]> git.saurik.com Git - apple/xnu.git/blob - bsd/net/necp.h
projects / apple / xnu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
xnu-4570.31.3.tar.gz
[apple/xnu.git] / bsd / net / necp.h
1 /*
2 * Copyright (c) 2013-2017 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #ifndef _NET_NECP_H_
30 #define _NET_NECP_H_
31
32 #include <net/net_kev.h>
33 #ifdef PRIVATE
34
35 #include <netinet/in.h>
36 #include <netinet/in_stat.h>
37 #include <sys/socket.h>
38 #include <net/if.h>
39
40 /*
41 * Name registered by the ipsec kernel control
42 */
43 #define NECP_CONTROL_NAME "com.apple.net.necp_control"
44
45 #define NECP_TLV_LENGTH_UINT32 1
46
47 struct necp_packet_header {
48 u_int8_t packet_type;
49 u_int8_t flags;
50 u_int32_t message_id;
51 };
52
53 /*
54 * Control message commands
55 */
56 #define NECP_PACKET_TYPE_POLICY_ADD 1
57 #define NECP_PACKET_TYPE_POLICY_GET 2
58 #define NECP_PACKET_TYPE_POLICY_DELETE 3
59 #define NECP_PACKET_TYPE_POLICY_APPLY_ALL 4
60 #define NECP_PACKET_TYPE_POLICY_LIST_ALL 5
61 #define NECP_PACKET_TYPE_POLICY_DELETE_ALL 6
62 #define NECP_PACKET_TYPE_SET_SESSION_PRIORITY 7
63 #define NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC 8
64 #define NECP_PACKET_TYPE_REGISTER_SERVICE 9
65 #define NECP_PACKET_TYPE_UNREGISTER_SERVICE 10
66 #define NECP_PACKET_TYPE_POLICY_DUMP_ALL 11
67
68 /*
69 * Session actions
70 */
71 #define NECP_SESSION_ACTION_POLICY_ADD 1 // In: Policy TLVs Out: necp_policy_id
72 #define NECP_SESSION_ACTION_POLICY_GET 2 // In: necp_policy_id Out: Policy TLVs
73 #define NECP_SESSION_ACTION_POLICY_DELETE 3 // In: necp_policy_id Out: None
74 #define NECP_SESSION_ACTION_POLICY_APPLY_ALL 4 // In: None Out: None
75 #define NECP_SESSION_ACTION_POLICY_LIST_ALL 5 // In: None Out: TLVs of IDs
76 #define NECP_SESSION_ACTION_POLICY_DELETE_ALL 6 // In: None Out: None
77 #define NECP_SESSION_ACTION_SET_SESSION_PRIORITY 7 // In: necp_session_priority Out: None
78 #define NECP_SESSION_ACTION_LOCK_SESSION_TO_PROC 8 // In: None Out: None
79 #define NECP_SESSION_ACTION_REGISTER_SERVICE 9 // In: uuid_t Out: None
80 #define NECP_SESSION_ACTION_UNREGISTER_SERVICE 10 // In: uuid_t Out: None
81 #define NECP_SESSION_ACTION_POLICY_DUMP_ALL 11 // In: None Out: uint32_t bytes length, then Policy TLVs
82
83 /*
84 * Control message flags
85 */
86 #define NECP_PACKET_FLAGS_RESPONSE 0x01 // Used for acks, errors, and query responses
87
88 /*
89 * Control message TLV types
90 */
91 #define NECP_TLV_NIL 0
92 #define NECP_TLV_ERROR 1 // u_int32_t
93 #define NECP_TLV_POLICY_ORDER 2 // u_int32_t
94 #define NECP_TLV_POLICY_CONDITION 3
95 #define NECP_TLV_POLICY_RESULT 4
96 #define NECP_TLV_POLICY_ID 5 // u_int32_t
97 #define NECP_TLV_SESSION_PRIORITY 6 // u_int32_t
98 #define NECP_TLV_ATTRIBUTE_DOMAIN 7 // char[]
99 #define NECP_TLV_ATTRIBUTE_ACCOUNT 8 // char[]
100 #define NECP_TLV_SERVICE_UUID 9 // uuid_t
101 #define NECP_TLV_ROUTE_RULE 10
102
103 /*
104 * Control message TLV sent only by the kernel to userspace
105 */
106 #define NECP_TLV_POLICY_OWNER 100 // char []
107 #define NECP_TLV_POLICY_DUMP 101
108 #define NECP_TLV_POLICY_RESULT_STRING 102 // char []
109 #define NECP_TLV_POLICY_SESSION_ORDER 103 // u_int32_t
110
111 /*
112 * Condition flags
113 */
114 #define NECP_POLICY_CONDITION_FLAGS_NEGATIVE 0x01 // Negative
115
116 /*
117 * Conditions
118 * Used for setting policies as well as passing parameters to necp_match_policy.
119 */
120 #define NECP_POLICY_CONDITION_DEFAULT 0 // N/A, not valid with any other conditions
121 // Socket/Application conditions
122 #define NECP_POLICY_CONDITION_APPLICATION 1 // uuid_t, uses effective UUID when possible
123 #define NECP_POLICY_CONDITION_REAL_APPLICATION 2 // uuid_t, never uses effective UUID. Only valid with NECP_POLICY_CONDITION_APPLICATION
124 #define NECP_POLICY_CONDITION_DOMAIN 3 // String, such as apple.com
125 #define NECP_POLICY_CONDITION_ACCOUNT 4 // String
126 #define NECP_POLICY_CONDITION_ENTITLEMENT 5 // String
127 #define NECP_POLICY_CONDITION_PID 6 // pid_t
128 #define NECP_POLICY_CONDITION_UID 7 // uid_t
129 #define NECP_POLICY_CONDITION_ALL_INTERFACES 8 // N/A
130 #define NECP_POLICY_CONDITION_BOUND_INTERFACE 9 // String
131 #define NECP_POLICY_CONDITION_TRAFFIC_CLASS 10 // necp_policy_condition_tc_range
132 // Socket/IP conditions
133 #define NECP_POLICY_CONDITION_IP_PROTOCOL 11 // u_int8_t
134 #define NECP_POLICY_CONDITION_LOCAL_ADDR 12 // necp_policy_condition_addr
135 #define NECP_POLICY_CONDITION_REMOTE_ADDR 13 // necp_policy_condition_addr
136 #define NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE 14 // necp_policy_condition_addr_range
137 #define NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE 15 // necp_policy_condition_addr_range
138
139 /*
140 * Results
141 */
142 #define NECP_POLICY_RESULT_PASS 1 // N/A
143 #define NECP_POLICY_RESULT_SKIP 2 // u_int32_t, policy order to skip to. 0 to skip all session policies.
