]> git.saurik.com Git - apple/xnu.git/blob - bsd/net/necp.h
projects / apple / xnu.git / blob
? search:


c2f39c6af5346d063985e6b2bf709bee8919ae3a
[apple/xnu.git] / bsd / net / necp.h
1 /*
2 * Copyright (c) 2013-2020 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #ifndef _NET_NECP_H_
30 #define _NET_NECP_H_
31
32 #include <net/net_kev.h>
33 #ifdef PRIVATE
34
35 #include <netinet/in.h>
36 #include <netinet/in_stat.h>
37 #include <sys/socket.h>
38 #include <net/if.h>
39
40 /*
41 * Name registered by the NECP
42 */
43 #define NECP_CONTROL_NAME "com.apple.net.necp_control"
44
45 #define NECP_TLV_LENGTH_UINT32 1
46
47 struct necp_packet_header {
48 u_int8_t packet_type;
49 u_int8_t flags;
50 u_int32_t message_id;
51 };
52
53 /*
54 * Control message commands
55 */
56 #define NECP_PACKET_TYPE_POLICY_ADD 1
57 #define NECP_PACKET_TYPE_POLICY_GET 2
58 #define NECP_PACKET_TYPE_POLICY_DELETE 3
59 #define NECP_PACKET_TYPE_POLICY_APPLY_ALL 4
60 #define NECP_PACKET_TYPE_POLICY_LIST_ALL 5
61 #define NECP_PACKET_TYPE_POLICY_DELETE_ALL 6
62 #define NECP_PACKET_TYPE_SET_SESSION_PRIORITY 7
63 #define NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC 8
64 #define NECP_PACKET_TYPE_REGISTER_SERVICE 9
65 #define NECP_PACKET_TYPE_UNREGISTER_SERVICE 10
66 #define NECP_PACKET_TYPE_POLICY_DUMP_ALL 11
67
68 /*
69 * Session actions
70 */
71 #define NECP_SESSION_ACTION_POLICY_ADD 1 // In: Policy TLVs Out: necp_policy_id
72 #define NECP_SESSION_ACTION_POLICY_GET 2 // In: necp_policy_id Out: Policy TLVs
73 #define NECP_SESSION_ACTION_POLICY_DELETE 3 // In: necp_policy_id Out: None
74 #define NECP_SESSION_ACTION_POLICY_APPLY_ALL 4 // In: None Out: None
75 #define NECP_SESSION_ACTION_POLICY_LIST_ALL 5 // In: None Out: TLVs of IDs
76 #define NECP_SESSION_ACTION_POLICY_DELETE_ALL 6 // In: None Out: None
77 #define NECP_SESSION_ACTION_SET_SESSION_PRIORITY 7 // In: necp_session_priority Out: None
78 #define NECP_SESSION_ACTION_LOCK_SESSION_TO_PROC 8 // In: None Out: None
79 #define NECP_SESSION_ACTION_REGISTER_SERVICE 9 // In: uuid_t Out: None
80 #define NECP_SESSION_ACTION_UNREGISTER_SERVICE 10 // In: uuid_t Out: None
81 #define NECP_SESSION_ACTION_POLICY_DUMP_ALL 11 // In: None Out: uint32_t bytes length, then Policy TLVs
82
83 /*
84 * Control message flags
85 */
86 #define NECP_PACKET_FLAGS_RESPONSE 0x01 // Used for acks, errors, and query responses
87
88 /*
89 * Control message TLV types
90 */
91 #define NECP_TLV_NIL 0
92 #define NECP_TLV_ERROR 1 // u_int32_t
93 #define NECP_TLV_POLICY_ORDER 2 // u_int32_t
94 #define NECP_TLV_POLICY_CONDITION 3
95 #define NECP_TLV_POLICY_RESULT 4
96 #define NECP_TLV_POLICY_ID 5 // u_int32_t
97 #define NECP_TLV_SESSION_PRIORITY 6 // u_int32_t
98 #define NECP_TLV_ATTRIBUTE_DOMAIN 7 // char[]
99 #define NECP_TLV_ATTRIBUTE_ACCOUNT 8 // char[]
100 #define NECP_TLV_SERVICE_UUID 9 // uuid_t
101 #define NECP_TLV_ROUTE_RULE 10
102
103 /*
104 * Control message TLV sent only by the kernel to userspace
105 */
106 #define NECP_TLV_POLICY_OWNER 100 // char []
107 #define NECP_TLV_POLICY_DUMP 101
108 #define NECP_TLV_POLICY_RESULT_STRING 102 // char []
109 #define NECP_TLV_POLICY_SESSION_ORDER 103 // u_int32_t
110
111 /*
112 * Condition flags
113 */
114 #define NECP_POLICY_CONDITION_FLAGS_NEGATIVE 0x01 // Negative
115
116 /*
117 * Conditions
118 * Used for setting policies as well as passing parameters to necp_match_policy.
119 */
120 #define NECP_POLICY_CONDITION_DEFAULT 0 // N/A, not valid with any other conditions
121 // Socket/Application conditions
122 #define NECP_POLICY_CONDITION_APPLICATION 1 // uuid_t, uses effective UUID when possible
123 #define NECP_POLICY_CONDITION_REAL_APPLICATION 2 // uuid_t, never uses effective UUID. Only valid with NECP_POLICY_CONDITION_APPLICATION
124 #define NECP_POLICY_CONDITION_DOMAIN 3 // String, such as apple.com
125 #define NECP_POLICY_CONDITION_ACCOUNT 4 // String
126 #define NECP_POLICY_CONDITION_ENTITLEMENT 5 // String
127 #define NECP_POLICY_CONDITION_PID 6 // pid_t
128 #define NECP_POLICY_CONDITION_UID 7 // uid_t
129 #define NECP_POLICY_CONDITION_ALL_INTERFACES 8 // N/A
130 #define NECP_POLICY_CONDITION_BOUND_INTERFACE 9 // String
131 #define NECP_POLICY_CONDITION_TRAFFIC_CLASS 10 // necp_policy_condition_tc_range
132 // Socket/IP conditions
133 #define NECP_POLICY_CONDITION_IP_PROTOCOL 11 // u_int16_t
134 #define NECP_POLICY_CONDITION_LOCAL_ADDR 12 // necp_policy_condition_addr
135 #define NECP_POLICY_CONDITION_REMOTE_ADDR 13 // necp_policy_condition_addr
136 #define NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE 14 // necp_policy_condition_addr_range
137 #define NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE 15 // necp_policy_condition_addr_range
138 #define NECP_POLICY_CONDITION_AGENT_TYPE 16 // struct necp_policy_condition_agent_type
139 #define NECP_POLICY_CONDITION_HAS_CLIENT 17 // N/A
140 #define NECP_POLICY_CONDITION_LOCAL_NETWORKS 18 // Matches all local networks
141 // Socket-only conditions
142 #define NECP_POLICY_CONDITION_FLOW_IP_PROTOCOL 19 // u_int16_t
143 #define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR 20 // necp_policy_condition_addr
144 #define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR 21 // necp_policy_condition_addr
145 #define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_RANGE 22 // necp_policy_condition_addr_range
146 #define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_RANGE 23 // necp_policy_condition_addr_range
147 #define NECP_POLICY_CONDITION_FLOW_IS_LOOPBACK 31 // N/A
148 // Socket/Application conditions, continued
149 #define NECP_POLICY_CONDITION_CLIENT_FLAGS 24 // u_int32_t, values from NECP_CLIENT_PARAMETER_FLAG_*
150 #define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_EMPTY 25 // N/A
151 #define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_EMPTY 26 // N/A
152 #define NECP_POLICY_CONDITION_PLATFORM_BINARY 27 // N/A
153 #define NECP_POLICY_CONDITION_SDK_VERSION 28 // struct necp_policy_condition_sdk_version
154 #define NECP_POLICY_CONDITION_SIGNING_IDENTIFIER 29 // String
155 #define NECP_POLICY_CONDITION_PACKET_FILTER_TAGS 30 // u_int16_t
156
157 /*
158 * Policy Packet tags
159 */
160 #define NECP_POLICY_CONDITION_PACKET_FILTER_TAG_STACK_DROP 0x01
161 #define NECP_POLICY_CONDITION_PACKET_FILTER_TAG_MAX NECP_POLICY_CONDITION_PACKET_FILTER_TAG_STACK_DROP
162
163 /*
164 * Results
165 */
166 #define NECP_POLICY_RESULT_PASS 1 // N/A
167 #define NECP_POLICY_RESULT_SKIP 2 // u_int32_t, policy order to skip to. 0 to skip all session policies.
168 #define NECP_POLICY_RESULT_DROP 3 // N/A
169 #define NECP_POLICY_RESULT_SOCKET_DIVERT 4 // u_int32_t, flow divert control unit
170 #define NECP_POLICY_RESULT_SOCKET_FILTER 5 // u_int32_t, filter control unit
171 #define NECP_POLICY_RESULT_IP_TUNNEL 6 // String, interface name
172 #define NECP_POLICY_RESULT_IP_FILTER 7 // ?
