]> git.saurik.com Git - apple/xnu.git/blob - bsd/net/necp.h
projects / apple / xnu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
xnu-3789.70.16.tar.gz
[apple/xnu.git] / bsd / net / necp.h
1 /*
2 * Copyright (c) 2013-2016 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #ifndef _NET_NECP_H_
30 #define _NET_NECP_H_
31
32 #include <net/net_kev.h>
33 #ifdef PRIVATE
34
35 #include <netinet/in.h>
36 #include <sys/socket.h>
37 #include <net/if.h>
38
39 /*
40 * Name registered by the ipsec kernel control
41 */
42 #define NECP_CONTROL_NAME "com.apple.net.necp_control"
43
44 #define NECP_TLV_LENGTH_UINT32 1
45
46 struct necp_packet_header {
47 u_int8_t packet_type;
48 u_int8_t flags;
49 u_int32_t message_id;
50 };
51
52 /*
53 * Control message commands
54 */
55 #define NECP_PACKET_TYPE_POLICY_ADD 1
56 #define NECP_PACKET_TYPE_POLICY_GET 2
57 #define NECP_PACKET_TYPE_POLICY_DELETE 3
58 #define NECP_PACKET_TYPE_POLICY_APPLY_ALL 4
59 #define NECP_PACKET_TYPE_POLICY_LIST_ALL 5
60 #define NECP_PACKET_TYPE_POLICY_DELETE_ALL 6
61 #define NECP_PACKET_TYPE_SET_SESSION_PRIORITY 7
62 #define NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC 8
63 #define NECP_PACKET_TYPE_REGISTER_SERVICE 9
64 #define NECP_PACKET_TYPE_UNREGISTER_SERVICE 10
65 #define NECP_PACKET_TYPE_POLICY_DUMP_ALL 11
66
67 /*
68 * Control message flags
69 */
70 #define NECP_PACKET_FLAGS_RESPONSE 0x01 // Used for acks, errors, and query responses
71
72 /*
73 * Control message TLV types
74 */
75 #define NECP_TLV_NIL 0
76 #define NECP_TLV_ERROR 1 // u_int32_t
77 #define NECP_TLV_POLICY_ORDER 2 // u_int32_t
78 #define NECP_TLV_POLICY_CONDITION 3
79 #define NECP_TLV_POLICY_RESULT 4
80 #define NECP_TLV_POLICY_ID 5 // u_int32_t
81 #define NECP_TLV_SESSION_PRIORITY 6 // u_int32_t
82 #define NECP_TLV_ATTRIBUTE_DOMAIN 7 // char[]
83 #define NECP_TLV_ATTRIBUTE_ACCOUNT 8 // char[]
84 #define NECP_TLV_SERVICE_UUID 9 // uuid_t
85 #define NECP_TLV_ROUTE_RULE 10
86
87 /*
88 * Control message TLV sent only by the kernel to userspace
89 */
90 #define NECP_TLV_POLICY_OWNER 100 // char []
91 #define NECP_TLV_POLICY_DUMP 101
92 #define NECP_TLV_POLICY_RESULT_STRING 102 // char []
93 #define NECP_TLV_POLICY_SESSION_ORDER 103 // u_int32_t
94
95 /*
96 * Condition flags
97 */
98 #define NECP_POLICY_CONDITION_FLAGS_NEGATIVE 0x01 // Negative
99
100 /*
101 * Conditions
102 * Used for setting policies as well as passing parameters to necp_match_policy.
103 */
104 #define NECP_POLICY_CONDITION_DEFAULT 0 // N/A, not valid with any other conditions
105 // Socket/Application conditions
106 #define NECP_POLICY_CONDITION_APPLICATION 1 // uuid_t, uses effective UUID when possible
107 #define NECP_POLICY_CONDITION_REAL_APPLICATION 2 // uuid_t, never uses effective UUID. Only valid with NECP_POLICY_CONDITION_APPLICATION
108 #define NECP_POLICY_CONDITION_DOMAIN 3 // String, such as apple.com
109 #define NECP_POLICY_CONDITION_ACCOUNT 4 // String
110 #define NECP_POLICY_CONDITION_ENTITLEMENT 5 // String
111 #define NECP_POLICY_CONDITION_PID 6 // pid_t
112 #define NECP_POLICY_CONDITION_UID 7 // uid_t
113 #define NECP_POLICY_CONDITION_ALL_INTERFACES 8 // N/A
114 #define NECP_POLICY_CONDITION_BOUND_INTERFACE 9 // String
115 #define NECP_POLICY_CONDITION_TRAFFIC_CLASS 10 // necp_policy_condition_tc_range
116 // Socket/IP conditions
117 #define NECP_POLICY_CONDITION_IP_PROTOCOL 11 // u_int8_t
118 #define NECP_POLICY_CONDITION_LOCAL_ADDR 12 // necp_policy_condition_addr
119 #define NECP_POLICY_CONDITION_REMOTE_ADDR 13 // necp_policy_condition_addr
120 #define NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE 14 // necp_policy_condition_addr_range
121 #define NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE 15 // necp_policy_condition_addr_range
122
123 /*
124 * Results
125 */
126 #define NECP_POLICY_RESULT_PASS 1 // N/A
127 #define NECP_POLICY_RESULT_SKIP 2 // u_int32_t, policy order to skip to. 0 to skip all session policies.
