bsd/net/necp.h

   1 /*
   2  * Copyright (c) 2013, 2014 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #ifndef _NET_NECP_H_
  30 #define _NET_NECP_H_
  31
  32 #include <netinet/in.h>
  33 #include <sys/socket.h>
  34
  35 /*
  36  * Name registered by the ipsec kernel control
  37  */
  38 #define NECP_CONTROL_NAME "com.apple.net.necp_control"
  39
  40 #define NECP_TLV_LENGTH_UINT32  1
  41
  42 struct necp_packet_header {
  43     u_int8_t            packet_type;
  44         u_int8_t                flags;
  45     u_int32_t           message_id;
  46 };
  47 #define NECP_PACKET_TYPE_POLICY_ADD                             1
  48 #define NECP_PACKET_TYPE_POLICY_GET                             2
  49 #define NECP_PACKET_TYPE_POLICY_DELETE                  3
  50 #define NECP_PACKET_TYPE_POLICY_APPLY_ALL               4
  51 #define NECP_PACKET_TYPE_POLICY_LIST_ALL                5
  52 #define NECP_PACKET_TYPE_POLICY_DELETE_ALL              6
  53 #define NECP_PACKET_TYPE_SET_SESSION_PRIORITY   7
  54 #define NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC   8
  55 #define NECP_PACKET_TYPE_REGISTER_SERVICE               9
  56 #define NECP_PACKET_TYPE_UNREGISTER_SERVICE             10
  57
  58 #define NECP_PACKET_FLAGS_RESPONSE                              0x01    // Used for acks, errors, and query responses
  59
  60 #define NECP_TLV_NIL                                                    0
  61 #define NECP_TLV_ERROR                                                  1       // u_int32_t
  62 #define NECP_TLV_POLICY_ORDER                                   2       // u_int32_t
  63 #define NECP_TLV_POLICY_CONDITION                               3
  64 #define NECP_TLV_POLICY_RESULT                                  4
  65 #define NECP_TLV_POLICY_ID                                              5       // u_int32_t
  66 #define NECP_TLV_SESSION_PRIORITY                               6       // u_int32_t
  67 #define NECP_TLV_ATTRIBUTE_DOMAIN                               7       // char[]
  68 #define NECP_TLV_ATTRIBUTE_ACCOUNT                              8       // char[]
  69 #define NECP_TLV_SERVICE_UUID                                   9       // uuid_t
  70 #define NECP_TLV_ROUTE_RULE                                             10
  71
  72 #define NECP_POLICY_CONDITION_FLAGS_NEGATIVE    0x01 // Negative
  73
  74 // Conditions
  75 #define NECP_POLICY_CONDITION_DEFAULT                   0       // N/A, not valid with any other conditions
  76 // Socket/Application conditions
  77 #define NECP_POLICY_CONDITION_APPLICATION               1       // uuid_t, uses effective UUID when possible
  78 #define NECP_POLICY_CONDITION_REAL_APPLICATION  2       // uuid_t, never uses effective UUID. Only valid with NECP_POLICY_CONDITION_APPLICATION
  79 // Application-only Conditions
  80 #define NECP_POLICY_CONDITION_DOMAIN                    3       // String, such as apple.com
  81 #define NECP_POLICY_CONDITION_ACCOUNT                   4       // String
  82 // Socket/Application condition
  83 #define NECP_POLICY_CONDITION_ENTITLEMENT               5       // String
  84 #define NECP_POLICY_CONDITION_PID                               6       // pid_t
  85 #define NECP_POLICY_CONDITION_UID                               7       // uid_t
  86 #define NECP_POLICY_CONDITION_ALL_INTERFACES    8       // N/A
  87 #define NECP_POLICY_CONDITION_BOUND_INTERFACE   9       // String
  88 #define NECP_POLICY_CONDITION_TRAFFIC_CLASS             10      // necp_policy_condition_tc_range
  89 // Socket/IP conditions
  90 #define NECP_POLICY_CONDITION_IP_PROTOCOL               11      // u_int8_t
  91 #define NECP_POLICY_CONDITION_LOCAL_ADDR                12      // necp_policy_condition_addr
  92 #define NECP_POLICY_CONDITION_REMOTE_ADDR               13      // necp_policy_condition_addr
  93 #define NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE  14      // necp_policy_condition_addr_range
  94 #define NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE 15      // necp_policy_condition_addr_range
  95
  96 // Results
  97 #define NECP_POLICY_RESULT_PASS                                 1       // N/A
  98 #define NECP_POLICY_RESULT_SKIP                                 2       // u_int32_t, policy order to skip to. 0 to skip all session policies.
