]> git.saurik.com Git - apple/xnu.git/blob - bsd/net/necp.h
xnu-3789.41.3.tar.gz
[apple/xnu.git] / bsd / net / necp.h
1 /*
2 * Copyright (c) 2013-2016 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #ifndef _NET_NECP_H_
30 #define _NET_NECP_H_
31
32 #include <net/net_kev.h>
33 #ifdef PRIVATE
34
35 #include <netinet/in.h>
36 #include <sys/socket.h>
37 #include <net/if.h>
38
39 /*
40 * Name registered by the ipsec kernel control
41 */
42 #define NECP_CONTROL_NAME "com.apple.net.necp_control"
43
44 #define NECP_TLV_LENGTH_UINT32 1
45
46 struct necp_packet_header {
47 u_int8_t packet_type;
48 u_int8_t flags;
49 u_int32_t message_id;
50 };
51
52 /*
53 * Control message commands
54 */
55 #define NECP_PACKET_TYPE_POLICY_ADD 1
56 #define NECP_PACKET_TYPE_POLICY_GET 2
57 #define NECP_PACKET_TYPE_POLICY_DELETE 3
58 #define NECP_PACKET_TYPE_POLICY_APPLY_ALL 4
59 #define NECP_PACKET_TYPE_POLICY_LIST_ALL 5
60 #define NECP_PACKET_TYPE_POLICY_DELETE_ALL 6
61 #define NECP_PACKET_TYPE_SET_SESSION_PRIORITY 7
62 #define NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC 8
63 #define NECP_PACKET_TYPE_REGISTER_SERVICE 9
64 #define NECP_PACKET_TYPE_UNREGISTER_SERVICE 10
65 #define NECP_PACKET_TYPE_POLICY_DUMP_ALL 11
66
67 /*
68 * Control message flags
69 */
70 #define NECP_PACKET_FLAGS_RESPONSE 0x01 // Used for acks, errors, and query responses
71
72 /*
73 * Control message TLV types
74 */
75 #define NECP_TLV_NIL 0
76 #define NECP_TLV_ERROR 1 // u_int32_t
77 #define NECP_TLV_POLICY_ORDER 2 // u_int32_t
78 #define NECP_TLV_POLICY_CONDITION 3
79 #define NECP_TLV_POLICY_RESULT 4
80 #define NECP_TLV_POLICY_ID 5 // u_int32_t
81 #define NECP_TLV_SESSION_PRIORITY 6 // u_int32_t
82 #define NECP_TLV_ATTRIBUTE_DOMAIN 7 // char[]
83 #define NECP_TLV_ATTRIBUTE_ACCOUNT 8 // char[]
84 #define NECP_TLV_SERVICE_UUID 9 // uuid_t
85 #define NECP_TLV_ROUTE_RULE 10
86
87 /*
88 * Control message TLV sent only by the kernel to userspace
89 */
90 #define NECP_TLV_POLICY_OWNER 100 // char []
91 #define NECP_TLV_POLICY_DUMP 101
92 #define NECP_TLV_POLICY_RESULT_STRING 102 // char []
93 #define NECP_TLV_POLICY_SESSION_ORDER 103 // u_int32_t
94
95 /*
96 * Condition flags
97 */
98 #define NECP_POLICY_CONDITION_FLAGS_NEGATIVE 0x01 // Negative
99
100 /*
101 * Conditions
102 * Used for setting policies as well as passing parameters to necp_match_policy.
103 */
104 #define NECP_POLICY_CONDITION_DEFAULT 0 // N/A, not valid with any other conditions
105 // Socket/Application conditions
106 #define NECP_POLICY_CONDITION_APPLICATION 1 // uuid_t, uses effective UUID when possible
107 #define NECP_POLICY_CONDITION_REAL_APPLICATION 2 // uuid_t, never uses effective UUID. Only valid with NECP_POLICY_CONDITION_APPLICATION
108 #define NECP_POLICY_CONDITION_DOMAIN 3 // String, such as apple.com
109 #define NECP_POLICY_CONDITION_ACCOUNT 4 // String
110 #define NECP_POLICY_CONDITION_ENTITLEMENT 5 // String
111 #define NECP_POLICY_CONDITION_PID 6 // pid_t
112 #define NECP_POLICY_CONDITION_UID 7 // uid_t
113 #define NECP_POLICY_CONDITION_ALL_INTERFACES 8 // N/A
114 #define NECP_POLICY_CONDITION_BOUND_INTERFACE 9 // String
115 #define NECP_POLICY_CONDITION_TRAFFIC_CLASS 10 // necp_policy_condition_tc_range
116 // Socket/IP conditions
117 #define NECP_POLICY_CONDITION_IP_PROTOCOL 11 // u_int8_t
118 #define NECP_POLICY_CONDITION_LOCAL_ADDR 12 // necp_policy_condition_addr
119 #define NECP_POLICY_CONDITION_REMOTE_ADDR 13 // necp_policy_condition_addr
120 #define NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE 14 // necp_policy_condition_addr_range
121 #define NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE 15 // necp_policy_condition_addr_range
122
123 /*
124 * Results
125 */
126 #define NECP_POLICY_RESULT_PASS 1 // N/A
127 #define NECP_POLICY_RESULT_SKIP 2 // u_int32_t, policy order to skip to. 0 to skip all session policies.