128 #define NECP_POLICY_RESULT_DROP 3 // N/A
129 #define NECP_POLICY_RESULT_SOCKET_DIVERT 4 // u_int32_t, flow divert control unit
130 #define NECP_POLICY_RESULT_SOCKET_FILTER 5 // u_int32_t, filter control unit
131 #define NECP_POLICY_RESULT_IP_TUNNEL 6 // String, interface name
132 #define NECP_POLICY_RESULT_IP_FILTER 7 // ?
133 #define NECP_POLICY_RESULT_TRIGGER 8 // service uuid_t
134 #define NECP_POLICY_RESULT_TRIGGER_IF_NEEDED 9 // service uuid_t
135 #define NECP_POLICY_RESULT_TRIGGER_SCOPED 10 // service uuid_t
136 #define NECP_POLICY_RESULT_NO_TRIGGER_SCOPED 11 // service uuid_t
137 #define NECP_POLICY_RESULT_SOCKET_SCOPED 12 // String, interface name
138 #define NECP_POLICY_RESULT_ROUTE_RULES 13 // N/A, must have route rules defined
139 #define NECP_POLICY_RESULT_USE_NETAGENT 14 // netagent uuid_t
140
141 #define NECP_POLICY_RESULT_MAX NECP_POLICY_RESULT_USE_NETAGENT
142
143 /*
144 * Route Rules
145 * Detailed parameters for NECP_POLICY_RESULT_ROUTE_RULES.
146 */
147 #define NECP_ROUTE_RULE_NONE 0 // N/A
148 #define NECP_ROUTE_RULE_DENY_INTERFACE 1 // String, or empty to match all
149 #define NECP_ROUTE_RULE_ALLOW_INTERFACE 2 // String, or empty to match all
150 #define NECP_ROUTE_RULE_QOS_MARKING 3 // String, or empty to match all
151
152 #define NECP_ROUTE_RULE_FLAG_CELLULAR 0x01
153 #define NECP_ROUTE_RULE_FLAG_WIFI 0x02
154 #define NECP_ROUTE_RULE_FLAG_WIRED 0x04
155 #define NECP_ROUTE_RULE_FLAG_EXPENSIVE 0x08
156
157 /*
158 * Error types
159 */
160 #define NECP_ERROR_INTERNAL 0
161 #define NECP_ERROR_UNKNOWN_PACKET_TYPE 1
162 #define NECP_ERROR_INVALID_TLV 2
163 #define NECP_ERROR_POLICY_RESULT_INVALID 3
164 #define NECP_ERROR_POLICY_CONDITIONS_INVALID 4
165 #define NECP_ERROR_POLICY_ID_NOT_FOUND 5
166 #define NECP_ERROR_INVALID_PROCESS 6
167 #define NECP_ERROR_ROUTE_RULES_INVALID 7
168
169 // Modifiers
170 #define NECP_MASK_USERSPACE_ONLY 0x80000000 // on filter_control_unit value
171
172 struct necp_policy_condition_tc_range {
173 u_int32_t start_tc;
174 u_int32_t end_tc;
175 } __attribute__((__packed__));
176
177 struct necp_policy_condition_addr {
178 u_int8_t prefix;
179 union {
180 struct sockaddr sa;
181 struct sockaddr_in sin;
182 struct sockaddr_in6 sin6;
183 } address;
184 } __attribute__((__packed__));
185
186 struct necp_policy_condition_addr_range {
187 union {
188 struct sockaddr sa;
189 struct sockaddr_in sin;
190 struct sockaddr_in6 sin6;
191 } start_address;
192 union {
193 struct sockaddr sa;
194 struct sockaddr_in sin;
195 struct sockaddr_in6 sin6;
196 } end_address;
197 } __attribute__((__packed__));
198
199 #define NECP_SESSION_PRIORITY_UNKNOWN 0
200 #define NECP_SESSION_PRIORITY_CONTROL 1
201 #define NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL 2
202 #define NECP_SESSION_PRIORITY_HIGH 3
203 #define NECP_SESSION_PRIORITY_DEFAULT 4
204 #define NECP_SESSION_PRIORITY_LOW 5
205
206 #define NECP_SESSION_NUM_PRIORITIES NECP_SESSION_PRIORITY_LOW
207
208 typedef u_int32_t necp_policy_id;
209 typedef u_int32_t necp_policy_order;
210
211 typedef u_int32_t necp_kernel_policy_result;
212 typedef u_int32_t necp_kernel_policy_filter;
213
214 typedef union {
215 u_int tunnel_interface_index;
216 u_int scoped_interface_index;
217 u_int32_t flow_divert_control_unit;
218 u_int32_t filter_control_unit;
219 } necp_kernel_policy_routing_result_parameter;
220
221 #define NECP_SERVICE_FLAGS_REGISTERED 0x01
222 #define NECP_MAX_NETAGENTS 8
223 struct necp_aggregate_result {
224 necp_kernel_policy_result routing_result;
225 necp_kernel_policy_routing_result_parameter routing_result_parameter;
226 necp_kernel_policy_filter filter_control_unit;
227 necp_kernel_policy_result service_action;
228 uuid_t service_uuid;
229 u_int32_t service_flags;
230 u_int32_t service_data;
231 u_int routed_interface_index;
232 u_int32_t policy_id;
233 uuid_t netagents[NECP_MAX_NETAGENTS];
234 u_int32_t netagent_flags[NECP_MAX_NETAGENTS];
235 };
236
237 /*
238 * Statistics. It would be nice if the definitions in ntstat.h could be used,
239 * but they get entangled with #defines for v4 etc in pfvar.h and it may be better practice
240 * to have separate definitions here.