173 #define NECP_POLICY_RESULT_TRIGGER 8 // service uuid_t
174 #define NECP_POLICY_RESULT_TRIGGER_IF_NEEDED 9 // service uuid_t
175 #define NECP_POLICY_RESULT_TRIGGER_SCOPED 10 // service uuid_t
176 #define NECP_POLICY_RESULT_NO_TRIGGER_SCOPED 11 // service uuid_t
177 #define NECP_POLICY_RESULT_SOCKET_SCOPED 12 // String, interface name
178 #define NECP_POLICY_RESULT_ROUTE_RULES 13 // N/A, must have route rules defined
179 #define NECP_POLICY_RESULT_USE_NETAGENT 14 // netagent uuid_t
180 #define NECP_POLICY_RESULT_NETAGENT_SCOPED 15 // netagent uuid_t
181 #define NECP_POLICY_RESULT_SCOPED_DIRECT 16 // N/A, scopes to primary physical interface
182 #define NECP_POLICY_RESULT_ALLOW_UNENTITLED 17 // N/A
183
184 #define NECP_POLICY_RESULT_MAX NECP_POLICY_RESULT_ALLOW_UNENTITLED
185
186 /*
187 * PASS Result Flags
188 */
189 #define NECP_POLICY_PASS_NO_SKIP_IPSEC 0x01
190 #define NECP_POLICY_PASS_PF_TAG 0x02
191
192 /*
193 * DROP Result Flags
194 */
195 #define NECP_POLICY_DROP_FLAG_LOCAL_NETWORK 0x01
196
197 /*
198 * Route Rules
199 * Detailed parameters for NECP_POLICY_RESULT_ROUTE_RULES.
200 */
201 #define NECP_ROUTE_RULE_NONE 0 // N/A
202 #define NECP_ROUTE_RULE_DENY_INTERFACE 1 // String, or empty to match all
203 #define NECP_ROUTE_RULE_ALLOW_INTERFACE 2 // String, or empty to match all
204 #define NECP_ROUTE_RULE_QOS_MARKING 3 // String, or empty to match all
205 #define NECP_ROUTE_RULE_DENY_LQM_ABORT 4 // String, or empty to match all
206
207 #define NECP_ROUTE_RULE_FLAG_CELLULAR 0x01
208 #define NECP_ROUTE_RULE_FLAG_WIFI 0x02
209 #define NECP_ROUTE_RULE_FLAG_WIRED 0x04
210 #define NECP_ROUTE_RULE_FLAG_EXPENSIVE 0x08
211 #define NECP_ROUTE_RULE_FLAG_CONSTRAINED 0x10
212
213 /*
214 * Error types
215 */
216 #define NECP_ERROR_INTERNAL 0
217 #define NECP_ERROR_UNKNOWN_PACKET_TYPE 1
218 #define NECP_ERROR_INVALID_TLV 2
219 #define NECP_ERROR_POLICY_RESULT_INVALID 3
220 #define NECP_ERROR_POLICY_CONDITIONS_INVALID 4
221 #define NECP_ERROR_POLICY_ID_NOT_FOUND 5
222 #define NECP_ERROR_INVALID_PROCESS 6
223 #define NECP_ERROR_ROUTE_RULES_INVALID 7
224
225 // Modifiers
226 #define NECP_MASK_USERSPACE_ONLY 0x80000000 // on filter_control_unit value
227
228 struct necp_policy_condition_tc_range {
229 u_int32_t start_tc;
230 u_int32_t end_tc;
231 } __attribute__((__packed__));
232
233 struct necp_policy_condition_addr {
234 u_int8_t prefix;
235 union {
236 struct sockaddr sa;
237 struct sockaddr_in sin;
238 struct sockaddr_in6 sin6;
239 } address;
240 } __attribute__((__packed__));
241
242 struct necp_policy_condition_addr_range {
243 union {
244 struct sockaddr sa;
245 struct sockaddr_in sin;
246 struct sockaddr_in6 sin6;
247 } start_address;
248 union {
249 struct sockaddr sa;
250 struct sockaddr_in sin;
251 struct sockaddr_in6 sin6;
252 } end_address;
253 } __attribute__((__packed__));
254
255 struct necp_policy_condition_agent_type {
256 char agent_domain[32];
257 char agent_type[32];
258 } __attribute__((__packed__));
259
260 struct necp_policy_condition_sdk_version {
261 uint32_t platform; // e.g., PLATFORM_IOS
262 uint32_t min_version; // Encoded as XXXX.YY.ZZ
263 uint32_t version; // Encoded as XXXX.YY.ZZ
264 } __attribute__((__packed__));
265
266 #define NECP_SESSION_PRIORITY_UNKNOWN 0
267 #define NECP_SESSION_PRIORITY_CONTROL 1
268 #define NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL 2
269 #define NECP_SESSION_PRIORITY_HIGH 3
270 #define NECP_SESSION_PRIORITY_HIGH_1 4
271 #define NECP_SESSION_PRIORITY_HIGH_2 5
272 #define NECP_SESSION_PRIORITY_HIGH_3 6
273 #define NECP_SESSION_PRIORITY_HIGH_4 7
274 #define NECP_SESSION_PRIORITY_HIGH_RESTRICTED 8
275 #define NECP_SESSION_PRIORITY_DEFAULT 9
276 #define NECP_SESSION_PRIORITY_LOW 10
277 #define NECP_SESSION_NUM_PRIORITIES NECP_SESSION_PRIORITY_LOW
278
279 typedef u_int32_t necp_policy_id;
280 typedef u_int32_t necp_policy_order;
281 typedef u_int32_t necp_session_priority;
282
283 typedef u_int32_t necp_kernel_policy_result;
284 typedef u_int32_t necp_kernel_policy_filter;
285
286 typedef union {
287 u_int tunnel_interface_index;
288 u_int scoped_interface_index;
289 u_int32_t flow_divert_control_unit;
290 u_int32_t filter_control_unit;
291 u_int32_t pass_flags;
292 u_int32_t drop_flags;
293 } necp_kernel_policy_routing_result_parameter;
294
295 #define NECP_SERVICE_FLAGS_REGISTERED 0x01
296 #define NECP_MAX_NETAGENTS 8
297
298 #define NECP_AGENT_USE_FLAG_SCOPE 0x01
299
300 #define NECP_TFO_COOKIE_LEN_MAX 16
301 struct necp_aggregate_result {
302 necp_kernel_policy_result routing_result;
303 necp_kernel_policy_routing_result_parameter routing_result_parameter;
304 necp_kernel_policy_filter filter_control_unit;
305 u_int32_t flow_divert_aggregate_unit;
306 necp_kernel_policy_result service_action;
307 uuid_t service_uuid;
308 u_int32_t service_flags;
309 u_int32_t service_data;
310 u_int routed_interface_index;
311 u_int32_t policy_id;
312 uuid_t netagents[NECP_MAX_NETAGENTS];
313 u_int32_t netagent_use_flags[NECP_MAX_NETAGENTS];
314 u_int8_t mss_recommended;
315 };
316
317 /*
318 * Statistics. It would be nice if the definitions in ntstat.h could be used,
319 * but they get entangled with #defines for v4 etc in pfvar.h and it may be better practice
320 * to have separate definitions here.
321 */
322 struct necp_stat_counts {
323 /* Counters */
324 u_int64_t necp_stat_rxpackets __attribute__((aligned(8)));
325 u_int64_t necp_stat_rxbytes __attribute__((aligned(8)));
326 u_int64_t necp_stat_txpackets __attribute__((aligned(8)));
327 u_int64_t necp_stat_txbytes __attribute__((aligned(8)));
328
329 u_int32_t necp_stat_rxduplicatebytes;
330 u_int32_t necp_stat_rxoutoforderbytes;
331 u_int32_t necp_stat_txretransmit;
332
333 u_int32_t necp_stat_connectattempts;
334 u_int32_t necp_stat_connectsuccesses;
335
336 u_int32_t necp_stat_min_rtt;
337 u_int32_t necp_stat_avg_rtt;
338 u_int32_t necp_stat_var_rtt;
339
340 #define NECP_STAT_ROUTE_FLAGS 1
341 u_int32_t necp_stat_route_flags;
342 };
343
344 // Note, some metadata is implicit in the necp client itself:
345 // From the process itself : pid, upid, uuid, proc name.
346 // From the necp client parameters: local and remote addresses, euuid, traffic class, ifindex
347 //
348 // The following may well be supplied via future necp client parameters,
349 // but they are here so they don't get forgotten.
