2 * Copyright (c) 2013-2016 Apple Inc. All rights reserved.
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
32 #include <net/net_kev.h>
35 #include <netinet/in.h>
36 #include <sys/socket.h>
40 * Name registered by the ipsec kernel control
42 #define NECP_CONTROL_NAME "com.apple.net.necp_control"
44 #define NECP_TLV_LENGTH_UINT32 1
46 struct necp_packet_header
{
53 * Control message commands
55 #define NECP_PACKET_TYPE_POLICY_ADD 1
56 #define NECP_PACKET_TYPE_POLICY_GET 2
57 #define NECP_PACKET_TYPE_POLICY_DELETE 3
58 #define NECP_PACKET_TYPE_POLICY_APPLY_ALL 4
59 #define NECP_PACKET_TYPE_POLICY_LIST_ALL 5
60 #define NECP_PACKET_TYPE_POLICY_DELETE_ALL 6
61 #define NECP_PACKET_TYPE_SET_SESSION_PRIORITY 7
62 #define NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC 8
63 #define NECP_PACKET_TYPE_REGISTER_SERVICE 9
64 #define NECP_PACKET_TYPE_UNREGISTER_SERVICE 10
65 #define NECP_PACKET_TYPE_POLICY_DUMP_ALL 11
68 * Control message flags
70 #define NECP_PACKET_FLAGS_RESPONSE 0x01 // Used for acks, errors, and query responses
73 * Control message TLV types
75 #define NECP_TLV_NIL 0
76 #define NECP_TLV_ERROR 1 // u_int32_t
77 #define NECP_TLV_POLICY_ORDER 2 // u_int32_t
78 #define NECP_TLV_POLICY_CONDITION 3
79 #define NECP_TLV_POLICY_RESULT 4
80 #define NECP_TLV_POLICY_ID 5 // u_int32_t
81 #define NECP_TLV_SESSION_PRIORITY 6 // u_int32_t
82 #define NECP_TLV_ATTRIBUTE_DOMAIN 7 // char[]
83 #define NECP_TLV_ATTRIBUTE_ACCOUNT 8 // char[]
84 #define NECP_TLV_SERVICE_UUID 9 // uuid_t
85 #define NECP_TLV_ROUTE_RULE 10
88 * Control message TLV sent only by the kernel to userspace
90 #define NECP_TLV_POLICY_OWNER 100 // char []
91 #define NECP_TLV_POLICY_DUMP 101
92 #define NECP_TLV_POLICY_RESULT_STRING 102 // char []
93 #define NECP_TLV_POLICY_SESSION_ORDER 103 // u_int32_t
98 #define NECP_POLICY_CONDITION_FLAGS_NEGATIVE 0x01 // Negative
102 * Used for setting policies as well as passing parameters to necp_match_policy.
104 #define NECP_POLICY_CONDITION_DEFAULT 0 // N/A, not valid with any other conditions
105 // Socket/Application conditions
106 #define NECP_POLICY_CONDITION_APPLICATION 1 // uuid_t, uses effective UUID when possible
107 #define NECP_POLICY_CONDITION_REAL_APPLICATION 2 // uuid_t, never uses effective UUID. Only valid with NECP_POLICY_CONDITION_APPLICATION
108 #define NECP_POLICY_CONDITION_DOMAIN 3 // String, such as apple.com
109 #define NECP_POLICY_CONDITION_ACCOUNT 4 // String
110 #define NECP_POLICY_CONDITION_ENTITLEMENT 5 // String
111 #define NECP_POLICY_CONDITION_PID 6 // pid_t
112 #define NECP_POLICY_CONDITION_UID 7 // uid_t
113 #define NECP_POLICY_CONDITION_ALL_INTERFACES 8 // N/A
114 #define NECP_POLICY_CONDITION_BOUND_INTERFACE 9 // String
115 #define NECP_POLICY_CONDITION_TRAFFIC_CLASS 10 // necp_policy_condition_tc_range
116 // Socket/IP conditions
117 #define NECP_POLICY_CONDITION_IP_PROTOCOL 11 // u_int8_t
118 #define NECP_POLICY_CONDITION_LOCAL_ADDR 12 // necp_policy_condition_addr
119 #define NECP_POLICY_CONDITION_REMOTE_ADDR 13 // necp_policy_condition_addr
120 #define NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE 14 // necp_policy_condition_addr_range
121 #define NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE 15 // necp_policy_condition_addr_range
126 #define NECP_POLICY_RESULT_PASS 1 // N/A
127 #define NECP_POLICY_RESULT_SKIP 2 // u_int32_t, policy order to skip to. 0 to skip all session policies.