241 */
242 typedef struct necp_stat_counts
243 {
244 /* Counters */
245 u_int64_t necp_stat_rxpackets __attribute__((aligned(8)));
246 u_int64_t necp_stat_rxbytes __attribute__((aligned(8)));
247 u_int64_t necp_stat_txpackets __attribute__((aligned(8)));
248 u_int64_t necp_stat_txbytes __attribute__((aligned(8)));
249
250 u_int32_t necp_stat_rxduplicatebytes;
251 u_int32_t necp_stat_rxoutoforderbytes;
252 u_int32_t necp_stat_txretransmit;
253
254 u_int32_t necp_stat_connectattempts;
255 u_int32_t necp_stat_connectsuccesses;
256
257 u_int32_t necp_stat_min_rtt;
258 u_int32_t necp_stat_avg_rtt;
259 u_int32_t necp_stat_var_rtt;
260
261 u_int64_t necp_stat_cell_rxbytes __attribute__((aligned(8)));
262 u_int64_t necp_stat_cell_txbytes __attribute__((aligned(8)));
263 u_int64_t necp_stat_wifi_rxbytes __attribute__((aligned(8)));
264 u_int64_t necp_stat_wifi_txbytes __attribute__((aligned(8)));
265 u_int64_t necp_stat_wired_rxbytes __attribute__((aligned(8)));
266 u_int64_t necp_stat_wired_txbytes __attribute__((aligned(8)));
267 } necp_stat_counts;
268
269 // Note, some metadata is implicit in the necp client itself:
270 // From the process itself : pid, upid, uuid, proc name.
271 // From the necp client parameters: local and remote addresses, euuid, traffic class, ifindex
272 //
273 // The following may well be supplied via future necp client parameters,
274 // but they are here so they don't get forgotten.
275 typedef struct necp_basic_metadata
276 {
277 u_int32_t rcvbufsize;
278 u_int32_t rcvbufused;
279
280 u_int64_t eupid; // Not currently used by NetworkStatistics, could skip.