350 struct necp_basic_metadata {
351 u_int32_t rcvbufsize;
352 u_int32_t rcvbufused;
353 };
354
355 struct necp_connection_probe_status {
356 unsigned int probe_activated : 1;
357 unsigned int write_probe_failed : 1;
358 unsigned int read_probe_failed : 1;
359 unsigned int conn_probe_failed : 1;
360 };
361
362 struct necp_extra_tcp_metadata {
363 struct necp_connection_probe_status probestatus;
364
365 u_int32_t sndbufsize;
366 u_int32_t sndbufused;
367 u_int32_t txunacked;
368 u_int32_t txwindow;
369 u_int32_t txcwindow;
370 u_int32_t flags; // use SOF_*
371 u_int32_t flags1; // use SOF1_*
372 u_int32_t traffic_mgt_flags;
373 u_int32_t cc_alg_index;
374 u_int32_t state;
375 };
376
377 struct necp_stats_hdr {
378 u_int32_t necp_stats_type __attribute__((aligned(8)));
379 u_int32_t necp_stats_ver;
380 u_int64_t __necp_stats_reserved; // Pad the field for future use
381 };
382
383 #define NECP_CLIENT_STATISTICS_TYPE_TCP 1 // Identifies use of necp_tcp_stats
384 #define NECP_CLIENT_STATISTICS_TYPE_UDP 2 // Identifies use of necp_udp_stats
385 #define NECP_CLIENT_STATISTICS_TYPE_QUIC 3 // Identifies use of necp_quic_stats
386
387 #define NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1 1 // Currently supported version for TCP
388 #define NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1 1 // Currently supported version for UDP
389 #define NECP_CLIENT_STATISTICS_TYPE_QUIC_VER_1 1 // Currently supported version for QUIC
390
391 #define NECP_CLIENT_STATISTICS_TYPE_TCP_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1
392 #define NECP_CLIENT_STATISTICS_TYPE_UDP_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1
393 #define NECP_CLIENT_STATISTICS_TYPE_QUIC_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_QUIC_VER_1
394
395 #define NECP_CLIENT_STATISTICS_EVENT_INIT 0x00000000 // Register the flow
396 #define NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT 0x00000001 // The flow is effectively finished but waiting on timer
397
398 struct necp_tcp_stats {
399 struct necp_stats_hdr necp_tcp_hdr;
400 struct necp_stat_counts necp_tcp_counts;
401 struct necp_basic_metadata necp_tcp_basic;
402 struct necp_extra_tcp_metadata necp_tcp_extra;
403 };
404
405 struct necp_udp_stats {
406 struct necp_stats_hdr necp_udp_hdr;
407 struct necp_stat_counts necp_udp_counts;
408 struct necp_basic_metadata necp_udp_basic;
409 };
410
411
412 /*
413 * The following reflects the special case for QUIC.
414 * It is a streaming protocol built on top of UDP.
415 * Therefore QUIC stats are defined as basic UDP stats
416 * with some extra meta data.
417 * TODO: For now the extra metadata is an exact replica
418 * of the metadata for TCP. However keeping that separate allows
419 * the structures to diverge later as new stats are added.
420 */
421 #define QUIC_STATELESS_RESET_TOKEN_SIZE 16
422 struct necp_extra_quic_metadata {
423 u_int32_t sndbufsize;
424 u_int32_t sndbufused;
425 u_int32_t txunacked;
426 u_int32_t txwindow;
427 u_int32_t txcwindow;
428 u_int32_t traffic_mgt_flags;
429 u_int32_t cc_alg_index;
430 u_int32_t state;
431 u_int8_t ssr_token[QUIC_STATELESS_RESET_TOKEN_SIZE];
432 };
433
434 #define necp_quic_hdr necp_quic_udp_stats.necp_udp_hdr
435 #define necp_quic_counts necp_quic_udp_stats.necp_udp_counts
436 #define necp_quic_basic necp_quic_udp_stats.necp_udp_basic
437 struct necp_quic_stats {
438 struct necp_udp_stats necp_quic_udp_stats;
439 struct necp_extra_quic_metadata necp_quic_extra;
440 };
441
442 typedef struct necp_all_stats {
443 union {
444 struct necp_tcp_stats tcp_stats;
445 struct necp_udp_stats udp_stats;
446 struct necp_quic_stats quic_stats;
447 } all_stats_u;
448 } necp_all_stats;
449
450 // Memory for statistics is requested via a necp_stats_bufreq
451 //
452 struct necp_stats_bufreq {
453 u_int32_t necp_stats_bufreq_id __attribute__((aligned(8)));
454 u_int32_t necp_stats_bufreq_type; // NECP_CLIENT_STATISTICS_TYPE_*
455 u_int32_t necp_stats_bufreq_ver; // NECP_CLIENT_STATISTICS_TYPE_*_VER
456 u_int32_t necp_stats_bufreq_size;
457 union {
458 void *necp_stats_bufreq_addr;
459 mach_vm_address_t necp_stats_bufreq_uaddr;
460 };
461 };
462
463 #define NECP_CLIENT_STATISTICS_BUFREQ_ID 0xbf // Distinguishes from statistics actions taking a necp_all_stats struct
464
465 // There is a limit to the number of statistics structures that may be allocated per process, subject to change
466 //
467 #define NECP_MAX_PER_PROCESS_CLIENT_STATISTICS_STRUCTS 512
468
469 #define NECP_TCP_ECN_HEURISTICS_SYN_RST 1
470 typedef struct necp_tcp_ecn_cache {
471 u_int8_t necp_tcp_ecn_heuristics_success:1;
472 u_int8_t necp_tcp_ecn_heuristics_loss:1;
473 u_int8_t necp_tcp_ecn_heuristics_drop_rst:1;
474 u_int8_t necp_tcp_ecn_heuristics_drop_rxmt:1;
475 u_int8_t necp_tcp_ecn_heuristics_aggressive:1;
476 u_int8_t necp_tcp_ecn_heuristics_syn_rst:1;
477 } necp_tcp_ecn_cache;
478
479 #define NECP_TCP_TFO_HEURISTICS_RST 1
480 typedef struct necp_tcp_tfo_cache {
481 u_int8_t necp_tcp_tfo_cookie[NECP_TFO_COOKIE_LEN_MAX];
482 u_int8_t necp_tcp_tfo_cookie_len;
483 u_int8_t necp_tcp_tfo_heuristics_success:1; // TFO succeeded with data in the SYN
484 u_int8_t necp_tcp_tfo_heuristics_loss:1; // TFO SYN-loss with data
485 u_int8_t necp_tcp_tfo_heuristics_middlebox:1; // TFO middlebox detected
486 u_int8_t necp_tcp_tfo_heuristics_success_req:1; // TFO succeeded with the TFO-option in the SYN
487 u_int8_t necp_tcp_tfo_heuristics_loss_req:1; // TFO SYN-loss with the TFO-option
488 u_int8_t necp_tcp_tfo_heuristics_rst_data:1; // Recevied RST upon SYN with data in the SYN
489 u_int8_t necp_tcp_tfo_heuristics_rst_req:1; // Received RST upon SYN with the TFO-option
490 } necp_tcp_tfo_cache;
491
492 #define NECP_CLIENT_CACHE_TYPE_ECN 1 // Identifies use of necp_tcp_ecn_cache
493 #define NECP_CLIENT_CACHE_TYPE_TFO 2 // Identifies use of necp_tcp_tfo_cache
494
495 #define NECP_CLIENT_CACHE_TYPE_ECN_VER_1 1 // Currently supported version for ECN
496 #define NECP_CLIENT_CACHE_TYPE_TFO_VER_1 1 // Currently supported version for TFO
497
498 typedef struct necp_cache_buffer {
499 u_int8_t necp_cache_buf_type; // NECP_CLIENT_CACHE_TYPE_*
500 u_int8_t necp_cache_buf_ver; // NECP_CLIENT_CACHE_TYPE_*_VER
501 u_int32_t necp_cache_buf_size;
502 mach_vm_address_t necp_cache_buf_addr;
503 } necp_cache_buffer;
504
505 /*
506 * NECP Client definitions
507 */
508 #define NECP_MAX_CLIENT_PARAMETERS_SIZE 1024
509 #define NECP_MAX_CLIENT_RESULT_SIZE 512
510
511 #define NECP_OPEN_FLAG_OBSERVER 0x01 // Observers can query clients they don't own
512 #define NECP_OPEN_FLAG_BACKGROUND 0x02 // Mark this fd as backgrounded
513 #define NECP_OPEN_FLAG_PUSH_OBSERVER 0x04 // When used with the OBSERVER flag, allows updates to be pushed. Adding clients is not allowed in this mode.
