[apple/xnu.git] / bsd / net / necp.h

/*
 * Copyright (c) 2013, 2014 Apple Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 *
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 *
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 *
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */

#ifndef	_NET_NECP_H_
#define	_NET_NECP_H_

#include <netinet/in.h>
#include <sys/socket.h>

/*
 * Name registered by the ipsec kernel control
 */
#define	NECP_CONTROL_NAME "com.apple.net.necp_control"

struct necp_packet_header {
    u_int8_t		packet_type;
	u_int8_t		flags;
    u_int32_t		message_id;
};
#define	NECP_PACKET_TYPE_POLICY_ADD				1
#define	NECP_PACKET_TYPE_POLICY_GET				2
#define	NECP_PACKET_TYPE_POLICY_DELETE			3
#define	NECP_PACKET_TYPE_POLICY_APPLY_ALL		4
#define	NECP_PACKET_TYPE_POLICY_LIST_ALL		5
#define	NECP_PACKET_TYPE_POLICY_DELETE_ALL		6
#define	NECP_PACKET_TYPE_SET_SESSION_PRIORITY	7
#define	NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC	8
#define	NECP_PACKET_TYPE_REGISTER_SERVICE		9
#define	NECP_PACKET_TYPE_UNREGISTER_SERVICE		10

#define	NECP_PACKET_FLAGS_RESPONSE				0x01	// Used for acks, errors, and query responses

#define	NECP_TLV_NIL							0
#define	NECP_TLV_ERROR							1	// u_int32_t
#define	NECP_TLV_POLICY_ORDER					2	// u_int32_t
#define	NECP_TLV_POLICY_CONDITION				3
#define	NECP_TLV_POLICY_RESULT					4
#define	NECP_TLV_POLICY_ID						5	// u_int32_t
#define	NECP_TLV_SESSION_PRIORITY				6	// u_int32_t
#define	NECP_TLV_ATTRIBUTE_DOMAIN				7	// char[]
#define	NECP_TLV_ATTRIBUTE_ACCOUNT				8	// char[]
#define	NECP_TLV_SERVICE_UUID					9	// uuid_t

#define	NECP_POLICY_CONDITION_FLAGS_NEGATIVE	0x01 // Negative

// Conditions
#define	NECP_POLICY_CONDITION_DEFAULT			0	// N/A, not valid with any other conditions
// Socket/Application conditions
#define	NECP_POLICY_CONDITION_APPLICATION		1	// uuid_t, uses effective UUID when possible
#define	NECP_POLICY_CONDITION_REAL_APPLICATION	2	// uuid_t, never uses effective UUID. Only valid with NECP_POLICY_CONDITION_APPLICATION
// Application-only Conditions
#define	NECP_POLICY_CONDITION_DOMAIN			3	// String, such as apple.com
#define	NECP_POLICY_CONDITION_ACCOUNT			4	// String
// Socket/Application condition
#define	NECP_POLICY_CONDITION_ENTITLEMENT		5	// String
#define	NECP_POLICY_CONDITION_PID				6	// pid_t
#define	NECP_POLICY_CONDITION_UID				7	// uid_t
#define	NECP_POLICY_CONDITION_ALL_INTERFACES	8	// N/A
#define	NECP_POLICY_CONDITION_BOUND_INTERFACE	9	// String
#define	NECP_POLICY_CONDITION_TRAFFIC_CLASS		10	// necp_policy_condition_tc_range
// Socket/IP conditions
#define	NECP_POLICY_CONDITION_IP_PROTOCOL		11	// u_int8_t
#define	NECP_POLICY_CONDITION_LOCAL_ADDR		12	// necp_policy_condition_addr
#define	NECP_POLICY_CONDITION_REMOTE_ADDR		13	// necp_policy_condition_addr
#define	NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE	14	// necp_policy_condition_addr_range
#define	NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE	15	// necp_policy_condition_addr_range

// Results
#define	NECP_POLICY_RESULT_PASS					1	// N/A
#define	NECP_POLICY_RESULT_SKIP					2	// u_int32_t, policy order to skip to. 0 to skip all session policies.
#define	NECP_POLICY_RESULT_DROP					3	// N/A
#define	NECP_POLICY_RESULT_SOCKET_DIVERT		4	// u_int32_t, flow divert control unit
#define	NECP_POLICY_RESULT_SOCKET_FILTER		5	// u_int32_t, filter control unit
#define	NECP_POLICY_RESULT_IP_TUNNEL			6	// String, interface name
#define	NECP_POLICY_RESULT_IP_FILTER			7	// ?
#define	NECP_POLICY_RESULT_TRIGGER				8	// service uuid_t
#define	NECP_POLICY_RESULT_TRIGGER_IF_NEEDED	9	// service uuid_t
#define	NECP_POLICY_RESULT_TRIGGER_SCOPED		10	// service uuid_t
#define	NECP_POLICY_RESULT_NO_TRIGGER_SCOPED	11	// service uuid_t
#define	NECP_POLICY_RESULT_SOCKET_SCOPED		12	// String, interface name