128 #define NECP_POLICY_RESULT_DROP 3 // N/A
129 #define NECP_POLICY_RESULT_SOCKET_DIVERT 4 // u_int32_t, flow divert control unit
130 #define NECP_POLICY_RESULT_SOCKET_FILTER 5 // u_int32_t, filter control unit
131 #define NECP_POLICY_RESULT_IP_TUNNEL 6 // String, interface name
132 #define NECP_POLICY_RESULT_IP_FILTER 7 // ?
133 #define NECP_POLICY_RESULT_TRIGGER 8 // service uuid_t
134 #define NECP_POLICY_RESULT_TRIGGER_IF_NEEDED 9 // service uuid_t
135 #define NECP_POLICY_RESULT_TRIGGER_SCOPED 10 // service uuid_t
136 #define NECP_POLICY_RESULT_NO_TRIGGER_SCOPED 11 // service uuid_t
137 #define NECP_POLICY_RESULT_SOCKET_SCOPED 12 // String, interface name
138 #define NECP_POLICY_RESULT_ROUTE_RULES 13 // N/A, must have route rules defined
139 #define NECP_POLICY_RESULT_USE_NETAGENT 14 // netagent uuid_t
141 #define NECP_POLICY_RESULT_MAX NECP_POLICY_RESULT_USE_NETAGENT
145 * Detailed parameters for NECP_POLICY_RESULT_ROUTE_RULES.
147 #define NECP_ROUTE_RULE_NONE 0 // N/A
148 #define NECP_ROUTE_RULE_DENY_INTERFACE 1 // String, or empty to match all
149 #define NECP_ROUTE_RULE_ALLOW_INTERFACE 2 // String, or empty to match all
150 #define NECP_ROUTE_RULE_QOS_MARKING 3 // String, or empty to match all
152 #define NECP_ROUTE_RULE_FLAG_CELLULAR 0x01
153 #define NECP_ROUTE_RULE_FLAG_WIFI 0x02
154 #define NECP_ROUTE_RULE_FLAG_WIRED 0x04
155 #define NECP_ROUTE_RULE_FLAG_EXPENSIVE 0x08
160 #define NECP_ERROR_INTERNAL 0
161 #define NECP_ERROR_UNKNOWN_PACKET_TYPE 1
162 #define NECP_ERROR_INVALID_TLV 2
163 #define NECP_ERROR_POLICY_RESULT_INVALID 3
164 #define NECP_ERROR_POLICY_CONDITIONS_INVALID 4
165 #define NECP_ERROR_POLICY_ID_NOT_FOUND 5
166 #define NECP_ERROR_INVALID_PROCESS 6
167 #define NECP_ERROR_ROUTE_RULES_INVALID 7
170 #define NECP_MASK_USERSPACE_ONLY 0x80000000 // on filter_control_unit value
172 struct necp_policy_condition_tc_range
{
175 } __attribute__((__packed__
));
177 struct necp_policy_condition_addr
{
181 struct sockaddr_in sin
;
182 struct sockaddr_in6 sin6
;
184 } __attribute__((__packed__
));
186 struct necp_policy_condition_addr_range
{
189 struct sockaddr_in sin
;
190 struct sockaddr_in6 sin6
;
194 struct sockaddr_in sin
;
195 struct sockaddr_in6 sin6
;
197 } __attribute__((__packed__
));
199 #define NECP_SESSION_PRIORITY_UNKNOWN 0
200 #define NECP_SESSION_PRIORITY_CONTROL 1
201 #define NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL 2
202 #define NECP_SESSION_PRIORITY_HIGH 3
203 #define NECP_SESSION_PRIORITY_DEFAULT 4
204 #define NECP_SESSION_PRIORITY_LOW 5
206 #define NECP_SESSION_NUM_PRIORITIES NECP_SESSION_PRIORITY_LOW
208 typedef u_int32_t necp_policy_id
;
209 typedef u_int32_t necp_policy_order
;
211 typedef u_int32_t necp_kernel_policy_result
;
212 typedef u_int32_t necp_kernel_policy_filter
;
215 u_int tunnel_interface_index
;
216 u_int scoped_interface_index
;
217 u_int32_t flow_divert_control_unit
;
218 u_int32_t filter_control_unit
;
219 } necp_kernel_policy_routing_result_parameter
;
221 #define NECP_SERVICE_FLAGS_REGISTERED 0x01
222 #define NECP_MAX_NETAGENTS 8
223 struct necp_aggregate_result
{
224 necp_kernel_policy_result routing_result
;
225 necp_kernel_policy_routing_result_parameter routing_result_parameter
;
226 necp_kernel_policy_filter filter_control_unit
;
227 necp_kernel_policy_result service_action
;
229 u_int32_t service_flags
;
230 u_int32_t service_data
;
231 u_int routed_interface_index
;
233 uuid_t netagents
[NECP_MAX_NETAGENTS
];
234 u_int32_t netagent_flags
[NECP_MAX_NETAGENTS
];
238 * Statistics. It would be nice if the definitions in ntstat.h could be used,
239 * but they get entangled with #defines for v4 etc in pfvar.h and it may be better practice
240 * to have separate definitions here.