514
515 #define NECP_FD_SUPPORTS_GUARD 1
516
517 #define NECP_CLIENT_ACTION_ADD 1 // Register a new client. Input: parameters in buffer; Output: client_id
518 #define NECP_CLIENT_ACTION_REMOVE 2 // Unregister a client. Input: client_id, optional struct ifnet_stats_per_flow
519 #define NECP_CLIENT_ACTION_COPY_PARAMETERS 3 // Copy client parameters. Input: client_id; Output: parameters in buffer
520 #define NECP_CLIENT_ACTION_COPY_RESULT 4 // Copy client result. Input: client_id; Output: result in buffer
521 #define NECP_CLIENT_ACTION_COPY_LIST 5 // Copy all client IDs. Output: struct necp_client_list in buffer
522 #define NECP_CLIENT_ACTION_REQUEST_NEXUS_INSTANCE 6 // Request a nexus instance from a nexus provider, optional struct necp_stats_bufreq
523 #define NECP_CLIENT_ACTION_AGENT 7 // Interact with agent. Input: client_id, agent parameters
524 #define NECP_CLIENT_ACTION_COPY_AGENT 8 // Copy agent content. Input: agent UUID; Output: struct netagent
525 #define NECP_CLIENT_ACTION_COPY_INTERFACE 9 // Copy interface details. Input: ifindex cast to UUID; Output: struct necp_interface_details
526 #define NECP_CLIENT_ACTION_SET_STATISTICS 10 // Deprecated
527 #define NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS 11 // Get route statistics. Input: client_id; Output: struct necp_stat_counts
528 #define NECP_CLIENT_ACTION_AGENT_USE 12 // Return the use count and increment the use count. Input/Output: struct necp_agent_use_parameters
529 #define NECP_CLIENT_ACTION_MAP_SYSCTLS 13 // Get the read-only sysctls memory location. Output: mach_vm_address_t
530 #define NECP_CLIENT_ACTION_UPDATE_CACHE 14 // Update heuristics and cache
531 #define NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE 15 // Fetch an updated client for push-mode observer. Output: Client id, struct necp_client_observer_update in buffer
532 #define NECP_CLIENT_ACTION_COPY_UPDATED_RESULT 16 // Copy client result only if changed. Input: client_id; Output: result in buffer
533 #define NECP_CLIENT_ACTION_ADD_FLOW 17 // Add a flow. Input: client_id; Output: struct necp_client_add_flow
534 #define NECP_CLIENT_ACTION_REMOVE_FLOW 18 // Remove a flow. Input: flow_id, optional struct ifnet_stats_per_flow
535 #define NECP_CLIENT_ACTION_CLAIM 19 // Claim a client that has been added for this unique PID. Input: client_id
536 #define NECP_CLIENT_ACTION_SIGN 20 // Sign a resolver answer. Input: struct necp_client_resolver_answer; Output: signed tag, expected to be 32 bytes
537 #define NECP_CLIENT_ACTION_GET_INTERFACE_ADDRESS 21 // Get the best interface local address for given remote address. Input: ifindex, remote sockaddr; Output: matching local sockaddr
538
539 #define NECP_CLIENT_PARAMETER_APPLICATION NECP_POLICY_CONDITION_APPLICATION // Requires entitlement
540 #define NECP_CLIENT_PARAMETER_REAL_APPLICATION NECP_POLICY_CONDITION_REAL_APPLICATION // Requires entitlement
541 #define NECP_CLIENT_PARAMETER_DOMAIN NECP_POLICY_CONDITION_DOMAIN
542 #define NECP_CLIENT_PARAMETER_ACCOUNT NECP_POLICY_CONDITION_ACCOUNT
543 #define NECP_CLIENT_PARAMETER_PID NECP_POLICY_CONDITION_PID // Requires entitlement
544 #define NECP_CLIENT_PARAMETER_UID NECP_POLICY_CONDITION_UID // Requires entitlement
545 #define NECP_CLIENT_PARAMETER_BOUND_INTERFACE NECP_POLICY_CONDITION_BOUND_INTERFACE
546 #define NECP_CLIENT_PARAMETER_TRAFFIC_CLASS NECP_POLICY_CONDITION_TRAFFIC_CLASS
547 #define NECP_CLIENT_PARAMETER_IP_PROTOCOL NECP_POLICY_CONDITION_IP_PROTOCOL
548 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS NECP_POLICY_CONDITION_LOCAL_ADDR
549 #define NECP_CLIENT_PARAMETER_REMOTE_ADDRESS NECP_POLICY_CONDITION_REMOTE_ADDR
550 #define NECP_CLIENT_PARAMETER_NEXUS_KEY 102
551
552 // "Prohibit" will never choose an interface with that property
553 #define NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE 100 // String, interface name
554 #define NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE 101 // u_int8_t, see ifru_functional_type in <net/if.h>
555 #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT 102 // uuid_t, network agent UUID
556 #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE 103 // struct necp_client_parameter_netagent_type
557
558 // "Require" will choose an interface with that property, or none if not found
559 #define NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE 111 // u_int8_t, see ifru_functional_type in <net/if.h>
560 #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT 112 // uuid_t, network agent UUID
561 #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE 113 // struct necp_client_parameter_netagent_type
562
563 // "Prefer" will choose an interface with an agent, or best otherwise if not found
564 #define NECP_CLIENT_PARAMETER_PREFER_AGENT 122 // uuid_t, network agent UUID
565 #define NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE 123 // struct necp_client_parameter_netagent_type
566
567 // "Avoid" will choose an interface without an agent, or best otherwise if unavoidable
568 #define NECP_CLIENT_PARAMETER_AVOID_AGENT 124 // uuid_t, network agent UUID
569 #define NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE 125 // struct necp_client_parameter_netagent_type
570
571 // Use actions with NECP_CLIENT_ACTION_AGENT
572 #define NECP_CLIENT_PARAMETER_TRIGGER_AGENT 130 // uuid_t, network agent UUID
573 #define NECP_CLIENT_PARAMETER_ASSERT_AGENT 131 // uuid_t, network agent UUID
574 #define NECP_CLIENT_PARAMETER_UNASSERT_AGENT 132 // uuid_t, network agent UUID
575
576 #define NECP_CLIENT_PARAMETER_PARENT_ID 150 // uuid_t, client UUID
577
578 #define NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT 200 // struct necp_client_endpoint
579 #define NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT 201 // struct necp_client_endpoint
580 #define NECP_CLIENT_PARAMETER_BROWSE_DESCRIPTOR 202 // struct necp_client_endpoint
581 #define NECP_CLIENT_PARAMETER_RESOLVER_TAG 203 // Tag as bytes, expected to be 32 bytes
582 #define NECP_CLIENT_PARAMETER_ADVERTISE_DESCRIPTOR 204 // struct necp_client_endpoint
583
584 #define NECP_CLIENT_PARAMETER_DELEGATED_UPID 210 // u_int64_t, requires entitlement
585
586 #define NECP_CLIENT_PARAMETER_ETHERTYPE 220 // u_int16_t, ethertype
587 #define NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL 221 // u_int8_t, IPPROTO_
588
589 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE 230 // u_int8_t, NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_
590
591 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_DEFAULT 0
592 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_TEMPORARY 1
593 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_STABLE 2
594
595 #define NECP_CLIENT_PARAMETER_FLAGS 250 // u_int32_t, see NECP_CLIENT_PAREMETER_FLAG_* values
596
597 #define NECP_CLIENT_PARAMETER_FLAG_MULTIPATH 0x0001 // Get multipath interface results
598 #define NECP_CLIENT_PARAMETER_FLAG_BROWSE 0x0002 // Agent assertions on nexuses are requests to browse
599 #define NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE 0x0004 // Prohibit expensive interfaces
600 #define NECP_CLIENT_PARAMETER_FLAG_LISTENER 0x0008 // Client is interested in listening for inbound connections
601 #define NECP_CLIENT_PARAMETER_FLAG_DISCRETIONARY 0x0010 // Client's traffic is discretionary, and eligible for early defuncting
602 #define NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE 0x0020 // Client is requesting to enable ECN
603 #define NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE 0x0040 // Client is requesting to disable ECN
604 #define NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE 0x0080 // Client is requesting to enable TFO
605 #define NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE 0x0100 // Interpret NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE only for primary interface, and allow exceptions for multipath or listeners
606 #define NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER 0x0200 // Client expects to open a custom ethernet channel