128 #define NECP_POLICY_RESULT_DROP 3 // N/A
129 #define NECP_POLICY_RESULT_SOCKET_DIVERT 4 // u_int32_t, flow divert control unit
130 #define NECP_POLICY_RESULT_SOCKET_FILTER 5 // u_int32_t, filter control unit
131 #define NECP_POLICY_RESULT_IP_TUNNEL 6 // String, interface name
132 #define NECP_POLICY_RESULT_IP_FILTER 7 // ?
133 #define NECP_POLICY_RESULT_TRIGGER 8 // service uuid_t
134 #define NECP_POLICY_RESULT_TRIGGER_IF_NEEDED 9 // service uuid_t
135 #define NECP_POLICY_RESULT_TRIGGER_SCOPED 10 // service uuid_t
136 #define NECP_POLICY_RESULT_NO_TRIGGER_SCOPED 11 // service uuid_t
137 #define NECP_POLICY_RESULT_SOCKET_SCOPED 12 // String, interface name
138 #define NECP_POLICY_RESULT_ROUTE_RULES 13 // N/A, must have route rules defined
139 #define NECP_POLICY_RESULT_USE_NETAGENT 14 // netagent uuid_t
140
141 #define NECP_POLICY_RESULT_MAX NECP_POLICY_RESULT_USE_NETAGENT
142
143 /*
144 * Route Rules
145 * Detailed parameters for NECP_POLICY_RESULT_ROUTE_RULES.
146 */
147 #define NECP_ROUTE_RULE_NONE 0 // N/A
148 #define NECP_ROUTE_RULE_DENY_INTERFACE 1 // String, or empty to match all
149 #define NECP_ROUTE_RULE_ALLOW_INTERFACE 2 // String, or empty to match all
150 #define NECP_ROUTE_RULE_QOS_MARKING 3 // String, or empty to match all
151
152 #define NECP_ROUTE_RULE_FLAG_CELLULAR 0x01
153 #define NECP_ROUTE_RULE_FLAG_WIFI 0x02
154 #define NECP_ROUTE_RULE_FLAG_WIRED 0x04
155 #define NECP_ROUTE_RULE_FLAG_EXPENSIVE 0x08
156
157 /*
158 * Error types
159 */
160 #define NECP_ERROR_INTERNAL 0
161 #define NECP_ERROR_UNKNOWN_PACKET_TYPE 1
162 #define NECP_ERROR_INVALID_TLV 2
163 #define NECP_ERROR_POLICY_RESULT_INVALID 3
164 #define NECP_ERROR_POLICY_CONDITIONS_INVALID 4
165 #define NECP_ERROR_POLICY_ID_NOT_FOUND 5
166 #define NECP_ERROR_INVALID_PROCESS 6
167 #define NECP_ERROR_ROUTE_RULES_INVALID 7
168
169 // Modifiers
170 #define NECP_MASK_USERSPACE_ONLY 0x80000000 // on filter_control_unit value
171
172 struct necp_policy_condition_tc_range {
173 u_int32_t start_tc;
174 u_int32_t end_tc;
175 } __attribute__((__packed__));
176
177 struct necp_policy_condition_addr {
178 u_int8_t prefix;
179 union {
180 struct sockaddr sa;
181 struct sockaddr_in sin;
182 struct sockaddr_in6 sin6;
183 } address;
184 } __attribute__((__packed__));
185
186 struct necp_policy_condition_addr_range {
187 union {
188 struct sockaddr sa;
189 struct sockaddr_in sin;
190 struct sockaddr_in6 sin6;
191 } start_address;
192 union {
193 struct sockaddr sa;
194 struct sockaddr_in sin;
195 struct sockaddr_in6 sin6;
196 } end_address;
197 } __attribute__((__packed__));
198
199 #define NECP_SESSION_PRIORITY_UNKNOWN 0
200 #define NECP_SESSION_PRIORITY_CONTROL 1
201 #define NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL 2
202 #define NECP_SESSION_PRIORITY_HIGH 3
203 #define NECP_SESSION_PRIORITY_DEFAULT 4
204 #define NECP_SESSION_PRIORITY_LOW 5
205