242 typedef struct necp_stat_counts
245 u_int64_t necp_stat_rxpackets
__attribute__((aligned(8)));
246 u_int64_t necp_stat_rxbytes
__attribute__((aligned(8)));
247 u_int64_t necp_stat_txpackets
__attribute__((aligned(8)));
248 u_int64_t necp_stat_txbytes
__attribute__((aligned(8)));
250 u_int32_t necp_stat_rxduplicatebytes
;
251 u_int32_t necp_stat_rxoutoforderbytes
;
252 u_int32_t necp_stat_txretransmit
;
254 u_int32_t necp_stat_connectattempts
;
255 u_int32_t necp_stat_connectsuccesses
;
257 u_int32_t necp_stat_min_rtt
;
258 u_int32_t necp_stat_avg_rtt
;
259 u_int32_t necp_stat_var_rtt
;
261 u_int64_t necp_stat_cell_rxbytes
__attribute__((aligned(8)));
262 u_int64_t necp_stat_cell_txbytes
__attribute__((aligned(8)));
263 u_int64_t necp_stat_wifi_rxbytes
__attribute__((aligned(8)));
264 u_int64_t necp_stat_wifi_txbytes
__attribute__((aligned(8)));
265 u_int64_t necp_stat_wired_rxbytes
__attribute__((aligned(8)));
266 u_int64_t necp_stat_wired_txbytes
__attribute__((aligned(8)));
269 // Note, some metadata is implicit in the necp client itself:
270 // From the process itself : pid, upid, uuid, proc name.
271 // From the necp client parameters: local and remote addresses, euuid, traffic class, ifindex
273 // The following may well be supplied via future necp client parameters,
274 // but they are here so they don't get forgotten.
275 typedef struct necp_basic_metadata
277 u_int32_t rcvbufsize
;
278 u_int32_t rcvbufused
;
280 u_int64_t eupid
; // Not currently used by NetworkStatistics, could skip.
283 uuid_t vuuid
; // Effective UUID as given from voucher
284 uint16_t ifnet_properties
;
285 } necp_basic_metadata
;
287 struct necp_tcp_probe_status
{
288 unsigned int probe_activated
: 1;
289 unsigned int write_probe_failed
: 1;
290 unsigned int read_probe_failed
: 1;
291 unsigned int conn_probe_failed
: 1;
294 typedef struct necp_extra_tcp_metadata
296 struct necp_tcp_probe_status probestatus
;
298 u_int32_t sndbufsize
;
299 u_int32_t sndbufused
;
303 u_int32_t traffic_mgt_flags
;
304 u_int32_t cc_alg_index
;
306 } necp_extra_tcp_metadata
;
308 typedef struct necp_stats_hdr
{
309 u_int32_t necp_stats_type
__attribute__((aligned(8)));
310 u_int32_t necp_stats_ver
;
311 u_int64_t necp_stats_event
;
314 #define NECP_CLIENT_STATISTICS_TYPE_TCP 1 // Identifies use of necp_tcp_stats
315 #define NECP_CLIENT_STATISTICS_TYPE_UDP 2 // Identifies use of necp_udp_stats
316 #define NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1 1 // Currently supported version for TCP
317 #define NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1 1 // Currently supported version for UDP
319 typedef struct necp_tcp_stats
{
320 necp_stats_hdr necp_tcp_hdr
;
321 necp_stat_counts necp_tcp_counts
;
322 necp_basic_metadata necp_tcp_basic
;
323 necp_extra_tcp_metadata necp_tcp_extra
;
326 typedef struct necp_udp_stats
{
327 necp_stats_hdr necp_udp_hdr
;
328 necp_stat_counts necp_udp_counts
;
329 necp_basic_metadata necp_udp_basic
;
332 typedef struct necp_all_stats
{
334 necp_tcp_stats tcp_stats
;
335 necp_udp_stats udp_stats
;
340 * NECP Client definitions
342 #define NECP_MAX_CLIENT_PARAMETERS_SIZE 1024
343 #define NECP_MAX_CLIENT_RESULT_SIZE 512
345 #define NECP_OPEN_FLAG_OBSERVER 0x01 // Observers can query clients they don't own
347 #define NECP_CLIENT_ACTION_ADD 1 // Register a new client. Input: parameters in buffer; Output: client_id
348 #define NECP_CLIENT_ACTION_REMOVE 2 // Unregister a client. Input: client_id