144 #define NECP_POLICY_RESULT_DROP 3 // N/A
145 #define NECP_POLICY_RESULT_SOCKET_DIVERT 4 // u_int32_t, flow divert control unit
146 #define NECP_POLICY_RESULT_SOCKET_FILTER 5 // u_int32_t, filter control unit
147 #define NECP_POLICY_RESULT_IP_TUNNEL 6 // String, interface name
148 #define NECP_POLICY_RESULT_IP_FILTER 7 // ?
149 #define NECP_POLICY_RESULT_TRIGGER 8 // service uuid_t
150 #define NECP_POLICY_RESULT_TRIGGER_IF_NEEDED 9 // service uuid_t
151 #define NECP_POLICY_RESULT_TRIGGER_SCOPED 10 // service uuid_t
152 #define NECP_POLICY_RESULT_NO_TRIGGER_SCOPED 11 // service uuid_t
153 #define NECP_POLICY_RESULT_SOCKET_SCOPED 12 // String, interface name
154 #define NECP_POLICY_RESULT_ROUTE_RULES 13 // N/A, must have route rules defined
155 #define NECP_POLICY_RESULT_USE_NETAGENT 14 // netagent uuid_t
156
157 #define NECP_POLICY_RESULT_MAX NECP_POLICY_RESULT_USE_NETAGENT
158
159 /*
160 * Route Rules
161 * Detailed parameters for NECP_POLICY_RESULT_ROUTE_RULES.
162 */
163 #define NECP_ROUTE_RULE_NONE 0 // N/A
164 #define NECP_ROUTE_RULE_DENY_INTERFACE 1 // String, or empty to match all
165 #define NECP_ROUTE_RULE_ALLOW_INTERFACE 2 // String, or empty to match all
166 #define NECP_ROUTE_RULE_QOS_MARKING 3 // String, or empty to match all
167
168 #define NECP_ROUTE_RULE_FLAG_CELLULAR 0x01
169 #define NECP_ROUTE_RULE_FLAG_WIFI 0x02
170 #define NECP_ROUTE_RULE_FLAG_WIRED 0x04
171 #define NECP_ROUTE_RULE_FLAG_EXPENSIVE 0x08
172
173 /*
174 * Error types
175 */
176 #define NECP_ERROR_INTERNAL 0
177 #define NECP_ERROR_UNKNOWN_PACKET_TYPE 1
178 #define NECP_ERROR_INVALID_TLV 2
179 #define NECP_ERROR_POLICY_RESULT_INVALID 3
180 #define NECP_ERROR_POLICY_CONDITIONS_INVALID 4
181 #define NECP_ERROR_POLICY_ID_NOT_FOUND 5
182 #define NECP_ERROR_INVALID_PROCESS 6
183 #define NECP_ERROR_ROUTE_RULES_INVALID 7
184
185 // Modifiers
186 #define NECP_MASK_USERSPACE_ONLY 0x80000000 // on filter_control_unit value
187
188 struct necp_policy_condition_tc_range {
189 u_int32_t start_tc;
190 u_int32_t end_tc;
191 } __attribute__((__packed__));
192
193 struct necp_policy_condition_addr {
194 u_int8_t prefix;
195 union {
196 struct sockaddr sa;
197 struct sockaddr_in sin;
198 struct sockaddr_in6 sin6;
199 } address;
200 } __attribute__((__packed__));
201
202 struct necp_policy_condition_addr_range {
203 union {
204 struct sockaddr sa;
205 struct sockaddr_in sin;
206 struct sockaddr_in6 sin6;
207 } start_address;
208 union {
209 struct sockaddr sa;
210 struct sockaddr_in sin;
211 struct sockaddr_in6 sin6;
212 } end_address;
213 } __attribute__((__packed__));
214
215 #define NECP_SESSION_PRIORITY_UNKNOWN 0
216 #define NECP_SESSION_PRIORITY_CONTROL 1
217 #define NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL 2
218 #define NECP_SESSION_PRIORITY_HIGH 3
219 #define NECP_SESSION_PRIORITY_DEFAULT 4
220 #define NECP_SESSION_PRIORITY_LOW 5
221
222 #define NECP_SESSION_NUM_PRIORITIES NECP_SESSION_PRIORITY_LOW
223
224 typedef u_int32_t necp_policy_id;
225 typedef u_int32_t necp_policy_order;
226 typedef u_int32_t necp_session_priority;
227
228 typedef u_int32_t necp_kernel_policy_result;
229 typedef u_int32_t necp_kernel_policy_filter;
230
231 typedef union {
232 u_int tunnel_interface_index;
233 u_int scoped_interface_index;
234 u_int32_t flow_divert_control_unit;
235 u_int32_t filter_control_unit;
236 } necp_kernel_policy_routing_result_parameter;
237
238 #define NECP_SERVICE_FLAGS_REGISTERED 0x01
239 #define NECP_MAX_NETAGENTS 8
240
241 #define NECP_TFO_COOKIE_LEN_MAX 16
242 struct necp_aggregate_result {
243 necp_kernel_policy_result routing_result;
244 necp_kernel_policy_routing_result_parameter routing_result_parameter;
245 necp_kernel_policy_filter filter_control_unit;
246 necp_kernel_policy_result service_action;
247 uuid_t service_uuid;
248 u_int32_t service_flags;
249 u_int32_t service_data;
250 u_int routed_interface_index;
251 u_int32_t policy_id;
252 uuid_t netagents[NECP_MAX_NETAGENTS];
253 u_int32_t netagent_flags[NECP_MAX_NETAGENTS];
254 u_int8_t mss_recommended;
255 };
256
257 /*
258 * Statistics. It would be nice if the definitions in ntstat.h could be used,
259 * but they get entangled with #defines for v4 etc in pfvar.h and it may be better practice
260 * to have separate definitions here.
261 */
262 struct necp_stat_counts
263 {
264 /* Counters */
265 u_int64_t necp_stat_rxpackets __attribute__((aligned(8)));
266 u_int64_t necp_stat_rxbytes __attribute__((aligned(8)));
267 u_int64_t necp_stat_txpackets __attribute__((aligned(8)));
268 u_int64_t necp_stat_txbytes __attribute__((aligned(8)));
269
270 u_int32_t necp_stat_rxduplicatebytes;
271 u_int32_t necp_stat_rxoutoforderbytes;
272 u_int32_t necp_stat_txretransmit;
273
274 u_int32_t necp_stat_connectattempts;
275 u_int32_t necp_stat_connectsuccesses;
276
277 u_int32_t necp_stat_min_rtt;
278 u_int32_t necp_stat_avg_rtt;
279 u_int32_t necp_stat_var_rtt;
280
281 };
282
283 // Note, some metadata is implicit in the necp client itself:
284 // From the process itself : pid, upid, uuid, proc name.
285 // From the necp client parameters: local and remote addresses, euuid, traffic class, ifindex
286 //
287 // The following may well be supplied via future necp client parameters,
288 // but they are here so they don't get forgotten.