206 #define NECP_SESSION_NUM_PRIORITIES NECP_SESSION_PRIORITY_LOW
207
208 typedef u_int32_t necp_policy_id;
209 typedef u_int32_t necp_policy_order;
210
211 typedef u_int32_t necp_kernel_policy_result;
212 typedef u_int32_t necp_kernel_policy_filter;
213
214 typedef union {
215 u_int tunnel_interface_index;
216 u_int scoped_interface_index;
217 u_int32_t flow_divert_control_unit;
218 u_int32_t filter_control_unit;
219 } necp_kernel_policy_routing_result_parameter;
220
221 #define NECP_SERVICE_FLAGS_REGISTERED 0x01
222 #define NECP_MAX_NETAGENTS 8
223 struct necp_aggregate_result {
224 necp_kernel_policy_result routing_result;
225 necp_kernel_policy_routing_result_parameter routing_result_parameter;
226 necp_kernel_policy_filter filter_control_unit;
227 necp_kernel_policy_result service_action;
228 uuid_t service_uuid;
229 u_int32_t service_flags;
230 u_int32_t service_data;
231 u_int routed_interface_index;
232 u_int32_t policy_id;
233 uuid_t netagents[NECP_MAX_NETAGENTS];
234 u_int32_t netagent_flags[NECP_MAX_NETAGENTS];
235 };
236
237 /*
238 * Statistics. It would be nice if the definitions in ntstat.h could be used,
239 * but they get entangled with #defines for v4 etc in pfvar.h and it may be better practice
240 * to have separate definitions here.
241 */
242 typedef struct necp_stat_counts
243 {
244 /* Counters */
245 u_int64_t necp_stat_rxpackets __attribute__((aligned(8)));
246 u_int64_t necp_stat_rxbytes __attribute__((aligned(8)));
247 u_int64_t necp_stat_txpackets __attribute__((aligned(8)));
248 u_int64_t necp_stat_txbytes __attribute__((aligned(8)));
249
250 u_int32_t necp_stat_rxduplicatebytes;
251 u_int32_t necp_stat_rxoutoforderbytes;
252 u_int32_t necp_stat_txretransmit;
253
254 u_int32_t necp_stat_connectattempts;
255 u_int32_t necp_stat_connectsuccesses;
256
257 u_int32_t necp_stat_min_rtt;
258 u_int32_t necp_stat_avg_rtt;
259 u_int32_t necp_stat_var_rtt;
260
261 u_int64_t necp_stat_cell_rxbytes __attribute__((aligned(8)));
262 u_int64_t necp_stat_cell_txbytes __attribute__((aligned(8)));
263 u_int64_t necp_stat_wifi_rxbytes __attribute__((aligned(8)));
264 u_int64_t necp_stat_wifi_txbytes __attribute__((aligned(8)));
265 u_int64_t necp_stat_wired_rxbytes __attribute__((aligned(8)));
266 u_int64_t necp_stat_wired_txbytes __attribute__((aligned(8)));
267 } necp_stat_counts;
268
269 // Note, some metadata is implicit in the necp client itself:
270 // From the process itself : pid, upid, uuid, proc name.
271 // From the necp client parameters: local and remote addresses, euuid, traffic class, ifindex
272 //
273 // The following may well be supplied via future necp client parameters,
274 // but they are here so they don't get forgotten.
275 typedef struct necp_basic_metadata
276 {
277 u_int32_t rcvbufsize;
278 u_int32_t rcvbufused;
279
280 u_int64_t eupid; // Not currently used by NetworkStatistics, could skip.
