X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/d9a64523371fa019c4575bb400cbbc3a50ac9903..a991bd8d3e7fe02dbca0644054bab73c5b75324a:/bsd/net/necp.c diff --git a/bsd/net/necp.c b/bsd/net/necp.c index 17d00fd4f..a06dc3914 100644 --- a/bsd/net/necp.c +++ b/bsd/net/necp.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2013-2018 Apple Inc. All rights reserved. + * Copyright (c) 2013-2020 Apple Inc. All rights reserved. * * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ * @@ -31,7 +31,6 @@ #include #include #include -#include #include #include #include @@ -43,6 +42,9 @@ #include #include #include +#include +#include +#include #include #include #include @@ -61,14 +63,19 @@ #include #include #include +#include +#include +#include +#include #include #include +#include /* * NECP - Network Extension Control Policy database * ------------------------------------------------ * The goal of this module is to allow clients connecting via a - * kernel control socket to create high-level policy sessions, which + * policy file descriptor to create high-level policy sessions, which * are ingested into low-level kernel policies that control and tag * traffic at the application, socket, and IP layers. * @@ -84,7 +91,7 @@ * can specify the sub-order for each policy it creates which will be * used to further sort the kernel policies. * - * Kernel Control Socket --> 1 necp_session --> list of necp_session_policy structs + * Policy fd --> 1 necp_session --> list of necp_session_policy structs * * ------------------------------------------------ * Kernel Policies @@ -134,105 +141,152 @@ u_int32_t necp_drop_all_order = 0; u_int32_t necp_drop_all_level = 0; -u_int32_t necp_pass_loopback = 1; // 0=Off, 1=On +#define NECP_LOOPBACK_PASS_ALL 1 // Pass all loopback traffic +#define NECP_LOOPBACK_PASS_WITH_FILTER 2 // Pass all loopback traffic, but activate content filter and/or flow divert if applicable + +#if defined(XNU_TARGET_OS_OSX) +#define NECP_LOOPBACK_PASS_DEFAULT NECP_LOOPBACK_PASS_WITH_FILTER +#else +#define NECP_LOOPBACK_PASS_DEFAULT NECP_LOOPBACK_PASS_ALL +#endif + +u_int32_t necp_pass_loopback = NECP_LOOPBACK_PASS_DEFAULT; u_int32_t necp_pass_keepalives = 1; // 0=Off, 1=On +u_int32_t necp_pass_interpose = 1; // 0=Off, 1=On +u_int32_t necp_restrict_multicast = 1; // 0=Off, 1=On +u_int32_t necp_dedup_policies = 0; // 0=Off, 1=On + +u_int32_t necp_drop_unentitled_order = 0; +#ifdef XNU_TARGET_OS_WATCH +u_int32_t necp_drop_unentitled_level = NECP_SESSION_PRIORITY_CONTROL + 1; // Block all unentitled traffic from policies below control level +#else // XNU_TARGET_OS_WATCH +u_int32_t necp_drop_unentitled_level = 0; +#endif // XNU_TARGET_OS_WATCH u_int32_t necp_debug = 0; // 0=None, 1=Basic, 2=EveryMatch +os_log_t necp_log_handle = NULL; + u_int32_t necp_session_count = 0; -#define LIST_INSERT_SORTED_ASCENDING(head, elm, field, sortfield, tmpelm) do { \ - if (LIST_EMPTY((head)) || (LIST_FIRST(head)->sortfield >= (elm)->sortfield)) { \ - LIST_INSERT_HEAD((head), elm, field); \ - } else { \ - LIST_FOREACH(tmpelm, head, field) { \ - if (LIST_NEXT(tmpelm, field) == NULL || LIST_NEXT(tmpelm, field)->sortfield >= (elm)->sortfield) { \ - LIST_INSERT_AFTER(tmpelm, elm, field); \ - break; \ - } \ - } \ - } \ +ZONE_DECLARE(necp_session_policy_zone, "necp_session_policy", + sizeof(struct necp_session_policy), ZC_ZFREE_CLEARMEM | ZC_NOENCRYPT); +ZONE_DECLARE(necp_socket_policy_zone, "necp_socket_policy", + sizeof(struct necp_kernel_socket_policy), ZC_ZFREE_CLEARMEM | ZC_NOENCRYPT); +ZONE_DECLARE(necp_ip_policy_zone, "necp_ip_policy", + sizeof(struct necp_kernel_ip_output_policy), ZC_ZFREE_CLEARMEM | ZC_NOENCRYPT); + +#define LIST_INSERT_SORTED_ASCENDING(head, elm, field, sortfield, tmpelm) do { \ + if (LIST_EMPTY((head)) || (LIST_FIRST(head)->sortfield >= (elm)->sortfield)) { \ + LIST_INSERT_HEAD((head), elm, field); \ + } else { \ + LIST_FOREACH(tmpelm, head, field) { \ + if (LIST_NEXT(tmpelm, field) == NULL || LIST_NEXT(tmpelm, field)->sortfield >= (elm)->sortfield) { \ + LIST_INSERT_AFTER(tmpelm, elm, field); \ + break; \ + } \ + } \ + } \ } while (0) -#define LIST_INSERT_SORTED_TWICE_ASCENDING(head, elm, field, firstsortfield, secondsortfield, tmpelm) do { \ - if (LIST_EMPTY((head)) || (LIST_FIRST(head)->firstsortfield > (elm)->firstsortfield) || ((LIST_FIRST(head)->firstsortfield == (elm)->firstsortfield) && (LIST_FIRST(head)->secondsortfield >= (elm)->secondsortfield))) { \ - LIST_INSERT_HEAD((head), elm, field); \ - } else { \ - LIST_FOREACH(tmpelm, head, field) { \ - if (LIST_NEXT(tmpelm, field) == NULL || (LIST_NEXT(tmpelm, field)->firstsortfield > (elm)->firstsortfield) || ((LIST_NEXT(tmpelm, field)->firstsortfield == (elm)->firstsortfield) && (LIST_NEXT(tmpelm, field)->secondsortfield >= (elm)->secondsortfield))) { \ - LIST_INSERT_AFTER(tmpelm, elm, field); \ - break; \ - } \ - } \ - } \ +#define LIST_INSERT_SORTED_TWICE_ASCENDING(head, elm, field, firstsortfield, secondsortfield, tmpelm) do { \ + if (LIST_EMPTY((head)) || (LIST_FIRST(head)->firstsortfield > (elm)->firstsortfield) || ((LIST_FIRST(head)->firstsortfield == (elm)->firstsortfield) && (LIST_FIRST(head)->secondsortfield >= (elm)->secondsortfield))) { \ + LIST_INSERT_HEAD((head), elm, field); \ + } else { \ + LIST_FOREACH(tmpelm, head, field) { \ + if (LIST_NEXT(tmpelm, field) == NULL || (LIST_NEXT(tmpelm, field)->firstsortfield > (elm)->firstsortfield) || ((LIST_NEXT(tmpelm, field)->firstsortfield == (elm)->firstsortfield) && (LIST_NEXT(tmpelm, field)->secondsortfield >= (elm)->secondsortfield))) { \ + LIST_INSERT_AFTER(tmpelm, elm, field); \ + break; \ + } \ + } \ + } \ } while (0) -#define LIST_INSERT_SORTED_THRICE_ASCENDING(head, elm, field, firstsortfield, secondsortfield, thirdsortfield, tmpelm) do { \ - if (LIST_EMPTY((head)) || (LIST_FIRST(head)->firstsortfield > (elm)->firstsortfield) || ((LIST_FIRST(head)->firstsortfield == (elm)->firstsortfield) && (LIST_FIRST(head)->secondsortfield >= (elm)->secondsortfield)) || ((LIST_FIRST(head)->firstsortfield == (elm)->firstsortfield) && (LIST_FIRST(head)->secondsortfield == (elm)->secondsortfield) && (LIST_FIRST(head)->thirdsortfield >= (elm)->thirdsortfield))) { \ - LIST_INSERT_HEAD((head), elm, field); \ - } else { \ - LIST_FOREACH(tmpelm, head, field) { \ - if (LIST_NEXT(tmpelm, field) == NULL || (LIST_NEXT(tmpelm, field)->firstsortfield > (elm)->firstsortfield) || ((LIST_NEXT(tmpelm, field)->firstsortfield == (elm)->firstsortfield) && (LIST_NEXT(tmpelm, field)->secondsortfield >= (elm)->secondsortfield)) || ((LIST_NEXT(tmpelm, field)->firstsortfield == (elm)->firstsortfield) && (LIST_NEXT(tmpelm, field)->secondsortfield == (elm)->secondsortfield) && (LIST_NEXT(tmpelm, field)->thirdsortfield >= (elm)->thirdsortfield))) { \ - LIST_INSERT_AFTER(tmpelm, elm, field); \ - break; \ - } \ - } \ - } \ +#define LIST_INSERT_SORTED_THRICE_ASCENDING(head, elm, field, firstsortfield, secondsortfield, thirdsortfield, tmpelm) do { \ + if (LIST_EMPTY((head)) || (LIST_FIRST(head)->firstsortfield > (elm)->firstsortfield) || ((LIST_FIRST(head)->firstsortfield == (elm)->firstsortfield) && (LIST_FIRST(head)->secondsortfield >= (elm)->secondsortfield)) || ((LIST_FIRST(head)->firstsortfield == (elm)->firstsortfield) && (LIST_FIRST(head)->secondsortfield == (elm)->secondsortfield) && (LIST_FIRST(head)->thirdsortfield >= (elm)->thirdsortfield))) { \ + LIST_INSERT_HEAD((head), elm, field); \ + } else { \ + LIST_FOREACH(tmpelm, head, field) { \ + if (LIST_NEXT(tmpelm, field) == NULL || (LIST_NEXT(tmpelm, field)->firstsortfield > (elm)->firstsortfield) || ((LIST_NEXT(tmpelm, field)->firstsortfield == (elm)->firstsortfield) && (LIST_NEXT(tmpelm, field)->secondsortfield >= (elm)->secondsortfield)) || ((LIST_NEXT(tmpelm, field)->firstsortfield == (elm)->firstsortfield) && (LIST_NEXT(tmpelm, field)->secondsortfield == (elm)->secondsortfield) && (LIST_NEXT(tmpelm, field)->thirdsortfield >= (elm)->thirdsortfield))) { \ + LIST_INSERT_AFTER(tmpelm, elm, field); \ + break; \ + } \ + } \ + } \ } while (0) -#define IS_NECP_ROUTE_RULE_ALLOW_OR_DENY(x) ((x) == NECP_ROUTE_RULE_DENY_INTERFACE || (x) == NECP_ROUTE_RULE_ALLOW_INTERFACE) - -#define NECP_KERNEL_CONDITION_ALL_INTERFACES 0x000001 -#define NECP_KERNEL_CONDITION_BOUND_INTERFACE 0x000002 -#define NECP_KERNEL_CONDITION_PROTOCOL 0x000004 -#define NECP_KERNEL_CONDITION_LOCAL_START 0x000008 -#define NECP_KERNEL_CONDITION_LOCAL_END 0x000010 -#define NECP_KERNEL_CONDITION_LOCAL_PREFIX 0x000020 -#define NECP_KERNEL_CONDITION_REMOTE_START 0x000040 -#define NECP_KERNEL_CONDITION_REMOTE_END 0x000080 -#define NECP_KERNEL_CONDITION_REMOTE_PREFIX 0x000100 -#define NECP_KERNEL_CONDITION_APP_ID 0x000200 -#define NECP_KERNEL_CONDITION_REAL_APP_ID 0x000400 -#define NECP_KERNEL_CONDITION_DOMAIN 0x000800 -#define NECP_KERNEL_CONDITION_ACCOUNT_ID 0x001000 -#define NECP_KERNEL_CONDITION_POLICY_ID 0x002000 -#define NECP_KERNEL_CONDITION_PID 0x004000 -#define NECP_KERNEL_CONDITION_UID 0x008000 -#define NECP_KERNEL_CONDITION_LAST_INTERFACE 0x010000 // Only set from packets looping between interfaces -#define NECP_KERNEL_CONDITION_TRAFFIC_CLASS 0x020000 -#define NECP_KERNEL_CONDITION_ENTITLEMENT 0x040000 -#define NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT 0x080000 -#define NECP_KERNEL_CONDITION_AGENT_TYPE 0x100000 - -#define NECP_MAX_POLICY_RESULT_SIZE 512 -#define NECP_MAX_ROUTE_RULES_ARRAY_SIZE 1024 -#define NECP_MAX_CONDITIONS_ARRAY_SIZE 4096 -#define NECP_MAX_POLICY_LIST_COUNT 1024 +#define IS_NECP_ROUTE_RULE_ALLOW_OR_DENY(x) ((x) == NECP_ROUTE_RULE_DENY_INTERFACE || (x) == NECP_ROUTE_RULE_ALLOW_INTERFACE) + +#define IS_NECP_DEST_IN_LOCAL_NETWORKS(rt) \ + ((rt) != NULL && !((rt)->rt_flags & RTF_GATEWAY) && ((rt)->rt_ifa && (rt)->rt_ifa->ifa_ifp && !