289 struct necp_basic_metadata
290 {
291 u_int32_t rcvbufsize;
292 u_int32_t rcvbufused;
293 };
294
295 struct necp_tcp_probe_status {
296 unsigned int probe_activated : 1;
297 unsigned int write_probe_failed : 1;
298 unsigned int read_probe_failed : 1;
299 unsigned int conn_probe_failed : 1;
300 };
301
302 struct necp_extra_tcp_metadata
303 {
304 struct necp_tcp_probe_status probestatus;
305
306 u_int32_t sndbufsize;
307 u_int32_t sndbufused;
308 u_int32_t txunacked;
309 u_int32_t txwindow;
310 u_int32_t txcwindow;
311 u_int32_t flags; // use SOF_*
312 u_int32_t flags1; // use SOF1_*
313 u_int32_t traffic_mgt_flags;
314 u_int32_t cc_alg_index;
315 u_int32_t state;
316 activity_bitmap_t activity_bitmap;
317 };
318
319 struct necp_stats_hdr {
320 u_int32_t necp_stats_type __attribute__((aligned(8)));
321 u_int32_t necp_stats_ver;
322 u_int64_t __necp_stats_reserved; // Pad the field for future use
323 };
324
325 #define NECP_CLIENT_STATISTICS_TYPE_TCP 1 // Identifies use of necp_tcp_stats
326 #define NECP_CLIENT_STATISTICS_TYPE_UDP 2 // Identifies use of necp_udp_stats
327 #define NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1 1 // Currently supported version for TCP
328 #define NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1 1 // Currently supported version for UDP
329
330 #define NECP_CLIENT_STATISTICS_TYPE_TCP_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1
331 #define NECP_CLIENT_STATISTICS_TYPE_UDP_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1
332
333 #define NECP_CLIENT_STATISTICS_EVENT_INIT 0x00000000 // Register the flow
334 #define NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT 0x00000001 // The flow is effectively finished but waiting on timer
335
336 struct necp_tcp_stats {
337 struct necp_stats_hdr necp_tcp_hdr;
338 struct necp_stat_counts necp_tcp_counts;
339 struct necp_basic_metadata necp_tcp_basic;
340 struct necp_extra_tcp_metadata necp_tcp_extra;
341 };
342
343 struct necp_udp_stats {
344 struct necp_stats_hdr necp_udp_hdr;
345 struct necp_stat_counts necp_udp_counts;
346 struct necp_basic_metadata necp_udp_basic;
347 };
348
349 typedef struct necp_all_stats {
350 union {
351 struct necp_tcp_stats tcp_stats;
352 struct necp_udp_stats udp_stats;
353 } all_stats_u;
354 } necp_all_stats;
355
356 // Memory for statistics is requested via a necp_stats_bufreq
357 //
358 struct necp_stats_bufreq {
359 u_int32_t necp_stats_bufreq_id __attribute__((aligned(8)));
360 u_int32_t necp_stats_bufreq_type; // NECP_CLIENT_STATISTICS_TYPE_*
361 u_int32_t necp_stats_bufreq_ver; // NECP_CLIENT_STATISTICS_TYPE_*_VER
362 u_int32_t necp_stats_bufreq_size;
363 union {
364 void *necp_stats_bufreq_addr;
365 mach_vm_address_t necp_stats_bufreq_uaddr;
366 };
367 };
368
369 #define NECP_CLIENT_STATISTICS_BUFREQ_ID 0xbf // Distinguishes from statistics actions taking a necp_all_stats struct
370
371 // There is a limit to the number of statistics structures that may be allocated per process, subject to change
372 //
373 #define NECP_MAX_PER_PROCESS_CLIENT_STATISTICS_STRUCTS 512
374
375 #define NECP_TCP_ECN_HEURISTICS_SYN_RST 1
376 typedef struct necp_tcp_ecn_cache {
377 u_int8_t necp_tcp_ecn_heuristics_success:1;
378 u_int8_t necp_tcp_ecn_heuristics_loss:1;
379 u_int8_t necp_tcp_ecn_heuristics_drop_rst:1;
380 u_int8_t necp_tcp_ecn_heuristics_drop_rxmt:1;
381 u_int8_t necp_tcp_ecn_heuristics_aggressive:1;
382 u_int8_t necp_tcp_ecn_heuristics_syn_rst:1;
383 } necp_tcp_ecn_cache;
384
385 #define NECP_TCP_TFO_HEURISTICS_RST 1
386 typedef struct necp_tcp_tfo_cache {
387 u_int8_t necp_tcp_tfo_cookie[NECP_TFO_COOKIE_LEN_MAX];
388 u_int8_t necp_tcp_tfo_cookie_len;
389 u_int8_t necp_tcp_tfo_heuristics_success:1; // TFO succeeded with data in the SYN
390 u_int8_t necp_tcp_tfo_heuristics_loss:1; // TFO SYN-loss with data
391 u_int8_t necp_tcp_tfo_heuristics_middlebox:1; // TFO middlebox detected
392 u_int8_t necp_tcp_tfo_heuristics_success_req:1; // TFO succeeded with the TFO-option in the SYN
393 u_int8_t necp_tcp_tfo_heuristics_loss_req:1; // TFO SYN-loss with the TFO-option
394 u_int8_t necp_tcp_tfo_heuristics_rst_data:1; // Recevied RST upon SYN with data in the SYN
395 u_int8_t necp_tcp_tfo_heuristics_rst_req:1; // Received RST upon SYN with the TFO-option
396 } necp_tcp_tfo_cache;
397
398 #define NECP_CLIENT_CACHE_TYPE_ECN 1 // Identifies use of necp_tcp_ecn_cache
399 #define NECP_CLIENT_CACHE_TYPE_TFO 2 // Identifies use of necp_tcp_tfo_cache
400
401 #define NECP_CLIENT_CACHE_TYPE_ECN_VER_1 1 // Currently supported version for ECN
402 #define NECP_CLIENT_CACHE_TYPE_TFO_VER_1 1 // Currently supported version for TFO
403
404 typedef struct necp_cache_buffer {
405 u_int8_t necp_cache_buf_type; // NECP_CLIENT_CACHE_TYPE_*
406 u_int8_t necp_cache_buf_ver; // NECP_CLIENT_CACHE_TYPE_*_VER
407 u_int32_t necp_cache_buf_size;
408 mach_vm_address_t necp_cache_buf_addr;
409 } necp_cache_buffer;
410
411 /*
412 * NECP Client definitions
413 */
414 #define NECP_MAX_CLIENT_PARAMETERS_SIZE 1024
415 #define NECP_MAX_CLIENT_RESULT_SIZE 512
416
417 #define NECP_OPEN_FLAG_OBSERVER 0x01 // Observers can query clients they don't own
418 #define NECP_OPEN_FLAG_BACKGROUND 0x02 // Mark this fd as backgrounded
419 #define NECP_OPEN_FLAG_PUSH_OBSERVER 0x04 // When used with the OBSERVER flag, allows updates to be pushed. Adding clients is not allowed in this mode.
