[apple/xnu.git] / bsd / net / necp.h

/*
 * Copyright (c) 2013, 2014 Apple Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 *
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 *
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 *
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */

#ifndef	_NET_NECP_H_
#define	_NET_NECP_H_

#include <netinet/in.h>
#include <sys/socket.h>

/*
 * Name registered by the ipsec kernel control
 */
#define	NECP_CONTROL_NAME "com.apple.net.necp_control"

#define NECP_TLV_LENGTH_UINT32	1

struct necp_packet_header {
    u_int8_t		packet_type;
	u_int8_t		flags;
    u_int32_t		message_id;
};
#define	NECP_PACKET_TYPE_POLICY_ADD				1
#define	NECP_PACKET_TYPE_POLICY_GET				2
#define	NECP_PACKET_TYPE_POLICY_DELETE			3
#define	NECP_PACKET_TYPE_POLICY_APPLY_ALL		4
#define	NECP_PACKET_TYPE_POLICY_LIST_ALL		5
#define	NECP_PACKET_TYPE_POLICY_DELETE_ALL		6
#define	NECP_PACKET_TYPE_SET_SESSION_PRIORITY	7
#define	NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC	8
#define	NECP_PACKET_TYPE_REGISTER_SERVICE		9
#define	NECP_PACKET_TYPE_UNREGISTER_SERVICE		10

#define	NECP_PACKET_FLAGS_RESPONSE				0x01	// Used for acks, errors, and query responses

#define	NECP_TLV_NIL							0
#define	NECP_TLV_ERROR							1	// u_int32_t
#define	NECP_TLV_POLICY_ORDER					2	// u_int32_t
#define	NECP_TLV_POLICY_CONDITION				3
#define	NECP_TLV_POLICY_RESULT					4
#define	NECP_TLV_POLICY_ID						5	// u_int32_t
#define	NECP_TLV_SESSION_PRIORITY				6	// u_int32_t
#define	NECP_TLV_ATTRIBUTE_DOMAIN				7	// char[]
#define	NECP_TLV_ATTRIBUTE_ACCOUNT				8	// char[]
#define	NECP_TLV_SERVICE_UUID					9	// uuid_t
#define	NECP_TLV_ROUTE_RULE						10

#define	NECP_POLICY_CONDITION_FLAGS_NEGATIVE	0x01 // Negative

// Conditions
#define	NECP_POLICY_CONDITION_DEFAULT			0	// N/A, not valid with any other conditions
// Socket/Application conditions
#define	NECP_POLICY_CONDITION_APPLICATION		1	// uuid_t, uses effective UUID when possible
#define	NECP_POLICY_CONDITION_REAL_APPLICATION	2	// uuid_t, never uses effective UUID. Only valid with NECP_POLICY_CONDITION_APPLICATION
// Application-only Conditions
#define	NECP_POLICY_CONDITION_DOMAIN			3	// String, such as apple.com
#define	NECP_POLICY_CONDITION_ACCOUNT			4	// String
// Socket/Application condition
#define	NECP_POLICY_CONDITION_ENTITLEMENT		5	// String
#define	NECP_POLICY_CONDITION_PID				6	// pid_t
#define	NECP_POLICY_CONDITION_UID				7	// uid_t
#define	NECP_POLICY_CONDITION_ALL_INTERFACES	8	// N/A
#define	NECP_POLICY_CONDITION_BOUND_INTERFACE	9	// String
#define	NECP_POLICY_CONDITION_TRAFFIC_CLASS		10	// necp_policy_condition_tc_range
// Socket/IP conditions
#define	NECP_POLICY_CONDITION_IP_PROTOCOL		11	// u_int8_t
#define	NECP_POLICY_CONDITION_LOCAL_ADDR		12	// necp_policy_condition_addr
#define	NECP_POLICY_CONDITION_REMOTE_ADDR		13	// necp_policy_condition_addr
#define	NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE	14	// necp_policy_condition_addr_range
#define	NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE	15	// necp_policy_condition_addr_range

// Results
#define	NECP_POLICY_RESULT_PASS					1	// N/A
#define	NECP_POLICY_RESULT_SKIP					2	// u_int32_t, policy order to skip to. 0 to skip all session policies.
#define	NECP_POLICY_RESULT_DROP					3	// N/A
#define	NECP_POLICY_RESULT_SOCKET_DIVERT		4	// u_int32_t, flow divert control unit
#define	NECP_POLICY_RESULT_SOCKET_FILTER		5	// u_int32_t, filter control unit
#define	NECP_POLICY_RESULT_IP_TUNNEL			6	// String, interface name
#define	NECP_POLICY_RESULT_IP_FILTER			7	// ?
#define	NECP_POLICY_RESULT_TRIGGER				8	// service uuid_t
#define	NECP_POLICY_RESULT_TRIGGER_IF_NEEDED	9	// service uuid_t
#define	NECP_POLICY_RESULT_TRIGGER_SCOPED		10	// service uuid_t
#define	NECP_POLICY_RESULT_NO_TRIGGER_SCOPED	11	// service uuid_t
#define	NECP_POLICY_RESULT_SOCKET_SCOPED		12	// String, interface name
#define	NECP_POLICY_RESULT_ROUTE_RULES			13	// N/A, must have route rules defined
#define	NECP_POLICY_RESULT_USE_NETAGENT			14	// netagent uuid_t

#define	NECP_POLICY_RESULT_MAX					NECP_POLICY_RESULT_USE_NETAGENT

// Route rule
#define	NECP_ROUTE_RULE_NONE					0	// N/A
#define	NECP_ROUTE_RULE_DENY_INTERFACE			1	// String, or empty to match all
#define	NECP_ROUTE_RULE_ALLOW_INTERFACE			2	// String, or empty to match all