((rt)->rt_ifa->ifa_ifp->if_flags & IFF_POINTOPOINT))) + +#define NECP_KERNEL_CONDITION_ALL_INTERFACES 0x000001 +#define NECP_KERNEL_CONDITION_BOUND_INTERFACE 0x000002 +#define NECP_KERNEL_CONDITION_PROTOCOL 0x000004 +#define NECP_KERNEL_CONDITION_LOCAL_START 0x000008 +#define NECP_KERNEL_CONDITION_LOCAL_END 0x000010 +#define NECP_KERNEL_CONDITION_LOCAL_PREFIX 0x000020 +#define NECP_KERNEL_CONDITION_REMOTE_START 0x000040 +#define NECP_KERNEL_CONDITION_REMOTE_END 0x000080 +#define NECP_KERNEL_CONDITION_REMOTE_PREFIX 0x000100 +#define NECP_KERNEL_CONDITION_APP_ID 0x000200 +#define NECP_KERNEL_CONDITION_REAL_APP_ID 0x000400 +#define NECP_KERNEL_CONDITION_DOMAIN 0x000800 +#define NECP_KERNEL_CONDITION_ACCOUNT_ID 0x001000 +#define NECP_KERNEL_CONDITION_POLICY_ID 0x002000 +#define NECP_KERNEL_CONDITION_PID 0x004000 +#define NECP_KERNEL_CONDITION_UID 0x008000 +#define NECP_KERNEL_CONDITION_LAST_INTERFACE 0x010000 // Only set from packets looping between interfaces +#define NECP_KERNEL_CONDITION_TRAFFIC_CLASS 0x020000 +#define NECP_KERNEL_CONDITION_ENTITLEMENT 0x040000 +#define NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT 0x080000 +#define NECP_KERNEL_CONDITION_AGENT_TYPE 0x100000 +#define NECP_KERNEL_CONDITION_HAS_CLIENT 0x200000 +#define NECP_KERNEL_CONDITION_LOCAL_NETWORKS 0x400000 +#define NECP_KERNEL_CONDITION_CLIENT_FLAGS 0x800000 +#define NECP_KERNEL_CONDITION_LOCAL_EMPTY 0x1000000 +#define NECP_KERNEL_CONDITION_REMOTE_EMPTY 0x2000000 +#define NECP_KERNEL_CONDITION_PLATFORM_BINARY 0x4000000 +#define NECP_KERNEL_CONDITION_SDK_VERSION 0x8000000 +#define NECP_KERNEL_CONDITION_SIGNING_IDENTIFIER 0x10000000 +#define NECP_KERNEL_CONDITION_PACKET_FILTER_TAGS 0x20000000 +#define NECP_KERNEL_CONDITION_IS_LOOPBACK 0x40000000 + +#define NECP_MAX_POLICY_RESULT_SIZE 512 +#define NECP_MAX_ROUTE_RULES_ARRAY_SIZE 1024 +#define NECP_MAX_CONDITIONS_ARRAY_SIZE 4096 +#define NECP_MAX_POLICY_LIST_COUNT 1024 + +typedef enum { + NECP_BYPASS_TYPE_NONE = 0, + NECP_BYPASS_TYPE_INTCOPROC = 1, + NECP_BYPASS_TYPE_LOOPBACK = 2, +} necp_socket_bypass_type_t; // Cap the policy size at the max result + conditions size, with room for extra TLVs -#define NECP_MAX_POLICY_SIZE (1024 + NECP_MAX_POLICY_RESULT_SIZE + NECP_MAX_CONDITIONS_ARRAY_SIZE) +#define NECP_MAX_POLICY_SIZE (1024 + NECP_MAX_POLICY_RESULT_SIZE + NECP_MAX_CONDITIONS_ARRAY_SIZE) struct necp_service_registration { - LIST_ENTRY(necp_service_registration) session_chain; - LIST_ENTRY(necp_service_registration) kernel_chain; - u_int32_t service_id; + LIST_ENTRY(necp_service_registration) session_chain; + LIST_ENTRY(necp_service_registration) kernel_chain; + u_int32_t service_id; }; struct necp_session { - u_int8_t necp_fd_type; - u_int32_t control_unit; - u_int32_t session_priority; // Descriptive priority rating - u_int32_t session_order; + u_int8_t necp_fd_type; + u_int32_t control_unit; + u_int32_t session_priority; // Descriptive priority rating + u_int32_t session_order; - necp_policy_id last_policy_id; + necp_policy_id last_policy_id; decl_lck_mtx_data(, lock); - bool proc_locked; // Messages must come from proc_uuid - uuid_t proc_uuid; - int proc_pid; + bool proc_locked; // Messages must come from proc_uuid + uuid_t proc_uuid; + int proc_pid; - bool dirty; + bool dirty; LIST_HEAD(_policies, necp_session_policy) policies; LIST_HEAD(_services, necp_service_registration) services; @@ -256,43 +310,65 @@ struct necp_socket_info { u_int32_t application_id; u_int32_t real_application_id; u_int32_t account_id; + u_int32_t drop_order; + u_int32_t client_flags; char *domain; errno_t cred_result; + unsigned has_client : 1; + unsigned is_platform_binary : 1; + unsigned used_responsible_pid : 1; + unsigned is_loopback : 1; + unsigned __pad_bits : 4; }; -static kern_ctl_ref necp_kctlref; -static u_int32_t necp_family; -static OSMallocTag necp_malloc_tag; -static lck_grp_attr_t *necp_kernel_policy_grp_attr = NULL; -static lck_attr_t *necp_kernel_policy_mtx_attr = NULL; -static lck_grp_t *necp_kernel_policy_mtx_grp = NULL; +static lck_grp_attr_t *necp_kernel_policy_grp_attr = NULL; +static lck_attr_t *necp_kernel_policy_mtx_attr = NULL; +static lck_grp_t *necp_kernel_policy_mtx_grp = NULL; decl_lck_rw_data(static, necp_kernel_policy_lock); -static lck_grp_attr_t *necp_route_rule_grp_attr = NULL; -static lck_attr_t *necp_route_rule_mtx_attr = NULL; -static lck_grp_t *necp_route_rule_mtx_grp = NULL; +static lck_grp_attr_t *necp_route_rule_grp_attr = NULL; +static lck_attr_t *necp_route_rule_mtx_attr = NULL; +static lck_grp_t *necp_route_rule_mtx_grp = NULL; decl_lck_rw_data(static, necp_route_rule_lock); +os_refgrp_decl(static, necp_refgrp, "NECPRefGroup", NULL); + /* * On modification, invalidate cached lookups by bumping the generation count. * Other calls will need to take the slowpath of taking * the subsystem lock. */ static volatile int32_t necp_kernel_socket_policies_gencount; -#define BUMP_KERNEL_SOCKET_POLICIES_GENERATION_COUNT() do { \ - if (OSIncrementAtomic(&necp_kernel_socket_policies_gencount) == (INT32_MAX - 1)) { \ - necp_kernel_socket_policies_gencount = 1; \ - } \ +#define BUMP_KERNEL_SOCKET_POLICIES_GENERATION_COUNT() do { \ + if (OSIncrementAtomic(&necp_kernel_socket_policies_gencount) == (INT32_MAX - 1)) { \ + necp_kernel_socket_policies_gencount = 1; \ + } \ } while (0) +/* + * Drop-all Bypass: + * Allow priviledged processes to bypass the default drop-all + * via entitlement check. For OSX, since entitlement check is + * not supported for configd, configd signing identity is checked + * instead. + */ +#define SIGNING_ID_CONFIGD "com.apple.configd" +#define SIGNING_ID_CONFIGD_LEN (sizeof(SIGNING_ID_CONFIGD) - 1) + +typedef enum { + NECP_DROP_ALL_BYPASS_CHECK_RESULT_NONE = 0, + NECP_DROP_ALL_BYPASS_CHECK_RESULT_TRUE = 1, + NECP_DROP_ALL_BYPASS_CHECK_RESULT_FALSE = 2, +} necp_drop_all_bypass_check_result_t; + static u_int32_t necp_kernel_application_policies_condition_mask; static size_t necp_kernel_application_policies_count; static u_int32_t necp_kernel_socket_policies_condition_mask; static size_t necp_kernel_socket_policies_count; static size_t necp_kernel_socket_policies_non_app_count; static LIST_HEAD(_necpkernelsocketconnectpolicies, necp_kernel_socket_policy) necp_kernel_socket_policies; -#define NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS 5 -#define NECP_SOCKET_MAP_APP_ID_TO_BUCKET(appid) (appid ? (appid%(NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS - 1) + 1) : 0) +#define NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS 5 +#define NECP_SOCKET_MAP_APP_ID_TO_BUCKET(appid) (appid ? (appid%(NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS - 1) + 1) : 0) static struct necp_kernel_socket_policy **necp_kernel_socket_policies_map[NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS]; static struct necp_kernel_socket_policy **necp_kernel_socket_policies_app_layer_map; /* @@ -307,26 +383,21 @@ static u_int32_t necp_kernel_ip_output_policies_condition_mask; static size_t necp_kernel_ip_output_policies_count; static size_t necp_kernel_ip_output_policies_non_id_count; static LIST_HEAD(_necpkernelipoutputpolicies, necp_kernel_ip_output_policy) necp_kernel_ip_output_policies; -#define NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS 5 -#define NECP_IP_OUTPUT_MAP_ID_TO_BUCKET(id) (id ? (id%(NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS - 1) + 1) : 0) +#define NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS 5 +#define NECP_IP_OUTPUT_MAP_ID_TO_BUCKET(id) (id ? (id%(NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS - 1) + 1) : 0) static struct necp_kernel_ip_output_policy **necp_kernel_ip_output_policies_map[NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS]; +static struct necp_kernel_socket_policy pass_policy = +{ + .id = NECP_KERNEL_POLICY_ID_NO_MATCH, + .result = NECP_KERNEL_POLICY_RESULT_PASS, +}; static struct necp_session *necp_create_session(void); static void necp_delete_session(struct necp_session *session); -static necp_policy_id necp_handle_policy_add(struct necp_session *session, u_int32_t message_id, mbuf_t packet, - u_int8_t *tlv_buffer, size_t tlv_buffer_length, int offset, int *error); -static void necp_handle_policy_get(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset); -static void necp_handle_policy_delete(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset); -static void necp_handle_policy_apply_all(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset); -static void necp_handle_policy_list_all(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset); -static void necp_handle_policy_delete_all(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset); -static int necp_handle_policy_dump_all(struct necp_session *session, u_int32_t message_id, mbuf_t packet, - user_addr_t out_buffer, size_t out_buffer_length, int offset); -static void necp_handle_set_session_priority(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset); -static void necp_handle_lock_session_to_proc(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset); -static void necp_handle_register_service(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset); -static void necp_handle_unregister_service(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset); +static necp_policy_id necp_handle_policy_add(struct necp_session *session, + u_int8_t *tlv_buffer, size_t tlv_buffer_length, int offset, int *error); +static int necp_handle_policy_dump_all(user_addr_t out_buffer, size_t out_buffer_length); #define MAX_RESULT_STRING_LEN 64 static inline const char * necp_get_result_description(char *result_string, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter); @@ -338,13 +409,13 @@ static bool necp_policy_mark_all_for_deletion(struct necp_session *session); static bool necp_policy_delete(struct necp_session *session, struct necp_session_policy *policy); static void necp_policy_apply_all(struct necp_session *session); -static necp_kernel_policy_id necp_kernel_socket_policy_add(necp_policy_order order, u_int32_t session_order, int session_pid, u_int32_t condition_mask, u_int32_t condition_negated_mask, necp_app_id cond_app_id, necp_app_id cond_real_app_id, char *cond_custom_entitlement, u_int32_t cond_account_id, char *domain, pid_t cond_pid, uid_t cond_uid, ifnet_t cond_bound_interface, struct necp_policy_condition_tc_range cond_traffic_class, u_int16_t cond_protocol, union necp_sockaddr_union *cond_local_start, union necp_sockaddr_union *cond_local_end, u_int8_t cond_local_prefix, union necp_sockaddr_union *cond_remote_start, union necp_sockaddr_union *cond_remote_end, u_int8_t cond_remote_prefix, struct necp_policy_condition_agent_type *cond_agent_type, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter); +static necp_kernel_policy_id necp_kernel_socket_policy_add(necp_policy_order order, u_int32_t session_order, int session_pid, u_int32_t condition_mask, u_int32_t condition_negated_mask, necp_app_id cond_app_id, necp_app_id cond_real_app_id, char *cond_custom_entitlement, u_int32_t cond_account_id, char *domain, pid_t cond_pid, uid_t cond_uid, ifnet_t cond_bound_interface, struct necp_policy_condition_tc_range cond_traffic_class, u_int16_t cond_protocol, union necp_sockaddr_union *cond_local_start, union necp_sockaddr_union *cond_local_end, u_int8_t cond_local_prefix, union necp_sockaddr_union *cond_remote_start, union necp_sockaddr_union *cond_remote_end, u_int8_t