349 #define NECP_CLIENT_ACTION_COPY_PARAMETERS 3 // Copy client parameters. Input: client_id; Output: parameters in buffer
350 #define NECP_CLIENT_ACTION_COPY_RESULT 4 // Copy client result. Input: client_id; Output: result in buffer
351 #define NECP_CLIENT_ACTION_COPY_LIST 5 // Copy all client IDs. Output: struct necp_client_list in buffer
352 #define NECP_CLIENT_ACTION_REQUEST_NEXUS_INSTANCE 6 // Request a nexus instance from a nexus provider
353 #define NECP_CLIENT_ACTION_AGENT 7 // Interact with agent. Input: client_id, agent parameters
354 #define NECP_CLIENT_ACTION_COPY_AGENT 8 // Copy agent content. Input: agent UUID; Output: struct netagent
355 #define NECP_CLIENT_ACTION_COPY_INTERFACE 9 // Copy interface details. Input: ifindex cast to UUID; Output: struct necp_interface_details
356 #define NECP_CLIENT_ACTION_SET_STATISTICS 10 // Start/update/complete per-flow statistics. Input: client_id, statistics area
358 #define NECP_CLIENT_PARAMETER_APPLICATION NECP_POLICY_CONDITION_APPLICATION // Requires entitlement
359 #define NECP_CLIENT_PARAMETER_REAL_APPLICATION NECP_POLICY_CONDITION_REAL_APPLICATION // Requires entitlement
360 #define NECP_CLIENT_PARAMETER_DOMAIN NECP_POLICY_CONDITION_DOMAIN
361 #define NECP_CLIENT_PARAMETER_ACCOUNT NECP_POLICY_CONDITION_ACCOUNT
362 #define NECP_CLIENT_PARAMETER_PID NECP_POLICY_CONDITION_PID // Requires entitlement
363 #define NECP_CLIENT_PARAMETER_UID NECP_POLICY_CONDITION_UID // Requires entitlement
364 #define NECP_CLIENT_PARAMETER_BOUND_INTERFACE NECP_POLICY_CONDITION_BOUND_INTERFACE
365 #define NECP_CLIENT_PARAMETER_TRAFFIC_CLASS NECP_POLICY_CONDITION_TRAFFIC_CLASS
366 #define NECP_CLIENT_PARAMETER_IP_PROTOCOL NECP_POLICY_CONDITION_IP_PROTOCOL
367 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS NECP_POLICY_CONDITION_LOCAL_ADDR
368 #define NECP_CLIENT_PARAMETER_REMOTE_ADDRESS NECP_POLICY_CONDITION_REMOTE_ADDR
370 // "Prohibit" will never choose an interface with that property
371 #define NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE 100 // String, interface name
372 #define NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE 101 // u_int8_t, see ifru_functional_type in <net/if.h>
373 #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT 102 // uuid_t, network agent UUID
374 #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE 103 // struct necp_client_parameter_netagent_type
376 // "Require" will choose an interface with that property, or none if not found
377 #define NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE 111 // u_int8_t, see ifru_functional_type in <net/if.h>
378 #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT 112 // uuid_t, network agent UUID
379 #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE 113 // struct necp_client_parameter_netagent_type
381 // "Prefer" will choose an interface with that property, or best otherwise if not found
382 #define NECP_CLIENT_PARAMETER_PREFER_AGENT 122 // uuid_t, network agent UUID
383 #define NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE 123 // struct necp_client_parameter_netagent_type
385 // Use actions with NECP_CLIENT_ACTION_AGENT
386 #define NECP_CLIENT_PARAMETER_TRIGGER_AGENT 130 // uuid_t, network agent UUID
387 #define NECP_CLIENT_PARAMETER_ASSERT_AGENT 131 // uuid_t, network agent UUID
388 #define NECP_CLIENT_PARAMETER_UNASSERT_AGENT 132 // uuid_t, network agent UUID
390 #define NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT 200 // struct necp_client_endpoint