#define	NECP_ROUTE_RULE_FLAG_CELLULAR			0x01
#define	NECP_ROUTE_RULE_FLAG_WIFI				0x02
#define	NECP_ROUTE_RULE_FLAG_WIRED				0x04
#define	NECP_ROUTE_RULE_FLAG_EXPENSIVE			0x08

// Errors
#define	NECP_ERROR_INTERNAL						0
#define	NECP_ERROR_UNKNOWN_PACKET_TYPE			1
#define	NECP_ERROR_INVALID_TLV					2
#define	NECP_ERROR_POLICY_RESULT_INVALID		3
#define	NECP_ERROR_POLICY_CONDITIONS_INVALID	4
#define	NECP_ERROR_POLICY_ID_NOT_FOUND			5
#define	NECP_ERROR_INVALID_PROCESS				6
#define	NECP_ERROR_ROUTE_RULES_INVALID			7

// Modifiers
#define	NECP_MASK_USERSPACE_ONLY	0x80000000	// on filter_control_unit value

struct necp_policy_condition_tc_range {
	u_int32_t start_tc;
	u_int32_t end_tc;
} __attribute__((__packed__));

struct necp_policy_condition_addr {
	u_int8_t		prefix;
	union {
		struct sockaddr			sa;
		struct sockaddr_in		sin;
		struct sockaddr_in6		sin6;
	} address;
} __attribute__((__packed__));

struct necp_policy_condition_addr_range {
	union {
		struct sockaddr			sa;
		struct sockaddr_in		sin;
		struct sockaddr_in6		sin6;
	} start_address;
	union {
		struct sockaddr			sa;
		struct sockaddr_in		sin;
		struct sockaddr_in6		sin6;
	} end_address;
} __attribute__((__packed__));

#define	NECP_SESSION_PRIORITY_UNKNOWN			0
#define	NECP_SESSION_PRIORITY_CONTROL			1
#define	NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL	2
#define	NECP_SESSION_PRIORITY_HIGH				3
#define	NECP_SESSION_PRIORITY_DEFAULT			4
#define	NECP_SESSION_PRIORITY_LOW				5

#define	NECP_SESSION_NUM_PRIORITIES				NECP_SESSION_PRIORITY_LOW

typedef u_int32_t necp_policy_id;
typedef u_int32_t necp_policy_order;

typedef u_int32_t necp_kernel_policy_result;
typedef u_int32_t necp_kernel_policy_filter;

typedef union {
	u_int						tunnel_interface_index;
	u_int						scoped_interface_index;
	u_int32_t					flow_divert_control_unit;
	u_int32_t					filter_control_unit;
} necp_kernel_policy_routing_result_parameter;

#define	NECP_SERVICE_FLAGS_REGISTERED			0x01
#define	NECP_MAX_NETAGENTS						8
struct necp_aggregate_result {
	necp_kernel_policy_result			routing_result;
	necp_kernel_policy_routing_result_parameter	routing_result_parameter;
	necp_kernel_policy_filter			filter_control_unit;
	necp_kernel_policy_result			service_action;
	uuid_t								service_uuid;
	u_int32_t							service_flags;
	u_int32_t							service_data;
	u_int								routed_interface_index;
	u_int32_t							policy_id;
	uuid_t								netagents[NECP_MAX_NETAGENTS];
	u_int32_t							netagent_flags[NECP_MAX_NETAGENTS];
};

#define KEV_NECP_SUBCLASS 8
#define KEV_NECP_POLICIES_CHANGED 1

struct kev_necp_policies_changed_data {
	u_int32_t		changed_count;	// Defaults to 0.
};

#ifdef BSD_KERNEL_PRIVATE
#include <stdbool.h>
#include <sys/socketvar.h>
#include <sys/kern_control.h>
#include <netinet/ip_var.h>
#include <netinet6/ip6_var.h>

#define	NECPCTL_DROP_ALL_LEVEL				1	/* Drop all packets if no policy matches above this level */
#define	NECPCTL_DEBUG						2	/* Log all kernel policy matches */
#define	NECPCTL_PASS_LOOPBACK				3	/* Pass all loopback traffic */
#define	NECPCTL_PASS_KEEPALIVES				4	/* Pass all kernel-generated keepalive traffic */
#define	NECPCTL_SOCKET_POLICY_COUNT			5	/* Count of all socket-level policies */
#define	NECPCTL_SOCKET_NON_APP_POLICY_COUNT	6	/* Count of non-per-app socket-level policies */
#define	NECPCTL_IP_POLICY_COUNT				7	/* Count of all ip-level policies */
#define	NECPCTL_SESSION_COUNT				8	/* Count of NECP sessions */

#define	NECPCTL_NAMES {					\
	{ 0, 0 },							\
	{ "drop_all_level", CTLTYPE_INT },	\
	{ "debug", CTLTYPE_INT },			\
	{ "pass_loopback", CTLTYPE_INT },	\
	{ "pass_keepalives", CTLTYPE_INT },	\
}

typedef u_int32_t necp_kernel_policy_id;
#define	NECP_KERNEL_POLICY_ID_NONE			0
#define	NECP_KERNEL_POLICY_ID_NO_MATCH		1
#define	NECP_KERNEL_POLICY_ID_FIRST_VALID	2

typedef u_int32_t necp_app_id;