cond_remote_prefix, struct necp_policy_condition_agent_type *cond_agent_type, struct necp_policy_condition_sdk_version *cond_sdk_version, u_int32_t cond_client_flags, char *cond_signing_identifier, u_int16_t cond_packet_filter_tags, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter); static bool necp_kernel_socket_policy_delete(necp_kernel_policy_id policy_id); static bool necp_kernel_socket_policies_reprocess(void); static bool necp_kernel_socket_policies_update_uuid_table(void); -static inline struct necp_kernel_socket_policy *necp_socket_find_policy_match_with_info_locked(struct necp_kernel_socket_policy **policy_search_array, struct necp_socket_info *info, necp_kernel_policy_filter *return_filter, u_int32_t *return_route_rule_id, necp_kernel_policy_result *return_service_action, necp_kernel_policy_service *return_service, u_int32_t *return_netagent_array, u_int32_t *return_netagent_use_flags_array, size_t netagent_array_count, struct necp_client_parameter_netagent_type *required_agent_types, u_int32_t num_required_agent_types, proc_t proc, necp_kernel_policy_id *skip_policy_id); +static inline struct necp_kernel_socket_policy *necp_socket_find_policy_match_with_info_locked(struct necp_kernel_socket_policy **policy_search_array, struct necp_socket_info *info, necp_kernel_policy_filter *return_filter, u_int32_t *return_route_rule_id_array, size_t *return_route_rule_id_array_count, size_t route_rule_id_array_count, necp_kernel_policy_result *return_service_action, necp_kernel_policy_service *return_service, u_int32_t *return_netagent_array, u_int32_t *return_netagent_use_flags_array, size_t netagent_array_count, struct necp_client_parameter_netagent_type *required_agent_types, u_int32_t num_required_agent_types, proc_t proc, u_int16_t pf_tag, necp_kernel_policy_id *skip_policy_id, struct rtentry *rt, necp_kernel_policy_result *return_drop_dest_policy_result, necp_drop_all_bypass_check_result_t *return_drop_all_bypass, u_int32_t *return_flow_divert_aggregate_unit); -static necp_kernel_policy_id necp_kernel_ip_output_policy_add(necp_policy_order order, necp_policy_order suborder, u_int32_t session_order, int session_pid, u_int32_t condition_mask, u_int32_t condition_negated_mask, necp_kernel_policy_id cond_policy_id, ifnet_t cond_bound_interface, u_int32_t cond_last_interface_index, u_int16_t cond_protocol, union necp_sockaddr_union *cond_local_start, union necp_sockaddr_union *cond_local_end, u_int8_t cond_local_prefix, union necp_sockaddr_union *cond_remote_start, union necp_sockaddr_union *cond_remote_end, u_int8_t cond_remote_prefix, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter); +static necp_kernel_policy_id necp_kernel_ip_output_policy_add(necp_policy_order order, necp_policy_order suborder, u_int32_t session_order, int session_pid, u_int32_t condition_mask, u_int32_t condition_negated_mask, necp_kernel_policy_id cond_policy_id, ifnet_t cond_bound_interface, u_int32_t cond_last_interface_index, u_int16_t cond_protocol, union necp_sockaddr_union *cond_local_start, union necp_sockaddr_union *cond_local_end, u_int8_t cond_local_prefix, union necp_sockaddr_union *cond_remote_start, union necp_sockaddr_union *cond_remote_end, u_int8_t cond_remote_prefix, u_int16_t cond_packet_filter_tags, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter); static bool necp_kernel_ip_output_policy_delete(necp_kernel_policy_id policy_id); static bool necp_kernel_ip_output_policies_reprocess(void); @@ -353,23 +424,24 @@ static bool necp_is_range_in_range(struct sockaddr *inner_range_start, struct so static bool necp_is_addr_in_subnet(struct sockaddr *addr, struct sockaddr *subnet_addr, u_int8_t subnet_prefix); static int necp_addr_compare(struct sockaddr *sa1, struct sockaddr *sa2, int check_port); static bool necp_buffer_compare_with_bit_prefix(u_int8_t *p1, u_int8_t *p2, u_int32_t bits); -static bool necp_is_loopback(struct sockaddr *local_addr, struct sockaddr *remote_addr, struct inpcb *inp, struct mbuf *packet); +static bool necp_addr_is_empty(struct sockaddr *addr); +static bool necp_is_loopback(struct sockaddr *local_addr, struct sockaddr *remote_addr, struct inpcb *inp, struct mbuf *packet, u_int32_t bound_interface_index); static bool necp_is_intcoproc(struct inpcb *inp, struct mbuf *packet); struct necp_uuid_id_mapping { LIST_ENTRY(necp_uuid_id_mapping) chain; - uuid_t uuid; - u_int32_t id; - u_int32_t refcount; - u_int32_t table_refcount; // Add to UUID policy table count + uuid_t uuid; + u_int32_t id; + os_refcnt_t refcount; + u_int32_t table_usecount; // Add to UUID policy table count }; static size_t necp_num_uuid_app_id_mappings; static bool necp_uuid_app_id_mappings_dirty; -#define NECP_UUID_APP_ID_HASH_SIZE 64 +#define NECP_UUID_APP_ID_HASH_SIZE 64 static u_long necp_uuid_app_id_hash_mask; static u_long necp_uuid_app_id_hash_num_buckets; -static LIST_HEAD(necp_uuid_id_mapping_head, necp_uuid_id_mapping) *necp_uuid_app_id_hashtbl, necp_uuid_service_id_list; // App map is real hash table, service map is just mapping -#define APPUUIDHASH(uuid) (&necp_uuid_app_id_hashtbl[uuid[0] & necp_uuid_app_id_hash_mask]) // Assume first byte of UUIDs are evenly distributed +static LIST_HEAD(necp_uuid_id_mapping_head, necp_uuid_id_mapping) * necp_uuid_app_id_hashtbl, necp_uuid_service_id_list; // App map is real hash table, service map is just mapping +#define APPUUIDHASH(uuid) (&necp_uuid_app_id_hashtbl[uuid[0] & necp_uuid_app_id_hash_mask]) // Assume first byte of UUIDs are evenly distributed static u_int32_t necp_create_uuid_app_id_mapping(uuid_t uuid, bool *allocated_mapping, bool uuid_policy_table); static bool necp_remove_uuid_app_id_mapping(uuid_t uuid, bool *removed_mapping, bool uuid_policy_table); static struct necp_uuid_id_mapping *necp_uuid_lookup_uuid_with_app_id_locked(u_int32_t local_id); @@ -381,9 +453,9 @@ static bool necp_remove_uuid_service_id_mapping(uuid_t uuid); struct necp_string_id_mapping { LIST_ENTRY(necp_string_id_mapping) chain; - char *string; - necp_app_id id; - u_int32_t refcount; + char *string; + necp_app_id id; + os_refcnt_t refcount; }; static LIST_HEAD(necp_string_id_mapping_list, necp_string_id_mapping) necp_account_id_list; static u_int32_t necp_create_string_to_id_mapping(struct necp_string_id_mapping_list *list, char *domain); @@ -406,15 +478,16 @@ static bool necp_update_qos_marking(struct ifnet *ifp, u_int32_t route_rule_id); #define MAX_ROUTE_RULE_INTERFACES 10 struct necp_route_rule { LIST_ENTRY(necp_route_rule) chain; - u_int32_t id; - u_int32_t default_action; - u_int8_t cellular_action; - u_int8_t wifi_action; - u_int8_t wired_action; - u_int8_t expensive_action; - u_int exception_if_indices[MAX_ROUTE_RULE_INTERFACES]; - u_int8_t exception_if_actions[MAX_ROUTE_RULE_INTERFACES]; - u_int32_t refcount; + u_int32_t id; + u_int32_t default_action; + u_int8_t cellular_action; + u_int8_t wifi_action; + u_int8_t wired_action; + u_int8_t expensive_action; + u_int8_t constrained_action; + u_int exception_if_indices[MAX_ROUTE_RULE_INTERFACES]; + u_int8_t exception_if_actions[MAX_ROUTE_RULE_INTERFACES]; + os_refcnt_t refcount; }; static LIST_HEAD(necp_route_rule_list, necp_route_rule) necp_route_rules; static u_int32_t necp_create_route_rule(struct necp_route_rule_list *list, u_int8_t *route_rules_array, u_int32_t route_rules_array_size); @@ -426,25 +499,40 @@ static inline void necp_get_parent_cred_result(proc_t proc, struct necp_socket_i #define MAX_AGGREGATE_ROUTE_RULES 16 struct necp_aggregate_route_rule { LIST_ENTRY(necp_aggregate_route_rule) chain; - u_int32_t id; - u_int32_t rule_ids[MAX_AGGREGATE_ROUTE_RULES]; + u_int32_t id; + u_int32_t rule_ids[MAX_AGGREGATE_ROUTE_RULES]; }; static LIST_HEAD(necp_aggregate_route_rule_list, necp_aggregate_route_rule) necp_aggregate_route_rules; static u_int32_t necp_create_aggregate_route_rule(u_int32_t *rule_ids); // Sysctl definitions static int sysctl_handle_necp_level SYSCTL_HANDLER_ARGS; +static int sysctl_handle_necp_unentitled_level SYSCTL_HANDLER_ARGS; SYSCTL_NODE(_net, OID_AUTO, necp, CTLFLAG_RW | CTLFLAG_LOCKED, 0, "NECP"); +SYSCTL_INT(_net_necp, NECPCTL_DEDUP_POLICIES, dedup_policies, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_dedup_policies, 0, ""); +SYSCTL_INT(_net_necp, NECPCTL_RESTRICT_MULTICAST, restrict_multicast, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_restrict_multicast, 0, ""); SYSCTL_INT(_net_necp, NECPCTL_PASS_LOOPBACK, pass_loopback, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_pass_loopback, 0, ""); SYSCTL_INT(_net_necp, NECPCTL_PASS_KEEPALIVES, pass_keepalives, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_pass_keepalives, 0, ""); +SYSCTL_INT(_net_necp, NECPCTL_PASS_INTERPOSE, pass_interpose, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_pass_interpose, 0, ""); SYSCTL_INT(_net_necp, NECPCTL_DEBUG, debug, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_debug, 0, ""); +SYSCTL_PROC(_net_necp, NECPCTL_DROP_UNENTITLED_LEVEL, drop_unentitled_level, CTLTYPE_INT | CTLFLAG_LOCKED | CTLFLAG_RW, &necp_drop_unentitled_level, 0, &sysctl_handle_necp_unentitled_level, "IU", ""); SYSCTL_PROC(_net_necp, NECPCTL_DROP_ALL_LEVEL, drop_all_level, CTLTYPE_INT | CTLFLAG_LOCKED | CTLFLAG_RW, &necp_drop_all_level, 0, &sysctl_handle_necp_level, "IU", ""); SYSCTL_LONG(_net_necp, NECPCTL_SOCKET_POLICY_COUNT, socket_policy_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_kernel_socket_policies_count, ""); SYSCTL_LONG(_net_necp, NECPCTL_SOCKET_NON_APP_POLICY_COUNT, socket_non_app_policy_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_kernel_socket_policies_non_app_count, ""); SYSCTL_LONG(_net_necp, NECPCTL_IP_POLICY_COUNT, ip_policy_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_kernel_ip_output_policies_count, ""); SYSCTL_INT(_net_necp, NECPCTL_SESSION_COUNT, session_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_session_count, 0, ""); +static struct necp_drop_dest_policy necp_drop_dest_policy; +static int necp_drop_dest_debug = 0; // 0: off, 1: match, >1: every evaluation +SYSCTL_INT(_net_necp, OID_AUTO, drop_dest_debug, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_drop_dest_debug, 0, ""); + +static int sysctl_handle_necp_drop_dest_level SYSCTL_HANDLER_ARGS; +SYSCTL_PROC(_net_necp, OID_AUTO, drop_dest_level, CTLTYPE_STRUCT | CTLFLAG_LOCKED | CTLFLAG_ANYBODY | CTLFLAG_RW, + 0, 0, &sysctl_handle_necp_drop_dest_level, "S,necp_drop_dest_level", ""); + +static bool necp_address_matches_drop_dest_policy(union necp_sockaddr_union *, u_int32_t); + // Session order allocation static u_int32_t necp_allocate_new_session_order(u_int32_t