373static u_int32_t necp_create_uuid_app_id_mapping(uuid_t uuid, bool *allocated_mapping, bool uuid_policy_table);
374static bool necp_remove_uuid_app_id_mapping(uuid_t uuid, bool *removed_mapping, bool uuid_policy_table);
39037602 375static struct necp_uuid_id_mapping *necp_uuid_lookup_uuid_with_app_id_locked(u_int32_t local_id);
fe8ab488
A		 376
377static struct necp_uuid_id_mapping *necp_uuid_lookup_service_id_locked(uuid_t uuid);
378static struct necp_uuid_id_mapping *necp_uuid_lookup_uuid_with_service_id_locked(u_int32_t local_id);
379static u_int32_t necp_create_uuid_service_id_mapping(uuid_t uuid);
380static bool necp_remove_uuid_service_id_mapping(uuid_t uuid);
381
382struct necp_string_id_mapping {
383 LIST_ENTRY(necp_string_id_mapping) chain;
0a7de745
A		 384 char *string;
385 necp_app_id id;
386 u_int32_t refcount;
fe8ab488
A		 387};
388static LIST_HEAD(necp_string_id_mapping_list, necp_string_id_mapping) necp_account_id_list;
389static u_int32_t necp_create_string_to_id_mapping(struct necp_string_id_mapping_list *list, char *domain);
390static bool necp_remove_string_to_id_mapping(struct necp_string_id_mapping_list *list, char *domain);
39037602 391static struct necp_string_id_mapping *necp_lookup_string_with_id_locked(struct necp_string_id_mapping_list *list, u_int32_t local_id);
fe8ab488 392
d26ffc64
A		 393static struct necp_kernel_socket_policy *necp_kernel_socket_policy_find(necp_kernel_policy_id policy_id);
394static struct necp_kernel_ip_output_policy *necp_kernel_ip_output_policy_find(necp_kernel_policy_id policy_id);
395
fe8ab488
A		 396static LIST_HEAD(_necp_kernel_service_list, necp_service_registration) necp_registered_service_list;
397
398static char *necp_create_trimmed_domain(char *string, size_t length);
399static inline int necp_count_dots(char *string, size_t length);
400
39037602 401static char *necp_copy_string(char *string, size_t length);
5ba3f43e 402static bool necp_update_qos_marking(struct ifnet *ifp, u_int32_t route_rule_id);
39037602 403
3e170ce0
A		 404#define ROUTE_RULE_IS_AGGREGATE(ruleid) (ruleid > UINT16_MAX)
405
406#define MAX_ROUTE_RULE_INTERFACES 10
407struct necp_route_rule {
408 LIST_ENTRY(necp_route_rule) chain;
0a7de745
A		 409 u_int32_t id;
410 u_int32_t default_action;
411 u_int8_t cellular_action;
412 u_int8_t wifi_action;
413 u_int8_t wired_action;
414 u_int8_t expensive_action;
415 u_int exception_if_indices[MAX_ROUTE_RULE_INTERFACES];
416 u_int8_t exception_if_actions[MAX_ROUTE_RULE_INTERFACES];
417 u_int32_t refcount;
3e170ce0
A		 418};
419static LIST_HEAD(necp_route_rule_list, necp_route_rule) necp_route_rules;
420static u_int32_t necp_create_route_rule(struct necp_route_rule_list *list, u_int8_t *route_rules_array, u_int32_t route_rules_array_size);
421static bool necp_remove_route_rule(struct necp_route_rule_list *list, u_int32_t route_rule_id);
39037602 422static bool necp_route_is_allowed(struct rtentry *route, ifnet_t interface, u_int32_t route_rule_id, u_int32_t *interface_type_denied);
3e170ce0 423static struct necp_route_rule *necp_lookup_route_rule_locked(struct necp_route_rule_list *list, u_int32_t route_rule_id);
d26ffc64 424static inline void necp_get_parent_cred_result(proc_t proc, struct necp_socket_info *info);
3e170ce0
A		 425
426#define MAX_AGGREGATE_ROUTE_RULES 16
427struct necp_aggregate_route_rule {
428 LIST_ENTRY(necp_aggregate_route_rule) chain;
0a7de745
A		 429 u_int32_t id;
430 u_int32_t rule_ids[MAX_AGGREGATE_ROUTE_RULES];
3e170ce0
A		 431};
432static LIST_HEAD(necp_aggregate_route_rule_list, necp_aggregate_route_rule) necp_aggregate_route_rules;
433static u_int32_t necp_create_aggregate_route_rule(u_int32_t *rule_ids);
434
435// Sysctl definitions
436static int sysctl_handle_necp_level SYSCTL_HANDLER_ARGS;
437
438SYSCTL_NODE(_net, OID_AUTO, necp, CTLFLAG_RW | CTLFLAG_LOCKED, 0, "NECP");
439SYSCTL_INT(_net_necp, NECPCTL_PASS_LOOPBACK, pass_loopback, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_pass_loopback, 0, "");
440SYSCTL_INT(_net_necp, NECPCTL_PASS_KEEPALIVES, pass_keepalives, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_pass_keepalives, 0, "");
441SYSCTL_INT(_net_necp, NECPCTL_DEBUG, debug, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_debug, 0, "");
442SYSCTL_PROC(_net_necp, NECPCTL_DROP_ALL_LEVEL, drop_all_level, CTLTYPE_INT | CTLFLAG_LOCKED | CTLFLAG_RW, &necp_drop_all_level, 0, &sysctl_handle_necp_level, "IU", "");
443SYSCTL_LONG(_net_necp, NECPCTL_SOCKET_POLICY_COUNT, socket_policy_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_kernel_socket_policies_count, "");
444SYSCTL_LONG(_net_necp, NECPCTL_SOCKET_NON_APP_POLICY_COUNT, socket_non_app_policy_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_kernel_socket_policies_non_app_count, "");
445SYSCTL_LONG(_net_necp, NECPCTL_IP_POLICY_COUNT, ip_policy_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_kernel_ip_output_policies_count, "");
446SYSCTL_INT(_net_necp, NECPCTL_SESSION_COUNT, session_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_session_count, 0, "");
447
fe8ab488
A		 448// Session order allocation
449static u_int32_t
450necp_allocate_new_session_order(u_int32_t priority, u_int32_t control_unit)
451{
452 u_int32_t new_order = 0;
453
454 // For now, just allocate 1000 orders for each priority
455 if (priority == NECP_SESSION_PRIORITY_UNKNOWN || priority > NECP_SESSION_NUM_PRIORITIES) {
456 priority = NECP_SESSION_PRIORITY_DEFAULT;
457 }
458
5ba3f43e
A		 459 // Use the control unit to decide the offset into the priority list
460 new_order = (control_unit) + ((priority - 1) * 1000);
461
0a7de745 462 return new_order;
5ba3f43e
A		 463}
464
465static inline u_int32_t
466necp_get_first_order_for_priority(u_int32_t priority)
467{
0a7de745 468 return ((priority - 1) * 1000) + 1;
5ba3f43e
A		 469}
470
471// Sysctl handler
472static int
473sysctl_handle_necp_level SYSCTL_HANDLER_ARGS
474{
475#pragma unused(arg1, arg2)
476 int error = sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2, req);
477 if (necp_drop_all_level == 0) {
478 necp_drop_all_order = 0;
479 } else {
480 necp_drop_all_order = necp_get_first_order_for_priority(necp_drop_all_level);
481 }
0a7de745 482 return error;
5ba3f43e
A		 483}
484
485// Session fd
486
487static int noop_read(struct fileproc *, struct uio *, int, vfs_context_t);
488static int noop_write(struct fileproc *, struct uio *, int, vfs_context_t);
489static int noop_ioctl(struct fileproc *, unsigned long, caddr_t,
0a7de745 490 vfs_context_t);
5ba3f43e
A		 491static int noop_select(struct fileproc *, int, void *, vfs_context_t);
492static int necp_session_op_close(struct fileglob *, vfs_context_t);
493static int noop_kqfilter(struct fileproc *, struct knote *,
0a7de745 494 struct kevent_internal_s *, vfs_context_t);
5ba3f43e
A		 495
496static const struct fileops necp_session_fd_ops = {
497 .fo_type = DTYPE_NETPOLICY,
498 .fo_read = noop_read,
499 .fo_write = noop_write,
500 .fo_ioctl = noop_ioctl,
501 .fo_select = noop_select,
502 .fo_close = necp_session_op_close,
503 .fo_kqfilter = noop_kqfilter,
504 .fo_drain = NULL,
505};
506
507static int
508noop_read(struct fileproc *fp, struct uio *uio, int flags, vfs_context_t ctx)
509{
510#pragma unused(fp, uio, flags, ctx)
0a7de745 511 return ENXIO;
5ba3f43e
A		 512}
513
514static int
515noop_write(struct fileproc *fp, struct uio *uio, int flags,
0a7de745 516 vfs_context_t ctx)
5ba3f43e
A		 517{
518#pragma unused(fp, uio, flags, ctx)
0a7de745 519 return ENXIO;
5ba3f43e
A		 520}
521
522static int
523noop_ioctl(struct fileproc *fp, unsigned long com, caddr_t data,
0a7de745 524 vfs_context_t ctx)
5ba3f43e
A		 525{
526#pragma unused(fp, com, data, ctx)
0a7de745 527 return ENOTTY;
5ba3f43e
A		 528}
529
530static int
531noop_select(struct fileproc *fp, int which, void *wql, vfs_context_t ctx)
532{
533#pragma unused(fp, which, wql, ctx)
0a7de745 534 return ENXIO;
5ba3f43e
A		 535}
536
537static int
538noop_kqfilter(struct fileproc *fp, struct knote *kn,
0a7de745 539 struct kevent_internal_s *kev, vfs_context_t ctx)
5ba3f43e
A		 540{
541#pragma unused(fp, kn, kev, ctx)
0a7de745 542 return ENXIO;
5ba3f43e
A		 543}
544
545int
546necp_session_open(struct proc *p, struct necp_session_open_args *uap, int *retval)
547{
548#pragma unused(uap)
549 int error = 0;
550 struct necp_session *session = NULL;
551 struct fileproc *fp = NULL;
552 int fd = -1;
553
554 uid_t uid = kauth_cred_getuid(proc_ucred(p));
555 if (uid != 0 && priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NECP_POLICIES, 0) != 0) {
556 NECPLOG0(LOG_ERR, "Process does not hold necessary entitlement to open NECP session");
557 error = EACCES;
558 goto done;
559 }
560
561 error = falloc(p, &fp, &fd, vfs_context_current());
562 if (error != 0) {
563 goto done;
564 }
565
566 session = necp_create_session();
567 if (session == NULL) {
568 error = ENOMEM;
569 goto done;
570 }
571
572 fp->f_fglob->fg_flag = 0;
573 fp->f_fglob->fg_ops = &necp_session_fd_ops;
574 fp->f_fglob->fg_data = session;
575
576 proc_fdlock(p);
577 FDFLAGS_SET(p, fd, (UF_EXCLOSE | UF_FORKCLOSE));
578 procfdtbl_releasefd(p, fd, NULL);
579 fp_drop(p, fd, fp, 1);
580 proc_fdunlock(p);
581
582 *retval = fd;
583done:
584 if (error != 0) {
585 if (fp != NULL) {
586 fp_free(p, fd, fp);
587 fp = NULL;
588 }
589 }
590
0a7de745 591 return error;
5ba3f43e
A		 592}
593
594static int
595necp_session_op_close(struct fileglob *fg, vfs_context_t ctx)
596{
597#pragma unused(ctx)
598 struct necp_session *session = (struct necp_session *)fg->fg_data;
599 fg->fg_data = NULL;
600
601 if (session != NULL) {
602 necp_policy_mark_all_for_deletion(session);
603 necp_policy_apply_all(session);
604 necp_delete_session(session);
0a7de745 605 return 0;
5ba3f43e 606 } else {
0a7de745 607 return ENOENT;
5ba3f43e
A		 608 }
609}
610
611static int
612necp_session_find_from_fd(int fd, struct necp_session **session)
613{
614 proc_t p = current_proc();
615 struct fileproc *fp = NULL;
616 int error = 0;
617
618 proc_fdlock_spin(p);
619 if ((error = fp_lookup(p, fd, &fp, 1)) != 0) {
620 goto done;
621 }
622 if (fp->f_fglob->fg_ops->fo_type != DTYPE_NETPOLICY) {
623 fp_drop(p, fd, fp, 1);
624 error = ENODEV;
625 goto done;
626 }
627 *session = (struct necp_session *)fp->f_fglob->fg_data;
628
d9a64523
A		 629 if ((*session)->necp_fd_type != necp_fd_type_session) {
630 // Not a client fd, ignore
0a7de745 631 fp_drop(p, fd, fp, 1);
d9a64523
A		 632 error = EINVAL;
633 goto done;
634 }
635
5ba3f43e
A		 636done:
637 proc_fdunlock(p);
0a7de745 638 return error;
5ba3f43e
A		 639}
640
641static int
642necp_session_add_policy(struct necp_session *session, struct necp_session_action_args *uap, int *retval)
643{
644 int error = 0;
645 u_int8_t *tlv_buffer = NULL;
646
647 if (uap->in_buffer_length == 0 || uap->in_buffer_length > NECP_MAX_POLICY_SIZE || uap->in_buffer == 0) {
648 NECPLOG(LOG_ERR, "necp_session_add_policy invalid input (%zu)", uap->in_buffer_length);
649 error = EINVAL;
650 goto done;
651 }
652
653 if (uap->out_buffer_length < sizeof(necp_policy_id) || uap->out_buffer == 0) {
654 NECPLOG(LOG_ERR, "necp_session_add_policy invalid output buffer (%zu)", uap->out_buffer_length);
655 error = EINVAL;
656 goto done;
657 }
658
659 if ((tlv_buffer = _MALLOC(uap->in_buffer_length, M_NECP, M_WAITOK | M_ZERO)) == NULL) {
660 error = ENOMEM;
661 goto done;
662 }
663
664 error = copyin(uap->in_buffer, tlv_buffer, uap->in_buffer_length);
665 if (error != 0) {
666 NECPLOG(LOG_ERR, "necp_session_add_policy tlv copyin error (%d)", error);
667 goto done;
668 }
669
670 necp_policy_id new_policy_id = necp_handle_policy_add(session, 0, NULL, tlv_buffer, uap->in_buffer_length, 0, &error);
671 if (error != 0) {
672 NECPLOG(LOG_ERR, "necp_session_add_policy failed to add policy (%d)", error);
673 goto done;
674 }
675
676 error = copyout(&new_policy_id, uap->out_buffer, sizeof(new_policy_id));
677 if (error != 0) {
678 NECPLOG(LOG_ERR, "necp_session_add_policy policy_id copyout error (%d)", error);
679 goto done;
680 }
681
682done:
683 if (tlv_buffer != NULL) {
684 FREE(tlv_buffer, M_NECP);
685 tlv_buffer = NULL;
686 }
687 *retval = error;
688
0a7de745 689 return error;
5ba3f43e
A		 690}
691
692static int
693necp_session_get_policy(struct necp_session *session, struct necp_session_action_args *uap, int *retval)
694{
695 int error = 0;
696 u_int8_t *response = NULL;
697
698 if (uap->in_buffer_length < sizeof(necp_policy_id) || uap->in_buffer == 0) {
699 NECPLOG(LOG_ERR, "necp_session_get_policy invalid input (%zu)", uap->in_buffer_length);
700 error = EINVAL;
701 goto done;
702 }
703
704 necp_policy_id policy_id = 0;
705 error = copyin(uap->in_buffer, &policy_id, sizeof(policy_id));
706 if (error != 0) {
707 NECPLOG(LOG_ERR, "necp_session_get_policy policy_id copyin error (%d)", error);
708 goto done;
709 }
710
711 struct necp_session_policy *policy = necp_policy_find(session, policy_id);
712 if (policy == NULL || policy->pending_deletion) {
713 NECPLOG(LOG_ERR, "Failed to find policy with id %d", policy_id);
714 error = ENOENT;
715 goto done;
716 }
717
718 u_int32_t order_tlv_size = sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(necp_policy_order);
719 u_int32_t result_tlv_size = (policy->result_size ? (sizeof(u_int8_t) + sizeof(u_int32_t) + policy->result_size) : 0);
720 u_int32_t response_size = order_tlv_size + result_tlv_size + policy->conditions_size;
721
722 if (uap->out_buffer_length < response_size || uap->out_buffer == 0) {
723 NECPLOG(LOG_ERR, "necp_session_get_policy buffer not large enough (%u < %u)", uap->out_buffer_length, response_size);
724 error = EINVAL;
725 goto done;
726 }
727
728 if (response_size > NECP_MAX_POLICY_SIZE) {
729 NECPLOG(LOG_ERR, "necp_session_get_policy size too large to copy (%u)", response_size);
730 error = EINVAL;
731 goto done;
732 }
733
734 MALLOC(response, u_int8_t *, response_size, M_NECP, M_WAITOK | M_ZERO);
735 if (response == NULL) {
736 error = ENOMEM;
737 goto done;
738 }
739
740 u_int8_t *cursor = response;
741 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_ORDER, sizeof(necp_policy_order), &policy->order, response, response_size);
742 if (result_tlv_size) {
743 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_RESULT, policy->result_size, &policy->result, response, response_size);
744 }
745 if (policy->conditions_size) {
746 memcpy(((u_int8_t *)(void *)(cursor)), policy->conditions, policy->conditions_size);
747 }
748
749 error = copyout(response, uap->out_buffer, response_size);
750 if (error != 0) {
751 NECPLOG(LOG_ERR, "necp_session_get_policy TLV copyout error (%d)", error);
752 goto done;
753 }
754
755done:
756 if (response != NULL) {
757 FREE(response, M_NECP);
758 response = NULL;
759 }
760 *retval = error;
761
0a7de745 762 return error;
5ba3f43e
A		 763}
764
765static int
766necp_session_delete_policy(struct necp_session *session, struct necp_session_action_args *uap, int *retval)
767{
768 int error = 0;
769
770 if (uap->in_buffer_length < sizeof(necp_policy_id) || uap->in_buffer == 0) {
771 NECPLOG(LOG_ERR, "necp_session_delete_policy invalid input (%zu)", uap->in_buffer_length);
772 error = EINVAL;
773 goto done;
774 }
775
776 necp_policy_id delete_policy_id = 0;
777 error = copyin(uap->in_buffer, &delete_policy_id, sizeof(delete_policy_id));
778 if (error != 0) {
779 NECPLOG(LOG_ERR, "necp_session_delete_policy policy_id copyin error (%d)", error);
780 goto done;
781 }
782
783 struct necp_session_policy *policy = necp_policy_find(session, delete_policy_id);
784 if (policy == NULL || policy->pending_deletion) {
785 NECPLOG(LOG_ERR, "necp_session_delete_policy failed to find policy with id %u", delete_policy_id);
786 error = ENOENT;
787 goto done;
788 }
789
790 necp_policy_mark_for_deletion(session, policy);
791done:
792 *retval = error;
0a7de745 793 return error;
5ba3f43e
A		 794}
795
796static int
797necp_session_apply_all(struct necp_session *session, struct necp_session_action_args *uap, int *retval)
798{
799#pragma unused(uap)
800 necp_policy_apply_all(session);
801 *retval = 0;
0a7de745 802 return 0;
5ba3f43e
A		 803}
804
805static int
806necp_session_list_all(struct necp_session *session, struct necp_session_action_args *uap, int *retval)
807{
808 u_int32_t tlv_size = (sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(necp_policy_id));
809 u_int32_t response_size = 0;
810 u_int8_t *response = NULL;
811 int num_policies = 0;
812 int cur_policy_index = 0;
813 int error = 0;
814 struct necp_session_policy *policy;
815
816 LIST_FOREACH(policy, &session->policies, chain) {
817 if (!policy->pending_deletion) {
818 num_policies++;
819 }
820 }
821
822 if (num_policies > NECP_MAX_POLICY_LIST_COUNT) {
823 NECPLOG(LOG_ERR, "necp_session_list_all size too large to copy (%u policies)", num_policies);
824 error = EINVAL;
825 goto done;
826 }
827
828 response_size = num_policies * tlv_size;
829 if (uap->out_buffer_length < response_size || uap->out_buffer == 0) {
830 NECPLOG(LOG_ERR, "necp_session_list_all buffer not large enough (%u < %u)", uap->out_buffer_length, response_size);
831 error = EINVAL;
832 goto done;
833 }
834
835 // Create a response with one Policy ID TLV for each policy
836 MALLOC(response, u_int8_t *, response_size, M_NECP, M_WAITOK | M_ZERO);
837 if (response == NULL) {
838 error = ENOMEM;
839 goto done;
840 }
841
842 u_int8_t *cursor = response;
843 LIST_FOREACH(policy, &session->policies, chain) {
844 if (!policy->pending_deletion && cur_policy_index < num_policies) {
d9a64523 845 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_ID, sizeof(u_int32_t), &policy->local_id, response, response_size);
5ba3f43e
A		 846 cur_policy_index++;
847 }
848 }
849
850 error = copyout(response, uap->out_buffer, response_size);
851 if (error != 0) {
852 NECPLOG(LOG_ERR, "necp_session_list_all TLV copyout error (%d)", error);
853 goto done;
854 }
855
856done:
857 if (response != NULL) {
858 FREE(response, M_NECP);
859 response = NULL;
860 }
861 *retval = error;
862
0a7de745 863 return error;
5ba3f43e
A		 864}
865
866
867static int
868necp_session_delete_all(struct necp_session *session, struct necp_session_action_args *uap, int *retval)
869{
870#pragma unused(uap)
871 necp_policy_mark_all_for_deletion(session);
872 *retval = 0;
0a7de745 873 return 0;
5ba3f43e
A		 874}
875
876static int
877necp_session_set_session_priority(struct necp_session *session, struct necp_session_action_args *uap, int *retval)
878{
879 int error = 0;
880 struct necp_session_policy *policy = NULL;
881 struct necp_session_policy *temp_policy = NULL;
882
883 if (uap->in_buffer_length < sizeof(necp_session_priority) || uap->in_buffer == 0) {
884 NECPLOG(LOG_ERR, "necp_session_set_session_priority invalid input (%zu)", uap->in_buffer_length);
885 error = EINVAL;
886 goto done;
887 }
888
889 necp_session_priority requested_session_priority = 0;
890 error = copyin(uap->in_buffer, &requested_session_priority, sizeof(requested_session_priority));
891 if (error != 0) {
892 NECPLOG(LOG_ERR, "necp_session_set_session_priority priority copyin error (%d)", error);
893 goto done;
894 }
895
896 // Enforce special session priorities with entitlements
897 if (requested_session_priority == NECP_SESSION_PRIORITY_CONTROL ||
0a7de745 898 requested_session_priority == NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL) {
5ba3f43e
A		 899 errno_t cred_result = priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NECP_POLICIES, 0);
900 if (cred_result != 0) {
901 NECPLOG(LOG_ERR, "Session does not hold necessary entitlement to claim priority level %d", requested_session_priority);
902 error = EPERM;
903 goto done;
904 }
905 }
906
907 if (session->session_priority != requested_session_priority) {
908 session->session_priority = requested_session_priority;
909 session->session_order = necp_allocate_new_session_order(session->session_priority, session->control_unit);
910 session->dirty = TRUE;
911
912 // Mark all policies as needing updates
913 LIST_FOREACH_SAFE(policy, &session->policies, chain, temp_policy) {
914 policy->pending_update = TRUE;
915 }
916 }
917
918done:
919 *retval = error;
0a7de745 920 return error;
5ba3f43e
A		 921}
922
923static int
924necp_session_lock_to_process(struct necp_session *session, struct necp_session_action_args *uap, int *retval)
925{
926#pragma unused(uap)
927 session->proc_locked = TRUE;
928 *retval = 0;
0a7de745 929 return 0;
5ba3f43e
A		 930}
931
932static int
933necp_session_register_service(struct necp_session *session, struct necp_session_action_args *uap, int *retval)
934{
935 int error = 0;
936 struct necp_service_registration *new_service = NULL;
937
938 if (uap->in_buffer_length < sizeof(uuid_t) || uap->in_buffer == 0) {
939 NECPLOG(LOG_ERR, "necp_session_register_service invalid input (%zu)", uap->in_buffer_length);
940 error = EINVAL;
941 goto done;
942 }
943
944 uuid_t service_uuid;
945 error = copyin(uap->in_buffer, service_uuid, sizeof(service_uuid));
946 if (error != 0) {
947 NECPLOG(LOG_ERR, "necp_session_register_service uuid copyin error (%d)", error);
948 goto done;
949 }
950
951 MALLOC(new_service, struct necp_service_registration *, sizeof(*new_service), M_NECP, M_WAITOK | M_ZERO);
952 if (new_service == NULL) {
953 NECPLOG0(LOG_ERR, "Failed to allocate service registration");
954 error = ENOMEM;
955 goto done;
956 }
957
958 lck_rw_lock_exclusive(&necp_kernel_policy_lock);
959 new_service->service_id = necp_create_uuid_service_id_mapping(service_uuid);
960 LIST_INSERT_HEAD(&session->services, new_service, session_chain);
961 LIST_INSERT_HEAD(&necp_registered_service_list, new_service, kernel_chain);
962 lck_rw_done(&necp_kernel_policy_lock);
963
964done:
965 *retval = error;
0a7de745 966 return error;
5ba3f43e
A		 967}
968
969static int
970necp_session_unregister_service(struct necp_session *session, struct necp_session_action_args *uap, int *retval)
971{
972 int error = 0;
973 struct necp_service_registration *service = NULL;
974 struct necp_service_registration *temp_service = NULL;
975 struct necp_uuid_id_mapping *mapping = NULL;
976
977 if (uap->in_buffer_length < sizeof(uuid_t) || uap->in_buffer == 0) {
978 NECPLOG(LOG_ERR, "necp_session_unregister_service invalid input (%zu)", uap->in_buffer_length);
979 error = EINVAL;
980 goto done;
981 }
982
983 uuid_t service_uuid;
984 error = copyin(uap->in_buffer, service_uuid, sizeof(service_uuid));
985 if (error != 0) {
986 NECPLOG(LOG_ERR, "necp_session_unregister_service uuid copyin error (%d)", error);
987 goto done;
988 }
989
990 // Remove all matching services for this session
991 lck_rw_lock_exclusive(&necp_kernel_policy_lock);
992 mapping = necp_uuid_lookup_service_id_locked(service_uuid);
993 if (mapping != NULL) {
994 LIST_FOREACH_SAFE(service, &session->services, session_chain, temp_service) {
995 if (service->service_id == mapping->id) {
996 LIST_REMOVE(service, session_chain);
997 LIST_REMOVE(service, kernel_chain);
998 FREE(service, M_NECP);
999 }
1000 }
1001 necp_remove_uuid_service_id_mapping(service_uuid);
1002 }
1003 lck_rw_done(&necp_kernel_policy_lock);
1004
1005done:
1006 *retval = error;
0a7de745 1007 return error;
5ba3f43e
A		 1008}
1009
1010static int
1011necp_session_dump_all(struct necp_session *session, struct necp_session_action_args *uap, int *retval)
1012{
1013 int error = 0;
1014
1015 if (uap->out_buffer_length == 0 || uap->out_buffer == 0) {
1016 NECPLOG(LOG_ERR, "necp_session_dump_all invalid output buffer (%zu)", uap->out_buffer_length);
1017 error = EINVAL;
1018 goto done;
1019 }
1020
1021 error = necp_handle_policy_dump_all(session, 0, NULL, uap->out_buffer, uap->out_buffer_length, 0);
1022done:
1023 *retval = error;
0a7de745 1024 return error;
5ba3f43e
A		 1025}
1026
1027int
1028necp_session_action(struct proc *p, struct necp_session_action_args *uap, int *retval)
1029{
1030#pragma unused(p)
1031 int error = 0;
1032 int return_value = 0;
1033 struct necp_session *session = NULL;
1034 error = necp_session_find_from_fd(uap->necp_fd, &session);
1035 if (error != 0) {
1036 NECPLOG(LOG_ERR, "necp_session_action find fd error (%d)", error);
0a7de745 1037 return error;
5ba3f43e
A		 1038 }
1039
1040 NECP_SESSION_LOCK(session);
1041
1042 if (session->proc_locked) {
1043 // Verify that the calling process is allowed to do actions
1044 uuid_t proc_uuid;
1045 proc_getexecutableuuid(current_proc(), proc_uuid, sizeof(proc_uuid));
1046 if (uuid_compare(proc_uuid, session->proc_uuid) != 0) {
1047 error = EPERM;
1048 goto done;
1049 }
1050 } else {
1051 // If not locked, update the proc_uuid and proc_pid of the session
1052 proc_getexecutableuuid(current_proc(), session->proc_uuid, sizeof(session->proc_uuid));
1053 session->proc_pid = proc_pid(current_proc());
1054 }
1055
1056 u_int32_t action = uap->action;
1057 switch (action) {
0a7de745
A		 1058 case NECP_SESSION_ACTION_POLICY_ADD: {
1059 return_value = necp_session_add_policy(session, uap, retval);
1060 break;
1061 }
1062 case NECP_SESSION_ACTION_POLICY_GET: {
1063 return_value = necp_session_get_policy(session, uap, retval);
1064 break;
1065 }
1066 case NECP_SESSION_ACTION_POLICY_DELETE: {
1067 return_value = necp_session_delete_policy(session, uap, retval);
1068 break;
1069 }
1070 case NECP_SESSION_ACTION_POLICY_APPLY_ALL: {
1071 return_value = necp_session_apply_all(session, uap, retval);
1072 break;
1073 }
1074 case NECP_SESSION_ACTION_POLICY_LIST_ALL: {
1075 return_value = necp_session_list_all(session, uap, retval);
1076 break;
1077 }
1078 case NECP_SESSION_ACTION_POLICY_DELETE_ALL: {
1079 return_value = necp_session_delete_all(session, uap, retval);
1080 break;
1081 }
1082 case NECP_SESSION_ACTION_SET_SESSION_PRIORITY: {
1083 return_value = necp_session_set_session_priority(session, uap, retval);
1084 break;
1085 }
1086 case NECP_SESSION_ACTION_LOCK_SESSION_TO_PROC: {
1087 return_value = necp_session_lock_to_process(session, uap, retval);
1088 break;
1089 }
1090 case NECP_SESSION_ACTION_REGISTER_SERVICE: {
1091 return_value = necp_session_register_service(session, uap, retval);
1092 break;
1093 }
1094 case NECP_SESSION_ACTION_UNREGISTER_SERVICE: {
1095 return_value = necp_session_unregister_service(session, uap, retval);
1096 break;
1097 }
1098 case NECP_SESSION_ACTION_POLICY_DUMP_ALL: {
1099 return_value = necp_session_dump_all(session, uap, retval);
1100 break;
1101 }
1102 default: {
1103 NECPLOG(LOG_ERR, "necp_session_action unknown action (%u)", action);
1104 return_value = EINVAL;
1105 break;
1106 }
5ba3f43e
A		 1107 }
1108
1109done:
1110 NECP_SESSION_UNLOCK(session);
1111 file_drop(uap->necp_fd);
fe8ab488 1112
0a7de745 1113 return return_value;
fe8ab488
A		 1114}
1115
fe8ab488
A		 1116// Kernel Control functions
1117static errno_t necp_register_control(void);
1118static errno_t necp_ctl_connect(kern_ctl_ref kctlref, struct sockaddr_ctl *sac, void **unitinfo);
1119static errno_t necp_ctl_disconnect(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo);
1120static errno_t necp_ctl_send(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo, mbuf_t m, int flags);
1121static void necp_ctl_rcvd(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo, int flags);
1122static errno_t necp_ctl_getopt(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo, int opt, void *data, size_t *len);
1123static errno_t necp_ctl_setopt(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo, int opt, void *data, size_t len);
1124
1125static bool necp_send_ctl_data(struct necp_session *session, u_int8_t *buffer, size_t buffer_size);
1126
1127errno_t
1128necp_init(void)
1129{
1130 errno_t result = 0;
1131
1132 result = necp_register_control();
1133 if (result != 0) {
1134 goto done;
1135 }
1136
1137 necp_kernel_policy_grp_attr = lck_grp_attr_alloc_init();
1138 if (necp_kernel_policy_grp_attr == NULL) {
1139 NECPLOG0(LOG_ERR, "lck_grp_attr_alloc_init failed");
1140 result = ENOMEM;
1141 goto done;
1142 }
1143
1144 necp_kernel_policy_mtx_grp = lck_grp_alloc_init(NECP_CONTROL_NAME, necp_kernel_policy_grp_attr);
1145 if (necp_kernel_policy_mtx_grp == NULL) {
1146 NECPLOG0(LOG_ERR, "lck_grp_alloc_init failed");
1147 result = ENOMEM;
1148 goto done;
1149 }
1150
1151 necp_kernel_policy_mtx_attr = lck_attr_alloc_init();
1152 if (necp_kernel_policy_mtx_attr == NULL) {
1153 NECPLOG0(LOG_ERR, "lck_attr_alloc_init failed");
1154 result = ENOMEM;
1155 goto done;
1156 }
1157
1158 lck_rw_init(&necp_kernel_policy_lock, necp_kernel_policy_mtx_grp, necp_kernel_policy_mtx_attr);
1159
3e170ce0
A		 1160 necp_route_rule_grp_attr = lck_grp_attr_alloc_init();
1161 if (necp_route_rule_grp_attr == NULL) {
1162 NECPLOG0(LOG_ERR, "lck_grp_attr_alloc_init failed");
1163 result = ENOMEM;
1164 goto done;
1165 }
1166
1167 necp_route_rule_mtx_grp = lck_grp_alloc_init("necp_route_rule", necp_route_rule_grp_attr);
1168 if (necp_route_rule_mtx_grp == NULL) {
1169 NECPLOG0(LOG_ERR, "lck_grp_alloc_init failed");
1170 result = ENOMEM;
1171 goto done;
1172 }
1173
1174 necp_route_rule_mtx_attr = lck_attr_alloc_init();
1175 if (necp_route_rule_mtx_attr == NULL) {
1176 NECPLOG0(LOG_ERR, "lck_attr_alloc_init failed");
1177 result = ENOMEM;
1178 goto done;
1179 }
1180
1181 lck_rw_init(&necp_route_rule_lock, necp_route_rule_mtx_grp, necp_route_rule_mtx_attr);
1182
39037602
A		 1183 necp_client_init();
1184
5ba3f43e
A		 1185 TAILQ_INIT(&necp_session_list);
1186
fe8ab488
A		 1187 LIST_INIT(&necp_kernel_socket_policies);
1188 LIST_INIT(&necp_kernel_ip_output_policies);
1189
1190 LIST_INIT(&necp_account_id_list);
1191
1192 LIST_INIT(&necp_uuid_service_id_list);
3e170ce0 1193
fe8ab488
A		 1194 LIST_INIT(&necp_registered_service_list);
1195
3e170ce0
A		 1196 LIST_INIT(&necp_route_rules);
1197 LIST_INIT(&necp_aggregate_route_rules);
1198
fe8ab488
A		 1199 necp_uuid_app_id_hashtbl = hashinit(NECP_UUID_APP_ID_HASH_SIZE, M_NECP, &necp_uuid_app_id_hash_mask);
1200 necp_uuid_app_id_hash_num_buckets = necp_uuid_app_id_hash_mask + 1;
1201 necp_num_uuid_app_id_mappings = 0;
1202 necp_uuid_app_id_mappings_dirty = FALSE;
1203
1204 necp_kernel_application_policies_condition_mask = 0;
1205 necp_kernel_socket_policies_condition_mask = 0;
1206 necp_kernel_ip_output_policies_condition_mask = 0;
1207
1208 necp_kernel_application_policies_count = 0;
1209 necp_kernel_socket_policies_count = 0;
1210 necp_kernel_socket_policies_non_app_count = 0;
1211 necp_kernel_ip_output_policies_count = 0;
1212 necp_kernel_ip_output_policies_non_id_count = 0;
1213
fe8ab488
A		 1214 necp_kernel_socket_policies_gencount = 1;
1215
1216 memset(&necp_kernel_socket_policies_map, 0, sizeof(necp_kernel_socket_policies_map));
1217 memset(&necp_kernel_ip_output_policies_map, 0, sizeof(necp_kernel_ip_output_policies_map));
1218 necp_kernel_socket_policies_app_layer_map = NULL;
1219
1220done:
1221 if (result != 0) {
1222 if (necp_kernel_policy_mtx_attr != NULL) {
1223 lck_attr_free(necp_kernel_policy_mtx_attr);
1224 necp_kernel_policy_mtx_attr = NULL;
1225 }
1226 if (necp_kernel_policy_mtx_grp != NULL) {
1227 lck_grp_free(necp_kernel_policy_mtx_grp);
1228 necp_kernel_policy_mtx_grp = NULL;
1229 }
1230 if (necp_kernel_policy_grp_attr != NULL) {
1231 lck_grp_attr_free(necp_kernel_policy_grp_attr);
1232 necp_kernel_policy_grp_attr = NULL;
1233 }
3e170ce0
A		 1234 if (necp_route_rule_mtx_attr != NULL) {
1235 lck_attr_free(necp_route_rule_mtx_attr);
1236 necp_route_rule_mtx_attr = NULL;
1237 }
1238 if (necp_route_rule_mtx_grp != NULL) {
1239 lck_grp_free(necp_route_rule_mtx_grp);
1240 necp_route_rule_mtx_grp = NULL;
1241 }
1242 if (necp_route_rule_grp_attr != NULL) {
1243 lck_grp_attr_free(necp_route_rule_grp_attr);
1244 necp_route_rule_grp_attr = NULL;
1245 }
fe8ab488
A		 1246 if (necp_kctlref != NULL) {
1247 ctl_deregister(necp_kctlref);
1248 necp_kctlref = NULL;
1249 }
1250 }
0a7de745 1251 return result;
fe8ab488
A		 1252}
1253
1254static errno_t
1255necp_register_control(void)
1256{
0a7de745
A		 1257 struct kern_ctl_reg kern_ctl;
1258 errno_t result = 0;
fe8ab488
A		 1259
1260 // Create a tag to allocate memory
1261 necp_malloc_tag = OSMalloc_Tagalloc(NECP_CONTROL_NAME, OSMT_DEFAULT);
1262
1263 // Find a unique value for our interface family
1264 result = mbuf_tag_id_find(NECP_CONTROL_NAME, &necp_family);
1265 if (result != 0) {
1266 NECPLOG(LOG_ERR, "mbuf_tag_id_find_internal failed: %d", result);
0a7de745 1267 return result;
fe8ab488
A		 1268 }
1269
1270 bzero(&kern_ctl, sizeof(kern_ctl));
1271 strlcpy(kern_ctl.ctl_name, NECP_CONTROL_NAME, sizeof(kern_ctl.ctl_name));
1272 kern_ctl.ctl_name[sizeof(kern_ctl.ctl_name) - 1] = 0;
1273 kern_ctl.ctl_flags = CTL_FLAG_PRIVILEGED; // Require root
1274 kern_ctl.ctl_sendsize = 64 * 1024;
1275 kern_ctl.ctl_recvsize = 64 * 1024;
1276 kern_ctl.ctl_connect = necp_ctl_connect;
1277 kern_ctl.ctl_disconnect = necp_ctl_disconnect;
1278 kern_ctl.ctl_send = necp_ctl_send;
1279 kern_ctl.ctl_rcvd = necp_ctl_rcvd;
1280 kern_ctl.ctl_setopt = necp_ctl_setopt;
1281 kern_ctl.ctl_getopt = necp_ctl_getopt;
1282
1283 result = ctl_register(&kern_ctl, &necp_kctlref);
1284 if (result != 0) {
1285 NECPLOG(LOG_ERR, "ctl_register failed: %d", result);
0a7de745 1286 return result;
fe8ab488
A		 1287 }
1288
0a7de745 1289 return 0;
fe8ab488
A		 1290}
1291
3e170ce0
A		 1292static void
1293necp_post_change_event(struct kev_necp_policies_changed_data *necp_event_data)
1294{
1295 struct kev_msg ev_msg;
1296 memset(&ev_msg, 0, sizeof(ev_msg));
1297
0a7de745
A		 1298 ev_msg.vendor_code = KEV_VENDOR_APPLE;
1299 ev_msg.kev_class = KEV_NETWORK_CLASS;
1300 ev_msg.kev_subclass = KEV_NECP_SUBCLASS;
1301 ev_msg.event_code = KEV_NECP_POLICIES_CHANGED;
3e170ce0 1302
0a7de745 1303 ev_msg.dv[0].data_ptr = necp_event_data;
3e170ce0
A		 1304 ev_msg.dv[0].data_length = sizeof(necp_event_data->changed_count);
1305 ev_msg.dv[1].data_length = 0;
1306
1307 kev_post_msg(&ev_msg);
1308}
1309
fe8ab488
A		 1310static errno_t
1311necp_ctl_connect(kern_ctl_ref kctlref, struct sockaddr_ctl *sac, void **unitinfo)
1312{
5ba3f43e
A		 1313#pragma unused(kctlref, sac)
1314 *unitinfo = necp_create_session();
fe8ab488
A		 1315 if (*unitinfo == NULL) {
1316 // Could not allocate session
0a7de745 1317 return ENOBUFS;
fe8ab488
A		 1318 }
1319
0a7de745 1320 return 0;
fe8ab488
A		 1321}
1322
1323static errno_t
1324necp_ctl_disconnect(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo)
1325{
1326#pragma unused(kctlref, unit)
1327 struct necp_session *session = (struct necp_session *)unitinfo;
1328 if (session != NULL) {
1329 necp_policy_mark_all_for_deletion(session);
1330 necp_policy_apply_all(session);
1331 necp_delete_session((struct necp_session *)unitinfo);
1332 }
1333
0a7de745 1334 return 0;
fe8ab488
A		 1335}
1336
1337
1338// Message handling
1339static int
1340necp_packet_find_tlv(mbuf_t packet, int offset, u_int8_t type, int *err, int next)
1341{
0a7de745
A		 1342 size_t cursor = offset;
1343 int error = 0;
1344 u_int32_t curr_length;
1345 u_int8_t curr_type;
fe8ab488
A		 1346
1347 *err = 0;
1348
1349 do {
1350 if (!next) {
1351 error = mbuf_copydata(packet, cursor, sizeof(curr_type), &curr_type);
1352 if (error) {
1353 *err = ENOENT;
0a7de745 1354 return -1;
fe8ab488
A		 1355 }
1356 } else {
1357 next = 0;
1358 curr_type = NECP_TLV_NIL;
1359 }
1360
1361 if (curr_type != type) {
1362 cursor += sizeof(curr_type);
1363 error = mbuf_copydata(packet, cursor, sizeof(curr_length), &curr_length);
1364 if (error) {
1365 *err = error;
0a7de745 1366 return -1;
fe8ab488
A		 1367 }
1368 cursor += (sizeof(curr_length) + curr_length);
1369 }
1370 } while (curr_type != type);
1371
0a7de745 1372 return cursor;
fe8ab488
A		 1373}
1374
1375static int
3e170ce0 1376necp_packet_get_tlv_at_offset(mbuf_t packet, int tlv_offset, u_int32_t buff_len, void *buff, u_int32_t *value_size)
fe8ab488 1377{
0a7de745
A		 1378 int error = 0;
1379 u_int32_t length;
fe8ab488
A		 1380
1381 if (tlv_offset < 0) {
0a7de745 1382 return EINVAL;
fe8ab488
A		 1383 }
1384
1385 error = mbuf_copydata(packet, tlv_offset + sizeof(u_int8_t), sizeof(length), &length);
1386 if (error) {
0a7de745 1387 return error;
fe8ab488
A		 1388 }
1389
4bd07ac2
A		 1390 u_int32_t total_len = m_length2(packet, NULL);
1391 if (total_len < (tlv_offset + sizeof(u_int8_t) + sizeof(length) + length)) {
1392 NECPLOG(LOG_ERR, "Got a bad TLV, length (%u) + offset (%d) < total length (%u)",
0a7de745
A		 1393 length, (tlv_offset + sizeof(u_int8_t) + sizeof(length)), total_len);
1394 return EINVAL;
4bd07ac2
A		 1395 }
1396
fe8ab488
A		 1397 if (value_size != NULL) {
1398 *value_size = length;
1399 }
1400
1401 if (buff != NULL && buff_len > 0) {
3e170ce0 1402 u_int32_t to_copy = (length < buff_len) ? length : buff_len;
fe8ab488
A		 1403 error = mbuf_copydata(packet, tlv_offset + sizeof(u_int8_t) + sizeof(length), to_copy, buff);
1404 if (error) {
0a7de745 1405 return error;
fe8ab488
A		 1406 }
1407 }
1408
0a7de745 1409 return 0;
fe8ab488
A		 1410}
1411
fe8ab488
A		 1412static u_int8_t *
1413necp_buffer_write_packet_header(u_int8_t *buffer, u_int8_t packet_type, u_int8_t flags, u_int32_t message_id)
1414{
1415 ((struct necp_packet_header *)(void *)buffer)->packet_type = packet_type;
1416 ((struct necp_packet_header *)(void *)buffer)->flags = flags;
1417 ((struct necp_packet_header *)(void *)buffer)->message_id = message_id;
0a7de745 1418 return buffer + sizeof(struct necp_packet_header);
fe8ab488
A		 1419}
1420
5ba3f43e
A		 1421static inline bool
1422necp_buffer_write_tlv_validate(u_int8_t *cursor, u_int8_t type, u_int32_t length,
0a7de745 1423 u_int8_t *buffer, u_int32_t buffer_length)
5ba3f43e
A		 1424{
1425 if (cursor < buffer || (uintptr_t)(cursor - buffer) > buffer_length) {
1426 NECPLOG0(LOG_ERR, "Cannot write TLV in buffer (invalid cursor)");
0a7de745 1427 return false;
5ba3f43e
A		 1428 }
1429 u_int8_t *next_tlv = (u_int8_t *)(cursor + sizeof(type) + sizeof(length) + length);
1430 if (next_tlv <= buffer || // make sure the next TLV start doesn't overflow
0a7de745 1431 (uintptr_t)(next_tlv - buffer) > buffer_length) { // make sure the next TLV has enough room in buffer
5ba3f43e 1432 NECPLOG(LOG_ERR, "Cannot write TLV in buffer (TLV length %u, buffer length %u)",
0a7de745
A		 1433 length, buffer_length);
1434 return false;
5ba3f43e 1435 }
0a7de745 1436 return true;
5ba3f43e 1437}
39037602
A		 1438
1439u_int8_t *
5ba3f43e 1440necp_buffer_write_tlv_if_different(u_int8_t *cursor, u_int8_t type,
0a7de745
A		 1441 u_int32_t length, const void *value, bool *updated,
1442 u_int8_t *buffer, u_int32_t buffer_length)
39037602 1443{
5ba3f43e 1444 if (!necp_buffer_write_tlv_validate(cursor, type, length, buffer, buffer_length)) {
0a7de745 1445 return NULL;
5ba3f43e
A		 1446 }
1447 u_int8_t *next_tlv = (u_int8_t *)(cursor + sizeof(type) + sizeof(length) + length);
1448 if (*updated || *(u_int8_t *)(cursor) != type) {
1449 *(u_int8_t *)(cursor) = type;
1450 *updated = TRUE;
1451 }
1452 if (*updated || *(u_int32_t *)(void *)(cursor + sizeof(type)) != length) {
1453 *(u_int32_t *)(void *)(cursor + sizeof(type)) = length;
1454 *updated = TRUE;
1455 }
1456 if (length > 0) {
1457 if (*updated || memcmp((u_int8_t *)(cursor + sizeof(type) + sizeof(length)), value, length) != 0) {
1458 memcpy((u_int8_t *)(cursor + sizeof(type) + sizeof(length)), value, length);
39037602
A		 1459 *updated = TRUE;
1460 }
39037602 1461 }
0a7de745 1462 return next_tlv;
39037602
A		 1463}
1464
1465u_int8_t *
5ba3f43e 1466necp_buffer_write_tlv(u_int8_t *cursor, u_int8_t type,
0a7de745
A		 1467 u_int32_t length, const void *value,
1468 u_int8_t *buffer, u_int32_t buffer_length)
fe8ab488 1469{
5ba3f43e 1470 if (!necp_buffer_write_tlv_validate(cursor, type, length, buffer, buffer_length)) {
0a7de745 1471 return NULL;
5ba3f43e
A		 1472 }
1473 u_int8_t *next_tlv = (u_int8_t *)(cursor + sizeof(type) + sizeof(length) + length);
1474 *(u_int8_t *)(cursor) = type;
1475 *(u_int32_t *)(void *)(cursor + sizeof(type)) = length;
fe8ab488 1476 if (length > 0) {
5ba3f43e 1477 memcpy((u_int8_t *)(cursor + sizeof(type) + sizeof(length)), value, length);
fe8ab488
A		 1478 }
1479
0a7de745 1480 return next_tlv;
fe8ab488
A		 1481}
1482
39037602 1483u_int8_t
fe8ab488
A		 1484necp_buffer_get_tlv_type(u_int8_t *buffer, int tlv_offset)
1485{
1486 u_int8_t *type = NULL;
1487
1488 if (buffer == NULL) {
0a7de745 1489 return 0;
fe8ab488
A		 1490 }
1491
1492 type = (u_int8_t *)((u_int8_t *)buffer + tlv_offset);
0a7de745 1493 return type ? *type : 0;
fe8ab488
A		 1494}
1495
39037602 1496u_int32_t
fe8ab488
A		 1497necp_buffer_get_tlv_length(u_int8_t *buffer, int tlv_offset)
1498{
3e170ce0 1499 u_int32_t *length = NULL;
fe8ab488
A		 1500
1501 if (buffer == NULL) {
0a7de745 1502 return 0;
fe8ab488
A		 1503 }
1504
3e170ce0 1505 length = (u_int32_t *)(void *)((u_int8_t *)buffer + tlv_offset + sizeof(u_int8_t));
0a7de745 1506 return length ? *length : 0;
fe8ab488
A		 1507}
1508
39037602 1509u_int8_t *
3e170ce0 1510necp_buffer_get_tlv_value(u_int8_t *buffer, int tlv_offset, u_int32_t *value_size)
fe8ab488
A		 1511{
1512 u_int8_t *value = NULL;
3e170ce0 1513 u_int32_t length = necp_buffer_get_tlv_length(buffer, tlv_offset);
fe8ab488 1514 if (length == 0) {
0a7de745 1515 return value;
fe8ab488
A		 1516 }
1517
1518 if (value_size) {
1519 *value_size = length;
1520 }
1521
3e170ce0 1522 value = (u_int8_t *)((u_int8_t *)buffer + tlv_offset + sizeof(u_int8_t) + sizeof(u_int32_t));
0a7de745 1523 return value;
fe8ab488
A		 1524}
1525
39037602 1526int
3e170ce0 1527necp_buffer_find_tlv(u_int8_t *buffer, u_int32_t buffer_length, int offset, u_int8_t type, int next)
fe8ab488 1528{
3e170ce0 1529 if (offset < 0) {
0a7de745 1530 return -1;
3e170ce0
A		 1531 }
1532 int cursor = offset;
1533 int next_cursor;
1534 u_int32_t curr_length;
fe8ab488
A		 1535 u_int8_t curr_type;
1536
3e170ce0
A		 1537 while (TRUE) {
1538 if ((((u_int32_t)cursor) + sizeof(curr_type) + sizeof(curr_length)) > buffer_length) {
0a7de745 1539 return -1;
fe8ab488
A		 1540 }
1541 if (!next) {
1542 curr_type = necp_buffer_get_tlv_type(buffer, cursor);
1543 } else {
1544 next = 0;
1545 curr_type = NECP_TLV_NIL;
1546 }
3e170ce0 1547 curr_length = necp_buffer_get_tlv_length(buffer, cursor);
813fb2f6 1548 if (curr_length > buffer_length - ((u_int32_t)cursor + sizeof(curr_type) + sizeof(curr_length))) {
0a7de745 1549 return -1;
813fb2f6
A		 1550 }
1551
3e170ce0
A		 1552 next_cursor = (cursor + sizeof(curr_type) + sizeof(curr_length) + curr_length);
1553 if (curr_type == type) {
1554 // check if entire TLV fits inside buffer
1555 if (((u_int32_t)next_cursor) <= buffer_length) {
0a7de745 1556 return cursor;
3e170ce0 1557 } else {
0a7de745 1558 return -1;
3e170ce0 1559 }
fe8ab488 1560 }
3e170ce0
A		 1561 cursor = next_cursor;
1562 }
fe8ab488
A		 1563}
1564
5ba3f43e
A		 1565static int
1566necp_find_tlv(mbuf_t packet, u_int8_t *buffer, u_int32_t buffer_length, int offset, u_int8_t type, int *err, int next)
1567{
1568 int cursor = -1;
1569 if (packet != NULL) {
1570 cursor = necp_packet_find_tlv(packet, offset, type, err, next);
1571 } else if (buffer != NULL) {
1572 cursor = necp_buffer_find_tlv(buffer, buffer_length, offset, type, next);
1573 }
0a7de745 1574 return cursor;
5ba3f43e
A		 1575}
1576
1577static int
1578necp_get_tlv_at_offset(mbuf_t packet, u_int8_t *buffer, u_int32_t buffer_length,
0a7de745 1579 int tlv_offset, u_int32_t out_buffer_length, void *out_buffer, u_int32_t *value_size)
5ba3f43e
A		 1580{
1581 if (packet != NULL) {
1582 // Handle mbuf parsing
1583 return necp_packet_get_tlv_at_offset(packet, tlv_offset, out_buffer_length, out_buffer, value_size);
1584 }
1585
1586 if (buffer == NULL) {
1587 NECPLOG0(LOG_ERR, "necp_get_tlv_at_offset buffer is NULL");
0a7de745 1588 return EINVAL;
5ba3f43e
A		 1589 }
1590
1591 // Handle buffer parsing
1592
1593 // Validate that buffer has enough room for any TLV
1594 if (tlv_offset + sizeof(u_int8_t) + sizeof(u_int32_t) > buffer_length) {
1595 NECPLOG(LOG_ERR, "necp_get_tlv_at_offset buffer_length is too small for TLV (%u < %u)",
0a7de745
A		 1596 buffer_length, tlv_offset + sizeof(u_int8_t) + sizeof(u_int32_t));
1597 return EINVAL;
5ba3f43e
A		 1598 }
1599
1600 // Validate that buffer has enough room for this TLV
1601 u_int32_t tlv_length = necp_buffer_get_tlv_length(buffer, tlv_offset);
1602 if (tlv_length > buffer_length - (tlv_offset + sizeof(u_int8_t) + sizeof(u_int32_t))) {
1603 NECPLOG(LOG_ERR, "necp_get_tlv_at_offset buffer_length is too small for TLV of length %u (%u < %u)",
0a7de745
A		 1604 tlv_length, buffer_length, tlv_offset + sizeof(u_int8_t) + sizeof(u_int32_t) + tlv_length);
1605 return EINVAL;
5ba3f43e
A		 1606 }
1607
1608 if (out_buffer != NULL && out_buffer_length > 0) {
1609 // Validate that out buffer is large enough for value
1610 if (out_buffer_length < tlv_length) {
1611 NECPLOG(LOG_ERR, "necp_get_tlv_at_offset out_buffer_length is too small for TLV value (%u < %u)",
0a7de745
A		 1612 out_buffer_length, tlv_length);
1613 return EINVAL;
5ba3f43e
A		 1614 }
1615
1616 // Get value pointer
1617 u_int8_t *tlv_value = necp_buffer_get_tlv_value(buffer, tlv_offset, NULL);
1618 if (tlv_value == NULL) {
1619 NECPLOG0(LOG_ERR, "necp_get_tlv_at_offset tlv_value is NULL");
0a7de745 1620 return ENOENT;
5ba3f43e
A		 1621 }
1622
1623 // Copy value
1624 memcpy(out_buffer, tlv_value, tlv_length);
1625 }
1626
1627 // Copy out length
1628 if (value_size != NULL) {
1629 *value_size = tlv_length;
1630 }
1631
0a7de745 1632 return 0;
5ba3f43e
A		 1633}
1634
1635static int
1636necp_get_tlv(mbuf_t packet, u_int8_t *buffer, u_int32_t buffer_length,
0a7de745 1637 int offset, u_int8_t type, u_int32_t buff_len, void *buff, u_int32_t *value_size)
5ba3f43e
A		 1638{
1639 int error = 0;
1640
1641 int tlv_offset = necp_find_tlv(packet, buffer, buffer_length, offset, type, &error, 0);
1642 if (tlv_offset < 0) {
0a7de745 1643 return error;
5ba3f43e
A		 1644 }
1645
0a7de745 1646 return necp_get_tlv_at_offset(packet, buffer, buffer_length, tlv_offset, buff_len, buff, value_size);
5ba3f43e
A		 1647}
1648
fe8ab488
A		 1649static bool
1650necp_send_ctl_data(struct necp_session *session, u_int8_t *buffer, size_t buffer_size)
1651{
0a7de745 1652 int error;
fe8ab488
A		 1653
1654 if (necp_kctlref == NULL || session == NULL || buffer == NULL || buffer_size == 0) {
0a7de745 1655 return FALSE;
fe8ab488
A		 1656 }
1657
1658 error = ctl_enqueuedata(necp_kctlref, session->control_unit, buffer, buffer_size, CTL_DATA_EOR);
1659
0a7de745 1660 return error == 0;
fe8ab488
A		 1661}
1662
1663static bool
1664necp_send_success_response(struct necp_session *session, u_int8_t packet_type, u_int32_t message_id)
1665{
1666 bool success = TRUE;
1667 u_int8_t *response = NULL;
1668 u_int8_t *cursor = NULL;
3e170ce0 1669 size_t response_size = sizeof(struct necp_packet_header) + sizeof(u_int8_t) + sizeof(u_int32_t);
fe8ab488
A		 1670 MALLOC(response, u_int8_t *, response_size, M_NECP, M_WAITOK);
1671 if (response == NULL) {