#define	NECP_KERNEL_POLICY_RESULT_NONE					0
#define	NECP_KERNEL_POLICY_RESULT_PASS					NECP_POLICY_RESULT_PASS
#define	NECP_KERNEL_POLICY_RESULT_SKIP					NECP_POLICY_RESULT_SKIP
#define	NECP_KERNEL_POLICY_RESULT_DROP					NECP_POLICY_RESULT_DROP
#define	NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT			NECP_POLICY_RESULT_SOCKET_DIVERT
#define	NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER			NECP_POLICY_RESULT_SOCKET_FILTER
#define	NECP_KERNEL_POLICY_RESULT_IP_TUNNEL				NECP_POLICY_RESULT_IP_TUNNEL
#define	NECP_KERNEL_POLICY_RESULT_IP_FILTER				NECP_POLICY_RESULT_IP_FILTER
#define	NECP_KERNEL_POLICY_RESULT_TRIGGER				NECP_POLICY_RESULT_TRIGGER
#define	NECP_KERNEL_POLICY_RESULT_TRIGGER_IF_NEEDED		NECP_POLICY_RESULT_TRIGGER_IF_NEEDED
#define	NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED		NECP_POLICY_RESULT_TRIGGER_SCOPED
#define	NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED		NECP_POLICY_RESULT_NO_TRIGGER_SCOPED
#define	NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED			NECP_POLICY_RESULT_SOCKET_SCOPED
#define	NECP_KERNEL_POLICY_RESULT_ROUTE_RULES			NECP_POLICY_RESULT_ROUTE_RULES
#define	NECP_KERNEL_POLICY_RESULT_USE_NETAGENT			NECP_POLICY_RESULT_USE_NETAGENT

typedef struct {
	u_int32_t identifier;
	u_int32_t data;
} necp_kernel_policy_service;

typedef union {
	u_int						tunnel_interface_index;
	u_int						scoped_interface_index;
	u_int32_t					flow_divert_control_unit;
	u_int32_t					filter_control_unit;
	u_int32_t					skip_policy_order;
	u_int32_t					route_rule_id;
	u_int32_t					netagent_id;
	necp_kernel_policy_service	service;
} necp_kernel_policy_result_parameter;

union necp_sockaddr_union {
	struct sockaddr			sa;
	struct sockaddr_in		sin;
	struct sockaddr_in6		sin6;
};

struct necp_kernel_socket_policy {
	LIST_ENTRY(necp_kernel_socket_policy)	chain;
	necp_policy_id				parent_policy_id;
	necp_kernel_policy_id		id;
	necp_policy_order			order;
	u_int32_t					session_order;
	int							session_pid;

	u_int32_t					condition_mask;
	u_int32_t					condition_negated_mask;
	necp_kernel_policy_id		cond_policy_id;
	u_int32_t					cond_app_id;					// Locally assigned ID value stored
	u_int32_t					cond_real_app_id;				// Locally assigned ID value stored
	u_int32_t					cond_account_id;				// Locally assigned ID value stored
	char						*cond_domain;					// String
	u_int8_t					cond_domain_dot_count;			// Number of dots in cond_domain
	pid_t						cond_pid;
	uid_t						cond_uid;
	ifnet_t						cond_bound_interface;			// Matches specific binding only
	struct necp_policy_condition_tc_range cond_traffic_class;	// Matches traffic class in range
	u_int16_t					cond_protocol;					// Matches IP protcol number
	union necp_sockaddr_union	cond_local_start;				// Matches local IP address (or start)
	union necp_sockaddr_union	cond_local_end;					// Matches IP address range
	u_int8_t					cond_local_prefix;				// Defines subnet
	union necp_sockaddr_union	cond_remote_start;				// Matches remote IP address (or start)
	union necp_sockaddr_union	cond_remote_end;				// Matches IP address range
	u_int8_t					cond_remote_prefix;				// Defines subnet

	necp_kernel_policy_result	result;
	necp_kernel_policy_result_parameter	result_parameter;
};

struct necp_kernel_ip_output_policy {
	LIST_ENTRY(necp_kernel_ip_output_policy)	chain;
	necp_policy_id				parent_policy_id;
	necp_kernel_policy_id		id;
	necp_policy_order			suborder;
	necp_policy_order			order;
	u_int32_t					session_order;
	int							session_pid;

	u_int32_t					condition_mask;
	u_int32_t					condition_negated_mask;
	necp_kernel_policy_id		cond_policy_id;
	ifnet_t						cond_bound_interface;			// Matches specific binding only
	u_int16_t					cond_protocol;					// Matches IP protcol number
	union necp_sockaddr_union	cond_local_start;				// Matches local IP address (or start)
	union necp_sockaddr_union	cond_local_end;					// Matches IP address range
	u_int8_t					cond_local_prefix;				// Defines subnet
	union necp_sockaddr_union	cond_remote_start;				// Matches remote IP address (or start)
	union necp_sockaddr_union	cond_remote_end;				// Matches IP address range
	u_int8_t					cond_remote_prefix;				// Defines subnet
	u_int32_t					cond_last_interface_index;

	necp_kernel_policy_result	result;
	necp_kernel_policy_result_parameter	result_parameter;
};