priority, u_int32_t control_unit) @@ -459,13 +547,16 @@ necp_allocate_new_session_order(u_int32_t priority, u_int32_t control_unit) // Use the control unit to decide the offset into the priority list new_order = (control_unit) + ((priority - 1) * 1000); - return (new_order); + return new_order; } static inline u_int32_t necp_get_first_order_for_priority(u_int32_t priority) { - return (((priority - 1) * 1000) + 1); + if (priority == 0) { + return 0; + } + return ((priority - 1) * 1000) + 1; } // Sysctl handler @@ -474,72 +565,82 @@ sysctl_handle_necp_level SYSCTL_HANDLER_ARGS { #pragma unused(arg1, arg2) int error = sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2, req); - if (necp_drop_all_level == 0) { - necp_drop_all_order = 0; + necp_drop_all_order = necp_get_first_order_for_priority(necp_drop_all_level); + return error; +} + +static int +sysctl_handle_necp_unentitled_level SYSCTL_HANDLER_ARGS +{ +#pragma unused(arg1, arg2) + int error = sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2, req); + necp_drop_unentitled_order = necp_get_first_order_for_priority(necp_drop_unentitled_level); + return error; +} + +// Use a macro here to avoid computing the kauth_cred_t when necp_drop_unentitled_level is 0 +static inline u_int32_t +_necp_process_drop_order_inner(kauth_cred_t cred) +{ + if (priv_check_cred(cred, PRIV_NET_PRIVILEGED_CLIENT_ACCESS, 0) != 0 && + priv_check_cred(cred, PRIV_NET_PRIVILEGED_SERVER_ACCESS, 0) != 0) { + return necp_drop_unentitled_order; } else { - necp_drop_all_order = necp_get_first_order_for_priority(necp_drop_all_level); + return 0; } - return (error); } +#define necp_process_drop_order(_cred) (necp_drop_unentitled_order != 0 ? _necp_process_drop_order_inner(_cred) : necp_drop_unentitled_order) +#pragma GCC poison _necp_process_drop_order_inner + // Session fd -static int noop_read(struct fileproc *, struct uio *, int, vfs_context_t); -static int noop_write(struct fileproc *, struct uio *, int, vfs_context_t); -static int noop_ioctl(struct fileproc *, unsigned long, caddr_t, - vfs_context_t); -static int noop_select(struct fileproc *, int, void *, vfs_context_t); static int necp_session_op_close(struct fileglob *, vfs_context_t); -static int noop_kqfilter(struct fileproc *, struct knote *, - struct kevent_internal_s *, vfs_context_t); static const struct fileops necp_session_fd_ops = { - .fo_type = DTYPE_NETPOLICY, - .fo_read = noop_read, - .fo_write = noop_write, - .fo_ioctl = noop_ioctl, - .fo_select = noop_select, - .fo_close = necp_session_op_close, - .fo_kqfilter = noop_kqfilter, - .fo_drain = NULL, + .fo_type = DTYPE_NETPOLICY, + .fo_read = fo_no_read, + .fo_write = fo_no_write, + .fo_ioctl = fo_no_ioctl, + .fo_select = fo_no_select, + .fo_close = necp_session_op_close, + .fo_drain = fo_no_drain, + .fo_kqfilter = fo_no_kqfilter, }; -static int -noop_read(struct fileproc *fp, struct uio *uio, int flags, vfs_context_t ctx) -{ -#pragma unused(fp, uio, flags, ctx) - return (ENXIO); -} - -static int -noop_write(struct fileproc *fp, struct uio *uio, int flags, - vfs_context_t ctx) +static inline int +necp_is_platform_binary(proc_t proc) { -#pragma unused(fp, uio, flags, ctx) - return (ENXIO); + return (proc != NULL) ? (csproc_get_platform_binary(proc) && cs_valid(proc)) : 0; } -static int -noop_ioctl(struct fileproc *fp, unsigned long com, caddr_t data, - vfs_context_t ctx) +static inline necp_drop_all_bypass_check_result_t +necp_check_drop_all_bypass_result(proc_t proc) { -#pragma unused(fp, com, data, ctx) - return (ENOTTY); -} + if (proc == NULL) { + proc = current_proc(); + if (proc == NULL) { + return NECP_DROP_ALL_BYPASS_CHECK_RESULT_FALSE; + } + } -static int -noop_select(struct fileproc *fp, int which, void *wql, vfs_context_t ctx) -{ -#pragma unused(fp, which, wql, ctx) - return (ENXIO); -} +#if defined(XNU_TARGET_OS_OSX) + const char *signing_id = NULL; + const bool isConfigd = (necp_is_platform_binary(proc) && + (signing_id = cs_identity_get(proc)) && + (strlen(signing_id) == SIGNING_ID_CONFIGD_LEN) && + (memcmp(signing_id, SIGNING_ID_CONFIGD, SIGNING_ID_CONFIGD_LEN) == 0)); + if (isConfigd) { + return NECP_DROP_ALL_BYPASS_CHECK_RESULT_TRUE; + } +#endif -static int -noop_kqfilter(struct fileproc *fp, struct knote *kn, - struct kevent_internal_s *kev, vfs_context_t ctx) -{ -#pragma unused(fp, kn, kev, ctx) - return (ENXIO); + const task_t task = proc_task(proc); + if (task == NULL || !IOTaskHasEntitlement(task, "com.apple.private.necp.drop_all_bypass")) { + return NECP_DROP_ALL_BYPASS_CHECK_RESULT_FALSE; + } else { + return NECP_DROP_ALL_BYPASS_CHECK_RESULT_TRUE; + } } int @@ -569,9 +670,9 @@ necp_session_open(struct proc *p, struct necp_session_open_args *uap, int *retva goto done; } - fp->f_fglob->fg_flag = 0; - fp->f_fglob->fg_ops = &necp_session_fd_ops; - fp->f_fglob->fg_data = session; + fp->fp_glob->fg_flag = 0; + fp->fp_glob->fg_ops = &necp_session_fd_ops; + fp->fp_glob->fg_data = session; proc_fdlock(p); FDFLAGS_SET(p, fd, (UF_EXCLOSE | UF_FORKCLOSE)); @@ -588,7 +689,7 @@ done: } } - return (error); + return error; } static int @@ -602,39 +703,30 @@ necp_session_op_close(struct fileglob *fg, vfs_context_t ctx) necp_policy_mark_all_for_deletion(session); necp_policy_apply_all(session); necp_delete_session(session); - return (0); + return 0; } else { - return (ENOENT); + return ENOENT; } } static int -necp_session_find_from_fd(int fd, struct necp_session **session) +necp_session_find_from_fd(struct proc *p, int fd, + struct fileproc **fpp, struct necp_session **session) { - proc_t p = current_proc(); struct fileproc *fp = NULL; - int error = 0; + int error = fp_get_ftype(p, fd, DTYPE_NETPOLICY, ENODEV, &fp); - proc_fdlock_spin(p); - if ((error = fp_lookup(p, fd, &fp, 1)) != 0) { - goto done; - } - if (fp->f_fglob->fg_ops->fo_type != DTYPE_NETPOLICY) { - fp_drop(p, fd, fp, 1); - error = ENODEV; - goto done; - } - *session = (struct necp_session *)fp->f_fglob->fg_data; - - if ((*session)->necp_fd_type != necp_fd_type_session) { - // Not a client fd, ignore - error = EINVAL; - goto done; + if (error == 0) { + *fpp = fp; + *session = (struct necp_session *)fp->fp_glob->fg_data; + if ((*session)->necp_fd_type != necp_fd_type_session) { + // Not a client fd, ignore + fp_drop(p, fd, fp, 0); + error = EINVAL; + } } -done: - proc_fdunlock(p); - return (error); + return error; } static int @@ -644,13 +736,13 @@ necp_session_add_policy(struct necp_session *session, struct necp_session_action u_int8_t *tlv_buffer = NULL; if (uap->in_buffer_length == 0 || uap->in_buffer_length > NECP_MAX_POLICY_SIZE || uap->in_buffer == 0) { - NECPLOG(LOG_ERR, "necp_session_add_policy invalid input (%zu)", uap->in_buffer_length); + NECPLOG(LOG_ERR, "necp_session_add_policy invalid input (%zu)", (size_t)uap->in_buffer_length); error = EINVAL; goto done; } if (uap->out_buffer_length < sizeof(necp_policy_id) || uap->out_buffer == 0) { - NECPLOG(LOG_ERR, "necp_session_add_policy invalid output buffer (%zu)", uap->out_buffer_length); + NECPLOG(LOG_ERR, "necp_session_add_policy invalid output buffer (%zu)", (size_t)uap->out_buffer_length); error = EINVAL; goto done; } @@ -666,7 +758,7 @@ necp_session_add_policy(struct necp_session *session, struct necp_session_action goto done; } - necp_policy_id new_policy_id = necp_handle_policy_add(session, 0, NULL, tlv_buffer, uap->in_buffer_length, 0, &error); + necp_policy_id new_policy_id = necp_handle_policy_add(session, tlv_buffer, uap->in_buffer_length, 0, &error); if (error != 0) { NECPLOG(LOG_ERR, "necp_session_add_policy failed to add policy (%d)", error); goto done; @@ -685,7 +777,7 @@ done: } *retval = error; - return (error); + return error; } static int @@ -695,7 +787,7 @@ necp_session_get_policy(struct necp_session *session, struct necp_session_action u_int8_t *response = NULL; if (uap->in_buffer_length < sizeof(necp_policy_id) || uap->in_buffer == 0) { - NECPLOG(LOG_ERR, "necp_session_get_policy invalid input (%zu)", uap->in_buffer_length); + NECPLOG(LOG_ERR, "necp_session_get_policy invalid input (%zu)", (size_t)uap->in_buffer_length); error = EINVAL; goto done; } @@ -719,7 +811,7 @@ necp_session_get_policy(struct necp_session *session, struct necp_session_action u_int32_t response_size = order_tlv_size + result_tlv_size + policy->conditions_size; if (uap->out_buffer_length < response_size || uap->out_buffer == 0) { - NECPLOG(LOG_ERR, "necp_session_get_policy buffer not large enough (%u < %u)", uap->out_buffer_length, response_size); + NECPLOG(LOG_ERR, "necp_session_get_policy buffer not large enough (%zu < %u)", (size_t)uap->out_buffer_length, response_size); error = EINVAL; goto done; } @@ -758,7 +850,7 @@ done: } *retval = error; - return (error); + return error; } static int @@ -767,7 +859,7 @@ necp_session_delete_policy(struct necp_session *session, struct necp_session_act int error = 0; if (uap->in_buffer_length < sizeof(necp_policy_id) || uap->in_buffer == 0) { - NECPLOG(LOG_ERR, "necp_session_delete_policy invalid input (%zu)", uap->in_buffer_length); + NECPLOG(LOG_ERR, "necp_session_delete_policy invalid input (%zu)", (size_t)uap->in_buffer_length); error = EINVAL; goto done; } @@ -789,7 +881,7 @@ necp_session_delete_policy(struct necp_session *session, struct necp_session_act necp_policy_mark_for_deletion(session, policy); done: *retval = error; - return (error); + return error; } static int @@ -798,7 +890,7 @@ necp_session_apply_all(struct necp_session *session, struct necp_session_action_ #pragma unused(uap) necp_policy_apply_all(session); *retval = 0; - return (0); + return 0; } static int @@ -826,7 +918,7 @@ necp_session_list_all(struct necp_session *session, struct necp_session_action_a response_size = num_policies * tlv_size; if (uap->out_buffer_length < response_size || uap->out_buffer == 0) { - NECPLOG(LOG_ERR, "necp_session_list_all buffer not large enough (%u < %u)", uap->out_buffer_length, response_size); + NECPLOG(LOG_ERR, "necp_session_list_all buffer not large enough (%zu < %u)", (size_t)uap->out_buffer_length, response_size); error = EINVAL; goto done; } @@ -859,7 +951,7 @@ done: } *retval = error; - return (error); + return error; } @@ -869,7 +961,7 @@ necp_session_delete_all(struct necp_session *session, struct necp_session_action #pragma unused(uap) necp_policy_mark_all_for_deletion(session); *retval = 0; - return (0); + return 0; } static int @@ -880,7 +972,7 @@ necp_session_set_session_priority(struct necp_session *session, struct necp_sess struct necp_session_policy *temp_policy = NULL; if (uap->in_buffer_length < sizeof(necp_session_priority) || uap->in_buffer == 