420
421 #define NECP_FD_SUPPORTS_GUARD 1
422
423 #define NECP_CLIENT_ACTION_ADD 1 // Register a new client. Input: parameters in buffer; Output: client_id
424 #define NECP_CLIENT_ACTION_REMOVE 2 // Unregister a client. Input: client_id, optional struct ifnet_stats_per_flow
425 #define NECP_CLIENT_ACTION_COPY_PARAMETERS 3 // Copy client parameters. Input: client_id; Output: parameters in buffer
426 #define NECP_CLIENT_ACTION_COPY_RESULT 4 // Copy client result. Input: client_id; Output: result in buffer
427 #define NECP_CLIENT_ACTION_COPY_LIST 5 // Copy all client IDs. Output: struct necp_client_list in buffer
428 #define NECP_CLIENT_ACTION_REQUEST_NEXUS_INSTANCE 6 // Request a nexus instance from a nexus provider, optional struct necp_stats_bufreq
429 #define NECP_CLIENT_ACTION_AGENT 7 // Interact with agent. Input: client_id, agent parameters
430 #define NECP_CLIENT_ACTION_COPY_AGENT 8 // Copy agent content. Input: agent UUID; Output: struct netagent
431 #define NECP_CLIENT_ACTION_COPY_INTERFACE 9 // Copy interface details. Input: ifindex cast to UUID; Output: struct necp_interface_details
432 #define NECP_CLIENT_ACTION_SET_STATISTICS 10 // Deprecated
433 #define NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS 11 // Get route statistics. Input: client_id; Output: struct necp_stat_counts
434 #define NECP_CLIENT_ACTION_AGENT_USE 12 // Return the use count and increment the use count. Input/Output: struct necp_agent_use_parameters
435 #define NECP_CLIENT_ACTION_MAP_SYSCTLS 13 // Get the read-only sysctls memory location. Output: mach_vm_address_t
436 #define NECP_CLIENT_ACTION_UPDATE_CACHE 14 // Update heuristics and cache
437 #define NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE 15 // Fetch an updated client for push-mode observer. Output: Client id, struct necp_client_observer_update in buffer
438 #define NECP_CLIENT_ACTION_COPY_UPDATED_RESULT 16 // Copy client result only if changed. Input: client_id; Output: result in buffer
439
440 #define NECP_CLIENT_PARAMETER_APPLICATION NECP_POLICY_CONDITION_APPLICATION // Requires entitlement
441 #define NECP_CLIENT_PARAMETER_REAL_APPLICATION NECP_POLICY_CONDITION_REAL_APPLICATION // Requires entitlement
442 #define NECP_CLIENT_PARAMETER_DOMAIN NECP_POLICY_CONDITION_DOMAIN
443 #define NECP_CLIENT_PARAMETER_ACCOUNT NECP_POLICY_CONDITION_ACCOUNT
444 #define NECP_CLIENT_PARAMETER_PID NECP_POLICY_CONDITION_PID // Requires entitlement
445 #define NECP_CLIENT_PARAMETER_UID NECP_POLICY_CONDITION_UID // Requires entitlement
446 #define NECP_CLIENT_PARAMETER_BOUND_INTERFACE NECP_POLICY_CONDITION_BOUND_INTERFACE
447 #define NECP_CLIENT_PARAMETER_TRAFFIC_CLASS NECP_POLICY_CONDITION_TRAFFIC_CLASS
448 #define NECP_CLIENT_PARAMETER_IP_PROTOCOL NECP_POLICY_CONDITION_IP_PROTOCOL
449 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS NECP_POLICY_CONDITION_LOCAL_ADDR
450 #define NECP_CLIENT_PARAMETER_REMOTE_ADDRESS NECP_POLICY_CONDITION_REMOTE_ADDR
451 #define NECP_CLIENT_PARAMETER_NEXUS_KEY 102
452
453 // "Prohibit" will never choose an interface with that property
454 #define NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE 100 // String, interface name
455 #define NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE 101 // u_int8_t, see ifru_functional_type in <net/if.h>
456 #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT 102 // uuid_t, network agent UUID
457 #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE 103 // struct necp_client_parameter_netagent_type
458
459 // "Require" will choose an interface with that property, or none if not found
460 #define NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE 111 // u_int8_t, see ifru_functional_type in <net/if.h>
461 #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT 112 // uuid_t, network agent UUID
462 #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE 113 // struct necp_client_parameter_netagent_type
463
464 // "Prefer" will choose an interface with that property, or best otherwise if not found
465 #define NECP_CLIENT_PARAMETER_PREFER_AGENT 122 // uuid_t, network agent UUID
466 #define NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE 123 // struct necp_client_parameter_netagent_type
467
468 // Use actions with NECP_CLIENT_ACTION_AGENT
469 #define NECP_CLIENT_PARAMETER_TRIGGER_AGENT 130 // uuid_t, network agent UUID
470 #define NECP_CLIENT_PARAMETER_ASSERT_AGENT 131 // uuid_t, network agent UUID
471 #define NECP_CLIENT_PARAMETER_UNASSERT_AGENT 132 // uuid_t, network agent UUID
472
473 #define NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT 200 // struct necp_client_endpoint
474 #define NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT 201 // struct necp_client_endpoint
475 #define NECP_CLIENT_PARAMETER_BROWSE_CATEGORY 202 // struct necp_client_endpoint
476
477 #define NECP_CLIENT_PARAMETER_FLAGS 250 // u_int32_t, see NECP_CLIENT_PAREMETER_FLAG_* values
478
479 #define NECP_CLIENT_PARAMETER_FLAG_MULTIPATH 0x0001 // Get multipath interface results
480 #define NECP_CLIENT_PARAMETER_FLAG_BROWSE 0x0002 // Agent assertions on nexuses are requests to browse
481 #define NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE 0x0004 // Prohibit expensive interfaces
482 #define NECP_CLIENT_PARAMETER_FLAG_LISTENER 0x0008 // Client is interested in listening for inbound connections