281 u_int32_t epid;
282
283 uuid_t vuuid; // Effective UUID as given from voucher
284 uint16_t ifnet_properties;
285 } necp_basic_metadata;
286
287 struct necp_tcp_probe_status {
288 unsigned int probe_activated : 1;
289 unsigned int write_probe_failed : 1;
290 unsigned int read_probe_failed : 1;
291 unsigned int conn_probe_failed : 1;
292 };
293
294 typedef struct necp_extra_tcp_metadata
295 {
296 struct necp_tcp_probe_status probestatus;
297
298 u_int32_t sndbufsize;
299 u_int32_t sndbufused;
300 u_int32_t txunacked;
301 u_int32_t txwindow;
302 u_int32_t txcwindow;
303 u_int32_t traffic_mgt_flags;
304 u_int32_t cc_alg_index;
305 u_int32_t state;
306 } necp_extra_tcp_metadata;
307
308 typedef struct necp_stats_hdr {
309 u_int32_t necp_stats_type __attribute__((aligned(8)));
310 u_int32_t necp_stats_ver;
311 u_int64_t necp_stats_event;
312 } necp_stats_hdr;
313
314 #define NECP_CLIENT_STATISTICS_TYPE_TCP 1 // Identifies use of necp_tcp_stats
315 #define NECP_CLIENT_STATISTICS_TYPE_UDP 2 // Identifies use of necp_udp_stats
316 #define NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1 1 // Currently supported version for TCP
317 #define NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1 1 // Currently supported version for UDP
318
319 typedef struct necp_tcp_stats {
320 necp_stats_hdr necp_tcp_hdr;
321 necp_stat_counts necp_tcp_counts;
322 necp_basic_metadata necp_tcp_basic;
323 necp_extra_tcp_metadata necp_tcp_extra;
324 } necp_tcp_stats;
325
326 typedef struct necp_udp_stats {
327 necp_stats_hdr necp_udp_hdr;
328 necp_stat_counts necp_udp_counts;
329 necp_basic_metadata necp_udp_basic;
330 } necp_udp_stats;
331
332 typedef struct necp_all_stats {
333 union {
334 necp_tcp_stats tcp_stats;
335 necp_udp_stats udp_stats;
336 } all_stats_u;
337 } necp_all_stats;
338
339 /*
340 * NECP Client definitions
341 */
342 #define NECP_MAX_CLIENT_PARAMETERS_SIZE 1024
343 #define NECP_MAX_CLIENT_RESULT_SIZE 512
344
345 #define NECP_OPEN_FLAG_OBSERVER 0x01 // Observers can query clients they don't own
346
347 #define NECP_CLIENT_ACTION_ADD 1 // Register a new client. Input: parameters in buffer; Output: client_id
348 #define NECP_CLIENT_ACTION_REMOVE 2 // Unregister a client. Input: client_id
349 #define NECP_CLIENT_ACTION_COPY_PARAMETERS 3 // Copy client parameters. Input: client_id; Output: parameters in buffer
350 #define NECP_CLIENT_ACTION_COPY_RESULT 4 // Copy client result. Input: client_id; Output: result in buffer
351 #define NECP_CLIENT_ACTION_COPY_LIST 5 // Copy all client IDs. Output: struct necp_client_list in buffer
352 #define NECP_CLIENT_ACTION_REQUEST_NEXUS_INSTANCE 6 // Request a nexus instance from a nexus provider
353 #define NECP_CLIENT_ACTION_AGENT 7 // Interact with agent. Input: client_id, agent parameters
354 #define NECP_CLIENT_ACTION_COPY_AGENT 8 // Copy agent content. Input: agent UUID; Output: struct netagent
355 #define NECP_CLIENT_ACTION_COPY_INTERFACE 9 // Copy interface details. Input: ifindex cast to UUID; Output: struct necp_interface_details
356 #define NECP_CLIENT_ACTION_SET_STATISTICS 10 // Start/update/complete per-flow statistics. Input: client_id, statistics area
357
358 #define NECP_CLIENT_PARAMETER_APPLICATION NECP_POLICY_CONDITION_APPLICATION // Requires entitlement
359 #define NECP_CLIENT_PARAMETER_REAL_APPLICATION NECP_POLICY_CONDITION_REAL_APPLICATION // Requires entitlement
360 #define NECP_CLIENT_PARAMETER_DOMAIN NECP_POLICY_CONDITION_DOMAIN
361 #define NECP_CLIENT_PARAMETER_ACCOUNT NECP_POLICY_CONDITION_ACCOUNT
362 #define NECP_CLIENT_PARAMETER_PID NECP_POLICY_CONDITION_PID // Requires entitlement
363 #define NECP_CLIENT_PARAMETER_UID NECP_POLICY_CONDITION_UID // Requires entitlement
364 #define NECP_CLIENT_PARAMETER_BOUND_INTERFACE NECP_POLICY_CONDITION_BOUND_INTERFACE
365 #define NECP_CLIENT_PARAMETER_TRAFFIC_CLASS NECP_POLICY_CONDITION_TRAFFIC_CLASS
366 #define NECP_CLIENT_PARAMETER_IP_PROTOCOL NECP_POLICY_CONDITION_IP_PROTOCOL
367 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS NECP_POLICY_CONDITION_LOCAL_ADDR
368 #define NECP_CLIENT_PARAMETER_REMOTE_ADDRESS NECP_POLICY_CONDITION_REMOTE_ADDR
369
370 // "Prohibit" will never choose an interface with that property