#define	NECP_POLICY_RESULT_MAX					NECP_POLICY_RESULT_SOCKET_SCOPED

// Errors
#define	NECP_ERROR_INTERNAL						0
#define	NECP_ERROR_UNKNOWN_PACKET_TYPE			1
#define	NECP_ERROR_INVALID_TLV					2
#define	NECP_ERROR_POLICY_RESULT_INVALID		3
#define	NECP_ERROR_POLICY_CONDITIONS_INVALID	4
#define	NECP_ERROR_POLICY_ID_NOT_FOUND			5
#define	NECP_ERROR_INVALID_PROCESS				6

// Modifiers
#define	NECP_MASK_USERSPACE_ONLY	0x80000000	// on filter_control_unit value

struct necp_policy_condition_tc_range {
	u_int32_t start_tc;
	u_int32_t end_tc;
} __attribute__((__packed__));

struct necp_policy_condition_addr {
	u_int8_t		prefix;
	union {
		struct sockaddr			sa;
		struct sockaddr_in		sin;
		struct sockaddr_in6		sin6;
	} address;
} __attribute__((__packed__));

struct necp_policy_condition_addr_range {
	union {
		struct sockaddr			sa;
		struct sockaddr_in		sin;
		struct sockaddr_in6		sin6;
	} start_address;
	union {
		struct sockaddr			sa;
		struct sockaddr_in		sin;
		struct sockaddr_in6		sin6;
	} end_address;
} __attribute__((__packed__));

#define	NECP_SESSION_PRIORITY_UNKNOWN			0
#define	NECP_SESSION_PRIORITY_CONTROL			1
#define	NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL	2
#define	NECP_SESSION_PRIORITY_HIGH				3
#define	NECP_SESSION_PRIORITY_DEFAULT			4
#define	NECP_SESSION_PRIORITY_LOW				5

#define	NECP_SESSION_NUM_PRIORITIES				NECP_SESSION_PRIORITY_LOW

typedef u_int32_t necp_policy_id;
typedef u_int32_t necp_policy_order;

typedef u_int32_t necp_kernel_policy_result;
typedef u_int32_t necp_kernel_policy_filter;

typedef union {
	u_int						tunnel_interface_index;
	u_int						scoped_interface_index;
	u_int32_t					flow_divert_control_unit;
	u_int32_t					filter_control_unit;
} necp_kernel_policy_routing_result_parameter;

#define	NECP_SERVICE_FLAGS_REGISTERED			0x01
struct necp_aggregate_result {
	necp_kernel_policy_result			routing_result;
	necp_kernel_policy_routing_result_parameter	routing_result_parameter;
	necp_kernel_policy_filter			filter_control_unit;
	necp_kernel_policy_result			service_action;
	uuid_t								service_uuid;
	u_int32_t							service_flags;
	u_int32_t							service_data;
};

#ifdef BSD_KERNEL_PRIVATE
#include <stdbool.h>
#include <sys/socketvar.h>
#include <sys/kern_control.h>
#include <netinet/ip_var.h>
#include <netinet6/ip6_var.h>

#define	NECPCTL_DROP_ALL_LEVEL			1	/* Drop all packets if no policy matches above this level */
#define	NECPCTL_DEBUG					2	/* Log all kernel policy matches */
#define	NECPCTL_PASS_LOOPBACK			3	/* Pass all loopback traffic */
#define	NECPCTL_PASS_KEEPALIVES			4	/* Pass all kernel-generated keepalive traffic */

#define	NECPCTL_NAMES {					\
	{ 0, 0 },							\
	{ "drop_all_level", CTLTYPE_INT },	\
	{ "debug", CTLTYPE_INT },			\
	{ "pass_loopback", CTLTYPE_INT },	\
	{ "pass_keepalives", CTLTYPE_INT },	\
}

typedef u_int32_t necp_kernel_policy_id;
#define	NECP_KERNEL_POLICY_ID_NONE			0
#define	NECP_KERNEL_POLICY_ID_NO_MATCH		1
#define	NECP_KERNEL_POLICY_ID_FIRST_VALID	2

typedef u_int32_t necp_app_id;