483 #define NECP_CLIENT_PARAMETER_FLAG_DISCRETIONARY 0x0010 // Client's traffic is discretionary, and eligible for early defuncting
484 #define NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE 0x0020 // Client is requesting to enable ECN
485 #define NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE 0x0040 // Client is requesting to disable ECN
486 #define NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE 0x0080 // Client is requesting to enable TFO
487
488 #define NECP_CLIENT_RESULT_CLIENT_ID 1 // uuid_t
489 #define NECP_CLIENT_RESULT_POLICY_RESULT 2 // u_int32_t
490 #define NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER 3 // u_int32_t
491 #define NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT 4 // u_int32_t
492 #define NECP_CLIENT_RESULT_INTERFACE_INDEX 5 // u_int32_t
493 #define NECP_CLIENT_RESULT_NETAGENT 6 // struct necp_client_result_netagent
494 #define NECP_CLIENT_RESULT_FLAGS 7 // u_int32_t, see NECP_CLIENT_RESULT_FLAG_* values
495 #define NECP_CLIENT_RESULT_INTERFACE 8 // struct necp_client_result_interface
496 #define NECP_CLIENT_RESULT_MULTIPATH_INTERFACE 9 // struct necp_client_result_interface
497 #define NECP_CLIENT_RESULT_EFFECTIVE_MTU 10 // u_int32_t
498 #define NECP_CLIENT_RESULT_FLOW 11 // TLV array of a single flow's state
499 #define NECP_CLIENT_RESULT_PROTO_CTL_EVENT 12
500 #define NECP_CLIENT_RESULT_TFO_COOKIE 13 // NECP_TFO_COOKIE_LEN_MAX
501 #define NECP_CLIENT_RESULT_TFO_FLAGS 14 // u_int8_t
502 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS 15 // u_int8_t
503
504 #define NECP_CLIENT_RESULT_NEXUS_INSTANCE 100 // uuid_t
505 #define NECP_CLIENT_RESULT_NEXUS_PORT 101 // u_int16_t
506 #define NECP_CLIENT_RESULT_NEXUS_KEY 102 // uuid_t
507 #define NECP_CLIENT_RESULT_NEXUS_PORT_FLOW_INDEX 103 // u_int32_t
508
509 #define NECP_CLIENT_RESULT_LOCAL_ENDPOINT 200 // struct necp_client_endpoint
510 #define NECP_CLIENT_RESULT_REMOTE_ENDPOINT 201 // struct necp_client_endpoint
511 #define NECP_CLIENT_RESULT_DISCOVERED_ENDPOINT 202 // struct necp_client_endpoint, result of browse
512 #define NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS 210 // u_int32_t
513 #define NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG 211 // u_int32_t, 1: background, 0: not background
514
515 #define NECP_CLIENT_RESULT_FLAG_IS_LOCAL 0x0001 // Routes to this device
516 #define NECP_CLIENT_RESULT_FLAG_IS_DIRECT 0x0002 // Routes to directly accessible peer
517 #define NECP_CLIENT_RESULT_FLAG_HAS_IPV4 0x0004 // Supports IPv4
518 #define NECP_CLIENT_RESULT_FLAG_HAS_IPV6 0x0008 // Supports IPv6
519 #define NECP_CLIENT_RESULT_FLAG_DEFUNCT 0x0010 // Defunct
520 #define NECP_CLIENT_RESULT_FLAG_SATISFIED 0x0020 // Satisfied path
521 #define NECP_CLIENT_RESULT_FLAG_FLOW_ASSIGNED 0x0040 // Assigned, the flow is active
522 #define NECP_CLIENT_RESULT_FLAG_FLOW_VIABLE 0x0080 // Viable, the flow has a valid route
523 #define NECP_CLIENT_RESULT_FLAG_PROBE_CONNECTIVITY 0x0100 // Flow should probe connectivity
524 #define NECP_CLIENT_RESULT_FLAG_ECN_ENABLED 0x0200 // ECN should be used
525 #define NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED 0x0400 // Fast open should not be used
526 #define NECP_CLIENT_RESULT_FLAG_LINK_QUALITY_ABORT 0x0800 // Link quality is very bad, recommend close connections
527 #define NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING 0x1000 // QoS marking is allowed
528
529 #define NECP_CLIENT_RESULT_FAST_OPEN_SND_PROBE 0x01 // DEPRECATED - Fast open send probe
530 #define NECP_CLIENT_RESULT_FAST_OPEN_RCV_PROBE 0x02 // DEPRECATED - Fast open receive probe
531
532 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_NONE 0x01
533 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_LOW 0x02
534 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_MEDIUM 0x04
535
536 struct necp_interface_signature {
537 u_int8_t signature[IFNET_SIGNATURELEN];
538 u_int8_t signature_len;
539 };
540
541 struct necp_interface_details {
542 char name[IFXNAMSIZ];
543 u_int32_t index;
544 u_int32_t generation;
545 u_int32_t functional_type;
546 u_int32_t delegate_index;
547 u_int32_t flags; // see NECP_INTERFACE_FLAG_*
548 u_int32_t mtu;
549 struct necp_interface_signature ipv4_signature;
550 struct necp_interface_signature ipv6_signature;
551 };
552
553 #define NECP_INTERFACE_FLAG_EXPENSIVE 0x0001
554 #define NECP_INTERFACE_FLAG_TXSTART 0X0002
555 #define NECP_INTERFACE_FLAG_NOACKPRI 0x0004
556
557 struct necp_client_parameter_netagent_type {
558 char netagent_domain[32];
559 char netagent_type[32];
560 };
561
562 struct necp_client_result_netagent {
563 u_int32_t generation;
564 uuid_t netagent_uuid;
565 };
566
567 struct necp_client_result_interface {
568 u_int32_t generation;
569 u_int32_t index;
570 };
571
572 struct necp_client_endpoint {
573 union {
574 struct sockaddr sa;
575 struct sockaddr_in sin;
576 struct sockaddr_in6 sin6;
577 struct {
578 u_int8_t endpoint_length;
579 u_int8_t endpoint_family; // Use AF_UNSPEC to target a name
580 u_int16_t endpoint_port;
581 u_int32_t endpoint_type; // Client-specific type
582 char endpoint_data[0]; // Type-specific endpoint value
583 } endpoint;
584 } u;
585 };
586
587 struct necp_client_list {
588 u_int32_t client_count;
589 uuid_t clients[0];
590 };
591
592 struct kev_necp_policies_changed_data {
593 u_int32_t changed_count; // Defaults to 0.