281 u_int32_t epid;
282
283 uuid_t vuuid; // Effective UUID as given from voucher
284 uint16_t ifnet_properties;
285 } necp_basic_metadata;
286
287 struct necp_tcp_probe_status {
288 unsigned int probe_activated : 1;
289 unsigned int write_probe_failed : 1;
290 unsigned int read_probe_failed : 1;
291 unsigned int conn_probe_failed : 1;
292 };
293
294 typedef struct necp_extra_tcp_metadata
295 {
296 struct necp_tcp_probe_status probestatus;
297
298 u_int32_t sndbufsize;
299 u_int32_t sndbufused;
300 u_int32_t txunacked;
301 u_int32_t txwindow;
302 u_int32_t txcwindow;
303 u_int32_t traffic_mgt_flags;
304 u_int32_t cc_alg_index;
305 u_int32_t state;
306 } necp_extra_tcp_metadata;
307
308 typedef struct necp_stats_hdr {
309 u_int32_t necp_stats_type __attribute__((aligned(8)));
310 u_int32_t necp_stats_ver;
311 u_int64_t necp_stats_event;
312 } necp_stats_hdr;
313
314 #define NECP_CLIENT_STATISTICS_TYPE_TCP 1 // Identifies use of necp_tcp_stats
315 #define NECP_CLIENT_STATISTICS_TYPE_UDP 2 // Identifies use of necp_udp_stats
316 #define NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1 1 // Currently supported version for TCP
317 #define NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1 1 // Currently supported version for UDP
318
319 typedef struct necp_tcp_stats {
320 necp_stats_hdr necp_tcp_hdr;
321 necp_stat_counts necp_tcp_counts;
322 necp_basic_metadata necp_tcp_basic;
323 necp_extra_tcp_metadata necp_tcp_extra;
324 } necp_tcp_stats;
325
326 typedef struct necp_udp_stats {
327 necp_stats_hdr necp_udp_hdr;
328 necp_stat_counts necp_udp_counts;
329 necp_basic_metadata necp_udp_basic;
330 } necp_udp_stats;
331
332 typedef struct necp_all_stats {
333 union {
334 necp_tcp_stats tcp_stats;
335 necp_udp_stats udp_stats;
336 } all_stats_u;
337 } necp_all_stats;
338
339 /*
340 * NECP Client definitions
341 */
342 #define NECP_MAX_CLIENT_PARAMETERS_SIZE 1024
343 #define NECP_MAX_CLIENT_RESULT_SIZE 512
344
345 #define NECP_OPEN_FLAG_OBSERVER 0x01 // Observers can query clients they don't own
346
347 #define NECP_CLIENT_ACTION_ADD 1 // Register a new client. Input: parameters in buffer; Output: client_id
348 #define NECP_CLIENT_ACTION_REMOVE 2 // Unregister a client. Input: client_id
349 #define NECP_CLIENT_ACTION_COPY_PARAMETERS 3 // Copy client parameters. Input: client_id; Output: parameters in buffer
350 #define NECP_CLIENT_ACTION_COPY_RESULT 4 // Copy client result. Input: client_id; Output: result in buffer
351 #define NECP_CLIENT_ACTION_COPY_LIST 5 // Copy all client IDs. Output: struct necp_client_list in buffer
352 #define NECP_CLIENT_ACTION_REQUEST_NEXUS_INSTANCE 6 // Request a nexus instance from a nexus provider
353 #define NECP_CLIENT_ACTION_AGENT 7 // Interact with agent. Input: client_id, agent parameters
354 #define NECP_CLIENT_ACTION_COPY_AGENT 8 // Copy agent content. Input: agent UUID; Output: struct netagent
355 #define NECP_CLIENT_ACTION_COPY_INTERFACE 9 // Copy interface details. Input: ifindex cast to UUID; Output: struct necp_interface_details
356 #define NECP_CLIENT_ACTION_SET_STATISTICS 10 // Start/update/complete per-flow statistics. Input: client_id, statistics area
357 #define NECP_CLIENT_ACTION_AGENT_USE 12 // Return the use count and increment the use count. Input/Output: struct necp_agent_use_parameters
358
359 #define NECP_CLIENT_PARAMETER_APPLICATION NECP_POLICY_CONDITION_APPLICATION // Requires entitlement
360 #define NECP_CLIENT_PARAMETER_REAL_APPLICATION NECP_POLICY_CONDITION_REAL_APPLICATION // Requires entitlement
361 #define NECP_CLIENT_PARAMETER_DOMAIN NECP_POLICY_CONDITION_DOMAIN
362 #define NECP_CLIENT_PARAMETER_ACCOUNT NECP_POLICY_CONDITION_ACCOUNT
363 #define NECP_CLIENT_PARAMETER_PID NECP_POLICY_CONDITION_PID // Requires entitlement
364 #define NECP_CLIENT_PARAMETER_UID NECP_POLICY_CONDITION_UID // Requires entitlement
365 #define NECP_CLIENT_PARAMETER_BOUND_INTERFACE NECP_POLICY_CONDITION_BOUND_INTERFACE
366 #define NECP_CLIENT_PARAMETER_TRAFFIC_CLASS NECP_POLICY_CONDITION_TRAFFIC_CLASS
367 #define NECP_CLIENT_PARAMETER_IP_PROTOCOL NECP_POLICY_CONDITION_IP_PROTOCOL
368 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS NECP_POLICY_CONDITION_LOCAL_ADDR
369 #define NECP_CLIENT_PARAMETER_REMOTE_ADDRESS NECP_POLICY_CONDITION_REMOTE_ADDR
370
371 // "Prohibit" will never choose an interface with that property