#define	NECP_KERNEL_POLICY_RESULT_NONE					0
#define	NECP_KERNEL_POLICY_RESULT_PASS					NECP_POLICY_RESULT_PASS
#define	NECP_KERNEL_POLICY_RESULT_SKIP					NECP_POLICY_RESULT_SKIP
#define	NECP_KERNEL_POLICY_RESULT_DROP					NECP_POLICY_RESULT_DROP
#define	NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT			NECP_POLICY_RESULT_SOCKET_DIVERT
#define	NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER			NECP_POLICY_RESULT_SOCKET_FILTER
#define	NECP_KERNEL_POLICY_RESULT_IP_TUNNEL				NECP_POLICY_RESULT_IP_TUNNEL
#define	NECP_KERNEL_POLICY_RESULT_IP_FILTER				NECP_POLICY_RESULT_IP_FILTER
#define	NECP_KERNEL_POLICY_RESULT_TRIGGER				NECP_POLICY_RESULT_TRIGGER
#define	NECP_KERNEL_POLICY_RESULT_TRIGGER_IF_NEEDED		NECP_POLICY_RESULT_TRIGGER_IF_NEEDED
#define	NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED		NECP_POLICY_RESULT_TRIGGER_SCOPED
#define	NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED		NECP_POLICY_RESULT_NO_TRIGGER_SCOPED
#define	NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED			NECP_POLICY_RESULT_SOCKET_SCOPED

typedef struct {
	u_int32_t identifier;
	u_int32_t data;
} necp_kernel_policy_service;

typedef union {
	u_int						tunnel_interface_index;
	u_int						scoped_interface_index;
	u_int32_t					flow_divert_control_unit;
	u_int32_t					filter_control_unit;
	u_int32_t					skip_policy_order;
	necp_kernel_policy_service	service;
} necp_kernel_policy_result_parameter;

union necp_sockaddr_union {
	struct sockaddr			sa;
	struct sockaddr_in		sin;
	struct sockaddr_in6		sin6;
};

struct necp_kernel_socket_policy {
	LIST_ENTRY(necp_kernel_socket_policy)	chain;
	necp_policy_id				parent_policy_id;
	necp_kernel_policy_id		id;
	necp_policy_order			order;
	u_int32_t					session_order;
	
	u_int32_t					condition_mask;
	u_int32_t					condition_negated_mask;
	necp_kernel_policy_id		cond_policy_id;
	u_int32_t					cond_app_id;					// Locally assigned ID value stored
	u_int32_t					cond_real_app_id;				// Locally assigned ID value stored
	u_int32_t					cond_account_id;				// Locally assigned ID value stored
	char						*cond_domain;					// String
	u_int8_t					cond_domain_dot_count;			// Number of dots in cond_domain
	pid_t						cond_pid;
	uid_t						cond_uid;
	ifnet_t						cond_bound_interface;			// Matches specific binding only
	struct necp_policy_condition_tc_range cond_traffic_class;	// Matches traffic class in range
	u_int16_t					cond_protocol;					// Matches IP protcol number
	union necp_sockaddr_union	cond_local_start;				// Matches local IP address (or start)
	union necp_sockaddr_union	cond_local_end;					// Matches IP address range
	u_int8_t					cond_local_prefix;				// Defines subnet
	union necp_sockaddr_union	cond_remote_start;				// Matches remote IP address (or start)
	union necp_sockaddr_union	cond_remote_end;				// Matches IP address range
	u_int8_t					cond_remote_prefix;				// Defines subnet
	
	necp_kernel_policy_result	result;
	necp_kernel_policy_result_parameter	result_parameter;
};

struct necp_kernel_ip_output_policy {
	LIST_ENTRY(necp_kernel_ip_output_policy)	chain;
	necp_policy_id				parent_policy_id;
	necp_kernel_policy_id		id;
	necp_policy_order			suborder;
	necp_policy_order			order;
	u_int32_t					session_order;
	
	u_int32_t					condition_mask;
	u_int32_t					condition_negated_mask;
	necp_kernel_policy_id		cond_policy_id;
	ifnet_t						cond_bound_interface;			// Matches specific binding only
	u_int16_t					cond_protocol;					// Matches IP protcol number
	union necp_sockaddr_union	cond_local_start;				// Matches local IP address (or start)
	union necp_sockaddr_union	cond_local_end;					// Matches IP address range
	u_int8_t					cond_local_prefix;				// Defines subnet
	union necp_sockaddr_union	cond_remote_start;				// Matches remote IP address (or start)
	union necp_sockaddr_union	cond_remote_end;				// Matches IP address range
	u_int8_t					cond_remote_prefix;				// Defines subnet
	u_int32_t					cond_last_interface_index;
	
	necp_kernel_policy_result	result;
	necp_kernel_policy_result_parameter	result_parameter;
};