371 #define NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE 100 // String, interface name
372 #define NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE 101 // u_int8_t, see ifru_functional_type in <net/if.h>
373 #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT 102 // uuid_t, network agent UUID
374 #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE 103 // struct necp_client_parameter_netagent_type
375
376 // "Require" will choose an interface with that property, or none if not found
377 #define NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE 111 // u_int8_t, see ifru_functional_type in <net/if.h>
378 #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT 112 // uuid_t, network agent UUID
379 #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE 113 // struct necp_client_parameter_netagent_type
380
381 // "Prefer" will choose an interface with that property, or best otherwise if not found
382 #define NECP_CLIENT_PARAMETER_PREFER_AGENT 122 // uuid_t, network agent UUID
383 #define NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE 123 // struct necp_client_parameter_netagent_type
384
385 // Use actions with NECP_CLIENT_ACTION_AGENT
386 #define NECP_CLIENT_PARAMETER_TRIGGER_AGENT 130 // uuid_t, network agent UUID
387 #define NECP_CLIENT_PARAMETER_ASSERT_AGENT 131 // uuid_t, network agent UUID
388 #define NECP_CLIENT_PARAMETER_UNASSERT_AGENT 132 // uuid_t, network agent UUID
389
390 #define NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT 200 // struct necp_client_endpoint
391 #define NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT 201 // struct necp_client_endpoint
392 #define NECP_CLIENT_PARAMETER_RESERVED_START 1000 // Parameters 1000 and higher are reserved for custom userspace options
393
394 #define NECP_CLIENT_RESULT_CLIENT_ID 1 // uuid_t
395 #define NECP_CLIENT_RESULT_POLICY_RESULT 2 // u_int32_t
396 #define NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER 3 // u_int32_t
397 #define NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT 4 // u_int32_t
398 #define NECP_CLIENT_RESULT_INTERFACE_INDEX 5 // u_int32_t
399 #define NECP_CLIENT_RESULT_NETAGENT 6 // struct necp_client_result_netagent
400 #define NECP_CLIENT_RESULT_FLAGS 7 // u_int32_t, see NECP_CLIENT_RESULT_FLAG_* values
401 #define NECP_CLIENT_RESULT_INTERFACE 8 // struct necp_client_result_interface
402
403 #define NECP_CLIENT_RESULT_NEXUS_INSTANCE 100 // uuid_t
404 #define NECP_CLIENT_RESULT_NEXUS_PORT 101 // u_int16_t
405
406 #define NECP_CLIENT_RESULT_LOCAL_ENDPOINT 200 // struct necp_client_endpoint
407 #define NECP_CLIENT_RESULT_REMOTE_ENDPOINT 201 // struct necp_client_endpoint
408
409 #define NECP_CLIENT_RESULT_FLAG_IS_LOCAL 0x0001 // Routes to this device
410 #define NECP_CLIENT_RESULT_FLAG_IS_DIRECT 0x0002 // Routes to directly accessible peer
411 #define NECP_CLIENT_RESULT_FLAG_HAS_IPV4 0x0004 // Supports IPv4
412 #define NECP_CLIENT_RESULT_FLAG_HAS_IPV6 0x0008 // Supports IPv6
413
414 struct necp_interface_details {
415 char name[IFXNAMSIZ];
416 u_int32_t index;
417 u_int32_t generation;
418 u_int32_t functional_type;
419 u_int32_t delegate_index;
420 u_int32_t flags; // see NECP_INTERFACE_FLAG_*
421 u_int32_t mtu;
422 u_int8_t ipv4_signature[IFNET_SIGNATURELEN];
423 u_int8_t ipv6_signature[IFNET_SIGNATURELEN];
424 };
425
426 #define NECP_INTERFACE_FLAG_EXPENSIVE 0x0001
427
428 struct necp_client_parameter_netagent_type {
429 char netagent_domain[32];
430 char netagent_type[32];
431 };
432
433 struct necp_client_result_netagent {
434 u_int32_t generation;
435 uuid_t netagent_uuid;
436 };
437
438 struct necp_client_result_interface {
439 u_int32_t generation;
440 u_int32_t index;
441 };
442
443 struct necp_client_endpoint {
444 union {
445 struct sockaddr sa;
446 struct sockaddr_in sin;
447 struct sockaddr_in6 sin6;
448 struct {
449 u_int8_t endpoint_length;
450 u_int8_t endpoint_family; // Use AF_UNSPEC to target a name
451 u_int16_t endpoint_port;
452 u_int32_t endpoint_type; // Client-specific type
453 char endpoint_data[0]; // Type-specific endpoint value
454 } endpoint;
455 } u;
456 };
457
458 struct necp_client_list {
459 u_int32_t client_count;
460 uuid_t clients[0];
461 };
462
463 struct kev_necp_policies_changed_data {
464 u_int32_t changed_count; // Defaults to 0.