0) { - NECPLOG(LOG_ERR, "necp_session_set_session_priority invalid input (%zu)", uap->in_buffer_length); + NECPLOG(LOG_ERR, "necp_session_set_session_priority invalid input (%zu)", (size_t)uap->in_buffer_length); error = EINVAL; goto done; } @@ -894,7 +986,8 @@ necp_session_set_session_priority(struct necp_session *session, struct necp_sess // Enforce special session priorities with entitlements if (requested_session_priority == NECP_SESSION_PRIORITY_CONTROL || - requested_session_priority == NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL) { + requested_session_priority == NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL || + requested_session_priority == NECP_SESSION_PRIORITY_HIGH_RESTRICTED) { errno_t cred_result = priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NECP_POLICIES, 0); if (cred_result != 0) { NECPLOG(LOG_ERR, "Session does not hold necessary entitlement to claim priority level %d", requested_session_priority); @@ -916,7 +1009,7 @@ necp_session_set_session_priority(struct necp_session *session, struct necp_sess done: *retval = error; - return (error); + return error; } static int @@ -925,7 +1018,7 @@ necp_session_lock_to_process(struct necp_session *session, struct necp_session_a #pragma unused(uap) session->proc_locked = TRUE; *retval = 0; - return (0); + return 0; } static int @@ -935,7 +1028,7 @@ necp_session_register_service(struct necp_session *session, struct necp_session_ struct necp_service_registration *new_service = NULL; if (uap->in_buffer_length < sizeof(uuid_t) || uap->in_buffer == 0) { - NECPLOG(LOG_ERR, "necp_session_register_service invalid input (%zu)", uap->in_buffer_length); + NECPLOG(LOG_ERR, "necp_session_register_service invalid input (%zu)", (size_t)uap->in_buffer_length); error = EINVAL; goto done; } @@ -962,7 +1055,7 @@ necp_session_register_service(struct necp_session *session, struct necp_session_ done: *retval = error; - return (error); + return error; } static int @@ -974,7 +1067,7 @@ necp_session_unregister_service(struct necp_session *session, struct necp_sessio struct necp_uuid_id_mapping *mapping = NULL; if (uap->in_buffer_length < sizeof(uuid_t) || uap->in_buffer == 0) { - NECPLOG(LOG_ERR, "necp_session_unregister_service invalid input (%zu)", uap->in_buffer_length); + NECPLOG(LOG_ERR, "necp_session_unregister_service invalid input (%zu)", (size_t)uap->in_buffer_length); error = EINVAL; goto done; } @@ -1003,37 +1096,39 @@ necp_session_unregister_service(struct necp_session *session, struct necp_sessio done: *retval = error; - return (error); + return error; } static int necp_session_dump_all(struct necp_session *session, struct necp_session_action_args *uap, int *retval) { +#pragma unused(session) int error = 0; if (uap->out_buffer_length == 0 || uap->out_buffer == 0) { - NECPLOG(LOG_ERR, "necp_session_dump_all invalid output buffer (%zu)", uap->out_buffer_length); + NECPLOG(LOG_ERR, "necp_session_dump_all invalid output buffer (%zu)", (size_t)uap->out_buffer_length); error = EINVAL; goto done; } - error = necp_handle_policy_dump_all(session, 0, NULL, uap->out_buffer, uap->out_buffer_length, 0); + error = necp_handle_policy_dump_all(uap->out_buffer, uap->out_buffer_length); done: *retval = error; - return (error); + return error; } int necp_session_action(struct proc *p, struct necp_session_action_args *uap, int *retval) { -#pragma unused(p) + struct fileproc *fp; int error = 0; int return_value = 0; struct necp_session *session = NULL; - error = necp_session_find_from_fd(uap->necp_fd, &session); + + error = necp_session_find_from_fd(p, uap->necp_fd, &fp, &session); if (error != 0) { NECPLOG(LOG_ERR, "necp_session_action find fd error (%d)", error); - return (error); + return error; } NECP_SESSION_LOCK(session); @@ -1054,84 +1149,180 @@ necp_session_action(struct proc *p, struct necp_session_action_args *uap, int *r u_int32_t action = uap->action; switch (action) { - case NECP_SESSION_ACTION_POLICY_ADD: { - return_value = necp_session_add_policy(session, uap, retval); - break; - } - case NECP_SESSION_ACTION_POLICY_GET: { - return_value = necp_session_get_policy(session, uap, retval); - break; - } - case NECP_SESSION_ACTION_POLICY_DELETE: { - return_value = necp_session_delete_policy(session, uap, retval); - break; - } - case NECP_SESSION_ACTION_POLICY_APPLY_ALL: { - return_value = necp_session_apply_all(session, uap, retval); - break; - } - case NECP_SESSION_ACTION_POLICY_LIST_ALL: { - return_value = necp_session_list_all(session, uap, retval); - break; - } - case NECP_SESSION_ACTION_POLICY_DELETE_ALL: { - return_value = necp_session_delete_all(session, uap, retval); - break; - } - case NECP_SESSION_ACTION_SET_SESSION_PRIORITY: { - return_value = necp_session_set_session_priority(session, uap, retval); - break; - } - case NECP_SESSION_ACTION_LOCK_SESSION_TO_PROC: { - return_value = necp_session_lock_to_process(session, uap, retval); - break; - } - case NECP_SESSION_ACTION_REGISTER_SERVICE: { - return_value = necp_session_register_service(session, uap, retval); - break; - } - case NECP_SESSION_ACTION_UNREGISTER_SERVICE: { - return_value = necp_session_unregister_service(session, uap, retval); - break; - } - case NECP_SESSION_ACTION_POLICY_DUMP_ALL: { - return_value = necp_session_dump_all(session, uap, retval); - break; - } - default: { - NECPLOG(LOG_ERR, "necp_session_action unknown action (%u)", action); - return_value = EINVAL; - break; - } + case NECP_SESSION_ACTION_POLICY_ADD: { + return_value = necp_session_add_policy(session, uap, retval); + break; + } + case NECP_SESSION_ACTION_POLICY_GET: { + return_value = necp_session_get_policy(session, uap, retval); + break; + } + case NECP_SESSION_ACTION_POLICY_DELETE: { + return_value = necp_session_delete_policy(session, uap, retval); + break; + } + case NECP_SESSION_ACTION_POLICY_APPLY_ALL: { + return_value = necp_session_apply_all(session, uap, retval); + break; + } + case NECP_SESSION_ACTION_POLICY_LIST_ALL: { + return_value = necp_session_list_all(session, uap, retval); + break; + } + case NECP_SESSION_ACTION_POLICY_DELETE_ALL: { + return_value = necp_session_delete_all(session, uap, retval); + break; + } + case NECP_SESSION_ACTION_SET_SESSION_PRIORITY: { + return_value = necp_session_set_session_priority(session, uap, retval); + break; + } + case NECP_SESSION_ACTION_LOCK_SESSION_TO_PROC: { + return_value = necp_session_lock_to_process(session, uap, retval); + break; + } + case NECP_SESSION_ACTION_REGISTER_SERVICE: { + return_value = necp_session_register_service(session, uap, retval); + break; + } + case NECP_SESSION_ACTION_UNREGISTER_SERVICE: { + return_value = necp_session_unregister_service(session, uap, retval); + break; + } + case NECP_SESSION_ACTION_POLICY_DUMP_ALL: { + return_value = necp_session_dump_all(session, uap, retval); + break; + } + default: { + NECPLOG(LOG_ERR, "necp_session_action unknown action (%u)", action); + return_value = EINVAL; + break; + } } done: NECP_SESSION_UNLOCK(session); - file_drop(uap->necp_fd); + fp_drop(p, uap->necp_fd, fp, 0); + return return_value; +} + +struct necp_resolver_key_state { + const struct ccdigest_info *digest_info; + uint8_t key[CCSHA256_OUTPUT_SIZE]; +}; +static struct necp_resolver_key_state s_necp_resolver_key_state; + +static void +necp_generate_resolver_key(void) +{ + s_necp_resolver_key_state.digest_info = ccsha256_di(); + cc_rand_generate(s_necp_resolver_key_state.key, sizeof(s_necp_resolver_key_state.key)); +} + +static void +necp_sign_update_context(const struct ccdigest_info *di, + cchmac_ctx_t ctx, + uuid_t client_id, + u_int8_t *query, + u_int32_t query_length, + u_int8_t *answer, + u_int32_t answer_length) +{ + const uint8_t context[32] = {[0 ... 31] = 0x20}; // 0x20 repeated 32 times + const char *context_string = "NECP Resolver Binder"; + uint8_t separator = 0; + cchmac_update(di, ctx, sizeof(context), context); + cchmac_update(di, ctx, strlen(context_string), context_string); + cchmac_update(di, ctx, sizeof(separator), &separator); + cchmac_update(di, ctx, sizeof(uuid_t), client_id); + cchmac_update(di, ctx, sizeof(query_length), &query_length); + cchmac_update(di, ctx, query_length, query); + cchmac_update(di, ctx, sizeof(answer_length), &answer_length); + cchmac_update(di, ctx, answer_length, answer); +} + +int +necp_sign_resolver_answer(uuid_t client_id, u_int8_t *query, u_int32_t query_length, + u_int8_t *answer, u_int32_t answer_length, + u_int8_t *tag, u_int32_t *out_tag_length) +{ + if (s_necp_resolver_key_state.digest_info == NULL) { + return EINVAL; + } + + if (query == NULL || + query_length == 0 || + answer == NULL || + answer_length == 0 || + tag == NULL || + out_tag_length == NULL) { + return EINVAL; + } - return (return_value); + size_t required_tag_length = s_necp_resolver_key_state.digest_info->output_size; + if (*out_tag_length < required_tag_length) { + return ERANGE; + } + + *out_tag_length = required_tag_length; + + cchmac_ctx_decl(s_necp_resolver_key_state.digest_info->state_size, + s_necp_resolver_key_state.digest_info->block_size, ctx); + cchmac_init(s_necp_resolver_key_state.digest_info, ctx, + sizeof(s_necp_resolver_key_state.key), + s_necp_resolver_key_state.key); + necp_sign_update_context(s_necp_resolver_key_state.digest_info, + ctx, client_id, query, query_length, + answer, answer_length); + cchmac_final(s_necp_resolver_key_state.digest_info, ctx, tag); + + return 0; } -// Kernel Control functions -static errno_t necp_register_control(void); -static errno_t necp_ctl_connect(kern_ctl_ref kctlref, struct sockaddr_ctl *sac, void **unitinfo); -static errno_t necp_ctl_disconnect(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo); -static errno_t necp_ctl_send(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo, mbuf_t m, int flags); -static void necp_ctl_rcvd(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo, int flags); -static errno_t necp_ctl_getopt(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo, int opt, void *data, size_t *len); -static errno_t necp_ctl_setopt(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo, int opt, void *data, size_t len); +bool +necp_validate_resolver_answer(uuid_t client_id, u_int8_t *query, u_int32_t query_length, + u_int8_t *answer, u_int32_t answer_length, + u_int8_t *tag, u_int32_t tag_length) +{ + if (s_necp_resolver_key_state.digest_info == NULL) { + return false; + } + + if (query == NULL || + query_length == 0 || + answer == NULL || + answer_length == 0 || + tag == NULL || + tag_length == 0) { + return false; + } + + size_t required_tag_length = s_necp_resolver_key_state.digest_info->output_size; + if (tag_length != required_tag_length) { + return false; + } + + uint8_t actual_tag[required_tag_length]; -static bool necp_send_ctl_data(struct necp_session *session, u_int8_t *buffer, size_t buffer_size); + cchmac_ctx_decl(s_necp_resolver_key_state.digest_info->state_size, + s_necp_resolver_key_state.digest_info->block_size, ctx); + cchmac_init(s_necp_resolver_key_state.digest_info, ctx, + sizeof(s_necp_resolver_key_state.key), + s_necp_resolver_key_state.key); + necp_sign_update_context(s_necp_resolver_key_state.digest_info, + ctx, client_id, query, query_length, + answer, answer_length); + cchmac_final(s_necp_resolver_key_state.digest_info, ctx, actual_tag); + + return cc_cmp_safe(s_necp_resolver_key_state.digest_info->output_size, tag, actual_tag) == 0; +} errno_t necp_init(void) { errno_t result = 0; - result = necp_register_control(); - if (result != 0) { - goto done; - } + necp_log_handle = os_log_create("com.apple.xnu.net.necp", "necp"); necp_kernel_policy_grp_attr = lck_grp_attr_alloc_init(); if (necp_kernel_policy_grp_attr == NULL) { @@ -1195,6 +1386,8 @@ necp_init(void) LIST_INIT(&necp_route_rules); LIST_INIT(&necp_aggregate_route_rules); + necp_generate_resolver_key(); + necp_uuid_app_id_hashtbl = hashinit(NECP_UUID_APP_ID_HASH_SIZE, M_NECP, &necp_uuid_app_id_hash_mask); necp_uuid_app_id_hash_num_buckets = necp_uuid_app_id_hash_mask + 1; necp_num_uuid_app_id_mappings = 0; @@ -1216,6 +1409,8 @@ necp_init(void) memset(&necp_kernel_ip_output_policies_map, 0, sizeof(necp_kernel_ip_output_policies_map)); necp_kernel_socket_policies_app_layer_map = NULL; + necp_drop_unentitled_order = necp_get_first_order_for_priority(necp_drop_unentitled_level); + done: if (result != 0) { if (necp_kernel_policy_mtx_attr != NULL) { @@ -1242,50 +1437,8 @@ done: lck_grp_attr_free(necp_route_rule_grp_attr); necp_route_rule_grp_attr = NULL; } - if (necp_kctlref != NULL) { - ctl_deregister(necp_kctlref); - necp_kctlref = NULL; - } - } - return (result); -} - -static errno_t -necp_register_control(void) -{ - struct kern_ctl_reg kern_ctl; - errno_t result = 0; - - // Create a tag to allocate memory - necp_malloc_tag = OSMalloc_Tagalloc(NECP_CONTROL_NAME, OSMT_DEFAULT); - - // Find a unique value for our interface family - result = mbuf_tag_id_find(NECP_CONTROL_NAME, &necp_family); - if (result != 0) { - NECPLOG(LOG_ERR, "mbuf_tag_id_find_internal failed: %d", result); - return (result); - } - - bzero(&kern_ctl, sizeof(kern_ctl)); - strlcpy(kern_ctl.ctl_name, NECP_CONTROL_NAME, sizeof(kern_ctl.ctl_name)); - kern_ctl.ctl_name[sizeof(kern_ctl.ctl_name) - 1] = 0; - kern_ctl.ctl_flags = CTL_FLAG_PRIVILEGED; // Require root - kern_ctl.ctl_sendsize = 64 * 1024; - kern_ctl.ctl_recvsize = 64 * 1024; - kern_ctl.ctl_connect = necp_ctl_connect; - kern_ctl.ctl_disconnect = necp_ctl_disconnect; - kern_ctl.ctl_send = necp_ctl_send; - kern_ctl.ctl_rcvd = necp_ctl_rcvd; - kern_ctl.ctl_setopt = necp_ctl_setopt; - kern_ctl.ctl_getopt = necp_ctl_getopt; - - result = ctl_register(&kern_ctl, &necp_kctlref); - if (result != 0) { - NECPLOG(LOG_ERR, "ctl_register failed: %d", result); - return (result); } - - return (0); + return result; } static void @@ -1294,154 +1447,44 @@ necp_post_change_event(struct kev_necp_policies_changed_data *necp_event_data) struct kev_msg ev_msg; memset(&ev_msg, 0, sizeof(ev_msg)); - ev_msg.vendor_code = KEV_VENDOR_APPLE; - ev_msg.kev_class = KEV_NETWORK_CLASS; - ev_msg.kev_subclass = KEV_NECP_SUBCLASS; - ev_msg.event_code = KEV_NECP_POLICIES_CHANGED; + ev_msg.vendor_code = KEV_VENDOR_APPLE; + ev_msg.kev_class = KEV_NETWORK_CLASS; + ev_msg.kev_subclass = KEV_NECP_SUBCLASS; + ev_msg.event_code = KEV_NECP_POLICIES_CHANGED; - ev_msg.dv[0].data_ptr = necp_event_data; + ev_msg.dv[0].data_ptr = necp_event_data; ev_msg.dv[0].data_length = sizeof(necp_event_data->changed_count); ev_msg.dv[1].data_length = 0; kev_post_msg(&ev_msg); } -static errno_t -necp_ctl_connect(kern_ctl_ref kctlref, struct sockaddr_ctl *sac, void **unitinfo) -{ -#pragma unused(kctlref, sac) - *unitinfo = necp_create_session(); - if (*unitinfo == NULL) { - // Could not allocate session - return (ENOBUFS); - } - - return (0); -} - -static errno_t -necp_ctl_disconnect(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo) -{ -#pragma unused(kctlref, unit) - struct necp_session *session = (struct necp_session *)unitinfo; - if (session != NULL) { - necp_policy_mark_all_for_deletion(session); - necp_policy_apply_all(session); - necp_delete_session((struct necp_session *)unitinfo); - } - - return (0); -} - - -// Message handling -static int -necp_packet_find_tlv(mbuf_t packet, int offset, u_int8_t type, int *err, int next) -{ - size_t cursor = offset; - int error = 0; - u_int32_t curr_length; - u_int8_t curr_type; - - *err = 0; - - do { - if (!next) { - error = mbuf_copydata(packet, cursor, sizeof(curr_type), &curr_type); - if (error) { - *err = ENOENT; - return (-1); - } - } else { - next = 0; - curr_type = NECP_TLV_NIL; - } - - if (curr_type != type) { - cursor += sizeof(curr_type); - error = mbuf_copydata(packet, cursor, sizeof(curr_length), &curr_length); - if (error) { - *err = error; - return (-1); - } - cursor += (sizeof(curr_length) + curr_length); - } - } while (curr_type != type); - - return (cursor); -} - -static int -necp_packet_get_tlv_at_offset(mbuf_t packet, int tlv_offset, u_int32_t buff_len, void *buff, u_int32_t *value_size) -{ - int error = 0; - u_int32_t length; - - if (tlv_offset < 0) { - return (EINVAL); - } - - error = mbuf_copydata(packet, tlv_offset + sizeof(u_int8_t), sizeof(length), &length); - if (error) { - return (error); - } - - u_int32_t total_len = m_length2(packet, NULL); - if (total_len < (tlv_offset + sizeof(u_int8_t) + sizeof(length) + length)) { - NECPLOG(LOG_ERR, "Got a bad TLV, length (%u) + offset (%d) < total length (%u)", - length, (tlv_offset + sizeof(u_int8_t) + sizeof(length)), total_len); - return (EINVAL); - } - - if (value_size != NULL) { - *value_size = length; - } - - if (buff != NULL && buff_len > 0) { - u_int32_t to_copy = (length < buff_len) ? length : buff_len; - error = mbuf_copydata(packet, tlv_offset + sizeof(u_int8_t) + sizeof(length), to_copy, buff); - if (error) { - return (error); - } - } - - return (0); -} - -static u_int8_t * -necp_buffer_write_packet_header(u_int8_t *buffer, u_int8_t packet_type, u_int8_t flags, u_int32_t message_id) -{ - ((struct necp_packet_header *)(void *)buffer)->packet_type = packet_type; - ((struct necp_packet_header *)(void *)buffer)->flags = flags; - ((struct necp_packet_header *)(void *)buffer)->message_id = message_id; - return (buffer + sizeof(struct necp_packet_header)); -} - static inline bool necp_buffer_write_tlv_validate(u_int8_t *cursor, u_int8_t type, u_int32_t length, - u_int8_t *buffer, u_int32_t buffer_length) + u_int8_t *buffer, u_int32_t buffer_length) { if (cursor < buffer || (uintptr_t)(cursor - buffer) > buffer_length) { NECPLOG0(LOG_ERR, "Cannot write TLV in buffer (invalid cursor)"); - return (false); + return false; } u_int8_t *next_tlv = (u_int8_t *)(cursor + sizeof(type) + sizeof(length) + length); if (next_tlv <= buffer || // make sure the next TLV start doesn't overflow - (uintptr_t)(next_tlv - buffer) > buffer_length) { // make sure the next TLV has enough room in buffer + (uintptr_t)(next_tlv - buffer) > buffer_length) { // make sure the next TLV has enough room in buffer NECPLOG(LOG_ERR, "Cannot write TLV in buffer (TLV length %u, buffer length %u)", - length, buffer_length); - return (false); + length, buffer_length); + return false; } - return (true); + return true; } u_int8_t * necp_buffer_write_tlv_if_different(u_int8_t *cursor, u_int8_t type, - u_int32_t length, const void *value, bool *updated, - u_int8_t *buffer, u_int32_t buffer_length) + u_int32_t length, const void *value, bool *updated, + u_int8_t *buffer, u_int32_t buffer_length) { if (!necp_buffer_write_tlv_validate(cursor, type, length, buffer, buffer_length)) { - return (NULL); + // If we can't fit this TLV, return the current cursor + return cursor; } u_int8_t *next_tlv = (u_int8_t *)(cursor + sizeof(type) + sizeof(length) + length); if (*updated || *(u_int8_t *)(cursor) != type) { @@ -1458,16 +1501,16 @@ necp_buffer_write_tlv_if_different(u_int8_t *cursor, u_int8_t type, *updated = TRUE; } } - return (next_tlv); + return next_tlv; } u_int8_t * necp_buffer_write_tlv(u_int8_t *cursor, u_int8_t type, - u_int32_t length, const void *value, - u_int8_t *buffer, u_int32_t buffer_length) + u_int32_t length, const void *value, + u_int8_t *buffer, u_int32_t buffer_length) { if (!necp_buffer_write_tlv_validate(cursor, type, length, buffer, buffer_length)) { - return (NULL); + return NULL; } u_int8_t *next_tlv = (u_int8_t *)(cursor + sizeof(type) + sizeof(length) + length); *(u_int8_t *)(cursor) = type; @@ -1476,7 +1519,7 @@ necp_buffer_write_tlv(u_int8_t *cursor, u_int8_t type, memcpy((u_int8_t *)(cursor + sizeof(type) + sizeof(length)), value, length); } - return (next_tlv); + return next_tlv; } u_int8_t @@ -1485,11 +1528,11 @@ necp_buffer_get_tlv_type(u_int8_t *buffer, int tlv_offset) u_int8_t *type = NULL; if (buffer == NULL) { - return (0); + return 0; } type = (u_int8_t *)((u_int8_t *)buffer + tlv_offset); - return (type ? *type : 0); + return type ? *type : 0; } u_int32_t @@ -1498,11 +1541,11 @@ necp_buffer_get_tlv_length(u_int8_t *buffer, int tlv_offset) u_int32_t *length = NULL; if (buffer == NULL) { - return (0); + return 0; } length = (u_int32_t *)(void *)((u_int8_t *)buffer + tlv_offset + sizeof(u_int8_t)); - return (length ? *length : 0); + return length ? *length : 0; } u_int8_t * @@ -1511,7 +1554,7 @@ necp_buffer_get_tlv_value(u_int8_t *buffer, int tlv_offset, u_int32_t *value_siz u_int8_t *value = NULL; u_int32_t length = necp_buffer_get_tlv_length(buffer, tlv_offset); if (length == 0) { - return (value); + return value; } if (value_size) { @@ -1519,14 +1562,20 @@ necp_buffer_get_tlv_value(u_int8_t *buffer, int tlv_offset, u_int32_t *value_siz } value = (u_int8_t *)((u_int8_t *)buffer + tlv_offset + sizeof(u_int8_t) + sizeof(u_int32_t)); - return (value); + return value; } int -necp_buffer_find_tlv(u_int8_t *buffer, u_int32_t buffer_length, int offset, u_int8_t type, int next) +necp_buffer_find_tlv(u_int8_t *buffer, u_int32_t buffer_length, int offset, u_int8_t type, int *err, int next) { + if (err != NULL) { + *err = ENOENT; + } if (offset < 0) { - return (-1); + if (err != NULL) { + *err = EINVAL; + } + return -1; } int cursor = offset; int next_cursor; @@ -1535,7 +1584,7 @@ necp_buffer_find_tlv(u_int8_t *buffer, u_int32_t buffer_length, int offset, u_in