#define	MAX_KERNEL_SOCKET_POLICIES			1
#define	MAX_KERNEL_IP_OUTPUT_POLICIES		4
struct necp_session_policy {
	LIST_ENTRY(necp_session_policy) chain;
	bool				applied;			// Applied into the kernel table
	bool				pending_deletion;	// Waiting to be removed from kernel table
	bool				pending_update;		// Policy has been modified since creation/last application
	necp_policy_id		id;
	necp_policy_order	order;
	u_int8_t			*result;
	u_int32_t			result_size;
	u_int8_t			*conditions; // Array of conditions, each with a u_int32_t length at start
	u_int32_t			conditions_size;
	u_int8_t			*route_rules; // Array of route rules, each with a u_int32_t length at start
	u_int32_t			route_rules_size;

	uuid_t				applied_app_uuid;
	uuid_t				applied_real_app_uuid;
	char				*applied_domain;
	char				*applied_account;

	uuid_t				applied_result_uuid;

	u_int32_t			applied_route_rules_id;

	necp_kernel_policy_id	kernel_socket_policies[MAX_KERNEL_SOCKET_POLICIES];
	necp_kernel_policy_id	kernel_ip_output_policies[MAX_KERNEL_IP_OUTPUT_POLICIES];
};

struct necp_aggregate_socket_result {
	necp_kernel_policy_result			result;
	necp_kernel_policy_result_parameter	result_parameter;
	necp_kernel_policy_filter			filter_control_unit;
	u_int32_t							route_rule_id;
};

struct necp_inpcb_result {
	char								*application_layer_domain;
	u_int32_t							application_layer_account_id;
	necp_kernel_policy_id				policy_id;
	int32_t								policy_gencount;
	u_int32_t							flowhash;
	struct necp_aggregate_socket_result	results;
};

errno_t necp_init(void);

errno_t necp_set_socket_attributes(struct socket *so, struct sockopt *sopt);
errno_t necp_get_socket_attributes(struct socket *so, struct sockopt *sopt);

u_int32_t necp_socket_get_content_filter_control_unit(struct socket *so);

bool necp_socket_should_use_flow_divert(struct inpcb *inp);
u_int32_t necp_socket_get_flow_divert_control_unit(struct inpcb *inp);

bool necp_socket_should_rescope(struct inpcb *inp);
u_int necp_socket_get_rescope_if_index(struct inpcb *inp);
u_int32_t necp_socket_get_effective_mtu(struct inpcb *inp, u_int32_t current_mtu);

bool necp_socket_is_allowed_to_send_recv(struct inpcb *inp, necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id);
bool necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port, u_int16_t remote_port, struct in_addr *local_addr, struct in_addr *remote_addr, ifnet_t interface, necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id);
bool necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port, u_int16_t remote_port, struct in6_addr *local_addr, struct in6_addr *remote_addr, ifnet_t interface, necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id);
int necp_mark_packet_from_socket(struct mbuf *packet, struct inpcb *inp, necp_kernel_policy_id policy_id, u_int32_t route_rule_id);
necp_kernel_policy_id necp_get_policy_id_from_packet(struct mbuf *packet);
u_int32_t necp_get_last_interface_index_from_packet(struct mbuf *packet);
u_int32_t necp_get_route_rule_id_from_packet(struct mbuf *packet);

necp_kernel_policy_id necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local_addr, struct sockaddr *override_remote_addr, u_int32_t override_bound_interface);
necp_kernel_policy_id necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_args *ipoa, necp_kernel_policy_result *result, necp_kernel_policy_result_parameter *result_parameter);
necp_kernel_policy_id necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out_args *ip6oa, necp_kernel_policy_result *result, necp_kernel_policy_result_parameter *result_parameter);

int necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id);
int necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface);

ifnet_t necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter);
bool necp_packet_can_rebind_to_ifnet(struct mbuf *packet, struct ifnet *interface, struct route *new_route, int family);

bool necp_packet_is_allowed_over_interface(struct mbuf *packet, struct ifnet *interface);

int necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive);
bool necp_get_is_keepalive_from_packet(struct mbuf *packet);

#endif /* BSD_KERNEL_PRIVATE */
#ifndef KERNEL
int necp_match_policy(const uint8_t *parameters, size_t parameters_size, struct necp_aggregate_result *returned_result);
#endif /* !KERNEL */