#define	MAX_KERNEL_SOCKET_POLICIES			1
#define	MAX_KERNEL_IP_OUTPUT_POLICIES		4
struct necp_session_policy {
	LIST_ENTRY(necp_session_policy) chain;
	bool				applied;			// Applied into the kernel table
	bool				pending_deletion;	// Waiting to be removed from kernel table
	bool				pending_update;		// Policy has been modified since creation/last application
	necp_policy_id		id;
	necp_policy_order	order;
	u_int8_t			*result;
	size_t				result_size;
	u_int8_t			*conditions; // Array of conditions, each with a size_t length at start
	size_t				conditions_size;
	
	uuid_t				applied_app_uuid;
	uuid_t				applied_real_app_uuid;
	char				*applied_domain;
	char				*applied_account;
	
	uuid_t				applied_service_uuid;
	
	necp_kernel_policy_id	kernel_socket_policies[MAX_KERNEL_SOCKET_POLICIES];
	necp_kernel_policy_id	kernel_ip_output_policies[MAX_KERNEL_IP_OUTPUT_POLICIES];
};

struct necp_aggregate_socket_result {
	necp_kernel_policy_result			result;
	necp_kernel_policy_result_parameter	result_parameter;
	necp_kernel_policy_filter			filter_control_unit;
};

struct necp_inpcb_result {
	char								*application_layer_domain;
	u_int32_t							application_layer_account_id;
	necp_kernel_policy_id				policy_id;
	int32_t								policy_gencount;
	u_int32_t							flowhash;
	struct necp_aggregate_socket_result	results;
};

errno_t necp_init(void);

errno_t necp_set_socket_attributes(struct socket *so, struct sockopt *sopt);
errno_t necp_get_socket_attributes(struct socket *so, struct sockopt *sopt);

u_int32_t necp_socket_get_content_filter_control_unit(struct socket *so);

bool necp_socket_should_use_flow_divert(struct inpcb *inp);
u_int32_t necp_socket_get_flow_divert_control_unit(struct inpcb *inp);

bool necp_socket_should_rescope(struct inpcb *inp);
u_int necp_socket_get_rescope_if_index(struct inpcb *inp);

bool necp_socket_is_allowed_to_send_recv(struct inpcb *inp, necp_kernel_policy_id *return_policy_id);
bool necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port, u_int16_t remote_port, struct in_addr *local_addr, struct in_addr *remote_addr, ifnet_t interface, necp_kernel_policy_id *return_policy_id);
bool necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port, u_int16_t remote_port, struct in6_addr *local_addr, struct in6_addr *remote_addr, ifnet_t interface, necp_kernel_policy_id *return_policy_id);
int necp_mark_packet_from_socket(struct mbuf *packet, struct inpcb *inp, necp_kernel_policy_id policy_id);
necp_kernel_policy_id necp_get_policy_id_from_packet(struct mbuf *packet);
u_int32_t necp_get_last_interface_index_from_packet(struct mbuf *packet);

necp_kernel_policy_id necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local_addr, struct sockaddr *override_remote_addr, u_int32_t override_bound_interface);
necp_kernel_policy_id necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_args *ipoa, necp_kernel_policy_result *result, necp_kernel_policy_result_parameter *result_parameter);
necp_kernel_policy_id necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out_args *ip6oa, necp_kernel_policy_result *result, necp_kernel_policy_result_parameter *result_parameter);

int necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id);
int necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface);

ifnet_t necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter);
bool necp_packet_can_rebind_to_ifnet(struct mbuf *packet, struct ifnet *interface, struct route *new_route, int family);

int necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive);
bool necp_get_is_keepalive_from_packet(struct mbuf *packet);

#endif /* BSD_KERNEL_PRIVATE */
#ifndef KERNEL
int necp_match_policy(const uint8_t *parameters, size_t parameters_size, struct necp_aggregate_result *returned_result);
#endif /* !KERNEL */