0a7de745 1672 return FALSE;
fe8ab488
A		 1673 }
1674 cursor = response;
1675 cursor = necp_buffer_write_packet_header(cursor, packet_type, NECP_PACKET_FLAGS_RESPONSE, message_id);
5ba3f43e 1676 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_NIL, 0, NULL, response, response_size);
fe8ab488
A		 1677
1678 if (!(success = necp_send_ctl_data(session, (u_int8_t *)response, response_size))) {
1679 NECPLOG0(LOG_ERR, "Failed to send response");
1680 }
1681
1682 FREE(response, M_NECP);
0a7de745 1683 return success;
fe8ab488
A		 1684}
1685
1686static bool
1687necp_send_error_response(struct necp_session *session, u_int8_t packet_type, u_int32_t message_id, u_int32_t error)
1688{
1689 bool success = TRUE;
1690 u_int8_t *response = NULL;
1691 u_int8_t *cursor = NULL;
3e170ce0 1692 size_t response_size = sizeof(struct necp_packet_header) + sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(u_int32_t);
fe8ab488
A		 1693 MALLOC(response, u_int8_t *, response_size, M_NECP, M_WAITOK);
1694 if (response == NULL) {
0a7de745 1695 return FALSE;
fe8ab488
A		 1696 }
1697 cursor = response;
1698 cursor = necp_buffer_write_packet_header(cursor, packet_type, NECP_PACKET_FLAGS_RESPONSE, message_id);
5ba3f43e 1699 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ERROR, sizeof(error), &error, response, response_size);
fe8ab488
A		 1700
1701 if (!(success = necp_send_ctl_data(session, (u_int8_t *)response, response_size))) {
1702 NECPLOG0(LOG_ERR, "Failed to send response");
1703 }
1704
1705 FREE(response, M_NECP);
0a7de745 1706 return success;
fe8ab488
A		 1707}
1708
1709static bool
1710necp_send_policy_id_response(struct necp_session *session, u_int8_t packet_type, u_int32_t message_id, necp_policy_id policy_id)
1711{
1712 bool success = TRUE;
1713 u_int8_t *response = NULL;
1714 u_int8_t *cursor = NULL;
3e170ce0 1715 size_t response_size = sizeof(struct necp_packet_header) + sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(u_int32_t);
fe8ab488
A		 1716 MALLOC(response, u_int8_t *, response_size, M_NECP, M_WAITOK);
1717 if (response == NULL) {
0a7de745 1718 return FALSE;
fe8ab488
A		 1719 }
1720 cursor = response;
1721 cursor = necp_buffer_write_packet_header(cursor, packet_type, NECP_PACKET_FLAGS_RESPONSE, message_id);
5ba3f43e 1722 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_ID, sizeof(policy_id), &policy_id, response, response_size);
fe8ab488
A		 1723
1724 if (!(success = necp_send_ctl_data(session, (u_int8_t *)response, response_size))) {
1725 NECPLOG0(LOG_ERR, "Failed to send response");
1726 }
1727
1728 FREE(response, M_NECP);
0a7de745 1729 return success;
fe8ab488
A		 1730}
1731
1732static errno_t
1733necp_ctl_send(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo, mbuf_t packet, int flags)
1734{
1735#pragma unused(kctlref, unit, flags)
1736 struct necp_session *session = (struct necp_session *)unitinfo;
1737 struct necp_packet_header header;
1738 int error = 0;
1739
1740 if (session == NULL) {
1741 NECPLOG0(LOG_ERR, "Got a NULL session");
1742 error = EINVAL;
1743 goto done;
1744 }
1745
1746 if (mbuf_pkthdr_len(packet) < sizeof(header)) {
1747 NECPLOG(LOG_ERR, "Got a bad packet, length (%lu) < sizeof header (%lu)", mbuf_pkthdr_len(packet), sizeof(header));
1748 error = EINVAL;
1749 goto done;
1750 }
1751
1752 error = mbuf_copydata(packet, 0, sizeof(header), &header);
1753 if (error) {
1754 NECPLOG(LOG_ERR, "mbuf_copydata failed for the header: %d", error);
1755 error = ENOBUFS;
1756 goto done;
1757 }
1758
1759 if (session->proc_locked) {
1760 // Verify that the calling process is allowed to send messages
1761 uuid_t proc_uuid;
1762 proc_getexecutableuuid(current_proc(), proc_uuid, sizeof(proc_uuid));
1763 if (uuid_compare(proc_uuid, session->proc_uuid) != 0) {
1764 necp_send_error_response(session, header.packet_type, header.message_id, NECP_ERROR_INVALID_PROCESS);
1765 goto done;
1766 }
3e170ce0
A		 1767 } else {
1768 // If not locked, update the proc_uuid and proc_pid of the session
1769 proc_getexecutableuuid(current_proc(), session->proc_uuid, sizeof(session->proc_uuid));
1770 session->proc_pid = proc_pid(current_proc());
fe8ab488
A		 1771 }
1772
1773 switch (header.packet_type) {
0a7de745
A		 1774 case NECP_PACKET_TYPE_POLICY_ADD: {
1775 necp_handle_policy_add(session, header.message_id, packet, NULL, 0, sizeof(header), NULL);
1776 break;
1777 }
1778 case NECP_PACKET_TYPE_POLICY_GET: {
1779 necp_handle_policy_get(session, header.message_id, packet, sizeof(header));
1780 break;
1781 }
1782 case NECP_PACKET_TYPE_POLICY_DELETE: {
1783 necp_handle_policy_delete(session, header.message_id, packet, sizeof(header));
1784 break;
1785 }
1786 case NECP_PACKET_TYPE_POLICY_APPLY_ALL: {
1787 necp_handle_policy_apply_all(session, header.message_id, packet, sizeof(header));
1788 break;
1789 }
1790 case NECP_PACKET_TYPE_POLICY_LIST_ALL: {
1791 necp_handle_policy_list_all(session, header.message_id, packet, sizeof(header));
1792 break;
1793 }
1794 case NECP_PACKET_TYPE_POLICY_DELETE_ALL: {
1795 necp_handle_policy_delete_all(session, header.message_id, packet, sizeof(header));
1796 break;
1797 }
1798 case NECP_PACKET_TYPE_POLICY_DUMP_ALL: {
1799 necp_handle_policy_dump_all(session, header.message_id, packet, 0, 0, sizeof(header));
1800 break;
1801 }
1802 case NECP_PACKET_TYPE_SET_SESSION_PRIORITY: {
1803 necp_handle_set_session_priority(session, header.message_id, packet, sizeof(header));
1804 break;
1805 }
1806 case NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC: {
1807 necp_handle_lock_session_to_proc(session, header.message_id, packet, sizeof(header));
1808 break;
1809 }
1810 case NECP_PACKET_TYPE_REGISTER_SERVICE: {
1811 necp_handle_register_service(session, header.message_id, packet, sizeof(header));
1812 break;
1813 }
1814 case NECP_PACKET_TYPE_UNREGISTER_SERVICE: {
1815 necp_handle_unregister_service(session, header.message_id, packet, sizeof(header));
1816 break;
1817 }
1818 default: {
1819 NECPLOG(LOG_ERR, "Received unknown message type %d", header.packet_type);
1820 necp_send_error_response(session, header.packet_type, header.message_id, NECP_ERROR_UNKNOWN_PACKET_TYPE);
1821 break;
1822 }
fe8ab488
A		 1823 }
1824
1825done:
1826 mbuf_freem(packet);
0a7de745 1827 return error;
fe8ab488
A		 1828}
1829
1830static void
1831necp_ctl_rcvd(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo, int flags)
1832{
1833#pragma unused(kctlref, unit, unitinfo, flags)
1834 return;
1835}
1836
1837static errno_t
1838necp_ctl_getopt(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo, int opt, void *data, size_t *len)
1839{
1840#pragma unused(kctlref, unit, unitinfo, opt, data, len)
0a7de745 1841 return 0;
fe8ab488
A		 1842}
1843
1844static errno_t
1845necp_ctl_setopt(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo, int opt, void *data, size_t len)
1846{
1847#pragma unused(kctlref, unit, unitinfo, opt, data, len)
0a7de745 1848 return 0;
fe8ab488
A		 1849}
1850
1851// Session Management
5ba3f43e 1852
fe8ab488 1853static struct necp_session *
5ba3f43e 1854necp_create_session(void)
fe8ab488
A		 1855{
1856 struct necp_session *new_session = NULL;
1857
5ba3f43e 1858 MALLOC(new_session, struct necp_session *, sizeof(*new_session), M_NECP, M_WAITOK | M_ZERO);
fe8ab488
A		 1859 if (new_session == NULL) {
1860 goto done;
1861 }
5ba3f43e
A		 1862
1863 new_session->necp_fd_type = necp_fd_type_session;
fe8ab488 1864 new_session->session_priority = NECP_SESSION_PRIORITY_UNKNOWN;
fe8ab488
A		 1865 new_session->dirty = FALSE;
1866 LIST_INIT(&new_session->policies);
5ba3f43e 1867 lck_mtx_init(&new_session->lock, necp_kernel_policy_mtx_grp, necp_kernel_policy_mtx_attr);
fe8ab488 1868
5ba3f43e 1869 // Take the lock
3e170ce0 1870 lck_rw_lock_exclusive(&necp_kernel_policy_lock);
5ba3f43e
A		 1871
1872 // Find the next available control unit
1873 u_int32_t control_unit = 1;
1874 struct necp_session *next_session = NULL;
1875 TAILQ_FOREACH(next_session, &necp_session_list, chain) {
1876 if (next_session->control_unit > control_unit) {
1877 // Found a gap, grab this control unit
1878 break;
1879 }
1880
1881 // Try the next control unit, loop around
1882 control_unit = next_session->control_unit + 1;
1883 }
1884
1885 new_session->control_unit = control_unit;
1886 new_session->session_order = necp_allocate_new_session_order(new_session->session_priority, control_unit);
1887
1888 if (next_session != NULL) {
1889 TAILQ_INSERT_BEFORE(next_session, new_session, chain);
1890 } else {
1891 TAILQ_INSERT_TAIL(&necp_session_list, new_session, chain);
1892 }
1893
3e170ce0
A		 1894 necp_session_count++;
1895 lck_rw_done(&necp_kernel_policy_lock);
1896
5ba3f43e
A		 1897 if (necp_debug) {
1898 NECPLOG(LOG_DEBUG, "Created NECP session, control unit %d", control_unit);
1899 }
1900
fe8ab488 1901done:
0a7de745 1902 return new_session;
fe8ab488
A		 1903}
1904
1905static void
1906necp_delete_session(struct necp_session *session)
1907{
1908 if (session != NULL) {
1909 struct necp_service_registration *service = NULL;
1910 struct necp_service_registration *temp_service = NULL;
1911 LIST_FOREACH_SAFE(service, &session->services, session_chain, temp_service) {
1912 LIST_REMOVE(service, session_chain);
1913 lck_rw_lock_exclusive(&necp_kernel_policy_lock);
1914 LIST_REMOVE(service, kernel_chain);
1915 lck_rw_done(&necp_kernel_policy_lock);
1916 FREE(service, M_NECP);
1917 }
1918 if (necp_debug) {
1919 NECPLOG0(LOG_DEBUG, "Deleted NECP session");
1920 }
3e170ce0
A		 1921
1922 lck_rw_lock_exclusive(&necp_kernel_policy_lock);
5ba3f43e 1923 TAILQ_REMOVE(&necp_session_list, session, chain);
3e170ce0
A		 1924 necp_session_count--;
1925 lck_rw_done(&necp_kernel_policy_lock);
5ba3f43e
A		 1926
1927 lck_mtx_destroy(&session->lock, necp_kernel_policy_mtx_grp);
1928 FREE(session, M_NECP);
fe8ab488
A		 1929 }
1930}
1931
1932// Session Policy Management
39037602 1933
fe8ab488 1934static inline u_int8_t
3e170ce0 1935necp_policy_result_get_type_from_buffer(u_int8_t *buffer, u_int32_t length)
fe8ab488 1936{
0a7de745 1937 return (buffer && length >= sizeof(u_int8_t)) ? buffer[0] : 0;
fe8ab488
A		 1938}
1939
3e170ce0
A		 1940static inline u_int32_t
1941necp_policy_result_get_parameter_length_from_buffer(u_int8_t *buffer, u_int32_t length)
fe8ab488 1942{
0a7de745 1943 return (buffer && length > sizeof(u_int8_t)) ? (length - sizeof(u_int8_t)) : 0;
fe8ab488
A		 1944}
1945
1946static inline u_int8_t *
3e170ce0 1947necp_policy_result_get_parameter_pointer_from_buffer(u_int8_t *buffer, u_int32_t length)
fe8ab488 1948{
0a7de745 1949 return (buffer && length > sizeof(u_int8_t)) ? (buffer + sizeof(u_int8_t)) : NULL;
fe8ab488
A		 1950}
1951
1952static bool
3e170ce0
A		 1953necp_policy_result_requires_route_rules(u_int8_t *buffer, u_int32_t length)
1954{
1955 u_int8_t type = necp_policy_result_get_type_from_buffer(buffer, length);
1956 if (type == NECP_POLICY_RESULT_ROUTE_RULES) {
0a7de745 1957 return TRUE;
3e170ce0 1958 }
0a7de745 1959 return FALSE;
3e170ce0
A		 1960}
1961
39037602
A		 1962static inline bool
1963necp_address_is_valid(struct sockaddr *address)
1964{
1965 if (address->sa_family == AF_INET) {
0a7de745 1966 return address->sa_len == sizeof(struct sockaddr_in);
39037602 1967 } else if (address->sa_family == AF_INET6) {
0a7de745 1968 return address->sa_len == sizeof(struct sockaddr_in6);
39037602 1969 } else {
0a7de745 1970 return FALSE;
39037602
A		 1971 }
1972}
1973
3e170ce0
A		 1974static bool
1975necp_policy_result_is_valid(u_int8_t *buffer, u_int32_t length)
fe8ab488
A		 1976{
1977 bool validated = FALSE;
1978 u_int8_t type = necp_policy_result_get_type_from_buffer(buffer, length);
3e170ce0 1979 u_int32_t parameter_length = necp_policy_result_get_parameter_length_from_buffer(buffer, length);
fe8ab488 1980 switch (type) {
0a7de745
A		 1981 case NECP_POLICY_RESULT_PASS:
1982 case NECP_POLICY_RESULT_DROP:
1983 case NECP_POLICY_RESULT_ROUTE_RULES:
1984 case NECP_POLICY_RESULT_SCOPED_DIRECT: {
1985 validated = TRUE;
1986 break;
1987 }
1988 case NECP_POLICY_RESULT_SKIP:
1989 case NECP_POLICY_RESULT_SOCKET_DIVERT:
1990 case NECP_POLICY_RESULT_SOCKET_FILTER: {
1991 if (parameter_length >= sizeof(u_int32_t)) {
fe8ab488 1992 validated = TRUE;
fe8ab488 1993 }
0a7de745
A		 1994 break;
1995 }
1996 case NECP_POLICY_RESULT_IP_TUNNEL: {
1997 if (parameter_length > sizeof(u_int32_t)) {
1998 validated = TRUE;
fe8ab488 1999 }
0a7de745
A		 2000 break;
2001 }
2002 case NECP_POLICY_RESULT_SOCKET_SCOPED: {
2003 if (parameter_length > 0) {
2004 validated = TRUE;
fe8ab488 2005 }
0a7de745
A		 2006 break;
2007 }
2008 case NECP_POLICY_RESULT_TRIGGER:
2009 case NECP_POLICY_RESULT_TRIGGER_IF_NEEDED:
2010 case NECP_POLICY_RESULT_TRIGGER_SCOPED:
2011 case NECP_POLICY_RESULT_NO_TRIGGER_SCOPED:
2012 case NECP_POLICY_RESULT_USE_NETAGENT:
2013 case NECP_POLICY_RESULT_NETAGENT_SCOPED:{
2014 if (parameter_length >= sizeof(uuid_t)) {
2015 validated = TRUE;
fe8ab488 2016 }
0a7de745
A		 2017 break;
2018 }
2019 default: {
2020 validated = FALSE;
2021 break;
2022 }
fe8ab488
A		 2023 }
2024
2025 if (necp_debug) {
2026 NECPLOG(LOG_DEBUG, "Policy result type %d, valid %d", type, validated);
2027 }
2028
0a7de745 2029 return validated;
fe8ab488
A		 2030}
2031
2032static inline u_int8_t
3e170ce0 2033necp_policy_condition_get_type_from_buffer(u_int8_t *buffer, u_int32_t length)
fe8ab488 2034{
0a7de745 2035 return (buffer && length >= sizeof(u_int8_t)) ? buffer[0] : 0;
fe8ab488
A		 2036}
2037
2038static inline u_int8_t
3e170ce0 2039necp_policy_condition_get_flags_from_buffer(u_int8_t *buffer, u_int32_t length)
fe8ab488 2040{
0a7de745 2041 return (buffer && length >= (2 * sizeof(u_int8_t))) ? buffer[1] : 0;
fe8ab488
A		 2042}
2043
3e170ce0
A		 2044static inline u_int32_t
2045necp_policy_condition_get_value_length_from_buffer(u_int8_t *buffer, u_int32_t length)
fe8ab488 2046{
0a7de745 2047 return (buffer && length >= (2 * sizeof(u_int8_t))) ? (length - (2 * sizeof(u_int8_t))) : 0;
fe8ab488
A		 2048}
2049
2050static inline u_int8_t *
3e170ce0 2051necp_policy_condition_get_value_pointer_from_buffer(u_int8_t *buffer, u_int32_t length)
fe8ab488 2052{
0a7de745 2053 return (buffer && length > (2 * sizeof(u_int8_t))) ? (buffer + (2 * sizeof(u_int8_t))) : NULL;
fe8ab488
A		 2054}
2055
2056static inline bool
3e170ce0 2057necp_policy_condition_is_default(u_int8_t *buffer, u_int32_t length)
fe8ab488 2058{
0a7de745 2059 return necp_policy_condition_get_type_from_buffer(buffer, length) == NECP_POLICY_CONDITION_DEFAULT;
fe8ab488
A		 2060}
2061
2062static inline bool
3e170ce0 2063necp_policy_condition_is_application(u_int8_t *buffer, u_int32_t length)
fe8ab488 2064{
0a7de745 2065 return necp_policy_condition_get_type_from_buffer(buffer, length) == NECP_POLICY_CONDITION_APPLICATION;
fe8ab488
A		 2066}
2067
813fb2f6
A		 2068static inline bool
2069necp_policy_condition_is_real_application(u_int8_t *buffer, u_int32_t length)
2070{
0a7de745 2071 return necp_policy_condition_get_type_from_buffer(buffer, length) == NECP_POLICY_CONDITION_REAL_APPLICATION;
813fb2f6
A		 2072}
2073
fe8ab488 2074static inline bool
3e170ce0 2075necp_policy_condition_requires_application(u_int8_t *buffer, u_int32_t length)
fe8ab488
A		 2076{
2077 u_int8_t type = necp_policy_condition_get_type_from_buffer(buffer, length);
0a7de745 2078 return type == NECP_POLICY_CONDITION_REAL_APPLICATION;
fe8ab488
A		 2079}
2080
813fb2f6
A		 2081static inline bool
2082necp_policy_condition_requires_real_application(u_int8_t *buffer, u_int32_t length)
2083{
2084 u_int8_t type = necp_policy_condition_get_type_from_buffer(buffer, length);
0a7de745 2085 return type == NECP_POLICY_CONDITION_ENTITLEMENT;
813fb2f6
A		 2086}
2087
fe8ab488 2088static bool
3e170ce0 2089necp_policy_condition_is_valid(u_int8_t *buffer, u_int32_t length, u_int8_t policy_result_type)
fe8ab488
A		 2090{
2091 bool validated = FALSE;
2092 bool result_cannot_have_ip_layer = (policy_result_type == NECP_POLICY_RESULT_SOCKET_DIVERT ||
0a7de745
A		 2093 policy_result_type == NECP_POLICY_RESULT_SOCKET_FILTER ||
2094 policy_result_type == NECP_POLICY_RESULT_TRIGGER ||
2095 policy_result_type == NECP_POLICY_RESULT_TRIGGER_IF_NEEDED ||
2096 policy_result_type == NECP_POLICY_RESULT_TRIGGER_SCOPED ||
2097 policy_result_type == NECP_POLICY_RESULT_NO_TRIGGER_SCOPED ||
2098 policy_result_type == NECP_POLICY_RESULT_SOCKET_SCOPED ||
2099 policy_result_type == NECP_POLICY_RESULT_ROUTE_RULES ||
2100 policy_result_type == NECP_POLICY_RESULT_USE_NETAGENT ||
2101 policy_result_type == NECP_POLICY_RESULT_NETAGENT_SCOPED ||
2102 policy_result_type == NECP_POLICY_RESULT_SCOPED_DIRECT) ? TRUE : FALSE;
3e170ce0 2103 u_int32_t condition_length = necp_policy_condition_get_value_length_from_buffer(buffer, length);
fe8ab488
A		 2104 u_int8_t *condition_value = necp_policy_condition_get_value_pointer_from_buffer(buffer, length);
2105 u_int8_t type = necp_policy_condition_get_type_from_buffer(buffer, length);
2106 u_int8_t flags = necp_policy_condition_get_flags_from_buffer(buffer, length);
2107 switch (type) {
0a7de745
A		 2108 case NECP_POLICY_CONDITION_APPLICATION:
2109 case NECP_POLICY_CONDITION_REAL_APPLICATION: {
2110 if (!(flags & NECP_POLICY_CONDITION_FLAGS_NEGATIVE) &&
2111 condition_length >= sizeof(uuid_t) &&
2112 condition_value != NULL &&
2113 !uuid_is_null(condition_value)) {
2114 validated = TRUE;
fe8ab488 2115 }
0a7de745
A		 2116 break;
2117 }
2118 case NECP_POLICY_CONDITION_DOMAIN:
2119 case NECP_POLICY_CONDITION_ACCOUNT:
2120 case NECP_POLICY_CONDITION_BOUND_INTERFACE: {
2121 if (condition_length > 0) {
2122 validated = TRUE;
fe8ab488 2123 }
0a7de745
A		 2124 break;
2125 }
2126 case NECP_POLICY_CONDITION_TRAFFIC_CLASS: {
2127 if (condition_length >= sizeof(struct necp_policy_condition_tc_range)) {
2128 validated = TRUE;
fe8ab488 2129 }
0a7de745
A		 2130 break;
2131 }
2132 case NECP_POLICY_CONDITION_DEFAULT:
2133 case NECP_POLICY_CONDITION_ALL_INTERFACES:
2134 case NECP_POLICY_CONDITION_ENTITLEMENT: {
2135 if (!(flags & NECP_POLICY_CONDITION_FLAGS_NEGATIVE)) {
2136 validated = TRUE;
fe8ab488 2137 }
0a7de745
A		 2138 break;
2139 }
2140 case NECP_POLICY_CONDITION_IP_PROTOCOL: {
2141 if (condition_length >= sizeof(u_int16_t)) {
2142 validated = TRUE;
fe8ab488 2143 }
0a7de745
A		 2144 break;
2145 }
2146 case NECP_POLICY_CONDITION_PID: {
2147 if (condition_length >= sizeof(pid_t) &&
2148 condition_value != NULL &&
2149 *((pid_t *)(void *)condition_value) != 0) {
2150 validated = TRUE;
fe8ab488 2151 }
0a7de745
A		 2152 break;
2153 }
2154 case NECP_POLICY_CONDITION_UID: {
2155 if (condition_length >= sizeof(uid_t)) {
2156 validated = TRUE;
fe8ab488 2157 }
0a7de745
A		 2158 break;
2159 }
2160 case NECP_POLICY_CONDITION_LOCAL_ADDR:
2161 case NECP_POLICY_CONDITION_REMOTE_ADDR: {
2162 if (!result_cannot_have_ip_layer && condition_length >= sizeof(struct necp_policy_condition_addr) &&
2163 necp_address_is_valid(&((struct necp_policy_condition_addr *)(void *)condition_value)->address.sa)) {
2164 validated = TRUE;
fe8ab488 2165 }
0a7de745
A		 2166 break;
2167 }
2168 case NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE:
2169 case NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE: {
2170 if (!result_cannot_have_ip_layer && condition_length >= sizeof(struct necp_policy_condition_addr_range) &&
2171 necp_address_is_valid(&((struct necp_policy_condition_addr_range *)(void *)condition_value)->start_address.sa) &&
2172 necp_address_is_valid(&((struct necp_policy_condition_addr_range *)(void *)condition_value)->end_address.sa)) {
2173 validated = TRUE;
d9a64523 2174 }
0a7de745
A		 2175 break;
2176 }
2177 case NECP_POLICY_CONDITION_AGENT_TYPE: {
2178 if (!(flags & NECP_POLICY_CONDITION_FLAGS_NEGATIVE) &&
2179 condition_length >= sizeof(struct necp_policy_condition_agent_type)) {
2180 validated = TRUE;
fe8ab488 2181 }
0a7de745
A		 2182 break;
2183 }
2184 default: {
2185 validated = FALSE;
2186 break;
2187 }
fe8ab488
A		 2188 }
2189
2190 if (necp_debug) {
2191 NECPLOG(LOG_DEBUG, "Policy condition type %d, valid %d", type, validated);
2192 }
2193
0a7de745 2194 return validated;
fe8ab488
A		 2195}
2196
3e170ce0
A		 2197static bool
2198necp_policy_route_rule_is_default(u_int8_t *buffer, u_int32_t length)
2199{
0a7de745
A		 2200 return necp_policy_condition_get_value_length_from_buffer(buffer, length) == 0 &&
2201 necp_policy_condition_get_flags_from_buffer(buffer, length) == 0;
3e170ce0
A		 2202}
2203
2204static bool
2205necp_policy_route_rule_is_valid(u_int8_t *buffer, u_int32_t length)
2206{
2207 bool validated = FALSE;
2208 u_int8_t type = necp_policy_condition_get_type_from_buffer(buffer, length);
2209 switch (type) {
0a7de745
A		 2210 case NECP_ROUTE_RULE_ALLOW_INTERFACE: {
2211 validated = TRUE;
2212 break;
2213 }
2214 case NECP_ROUTE_RULE_DENY_INTERFACE: {
2215 validated = TRUE;
2216 break;
2217 }
2218 case NECP_ROUTE_RULE_QOS_MARKING: {
2219 validated = TRUE;
2220 break;
2221 }
2222 case NECP_ROUTE_RULE_DENY_LQM_ABORT: {
2223 validated = TRUE;
2224 break;
2225 }
2226 default: {
2227 validated = FALSE;
2228 break;
2229 }
3e170ce0
A		 2230 }
2231
2232 if (necp_debug) {
2233 NECPLOG(LOG_DEBUG, "Policy route rule type %d, valid %d", type, validated);
2234 }
2235
0a7de745 2236 return validated;
3e170ce0
A		 2237}
2238
5ba3f43e
A		 2239static int
2240necp_get_posix_error_for_necp_error(int response_error)
2241{
2242 switch (response_error) {
0a7de745
A		 2243 case NECP_ERROR_UNKNOWN_PACKET_TYPE:
2244 case NECP_ERROR_INVALID_TLV:
2245 case NECP_ERROR_POLICY_RESULT_INVALID:
2246 case NECP_ERROR_POLICY_CONDITIONS_INVALID:
2247 case NECP_ERROR_ROUTE_RULES_INVALID: {
2248 return EINVAL;
2249 }
2250 case NECP_ERROR_POLICY_ID_NOT_FOUND: {
2251 return ENOENT;
2252 }
2253 case NECP_ERROR_INVALID_PROCESS: {
2254 return EPERM;
2255 }
2256 case NECP_ERROR_INTERNAL:
2257 default: {
2258 return ENOMEM;
2259 }
5ba3f43e
A		 2260 }
2261}
2262
fe8ab488
A		 2263static void
2264necp_handle_set_session_priority(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset)
2265{
2266 int error;
2267 struct necp_session_policy *policy = NULL;
2268 struct necp_session_policy *temp_policy = NULL;
2269 u_int32_t response_error = NECP_ERROR_INTERNAL;
2270 u_int32_t requested_session_priority = NECP_SESSION_PRIORITY_UNKNOWN;
2271
2272 // Read policy id
5ba3f43e 2273 error = necp_get_tlv(packet, NULL, 0, offset, NECP_TLV_SESSION_PRIORITY, sizeof(requested_session_priority), &requested_session_priority, NULL);
fe8ab488
A		 2274 if (error) {
2275 NECPLOG(LOG_ERR, "Failed to get session priority: %d", error);
2276 response_error = NECP_ERROR_INVALID_TLV;
2277 goto fail;
2278 }
2279
2280 if (session == NULL) {
2281 NECPLOG0(LOG_ERR, "Failed to find session");
2282 response_error = NECP_ERROR_INTERNAL;
2283 goto fail;
2284 }
2285
2286 // Enforce special session priorities with entitlements
2287 if (requested_session_priority == NECP_SESSION_PRIORITY_CONTROL ||
0a7de745 2288 requested_session_priority == NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL) {
fe8ab488
A		 2289 errno_t cred_result = priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NECP_POLICIES, 0);
2290 if (cred_result != 0) {
2291 NECPLOG(LOG_ERR, "Session does not hold necessary entitlement to claim priority level %d", requested_session_priority);
2292 goto fail;
2293 }
2294 }
2295
2296 if (session->session_priority != requested_session_priority) {
2297 session->session_priority = requested_session_priority;
2298 session->session_order = necp_allocate_new_session_order(session->session_priority, session->control_unit);
2299 session->dirty = TRUE;
2300
2301 // Mark all policies as needing updates
2302 LIST_FOREACH_SAFE(policy, &session->policies, chain, temp_policy) {
2303 policy->pending_update = TRUE;
2304 }
2305 }
2306
2307 necp_send_success_response(session, NECP_PACKET_TYPE_SET_SESSION_PRIORITY, message_id);
2308 return;
2309
2310fail:
2311 necp_send_error_response(session, NECP_PACKET_TYPE_SET_SESSION_PRIORITY, message_id, response_error);
2312}
2313
2314static void
2315necp_handle_lock_session_to_proc(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset)
2316{
2317#pragma unused(packet, offset)
3e170ce0 2318 // proc_uuid already filled out
fe8ab488
A		 2319 session->proc_locked = TRUE;
2320 necp_send_success_response(session, NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC, message_id);
2321}
2322
2323static void
2324necp_handle_register_service(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset)
2325{
2326 int error;
2327 struct necp_service_registration *new_service = NULL;
2328 u_int32_t response_error = NECP_ERROR_INTERNAL;
2329 uuid_t service_uuid;
2330 uuid_clear(service_uuid);
2331
2332 if (session == NULL) {
2333 NECPLOG0(LOG_ERR, "Failed to find session");
2334 response_error = NECP_ERROR_INTERNAL;
2335 goto fail;
2336 }
2337
2338 // Enforce entitlements
2339 errno_t cred_result = priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NECP_POLICIES, 0);
2340 if (cred_result != 0) {
2341 NECPLOG0(LOG_ERR, "Session does not hold necessary entitlement to register service");
2342 goto fail;
2343 }
2344
2345 // Read service uuid
5ba3f43e 2346 error = necp_get_tlv(packet, NULL, 0, offset, NECP_TLV_SERVICE_UUID, sizeof(uuid_t), service_uuid, NULL);
fe8ab488
A		 2347 if (error) {
2348 NECPLOG(LOG_ERR, "Failed to get service UUID: %d", error);
2349 response_error = NECP_ERROR_INVALID_TLV;
2350 goto fail;
2351 }
2352
2353 MALLOC(new_service, struct necp_service_registration *, sizeof(*new_service), M_NECP, M_WAITOK);
2354 if (new_service == NULL) {
2355 NECPLOG0(LOG_ERR, "Failed to allocate service registration");
2356 response_error = NECP_ERROR_INTERNAL;
2357 goto fail;
2358 }
39037602 2359
fe8ab488
A		 2360 lck_rw_lock_exclusive(&necp_kernel_policy_lock);
2361 memset(new_service, 0, sizeof(*new_service));
2362 new_service->service_id = necp_create_uuid_service_id_mapping(service_uuid);
2363 LIST_INSERT_HEAD(&session->services, new_service, session_chain);
2364 LIST_INSERT_HEAD(&necp_registered_service_list, new_service, kernel_chain);
2365 lck_rw_done(&necp_kernel_policy_lock);
2366
2367 necp_send_success_response(session, NECP_PACKET_TYPE_REGISTER_SERVICE, message_id);
2368 return;
2369fail:
2370 necp_send_error_response(session, NECP_PACKET_TYPE_REGISTER_SERVICE, message_id, response_error);
2371}
2372
2373static void
2374necp_handle_unregister_service(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset)
2375{
2376 int error;
2377 struct necp_service_registration *service = NULL;
2378 struct necp_service_registration *temp_service = NULL;
2379 u_int32_t response_error = NECP_ERROR_INTERNAL;
2380 struct necp_uuid_id_mapping *mapping = NULL;
2381 uuid_t service_uuid;
2382 uuid_clear(service_uuid);
2383
2384 if (session == NULL) {
2385 NECPLOG0(LOG_ERR, "Failed to find session");
2386 response_error = NECP_ERROR_INTERNAL;
2387 goto fail;
2388 }
2389
2390 // Read service uuid
5ba3f43e 2391 error = necp_get_tlv(packet, NULL, 0, offset, NECP_TLV_SERVICE_UUID, sizeof(uuid_t), service_uuid, NULL);
fe8ab488
A		 2392 if (error) {
2393 NECPLOG(LOG_ERR, "Failed to get service UUID: %d", error);
2394 response_error = NECP_ERROR_INVALID_TLV;
2395 goto fail;
2396 }
2397
2398 // Mark remove all matching services for this session
2399 lck_rw_lock_exclusive(&necp_kernel_policy_lock);
2400 mapping = necp_uuid_lookup_service_id_locked(service_uuid);
2401 if (mapping != NULL) {
2402 LIST_FOREACH_SAFE(service, &session->services, session_chain, temp_service) {
2403 if (service->service_id == mapping->id) {
2404 LIST_REMOVE(service, session_chain);
2405 LIST_REMOVE(service, kernel_chain);
2406 FREE(service, M_NECP);
2407 }
2408 }
2409 necp_remove_uuid_service_id_mapping(service_uuid);
2410 }
2411 lck_rw_done(&necp_kernel_policy_lock);
2412
3e170ce0 2413 necp_send_success_response(session, NECP_PACKET_TYPE_UNREGISTER_SERVICE, message_id);
fe8ab488
A		 2414 return;
2415fail:
3e170ce0 2416 necp_send_error_response(session, NECP_PACKET_TYPE_UNREGISTER_SERVICE, message_id, response_error);
fe8ab488
A		 2417}
2418
5ba3f43e
A		 2419static necp_policy_id
2420necp_handle_policy_add(struct necp_session *session, u_int32_t message_id, mbuf_t packet,
0a7de745 2421 u_int8_t *tlv_buffer, size_t tlv_buffer_length, int offset, int *return_error)
fe8ab488
A		 2422{
2423 bool has_default_condition = FALSE;
2424 bool has_non_default_condition = FALSE;
2425 bool has_application_condition = FALSE;
813fb2f6 2426 bool has_real_application_condition = FALSE;
fe8ab488 2427 bool requires_application_condition = FALSE;
813fb2f6 2428 bool requires_real_application_condition = FALSE;
fe8ab488 2429 u_int8_t *conditions_array = NULL;
3e170ce0 2430 u_int32_t conditions_array_size = 0;
fe8ab488
A		 2431 int conditions_array_cursor;
2432
3e170ce0
A		 2433 bool has_default_route_rule = FALSE;
2434 u_int8_t *route_rules_array = NULL;
2435 u_int32_t route_rules_array_size = 0;
2436 int route_rules_array_cursor;
2437
fe8ab488
A		 2438 int cursor;
2439 int error = 0;
2440 u_int32_t response_error = NECP_ERROR_INTERNAL;
2441
2442 necp_policy_order order = 0;
2443 struct necp_session_policy *policy = NULL;
2444 u_int8_t *policy_result = NULL;
3e170ce0 2445 u_int32_t policy_result_size = 0;
fe8ab488
A		 2446
2447 // Read policy order
5ba3f43e 2448 error = necp_get_tlv(packet, tlv_buffer, tlv_buffer_length, offset, NECP_TLV_POLICY_ORDER, sizeof(order), &order, NULL);
fe8ab488
A		 2449 if (error) {
2450 NECPLOG(LOG_ERR, "Failed to get policy order: %d", error);
2451 response_error = NECP_ERROR_INVALID_TLV;
2452 goto fail;
2453 }
2454
2455 // Read policy result
5ba3f43e
A		 2456 cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, offset, NECP_TLV_POLICY_RESULT, &error, 0);
2457 error = necp_get_tlv_at_offset(packet, tlv_buffer, tlv_buffer_length, cursor, 0, NULL, &policy_result_size);
fe8ab488
A		 2458 if (error || policy_result_size == 0) {
2459 NECPLOG(LOG_ERR, "Failed to get policy result length: %d", error);
2460 response_error = NECP_ERROR_INVALID_TLV;
2461 goto fail;
2462 }
39037602
A		 2463 if (policy_result_size > NECP_MAX_POLICY_RESULT_SIZE) {
2464 NECPLOG(LOG_ERR, "Policy result length too large: %u", policy_result_size);
2465 response_error = NECP_ERROR_INVALID_TLV;
2466 goto fail;
2467 }
fe8ab488
A		 2468 MALLOC(policy_result, u_int8_t *, policy_result_size, M_NECP, M_WAITOK);
2469 if (policy_result == NULL) {
2470 NECPLOG(LOG_ERR, "Failed to allocate a policy result buffer (size %d)", policy_result_size);
2471 response_error = NECP_ERROR_INTERNAL;
2472 goto fail;
2473 }
5ba3f43e 2474 error = necp_get_tlv_at_offset(packet, tlv_buffer, tlv_buffer_length, cursor, policy_result_size, policy_result, NULL);
fe8ab488
A		 2475 if (error) {
2476 NECPLOG(LOG_ERR, "Failed to get policy result: %d", error);
2477 response_error = NECP_ERROR_POLICY_RESULT_INVALID;
2478 goto fail;
2479 }
2480 if (!necp_policy_result_is_valid(policy_result, policy_result_size)) {
2481 NECPLOG0(LOG_ERR, "Failed to validate policy result");
2482 response_error = NECP_ERROR_POLICY_RESULT_INVALID;
2483 goto fail;
2484 }
2485
3e170ce0
A		 2486 if (necp_policy_result_requires_route_rules(policy_result, policy_result_size)) {
2487 // Read route rules conditions
5ba3f43e 2488 for (cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, offset, NECP_TLV_ROUTE_RULE, &error, 0);
0a7de745
A		 2489 cursor >= 0;
2490 cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, cursor, NECP_TLV_ROUTE_RULE, &error, 1)) {
3e170ce0 2491 u_int32_t route_rule_size = 0;
5ba3f43e 2492 necp_get_tlv_at_offset(packet, tlv_buffer, tlv_buffer_length, cursor, 0, NULL, &route_rule_size);
3e170ce0
A		 2493 if (route_rule_size > 0) {
2494 route_rules_array_size += (sizeof(u_int8_t) + sizeof(u_int32_t) + route_rule_size);
2495 }
2496 }
2497
2498 if (route_rules_array_size == 0) {
2499 NECPLOG0(LOG_ERR, "Failed to get policy route rules");
2500 response_error = NECP_ERROR_INVALID_TLV;
2501 goto fail;
2502 }
39037602
A		 2503 if (route_rules_array_size > NECP_MAX_ROUTE_RULES_ARRAY_SIZE) {
2504 NECPLOG(LOG_ERR, "Route rules length too large: %u", route_rules_array_size);
2505 response_error = NECP_ERROR_INVALID_TLV;
2506 goto fail;
2507 }
3e170ce0
A		 2508 MALLOC(route_rules_array, u_int8_t *, route_rules_array_size, M_NECP, M_WAITOK);
2509 if (route_rules_array == NULL) {
2510 NECPLOG(LOG_ERR, "Failed to allocate a policy route rules array (size %d)", route_rules_array_size);
2511 response_error = NECP_ERROR_INTERNAL;
2512 goto fail;
2513 }
2514
2515 route_rules_array_cursor = 0;
5ba3f43e 2516 for (cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, offset, NECP_TLV_ROUTE_RULE, &error, 0);
0a7de745
A		 2517 cursor >= 0;
2518 cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, cursor, NECP_TLV_ROUTE_RULE, &error, 1)) {
3e170ce0
A		 2519 u_int8_t route_rule_type = NECP_TLV_ROUTE_RULE;
2520 u_int32_t route_rule_size = 0;
5ba3f43e 2521 necp_get_tlv_at_offset(packet, tlv_buffer, tlv_buffer_length, cursor, 0, NULL, &route_rule_size);
3e170ce0
A		 2522 if (route_rule_size > 0 && route_rule_size <= (route_rules_array_size - route_rules_array_cursor)) {
2523 // Add type
2524 memcpy((route_rules_array + route_rules_array_cursor), &route_rule_type, sizeof(route_rule_type));
2525 route_rules_array_cursor += sizeof(route_rule_type);
2526
2527 // Add length
2528 memcpy((route_rules_array + route_rules_array_cursor), &route_rule_size, sizeof(route_rule_size));
2529 route_rules_array_cursor += sizeof(route_rule_size);
2530
2531 // Add value
5ba3f43e 2532 necp_get_tlv_at_offset(packet, tlv_buffer, tlv_buffer_length, cursor, route_rule_size, (route_rules_array + route_rules_array_cursor), NULL);
3e170ce0
A		 2533
2534 if (!necp_policy_route_rule_is_valid((route_rules_array + route_rules_array_cursor), route_rule_size)) {
2535 NECPLOG0(LOG_ERR, "Failed to validate policy route rule");
2536 response_error = NECP_ERROR_ROUTE_RULES_INVALID;
2537 goto fail;
2538 }
2539
2540 if (necp_policy_route_rule_is_default((route_rules_array + route_rules_array_cursor), route_rule_size)) {
2541 if (has_default_route_rule) {
2542 NECPLOG0(LOG_ERR, "Failed to validate route rule; contained multiple default route rules");
2543 response_error = NECP_ERROR_ROUTE_RULES_INVALID;
2544 goto fail;
2545 }
2546 has_default_route_rule = TRUE;
2547 }
2548
2549 route_rules_array_cursor += route_rule_size;
2550 }
2551 }
2552 }
2553
fe8ab488 2554 // Read policy conditions
5ba3f43e 2555 for (cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, offset, NECP_TLV_POLICY_CONDITION, &error, 0);
0a7de745
A		 2556 cursor >= 0;
2557 cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, cursor, NECP_TLV_POLICY_CONDITION, &error, 1)) {
3e170ce0 2558 u_int32_t condition_size = 0;
5ba3f43e 2559 necp_get_tlv_at_offset(packet, tlv_buffer, tlv_buffer_length, cursor, 0, NULL, &condition_size);
fe8ab488
A		 2560
2561 if (condition_size > 0) {
3e170ce0 2562 conditions_array_size += (sizeof(u_int8_t) + sizeof(u_int32_t) + condition_size);
fe8ab488
A		 2563 }
2564 }
2565
2566 if (conditions_array_size == 0) {
2567 NECPLOG0(LOG_ERR, "Failed to get policy conditions");
2568 response_error = NECP_ERROR_INVALID_TLV;
2569 goto fail;
2570 }
39037602
A		 2571 if (conditions_array_size > NECP_MAX_CONDITIONS_ARRAY_SIZE) {
2572 NECPLOG(LOG_ERR, "Conditions length too large: %u", conditions_array_size);
2573 response_error = NECP_ERROR_INVALID_TLV;
2574 goto fail;
2575 }
fe8ab488
A		 2576 MALLOC(conditions_array, u_int8_t *, conditions_array_size, M_NECP, M_WAITOK);
2577 if (conditions_array == NULL) {
2578 NECPLOG(LOG_ERR, "Failed to allocate a policy conditions array (size %d)", conditions_array_size);
2579 response_error = NECP_ERROR_INTERNAL;
2580 goto fail;
2581 }
2582
2583 conditions_array_cursor = 0;
5ba3f43e 2584 for (cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, offset, NECP_TLV_POLICY_CONDITION, &error, 0);
0a7de745
A		 2585 cursor >= 0;
2586 cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, cursor, NECP_TLV_POLICY_CONDITION, &error, 1)) {
fe8ab488 2587 u_int8_t condition_type = NECP_TLV_POLICY_CONDITION;
3e170ce0 2588 u_int32_t condition_size = 0;
5ba3f43e 2589 necp_get_tlv_at_offset(packet, tlv_buffer, tlv_buffer_length, cursor, 0, NULL, &condition_size);
fe8ab488
A		 2590 if (condition_size > 0 && condition_size <= (conditions_array_size - conditions_array_cursor)) {
2591 // Add type
2592 memcpy((conditions_array + conditions_array_cursor), &condition_type, sizeof(condition_type));
2593 conditions_array_cursor += sizeof(condition_type);
2594
2595 // Add length
2596 memcpy((conditions_array + conditions_array_cursor), &condition_size, sizeof(condition_size));
2597 conditions_array_cursor += sizeof(condition_size);
2598
2599 // Add value
5ba3f43e 2600 necp_get_tlv_at_offset(packet, tlv_buffer, tlv_buffer_length, cursor, condition_size, (conditions_array + conditions_array_cursor), NULL);
fe8ab488
A		 2601 if (!necp_policy_condition_is_valid((conditions_array + conditions_array_cursor), condition_size, necp_policy_result_get_type_from_buffer(policy_result, policy_result_size))) {
2602 NECPLOG0(LOG_ERR, "Failed to validate policy condition");
2603 response_error = NECP_ERROR_POLICY_CONDITIONS_INVALID;
2604 goto fail;
2605 }
2606
2607 if (necp_policy_condition_is_default((conditions_array + conditions_array_cursor), condition_size)) {
2608 has_default_condition = TRUE;
2609 } else {
2610 has_non_default_condition = TRUE;
2611 }
2612 if (has_default_condition && has_non_default_condition) {
2613 NECPLOG0(LOG_ERR, "Failed to validate conditions; contained default and non-default conditions");
2614 response_error = NECP_ERROR_POLICY_CONDITIONS_INVALID;
2615 goto fail;
2616 }
39037602 2617
fe8ab488
A		 2618 if (necp_policy_condition_is_application((conditions_array + conditions_array_cursor), condition_size)) {
2619 has_application_condition = TRUE;
2620 }
39037602 2621
813fb2f6
A		 2622 if (necp_policy_condition_is_real_application((conditions_array + conditions_array_cursor), condition_size)) {
2623 has_real_application_condition = TRUE;
2624 }
2625
fe8ab488
A		 2626 if (necp_policy_condition_requires_application((conditions_array + conditions_array_cursor), condition_size)) {
2627 requires_application_condition = TRUE;
2628 }
2629
813fb2f6
A		 2630 if (necp_policy_condition_requires_real_application((conditions_array + conditions_array_cursor), condition_size)) {
2631 requires_real_application_condition = TRUE;
2632 }
2633
fe8ab488
A		 2634 conditions_array_cursor += condition_size;
2635 }
2636 }
39037602 2637
fe8ab488
A		 2638 if (requires_application_condition && !has_application_condition) {
2639 NECPLOG0(LOG_ERR, "Failed to validate conditions; did not contain application condition");
2640 response_error = NECP_ERROR_POLICY_CONDITIONS_INVALID;
2641 goto fail;
2642 }
2643
813fb2f6
A		 2644 if (requires_real_application_condition && !has_real_application_condition) {
2645 NECPLOG0(LOG_ERR, "Failed to validate conditions; did not contain real application condition");
2646 response_error = NECP_ERROR_POLICY_CONDITIONS_INVALID;
2647 goto fail;
2648 }
2649
3e170ce0 2650 if ((policy = necp_policy_create(session, order, conditions_array, conditions_array_size, route_rules_array, route_rules_array_size, policy_result, policy_result_size)) == NULL) {
fe8ab488
A		 2651 response_error = NECP_ERROR_INTERNAL;
2652 goto fail;
2653 }
2654
5ba3f43e 2655 if (packet != NULL) {
d9a64523 2656 necp_send_policy_id_response(session, NECP_PACKET_TYPE_POLICY_ADD, message_id, policy->local_id);
5ba3f43e 2657 }
0a7de745 2658 return policy->local_id;
fe8ab488
A		 2659
2660fail:
2661 if (policy_result != NULL) {
2662 FREE(policy_result, M_NECP);
2663 }
2664 if (conditions_array != NULL) {
2665 FREE(conditions_array, M_NECP);
2666 }
3e170ce0
A		 2667 if (route_rules_array != NULL) {
2668 FREE(route_rules_array, M_NECP);
2669 }
fe8ab488 2670
5ba3f43e
A		 2671 if (packet != NULL) {
2672 necp_send_error_response(session, NECP_PACKET_TYPE_POLICY_ADD, message_id, response_error);
2673 }
2674 if (return_error != NULL) {
2675 *return_error = necp_get_posix_error_for_necp_error(response_error);
2676 }
0a7de745 2677 return 0;
fe8ab488
A		 2678}
2679
2680static void
2681necp_handle_policy_get(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset)
2682{
2683#pragma unused(offset)
2684 int error;
2685 u_int8_t *response = NULL;
2686 u_int8_t *cursor = NULL;
2687 u_int32_t response_error = NECP_ERROR_INTERNAL;
2688 necp_policy_id policy_id = 0;
3e170ce0
A		 2689 u_int32_t order_tlv_size = 0;
2690 u_int32_t result_tlv_size = 0;
2691 u_int32_t response_size = 0;
fe8ab488
A		 2692
2693 struct necp_session_policy *policy = NULL;
2694
2695 // Read policy id
5ba3f43e 2696 error = necp_get_tlv(packet, NULL, 0, offset, NECP_TLV_POLICY_ID, sizeof(policy_id), &policy_id, NULL);
fe8ab488
A		 2697 if (error) {
2698 NECPLOG(LOG_ERR, "Failed to get policy id: %d", error);
2699 response_error = NECP_ERROR_INVALID_TLV;
2700 goto fail;
2701 }
2702
2703 policy = necp_policy_find(session, policy_id);
2704 if (policy == NULL || policy->pending_deletion) {
2705 NECPLOG(LOG_ERR, "Failed to find policy with id %d", policy_id);
2706 response_error = NECP_ERROR_POLICY_ID_NOT_FOUND;
2707 goto fail;
2708 }
2709
3e170ce0
A		 2710 order_tlv_size = sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(necp_policy_order);
2711 result_tlv_size = (policy->result_size ? (sizeof(u_int8_t) + sizeof(u_int32_t) + policy->result_size) : 0);
fe8ab488
A		 2712 response_size = sizeof(struct necp_packet_header) + order_tlv_size + result_tlv_size + policy->conditions_size;
2713 MALLOC(response, u_int8_t *, response_size, M_NECP, M_WAITOK);
2714 if (response == NULL) {
5ba3f43e 2715 necp_send_error_response(session, NECP_PACKET_TYPE_POLICY_GET, message_id, NECP_ERROR_INTERNAL);
fe8ab488
A		 2716 return;
2717 }
2718
2719 cursor = response;
2720 cursor = necp_buffer_write_packet_header(cursor, NECP_PACKET_TYPE_POLICY_GET, NECP_PACKET_FLAGS_RESPONSE, message_id);
5ba3f43e 2721 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_ORDER, sizeof(necp_policy_order), &policy->order, response, response_size);
fe8ab488
A		 2722
2723 if (result_tlv_size) {
5ba3f43e 2724 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_RESULT, policy->result_size, &policy->result, response, response_size);
fe8ab488
A		 2725 }
2726 if (policy->conditions_size) {
2727 memcpy(((u_int8_t *)(void *)(cursor)), policy->conditions, policy->conditions_size);
2728 }
2729
2730 if (!necp_send_ctl_data(session, (u_int8_t *)response, response_size)) {
2731 NECPLOG0(LOG_ERR, "Failed to send response");
2732 }
2733
2734 FREE(response, M_NECP);
2735 return;
2736
2737fail:
2738 necp_send_error_response(session, NECP_PACKET_TYPE_POLICY_GET, message_id, response_error);
2739}
2740
2741static void
2742necp_handle_policy_delete(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset)
2743{
2744 int error;
2745 u_int32_t response_error = NECP_ERROR_INTERNAL;
2746 necp_policy_id policy_id = 0;
2747
2748 struct necp_session_policy *policy = NULL;
2749
2750 // Read policy id
5ba3f43e 2751 error = necp_get_tlv(packet, NULL, 0, offset, NECP_TLV_POLICY_ID, sizeof(policy_id), &policy_id, NULL);
fe8ab488
A		 2752 if (error) {
2753 NECPLOG(LOG_ERR, "Failed to get policy id: %d", error);
2754 response_error = NECP_ERROR_INVALID_TLV;
2755 goto fail;
2756 }
2757
2758 policy = necp_policy_find(session, policy_id);
2759 if (policy == NULL || policy->pending_deletion) {
2760 NECPLOG(LOG_ERR, "Failed to find policy with id %d", policy_id);
2761 response_error = NECP_ERROR_POLICY_ID_NOT_FOUND;
2762 goto fail;
2763 }
2764
2765 necp_policy_mark_for_deletion(session, policy);
2766
2767 necp_send_success_response(session, NECP_PACKET_TYPE_POLICY_DELETE, message_id);
2768 return;
2769
2770fail:
2771 necp_send_error_response(session, NECP_PACKET_TYPE_POLICY_DELETE, message_id, response_error);
2772}
2773
2774static void
2775necp_handle_policy_apply_all(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset)
2776{
2777#pragma unused(packet, offset)
2778 necp_policy_apply_all(session);
2779 necp_send_success_response(session, NECP_PACKET_TYPE_POLICY_APPLY_ALL, message_id);
2780}
2781
2782static void
2783necp_handle_policy_list_all(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset)
2784{
2785#pragma unused(packet, offset)
3e170ce0
A		 2786 u_int32_t tlv_size = (sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(u_int32_t));
2787 u_int32_t response_size = 0;
fe8ab488
A		 2788 u_int8_t *response = NULL;
2789 u_int8_t *cursor = NULL;
2790 int num_policies = 0;
2791 int cur_policy_index = 0;
2792 struct necp_session_policy *policy;
2793
2794 LIST_FOREACH(policy, &session->policies, chain) {
2795 if (!policy->pending_deletion) {
2796 num_policies++;
2797 }
2798 }
2799
2800 // Create a response with one Policy ID TLV for each policy
2801 response_size = sizeof(struct necp_packet_header) + num_policies * tlv_size;
2802 MALLOC(response, u_int8_t *, response_size, M_NECP, M_WAITOK);
2803 if (response == NULL) {
2804 necp_send_error_response(session, NECP_PACKET_TYPE_POLICY_LIST_ALL, message_id, NECP_ERROR_INTERNAL);
2805 return;
2806 }
2807
2808 cursor = response;
2809 cursor = necp_buffer_write_packet_header(cursor, NECP_PACKET_TYPE_POLICY_LIST_ALL, NECP_PACKET_FLAGS_RESPONSE, message_id);
2810
2811 LIST_FOREACH(policy, &session->policies, chain) {
2812 if (!policy->pending_deletion && cur_policy_index < num_policies) {
d9a64523 2813 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_ID, sizeof(u_int32_t), &policy->local_id, response, response_size);
fe8ab488
A		 2814 cur_policy_index++;
2815 }
2816 }
2817
2818 if (!necp_send_ctl_data(session, (u_int8_t *)response, response_size)) {
2819 NECPLOG0(LOG_ERR, "Failed to send response");
2820 }
2821
2822 FREE(response, M_NECP);
2823}
2824
2825static void
2826necp_handle_policy_delete_all(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset)
2827{
2828#pragma unused(packet, offset)
2829 necp_policy_mark_all_for_deletion(session);
2830 necp_send_success_response(session, NECP_PACKET_TYPE_POLICY_DELETE_ALL, message_id);
2831}
2832
2833static necp_policy_id
d9a64523 2834necp_policy_get_new_id(struct necp_session *session)
fe8ab488 2835{
d9a64523
A		 2836 session->last_policy_id++;
2837 if (session->last_policy_id < 1) {
2838 session->last_policy_id = 1;
fe8ab488
A		 2839 }
2840
d9a64523 2841 necp_policy_id newid = session->last_policy_id;
fe8ab488
A		 2842
2843 if (newid == 0) {
d9a64523 2844 NECPLOG0(LOG_ERR, "Allocate policy id failed.\n");
0a7de745 2845 return 0;
fe8ab488
A		 2846 }
2847
0a7de745 2848 return newid;
fe8ab488
A		 2849}
2850
39037602
A		 2851/*
2852 * For the policy dump response this is the structure:
2853 *
2854 * <NECP_PACKET_HEADER>
2855 * {
2856 * type : NECP_TLV_POLICY_DUMP
2857 * length : ...