465 };
466
467 #ifdef BSD_KERNEL_PRIVATE
468 #include <stdbool.h>
469 #include <sys/socketvar.h>
470 #include <sys/kern_control.h>
471 #include <netinet/ip_var.h>
472 #include <netinet6/ip6_var.h>
473 #include <net/if_var.h>
474 #include <sys/syslog.h>
475 #include <net/network_agent.h>
476
477 #define NECPLOG(level, format, ...) do { \
478 log((level > LOG_NOTICE ? LOG_NOTICE : level), "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \
479 } while (0)
480
481 #define NECPLOG0(level, msg) do { \
482 log((level > LOG_NOTICE ? LOG_NOTICE : level), "%s: %s\n", __FUNCTION__, msg); \
483 } while (0)
484
485 extern errno_t necp_client_init(void);
486 extern int necp_application_find_policy_match_internal(proc_t proc, u_int8_t *parameters, u_int32_t parameters_size,
487 struct necp_aggregate_result *returned_result,
488 u_int32_t *flags, u_int required_interface_index);
489 /*
490 * TLV utilities
491 *
492 * Note that these functions (other than necp_buffer_find_tlv) do not check the length of the entire buffer,
493 * so the caller must be sure that the entire TLV is within bounds.
494 */
495 extern u_int8_t *necp_buffer_write_tlv(u_int8_t *buffer, u_int8_t type, u_int32_t length, const void *value);
496 extern u_int8_t *necp_buffer_write_tlv_if_different(u_int8_t *buffer, const u_int8_t *max, u_int8_t type,
497 u_int32_t length, const void *value, bool *updated);
498 extern u_int8_t necp_buffer_get_tlv_type(u_int8_t *buffer, int tlv_offset);
499 extern u_int32_t necp_buffer_get_tlv_length(u_int8_t *buffer, int tlv_offset);
500 extern u_int8_t *necp_buffer_get_tlv_value(u_int8_t *buffer, int tlv_offset, u_int32_t *value_size);
501 extern int necp_buffer_find_tlv(u_int8_t *buffer, u_int32_t buffer_length, int offset, u_int8_t type, int next);
502
503 #define NECPCTL_DROP_ALL_LEVEL 1 /* Drop all packets if no policy matches above this level */
504 #define NECPCTL_DEBUG 2 /* Log all kernel policy matches */
505 #define NECPCTL_PASS_LOOPBACK 3 /* Pass all loopback traffic */
506 #define NECPCTL_PASS_KEEPALIVES 4 /* Pass all kernel-generated keepalive traffic */
507 #define NECPCTL_SOCKET_POLICY_COUNT 5 /* Count of all socket-level policies */
508 #define NECPCTL_SOCKET_NON_APP_POLICY_COUNT 6 /* Count of non-per-app socket-level policies */
509 #define NECPCTL_IP_POLICY_COUNT 7 /* Count of all ip-level policies */
510 #define NECPCTL_SESSION_COUNT 8 /* Count of NECP sessions */
511
512 #define NECPCTL_NAMES { \
513 { 0, 0 }, \
514 { "drop_all_level", CTLTYPE_INT }, \
515 { "debug", CTLTYPE_INT }, \
516 { "pass_loopback", CTLTYPE_INT }, \
517 { "pass_keepalives", CTLTYPE_INT }, \
518 }
519
520 typedef u_int32_t necp_kernel_policy_id;
521 #define NECP_KERNEL_POLICY_ID_NONE 0
522 #define NECP_KERNEL_POLICY_ID_NO_MATCH 1
523 #define NECP_KERNEL_POLICY_ID_FIRST_VALID 2
524
525 typedef u_int32_t necp_app_id;
526
527 #define NECP_KERNEL_POLICY_RESULT_NONE 0
528 #define NECP_KERNEL_POLICY_RESULT_PASS NECP_POLICY_RESULT_PASS
529 #define NECP_KERNEL_POLICY_RESULT_SKIP NECP_POLICY_RESULT_SKIP
530 #define NECP_KERNEL_POLICY_RESULT_DROP NECP_POLICY_RESULT_DROP
531 #define NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT NECP_POLICY_RESULT_SOCKET_DIVERT
532 #define NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER NECP_POLICY_RESULT_SOCKET_FILTER
533 #define NECP_KERNEL_POLICY_RESULT_IP_TUNNEL NECP_POLICY_RESULT_IP_TUNNEL
534 #define NECP_KERNEL_POLICY_RESULT_IP_FILTER NECP_POLICY_RESULT_IP_FILTER
535 #define NECP_KERNEL_POLICY_RESULT_TRIGGER NECP_POLICY_RESULT_TRIGGER
536 #define NECP_KERNEL_POLICY_RESULT_TRIGGER_IF_NEEDED NECP_POLICY_RESULT_TRIGGER_IF_NEEDED
537 #define NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED NECP_POLICY_RESULT_TRIGGER_SCOPED
538 #define NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED NECP_POLICY_RESULT_NO_TRIGGER_SCOPED
539 #define NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED NECP_POLICY_RESULT_SOCKET_SCOPED
540 #define NECP_KERNEL_POLICY_RESULT_ROUTE_RULES NECP_POLICY_RESULT_ROUTE_RULES
541 #define NECP_KERNEL_POLICY_RESULT_USE_NETAGENT NECP_POLICY_RESULT_USE_NETAGENT
542
543 typedef struct {
544 u_int32_t identifier;
545 u_int32_t data;
546 } necp_kernel_policy_service;
547
548 typedef union {
549 u_int tunnel_interface_index;