  99 #define NECP_POLICY_RESULT_DROP                                 3       // N/A
 100 #define NECP_POLICY_RESULT_SOCKET_DIVERT                4       // u_int32_t, flow divert control unit
 101 #define NECP_POLICY_RESULT_SOCKET_FILTER                5       // u_int32_t, filter control unit
 102 #define NECP_POLICY_RESULT_IP_TUNNEL                    6       // String, interface name
 103 #define NECP_POLICY_RESULT_IP_FILTER                    7       // ?
 104 #define NECP_POLICY_RESULT_TRIGGER                              8       // service uuid_t
 105 #define NECP_POLICY_RESULT_TRIGGER_IF_NEEDED    9       // service uuid_t
 106 #define NECP_POLICY_RESULT_TRIGGER_SCOPED               10      // service uuid_t
 107 #define NECP_POLICY_RESULT_NO_TRIGGER_SCOPED    11      // service uuid_t
 108 #define NECP_POLICY_RESULT_SOCKET_SCOPED                12      // String, interface name
 109 #define NECP_POLICY_RESULT_ROUTE_RULES                  13      // N/A, must have route rules defined
 110 #define NECP_POLICY_RESULT_USE_NETAGENT                 14      // netagent uuid_t
 111
 112 #define NECP_POLICY_RESULT_MAX                                  NECP_POLICY_RESULT_USE_NETAGENT
 113
 114 // Route rule
 115 #define NECP_ROUTE_RULE_NONE                                    0       // N/A
 116 #define NECP_ROUTE_RULE_DENY_INTERFACE                  1       // String, or empty to match all
 117 #define NECP_ROUTE_RULE_ALLOW_INTERFACE                 2       // String, or empty to match all
 118
 119 #define NECP_ROUTE_RULE_FLAG_CELLULAR                   0x01
 120 #define NECP_ROUTE_RULE_FLAG_WIFI                               0x02
 121 #define NECP_ROUTE_RULE_FLAG_WIRED                              0x04
 122 #define NECP_ROUTE_RULE_FLAG_EXPENSIVE                  0x08
 123
 124 // Errors
 125 #define NECP_ERROR_INTERNAL                                             0
 126 #define NECP_ERROR_UNKNOWN_PACKET_TYPE                  1
 127 #define NECP_ERROR_INVALID_TLV                                  2
 128 #define NECP_ERROR_POLICY_RESULT_INVALID                3
 129 #define NECP_ERROR_POLICY_CONDITIONS_INVALID    4
 130 #define NECP_ERROR_POLICY_ID_NOT_FOUND                  5
 131 #define NECP_ERROR_INVALID_PROCESS                              6
 132 #define NECP_ERROR_ROUTE_RULES_INVALID                  7
 133
 134 // Modifiers
 135 #define NECP_MASK_USERSPACE_ONLY        0x80000000      // on filter_control_unit value
 136
 137 struct necp_policy_condition_tc_range {
 138         u_int32_t start_tc;
 139         u_int32_t end_tc;
 140 } __attribute__((__packed__));
 141
 142 struct necp_policy_condition_addr {
 143         u_int8_t                prefix;
 144         union {
 145                 struct sockaddr                 sa;
 146                 struct sockaddr_in              sin;
 147                 struct sockaddr_in6             sin6;
 148         } address;
 149 } __attribute__((__packed__));
 150
 151 struct necp_policy_condition_addr_range {
 152         union {
 153                 struct sockaddr                 sa;
 154                 struct sockaddr_in              sin;
 155                 struct sockaddr_in6             sin6;
 156         } start_address;
 157         union {
 158                 struct sockaddr                 sa;
 159                 struct sockaddr_in              sin;
 160                 struct sockaddr_in6             sin6;
 161         } end_address;
 162 } __attribute__((__packed__));
 163
 164 #define NECP_SESSION_PRIORITY_UNKNOWN                   0
 165 #define NECP_SESSION_PRIORITY_CONTROL                   1
 166 #define NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL 2
 167 #define NECP_SESSION_PRIORITY_HIGH                              3
 168 #define NECP_SESSION_PRIORITY_DEFAULT                   4
 169 #define NECP_SESSION_PRIORITY_LOW                               5
 170
 171 #define NECP_SESSION_NUM_PRIORITIES                             NECP_SESSION_PRIORITY_LOW
 172
 173 typedef u_int32_t necp_policy_id;
 174 typedef u_int32_t necp_policy_order;
 175
 176 typedef u_int32_t necp_kernel_policy_result;