2858 * value :
2859 * {
2860 * {
2861 * type : NECP_TLV_POLICY_ID
2862 * len : ...
2863 * value : ...
2864 * }
2865 * {
2866 * type : NECP_TLV_POLICY_ORDER
2867 * len : ...
2868 * value : ...
2869 * }
2870 * {
2871 * type : NECP_TLV_POLICY_RESULT_STRING
2872 * len : ...
2873 * value : ...
2874 * }
2875 * {
2876 * type : NECP_TLV_POLICY_OWNER
2877 * len : ...
2878 * value : ...
2879 * }
2880 * {
2881 * type : NECP_TLV_POLICY_CONDITION
2882 * len : ...
2883 * value :
2884 * {
2885 * {
2886 * type : NECP_POLICY_CONDITION_ALL_INTERFACES
2887 * len : ...
2888 * value : ...
2889 * }
2890 * {
2891 * type : NECP_POLICY_CONDITION_BOUND_INTERFACES
2892 * len : ...
2893 * value : ...
2894 * }
2895 * ...
2896 * }
2897 * }
2898 * }
2899 * }
2900 * {
2901 * type : NECP_TLV_POLICY_DUMP
2902 * length : ...
2903 * value :
2904 * {
2905 * {
2906 * type : NECP_TLV_POLICY_ID
2907 * len : ...
2908 * value : ...
2909 * }
2910 * {
2911 * type : NECP_TLV_POLICY_ORDER
2912 * len : ...
2913 * value : ...
2914 * }
2915 * {
2916 * type : NECP_TLV_POLICY_RESULT_STRING
2917 * len : ...
2918 * value : ...
2919 * }
2920 * {
2921 * type : NECP_TLV_POLICY_OWNER
2922 * len : ...
2923 * value : ...
2924 * }
2925 * {
2926 * type : NECP_TLV_POLICY_CONDITION
2927 * len : ...
2928 * value :
2929 * {
2930 * {
2931 * type : NECP_POLICY_CONDITION_ALL_INTERFACES
2932 * len : ...
2933 * value : ...
2934 * }
2935 * {
2936 * type : NECP_POLICY_CONDITION_BOUND_INTERFACES
2937 * len : ...
2938 * value : ...
2939 * }
2940 * ...
2941 * }
2942 * }
2943 * }
2944 * }
2945 * ...
2946 */
5ba3f43e
A		 2947static int
2948necp_handle_policy_dump_all(struct necp_session *session, u_int32_t message_id, mbuf_t packet,
0a7de745 2949 user_addr_t out_buffer, size_t out_buffer_length, int offset)
39037602 2950{
5ba3f43e 2951#pragma unused(offset)
39037602
A		 2952 struct necp_kernel_socket_policy *policy = NULL;
2953 int policy_i;
2954 int policy_count = 0;
2955 u_int8_t **tlv_buffer_pointers = NULL;
2956 u_int32_t *tlv_buffer_lengths = NULL;
5ba3f43e 2957 u_int32_t total_tlv_len = 0;
39037602
A		 2958 u_int8_t *result_buf = NULL;
2959 u_int8_t *result_buf_cursor = result_buf;
2960 char result_string[MAX_RESULT_STRING_LEN];
2961 char proc_name_string[MAXCOMLEN + 1];
2962
5ba3f43e 2963 int error_code = 0;
39037602
A		 2964 bool error_occured = false;
2965 u_int32_t response_error = NECP_ERROR_INTERNAL;
2966
0a7de745
A		 2967#define REPORT_ERROR(error) error_occured = true; \
2968 response_error = error; \
2969 goto done
39037602 2970
0a7de745
A		 2971#define UNLOCK_AND_REPORT_ERROR(lock, error) lck_rw_done(lock); \
2972 REPORT_ERROR(error)
39037602
A		 2973
2974 errno_t cred_result = priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NECP_POLICIES, 0);
2975 if (cred_result != 0) {
2976 NECPLOG0(LOG_ERR, "Session does not hold the necessary entitlement to get Network Extension Policy information");
2977 REPORT_ERROR(NECP_ERROR_INTERNAL);
2978 }
2979
2980 // LOCK
2981 lck_rw_lock_shared(&necp_kernel_policy_lock);
2982
5ba3f43e
A		 2983 if (necp_debug) {
2984 NECPLOG0(LOG_DEBUG, "Gathering policies");
2985 }
39037602
A		 2986
2987 policy_count = necp_kernel_application_policies_count;
2988
0a7de745 2989 MALLOC(tlv_buffer_pointers, u_int8_t * *, sizeof(u_int8_t *) * policy_count, M_NECP, M_NOWAIT | M_ZERO);
39037602
A		 2990 if (tlv_buffer_pointers == NULL) {
2991 NECPLOG(LOG_DEBUG, "Failed to allocate tlv_buffer_pointers (%u bytes)", sizeof(u_int8_t *) * policy_count);
2992 UNLOCK_AND_REPORT_ERROR(&necp_kernel_policy_lock, NECP_ERROR_INTERNAL);
2993 }
2994
2995 MALLOC(tlv_buffer_lengths, u_int32_t *, sizeof(u_int32_t) * policy_count, M_NECP, M_NOWAIT | M_ZERO);
2996 if (tlv_buffer_lengths == NULL) {
2997 NECPLOG(LOG_DEBUG, "Failed to allocate tlv_buffer_lengths (%u bytes)", sizeof(u_int32_t) * policy_count);
2998 UNLOCK_AND_REPORT_ERROR(&necp_kernel_policy_lock, NECP_ERROR_INTERNAL);
2999 }
3000
3001 for (policy_i = 0; necp_kernel_socket_policies_app_layer_map != NULL && necp_kernel_socket_policies_app_layer_map[policy_i] != NULL; policy_i++) {
3002 policy = necp_kernel_socket_policies_app_layer_map[policy_i];
3003
3004 memset(result_string, 0, MAX_RESULT_STRING_LEN);
3005 memset(proc_name_string, 0, MAXCOMLEN + 1);
3006
3007 necp_get_result_description(result_string, policy->result, policy->result_parameter);
3008 proc_name(policy->session_pid, proc_name_string, MAXCOMLEN);
3009
3010 u_int16_t proc_name_len = strlen(proc_name_string) + 1;
3011 u_int16_t result_string_len = strlen(result_string) + 1;
3012
5ba3f43e
A		 3013 if (necp_debug) {
3014 NECPLOG(LOG_DEBUG, "Policy: process: %s, result: %s", proc_name_string, result_string);
3015 }
39037602 3016
0a7de745
A		 3017 u_int32_t total_allocated_bytes = sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(policy->id) + // NECP_TLV_POLICY_ID
3018 sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(policy->order) + // NECP_TLV_POLICY_ORDER
3019 sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(policy->session_order) + // NECP_TLV_POLICY_SESSION_ORDER
3020 sizeof(u_int8_t) + sizeof(u_int32_t) + result_string_len + // NECP_TLV_POLICY_RESULT_STRING
3021 sizeof(u_int8_t) + sizeof(u_int32_t) + proc_name_len + // NECP_TLV_POLICY_OWNER
3022 sizeof(u_int8_t) + sizeof(u_int32_t); // NECP_TLV_POLICY_CONDITION
39037602
A		 3023
3024 // We now traverse the condition_mask to see how much space we need to allocate
3025 u_int32_t condition_mask = policy->condition_mask;
3026 u_int8_t num_conditions = 0;
3027 struct necp_string_id_mapping *account_id_entry = NULL;
3028 char if_name[IFXNAMSIZ];
3029 u_int32_t condition_tlv_length = 0;
3030 memset(if_name, 0, sizeof(if_name));
3031
3032 if (condition_mask == NECP_POLICY_CONDITION_DEFAULT) {
3033 num_conditions++;
3034 } else {
3035 if (condition_mask & NECP_KERNEL_CONDITION_ALL_INTERFACES) {
3036 num_conditions++;
3037 }
3038 if (condition_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE) {
3039 snprintf(if_name, IFXNAMSIZ, "%s%d", ifnet_name(policy->cond_bound_interface), ifnet_unit(policy->cond_bound_interface));
3040 condition_tlv_length += strlen(if_name) + 1;
3041 num_conditions++;
3042 }
3043 if (condition_mask & NECP_KERNEL_CONDITION_PROTOCOL) {
3044 condition_tlv_length += sizeof(policy->cond_protocol);
3045 num_conditions++;
3046 }
3047 if (condition_mask & NECP_KERNEL_CONDITION_APP_ID) {
3048 condition_tlv_length += sizeof(uuid_t);
3049 num_conditions++;
3050 }
3051 if (condition_mask & NECP_KERNEL_CONDITION_REAL_APP_ID) {
3052 condition_tlv_length += sizeof(uuid_t);
3053 num_conditions++;
3054 }
3055 if (condition_mask & NECP_KERNEL_CONDITION_DOMAIN) {
3056 u_int32_t domain_len = strlen(policy->cond_domain) + 1;
3057 condition_tlv_length += domain_len;
3058 num_conditions++;
3059 }
3060 if (condition_mask & NECP_KERNEL_CONDITION_ACCOUNT_ID) {
3061 account_id_entry = necp_lookup_string_with_id_locked(&necp_account_id_list, policy->cond_account_id);
3062 u_int32_t account_id_len = 0;
3063 if (account_id_entry) {
3064 account_id_len = account_id_entry->string ? strlen(account_id_entry->string) + 1 : 0;
3065 }
3066 condition_tlv_length += account_id_len;
3067 num_conditions++;
3068 }
3069 if (condition_mask & NECP_KERNEL_CONDITION_PID) {
3070 condition_tlv_length += sizeof(pid_t);
3071 num_conditions++;
3072 }
3073 if (condition_mask & NECP_KERNEL_CONDITION_UID) {
3074 condition_tlv_length += sizeof(uid_t);
3075 num_conditions++;
3076 }
3077 if (condition_mask & NECP_KERNEL_CONDITION_TRAFFIC_CLASS) {
3078 condition_tlv_length += sizeof(struct necp_policy_condition_tc_range);
3079 num_conditions++;
3080 }
3081 if (condition_mask & NECP_KERNEL_CONDITION_ENTITLEMENT) {
3082 num_conditions++;
3083 }
3084 if (condition_mask & NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT) {
3085 u_int32_t entitlement_len = strlen(policy->cond_custom_entitlement) + 1;
3086 condition_tlv_length += entitlement_len;
3087 num_conditions++;
3088 }
3089 if (condition_mask & NECP_KERNEL_CONDITION_LOCAL_START) {
3090 if (condition_mask & NECP_KERNEL_CONDITION_LOCAL_END) {
3091 condition_tlv_length += sizeof(struct necp_policy_condition_addr_range);
3092 } else {
3093 condition_tlv_length += sizeof(struct necp_policy_condition_addr);
3094 }
3095 num_conditions++;
3096 }
3097 if (condition_mask & NECP_KERNEL_CONDITION_REMOTE_START) {
3098 if (condition_mask & NECP_KERNEL_CONDITION_REMOTE_END) {
3099 condition_tlv_length += sizeof(struct necp_policy_condition_addr_range);
3100 } else {
3101 condition_tlv_length += sizeof(struct necp_policy_condition_addr);
3102 }
3103 num_conditions++;
3104 }
d9a64523
A		 3105 if (condition_mask & NECP_KERNEL_CONDITION_AGENT_TYPE) {
3106 condition_tlv_length += sizeof(struct necp_policy_condition_agent_type);
3107 num_conditions++;
3108 }
39037602
A		 3109 }
3110
3111 condition_tlv_length += num_conditions * (sizeof(u_int8_t) + sizeof(u_int32_t)); // These are for the condition TLVs. The space for "value" is already accounted for above.
3112 total_allocated_bytes += condition_tlv_length;
3113
3114 u_int8_t *tlv_buffer;
3115 MALLOC(tlv_buffer, u_int8_t *, total_allocated_bytes, M_NECP, M_NOWAIT | M_ZERO);
3116 if (tlv_buffer == NULL) {
3117 NECPLOG(LOG_DEBUG, "Failed to allocate tlv_buffer (%u bytes)", total_allocated_bytes);
3118 continue;
3119 }
3120
3121 u_int8_t *cursor = tlv_buffer;
5ba3f43e
A		 3122 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_ID, sizeof(policy->id), &policy->id, tlv_buffer, total_allocated_bytes);
3123 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_ORDER, sizeof(necp_policy_order), &policy->order, tlv_buffer, total_allocated_bytes);
3124 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_SESSION_ORDER, sizeof(policy->session_order), &policy->session_order, tlv_buffer, total_allocated_bytes);
3125 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_RESULT_STRING, result_string_len, result_string, tlv_buffer, total_allocated_bytes);
3126 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_OWNER, proc_name_len, proc_name_string, tlv_buffer, total_allocated_bytes);
39037602
A		 3127
3128#define N_QUICK 256
3129 u_int8_t q_cond_buf[N_QUICK]; // Minor optimization
3130
3131 u_int8_t *cond_buf; // To be used for condition TLVs
3132 if (condition_tlv_length <= N_QUICK) {
3133 cond_buf = q_cond_buf;
3134 } else {
3135 MALLOC(cond_buf, u_int8_t *, condition_tlv_length, M_NECP, M_NOWAIT);
3136 if (cond_buf == NULL) {
3137 NECPLOG(LOG_DEBUG, "Failed to allocate cond_buffer (%u bytes)", condition_tlv_length);
3138 FREE(tlv_buffer, M_NECP);
3139 continue;
3140 }
3141 }
3142
3143 memset(cond_buf, 0, condition_tlv_length);
3144 u_int8_t *cond_buf_cursor = cond_buf;
3145 if (condition_mask == NECP_POLICY_CONDITION_DEFAULT) {
5ba3f43e 3146 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_DEFAULT, 0, "", cond_buf, condition_tlv_length);
39037602
A		 3147 } else {
3148 if (condition_mask & NECP_KERNEL_CONDITION_ALL_INTERFACES) {
5ba3f43e 3149 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_ALL_INTERFACES, 0, "", cond_buf, condition_tlv_length);
39037602
A		 3150 }
3151 if (condition_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE) {
5ba3f43e 3152 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_BOUND_INTERFACE, strlen(if_name) + 1,
0a7de745 3153 if_name, cond_buf, condition_tlv_length);
39037602
A		 3154 }
3155 if (condition_mask & NECP_KERNEL_CONDITION_PROTOCOL) {
5ba3f43e 3156 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_IP_PROTOCOL, sizeof(policy->cond_protocol), &policy->cond_protocol,
0a7de745 3157 cond_buf, condition_tlv_length);
39037602
A		 3158 }
3159 if (condition_mask & NECP_KERNEL_CONDITION_APP_ID) {
3160 struct necp_uuid_id_mapping *entry = necp_uuid_lookup_uuid_with_app_id_locked(policy->cond_app_id);
3161 if (entry != NULL) {
5ba3f43e 3162 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_APPLICATION, sizeof(entry->uuid), entry->uuid,
0a7de745 3163 cond_buf, condition_tlv_length);
39037602
A		 3164 }
3165 }
3166 if (condition_mask & NECP_KERNEL_CONDITION_REAL_APP_ID) {
3167 struct necp_uuid_id_mapping *entry = necp_uuid_lookup_uuid_with_app_id_locked(policy->cond_real_app_id);
3168 if (entry != NULL) {
5ba3f43e 3169 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_REAL_APPLICATION, sizeof(entry->uuid), entry->uuid,
0a7de745 3170 cond_buf, condition_tlv_length);
39037602
A		 3171 }
3172 }
3173 if (condition_mask & NECP_KERNEL_CONDITION_DOMAIN) {
5ba3f43e 3174 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_DOMAIN, strlen(policy->cond_domain) + 1, policy->cond_domain,
0a7de745 3175 cond_buf, condition_tlv_length);
39037602
A		 3176 }
3177 if (condition_mask & NECP_KERNEL_CONDITION_ACCOUNT_ID) {
3178 if (account_id_entry != NULL) {
5ba3f43e 3179 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_ACCOUNT, strlen(account_id_entry->string) + 1, account_id_entry->string,
0a7de745 3180 cond_buf, condition_tlv_length);
39037602
A		 3181 }
3182 }
3183 if (condition_mask & NECP_KERNEL_CONDITION_PID) {
5ba3f43e 3184 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_PID, sizeof(policy->cond_pid), &policy->cond_pid,
0a7de745 3185 cond_buf, condition_tlv_length);
39037602
A		 3186 }
3187 if (condition_mask & NECP_KERNEL_CONDITION_UID) {
5ba3f43e 3188 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_UID, sizeof(policy->cond_uid), &policy->cond_uid,
0a7de745 3189 cond_buf, condition_tlv_length);
39037602
A		 3190 }
3191 if (condition_mask & NECP_KERNEL_CONDITION_TRAFFIC_CLASS) {
5ba3f43e 3192 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_TRAFFIC_CLASS, sizeof(policy->cond_traffic_class), &policy->cond_traffic_class,
0a7de745 3193 cond_buf, condition_tlv_length);
39037602
A		 3194 }
3195 if (condition_mask & NECP_KERNEL_CONDITION_ENTITLEMENT) {
5ba3f43e 3196 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_ENTITLEMENT, 0, "",
0a7de745 3197 cond_buf, condition_tlv_length);
39037602
A		 3198 }
3199 if (condition_mask & NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT) {
5ba3f43e 3200 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_ENTITLEMENT, strlen(policy->cond_custom_entitlement) + 1, policy->cond_custom_entitlement,
0a7de745 3201 cond_buf, condition_tlv_length);
39037602
A		 3202 }
3203 if (condition_mask & NECP_KERNEL_CONDITION_LOCAL_START) {
3204 if (condition_mask & NECP_KERNEL_CONDITION_LOCAL_END) {
3205 struct necp_policy_condition_addr_range range;
3206 memcpy(&range.start_address, &policy->cond_local_start, sizeof(policy->cond_local_start));
3207 memcpy(&range.end_address, &policy->cond_local_end, sizeof(policy->cond_local_end));
5ba3f43e 3208 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE, sizeof(range), &range,
0a7de745 3209 cond_buf, condition_tlv_length);
39037602
A		 3210 } else {
3211 struct necp_policy_condition_addr addr;
3212 addr.prefix = policy->cond_local_prefix;
3213 memcpy(&addr.address, &policy->cond_local_start, sizeof(policy->cond_local_start));
5ba3f43e 3214 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_LOCAL_ADDR, sizeof(addr), &addr,
0a7de745 3215 cond_buf, condition_tlv_length);
39037602
A		 3216 }
3217 }
3218 if (condition_mask & NECP_KERNEL_CONDITION_REMOTE_START) {
3219 if (condition_mask & NECP_KERNEL_CONDITION_REMOTE_END) {
3220 struct necp_policy_condition_addr_range range;
3221 memcpy(&range.start_address, &policy->cond_remote_start, sizeof(policy->cond_remote_start));
3222 memcpy(&range.end_address, &policy->cond_remote_end, sizeof(policy->cond_remote_end));
5ba3f43e 3223 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE, sizeof(range), &range,
0a7de745 3224 cond_buf, condition_tlv_length);
39037602
A		 3225 } else {
3226 struct necp_policy_condition_addr addr;
3227 addr.prefix = policy->cond_remote_prefix;
3228 memcpy(&addr.address, &policy->cond_remote_start, sizeof(policy->cond_remote_start));
5ba3f43e 3229 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_REMOTE_ADDR, sizeof(addr), &addr,
0a7de745 3230 cond_buf, condition_tlv_length);
39037602
A		 3231 }
3232 }
d9a64523
A		 3233 if (condition_mask & NECP_KERNEL_CONDITION_AGENT_TYPE) {
3234 cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_AGENT_TYPE,
0a7de745
A		 3235 sizeof(policy->cond_agent_type), &policy->cond_agent_type,
3236 cond_buf, condition_tlv_length);
d9a64523 3237 }
39037602
A		 3238 }
3239
5ba3f43e 3240 cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_CONDITION, cond_buf_cursor - cond_buf, cond_buf, tlv_buffer, total_allocated_bytes);
39037602
A		 3241 if (cond_buf != q_cond_buf) {
3242 FREE(cond_buf, M_NECP);
3243 }
3244
3245 tlv_buffer_pointers[policy_i] = tlv_buffer;
3246 tlv_buffer_lengths[policy_i] = (cursor - tlv_buffer);
3247
3248 // This is the length of the TLV for NECP_TLV_POLICY_DUMP
3249 total_tlv_len += sizeof(u_int8_t) + sizeof(u_int32_t) + (cursor - tlv_buffer);
3250 }
3251
3252 // UNLOCK
3253 lck_rw_done(&necp_kernel_policy_lock);
3254
5ba3f43e
A		 3255 // Send packet
3256 if (packet != NULL) {
0a7de745 3257 u_int32_t total_result_length = sizeof(struct necp_packet_header) + total_tlv_len;
5ba3f43e
A		 3258
3259 // Allow malloc to wait, since the total buffer may be large and we are not holding any locks
3260 MALLOC(result_buf, u_int8_t *, total_result_length, M_NECP, M_WAITOK | M_ZERO);
3261 if (result_buf == NULL) {
3262 NECPLOG(LOG_DEBUG, "Failed to allocate result_buffer (%u bytes)", total_result_length);
3263 REPORT_ERROR(NECP_ERROR_INTERNAL);
3264 }
39037602 3265
5ba3f43e
A		 3266 result_buf_cursor = result_buf;
3267 result_buf_cursor = necp_buffer_write_packet_header(result_buf_cursor, NECP_PACKET_TYPE_POLICY_DUMP_ALL, NECP_PACKET_FLAGS_RESPONSE, message_id);
3268
3269 for (int i = 0; i < policy_count; i++) {
3270 if (tlv_buffer_pointers[i] != NULL) {
3271 result_buf_cursor = necp_buffer_write_tlv(result_buf_cursor, NECP_TLV_POLICY_DUMP, tlv_buffer_lengths[i], tlv_buffer_pointers[i], result_buf, total_result_length);
3272 }
3273 }
39037602 3274
5ba3f43e
A		 3275 if (!necp_send_ctl_data(session, result_buf, result_buf_cursor - result_buf)) {
3276 NECPLOG(LOG_ERR, "Failed to send response (%u bytes)", result_buf_cursor - result_buf);
3277 } else {
3278 NECPLOG(LOG_ERR, "Sent data worth %u bytes. Total result buffer length was %u bytes", result_buf_cursor - result_buf, total_result_length);
39037602
A		 3279 }
3280 }
3281
5ba3f43e
A		 3282 // Copy out
3283 if (out_buffer != 0) {
3284 if (out_buffer_length < total_tlv_len + sizeof(u_int32_t)) {
3285 NECPLOG(LOG_DEBUG, "out_buffer_length too small (%u < %u)", out_buffer_length, total_tlv_len + sizeof(u_int32_t));
3286 REPORT_ERROR(NECP_ERROR_INVALID_TLV);
3287 }
3288
3289 // Allow malloc to wait, since the total buffer may be large and we are not holding any locks
3290 MALLOC(result_buf, u_int8_t *, total_tlv_len + sizeof(u_int32_t), M_NECP, M_WAITOK | M_ZERO);
3291 if (result_buf == NULL) {
3292 NECPLOG(LOG_DEBUG, "Failed to allocate result_buffer (%u bytes)", total_tlv_len + sizeof(u_int32_t));
3293 REPORT_ERROR(NECP_ERROR_INTERNAL);
3294 }
3295
3296 // Add four bytes for total length at the start
3297 memcpy(result_buf, &total_tlv_len, sizeof(u_int32_t));
3298
3299 // Copy the TLVs
3300 result_buf_cursor = result_buf + sizeof(u_int32_t);
3301 for (int i = 0; i < policy_count; i++) {
3302 if (tlv_buffer_pointers[i] != NULL) {
3303 result_buf_cursor = necp_buffer_write_tlv(result_buf_cursor, NECP_TLV_POLICY_DUMP, tlv_buffer_lengths[i], tlv_buffer_pointers[i],
0a7de745 3304 result_buf, total_tlv_len + sizeof(u_int32_t));
5ba3f43e
A		 3305 }
3306 }
3307
3308 int copy_error = copyout(result_buf, out_buffer, total_tlv_len + sizeof(u_int32_t));
3309 if (copy_error) {
3310 NECPLOG(LOG_DEBUG, "Failed to copy out result_buffer (%u bytes)", total_tlv_len + sizeof(u_int32_t));
3311 REPORT_ERROR(NECP_ERROR_INTERNAL);
3312 }
39037602
A		 3313 }
3314
3315done:
3316
3317 if (error_occured) {
5ba3f43e 3318 if (packet != NULL) {
0a7de745 3319 if (!necp_send_error_response(session, NECP_PACKET_TYPE_POLICY_DUMP_ALL, message_id, response_error)) {
5ba3f43e
A		 3320 NECPLOG0(LOG_ERR, "Failed to send error response");
3321 } else {
3322 NECPLOG0(LOG_ERR, "Sent error response");
3323 }
39037602 3324 }
5ba3f43e 3325 error_code = necp_get_posix_error_for_necp_error(response_error);
39037602
A		 3326 }
3327
3328 if (result_buf != NULL) {
3329 FREE(result_buf, M_NECP);
3330 }
3331
3332 if (tlv_buffer_pointers != NULL) {
3333 for (int i = 0; i < policy_count; i++) {
3334 if (tlv_buffer_pointers[i] != NULL) {
3335 FREE(tlv_buffer_pointers[i], M_NECP);
3336 tlv_buffer_pointers[i] = NULL;
3337 }
3338 }
3339 FREE(tlv_buffer_pointers, M_NECP);
3340 }
3341
3342 if (tlv_buffer_lengths != NULL) {
3343 FREE(tlv_buffer_lengths, M_NECP);
3344 }
3345#undef N_QUICK
3346#undef RESET_COND_BUF
3347#undef REPORT_ERROR
3348#undef UNLOCK_AND_REPORT_ERROR
5ba3f43e 3349
0a7de745 3350 return error_code;
39037602
A		 3351}
3352
fe8ab488 3353static struct necp_session_policy *
3e170ce0 3354necp_policy_create(struct necp_session *session, necp_policy_order order, u_int8_t *conditions_array, u_int32_t conditions_array_size, u_int8_t *route_rules_array, u_int32_t route_rules_array_size, u_int8_t *result, u_int32_t result_size)
fe8ab488
A		 3355{
3356 struct necp_session_policy *new_policy = NULL;
3357 struct necp_session_policy *tmp_policy = NULL;
3358
3359 if (session == NULL || conditions_array == NULL || result == NULL || result_size == 0) {
3360 goto done;
3361 }
3362
3363 MALLOC_ZONE(new_policy, struct necp_session_policy *, sizeof(*new_policy), M_NECP_SESSION_POLICY, M_WAITOK);
3364 if (new_policy == NULL) {
3365 goto done;
3366 }
3367
5ba3f43e 3368 memset(new_policy, 0, sizeof(*new_policy)); // M_ZERO is not supported for MALLOC_ZONE
fe8ab488
A		 3369 new_policy->applied = FALSE;
3370 new_policy->pending_deletion = FALSE;
3371 new_policy->pending_update = FALSE;
3372 new_policy->order = order;
3373 new_policy->conditions = conditions_array;
3374 new_policy->conditions_size = conditions_array_size;
3e170ce0
A		 3375 new_policy->route_rules = route_rules_array;
3376 new_policy->route_rules_size = route_rules_array_size;
fe8ab488
A		 3377 new_policy->result = result;
3378 new_policy->result_size = result_size;
d9a64523 3379 new_policy->local_id = necp_policy_get_new_id(session);
fe8ab488
A		 3380
3381 LIST_INSERT_SORTED_ASCENDING(&session->policies, new_policy, chain, order, tmp_policy);
3382
3383 session->dirty = TRUE;
3384
3385 if (necp_debug) {
3386 NECPLOG(LOG_DEBUG, "Created NECP policy, order %d", order);
3387 }
3388done:
0a7de745 3389 return new_policy;
fe8ab488
A		 3390}
3391
3392static struct necp_session_policy *
3393necp_policy_find(struct necp_session *session, necp_policy_id policy_id)
3394{
3395 struct necp_session_policy *policy = NULL;
3396 if (policy_id == 0) {
0a7de745 3397 return NULL;
fe8ab488
A		 3398 }
3399
3400 LIST_FOREACH(policy, &session->policies, chain) {
d9a64523 3401 if (policy->local_id == policy_id) {
0a7de745 3402 return policy;
fe8ab488
A		 3403 }
3404 }
3405
0a7de745 3406 return NULL;
fe8ab488
A		 3407}
3408
3409static inline u_int8_t
3410necp_policy_get_result_type(struct necp_session_policy *policy)
3411{
0a7de745 3412 return policy ? necp_policy_result_get_type_from_buffer(policy->result, policy->result_size) : 0;
fe8ab488
A		 3413}
3414
3e170ce0 3415static inline u_int32_t
fe8ab488
A		 3416necp_policy_get_result_parameter_length(struct necp_session_policy *policy)
3417{
0a7de745 3418 return policy ? necp_policy_result_get_parameter_length_from_buffer(policy->result, policy->result_size) : 0;
fe8ab488
A		 3419}
3420
3421static bool
3e170ce0 3422necp_policy_get_result_parameter(struct necp_session_policy *policy, u_int8_t *parameter_buffer, u_int32_t parameter_buffer_length)
fe8ab488
A		 3423{
3424 if (policy) {
3e170ce0 3425 u_int32_t parameter_length = necp_policy_result_get_parameter_length_from_buffer(policy->result, policy->result_size);
fe8ab488
A		 3426 if (parameter_buffer_length >= parameter_length) {
3427 u_int8_t *parameter = necp_policy_result_get_parameter_pointer_from_buffer(policy->result, policy->result_size);
3428 if (parameter && parameter_buffer) {
3429 memcpy(parameter_buffer, parameter, parameter_length);
0a7de745 3430 return TRUE;
fe8ab488
A		 3431 }
3432 }
3433 }
3434
0a7de745 3435 return FALSE;
fe8ab488
A		 3436}
3437
3438static bool
3439necp_policy_mark_for_deletion(struct necp_session *session, struct necp_session_policy *policy)
3440{
3441 if (session == NULL || policy == NULL) {
0a7de745 3442 return FALSE;
fe8ab488
A		 3443 }
3444
3445 policy->pending_deletion = TRUE;
3446 session->dirty = TRUE;
3447
3448 if (necp_debug) {
3449 NECPLOG0(LOG_DEBUG, "Marked NECP policy for removal");
3450 }
0a7de745 3451 return TRUE;
fe8ab488
A		 3452}
3453
3454static bool
3455necp_policy_mark_all_for_deletion(struct necp_session *session)
3456{
3457 struct necp_session_policy *policy = NULL;
3458 struct necp_session_policy *temp_policy = NULL;
3459
3460 LIST_FOREACH_SAFE(policy, &session->policies, chain, temp_policy) {
3461 necp_policy_mark_for_deletion(session, policy);
3462 }
3463
0a7de745 3464 return TRUE;
fe8ab488
A		 3465}
3466
3467static bool
3468necp_policy_delete(struct necp_session *session, struct necp_session_policy *policy)
3469{
3470 if (session == NULL || policy == NULL) {
0a7de745 3471 return FALSE;
fe8ab488
A		 3472 }
3473
3474 LIST_REMOVE(policy, chain);
3475
3476 if (policy->result) {
3477 FREE(policy->result, M_NECP);
3478 policy->result = NULL;
3479 }
3480
3481 if (policy->conditions) {
3482 FREE(policy->conditions, M_NECP);
3483 policy->conditions = NULL;
3484 }
3485
39037602
A		 3486 if (policy->route_rules) {
3487 FREE(policy->route_rules, M_NECP);
3488 policy->route_rules = NULL;
3489 }
3490
fe8ab488
A		 3491 FREE_ZONE(policy, sizeof(*policy), M_NECP_SESSION_POLICY);
3492
3493 if (necp_debug) {
3494 NECPLOG0(LOG_DEBUG, "Removed NECP policy");
3495 }
0a7de745 3496 return TRUE;
fe8ab488
A		 3497}
3498
3499static bool
3500necp_policy_unapply(struct necp_session_policy *policy)
3501{
3502 int i = 0;
3503 if (policy == NULL) {
0a7de745 3504 return FALSE;
fe8ab488
A		 3505 }
3506
5ba3f43e 3507 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
fe8ab488
A		 3508
3509 // Release local uuid mappings
3510 if (!uuid_is_null(policy->applied_app_uuid)) {
3511 bool removed_mapping = FALSE;
3512 if (necp_remove_uuid_app_id_mapping(policy->applied_app_uuid, &removed_mapping, TRUE) && removed_mapping) {
3513 necp_uuid_app_id_mappings_dirty = TRUE;
3514 necp_num_uuid_app_id_mappings--;
3515 }
3516 uuid_clear(policy->applied_app_uuid);
3517 }
3518 if (!uuid_is_null(policy->applied_real_app_uuid)) {
3519 necp_remove_uuid_app_id_mapping(policy->applied_real_app_uuid, NULL, FALSE);
3520 uuid_clear(policy->applied_real_app_uuid);
3521 }
3e170ce0
A		 3522 if (!uuid_is_null(policy->applied_result_uuid)) {
3523 necp_remove_uuid_service_id_mapping(policy->applied_result_uuid);
3524 uuid_clear(policy->applied_result_uuid);
fe8ab488
A		 3525 }
3526
3527 // Release string mappings
3528 if (policy->applied_account != NULL) {
3529 necp_remove_string_to_id_mapping(&necp_account_id_list, policy->applied_account);
3530 FREE(policy->applied_account, M_NECP);
3531 policy->applied_account = NULL;
3532 }
3533
3e170ce0
A		 3534 // Release route rule
3535 if (policy->applied_route_rules_id != 0) {
3536 necp_remove_route_rule(&necp_route_rules, policy->applied_route_rules_id);
3537 policy->applied_route_rules_id = 0;
3538 }
3539
fe8ab488
A		 3540 // Remove socket policies
3541 for (i = 0; i < MAX_KERNEL_SOCKET_POLICIES; i++) {
3542 if (policy->kernel_socket_policies[i] != 0) {
3543 necp_kernel_socket_policy_delete(policy->kernel_socket_policies[i]);
3544 policy->kernel_socket_policies[i] = 0;
3545 }
3546 }
3547
3548 // Remove IP output policies
3549 for (i = 0; i < MAX_KERNEL_IP_OUTPUT_POLICIES; i++) {
3550 if (policy->kernel_ip_output_policies[i] != 0) {
3551 necp_kernel_ip_output_policy_delete(policy->kernel_ip_output_policies[i]);
3552 policy->kernel_ip_output_policies[i] = 0;
3553 }
3554 }
3555
3556 policy->applied = FALSE;
3557
0a7de745 3558 return TRUE;
fe8ab488
A		 3559}
3560
0a7de745
A		 3561#define NECP_KERNEL_POLICY_SUBORDER_ID_TUNNEL_CONDITION 0
3562#define NECP_KERNEL_POLICY_SUBORDER_NON_ID_TUNNEL_CONDITION 1
3563#define NECP_KERNEL_POLICY_SUBORDER_ID_CONDITION 2
3564#define NECP_KERNEL_POLICY_SUBORDER_NON_ID_CONDITIONS 3
fe8ab488
A		 3565struct necp_policy_result_ip_tunnel {
3566 u_int32_t secondary_result;
3567 char interface_name[IFXNAMSIZ];
3568} __attribute__((__packed__));
3569
3570struct necp_policy_result_service {
3571 uuid_t identifier;
3572 u_int32_t data;
3573} __attribute__((__packed__));
3574
3575static bool
3576necp_policy_apply(struct necp_session *session, struct necp_session_policy *policy)
3577{
3578 bool socket_only_conditions = FALSE;
3579 bool socket_ip_conditions = FALSE;
3580
3581 bool socket_layer_non_id_conditions = FALSE;
3582 bool ip_output_layer_non_id_conditions = FALSE;
39037602 3583 bool ip_output_layer_non_id_only = FALSE;
fe8ab488
A		 3584 bool ip_output_layer_id_condition = FALSE;
3585 bool ip_output_layer_tunnel_condition_from_id = FALSE;
3586 bool ip_output_layer_tunnel_condition_from_non_id = FALSE;
3587 necp_kernel_policy_id cond_ip_output_layer_id = NECP_KERNEL_POLICY_ID_NONE;
3588
3589 u_int32_t master_condition_mask = 0;
3590 u_int32_t master_condition_negated_mask = 0;
3591 ifnet_t cond_bound_interface = NULL;
3592 u_int32_t cond_account_id = 0;
3593 char *cond_domain = NULL;
39037602 3594 char *cond_custom_entitlement = NULL;
fe8ab488
A		 3595 pid_t cond_pid = 0;
3596 uid_t cond_uid = 0;
3597 necp_app_id cond_app_id = 0;
3598 necp_app_id cond_real_app_id = 0;
3599 struct necp_policy_condition_tc_range cond_traffic_class;
3600 cond_traffic_class.start_tc = 0;
3601 cond_traffic_class.end_tc = 0;
3602 u_int16_t cond_protocol = 0;
3603 union necp_sockaddr_union cond_local_start;
3604 union necp_sockaddr_union cond_local_end;
3605 u_int8_t cond_local_prefix = 0;
3606 union necp_sockaddr_union cond_remote_start;
3607 union necp_sockaddr_union cond_remote_end;
3608 u_int8_t cond_remote_prefix = 0;
3e170ce0 3609 u_int32_t offset = 0;
fe8ab488
A		 3610 u_int8_t ultimate_result = 0;
3611 u_int32_t secondary_result = 0;
d9a64523 3612 struct necp_policy_condition_agent_type cond_agent_type = {};
fe8ab488
A		 3613 necp_kernel_policy_result_parameter secondary_result_parameter;
3614 memset(&secondary_result_parameter, 0, sizeof(secondary_result_parameter));
3615 u_int32_t cond_last_interface_index = 0;
3616 necp_kernel_policy_result_parameter ultimate_result_parameter;
3617 memset(&ultimate_result_parameter, 0, sizeof(ultimate_result_parameter));
3618
3619 if (policy == NULL) {
0a7de745 3620 return FALSE;
fe8ab488
A		 3621 }
3622
5ba3f43e 3623 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
fe8ab488
A		 3624
3625 // Process conditions
3626 while (offset < policy->conditions_size) {
3e170ce0 3627 u_int32_t length = 0;
fe8ab488
A		 3628 u_int8_t *value = necp_buffer_get_tlv_value(policy->conditions, offset, &length);
3629
3630 u_int8_t condition_type = necp_policy_condition_get_type_from_buffer(value, length);
3631 u_int8_t condition_flags = necp_policy_condition_get_flags_from_buffer(value, length);
3632 bool condition_is_negative = condition_flags & NECP_POLICY_CONDITION_FLAGS_NEGATIVE;
3e170ce0 3633 u_int32_t condition_length = necp_policy_condition_get_value_length_from_buffer(value, length);
fe8ab488
A		 3634 u_int8_t *condition_value = necp_policy_condition_get_value_pointer_from_buffer(value, length);
3635 switch (condition_type) {
0a7de745
A		 3636 case NECP_POLICY_CONDITION_DEFAULT: {
3637 socket_ip_conditions = TRUE;
3638 break;
3639 }
3640 case NECP_POLICY_CONDITION_ALL_INTERFACES: {
3641 master_condition_mask |= NECP_KERNEL_CONDITION_ALL_INTERFACES;
3642 socket_ip_conditions = TRUE;
3643 break;
3644 }
3645 case NECP_POLICY_CONDITION_ENTITLEMENT: {
3646 if (condition_length > 0) {
3647 if (cond_custom_entitlement == NULL) {
3648 cond_custom_entitlement = necp_copy_string((char *)condition_value, condition_length);
3649 if (cond_custom_entitlement != NULL) {
3650 master_condition_mask |= NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT;
fe8ab488
A		 3651 socket_only_conditions = TRUE;
3652 }
3653 }
0a7de745
A		 3654 } else {
3655 master_condition_mask |= NECP_KERNEL_CONDITION_ENTITLEMENT;
3656 socket_only_conditions = TRUE;
fe8ab488 3657 }
0a7de745
A		 3658 break;
3659 }
3660 case NECP_POLICY_CONDITION_DOMAIN: {
3661 // Make sure there is only one such rule
3662 if (condition_length > 0 && cond_domain == NULL) {
3663 cond_domain = necp_create_trimmed_domain((char *)condition_value, condition_length);
3664 if (cond_domain != NULL) {
3665 master_condition_mask |= NECP_KERNEL_CONDITION_DOMAIN;
3666 if (condition_is_negative) {
3667 master_condition_negated_mask |= NECP_KERNEL_CONDITION_DOMAIN;
fe8ab488 3668 }
0a7de745 3669 socket_only_conditions = TRUE;
fe8ab488 3670 }
fe8ab488 3671 }
0a7de745
A		 3672 break;
3673 }
3674 case NECP_POLICY_CONDITION_ACCOUNT: {
3675 // Make sure there is only one such rule
3676 if (condition_length > 0 && cond_account_id == 0 && policy->applied_account == NULL) {
3677 char *string = NULL;
3678 MALLOC(string, char *, condition_length + 1, M_NECP, M_WAITOK);
3679 if (string != NULL) {
3680 memcpy(string, condition_value, condition_length);
3681 string[condition_length] = 0;
3682 cond_account_id = necp_create_string_to_id_mapping(&necp_account_id_list, string);
3683 if (cond_account_id != 0) {
3684 policy->applied_account = string; // Save the string in parent policy
3685 master_condition_mask |= NECP_KERNEL_CONDITION_ACCOUNT_ID;
fe8ab488 3686 if (condition_is_negative) {
0a7de745 3687 master_condition_negated_mask |= NECP_KERNEL_CONDITION_ACCOUNT_ID;
fe8ab488
A		 3688 }
3689 socket_only_conditions = TRUE;
0a7de745
A		 3690 } else {
3691 FREE(string, M_NECP);
fe8ab488
A		 3692 }
3693 }
fe8ab488 3694 }
0a7de745
A		 3695 break;
3696 }
3697 case NECP_POLICY_CONDITION_APPLICATION: {
3698 // Make sure there is only one such rule, because we save the uuid in the policy
3699 if (condition_length >= sizeof(uuid_t) && cond_app_id == 0) {
3700 bool allocated_mapping = FALSE;
3701 uuid_t application_uuid;
3702 memcpy(application_uuid, condition_value, sizeof(uuid_t));
3703 cond_app_id = necp_create_uuid_app_id_mapping(application_uuid, &allocated_mapping, TRUE);
3704 if (cond_app_id != 0) {
3705 if (allocated_mapping) {
3706 necp_uuid_app_id_mappings_dirty = TRUE;
3707 necp_num_uuid_app_id_mappings++;
fe8ab488 3708 }
0a7de745
A		 3709 uuid_copy(policy->applied_app_uuid, application_uuid);
3710 master_condition_mask |= NECP_KERNEL_CONDITION_APP_ID;
fe8ab488 3711 if (condition_is_negative) {
0a7de745 3712 master_condition_negated_mask |= NECP_KERNEL_CONDITION_APP_ID;
fe8ab488 3713 }
fe8ab488
A		 3714 socket_only_conditions = TRUE;
3715 }
fe8ab488 3716 }
0a7de745
A		 3717 break;
3718 }
3719 case NECP_POLICY_CONDITION_REAL_APPLICATION: {
3720 // Make sure there is only one such rule, because we save the uuid in the policy
3721 if (condition_length >= sizeof(uuid_t) && cond_real_app_id == 0) {
3722 uuid_t real_application_uuid;
3723 memcpy(real_application_uuid, condition_value, sizeof(uuid_t));
3724 cond_real_app_id = necp_create_uuid_app_id_mapping(real_application_uuid, NULL, FALSE);
3725 if (cond_real_app_id != 0) {
3726 uuid_copy(policy->applied_real_app_uuid, real_application_uuid);
3727 master_condition_mask |= NECP_KERNEL_CONDITION_REAL_APP_ID;
fe8ab488 3728 if (condition_is_negative) {
0a7de745 3729 master_condition_negated_mask |= NECP_KERNEL_CONDITION_REAL_APP_ID;
fe8ab488 3730 }
fe8ab488
A		 3731 socket_only_conditions = TRUE;
3732 }
fe8ab488 3733 }
0a7de745
A		 3734 break;
3735 }
3736 case NECP_POLICY_CONDITION_PID: {
3737 if (condition_length >= sizeof(pid_t)) {
3738 master_condition_mask |= NECP_KERNEL_CONDITION_PID;
3739 if (condition_is_negative) {
3740 master_condition_negated_mask |= NECP_KERNEL_CONDITION_PID;
fe8ab488 3741 }
0a7de745
A		 3742 memcpy(&cond_pid, condition_value, sizeof(cond_pid));
3743 socket_only_conditions = TRUE;
fe8ab488 3744 }
0a7de745
A		 3745 break;
3746 }
3747 case NECP_POLICY_CONDITION_UID: {
3748 if (condition_length >= sizeof(uid_t)) {
3749 master_condition_mask |= NECP_KERNEL_CONDITION_UID;
3750 if (condition_is_negative) {
3751 master_condition_negated_mask |= NECP_KERNEL_CONDITION_UID;
fe8ab488 3752 }
0a7de745
A		 3753 memcpy(&cond_uid, condition_value, sizeof(cond_uid));
3754 socket_only_conditions = TRUE;
3755 }
3756 break;
3757 }
3758 case NECP_POLICY_CONDITION_TRAFFIC_CLASS: {
3759 if (condition_length >= sizeof(struct necp_policy_condition_tc_range)) {
3760 master_condition_mask |= NECP_KERNEL_CONDITION_TRAFFIC_CLASS;
3761 if (condition_is_negative) {
3762 master_condition_negated_mask |= NECP_KERNEL_CONDITION_TRAFFIC_CLASS;
3763 }
3764 memcpy(&cond_traffic_class, condition_value, sizeof(cond_traffic_class));
3765 socket_only_conditions = TRUE;
fe8ab488 3766 }
0a7de745
A		 3767 break;
3768 }
3769 case NECP_POLICY_CONDITION_BOUND_INTERFACE: {
3770 if (condition_length <= IFXNAMSIZ && condition_length > 0) {
3771 char interface_name[IFXNAMSIZ];
3772 memcpy(interface_name, condition_value, condition_length);
3773 interface_name[condition_length - 1] = 0; // Make sure the string is NULL terminated
3774 if (ifnet_find_by_name(interface_name, &cond_bound_interface) == 0) {
3775 master_condition_mask |= NECP_KERNEL_CONDITION_BOUND_INTERFACE;
fe8ab488 3776 if (condition_is_negative) {
0a7de745 3777 master_condition_negated_mask |= NECP_KERNEL_CONDITION_BOUND_INTERFACE;
fe8ab488 3778 }
fe8ab488 3779 }
0a7de745 3780 socket_ip_conditions = TRUE;
fe8ab488 3781 }
0a7de745
A		 3782 break;
3783 }
3784 case NECP_POLICY_CONDITION_IP_PROTOCOL: {
3785 if (condition_length >= sizeof(u_int16_t)) {
3786 master_condition_mask |= NECP_KERNEL_CONDITION_PROTOCOL;
fe8ab488 3787 if (condition_is_negative) {
0a7de745 3788 master_condition_negated_mask |= NECP_KERNEL_CONDITION_PROTOCOL;
fe8ab488 3789 }
0a7de745 3790 memcpy(&cond_protocol, condition_value, sizeof(cond_protocol));
fe8ab488 3791 socket_ip_conditions = TRUE;
0a7de745
A		 3792 }
3793 break;
3794 }
3795 case NECP_POLICY_CONDITION_LOCAL_ADDR: {
3796 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)condition_value;
3797 if (!necp_address_is_valid(&address_struct->address.sa)) {
fe8ab488
A		 3798 break;
3799 }
490019cf 3800
0a7de745
A		 3801 cond_local_prefix = address_struct->prefix;
3802 memcpy(&cond_local_start, &address_struct->address, sizeof(address_struct->address));
3803 master_condition_mask |= NECP_KERNEL_CONDITION_LOCAL_START;
3804 master_condition_mask |= NECP_KERNEL_CONDITION_LOCAL_PREFIX;
3805 if (condition_is_negative) {
3806 master_condition_negated_mask |= NECP_KERNEL_CONDITION_LOCAL_START;
3807 master_condition_negated_mask |= NECP_KERNEL_CONDITION_LOCAL_PREFIX;
3808 }
3809 socket_ip_conditions = TRUE;
3810 break;
3811 }
3812 case NECP_POLICY_CONDITION_REMOTE_ADDR: {
3813 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)condition_value;
3814 if (!necp_address_is_valid(&address_struct->address.sa)) {
fe8ab488
A		 3815 break;
3816 }
490019cf 3817
0a7de745
A		 3818 cond_remote_prefix = address_struct->prefix;
3819 memcpy(&cond_remote_start, &address_struct->address, sizeof(address_struct->address));
3820 master_condition_mask |= NECP_KERNEL_CONDITION_REMOTE_START;
3821 master_condition_mask |= NECP_KERNEL_CONDITION_REMOTE_PREFIX;
3822 if (condition_is_negative) {
3823 master_condition_negated_mask |= NECP_KERNEL_CONDITION_REMOTE_START;
3824 master_condition_negated_mask |= NECP_KERNEL_CONDITION_REMOTE_PREFIX;
3825 }
3826 socket_ip_conditions = TRUE;
3827 break;
3828 }
3829 case NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE: {
3830 struct necp_policy_condition_addr_range *address_struct = (struct necp_policy_condition_addr_range *)(void *)condition_value;
3831 if (!necp_address_is_valid(&address_struct->start_address.sa) ||
3832 !necp_address_is_valid(&address_struct->end_address.sa)) {
fe8ab488
A		 3833 break;
3834 }
490019cf 3835
0a7de745
A		 3836 memcpy(&cond_local_start, &address_struct->start_address, sizeof(address_struct->start_address));
3837 memcpy(&cond_local_end, &address_struct->end_address, sizeof(address_struct->end_address));
3838 master_condition_mask |= NECP_KERNEL_CONDITION_LOCAL_START;
3839 master_condition_mask |= NECP_KERNEL_CONDITION_LOCAL_END;
3840 if (condition_is_negative) {
3841 master_condition_negated_mask |= NECP_KERNEL_CONDITION_LOCAL_START;
3842 master_condition_negated_mask |= NECP_KERNEL_CONDITION_LOCAL_END;
fe8ab488 3843 }
0a7de745
A		 3844 socket_ip_conditions = TRUE;
3845 break;
3846 }
3847 case NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE: {
3848 struct necp_policy_condition_addr_range *address_struct = (struct necp_policy_condition_addr_range *)(void *)condition_value;
3849 if (!necp_address_is_valid(&address_struct->start_address.sa) ||
3850 !necp_address_is_valid(&address_struct->end_address.sa)) {
d9a64523
A		 3851 break;
3852 }
0a7de745
A		 3853
3854 memcpy(&cond_remote_start, &address_struct->start_address, sizeof(address_struct->start_address));
3855 memcpy(&cond_remote_end, &address_struct->end_address, sizeof(address_struct->end_address));
3856 master_condition_mask |= NECP_KERNEL_CONDITION_REMOTE_START;
3857 master_condition_mask |= NECP_KERNEL_CONDITION_REMOTE_END;
3858 if (condition_is_negative) {
3859 master_condition_negated_mask |= NECP_KERNEL_CONDITION_REMOTE_START;
3860 master_condition_negated_mask |= NECP_KERNEL_CONDITION_REMOTE_END;
3861 }
3862 socket_ip_conditions = TRUE;
3863 break;
3864 }
3865 case NECP_POLICY_CONDITION_AGENT_TYPE: {
3866 if (condition_length >= sizeof(cond_agent_type)) {
3867 master_condition_mask |= NECP_KERNEL_CONDITION_AGENT_TYPE;
3868 memcpy(&cond_agent_type, condition_value, sizeof(cond_agent_type));
3869 socket_only_conditions = TRUE;
fe8ab488 3870 }
0a7de745
A		 3871 break;
3872 }
3873 default: {
3874 break;
3875 }
fe8ab488
A		 3876 }
3877
3e170ce0 3878 offset += sizeof(u_int8_t) + sizeof(u_int32_t) + length;
fe8ab488
A		 3879 }
3880
3881 // Process result
3882 ultimate_result = necp_policy_get_result_type(policy);
3883 switch (ultimate_result) {
0a7de745
A		 3884 case NECP_POLICY_RESULT_PASS: {
3885 if (socket_only_conditions) { // socket_ip_conditions can be TRUE or FALSE
3886 socket_layer_non_id_conditions = TRUE;
3887 ip_output_layer_id_condition = TRUE;
3888 } else if (socket_ip_conditions) {
3889 socket_layer_non_id_conditions = TRUE;
3890 ip_output_layer_id_condition = TRUE;
3891 ip_output_layer_non_id_conditions = TRUE;
fe8ab488 3892 }
0a7de745
A		 3893 break;
3894 }
3895 case NECP_POLICY_RESULT_DROP: {
3896 if (socket_only_conditions) { // socket_ip_conditions can be TRUE or FALSE
3897 socket_layer_non_id_conditions = TRUE;
3898 } else if (socket_ip_conditions) {
3899 socket_layer_non_id_conditions = TRUE;
3900 ip_output_layer_non_id_conditions = TRUE;
3901 ip_output_layer_non_id_only = TRUE; // Only apply drop to packets that didn't go through socket layer
fe8ab488 3902 }
0a7de745
A		 3903 break;
3904 }
3905 case NECP_POLICY_RESULT_SKIP: {
3906 u_int32_t skip_policy_order = 0;
3907 if (necp_policy_get_result_parameter(policy, (u_int8_t *)&skip_policy_order, sizeof(skip_policy_order))) {
3908 ultimate_result_parameter.skip_policy_order = skip_policy_order;
fe8ab488 3909 }
0a7de745
A		 3910
3911 if (socket_only_conditions) { // socket_ip_conditions can be TRUE or FALSE
fe8ab488 3912 socket_layer_non_id_conditions = TRUE;
0a7de745
A		 3913 ip_output_layer_id_condition = TRUE;
3914 } else if (socket_ip_conditions) {
3915 socket_layer_non_id_conditions = TRUE;
3916 ip_output_layer_non_id_conditions = TRUE;
fe8ab488 3917 }
0a7de745
A		 3918 break;
3919 }
3920 case NECP_POLICY_RESULT_SOCKET_DIVERT:
3921 case NECP_POLICY_RESULT_SOCKET_FILTER: {
3922 u_int32_t control_unit = 0;
3923 if (necp_policy_get_result_parameter(policy, (u_int8_t *)&control_unit, sizeof(control_unit))) {
3924 ultimate_result_parameter.flow_divert_control_unit = control_unit;
3925 }
3926 socket_layer_non_id_conditions = TRUE;
3927 break;
3928 }
3929 case NECP_POLICY_RESULT_IP_TUNNEL: {
3930 struct necp_policy_result_ip_tunnel tunnel_parameters;
3931 u_int32_t tunnel_parameters_length = necp_policy_get_result_parameter_length(policy);
3932 if (tunnel_parameters_length > sizeof(u_int32_t) &&
3933 tunnel_parameters_length <= sizeof(struct necp_policy_result_ip_tunnel) &&
3934 necp_policy_get_result_parameter(policy, (u_int8_t *)&tunnel_parameters, sizeof(tunnel_parameters))) {
3935 ifnet_t tunnel_interface = NULL;
3936 tunnel_parameters.interface_name[tunnel_parameters_length - sizeof(u_int32_t) - 1] = 0; // Make sure the string is NULL terminated
3937 if (ifnet_find_by_name(tunnel_parameters.interface_name, &tunnel_interface) == 0) {
3938 ultimate_result_parameter.tunnel_interface_index = tunnel_interface->if_index;
3939 ifnet_release(tunnel_interface);
fe8ab488
A		 3940 }
3941
0a7de745
A		 3942 secondary_result = tunnel_parameters.secondary_result;
3943 if (secondary_result) {
3944 cond_last_interface_index = ultimate_result_parameter.tunnel_interface_index;
fe8ab488 3945 }
fe8ab488 3946 }
0a7de745
A		 3947
3948 if (socket_only_conditions) { // socket_ip_conditions can be TRUE or FALSE
3949 socket_layer_non_id_conditions = TRUE;
3950 ip_output_layer_id_condition = TRUE;
3951 if (secondary_result) {
3952 ip_output_layer_tunnel_condition_from_id = TRUE;
3953 }
3954 } else if (socket_ip_conditions) {
3955 socket_layer_non_id_conditions = TRUE;
3956 ip_output_layer_id_condition = TRUE;
3957 ip_output_layer_non_id_conditions = TRUE;
3958 if (secondary_result) {
3959 ip_output_layer_tunnel_condition_from_id = TRUE;
3960 ip_output_layer_tunnel_condition_from_non_id = TRUE;
3961 }
3962 }
3963 break;
3964 }
3965 case NECP_POLICY_RESULT_TRIGGER:
3966 case NECP_POLICY_RESULT_TRIGGER_IF_NEEDED:
3967 case NECP_POLICY_RESULT_TRIGGER_SCOPED:
3968 case NECP_POLICY_RESULT_NO_TRIGGER_SCOPED: {
3969 struct necp_policy_result_service service_parameters;
3970 u_int32_t service_result_length = necp_policy_get_result_parameter_length(policy);
3971 bool has_extra_service_data = FALSE;
3972 if (service_result_length >= (sizeof(service_parameters))) {
3973 has_extra_service_data = TRUE;
3974 }
3975 if (necp_policy_get_result_parameter(policy, (u_int8_t *)&service_parameters, sizeof(service_parameters))) {
3976 ultimate_result_parameter.service.identifier = necp_create_uuid_service_id_mapping(service_parameters.identifier);
3977 if (ultimate_result_parameter.service.identifier != 0) {
3978 uuid_copy(policy->applied_result_uuid, service_parameters.identifier);
3979 socket_layer_non_id_conditions = TRUE;
3980 if (has_extra_service_data) {
3981 ultimate_result_parameter.service.data = service_parameters.data;
3982 } else {
3983 ultimate_result_parameter.service.data = 0;
fe8ab488
A		 3984 }
3985 }
fe8ab488 3986 }
0a7de745
A		 3987 break;
3988 }
3989 case NECP_POLICY_RESULT_USE_NETAGENT:
3990 case NECP_POLICY_RESULT_NETAGENT_SCOPED: {
3991 uuid_t netagent_uuid;
3992 if (necp_policy_get_result_parameter(policy, (u_int8_t *)&netagent_uuid, sizeof(netagent_uuid))) {
3993 ultimate_result_parameter.netagent_id = necp_create_uuid_service_id_mapping(netagent_uuid);
3994 if (ultimate_result_parameter.netagent_id != 0) {
3995 uuid_copy(policy->applied_result_uuid, netagent_uuid);
3996 socket_layer_non_id_conditions = TRUE;
3e170ce0 3997 }
3e170ce0 3998 }
0a7de745
A		 3999 break;
4000 }
4001 case NECP_POLICY_RESULT_SOCKET_SCOPED: {
4002 u_int32_t interface_name_length = necp_policy_get_result_parameter_length(policy);
4003 if (interface_name_length <= IFXNAMSIZ && interface_name_length > 0) {
4004 char interface_name[IFXNAMSIZ];
4005 ifnet_t scope_interface = NULL;
4006 necp_policy_get_result_parameter(policy, (u_int8_t *)interface_name, interface_name_length);
4007 interface_name[interface_name_length - 1] = 0; // Make sure the string is NULL terminated
4008 if (ifnet_find_by_name(interface_name, &scope_interface) == 0) {
4009 ultimate_result_parameter.scoped_interface_index = scope_interface->if_index;
4010 socket_layer_non_id_conditions = TRUE;
4011 ifnet_release(scope_interface);
fe8ab488 4012 }