550 u_int scoped_interface_index;
551 u_int32_t flow_divert_control_unit;
552 u_int32_t filter_control_unit;
553 u_int32_t skip_policy_order;
554 u_int32_t route_rule_id;
555 u_int32_t netagent_id;
556 necp_kernel_policy_service service;
557 } necp_kernel_policy_result_parameter;
558
559 union necp_sockaddr_union {
560 struct sockaddr sa;
561 struct sockaddr_in sin;
562 struct sockaddr_in6 sin6;
563 };
564
565 struct necp_kernel_socket_policy {
566 LIST_ENTRY(necp_kernel_socket_policy) chain;
567 necp_policy_id parent_policy_id;
568 necp_kernel_policy_id id;
569 necp_policy_order order;
570 u_int32_t session_order;
571 int session_pid;
572
573 u_int32_t condition_mask;
574 u_int32_t condition_negated_mask;
575 necp_kernel_policy_id cond_policy_id;
576 u_int32_t cond_app_id; // Locally assigned ID value stored
577 u_int32_t cond_real_app_id; // Locally assigned ID value stored
578 char *cond_custom_entitlement; // String
579 u_int32_t cond_account_id; // Locally assigned ID value stored
580 char *cond_domain; // String
581 u_int8_t cond_domain_dot_count; // Number of dots in cond_domain
582 pid_t cond_pid;
583 uid_t cond_uid;
584 ifnet_t cond_bound_interface; // Matches specific binding only
585 struct necp_policy_condition_tc_range cond_traffic_class; // Matches traffic class in range
586 u_int16_t cond_protocol; // Matches IP protcol number
587 union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
588 union necp_sockaddr_union cond_local_end; // Matches IP address range
589 u_int8_t cond_local_prefix; // Defines subnet
590 union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
591 union necp_sockaddr_union cond_remote_end; // Matches IP address range
592 u_int8_t cond_remote_prefix; // Defines subnet
593
594 necp_kernel_policy_result result;
595 necp_kernel_policy_result_parameter result_parameter;
596 };
597
598 struct necp_kernel_ip_output_policy {
599 LIST_ENTRY(necp_kernel_ip_output_policy) chain;
600 necp_policy_id parent_policy_id;
601 necp_kernel_policy_id id;
602 necp_policy_order suborder;
603 necp_policy_order order;
604 u_int32_t session_order;
605 int session_pid;
606
607 u_int32_t condition_mask;
608 u_int32_t condition_negated_mask;
609 necp_kernel_policy_id cond_policy_id;
610 ifnet_t cond_bound_interface; // Matches specific binding only
611 u_int16_t cond_protocol; // Matches IP protcol number
612 union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
613 union necp_sockaddr_union cond_local_end; // Matches IP address range
614 u_int8_t cond_local_prefix; // Defines subnet
615 union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
616 union necp_sockaddr_union cond_remote_end; // Matches IP address range
617 u_int8_t cond_remote_prefix; // Defines subnet
618 u_int32_t cond_last_interface_index;
619
620 necp_kernel_policy_result result;
621 necp_kernel_policy_result_parameter result_parameter;
622 };
623
624 #define MAX_KERNEL_SOCKET_POLICIES 1
625 #define MAX_KERNEL_IP_OUTPUT_POLICIES 4
626 struct necp_session_policy {
627 LIST_ENTRY(necp_session_policy) chain;
628 bool applied; // Applied into the kernel table
629 bool pending_deletion; // Waiting to be removed from kernel table
630 bool pending_update; // Policy has been modified since creation/last application
631 necp_policy_id id;
632 necp_policy_order order;
633 u_int8_t *result;
634 u_int32_t result_size;
635 u_int8_t *conditions; // Array of conditions, each with a u_int32_t length at start
636 u_int32_t conditions_size;
637 u_int8_t *route_rules; // Array of route rules, each with a u_int32_t length at start
638 u_int32_t route_rules_size;
639
640 uuid_t applied_app_uuid;
641 uuid_t applied_real_app_uuid;
642 char *applied_domain;
643 char *applied_account;
644
645 uuid_t applied_result_uuid;
646
647 u_int32_t applied_route_rules_id;
648
649 necp_kernel_policy_id kernel_socket_policies[MAX_KERNEL_SOCKET_POLICIES];
650 necp_kernel_policy_id kernel_ip_output_policies[MAX_KERNEL_IP_OUTPUT_POLICIES];
651 };
652
653 struct necp_aggregate_socket_result {
654 necp_kernel_policy_result result;
655 necp_kernel_policy_result_parameter result_parameter;
656 necp_kernel_policy_filter filter_control_unit;
657 u_int32_t route_rule_id;
658 int32_t qos_marking_gencount;
659 };
660
661 struct necp_inpcb_result {