 177 typedef u_int32_t necp_kernel_policy_filter;
 178
 179 typedef union {
 180         u_int                                           tunnel_interface_index;
 181         u_int                                           scoped_interface_index;
 182         u_int32_t                                       flow_divert_control_unit;
 183         u_int32_t                                       filter_control_unit;
 184 } necp_kernel_policy_routing_result_parameter;
 185
 186 #define NECP_SERVICE_FLAGS_REGISTERED                   0x01
 187 #define NECP_MAX_NETAGENTS                                              8
 188 struct necp_aggregate_result {
 189         necp_kernel_policy_result                       routing_result;
 190         necp_kernel_policy_routing_result_parameter     routing_result_parameter;
 191         necp_kernel_policy_filter                       filter_control_unit;
 192         necp_kernel_policy_result                       service_action;
 193         uuid_t                                                          service_uuid;
 194         u_int32_t                                                       service_flags;
 195         u_int32_t                                                       service_data;
 196         u_int                                                           routed_interface_index;
 197         u_int32_t                                                       policy_id;
 198         uuid_t                                                          netagents[NECP_MAX_NETAGENTS];
 199         u_int32_t                                                       netagent_flags[NECP_MAX_NETAGENTS];
 200 };
 201
 202 #define KEV_NECP_SUBCLASS 8
 203 #define KEV_NECP_POLICIES_CHANGED 1
 204
 205 struct kev_necp_policies_changed_data {
 206         u_int32_t               changed_count;  // Defaults to 0.
 207 };
 208
 209 #ifdef BSD_KERNEL_PRIVATE
 210 #include <stdbool.h>
 211 #include <sys/socketvar.h>
 212 #include <sys/kern_control.h>
 213 #include <netinet/ip_var.h>
 214 #include <netinet6/ip6_var.h>
 215
 216 #define NECPCTL_DROP_ALL_LEVEL                          1       /* Drop all packets if no policy matches above this level */
 217 #define NECPCTL_DEBUG                                           2       /* Log all kernel policy matches */
 218 #define NECPCTL_PASS_LOOPBACK                           3       /* Pass all loopback traffic */
 219 #define NECPCTL_PASS_KEEPALIVES                         4       /* Pass all kernel-generated keepalive traffic */
 220 #define NECPCTL_SOCKET_POLICY_COUNT                     5       /* Count of all socket-level policies */
 221 #define NECPCTL_SOCKET_NON_APP_POLICY_COUNT     6       /* Count of non-per-app socket-level policies */
 222 #define NECPCTL_IP_POLICY_COUNT                         7       /* Count of all ip-level policies */
 223 #define NECPCTL_SESSION_COUNT                           8       /* Count of NECP sessions */
 224
 225 #define NECPCTL_NAMES {                                 \
 226         { 0, 0 },                                                       \
 227         { "drop_all_level", CTLTYPE_INT },      \
 228         { "debug", CTLTYPE_INT },                       \
 229         { "pass_loopback", CTLTYPE_INT },       \
 230         { "pass_keepalives", CTLTYPE_INT },     \
 231 }
 232
 233 typedef u_int32_t necp_kernel_policy_id;
 234 #define NECP_KERNEL_POLICY_ID_NONE                      0
 235 #define NECP_KERNEL_POLICY_ID_NO_MATCH          1
 236 #define NECP_KERNEL_POLICY_ID_FIRST_VALID       2
 237
 238 typedef u_int32_t necp_app_id;
 239
 240 #define NECP_KERNEL_POLICY_RESULT_NONE                                  0
 241 #define NECP_KERNEL_POLICY_RESULT_PASS                                  NECP_POLICY_RESULT_PASS
 242 #define NECP_KERNEL_POLICY_RESULT_SKIP                                  NECP_POLICY_RESULT_SKIP
 243 #define NECP_KERNEL_POLICY_RESULT_DROP                                  NECP_POLICY_RESULT_DROP
 244 #define NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT                 NECP_POLICY_RESULT_SOCKET_DIVERT
 245 #define NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER                 NECP_POLICY_RESULT_SOCKET_FILTER