391 #define NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT 201 // struct necp_client_endpoint
392 #define NECP_CLIENT_PARAMETER_RESERVED_START 1000 // Parameters 1000 and higher are reserved for custom userspace options
394 #define NECP_CLIENT_RESULT_CLIENT_ID 1 // uuid_t
395 #define NECP_CLIENT_RESULT_POLICY_RESULT 2 // u_int32_t
396 #define NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER 3 // u_int32_t
397 #define NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT 4 // u_int32_t
398 #define NECP_CLIENT_RESULT_INTERFACE_INDEX 5 // u_int32_t
399 #define NECP_CLIENT_RESULT_NETAGENT 6 // struct necp_client_result_netagent
400 #define NECP_CLIENT_RESULT_FLAGS 7 // u_int32_t, see NECP_CLIENT_RESULT_FLAG_* values
401 #define NECP_CLIENT_RESULT_INTERFACE 8 // struct necp_client_result_interface
403 #define NECP_CLIENT_RESULT_NEXUS_INSTANCE 100 // uuid_t
404 #define NECP_CLIENT_RESULT_NEXUS_PORT 101 // u_int16_t
406 #define NECP_CLIENT_RESULT_LOCAL_ENDPOINT 200 // struct necp_client_endpoint
407 #define NECP_CLIENT_RESULT_REMOTE_ENDPOINT 201 // struct necp_client_endpoint
409 #define NECP_CLIENT_RESULT_FLAG_IS_LOCAL 0x0001 // Routes to this device
410 #define NECP_CLIENT_RESULT_FLAG_IS_DIRECT 0x0002 // Routes to directly accessible peer
411 #define NECP_CLIENT_RESULT_FLAG_HAS_IPV4 0x0004 // Supports IPv4
412 #define NECP_CLIENT_RESULT_FLAG_HAS_IPV6 0x0008 // Supports IPv6
414 struct necp_interface_details
{
415 char name
[IFXNAMSIZ
];
417 u_int32_t generation
;
418 u_int32_t functional_type
;
419 u_int32_t delegate_index
;
420 u_int32_t flags
; // see NECP_INTERFACE_FLAG_*
422 u_int8_t ipv4_signature
[IFNET_SIGNATURELEN
];
423 u_int8_t ipv6_signature
[IFNET_SIGNATURELEN
];
426 #define NECP_INTERFACE_FLAG_EXPENSIVE 0x0001
428 struct necp_client_parameter_netagent_type
{
429 char netagent_domain
[32];
430 char netagent_type
[32];
433 struct necp_client_result_netagent
{
434 u_int32_t generation
;
435 uuid_t netagent_uuid
;
438 struct necp_client_result_interface
{
439 u_int32_t generation
;
443 struct necp_client_endpoint
{
446 struct sockaddr_in sin
;
447 struct sockaddr_in6 sin6
;
449 u_int8_t endpoint_length
;
450 u_int8_t endpoint_family
; // Use AF_UNSPEC to target a name
451 u_int16_t endpoint_port
;
452 u_int32_t endpoint_type
; // Client-specific type
453 char endpoint_data
[0]; // Type-specific endpoint value
458 struct necp_client_list
{
459 u_int32_t client_count
;
463 struct kev_necp_policies_changed_data
{
464 u_int32_t changed_count
; // Defaults to 0.
467 #ifdef BSD_KERNEL_PRIVATE
469 #include <sys/socketvar.h>
470 #include <sys/kern_control.h>
471 #include <netinet/ip_var.h>
472 #include <netinet6/ip6_var.h>
473 #include <net/if_var.h>
474 #include <sys/syslog.h>
475 #include <net/network_agent.h>
477 #define NECPLOG(level, format, ...) do { \
478 log((level > LOG_NOTICE ? LOG_NOTICE : level), "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \
481 #define NECPLOG0(level, msg) do { \
482 log((level > LOG_NOTICE ? LOG_NOTICE : level), "%s: %s\n", __FUNCTION__, msg); \
485 extern errno_t
necp_client_init(void);
486 extern int necp_application_find_policy_match_internal(proc_t proc
, u_int8_t
*parameters
, u_int32_t parameters_size
,
487 struct necp_aggregate_result
*returned_result
,
488 u_int32_t
*flags
, u_int required_interface_index
);
492 * Note that these functions (other than necp_buffer_find_tlv) do not check the length of the entire buffer,
493 * so the caller must be sure that the entire TLV is within bounds.