while (TRUE) { if ((((u_int32_t)cursor) + sizeof(curr_type) + sizeof(curr_length)) > buffer_length) { - return (-1); + return -1; } if (!next) { curr_type = necp_buffer_get_tlv_type(buffer, cursor); @@ -1545,16 +1594,19 @@ necp_buffer_find_tlv(u_int8_t *buffer, u_int32_t buffer_length, int offset, u_in } curr_length = necp_buffer_get_tlv_length(buffer, cursor); if (curr_length > buffer_length - ((u_int32_t)cursor + sizeof(curr_type) + sizeof(curr_length))) { - return (-1); + return -1; } next_cursor = (cursor + sizeof(curr_type) + sizeof(curr_length) + curr_length); if (curr_type == type) { // check if entire TLV fits inside buffer if (((u_int32_t)next_cursor) <= buffer_length) { - return (cursor); + if (err != NULL) { + *err = 0; + } + return cursor; } else { - return (-1); + return -1; } } cursor = next_cursor; @@ -1562,61 +1614,54 @@ necp_buffer_find_tlv(u_int8_t *buffer, u_int32_t buffer_length, int offset, u_in } static int -necp_find_tlv(mbuf_t packet, u_int8_t *buffer, u_int32_t buffer_length, int offset, u_int8_t type, int *err, int next) +necp_find_tlv(u_int8_t *buffer, u_int32_t buffer_length, int offset, u_int8_t type, int *err, int next) { int cursor = -1; - if (packet != NULL) { - cursor = necp_packet_find_tlv(packet, offset, type, err, next); - } else if (buffer != NULL) { - cursor = necp_buffer_find_tlv(buffer, buffer_length, offset, type, next); + if (buffer != NULL) { + cursor = necp_buffer_find_tlv(buffer, buffer_length, offset, type, err, next); } - return (cursor); + return cursor; } static int -necp_get_tlv_at_offset(mbuf_t packet, u_int8_t *buffer, u_int32_t buffer_length, - int tlv_offset, u_int32_t out_buffer_length, void *out_buffer, u_int32_t *value_size) +necp_get_tlv_at_offset(u_int8_t *buffer, u_int32_t buffer_length, + int tlv_offset, u_int32_t out_buffer_length, void *out_buffer, u_int32_t *value_size) { - if (packet != NULL) { - // Handle mbuf parsing - return necp_packet_get_tlv_at_offset(packet, tlv_offset, out_buffer_length, out_buffer, value_size); - } - if (buffer == NULL) { NECPLOG0(LOG_ERR, "necp_get_tlv_at_offset buffer is NULL"); - return (EINVAL); + return EINVAL; } // Handle buffer parsing // Validate that buffer has enough room for any TLV if (tlv_offset + sizeof(u_int8_t) + sizeof(u_int32_t) > buffer_length) { - NECPLOG(LOG_ERR, "necp_get_tlv_at_offset buffer_length is too small for TLV (%u < %u)", - buffer_length, tlv_offset + sizeof(u_int8_t) + sizeof(u_int32_t)); - return (EINVAL); + NECPLOG(LOG_ERR, "necp_get_tlv_at_offset buffer_length is too small for TLV (%u < %lu)", + buffer_length, tlv_offset + sizeof(u_int8_t) + sizeof(u_int32_t)); + return EINVAL; } // Validate that buffer has enough room for this TLV u_int32_t tlv_length = necp_buffer_get_tlv_length(buffer, tlv_offset); if (tlv_length > buffer_length - (tlv_offset + sizeof(u_int8_t) + sizeof(u_int32_t))) { - NECPLOG(LOG_ERR, "necp_get_tlv_at_offset buffer_length is too small for TLV of length %u (%u < %u)", - tlv_length, buffer_length, tlv_offset + sizeof(u_int8_t) + sizeof(u_int32_t) + tlv_length); - return (EINVAL); + NECPLOG(LOG_ERR, "necp_get_tlv_at_offset buffer_length is too small for TLV of length %u (%u < %lu)", + tlv_length, buffer_length, tlv_offset + sizeof(u_int8_t) + sizeof(u_int32_t) + tlv_length); + return EINVAL; } if (out_buffer != NULL && out_buffer_length > 0) { // Validate that out buffer is large enough for value if (out_buffer_length < tlv_length) { NECPLOG(LOG_ERR, "necp_get_tlv_at_offset out_buffer_length is too small for TLV value (%u < %u)", - out_buffer_length, tlv_length); - return (EINVAL); + out_buffer_length, tlv_length); + return EINVAL; } // Get value pointer u_int8_t *tlv_value = necp_buffer_get_tlv_value(buffer, tlv_offset, NULL); if (tlv_value == NULL) { NECPLOG0(LOG_ERR, "necp_get_tlv_at_offset tlv_value is NULL"); - return (ENOENT); + return ENOENT; } // Copy value @@ -1628,281 +1673,79 @@ necp_get_tlv_at_offset(mbuf_t packet, u_int8_t *buffer, u_int32_t buffer_length, *value_size = tlv_length; } - return (0); + return 0; } static int -necp_get_tlv(mbuf_t packet, u_int8_t *buffer, u_int32_t buffer_length, - int offset, u_int8_t type, u_int32_t buff_len, void *buff, u_int32_t *value_size) +necp_get_tlv(u_int8_t *buffer, u_int32_t buffer_length, + int offset, u_int8_t type, u_int32_t buff_len, void *buff, u_int32_t *value_size) { int error = 0; - int tlv_offset = necp_find_tlv(packet, buffer, buffer_length, offset, type, &error, 0); + int tlv_offset = necp_find_tlv(buffer, buffer_length, offset, type, &error, 0); if (tlv_offset < 0) { - return (error); + return error; } - return (necp_get_tlv_at_offset(packet, buffer, buffer_length, tlv_offset, buff_len, buff, value_size)); + return necp_get_tlv_at_offset(buffer, buffer_length, tlv_offset, buff_len, buff, value_size); } -static bool -necp_send_ctl_data(struct necp_session *session, u_int8_t *buffer, size_t buffer_size) +// Session Management + +static struct necp_session * +necp_create_session(void) { - int error; + struct necp_session *new_session = NULL; - if (necp_kctlref == NULL || session == NULL || buffer == NULL || buffer_size == 0) { - return (FALSE); + MALLOC(new_session, struct necp_session *, sizeof(*new_session), M_NECP, M_WAITOK | M_ZERO); + if (new_session == NULL) { + goto done; } - error = ctl_enqueuedata(necp_kctlref, session->control_unit, buffer, buffer_size, CTL_DATA_EOR); + new_session->necp_fd_type = necp_fd_type_session; + new_session->session_priority = NECP_SESSION_PRIORITY_UNKNOWN; + new_session->dirty = FALSE; + LIST_INIT(&new_session->policies); + lck_mtx_init(&new_session->lock, necp_kernel_policy_mtx_grp, necp_kernel_policy_mtx_attr); - return (error == 0); -} + // Take the lock + lck_rw_lock_exclusive(&necp_kernel_policy_lock); -static bool -necp_send_success_response(struct necp_session *session, u_int8_t packet_type, u_int32_t message_id) -{ - bool success = TRUE; - u_int8_t *response = NULL; - u_int8_t *cursor = NULL; - size_t response_size = sizeof(struct necp_packet_header) + sizeof(u_int8_t) + sizeof(u_int32_t); - MALLOC(response, u_int8_t *, response_size, M_NECP, M_WAITOK); - if (response == NULL) { - return (FALSE); - } - cursor = response; - cursor = necp_buffer_write_packet_header(cursor, packet_type, NECP_PACKET_FLAGS_RESPONSE, message_id); - cursor = necp_buffer_write_tlv(cursor, NECP_TLV_NIL, 0, NULL, response, response_size); + // Find the next available control unit + u_int32_t control_unit = 1; + struct necp_session *next_session = NULL; + TAILQ_FOREACH(next_session, &necp_session_list, chain) { + if (next_session->control_unit > control_unit) { + // Found a gap, grab this control unit + break; + } - if (!(success = necp_send_ctl_data(session, (u_int8_t *)response, response_size))) { - NECPLOG0(LOG_ERR, "Failed to send response"); + // Try the next control unit, loop around + control_unit = next_session->control_unit + 1; } - FREE(response, M_NECP); - return (success); -} + new_session->control_unit = control_unit; + new_session->session_order = necp_allocate_new_session_order(new_session->session_priority, control_unit); -static bool -necp_send_error_response(struct necp_session *session, u_int8_t packet_type, u_int32_t message_id, u_int32_t error) -{ - bool success = TRUE; - u_int8_t *response = NULL; - u_int8_t *cursor = NULL; - size_t response_size = sizeof(struct necp_packet_header) + sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(u_int32_t); - MALLOC(response, u_int8_t *, response_size, M_NECP, M_WAITOK); - if (response == NULL) { - return (FALSE); + if (next_session != NULL) { + TAILQ_INSERT_BEFORE(next_session, new_session, chain); + } else { + TAILQ_INSERT_TAIL(&necp_session_list, new_session, chain); } - cursor = response; - cursor = necp_buffer_write_packet_header(cursor, packet_type, NECP_PACKET_FLAGS_RESPONSE, message_id); - cursor = necp_buffer_write_tlv(cursor, NECP_TLV_ERROR, sizeof(error), &error, response, response_size); - if (!(success = necp_send_ctl_data(session, (u_int8_t *)response, response_size))) { - NECPLOG0(LOG_ERR, "Failed to send response"); + necp_session_count++; + lck_rw_done(&necp_kernel_policy_lock); + + if (necp_debug) { + NECPLOG(LOG_DEBUG, "Created NECP session, control unit %d", control_unit); } - FREE(response, M_NECP); - return (success); +done: + return new_session; } -static bool -necp_send_policy_id_response(struct necp_session *session, u_int8_t packet_type, u_int32_t message_id, necp_policy_id policy_id) -{ - bool success = TRUE; - u_int8_t *response = NULL; - u_int8_t *cursor = NULL; - size_t response_size = sizeof(struct necp_packet_header) + sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(u_int32_t); - MALLOC(response, u_int8_t *, response_size, M_NECP, M_WAITOK); - if (response == NULL) { - return (FALSE); - } - cursor = response; - cursor = necp_buffer_write_packet_header(cursor, packet_type, NECP_PACKET_FLAGS_RESPONSE, message_id); - cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_ID, sizeof(policy_id), &policy_id, response, response_size); - - if (!