#endif
Commit	Line	Data
fe8ab488 A	1	/*
	2	* Copyright (c) 2013, 2014 Apple Inc. All rights reserved.
	3	*
	4	* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
	5	*
	6	* This file contains Original Code and/or Modifications of Original Code
	7	* as defined in and that are subject to the Apple Public Source License
	8	* Version 2.0 (the 'License'). You may not use this file except in
	9	* compliance with the License. The rights granted to you under the License
	10	* may not be used to create, or enable the creation or redistribution of,
	11	* unlawful or unlicensed copies of an Apple operating system, or to
	12	* circumvent, violate, or enable the circumvention or violation of, any
	13	* terms of an Apple operating system software license agreement.
	14	*
	15	* Please obtain a copy of the License at
	16	* http://www.opensource.apple.com/apsl/ and read it before using this file.
	17	*
	18	* The Original Code and all software distributed under the License are
	19	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
	20	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
	21	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
	22	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
	23	* Please see the License for the specific language governing rights and
	24	* limitations under the License.
	25	*
	26	* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
	27	*/
	28
	29	#ifndef _NET_NECP_H_
	30	#define _NET_NECP_H_
	31
	32	#include <netinet/in.h>
	33	#include <sys/socket.h>
	34
	35	/*
	36	* Name registered by the ipsec kernel control
	37	*/
	38	#define NECP_CONTROL_NAME "com.apple.net.necp_control"
	39
	40	struct necp_packet_header {
	41	u_int8_t packet_type;
	42	u_int8_t flags;
	43	u_int32_t message_id;
	44	};
	45	#define NECP_PACKET_TYPE_POLICY_ADD 1
	46	#define NECP_PACKET_TYPE_POLICY_GET 2
	47	#define NECP_PACKET_TYPE_POLICY_DELETE 3
	48	#define NECP_PACKET_TYPE_POLICY_APPLY_ALL 4
	49	#define NECP_PACKET_TYPE_POLICY_LIST_ALL 5
	50	#define NECP_PACKET_TYPE_POLICY_DELETE_ALL 6
	51	#define NECP_PACKET_TYPE_SET_SESSION_PRIORITY 7
	52	#define NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC 8
	53	#define NECP_PACKET_TYPE_REGISTER_SERVICE 9
	54	#define NECP_PACKET_TYPE_UNREGISTER_SERVICE 10
	55
	56	#define NECP_PACKET_FLAGS_RESPONSE 0x01 // Used for acks, errors, and query responses
	57
	58	#define NECP_TLV_NIL 0
	59	#define NECP_TLV_ERROR 1 // u_int32_t
	60	#define NECP_TLV_POLICY_ORDER 2 // u_int32_t
	61	#define NECP_TLV_POLICY_CONDITION 3
	62	#define NECP_TLV_POLICY_RESULT 4
	63	#define NECP_TLV_POLICY_ID 5 // u_int32_t
	64	#define NECP_TLV_SESSION_PRIORITY 6 // u_int32_t
65	#define NECP_TLV_ATTRIBUTE_DOMAIN 7 // char[]
66	#define NECP_TLV_ATTRIBUTE_ACCOUNT 8 // char[]
67	#define NECP_TLV_SERVICE_UUID 9 // uuid_t
68
69	#define NECP_POLICY_CONDITION_FLAGS_NEGATIVE 0x01 // Negative
70
71	// Conditions
72	#define NECP_POLICY_CONDITION_DEFAULT 0 // N/A, not valid with any other conditions
73	// Socket/Application conditions
74	#define NECP_POLICY_CONDITION_APPLICATION 1 // uuid_t, uses effective UUID when possible
75	#define NECP_POLICY_CONDITION_REAL_APPLICATION 2 // uuid_t, never uses effective UUID. Only valid with NECP_POLICY_CONDITION_APPLICATION
76	// Application-only Conditions
77	#define NECP_POLICY_CONDITION_DOMAIN 3 // String, such as apple.com
78	#define NECP_POLICY_CONDITION_ACCOUNT 4 // String
79	// Socket/Application condition
80	#define NECP_POLICY_CONDITION_ENTITLEMENT 5 // String
81	#define NECP_POLICY_CONDITION_PID 6 // pid_t
82	#define NECP_POLICY_CONDITION_UID 7 // uid_t
83	#define NECP_POLICY_CONDITION_ALL_INTERFACES 8 // N/A
84	#define NECP_POLICY_CONDITION_BOUND_INTERFACE 9 // String
85	#define NECP_POLICY_CONDITION_TRAFFIC_CLASS 10 // necp_policy_condition_tc_range
86	// Socket/IP conditions
87	#define NECP_POLICY_CONDITION_IP_PROTOCOL 11 // u_int8_t
88	#define NECP_POLICY_CONDITION_LOCAL_ADDR 12 // necp_policy_condition_addr
89	#define NECP_POLICY_CONDITION_REMOTE_ADDR 13 // necp_policy_condition_addr
90	#define NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE 14 // necp_policy_condition_addr_range