372 #define NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE 100 // String, interface name
373 #define NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE 101 // u_int8_t, see ifru_functional_type in <net/if.h>
374 #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT 102 // uuid_t, network agent UUID
375 #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE 103 // struct necp_client_parameter_netagent_type
376
377 // "Require" will choose an interface with that property, or none if not found
378 #define NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE 111 // u_int8_t, see ifru_functional_type in <net/if.h>
379 #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT 112 // uuid_t, network agent UUID
380 #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE 113 // struct necp_client_parameter_netagent_type
381
382 // "Prefer" will choose an interface with that property, or best otherwise if not found
383 #define NECP_CLIENT_PARAMETER_PREFER_AGENT 122 // uuid_t, network agent UUID
384 #define NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE 123 // struct necp_client_parameter_netagent_type
385
386 // Use actions with NECP_CLIENT_ACTION_AGENT
387 #define NECP_CLIENT_PARAMETER_TRIGGER_AGENT 130 // uuid_t, network agent UUID
388 #define NECP_CLIENT_PARAMETER_ASSERT_AGENT 131 // uuid_t, network agent UUID
389 #define NECP_CLIENT_PARAMETER_UNASSERT_AGENT 132 // uuid_t, network agent UUID
390
391 #define NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT 200 // struct necp_client_endpoint
392 #define NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT 201 // struct necp_client_endpoint
393 #define NECP_CLIENT_PARAMETER_RESERVED_START 1000 // Parameters 1000 and higher are reserved for custom userspace options
394
395 #define NECP_CLIENT_RESULT_CLIENT_ID 1 // uuid_t
396 #define NECP_CLIENT_RESULT_POLICY_RESULT 2 // u_int32_t
397 #define NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER 3 // u_int32_t
398 #define NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT 4 // u_int32_t
399 #define NECP_CLIENT_RESULT_INTERFACE_INDEX 5 // u_int32_t
400 #define NECP_CLIENT_RESULT_NETAGENT 6 // struct necp_client_result_netagent
401 #define NECP_CLIENT_RESULT_FLAGS 7 // u_int32_t, see NECP_CLIENT_RESULT_FLAG_* values
402 #define NECP_CLIENT_RESULT_INTERFACE 8 // struct necp_client_result_interface
403
404 #define NECP_CLIENT_RESULT_NEXUS_INSTANCE 100 // uuid_t
405 #define NECP_CLIENT_RESULT_NEXUS_PORT 101 // u_int16_t
406
407 #define NECP_CLIENT_RESULT_LOCAL_ENDPOINT 200 // struct necp_client_endpoint
408 #define NECP_CLIENT_RESULT_REMOTE_ENDPOINT 201 // struct necp_client_endpoint
409
410 #define NECP_CLIENT_RESULT_FLAG_IS_LOCAL 0x0001 // Routes to this device
411 #define NECP_CLIENT_RESULT_FLAG_IS_DIRECT 0x0002 // Routes to directly accessible peer
412 #define NECP_CLIENT_RESULT_FLAG_HAS_IPV4 0x0004 // Supports IPv4
413 #define NECP_CLIENT_RESULT_FLAG_HAS_IPV6 0x0008 // Supports IPv6
414
415 struct necp_interface_details {
416 char name[IFXNAMSIZ];
417 u_int32_t index;
418 u_int32_t generation;
419 u_int32_t functional_type;
420 u_int32_t delegate_index;
421 u_int32_t flags; // see NECP_INTERFACE_FLAG_*
422 u_int32_t mtu;
423 u_int8_t ipv4_signature[IFNET_SIGNATURELEN];
424 u_int8_t ipv6_signature[IFNET_SIGNATURELEN];
425 };
426
427 #define NECP_INTERFACE_FLAG_EXPENSIVE 0x0001
428
429 struct necp_client_parameter_netagent_type {
430 char netagent_domain[32];
431 char netagent_type[32];
432 };
433
434 struct necp_client_result_netagent {
435 u_int32_t generation;
436 uuid_t netagent_uuid;
437 };
438
439 struct necp_client_result_interface {
440 u_int32_t generation;
441 u_int32_t index;
442 };
443
444 struct necp_client_endpoint {
445 union {
446 struct sockaddr sa;
447 struct sockaddr_in sin;
448 struct sockaddr_in6 sin6;
449 struct {
450 u_int8_t endpoint_length;
451 u_int8_t endpoint_family; // Use AF_UNSPEC to target a name
452 u_int16_t endpoint_port;
453 u_int32_t endpoint_type; // Client-specific type
454 char endpoint_data[0]; // Type-specific endpoint value
455 } endpoint;
456 } u;
457 };
458
459 struct necp_client_list {
460 u_int32_t client_count;
461 uuid_t clients[0];
462 };
463
464 struct kev_necp_policies_changed_data {
465 u_int32_t changed_count; // Defaults to 0.