 246 #define NECP_KERNEL_POLICY_RESULT_IP_TUNNEL                             NECP_POLICY_RESULT_IP_TUNNEL
 247 #define NECP_KERNEL_POLICY_RESULT_IP_FILTER                             NECP_POLICY_RESULT_IP_FILTER
 248 #define NECP_KERNEL_POLICY_RESULT_TRIGGER                               NECP_POLICY_RESULT_TRIGGER
 249 #define NECP_KERNEL_POLICY_RESULT_TRIGGER_IF_NEEDED             NECP_POLICY_RESULT_TRIGGER_IF_NEEDED
 250 #define NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED                NECP_POLICY_RESULT_TRIGGER_SCOPED
 251 #define NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED             NECP_POLICY_RESULT_NO_TRIGGER_SCOPED
 252 #define NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED                 NECP_POLICY_RESULT_SOCKET_SCOPED
 253 #define NECP_KERNEL_POLICY_RESULT_ROUTE_RULES                   NECP_POLICY_RESULT_ROUTE_RULES
 254 #define NECP_KERNEL_POLICY_RESULT_USE_NETAGENT                  NECP_POLICY_RESULT_USE_NETAGENT
 255
 256 typedef struct {
 257         u_int32_t identifier;
 258         u_int32_t data;
 259 } necp_kernel_policy_service;
 260
 261 typedef union {
 262         u_int                                           tunnel_interface_index;
 263         u_int                                           scoped_interface_index;
 264         u_int32_t                                       flow_divert_control_unit;
 265         u_int32_t                                       filter_control_unit;
 266         u_int32_t                                       skip_policy_order;
 267         u_int32_t                                       route_rule_id;
 268         u_int32_t                                       netagent_id;
 269         necp_kernel_policy_service      service;
 270 } necp_kernel_policy_result_parameter;
 271
 272 union necp_sockaddr_union {
 273         struct sockaddr                 sa;
 274         struct sockaddr_in              sin;
 275         struct sockaddr_in6             sin6;
 276 };
 277
 278 struct necp_kernel_socket_policy {
 279         LIST_ENTRY(necp_kernel_socket_policy)   chain;
 280         necp_policy_id                          parent_policy_id;
 281         necp_kernel_policy_id           id;
 282         necp_policy_order                       order;
 283         u_int32_t                                       session_order;
 284         int                                                     session_pid;
 285
 286         u_int32_t                                       condition_mask;
 287         u_int32_t                                       condition_negated_mask;
 288         necp_kernel_policy_id           cond_policy_id;
 289         u_int32_t                                       cond_app_id;                                    // Locally assigned ID value stored
 290         u_int32_t                                       cond_real_app_id;                               // Locally assigned ID value stored
 291         u_int32_t                                       cond_account_id;                                // Locally assigned ID value stored
 292         char                                            *cond_domain;                                   // String
 293         u_int8_t                                        cond_domain_dot_count;                  // Number of dots in cond_domain
 294         pid_t                                           cond_pid;
 295         uid_t                                           cond_uid;
 296         ifnet_t                                         cond_bound_interface;                   // Matches specific binding only
 297         struct necp_policy_condition_tc_range cond_traffic_class;       // Matches traffic class in range
 298         u_int16_t                                       cond_protocol;                                  // Matches IP protcol number
 299         union necp_sockaddr_union       cond_local_start;                               // Matches local IP address (or start)
 300         union necp_sockaddr_union       cond_local_end;                                 // Matches IP address range