#endif
Commit	Line	Data
fe8ab488 A	1	/*
	2	* Copyright (c) 2013, 2014 Apple Inc. All rights reserved.
	3	*
	4	* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
	5	*
	6	* This file contains Original Code and/or Modifications of Original Code
	7	* as defined in and that are subject to the Apple Public Source License
	8	* Version 2.0 (the 'License'). You may not use this file except in
	9	* compliance with the License. The rights granted to you under the License
	10	* may not be used to create, or enable the creation or redistribution of,
	11	* unlawful or unlicensed copies of an Apple operating system, or to
	12	* circumvent, violate, or enable the circumvention or violation of, any
	13	* terms of an Apple operating system software license agreement.
	14	*
	15	* Please obtain a copy of the License at
	16	* http://www.opensource.apple.com/apsl/ and read it before using this file.
	17	*
	18	* The Original Code and all software distributed under the License are
	19	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
	20	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
	21	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
	22	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
	23	* Please see the License for the specific language governing rights and
	24	* limitations under the License.
	25	*
	26	* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
	27	*/
	28
	29	#ifndef _NET_NECP_H_
	30	#define _NET_NECP_H_
	31
	32	#include <netinet/in.h>
	33	#include <sys/socket.h>
	34
	35	/*
	36	* Name registered by the ipsec kernel control
	37	*/
	38	#define NECP_CONTROL_NAME "com.apple.net.necp_control"
	39
3e170ce0 A	40	#define NECP_TLV_LENGTH_UINT32 1
3e170ce0 A	41
fe8ab488 A	42	struct necp_packet_header {
	43	u_int8_t packet_type;
	44	u_int8_t flags;
	45	u_int32_t message_id;
	46	};
	47	#define NECP_PACKET_TYPE_POLICY_ADD 1
	48	#define NECP_PACKET_TYPE_POLICY_GET 2
	49	#define NECP_PACKET_TYPE_POLICY_DELETE 3
	50	#define NECP_PACKET_TYPE_POLICY_APPLY_ALL 4
	51	#define NECP_PACKET_TYPE_POLICY_LIST_ALL 5
	52	#define NECP_PACKET_TYPE_POLICY_DELETE_ALL 6
	53	#define NECP_PACKET_TYPE_SET_SESSION_PRIORITY 7
	54	#define NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC 8
	55	#define NECP_PACKET_TYPE_REGISTER_SERVICE 9
	56	#define NECP_PACKET_TYPE_UNREGISTER_SERVICE 10
	57
	58	#define NECP_PACKET_FLAGS_RESPONSE 0x01 // Used for acks, errors, and query responses
	59
	60	#define NECP_TLV_NIL 0
	61	#define NECP_TLV_ERROR 1 // u_int32_t
	62	#define NECP_TLV_POLICY_ORDER 2 // u_int32_t
	63	#define NECP_TLV_POLICY_CONDITION 3
	64	#define NECP_TLV_POLICY_RESULT 4
	65	#define NECP_TLV_POLICY_ID 5 // u_int32_t
	66	#define NECP_TLV_SESSION_PRIORITY 6 // u_int32_t
	67	#define NECP_TLV_ATTRIBUTE_DOMAIN 7 // char[]
	68	#define NECP_TLV_ATTRIBUTE_ACCOUNT 8 // char[]
	69	#define NECP_TLV_SERVICE_UUID 9 // uuid_t
3e170ce0	70	#define NECP_TLV_ROUTE_RULE 10
fe8ab488 A	71
	72	#define NECP_POLICY_CONDITION_FLAGS_NEGATIVE 0x01 // Negative
	73
	74	// Conditions
	75	#define NECP_POLICY_CONDITION_DEFAULT 0 // N/A, not valid with any other conditions
	76	// Socket/Application conditions
	77	#define NECP_POLICY_CONDITION_APPLICATION 1 // uuid_t, uses effective UUID when possible
	78	#define NECP_POLICY_CONDITION_REAL_APPLICATION 2 // uuid_t, never uses effective UUID. Only valid with NECP_POLICY_CONDITION_APPLICATION
	79	// Application-only Conditions
	80	#define NECP_POLICY_CONDITION_DOMAIN 3 // String, such as apple.com
	81	#define NECP_POLICY_CONDITION_ACCOUNT 4 // String
	82	// Socket/Application condition
	83	#define NECP_POLICY_CONDITION_ENTITLEMENT 5 // String
	84	#define NECP_POLICY_CONDITION_PID 6 // pid_t
	85	#define NECP_POLICY_CONDITION_UID 7 // uid_t
	86	#define NECP_POLICY_CONDITION_ALL_INTERFACES 8 // N/A
	87	#define NECP_POLICY_CONDITION_BOUND_INTERFACE 9 // String
	88	#define NECP_POLICY_CONDITION_TRAFFIC_CLASS 10 // necp_policy_condition_tc_range
	89	// Socket/IP conditions
	90	#define NECP_POLICY_CONDITION_IP_PROTOCOL 11 // u_int8_t
	91	#define NECP_POLICY_CONDITION_LOCAL_ADDR 12 // necp_policy_condition_addr
	92	#define NECP_POLICY_CONDITION_REMOTE_ADDR 13 // necp_policy_condition_addr
	93	#define NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE 14 // necp_policy_condition_addr_range
	94	#define NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE 15 // necp_policy_condition_addr_range
	95
	96	// Results
	97	#define NECP_POLICY_RESULT_PASS 1 // N/A
	98	#define NECP_POLICY_RESULT_SKIP 2 // u_int32_t, policy order to skip to. 0 to skip all session policies.
	99	#define NECP_POLICY_RESULT_DROP 3 // N/A
	100	#define NECP_POLICY_RESULT_SOCKET_DIVERT 4 // u_int32_t, flow divert control unit
	101	#define NECP_POLICY_RESULT_SOCKET_FILTER 5 // u_int32_t, filter control unit
	102	#define NECP_POLICY_RESULT_IP_TUNNEL 6 // String, interface name