607 #define NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP 0x0400 // Client expects to open a custom IP protocol channel
608 #define NECP_CLIENT_PARAMETER_FLAG_INTERPOSE 0x0800 // Client expects to open an interpose filter channel
609 #define NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED 0x1000 // Prohibit constrained interfaces
610 #define NECP_CLIENT_PARAMETER_FLAG_FALLBACK_TRAFFIC 0x2000 // Fallback traffic
611 #define NECP_CLIENT_PARAMETER_FLAG_INBOUND 0x4000 // Flow is inbound (passive)
612
613 #define NECP_CLIENT_RESULT_CLIENT_ID 1 // uuid_t
614 #define NECP_CLIENT_RESULT_POLICY_RESULT 2 // u_int32_t
615 #define NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER 3 // u_int32_t
616 #define NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT 4 // u_int32_t
617 #define NECP_CLIENT_RESULT_INTERFACE_INDEX 5 // u_int32_t
618 #define NECP_CLIENT_RESULT_NETAGENT 6 // struct necp_client_result_netagent
619 #define NECP_CLIENT_RESULT_FLAGS 7 // u_int32_t, see NECP_CLIENT_RESULT_FLAG_* values
620 #define NECP_CLIENT_RESULT_INTERFACE 8 // struct necp_client_result_interface
621 #define NECP_CLIENT_RESULT_INTERFACE_OPTION 9 // struct necp_client_interface_option
622 #define NECP_CLIENT_RESULT_EFFECTIVE_MTU 10 // u_int32_t
623 #define NECP_CLIENT_RESULT_FLOW 11 // TLV array of a single flow's state
624 #define NECP_CLIENT_RESULT_PROTO_CTL_EVENT 12
625 #define NECP_CLIENT_RESULT_TFO_COOKIE 13 // NECP_TFO_COOKIE_LEN_MAX
626 #define NECP_CLIENT_RESULT_TFO_FLAGS 14 // u_int8_t
627 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS 15 // u_int8_t
628 #define NECP_CLIENT_RESULT_FLOW_ID 16 // uuid_t
629 #define NECP_CLIENT_RESULT_INTERFACE_TIME_DELTA 17 // u_int32_t, seconds since interface up/down
630 #define NECP_CLIENT_RESULT_REASON 18 // u_int32_t, see NECP_CLIENT_RESULT_REASON_* values
631 #define NECP_CLIENT_RESULT_FLOW_DIVERT_AGGREGATE_UNIT 19 // u_int32_t
632
633 #define NECP_CLIENT_RESULT_NEXUS_INSTANCE 100 // uuid_t
634 #define NECP_CLIENT_RESULT_NEXUS_PORT 101 // u_int16_t
635 #define NECP_CLIENT_RESULT_NEXUS_KEY 102 // uuid_t
636 #define NECP_CLIENT_RESULT_NEXUS_PORT_FLOW_INDEX 103 // u_int32_t
637 #define NECP_CLIENT_RESULT_NEXUS_FLOW_STATS 104 // struct sk_stats_flow *
638
639 #define NECP_CLIENT_RESULT_LOCAL_ENDPOINT 200 // struct necp_client_endpoint
640 #define NECP_CLIENT_RESULT_REMOTE_ENDPOINT 201 // struct necp_client_endpoint
641 #define NECP_CLIENT_RESULT_DISCOVERED_ENDPOINT 202 // struct necp_client_endpoint, result of browse
642 #define NECP_CLIENT_RESULT_RESOLVED_ENDPOINT 203 // struct necp_client_endpoint, result of resolve
643 #define NECP_CLIENT_RESULT_LOCAL_ETHER_ADDR 204 // struct ether_addr
644 #define NECP_CLIENT_RESULT_REMOTE_ETHER_ADDR 205 // struct ether_addr
645 #define NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS 210 // u_int32_t
646 #define NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG 211 // u_int32_t, 1: background, 0: not background
647 #define NECP_CLIENT_RESULT_GATEWAY 212 // struct necp_client_endpoint
648
649 #define NECP_CLIENT_RESULT_FLAG_IS_LOCAL 0x0001 // Routes to this device
650 #define NECP_CLIENT_RESULT_FLAG_IS_DIRECT 0x0002 // Routes to directly accessible peer
651 #define NECP_CLIENT_RESULT_FLAG_HAS_IPV4 0x0004 // Supports IPv4
652 #define NECP_CLIENT_RESULT_FLAG_HAS_IPV6 0x0008 // Supports IPv6
653 #define NECP_CLIENT_RESULT_FLAG_DEFUNCT 0x0010 // Defunct
654 #define NECP_CLIENT_RESULT_FLAG_SATISFIED 0x0020 // Satisfied path
655 #define NECP_CLIENT_RESULT_FLAG_FLOW_ASSIGNED 0x0040 // Assigned, the flow is active
656 #define NECP_CLIENT_RESULT_FLAG_FLOW_VIABLE 0x0080 // Viable, the flow has a valid route
657 #define NECP_CLIENT_RESULT_FLAG_PROBE_CONNECTIVITY 0x0100 // Flow should probe connectivity
658 #define NECP_CLIENT_RESULT_FLAG_ECN_ENABLED 0x0200 // ECN should be used
659 #define NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED 0x0400 // Fast open should not be used
660 #define NECP_CLIENT_RESULT_FLAG_LINK_QUALITY_ABORT 0x0800 // Link quality is very bad, recommend close connections
661 #define NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING 0x1000 // QoS marking is allowed
662 #define NECP_CLIENT_RESULT_FLAG_HAS_NAT64 0x2000 // Has NAT64 prefix
663 #define NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER 0x4000 // Interface is in low-power mode
664 #define NECP_CLIENT_RESULT_FLAG_SPECIFIC_LISTENER 0x8000 // Listener should not listen on all interfaces
665
666 #define NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE (NECP_CLIENT_RESULT_FLAG_HAS_IPV4 | NECP_CLIENT_RESULT_FLAG_HAS_IPV6 | NECP_CLIENT_RESULT_FLAG_HAS_NAT64 | NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER)
667
668 #define NECP_CLIENT_RESULT_FAST_OPEN_SND_PROBE 0x01 // DEPRECATED - Fast open send probe
669 #define NECP_CLIENT_RESULT_FAST_OPEN_RCV_PROBE 0x02 // DEPRECATED - Fast open receive probe
670
671 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_NONE 0x01
672 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_LOW 0x02
673 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_MEDIUM 0x04
674
675 #define NECP_CLIENT_RESULT_REASON_EXPENSIVE_PROHIBITED 1 // Expensive networks were prohibited
676 #define NECP_CLIENT_RESULT_REASON_CONSTRAINED_PROHIBITED 2 // Constrained networks were prohibited
677 #define NECP_CLIENT_RESULT_REASON_CELLULAR_DENIED 3 // Denied by a cellular route rule
678 #define NECP_CLIENT_RESULT_REASON_WIFI_DENIED 4 // Denied by a wifi route rule
679 #define NECP_CLIENT_RESULT_REASON_LOCAL_NETWORK_PROHIBITED 5 // Local network access prohibited
680
681 struct necp_interface_signature {
682 u_int8_t signature[IFNET_SIGNATURELEN];
683 u_int8_t signature_len;
684 };
685
686 struct necp_interface_details {
687 char name[IFXNAMSIZ];
688 u_int32_t index;
689 u_int32_t generation;
690 u_int32_t functional_type;
691 u_int32_t delegate_index;
692 u_int32_t flags; // see NECP_INTERFACE_FLAG_*
693 u_int32_t mtu;
694 struct necp_interface_signature ipv4_signature;
695 struct necp_interface_signature ipv6_signature;
696 u_int32_t ipv4_netmask;
697 u_int32_t ipv4_broadcast;
698 };
699
700 #define NECP_INTERFACE_FLAG_EXPENSIVE 0x0001
701 #define NECP_INTERFACE_FLAG_TXSTART 0X0002
702 #define NECP_INTERFACE_FLAG_NOACKPRI 0x0004
703 #define NECP_INTERFACE_FLAG_3CARRIERAGG 0x0008
704 #define NECP_INTERFACE_FLAG_IS_LOW_POWER 0x0010
705 #define NECP_INTERFACE_FLAG_MPK_LOG 0x0020 // Multi-layer Packet Logging
706 #define NECP_INTERFACE_FLAG_CONSTRAINED 0x0040
707 #define NECP_INTERFACE_FLAG_HAS_NETMASK 0x0080
708 #define NECP_INTERFACE_FLAG_HAS_BROADCAST 0x0100
709 #define NECP_INTERFACE_FLAG_SUPPORTS_MULTICAST 0x0200
710 #define NECP_INTERFACE_FLAG_HAS_DNS 0x0400
711 #define NECP_INTERFACE_FLAG_HAS_NAT64 0x0800
712 #define NECP_INTERFACE_FLAG_IPV4_ROUTABLE 0x1000
713 #define NECP_INTERFACE_FLAG_IPV6_ROUTABLE 0x2000
714
715 struct necp_client_parameter_netagent_type {
716 char netagent_domain[32];
717 char netagent_type[32];
718 };
719
720 struct necp_client_result_netagent {
721 u_int32_t generation;
722 uuid_t netagent_uuid;
723 };
724
725 struct necp_client_result_interface {
726 u_int32_t generation;
727 u_int32_t index;
728 };
729
730 #define NECP_USES_INTERFACE_OPTIONS_FOR_BROWSE 1
731
732 struct necp_client_interface_option {
733 u_int32_t interface_index;
734 u_int32_t interface_generation;
735 uuid_t nexus_agent;
736 };
737
738 struct necp_client_endpoint {
739 union {
740 struct sockaddr sa;
741 struct sockaddr_in sin;
742 struct sockaddr_in6 sin6;
743 struct {
744 u_int8_t endpoint_length;
745 u_int8_t endpoint_family; // Use AF_UNSPEC to target a name
746 u_int16_t endpoint_port;
747 u_int32_t endpoint_type; // Client-specific type
748 char endpoint_data[0]; // Type-specific endpoint value
749 } endpoint;
750 } u;
751 };
752
753 struct necp_client_list {
754 u_int32_t client_count;
755 uuid_t clients[0];
756 };
757
758 struct kev_necp_policies_changed_data {
759 u_int32_t changed_count; // Defaults to 0.