662 u_int32_t app_id;
663 necp_kernel_policy_id policy_id;
664 int32_t policy_gencount;
665 u_int32_t flowhash;
666 struct necp_aggregate_socket_result results;
667 };
668
669 extern errno_t necp_init(void);
670
671 extern errno_t necp_set_socket_attributes(struct socket *so, struct sockopt *sopt);
672 extern errno_t necp_get_socket_attributes(struct socket *so, struct sockopt *sopt);
673 extern void necp_inpcb_dispose(struct inpcb *inp);
674
675 extern u_int32_t necp_socket_get_content_filter_control_unit(struct socket *so);
676
677 extern bool necp_socket_should_use_flow_divert(struct inpcb *inp);
678 extern u_int32_t necp_socket_get_flow_divert_control_unit(struct inpcb *inp);
679
680 extern bool necp_socket_should_rescope(struct inpcb *inp);
681 extern u_int necp_socket_get_rescope_if_index(struct inpcb *inp);
682 extern u_int32_t necp_socket_get_effective_mtu(struct inpcb *inp, u_int32_t current_mtu);
683
684 extern bool necp_socket_is_allowed_to_send_recv(struct inpcb *inp, necp_kernel_policy_id *return_policy_id,
685 u_int32_t *return_route_rule_id);
686 extern bool necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port,
687 u_int16_t remote_port, struct in_addr *local_addr,
688 struct in_addr *remote_addr, ifnet_t interface,
689 necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id);
690 extern bool necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port,
691 u_int16_t remote_port, struct in6_addr *local_addr,
692 struct in6_addr *remote_addr, ifnet_t interface,
693 necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id);
694 extern void necp_socket_update_qos_marking(struct inpcb *inp, struct rtentry *route, struct ifnet *interface, u_int32_t route_rule_id);
695 extern int necp_mark_packet_from_socket(struct mbuf *packet, struct inpcb *inp, necp_kernel_policy_id policy_id,
696 u_int32_t route_rule_id);
697 extern necp_kernel_policy_id necp_get_policy_id_from_packet(struct mbuf *packet);
698 extern u_int32_t necp_get_last_interface_index_from_packet(struct mbuf *packet);
699 extern u_int32_t necp_get_route_rule_id_from_packet(struct mbuf *packet);
700 extern int necp_get_app_uuid_from_packet(struct mbuf *packet,
701 uuid_t app_uuid);
702
703 extern necp_kernel_policy_id necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local_addr,
704 struct sockaddr *override_remote_addr, u_int32_t override_bound_interface);
705 extern necp_kernel_policy_id necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_args *ipoa,
706 necp_kernel_policy_result *result,
707 necp_kernel_policy_result_parameter *result_parameter);
708 extern necp_kernel_policy_id necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out_args *ip6oa,
709 necp_kernel_policy_result *result,
710 necp_kernel_policy_result_parameter *result_parameter);
711
712 extern int necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id);
713 extern int necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface);
714
715 extern ifnet_t necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter);
716 extern bool necp_packet_can_rebind_to_ifnet(struct mbuf *packet, struct ifnet *interface, struct route *new_route, int family);
717
718 extern bool necp_packet_is_allowed_over_interface(struct mbuf *packet, struct ifnet *interface);
719
720 extern int necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive);
721 extern bool necp_get_is_keepalive_from_packet(struct mbuf *packet);
722
723 extern void necp_update_all_clients(void); // Handle general re-evaluate event
724
725 extern void necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid); // Cause a single client to get an update event
726
727 extern int necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id,
728 u_int8_t *assigned_results, size_t assigned_results_length);
729
730 #endif /* BSD_KERNEL_PRIVATE */
731 #ifndef KERNEL
732
733 extern int necp_match_policy(const uint8_t *parameters, size_t parameters_size, struct necp_aggregate_result *returned_result);
734
735 extern int necp_open(int flags);
736
737 extern int necp_client_action(int necp_fd, uint32_t action, uuid_t client_id,
738 size_t client_id_len, uint8_t *buffer, size_t buffer_size);
739
740 #endif /* !KERNEL */
741
742 #endif /* PRIVATE */
743
744 #endif