594 };
595
596 struct necp_agent_use_parameters {
597 uuid_t agent_uuid;
598 uint64_t out_use_count;
599 };
600
601 struct necp_client_flow_protoctl_event {
602 uint32_t protoctl_event_code;
603 uint32_t protoctl_event_val;
604 /* TCP seq number is in host byte order */
605 uint32_t protoctl_event_tcp_seq_num;
606 };
607
608 #define NECP_CLIENT_UPDATE_TYPE_PARAMETERS 1 // Parameters, for a new client
609 #define NECP_CLIENT_UPDATE_TYPE_RESULT 2 // Result, for a udpated client
610 #define NECP_CLIENT_UPDATE_TYPE_REMOVE 3 // Empty, for a removed client
611
612 struct necp_client_observer_update {
613 u_int32_t update_type; // NECP_CLIENT_UPDATE_TYPE_*
614 u_int8_t tlv_buffer[0]; // Parameters or result as TLVs, based on type
615 };
616
617 #ifdef BSD_KERNEL_PRIVATE
618 #include <stdbool.h>
619 #include <sys/socketvar.h>
620 #include <sys/kern_control.h>
621 #include <netinet/ip_var.h>
622 #include <netinet/mp_pcb.h>
623 #include <netinet6/ip6_var.h>
624 #include <net/if_var.h>
625 #include <sys/syslog.h>
626 #include <net/network_agent.h>
627
628 SYSCTL_DECL(_net_necp);
629
630 #define NECPLOG(level, format, ...) do { \
631 log((level > LOG_NOTICE ? LOG_NOTICE : level), "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \
632 } while (0)
633
634 #define NECPLOG0(level, msg) do { \
635 log((level > LOG_NOTICE ? LOG_NOTICE : level), "%s: %s\n", __FUNCTION__, msg); \
636 } while (0)
637
638 enum necp_fd_type_t {
639 necp_fd_type_invalid = 0,
640 necp_fd_type_session = 1,
641 necp_fd_type_client = 2,
642 };
643
644 union necp_sockaddr_union {
645 struct sockaddr sa;
646 struct sockaddr_in sin;
647 struct sockaddr_in6 sin6;
648 };
649
650 /*
651 * kstats
652 * The ustats and kstats region are mirrored. So when we allocate with
653 * skmem_cache from kstats region, we also get an ustats object. To tie them
654 * together, kstats has an extra *necp_stats_ustats pointer pointing to the
655 * ustats object
656 */
657 struct necp_all_kstats {
658 struct necp_all_stats necp_stats_comm; /* kernel private stats snapshot */
659 struct necp_all_stats *necp_stats_ustats; /* points to user-visible stats (in shared ustats region) */
660 };
661
662 extern errno_t necp_client_init(void);
663 extern int necp_application_find_policy_match_internal(proc_t proc, u_int8_t *parameters, u_int32_t parameters_size,
664 struct necp_aggregate_result *returned_result,
665 u_int32_t *flags, u_int required_interface_index,
666 const union necp_sockaddr_union *override_local_addr,
667 const union necp_sockaddr_union *override_remote_addr,
668 struct rtentry **returned_route, bool ignore_address);
669 /*
670 * TLV utilities
671 *
672 * Note that these functions (other than necp_buffer_find_tlv) do not check the length of the entire buffer,
673 * so the caller must be sure that the entire TLV is within bounds.
674 */
675 struct necp_tlv_header {
676 u_int8_t type;
677 u_int32_t length;
678 } __attribute__((__packed__));
679
680 extern u_int8_t *necp_buffer_write_tlv(u_int8_t *cursor, u_int8_t type, u_int32_t length, const void *value,
681 u_int8_t *buffer, u_int32_t buffer_length);
682 extern u_int8_t *necp_buffer_write_tlv_if_different(u_int8_t *cursor, u_int8_t type,
683 u_int32_t length, const void *value, bool *updated,
684 u_int8_t *buffer, u_int32_t buffer_length);
685 extern u_int8_t necp_buffer_get_tlv_type(u_int8_t *buffer, int tlv_offset);
686 extern u_int32_t necp_buffer_get_tlv_length(u_int8_t *buffer, int tlv_offset);
687 extern u_int8_t *necp_buffer_get_tlv_value(u_int8_t *buffer, int tlv_offset, u_int32_t *value_size);
688 extern int necp_buffer_find_tlv(u_int8_t *buffer, u_int32_t buffer_length, int offset, u_int8_t type, int next);
689
690 #define NECPCTL_DROP_ALL_LEVEL 1 /* Drop all packets if no policy matches above this level */
691 #define NECPCTL_DEBUG 2 /* Log all kernel policy matches */
692 #define NECPCTL_PASS_LOOPBACK 3 /* Pass all loopback traffic */
693 #define NECPCTL_PASS_KEEPALIVES 4 /* Pass all kernel-generated keepalive traffic */
694 #define NECPCTL_SOCKET_POLICY_COUNT 5 /* Count of all socket-level policies */
695 #define NECPCTL_SOCKET_NON_APP_POLICY_COUNT 6 /* Count of non-per-app socket-level policies */
696 #define NECPCTL_IP_POLICY_COUNT 7 /* Count of all ip-level policies */
697 #define NECPCTL_SESSION_COUNT 8 /* Count of NECP sessions */
698 #define NECPCTL_CLIENT_FD_COUNT 9 /* Count of NECP client fds */
699 #define NECPCTL_CLIENT_COUNT 10 /* Count of NECP clients */
700 #define NECPCTL_ARENA_COUNT 11 /* Count of NECP arenas (stats, etc) */
701 #define NECPCTL_NEXUS_FLOW_COUNT 12 /* Count of NECP nexus flows */
702 #define NECPCTL_SOCKET_FLOW_COUNT 13 /* Count of NECP socket flows */
703 #define NECPCTL_IF_FLOW_COUNT 14 /* Count of NECP socket flows */
704 #define NECPCTL_OBSERVER_FD_COUNT 15 /* Count of NECP observer fds */
705 #define NECPCTL_OBSERVER_MESSAGE_LIMIT 16 /* Number of of NECP observer messages allowed to be queued */
706 #define NECPCTL_SYSCTL_ARENA_COUNT 17 /* Count of sysctl arenas */
707
708 #define NECPCTL_NAMES { \
709 { 0, 0 }, \
710 { "drop_all_level", CTLTYPE_INT }, \
711 { "debug", CTLTYPE_INT }, \
712 { "pass_loopback", CTLTYPE_INT }, \
713 { "pass_keepalives", CTLTYPE_INT }, \
714 }
715
716 typedef u_int32_t necp_kernel_policy_id;
717 #define NECP_KERNEL_POLICY_ID_NONE 0
718 #define NECP_KERNEL_POLICY_ID_NO_MATCH 1
719 #define NECP_KERNEL_POLICY_ID_FIRST_VALID_SOCKET 2
720 #define NECP_KERNEL_POLICY_ID_FIRST_VALID_IP UINT16_MAX
721
722 typedef u_int32_t necp_app_id;
723
724 #define NECP_KERNEL_POLICY_RESULT_NONE 0
725 #define NECP_KERNEL_POLICY_RESULT_PASS NECP_POLICY_RESULT_PASS
726 #define NECP_KERNEL_POLICY_RESULT_SKIP NECP_POLICY_RESULT_SKIP
727 #define NECP_KERNEL_POLICY_RESULT_DROP NECP_POLICY_RESULT_DROP
728 #define NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT NECP_POLICY_RESULT_SOCKET_DIVERT
729 #define NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER NECP_POLICY_RESULT_SOCKET_FILTER
730 #define NECP_KERNEL_POLICY_RESULT_IP_TUNNEL NECP_POLICY_RESULT_IP_TUNNEL
731 #define NECP_KERNEL_POLICY_RESULT_IP_FILTER NECP_POLICY_RESULT_IP_FILTER
732 #define NECP_KERNEL_POLICY_RESULT_TRIGGER NECP_POLICY_RESULT_TRIGGER
733 #define NECP_KERNEL_POLICY_RESULT_TRIGGER_IF_NEEDED NECP_POLICY_RESULT_TRIGGER_IF_NEEDED