760 };
761
762 #define NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS 0x01 // Request a nexus instance upon adding a flow
763 #define NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID 0x02 // Register the client ID rather than the flow registration ID with network agents
764 #define NECP_CLIENT_FLOW_FLAGS_BROWSE 0x04 // Create request with a browse agent
765 #define NECP_CLIENT_FLOW_FLAGS_RESOLVE 0x08 // Create request with a resolution agent
766 #define NECP_CLIENT_FLOW_FLAGS_OVERRIDE_ADDRESS 0x10 // Flow has a different remote address than the parent flow
767
768 struct necp_client_flow_stats {
769 u_int32_t stats_type; // NECP_CLIENT_STATISTICS_TYPE_*
770 u_int32_t stats_version; // NECP_CLIENT_STATISTICS_TYPE_*_VER
771 u_int32_t stats_size;
772 mach_vm_address_t stats_addr;
773 };
774
775 struct necp_client_add_flow {
776 uuid_t agent_uuid;
777 uuid_t registration_id;
778 u_int16_t flags; // NECP_CLIENT_FLOW_FLAGS_*
779 u_int16_t stats_request_count;
780 struct necp_client_flow_stats stats_requests[0];
781 // sockaddr for override endpoint
782 } __attribute__((__packed__));
783
784 struct necp_agent_use_parameters {
785 uuid_t agent_uuid;
786 uint64_t out_use_count;
787 };
788
789 struct necp_client_flow_protoctl_event {
790 uint32_t protoctl_event_code;
791 uint32_t protoctl_event_val;
792 /* TCP seq number is in host byte order */
793 uint32_t protoctl_event_tcp_seq_num;
794 };
795
796 #define NECP_CLIENT_UPDATE_TYPE_PARAMETERS 1 // Parameters, for a new client
797 #define NECP_CLIENT_UPDATE_TYPE_RESULT 2 // Result, for a udpated client
798 #define NECP_CLIENT_UPDATE_TYPE_REMOVE 3 // Empty, for a removed client
799
800 struct necp_client_observer_update {
801 u_int32_t update_type; // NECP_CLIENT_UPDATE_TYPE_*
802 u_int8_t tlv_buffer[0]; // Parameters or result as TLVs, based on type
803 };
804
805 #define NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER 1
806
807 struct necp_client_signable {
808 uuid_t client_id;
809 u_int32_t sign_type;
810 } __attribute__((__packed__));
811
812 struct necp_client_resolver_answer {
813 uuid_t client_id;
814 u_int32_t sign_type;
815 union sockaddr_in_4_6 address_answer;
816 u_int32_t hostname_length;
817 // hostname
818 } __attribute__((__packed__));
819
820 #define NECP_FILTER_UNIT_NO_FILTER UINT32_MAX // Reserved filter unit value that prohibits all filters and socket filters
821
822 /*
823 * The sysctl "net.necp.necp_drop_dest_level" controls the global drop rule policy for
824 * a set of destinations addresses at the given level -- the drop rule is the last one
825 * to be evaluated at this level.
826 */
827 #define MAX_NECP_DROP_DEST_LEVEL_ADDRS 8
828
829 struct necp_drop_dest_entry {
830 u_int32_t level; // priority level
831 u_int32_t order; // session order (read only via sysctl)
832 struct necp_policy_condition_addr cond_addr;
833 };
834
835 struct necp_drop_dest_policy {
836 u_int32_t entry_count;
837 struct necp_drop_dest_entry entries[MAX_NECP_DROP_DEST_LEVEL_ADDRS];
838 };
839
840 #ifdef BSD_KERNEL_PRIVATE
841 #include <stdbool.h>
842 #include <sys/socketvar.h>
843 #include <sys/kern_control.h>
844 #include <netinet/ip_var.h>
845 #include <netinet6/ip6_var.h>
846 #include <net/if_var.h>
847 #include <sys/syslog.h>
848 #include <net/network_agent.h>
849 #include <net/ethernet.h>
850 #include <os/log.h>
851
852
853 SYSCTL_DECL(_net_necp);
854
855 extern os_log_t necp_log_handle;
856
857 #define NECPLOG(level, format, ...) do { \
858 if (level == LOG_ERR) { \
859 os_log_error(necp_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \
860 } else { \
861 os_log(necp_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \
862 } \
863 } while (0)
864
865 #define NECPLOG0(level, msg) do { \
866 if (level == LOG_ERR) { \
867 os_log_error(necp_log_handle, "%s: %s\n", __FUNCTION__, msg); \
868 } else { \
869 os_log(necp_log_handle, "%s: %s\n", __FUNCTION__, msg); \
870 } \
871 } while (0)
872
873 enum necp_fd_type_t {
874 necp_fd_type_invalid = 0,
875 necp_fd_type_session = 1,
876 necp_fd_type_client = 2,
877 };
878
879 union necp_sockaddr_union {
880 struct sockaddr sa;
881 struct sockaddr_in sin;
882 struct sockaddr_in6 sin6;
883 };
884
885 /*
886 * kstats
887 * The ustats and kstats region are mirrored. So when we allocate with
888 * skmem_cache from kstats region, we also get an ustats object. To tie them
889 * together, kstats has an extra *necp_stats_ustats pointer pointing to the
890 * ustats object
891 */
892 struct necp_all_kstats {
893 struct necp_all_stats necp_stats_comm; /* kernel private stats snapshot */
894 struct necp_all_stats *necp_stats_ustats; /* points to user-visible stats (in shared ustats region) */
895 };
896
897 extern errno_t necp_client_init(void);
898 extern int necp_application_find_policy_match_internal(proc_t proc, u_int8_t *parameters, u_int32_t parameters_size,
899 struct necp_aggregate_result *returned_result,
900 u_int32_t *flags, u_int32_t *reason, u_int required_interface_index,
901 const union necp_sockaddr_union *override_local_addr,
902 const union necp_sockaddr_union *override_remote_addr,
903 struct necp_client_endpoint *returned_v4_gateway,
904 struct necp_client_endpoint *returned_v6_gateway,
905 struct rtentry **returned_route, bool ignore_address,
906 bool has_client,
907 uuid_t *returned_override_euuid);
908 /*
909 * TLV utilities
910 *
911 * Note that these functions (other than necp_buffer_find_tlv) do not check the length of the entire buffer,
912 * so the caller must be sure that the entire TLV is within bounds.
913 */
914 struct necp_tlv_header {
915 u_int8_t type;
916 u_int32_t length;
917 } __attribute__((__packed__));
918
919 extern u_int8_t *necp_buffer_write_tlv(u_int8_t *cursor, u_int8_t type, u_int32_t length, const void *value,
920 u_int8_t *buffer, u_int32_t buffer_length);
921 extern u_int8_t *necp_buffer_write_tlv_if_different(u_int8_t *cursor, u_int8_t type,
922 u_int32_t length, const void *value, bool *updated,
923 u_int8_t *buffer, u_int32_t buffer_length);
924 extern u_int8_t necp_buffer_get_tlv_type(u_int8_t *buffer, int tlv_offset);
925 extern u_int32_t necp_buffer_get_tlv_length(u_int8_t *buffer, int tlv_offset);
926 extern u_int8_t *necp_buffer_get_tlv_value(u_int8_t *buffer, int tlv_offset, u_int32_t *value_size);
927 extern int necp_buffer_find_tlv(u_int8_t *buffer, u_int32_t buffer_length, int offset, u_int8_t type, int *err, int next);
928
929 #define NECPCTL_DROP_ALL_LEVEL 1 /* Drop all packets if no policy matches above this level */
930 #define NECPCTL_DEBUG 2 /* Log all kernel policy matches */
931 #define NECPCTL_PASS_LOOPBACK 3 /* Pass all loopback traffic */
932 #define NECPCTL_PASS_KEEPALIVES 4 /* Pass all kernel-generated keepalive traffic */
933 #define NECPCTL_SOCKET_POLICY_COUNT 5 /* Count of all socket-level policies */
934 #define NECPCTL_SOCKET_NON_APP_POLICY_COUNT 6 /* Count of non-per-app socket-level policies */
935 #define NECPCTL_IP_POLICY_COUNT 7 /* Count of all ip-level policies */
936 #define NECPCTL_SESSION_COUNT 8 /* Count of NECP sessions */
937 #define NECPCTL_CLIENT_FD_COUNT 9 /* Count of NECP client fds */
938 #define NECPCTL_CLIENT_COUNT 10 /* Count of NECP clients */
939 #define NECPCTL_ARENA_COUNT 11 /* Count of NECP arenas (stats, etc) */
940 #define NECPCTL_NEXUS_FLOW_COUNT 12 /* Count of NECP nexus flows */
941 #define NECPCTL_SOCKET_FLOW_COUNT 13 /* Count of NECP socket flows */
942 #define NECPCTL_IF_FLOW_COUNT 14 /* Count of NECP socket flows */
943 #define NECPCTL_OBSERVER_FD_COUNT 15 /* Count of NECP observer fds */
944 #define NECPCTL_OBSERVER_MESSAGE_LIMIT 16 /* Number of of NECP observer messages allowed to be queued */
945 #define NECPCTL_SYSCTL_ARENA_COUNT 17 /* Count of sysctl arenas */
946 #define NECPCTL_DROP_UNENTITLED_LEVEL 18 /* Drop unentitled process traffic above this level */
947 #define NECPCTL_PASS_INTERPOSE 19 /* Pass interpose */
948 #define NECPCTL_RESTRICT_MULTICAST 20 /* Restrict multicast access */
949 #define NECPCTL_DEDUP_POLICIES 21 /* Dedup overlapping policies */
950
951
952 #define NECPCTL_NAMES { \
953 { 0, 0 }, \
954 { "drop_all_level", CTLTYPE_INT }, \
955 { "debug", CTLTYPE_INT }, \
956 { "pass_loopback", CTLTYPE_INT }, \
957 { "pass_keepalives", CTLTYPE_INT }, \