466 };
467
468 struct necp_agent_use_parameters {
469 uuid_t agent_uuid;
470 uint64_t out_use_count;
471 };
472
473 #ifdef BSD_KERNEL_PRIVATE
474 #include <stdbool.h>
475 #include <sys/socketvar.h>
476 #include <sys/kern_control.h>
477 #include <netinet/ip_var.h>
478 #include <netinet6/ip6_var.h>
479 #include <net/if_var.h>
480 #include <sys/syslog.h>
481 #include <net/network_agent.h>
482
483 #define NECPLOG(level, format, ...) do { \
484 log((level > LOG_NOTICE ? LOG_NOTICE : level), "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \
485 } while (0)
486
487 #define NECPLOG0(level, msg) do { \
488 log((level > LOG_NOTICE ? LOG_NOTICE : level), "%s: %s\n", __FUNCTION__, msg); \
489 } while (0)
490
491 extern errno_t necp_client_init(void);
492 extern int necp_application_find_policy_match_internal(proc_t proc, u_int8_t *parameters, u_int32_t parameters_size,
493 struct necp_aggregate_result *returned_result,
494 u_int32_t *flags, u_int required_interface_index);
495 /*
496 * TLV utilities
497 *
498 * Note that these functions (other than necp_buffer_find_tlv) do not check the length of the entire buffer,
499 * so the caller must be sure that the entire TLV is within bounds.
500 */
501 extern u_int8_t *necp_buffer_write_tlv(u_int8_t *buffer, u_int8_t type, u_int32_t length, const void *value);
502 extern u_int8_t *necp_buffer_write_tlv_if_different(u_int8_t *buffer, const u_int8_t *max, u_int8_t type,
503 u_int32_t length, const void *value, bool *updated);
504 extern u_int8_t necp_buffer_get_tlv_type(u_int8_t *buffer, int tlv_offset);
505 extern u_int32_t necp_buffer_get_tlv_length(u_int8_t *buffer, int tlv_offset);
506 extern u_int8_t *necp_buffer_get_tlv_value(u_int8_t *buffer, int tlv_offset, u_int32_t *value_size);
507 extern int necp_buffer_find_tlv(u_int8_t *buffer, u_int32_t buffer_length, int offset, u_int8_t type, int next);
508
509 #define NECPCTL_DROP_ALL_LEVEL 1 /* Drop all packets if no policy matches above this level */
510 #define NECPCTL_DEBUG 2 /* Log all kernel policy matches */
511 #define NECPCTL_PASS_LOOPBACK 3 /* Pass all loopback traffic */
512 #define NECPCTL_PASS_KEEPALIVES 4 /* Pass all kernel-generated keepalive traffic */
513 #define NECPCTL_SOCKET_POLICY_COUNT 5 /* Count of all socket-level policies */
514 #define NECPCTL_SOCKET_NON_APP_POLICY_COUNT 6 /* Count of non-per-app socket-level policies */
515 #define NECPCTL_IP_POLICY_COUNT 7 /* Count of all ip-level policies */
516 #define NECPCTL_SESSION_COUNT 8 /* Count of NECP sessions */
517
518 #define NECPCTL_NAMES { \
519 { 0, 0 }, \
520 { "drop_all_level", CTLTYPE_INT }, \
521 { "debug", CTLTYPE_INT }, \
522 { "pass_loopback", CTLTYPE_INT }, \
523 { "pass_keepalives", CTLTYPE_INT }, \
524 }
525
526 typedef u_int32_t necp_kernel_policy_id;
527 #define NECP_KERNEL_POLICY_ID_NONE 0
528 #define NECP_KERNEL_POLICY_ID_NO_MATCH 1
529 #define NECP_KERNEL_POLICY_ID_FIRST_VALID 2
530
531 typedef u_int32_t necp_app_id;
532
533 #define NECP_KERNEL_POLICY_RESULT_NONE 0
534 #define NECP_KERNEL_POLICY_RESULT_PASS NECP_POLICY_RESULT_PASS
535 #define NECP_KERNEL_POLICY_RESULT_SKIP NECP_POLICY_RESULT_SKIP
536 #define NECP_KERNEL_POLICY_RESULT_DROP NECP_POLICY_RESULT_DROP
537 #define NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT NECP_POLICY_RESULT_SOCKET_DIVERT
538 #define NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER NECP_POLICY_RESULT_SOCKET_FILTER
539 #define NECP_KERNEL_POLICY_RESULT_IP_TUNNEL NECP_POLICY_RESULT_IP_TUNNEL
540 #define NECP_KERNEL_POLICY_RESULT_IP_FILTER NECP_POLICY_RESULT_IP_FILTER
541 #define NECP_KERNEL_POLICY_RESULT_TRIGGER NECP_POLICY_RESULT_TRIGGER
542 #define NECP_KERNEL_POLICY_RESULT_TRIGGER_IF_NEEDED NECP_POLICY_RESULT_TRIGGER_IF_NEEDED
543 #define NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED NECP_POLICY_RESULT_TRIGGER_SCOPED
544 #define NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED NECP_POLICY_RESULT_NO_TRIGGER_SCOPED
545 #define NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED NECP_POLICY_RESULT_SOCKET_SCOPED
546 #define NECP_KERNEL_POLICY_RESULT_ROUTE_RULES NECP_POLICY_RESULT_ROUTE_RULES
547 #define NECP_KERNEL_POLICY_RESULT_USE_NETAGENT NECP_POLICY_RESULT_USE_NETAGENT
548
549 typedef struct {
550 u_int32_t identifier;
551 u_int32_t data;
552 } necp_kernel_policy_service;
553
554 typedef union {
555 u_int tunnel_interface_index;