91	#define NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE 15 // necp_policy_condition_addr_range
92
93	// Results
94	#define NECP_POLICY_RESULT_PASS 1 // N/A
95	#define NECP_POLICY_RESULT_SKIP 2 // u_int32_t, policy order to skip to. 0 to skip all session policies.
96	#define NECP_POLICY_RESULT_DROP 3 // N/A
97	#define NECP_POLICY_RESULT_SOCKET_DIVERT 4 // u_int32_t, flow divert control unit
98	#define NECP_POLICY_RESULT_SOCKET_FILTER 5 // u_int32_t, filter control unit
99	#define NECP_POLICY_RESULT_IP_TUNNEL 6 // String, interface name
100	#define NECP_POLICY_RESULT_IP_FILTER 7 // ?
101	#define NECP_POLICY_RESULT_TRIGGER 8 // service uuid_t
102	#define NECP_POLICY_RESULT_TRIGGER_IF_NEEDED 9 // service uuid_t
103	#define NECP_POLICY_RESULT_TRIGGER_SCOPED 10 // service uuid_t
104	#define NECP_POLICY_RESULT_NO_TRIGGER_SCOPED 11 // service uuid_t
105	#define NECP_POLICY_RESULT_SOCKET_SCOPED 12 // String, interface name
106
107	#define NECP_POLICY_RESULT_MAX NECP_POLICY_RESULT_SOCKET_SCOPED
108
109	// Errors
110	#define NECP_ERROR_INTERNAL 0
111	#define NECP_ERROR_UNKNOWN_PACKET_TYPE 1
112	#define NECP_ERROR_INVALID_TLV 2
113	#define NECP_ERROR_POLICY_RESULT_INVALID 3
114	#define NECP_ERROR_POLICY_CONDITIONS_INVALID 4
115	#define NECP_ERROR_POLICY_ID_NOT_FOUND 5
116	#define NECP_ERROR_INVALID_PROCESS 6
117
118	// Modifiers
119	#define NECP_MASK_USERSPACE_ONLY 0x80000000 // on filter_control_unit value
120
121	struct necp_policy_condition_tc_range {
122	u_int32_t start_tc;
123	u_int32_t end_tc;
124	} __attribute__((__packed__));
125
126	struct necp_policy_condition_addr {
127	u_int8_t prefix;
128	union {
129	struct sockaddr sa;
130	struct sockaddr_in sin;
131	struct sockaddr_in6 sin6;
132	} address;
133	} __attribute__((__packed__));
134
135	struct necp_policy_condition_addr_range {
136	union {
137	struct sockaddr sa;
138	struct sockaddr_in sin;
139	struct sockaddr_in6 sin6;
140	} start_address;
141	union {
142	struct sockaddr sa;
143	struct sockaddr_in sin;
144	struct sockaddr_in6 sin6;
145	} end_address;
146	} __attribute__((__packed__));
147
148	#define NECP_SESSION_PRIORITY_UNKNOWN 0
149	#define NECP_SESSION_PRIORITY_CONTROL 1
150	#define NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL 2
151	#define NECP_SESSION_PRIORITY_HIGH 3
152	#define NECP_SESSION_PRIORITY_DEFAULT 4
153	#define NECP_SESSION_PRIORITY_LOW 5
154
155	#define NECP_SESSION_NUM_PRIORITIES NECP_SESSION_PRIORITY_LOW
156
157	typedef u_int32_t necp_policy_id;
158	typedef u_int32_t necp_policy_order;
159
160	typedef u_int32_t necp_kernel_policy_result;
161	typedef u_int32_t necp_kernel_policy_filter;
162
163	typedef union {
164	u_int tunnel_interface_index;
165	u_int scoped_interface_index;
166	u_int32_t flow_divert_control_unit;
167	u_int32_t filter_control_unit;
168	} necp_kernel_policy_routing_result_parameter;
169
170	#define NECP_SERVICE_FLAGS_REGISTERED 0x01
171	struct necp_aggregate_result {
172	necp_kernel_policy_result routing_result;
173	necp_kernel_policy_routing_result_parameter routing_result_parameter;
174	necp_kernel_policy_filter filter_control_unit;
175	necp_kernel_policy_result service_action;
176	uuid_t service_uuid;
177	u_int32_t service_flags;
178	u_int32_t service_data;
179	};
180
181	#ifdef BSD_KERNEL_PRIVATE
182	#include <stdbool.h>
183	#include <sys/socketvar.h>
184	#include <sys/kern_control.h>
185	#include <netinet/ip_var.h>
186	#include <netinet6/ip6_var.h>
187
188	#define NECPCTL_DROP_ALL_LEVEL 1 /* Drop all packets if no policy matches above this level */
189	#define NECPCTL_DEBUG 2 /* Log all kernel policy matches */
190	#define NECPCTL_PASS_LOOPBACK 3 /* Pass all loopback traffic */
191	#define NECPCTL_PASS_KEEPALIVES 4 /* Pass all kernel-generated keepalive traffic */
192
193	#define NECPCTL_NAMES { \
194	{ 0, 0 }, \
195	{ "drop_all_level", CTLTYPE_INT }, \
196	{ "debug", CTLTYPE_INT }, \
197	{ "pass_loopback", CTLTYPE_INT }, \
198	{ "pass_keepalives", CTLTYPE_INT }, \
199	}
200
201	typedef u_int32_t necp_kernel_policy_id;