	103	#define NECP_POLICY_RESULT_IP_FILTER 7 // ?
	104	#define NECP_POLICY_RESULT_TRIGGER 8 // service uuid_t
	105	#define NECP_POLICY_RESULT_TRIGGER_IF_NEEDED 9 // service uuid_t
	106	#define NECP_POLICY_RESULT_TRIGGER_SCOPED 10 // service uuid_t
	107	#define NECP_POLICY_RESULT_NO_TRIGGER_SCOPED 11 // service uuid_t
	108	#define NECP_POLICY_RESULT_SOCKET_SCOPED 12 // String, interface name
3e170ce0 A	109	#define NECP_POLICY_RESULT_ROUTE_RULES 13 // N/A, must have route rules defined
	110	#define NECP_POLICY_RESULT_USE_NETAGENT 14 // netagent uuid_t
	111
	112	#define NECP_POLICY_RESULT_MAX NECP_POLICY_RESULT_USE_NETAGENT
fe8ab488	113
3e170ce0 A	114	// Route rule
	115	#define NECP_ROUTE_RULE_NONE 0 // N/A
	116	#define NECP_ROUTE_RULE_DENY_INTERFACE 1 // String, or empty to match all
	117	#define NECP_ROUTE_RULE_ALLOW_INTERFACE 2 // String, or empty to match all
	118
	119	#define NECP_ROUTE_RULE_FLAG_CELLULAR 0x01
	120	#define NECP_ROUTE_RULE_FLAG_WIFI 0x02
	121	#define NECP_ROUTE_RULE_FLAG_WIRED 0x04
	122	#define NECP_ROUTE_RULE_FLAG_EXPENSIVE 0x08
fe8ab488 A	123
	124	// Errors
	125	#define NECP_ERROR_INTERNAL 0
	126	#define NECP_ERROR_UNKNOWN_PACKET_TYPE 1
	127	#define NECP_ERROR_INVALID_TLV 2
	128	#define NECP_ERROR_POLICY_RESULT_INVALID 3
	129	#define NECP_ERROR_POLICY_CONDITIONS_INVALID 4
	130	#define NECP_ERROR_POLICY_ID_NOT_FOUND 5
	131	#define NECP_ERROR_INVALID_PROCESS 6
3e170ce0	132	#define NECP_ERROR_ROUTE_RULES_INVALID 7
fe8ab488 A	133
	134	// Modifiers
	135	#define NECP_MASK_USERSPACE_ONLY 0x80000000 // on filter_control_unit value
	136
	137	struct necp_policy_condition_tc_range {
	138	u_int32_t start_tc;
	139	u_int32_t end_tc;
	140	} __attribute__((__packed__));
	141
	142	struct necp_policy_condition_addr {
	143	u_int8_t prefix;
	144	union {
	145	struct sockaddr sa;
	146	struct sockaddr_in sin;
	147	struct sockaddr_in6 sin6;
	148	} address;
	149	} __attribute__((__packed__));
	150
	151	struct necp_policy_condition_addr_range {
	152	union {
	153	struct sockaddr sa;
	154	struct sockaddr_in sin;
	155	struct sockaddr_in6 sin6;
	156	} start_address;
	157	union {
	158	struct sockaddr sa;
	159	struct sockaddr_in sin;
	160	struct sockaddr_in6 sin6;
	161	} end_address;
	162	} __attribute__((__packed__));
	163
	164	#define NECP_SESSION_PRIORITY_UNKNOWN 0
	165	#define NECP_SESSION_PRIORITY_CONTROL 1
	166	#define NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL 2
	167	#define NECP_SESSION_PRIORITY_HIGH 3
	168	#define NECP_SESSION_PRIORITY_DEFAULT 4
	169	#define NECP_SESSION_PRIORITY_LOW 5
	170
	171	#define NECP_SESSION_NUM_PRIORITIES NECP_SESSION_PRIORITY_LOW
	172
	173	typedef u_int32_t necp_policy_id;
	174	typedef u_int32_t necp_policy_order;
	175
	176	typedef u_int32_t necp_kernel_policy_result;
	177	typedef u_int32_t necp_kernel_policy_filter;
	178
	179	typedef union {
	180	u_int tunnel_interface_index;
	181	u_int scoped_interface_index;
	182	u_int32_t flow_divert_control_unit;
	183	u_int32_t filter_control_unit;
	184	} necp_kernel_policy_routing_result_parameter;
	185
	186	#define NECP_SERVICE_FLAGS_REGISTERED 0x01
3e170ce0	187	#define NECP_MAX_NETAGENTS 8
fe8ab488 A	188	struct necp_aggregate_result {
	189	necp_kernel_policy_result routing_result;
	190	necp_kernel_policy_routing_result_parameter routing_result_parameter;
	191	necp_kernel_policy_filter filter_control_unit;
	192	necp_kernel_policy_result service_action;
	193	uuid_t service_uuid;
	194	u_int32_t service_flags;
	195	u_int32_t service_data;
3e170ce0 A	196	u_int routed_interface_index;
	197	u_int32_t policy_id;
	198	uuid_t netagents[NECP_MAX_NETAGENTS];
	199	u_int32_t netagent_flags[NECP_MAX_NETAGENTS];
	200	};
	201
	202	#define KEV_NECP_SUBCLASS 8
	203	#define KEV_NECP_POLICIES_CHANGED 1
	204
	205	struct kev_necp_policies_changed_data {
	206	u_int32_t changed_count; // Defaults to 0.
fe8ab488 A	207	};
	208
	209	#ifdef BSD_KERNEL_PRIVATE
	210	#include <stdbool.h>
	211	#include <sys/socketvar.h>
	212	#include <sys/kern_control.h>
	213	#include <netinet/ip_var.h>
	214	#include <netinet6/ip6_var.h>
	215
3e170ce0 A	216	#define NECPCTL_DROP_ALL_LEVEL 1 /* Drop all packets if no policy matches above this level */
	217	#define NECPCTL_DEBUG 2 /* Log all kernel policy matches */
	218	#define NECPCTL_PASS_LOOPBACK 3 /* Pass all loopback traffic */
	219	#define NECPCTL_PASS_KEEPALIVES 4 /* Pass all kernel-generated keepalive traffic */
	220	#define NECPCTL_SOCKET_POLICY_COUNT 5 /* Count of all socket-level policies */
	221	#define NECPCTL_SOCKET_NON_APP_POLICY_COUNT 6 /* Count of non-per-app socket-level policies */
	222	#define NECPCTL_IP_POLICY_COUNT 7 /* Count of all ip-level policies */
	223	#define NECPCTL_SESSION_COUNT 8 /* Count of NECP sessions */
fe8ab488 A	224
	225	#define NECPCTL_NAMES { \
	226	{ 0, 0 }, \
	227	{ "drop_all_level", CTLTYPE_INT }, \