495 extern u_int8_t
*necp_buffer_write_tlv(u_int8_t
*buffer
, u_int8_t type
, u_int32_t length
, const void *value
);
496 extern u_int8_t
*necp_buffer_write_tlv_if_different(u_int8_t
*buffer
, const u_int8_t
*max
, u_int8_t type
,
497 u_int32_t length
, const void *value
, bool *updated
);
498 extern u_int8_t
necp_buffer_get_tlv_type(u_int8_t
*buffer
, int tlv_offset
);
499 extern u_int32_t
necp_buffer_get_tlv_length(u_int8_t
*buffer
, int tlv_offset
);
500 extern u_int8_t
*necp_buffer_get_tlv_value(u_int8_t
*buffer
, int tlv_offset
, u_int32_t
*value_size
);
501 extern int necp_buffer_find_tlv(u_int8_t
*buffer
, u_int32_t buffer_length
, int offset
, u_int8_t type
, int next
);
503 #define NECPCTL_DROP_ALL_LEVEL 1 /* Drop all packets if no policy matches above this level */
504 #define NECPCTL_DEBUG 2 /* Log all kernel policy matches */
505 #define NECPCTL_PASS_LOOPBACK 3 /* Pass all loopback traffic */
506 #define NECPCTL_PASS_KEEPALIVES 4 /* Pass all kernel-generated keepalive traffic */
507 #define NECPCTL_SOCKET_POLICY_COUNT 5 /* Count of all socket-level policies */
508 #define NECPCTL_SOCKET_NON_APP_POLICY_COUNT 6 /* Count of non-per-app socket-level policies */
509 #define NECPCTL_IP_POLICY_COUNT 7 /* Count of all ip-level policies */
510 #define NECPCTL_SESSION_COUNT 8 /* Count of NECP sessions */
512 #define NECPCTL_NAMES { \
514 { "drop_all_level", CTLTYPE_INT }, \
515 { "debug", CTLTYPE_INT }, \
516 { "pass_loopback", CTLTYPE_INT }, \
517 { "pass_keepalives", CTLTYPE_INT }, \
520 typedef u_int32_t necp_kernel_policy_id
;
521 #define NECP_KERNEL_POLICY_ID_NONE 0
522 #define NECP_KERNEL_POLICY_ID_NO_MATCH 1
523 #define NECP_KERNEL_POLICY_ID_FIRST_VALID 2
525 typedef u_int32_t necp_app_id
;
527 #define NECP_KERNEL_POLICY_RESULT_NONE 0
528 #define NECP_KERNEL_POLICY_RESULT_PASS NECP_POLICY_RESULT_PASS
529 #define NECP_KERNEL_POLICY_RESULT_SKIP NECP_POLICY_RESULT_SKIP
530 #define NECP_KERNEL_POLICY_RESULT_DROP NECP_POLICY_RESULT_DROP
531 #define NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT NECP_POLICY_RESULT_SOCKET_DIVERT
532 #define NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER NECP_POLICY_RESULT_SOCKET_FILTER
533 #define NECP_KERNEL_POLICY_RESULT_IP_TUNNEL NECP_POLICY_RESULT_IP_TUNNEL
534 #define NECP_KERNEL_POLICY_RESULT_IP_FILTER NECP_POLICY_RESULT_IP_FILTER
535 #define NECP_KERNEL_POLICY_RESULT_TRIGGER NECP_POLICY_RESULT_TRIGGER
536 #define NECP_KERNEL_POLICY_RESULT_TRIGGER_IF_NEEDED NECP_POLICY_RESULT_TRIGGER_IF_NEEDED
537 #define NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED NECP_POLICY_RESULT_TRIGGER_SCOPED
538 #define NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED NECP_POLICY_RESULT_NO_TRIGGER_SCOPED
539 #define NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED NECP_POLICY_RESULT_SOCKET_SCOPED
540 #define NECP_KERNEL_POLICY_RESULT_ROUTE_RULES NECP_POLICY_RESULT_ROUTE_RULES
541 #define NECP_KERNEL_POLICY_RESULT_USE_NETAGENT NECP_POLICY_RESULT_USE_NETAGENT
544 u_int32_t identifier
;
546 } necp_kernel_policy_service
;
549 u_int tunnel_interface_index
;
550 u_int scoped_interface_index
;
551 u_int32_t flow_divert_control_unit
;
552 u_int32_t filter_control_unit
;
553 u_int32_t skip_policy_order
;
554 u_int32_t route_rule_id
;
555 u_int32_t netagent_id
;
556 necp_kernel_policy_service service
;
557 } necp_kernel_policy_result_parameter
;
559 union necp_sockaddr_union
{
561 struct sockaddr_in sin
;
562 struct sockaddr_in6 sin6
;
565 struct necp_kernel_socket_policy
{
566 LIST_ENTRY(necp_kernel_socket_policy
) chain
;
567 necp_policy_id parent_policy_id
;
568 necp_kernel_policy_id id
;
569 necp_policy_order order
;
570 u_int32_t session_order
;
573 u_int32_t condition_mask
;
574 u_int32_t condition_negated_mask
;
575 necp_kernel_policy_id cond_policy_id
;
576 u_int32_t cond_app_id
; // Locally assigned ID value stored