 301         u_int8_t                                        cond_local_prefix;                              // Defines subnet
 302         union necp_sockaddr_union       cond_remote_start;                              // Matches remote IP address (or start)
 303         union necp_sockaddr_union       cond_remote_end;                                // Matches IP address range
 304         u_int8_t                                        cond_remote_prefix;                             // Defines subnet
 305
 306         necp_kernel_policy_result       result;
 307         necp_kernel_policy_result_parameter     result_parameter;
 308 };
 309
 310 struct necp_kernel_ip_output_policy {
 311         LIST_ENTRY(necp_kernel_ip_output_policy)        chain;
 312         necp_policy_id                          parent_policy_id;
 313         necp_kernel_policy_id           id;
 314         necp_policy_order                       suborder;
 315         necp_policy_order                       order;
 316         u_int32_t                                       session_order;
 317         int                                                     session_pid;
 318
 319         u_int32_t                                       condition_mask;
 320         u_int32_t                                       condition_negated_mask;
 321         necp_kernel_policy_id           cond_policy_id;
 322         ifnet_t                                         cond_bound_interface;                   // Matches specific binding only
 323         u_int16_t                                       cond_protocol;                                  // Matches IP protcol number
 324         union necp_sockaddr_union       cond_local_start;                               // Matches local IP address (or start)
 325         union necp_sockaddr_union       cond_local_end;                                 // Matches IP address range
 326         u_int8_t                                        cond_local_prefix;                              // Defines subnet
 327         union necp_sockaddr_union       cond_remote_start;                              // Matches remote IP address (or start)
 328         union necp_sockaddr_union       cond_remote_end;                                // Matches IP address range
 329         u_int8_t                                        cond_remote_prefix;                             // Defines subnet
 330         u_int32_t                                       cond_last_interface_index;
 331
 332         necp_kernel_policy_result       result;
 333         necp_kernel_policy_result_parameter     result_parameter;
 334 };
 335
 336 #define MAX_KERNEL_SOCKET_POLICIES                      1
 337 #define MAX_KERNEL_IP_OUTPUT_POLICIES           4
 338 struct necp_session_policy {
 339         LIST_ENTRY(necp_session_policy) chain;
 340         bool                            applied;                        // Applied into the kernel table
 341         bool                            pending_deletion;       // Waiting to be removed from kernel table
 342         bool                            pending_update;         // Policy has been modified since creation/last application
 343         necp_policy_id          id;
 344         necp_policy_order       order;
 345         u_int8_t                        *result;
 346         u_int32_t                       result_size;
 347         u_int8_t                        *conditions; // Array of conditions, each with a u_int32_t length at start
 348         u_int32_t                       conditions_size;
 349         u_int8_t                        *route_rules; // Array of route rules, each with a u_int32_t length at start
 350         u_int32_t                       route_rules_size;
 351
 352         uuid_t                          applied_app_uuid;
 353         uuid_t                          applied_real_app_uuid;
 354         char                            *applied_domain;
 355         char                            *applied_account;
 356
 357         uuid_t                          applied_result_uuid;
 358
 359         u_int32_t                       applied_route_rules_id;