	228	{ "debug", CTLTYPE_INT }, \
	229	{ "pass_loopback", CTLTYPE_INT }, \
	230	{ "pass_keepalives", CTLTYPE_INT }, \
	231	}
	232
	233	typedef u_int32_t necp_kernel_policy_id;
	234	#define NECP_KERNEL_POLICY_ID_NONE 0
	235	#define NECP_KERNEL_POLICY_ID_NO_MATCH 1
	236	#define NECP_KERNEL_POLICY_ID_FIRST_VALID 2
	237
	238	typedef u_int32_t necp_app_id;
	239
	240	#define NECP_KERNEL_POLICY_RESULT_NONE 0
	241	#define NECP_KERNEL_POLICY_RESULT_PASS NECP_POLICY_RESULT_PASS
	242	#define NECP_KERNEL_POLICY_RESULT_SKIP NECP_POLICY_RESULT_SKIP
	243	#define NECP_KERNEL_POLICY_RESULT_DROP NECP_POLICY_RESULT_DROP
	244	#define NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT NECP_POLICY_RESULT_SOCKET_DIVERT
	245	#define NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER NECP_POLICY_RESULT_SOCKET_FILTER
	246	#define NECP_KERNEL_POLICY_RESULT_IP_TUNNEL NECP_POLICY_RESULT_IP_TUNNEL
	247	#define NECP_KERNEL_POLICY_RESULT_IP_FILTER NECP_POLICY_RESULT_IP_FILTER
	248	#define NECP_KERNEL_POLICY_RESULT_TRIGGER NECP_POLICY_RESULT_TRIGGER
	249	#define NECP_KERNEL_POLICY_RESULT_TRIGGER_IF_NEEDED NECP_POLICY_RESULT_TRIGGER_IF_NEEDED
	250	#define NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED NECP_POLICY_RESULT_TRIGGER_SCOPED
	251	#define NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED NECP_POLICY_RESULT_NO_TRIGGER_SCOPED
	252	#define NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED NECP_POLICY_RESULT_SOCKET_SCOPED
3e170ce0 A	253	#define NECP_KERNEL_POLICY_RESULT_ROUTE_RULES NECP_POLICY_RESULT_ROUTE_RULES
3e170ce0 A	254	#define NECP_KERNEL_POLICY_RESULT_USE_NETAGENT NECP_POLICY_RESULT_USE_NETAGENT
fe8ab488 A	255
	256	typedef struct {
	257	u_int32_t identifier;
	258	u_int32_t data;
	259	} necp_kernel_policy_service;
	260
	261	typedef union {
	262	u_int tunnel_interface_index;
	263	u_int scoped_interface_index;
	264	u_int32_t flow_divert_control_unit;
	265	u_int32_t filter_control_unit;
	266	u_int32_t skip_policy_order;
3e170ce0 A	267	u_int32_t route_rule_id;
3e170ce0 A	268	u_int32_t netagent_id;
fe8ab488 A	269	necp_kernel_policy_service service;
	270	} necp_kernel_policy_result_parameter;
	271
	272	union necp_sockaddr_union {
	273	struct sockaddr sa;
	274	struct sockaddr_in sin;
	275	struct sockaddr_in6 sin6;
	276	};
	277
	278	struct necp_kernel_socket_policy {
	279	LIST_ENTRY(necp_kernel_socket_policy) chain;
	280	necp_policy_id parent_policy_id;
	281	necp_kernel_policy_id id;
	282	necp_policy_order order;
	283	u_int32_t session_order;
3e170ce0 A	284	int session_pid;
3e170ce0 A	285
fe8ab488 A	286	u_int32_t condition_mask;
	287	u_int32_t condition_negated_mask;
	288	necp_kernel_policy_id cond_policy_id;
	289	u_int32_t cond_app_id; // Locally assigned ID value stored
	290	u_int32_t cond_real_app_id; // Locally assigned ID value stored
	291	u_int32_t cond_account_id; // Locally assigned ID value stored
	292	char *cond_domain; // String
	293	u_int8_t cond_domain_dot_count; // Number of dots in cond_domain
	294	pid_t cond_pid;
	295	uid_t cond_uid;
	296	ifnet_t cond_bound_interface; // Matches specific binding only
	297	struct necp_policy_condition_tc_range cond_traffic_class; // Matches traffic class in range
	298	u_int16_t cond_protocol; // Matches IP protcol number
	299	union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
	300	union necp_sockaddr_union cond_local_end; // Matches IP address range
	301	u_int8_t cond_local_prefix; // Defines subnet
	302	union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
	303	union necp_sockaddr_union cond_remote_end; // Matches IP address range
	304	u_int8_t cond_remote_prefix; // Defines subnet
3e170ce0	305
fe8ab488 A	306	necp_kernel_policy_result result;
	307	necp_kernel_policy_result_parameter result_parameter;
	308	};
	309
	310	struct necp_kernel_ip_output_policy {
	311	LIST_ENTRY(necp_kernel_ip_output_policy) chain;
	312	necp_policy_id parent_policy_id;
	313	necp_kernel_policy_id id;
	314	necp_policy_order suborder;
	315	necp_policy_order order;
	316	u_int32_t session_order;
3e170ce0 A	317	int session_pid;
3e170ce0 A	318
fe8ab488 A	319	u_int32_t condition_mask;
	320	u_int32_t condition_negated_mask;
	321	necp_kernel_policy_id cond_policy_id;
	322	ifnet_t cond_bound_interface; // Matches specific binding only
	323	u_int16_t cond_protocol; // Matches IP protcol number
	324	union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
	325	union necp_sockaddr_union cond_local_end; // Matches IP address range
	326	u_int8_t cond_local_prefix; // Defines subnet
	327	union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
	328	union necp_sockaddr_union cond_remote_end; // Matches IP address range
	329	u_int8_t cond_remote_prefix; // Defines subnet
	330	u_int32_t cond_last_interface_index;
3e170ce0	331
fe8ab488 A	332	necp_kernel_policy_result result;
	333	necp_kernel_policy_result_parameter result_parameter;