958 { "pass_interpose", CTLTYPE_INT }, \
959 }
960
961 typedef u_int32_t necp_kernel_policy_id;
962 #define NECP_KERNEL_POLICY_ID_NONE 0
963 #define NECP_KERNEL_POLICY_ID_NO_MATCH 1
964 #define NECP_KERNEL_POLICY_ID_FIRST_VALID_SOCKET 2
965 #define NECP_KERNEL_POLICY_ID_FIRST_VALID_IP UINT16_MAX
966
967 typedef u_int32_t necp_app_id;
968
969 #define NECP_KERNEL_POLICY_RESULT_NONE 0
970 #define NECP_KERNEL_POLICY_RESULT_PASS NECP_POLICY_RESULT_PASS
971 #define NECP_KERNEL_POLICY_RESULT_SKIP NECP_POLICY_RESULT_SKIP
972 #define NECP_KERNEL_POLICY_RESULT_DROP NECP_POLICY_RESULT_DROP
973 #define NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT NECP_POLICY_RESULT_SOCKET_DIVERT
974 #define NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER NECP_POLICY_RESULT_SOCKET_FILTER
975 #define NECP_KERNEL_POLICY_RESULT_IP_TUNNEL NECP_POLICY_RESULT_IP_TUNNEL
976 #define NECP_KERNEL_POLICY_RESULT_IP_FILTER NECP_POLICY_RESULT_IP_FILTER
977 #define NECP_KERNEL_POLICY_RESULT_TRIGGER NECP_POLICY_RESULT_TRIGGER
978 #define NECP_KERNEL_POLICY_RESULT_TRIGGER_IF_NEEDED NECP_POLICY_RESULT_TRIGGER_IF_NEEDED
979 #define NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED NECP_POLICY_RESULT_TRIGGER_SCOPED
980 #define NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED NECP_POLICY_RESULT_NO_TRIGGER_SCOPED
981 #define NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED NECP_POLICY_RESULT_SOCKET_SCOPED
982 #define NECP_KERNEL_POLICY_RESULT_ROUTE_RULES NECP_POLICY_RESULT_ROUTE_RULES
983 #define NECP_KERNEL_POLICY_RESULT_USE_NETAGENT NECP_POLICY_RESULT_USE_NETAGENT
984 #define NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED NECP_POLICY_RESULT_NETAGENT_SCOPED
985 #define NECP_KERNEL_POLICY_RESULT_SCOPED_DIRECT NECP_POLICY_RESULT_SCOPED_DIRECT
986 #define NECP_KERNEL_POLICY_RESULT_ALLOW_UNENTITLED NECP_POLICY_RESULT_ALLOW_UNENTITLED
987
988 #define NECP_KERNEL_POLICY_PASS_NO_SKIP_IPSEC NECP_POLICY_PASS_NO_SKIP_IPSEC
989 #define NECP_KERNEL_POLICY_PASS_PF_TAG NECP_POLICY_PASS_PF_TAG
990
991 #define NECP_KERNEL_POLICY_DROP_FLAG_LOCAL_NETWORK NECP_POLICY_DROP_FLAG_LOCAL_NETWORK
992
993 typedef struct {
994 u_int32_t identifier;
995 u_int32_t data;
996 } necp_kernel_policy_service;
997
998 typedef union {
999 u_int tunnel_interface_index;
1000 u_int scoped_interface_index;
1001 u_int32_t flow_divert_control_unit;
1002 u_int32_t filter_control_unit;
1003 u_int32_t skip_policy_order;
1004 u_int32_t route_rule_id;
1005 u_int32_t netagent_id;
1006 u_int32_t pass_flags;
1007 u_int32_t drop_flags;
1008 necp_kernel_policy_service service;
1009 } necp_kernel_policy_result_parameter;
1010
1011 enum necp_boolean_state {
1012 necp_boolean_state_unknown = 0,
1013 necp_boolean_state_false = 1,
1014 necp_boolean_state_true = 2,
1015 };
1016
1017 struct necp_kernel_socket_policy {
1018 LIST_ENTRY(necp_kernel_socket_policy) chain;
1019 necp_kernel_policy_id id;
1020 necp_policy_order order;
1021 u_int32_t session_order;
1022 int session_pid;
1023
1024 u_int32_t condition_mask;
1025 u_int32_t condition_negated_mask;
1026 u_int32_t cond_client_flags;
1027 necp_kernel_policy_id cond_policy_id;
1028 u_int32_t cond_app_id; // Locally assigned ID value stored
1029 u_int32_t cond_real_app_id; // Locally assigned ID value stored
1030 char *cond_custom_entitlement; // String
1031 u_int8_t cond_custom_entitlement_matched;// Boolean if entitlement matched app
1032 u_int32_t cond_account_id; // Locally assigned ID value stored
1033 char *cond_domain; // String
1034 u_int8_t cond_domain_dot_count; // Number of dots in cond_domain
1035 pid_t cond_pid;
1036 uid_t cond_uid;
1037 ifnet_t cond_bound_interface; // Matches specific binding only
1038 struct necp_policy_condition_tc_range cond_traffic_class; // Matches traffic class in range
1039 u_int16_t cond_protocol; // Matches IP protcol number
1040 union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
1041 union necp_sockaddr_union cond_local_end; // Matches IP address range
1042 u_int8_t cond_local_prefix; // Defines subnet
1043 union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
1044 union necp_sockaddr_union cond_remote_end; // Matches IP address range
1045 u_int8_t cond_remote_prefix; // Defines subnet
1046 struct necp_policy_condition_agent_type cond_agent_type;
1047 struct necp_policy_condition_sdk_version cond_sdk_version;
1048 char *cond_signing_identifier; // String
1049 u_int16_t cond_packet_filter_tags;
1050
1051 necp_kernel_policy_result result;
1052 necp_kernel_policy_result_parameter result_parameter;
1053 };
1054
1055 struct necp_kernel_ip_output_policy {
1056 LIST_ENTRY(necp_kernel_ip_output_policy) chain;
1057 necp_kernel_policy_id id;
1058 necp_policy_order suborder;
1059 necp_policy_order order;
1060 u_int32_t session_order;
1061 int session_pid;
1062
1063 u_int32_t condition_mask;
1064 u_int32_t condition_negated_mask;
1065 necp_kernel_policy_id cond_policy_id;
1066 ifnet_t cond_bound_interface; // Matches specific binding only
1067 u_int16_t cond_protocol; // Matches IP protcol number
1068 union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
1069 union necp_sockaddr_union cond_local_end; // Matches IP address range
1070 u_int8_t cond_local_prefix; // Defines subnet
1071 union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
1072 union necp_sockaddr_union cond_remote_end; // Matches IP address range
1073 u_int8_t cond_remote_prefix; // Defines subnet
1074 u_int32_t cond_last_interface_index;
1075 u_int16_t cond_packet_filter_tags;
1076
1077 necp_kernel_policy_result result;
1078 necp_kernel_policy_result_parameter result_parameter;
1079 };
1080
1081 #define MAX_KERNEL_SOCKET_POLICIES 1
1082 #define MAX_KERNEL_IP_OUTPUT_POLICIES 4
1083 struct necp_session_policy {
1084 LIST_ENTRY(necp_session_policy) chain;
1085 bool applied; // Applied into the kernel table
1086 bool pending_deletion; // Waiting to be removed from kernel table
1087 bool pending_update; // Policy has been modified since creation/last application
1088 necp_policy_id local_id;
1089 necp_policy_order order;
1090 u_int8_t *result;
1091 u_int32_t result_size;
1092 u_int8_t *conditions; // Array of conditions, each with a u_int32_t length at start
1093 u_int32_t conditions_size;
1094 u_int8_t *route_rules; // Array of route rules, each with a u_int32_t length at start
1095 u_int32_t route_rules_size;
1096
1097 uuid_t applied_app_uuid;
1098 uuid_t applied_real_app_uuid;
1099 char *applied_account;
1100
1101 uuid_t applied_result_uuid;
1102
1103 u_int32_t applied_route_rules_id;
1104
1105 necp_kernel_policy_id kernel_socket_policies[MAX_KERNEL_SOCKET_POLICIES];
1106 necp_kernel_policy_id kernel_ip_output_policies[MAX_KERNEL_IP_OUTPUT_POLICIES];
1107 };
1108
1109 struct necp_aggregate_socket_result {
1110 necp_kernel_policy_result result;
1111 necp_kernel_policy_result_parameter result_parameter;
1112 necp_kernel_policy_filter filter_control_unit;
1113 u_int32_t flow_divert_aggregate_unit;
1114 u_int32_t route_rule_id;
1115 int32_t qos_marking_gencount;
1116 };
1117
1118 struct necp_inpcb_result {
1119 u_int32_t app_id;
1120 necp_kernel_policy_id policy_id;
1121 necp_kernel_policy_id skip_policy_id;
1122 int32_t policy_gencount;
1123 u_int32_t flowhash;
1124 struct necp_aggregate_socket_result results;
1125 };
1126
1127 extern errno_t necp_init(void);
1128
1129 extern errno_t necp_set_socket_attributes(struct socket *so, struct sockopt *sopt);
1130 extern errno_t necp_get_socket_attributes(struct socket *so, struct sockopt *sopt);
1131 extern void necp_inpcb_remove_cb(struct inpcb *inp);
1132 extern void necp_inpcb_dispose(struct inpcb *inp);
1133
1134 extern u_int32_t necp_socket_get_content_filter_control_unit(struct socket *so);
1135
1136 extern bool necp_socket_should_use_flow_divert(struct inpcb *inp);
1137 extern u_int32_t necp_socket_get_flow_divert_control_unit(struct inpcb *inp, uint32_t *aggregate_unit);
1138
1139 extern bool necp_socket_should_rescope(struct inpcb *inp);
1140 extern u_int necp_socket_get_rescope_if_index(struct inpcb *inp);
1141 extern u_int32_t necp_socket_get_effective_mtu(struct inpcb *inp, u_int32_t current_mtu);
1142
1143 extern bool necp_socket_is_allowed_to_recv_on_interface(struct inpcb *inp, ifnet_t interface);
1144