202	#define NECP_KERNEL_POLICY_ID_NONE 0
203	#define NECP_KERNEL_POLICY_ID_NO_MATCH 1
204	#define NECP_KERNEL_POLICY_ID_FIRST_VALID 2
205
206	typedef u_int32_t necp_app_id;
207
208	#define NECP_KERNEL_POLICY_RESULT_NONE 0
209	#define NECP_KERNEL_POLICY_RESULT_PASS NECP_POLICY_RESULT_PASS
210	#define NECP_KERNEL_POLICY_RESULT_SKIP NECP_POLICY_RESULT_SKIP
211	#define NECP_KERNEL_POLICY_RESULT_DROP NECP_POLICY_RESULT_DROP
212	#define NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT NECP_POLICY_RESULT_SOCKET_DIVERT
213	#define NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER NECP_POLICY_RESULT_SOCKET_FILTER
214	#define NECP_KERNEL_POLICY_RESULT_IP_TUNNEL NECP_POLICY_RESULT_IP_TUNNEL
215	#define NECP_KERNEL_POLICY_RESULT_IP_FILTER NECP_POLICY_RESULT_IP_FILTER
216	#define NECP_KERNEL_POLICY_RESULT_TRIGGER NECP_POLICY_RESULT_TRIGGER
217	#define NECP_KERNEL_POLICY_RESULT_TRIGGER_IF_NEEDED NECP_POLICY_RESULT_TRIGGER_IF_NEEDED
218	#define NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED NECP_POLICY_RESULT_TRIGGER_SCOPED
219	#define NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED NECP_POLICY_RESULT_NO_TRIGGER_SCOPED
220	#define NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED NECP_POLICY_RESULT_SOCKET_SCOPED
221
222	typedef struct {
223	u_int32_t identifier;
224	u_int32_t data;
225	} necp_kernel_policy_service;
226
227	typedef union {
228	u_int tunnel_interface_index;
229	u_int scoped_interface_index;
230	u_int32_t flow_divert_control_unit;
231	u_int32_t filter_control_unit;
232	u_int32_t skip_policy_order;
233	necp_kernel_policy_service service;
234	} necp_kernel_policy_result_parameter;
235
236	union necp_sockaddr_union {
237	struct sockaddr sa;
238	struct sockaddr_in sin;
239	struct sockaddr_in6 sin6;
240	};
241
242	struct necp_kernel_socket_policy {
243	LIST_ENTRY(necp_kernel_socket_policy) chain;
244	necp_policy_id parent_policy_id;
245	necp_kernel_policy_id id;
246	necp_policy_order order;
247	u_int32_t session_order;
248
249	u_int32_t condition_mask;
250	u_int32_t condition_negated_mask;
251	necp_kernel_policy_id cond_policy_id;
252	u_int32_t cond_app_id; // Locally assigned ID value stored
253	u_int32_t cond_real_app_id; // Locally assigned ID value stored
254	u_int32_t cond_account_id; // Locally assigned ID value stored
255	char *cond_domain; // String
256	u_int8_t cond_domain_dot_count; // Number of dots in cond_domain
257	pid_t cond_pid;
258	uid_t cond_uid;
259	ifnet_t cond_bound_interface; // Matches specific binding only
260	struct necp_policy_condition_tc_range cond_traffic_class; // Matches traffic class in range
261	u_int16_t cond_protocol; // Matches IP protcol number
262	union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
263	union necp_sockaddr_union cond_local_end; // Matches IP address range
264	u_int8_t cond_local_prefix; // Defines subnet
265	union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
266	union necp_sockaddr_union cond_remote_end; // Matches IP address range
267	u_int8_t cond_remote_prefix; // Defines subnet
268
269	necp_kernel_policy_result result;
270	necp_kernel_policy_result_parameter result_parameter;
271	};
272
273	struct necp_kernel_ip_output_policy {
274	LIST_ENTRY(necp_kernel_ip_output_policy) chain;
275	necp_policy_id parent_policy_id;
276	necp_kernel_policy_id id;
277	necp_policy_order suborder;
278	necp_policy_order order;
279	u_int32_t session_order;
280
281	u_int32_t condition_mask;
282	u_int32_t condition_negated_mask;
283	necp_kernel_policy_id cond_policy_id;
284	ifnet_t cond_bound_interface; // Matches specific binding only
285	u_int16_t cond_protocol; // Matches IP protcol number
286	union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
287	union necp_sockaddr_union cond_local_end; // Matches IP address range
288	u_int8_t cond_local_prefix; // Defines subnet
289	union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
290	union necp_sockaddr_union cond_remote_end; // Matches IP address range
291	u_int8_t cond_remote_prefix; // Defines subnet
292	u_int32_t cond_last_interface_index;
293
294	necp_kernel_policy_result result;