734 #define NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED NECP_POLICY_RESULT_TRIGGER_SCOPED
735 #define NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED NECP_POLICY_RESULT_NO_TRIGGER_SCOPED
736 #define NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED NECP_POLICY_RESULT_SOCKET_SCOPED
737 #define NECP_KERNEL_POLICY_RESULT_ROUTE_RULES NECP_POLICY_RESULT_ROUTE_RULES
738 #define NECP_KERNEL_POLICY_RESULT_USE_NETAGENT NECP_POLICY_RESULT_USE_NETAGENT
739
740 typedef struct {
741 u_int32_t identifier;
742 u_int32_t data;
743 } necp_kernel_policy_service;
744
745 typedef union {
746 u_int tunnel_interface_index;
747 u_int scoped_interface_index;
748 u_int32_t flow_divert_control_unit;
749 u_int32_t filter_control_unit;
750 u_int32_t skip_policy_order;
751 u_int32_t route_rule_id;
752 u_int32_t netagent_id;
753 necp_kernel_policy_service service;
754 } necp_kernel_policy_result_parameter;
755
756 enum necp_boolean_state {
757 necp_boolean_state_unknown = 0,
758 necp_boolean_state_false = 1,
759 necp_boolean_state_true = 2,
760 };
761
762 struct necp_kernel_socket_policy {
763 LIST_ENTRY(necp_kernel_socket_policy) chain;
764 necp_policy_id parent_policy_id;
765 necp_kernel_policy_id id;
766 necp_policy_order order;
767 u_int32_t session_order;
768 int session_pid;
769
770 u_int32_t condition_mask;
771 u_int32_t condition_negated_mask;
772 necp_kernel_policy_id cond_policy_id;
773 u_int32_t cond_app_id; // Locally assigned ID value stored
774 u_int32_t cond_real_app_id; // Locally assigned ID value stored
775 char *cond_custom_entitlement; // String
776 u_int8_t cond_custom_entitlement_matched;// Boolean if entitlement matched app
777 u_int32_t cond_account_id; // Locally assigned ID value stored
778 char *cond_domain; // String
779 u_int8_t cond_domain_dot_count; // Number of dots in cond_domain
780 pid_t cond_pid;
781 uid_t cond_uid;
782 ifnet_t cond_bound_interface; // Matches specific binding only
783 struct necp_policy_condition_tc_range cond_traffic_class; // Matches traffic class in range
784 u_int16_t cond_protocol; // Matches IP protcol number
785 union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
786 union necp_sockaddr_union cond_local_end; // Matches IP address range
787 u_int8_t cond_local_prefix; // Defines subnet
788 union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
789 union necp_sockaddr_union cond_remote_end; // Matches IP address range
790 u_int8_t cond_remote_prefix; // Defines subnet
791
792 necp_kernel_policy_result result;
793 necp_kernel_policy_result_parameter result_parameter;
794 };
795
796 struct necp_kernel_ip_output_policy {
797 LIST_ENTRY(necp_kernel_ip_output_policy) chain;
798 necp_policy_id parent_policy_id;
799 necp_kernel_policy_id id;
800 necp_policy_order suborder;
801 necp_policy_order order;
802 u_int32_t session_order;
803 int session_pid;
804
805 u_int32_t condition_mask;
806 u_int32_t condition_negated_mask;
807 necp_kernel_policy_id cond_policy_id;
808 ifnet_t cond_bound_interface; // Matches specific binding only
809 u_int16_t cond_protocol; // Matches IP protcol number
810 union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
811 union necp_sockaddr_union cond_local_end; // Matches IP address range
812 u_int8_t cond_local_prefix; // Defines subnet
813 union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
814 union necp_sockaddr_union cond_remote_end; // Matches IP address range
815 u_int8_t cond_remote_prefix; // Defines subnet
816 u_int32_t cond_last_interface_index;
817
818 necp_kernel_policy_result result;
819 necp_kernel_policy_result_parameter result_parameter;
820 };
821
822 #define MAX_KERNEL_SOCKET_POLICIES 1
823 #define MAX_KERNEL_IP_OUTPUT_POLICIES 4
824 struct necp_session_policy {
825 LIST_ENTRY(necp_session_policy) chain;
826 bool applied; // Applied into the kernel table
827 bool pending_deletion; // Waiting to be removed from kernel table
828 bool pending_update; // Policy has been modified since creation/last application
829 necp_policy_id id;
830 necp_policy_order order;
831 u_int8_t *result;
832 u_int32_t result_size;
833 u_int8_t *conditions; // Array of conditions, each with a u_int32_t length at start
834 u_int32_t conditions_size;
835 u_int8_t *route_rules; // Array of route rules, each with a u_int32_t length at start
836 u_int32_t route_rules_size;
837
838 uuid_t applied_app_uuid;
839 uuid_t applied_real_app_uuid;
840 char *applied_account;
841
842 uuid_t applied_result_uuid;
843
844 u_int32_t applied_route_rules_id;
845
846 necp_kernel_policy_id kernel_socket_policies[MAX_KERNEL_SOCKET_POLICIES];
847 necp_kernel_policy_id kernel_ip_output_policies[MAX_KERNEL_IP_OUTPUT_POLICIES];
848 };
849
850 struct necp_aggregate_socket_result {
851 necp_kernel_policy_result result;
852 necp_kernel_policy_result_parameter result_parameter;
853 necp_kernel_policy_filter filter_control_unit;
854 u_int32_t route_rule_id;
855 int32_t qos_marking_gencount;
856 };
857
858 struct necp_inpcb_result {
859 u_int32_t app_id;
860 necp_kernel_policy_id policy_id;
861 int32_t policy_gencount;
862 u_int32_t flowhash;
863 struct necp_aggregate_socket_result results;
864 };
865
866 extern errno_t necp_init(void);
867
868 extern errno_t necp_set_socket_attributes(struct socket *so, struct sockopt *sopt);
869 extern errno_t necp_get_socket_attributes(struct socket *so, struct sockopt *sopt);
870 extern void necp_inpcb_remove_cb(struct inpcb *inp);
871 extern void necp_inpcb_dispose(struct inpcb *inp);
872 extern void necp_mppcb_dispose(struct mppcb *mpp);
873
874 extern u_int32_t necp_socket_get_content_filter_control_unit(struct socket *so);
875
876 extern bool necp_socket_should_use_flow_divert(struct inpcb *inp);
877 extern u_int32_t necp_socket_get_flow_divert_control_unit(struct inpcb *inp);
878
879 extern bool necp_socket_should_rescope(struct inpcb *inp);
880 extern u_int necp_socket_get_rescope_if_index(struct inpcb *inp);
881 extern u_int32_t necp_socket_get_effective_mtu(struct inpcb *inp, u_int32_t current_mtu);
882
883 extern bool necp_socket_is_allowed_to_send_recv(struct inpcb *inp, necp_kernel_policy_id *return_policy_id,
884 u_int32_t *return_route_rule_id);
885 extern bool necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port,