577 u_int32_t cond_real_app_id
; // Locally assigned ID value stored
578 char *cond_custom_entitlement
; // String
579 u_int32_t cond_account_id
; // Locally assigned ID value stored
580 char *cond_domain
; // String
581 u_int8_t cond_domain_dot_count
; // Number of dots in cond_domain
584 ifnet_t cond_bound_interface
; // Matches specific binding only
585 struct necp_policy_condition_tc_range cond_traffic_class
; // Matches traffic class in range
586 u_int16_t cond_protocol
; // Matches IP protcol number
587 union necp_sockaddr_union cond_local_start
; // Matches local IP address (or start)
588 union necp_sockaddr_union cond_local_end
; // Matches IP address range
589 u_int8_t cond_local_prefix
; // Defines subnet
590 union necp_sockaddr_union cond_remote_start
; // Matches remote IP address (or start)
591 union necp_sockaddr_union cond_remote_end
; // Matches IP address range
592 u_int8_t cond_remote_prefix
; // Defines subnet
594 necp_kernel_policy_result result
;
595 necp_kernel_policy_result_parameter result_parameter
;
598 struct necp_kernel_ip_output_policy
{
599 LIST_ENTRY(necp_kernel_ip_output_policy
) chain
;
600 necp_policy_id parent_policy_id
;
601 necp_kernel_policy_id id
;
602 necp_policy_order suborder
;
603 necp_policy_order order
;
604 u_int32_t session_order
;
607 u_int32_t condition_mask
;
608 u_int32_t condition_negated_mask
;
609 necp_kernel_policy_id cond_policy_id
;
610 ifnet_t cond_bound_interface
; // Matches specific binding only
611 u_int16_t cond_protocol
; // Matches IP protcol number
612 union necp_sockaddr_union cond_local_start
; // Matches local IP address (or start)
613 union necp_sockaddr_union cond_local_end
; // Matches IP address range
614 u_int8_t cond_local_prefix
; // Defines subnet
615 union necp_sockaddr_union cond_remote_start
; // Matches remote IP address (or start)
616 union necp_sockaddr_union cond_remote_end
; // Matches IP address range
617 u_int8_t cond_remote_prefix
; // Defines subnet
618 u_int32_t cond_last_interface_index
;
620 necp_kernel_policy_result result
;
621 necp_kernel_policy_result_parameter result_parameter
;
624 #define MAX_KERNEL_SOCKET_POLICIES 1
625 #define MAX_KERNEL_IP_OUTPUT_POLICIES 4
626 struct necp_session_policy
{
627 LIST_ENTRY(necp_session_policy
) chain
;
628 bool applied
; // Applied into the kernel table
629 bool pending_deletion
; // Waiting to be removed from kernel table
630 bool pending_update
; // Policy has been modified since creation/last application
632 necp_policy_order order
;
634 u_int32_t result_size
;
635 u_int8_t
*conditions
; // Array of conditions, each with a u_int32_t length at start
636 u_int32_t conditions_size
;
637 u_int8_t
*route_rules
; // Array of route rules, each with a u_int32_t length at start
638 u_int32_t route_rules_size
;
640 uuid_t applied_app_uuid
;
641 uuid_t applied_real_app_uuid
;
642 char *applied_domain
;
643 char *applied_account
;
645 uuid_t applied_result_uuid
;
647 u_int32_t applied_route_rules_id
;
649 necp_kernel_policy_id kernel_socket_policies
[MAX_KERNEL_SOCKET_POLICIES
];
650 necp_kernel_policy_id kernel_ip_output_policies
[MAX_KERNEL_IP_OUTPUT_POLICIES
];
653 struct necp_aggregate_socket_result
{
654 necp_kernel_policy_result result
;
655 necp_kernel_policy_result_parameter result_parameter
;
656 necp_kernel_policy_filter filter_control_unit
;
657 u_int32_t route_rule_id
;
658 int32_t qos_marking_gencount
;
661 struct necp_inpcb_result
{
663 necp_kernel_policy_id policy_id
;
664 int32_t policy_gencount
;
666 struct necp_aggregate_socket_result results
;
669 extern errno_t
necp_init(void);
671 extern errno_t
necp_set_socket_attributes(struct socket
*so
, struct sockopt
*sopt
);
672 extern errno_t
necp_get_socket_attributes(struct socket
*so
, struct sockopt
*sopt
);
673 extern void necp_inpcb_dispose(struct inpcb
*inp
);
675 extern u_int32_t