556 u_int scoped_interface_index;
557 u_int32_t flow_divert_control_unit;
558 u_int32_t filter_control_unit;
559 u_int32_t skip_policy_order;
560 u_int32_t route_rule_id;
561 u_int32_t netagent_id;
562 necp_kernel_policy_service service;
563 } necp_kernel_policy_result_parameter;
564
565 union necp_sockaddr_union {
566 struct sockaddr sa;
567 struct sockaddr_in sin;
568 struct sockaddr_in6 sin6;
569 };
570
571 enum necp_boolean_state {
572 necp_boolean_state_unknown = 0,
573 necp_boolean_state_false = 1,
574 necp_boolean_state_true = 2,
575 };
576
577 struct necp_kernel_socket_policy {
578 LIST_ENTRY(necp_kernel_socket_policy) chain;
579 necp_policy_id parent_policy_id;
580 necp_kernel_policy_id id;
581 necp_policy_order order;
582 u_int32_t session_order;
583 int session_pid;
584
585 u_int32_t condition_mask;
586 u_int32_t condition_negated_mask;
587 necp_kernel_policy_id cond_policy_id;
588 u_int32_t cond_app_id; // Locally assigned ID value stored
589 u_int32_t cond_real_app_id; // Locally assigned ID value stored
590 char *cond_custom_entitlement; // String
591 u_int8_t cond_custom_entitlement_matched;// Boolean if entitlement matched app
592 u_int32_t cond_account_id; // Locally assigned ID value stored
593 char *cond_domain; // String
594 u_int8_t cond_domain_dot_count; // Number of dots in cond_domain
595 pid_t cond_pid;
596 uid_t cond_uid;
597 ifnet_t cond_bound_interface; // Matches specific binding only
598 struct necp_policy_condition_tc_range cond_traffic_class; // Matches traffic class in range
599 u_int16_t cond_protocol; // Matches IP protcol number
600 union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
601 union necp_sockaddr_union cond_local_end; // Matches IP address range
602 u_int8_t cond_local_prefix; // Defines subnet
603 union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
604 union necp_sockaddr_union cond_remote_end; // Matches IP address range
605 u_int8_t cond_remote_prefix; // Defines subnet
606
607 necp_kernel_policy_result result;
608 necp_kernel_policy_result_parameter result_parameter;
609 };
610
611 struct necp_kernel_ip_output_policy {
612 LIST_ENTRY(necp_kernel_ip_output_policy) chain;
613 necp_policy_id parent_policy_id;
614 necp_kernel_policy_id id;
615 necp_policy_order suborder;
616 necp_policy_order order;
617 u_int32_t session_order;
618 int session_pid;
619
620 u_int32_t condition_mask;
621 u_int32_t condition_negated_mask;
622 necp_kernel_policy_id cond_policy_id;
623 ifnet_t cond_bound_interface; // Matches specific binding only
624 u_int16_t cond_protocol; // Matches IP protcol number
625 union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
626 union necp_sockaddr_union cond_local_end; // Matches IP address range
627 u_int8_t cond_local_prefix; // Defines subnet
628 union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
629 union necp_sockaddr_union cond_remote_end; // Matches IP address range
630 u_int8_t cond_remote_prefix; // Defines subnet
631 u_int32_t cond_last_interface_index;
632
633 necp_kernel_policy_result result;
634 necp_kernel_policy_result_parameter result_parameter;
635 };
636
637 #define MAX_KERNEL_SOCKET_POLICIES 1
638 #define MAX_KERNEL_IP_OUTPUT_POLICIES 4
639 struct necp_session_policy {
640 LIST_ENTRY(necp_session_policy) chain;
641 bool applied; // Applied into the kernel table
642 bool pending_deletion; // Waiting to be removed from kernel table
643 bool pending_update; // Policy has been modified since creation/last application
644 necp_policy_id id;
645 necp_policy_order order;
646 u_int8_t *result;
647 u_int32_t result_size;
648 u_int8_t *conditions; // Array of conditions, each with a u_int32_t length at start
649 u_int32_t conditions_size;
650 u_int8_t *route_rules; // Array of route rules, each with a u_int32_t length at start
651 u_int32_t route_rules_size;
652
653 uuid_t applied_app_uuid;
654 uuid_t applied_real_app_uuid;
655 char *applied_domain;
656 char *applied_account;
657
658 uuid_t applied_result_uuid;
659
660 u_int32_t applied_route_rules_id;
661
662 necp_kernel_policy_id kernel_socket_policies[MAX_KERNEL_SOCKET_POLICIES];
663 necp_kernel_policy_id kernel_ip_output_policies[MAX_KERNEL_IP_OUTPUT_POLICIES];
664 };
665
666 struct necp_aggregate_socket_result {
667 necp_kernel_policy_result result;
668 necp_kernel_policy_result_parameter result_parameter;
669 necp_kernel_policy_filter filter_control_unit;