d9a64523 4013 }
0a7de745
A		 4014 break;
4015 }
4016 case NECP_POLICY_RESULT_SCOPED_DIRECT: {
4017 socket_layer_non_id_conditions = TRUE;
4018 break;
4019 }
4020 case NECP_POLICY_RESULT_ROUTE_RULES: {
4021 if (policy->route_rules != NULL && policy->route_rules_size > 0) {
4022 u_int32_t route_rule_id = necp_create_route_rule(&necp_route_rules, policy->route_rules, policy->route_rules_size);
4023 if (route_rule_id > 0) {
4024 policy->applied_route_rules_id = route_rule_id;
4025 ultimate_result_parameter.route_rule_id = route_rule_id;
4026 socket_layer_non_id_conditions = TRUE;
3e170ce0 4027 }
fe8ab488 4028 }
0a7de745
A		 4029 break;
4030 }
4031 default: {
4032 break;
4033 }
fe8ab488
A		 4034 }
4035
4036 if (socket_layer_non_id_conditions) {
d9a64523 4037 necp_kernel_policy_id policy_id = necp_kernel_socket_policy_add(policy->order, session->session_order, session->proc_pid, master_condition_mask, master_condition_negated_mask, cond_app_id, cond_real_app_id, cond_custom_entitlement, cond_account_id, cond_domain, cond_pid, cond_uid, cond_bound_interface, cond_traffic_class, cond_protocol, &cond_local_start, &cond_local_end, cond_local_prefix, &cond_remote_start, &cond_remote_end, cond_remote_prefix, &cond_agent_type, ultimate_result, ultimate_result_parameter);
fe8ab488
A		 4038
4039 if (policy_id == 0) {
4040 NECPLOG0(LOG_DEBUG, "Error applying socket kernel policy");
4041 goto fail;
4042 }
4043
4044 cond_ip_output_layer_id = policy_id;
4045 policy->kernel_socket_policies[0] = policy_id;
4046 }
4047
4048 if (ip_output_layer_non_id_conditions) {
39037602
A		 4049 u_int32_t condition_mask = master_condition_mask;
4050 if (ip_output_layer_non_id_only) {
4051 condition_mask |= NECP_KERNEL_CONDITION_POLICY_ID;
4052 }
d9a64523 4053 necp_kernel_policy_id policy_id = necp_kernel_ip_output_policy_add(policy->order, NECP_KERNEL_POLICY_SUBORDER_NON_ID_CONDITIONS, session->session_order, session->proc_pid, condition_mask, master_condition_negated_mask, NECP_KERNEL_POLICY_ID_NONE, cond_bound_interface, 0, cond_protocol, &cond_local_start, &cond_local_end, cond_local_prefix, &cond_remote_start, &cond_remote_end, cond_remote_prefix, ultimate_result, ultimate_result_parameter);
fe8ab488
A		 4054
4055 if (policy_id == 0) {
4056 NECPLOG0(LOG_DEBUG, "Error applying IP output kernel policy");
4057 goto fail;
4058 }
4059
4060 policy->kernel_ip_output_policies[NECP_KERNEL_POLICY_SUBORDER_NON_ID_CONDITIONS] = policy_id;
4061 }
4062
4063 if (ip_output_layer_id_condition) {
d9a64523 4064 necp_kernel_policy_id policy_id = necp_kernel_ip_output_policy_add(policy->order, NECP_KERNEL_POLICY_SUBORDER_ID_CONDITION, session->session_order, session->proc_pid, NECP_KERNEL_CONDITION_POLICY_ID | NECP_KERNEL_CONDITION_ALL_INTERFACES, 0, cond_ip_output_layer_id, NULL, 0, 0, NULL, NULL, 0, NULL, NULL, 0, ultimate_result, ultimate_result_parameter);
fe8ab488
A		 4065
4066 if (policy_id == 0) {
4067 NECPLOG0(LOG_DEBUG, "Error applying IP output kernel policy");
4068 goto fail;
4069 }
4070
4071 policy->kernel_ip_output_policies[NECP_KERNEL_POLICY_SUBORDER_ID_CONDITION] = policy_id;
4072 }
4073
4074 // Extra policies for IP Output tunnels for when packets loop back
4075 if (ip_output_layer_tunnel_condition_from_id) {
d9a64523 4076 necp_kernel_policy_id policy_id = necp_kernel_ip_output_policy_add(policy->order, NECP_KERNEL_POLICY_SUBORDER_NON_ID_TUNNEL_CONDITION, session->session_order, session->proc_pid, NECP_KERNEL_CONDITION_POLICY_ID | NECP_KERNEL_CONDITION_LAST_INTERFACE | NECP_KERNEL_CONDITION_ALL_INTERFACES, 0, policy->kernel_ip_output_policies[NECP_KERNEL_POLICY_SUBORDER_NON_ID_CONDITIONS], NULL, cond_last_interface_index, 0, NULL, NULL, 0, NULL, NULL, 0, secondary_result, secondary_result_parameter);
fe8ab488
A		 4077
4078 if (policy_id == 0) {
4079 NECPLOG0(LOG_DEBUG, "Error applying IP output kernel policy");
4080 goto fail;
4081 }
4082
4083 policy->kernel_ip_output_policies[NECP_KERNEL_POLICY_SUBORDER_NON_ID_TUNNEL_CONDITION] = policy_id;
4084 }
4085
4086 if (ip_output_layer_tunnel_condition_from_id) {
d9a64523 4087 necp_kernel_policy_id policy_id = necp_kernel_ip_output_policy_add(policy->order, NECP_KERNEL_POLICY_SUBORDER_ID_TUNNEL_CONDITION, session->session_order, session->proc_pid, NECP_KERNEL_CONDITION_POLICY_ID | NECP_KERNEL_CONDITION_LAST_INTERFACE | NECP_KERNEL_CONDITION_ALL_INTERFACES, 0, policy->kernel_ip_output_policies[NECP_KERNEL_POLICY_SUBORDER_ID_CONDITION], NULL, cond_last_interface_index, 0, NULL, NULL, 0, NULL, NULL, 0, secondary_result, secondary_result_parameter);
fe8ab488
A		 4088
4089 if (policy_id == 0) {
4090 NECPLOG0(LOG_DEBUG, "Error applying IP output kernel policy");
4091 goto fail;
4092 }
4093
4094 policy->kernel_ip_output_policies[NECP_KERNEL_POLICY_SUBORDER_ID_TUNNEL_CONDITION] = policy_id;
4095 }
4096
4097 policy->applied = TRUE;
4098 policy->pending_update = FALSE;
0a7de745 4099 return TRUE;
fe8ab488
A		 4100
4101fail:
0a7de745 4102 return FALSE;
fe8ab488
A		 4103}
4104
4105static void
4106necp_policy_apply_all(struct necp_session *session)
4107{
4108 struct necp_session_policy *policy = NULL;
4109 struct necp_session_policy *temp_policy = NULL;
3e170ce0
A		 4110 struct kev_necp_policies_changed_data kev_data;
4111 kev_data.changed_count = 0;
fe8ab488
A		 4112
4113 lck_rw_lock_exclusive(&necp_kernel_policy_lock);
4114
4115 // Remove exisiting applied policies
4116 if (session->dirty) {
4117 LIST_FOREACH_SAFE(policy, &session->policies, chain, temp_policy) {
4118 if (policy->pending_deletion) {
4119 if (policy->applied) {
4120 necp_policy_unapply(policy);
4121 }
4122 // Delete the policy
4123 necp_policy_delete(session, policy);
4124 } else if (!policy->applied) {
4125 necp_policy_apply(session, policy);
4126 } else if (policy->pending_update) {
4127 // Must have been applied, but needs an update. Remove and re-add.
4128 necp_policy_unapply(policy);
4129 necp_policy_apply(session, policy);
4130 }
4131 }
4132
4133 necp_kernel_socket_policies_update_uuid_table();
4134 necp_kernel_socket_policies_reprocess();
4135 necp_kernel_ip_output_policies_reprocess();
4136
4137 // Clear dirty bit flags
4138 session->dirty = FALSE;
4139 }
4140
4141 lck_rw_done(&necp_kernel_policy_lock);
4142
39037602 4143 necp_update_all_clients();
3e170ce0
A		 4144 necp_post_change_event(&kev_data);
4145
fe8ab488
A		 4146 if (necp_debug) {
4147 NECPLOG0(LOG_DEBUG, "Applied NECP policies");
4148 }
4149}
4150
4151// Kernel Policy Management
4152// ---------------------
4153// Kernel policies are derived from session policies
4154static necp_kernel_policy_id
5ba3f43e 4155necp_kernel_policy_get_new_id(bool socket_level)
fe8ab488 4156{
5ba3f43e
A		 4157 static necp_kernel_policy_id necp_last_kernel_socket_policy_id = 0;
4158 static necp_kernel_policy_id necp_last_kernel_ip_policy_id = 0;
4159
fe8ab488
A		 4160 necp_kernel_policy_id newid = NECP_KERNEL_POLICY_ID_NONE;
4161
5ba3f43e 4162 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
fe8ab488 4163
5ba3f43e 4164 if (socket_level) {
d26ffc64
A		 4165 bool wrapped = FALSE;
4166 do {
4167 necp_last_kernel_socket_policy_id++;
4168 if (necp_last_kernel_socket_policy_id < NECP_KERNEL_POLICY_ID_FIRST_VALID_SOCKET ||
0a7de745 4169 necp_last_kernel_socket_policy_id >= NECP_KERNEL_POLICY_ID_FIRST_VALID_IP) {
d26ffc64
A		 4170 if (wrapped) {
4171 // Already wrapped, give up
4172 NECPLOG0(LOG_ERR, "Failed to find a free socket kernel policy ID.\n");
0a7de745 4173 return NECP_KERNEL_POLICY_ID_NONE;
d26ffc64
A		 4174 }
4175 necp_last_kernel_socket_policy_id = NECP_KERNEL_POLICY_ID_FIRST_VALID_SOCKET;
4176 wrapped = TRUE;
4177 }
4178 newid = necp_last_kernel_socket_policy_id;
4179 } while (necp_kernel_socket_policy_find(newid) != NULL); // If already used, keep trying
5ba3f43e 4180 } else {
d26ffc64
A		 4181 bool wrapped = FALSE;
4182 do {
4183 necp_last_kernel_ip_policy_id++;
4184 if (necp_last_kernel_ip_policy_id < NECP_KERNEL_POLICY_ID_FIRST_VALID_IP) {
4185 if (wrapped) {
4186 // Already wrapped, give up
4187 NECPLOG0(LOG_ERR, "Failed to find a free IP kernel policy ID.\n");
0a7de745 4188 return NECP_KERNEL_POLICY_ID_NONE;
d26ffc64
A		 4189 }
4190 necp_last_kernel_ip_policy_id = NECP_KERNEL_POLICY_ID_FIRST_VALID_IP;
4191 wrapped = TRUE;
4192 }
4193 newid = necp_last_kernel_ip_policy_id;
4194 } while (necp_kernel_ip_output_policy_find(newid) != NULL); // If already used, keep trying
fe8ab488
A		 4195 }
4196
fe8ab488 4197 if (newid == NECP_KERNEL_POLICY_ID_NONE) {
d26ffc64 4198 NECPLOG0(LOG_ERR, "Allocate kernel policy id failed.\n");
0a7de745 4199 return NECP_KERNEL_POLICY_ID_NONE;
fe8ab488
A		 4200 }
4201
0a7de745 4202 return newid;
fe8ab488
A		 4203}
4204
0a7de745 4205#define NECP_KERNEL_VALID_SOCKET_CONDITIONS (NECP_KERNEL_CONDITION_APP_ID | NECP_KERNEL_CONDITION_REAL_APP_ID | NECP_KERNEL_CONDITION_DOMAIN | NECP_KERNEL_CONDITION_ACCOUNT_ID | NECP_KERNEL_CONDITION_PID | NECP_KERNEL_CONDITION_UID | NECP_KERNEL_CONDITION_ALL_INTERFACES | NECP_KERNEL_CONDITION_BOUND_INTERFACE | NECP_KERNEL_CONDITION_TRAFFIC_CLASS | NECP_KERNEL_CONDITION_PROTOCOL | NECP_KERNEL_CONDITION_LOCAL_START | NECP_KERNEL_CONDITION_LOCAL_END | NECP_KERNEL_CONDITION_LOCAL_PREFIX | NECP_KERNEL_CONDITION_REMOTE_START | NECP_KERNEL_CONDITION_REMOTE_END | NECP_KERNEL_CONDITION_REMOTE_PREFIX | NECP_KERNEL_CONDITION_ENTITLEMENT | NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT | NECP_KERNEL_CONDITION_AGENT_TYPE)
fe8ab488 4206static necp_kernel_policy_id
d9a64523 4207necp_kernel_socket_policy_add(necp_policy_order order, u_int32_t session_order, int session_pid, u_int32_t condition_mask, u_int32_t condition_negated_mask, necp_app_id cond_app_id, necp_app_id cond_real_app_id, char *cond_custom_entitlement, u_int32_t cond_account_id, char *cond_domain, pid_t cond_pid, uid_t cond_uid, ifnet_t cond_bound_interface, struct necp_policy_condition_tc_range cond_traffic_class, u_int16_t cond_protocol, union necp_sockaddr_union *cond_local_start, union necp_sockaddr_union *cond_local_end, u_int8_t cond_local_prefix, union necp_sockaddr_union *cond_remote_start, union necp_sockaddr_union *cond_remote_end, u_int8_t cond_remote_prefix, struct necp_policy_condition_agent_type *cond_agent_type, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter)
fe8ab488
A		 4208{
4209 struct necp_kernel_socket_policy *new_kernel_policy = NULL;
4210 struct necp_kernel_socket_policy *tmp_kernel_policy = NULL;
4211
4212 MALLOC_ZONE(new_kernel_policy, struct necp_kernel_socket_policy *, sizeof(*new_kernel_policy), M_NECP_SOCKET_POLICY, M_WAITOK);
4213 if (new_kernel_policy == NULL) {
4214 goto done;
4215 }
4216
5ba3f43e 4217 memset(new_kernel_policy, 0, sizeof(*new_kernel_policy)); // M_ZERO is not supported for MALLOC_ZONE
5ba3f43e 4218 new_kernel_policy->id = necp_kernel_policy_get_new_id(true);
fe8ab488
A		 4219 new_kernel_policy->order = order;
4220 new_kernel_policy->session_order = session_order;
3e170ce0 4221 new_kernel_policy->session_pid = session_pid;
fe8ab488
A		 4222
4223 // Sanitize condition mask
4224 new_kernel_policy->condition_mask = (condition_mask & NECP_KERNEL_VALID_SOCKET_CONDITIONS);
4225 if ((new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_ALL_INTERFACES) && (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE)) {
4226 new_kernel_policy->condition_mask &= ~NECP_KERNEL_CONDITION_BOUND_INTERFACE;
4227 }
4228 if ((new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REAL_APP_ID) && !(new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_APP_ID)) {
4229 new_kernel_policy->condition_mask &= ~NECP_KERNEL_CONDITION_REAL_APP_ID;
4230 }
4231 if ((new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_ENTITLEMENT) && !(new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_APP_ID)) {
4232 new_kernel_policy->condition_mask &= ~NECP_KERNEL_CONDITION_ENTITLEMENT;
4233 }
4234 if ((new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_END) && (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_PREFIX)) {
4235 new_kernel_policy->condition_mask &= ~NECP_KERNEL_CONDITION_LOCAL_PREFIX;
4236 }
4237 if ((new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_END) && (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX)) {
4238 new_kernel_policy->condition_mask &= ~NECP_KERNEL_CONDITION_REMOTE_PREFIX;
4239 }
4240 new_kernel_policy->condition_negated_mask = condition_negated_mask & new_kernel_policy->condition_mask;
4241
4242 // Set condition values
4243 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_APP_ID) {
4244 new_kernel_policy->cond_app_id = cond_app_id;
4245 }
4246 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REAL_APP_ID) {
4247 new_kernel_policy->cond_real_app_id = cond_real_app_id;
4248 }
39037602
A		 4249 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT) {
4250 new_kernel_policy->cond_custom_entitlement = cond_custom_entitlement;
813fb2f6 4251 new_kernel_policy->cond_custom_entitlement_matched = necp_boolean_state_unknown;
39037602 4252 }
fe8ab488
A		 4253 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_ACCOUNT_ID) {
4254 new_kernel_policy->cond_account_id = cond_account_id;
4255 }
4256 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_DOMAIN) {
4257 new_kernel_policy->cond_domain = cond_domain;
4258 new_kernel_policy->cond_domain_dot_count = necp_count_dots(cond_domain, strlen(cond_domain));
4259 }
4260 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_PID) {
4261 new_kernel_policy->cond_pid = cond_pid;
4262 }
4263 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_UID) {
4264 new_kernel_policy->cond_uid = cond_uid;
4265 }
4266 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE) {
4267 if (cond_bound_interface) {
4268 ifnet_reference(cond_bound_interface);
4269 }
4270 new_kernel_policy->cond_bound_interface = cond_bound_interface;
4271 }
4272 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_TRAFFIC_CLASS) {
4273 new_kernel_policy->cond_traffic_class = cond_traffic_class;
4274 }
4275 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_PROTOCOL) {
4276 new_kernel_policy->cond_protocol = cond_protocol;
4277 }
4278 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_START) {
4279 memcpy(&new_kernel_policy->cond_local_start, cond_local_start, cond_local_start->sa.sa_len);
4280 }
4281 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_END) {
4282 memcpy(&new_kernel_policy->cond_local_end, cond_local_end, cond_local_end->sa.sa_len);
4283 }
4284 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_PREFIX) {
4285 new_kernel_policy->cond_local_prefix = cond_local_prefix;
4286 }
4287 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_START) {
4288 memcpy(&new_kernel_policy->cond_remote_start, cond_remote_start, cond_remote_start->sa.sa_len);
4289 }
4290 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_END) {
4291 memcpy(&new_kernel_policy->cond_remote_end, cond_remote_end, cond_remote_end->sa.sa_len);
4292 }
4293 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX) {
4294 new_kernel_policy->cond_remote_prefix = cond_remote_prefix;
4295 }
d9a64523
A		 4296 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_AGENT_TYPE) {
4297 memcpy(&new_kernel_policy->cond_agent_type, cond_agent_type, sizeof(*cond_agent_type));
4298 }
fe8ab488
A		 4299
4300 new_kernel_policy->result = result;
4301 memcpy(&new_kernel_policy->result_parameter, &result_parameter, sizeof(result_parameter));
4302
4303 if (necp_debug) {
4304 NECPLOG(LOG_DEBUG, "Added kernel policy: socket, id=%d, mask=%x\n", new_kernel_policy->id, new_kernel_policy->condition_mask);
4305 }
4306 LIST_INSERT_SORTED_TWICE_ASCENDING(&necp_kernel_socket_policies, new_kernel_policy, chain, session_order, order, tmp_kernel_policy);
4307done:
0a7de745 4308 return new_kernel_policy ? new_kernel_policy->id : 0;
fe8ab488
A		 4309}
4310
4311static struct necp_kernel_socket_policy *
4312necp_kernel_socket_policy_find(necp_kernel_policy_id policy_id)
4313{
4314 struct necp_kernel_socket_policy *kernel_policy = NULL;
4315 struct necp_kernel_socket_policy *tmp_kernel_policy = NULL;
4316
4317 if (policy_id == 0) {
0a7de745 4318 return NULL;
fe8ab488
A		 4319 }
4320
4321 LIST_FOREACH_SAFE(kernel_policy, &necp_kernel_socket_policies, chain, tmp_kernel_policy) {
4322 if (kernel_policy->id == policy_id) {
0a7de745 4323 return kernel_policy;
fe8ab488
A		 4324 }
4325 }
4326
0a7de745 4327 return NULL;
fe8ab488
A		 4328}
4329
4330static bool
4331necp_kernel_socket_policy_delete(necp_kernel_policy_id policy_id)
4332{
4333 struct necp_kernel_socket_policy *policy = NULL;
4334
5ba3f43e 4335 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
fe8ab488
A		 4336
4337 policy = necp_kernel_socket_policy_find(policy_id);
4338 if (policy) {
4339 LIST_REMOVE(policy, chain);
4340
4341 if (policy->cond_bound_interface) {
4342 ifnet_release(policy->cond_bound_interface);
4343 policy->cond_bound_interface = NULL;
4344 }
39037602 4345
fe8ab488
A		 4346 if (policy->cond_domain) {
4347 FREE(policy->cond_domain, M_NECP);
4348 policy->cond_domain = NULL;
4349 }
4350
39037602
A		 4351 if (policy->cond_custom_entitlement) {
4352 FREE(policy->cond_custom_entitlement, M_NECP);
4353 policy->cond_custom_entitlement = NULL;
4354 }
4355
fe8ab488 4356 FREE_ZONE(policy, sizeof(*policy), M_NECP_SOCKET_POLICY);
0a7de745 4357 return TRUE;
fe8ab488
A		 4358 }
4359
0a7de745 4360 return FALSE;
fe8ab488
A		 4361}
4362
3e170ce0
A		 4363static inline const char *
4364necp_get_result_description(char *result_string, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter)
4365{
4366 uuid_string_t uuid_string;
4367 switch (result) {
0a7de745
A		 4368 case NECP_KERNEL_POLICY_RESULT_NONE: {
4369 snprintf(result_string, MAX_RESULT_STRING_LEN, "None");
4370 break;
4371 }
4372 case NECP_KERNEL_POLICY_RESULT_PASS: {
4373 snprintf(result_string, MAX_RESULT_STRING_LEN, "Pass");
4374 break;
4375 }
4376 case NECP_KERNEL_POLICY_RESULT_SKIP: {
4377 snprintf(result_string, MAX_RESULT_STRING_LEN, "Skip (%u)", result_parameter.skip_policy_order);
4378 break;
4379 }
4380 case NECP_KERNEL_POLICY_RESULT_DROP: {
4381 snprintf(result_string, MAX_RESULT_STRING_LEN, "Drop");
4382 break;
4383 }
4384 case NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT: {
4385 snprintf(result_string, MAX_RESULT_STRING_LEN, "SocketDivert (%d)", result_parameter.flow_divert_control_unit);
4386 break;
4387 }
4388 case NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER: {
4389 snprintf(result_string, MAX_RESULT_STRING_LEN, "SocketFilter (%d)", result_parameter.filter_control_unit);
4390 break;
4391 }
4392 case NECP_KERNEL_POLICY_RESULT_IP_TUNNEL: {
4393 ifnet_t interface = ifindex2ifnet[result_parameter.tunnel_interface_index];
4394 snprintf(result_string, MAX_RESULT_STRING_LEN, "IPTunnel (%s%d)", ifnet_name(interface), ifnet_unit(interface));
4395 break;
4396 }
4397 case NECP_KERNEL_POLICY_RESULT_IP_FILTER: {
4398 snprintf(result_string, MAX_RESULT_STRING_LEN, "IPFilter");
4399 break;
4400 }
4401 case NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED: {
4402 ifnet_t interface = ifindex2ifnet[result_parameter.scoped_interface_index];
4403 snprintf(result_string, MAX_RESULT_STRING_LEN, "SocketScoped (%s%d)", ifnet_name(interface), ifnet_unit(interface));
4404 break;
4405 }
4406 case NECP_KERNEL_POLICY_RESULT_SCOPED_DIRECT: {
4407 snprintf(result_string, MAX_RESULT_STRING_LEN, "ScopedDirect");
4408 break;
4409 }
4410 case NECP_KERNEL_POLICY_RESULT_ROUTE_RULES: {
4411 int index = 0;
4412 char interface_names[IFXNAMSIZ][MAX_ROUTE_RULE_INTERFACES];
4413 struct necp_route_rule *route_rule = necp_lookup_route_rule_locked(&necp_route_rules, result_parameter.route_rule_id);
4414 if (route_rule != NULL) {
4415 for (index = 0; index < MAX_ROUTE_RULE_INTERFACES; index++) {
4416 if (route_rule->exception_if_indices[index] != 0) {
4417 ifnet_t interface = ifindex2ifnet[route_rule->exception_if_indices[index]];
4418 snprintf(interface_names[index], IFXNAMSIZ, "%s%d", ifnet_name(interface), ifnet_unit(interface));
4419 } else {
4420 memset(interface_names[index], 0, IFXNAMSIZ);
4421 }
4422 }
4423 switch (route_rule->default_action) {
4424 case NECP_ROUTE_RULE_DENY_INTERFACE:
4425 snprintf(result_string, MAX_RESULT_STRING_LEN, "RouteRules (Only %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s)",
4426 (route_rule->cellular_action == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? "Cell " : "",
4427 (route_rule->wifi_action == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? "WiFi " : "",
4428 (route_rule->wired_action == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? "Wired " : "",
4429 (route_rule->expensive_action == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? "Exp " : "",
4430 (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[0] : "",
4431 (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "",
4432 (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[1] : "",
4433 (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "",
4434 (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[2] : "",
4435 (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "",
4436 (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[3] : "",
4437 (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "",
4438 (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[4] : "",
4439 (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "",
4440 (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[5] : "",
4441 (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "",
4442 (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[6] : "",
4443 (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "",
4444 (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[7] : "",
4445 (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "",
4446 (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[8] : "",
4447 (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "",
4448 (route_rule->exception_if_actions[9] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[9] : "");
4449 break;
4450 case NECP_ROUTE_RULE_ALLOW_INTERFACE:
4451 snprintf(result_string, MAX_RESULT_STRING_LEN, "RouteRules (%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s)",
4452 (route_rule->cellular_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!Cell " : "",
4453 (route_rule->wifi_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!WiFi " : "",
4454 (route_rule->wired_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!Wired " : "",
4455 (route_rule->expensive_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!Exp " : "",
4456 (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "",
4457 (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[0] : "",
4458 (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "",
4459 (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[1] : "",
4460 (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "",
4461 (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[2] : "",
4462 (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "",
4463 (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[3] : "",
4464 (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "",
4465 (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[4] : "",
4466 (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "",
4467 (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[5] : "",
4468 (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "",
4469 (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[6] : "",
4470 (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "",
4471 (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[7] : "",
4472 (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "",
4473 (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[8] : "",
4474 (route_rule->exception_if_actions[9] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "",
4475 (route_rule->exception_if_actions[9] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[9] : "");
4476 break;
4477 case NECP_ROUTE_RULE_QOS_MARKING:
4478 snprintf(result_string, MAX_RESULT_STRING_LEN, "RouteRules (QoSMarking %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s)",
4479 (route_rule->cellular_action == NECP_ROUTE_RULE_QOS_MARKING) ? "Cell " : "",
4480 (route_rule->wifi_action == NECP_ROUTE_RULE_QOS_MARKING) ? "WiFi " : "",
4481 (route_rule->wired_action == NECP_ROUTE_RULE_QOS_MARKING) ? "Wired " : "",
4482 (route_rule->expensive_action == NECP_ROUTE_RULE_QOS_MARKING) ? "Exp " : "",
4483 (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[0] : "",
4484 (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "",
4485 (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[1] : "",
4486 (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "",
4487 (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[2] : "",
4488 (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "",
4489 (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[3] : "",
4490 (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "",
4491 (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[4] : "",
4492 (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "",
4493 (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[5] : "",
4494 (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "",
4495 (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[6] : "",
4496 (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "",
4497 (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[7] : "",
4498 (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "",
4499 (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[8] : "",
4500 (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "",
4501 (route_rule->exception_if_actions[9] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[9] : "");
4502 break;
4503 default:
4504 snprintf(result_string, MAX_RESULT_STRING_LEN, "RouteRules (Unknown)");
4505 break;
3e170ce0 4506 }
3e170ce0 4507 }
0a7de745
A		 4508 break;
4509 }
4510 case NECP_KERNEL_POLICY_RESULT_USE_NETAGENT: {
4511 bool found_mapping = FALSE;
4512 struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.netagent_id);
4513 if (mapping != NULL) {
4514 uuid_unparse(mapping->uuid, uuid_string);
4515 found_mapping = TRUE;
d9a64523 4516 }
0a7de745
A		 4517 snprintf(result_string, MAX_RESULT_STRING_LEN, "UseNetAgent (%s)", found_mapping ? uuid_string : "Unknown");
4518 break;
4519 }
4520 case NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED: {
4521 bool found_mapping = FALSE;
4522 struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.netagent_id);
4523 if (mapping != NULL) {
4524 uuid_unparse(mapping->uuid, uuid_string);
4525 found_mapping = TRUE;
3e170ce0 4526 }
0a7de745
A		 4527 snprintf(result_string, MAX_RESULT_STRING_LEN, "NetAgentScoped (%s)", found_mapping ? uuid_string : "Unknown");
4528 break;
4529 }
4530 case NECP_POLICY_RESULT_TRIGGER: {
4531 bool found_mapping = FALSE;
4532 struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.service.identifier);
4533 if (mapping != NULL) {
4534 uuid_unparse(mapping->uuid, uuid_string);
4535 found_mapping = TRUE;
3e170ce0 4536 }
0a7de745
A		 4537 snprintf(result_string, MAX_RESULT_STRING_LEN, "Trigger (%s.%d)", found_mapping ? uuid_string : "Unknown", result_parameter.service.data);
4538 break;
4539 }
4540 case NECP_POLICY_RESULT_TRIGGER_IF_NEEDED: {
4541 bool found_mapping = FALSE;
4542 struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.service.identifier);
4543 if (mapping != NULL) {
4544 uuid_unparse(mapping->uuid, uuid_string);
4545 found_mapping = TRUE;
3e170ce0 4546 }
0a7de745
A		 4547 snprintf(result_string, MAX_RESULT_STRING_LEN, "TriggerIfNeeded (%s.%d)", found_mapping ? uuid_string : "Unknown", result_parameter.service.data);
4548 break;
4549 }
4550 case NECP_POLICY_RESULT_TRIGGER_SCOPED: {
4551 bool found_mapping = FALSE;
4552 struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.service.identifier);
4553 if (mapping != NULL) {
4554 uuid_unparse(mapping->uuid, uuid_string);
4555 found_mapping = TRUE;
3e170ce0 4556 }
0a7de745
A		 4557 snprintf(result_string, MAX_RESULT_STRING_LEN, "TriggerScoped (%s.%d)", found_mapping ? uuid_string : "Unknown", result_parameter.service.data);
4558 break;
4559 }
4560 case NECP_POLICY_RESULT_NO_TRIGGER_SCOPED: {
4561 bool found_mapping = FALSE;
4562 struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.service.identifier);
4563 if (mapping != NULL) {
4564 uuid_unparse(mapping->uuid, uuid_string);
4565 found_mapping = TRUE;
3e170ce0 4566 }
0a7de745
A		 4567 snprintf(result_string, MAX_RESULT_STRING_LEN, "NoTriggerScoped (%s.%d)", found_mapping ? uuid_string : "Unknown", result_parameter.service.data);
4568 break;
4569 }
4570 default: {
4571 snprintf(result_string, MAX_RESULT_STRING_LEN, "Unknown %d (%d)", result, result_parameter.tunnel_interface_index);
4572 break;
3e170ce0 4573 }
0a7de745
A		 4574 }
4575 return result_string;
3e170ce0
A		 4576}
4577
fe8ab488
A		 4578static void
4579necp_kernel_socket_policies_dump_all(void)
4580{
fe8ab488 4581 if (necp_debug) {
3e170ce0
A		 4582 struct necp_kernel_socket_policy *policy = NULL;
4583 int policy_i;
4584 int app_i;
4585 char result_string[MAX_RESULT_STRING_LEN];
4586 char proc_name_string[MAXCOMLEN + 1];
4587 memset(result_string, 0, MAX_RESULT_STRING_LEN);
4588 memset(proc_name_string, 0, MAXCOMLEN + 1);
4589
fe8ab488
A		 4590 NECPLOG0(LOG_DEBUG, "NECP Application Policies:\n");
4591 NECPLOG0(LOG_DEBUG, "-----------\n");
4592 for (policy_i = 0; necp_kernel_socket_policies_app_layer_map != NULL && necp_kernel_socket_policies_app_layer_map[policy_i] != NULL; policy_i++) {
4593 policy = necp_kernel_socket_policies_app_layer_map[policy_i];
3e170ce0
A		 4594 proc_name(policy->session_pid, proc_name_string, MAXCOMLEN);
4595 NECPLOG(LOG_DEBUG, "\t%3d. Policy ID: %5d\tProcess: %10.10s\tOrder: %04d.%04d\tMask: %5x\tResult: %s\n", policy_i, policy->id, proc_name_string, policy->session_order, policy->order, policy->condition_mask, necp_get_result_description(result_string, policy->result, policy->result_parameter));
fe8ab488
A		 4596 }
4597 if (necp_kernel_socket_policies_app_layer_map[0] != NULL) {
4598 NECPLOG0(LOG_DEBUG, "-----------\n");
4599 }
4600
4601 NECPLOG0(LOG_DEBUG, "NECP Socket Policies:\n");
4602 NECPLOG0(LOG_DEBUG, "-----------\n");
4603 for (app_i = 0; app_i < NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS; app_i++) {
4604 NECPLOG(LOG_DEBUG, "\tApp Bucket: %d\n", app_i);
4605 for (policy_i = 0; necp_kernel_socket_policies_map[app_i] != NULL && (necp_kernel_socket_policies_map[app_i])[policy_i] != NULL; policy_i++) {
4606 policy = (necp_kernel_socket_policies_map[app_i])[policy_i];
3e170ce0
A		 4607 proc_name(policy->session_pid, proc_name_string, MAXCOMLEN);
4608 NECPLOG(LOG_DEBUG, "\t%3d. Policy ID: %5d\tProcess: %10.10s\tOrder: %04d.%04d\tMask: %5x\tResult: %s\n", policy_i, policy->id, proc_name_string, policy->session_order, policy->order, policy->condition_mask, necp_get_result_description(result_string, policy->result, policy->result_parameter));
fe8ab488
A		 4609 }
4610 NECPLOG0(LOG_DEBUG, "-----------\n");
4611 }
4612 }
4613}
4614
4615static inline bool
3e170ce0 4616necp_kernel_socket_result_is_trigger_service_type(struct necp_kernel_socket_policy *kernel_policy)
fe8ab488 4617{
0a7de745 4618 return kernel_policy->result >= NECP_KERNEL_POLICY_RESULT_TRIGGER && kernel_policy->result <= NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED;
fe8ab488
A		 4619}
4620
4621static inline bool
4622necp_kernel_socket_policy_results_overlap(struct necp_kernel_socket_policy *upper_policy, struct necp_kernel_socket_policy *lower_policy)
4623{
4624 if (upper_policy->result == NECP_KERNEL_POLICY_RESULT_DROP) {
4625 // Drop always cancels out lower policies
0a7de745 4626 return TRUE;
3e170ce0 4627 } else if (upper_policy->result == NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER ||
0a7de745
A		 4628 upper_policy->result == NECP_KERNEL_POLICY_RESULT_ROUTE_RULES ||
4629 upper_policy->result == NECP_KERNEL_POLICY_RESULT_USE_NETAGENT ||
4630 upper_policy->result == NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED) {
3e170ce0 4631 // Filters and route rules never cancel out lower policies
0a7de745 4632 return FALSE;
3e170ce0 4633 } else if (necp_kernel_socket_result_is_trigger_service_type(upper_policy)) {
fe8ab488 4634 // Trigger/Scoping policies can overlap one another, but not other results
0a7de745 4635 return necp_kernel_socket_result_is_trigger_service_type(lower_policy);
fe8ab488
A		 4636 } else if (upper_policy->result == NECP_KERNEL_POLICY_RESULT_SKIP) {
4637 if (upper_policy->session_order != lower_policy->session_order) {
4638 // A skip cannot override a policy of a different session
0a7de745 4639 return FALSE;
fe8ab488
A		 4640 } else {
4641 if (upper_policy->result_parameter.skip_policy_order == 0 ||
0a7de745 4642 lower_policy->order >= upper_policy->result_parameter.skip_policy_order) {
fe8ab488 4643 // This policy is beyond the skip
0a7de745 4644 return FALSE;
fe8ab488
A		 4645 } else {
4646 // This policy is inside the skip
0a7de745 4647 return TRUE;
fe8ab488
A		 4648 }
4649 }
4650 }
4651
3e170ce0 4652 // A hard pass, flow divert, tunnel, or scope will currently block out lower policies
0a7de745 4653 return TRUE;
fe8ab488
A		 4654}
4655
4656static bool
4657necp_kernel_socket_policy_is_unnecessary(struct necp_kernel_socket_policy *policy, struct necp_kernel_socket_policy **policy_array, int valid_indices)
4658{
4659 bool can_skip = FALSE;
4660 u_int32_t highest_skip_session_order = 0;
4661 u_int32_t highest_skip_order = 0;
4662 int i;
4663 for (i = 0; i < valid_indices; i++) {
4664 struct necp_kernel_socket_policy *compared_policy = policy_array[i];
4665
4666 // For policies in a skip window, we can't mark conflicting policies as unnecessary
4667 if (can_skip) {
4668 if (highest_skip_session_order != compared_policy->session_order ||
0a7de745 4669 (highest_skip_order != 0 && compared_policy->order >= highest_skip_order)) {
fe8ab488
A		 4670 // If we've moved on to the next session, or passed the skip window
4671 highest_skip_session_order = 0;
4672 highest_skip_order = 0;
4673 can_skip = FALSE;
4674 } else {
4675 // If this policy is also a skip, in can increase the skip window
4676 if (compared_policy->result == NECP_KERNEL_POLICY_RESULT_SKIP) {
4677 if (compared_policy->result_parameter.skip_policy_order > highest_skip_order) {
4678 highest_skip_order = compared_policy->result_parameter.skip_policy_order;
4679 }
4680 }
4681 continue;
4682 }
4683 }
4684
4685 if (compared_policy->result == NECP_KERNEL_POLICY_RESULT_SKIP) {
4686 // This policy is a skip. Set the skip window accordingly
4687 can_skip = TRUE;
4688 highest_skip_session_order = compared_policy->session_order;
4689 highest_skip_order = compared_policy->result_parameter.skip_policy_order;
4690 }
4691
4692 // The result of the compared policy must be able to block out this policy result
4693 if (!necp_kernel_socket_policy_results_overlap(compared_policy, policy)) {
4694 continue;
4695 }
4696
4697 // If new policy matches All Interfaces, compared policy must also
4698 if ((policy->condition_mask & NECP_KERNEL_CONDITION_ALL_INTERFACES) && !(compared_policy->condition_mask & NECP_KERNEL_CONDITION_ALL_INTERFACES)) {
4699 continue;
4700 }
4701
4702 // Default makes lower policies unecessary always
4703 if (compared_policy->condition_mask == 0) {
0a7de745 4704 return TRUE;
fe8ab488
A		 4705 }
4706
4707 // Compared must be more general than policy, and include only conditions within policy
4708 if ((policy->condition_mask & compared_policy->condition_mask) != compared_policy->condition_mask) {
4709 continue;
4710 }
4711
4712 // Negative conditions must match for the overlapping conditions
4713 if ((policy->condition_negated_mask & compared_policy->condition_mask) != (compared_policy->condition_negated_mask & compared_policy->condition_mask)) {
4714 continue;
4715 }
4716
4717 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_DOMAIN &&
0a7de745 4718 strcmp(compared_policy->cond_domain, policy->cond_domain) != 0) {
fe8ab488
A		 4719 continue;
4720 }
4721
39037602 4722 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT &&
0a7de745 4723 strcmp(compared_policy->cond_custom_entitlement, policy->cond_custom_entitlement) != 0) {
39037602
A		 4724 continue;
4725 }
4726
fe8ab488 4727 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_ACCOUNT_ID &&
0a7de745 4728 compared_policy->cond_account_id != policy->cond_account_id) {
fe8ab488
A		 4729 continue;
4730 }
4731
4732 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_POLICY_ID &&
0a7de745 4733 compared_policy->cond_policy_id != policy->cond_policy_id) {
fe8ab488
A		 4734 continue;
4735 }
4736
4737 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_APP_ID &&
0a7de745 4738 compared_policy->cond_app_id != policy->cond_app_id) {
fe8ab488
A		 4739 continue;
4740 }
4741
4742 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_REAL_APP_ID &&
0a7de745 4743 compared_policy->cond_real_app_id != policy->cond_real_app_id) {
fe8ab488
A		 4744 continue;
4745 }
4746
4747 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_PID &&
0a7de745 4748 compared_policy->cond_pid != policy->cond_pid) {
fe8ab488
A		 4749 continue;
4750 }
4751
4752 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_UID &&
0a7de745 4753 compared_policy->cond_uid != policy->cond_uid) {
fe8ab488
A		 4754 continue;
4755 }
4756
4757 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE &&
0a7de745 4758 compared_policy->cond_bound_interface != policy->cond_bound_interface) {
fe8ab488
A		 4759 continue;
4760 }
4761
4762 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_PROTOCOL &&
0a7de745 4763 compared_policy->cond_protocol != policy->cond_protocol) {
fe8ab488
A		 4764 continue;
4765 }
4766
4767 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_TRAFFIC_CLASS &&
0a7de745
A		 4768 !(compared_policy->cond_traffic_class.start_tc <= policy->cond_traffic_class.start_tc &&
4769 compared_policy->cond_traffic_class.end_tc >= policy->cond_traffic_class.end_tc)) {
fe8ab488
A		 4770 continue;
4771 }
4772
4773 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_START) {
4774 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_END) {
4775 if (!necp_is_range_in_range((struct sockaddr *)&policy->cond_local_start, (struct sockaddr *)&policy->cond_local_end, (struct sockaddr *)&compared_policy->cond_local_start, (struct sockaddr *)&compared_policy->cond_local_end)) {
4776 continue;
4777 }
4778 } else if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_PREFIX) {
4779 if (compared_policy->cond_local_prefix > policy->cond_local_prefix ||
0a7de745 4780 !necp_is_addr_in_subnet((struct sockaddr *)&policy->cond_local_start, (struct sockaddr *)&compared_policy->cond_local_start, compared_policy->cond_local_prefix)) {
fe8ab488
A		 4781 continue;
4782 }
4783 }
4784 }
4785
4786 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_START) {
4787 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_END) {
4788 if (!necp_is_range_in_range((struct sockaddr *)&policy->cond_remote_start, (struct sockaddr *)&policy->cond_remote_end, (struct sockaddr *)&compared_policy->cond_remote_start, (struct sockaddr *)&compared_policy->cond_remote_end)) {
4789 continue;
4790 }
4791 } else if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX) {
4792 if (compared_policy->cond_remote_prefix > policy->cond_remote_prefix ||
0a7de745 4793 !necp_is_addr_in_subnet((struct sockaddr *)&policy->cond_remote_start, (struct sockaddr *)&compared_policy->cond_remote_start, compared_policy->cond_remote_prefix)) {
fe8ab488
A		 4794 continue;
4795 }
4796 }
4797 }
4798
d9a64523 4799 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_AGENT_TYPE &&
0a7de745 4800 memcmp(&compared_policy->cond_agent_type, &policy->cond_agent_type, sizeof(policy->cond_agent_type)) == 0) {
d9a64523
A		 4801 continue;
4802 }
4803
0a7de745 4804 return TRUE;
fe8ab488
A		 4805 }
4806
0a7de745 4807 return FALSE;
fe8ab488
A		 4808}
4809
4810static bool
4811necp_kernel_socket_policies_reprocess(void)
4812{
4813 int app_i;
4814 int bucket_allocation_counts[NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS];
4815 int bucket_current_free_index[NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS];
4816 int app_layer_allocation_count = 0;
4817 int app_layer_current_free_index = 0;
4818 struct necp_kernel_socket_policy *kernel_policy = NULL;
4819
5ba3f43e 4820 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
fe8ab488
A		 4821
4822 // Reset mask to 0
4823 necp_kernel_application_policies_condition_mask = 0;
4824 necp_kernel_socket_policies_condition_mask = 0;
4825 necp_kernel_application_policies_count = 0;
4826 necp_kernel_socket_policies_count = 0;
4827 necp_kernel_socket_policies_non_app_count = 0;
4828
4829 // Reset all maps to NULL
4830 for (app_i = 0; app_i < NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS; app_i++) {
4831 if (necp_kernel_socket_policies_map[app_i] != NULL) {
4832 FREE(necp_kernel_socket_policies_map[app_i], M_NECP);
4833 necp_kernel_socket_policies_map[app_i] = NULL;
4834 }
4835
4836 // Init counts
4837 bucket_allocation_counts[app_i] = 0;
4838 }
4839 if (necp_kernel_socket_policies_app_layer_map != NULL) {
4840 FREE(necp_kernel_socket_policies_app_layer_map, M_NECP);
4841 necp_kernel_socket_policies_app_layer_map = NULL;
4842 }
4843
4844 // Create masks and counts
4845 LIST_FOREACH(kernel_policy, &necp_kernel_socket_policies, chain) {
4846 // App layer mask/count
4847 necp_kernel_application_policies_condition_mask |= kernel_policy->condition_mask;
4848 necp_kernel_application_policies_count++;
4849 app_layer_allocation_count++;
4850
d9a64523
A		 4851 if ((kernel_policy->condition_mask & NECP_KERNEL_CONDITION_AGENT_TYPE)) {
4852 // Agent type conditions only apply to app layer
4853 continue;
4854 }
4855
fe8ab488
A		 4856 // Update socket layer bucket mask/counts
4857 necp_kernel_socket_policies_condition_mask |= kernel_policy->condition_mask;
4858 necp_kernel_socket_policies_count++;
4859
4860 if (!(kernel_policy->condition_mask & NECP_KERNEL_CONDITION_APP_ID) ||
0a7de745 4861 kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_APP_ID) {
fe8ab488
A		 4862 necp_kernel_socket_policies_non_app_count++;
4863 for (app_i = 0; app_i < NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS; app_i++) {
4864 bucket_allocation_counts[app_i]++;
4865 }
4866 } else {
4867 bucket_allocation_counts[NECP_SOCKET_MAP_APP_ID_TO_BUCKET(kernel_policy->cond_app_id)]++;
4868 }
4869 }
4870
4871 // Allocate maps
4872 for (app_i = 0; app_i < NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS; app_i++) {
4873 if (bucket_allocation_counts[app_i] > 0) {
4874 // Allocate a NULL-terminated array of policy pointers for each bucket
4875 MALLOC(necp_kernel_socket_policies_map[app_i], struct necp_kernel_socket_policy **, sizeof(struct necp_kernel_socket_policy *) * (bucket_allocation_counts[app_i] + 1), M_NECP, M_WAITOK);
4876 if (necp_kernel_socket_policies_map[app_i] == NULL) {
4877 goto fail;
4878 }
4879
4880 // Initialize the first entry to NULL
4881 (necp_kernel_socket_policies_map[app_i])[0] = NULL;
4882 }
4883 bucket_current_free_index[app_i] = 0;
4884 }
4885 MALLOC(necp_kernel_socket_policies_app_layer_map, struct necp_kernel_socket_policy **, sizeof(struct necp_kernel_socket_policy *) * (app_layer_allocation_count + 1), M_NECP, M_WAITOK);
4886 if (necp_kernel_socket_policies_app_layer_map == NULL) {
4887 goto fail;
4888 }
4889 necp_kernel_socket_policies_app_layer_map[0] = NULL;
4890
4891 // Fill out maps
4892 LIST_FOREACH(kernel_policy, &necp_kernel_socket_policies, chain) {
d9a64523
A		 4893 // Add app layer policies
4894 if (!necp_kernel_socket_policy_is_unnecessary(kernel_policy, necp_kernel_socket_policies_app_layer_map, app_layer_current_free_index)) {
4895 necp_kernel_socket_policies_app_layer_map[app_layer_current_free_index] = kernel_policy;
4896 app_layer_current_free_index++;
4897 necp_kernel_socket_policies_app_layer_map[app_layer_current_free_index] = NULL;
4898 }
4899
4900 if ((kernel_policy->condition_mask & NECP_KERNEL_CONDITION_AGENT_TYPE)) {
4901 // Agent type conditions only apply to app layer
4902 continue;
4903 }
4904
4905 // Add socket policies
fe8ab488 4906 if (!(kernel_policy->condition_mask & NECP_KERNEL_CONDITION_APP_ID) ||
0a7de745 4907 kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_APP_ID) {
fe8ab488
A		 4908 for (app_i = 0; app_i < NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS; app_i++) {
4909 if (!necp_kernel_socket_policy_is_unnecessary(kernel_policy, necp_kernel_socket_policies_map[app_i], bucket_current_free_index[app_i])) {
4910 (necp_kernel_socket_policies_map[app_i])[(bucket_current_free_index[app_i])] = kernel_policy;
4911 bucket_current_free_index[app_i]++;
4912 (necp_kernel_socket_policies_map[app_i])[(bucket_current_free_index[app_i])] = NULL;
4913 }
4914 }
4915 } else {
4916 app_i = NECP_SOCKET_MAP_APP_ID_TO_BUCKET(kernel_policy->cond_app_id);
4917 if (!necp_kernel_socket_policy_is_unnecessary(kernel_policy, necp_kernel_socket_policies_map[app_i], bucket_current_free_index[app_i])) {
4918 (necp_kernel_socket_policies_map[app_i])[(bucket_current_free_index[app_i])] = kernel_policy;
4919 bucket_current_free_index[app_i]++;
4920 (necp_kernel_socket_policies_map[app_i])[(bucket_current_free_index[app_i])] = NULL;
4921 }
4922 }
fe8ab488
A		 4923 }
4924 necp_kernel_socket_policies_dump_all();
4925 BUMP_KERNEL_SOCKET_POLICIES_GENERATION_COUNT();
0a7de745 4926 return TRUE;
fe8ab488
A		 4927
4928fail:
4929 // Free memory, reset masks to 0
4930 necp_kernel_application_policies_condition_mask = 0;
4931 necp_kernel_socket_policies_condition_mask = 0;
4932 necp_kernel_application_policies_count = 0;
4933 necp_kernel_socket_policies_count = 0;
4934 necp_kernel_socket_policies_non_app_count = 0;
4935 for (app_i = 0; app_i < NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS; app_i++) {
4936 if (necp_kernel_socket_policies_map[app_i] != NULL) {
4937 FREE(necp_kernel_socket_policies_map[app_i], M_NECP);
4938 necp_kernel_socket_policies_map[app_i] = NULL;
4939 }
4940 }
4941 if (necp_kernel_socket_policies_app_layer_map != NULL) {
4942 FREE(necp_kernel_socket_policies_app_layer_map, M_NECP);
4943 necp_kernel_socket_policies_app_layer_map = NULL;
4944 }
0a7de745 4945 return FALSE;
fe8ab488
A		 4946}
4947
4948static u_int32_t
4949necp_get_new_string_id(void)
4950{
d9a64523
A		 4951 static u_int32_t necp_last_string_id = 0;
4952
fe8ab488
A		 4953 u_int32_t newid = 0;
4954
5ba3f43e 4955 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
fe8ab488 4956
d9a64523
A		 4957 bool wrapped = FALSE;
4958 do {
4959 necp_last_string_id++;
4960 if (necp_last_string_id < 1) {
4961 if (wrapped) {
4962 // Already wrapped, give up
4963 NECPLOG0(LOG_ERR, "Failed to find a free app UUID.\n");
0a7de745 4964 return 0;
d9a64523
A		 4965 }
4966 necp_last_string_id = 1;
4967 wrapped = TRUE;
4968 }
4969 newid = necp_last_string_id;
4970 } while (necp_lookup_string_with_id_locked(&necp_account_id_list, newid) != NULL); // If already used, keep trying
fe8ab488 4971
fe8ab488 4972 if (newid == 0) {
d9a64523 4973 NECPLOG0(LOG_ERR, "Allocate string id failed.\n");
0a7de745 4974 return 0;
fe8ab488
A		 4975 }
4976
0a7de745 4977 return newid;
fe8ab488
A		 4978}
4979
4980static struct necp_string_id_mapping *
4981necp_lookup_string_to_id_locked(struct necp_string_id_mapping_list *list, char *string)
4982{
4983 struct necp_string_id_mapping *searchentry = NULL;
4984 struct necp_string_id_mapping *foundentry = NULL;
4985
4986 LIST_FOREACH(searchentry, list, chain) {
4987 if (strcmp(searchentry->string, string) == 0) {
4988 foundentry = searchentry;
4989 break;
4990 }
4991 }
4992
0a7de745 4993 return foundentry;
fe8ab488
A		 4994}
4995
39037602
A		 4996static struct necp_string_id_mapping *
4997necp_lookup_string_with_id_locked(struct necp_string_id_mapping_list *list, u_int32_t local_id)
4998{
4999 struct necp_string_id_mapping *searchentry = NULL;
5000 struct necp_string_id_mapping *foundentry = NULL;
5001
5002 LIST_FOREACH(searchentry, list, chain) {
5003 if (searchentry->id == local_id) {
5004 foundentry = searchentry;
5005 break;
5006 }
5007 }
5008
0a7de745 5009 return foundentry;
39037602
A		 5010}
5011
fe8ab488
A		 5012static u_int32_t