295	necp_kernel_policy_result_parameter result_parameter;
296	};
297
298	#define MAX_KERNEL_SOCKET_POLICIES 1
299	#define MAX_KERNEL_IP_OUTPUT_POLICIES 4
300	struct necp_session_policy {
301	LIST_ENTRY(necp_session_policy) chain;
302	bool applied; // Applied into the kernel table
303	bool pending_deletion; // Waiting to be removed from kernel table
304	bool pending_update; // Policy has been modified since creation/last application
305	necp_policy_id id;
306	necp_policy_order order;
307	u_int8_t *result;
308	size_t result_size;
309	u_int8_t *conditions; // Array of conditions, each with a size_t length at start
310	size_t conditions_size;
311
312	uuid_t applied_app_uuid;
313	uuid_t applied_real_app_uuid;
314	char *applied_domain;
315	char *applied_account;
316
317	uuid_t applied_service_uuid;
318
319	necp_kernel_policy_id kernel_socket_policies[MAX_KERNEL_SOCKET_POLICIES];
320	necp_kernel_policy_id kernel_ip_output_policies[MAX_KERNEL_IP_OUTPUT_POLICIES];
321	};
322
323	struct necp_aggregate_socket_result {
324	necp_kernel_policy_result result;
325	necp_kernel_policy_result_parameter result_parameter;
326	necp_kernel_policy_filter filter_control_unit;
327	};
328
329	struct necp_inpcb_result {
330	char *application_layer_domain;
331	u_int32_t application_layer_account_id;
332	necp_kernel_policy_id policy_id;
333	int32_t policy_gencount;
334	u_int32_t flowhash;
335	struct necp_aggregate_socket_result results;
336	};
337
338	errno_t necp_init(void);
339
340	errno_t necp_set_socket_attributes(struct socket so, struct sockopt sopt);
341	errno_t necp_get_socket_attributes(struct socket so, struct sockopt sopt);
342
343	u_int32_t necp_socket_get_content_filter_control_unit(struct socket *so);
344
345	bool necp_socket_should_use_flow_divert(struct inpcb *inp);
346	u_int32_t necp_socket_get_flow_divert_control_unit(struct inpcb *inp);
347
348	bool necp_socket_should_rescope(struct inpcb *inp);
349	u_int necp_socket_get_rescope_if_index(struct inpcb *inp);
350
351	bool necp_socket_is_allowed_to_send_recv(struct inpcb inp, necp_kernel_policy_id return_policy_id);
352	bool necp_socket_is_allowed_to_send_recv_v4(struct inpcb inp, u_int16_t local_port, u_int16_t remote_port, struct in_addr local_addr, struct in_addr remote_addr, ifnet_t interface, necp_kernel_policy_id return_policy_id);
353	bool necp_socket_is_allowed_to_send_recv_v6(struct inpcb inp, u_int16_t local_port, u_int16_t remote_port, struct in6_addr local_addr, struct in6_addr remote_addr, ifnet_t interface, necp_kernel_policy_id return_policy_id);
354	int necp_mark_packet_from_socket(struct mbuf packet, struct inpcb inp, necp_kernel_policy_id policy_id);
355	necp_kernel_policy_id necp_get_policy_id_from_packet(struct mbuf *packet);
356	u_int32_t necp_get_last_interface_index_from_packet(struct mbuf *packet);
357
358	necp_kernel_policy_id necp_socket_find_policy_match(struct inpcb inp, struct sockaddr override_local_addr, struct sockaddr *override_remote_addr, u_int32_t override_bound_interface);
359	necp_kernel_policy_id necp_ip_output_find_policy_match(struct mbuf packet, int flags, struct ip_out_args ipoa, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter);
360	necp_kernel_policy_id necp_ip6_output_find_policy_match(struct mbuf packet, int flags, struct ip6_out_args ip6oa, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter);
361
362	int necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id);
363	int necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface);
364
365	ifnet_t necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter);
366	bool necp_packet_can_rebind_to_ifnet(struct mbuf packet, struct ifnet interface, struct route *new_route, int family);
367
368	int necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive);
369	bool necp_get_is_keepalive_from_packet(struct mbuf *packet);
370
371	#endif /* BSD_KERNEL_PRIVATE */
372	#ifndef KERNEL
373	int necp_match_policy(const uint8_t parameters, size_t parameters_size, struct necp_aggregate_result returned_result);
374	#endif /* !KERNEL */
375
376	#endif