886 u_int16_t remote_port, struct in_addr *local_addr,
887 struct in_addr *remote_addr, ifnet_t interface,
888 necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id);
889 extern bool necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port,
890 u_int16_t remote_port, struct in6_addr *local_addr,
891 struct in6_addr *remote_addr, ifnet_t interface,
892 necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id);
893 extern void necp_socket_update_qos_marking(struct inpcb *inp, struct rtentry *route, struct ifnet *interface, u_int32_t route_rule_id);
894 extern int necp_mark_packet_from_socket(struct mbuf *packet, struct inpcb *inp, necp_kernel_policy_id policy_id,
895 u_int32_t route_rule_id);
896 extern necp_kernel_policy_id necp_get_policy_id_from_packet(struct mbuf *packet);
897 extern u_int32_t necp_get_last_interface_index_from_packet(struct mbuf *packet);
898 extern u_int32_t necp_get_route_rule_id_from_packet(struct mbuf *packet);
899 extern int necp_get_app_uuid_from_packet(struct mbuf *packet,
900 uuid_t app_uuid);
901
902 extern necp_kernel_policy_id necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local_addr,
903 struct sockaddr *override_remote_addr, u_int32_t override_bound_interface);
904 extern necp_kernel_policy_id necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_args *ipoa,
905 necp_kernel_policy_result *result,
906 necp_kernel_policy_result_parameter *result_parameter);
907 extern necp_kernel_policy_id necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out_args *ip6oa,
908 necp_kernel_policy_result *result,
909 necp_kernel_policy_result_parameter *result_parameter);
910
911 extern int necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id);
912 extern int necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface);
913
914 extern ifnet_t necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter);
915 extern bool necp_packet_can_rebind_to_ifnet(struct mbuf *packet, struct ifnet *interface, struct route *new_route, int family);
916
917 extern bool necp_packet_is_allowed_over_interface(struct mbuf *packet, struct ifnet *interface);
918
919 extern int necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive);
920 extern bool necp_get_is_keepalive_from_packet(struct mbuf *packet);
921
922 extern void necp_update_all_clients(void); // Handle general re-evaluate event
923
924 extern void necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid); // Cause a single client to get an update event
925
926 extern void necp_client_early_close(uuid_t client_id); // Cause a single client to close stats, etc
927
928 extern void necp_set_client_as_background(proc_t proc, struct fileproc *fp, bool background); // Set all clients for an fp as background or not
929
930 extern void necp_defunct_client(proc_t proc, struct fileproc *fp); // Set all clients for an fp as defunct
931
932 extern int necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp);
933
934 extern int necp_client_register_multipath_cb(pid_t pid, uuid_t client_id, struct mppcb *mpp);
935
936 extern int necp_client_assign_from_socket(pid_t pid, uuid_t client_id, struct inpcb *inp);
937
938 extern int necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id,
939 u_int8_t *assigned_results, size_t assigned_results_length);
940 struct skmem_obj_info; // forward declaration
941 extern int necp_stats_ctor(struct skmem_obj_info *oi, struct skmem_obj_info *oim, void *arg, uint32_t skmflag);
942 extern int necp_stats_dtor(void *addr, void *arg);
943
944 /* value to denote invalid flow advisory index */
945 struct netagent_session;
946 extern int
947 necp_update_flow_protoctl_event(uuid_t netagent_uuid, uuid_t client_id,
948 uint32_t protoctl_event_code, uint32_t protoctl_event_val,
949 uint32_t protoctl_event_tcp_seq_num);
950
951 #define NECP_FLOWADV_IDX_INVALID UINT32_MAX
952 extern void *necp_create_nexus_assign_message(uuid_t nexus_instance, u_int32_t nexus_port, void *key, uint32_t key_length,
953 struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint,
954 u_int32_t flow_adv_index, size_t *message_length);
955
956 struct necp_client_nexus_parameters {
957 pid_t pid;
958 pid_t epid;
959 uuid_t euuid;
960 union necp_sockaddr_union local_addr;
961 union necp_sockaddr_union remote_addr;
962 u_int16_t ip_protocol;
963 u_int32_t traffic_class;
964 necp_policy_id policy_id;
965 unsigned is_listener:1;
966 unsigned allow_qos_marking:1;
967 };
968
969 extern int necp_client_copy_parameters(uuid_t client_uuid, struct necp_client_nexus_parameters *parameters);
970
971 #define NECP_CLIENT_CBACTION_NONVIABLE 1
972 #define NECP_CLIENT_CBACTION_VIABLE 2
973 #define NECP_CLIENT_CBACTION_INITIAL 3
974
975 struct necp_client_flow {
976 LIST_ENTRY(necp_client_flow) flow_chain;
977 unsigned invalid : 1;
978 unsigned nexus : 1; // If true, flow is a nexus; if false, flow is attached to socket
979 unsigned socket : 1;
980 unsigned viable : 1;
981 unsigned requested_nexus : 1;
982 unsigned assigned : 1;
983 unsigned has_protoctl_event : 1;
984 unsigned check_tcp_heuristics : 1;
985 union {
986 uuid_t nexus_agent;
987 struct {
988 void *socket_handle;
989 void (*cb)(void *handle, int action, struct necp_client_flow *flow);
990 };
991 } u;
992 uint32_t interface_index;
993 uint16_t interface_flags;
994 uint32_t necp_flow_flags;
995 struct necp_client_flow_protoctl_event protoctl_event;
996 union necp_sockaddr_union local_addr;
997 union necp_sockaddr_union remote_addr;
998
999 size_t assigned_results_length;
1000 u_int8_t *assigned_results;
1001 };
1002 #endif /* BSD_KERNEL_PRIVATE */
1003 #ifndef KERNEL
1004
1005 extern int necp_match_policy(const uint8_t *parameters, size_t parameters_size, struct necp_aggregate_result *returned_result);
1006
1007 extern int necp_open(int flags);
1008
1009 extern int necp_client_action(int necp_fd, uint32_t action, uuid_t client_id,
1010 size_t client_id_len, uint8_t *buffer, size_t buffer_size);
1011
1012 extern int necp_session_open(int flags);
1013
1014 extern int necp_session_action(int necp_fd, uint32_t action,
1015 uint8_t *in_buffer, size_t in_buffer_length,
1016 uint8_t *out_buffer, size_t out_buffer_length);
1017
1018 #endif /* !KERNEL */
1019
1020 #endif /* PRIVATE */
1021
1022 #endif
mirror of XNU