5013necp_create_string_to_id_mapping(struct necp_string_id_mapping_list *list, char *string)
5014{
5015 u_int32_t string_id = 0;
5016 struct necp_string_id_mapping *existing_mapping = NULL;
5017
5ba3f43e 5018 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
fe8ab488
A		 5019
5020 existing_mapping = necp_lookup_string_to_id_locked(list, string);
5021 if (existing_mapping != NULL) {
5022 string_id = existing_mapping->id;
5023 existing_mapping->refcount++;
5024 } else {
5025 struct necp_string_id_mapping *new_mapping = NULL;
5026 MALLOC(new_mapping, struct necp_string_id_mapping *, sizeof(struct necp_string_id_mapping), M_NECP, M_WAITOK);
5027 if (new_mapping != NULL) {
5028 memset(new_mapping, 0, sizeof(struct necp_string_id_mapping));
5029
5030 size_t length = strlen(string) + 1;
5031 MALLOC(new_mapping->string, char *, length, M_NECP, M_WAITOK);
5032 if (new_mapping->string != NULL) {
5033 memcpy(new_mapping->string, string, length);
5034 new_mapping->id = necp_get_new_string_id();
5035 new_mapping->refcount = 1;
5036 LIST_INSERT_HEAD(list, new_mapping, chain);
5037 string_id = new_mapping->id;
5038 } else {
5039 FREE(new_mapping, M_NECP);
5040 new_mapping = NULL;
5041 }
5042 }
5043 }
0a7de745 5044 return string_id;
fe8ab488
A		 5045}
5046
5047static bool
5048necp_remove_string_to_id_mapping(struct necp_string_id_mapping_list *list, char *string)
5049{
5050 struct necp_string_id_mapping *existing_mapping = NULL;
5051
5ba3f43e 5052 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
fe8ab488
A		 5053
5054 existing_mapping = necp_lookup_string_to_id_locked(list, string);
5055 if (existing_mapping != NULL) {
5056 if (--existing_mapping->refcount == 0) {
5057 LIST_REMOVE(existing_mapping, chain);
5058 FREE(existing_mapping->string, M_NECP);
5059 FREE(existing_mapping, M_NECP);
5060 }
0a7de745 5061 return TRUE;
fe8ab488
A		 5062 }
5063
0a7de745 5064 return FALSE;
fe8ab488
A		 5065}
5066
d9a64523
A		 5067#define NECP_FIRST_VALID_ROUTE_RULE_ID 1
5068#define NECP_FIRST_VALID_AGGREGATE_ROUTE_RULE_ID UINT16_MAX
fe8ab488 5069static u_int32_t
d9a64523 5070necp_get_new_route_rule_id(bool aggregate)
fe8ab488 5071{
d9a64523
A		 5072 static u_int32_t necp_last_route_rule_id = 0;
5073 static u_int32_t necp_last_aggregate_route_rule_id = 0;
fe8ab488 5074
3e170ce0 5075 u_int32_t newid = 0;
fe8ab488 5076
d9a64523
A		 5077 if (!aggregate) {
5078 // Main necp_kernel_policy_lock protects non-aggregate rule IDs
5079 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
3e170ce0 5080
d9a64523
A		 5081 bool wrapped = FALSE;
5082 do {
5083 necp_last_route_rule_id++;
5084 if (necp_last_route_rule_id < NECP_FIRST_VALID_ROUTE_RULE_ID ||
0a7de745 5085 necp_last_route_rule_id >= NECP_FIRST_VALID_AGGREGATE_ROUTE_RULE_ID) {
d9a64523
A		 5086 if (wrapped) {
5087 // Already wrapped, give up
5088 NECPLOG0(LOG_ERR, "Failed to find a free route rule id.\n");
0a7de745 5089 return 0;
d9a64523
A		 5090 }
5091 necp_last_route_rule_id = NECP_FIRST_VALID_ROUTE_RULE_ID;
5092 wrapped = TRUE;
5093 }
5094 newid = necp_last_route_rule_id;
5095 } while (necp_lookup_route_rule_locked(&necp_route_rules, newid) != NULL); // If already used, keep trying
5096 } else {
5097 // necp_route_rule_lock protects aggregate rule IDs
5098 LCK_RW_ASSERT(&necp_route_rule_lock, LCK_RW_ASSERT_EXCLUSIVE);
5099
5100 bool wrapped = FALSE;
5101 do {
5102 necp_last_aggregate_route_rule_id++;
5103 if (necp_last_aggregate_route_rule_id < NECP_FIRST_VALID_AGGREGATE_ROUTE_RULE_ID) {
5104 if (wrapped) {
5105 // Already wrapped, give up
5106 NECPLOG0(LOG_ERR, "Failed to find a free aggregate route rule id.\n");
0a7de745 5107 return 0;
d9a64523
A		 5108 }
5109 necp_last_aggregate_route_rule_id = NECP_FIRST_VALID_AGGREGATE_ROUTE_RULE_ID;
5110 wrapped = TRUE;
5111 }
5112 newid = necp_last_aggregate_route_rule_id;
5113 } while (necp_lookup_route_rule_locked(&necp_route_rules, newid) != NULL); // If already used, keep trying
3e170ce0
A		 5114 }
5115
3e170ce0 5116 if (newid == 0) {
d9a64523 5117 NECPLOG0(LOG_ERR, "Allocate route rule ID failed.\n");
0a7de745 5118 return 0;
3e170ce0
A		 5119 }
5120
0a7de745 5121 return newid;
3e170ce0
A		 5122}
5123
5124static struct necp_route_rule *
5125necp_lookup_route_rule_locked(struct necp_route_rule_list *list, u_int32_t route_rule_id)
5126{
5127 struct necp_route_rule *searchentry = NULL;
5128 struct necp_route_rule *foundentry = NULL;
5129
5130 LIST_FOREACH(searchentry, list, chain) {
5131 if (searchentry->id == route_rule_id) {
fe8ab488
A		 5132 foundentry = searchentry;
5133 break;
5134 }
5135 }
5136
0a7de745 5137 return foundentry;
fe8ab488
A		 5138}
5139
3e170ce0
A		 5140static struct necp_route_rule *
5141necp_lookup_route_rule_by_contents_locked(struct necp_route_rule_list *list, u_int32_t default_action, u_int8_t cellular_action, u_int8_t wifi_action, u_int8_t wired_action, u_int8_t expensive_action, u_int32_t *if_indices, u_int8_t *if_actions)
5142{
5143 struct necp_route_rule *searchentry = NULL;
5144 struct necp_route_rule *foundentry = NULL;
5145
5146 LIST_FOREACH(searchentry, list, chain) {
5147 if (searchentry->default_action == default_action &&
0a7de745
A		 5148 searchentry->cellular_action == cellular_action &&
5149 searchentry->wifi_action == wifi_action &&
5150 searchentry->wired_action == wired_action &&
5151 searchentry->expensive_action == expensive_action) {
3e170ce0
A		 5152 bool match_failed = FALSE;
5153 size_t index_a = 0;
5154 size_t index_b = 0;
5155 size_t count_a = 0;
5156 size_t count_b = 0;
5157 for (index_a = 0; index_a < MAX_ROUTE_RULE_INTERFACES; index_a++) {
5158 bool found_index = FALSE;
5159 if (searchentry->exception_if_indices[index_a] == 0) {
5160 break;
5161 }
5162 count_a++;
5163 for (index_b = 0; index_b < MAX_ROUTE_RULE_INTERFACES; index_b++) {
5164 if (if_indices[index_b] == 0) {
5165 break;
5166 }
5167 if (index_b >= count_b) {
5168 count_b = index_b + 1;
5169 }
5170 if (searchentry->exception_if_indices[index_a] == if_indices[index_b] &&
0a7de745 5171 searchentry->exception_if_actions[index_a] == if_actions[index_b]) {
3e170ce0
A		 5172 found_index = TRUE;
5173 break;
5174 }
5175 }
5176 if (!found_index) {
5177 match_failed = TRUE;
5178 break;
5179 }
5180 }
5181 if (!match_failed && count_a == count_b) {
5182 foundentry = searchentry;
5183 break;
5184 }
5185 }
5186 }
5187
0a7de745 5188 return foundentry;
3e170ce0
A		 5189}
5190
fe8ab488 5191static u_int32_t
3e170ce0 5192necp_create_route_rule(struct necp_route_rule_list *list, u_int8_t *route_rules_array, u_int32_t route_rules_array_size)
fe8ab488 5193{
3e170ce0
A		 5194 size_t offset = 0;
5195 u_int32_t route_rule_id = 0;
5196 struct necp_route_rule *existing_rule = NULL;
5197 u_int32_t default_action = NECP_ROUTE_RULE_ALLOW_INTERFACE;
5198 u_int8_t cellular_action = NECP_ROUTE_RULE_NONE;
5199 u_int8_t wifi_action = NECP_ROUTE_RULE_NONE;
5200 u_int8_t wired_action = NECP_ROUTE_RULE_NONE;
5201 u_int8_t expensive_action = NECP_ROUTE_RULE_NONE;
5202 u_int32_t if_indices[MAX_ROUTE_RULE_INTERFACES];
5203 size_t num_valid_indices = 0;
5204 memset(&if_indices, 0, sizeof(if_indices));
5205 u_int8_t if_actions[MAX_ROUTE_RULE_INTERFACES];
5206 memset(&if_actions, 0, sizeof(if_actions));
fe8ab488 5207
5ba3f43e 5208 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
fe8ab488 5209
3e170ce0 5210 if (route_rules_array == NULL || route_rules_array_size == 0) {
0a7de745 5211 return 0;
fe8ab488
A		 5212 }
5213
3e170ce0
A		 5214 // Process rules
5215 while (offset < route_rules_array_size) {
5216 ifnet_t rule_interface = NULL;
5217 char interface_name[IFXNAMSIZ];
5218 u_int32_t length = 0;
5219 u_int8_t *value = necp_buffer_get_tlv_value(route_rules_array, offset, &length);
5220
5221 u_int8_t rule_type = necp_policy_condition_get_type_from_buffer(value, length);
5222 u_int8_t rule_flags = necp_policy_condition_get_flags_from_buffer(value, length);
5223 u_int32_t rule_length = necp_policy_condition_get_value_length_from_buffer(value, length);
5224 u_int8_t *rule_value = necp_policy_condition_get_value_pointer_from_buffer(value, length);
5225
5226 if (rule_type == NECP_ROUTE_RULE_NONE) {
5227 // Don't allow an explicit rule to be None action
5228 continue;
5229 }
5230
5231 if (rule_length == 0) {
5232 if (rule_flags & NECP_ROUTE_RULE_FLAG_CELLULAR) {
5233 cellular_action = rule_type;
5234 }
5235 if (rule_flags & NECP_ROUTE_RULE_FLAG_WIFI) {
5236 wifi_action = rule_type;
5237 }
5238 if (rule_flags & NECP_ROUTE_RULE_FLAG_WIRED) {
5239 wired_action = rule_type;
5240 }
5241 if (rule_flags & NECP_ROUTE_RULE_FLAG_EXPENSIVE) {
5242 expensive_action = rule_type;
5243 }
5244 if (rule_flags == 0) {
5245 default_action = rule_type;
5246 }
5247 offset += sizeof(u_int8_t) + sizeof(u_int32_t) + length;
5248 continue;
5249 }
5250
5251 if (num_valid_indices >= MAX_ROUTE_RULE_INTERFACES) {
5252 offset += sizeof(u_int8_t) + sizeof(u_int32_t) + length;
5253 continue;
5254 }
5255
39037602
A		 5256 if (rule_length <= IFXNAMSIZ) {
5257 memcpy(interface_name, rule_value, rule_length);
5258 interface_name[rule_length - 1] = 0; // Make sure the string is NULL terminated
5259 if (ifnet_find_by_name(interface_name, &rule_interface) == 0) {
5260 if_actions[num_valid_indices] = rule_type;
5261 if_indices[num_valid_indices++] = rule_interface->if_index;
5262 ifnet_release(rule_interface);
5263 }
3e170ce0 5264 }
3e170ce0
A		 5265 offset += sizeof(u_int8_t) + sizeof(u_int32_t) + length;
5266 }
5267
5268 existing_rule = necp_lookup_route_rule_by_contents_locked(list, default_action, cellular_action, wifi_action, wired_action, expensive_action, if_indices, if_actions);
5269 if (existing_rule != NULL) {
5270 route_rule_id = existing_rule->id;
5271 existing_rule->refcount++;
5272 } else {
5273 struct necp_route_rule *new_rule = NULL;
5274 MALLOC(new_rule, struct necp_route_rule *, sizeof(struct necp_route_rule), M_NECP, M_WAITOK);
5275 if (new_rule != NULL) {
5276 memset(new_rule, 0, sizeof(struct necp_route_rule));
d9a64523 5277 route_rule_id = new_rule->id = necp_get_new_route_rule_id(false);
3e170ce0
A		 5278 new_rule->default_action = default_action;
5279 new_rule->cellular_action = cellular_action;
5280 new_rule->wifi_action = wifi_action;
5281 new_rule->wired_action = wired_action;
5282 new_rule->expensive_action = expensive_action;
5283 memcpy(&new_rule->exception_if_indices, &if_indices, sizeof(if_indices));
5284 memcpy(&new_rule->exception_if_actions, &if_actions, sizeof(if_actions));
5285 new_rule->refcount = 1;
5286 LIST_INSERT_HEAD(list, new_rule, chain);
5287 }
5288 }
0a7de745 5289 return route_rule_id;
3e170ce0
A		 5290}
5291
5292static void
5293necp_remove_aggregate_route_rule_for_id(u_int32_t rule_id)
5294{
5295 if (rule_id) {
5296 lck_rw_lock_exclusive(&necp_route_rule_lock);
5297
5298 struct necp_aggregate_route_rule *existing_rule = NULL;
5299 struct necp_aggregate_route_rule *tmp_rule = NULL;
5300
5301 LIST_FOREACH_SAFE(existing_rule, &necp_aggregate_route_rules, chain, tmp_rule) {
5302 int index = 0;
5303 for (index = 0; index < MAX_AGGREGATE_ROUTE_RULES; index++) {
5304 u_int32_t route_rule_id = existing_rule->rule_ids[index];
5305 if (route_rule_id == rule_id) {
5306 LIST_REMOVE(existing_rule, chain);
5307 FREE(existing_rule, M_NECP);
5308 break;
5309 }
5310 }
5311 }
5312
5313 lck_rw_done(&necp_route_rule_lock);
5314 }
5315}
5316
5317static bool
5318necp_remove_route_rule(struct necp_route_rule_list *list, u_int32_t route_rule_id)
5319{
5320 struct necp_route_rule *existing_rule = NULL;
5321
5ba3f43e 5322 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
3e170ce0
A		 5323
5324 existing_rule = necp_lookup_route_rule_locked(list, route_rule_id);
5325 if (existing_rule != NULL) {
5326 if (--existing_rule->refcount == 0) {
5327 necp_remove_aggregate_route_rule_for_id(existing_rule->id);
5328 LIST_REMOVE(existing_rule, chain);
5329 FREE(existing_rule, M_NECP);
5330 }
0a7de745 5331 return TRUE;
3e170ce0
A		 5332 }
5333
0a7de745 5334 return FALSE;
3e170ce0
A		 5335}
5336
5337static struct necp_aggregate_route_rule *
5338necp_lookup_aggregate_route_rule_locked(u_int32_t route_rule_id)
5339{
5340 struct necp_aggregate_route_rule *searchentry = NULL;
5341 struct necp_aggregate_route_rule *foundentry = NULL;
5342
5343 lck_rw_lock_shared(&necp_route_rule_lock);
5344
5345 LIST_FOREACH(searchentry, &necp_aggregate_route_rules, chain) {
5346 if (searchentry->id == route_rule_id) {
5347 foundentry = searchentry;
5348 break;
5349 }
5350 }
5351
5352 lck_rw_done(&necp_route_rule_lock);
5353
0a7de745 5354 return foundentry;
3e170ce0
A		 5355}
5356
5357static u_int32_t
5358necp_create_aggregate_route_rule(u_int32_t *rule_ids)
5359{
5360 u_int32_t aggregate_route_rule_id = 0;
5361 struct necp_aggregate_route_rule *new_rule = NULL;
5362 struct necp_aggregate_route_rule *existing_rule = NULL;
5363
5364 LIST_FOREACH(existing_rule, &necp_aggregate_route_rules, chain) {
5365 if (memcmp(existing_rule->rule_ids, rule_ids, (sizeof(u_int32_t) * MAX_AGGREGATE_ROUTE_RULES)) == 0) {
0a7de745 5366 return existing_rule->id;
3e170ce0
A		 5367 }
5368 }
5369
5370 lck_rw_lock_exclusive(&necp_route_rule_lock);
5371
5372 LIST_FOREACH(existing_rule, &necp_aggregate_route_rules, chain) {
5373 // Re-check, in case something else created the rule while we are waiting to lock
5374 if (memcmp(existing_rule->rule_ids, rule_ids, (sizeof(u_int32_t) * MAX_AGGREGATE_ROUTE_RULES)) == 0) {
5375 lck_rw_done(&necp_route_rule_lock);
0a7de745 5376 return existing_rule->id;
3e170ce0
A		 5377 }
5378 }
5379
5380 MALLOC(new_rule, struct necp_aggregate_route_rule *, sizeof(struct necp_aggregate_route_rule), M_NECP, M_WAITOK);
5381 if (new_rule != NULL) {
5382 memset(new_rule, 0, sizeof(struct necp_aggregate_route_rule));
d9a64523 5383 aggregate_route_rule_id = new_rule->id = necp_get_new_route_rule_id(true);
3e170ce0
A		 5384 new_rule->id = aggregate_route_rule_id;
5385 memcpy(new_rule->rule_ids, rule_ids, (sizeof(u_int32_t) * MAX_AGGREGATE_ROUTE_RULES));
5386 LIST_INSERT_HEAD(&necp_aggregate_route_rules, new_rule, chain);
5387 }
5388 lck_rw_done(&necp_route_rule_lock);
5389
0a7de745 5390 return aggregate_route_rule_id;
3e170ce0
A		 5391}
5392
5393#define NECP_NULL_SERVICE_ID 1
d9a64523
A		 5394#define NECP_FIRST_VALID_SERVICE_ID 2
5395#define NECP_FIRST_VALID_APP_ID UINT16_MAX
3e170ce0 5396static u_int32_t
d9a64523 5397necp_get_new_uuid_id(bool service)
3e170ce0 5398{
d9a64523
A		 5399 static u_int32_t necp_last_service_uuid_id = 0;
5400 static u_int32_t necp_last_app_uuid_id = 0;
5401
3e170ce0
A		 5402 u_int32_t newid = 0;
5403
5ba3f43e 5404 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
3e170ce0 5405
d9a64523
A		 5406 if (service) {
5407 bool wrapped = FALSE;
5408 do {
5409 necp_last_service_uuid_id++;
5410 if (necp_last_service_uuid_id < NECP_FIRST_VALID_SERVICE_ID ||
0a7de745 5411 necp_last_service_uuid_id >= NECP_FIRST_VALID_APP_ID) {
d9a64523
A		 5412 if (wrapped) {
5413 // Already wrapped, give up
5414 NECPLOG0(LOG_ERR, "Failed to find a free service UUID.\n");
0a7de745 5415 return NECP_NULL_SERVICE_ID;
d9a64523
A		 5416 }
5417 necp_last_service_uuid_id = NECP_FIRST_VALID_SERVICE_ID;
5418 wrapped = TRUE;
5419 }
5420 newid = necp_last_service_uuid_id;
5421 } while (necp_uuid_lookup_uuid_with_service_id_locked(newid) != NULL); // If already used, keep trying
5422 } else {
5423 bool wrapped = FALSE;
5424 do {
5425 necp_last_app_uuid_id++;
5426 if (necp_last_app_uuid_id < NECP_FIRST_VALID_APP_ID) {
5427 if (wrapped) {
5428 // Already wrapped, give up
5429 NECPLOG0(LOG_ERR, "Failed to find a free app UUID.\n");
0a7de745 5430 return NECP_NULL_SERVICE_ID;
d9a64523
A		 5431 }
5432 necp_last_app_uuid_id = NECP_FIRST_VALID_APP_ID;
5433 wrapped = TRUE;
5434 }
5435 newid = necp_last_app_uuid_id;
5436 } while (necp_uuid_lookup_uuid_with_app_id_locked(newid) != NULL); // If already used, keep trying
3e170ce0
A		 5437 }
5438
d9a64523
A		 5439 if (newid == NECP_NULL_SERVICE_ID) {
5440 NECPLOG0(LOG_ERR, "Allocate uuid ID failed.\n");
0a7de745 5441 return NECP_NULL_SERVICE_ID;
3e170ce0
A		 5442 }
5443
0a7de745 5444 return newid;
3e170ce0
A		 5445}
5446
5447static struct necp_uuid_id_mapping *
5448necp_uuid_lookup_app_id_locked(uuid_t uuid)
5449{
5450 struct necp_uuid_id_mapping *searchentry = NULL;
5451 struct necp_uuid_id_mapping *foundentry = NULL;
5452
5453 LIST_FOREACH(searchentry, APPUUIDHASH(uuid), chain) {
5454 if (uuid_compare(searchentry->uuid, uuid) == 0) {
5455 foundentry = searchentry;
5456 break;
5457 }
5458 }
5459
0a7de745 5460 return foundentry;
3e170ce0
A		 5461}
5462
39037602
A		 5463static struct necp_uuid_id_mapping *
5464necp_uuid_lookup_uuid_with_app_id_locked(u_int32_t local_id)
5465{
5466 struct necp_uuid_id_mapping *searchentry = NULL;
5467 struct necp_uuid_id_mapping *foundentry = NULL;
5468
5469 struct necp_uuid_id_mapping_head *uuid_list_head = NULL;
5470 for (uuid_list_head = &necp_uuid_app_id_hashtbl[necp_uuid_app_id_hash_num_buckets - 1]; uuid_list_head >= necp_uuid_app_id_hashtbl; uuid_list_head--) {
5471 LIST_FOREACH(searchentry, uuid_list_head, chain) {
5472 if (searchentry->id == local_id) {
5473 foundentry = searchentry;
5474 break;
5475 }
5476 }
5477 }
5478
0a7de745 5479 return foundentry;
39037602
A		 5480}
5481
3e170ce0
A		 5482static u_int32_t
5483necp_create_uuid_app_id_mapping(uuid_t uuid, bool *allocated_mapping, bool uuid_policy_table)
5484{
5485 u_int32_t local_id = 0;
5486 struct necp_uuid_id_mapping *existing_mapping = NULL;
5487
5ba3f43e 5488 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
3e170ce0
A		 5489
5490 if (allocated_mapping) {
5491 *allocated_mapping = FALSE;
5492 }
5493
5494 existing_mapping = necp_uuid_lookup_app_id_locked(uuid);
5495 if (existing_mapping != NULL) {
5496 local_id = existing_mapping->id;
fe8ab488
A		 5497 existing_mapping->refcount++;
5498 if (uuid_policy_table) {
5499 existing_mapping->table_refcount++;
5500 }
5501 } else {
5502 struct necp_uuid_id_mapping *new_mapping = NULL;
5503 MALLOC(new_mapping, struct necp_uuid_id_mapping *, sizeof(*new_mapping), M_NECP, M_WAITOK);
5504 if (new_mapping != NULL) {
5505 uuid_copy(new_mapping->uuid, uuid);
d9a64523 5506 new_mapping->id = necp_get_new_uuid_id(false);
fe8ab488
A		 5507 new_mapping->refcount = 1;
5508 if (uuid_policy_table) {
5509 new_mapping->table_refcount = 1;
5510 } else {
5511 new_mapping->table_refcount = 0;
5512 }
5513
5514 LIST_INSERT_HEAD(APPUUIDHASH(uuid), new_mapping, chain);
5515
5516 if (allocated_mapping) {
5517 *allocated_mapping = TRUE;
5518 }
5519
5520 local_id = new_mapping->id;
5521 }
5522 }
5523
0a7de745 5524 return local_id;
fe8ab488
A		 5525}
5526
5527static bool
5528necp_remove_uuid_app_id_mapping(uuid_t uuid, bool *removed_mapping, bool uuid_policy_table)
5529{
5530 struct necp_uuid_id_mapping *existing_mapping = NULL;
5531
5ba3f43e 5532 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
fe8ab488
A		 5533
5534 if (removed_mapping) {
5535 *removed_mapping = FALSE;
5536 }
5537
5538 existing_mapping = necp_uuid_lookup_app_id_locked(uuid);
5539 if (existing_mapping != NULL) {
5540 if (uuid_policy_table) {
5541 existing_mapping->table_refcount--;
5542 }
5543 if (--existing_mapping->refcount == 0) {
5544 LIST_REMOVE(existing_mapping, chain);
5545 FREE(existing_mapping, M_NECP);
5546 if (removed_mapping) {
5547 *removed_mapping = TRUE;
5548 }
5549 }
0a7de745 5550 return TRUE;
fe8ab488
A		 5551 }
5552
0a7de745 5553 return FALSE;
fe8ab488
A		 5554}
5555
5556static struct necp_uuid_id_mapping *
5557necp_uuid_get_null_service_id_mapping(void)
5558{
5559 static struct necp_uuid_id_mapping null_mapping;
5560 uuid_clear(null_mapping.uuid);
5561 null_mapping.id = NECP_NULL_SERVICE_ID;
39037602 5562
0a7de745 5563 return &null_mapping;
fe8ab488
A		 5564}
5565
5566static struct necp_uuid_id_mapping *
5567necp_uuid_lookup_service_id_locked(uuid_t uuid)
5568{
5569 struct necp_uuid_id_mapping *searchentry = NULL;
5570 struct necp_uuid_id_mapping *foundentry = NULL;
39037602 5571
fe8ab488
A		 5572 if (uuid_is_null(uuid)) {
5573 return necp_uuid_get_null_service_id_mapping();
5574 }
39037602 5575
fe8ab488
A		 5576 LIST_FOREACH(searchentry, &necp_uuid_service_id_list, chain) {
5577 if (uuid_compare(searchentry->uuid, uuid) == 0) {
5578 foundentry = searchentry;
5579 break;
5580 }
5581 }
5582
0a7de745 5583 return foundentry;
fe8ab488
A		 5584}
5585
5586static struct necp_uuid_id_mapping *
5587necp_uuid_lookup_uuid_with_service_id_locked(u_int32_t local_id)
5588{
5589 struct necp_uuid_id_mapping *searchentry = NULL;
5590 struct necp_uuid_id_mapping *foundentry = NULL;
39037602 5591
fe8ab488
A		 5592 if (local_id == NECP_NULL_SERVICE_ID) {
5593 return necp_uuid_get_null_service_id_mapping();
5594 }
39037602 5595
fe8ab488
A		 5596 LIST_FOREACH(searchentry, &necp_uuid_service_id_list, chain) {
5597 if (searchentry->id == local_id) {
5598 foundentry = searchentry;
5599 break;
5600 }
5601 }
5602
0a7de745 5603 return foundentry;
fe8ab488
A		 5604}
5605
5606static u_int32_t
5607necp_create_uuid_service_id_mapping(uuid_t uuid)
5608{
5609 u_int32_t local_id = 0;
5610 struct necp_uuid_id_mapping *existing_mapping = NULL;
39037602 5611
fe8ab488 5612 if (uuid_is_null(uuid)) {
0a7de745 5613 return NECP_NULL_SERVICE_ID;
fe8ab488 5614 }
39037602 5615
5ba3f43e 5616 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
fe8ab488
A		 5617
5618 existing_mapping = necp_uuid_lookup_service_id_locked(uuid);
5619 if (existing_mapping != NULL) {
5620 local_id = existing_mapping->id;
5621 existing_mapping->refcount++;
5622 } else {
5623 struct necp_uuid_id_mapping *new_mapping = NULL;
5624 MALLOC(new_mapping, struct necp_uuid_id_mapping *, sizeof(*new_mapping), M_NECP, M_WAITOK);
5625 if (new_mapping != NULL) {
5626 uuid_copy(new_mapping->uuid, uuid);
d9a64523 5627 new_mapping->id = necp_get_new_uuid_id(true);
fe8ab488
A		 5628 new_mapping->refcount = 1;
5629
5630 LIST_INSERT_HEAD(&necp_uuid_service_id_list, new_mapping, chain);
5631
5632 local_id = new_mapping->id;
5633 }
5634 }
5635
0a7de745 5636 return local_id;
fe8ab488
A		 5637}
5638
5639static bool
5640necp_remove_uuid_service_id_mapping(uuid_t uuid)
5641{
5642 struct necp_uuid_id_mapping *existing_mapping = NULL;
39037602 5643
fe8ab488 5644 if (uuid_is_null(uuid)) {
0a7de745 5645 return TRUE;
fe8ab488 5646 }
39037602 5647
5ba3f43e 5648 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
fe8ab488
A		 5649
5650 existing_mapping = necp_uuid_lookup_app_id_locked(uuid);
5651 if (existing_mapping != NULL) {
5652 if (--existing_mapping->refcount == 0) {
5653 LIST_REMOVE(existing_mapping, chain);
5654 FREE(existing_mapping, M_NECP);
5655 }
0a7de745 5656 return TRUE;
fe8ab488
A		 5657 }
5658
0a7de745 5659 return FALSE;
fe8ab488
A		 5660}
5661
5662
5663static bool
5664necp_kernel_socket_policies_update_uuid_table(void)
5665{
5ba3f43e 5666 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
fe8ab488
A		 5667
5668 if (necp_uuid_app_id_mappings_dirty) {
5669 if (proc_uuid_policy_kernel(PROC_UUID_POLICY_OPERATION_CLEAR, NULL, PROC_UUID_NECP_APP_POLICY) < 0) {
5670 NECPLOG0(LOG_DEBUG, "Error clearing uuids from policy table\n");
0a7de745 5671 return FALSE;
fe8ab488
A		 5672 }
5673
5674 if (necp_num_uuid_app_id_mappings > 0) {
5675 struct necp_uuid_id_mapping_head *uuid_list_head = NULL;
5676 for (uuid_list_head = &necp_uuid_app_id_hashtbl[necp_uuid_app_id_hash_num_buckets - 1]; uuid_list_head >= necp_uuid_app_id_hashtbl; uuid_list_head--) {
5677 struct necp_uuid_id_mapping *mapping = NULL;
5678 LIST_FOREACH(mapping, uuid_list_head, chain) {
5679 if (mapping->table_refcount > 0 &&
0a7de745 5680 proc_uuid_policy_kernel(PROC_UUID_POLICY_OPERATION_ADD, mapping->uuid, PROC_UUID_NECP_APP_POLICY) < 0) {
fe8ab488
A		 5681 NECPLOG0(LOG_DEBUG, "Error adding uuid to policy table\n");
5682 }
5683 }
5684 }
5685 }
5686
5687 necp_uuid_app_id_mappings_dirty = FALSE;
5688 }
5689
0a7de745 5690 return TRUE;
fe8ab488
A		 5691}
5692
0a7de745 5693#define NECP_KERNEL_VALID_IP_OUTPUT_CONDITIONS (NECP_KERNEL_CONDITION_ALL_INTERFACES | NECP_KERNEL_CONDITION_BOUND_INTERFACE | NECP_KERNEL_CONDITION_PROTOCOL | NECP_KERNEL_CONDITION_LOCAL_START | NECP_KERNEL_CONDITION_LOCAL_END | NECP_KERNEL_CONDITION_LOCAL_PREFIX | NECP_KERNEL_CONDITION_REMOTE_START | NECP_KERNEL_CONDITION_REMOTE_END | NECP_KERNEL_CONDITION_REMOTE_PREFIX | NECP_KERNEL_CONDITION_POLICY_ID | NECP_KERNEL_CONDITION_LAST_INTERFACE)
fe8ab488 5694static necp_kernel_policy_id
d9a64523 5695necp_kernel_ip_output_policy_add(necp_policy_order order, necp_policy_order suborder, u_int32_t session_order, int session_pid, u_int32_t condition_mask, u_int32_t condition_negated_mask, necp_kernel_policy_id cond_policy_id, ifnet_t cond_bound_interface, u_int32_t cond_last_interface_index, u_int16_t cond_protocol, union necp_sockaddr_union *cond_local_start, union necp_sockaddr_union *cond_local_end, u_int8_t cond_local_prefix, union necp_sockaddr_union *cond_remote_start, union necp_sockaddr_union *cond_remote_end, u_int8_t cond_remote_prefix, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter)
fe8ab488
A		 5696{
5697 struct necp_kernel_ip_output_policy *new_kernel_policy = NULL;
5698 struct necp_kernel_ip_output_policy *tmp_kernel_policy = NULL;
5699
5700 MALLOC_ZONE(new_kernel_policy, struct necp_kernel_ip_output_policy *, sizeof(*new_kernel_policy), M_NECP_IP_POLICY, M_WAITOK);
5701 if (new_kernel_policy == NULL) {
5702 goto done;
5703 }
5704
5ba3f43e 5705 memset(new_kernel_policy, 0, sizeof(*new_kernel_policy)); // M_ZERO is not supported for MALLOC_ZONE
5ba3f43e 5706 new_kernel_policy->id = necp_kernel_policy_get_new_id(false);
fe8ab488
A		 5707 new_kernel_policy->suborder = suborder;
5708 new_kernel_policy->order = order;
5709 new_kernel_policy->session_order = session_order;
3e170ce0 5710 new_kernel_policy->session_pid = session_pid;
fe8ab488
A		 5711
5712 // Sanitize condition mask
5713 new_kernel_policy->condition_mask = (condition_mask & NECP_KERNEL_VALID_IP_OUTPUT_CONDITIONS);
5714 if ((new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_ALL_INTERFACES) && (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE)) {
5715 new_kernel_policy->condition_mask &= ~NECP_KERNEL_CONDITION_BOUND_INTERFACE;
5716 }
5717 if ((new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_END) && (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_PREFIX)) {
5718 new_kernel_policy->condition_mask &= ~NECP_KERNEL_CONDITION_LOCAL_PREFIX;
5719 }
5720 if ((new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_END) && (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX)) {
5721 new_kernel_policy->condition_mask &= ~NECP_KERNEL_CONDITION_REMOTE_PREFIX;
5722 }
5723 new_kernel_policy->condition_negated_mask = condition_negated_mask & new_kernel_policy->condition_mask;
5724
5725 // Set condition values
5726 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_POLICY_ID) {
5727 new_kernel_policy->cond_policy_id = cond_policy_id;
5728 }
5729 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE) {
5730 if (cond_bound_interface) {
5731 ifnet_reference(cond_bound_interface);
5732 }
5733 new_kernel_policy->cond_bound_interface = cond_bound_interface;
5734 }
5735 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LAST_INTERFACE) {
5736 new_kernel_policy->cond_last_interface_index = cond_last_interface_index;
5737 }
5738 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_PROTOCOL) {
5739 new_kernel_policy->cond_protocol = cond_protocol;
5740 }
5741 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_START) {
5742 memcpy(&new_kernel_policy->cond_local_start, cond_local_start, cond_local_start->sa.sa_len);
5743 }
5744 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_END) {
5745 memcpy(&new_kernel_policy->cond_local_end, cond_local_end, cond_local_end->sa.sa_len);
5746 }
5747 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_PREFIX) {
5748 new_kernel_policy->cond_local_prefix = cond_local_prefix;
5749 }
5750 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_START) {
5751 memcpy(&new_kernel_policy->cond_remote_start, cond_remote_start, cond_remote_start->sa.sa_len);
5752 }
5753 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_END) {
5754 memcpy(&new_kernel_policy->cond_remote_end, cond_remote_end, cond_remote_end->sa.sa_len);
5755 }
5756 if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX) {
5757 new_kernel_policy->cond_remote_prefix = cond_remote_prefix;
5758 }
5759
5760 new_kernel_policy->result = result;
5761 memcpy(&new_kernel_policy->result_parameter, &result_parameter, sizeof(result_parameter));
5762
5763 if (necp_debug) {
5764 NECPLOG(LOG_DEBUG, "Added kernel policy: ip output, id=%d, mask=%x\n", new_kernel_policy->id, new_kernel_policy->condition_mask);
5765 }
5766 LIST_INSERT_SORTED_THRICE_ASCENDING(&necp_kernel_ip_output_policies, new_kernel_policy, chain, session_order, order, suborder, tmp_kernel_policy);
5767done:
0a7de745 5768 return new_kernel_policy ? new_kernel_policy->id : 0;
fe8ab488
A		 5769}
5770
5771static struct necp_kernel_ip_output_policy *
5772necp_kernel_ip_output_policy_find(necp_kernel_policy_id policy_id)
5773{
5774 struct necp_kernel_ip_output_policy *kernel_policy = NULL;
5775 struct necp_kernel_ip_output_policy *tmp_kernel_policy = NULL;
5776
5777 if (policy_id == 0) {
0a7de745 5778 return NULL;
fe8ab488
A		 5779 }
5780
5781 LIST_FOREACH_SAFE(kernel_policy, &necp_kernel_ip_output_policies, chain, tmp_kernel_policy) {
5782 if (kernel_policy->id == policy_id) {
0a7de745 5783 return kernel_policy;
fe8ab488
A		 5784 }
5785 }
5786
0a7de745 5787 return NULL;
fe8ab488
A		 5788}
5789
5790static bool
5791necp_kernel_ip_output_policy_delete(necp_kernel_policy_id policy_id)
5792{
5793 struct necp_kernel_ip_output_policy *policy = NULL;
5794
5ba3f43e 5795 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
fe8ab488
A		 5796
5797 policy = necp_kernel_ip_output_policy_find(policy_id);
5798 if (policy) {
5799 LIST_REMOVE(policy, chain);
5800
5801 if (policy->cond_bound_interface) {
5802 ifnet_release(policy->cond_bound_interface);
5803 policy->cond_bound_interface = NULL;
5804 }
5805
5806 FREE_ZONE(policy, sizeof(*policy), M_NECP_IP_POLICY);
0a7de745 5807 return TRUE;
fe8ab488
A		 5808 }
5809
0a7de745 5810 return FALSE;
fe8ab488
A		 5811}
5812
5813static void
5814necp_kernel_ip_output_policies_dump_all(void)
5815{
fe8ab488 5816 if (necp_debug) {
3e170ce0
A		 5817 struct necp_kernel_ip_output_policy *policy = NULL;
5818 int policy_i;
5819 int id_i;
5820 char result_string[MAX_RESULT_STRING_LEN];
5821 char proc_name_string[MAXCOMLEN + 1];
5822 memset(result_string, 0, MAX_RESULT_STRING_LEN);
5823 memset(proc_name_string, 0, MAXCOMLEN + 1);
5824
fe8ab488
A		 5825 NECPLOG0(LOG_DEBUG, "NECP IP Output Policies:\n");
5826 NECPLOG0(LOG_DEBUG, "-----------\n");
5827 for (id_i = 0; id_i < NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS; id_i++) {
5828 NECPLOG(LOG_DEBUG, " ID Bucket: %d\n", id_i);
5829 for (policy_i = 0; necp_kernel_ip_output_policies_map[id_i] != NULL && (necp_kernel_ip_output_policies_map[id_i])[policy_i] != NULL; policy_i++) {
5830 policy = (necp_kernel_ip_output_policies_map[id_i])[policy_i];
3e170ce0
A		 5831 proc_name(policy->session_pid, proc_name_string, MAXCOMLEN);
5832 NECPLOG(LOG_DEBUG, "\t%3d. Policy ID: %5d\tProcess: %10.10s\tOrder: %04d.%04d.%d\tMask: %5x\tResult: %s\n", policy_i, policy->id, proc_name_string, policy->session_order, policy->order, policy->suborder, policy->condition_mask, necp_get_result_description(result_string, policy->result, policy->result_parameter));
fe8ab488
A		 5833 }
5834 NECPLOG0(LOG_DEBUG, "-----------\n");
5835 }
5836 }
5837}
5838
5839static inline bool
5840necp_kernel_ip_output_policy_results_overlap(struct necp_kernel_ip_output_policy *upper_policy, struct necp_kernel_ip_output_policy *lower_policy)
5841{
5842 if (upper_policy->result == NECP_KERNEL_POLICY_RESULT_SKIP) {
5843 if (upper_policy->session_order != lower_policy->session_order) {
5844 // A skip cannot override a policy of a different session
0a7de745 5845 return FALSE;
fe8ab488
A		 5846 } else {
5847 if (upper_policy->result_parameter.skip_policy_order == 0 ||
0a7de745 5848 lower_policy->order >= upper_policy->result_parameter.skip_policy_order) {
fe8ab488 5849 // This policy is beyond the skip
0a7de745 5850 return FALSE;
fe8ab488
A		 5851 } else {
5852 // This policy is inside the skip
0a7de745 5853 return TRUE;
fe8ab488
A		 5854 }
5855 }
5856 }
5857
5858 // All other IP Output policy results (drop, tunnel, hard pass) currently overlap
0a7de745 5859 return TRUE;
fe8ab488
A		 5860}
5861
5862static bool
5863necp_kernel_ip_output_policy_is_unnecessary(struct necp_kernel_ip_output_policy *policy, struct necp_kernel_ip_output_policy **policy_array, int valid_indices)
5864{
5865 bool can_skip = FALSE;
5866 u_int32_t highest_skip_session_order = 0;
5867 u_int32_t highest_skip_order = 0;
5868 int i;
5869 for (i = 0; i < valid_indices; i++) {
5870 struct necp_kernel_ip_output_policy *compared_policy = policy_array[i];
5871
5872 // For policies in a skip window, we can't mark conflicting policies as unnecessary
5873 if (can_skip) {
5874 if (highest_skip_session_order != compared_policy->session_order ||
0a7de745 5875 (highest_skip_order != 0 && compared_policy->order >= highest_skip_order)) {
fe8ab488
A		 5876 // If we've moved on to the next session, or passed the skip window
5877 highest_skip_session_order = 0;
5878 highest_skip_order = 0;
5879 can_skip = FALSE;
5880 } else {
5881 // If this policy is also a skip, in can increase the skip window
5882 if (compared_policy->result == NECP_KERNEL_POLICY_RESULT_SKIP) {
5883 if (compared_policy->result_parameter.skip_policy_order > highest_skip_order) {
5884 highest_skip_order = compared_policy->result_parameter.skip_policy_order;
5885 }
5886 }
5887 continue;
5888 }
5889 }
5890
5891 if (compared_policy->result == NECP_KERNEL_POLICY_RESULT_SKIP) {
5892 // This policy is a skip. Set the skip window accordingly
5893 can_skip = TRUE;
5894 highest_skip_session_order = compared_policy->session_order;
5895 highest_skip_order = compared_policy->result_parameter.skip_policy_order;
5896 }
5897
5898 // The result of the compared policy must be able to block out this policy result
5899 if (!necp_kernel_ip_output_policy_results_overlap(compared_policy, policy)) {
5900 continue;
5901 }
5902
5903 // If new policy matches All Interfaces, compared policy must also
5904 if ((policy->condition_mask & NECP_KERNEL_CONDITION_ALL_INTERFACES) && !(compared_policy->condition_mask & NECP_KERNEL_CONDITION_ALL_INTERFACES)) {
5905 continue;
5906 }
5907
5908 // Default makes lower policies unecessary always
5909 if (compared_policy->condition_mask == 0) {
0a7de745 5910 return TRUE;
fe8ab488
A		 5911 }
5912
5913 // Compared must be more general than policy, and include only conditions within policy
5914 if ((policy->condition_mask & compared_policy->condition_mask) != compared_policy->condition_mask) {
5915 continue;
5916 }
5917
5918 // Negative conditions must match for the overlapping conditions
5919 if ((policy->condition_negated_mask & compared_policy->condition_mask) != (compared_policy->condition_negated_mask & compared_policy->condition_mask)) {
5920 continue;
5921 }
5922
5923 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_POLICY_ID &&
0a7de745 5924 compared_policy->cond_policy_id != policy->cond_policy_id) {
fe8ab488
A		 5925 continue;
5926 }
5927
5928 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE &&
0a7de745 5929 compared_policy->cond_bound_interface != policy->cond_bound_interface) {
fe8ab488
A		 5930 continue;
5931 }
5932
5933 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_PROTOCOL &&
0a7de745 5934 compared_policy->cond_protocol != policy->cond_protocol) {
fe8ab488
A		 5935 continue;
5936 }
5937
5938 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_START) {
5939 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_END) {
5940 if (!necp_is_range_in_range((struct sockaddr *)&policy->cond_local_start, (struct sockaddr *)&policy->cond_local_end, (struct sockaddr *)&compared_policy->cond_local_start, (struct sockaddr *)&compared_policy->cond_local_end)) {
5941 continue;
5942 }
5943 } else if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_PREFIX) {
5944 if (compared_policy->cond_local_prefix > policy->cond_local_prefix ||
0a7de745 5945 !necp_is_addr_in_subnet((struct sockaddr *)&policy->cond_local_start, (struct sockaddr *)&compared_policy->cond_local_start, compared_policy->cond_local_prefix)) {
fe8ab488
A		 5946 continue;
5947 }
5948 }
5949 }
5950
5951 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_START) {
5952 if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_END) {
5953 if (!necp_is_range_in_range((struct sockaddr *)&policy->cond_remote_start, (struct sockaddr *)&policy->cond_remote_end, (struct sockaddr *)&compared_policy->cond_remote_start, (struct sockaddr *)&compared_policy->cond_remote_end)) {
5954 continue;
5955 }
5956 } else if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX) {
5957 if (compared_policy->cond_remote_prefix > policy->cond_remote_prefix ||
0a7de745 5958 !necp_is_addr_in_subnet((struct sockaddr *)&policy->cond_remote_start, (struct sockaddr *)&compared_policy->cond_remote_start, compared_policy->cond_remote_prefix)) {
fe8ab488
A		 5959 continue;
5960 }
5961 }
5962 }
5963
0a7de745 5964 return TRUE;
fe8ab488
A		 5965 }
5966
0a7de745 5967 return FALSE;
fe8ab488
A		 5968}
5969
5970static bool
5971necp_kernel_ip_output_policies_reprocess(void)
5972{
5973 int i;
5974 int bucket_allocation_counts[NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS];
5975 int bucket_current_free_index[NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS];
5976 struct necp_kernel_ip_output_policy *kernel_policy = NULL;
5977
5ba3f43e 5978 LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE);
fe8ab488
A		 5979
5980 // Reset mask to 0
5981 necp_kernel_ip_output_policies_condition_mask = 0;
5982 necp_kernel_ip_output_policies_count = 0;
5983 necp_kernel_ip_output_policies_non_id_count = 0;
5984
5985 for (i = 0; i < NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS; i++) {
5986 if (necp_kernel_ip_output_policies_map[i] != NULL) {
5987 FREE(necp_kernel_ip_output_policies_map[i], M_NECP);
5988 necp_kernel_ip_output_policies_map[i] = NULL;
5989 }
5990
5991 // Init counts
5992 bucket_allocation_counts[i] = 0;
5993 }
5994
5995 LIST_FOREACH(kernel_policy, &necp_kernel_ip_output_policies, chain) {
5996 // Update mask
5997 necp_kernel_ip_output_policies_condition_mask |= kernel_policy->condition_mask;
5998 necp_kernel_ip_output_policies_count++;
5999
d9a64523
A		 6000 /* Update bucket counts:
6001 * Non-id and SKIP policies will be added to all buckets
6002 */
6003 if (!(kernel_policy->condition_mask & NECP_KERNEL_CONDITION_POLICY_ID) ||
0a7de745 6004 kernel_policy->result == NECP_KERNEL_POLICY_RESULT_SKIP) {
fe8ab488
A		 6005 for (i = 0; i < NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS; i++) {
6006 bucket_allocation_counts[i]++;
6007 }
d9a64523
A		 6008 }
6009 if (!(kernel_policy->condition_mask & NECP_KERNEL_CONDITION_POLICY_ID)) {
6010 necp_kernel_ip_output_policies_non_id_count++;
fe8ab488
A		 6011 } else {
6012 bucket_allocation_counts[NECP_IP_OUTPUT_MAP_ID_TO_BUCKET(kernel_policy->cond_policy_id)]++;
6013 }
6014 }
6015
6016 for (i = 0; i < NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS; i++) {
6017 if (bucket_allocation_counts[i] > 0) {
6018 // Allocate a NULL-terminated array of policy pointers for each bucket
6019 MALLOC(necp_kernel_ip_output_policies_map[i], struct necp_kernel_ip_output_policy **, sizeof(struct necp_kernel_ip_output_policy *) * (bucket_allocation_counts[i] + 1), M_NECP, M_WAITOK);
6020 if (necp_kernel_ip_output_policies_map[i] == NULL) {
6021 goto fail;
6022 }
6023
6024 // Initialize the first entry to NULL
6025 (necp_kernel_ip_output_policies_map[i])[0] = NULL;
6026 }
6027 bucket_current_free_index[i] = 0;
6028 }
6029
6030 LIST_FOREACH(kernel_policy, &necp_kernel_ip_output_policies, chain) {
6031 // Insert pointers into map
d9a64523 6032 if (!(kernel_policy->condition_mask & NECP_KERNEL_CONDITION_POLICY_ID) ||
0a7de745 6033 kernel_policy->result == NECP_KERNEL_POLICY_RESULT_SKIP) {
fe8ab488
A		 6034 for (i = 0; i < NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS; i++) {
6035 if (!necp_kernel_ip_output_policy_is_unnecessary(kernel_policy, necp_kernel_ip_output_policies_map[i], bucket_current_free_index[i])) {
6036 (necp_kernel_ip_output_policies_map[i])[(bucket_current_free_index[i])] = kernel_policy;
6037 bucket_current_free_index[i]++;
6038 (necp_kernel_ip_output_policies_map[i])[(bucket_current_free_index[i])] = NULL;
6039 }
6040 }
6041 } else {
6042 i = NECP_IP_OUTPUT_MAP_ID_TO_BUCKET(kernel_policy->cond_policy_id);
6043 if (!necp_kernel_ip_output_policy_is_unnecessary(kernel_policy, necp_kernel_ip_output_policies_map[i], bucket_current_free_index[i])) {
6044 (necp_kernel_ip_output_policies_map[i])[(bucket_current_free_index[i])] = kernel_policy;
6045 bucket_current_free_index[i]++;
6046 (necp_kernel_ip_output_policies_map[i])[(bucket_current_free_index[i])] = NULL;
6047 }
6048 }
6049 }
6050 necp_kernel_ip_output_policies_dump_all();
0a7de745 6051 return TRUE;
fe8ab488
A		 6052
6053fail:
6054 // Free memory, reset mask to 0
6055 necp_kernel_ip_output_policies_condition_mask = 0;
6056 necp_kernel_ip_output_policies_count = 0;
6057 necp_kernel_ip_output_policies_non_id_count = 0;
6058 for (i = 0; i < NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS; i++) {
6059 if (necp_kernel_ip_output_policies_map[i] != NULL) {
6060 FREE(necp_kernel_ip_output_policies_map[i], M_NECP);
6061 necp_kernel_ip_output_policies_map[i] = NULL;
6062 }
6063 }
0a7de745 6064 return FALSE;
fe8ab488
A		 6065}
6066
6067// Outbound Policy Matching
6068// ---------------------
6069struct substring {
6070 char *string;
6071 size_t length;
6072};
6073
6074static struct substring
6075necp_trim_dots_and_stars(char *string, size_t length)
6076{
6077 struct substring sub;
6078 sub.string = string;
6079 sub.length = string ? length : 0;
6080
6081 while (sub.length && (sub.string[0] == '.' || sub.string[0] == '*')) {
6082 sub.string++;
6083 sub.length--;
6084 }
6085
6086 while (sub.length && (sub.string[sub.length - 1] == '.' || sub.string[sub.length - 1] == '*')) {
6087 sub.length--;
6088 }
6089
0a7de745 6090 return sub;
fe8ab488
A		 6091}
6092
6093static char *
6094necp_create_trimmed_domain(char *string, size_t length)
6095{
6096 char *trimmed_domain = NULL;
6097 struct substring sub = necp_trim_dots_and_stars(string, length);
6098
6099 MALLOC(trimmed_domain, char *, sub.length + 1, M_NECP, M_WAITOK);
6100 if (trimmed_domain == NULL) {
0a7de745 6101 return NULL;
fe8ab488
A		 6102 }
6103
6104 memcpy(trimmed_domain, sub.string, sub.length);
6105 trimmed_domain[sub.length] = 0;
6106
0a7de745 6107 return trimmed_domain;
fe8ab488
A		 6108}
6109
6110static inline int
6111necp_count_dots(char *string, size_t length)
6112{
6113 int dot_count = 0;
6114 size_t i = 0;
6115
6116 for (i = 0; i < length; i++) {
6117 if (string[i] == '.') {
6118 dot_count++;
6119 }
6120 }
6121
0a7de745 6122 return dot_count;
fe8ab488
A		 6123}
6124
6125static bool
6126necp_check_suffix(struct substring parent, struct substring suffix, bool require_dot_before_suffix)
6127{
6128 if (parent.length <= suffix.length) {
0a7de745 6129 return FALSE;
fe8ab488
A		 6130 }
6131
6132 size_t length_difference = (parent.length - suffix.length);
6133
6134 if (require_dot_before_suffix) {
6135 if (((char *)(parent.string + length_difference - 1))[0] != '.') {
0a7de745 6136 return FALSE;
fe8ab488
A		 6137 }
6138 }
6139
39037602 6140 // strncasecmp does case-insensitive check for all UTF-8 strings (ignores non-ASCII characters)
0a7de745 6141 return strncasecmp(parent.string + length_difference, suffix.string, suffix.length) == 0;
fe8ab488
A		 6142}
6143
6144static bool
6145necp_hostname_matches_domain(struct substring hostname_substring, u_int8_t hostname_dot_count, char *domain, u_int8_t domain_dot_count)
6146{
6147 if (hostname_substring.string == NULL || domain == NULL) {
0a7de745 6148 return hostname_substring.string == domain;
fe8ab488
A		 6149 }
6150
6151 struct substring domain_substring;
6152 domain_substring.string = domain;
6153 domain_substring.length = strlen(domain);
6154
6155 if (hostname_dot_count == domain_dot_count) {
39037602 6156 // strncasecmp does case-insensitive check for all UTF-8 strings (ignores non-ASCII characters)
fe8ab488 6157 if (hostname_substring.length == domain_substring.length &&
0a7de745
A		 6158 strncasecmp(hostname_substring.string, domain_substring.string, hostname_substring.length) == 0) {
6159 return TRUE;
fe8ab488 6160 }
3e170ce0 6161 } else if (domain_dot_count < hostname_dot_count) {
fe8ab488 6162 if (necp_check_suffix(hostname_substring, domain_substring, TRUE)) {
0a7de745 6163 return TRUE;
fe8ab488
A		 6164 }
6165 }
6166
0a7de745 6167 return FALSE;
fe8ab488
A		 6168}
6169
39037602
A		 6170static char *
6171necp_copy_string(char *string, size_t length)
6172{
6173 char *copied_string = NULL;
6174
6175 MALLOC(copied_string, char *, length + 1, M_NECP, M_WAITOK);
6176 if (copied_string == NULL) {
0a7de745 6177 return NULL;
39037602
A		 6178 }
6179
6180 memcpy(copied_string, string, length);
6181 copied_string[length] = 0;
6182
0a7de745 6183 return copied_string;
39037602
A		 6184}
6185
d9a64523
A		 6186static u_int32_t
6187necp_get_primary_direct_interface_index(void)
6188{
6189 u_int32_t interface_index = IFSCOPE_NONE;
6190
6191 ifnet_head_lock_shared();
6192 struct ifnet *ordered_interface = NULL;
6193 TAILQ_FOREACH(ordered_interface, &ifnet_ordered_head, if_ordered_link) {
6194 const u_int8_t functional_type = if_functional_type(ordered_interface, TRUE);
6195 if (functional_type != IFRTYPE_FUNCTIONAL_UNKNOWN &&
0a7de745 6196 functional_type != IFRTYPE_FUNCTIONAL_LOOPBACK) {
d9a64523
A		 6197 // All known, non-loopback functional types represent direct physical interfaces (Wi-Fi, Cellular, Wired)
6198 interface_index = ordered_interface->if_index;
6199 break;
6200 }
6201 }
6202 ifnet_head_done();
6203
6204 return interface_index;
6205}
6206
d26ffc64
A		 6207static inline void
6208necp_get_parent_cred_result(proc_t proc, struct necp_socket_info *info)
6209{
6210 task_t task = proc_task(proc ? proc : current_proc());
6211 coalition_t coal = COALITION_NULL;
6212 Boolean is_leader = coalition_is_leader(task, COALITION_TYPE_JETSAM, &coal);
6213
6214 if (is_leader == TRUE) {
6215 // No parent, nothing to do
6216 return;
6217 }
6218
6219 if (coal != NULL) {
6220 task_t lead_task = coalition_get_leader(coal);
6221 if (lead_task != NULL) {
6222 proc_t lead_proc = get_bsdtask_info(lead_task);
6223 if (lead_proc != NULL) {
6224 kauth_cred_t lead_cred = kauth_cred_proc_ref(lead_proc);
6225 if (lead_cred != NULL) {
6226 errno_t cred_result = priv_check_cred(lead_cred, PRIV_NET_PRIVILEGED_NECP_MATCH, 0);
6227 kauth_cred_unref(&lead_cred);
6228 info->cred_result = cred_result;
6229 }
6230 }
6231 task_deallocate(lead_task);
6232 }
6233 }
6234}
6235
0a7de745 6236#define NECP_KERNEL_ADDRESS_TYPE_CONDITIONS (NECP_KERNEL_CONDITION_LOCAL_START | NECP_KERNEL_CONDITION_LOCAL_END | NECP_KERNEL_CONDITION_LOCAL_PREFIX | NECP_KERNEL_CONDITION_REMOTE_START | NECP_KERNEL_CONDITION_REMOTE_END | NECP_KERNEL_CONDITION_REMOTE_PREFIX)
39037602
A		 6237static void
6238necp_application_fillout_info_locked(uuid_t application_uuid, uuid_t real_application_uuid, char *account, char *domain, pid_t pid, uid_t uid, u_int16_t protocol, u_int32_t bound_interface_index, u_int32_t traffic_class, union necp_sockaddr_union *local_addr, union necp_sockaddr_union *remote_addr, proc_t proc, struct necp_socket_info *info)
fe8ab488
A		 6239{
6240 memset(info, 0, sizeof(struct necp_socket_info));
6241
6242 info->pid = pid;
6243 info->uid = uid;
6244 info->protocol = protocol;
6245 info->bound_interface_index = bound_interface_index;
6246 info->traffic_class = traffic_class;
39037602
A		 6247
6248 if (necp_kernel_application_policies_condition_mask & NECP_KERNEL_CONDITION_ENTITLEMENT && proc != NULL) {
6249 info->cred_result = priv_check_cred(proc_ucred(proc), PRIV_NET_PRIVILEGED_NECP_MATCH, 0);
d26ffc64
A		 6250 if (info->cred_result != 0) {
6251 // Process does not have entitlement, check the parent process
6252 necp_get_parent_cred_result(proc, info);