 360
 361         necp_kernel_policy_id   kernel_socket_policies[MAX_KERNEL_SOCKET_POLICIES];
 362         necp_kernel_policy_id   kernel_ip_output_policies[MAX_KERNEL_IP_OUTPUT_POLICIES];
 363 };
 364
 365 struct necp_aggregate_socket_result {
 366         necp_kernel_policy_result                       result;
 367         necp_kernel_policy_result_parameter     result_parameter;
 368         necp_kernel_policy_filter                       filter_control_unit;
 369         u_int32_t                                                       route_rule_id;
 370 };
 371
 372 struct necp_inpcb_result {
 373         char                                                            *application_layer_domain;
 374         u_int32_t                                                       application_layer_account_id;
 375         necp_kernel_policy_id                           policy_id;
 376         int32_t                                                         policy_gencount;
 377         u_int32_t                                                       flowhash;
 378         struct necp_aggregate_socket_result     results;
 379 };
 380
 381 errno_t necp_init(void);
 382
 383 errno_t necp_set_socket_attributes(struct socket *so, struct sockopt *sopt);
 384 errno_t necp_get_socket_attributes(struct socket *so, struct sockopt *sopt);
 385
 386 u_int32_t necp_socket_get_content_filter_control_unit(struct socket *so);
 387
 388 bool necp_socket_should_use_flow_divert(struct inpcb *inp);
 389 u_int32_t necp_socket_get_flow_divert_control_unit(struct inpcb *inp);
 390
 391 bool necp_socket_should_rescope(struct inpcb *inp);
 392 u_int necp_socket_get_rescope_if_index(struct inpcb *inp);
 393 u_int32_t necp_socket_get_effective_mtu(struct inpcb *inp, u_int32_t current_mtu);
 394
 395 bool necp_socket_is_allowed_to_send_recv(struct inpcb *inp, necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id);
 396 bool necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port, u_int16_t remote_port, struct in_addr *local_addr, struct in_addr *remote_addr, ifnet_t interface, necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id);
 397 bool necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port, u_int16_t remote_port, struct in6_addr *local_addr, struct in6_addr *remote_addr, ifnet_t interface, necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id);
 398 int necp_mark_packet_from_socket(struct mbuf *packet, struct inpcb *inp, necp_kernel_policy_id policy_id, u_int32_t route_rule_id);
 399 necp_kernel_policy_id necp_get_policy_id_from_packet(struct mbuf *packet);
 400 u_int32_t necp_get_last_interface_index_from_packet(struct mbuf *packet);
 401 u_int32_t necp_get_route_rule_id_from_packet(struct mbuf *packet);
 402
 403 necp_kernel_policy_id necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local_addr, struct sockaddr *override_remote_addr, u_int32_t override_bound_interface);
 404 necp_kernel_policy_id necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_args *ipoa, necp_kernel_policy_result *result, necp_kernel_policy_result_parameter *result_parameter);
 405 necp_kernel_policy_id necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out_args *ip6oa, necp_kernel_policy_result *result, necp_kernel_policy_result_parameter *result_parameter);
 406
 407 int necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id);
 408 int necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface);
 409
 410 ifnet_t necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter);
 411 bool necp_packet_can_rebind_to_ifnet(struct mbuf *packet, struct ifnet *interface, struct route *new_route, int family);
 412
 413 bool necp_packet_is_allowed_over_interface(struct mbuf *packet, struct ifnet *interface);
 414
 415 int necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive);
 416 bool necp_get_is_keepalive_from_packet(struct mbuf *packet);
 417
 418 #endif /* BSD_KERNEL_PRIVATE */
 419 #ifndef KERNEL
 420 int necp_match_policy(const uint8_t *parameters, size_t parameters_size, struct necp_aggregate_result *returned_result);
 421 #endif /* !KERNEL */
 422
 423 #endif