1145 extern bool necp_socket_is_allowed_to_send_recv(struct inpcb *inp, ifnet_t interface, u_int16_t pf_tag,
1146 necp_kernel_policy_id *return_policy_id,
1147 u_int32_t *return_route_rule_id,
1148 necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags);
1149 extern bool necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port,
1150 u_int16_t remote_port, struct in_addr *local_addr,
1151 struct in_addr *remote_addr, ifnet_t interface, u_int16_t pf_tag,
1152 necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id,
1153 necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags);
1154 extern bool necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port,
1155 u_int16_t remote_port, struct in6_addr *local_addr,
1156 struct in6_addr *remote_addr, ifnet_t interface, u_int16_t pf_tag,
1157 necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id,
1158 necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags);
1159 extern void necp_socket_update_qos_marking(struct inpcb *inp, struct rtentry *route, u_int32_t route_rule_id);
1160 extern bool necp_lookup_current_qos_marking(int32_t *qos_marking_gencount, struct rtentry *route, struct ifnet *interface, u_int32_t route_rule_id, bool old_qos_marking);
1161 extern int necp_mark_packet_from_socket(struct mbuf *packet, struct inpcb *inp, necp_kernel_policy_id policy_id,
1162 u_int32_t route_rule_id, necp_kernel_policy_id skip_policy_id, u_int32_t pass_flags);
1163 extern necp_kernel_policy_id necp_get_policy_id_from_packet(struct mbuf *packet);
1164 extern necp_kernel_policy_id necp_get_skip_policy_id_from_packet(struct mbuf *packet);
1165 extern u_int16_t necp_get_packet_filter_tags_from_packet(struct mbuf *packet);
1166 extern bool necp_packet_should_skip_filters(struct mbuf *packet);
1167 extern u_int32_t necp_get_last_interface_index_from_packet(struct mbuf *packet);
1168 extern u_int32_t necp_get_route_rule_id_from_packet(struct mbuf *packet);
1169 extern int necp_get_app_uuid_from_packet(struct mbuf *packet,
1170 uuid_t app_uuid);
1171
1172 extern necp_kernel_policy_id necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local_addr,
1173 struct sockaddr *override_remote_addr, u_int32_t override_bound_interface);
1174 extern necp_kernel_policy_id necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_args *ipoa,
1175 struct rtentry *rt,
1176 necp_kernel_policy_result *result,
1177 necp_kernel_policy_result_parameter *result_parameter);
1178 extern necp_kernel_policy_id necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out_args *ip6oa,
1179 struct rtentry *rt,
1180 necp_kernel_policy_result *result,
1181 necp_kernel_policy_result_parameter *result_parameter);
1182
1183 extern int necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id);
1184 extern int necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface);
1185
1186 extern ifnet_t necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter);
1187 extern bool necp_packet_can_rebind_to_ifnet(struct mbuf *packet, struct ifnet *interface, struct route *new_route, int family);
1188
1189 extern bool necp_packet_is_allowed_over_interface(struct mbuf *packet, struct ifnet *interface);
1190
1191 extern int necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive);
1192 extern bool necp_get_is_keepalive_from_packet(struct mbuf *packet);
1193
1194 extern int necp_sign_resolver_answer(uuid_t client_id, u_int8_t *query, u_int32_t query_length,
1195 u_int8_t *answer, u_int32_t answer_length,
1196 u_int8_t *tag, u_int32_t *out_tag_length);
1197
1198 extern bool necp_validate_resolver_answer(uuid_t client_id, u_int8_t *query, u_int32_t query_length,
1199 u_int8_t *answer, u_int32_t answer_length,
1200 u_int8_t *tag, u_int32_t tag_length);
1201
1202 extern void necp_update_all_clients(void); // Handle general re-evaluate event
1203 extern void necp_update_all_clients_immediately_if_needed(bool should_update_immediately); // Handle general re-evaluate event
1204
1205 extern void necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid, u_int32_t agent_generation); // Cause a single client to get an update event
1206
1207 extern bool necp_set_client_as_background(proc_t proc, struct fileproc *fp, bool background); // Set all clients for an fp as background or not
1208
1209 struct necp_fd_data;
1210 extern void necp_fd_memstatus(proc_t proc, uint32_t status, struct necp_fd_data *client_fd); // Purge memory of clients for the process
1211 extern void necp_fd_defunct(proc_t proc, struct necp_fd_data *client_fd); // Set all clients for an process as defunct
1212
1213 extern int necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp);
1214
1215 extern int necp_client_register_socket_listener(pid_t pid, uuid_t client_id, struct inpcb *inp);
1216
1217
1218 extern int necp_client_assert_bb_radio_manager(uuid_t client_id, bool assert);
1219
1220 extern int necp_client_assign_from_socket(pid_t pid, uuid_t client_id, struct inpcb *inp);
1221
1222 extern int necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id,
1223 u_int8_t *assigned_results, size_t assigned_results_length);
1224 struct skmem_obj_info; // forward declaration
1225 extern int necp_stats_ctor(struct skmem_obj_info *oi, struct skmem_obj_info *oim, void *arg, uint32_t skmflag);
1226 extern int necp_stats_dtor(void *addr, void *arg);
1227
1228 /* value to denote invalid flow advisory index */
1229 struct netagent_session;
1230 extern int
1231 necp_update_flow_protoctl_event(uuid_t netagent_uuid, uuid_t client_id,
1232 uint32_t protoctl_event_code, uint32_t protoctl_event_val,
1233 uint32_t protoctl_event_tcp_seq_num);
1234
1235 #define NECP_FLOWADV_IDX_INVALID UINT32_MAX
1236 extern void *necp_create_nexus_assign_message(uuid_t nexus_instance, u_int32_t nexus_port, void *key, uint32_t key_length,
1237 struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint,
1238 struct ether_addr *local_ether_addr,
1239 u_int32_t flow_adv_index, void *flow_stats, size_t *message_length);
1240
1241 struct necp_client_nexus_parameters {
1242 pid_t pid;
1243 pid_t epid;
1244 uuid_t euuid;
1245 union necp_sockaddr_union local_addr;
1246 union necp_sockaddr_union remote_addr;
1247 u_int8_t ip_protocol;
1248 u_int8_t transport_protocol;
1249 u_int16_t ethertype;
1250 u_int32_t traffic_class;
1251 necp_policy_id policy_id;
1252 unsigned is_listener:1;
1253 unsigned is_interpose:1;
1254 unsigned is_custom_ether:1;
1255 unsigned allow_qos_marking:1;
1256 unsigned override_address_selection:1;
1257 unsigned use_stable_address:1; // Used if override_address_selection is set
1258 };
1259
1260 struct necp_client_agent_parameters {
1261 union {
1262 struct necp_client_nexus_parameters nexus_request;
1263 u_int8_t close_token[QUIC_STATELESS_RESET_TOKEN_SIZE];
1264 } u;
1265 };
1266
1267 #define NECP_CLIENT_CBACTION_NONVIABLE 1
1268 #define NECP_CLIENT_CBACTION_VIABLE 2
1269 #define NECP_CLIENT_CBACTION_INITIAL 3
1270
1271 struct necp_client_add_flow_default {
1272 uuid_t agent_uuid;
1273 uuid_t registration_id;
1274 u_int16_t flags; // NECP_CLIENT_FLOW_FLAGS_*
1275 u_int16_t stats_request_count;
1276 struct necp_client_flow_stats stats_requests[1];
1277 } __attribute__((__packed__));
1278
1279 typedef void (*necp_client_flow_cb)(void *handle, int action, uint32_t interface_index, uint32_t necp_flags, bool *viable);
1280
1281 extern void necp_client_reap_caches(boolean_t purge);
1282
1283
1284 #endif /* BSD_KERNEL_PRIVATE */
1285
1286 #ifdef KERNEL
1287 #ifdef KERNEL_PRIVATE
1288 extern bool net_domain_contains_hostname(char *hostname_string, char *domain_string);
1289 #endif /* KERNEL_PRIVATE */
1290 #endif /* KERNEL */
1291
1292 #ifndef KERNEL
1293
1294 extern int necp_match_policy(const uint8_t *parameters, size_t parameters_size, struct necp_aggregate_result *returned_result);
1295
1296 extern int necp_open(int flags);
1297
1298 extern int necp_client_action(int necp_fd, uint32_t action, uuid_t client_id,
1299 size_t client_id_len, uint8_t *buffer, size_t buffer_size);
1300
1301 extern int necp_session_open(int flags);
1302
1303 extern int necp_session_action(int necp_fd, uint32_t action,
1304 uint8_t *in_buffer, size_t in_buffer_length,
1305 uint8_t *out_buffer, size_t out_buffer_length);
1306
1307 #endif /* !KERNEL */
1308
1309 #endif /* PRIVATE */
1310
1311 #endif
mirror of XNU