6253 }
39037602 6254 }
fe8ab488
A		 6255
6256 if (necp_kernel_application_policies_condition_mask & NECP_KERNEL_CONDITION_APP_ID && !uuid_is_null(application_uuid)) {
6257 struct necp_uuid_id_mapping *existing_mapping = necp_uuid_lookup_app_id_locked(application_uuid);
6258 if (existing_mapping) {
6259 info->application_id = existing_mapping->id;
6260 }
6261 }
6262
6263 if (necp_kernel_application_policies_condition_mask & NECP_KERNEL_CONDITION_REAL_APP_ID && !uuid_is_null(real_application_uuid)) {
6264 if (uuid_compare(application_uuid, real_application_uuid) == 0) {
6265 info->real_application_id = info->application_id;
6266 } else {
6267 struct necp_uuid_id_mapping *existing_mapping = necp_uuid_lookup_app_id_locked(real_application_uuid);
6268 if (existing_mapping) {
6269 info->real_application_id = existing_mapping->id;
6270 }
6271 }
6272 }
6273
6274 if (necp_kernel_application_policies_condition_mask & NECP_KERNEL_CONDITION_ACCOUNT_ID && account != NULL) {
6275 struct necp_string_id_mapping *existing_mapping = necp_lookup_string_to_id_locked(&necp_account_id_list, account);
6276 if (existing_mapping) {
6277 info->account_id = existing_mapping->id;
6278 }
6279 }
6280
6281 if (necp_kernel_application_policies_condition_mask & NECP_KERNEL_CONDITION_DOMAIN) {
6282 info->domain = domain;
6283 }
3e170ce0
A		 6284
6285 if (necp_kernel_application_policies_condition_mask & NECP_KERNEL_ADDRESS_TYPE_CONDITIONS) {
6286 if (local_addr && local_addr->sa.sa_len > 0) {
6287 memcpy(&info->local_addr, local_addr, local_addr->sa.sa_len);
6288 }
6289 if (remote_addr && remote_addr->sa.sa_len > 0) {
6290 memcpy(&info->remote_addr, remote_addr, remote_addr->sa.sa_len);
6291 }
6292 }
6293}
6294
6295static void
39037602 6296necp_send_application_interface_denied_event(pid_t pid, uuid_t proc_uuid, u_int32_t if_functional_type)
3e170ce0
A		 6297{
6298 struct kev_netpolicy_ifdenied ev_ifdenied;
6299
6300 bzero(&ev_ifdenied, sizeof(ev_ifdenied));
6301
6302 ev_ifdenied.ev_data.epid = pid;
6303 uuid_copy(ev_ifdenied.ev_data.euuid, proc_uuid);
39037602 6304 ev_ifdenied.ev_if_functional_type = if_functional_type;
3e170ce0
A		 6305
6306 netpolicy_post_msg(KEV_NETPOLICY_IFDENIED, &ev_ifdenied.ev_data, sizeof(ev_ifdenied));
fe8ab488
A		 6307}
6308
39037602
A		 6309extern char *proc_name_address(void *p);
6310
6311#define NECP_VERIFY_DELEGATION_ENTITLEMENT(_p, _d) \
6312 if (!has_checked_delegation_entitlement) { \
0a7de745
A		 6313 has_delegation_entitlement = (priv_check_cred(proc_ucred(_p), PRIV_NET_PRIVILEGED_SOCKET_DELEGATE, 0) == 0); \
6314 has_checked_delegation_entitlement = TRUE; \
39037602
A		 6315 } \
6316 if (!has_delegation_entitlement) { \
0a7de745
A		 6317 NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to delegate network traffic for other processes by %s", \
6318 proc_name_address(_p), proc_pid(_p), _d); \
6319 break; \
39037602
A		 6320 }
6321
6322int
6323necp_application_find_policy_match_internal(proc_t proc,
0a7de745
A		 6324 u_int8_t *parameters,
6325 u_int32_t parameters_size,
6326 struct necp_aggregate_result *returned_result,
6327 u_int32_t *flags,
6328 u_int required_interface_index,
6329 const union necp_sockaddr_union *override_local_addr,
6330 const union necp_sockaddr_union *override_remote_addr,
6331 struct rtentry **returned_route, bool ignore_address)
fe8ab488
A		 6332{
6333 int error = 0;
6334 size_t offset = 0;
6335
6336 struct necp_kernel_socket_policy *matched_policy = NULL;
6337 struct necp_socket_info info;
6338 necp_kernel_policy_filter filter_control_unit = 0;
3e170ce0 6339 u_int32_t route_rule_id = 0;
fe8ab488
A		 6340 necp_kernel_policy_result service_action = 0;
6341 necp_kernel_policy_service service = { 0, 0 };
6342
fe8ab488 6343 u_int16_t protocol = 0;
39037602 6344 u_int32_t bound_interface_index = required_interface_index;
fe8ab488 6345 u_int32_t traffic_class = 0;
5ba3f43e 6346 u_int32_t client_flags = 0;
3e170ce0
A		 6347 union necp_sockaddr_union local_addr;
6348 union necp_sockaddr_union remote_addr;
6349 bool no_remote_addr = FALSE;
39037602
A		 6350 u_int8_t remote_family = 0;
6351 bool no_local_addr = FALSE;
fe8ab488 6352
5ba3f43e
A		 6353 if (override_local_addr) {
6354 memcpy(&local_addr, override_local_addr, sizeof(local_addr));
6355 } else {
6356 memset(&local_addr, 0, sizeof(local_addr));
6357 }
6358 if (override_remote_addr) {
6359 memcpy(&remote_addr, override_remote_addr, sizeof(remote_addr));
6360 } else {
6361 memset(&remote_addr, 0, sizeof(remote_addr));
6362 }
39037602
A		 6363
6364 // Initialize UID, PID, and UUIDs to the current process
6365 uid_t uid = kauth_cred_getuid(proc_ucred(proc));
6366 pid_t pid = proc_pid(proc);
fe8ab488
A		 6367 uuid_t application_uuid;
6368 uuid_clear(application_uuid);
6369 uuid_t real_application_uuid;
6370 uuid_clear(real_application_uuid);
39037602
A		 6371 proc_getexecutableuuid(proc, real_application_uuid, sizeof(real_application_uuid));
6372 uuid_copy(application_uuid, real_application_uuid);
6373
fe8ab488
A		 6374 char *domain = NULL;
6375 char *account = NULL;
6376
d9a64523
A		 6377#define NECP_MAX_REQUIRED_AGENTS 16
6378 u_int32_t num_required_agent_types = 0;
6379 struct necp_client_parameter_netagent_type required_agent_types[NECP_MAX_REQUIRED_AGENTS];
6380 memset(&required_agent_types, 0, sizeof(required_agent_types));
6381
3e170ce0 6382 u_int32_t netagent_ids[NECP_MAX_NETAGENTS];
d9a64523 6383 u_int32_t netagent_use_flags[NECP_MAX_NETAGENTS];
3e170ce0 6384 memset(&netagent_ids, 0, sizeof(netagent_ids));
d9a64523 6385 memset(&netagent_use_flags, 0, sizeof(netagent_use_flags));
3e170ce0
A		 6386 int netagent_cursor;
6387
39037602
A		 6388 bool has_checked_delegation_entitlement = FALSE;
6389 bool has_delegation_entitlement = FALSE;
6390
fe8ab488 6391 if (returned_result == NULL) {
0a7de745 6392 return EINVAL;
fe8ab488
A		 6393 }
6394
6395 memset(returned_result, 0, sizeof(struct necp_aggregate_result));
6396
6397 lck_rw_lock_shared(&necp_kernel_policy_lock);
6398 if (necp_kernel_application_policies_count == 0) {
6399 if (necp_drop_all_order > 0) {
6400 returned_result->routing_result = NECP_KERNEL_POLICY_RESULT_DROP;
6401 lck_rw_done(&necp_kernel_policy_lock);
0a7de745 6402 return 0;
fe8ab488
A		 6403 }
6404 }
6405 lck_rw_done(&necp_kernel_policy_lock);
6406
3e170ce0 6407 while ((offset + sizeof(u_int8_t) + sizeof(u_int32_t)) <= parameters_size) {
fe8ab488 6408 u_int8_t type = necp_buffer_get_tlv_type(parameters, offset);
3e170ce0 6409 u_int32_t length = necp_buffer_get_tlv_length(parameters, offset);
fe8ab488 6410
813fb2f6
A		 6411 if (length > (parameters_size - (offset + sizeof(u_int8_t) + sizeof(u_int32_t)))) {
6412 // If the length is larger than what can fit in the remaining parameters size, bail
6413 NECPLOG(LOG_ERR, "Invalid TLV length (%u)", length);
6414 break;
6415 }
6416
6417 if (length > 0) {
fe8ab488
A		 6418 u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL);
6419 if (value != NULL) {
6420 switch (type) {
0a7de745
A		 6421 case NECP_CLIENT_PARAMETER_APPLICATION: {
6422 if (length >= sizeof(uuid_t)) {
6423 if (uuid_compare(application_uuid, value) == 0) {
6424 // No delegation
6425 break;
6426 }
39037602 6427
0a7de745 6428 NECP_VERIFY_DELEGATION_ENTITLEMENT(proc, "euuid");
39037602 6429
0a7de745 6430 uuid_copy(application_uuid, value);
fe8ab488 6431 }
0a7de745
A		 6432 break;
6433 }
6434 case NECP_CLIENT_PARAMETER_REAL_APPLICATION: {
6435 if (length >= sizeof(uuid_t)) {
6436 if (uuid_compare(real_application_uuid, value) == 0) {
6437 // No delegation
6438 break;
6439 }
39037602 6440
0a7de745 6441 NECP_VERIFY_DELEGATION_ENTITLEMENT(proc, "uuid");
39037602 6442
0a7de745 6443 uuid_copy(real_application_uuid, value);
fe8ab488 6444 }
0a7de745
A		 6445 break;
6446 }
6447 case NECP_CLIENT_PARAMETER_PID: {
6448 if (length >= sizeof(pid_t)) {
6449 if (memcmp(&pid, value, sizeof(pid_t)) == 0) {
6450 // No delegation
6451 break;
6452 }
39037602 6453
0a7de745 6454 NECP_VERIFY_DELEGATION_ENTITLEMENT(proc, "pid");
39037602 6455
0a7de745 6456 memcpy(&pid, value, sizeof(pid_t));
39037602 6457 }
0a7de745
A		 6458 break;
6459 }
6460 case NECP_CLIENT_PARAMETER_UID: {
6461 if (length >= sizeof(uid_t)) {
6462 if (memcmp(&uid, value, sizeof(uid_t)) == 0) {
6463 // No delegation
6464 break;
6465 }
39037602 6466
0a7de745 6467 NECP_VERIFY_DELEGATION_ENTITLEMENT(proc, "uid");
39037602 6468
0a7de745 6469 memcpy(&uid, value, sizeof(uid_t));
fe8ab488 6470 }
0a7de745
A		 6471 break;
6472 }
6473 case NECP_CLIENT_PARAMETER_DOMAIN: {
6474 domain = (char *)value;
6475 domain[length - 1] = 0;
6476 break;
6477 }
6478 case NECP_CLIENT_PARAMETER_ACCOUNT: {
6479 account = (char *)value;
6480 account[length - 1] = 0;
6481 break;
6482 }
6483 case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: {
6484 if (length >= sizeof(u_int32_t)) {
6485 memcpy(&traffic_class, value, sizeof(u_int32_t));
fe8ab488 6486 }
0a7de745
A		 6487 break;
6488 }
6489 case NECP_CLIENT_PARAMETER_IP_PROTOCOL: {
6490 if (length >= sizeof(u_int16_t)) {
6491 memcpy(&protocol, value, sizeof(u_int16_t));
fe8ab488 6492 }
0a7de745
A		 6493 break;
6494 }
6495 case NECP_CLIENT_PARAMETER_BOUND_INTERFACE: {
6496 if (length <= IFXNAMSIZ && length > 0) {
6497 ifnet_t bound_interface = NULL;
6498 char interface_name[IFXNAMSIZ];
6499 memcpy(interface_name, value, length);
6500 interface_name[length - 1] = 0; // Make sure the string is NULL terminated
6501 if (ifnet_find_by_name(interface_name, &bound_interface) == 0) {
6502 bound_interface_index = bound_interface->if_index;
6503 ifnet_release(bound_interface);
fe8ab488 6504 }
fe8ab488 6505 }
0a7de745
A		 6506 break;
6507 }
6508 case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: {
6509 if (ignore_address) {
fe8ab488
A		 6510 break;
6511 }
5ba3f43e 6512
0a7de745
A		 6513 if (length >= sizeof(struct necp_policy_condition_addr)) {
6514 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
6515 if (necp_address_is_valid(&address_struct->address.sa)) {
6516 memcpy(&local_addr, &address_struct->address, sizeof(address_struct->address));
3e170ce0 6517 }
0a7de745
A		 6518 }
6519 break;
6520 }
6521 case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: {
6522 if (ignore_address) {
3e170ce0
A		 6523 break;
6524 }
5ba3f43e 6525
0a7de745
A		 6526 if (length >= sizeof(struct necp_policy_condition_addr)) {
6527 struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value;
6528 if (necp_address_is_valid(&address_struct->address.sa)) {
6529 memcpy(&remote_addr, &address_struct->address, sizeof(address_struct->address));
3e170ce0 6530 }
3e170ce0 6531 }
0a7de745
A		 6532 break;
6533 }
6534 case NECP_CLIENT_PARAMETER_FLAGS: {
6535 if (length >= sizeof(client_flags)) {
6536 memcpy(&client_flags, value, sizeof(client_flags));
d9a64523 6537 }
0a7de745
A		 6538 break;
6539 }
6540 case NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE: {
6541 if (num_required_agent_types >= NECP_MAX_REQUIRED_AGENTS) {
d9a64523 6542 break;
5ba3f43e 6543 }
0a7de745
A		 6544 if (length >= sizeof(struct necp_client_parameter_netagent_type)) {
6545 memcpy(&required_agent_types[num_required_agent_types], value, sizeof(struct necp_client_parameter_netagent_type));
6546 num_required_agent_types++;
fe8ab488 6547 }
0a7de745
A		 6548 break;
6549 }
6550 default: {
6551 break;
6552 }
fe8ab488
A		 6553 }
6554 }
6555 }
6556
3e170ce0 6557 offset += sizeof(u_int8_t) + sizeof(u_int32_t) + length;
fe8ab488
A		 6558 }
6559
6560 // Lock
6561 lck_rw_lock_shared(&necp_kernel_policy_lock);
6562
39037602 6563 necp_application_fillout_info_locked(application_uuid, real_application_uuid, account, domain, pid, uid, protocol, bound_interface_index, traffic_class, &local_addr, &remote_addr, proc, &info);
d9a64523 6564 matched_policy = necp_socket_find_policy_match_with_info_locked(necp_kernel_socket_policies_app_layer_map, &info, &filter_control_unit, &route_rule_id, &service_action, &service, netagent_ids, netagent_use_flags, NECP_MAX_NETAGENTS, required_agent_types, num_required_agent_types, proc, NULL);
fe8ab488 6565 if (matched_policy) {
3e170ce0 6566 returned_result->policy_id = matched_policy->id;
fe8ab488
A		 6567 returned_result->routing_result = matched_policy->result;
6568 memcpy(&returned_result->routing_result_parameter, &matched_policy->result_parameter, sizeof(returned_result->routing_result_parameter));
5ba3f43e
A		 6569 } else if (necp_drop_all_order > 0) {
6570 // Mark socket as a drop if drop_all is set
6571 returned_result->policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
6572 returned_result->routing_result = NECP_KERNEL_POLICY_RESULT_DROP;
fe8ab488 6573 } else {
3e170ce0 6574 returned_result->policy_id = 0;
fe8ab488
A		 6575 returned_result->routing_result = NECP_KERNEL_POLICY_RESULT_NONE;
6576 }
6577 returned_result->filter_control_unit = filter_control_unit;
6578 returned_result->service_action = service_action;
6579
3e170ce0 6580 // Handle trigger service
fe8ab488
A		 6581 if (service.identifier != 0) {
6582 struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(service.identifier);
6583 if (mapping != NULL) {
6584 struct necp_service_registration *service_registration = NULL;
6585 uuid_copy(returned_result->service_uuid, mapping->uuid);
6586 returned_result->service_data = service.data;
6587 if (service.identifier == NECP_NULL_SERVICE_ID) {
6588 // NULL service is always 'registered'
6589 returned_result->service_flags |= NECP_SERVICE_FLAGS_REGISTERED;
6590 } else {
6591 LIST_FOREACH(service_registration, &necp_registered_service_list, kernel_chain) {
6592 if (service.identifier == service_registration->service_id) {
6593 returned_result->service_flags |= NECP_SERVICE_FLAGS_REGISTERED;
6594 break;
6595 }
6596 }
6597 }
6598 }
6599 }
6600
3e170ce0
A		 6601 // Handle netagents
6602 for (netagent_cursor = 0; netagent_cursor < NECP_MAX_NETAGENTS; netagent_cursor++) {
6603 struct necp_uuid_id_mapping *mapping = NULL;
6604 u_int32_t netagent_id = netagent_ids[netagent_cursor];
6605 if (netagent_id == 0) {
6606 break;
6607 }
6608 mapping = necp_uuid_lookup_uuid_with_service_id_locked(netagent_id);
6609 if (mapping != NULL) {
6610 uuid_copy(returned_result->netagents[netagent_cursor], mapping->uuid);
d9a64523 6611 returned_result->netagent_use_flags[netagent_cursor] = netagent_use_flags[netagent_cursor];
3e170ce0
A		 6612 }
6613 }
6614
6615 // Do routing evaluation
6616 u_int output_bound_interface = bound_interface_index;
6617 if (returned_result->routing_result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) {
6618 output_bound_interface = returned_result->routing_result_parameter.scoped_interface_index;
6619 } else if (returned_result->routing_result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL) {
6620 output_bound_interface = returned_result->routing_result_parameter.tunnel_interface_index;
d9a64523
A		 6621 } else if (returned_result->routing_result == NECP_KERNEL_POLICY_RESULT_SCOPED_DIRECT) {
6622 output_bound_interface = necp_get_primary_direct_interface_index();
6623 if (output_bound_interface == IFSCOPE_NONE) {
6624 returned_result->routing_result = NECP_KERNEL_POLICY_RESULT_DROP;
6625 } else {
6626 returned_result->routing_result = NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED;
6627 returned_result->routing_result_parameter.scoped_interface_index = output_bound_interface;
6628 }
3e170ce0
A		 6629 }
6630
39037602 6631 if (local_addr.sa.sa_len == 0 ||
0a7de745
A		 6632 (local_addr.sa.sa_family == AF_INET && local_addr.sin.sin_addr.s_addr == 0) ||
6633 (local_addr.sa.sa_family == AF_INET6 && IN6_IS_ADDR_UNSPECIFIED(&local_addr.sin6.sin6_addr))) {
39037602
A		 6634 no_local_addr = TRUE;
6635 }
6636
6637 if (remote_addr.sa.sa_len == 0 ||
0a7de745
A		 6638 (remote_addr.sa.sa_family == AF_INET && remote_addr.sin.sin_addr.s_addr == 0) ||
6639 (remote_addr.sa.sa_family == AF_INET6 && IN6_IS_ADDR_UNSPECIFIED(&remote_addr.sin6.sin6_addr))) {
3e170ce0 6640 no_remote_addr = TRUE;
39037602
A		 6641 remote_family = remote_addr.sa.sa_family;
6642 }
6643
5ba3f43e 6644 returned_result->routed_interface_index = 0;
3e170ce0 6645 struct rtentry *rt = NULL;
5ba3f43e
A		 6646 if (!no_local_addr && (client_flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) != 0) {
6647 // Treat the output bound interface as the routed interface for local address
6648 // validation later.
6649 returned_result->routed_interface_index = output_bound_interface;
6650 } else {
6651 if (no_remote_addr) {
6652 memset(&remote_addr, 0, sizeof(remote_addr));
6653 if (remote_family == AF_INET6) {
6654 // Reset address to ::
6655 remote_addr.sa.sa_family = AF_INET6;
6656 remote_addr.sa.sa_len = sizeof(struct sockaddr_in6);
6657 } else {
6658 // Reset address to 0.0.0.0
6659 remote_addr.sa.sa_family = AF_INET;
6660 remote_addr.sa.sa_len = sizeof(struct sockaddr_in);
6661 }
6662 }
3e170ce0 6663
5ba3f43e 6664 rt = rtalloc1_scoped((struct sockaddr *)&remote_addr, 0, 0,
0a7de745 6665 output_bound_interface);
3e170ce0 6666
d9a64523
A		 6667 if (remote_addr.sa.sa_family == AF_INET && rt != NULL &&
6668 IS_INTF_CLAT46(rt->rt_ifp)) {
6669 rtfree(rt);
6670 rt = NULL;
6671 returned_result->routed_interface_index = 0;
6672 }
6673
5ba3f43e 6674 if (no_remote_addr && remote_family == 0 &&
0a7de745 6675 (rt == NULL || rt->rt_ifp == NULL)) {
5ba3f43e 6676 // Route lookup for default IPv4 failed, try IPv6
3e170ce0 6677
5ba3f43e
A		 6678 // Cleanup old route if necessary
6679 if (rt != NULL) {
6680 rtfree(rt);
6681 rt = NULL;
6682 }
3e170ce0 6683
5ba3f43e
A		 6684 // Reset address to ::
6685 memset(&remote_addr, 0, sizeof(remote_addr));
6686 remote_addr.sa.sa_family = AF_INET6;
6687 remote_addr.sa.sa_len = sizeof(struct sockaddr_in6);
3e170ce0 6688
5ba3f43e
A		 6689 // Get route
6690 rt = rtalloc1_scoped((struct sockaddr *)&remote_addr, 0, 0,
0a7de745 6691 output_bound_interface);
5ba3f43e 6692 }
3e170ce0 6693
5ba3f43e 6694 if (rt != NULL &&
0a7de745 6695 rt->rt_ifp != NULL) {
5ba3f43e 6696 returned_result->routed_interface_index = rt->rt_ifp->if_index;
3e170ce0 6697 /*
5ba3f43e
A		 6698 * For local addresses, we allow the interface scope to be
6699 * either the loopback interface or the interface hosting the
6700 * local address.
3e170ce0 6701 */
5ba3f43e 6702 if (bound_interface_index != IFSCOPE_NONE &&
0a7de745
A		 6703 rt->rt_ifa != NULL && rt->rt_ifa->ifa_ifp &&
6704 (output_bound_interface == lo_ifp->if_index ||
6705 rt->rt_ifp->if_index == lo_ifp->if_index ||
6706 rt->rt_ifa->ifa_ifp->if_index == bound_interface_index)) {
5ba3f43e
A		 6707 struct sockaddr_storage dst;
6708 unsigned int ifscope = bound_interface_index;
3e170ce0 6709
5ba3f43e
A		 6710 /*
6711 * Transform dst into the internal routing table form
6712 */
6713 (void) sa_copy((struct sockaddr *)&remote_addr,
0a7de745 6714 &dst, &ifscope);
5ba3f43e
A		 6715
6716 if ((rt->rt_ifp->if_index == lo_ifp->if_index) ||
0a7de745 6717 rt_ifa_is_dst((struct sockaddr *)&dst, rt->rt_ifa)) {
5ba3f43e 6718 returned_result->routed_interface_index =
0a7de745
A		 6719 bound_interface_index;
6720 }
5ba3f43e 6721 }
3e170ce0
A		 6722 }
6723 }
6724
39037602 6725 if (returned_result->routed_interface_index != 0 &&
0a7de745
A		 6726 returned_result->routed_interface_index != lo_ifp->if_index && // Loopback can accept any local address
6727 !no_local_addr) {
39037602
A		 6728 // Transform local_addr into the ifaddr form
6729 // IPv6 Scope IDs are always embedded in the ifaddr list
6730 struct sockaddr_storage local_address_sanitized;
6731 u_int ifscope = IFSCOPE_NONE;
6732 (void)sa_copy(&local_addr.sa, &local_address_sanitized, &ifscope);
6733 SIN(&local_address_sanitized)->sin_port = 0;
6734 if (local_address_sanitized.ss_family == AF_INET6) {
6735 SIN6(&local_address_sanitized)->sin6_scope_id = 0;
6736 }
6737
6738 // Validate local address on routed interface
6739 struct ifaddr *ifa = ifa_ifwithaddr_scoped((struct sockaddr *)&local_address_sanitized, returned_result->routed_interface_index);
6740 if (ifa == NULL) {
6741 // Interface address not found, reject route
6742 returned_result->routed_interface_index = 0;
6743 if (rt != NULL) {
6744 rtfree(rt);
6745 rt = NULL;
6746 }
6747 } else {
6748 ifaddr_release(ifa);
6749 ifa = NULL;
6750 }
6751 }
6752
6753 if (flags != NULL) {
5ba3f43e
A		 6754 if ((client_flags & NECP_CLIENT_PARAMETER_FLAG_LISTENER) == 0) {
6755 // Check for local/direct
6756 bool is_local = FALSE;
6757 if (rt != NULL && (rt->rt_flags & RTF_LOCAL)) {
6758 is_local = TRUE;
6759 } else if (returned_result->routed_interface_index != 0 &&
0a7de745 6760 !no_remote_addr) {
a39ff7e2
A		 6761 // Clean up the address before comparison with interface addresses
6762
6763 // Transform remote_addr into the ifaddr form
6764 // IPv6 Scope IDs are always embedded in the ifaddr list
6765 struct sockaddr_storage remote_address_sanitized;
6766 u_int ifscope = IFSCOPE_NONE;
6767 (void)sa_copy(&remote_addr.sa, &remote_address_sanitized, &ifscope);
6768 SIN(&remote_address_sanitized)->sin_port = 0;
6769 if (remote_address_sanitized.ss_family == AF_INET6) {
6770 SIN6(&remote_address_sanitized)->sin6_scope_id = 0;
6771 }
6772
5ba3f43e 6773 // Check if remote address is an interface address
a39ff7e2 6774 struct ifaddr *ifa = ifa_ifwithaddr((struct sockaddr *)&remote_address_sanitized);
5ba3f43e
A		 6775 if (ifa != NULL && ifa->ifa_ifp != NULL) {
6776 u_int if_index_for_remote_addr = ifa->ifa_ifp->if_index;
6777 if (if_index_for_remote_addr == returned_result->routed_interface_index ||
0a7de745 6778 if_index_for_remote_addr == lo_ifp->if_index) {
5ba3f43e
A		 6779 is_local = TRUE;
6780 }
6781 }
6782 if (ifa != NULL) {
6783 ifaddr_release(ifa);
6784 ifa = NULL;
39037602
A		 6785 }
6786 }
5ba3f43e
A		 6787
6788 if (is_local) {
6789 *flags |= (NECP_CLIENT_RESULT_FLAG_IS_LOCAL | NECP_CLIENT_RESULT_FLAG_IS_DIRECT);
6790 } else {
6791 if (rt != NULL &&
0a7de745
A		 6792 !(rt->rt_flags & RTF_GATEWAY) &&
6793 (rt->rt_ifa && rt->rt_ifa->ifa_ifp && !(rt->rt_ifa->ifa_ifp->if_flags & IFF_POINTOPOINT))) {
5ba3f43e
A		 6794 // Route is directly accessible
6795 *flags |= NECP_CLIENT_RESULT_FLAG_IS_DIRECT;
6796 }
39037602 6797 }
39037602 6798
39037602 6799 if (rt != NULL &&
0a7de745 6800 rt->rt_ifp != NULL) {
5ba3f43e
A		 6801 // Check probe status
6802 if (rt->rt_ifp->if_eflags & IFEF_PROBE_CONNECTIVITY) {
6803 *flags |= NECP_CLIENT_RESULT_FLAG_PROBE_CONNECTIVITY;
6804 }
6805
6806 if (rt->rt_ifp->if_type == IFT_CELLULAR) {
6807 struct if_cellular_status_v1 *ifsr;
6808
6809 ifnet_lock_shared(rt->rt_ifp);
6810 lck_rw_lock_exclusive(&rt->rt_ifp->if_link_status_lock);
6811
6812 if (rt->rt_ifp->if_link_status != NULL) {
6813 ifsr = &rt->rt_ifp->if_link_status->ifsr_u.ifsr_cell.if_cell_u.if_status_v1;
6814
6815 if (ifsr->valid_bitmask & IF_CELL_UL_MSS_RECOMMENDED_VALID) {
6816 if (ifsr->mss_recommended == IF_CELL_UL_MSS_RECOMMENDED_NONE) {
6817 returned_result->mss_recommended = NECP_CLIENT_RESULT_RECOMMENDED_MSS_NONE;
6818 } else if (ifsr->mss_recommended == IF_CELL_UL_MSS_RECOMMENDED_MEDIUM) {
6819 returned_result->mss_recommended = NECP_CLIENT_RESULT_RECOMMENDED_MSS_MEDIUM;
6820 } else if (ifsr->mss_recommended == IF_CELL_UL_MSS_RECOMMENDED_LOW) {
6821 returned_result->mss_recommended = NECP_CLIENT_RESULT_RECOMMENDED_MSS_LOW;
6822 }
6823 }
6824 }
6825 lck_rw_done(&rt->rt_ifp->if_link_status_lock);
6826 ifnet_lock_done(rt->rt_ifp);
6827 }
6828
6829 // Check link quality
6830 if ((client_flags & NECP_CLIENT_PARAMETER_FLAG_DISCRETIONARY) &&
0a7de745
A		 6831 (rt->rt_ifp->if_interface_state.valid_bitmask & IF_INTERFACE_STATE_LQM_STATE_VALID) &&
6832 rt->rt_ifp->if_interface_state.lqm_state == IFNET_LQM_THRESH_ABORT) {
5ba3f43e
A		 6833 *flags |= NECP_CLIENT_RESULT_FLAG_LINK_QUALITY_ABORT;
6834 }
6835
6836 // Check QoS marking (fastlane)
6837 if (necp_update_qos_marking(rt->rt_ifp, route_rule_id)) {
6838 *flags |= NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING;
6839 }
d9a64523
A		 6840
6841 if (IFNET_IS_LOW_POWER(rt->rt_ifp)) {
6842 *flags |= NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER;
6843 }
39037602
A		 6844 }
6845 }
6846
6847 if (returned_result->routed_interface_index != 0) {
6848 union necp_sockaddr_union default_address;
6849 struct rtentry *v4Route = NULL;
6850 struct rtentry *v6Route = NULL;
6851
6852 memset(&default_address, 0, sizeof(default_address));
6853
6854 // Reset address to 0.0.0.0
6855 default_address.sa.sa_family = AF_INET;
6856 default_address.sa.sa_len = sizeof(struct sockaddr_in);
6857 v4Route = rtalloc1_scoped((struct sockaddr *)&default_address, 0, 0,
6858 returned_result->routed_interface_index);
6859
6860 // Reset address to ::
6861 default_address.sa.sa_family = AF_INET6;
6862 default_address.sa.sa_len = sizeof(struct sockaddr_in6);
6863 v6Route = rtalloc1_scoped((struct sockaddr *)&default_address, 0, 0,
6864 returned_result->routed_interface_index);
6865
6866 if (v4Route != NULL) {
d9a64523 6867 if (v4Route->rt_ifp != NULL && !IS_INTF_CLAT46(v4Route->rt_ifp)) {
39037602
A		 6868 *flags |= NECP_CLIENT_RESULT_FLAG_HAS_IPV4;
6869 }
6870 rtfree(v4Route);
6871 v4Route = NULL;
6872 }
6873
6874 if (v6Route != NULL) {
6875 if (v6Route->rt_ifp != NULL) {
6876 *flags |= NECP_CLIENT_RESULT_FLAG_HAS_IPV6;
d9a64523
A		 6877
6878 if (ifnet_get_nat64prefix(v6Route->rt_ifp, NULL) == 0) {
6879 *flags |= NECP_CLIENT_RESULT_FLAG_HAS_NAT64;
6880 }
39037602
A		 6881 }
6882 rtfree(v6Route);
6883 v6Route = NULL;
6884 }
6885 }
6886 }
6887
6888 u_int32_t interface_type_denied = IFRTYPE_FUNCTIONAL_UNKNOWN;
6889 bool route_is_allowed = necp_route_is_allowed(rt, NULL, route_rule_id, &interface_type_denied);
3e170ce0
A		 6890 if (!route_is_allowed) {
6891 // If the route is blocked, treat the lookup as a drop
6892 returned_result->routing_result = NECP_KERNEL_POLICY_RESULT_DROP;
6893 memset(&returned_result->routing_result_parameter, 0, sizeof(returned_result->routing_result_parameter));
6894
39037602
A		 6895 if (interface_type_denied != IFRTYPE_FUNCTIONAL_UNKNOWN) {
6896 necp_send_application_interface_denied_event(pid, application_uuid, interface_type_denied);
3e170ce0
A		 6897 }
6898 }
6899
6900 if (rt != NULL) {
5ba3f43e
A		 6901 if (returned_route != NULL) {
6902 *returned_route = rt;
6903 } else {
6904 rtfree(rt);
6905 }
3e170ce0
A		 6906 rt = NULL;
6907 }
fe8ab488
A		 6908 // Unlock
6909 lck_rw_done(&necp_kernel_policy_lock);
6910
0a7de745 6911 return error;
fe8ab488
A		 6912}
6913
fe8ab488 6914static bool
d9a64523 6915necp_socket_check_policy(struct necp_kernel_socket_policy *kernel_policy, necp_app_id app_id, necp_app_id real_app_id, errno_t cred_result, u_int32_t account_id, struct substring domain, u_int8_t domain_dot_count, pid_t pid, uid_t uid, u_int32_t bound_interface_index, u_int32_t traffic_class, u_int16_t protocol, union necp_sockaddr_union *local, union necp_sockaddr_union *remote, struct necp_client_parameter_netagent_type *required_agent_types, u_int32_t num_required_agent_types, proc_t proc)
fe8ab488
A		 6916{
6917 if (!(kernel_policy->condition_mask & NECP_KERNEL_CONDITION_ALL_INTERFACES)) {
6918 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE) {
6919 u_int32_t cond_bound_interface_index = kernel_policy->cond_bound_interface ? kernel_policy->cond_bound_interface->if_index : 0;
6920 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE) {
6921 if (bound_interface_index == cond_bound_interface_index) {
6922 // No match, matches forbidden interface
0a7de745 6923 return FALSE;
fe8ab488
A		 6924 }
6925 } else {
6926 if (bound_interface_index != cond_bound_interface_index) {
6927 // No match, does not match required interface
0a7de745 6928 return FALSE;
fe8ab488
A		 6929 }
6930 }
6931 } else {
6932 if (bound_interface_index != 0) {
6933 // No match, requires a non-bound packet
0a7de745 6934 return FALSE;
fe8ab488
A		 6935 }
6936 }
6937 }
6938
6939 if (kernel_policy->condition_mask == 0) {
0a7de745 6940 return TRUE;
fe8ab488
A		 6941 }
6942
6943 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_APP_ID) {
6944 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_APP_ID) {
6945 if (app_id == kernel_policy->cond_app_id) {
6946 // No match, matches forbidden application
0a7de745 6947 return FALSE;
fe8ab488
A		 6948 }
6949 } else {
6950 if (app_id != kernel_policy->cond_app_id) {
6951 // No match, does not match required application
0a7de745 6952 return FALSE;
fe8ab488
A		 6953 }
6954 }
6955 }
6956
6957 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REAL_APP_ID) {
6958 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_REAL_APP_ID) {
6959 if (real_app_id == kernel_policy->cond_real_app_id) {
6960 // No match, matches forbidden application
0a7de745 6961 return FALSE;
fe8ab488
A		 6962 }
6963 } else {
6964 if (real_app_id != kernel_policy->cond_real_app_id) {
6965 // No match, does not match required application
0a7de745 6966 return FALSE;
fe8ab488
A		 6967 }
6968 }
6969 }
39037602 6970
fe8ab488
A		 6971 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_ENTITLEMENT) {
6972 if (cred_result != 0) {
6973 // Process is missing entitlement
0a7de745 6974 return FALSE;
fe8ab488
A		 6975 }
6976 }
6977
39037602 6978 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT) {
813fb2f6
A		 6979 if (kernel_policy->cond_custom_entitlement_matched == necp_boolean_state_false) {
6980 // Process is missing entitlement based on previous check
0a7de745 6981 return FALSE;
813fb2f6
A		 6982 } else if (kernel_policy->cond_custom_entitlement_matched == necp_boolean_state_unknown) {
6983 if (kernel_policy->cond_custom_entitlement != NULL) {
6984 if (proc == NULL) {
6985 // No process found, cannot check entitlement
0a7de745 6986 return FALSE;
813fb2f6
A		 6987 }
6988 task_t task = proc_task(proc);
6989 if (task == NULL ||
0a7de745 6990 !IOTaskHasEntitlement(task, kernel_policy->cond_custom_entitlement)) {
813fb2f6
A		 6991 // Process is missing custom entitlement
6992 kernel_policy->cond_custom_entitlement_matched = necp_boolean_state_false;
0a7de745 6993 return FALSE;
813fb2f6
A		 6994 } else {
6995 kernel_policy->cond_custom_entitlement_matched = necp_boolean_state_true;
6996 }
39037602
A		 6997 }
6998 }
6999 }
7000
fe8ab488
A		 7001 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_DOMAIN) {
7002 bool domain_matches = necp_hostname_matches_domain(domain, domain_dot_count, kernel_policy->cond_domain, kernel_policy->cond_domain_dot_count);
7003 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_DOMAIN) {
7004 if (domain_matches) {
7005 // No match, matches forbidden domain
0a7de745 7006 return FALSE;
fe8ab488
A		 7007 }
7008 } else {
7009 if (!domain_matches) {
7010 // No match, does not match required domain
0a7de745 7011 return FALSE;
fe8ab488
A		 7012 }
7013 }
7014 }
7015
7016 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_ACCOUNT_ID) {
7017 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_ACCOUNT_ID) {
7018 if (account_id == kernel_policy->cond_account_id) {
7019 // No match, matches forbidden account
0a7de745 7020 return FALSE;
fe8ab488
A		 7021 }
7022 } else {
7023 if (account_id != kernel_policy->cond_account_id) {
7024 // No match, does not match required account
0a7de745 7025 return FALSE;
fe8ab488
A		 7026 }
7027 }
7028 }
7029
7030 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_PID) {
7031 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_PID) {
7032 if (pid == kernel_policy->cond_pid) {
7033 // No match, matches forbidden pid
0a7de745 7034 return FALSE;
fe8ab488
A		 7035 }
7036 } else {
7037 if (pid != kernel_policy->cond_pid) {
7038 // No match, does not match required pid
0a7de745 7039 return FALSE;
fe8ab488
A		 7040 }
7041 }
7042 }
7043
7044 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_UID) {
7045 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_UID) {
7046 if (uid == kernel_policy->cond_uid) {
7047 // No match, matches forbidden uid
0a7de745 7048 return FALSE;
fe8ab488
A		 7049 }
7050 } else {
7051 if (uid != kernel_policy->cond_uid) {
7052 // No match, does not match required uid
0a7de745 7053 return FALSE;
fe8ab488
A		 7054 }
7055 }
7056 }
39037602 7057
fe8ab488
A		 7058 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_TRAFFIC_CLASS) {
7059 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_TRAFFIC_CLASS) {
7060 if (traffic_class >= kernel_policy->cond_traffic_class.start_tc &&
0a7de745 7061 traffic_class <= kernel_policy->cond_traffic_class.end_tc) {
fe8ab488 7062 // No match, matches forbidden traffic class
0a7de745 7063 return FALSE;
fe8ab488
A		 7064 }
7065 } else {
7066 if (traffic_class < kernel_policy->cond_traffic_class.start_tc ||
0a7de745 7067 traffic_class > kernel_policy->cond_traffic_class.end_tc) {
fe8ab488 7068 // No match, does not match required traffic class
0a7de745 7069 return FALSE;
fe8ab488
A		 7070 }
7071 }
7072 }
7073
7074 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_PROTOCOL) {
7075 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_PROTOCOL) {
7076 if (protocol == kernel_policy->cond_protocol) {
7077 // No match, matches forbidden protocol
0a7de745 7078 return FALSE;
fe8ab488
A		 7079 }
7080 } else {
7081 if (protocol != kernel_policy->cond_protocol) {
7082 // No match, does not match required protocol
0a7de745 7083 return FALSE;
fe8ab488
A		 7084 }
7085 }
7086 }
7087
d9a64523
A		 7088 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_AGENT_TYPE) {
7089 bool matches_agent_type = FALSE;
7090 for (u_int32_t i = 0; i < num_required_agent_types; i++) {
7091 struct necp_client_parameter_netagent_type *required_agent_type = &required_agent_types[i];
7092 if ((strlen(kernel_policy->cond_agent_type.agent_domain) == 0 ||
0a7de745
A		 7093 strncmp(required_agent_type->netagent_domain, kernel_policy->cond_agent_type.agent_domain, NETAGENT_DOMAINSIZE) == 0) &&
7094 (strlen(kernel_policy->cond_agent_type.agent_type) == 0 ||
7095 strncmp(required_agent_type->netagent_type, kernel_policy->cond_agent_type.agent_type, NETAGENT_TYPESIZE) == 0)) {
7096 // Found a required agent that matches
7097 matches_agent_type = TRUE;
7098 break;
7099 }
d9a64523
A		 7100 }
7101 if (!matches_agent_type) {
0a7de745 7102 return FALSE;
d9a64523
A		 7103 }
7104 }
7105
fe8ab488
A		 7106 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_START) {
7107 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_END) {
7108 bool inRange = necp_is_addr_in_range((struct sockaddr *)local, (struct sockaddr *)&kernel_policy->cond_local_start, (struct sockaddr *)&kernel_policy->cond_local_end);
7109 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_LOCAL_END) {
7110 if (inRange) {
0a7de745 7111 return FALSE;
fe8ab488
A		 7112 }
7113 } else {
7114 if (!inRange) {
0a7de745 7115 return FALSE;
fe8ab488
A		 7116 }
7117 }
7118 } else if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_PREFIX) {
7119 bool inSubnet = necp_is_addr_in_subnet((struct sockaddr *)local, (struct sockaddr *)&kernel_policy->cond_local_start, kernel_policy->cond_local_prefix);
7120 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_LOCAL_PREFIX) {
7121 if (inSubnet) {
0a7de745 7122 return FALSE;
fe8ab488
A		 7123 }
7124 } else {
7125 if (!inSubnet) {
0a7de745 7126 return FALSE;
fe8ab488
A		 7127 }
7128 }
7129 }
7130 }
7131
7132 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_START) {
7133 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_END) {
7134 bool inRange = necp_is_addr_in_range((struct sockaddr *)remote, (struct sockaddr *)&kernel_policy->cond_remote_start, (struct sockaddr *)&kernel_policy->cond_remote_end);
7135 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_REMOTE_END) {
7136 if (inRange) {
0a7de745 7137 return FALSE;
fe8ab488
A		 7138 }
7139 } else {
7140 if (!inRange) {
0a7de745 7141 return FALSE;
fe8ab488
A		 7142 }
7143 }
7144 } else if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX) {
7145 bool inSubnet = necp_is_addr_in_subnet((struct sockaddr *)remote, (struct sockaddr *)&kernel_policy->cond_remote_start, kernel_policy->cond_remote_prefix);
7146 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX) {
7147 if (inSubnet) {
0a7de745 7148 return FALSE;
fe8ab488
A		 7149 }
7150 } else {
7151 if (!inSubnet) {
0a7de745 7152 return FALSE;
fe8ab488
A		 7153 }
7154 }
7155 }
7156 }
7157
0a7de745 7158 return TRUE;
fe8ab488
A		 7159}
7160
7161static inline u_int32_t
7162necp_socket_calc_flowhash_locked(struct necp_socket_info *info)
7163{
0a7de745 7164 return net_flowhash(info, sizeof(*info), necp_kernel_socket_policies_gencount);
fe8ab488
A		 7165}
7166
fe8ab488
A		 7167static void
7168necp_socket_fillout_info_locked(struct inpcb *inp, struct sockaddr *override_local_addr, struct sockaddr *override_remote_addr, u_int32_t override_bound_interface, struct necp_socket_info *info)
7169{
7170 struct socket *so = NULL;
7171
7172 memset(info, 0, sizeof(struct necp_socket_info));
7173
7174 so = inp->inp_socket;
7175
7176 if (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_CONDITION_PID) {
7177 info->pid = ((so->so_flags & SOF_DELEGATED) ? so->e_pid : so->last_pid);
7178 }
7179
7180 if (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_CONDITION_UID) {
7181 info->uid = kauth_cred_getuid(so->so_cred);
7182 }
39037602 7183
fe8ab488
A		 7184 if (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_CONDITION_TRAFFIC_CLASS) {
7185 info->traffic_class = so->so_traffic_class;
7186 }
7187
7188 if (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_CONDITION_PROTOCOL) {
7189 if (inp->inp_ip_p) {
7190 info->protocol = inp->inp_ip_p;
7191 } else {
7192 info->protocol = SOCK_PROTO(so);
7193 }
7194 }
7195
7196 if (inp->inp_flags2 & INP2_WANT_APP_POLICY && necp_kernel_socket_policies_condition_mask & NECP_KERNEL_CONDITION_APP_ID) {
7197 struct necp_uuid_id_mapping *existing_mapping = necp_uuid_lookup_app_id_locked(((so->so_flags & SOF_DELEGATED) ? so->e_uuid : so->last_uuid));
7198 if (existing_mapping) {
7199 info->application_id = existing_mapping->id;
7200 }
7201
7202 if (!(so->so_flags & SOF_DELEGATED)) {
7203 info->real_application_id = info->application_id;
7204 } else if (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_CONDITION_REAL_APP_ID) {
7205 struct necp_uuid_id_mapping *real_existing_mapping = necp_uuid_lookup_app_id_locked(so->last_uuid);
7206 if (real_existing_mapping) {
7207 info->real_application_id = real_existing_mapping->id;
7208 }
7209 }
39037602 7210
fe8ab488
A		 7211 if (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_CONDITION_ENTITLEMENT) {
7212 info->cred_result = priv_check_cred(so->so_cred, PRIV_NET_PRIVILEGED_NECP_MATCH, 0);
d26ffc64
A		 7213 if (info->cred_result != 0) {
7214 // Process does not have entitlement, check the parent process
7215 necp_get_parent_cred_result(NULL, info);
7216 }
fe8ab488
A		 7217 }
7218 }
7219
7220 if (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_CONDITION_ACCOUNT_ID && inp->inp_necp_attributes.inp_account != NULL) {
7221 struct necp_string_id_mapping *existing_mapping = necp_lookup_string_to_id_locked(&necp_account_id_list, inp->inp_necp_attributes.inp_account);
7222 if (existing_mapping) {
7223 info->account_id = existing_mapping->id;
7224 }
7225 }
7226
7227 if (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_CONDITION_DOMAIN) {
7228 info->domain = inp->inp_necp_attributes.inp_domain;
7229 }
7230
7231 if (override_bound_interface) {
7232 info->bound_interface_index = override_bound_interface;
7233 } else {
7234 if ((inp->inp_flags & INP_BOUND_IF) && inp->inp_boundifp) {
7235 info->bound_interface_index = inp->inp_boundifp->if_index;
7236 }
7237 }
7238
7239 if (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_ADDRESS_TYPE_CONDITIONS) {
7240 if (inp->inp_vflag & INP_IPV4) {
7241 if (override_local_addr) {
490019cf
A		 7242 if (override_local_addr->sa_len <= sizeof(struct sockaddr_in)) {
7243 memcpy(&info->local_addr, override_local_addr, override_local_addr->sa_len);
7244 }
fe8ab488
A		 7245 } else {
7246 ((struct sockaddr_in *)&info->local_addr)->sin_family = AF_INET;
7247 ((struct sockaddr_in *)&info->local_addr)->sin_len = sizeof(struct sockaddr_in);
7248 ((struct sockaddr_in *)&info->local_addr)->sin_port = inp->inp_lport;
7249 memcpy(&((struct sockaddr_in *)&info->local_addr)->sin_addr, &inp->inp_laddr, sizeof(struct in_addr));
7250 }
7251
7252 if (override_remote_addr) {
490019cf
A		 7253 if (override_remote_addr->sa_len <= sizeof(struct sockaddr_in)) {
7254 memcpy(&info->remote_addr, override_remote_addr, override_remote_addr->sa_len);
7255 }
fe8ab488
A		 7256 } else {
7257 ((struct sockaddr_in *)&info->remote_addr)->sin_family = AF_INET;
7258 ((struct sockaddr_in *)&info->remote_addr)->sin_len = sizeof(struct sockaddr_in);
7259 ((struct sockaddr_in *)&info->remote_addr)->sin_port = inp->inp_fport;
7260 memcpy(&((struct sockaddr_in *)&info->remote_addr)->sin_addr, &inp->inp_faddr, sizeof(struct in_addr));
7261 }
7262 } else if (inp->inp_vflag & INP_IPV6) {
7263 if (override_local_addr) {
490019cf
A		 7264 if (override_local_addr->sa_len <= sizeof(struct sockaddr_in6)) {
7265 memcpy(&info->local_addr, override_local_addr, override_local_addr->sa_len);
7266 }
fe8ab488
A		 7267 } else {
7268 ((struct sockaddr_in6 *)&info->local_addr)->sin6_family = AF_INET6;
7269 ((struct sockaddr_in6 *)&info->local_addr)->sin6_len = sizeof(struct sockaddr_in6);
7270 ((struct sockaddr_in6 *)&info->local_addr)->sin6_port = inp->inp_lport;
7271 memcpy(&((struct sockaddr_in6 *)&info->local_addr)->sin6_addr, &inp->in6p_laddr, sizeof(struct in6_addr));
7272 }
7273
7274 if (override_remote_addr) {
490019cf
A		 7275 if (override_remote_addr->sa_len <= sizeof(struct sockaddr_in6)) {
7276 memcpy(&info->remote_addr, override_remote_addr, override_remote_addr->sa_len);
7277 }
fe8ab488
A		 7278 } else {
7279 ((struct sockaddr_in6 *)&info->remote_addr)->sin6_family = AF_INET6;
7280 ((struct sockaddr_in6 *)&info->remote_addr)->sin6_len = sizeof(struct sockaddr_in6);
7281 ((struct sockaddr_in6 *)&info->remote_addr)->sin6_port = inp->inp_fport;
7282 memcpy(&((struct sockaddr_in6 *)&info->remote_addr)->sin6_addr, &inp->in6p_faddr, sizeof(struct in6_addr));
7283 }
7284 }
7285 }
7286}
7287
7288static inline struct necp_kernel_socket_policy *
d9a64523 7289necp_socket_find_policy_match_with_info_locked(struct necp_kernel_socket_policy **policy_search_array, struct necp_socket_info *info,
0a7de745
A		 7290 necp_kernel_policy_filter *return_filter, u_int32_t *return_route_rule_id,
7291 necp_kernel_policy_result *return_service_action, necp_kernel_policy_service *return_service,
7292 u_int32_t *return_netagent_array, u_int32_t *return_netagent_use_flags_array, size_t netagent_array_count,
7293 struct necp_client_parameter_netagent_type *required_agent_types,
7294 u_int32_t num_required_agent_types, proc_t proc, necp_kernel_policy_id *skip_policy_id)
fe8ab488
A		 7295{
7296 struct necp_kernel_socket_policy *matched_policy = NULL;
7297 u_int32_t skip_order = 0;
7298 u_int32_t skip_session_order = 0;
3e170ce0
A		 7299 u_int32_t route_rule_id_array[MAX_AGGREGATE_ROUTE_RULES];
7300 size_t route_rule_id_count = 0;
fe8ab488 7301 int i;
3e170ce0
A		 7302 size_t netagent_cursor = 0;
7303
fe8ab488
A		 7304 // Pre-process domain for quick matching
7305 struct substring domain_substring = necp_trim_dots_and_stars(info->domain, info->domain ? strlen(info->domain) : 0);
7306 u_int8_t domain_dot_count = necp_count_dots(domain_substring.string, domain_substring.length);
7307
7308 if (return_filter) {
7309 *return_filter = 0;
7310 }
7311
3e170ce0
A		 7312 if (return_route_rule_id) {
7313 *return_route_rule_id = 0;
7314 }
7315
fe8ab488
A		 7316 if (return_service_action) {
7317 *return_service_action = 0;
7318 }
7319
7320 if (return_service) {
7321 return_service->identifier = 0;
7322 return_service->data = 0;
7323 }
7324
7325 if (policy_search_array != NULL) {
7326 for (i = 0; policy_search_array[i] != NULL; i++) {
7327 if (necp_drop_all_order != 0 && policy_search_array[i]->session_order >= necp_drop_all_order) {
7328 // We've hit a drop all rule
7329 break;
7330 }
7331 if (skip_session_order && policy_search_array[i]->session_order >= skip_session_order) {
7332 // Done skipping
7333 skip_order = 0;
7334 skip_session_order = 0;
7335 }
7336 if (skip_order) {
7337 if (policy_search_array[i]->order < skip_order) {
7338 // Skip this policy
7339 continue;
7340 } else {
7341 // Done skipping
7342 skip_order = 0;
7343 skip_session_order = 0;
7344 }
7345 } else if (skip_session_order) {
7346 // Skip this policy
7347 continue;
7348 }
d9a64523 7349 if (necp_socket_check_policy(policy_search_array[i], info->application_id, info->real_application_id, info->cred_result, info->account_id, domain_substring, domain_dot_count, info->pid, info->uid, info->bound_interface_index, info->traffic_class, info->protocol, &info->local_addr, &info->remote_addr, required_agent_types, num_required_agent_types, proc)) {
fe8ab488
A		 7350 if (policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER) {
7351 if (return_filter && *return_filter == 0) {
7352 *return_filter = policy_search_array[i]->result_parameter.filter_control_unit;
7353 if (necp_debug > 1) {
7354 NECPLOG(LOG_DEBUG, "Socket Policy: (Application %d Real Application %d BoundInterface %d Proto %d) Filter %d", info->application_id, info->real_application_id, info->bound_interface_index, info->protocol, policy_search_array[i]->result_parameter.filter_control_unit);
7355 }
7356 }
7357 continue;
3e170ce0
A		 7358 } else if (policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_ROUTE_RULES) {
7359 if (return_route_rule_id && route_rule_id_count < MAX_AGGREGATE_ROUTE_RULES) {
7360 route_rule_id_array[route_rule_id_count++] = policy_search_array[i]->result_parameter.route_rule_id;
7361 if (necp_debug > 1) {
7362 NECPLOG(LOG_DEBUG, "Socket Policy: (Application %d Real Application %d BoundInterface %d Proto %d) Route Rule %d", info->application_id, info->real_application_id, info->bound_interface_index, info->protocol, policy_search_array[i]->result_parameter.route_rule_id);
7363 }
7364 }
7365 continue;
7366 } else if (necp_kernel_socket_result_is_trigger_service_type(policy_search_array[i])) {
fe8ab488
A		 7367 if (return_service_action && *return_service_action == 0) {
7368 *return_service_action = policy_search_array[i]->result;
7369 if (necp_debug > 1) {
7370 NECPLOG(LOG_DEBUG, "Socket Policy: (Application %d Real Application %d BoundInterface %d Proto %d) Service Action %d", info->application_id, info->real_application_id, info->bound_interface_index, info->protocol, policy_search_array[i]->result);
7371 }
7372 }
7373 if (return_service && return_service->identifier == 0) {
7374 return_service->identifier = policy_search_array[i]->result_parameter.service.identifier;
7375 return_service->data = policy_search_array[i]->result_parameter.service.data;
7376 if (necp_debug > 1) {
7377 NECPLOG(LOG_DEBUG, "Socket Policy: (Application %d Real Application %d BoundInterface %d Proto %d) Service ID %d Data %d", info->application_id, info->real_application_id, info->bound_interface_index, info->protocol, policy_search_array[i]->result_parameter.service.identifier, policy_search_array[i]->result_parameter.service.data);
7378 }
7379 }
7380 continue;
d9a64523 7381 } else if (policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_USE_NETAGENT ||
0a7de745 7382 policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED) {
3e170ce0 7383 if (return_netagent_array != NULL &&
0a7de745 7384 netagent_cursor < netagent_array_count) {
3e170ce0 7385 return_netagent_array[netagent_cursor] = policy_search_array[i]->result_parameter.netagent_id;
d9a64523 7386 if (return_netagent_use_flags_array != NULL &&
0a7de745 7387 policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED) {
d9a64523
A		 7388 return_netagent_use_flags_array[netagent_cursor] |= NECP_AGENT_USE_FLAG_SCOPE;
7389 }
3e170ce0
A		 7390 netagent_cursor++;
7391 if (necp_debug > 1) {
d9a64523 7392 NECPLOG(LOG_DEBUG, "Socket Policy: (Application %d Real Application %d BoundInterface %d Proto %d) %s Netagent %d",
0a7de745
A		 7393 info->application_id, info->real_application_id, info->bound_interface_index, info->protocol,
7394 policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_USE_NETAGENT ? "Use" : "Scope",
7395 policy_search_array[i]->result_parameter.netagent_id);
3e170ce0
A		 7396 }
7397 }
7398 continue;
fe8ab488
A		 7399 }
7400
39037602 7401 // Matched policy is a skip. Do skip and continue.