necp_socket_get_content_filter_control_unit(struct socket
*so
);
677 extern bool necp_socket_should_use_flow_divert(struct inpcb
*inp
);
678 extern u_int32_t
necp_socket_get_flow_divert_control_unit(struct inpcb
*inp
);
680 extern bool necp_socket_should_rescope(struct inpcb
*inp
);
681 extern u_int
necp_socket_get_rescope_if_index(struct inpcb
*inp
);
682 extern u_int32_t
necp_socket_get_effective_mtu(struct inpcb
*inp
, u_int32_t current_mtu
);
684 extern bool necp_socket_is_allowed_to_send_recv(struct inpcb
*inp
, necp_kernel_policy_id
*return_policy_id
,
685 u_int32_t
*return_route_rule_id
);
686 extern bool necp_socket_is_allowed_to_send_recv_v4(struct inpcb
*inp
, u_int16_t local_port
,
687 u_int16_t remote_port
, struct in_addr
*local_addr
,
688 struct in_addr
*remote_addr
, ifnet_t interface
,
689 necp_kernel_policy_id
*return_policy_id
, u_int32_t
*return_route_rule_id
);
690 extern bool necp_socket_is_allowed_to_send_recv_v6(struct inpcb
*inp
, u_int16_t local_port
,
691 u_int16_t remote_port
, struct in6_addr
*local_addr
,
692 struct in6_addr
*remote_addr
, ifnet_t interface
,
693 necp_kernel_policy_id
*return_policy_id
, u_int32_t
*return_route_rule_id
);
694 extern void necp_socket_update_qos_marking(struct inpcb
*inp
, struct rtentry
*route
, struct ifnet
*interface
, u_int32_t route_rule_id
);
695 extern int necp_mark_packet_from_socket(struct mbuf
*packet
, struct inpcb
*inp
, necp_kernel_policy_id policy_id
,
696 u_int32_t route_rule_id
);
697 extern necp_kernel_policy_id
necp_get_policy_id_from_packet(struct mbuf
*packet
);
698 extern u_int32_t
necp_get_last_interface_index_from_packet(struct mbuf
*packet
);
699 extern u_int32_t
necp_get_route_rule_id_from_packet(struct mbuf
*packet
);
700 extern int necp_get_app_uuid_from_packet(struct mbuf
*packet
,
703 extern necp_kernel_policy_id
necp_socket_find_policy_match(struct inpcb
*inp
, struct sockaddr
*override_local_addr
,
704 struct sockaddr
*override_remote_addr
, u_int32_t override_bound_interface
);
705 extern necp_kernel_policy_id
necp_ip_output_find_policy_match(struct mbuf
*packet
, int flags
, struct ip_out_args
*ipoa
,
706 necp_kernel_policy_result
*result
,
707 necp_kernel_policy_result_parameter
*result_parameter
);
708 extern necp_kernel_policy_id
necp_ip6_output_find_policy_match(struct mbuf
*packet
, int flags
, struct ip6_out_args
*ip6oa
,
709 necp_kernel_policy_result
*result
,
710 necp_kernel_policy_result_parameter
*result_parameter
);
712 extern int necp_mark_packet_from_ip(struct mbuf
*packet
, necp_kernel_policy_id policy_id
);
713 extern int necp_mark_packet_from_interface(struct mbuf
*packet
, ifnet_t interface
);
715 extern ifnet_t
necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter
*result_parameter
);
716 extern bool necp_packet_can_rebind_to_ifnet(struct mbuf
*packet
, struct ifnet
*interface
, struct route
*new_route
, int family
);
718 extern bool necp_packet_is_allowed_over_interface(struct mbuf
*packet
, struct ifnet
*interface
);
720 extern int necp_mark_packet_as_keepalive(struct mbuf
*packet
, bool is_keepalive
);
721 extern bool necp_get_is_keepalive_from_packet(struct mbuf
*packet
);
723 extern void necp_update_all_clients(void); // Handle general re-evaluate event
725 extern void necp_force_update_client(uuid_t client_id
, uuid_t remove_netagent_uuid
); // Cause a single client to get an update event
727 extern int necp_assign_client_result(uuid_t netagent_uuid
, uuid_t client_id
,
728 u_int8_t
*assigned_results
, size_t assigned_results_length
);
730 #endif /* BSD_KERNEL_PRIVATE */
733 extern int necp_match_policy(const uint8_t *parameters
, size_t parameters_size
, struct necp_aggregate_result
*returned_result
);
735 extern int necp_open(int flags
);
737 extern int necp_client_action(int necp_fd
, uint32_t action
, uuid_t client_id
,
738 size_t client_id_len
, uint8_t *buffer
, size_t buffer_size
);