670 u_int32_t route_rule_id;
671 int32_t qos_marking_gencount;
672 };
673
674 struct necp_inpcb_result {
675 u_int32_t app_id;
676 necp_kernel_policy_id policy_id;
677 int32_t policy_gencount;
678 u_int32_t flowhash;
679 struct necp_aggregate_socket_result results;
680 };
681
682 extern errno_t necp_init(void);
683
684 extern errno_t necp_set_socket_attributes(struct socket *so, struct sockopt *sopt);
685 extern errno_t necp_get_socket_attributes(struct socket *so, struct sockopt *sopt);
686 extern void necp_inpcb_dispose(struct inpcb *inp);
687
688 extern u_int32_t necp_socket_get_content_filter_control_unit(struct socket *so);
689
690 extern bool necp_socket_should_use_flow_divert(struct inpcb *inp);
691 extern u_int32_t necp_socket_get_flow_divert_control_unit(struct inpcb *inp);
692
693 extern bool necp_socket_should_rescope(struct inpcb *inp);
694 extern u_int necp_socket_get_rescope_if_index(struct inpcb *inp);
695 extern u_int32_t necp_socket_get_effective_mtu(struct inpcb *inp, u_int32_t current_mtu);
696
697 extern bool necp_socket_is_allowed_to_send_recv(struct inpcb *inp, necp_kernel_policy_id *return_policy_id,
698 u_int32_t *return_route_rule_id);
699 extern bool necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port,
700 u_int16_t remote_port, struct in_addr *local_addr,
701 struct in_addr *remote_addr, ifnet_t interface,
702 necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id);
703 extern bool necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port,
704 u_int16_t remote_port, struct in6_addr *local_addr,
705 struct in6_addr *remote_addr, ifnet_t interface,
706 necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id);
707 extern void necp_socket_update_qos_marking(struct inpcb *inp, struct rtentry *route, struct ifnet *interface, u_int32_t route_rule_id);
708 extern int necp_mark_packet_from_socket(struct mbuf *packet, struct inpcb *inp, necp_kernel_policy_id policy_id,
709 u_int32_t route_rule_id);
710 extern necp_kernel_policy_id necp_get_policy_id_from_packet(struct mbuf *packet);
711 extern u_int32_t necp_get_last_interface_index_from_packet(struct mbuf *packet);
712 extern u_int32_t necp_get_route_rule_id_from_packet(struct mbuf *packet);
713 extern int necp_get_app_uuid_from_packet(struct mbuf *packet,
714 uuid_t app_uuid);
715
716 extern necp_kernel_policy_id necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local_addr,
717 struct sockaddr *override_remote_addr, u_int32_t override_bound_interface);
718 extern necp_kernel_policy_id necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_args *ipoa,
719 necp_kernel_policy_result *result,
720 necp_kernel_policy_result_parameter *result_parameter);
721 extern necp_kernel_policy_id necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out_args *ip6oa,
722 necp_kernel_policy_result *result,
723 necp_kernel_policy_result_parameter *result_parameter);
724
725 extern int necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id);
726 extern int necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface);
727
728 extern ifnet_t necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter);
729 extern bool necp_packet_can_rebind_to_ifnet(struct mbuf *packet, struct ifnet *interface, struct route *new_route, int family);
730
731 extern bool necp_packet_is_allowed_over_interface(struct mbuf *packet, struct ifnet *interface);
732
733 extern int necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive);
734 extern bool necp_get_is_keepalive_from_packet(struct mbuf *packet);
735
736 extern void necp_update_all_clients(void); // Handle general re-evaluate event
737
738 extern void necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid); // Cause a single client to get an update event
739
740 extern int necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id,
741 u_int8_t *assigned_results, size_t assigned_results_length);
742
743 #endif /* BSD_KERNEL_PRIVATE */
744 #ifndef KERNEL
745
746 extern int necp_match_policy(const uint8_t *parameters, size_t parameters_size, struct necp_aggregate_result *returned_result);
747
748 extern int necp_open(int flags);
749
750 extern int necp_client_action(int necp_fd, uint32_t action, uuid_t client_id,
751 size_t client_id_len, uint8_t *buffer, size_t buffer_size);
752
753 #endif /* !KERNEL */
754
755 #endif /* PRIVATE */
756
757 #endif
mirror of XNU