fe8ab488
A		 7402 if (policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_SKIP) {
7403 skip_order = policy_search_array[i]->result_parameter.skip_policy_order;
7404 skip_session_order = policy_search_array[i]->session_order + 1;
d9a64523
A		 7405 if (skip_policy_id) {
7406 *skip_policy_id = policy_search_array[i]->id;
7407 }
fe8ab488
A		 7408 continue;
7409 }
39037602
A		 7410
7411 // Passed all tests, found a match
7412 matched_policy = policy_search_array[i];
fe8ab488
A		 7413 break;
7414 }
7415 }
7416 }
7417
3e170ce0
A		 7418 if (route_rule_id_count == 1) {
7419 *return_route_rule_id = route_rule_id_array[0];
7420 } else if (route_rule_id_count > 1) {
7421 *return_route_rule_id = necp_create_aggregate_route_rule(route_rule_id_array);
7422 }
0a7de745 7423 return matched_policy;
fe8ab488
A		 7424}
7425
7426static bool
7427necp_socket_uses_interface(struct inpcb *inp, u_int32_t interface_index)
7428{
7429 bool found_match = FALSE;
7430 errno_t result = 0;
7431 ifaddr_t *addresses = NULL;
7432 union necp_sockaddr_union address_storage;
7433 int i;
7434 int family = AF_INET;
7435 ifnet_t interface = ifindex2ifnet[interface_index];
39037602 7436
fe8ab488 7437 if (inp == NULL || interface == NULL) {
0a7de745 7438 return FALSE;
fe8ab488 7439 }
39037602 7440
fe8ab488
A		 7441 if (inp->inp_vflag & INP_IPV4) {
7442 family = AF_INET;
7443 } else if (inp->inp_vflag & INP_IPV6) {
7444 family = AF_INET6;
7445 }
39037602 7446
fe8ab488
A		 7447 result = ifnet_get_address_list_family(interface, &addresses, family);
7448 if (result != 0) {
7449 NECPLOG(LOG_ERR, "Failed to get address list for %s%d", ifnet_name(interface), ifnet_unit(interface));
0a7de745 7450 return FALSE;
fe8ab488 7451 }
39037602 7452
fe8ab488
A		 7453 for (i = 0; addresses[i] != NULL; i++) {
7454 if (ifaddr_address(addresses[i], &address_storage.sa, sizeof(address_storage)) == 0) {
7455 if (family == AF_INET) {
7456 if (memcmp(&address_storage.sin.sin_addr, &inp->inp_laddr, sizeof(inp->inp_laddr)) == 0) {
7457 found_match = TRUE;
7458 goto done;
7459 }
7460 } else if (family == AF_INET6) {
7461 if (memcmp(&address_storage.sin6.sin6_addr, &inp->in6p_laddr, sizeof(inp->in6p_laddr)) == 0) {
7462 found_match = TRUE;
7463 goto done;
7464 }
7465 }
7466 }
7467 }
39037602 7468
fe8ab488
A		 7469done:
7470 ifnet_free_address_list(addresses);
7471 addresses = NULL;
0a7de745 7472 return found_match;
fe8ab488
A		 7473}
7474
7475static inline bool
7476necp_socket_is_connected(struct inpcb *inp)
7477{
0a7de745 7478 return inp->inp_socket->so_state & (SS_ISCONNECTING | SS_ISCONNECTED | SS_ISDISCONNECTING);
fe8ab488
A		 7479}
7480
743345f9
A		 7481static inline bool
7482necp_socket_bypass(struct sockaddr *override_local_addr, struct sockaddr *override_remote_addr, struct inpcb *inp)
7483{
743345f9 7484 if (necp_pass_loopback > 0 && necp_is_loopback(override_local_addr, override_remote_addr, inp, NULL)) {
0a7de745 7485 return true;
743345f9 7486 } else if (necp_is_intcoproc(inp, NULL)) {
0a7de745 7487 return true;
743345f9
A		 7488 }
7489
0a7de745 7490 return false;
743345f9
A		 7491}
7492
fe8ab488
A		 7493necp_kernel_policy_id
7494necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local_addr, struct sockaddr *override_remote_addr, u_int32_t override_bound_interface)
7495{
7496 struct socket *so = NULL;
7497 necp_kernel_policy_filter filter_control_unit = 0;
3e170ce0 7498 u_int32_t route_rule_id = 0;
fe8ab488
A		 7499 struct necp_kernel_socket_policy *matched_policy = NULL;
7500 necp_kernel_policy_id matched_policy_id = NECP_KERNEL_POLICY_ID_NONE;
7501 necp_kernel_policy_result service_action = 0;
7502 necp_kernel_policy_service service = { 0, 0 };
7503
3e170ce0
A		 7504 u_int32_t netagent_ids[NECP_MAX_NETAGENTS];
7505 memset(&netagent_ids, 0, sizeof(netagent_ids));
7506 int netagent_cursor;
7507
fe8ab488
A		 7508 struct necp_socket_info info;
7509
7510 if (inp == NULL) {
0a7de745 7511 return NECP_KERNEL_POLICY_ID_NONE;
fe8ab488
A		 7512 }
7513
39037602
A		 7514 // Ignore invalid addresses
7515 if (override_local_addr != NULL &&
0a7de745 7516 !necp_address_is_valid(override_local_addr)) {
39037602
A		 7517 override_local_addr = NULL;
7518 }
7519 if (override_remote_addr != NULL &&
0a7de745 7520 !necp_address_is_valid(override_remote_addr)) {
39037602
A		 7521 override_remote_addr = NULL;
7522 }
7523
fe8ab488
A		 7524 so = inp->inp_socket;
7525
7526 // Don't lock. Possible race condition, but we don't want the performance hit.
7527 if (necp_kernel_socket_policies_count == 0 ||
0a7de745 7528 (!(inp->inp_flags2 & INP2_WANT_APP_POLICY) && necp_kernel_socket_policies_non_app_count == 0)) {
fe8ab488
A		 7529 if (necp_drop_all_order > 0) {
7530 inp->inp_policyresult.policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
d9a64523 7531 inp->inp_policyresult.skip_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
fe8ab488 7532 inp->inp_policyresult.policy_gencount = 0;
39037602 7533 inp->inp_policyresult.app_id = 0;
fe8ab488
A		 7534 inp->inp_policyresult.flowhash = 0;
7535 inp->inp_policyresult.results.filter_control_unit = 0;
3e170ce0 7536 inp->inp_policyresult.results.route_rule_id = 0;
743345f9 7537 if (necp_socket_bypass(override_local_addr, override_remote_addr, inp)) {
fe8ab488
A		 7538 inp->inp_policyresult.results.result = NECP_KERNEL_POLICY_RESULT_PASS;
7539 } else {
7540 inp->inp_policyresult.results.result = NECP_KERNEL_POLICY_RESULT_DROP;
7541 }
7542 }
0a7de745 7543 return NECP_KERNEL_POLICY_ID_NONE;
fe8ab488 7544 }
39037602 7545
fe8ab488 7546 // Check for loopback exception
743345f9 7547 if (necp_socket_bypass(override_local_addr, override_remote_addr, inp)) {
fe8ab488
A		 7548 // Mark socket as a pass
7549 inp->inp_policyresult.policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
d9a64523 7550 inp->inp_policyresult.skip_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
fe8ab488 7551 inp->inp_policyresult.policy_gencount = 0;
39037602 7552 inp->inp_policyresult.app_id = 0;
fe8ab488
A		 7553 inp->inp_policyresult.flowhash = 0;
7554 inp->inp_policyresult.results.filter_control_unit = 0;
3e170ce0 7555 inp->inp_policyresult.results.route_rule_id = 0;
fe8ab488 7556 inp->inp_policyresult.results.result = NECP_KERNEL_POLICY_RESULT_PASS;
0a7de745 7557 return NECP_KERNEL_POLICY_ID_NONE;
fe8ab488
A		 7558 }
7559
7560 // Lock
7561 lck_rw_lock_shared(&necp_kernel_policy_lock);
39037602 7562
fe8ab488 7563 necp_socket_fillout_info_locked(inp, override_local_addr, override_remote_addr, override_bound_interface, &info);
39037602 7564 inp->inp_policyresult.app_id = info.application_id;
fe8ab488
A		 7565
7566 // Check info
7567 u_int32_t flowhash = necp_socket_calc_flowhash_locked(&info);
7568 if (inp->inp_policyresult.policy_id != NECP_KERNEL_POLICY_ID_NONE &&
0a7de745
A		 7569 inp->inp_policyresult.policy_gencount == necp_kernel_socket_policies_gencount &&
7570 inp->inp_policyresult.flowhash == flowhash) {
fe8ab488
A		 7571 // If already matched this socket on this generation of table, skip
7572
7573 // Unlock
7574 lck_rw_done(&necp_kernel_policy_lock);
7575
0a7de745 7576 return inp->inp_policyresult.policy_id;
fe8ab488
A		 7577 }
7578
7579 // Match socket to policy
d9a64523
A		 7580 necp_kernel_policy_id skip_policy_id;
7581 matched_policy = necp_socket_find_policy_match_with_info_locked(necp_kernel_socket_policies_map[NECP_SOCKET_MAP_APP_ID_TO_BUCKET(info.application_id)], &info, &filter_control_unit, &route_rule_id, &service_action, &service, netagent_ids, NULL, NECP_MAX_NETAGENTS, NULL, 0, current_proc(), &skip_policy_id);
fe8ab488
A		 7582 // If the socket matched a scoped service policy, mark as Drop if not registered.
7583 // This covers the cases in which a service is required (on demand) but hasn't started yet.
7584 if ((service_action == NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED ||
0a7de745
A		 7585 service_action == NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED) &&
7586 service.identifier != 0 &&
7587 service.identifier != NECP_NULL_SERVICE_ID) {
fe8ab488
A		 7588 bool service_is_registered = FALSE;
7589 struct necp_service_registration *service_registration = NULL;
7590 LIST_FOREACH(service_registration, &necp_registered_service_list, kernel_chain) {
7591 if (service.identifier == service_registration->service_id) {
7592 service_is_registered = TRUE;
7593 break;
7594 }
7595 }
7596 if (!service_is_registered) {
7597 // Mark socket as a drop if service is not registered
7598 inp->inp_policyresult.policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
d9a64523 7599 inp->inp_policyresult.skip_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
fe8ab488
A		 7600 inp->inp_policyresult.policy_gencount = necp_kernel_socket_policies_gencount;
7601 inp->inp_policyresult.flowhash = flowhash;
7602 inp->inp_policyresult.results.filter_control_unit = 0;
3e170ce0 7603 inp->inp_policyresult.results.route_rule_id = 0;
fe8ab488 7604 inp->inp_policyresult.results.result = NECP_KERNEL_POLICY_RESULT_DROP;
3e170ce0 7605
fe8ab488
A		 7606 if (necp_debug > 1) {
7607 NECPLOG(LOG_DEBUG, "Socket Policy: (BoundInterface %d Proto %d) Dropping packet because service is not registered", info.bound_interface_index, info.protocol);
7608 }
3e170ce0 7609
fe8ab488
A		 7610 // Unlock
7611 lck_rw_done(&necp_kernel_policy_lock);
0a7de745 7612 return NECP_KERNEL_POLICY_ID_NONE;
fe8ab488
A		 7613 }
7614 }
3e170ce0
A		 7615 // Verify netagents
7616 for (netagent_cursor = 0; netagent_cursor < NECP_MAX_NETAGENTS; netagent_cursor++) {
7617 struct necp_uuid_id_mapping *mapping = NULL;
7618 u_int32_t netagent_id = netagent_ids[netagent_cursor];
7619 if (netagent_id == 0) {
7620 break;
7621 }
7622 mapping = necp_uuid_lookup_uuid_with_service_id_locked(netagent_id);
7623 if (mapping != NULL) {
7624 u_int32_t agent_flags = 0;
7625 agent_flags = netagent_get_flags(mapping->uuid);
7626 if (agent_flags & NETAGENT_FLAG_REGISTERED) {
7627 if (agent_flags & NETAGENT_FLAG_ACTIVE) {
7628 continue;
7629 } else if ((agent_flags & NETAGENT_FLAG_VOLUNTARY) == 0) {
7630 if (agent_flags & NETAGENT_FLAG_KERNEL_ACTIVATED) {
7631 int trigger_error = 0;
7632 trigger_error = netagent_kernel_trigger(mapping->uuid);
7633 if (necp_debug > 1) {
7634 NECPLOG(LOG_DEBUG, "Socket Policy: Triggering inactive agent, error %d", trigger_error);
7635 }
7636 }
7637
7638 // Mark socket as a drop if required agent is not active
7639 inp->inp_policyresult.policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
d9a64523 7640 inp->inp_policyresult.skip_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
3e170ce0
A		 7641 inp->inp_policyresult.policy_gencount = necp_kernel_socket_policies_gencount;
7642 inp->inp_policyresult.flowhash = flowhash;
7643 inp->inp_policyresult.results.filter_control_unit = 0;
7644 inp->inp_policyresult.results.route_rule_id = 0;
7645 inp->inp_policyresult.results.result = NECP_KERNEL_POLICY_RESULT_DROP;
7646
7647 if (necp_debug > 1) {
7648 NECPLOG(LOG_DEBUG, "Socket Policy: (BoundInterface %d Proto %d) Dropping packet because agent is not active", info.bound_interface_index, info.protocol);
7649 }
7650
7651 // Unlock
7652 lck_rw_done(&necp_kernel_policy_lock);
0a7de745 7653 return NECP_KERNEL_POLICY_ID_NONE;
3e170ce0
A		 7654 }
7655 }
7656 }
7657 }
fe8ab488
A		 7658 if (matched_policy) {
7659 matched_policy_id = matched_policy->id;
7660 inp->inp_policyresult.policy_id = matched_policy->id;
d9a64523 7661 inp->inp_policyresult.skip_policy_id = skip_policy_id;
fe8ab488
A		 7662 inp->inp_policyresult.policy_gencount = necp_kernel_socket_policies_gencount;
7663 inp->inp_policyresult.flowhash = flowhash;
7664 inp->inp_policyresult.results.filter_control_unit = filter_control_unit;
3e170ce0 7665 inp->inp_policyresult.results.route_rule_id = route_rule_id;
fe8ab488
A		 7666 inp->inp_policyresult.results.result = matched_policy->result;
7667 memcpy(&inp->inp_policyresult.results.result_parameter, &matched_policy->result_parameter, sizeof(matched_policy->result_parameter));
7668
7669 if (necp_socket_is_connected(inp) &&
0a7de745
A		 7670 (matched_policy->result == NECP_KERNEL_POLICY_RESULT_DROP ||
7671 (matched_policy->result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL && !necp_socket_uses_interface(inp, matched_policy->result_parameter.tunnel_interface_index)))) {
fe8ab488
A		 7672 if (necp_debug) {
7673 NECPLOG(LOG_DEBUG, "Marking socket in state %d as defunct", so->so_state);
7674 }
39037602 7675 sosetdefunct(current_proc(), so, SHUTDOWN_SOCKET_LEVEL_NECP | SHUTDOWN_SOCKET_LEVEL_DISCONNECT_ALL, TRUE);
3e170ce0 7676 } else if (necp_socket_is_connected(inp) &&
0a7de745
A		 7677 matched_policy->result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
7678 info.protocol == IPPROTO_TCP) {
3e170ce0
A		 7679 // Reset MSS on TCP socket if tunnel policy changes
7680 tcp_mtudisc(inp, 0);
fe8ab488
A		 7681 }
7682
7683 if (necp_debug > 1) {
3e170ce0 7684 NECPLOG(LOG_DEBUG, "Socket Policy: %p (BoundInterface %d Proto %d) Policy %d Result %d Parameter %d", inp->inp_socket, info.bound_interface_index, info.protocol, matched_policy->id, matched_policy->result, matched_policy->result_parameter.tunnel_interface_index);
fe8ab488
A		 7685 }
7686 } else if (necp_drop_all_order > 0) {
7687 // Mark socket as a drop if set
7688 inp->inp_policyresult.policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
d9a64523 7689 inp->inp_policyresult.skip_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
fe8ab488
A		 7690 inp->inp_policyresult.policy_gencount = necp_kernel_socket_policies_gencount;
7691 inp->inp_policyresult.flowhash = flowhash;
7692 inp->inp_policyresult.results.filter_control_unit = 0;
3e170ce0 7693 inp->inp_policyresult.results.route_rule_id = 0;
fe8ab488
A		 7694 inp->inp_policyresult.results.result = NECP_KERNEL_POLICY_RESULT_DROP;
7695 } else {
7696 // Mark non-matching socket so we don't re-check it
7697 inp->inp_policyresult.policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
d9a64523 7698 inp->inp_policyresult.skip_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
fe8ab488
A		 7699 inp->inp_policyresult.policy_gencount = necp_kernel_socket_policies_gencount;
7700 inp->inp_policyresult.flowhash = flowhash;
7701 inp->inp_policyresult.results.filter_control_unit = filter_control_unit; // We may have matched a filter, so mark it!
3e170ce0 7702 inp->inp_policyresult.results.route_rule_id = route_rule_id; // We may have matched a route rule, so mark it!
fe8ab488
A		 7703 inp->inp_policyresult.results.result = NECP_KERNEL_POLICY_RESULT_NONE;
7704 }
7705
7706 // Unlock
7707 lck_rw_done(&necp_kernel_policy_lock);
7708
0a7de745 7709 return matched_policy_id;
fe8ab488
A		 7710}
7711
7712static bool
d9a64523 7713necp_ip_output_check_policy(struct necp_kernel_ip_output_policy *kernel_policy, necp_kernel_policy_id socket_policy_id, necp_kernel_policy_id socket_skip_policy_id, u_int32_t bound_interface_index, u_int32_t last_interface_index, u_int16_t protocol, union necp_sockaddr_union *local, union necp_sockaddr_union *remote)
fe8ab488
A		 7714{
7715 if (!(kernel_policy->condition_mask & NECP_KERNEL_CONDITION_ALL_INTERFACES)) {
7716 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE) {
7717 u_int32_t cond_bound_interface_index = kernel_policy->cond_bound_interface ? kernel_policy->cond_bound_interface->if_index : 0;
7718 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE) {
7719 if (bound_interface_index == cond_bound_interface_index) {
7720 // No match, matches forbidden interface
0a7de745 7721 return FALSE;
fe8ab488
A		 7722 }
7723 } else {
7724 if (bound_interface_index != cond_bound_interface_index) {
7725 // No match, does not match required interface
0a7de745 7726 return FALSE;
fe8ab488
A		 7727 }
7728 }
7729 } else {
7730 if (bound_interface_index != 0) {
7731 // No match, requires a non-bound packet
0a7de745 7732 return FALSE;
fe8ab488
A		 7733 }
7734 }
7735 }
7736
7737 if (kernel_policy->condition_mask == 0) {
0a7de745 7738 return TRUE;
fe8ab488
A		 7739 }
7740
7741 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_POLICY_ID) {
d9a64523 7742 necp_kernel_policy_id matched_policy_id =
0a7de745 7743 kernel_policy->result == NECP_KERNEL_POLICY_RESULT_SKIP ? socket_skip_policy_id : socket_policy_id;
d9a64523 7744 if (matched_policy_id != kernel_policy->cond_policy_id) {
fe8ab488 7745 // No match, does not match required id
0a7de745 7746 return FALSE;
fe8ab488
A		 7747 }
7748 }
7749
7750 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LAST_INTERFACE) {
7751 if (last_interface_index != kernel_policy->cond_last_interface_index) {
0a7de745 7752 return FALSE;
fe8ab488
A		 7753 }
7754 }
7755
7756 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_PROTOCOL) {
7757 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_PROTOCOL) {
7758 if (protocol == kernel_policy->cond_protocol) {
7759 // No match, matches forbidden protocol
0a7de745 7760 return FALSE;
fe8ab488
A		 7761 }
7762 } else {
7763 if (protocol != kernel_policy->cond_protocol) {
7764 // No match, does not match required protocol
0a7de745 7765 return FALSE;
fe8ab488
A		 7766 }
7767 }
7768 }
7769
7770 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_START) {
7771 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_END) {
7772 bool inRange = necp_is_addr_in_range((struct sockaddr *)local, (struct sockaddr *)&kernel_policy->cond_local_start, (struct sockaddr *)&kernel_policy->cond_local_end);
7773 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_LOCAL_END) {
7774 if (inRange) {
0a7de745 7775 return FALSE;
fe8ab488
A		 7776 }
7777 } else {
7778 if (!inRange) {
0a7de745 7779 return FALSE;
fe8ab488
A		 7780 }
7781 }
7782 } else if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_PREFIX) {
7783 bool inSubnet = necp_is_addr_in_subnet((struct sockaddr *)local, (struct sockaddr *)&kernel_policy->cond_local_start, kernel_policy->cond_local_prefix);
7784 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_LOCAL_PREFIX) {
7785 if (inSubnet) {
0a7de745 7786 return FALSE;
fe8ab488
A		 7787 }
7788 } else {
7789 if (!inSubnet) {
0a7de745 7790 return FALSE;
fe8ab488
A		 7791 }
7792 }
7793 }
7794 }
7795
7796 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_START) {
7797 if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_END) {
7798 bool inRange = necp_is_addr_in_range((struct sockaddr *)remote, (struct sockaddr *)&kernel_policy->cond_remote_start, (struct sockaddr *)&kernel_policy->cond_remote_end);
7799 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_REMOTE_END) {
7800 if (inRange) {
0a7de745 7801 return FALSE;
fe8ab488
A		 7802 }
7803 } else {
7804 if (!inRange) {
0a7de745 7805 return FALSE;
fe8ab488
A		 7806 }
7807 }
7808 } else if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX) {
7809 bool inSubnet = necp_is_addr_in_subnet((struct sockaddr *)remote, (struct sockaddr *)&kernel_policy->cond_remote_start, kernel_policy->cond_remote_prefix);
7810 if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX) {
7811 if (inSubnet) {
0a7de745 7812 return FALSE;
fe8ab488
A		 7813 }
7814 } else {
7815 if (!inSubnet) {
0a7de745 7816 return FALSE;
fe8ab488
A		 7817 }
7818 }
7819 }
7820 }
7821
0a7de745 7822 return TRUE;
fe8ab488
A		 7823}
7824
7825static inline struct necp_kernel_ip_output_policy *
d9a64523 7826necp_ip_output_find_policy_match_locked(necp_kernel_policy_id socket_policy_id, necp_kernel_policy_id socket_skip_policy_id, u_int32_t bound_interface_index, u_int32_t last_interface_index, u_int16_t protocol, union necp_sockaddr_union *local_addr, union necp_sockaddr_union *remote_addr)
fe8ab488
A		 7827{
7828 u_int32_t skip_order = 0;
7829 u_int32_t skip_session_order = 0;
7830 int i;
7831 struct necp_kernel_ip_output_policy *matched_policy = NULL;
7832 struct necp_kernel_ip_output_policy **policy_search_array = necp_kernel_ip_output_policies_map[NECP_IP_OUTPUT_MAP_ID_TO_BUCKET(socket_policy_id)];
7833 if (policy_search_array != NULL) {
7834 for (i = 0; policy_search_array[i] != NULL; i++) {
7835 if (necp_drop_all_order != 0 && policy_search_array[i]->session_order >= necp_drop_all_order) {
7836 // We've hit a drop all rule
7837 break;
7838 }
7839 if (skip_session_order && policy_search_array[i]->session_order >= skip_session_order) {
7840 // Done skipping
7841 skip_order = 0;
7842 skip_session_order = 0;
7843 }
7844 if (skip_order) {
7845 if (policy_search_array[i]->order < skip_order) {
7846 // Skip this policy
7847 continue;
7848 } else {
7849 // Done skipping
7850 skip_order = 0;
7851 skip_session_order = 0;
7852 }
7853 } else if (skip_session_order) {
7854 // Skip this policy
7855 continue;
7856 }
d9a64523 7857 if (necp_ip_output_check_policy(policy_search_array[i], socket_policy_id, socket_skip_policy_id, bound_interface_index, last_interface_index, protocol, local_addr, remote_addr)) {
fe8ab488
A		 7858 // Passed all tests, found a match
7859 matched_policy = policy_search_array[i];
7860
7861 if (policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_SKIP) {
7862 skip_order = policy_search_array[i]->result_parameter.skip_policy_order;
7863 skip_session_order = policy_search_array[i]->session_order + 1;
7864 continue;
7865 }
7866
7867 break;
7868 }
7869 }
7870 }
7871
0a7de745 7872 return matched_policy;
fe8ab488
A		 7873}
7874
743345f9
A		 7875static inline bool
7876necp_output_bypass(struct mbuf *packet)
7877{
7878 if (necp_pass_loopback > 0 && necp_is_loopback(NULL, NULL, NULL, packet)) {
0a7de745 7879 return true;
743345f9
A		 7880 }
7881 if (necp_pass_keepalives > 0 && necp_get_is_keepalive_from_packet(packet)) {
0a7de745 7882 return true;
743345f9
A		 7883 }
7884 if (necp_is_intcoproc(NULL, packet)) {
0a7de745 7885 return true;
743345f9 7886 }
0a7de745 7887 return false;
743345f9
A		 7888}
7889
fe8ab488
A		 7890necp_kernel_policy_id
7891necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_args *ipoa, necp_kernel_policy_result *result, necp_kernel_policy_result_parameter *result_parameter)
7892{
7893 struct ip *ip = NULL;
7894 int hlen = sizeof(struct ip);
7895 necp_kernel_policy_id socket_policy_id = NECP_KERNEL_POLICY_ID_NONE;
d9a64523 7896 necp_kernel_policy_id socket_skip_policy_id = NECP_KERNEL_POLICY_ID_NONE;
fe8ab488
A		 7897 necp_kernel_policy_id matched_policy_id = NECP_KERNEL_POLICY_ID_NONE;
7898 struct necp_kernel_ip_output_policy *matched_policy = NULL;
7899 u_int16_t protocol = 0;
7900 u_int32_t bound_interface_index = 0;
7901 u_int32_t last_interface_index = 0;
7902 union necp_sockaddr_union local_addr;
7903 union necp_sockaddr_union remote_addr;
7904
7905 if (result) {
7906 *result = 0;
7907 }
7908
7909 if (result_parameter) {
7910 memset(result_parameter, 0, sizeof(*result_parameter));
7911 }
7912
7913 if (packet == NULL) {
0a7de745 7914 return NECP_KERNEL_POLICY_ID_NONE;
fe8ab488 7915 }
39037602 7916
fe8ab488 7917 socket_policy_id = necp_get_policy_id_from_packet(packet);
d9a64523 7918 socket_skip_policy_id = necp_get_skip_policy_id_from_packet(packet);
fe8ab488
A		 7919
7920 // Exit early for an empty list
7921 // Don't lock. Possible race condition, but we don't want the performance hit.
7922 if (necp_kernel_ip_output_policies_count == 0 ||
0a7de745 7923 ((socket_policy_id == NECP_KERNEL_POLICY_ID_NONE) && necp_kernel_ip_output_policies_non_id_count == 0)) {
fe8ab488
A		 7924 if (necp_drop_all_order > 0) {
7925 matched_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
7926 if (result) {
743345f9 7927 if (necp_output_bypass(packet)) {
fe8ab488
A		 7928 *result = NECP_KERNEL_POLICY_RESULT_PASS;
7929 } else {
7930 *result = NECP_KERNEL_POLICY_RESULT_DROP;
7931 }
7932 }
7933 }
7934
0a7de745 7935 return matched_policy_id;
fe8ab488 7936 }
39037602 7937
fe8ab488 7938 // Check for loopback exception
743345f9 7939 if (necp_output_bypass(packet)) {
fe8ab488
A		 7940 matched_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
7941 if (result) {
7942 *result = NECP_KERNEL_POLICY_RESULT_PASS;
7943 }
0a7de745 7944 return matched_policy_id;
fe8ab488 7945 }
39037602 7946
fe8ab488
A		 7947 last_interface_index = necp_get_last_interface_index_from_packet(packet);
7948
7949 // Process packet to get relevant fields
7950 ip = mtod(packet, struct ip *);
7951#ifdef _IP_VHL
7952 hlen = _IP_VHL_HL(ip->ip_vhl) << 2;
7953#else
7954 hlen = ip->ip_hl << 2;
7955#endif
7956
7957 protocol = ip->ip_p;
7958
7959 if ((flags & IP_OUTARGS) && (ipoa != NULL) &&
0a7de745
A		 7960 (ipoa->ipoa_flags & IPOAF_BOUND_IF) &&
7961 ipoa->ipoa_boundif != IFSCOPE_NONE) {
fe8ab488
A		 7962 bound_interface_index = ipoa->ipoa_boundif;
7963 }
7964
7965 local_addr.sin.sin_family = AF_INET;
7966 local_addr.sin.sin_len = sizeof(struct sockaddr_in);
7967 memcpy(&local_addr.sin.sin_addr, &ip->ip_src, sizeof(ip->ip_src));
7968
7969 remote_addr.sin.sin_family = AF_INET;
7970 remote_addr.sin.sin_len = sizeof(struct sockaddr_in);
7971 memcpy(&((struct sockaddr_in *)&remote_addr)->sin_addr, &ip->ip_dst, sizeof(ip->ip_dst));
7972
7973 switch (protocol) {
0a7de745
A		 7974 case IPPROTO_TCP: {
7975 struct tcphdr th;
7976 if ((int)(hlen + sizeof(th)) <= packet->m_pkthdr.len) {
7977 m_copydata(packet, hlen, sizeof(th), (u_int8_t *)&th);
7978 ((struct sockaddr_in *)&local_addr)->sin_port = th.th_sport;
7979 ((struct sockaddr_in *)&remote_addr)->sin_port = th.th_dport;
fe8ab488 7980 }
0a7de745
A		 7981 break;
7982 }
7983 case IPPROTO_UDP: {
7984 struct udphdr uh;
7985 if ((int)(hlen + sizeof(uh)) <= packet->m_pkthdr.len) {
7986 m_copydata(packet, hlen, sizeof(uh), (u_int8_t *)&uh);
7987 ((struct sockaddr_in *)&local_addr)->sin_port = uh.uh_sport;
7988 ((struct sockaddr_in *)&remote_addr)->sin_port = uh.uh_dport;
fe8ab488 7989 }
0a7de745
A		 7990 break;
7991 }
7992 default: {
7993 ((struct sockaddr_in *)&local_addr)->sin_port = 0;
7994 ((struct sockaddr_in *)&remote_addr)->sin_port = 0;
7995 break;
7996 }
fe8ab488
A		 7997 }
7998
7999 // Match packet to policy
8000 lck_rw_lock_shared(&necp_kernel_policy_lock);
d9a64523 8001 matched_policy = necp_ip_output_find_policy_match_locked(socket_policy_id, socket_skip_policy_id, bound_interface_index, last_interface_index, protocol, &local_addr, &remote_addr);
fe8ab488
A		 8002 if (matched_policy) {
8003 matched_policy_id = matched_policy->id;
8004 if (result) {
8005 *result = matched_policy->result;
8006 }
8007
8008 if (result_parameter) {
8009 memcpy(result_parameter, &matched_policy->result_parameter, sizeof(matched_policy->result_parameter));
8010 }
8011
8012 if (necp_debug > 1) {
8013 NECPLOG(LOG_DEBUG, "IP Output: (ID %d BoundInterface %d LastInterface %d Proto %d) Policy %d Result %d Parameter %d", socket_policy_id, bound_interface_index, last_interface_index, protocol, matched_policy->id, matched_policy->result, matched_policy->result_parameter.tunnel_interface_index);
8014 }
8015 } else if (necp_drop_all_order > 0) {
8016 matched_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
8017 if (result) {
8018 *result = NECP_KERNEL_POLICY_RESULT_DROP;
8019 }
8020 }
8021
8022 lck_rw_done(&necp_kernel_policy_lock);
8023
0a7de745 8024 return matched_policy_id;
fe8ab488
A		 8025}
8026
8027necp_kernel_policy_id
8028necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out_args *ip6oa, necp_kernel_policy_result *result, necp_kernel_policy_result_parameter *result_parameter)
8029{
8030 struct ip6_hdr *ip6 = NULL;
8031 int next = -1;
8032 int offset = 0;
8033 necp_kernel_policy_id socket_policy_id = NECP_KERNEL_POLICY_ID_NONE;
d9a64523 8034 necp_kernel_policy_id socket_skip_policy_id = NECP_KERNEL_POLICY_ID_NONE;
fe8ab488
A		 8035 necp_kernel_policy_id matched_policy_id = NECP_KERNEL_POLICY_ID_NONE;
8036 struct necp_kernel_ip_output_policy *matched_policy = NULL;
8037 u_int16_t protocol = 0;
8038 u_int32_t bound_interface_index = 0;
8039 u_int32_t last_interface_index = 0;
8040 union necp_sockaddr_union local_addr;
8041 union necp_sockaddr_union remote_addr;
8042
8043 if (result) {
8044 *result = 0;
8045 }
8046
8047 if (result_parameter) {
8048 memset(result_parameter, 0, sizeof(*result_parameter));
8049 }
8050
8051 if (packet == NULL) {
0a7de745 8052 return NECP_KERNEL_POLICY_ID_NONE;
fe8ab488
A		 8053 }
8054
8055 socket_policy_id = necp_get_policy_id_from_packet(packet);
d9a64523 8056 socket_skip_policy_id = necp_get_skip_policy_id_from_packet(packet);
39037602 8057
fe8ab488
A		 8058 // Exit early for an empty list
8059 // Don't lock. Possible race condition, but we don't want the performance hit.