	334	};
	335
	336	#define MAX_KERNEL_SOCKET_POLICIES 1
	337	#define MAX_KERNEL_IP_OUTPUT_POLICIES 4
	338	struct necp_session_policy {
	339	LIST_ENTRY(necp_session_policy) chain;
	340	bool applied; // Applied into the kernel table
	341	bool pending_deletion; // Waiting to be removed from kernel table
	342	bool pending_update; // Policy has been modified since creation/last application
	343	necp_policy_id id;
	344	necp_policy_order order;
	345	u_int8_t *result;
3e170ce0 A	346	u_int32_t result_size;
	347	u_int8_t *conditions; // Array of conditions, each with a u_int32_t length at start
	348	u_int32_t conditions_size;
	349	u_int8_t *route_rules; // Array of route rules, each with a u_int32_t length at start
	350	u_int32_t route_rules_size;
	351
fe8ab488 A	352	uuid_t applied_app_uuid;
	353	uuid_t applied_real_app_uuid;
	354	char *applied_domain;
	355	char *applied_account;
3e170ce0 A	356
	357	uuid_t applied_result_uuid;
	358
	359	u_int32_t applied_route_rules_id;
	360
fe8ab488 A	361	necp_kernel_policy_id kernel_socket_policies[MAX_KERNEL_SOCKET_POLICIES];
	362	necp_kernel_policy_id kernel_ip_output_policies[MAX_KERNEL_IP_OUTPUT_POLICIES];
	363	};
	364
	365	struct necp_aggregate_socket_result {
	366	necp_kernel_policy_result result;
	367	necp_kernel_policy_result_parameter result_parameter;
	368	necp_kernel_policy_filter filter_control_unit;
3e170ce0	369	u_int32_t route_rule_id;
fe8ab488 A	370	};
	371
	372	struct necp_inpcb_result {
	373	char *application_layer_domain;
	374	u_int32_t application_layer_account_id;
	375	necp_kernel_policy_id policy_id;
	376	int32_t policy_gencount;
	377	u_int32_t flowhash;
	378	struct necp_aggregate_socket_result results;
	379	};
	380
	381	errno_t necp_init(void);
	382
	383	errno_t necp_set_socket_attributes(struct socket so, struct sockopt sopt);
	384	errno_t necp_get_socket_attributes(struct socket so, struct sockopt sopt);
	385
	386	u_int32_t necp_socket_get_content_filter_control_unit(struct socket *so);
	387
	388	bool necp_socket_should_use_flow_divert(struct inpcb *inp);
	389	u_int32_t necp_socket_get_flow_divert_control_unit(struct inpcb *inp);
	390
	391	bool necp_socket_should_rescope(struct inpcb *inp);
	392	u_int necp_socket_get_rescope_if_index(struct inpcb *inp);
3e170ce0	393	u_int32_t necp_socket_get_effective_mtu(struct inpcb *inp, u_int32_t current_mtu);
fe8ab488	394
3e170ce0 A	395	bool necp_socket_is_allowed_to_send_recv(struct inpcb inp, necp_kernel_policy_id return_policy_id, u_int32_t *return_route_rule_id);
	396	bool necp_socket_is_allowed_to_send_recv_v4(struct inpcb inp, u_int16_t local_port, u_int16_t remote_port, struct in_addr local_addr, struct in_addr remote_addr, ifnet_t interface, necp_kernel_policy_id return_policy_id, u_int32_t *return_route_rule_id);
	397	bool necp_socket_is_allowed_to_send_recv_v6(struct inpcb inp, u_int16_t local_port, u_int16_t remote_port, struct in6_addr local_addr, struct in6_addr remote_addr, ifnet_t interface, necp_kernel_policy_id return_policy_id, u_int32_t *return_route_rule_id);
	398	int necp_mark_packet_from_socket(struct mbuf packet, struct inpcb inp, necp_kernel_policy_id policy_id, u_int32_t route_rule_id);
fe8ab488 A	399	necp_kernel_policy_id necp_get_policy_id_from_packet(struct mbuf *packet);
fe8ab488 A	400	u_int32_t necp_get_last_interface_index_from_packet(struct mbuf *packet);
3e170ce0	401	u_int32_t necp_get_route_rule_id_from_packet(struct mbuf *packet);
fe8ab488 A	402
	403	necp_kernel_policy_id necp_socket_find_policy_match(struct inpcb inp, struct sockaddr override_local_addr, struct sockaddr *override_remote_addr, u_int32_t override_bound_interface);
	404	necp_kernel_policy_id necp_ip_output_find_policy_match(struct mbuf packet, int flags, struct ip_out_args ipoa, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter);
	405	necp_kernel_policy_id necp_ip6_output_find_policy_match(struct mbuf packet, int flags, struct ip6_out_args ip6oa, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter);
	406
	407	int necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id);
	408	int necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface);
	409
	410	ifnet_t necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter);
	411	bool necp_packet_can_rebind_to_ifnet(struct mbuf packet, struct ifnet interface, struct route *new_route, int family);
	412
3e170ce0 A	413	bool necp_packet_is_allowed_over_interface(struct mbuf packet, struct ifnet interface);
3e170ce0 A	414
fe8ab488 A	415	int necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive);
	416	bool necp_get_is_keepalive_from_packet(struct mbuf *packet);
	417
	418	#endif /* BSD_KERNEL_PRIVATE */
	419	#ifndef KERNEL
	420	int necp_match_policy(const uint8_t parameters, size_t parameters_size, struct necp_aggregate_result returned_result);
	421	#endif /* !KERNEL */
	422
	423	#endif