8060 if (necp_kernel_ip_output_policies_count == 0 ||
0a7de745 8061 ((socket_policy_id == NECP_KERNEL_POLICY_ID_NONE) && necp_kernel_ip_output_policies_non_id_count == 0)) {
fe8ab488
A		 8062 if (necp_drop_all_order > 0) {
8063 matched_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
8064 if (result) {
743345f9 8065 if (necp_output_bypass(packet)) {
fe8ab488
A		 8066 *result = NECP_KERNEL_POLICY_RESULT_PASS;
8067 } else {
8068 *result = NECP_KERNEL_POLICY_RESULT_DROP;
8069 }
8070 }
8071 }
8072
0a7de745 8073 return matched_policy_id;
fe8ab488 8074 }
39037602 8075
fe8ab488 8076 // Check for loopback exception
743345f9 8077 if (necp_output_bypass(packet)) {
fe8ab488
A		 8078 matched_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
8079 if (result) {
8080 *result = NECP_KERNEL_POLICY_RESULT_PASS;
8081 }
0a7de745 8082 return matched_policy_id;
fe8ab488 8083 }
39037602 8084
fe8ab488
A		 8085 last_interface_index = necp_get_last_interface_index_from_packet(packet);
8086
8087 // Process packet to get relevant fields
8088 ip6 = mtod(packet, struct ip6_hdr *);
8089
8090 if ((flags & IPV6_OUTARGS) && (ip6oa != NULL) &&
0a7de745
A		 8091 (ip6oa->ip6oa_flags & IP6OAF_BOUND_IF) &&
8092 ip6oa->ip6oa_boundif != IFSCOPE_NONE) {
fe8ab488
A		 8093 bound_interface_index = ip6oa->ip6oa_boundif;
8094 }
8095
8096 ((struct sockaddr_in6 *)&local_addr)->sin6_family = AF_INET6;
8097 ((struct sockaddr_in6 *)&local_addr)->sin6_len = sizeof(struct sockaddr_in6);
8098 memcpy(&((struct sockaddr_in6 *)&local_addr)->sin6_addr, &ip6->ip6_src, sizeof(ip6->ip6_src));
8099
8100 ((struct sockaddr_in6 *)&remote_addr)->sin6_family = AF_INET6;
8101 ((struct sockaddr_in6 *)&remote_addr)->sin6_len = sizeof(struct sockaddr_in6);
8102 memcpy(&((struct sockaddr_in6 *)&remote_addr)->sin6_addr, &ip6->ip6_dst, sizeof(ip6->ip6_dst));
8103
8104 offset = ip6_lasthdr(packet, 0, IPPROTO_IPV6, &next);
8105 if (offset >= 0 && packet->m_pkthdr.len >= offset) {
8106 protocol = next;
8107 switch (protocol) {
0a7de745
A		 8108 case IPPROTO_TCP: {
8109 struct tcphdr th;
8110 if ((int)(offset + sizeof(th)) <= packet->m_pkthdr.len) {
8111 m_copydata(packet, offset, sizeof(th), (u_int8_t *)&th);
8112 ((struct sockaddr_in6 *)&local_addr)->sin6_port = th.th_sport;
8113 ((struct sockaddr_in6 *)&remote_addr)->sin6_port = th.th_dport;
fe8ab488 8114 }
0a7de745
A		 8115 break;
8116 }
8117 case IPPROTO_UDP: {
8118 struct udphdr uh;
8119 if ((int)(offset + sizeof(uh)) <= packet->m_pkthdr.len) {
8120 m_copydata(packet, offset, sizeof(uh), (u_int8_t *)&uh);
8121 ((struct sockaddr_in6 *)&local_addr)->sin6_port = uh.uh_sport;
8122 ((struct sockaddr_in6 *)&remote_addr)->sin6_port = uh.uh_dport;
fe8ab488 8123 }
0a7de745
A		 8124 break;
8125 }
8126 default: {
8127 ((struct sockaddr_in6 *)&local_addr)->sin6_port = 0;
8128 ((struct sockaddr_in6 *)&remote_addr)->sin6_port = 0;
8129 break;
8130 }
fe8ab488
A		 8131 }
8132 }
8133
8134 // Match packet to policy
8135 lck_rw_lock_shared(&necp_kernel_policy_lock);
d9a64523 8136 matched_policy = necp_ip_output_find_policy_match_locked(socket_policy_id, socket_skip_policy_id, bound_interface_index, last_interface_index, protocol, &local_addr, &remote_addr);
fe8ab488
A		 8137 if (matched_policy) {
8138 matched_policy_id = matched_policy->id;
8139 if (result) {
8140 *result = matched_policy->result;
8141 }
8142
8143 if (result_parameter) {
8144 memcpy(result_parameter, &matched_policy->result_parameter, sizeof(matched_policy->result_parameter));
8145 }
8146
8147 if (necp_debug > 1) {
8148 NECPLOG(LOG_DEBUG, "IP6 Output: (ID %d BoundInterface %d LastInterface %d Proto %d) Policy %d Result %d Parameter %d", socket_policy_id, bound_interface_index, last_interface_index, protocol, matched_policy->id, matched_policy->result, matched_policy->result_parameter.tunnel_interface_index);
8149 }
8150 } else if (necp_drop_all_order > 0) {
8151 matched_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
8152 if (result) {
8153 *result = NECP_KERNEL_POLICY_RESULT_DROP;
8154 }
8155 }
8156
8157 lck_rw_done(&necp_kernel_policy_lock);
8158
0a7de745 8159 return matched_policy_id;
fe8ab488
A		 8160}
8161
8162// Utilities
8163static bool
8164necp_is_addr_in_range(struct sockaddr *addr, struct sockaddr *range_start, struct sockaddr *range_end)
8165{
8166 int cmp = 0;
8167
8168 if (addr == NULL || range_start == NULL || range_end == NULL) {
0a7de745 8169 return FALSE;
fe8ab488
A		 8170 }
8171
8172 /* Must be greater than or equal to start */
8173 cmp = necp_addr_compare(addr, range_start, 1);
8174 if (cmp != 0 && cmp != 1) {
0a7de745 8175 return FALSE;
fe8ab488
A		 8176 }
8177
8178 /* Must be less than or equal to end */
8179 cmp = necp_addr_compare(addr, range_end, 1);
8180 if (cmp != 0 && cmp != -1) {
0a7de745 8181 return FALSE;
fe8ab488
A		 8182 }
8183
0a7de745 8184 return TRUE;
fe8ab488
A		 8185}
8186
8187static bool
8188necp_is_range_in_range(struct sockaddr *inner_range_start, struct sockaddr *inner_range_end, struct sockaddr *range_start, struct sockaddr *range_end)
8189{
8190 int cmp = 0;
8191
8192 if (inner_range_start == NULL || inner_range_end == NULL || range_start == NULL || range_end == NULL) {
0a7de745 8193 return FALSE;
fe8ab488
A		 8194 }
8195
8196 /* Must be greater than or equal to start */
8197 cmp = necp_addr_compare(inner_range_start, range_start, 1);
8198 if (cmp != 0 && cmp != 1) {
0a7de745 8199 return FALSE;
fe8ab488
A		 8200 }
8201
8202 /* Must be less than or equal to end */
8203 cmp = necp_addr_compare(inner_range_end, range_end, 1);
8204 if (cmp != 0 && cmp != -1) {
0a7de745 8205 return FALSE;
fe8ab488
A		 8206 }
8207
0a7de745 8208 return TRUE;
fe8ab488
A		 8209}
8210
8211static bool
8212necp_is_addr_in_subnet(struct sockaddr *addr, struct sockaddr *subnet_addr, u_int8_t subnet_prefix)
8213{
8214 if (addr == NULL || subnet_addr == NULL) {
0a7de745 8215 return FALSE;
fe8ab488
A		 8216 }
8217
8218 if (addr->sa_family != subnet_addr->sa_family || addr->sa_len != subnet_addr->sa_len) {
0a7de745 8219 return FALSE;
fe8ab488
A		 8220 }
8221
8222 switch (addr->sa_family) {
0a7de745
A		 8223 case AF_INET: {
8224 if (satosin(subnet_addr)->sin_port != 0 &&
8225 satosin(addr)->sin_port != satosin(subnet_addr)->sin_port) {
8226 return FALSE;
fe8ab488 8227 }
0a7de745
A		 8228 return necp_buffer_compare_with_bit_prefix((u_int8_t *)&satosin(addr)->sin_addr, (u_int8_t *)&satosin(subnet_addr)->sin_addr, subnet_prefix);
8229 }
8230 case AF_INET6: {
8231 if (satosin6(subnet_addr)->sin6_port != 0 &&
8232 satosin6(addr)->sin6_port != satosin6(subnet_addr)->sin6_port) {
8233 return FALSE;
fe8ab488 8234 }
0a7de745
A		 8235 if (satosin6(addr)->sin6_scope_id &&
8236 satosin6(subnet_addr)->sin6_scope_id &&
8237 satosin6(addr)->sin6_scope_id != satosin6(subnet_addr)->sin6_scope_id) {
8238 return FALSE;
fe8ab488 8239 }
0a7de745
A		 8240 return necp_buffer_compare_with_bit_prefix((u_int8_t *)&satosin6(addr)->sin6_addr, (u_int8_t *)&satosin6(subnet_addr)->sin6_addr, subnet_prefix);
8241 }
8242 default: {
8243 return FALSE;
8244 }
fe8ab488
A		 8245 }
8246
0a7de745 8247 return FALSE;
fe8ab488
A		 8248}
8249
8250/*
8251 * Return values:
8252 * -1: sa1 < sa2
8253 * 0: sa1 == sa2
8254 * 1: sa1 > sa2
8255 * 2: Not comparable or error
8256 */
8257static int
8258necp_addr_compare(struct sockaddr *sa1, struct sockaddr *sa2, int check_port)
8259{
8260 int result = 0;
8261 int port_result = 0;
8262
8263 if (sa1->sa_family != sa2->sa_family || sa1->sa_len != sa2->sa_len) {
0a7de745 8264 return 2;
fe8ab488
A		 8265 }
8266
8267 if (sa1->sa_len == 0) {
0a7de745 8268 return 0;
fe8ab488
A		 8269 }
8270
8271 switch (sa1->sa_family) {
0a7de745
A		 8272 case AF_INET: {
8273 if (sa1->sa_len != sizeof(struct sockaddr_in)) {
8274 return 2;
8275 }
fe8ab488 8276
0a7de745 8277 result = memcmp(&satosin(sa1)->sin_addr.s_addr, &satosin(sa2)->sin_addr.s_addr, sizeof(satosin(sa1)->sin_addr.s_addr));
fe8ab488 8278
0a7de745
A		 8279 if (check_port) {
8280 if (satosin(sa1)->sin_port < satosin(sa2)->sin_port) {
8281 port_result = -1;
8282 } else if (satosin(sa1)->sin_port > satosin(sa2)->sin_port) {
8283 port_result = 1;
fe8ab488
A		 8284 }
8285
0a7de745
A		 8286 if (result == 0) {
8287 result = port_result;
8288 } else if ((result > 0 && port_result < 0) || (result < 0 && port_result > 0)) {
8289 return 2;
fe8ab488 8290 }
0a7de745 8291 }
fe8ab488 8292
0a7de745
A		 8293 break;
8294 }
8295 case AF_INET6: {
8296 if (sa1->sa_len != sizeof(struct sockaddr_in6)) {
8297 return 2;
8298 }
fe8ab488 8299
0a7de745
A		 8300 if (satosin6(sa1)->sin6_scope_id != satosin6(sa2)->sin6_scope_id) {
8301 return 2;
8302 }
fe8ab488 8303
0a7de745 8304 result = memcmp(&satosin6(sa1)->sin6_addr.s6_addr[0], &satosin6(sa2)->sin6_addr.s6_addr[0], sizeof(struct in6_addr));
fe8ab488 8305
0a7de745
A		 8306 if (check_port) {
8307 if (satosin6(sa1)->sin6_port < satosin6(sa2)->sin6_port) {
8308 port_result = -1;
8309 } else if (satosin6(sa1)->sin6_port > satosin6(sa2)->sin6_port) {
8310 port_result = 1;
fe8ab488
A		 8311 }
8312
0a7de745
A		 8313 if (result == 0) {
8314 result = port_result;
8315 } else if ((result > 0 && port_result < 0) || (result < 0 && port_result > 0)) {
8316 return 2;
8317 }
fe8ab488 8318 }
0a7de745
A		 8319
8320 break;
8321 }
8322 default: {
8323 result = memcmp(sa1, sa2, sa1->sa_len);
8324 break;
8325 }
fe8ab488
A		 8326 }
8327
8328 if (result < 0) {
8329 result = (-1);
8330 } else if (result > 0) {
8331 result = (1);
8332 }
8333
0a7de745 8334 return result;
fe8ab488
A		 8335}
8336
8337static bool
8338necp_buffer_compare_with_bit_prefix(u_int8_t *p1, u_int8_t *p2, u_int32_t bits)
8339{
8340 u_int8_t mask;
8341
8342 /* Handle null pointers */
8343 if (p1 == NULL || p2 == NULL) {
0a7de745 8344 return p1 == p2;
fe8ab488
A		 8345 }
8346
8347 while (bits >= 8) {
8348 if (*p1++ != *p2++) {
0a7de745 8349 return FALSE;
fe8ab488
A		 8350 }
8351 bits -= 8;
8352 }
8353
8354 if (bits > 0) {
0a7de745 8355 mask = ~((1 << (8 - bits)) - 1);
fe8ab488 8356 if ((*p1 & mask) != (*p2 & mask)) {
0a7de745 8357 return FALSE;
fe8ab488
A		 8358 }
8359 }
0a7de745 8360 return TRUE;
fe8ab488
A		 8361}
8362
fe8ab488 8363static bool
5ba3f43e 8364necp_update_qos_marking(struct ifnet *ifp, u_int32_t route_rule_id)
fe8ab488 8365{
39037602
A		 8366 bool qos_marking = FALSE;
8367 int exception_index = 0;
8368 struct necp_route_rule *route_rule = NULL;
fe8ab488 8369
39037602
A		 8370 route_rule = necp_lookup_route_rule_locked(&necp_route_rules, route_rule_id);
8371 if (route_rule == NULL) {
8372 qos_marking = FALSE;
fe8ab488
A		 8373 goto done;
8374 }
8375
39037602
A		 8376 qos_marking = (route_rule->default_action == NECP_ROUTE_RULE_QOS_MARKING) ? TRUE : FALSE;
8377
8378 if (ifp == NULL) {
fe8ab488
A		 8379 goto done;
8380 }
8381
39037602
A		 8382 for (exception_index = 0; exception_index < MAX_ROUTE_RULE_INTERFACES; exception_index++) {
8383 if (route_rule->exception_if_indices[exception_index] == 0) {
8384 break;
8385 }
8386 if (route_rule->exception_if_actions[exception_index] != NECP_ROUTE_RULE_QOS_MARKING) {
8387 continue;
8388 }
8389 if (route_rule->exception_if_indices[exception_index] == ifp->if_index) {
8390 qos_marking = TRUE;
8391 if (necp_debug > 2) {
8392 NECPLOG(LOG_DEBUG, "QoS Marking : Interface match %d for Rule %d Allowed %d",
8393 route_rule->exception_if_indices[exception_index], route_rule_id, qos_marking);
8394 }
8395 goto done;
8396 }
fe8ab488
A		 8397 }
8398
39037602
A		 8399 if ((route_rule->cellular_action == NECP_ROUTE_RULE_QOS_MARKING && IFNET_IS_CELLULAR(ifp)) ||
8400 (route_rule->wifi_action == NECP_ROUTE_RULE_QOS_MARKING && IFNET_IS_WIFI(ifp)) ||
8401 (route_rule->wired_action == NECP_ROUTE_RULE_QOS_MARKING && IFNET_IS_WIRED(ifp)) ||
8402 (route_rule->expensive_action == NECP_ROUTE_RULE_QOS_MARKING && IFNET_IS_EXPENSIVE(ifp))) {
8403 qos_marking = TRUE;
8404 if (necp_debug > 2) {
8405 NECPLOG(LOG_DEBUG, "QoS Marking: C:%d WF:%d W:%d E:%d for Rule %d Allowed %d",
8406 route_rule->cellular_action, route_rule->wifi_action, route_rule->wired_action,
8407 route_rule->expensive_action, route_rule_id, qos_marking);
8408 }
8409 goto done;
fe8ab488 8410 }
fe8ab488 8411done:
39037602
A		 8412 if (necp_debug > 1) {
8413 NECPLOG(LOG_DEBUG, "QoS Marking: Rule %d ifp %s Allowed %d",
8414 route_rule_id, ifp ? ifp->if_xname : "", qos_marking);
fe8ab488 8415 }
0a7de745 8416 return qos_marking;
fe8ab488
A		 8417}
8418
39037602
A		 8419void
8420necp_socket_update_qos_marking(struct inpcb *inp, struct rtentry *route, struct ifnet *interface, u_int32_t route_rule_id)
fe8ab488 8421{
39037602
A		 8422 bool qos_marking = FALSE;
8423 struct ifnet *ifp = interface = NULL;
fe8ab488 8424
5ba3f43e
A		 8425 if (net_qos_policy_restricted == 0) {
8426 return;
8427 }
39037602
A		 8428 if (inp->inp_socket == NULL) {
8429 return;
fe8ab488 8430 }
39037602
A		 8431 if ((inp->inp_socket->so_flags1 & SOF1_QOSMARKING_POLICY_OVERRIDE)) {
8432 return;
fe8ab488 8433 }
39037602
A		 8434 /*
8435 * This is racy but we do not need the performance hit of taking necp_kernel_policy_lock
8436 */
8437 if (inp->inp_policyresult.results.qos_marking_gencount == necp_kernel_socket_policies_gencount) {
8438 return;
fe8ab488
A		 8439 }
8440
39037602 8441 lck_rw_lock_shared(&necp_kernel_policy_lock);
fe8ab488 8442
39037602
A		 8443 if (ifp == NULL && route != NULL) {
8444 ifp = route->rt_ifp;
fe8ab488 8445 }
39037602
A		 8446 /*
8447 * By default, until we have a interface, do not mark and reevaluate the Qos marking policy
8448 */
8449 if (ifp == NULL || route_rule_id == 0) {
8450 qos_marking = FALSE;
fe8ab488
A		 8451 goto done;
8452 }
8453
39037602
A		 8454 if (ROUTE_RULE_IS_AGGREGATE(route_rule_id)) {
8455 struct necp_aggregate_route_rule *aggregate_route_rule = necp_lookup_aggregate_route_rule_locked(route_rule_id);
8456 if (aggregate_route_rule != NULL) {
8457 int index = 0;
8458 for (index = 0; index < MAX_AGGREGATE_ROUTE_RULES; index++) {
8459 u_int32_t sub_route_rule_id = aggregate_route_rule->rule_ids[index];
8460 if (sub_route_rule_id == 0) {
8461 break;
8462 }
5ba3f43e 8463 qos_marking = necp_update_qos_marking(ifp, sub_route_rule_id);
39037602
A		 8464 if (qos_marking == TRUE) {
8465 break;
8466 }
8467 }
8468 }
8469 } else {
5ba3f43e 8470 qos_marking = necp_update_qos_marking(ifp, route_rule_id);
fe8ab488 8471 }
39037602
A		 8472 /*
8473 * Now that we have an interface we remember the gencount
8474 */
8475 inp->inp_policyresult.results.qos_marking_gencount = necp_kernel_socket_policies_gencount;
fe8ab488 8476
fe8ab488 8477done:
39037602 8478 lck_rw_done(&necp_kernel_policy_lock);
fe8ab488 8479
39037602
A		 8480 if (qos_marking == TRUE) {
8481 inp->inp_socket->so_flags1 |= SOF1_QOSMARKING_ALLOWED;
8482 } else {
8483 inp->inp_socket->so_flags1 &= ~SOF1_QOSMARKING_ALLOWED;
8484 }
fe8ab488
A		 8485}
8486
d9a64523
A		 8487static bool
8488necp_route_is_lqm_abort(struct ifnet *ifp, struct ifnet *delegated_ifp)
8489{
8490 if (ifp != NULL &&
0a7de745
A		 8491 (ifp->if_interface_state.valid_bitmask & IF_INTERFACE_STATE_LQM_STATE_VALID) &&
8492 ifp->if_interface_state.lqm_state == IFNET_LQM_THRESH_ABORT) {
d9a64523
A		 8493 return true;
8494 }
8495 if (delegated_ifp != NULL &&
0a7de745
A		 8496 (delegated_ifp->if_interface_state.valid_bitmask & IF_INTERFACE_STATE_LQM_STATE_VALID) &&
8497 delegated_ifp->if_interface_state.lqm_state == IFNET_LQM_THRESH_ABORT) {
d9a64523
A		 8498 return true;
8499 }
8500 return false;
8501}
8502
fe8ab488 8503static bool
39037602 8504necp_route_is_allowed_inner(struct rtentry *route, struct ifnet *ifp, u_int32_t route_rule_id, u_int32_t *interface_type_denied)
3e170ce0
A		 8505{
8506 bool default_is_allowed = TRUE;
8507 u_int8_t type_aggregate_action = NECP_ROUTE_RULE_NONE;
8508 int exception_index = 0;
8509 struct ifnet *delegated_ifp = NULL;
8510 struct necp_route_rule *route_rule = NULL;
8511
8512 route_rule = necp_lookup_route_rule_locked(&necp_route_rules, route_rule_id);
8513 if (route_rule == NULL) {
0a7de745 8514 return TRUE;
3e170ce0
A		 8515 }
8516
8517 default_is_allowed = (route_rule->default_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? FALSE : TRUE;
8518 if (ifp == NULL) {
8519 ifp = route->rt_ifp;
8520 }
8521 if (ifp == NULL) {
8522 if (necp_debug > 1 && !default_is_allowed) {
8523 NECPLOG(LOG_DEBUG, "Route Allowed: No interface for route, using default for Rule %d Allowed %d", route_rule_id, default_is_allowed);
8524 }
0a7de745 8525 return default_is_allowed;
3e170ce0
A		 8526 }
8527
8528 delegated_ifp = ifp->if_delegated.ifp;
8529 for (exception_index = 0; exception_index < MAX_ROUTE_RULE_INTERFACES; exception_index++) {
8530 if (route_rule->exception_if_indices[exception_index] == 0) {
8531 break;
8532 }
8533 if (route_rule->exception_if_indices[exception_index] == ifp->if_index ||
0a7de745 8534 (delegated_ifp != NULL && route_rule->exception_if_indices[exception_index] == delegated_ifp->if_index)) {
d9a64523
A		 8535 if (route_rule->exception_if_actions[exception_index] == NECP_ROUTE_RULE_DENY_LQM_ABORT) {
8536 const bool lqm_abort = necp_route_is_lqm_abort(ifp, delegated_ifp);
8537 if (necp_debug > 1 && lqm_abort) {
8538 NECPLOG(LOG_DEBUG, "Route Allowed: Interface match %d for Rule %d Deny LQM Abort",
0a7de745 8539 route_rule->exception_if_indices[exception_index], route_rule_id);
d9a64523
A		 8540 }
8541 return false;
8542 } else if (IS_NECP_ROUTE_RULE_ALLOW_OR_DENY(route_rule->exception_if_actions[exception_index])) {
8543 if (necp_debug > 1) {
8544 NECPLOG(LOG_DEBUG, "Route Allowed: Interface match %d for Rule %d Allowed %d", route_rule->exception_if_indices[exception_index], route_rule_id, ((route_rule->exception_if_actions[exception_index] == NECP_ROUTE_RULE_DENY_INTERFACE) ? FALSE : TRUE));
8545 }
0a7de745 8546 return (route_rule->exception_if_actions[exception_index] == NECP_ROUTE_RULE_DENY_INTERFACE) ? FALSE : TRUE;
3e170ce0 8547 }
3e170ce0
A		 8548 }
8549 }
8550
d9a64523
A		 8551 if (IFNET_IS_CELLULAR(ifp)) {
8552 if (route_rule->cellular_action == NECP_ROUTE_RULE_DENY_LQM_ABORT) {
8553 if (necp_route_is_lqm_abort(ifp, delegated_ifp)) {
8554 if (interface_type_denied != NULL) {
8555 *interface_type_denied = IFRTYPE_FUNCTIONAL_CELLULAR;
8556 }
8557 // Mark aggregate action as deny
8558 type_aggregate_action = NECP_ROUTE_RULE_DENY_INTERFACE;
8559 }
8560 } else if (IS_NECP_ROUTE_RULE_ALLOW_OR_DENY(route_rule->cellular_action)) {
8561 if (interface_type_denied != NULL) {
8562 *interface_type_denied = IFRTYPE_FUNCTIONAL_CELLULAR;
8563 }
8564 if (type_aggregate_action == NECP_ROUTE_RULE_NONE ||
0a7de745
A		 8565 (type_aggregate_action == NECP_ROUTE_RULE_ALLOW_INTERFACE &&
8566 route_rule->cellular_action == NECP_ROUTE_RULE_DENY_INTERFACE)) {
8567 // Deny wins if there is a conflict
8568 type_aggregate_action = route_rule->cellular_action;
8569 }
3e170ce0 8570 }
3e170ce0
A		 8571 }
8572
d9a64523
A		 8573 if (IFNET_IS_WIFI(ifp)) {
8574 if (route_rule->wifi_action == NECP_ROUTE_RULE_DENY_LQM_ABORT) {
8575 if (necp_route_is_lqm_abort(ifp, delegated_ifp)) {
8576 if (interface_type_denied != NULL) {
8577 *interface_type_denied = IFRTYPE_FUNCTIONAL_WIFI_INFRA;
8578 }
8579 // Mark aggregate action as deny
8580 type_aggregate_action = NECP_ROUTE_RULE_DENY_INTERFACE;
8581 }
8582 } else if (IS_NECP_ROUTE_RULE_ALLOW_OR_DENY(route_rule->wifi_action)) {
8583 if (interface_type_denied != NULL) {
8584 *interface_type_denied = IFRTYPE_FUNCTIONAL_WIFI_INFRA;
8585 }
8586 if (type_aggregate_action == NECP_ROUTE_RULE_NONE ||
0a7de745
A		 8587 (type_aggregate_action == NECP_ROUTE_RULE_ALLOW_INTERFACE &&
8588 route_rule->wifi_action == NECP_ROUTE_RULE_DENY_INTERFACE)) {
8589 // Deny wins if there is a conflict
8590 type_aggregate_action = route_rule->wifi_action;
8591 }
39037602 8592 }
3e170ce0
A		 8593 }
8594
d9a64523
A		 8595 if (IFNET_IS_WIRED(ifp)) {
8596 if (route_rule->wired_action == NECP_ROUTE_RULE_DENY_LQM_ABORT) {
8597 if (necp_route_is_lqm_abort(ifp, delegated_ifp)) {
8598 if (interface_type_denied != NULL) {
8599 *interface_type_denied = IFRTYPE_FUNCTIONAL_WIRED;
8600 }
8601 // Mark aggregate action as deny
8602 type_aggregate_action = NECP_ROUTE_RULE_DENY_INTERFACE;
8603 }
8604 } else if (IS_NECP_ROUTE_RULE_ALLOW_OR_DENY(route_rule->wired_action)) {
8605 if (interface_type_denied != NULL) {
8606 *interface_type_denied = IFRTYPE_FUNCTIONAL_WIRED;
8607 }
8608 if (type_aggregate_action == NECP_ROUTE_RULE_NONE ||
0a7de745
A		 8609 (type_aggregate_action == NECP_ROUTE_RULE_ALLOW_INTERFACE &&
8610 route_rule->wired_action == NECP_ROUTE_RULE_DENY_INTERFACE)) {
8611 // Deny wins if there is a conflict
8612 type_aggregate_action = route_rule->wired_action;
8613 }
39037602 8614 }
3e170ce0
A		 8615 }
8616
d9a64523
A		 8617 if (IFNET_IS_EXPENSIVE(ifp)) {
8618 if (route_rule->expensive_action == NECP_ROUTE_RULE_DENY_LQM_ABORT) {
8619 if (necp_route_is_lqm_abort(ifp, delegated_ifp)) {
8620 // Mark aggregate action as deny
8621 type_aggregate_action = NECP_ROUTE_RULE_DENY_INTERFACE;
3e170ce0 8622 }
d9a64523
A		 8623 } else if (IS_NECP_ROUTE_RULE_ALLOW_OR_DENY(route_rule->expensive_action)) {
8624 if (type_aggregate_action == NECP_ROUTE_RULE_NONE ||
0a7de745
A		 8625 (type_aggregate_action == NECP_ROUTE_RULE_ALLOW_INTERFACE &&
8626 route_rule->expensive_action == NECP_ROUTE_RULE_DENY_INTERFACE)) {
8627 // Deny wins if there is a conflict
8628 type_aggregate_action = route_rule->expensive_action;
8629 }
d9a64523 8630 }
3e170ce0
A		 8631 }
8632
8633 if (type_aggregate_action != NECP_ROUTE_RULE_NONE) {
8634 if (necp_debug > 1) {
8635 NECPLOG(LOG_DEBUG, "Route Allowed: C:%d WF:%d W:%d E:%d for Rule %d Allowed %d", route_rule->cellular_action, route_rule->wifi_action, route_rule->wired_action, route_rule->expensive_action, route_rule_id, ((type_aggregate_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? FALSE : TRUE));
8636 }
0a7de745 8637 return (type_aggregate_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? FALSE : TRUE;
3e170ce0
A		 8638 }
8639
8640 if (necp_debug > 1 && !default_is_allowed) {
8641 NECPLOG(LOG_DEBUG, "Route Allowed: Using default for Rule %d Allowed %d", route_rule_id, default_is_allowed);
8642 }
0a7de745 8643 return default_is_allowed;
3e170ce0
A		 8644}
8645
8646static bool
39037602 8647necp_route_is_allowed(struct rtentry *route, struct ifnet *interface, u_int32_t route_rule_id, u_int32_t *interface_type_denied)
3e170ce0
A		 8648{
8649 if ((route == NULL && interface == NULL) || route_rule_id == 0) {
8650 if (necp_debug > 1) {
8651 NECPLOG(LOG_DEBUG, "Route Allowed: no route or interface, Rule %d Allowed %d", route_rule_id, TRUE);
8652 }
0a7de745 8653 return TRUE;
3e170ce0
A		 8654 }
8655
8656 if (ROUTE_RULE_IS_AGGREGATE(route_rule_id)) {
8657 struct necp_aggregate_route_rule *aggregate_route_rule = necp_lookup_aggregate_route_rule_locked(route_rule_id);
8658 if (aggregate_route_rule != NULL) {
8659 int index = 0;
8660 for (index = 0; index < MAX_AGGREGATE_ROUTE_RULES; index++) {
8661 u_int32_t sub_route_rule_id = aggregate_route_rule->rule_ids[index];
8662 if (sub_route_rule_id == 0) {
8663 break;
8664 }
39037602 8665 if (!necp_route_is_allowed_inner(route, interface, sub_route_rule_id, interface_type_denied)) {
0a7de745 8666 return FALSE;
3e170ce0
A		 8667 }
8668 }
8669 }
8670 } else {
0a7de745 8671 return necp_route_is_allowed_inner(route, interface, route_rule_id, interface_type_denied);
3e170ce0
A		 8672 }
8673
0a7de745 8674 return TRUE;
3e170ce0
A		 8675}
8676
8677bool
8678necp_packet_is_allowed_over_interface(struct mbuf *packet, struct ifnet *interface)
8679{
8680 bool is_allowed = TRUE;
8681 u_int32_t route_rule_id = necp_get_route_rule_id_from_packet(packet);
8682 if (route_rule_id != 0 &&
0a7de745 8683 interface != NULL) {
3e170ce0
A		 8684 lck_rw_lock_shared(&necp_kernel_policy_lock);
8685 is_allowed = necp_route_is_allowed(NULL, interface, necp_get_route_rule_id_from_packet(packet), NULL);
8686 lck_rw_done(&necp_kernel_policy_lock);
8687 }
0a7de745 8688 return is_allowed;
3e170ce0
A		 8689}
8690
8691static bool
8692necp_netagents_allow_traffic(u_int32_t *netagent_ids, size_t netagent_id_count)
8693{
8694 size_t netagent_cursor;
8695 for (netagent_cursor = 0; netagent_cursor < netagent_id_count; netagent_cursor++) {
8696 struct necp_uuid_id_mapping *mapping = NULL;
8697 u_int32_t netagent_id = netagent_ids[netagent_cursor];
8698 if (netagent_id == 0) {
8699 break;
8700 }
8701 mapping = necp_uuid_lookup_uuid_with_service_id_locked(netagent_id);
8702 if (mapping != NULL) {
8703 u_int32_t agent_flags = 0;
8704 agent_flags = netagent_get_flags(mapping->uuid);
8705 if (agent_flags & NETAGENT_FLAG_REGISTERED) {
8706 if (agent_flags & NETAGENT_FLAG_ACTIVE) {
8707 continue;
8708 } else if ((agent_flags & NETAGENT_FLAG_VOLUNTARY) == 0) {
0a7de745 8709 return FALSE;
3e170ce0
A		 8710 }
8711 }
8712 }
8713 }
0a7de745 8714 return TRUE;
3e170ce0
A		 8715}
8716
8717static bool
d9a64523 8718necp_socket_is_allowed_to_send_recv_internal(struct inpcb *inp, struct sockaddr *override_local_addr, struct sockaddr *override_remote_addr, ifnet_t interface, necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id, necp_kernel_policy_id *return_skip_policy_id)
fe8ab488
A		 8719{
8720 u_int32_t verifyifindex = interface ? interface->if_index : 0;
8721 bool allowed_to_receive = TRUE;
8722 struct necp_socket_info info;
8723 u_int32_t flowhash = 0;
8724 necp_kernel_policy_result service_action = 0;
8725 necp_kernel_policy_service service = { 0, 0 };
3e170ce0
A		 8726 u_int32_t route_rule_id = 0;
8727 struct rtentry *route = NULL;
39037602 8728 u_int32_t interface_type_denied = IFRTYPE_FUNCTIONAL_UNKNOWN;
3e170ce0
A		 8729
8730 u_int32_t netagent_ids[NECP_MAX_NETAGENTS];
8731 memset(&netagent_ids, 0, sizeof(netagent_ids));
fe8ab488
A		 8732
8733 if (return_policy_id) {
8734 *return_policy_id = NECP_KERNEL_POLICY_ID_NONE;
8735 }
d9a64523
A		 8736 if (return_skip_policy_id) {
8737 *return_skip_policy_id = NECP_KERNEL_POLICY_ID_NONE;
8738 }
3e170ce0
A		 8739 if (return_route_rule_id) {
8740 *return_route_rule_id = 0;
8741 }
fe8ab488
A		 8742
8743 if (inp == NULL) {
8744 goto done;
8745 }
8746
3e170ce0
A		 8747 route = inp->inp_route.ro_rt;
8748
fe8ab488
A		 8749 // Don't lock. Possible race condition, but we don't want the performance hit.
8750 if (necp_kernel_socket_policies_count == 0 ||
0a7de745 8751 (!(inp->inp_flags2 & INP2_WANT_APP_POLICY) && necp_kernel_socket_policies_non_app_count == 0)) {
fe8ab488 8752 if (necp_drop_all_order > 0) {
743345f9 8753 if (necp_socket_bypass(override_local_addr, override_remote_addr, inp)) {
fe8ab488
A		 8754 allowed_to_receive = TRUE;
8755 } else {
8756 allowed_to_receive = FALSE;
8757 }
8758 }
8759 goto done;
8760 }
8761
8762 // If this socket is connected, or we are not taking addresses into account, try to reuse last result
8763 if ((necp_socket_is_connected(inp) || (override_local_addr == NULL && override_remote_addr == NULL)) && inp->inp_policyresult.policy_id != NECP_KERNEL_POLICY_ID_NONE) {
8764 bool policies_have_changed = FALSE;
3e170ce0 8765 bool route_allowed = TRUE;
5ba3f43e 8766
fe8ab488
A		 8767 if (inp->inp_policyresult.policy_gencount != necp_kernel_socket_policies_gencount) {
8768 policies_have_changed = TRUE;
3e170ce0 8769 } else {
5ba3f43e
A		 8770 if (inp->inp_policyresult.results.route_rule_id != 0) {
8771 lck_rw_lock_shared(&necp_kernel_policy_lock);
8772 if (!necp_route_is_allowed(route, interface, inp->inp_policyresult.results.route_rule_id, &interface_type_denied)) {
8773 route_allowed = FALSE;
8774 }
8775 lck_rw_done(&necp_kernel_policy_lock);
3e170ce0 8776 }
fe8ab488 8777 }
fe8ab488
A		 8778
8779 if (!policies_have_changed) {
3e170ce0 8780 if (!route_allowed ||
0a7de745
A		 8781 inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_DROP ||
8782 inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT ||
8783 (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL && interface &&
8784 inp->inp_policyresult.results.result_parameter.tunnel_interface_index != verifyifindex)) {
8785 allowed_to_receive = FALSE;
8786 } else {
8787 if (return_policy_id) {
8788 *return_policy_id = inp->inp_policyresult.policy_id;
8789 }
8790 if (return_skip_policy_id) {
8791 *return_skip_policy_id = inp->inp_policyresult.skip_policy_id;
3e170ce0 8792 }
0a7de745
A		 8793 if (return_route_rule_id) {
8794 *return_route_rule_id = inp->inp_policyresult.results.route_rule_id;
8795 }
8796 }
fe8ab488
A		 8797 goto done;
8798 }
8799 }
3e170ce0 8800
fe8ab488 8801 // Check for loopback exception
743345f9 8802 if (necp_socket_bypass(override_local_addr, override_remote_addr, inp)) {
fe8ab488
A		 8803 allowed_to_receive = TRUE;
8804 goto done;
8805 }
8806
8807 // Actually calculate policy result
8808 lck_rw_lock_shared(&necp_kernel_policy_lock);
8809 necp_socket_fillout_info_locked(inp, override_local_addr, override_remote_addr, 0, &info);
8810
8811 flowhash = necp_socket_calc_flowhash_locked(&info);
8812 if (inp->inp_policyresult.policy_id != NECP_KERNEL_POLICY_ID_NONE &&
0a7de745
A		 8813 inp->inp_policyresult.policy_gencount == necp_kernel_socket_policies_gencount &&
8814 inp->inp_policyresult.flowhash == flowhash) {
fe8ab488 8815 if (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_DROP ||
0a7de745
A		 8816 inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT ||
8817 (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL && interface &&
8818 inp->inp_policyresult.results.result_parameter.tunnel_interface_index != verifyifindex) ||
8819 (inp->inp_policyresult.results.route_rule_id != 0 &&
8820 !necp_route_is_allowed(route, interface, inp->inp_policyresult.results.route_rule_id, &interface_type_denied))) {
fe8ab488 8821 allowed_to_receive = FALSE;
3e170ce0
A		 8822 } else {
8823 if (return_policy_id) {
8824 *return_policy_id = inp->inp_policyresult.policy_id;
8825 }
8826 if (return_route_rule_id) {
8827 *return_route_rule_id = inp->inp_policyresult.results.route_rule_id;
8828 }
e8c3f781
A		 8829 if (return_skip_policy_id) {
8830 *return_skip_policy_id = inp->inp_policyresult.skip_policy_id;
8831 }
fe8ab488
A		 8832 }
8833 lck_rw_done(&necp_kernel_policy_lock);
8834 goto done;
8835 }
8836
d9a64523 8837 struct necp_kernel_socket_policy *matched_policy = necp_socket_find_policy_match_with_info_locked(necp_kernel_socket_policies_map[NECP_SOCKET_MAP_APP_ID_TO_BUCKET(info.application_id)], &info, NULL, &route_rule_id, &service_action, &service, netagent_ids, NULL, NECP_MAX_NETAGENTS, NULL, 0, current_proc(), return_skip_policy_id);
fe8ab488
A		 8838 if (matched_policy != NULL) {
8839 if (matched_policy->result == NECP_KERNEL_POLICY_RESULT_DROP ||
0a7de745
A		 8840 matched_policy->result == NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT ||
8841 (matched_policy->result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL && interface &&
8842 matched_policy->result_parameter.tunnel_interface_index != verifyifindex) ||
8843 ((service_action == NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED ||
8844 service_action == NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED) &&
8845 service.identifier != 0 && service.identifier != NECP_NULL_SERVICE_ID) ||
8846 (route_rule_id != 0 &&
8847 !necp_route_is_allowed(route, interface, route_rule_id, &interface_type_denied)) ||
8848 !necp_netagents_allow_traffic(netagent_ids, NECP_MAX_NETAGENTS)) {
fe8ab488 8849 allowed_to_receive = FALSE;
3e170ce0
A		 8850 } else {
8851 if (return_policy_id) {
8852 *return_policy_id = matched_policy->id;
8853 }
8854 if (return_route_rule_id) {
8855 *return_route_rule_id = route_rule_id;
8856 }
fe8ab488
A		 8857 }
8858 lck_rw_done(&necp_kernel_policy_lock);
8859
8860 if (necp_debug > 1 && matched_policy->id != inp->inp_policyresult.policy_id) {
8861 NECPLOG(LOG_DEBUG, "Socket Send/Recv Policy: Policy %d Allowed %d", return_policy_id ? *return_policy_id : 0, allowed_to_receive);
8862 }
8863 goto done;
8864 } else if (necp_drop_all_order > 0) {
8865 allowed_to_receive = FALSE;
39037602
A		 8866 } else {
8867 if (return_policy_id) {
8868 *return_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH;
8869 }
8870 if (return_route_rule_id) {
8871 *return_route_rule_id = route_rule_id;
8872 }
fe8ab488
A		 8873 }
8874
8875 lck_rw_done(&necp_kernel_policy_lock);
8876
8877done:
39037602 8878 if (!allowed_to_receive && interface_type_denied != IFRTYPE_FUNCTIONAL_UNKNOWN) {
3e170ce0
A		 8879 soevent(inp->inp_socket, (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED));
8880 }
8881
0a7de745 8882 return allowed_to_receive;
fe8ab488
A		 8883}
8884
8885bool
d9a64523 8886necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port, u_int16_t remote_port, struct in_addr *local_addr, struct in_addr *remote_addr, ifnet_t interface, necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id, necp_kernel_policy_id *return_skip_policy_id)
fe8ab488 8887{
d9a64523
A		 8888 struct sockaddr_in local = {};
8889 struct sockaddr_in remote = {};
fe8ab488
A		 8890 local.sin_family = remote.sin_family = AF_INET;
8891 local.sin_len = remote.sin_len = sizeof(struct sockaddr_in);
8892 local.sin_port = local_port;
8893 remote.sin_port = remote_port;
8894 memcpy(&local.sin_addr, local_addr, sizeof(local.sin_addr));
8895 memcpy(&remote.sin_addr, remote_addr, sizeof(remote.sin_addr));
8896
0a7de745
A		 8897 return necp_socket_is_allowed_to_send_recv_internal(inp, (struct sockaddr *)&local, (struct sockaddr *)&remote, interface,
8898 return_policy_id, return_route_rule_id, return_skip_policy_id);
fe8ab488
A		 8899}
8900
8901bool
d9a64523 8902necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port, u_int16_t remote_port, struct in6_addr *local_addr, struct in6_addr *remote_addr, ifnet_t interface, necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id, necp_kernel_policy_id *return_skip_policy_id)
fe8ab488 8903{
d9a64523
A		 8904 struct sockaddr_in6 local = {};
8905 struct sockaddr_in6 remote = {};
fe8ab488
A		 8906 local.sin6_family = remote.sin6_family = AF_INET6;
8907 local.sin6_len = remote.sin6_len = sizeof(struct sockaddr_in6);
8908 local.sin6_port = local_port;
8909 remote.sin6_port = remote_port;
8910 memcpy(&local.sin6_addr, local_addr, sizeof(local.sin6_addr));
8911 memcpy(&remote.sin6_addr, remote_addr, sizeof(remote.sin6_addr));
8912
0a7de745
A		 8913 return necp_socket_is_allowed_to_send_recv_internal(inp, (struct sockaddr *)&local, (struct sockaddr *)&remote, interface,
8914 return_policy_id, return_route_rule_id, return_skip_policy_id);
fe8ab488
A		 8915}
8916
8917bool
d9a64523 8918necp_socket_is_allowed_to_send_recv(struct inpcb *inp, necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id,
0a7de745 8919 necp_kernel_policy_id *return_skip_policy_id)
fe8ab488 8920{
0a7de745 8921 return necp_socket_is_allowed_to_send_recv_internal(inp, NULL, NULL, NULL, return_policy_id, return_route_rule_id, return_skip_policy_id);
fe8ab488
A		 8922}
8923
8924int
d9a64523 8925necp_mark_packet_from_socket(struct mbuf *packet, struct inpcb *inp, necp_kernel_policy_id policy_id, u_int32_t route_rule_id,
0a7de745 8926 necp_kernel_policy_id skip_policy_id)
fe8ab488 8927{
39037602 8928 if (packet == NULL || inp == NULL || !(packet->m_flags & M_PKTHDR)) {
0a7de745 8929 return EINVAL;
fe8ab488
A		 8930 }
8931
8932 // Mark ID for Pass and IP Tunnel
8933 if (policy_id != NECP_KERNEL_POLICY_ID_NONE) {
8934 packet->m_pkthdr.necp_mtag.necp_policy_id = policy_id;
8935 } else if (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_PASS ||
0a7de745 8936 inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL) {
fe8ab488
A		 8937 packet->m_pkthdr.necp_mtag.necp_policy_id = inp->inp_policyresult.policy_id;
8938 } else {
8939 packet->m_pkthdr.necp_mtag.necp_policy_id = NECP_KERNEL_POLICY_ID_NONE;
8940 }
8941 packet->m_pkthdr.necp_mtag.necp_last_interface_index = 0;
3e170ce0
A		 8942 if (route_rule_id != 0) {
8943 packet->m_pkthdr.necp_mtag.necp_route_rule_id = route_rule_id;
8944 } else {
8945 packet->m_pkthdr.necp_mtag.necp_route_rule_id = inp->inp_policyresult.results.route_rule_id;
8946 }
39037602 8947 packet->m_pkthdr.necp_mtag.necp_app_id = inp->inp_policyresult.app_id;
fe8ab488 8948
d9a64523
A		 8949 if (skip_policy_id != NECP_KERNEL_POLICY_ID_NONE) {
8950 packet->m_pkthdr.necp_mtag.necp_skip_policy_id = skip_policy_id;
8951 }
8952
0a7de745 8953 return 0;
fe8ab488
A		 8954}
8955
8956int
8957necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id)
8958{
39037602 8959 if (packet == NULL || !(packet->m_flags & M_PKTHDR)) {
0a7de745 8960 return EINVAL;
fe8ab488
A		 8961 }
8962
8963 // Mark ID for Pass and IP Tunnel
8964 if (policy_id != NECP_KERNEL_POLICY_ID_NONE) {
8965 packet->m_pkthdr.necp_mtag.necp_policy_id = policy_id;
8966 } else {
8967 packet->m_pkthdr.necp_mtag.necp_policy_id = NECP_KERNEL_POLICY_ID_NONE;
8968 }
8969
0a7de745 8970 return 0;
fe8ab488
A		 8971}
8972
8973int
8974necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface)
8975{
39037602 8976 if (packet == NULL || !(packet->m_flags & M_PKTHDR)) {
0a7de745 8977 return EINVAL;
fe8ab488
A		 8978 }
8979
8980 // Mark ID for Pass and IP Tunnel
8981 if (interface != NULL) {
8982 packet->m_pkthdr.necp_mtag.necp_last_interface_index = interface->if_index;
8983 }
8984
0a7de745 8985 return 0;
fe8ab488
A		 8986}
8987
8988int
8989necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive)
8990{
39037602 8991 if (packet == NULL || !(packet->m_flags & M_PKTHDR)) {
0a7de745 8992 return EINVAL;
fe8ab488 8993 }
39037602 8994
fe8ab488
A		 8995 if (is_keepalive) {
8996 packet->m_pkthdr.pkt_flags |= PKTF_KEEPALIVE;
8997 } else {
8998 packet->m_pkthdr.pkt_flags &= ~PKTF_KEEPALIVE;
8999 }
39037602 9000
0a7de745 9001 return 0;
fe8ab488
A		 9002}
9003
9004necp_kernel_policy_id
9005necp_get_policy_id_from_packet(struct mbuf *packet)
9006{
39037602 9007 if (packet == NULL || !(packet->m_flags & M_PKTHDR)) {
0a7de745 9008 return NECP_KERNEL_POLICY_ID_NONE;
fe8ab488 9009 }
39037602 9010
0a7de745 9011 return packet->m_pkthdr.necp_mtag.necp_policy_id;
fe8ab488
A		 9012}
9013
d9a64523
A		 9014necp_kernel_policy_id
9015necp_get_skip_policy_id_from_packet(struct mbuf *packet)
9016{
9017 if (packet == NULL || !(packet->m_flags & M_PKTHDR)) {
0a7de745 9018 return NECP_KERNEL_POLICY_ID_NONE;
d9a64523
A		 9019 }
9020
0a7de745 9021 return packet->m_pkthdr.necp_mtag.necp_skip_policy_id;
d9a64523
A		 9022}
9023
fe8ab488
A		 9024u_int32_t
9025necp_get_last_interface_index_from_packet(struct mbuf *packet)
9026{
39037602 9027 if (packet == NULL || !(packet->m_flags & M_PKTHDR)) {
0a7de745 9028 return 0;
fe8ab488 9029 }
3e170ce0 9030
0a7de745 9031 return packet->m_pkthdr.necp_mtag.necp_last_interface_index;
fe8ab488
A		 9032}
9033
3e170ce0
A		 9034u_int32_t
9035necp_get_route_rule_id_from_packet(struct mbuf *packet)
9036{
39037602 9037 if (packet == NULL || !(packet->m_flags & M_PKTHDR)) {
0a7de745 9038 return 0;
3e170ce0
A		 9039 }
9040
0a7de745 9041 return packet->m_pkthdr.necp_mtag.necp_route_rule_id;
3e170ce0
A		 9042}
9043
39037602
A		 9044int
9045necp_get_app_uuid_from_packet(struct mbuf *packet,
0a7de745 9046 uuid_t app_uuid)
39037602
A		 9047{
9048 if (packet == NULL || !(packet->m_flags & M_PKTHDR)) {
0a7de745 9049 return EINVAL;
39037602
A		 9050 }
9051
9052 bool found_mapping = FALSE;
9053 if (packet->m_pkthdr.necp_mtag.necp_app_id != 0) {
9054 lck_rw_lock_shared(&necp_kernel_policy_lock);
9055 struct necp_uuid_id_mapping *entry = necp_uuid_lookup_uuid_with_app_id_locked(packet->m_pkthdr.necp_mtag.necp_app_id);
9056 if (entry != NULL) {
9057 uuid_copy(app_uuid, entry->uuid);
9058 found_mapping = true;
9059 }
9060 lck_rw_done(&necp_kernel_policy_lock);
9061 }
9062 if (!found_mapping) {
9063 uuid_clear(app_uuid);
9064 }
0a7de745 9065 return 0;
39037602
A		 9066}
9067
fe8ab488
A		 9068bool
9069necp_get_is_keepalive_from_packet(struct mbuf *packet)
9070{
39037602 9071 if (packet == NULL || !(packet->m_flags & M_PKTHDR)) {
0a7de745 9072 return FALSE;
fe8ab488 9073 }
39037602 9074
0a7de745 9075 return packet->m_pkthdr.pkt_flags & PKTF_KEEPALIVE;
fe8ab488
A		 9076}
9077
9078u_int32_t
9079necp_socket_get_content_filter_control_unit(struct socket *so)
9080{
9081 struct inpcb *inp = sotoinpcb(so);
39037602 9082
fe8ab488 9083 if (inp == NULL) {
0a7de745 9084 return 0;
fe8ab488 9085 }
0a7de745 9086 return inp->inp_policyresult.results.filter_control_unit;
fe8ab488
A		 9087}
9088
9089bool
9090necp_socket_should_use_flow_divert(struct inpcb *inp)
9091{
9092 if (inp == NULL) {
0a7de745 9093 return FALSE;
fe8ab488
A		 9094 }
9095
0a7de745 9096 return inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT;
fe8ab488
A		 9097}
9098
9099u_int32_t
9100necp_socket_get_flow_divert_control_unit(struct inpcb *inp)
9101{
9102 if (inp == NULL) {
0a7de745 9103 return 0;
fe8ab488
A		 9104 }
9105
9106 if (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT) {
0a7de745 9107 return inp->inp_policyresult.results.result_parameter.flow_divert_control_unit;
fe8ab488
A		 9108 }
9109
0a7de745 9110 return 0;
fe8ab488
A		 9111}
9112
9113bool
9114necp_socket_should_rescope(struct inpcb *inp)
9115{
9116 if (inp == NULL) {
0a7de745 9117 return FALSE;
fe8ab488 9118 }
39037602 9119
0a7de745
A		 9120 return inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED ||
9121 inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SCOPED_DIRECT;
fe8ab488
A		 9122}
9123
9124u_int
9125necp_socket_get_rescope_if_index(struct inpcb *inp)
9126{
9127 if (inp == NULL) {
0a7de745 9128 return 0;
fe8ab488 9129 }
39037602 9130
fe8ab488 9131 if (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) {
0a7de745 9132 return inp->inp_policyresult.results.result_parameter.scoped_interface_index;
d9a64523 9133 } else if (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SCOPED_DIRECT) {
0a7de745 9134 return necp_get_primary_direct_interface_index();
fe8ab488 9135 }
39037602 9136
0a7de745 9137 return 0;
fe8ab488
A		 9138}
9139
3e170ce0
A		 9140u_int32_t
9141necp_socket_get_effective_mtu(struct inpcb *inp, u_int32_t current_mtu)
9142{
9143 if (inp == NULL) {
0a7de745 9144 return current_mtu;
3e170ce0
A		 9145 }
9146
9147 if (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL &&
0a7de745
A		 9148 (inp->inp_flags & INP_BOUND_IF) &&
9149 inp->inp_boundifp) {
3e170ce0
A		 9150 u_int bound_interface_index = inp->inp_boundifp->if_index;
9151 u_int tunnel_interface_index = inp->inp_policyresult.results.result_parameter.tunnel_interface_index;
9152
9153 // The result is IP Tunnel, and is rescoping from one interface to another. Recalculate MTU.
9154 if (bound_interface_index != tunnel_interface_index) {
9155 ifnet_t tunnel_interface = NULL;
9156
9157 ifnet_head_lock_shared();
9158 tunnel_interface = ifindex2ifnet[tunnel_interface_index];
9159 ifnet_head_done();
9160
9161 if (tunnel_interface != NULL) {
9162 u_int32_t direct_tunnel_mtu = tunnel_interface->if_mtu;
9163 u_int32_t delegate_tunnel_mtu = (tunnel_interface->if_delegated.ifp != NULL) ? tunnel_interface->if_delegated.ifp->if_mtu : 0;
9164 if (delegate_tunnel_mtu != 0 &&
0a7de745
A		 9165 strncmp(tunnel_interface->if_name, "ipsec", strlen("ipsec")) == 0) {
9166 // For ipsec interfaces, calculate the overhead from the delegate interface
9167 u_int32_t tunnel_overhead = (u_int32_t)(esp_hdrsiz(NULL) + sizeof(struct ip6_hdr));
9168 if (delegate_tunnel_mtu > tunnel_overhead) {
9169 delegate_tunnel_mtu -= tunnel_overhead;
9170 }
3e170ce0 9171
0a7de745
A		 9172 if (delegate_tunnel_mtu < direct_tunnel_mtu) {
9173 // If the (delegate - overhead) < direct, return (delegate - overhead)
9174 return delegate_tunnel_mtu;
9175 } else {
9176 // Otherwise return direct
9177 return direct_tunnel_mtu;
9178 }
3e170ce0
A		 9179 } else {
9180 // For non-ipsec interfaces, just return the tunnel MTU
0a7de745 9181 return direct_tunnel_mtu;
3e170ce0
A		 9182 }
9183 }
9184 }
9185 }
9186
9187 // By default, just return the MTU passed in
0a7de745 9188 return current_mtu;
3e170ce0
A		 9189}
9190
fe8ab488
A		 9191ifnet_t
9192necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter)
9193{
9194 if (result_parameter == NULL) {
0a7de745 9195 return NULL;
fe8ab488
A		 9196 }
9197
0a7de745 9198 return ifindex2ifnet[result_parameter->tunnel_interface_index];
fe8ab488
A		 9199}
9200
9201bool
9202necp_packet_can_rebind_to_ifnet(struct mbuf *packet, struct ifnet *interface, struct route *new_route, int family)
9203{
9204 bool found_match = FALSE;
9205 errno_t result = 0;
9206 ifaddr_t *addresses = NULL;
9207 union necp_sockaddr_union address_storage;
9208 int i;
9209
9210 if (packet == NULL || interface == NULL || new_route == NULL || (family != AF_INET && family != AF_INET6)) {
0a7de745 9211 return FALSE;
fe8ab488
A		 9212 }
9213
9214 result = ifnet_get_address_list_family(interface, &addresses, family);
9215 if (result != 0) {
9216 NECPLOG(LOG_ERR, "Failed to get address list for %s%d", ifnet_name(interface), ifnet_unit(interface));
0a7de745 9217 return FALSE;
fe8ab488
A		 9218 }
9219
9220 for (i = 0; addresses[i] != NULL; i++) {
9221 ROUTE_RELEASE(new_route);
9222 if (ifaddr_address(addresses[i], &address_storage.sa, sizeof(address_storage)) == 0) {
9223 if (family == AF_INET) {
9224 struct ip *ip = mtod(packet, struct ip *);
9225 if (memcmp(&address_storage.sin.sin_addr, &ip->ip_src, sizeof(ip->ip_src)) == 0) {
9226 struct sockaddr_in *dst4 = (struct sockaddr_in *)(void *)&new_route->ro_dst;
9227 dst4->sin_family = AF_INET;
9228 dst4->sin_len = sizeof(struct sockaddr_in);
9229 dst4->sin_addr = ip->ip_dst;
9230 rtalloc_scoped(new_route, interface->if_index);
9231 if (!ROUTE_UNUSABLE(new_route)) {
9232 found_match = TRUE;
9233 goto done;
9234 }
9235 }
9236 } else if (family == AF_INET6) {
9237 struct ip6_hdr *ip6 = mtod(packet, struct ip6_hdr *);
9238 if (memcmp(&address_storage.sin6.sin6_addr, &ip6->ip6_src, sizeof(ip6->ip6_src)) == 0) {
9239 struct sockaddr_in6 *dst6 = (struct sockaddr_in6 *)(void *)&new_route->ro_dst;
9240 dst6->sin6_family = AF_INET6;
9241 dst6->sin6_len = sizeof(struct sockaddr_in6);
9242 dst6->sin6_addr = ip6->ip6_dst;
9243 rtalloc_scoped(new_route, interface->if_index);
9244 if (!ROUTE_UNUSABLE(new_route)) {
9245 found_match = TRUE;
9246 goto done;
9247 }
9248 }
9249 }
9250 }
9251 }
9252
9253done:
9254 ifnet_free_address_list(addresses);
9255 addresses = NULL;
0a7de745 9256 return found_match;
fe8ab488
A		 9257}
9258
9259static bool
9260necp_addr_is_loopback(struct sockaddr *address)
9261{
9262 if (address == NULL) {
0a7de745 9263 return FALSE;
fe8ab488 9264 }
39037602 9265
fe8ab488 9266 if (address->sa_family == AF_INET) {
0a7de745 9267 return ntohl(((struct sockaddr_in *)(void *)address)->sin_addr.s_addr) == INADDR_LOOPBACK;
fe8ab488
A		 9268 } else if (address->sa_family == AF_INET6) {
9269 return IN6_IS_ADDR_LOOPBACK(&((struct sockaddr_in6 *)(void *)address)->sin6_addr);
9270 }
39037602 9271
0a7de745 9272 return FALSE;
fe8ab488
A		 9273}
9274
9275static bool
9276necp_is_loopback(struct sockaddr *local_addr, struct sockaddr *remote_addr, struct inpcb *inp, struct mbuf *packet)
9277{
9278 // Note: This function only checks for the loopback addresses.
9279 // In the future, we may want to expand to also allow any traffic
9280 // going through the loopback interface, but until then, this
9281 // check is cheaper.
9282
9283 if (local_addr != NULL && necp_addr_is_loopback(local_addr)) {
0a7de745 9284 return TRUE;
fe8ab488 9285 }
39037602 9286
fe8ab488 9287 if (remote_addr != NULL && necp_addr_is_loopback(remote_addr)) {
0a7de745 9288 return TRUE;
fe8ab488 9289 }
39037602 9290
fe8ab488
A		 9291 if (inp != NULL) {
9292 if ((inp->inp_flags & INP_BOUND_IF) && inp->inp_boundifp && (inp->inp_boundifp->if_flags & IFF_LOOPBACK)) {
0a7de745 9293 return TRUE;
fe8ab488
A		 9294 }
9295 if (inp->inp_vflag & INP_IPV4) {
9296 if (ntohl(inp->inp_laddr.s_addr) == INADDR_LOOPBACK ||
0a7de745
A		 9297 ntohl(inp->inp_faddr.s_addr) == INADDR_LOOPBACK) {
9298 return TRUE;
fe8ab488
A		 9299 }
9300 } else if (inp->inp_vflag & INP_IPV6) {
9301 if (IN6_IS_ADDR_LOOPBACK(&inp->in6p_laddr) ||
0a7de745
A		 9302 IN6_IS_ADDR_LOOPBACK(&inp->in6p_faddr)) {
9303 return TRUE;
fe8ab488
A		 9304 }
9305 }
9306 }
39037602 9307
fe8ab488
A		 9308 if (packet != NULL) {
9309 struct ip *ip = mtod(packet, struct ip *);
9310 if (ip->ip_v == 4) {
9311 if (ntohl(ip->ip_src.s_addr) == INADDR_LOOPBACK) {
0a7de745 9312 return TRUE;
fe8ab488
A		 9313 }
9314 if (ntohl(ip->ip_dst.s_addr) == INADDR_LOOPBACK) {
0a7de745 9315 return TRUE;
fe8ab488
A		 9316 }
9317 } else if (ip->ip_v == 6) {
9318 struct ip6_hdr *ip6 = mtod(packet, struct ip6_hdr *);
9319 if (IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src)) {
0a7de745 9320 return TRUE;
fe8ab488
A		 9321 }
9322 if (IN6_IS_ADDR_LOOPBACK(&ip6->ip6_dst)) {
0a7de745 9323 return TRUE;
fe8ab488
A		 9324 }
9325 }
9326 }
39037602 9327
0a7de745 9328 return FALSE;
fe8ab488 9329}
743345f9
A		 9330
9331static bool
9332necp_is_intcoproc(struct inpcb *inp, struct mbuf *packet)
9333{
743345f9 9334 if (inp != NULL) {
0a7de745 9335 return sflt_permission_check(inp) ? true : false;
743345f9
A		 9336 }
9337 if (packet != NULL) {
9338 struct ip6_hdr *ip6 = mtod(packet, struct ip6_hdr *);
9339 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) == IPV6_VERSION &&
9340 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst) &&
9341 ip6->ip6_dst.s6_addr32[2] == ntohl(0xaede48ff) &&
9342 ip6->ip6_dst.s6_addr32[3] == ntohl(0xfe334455)) {
0a7de745 9343 return true;
743345f9
A		 9344 }
9345 }
9346
0a7de745 9347 return false;
743345f9 9348}
mirror of XNU