(success = necp_send_ctl_data(session, (u_int8_t *)response, response_size))) { - NECPLOG0(LOG_ERR, "Failed to send response"); - } - - FREE(response, M_NECP); - return (success); -} - -static errno_t -necp_ctl_send(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo, mbuf_t packet, int flags) -{ -#pragma unused(kctlref, unit, flags) - struct necp_session *session = (struct necp_session *)unitinfo; - struct necp_packet_header header; - int error = 0; - - if (session == NULL) { - NECPLOG0(LOG_ERR, "Got a NULL session"); - error = EINVAL; - goto done; - } - - if (mbuf_pkthdr_len(packet) < sizeof(header)) { - NECPLOG(LOG_ERR, "Got a bad packet, length (%lu) < sizeof header (%lu)", mbuf_pkthdr_len(packet), sizeof(header)); - error = EINVAL; - goto done; - } - - error = mbuf_copydata(packet, 0, sizeof(header), &header); - if (error) { - NECPLOG(LOG_ERR, "mbuf_copydata failed for the header: %d", error); - error = ENOBUFS; - goto done; - } - - if (session->proc_locked) { - // Verify that the calling process is allowed to send messages - uuid_t proc_uuid; - proc_getexecutableuuid(current_proc(), proc_uuid, sizeof(proc_uuid)); - if (uuid_compare(proc_uuid, session->proc_uuid) != 0) { - necp_send_error_response(session, header.packet_type, header.message_id, NECP_ERROR_INVALID_PROCESS); - goto done; - } - } else { - // If not locked, update the proc_uuid and proc_pid of the session - proc_getexecutableuuid(current_proc(), session->proc_uuid, sizeof(session->proc_uuid)); - session->proc_pid = proc_pid(current_proc()); - } - - switch (header.packet_type) { - case NECP_PACKET_TYPE_POLICY_ADD: { - necp_handle_policy_add(session, header.message_id, packet, NULL, 0, sizeof(header), NULL); - break; - } - case NECP_PACKET_TYPE_POLICY_GET: { - necp_handle_policy_get(session, header.message_id, packet, sizeof(header)); - break; - } - case NECP_PACKET_TYPE_POLICY_DELETE: { - necp_handle_policy_delete(session, header.message_id, packet, sizeof(header)); - break; - } - case NECP_PACKET_TYPE_POLICY_APPLY_ALL: { - necp_handle_policy_apply_all(session, header.message_id, packet, sizeof(header)); - break; - } - case NECP_PACKET_TYPE_POLICY_LIST_ALL: { - necp_handle_policy_list_all(session, header.message_id, packet, sizeof(header)); - break; - } - case NECP_PACKET_TYPE_POLICY_DELETE_ALL: { - necp_handle_policy_delete_all(session, header.message_id, packet, sizeof(header)); - break; - } - case NECP_PACKET_TYPE_POLICY_DUMP_ALL: { - necp_handle_policy_dump_all(session, header.message_id, packet, 0, 0, sizeof(header)); - break; - } - case NECP_PACKET_TYPE_SET_SESSION_PRIORITY: { - necp_handle_set_session_priority(session, header.message_id, packet, sizeof(header)); - break; - } - case NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC: { - necp_handle_lock_session_to_proc(session, header.message_id, packet, sizeof(header)); - break; - } - case NECP_PACKET_TYPE_REGISTER_SERVICE: { - necp_handle_register_service(session, header.message_id, packet, sizeof(header)); - break; - } - case NECP_PACKET_TYPE_UNREGISTER_SERVICE: { - necp_handle_unregister_service(session, header.message_id, packet, sizeof(header)); - break; - } - default: { - NECPLOG(LOG_ERR, "Received unknown message type %d", header.packet_type); - necp_send_error_response(session, header.packet_type, header.message_id, NECP_ERROR_UNKNOWN_PACKET_TYPE); - break; - } - } - -done: - mbuf_freem(packet); - return (error); -} - -static void -necp_ctl_rcvd(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo, int flags) -{ -#pragma unused(kctlref, unit, unitinfo, flags) - return; -} - -static errno_t -necp_ctl_getopt(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo, int opt, void *data, size_t *len) -{ -#pragma unused(kctlref, unit, unitinfo, opt, data, len) - return (0); -} - -static errno_t -necp_ctl_setopt(kern_ctl_ref kctlref, u_int32_t unit, void *unitinfo, int opt, void *data, size_t len) -{ -#pragma unused(kctlref, unit, unitinfo, opt, data, len) - return (0); -} - -// Session Management - -static struct necp_session * -necp_create_session(void) -{ - struct necp_session *new_session = NULL; - - MALLOC(new_session, struct necp_session *, sizeof(*new_session), M_NECP, M_WAITOK | M_ZERO); - if (new_session == NULL) { - goto done; - } - - new_session->necp_fd_type = necp_fd_type_session; - new_session->session_priority = NECP_SESSION_PRIORITY_UNKNOWN; - new_session->dirty = FALSE; - LIST_INIT(&new_session->policies); - lck_mtx_init(&new_session->lock, necp_kernel_policy_mtx_grp, necp_kernel_policy_mtx_attr); - - // Take the lock - lck_rw_lock_exclusive(&necp_kernel_policy_lock); - - // Find the next available control unit - u_int32_t control_unit = 1; - struct necp_session *next_session = NULL; - TAILQ_FOREACH(next_session, &necp_session_list, chain) { - if (next_session->control_unit > control_unit) { - // Found a gap, grab this control unit - break; - } - - // Try the next control unit, loop around - control_unit = next_session->control_unit + 1; - } - - new_session->control_unit = control_unit; - new_session->session_order = necp_allocate_new_session_order(new_session->session_priority, control_unit); - - if (next_session != NULL) { - TAILQ_INSERT_BEFORE(next_session, new_session, chain); - } else { - TAILQ_INSERT_TAIL(&necp_session_list, new_session, chain); - } - - necp_session_count++; - lck_rw_done(&necp_kernel_policy_lock); - - if (necp_debug) { - NECPLOG(LOG_DEBUG, "Created NECP session, control unit %d", control_unit); - } - -done: - return (new_session); -} - -static void -necp_delete_session(struct necp_session *session) +static void +necp_delete_session(struct necp_session *session) { if (session != NULL) { struct necp_service_registration *service = NULL; @@ -1933,19 +1776,19 @@ necp_delete_session(struct necp_session *session) static inline u_int8_t necp_policy_result_get_type_from_buffer(u_int8_t *buffer, u_int32_t length) { - return ((buffer && length >= sizeof(u_int8_t)) ? buffer[0] : 0); + return (buffer && length >= sizeof(u_int8_t)) ? buffer[0] : 0; } static inline u_int32_t necp_policy_result_get_parameter_length_from_buffer(u_int8_t *buffer, u_int32_t length) { - return ((buffer && length > sizeof(u_int8_t)) ? (length - sizeof(u_int8_t)) : 0); + return (buffer && length > sizeof(u_int8_t)) ? (length - sizeof(u_int8_t)) : 0; } static inline u_int8_t * necp_policy_result_get_parameter_pointer_from_buffer(u_int8_t *buffer, u_int32_t length) { - return ((buffer && length > sizeof(u_int8_t)) ? (buffer + sizeof(u_int8_t)) : NULL); + return (buffer && length > sizeof(u_int8_t)) ? (buffer + sizeof(u_int8_t)) : NULL; } static bool @@ -1953,20 +1796,20 @@ necp_policy_result_requires_route_rules(u_int8_t *buffer, u_int32_t length) { u_int8_t type = necp_policy_result_get_type_from_buffer(buffer, length); if (type == NECP_POLICY_RESULT_ROUTE_RULES) { - return (TRUE); + return TRUE; } - return (FALSE); + return FALSE; } static inline bool necp_address_is_valid(struct sockaddr *address) { if (address->sa_family == AF_INET) { - return (address->sa_len == sizeof(struct sockaddr_in)); + return address->sa_len == sizeof(struct sockaddr_in); } else if (address->sa_family == AF_INET6) { - return (address->sa_len == sizeof(struct sockaddr_in6)); + return address->sa_len == sizeof(struct sockaddr_in6); } else { - return (FALSE); + return FALSE; } } @@ -1977,111 +1820,123 @@ necp_policy_result_is_valid(u_int8_t *buffer, u_int32_t length) u_int8_t type = necp_policy_result_get_type_from_buffer(buffer, length); u_int32_t parameter_length = necp_policy_result_get_parameter_length_from_buffer(buffer, length); switch (type) { - case NECP_POLICY_RESULT_PASS: - case NECP_POLICY_RESULT_DROP: - case NECP_POLICY_RESULT_ROUTE_RULES: - case NECP_POLICY_RESULT_SCOPED_DIRECT: { + case NECP_POLICY_RESULT_PASS: { + if (parameter_length == 0 || parameter_length == sizeof(u_int32_t)) { validated = TRUE; - break; } - case NECP_POLICY_RESULT_SKIP: - case NECP_POLICY_RESULT_SOCKET_DIVERT: - case NECP_POLICY_RESULT_SOCKET_FILTER: { - if (parameter_length >= sizeof(u_int32_t)) { - validated = TRUE; - } - break; + break; + } + case NECP_POLICY_RESULT_DROP: { + if (parameter_length == 0 || parameter_length == sizeof(u_int32_t)) { + validated = TRUE; } - case NECP_POLICY_RESULT_IP_TUNNEL: { - if (parameter_length > sizeof(u_int32_t)) { - validated = TRUE; - } - break; + break; + } + case NECP_POLICY_RESULT_ROUTE_RULES: + case NECP_POLICY_RESULT_SCOPED_DIRECT: + case NECP_POLICY_RESULT_ALLOW_UNENTITLED: { + validated = TRUE; + break; + } + case NECP_POLICY_RESULT_SKIP: + case NECP_POLICY_RESULT_SOCKET_DIVERT: + case NECP_POLICY_RESULT_SOCKET_FILTER: { + if (parameter_length >= sizeof(u_int32_t)) { + validated = TRUE; } - case NECP_POLICY_RESULT_SOCKET_SCOPED: { - if (parameter_length > 0) { - validated = TRUE; - } - break; + break; + } + case NECP_POLICY_RESULT_IP_TUNNEL: { + if (parameter_length > sizeof(u_int32_t)) { + validated = TRUE; } - case NECP_POLICY_RESULT_TRIGGER: - case NECP_POLICY_RESULT_TRIGGER_IF_NEEDED: - case NECP_POLICY_RESULT_TRIGGER_SCOPED: - case NECP_POLICY_RESULT_NO_TRIGGER_SCOPED: - case NECP_POLICY_RESULT_USE_NETAGENT: - case NECP_POLICY_RESULT_NETAGENT_SCOPED:{ - if (parameter_length >= sizeof(uuid_t)) { - validated = TRUE; - } - break; + break; + } + case NECP_POLICY_RESULT_SOCKET_SCOPED: { + if (parameter_length > 0) { + validated = TRUE; } - default: { - validated = FALSE; - break; + break; + } + case NECP_POLICY_RESULT_TRIGGER: + case NECP_POLICY_RESULT_TRIGGER_IF_NEEDED: + case NECP_POLICY_RESULT_TRIGGER_SCOPED: + case NECP_POLICY_RESULT_NO_TRIGGER_SCOPED: + case NECP_POLICY_RESULT_USE_NETAGENT: + case NECP_POLICY_RESULT_NETAGENT_SCOPED:{ + if (parameter_length >= sizeof(uuid_t)) { + validated = TRUE; } + break; + } + default: { + validated = FALSE; + break; + } } if (necp_debug) { NECPLOG(LOG_DEBUG, "Policy result type %d, valid %d", type, validated); } - return (validated); + return validated; } static inline u_int8_t necp_policy_condition_get_type_from_buffer(u_int8_t *buffer, u_int32_t length) { - return ((buffer && length >= sizeof(u_int8_t)) ? buffer[0] : 0); + return (buffer && length >= sizeof(u_int8_t)) ? buffer[0] : 0; } static inline u_int8_t necp_policy_condition_get_flags_from_buffer(u_int8_t *buffer, u_int32_t length) { - return ((buffer && length >= (2 * sizeof(u_int8_t))) ? buffer[1] : 0); + return (buffer && length >= (2 * sizeof(u_int8_t))) ? buffer[1] : 0; } static inline u_int32_t necp_policy_condition_get_value_length_from_buffer(u_int8_t *buffer, u_int32_t length) { - return ((buffer && length >= (2 * sizeof(u_int8_t))) ? (length - (2 * sizeof(u_int8_t))) : 0); + return (buffer && length >= (2 * sizeof(u_int8_t))) ? (length - (2 * sizeof(u_int8_t))) : 0; } static inline u_int8_t * necp_policy_condition_get_value_pointer_from_buffer(u_int8_t *buffer, u_int32_t length) { - return ((buffer && length > (2 * sizeof(u_int8_t))) ? (buffer + (2 * sizeof(u_int8_t))) : NULL); + return (buffer && length > (2 * sizeof(u_int8_t))) ? (buffer + (2 * sizeof(u_int8_t))) : NULL; } static inline bool necp_policy_condition_is_default(u_int8_t *buffer, u_int32_t length) { - return (necp_policy_condition_get_type_from_buffer(buffer, length) == NECP_POLICY_CONDITION_DEFAULT); + return necp_policy_condition_get_type_from_buffer(buffer, length) == NECP_POLICY_CONDITION_DEFAULT; } static inline bool necp_policy_condition_is_application(u_int8_t *buffer, u_int32_t length) { - return (necp_policy_condition_get_type_from_buffer(buffer, length) == NECP_POLICY_CONDITION_APPLICATION); + return necp_policy_condition_get_type_from_buffer(buffer, length) == NECP_POLICY_CONDITION_APPLICATION; } static inline bool necp_policy_condition_is_real_application(u_int8_t *buffer, u_int32_t length) { - return (necp_policy_condition_get_type_from_buffer(buffer, length) == NECP_POLICY_CONDITION_REAL_APPLICATION); + return necp_policy_condition_get_type_from_buffer(buffer, length) == NECP_POLICY_CONDITION_REAL_APPLICATION; } static inline bool necp_policy_condition_requires_application(u_int8_t *buffer, u_int32_t length) { u_int8_t type = necp_policy_condition_get_type_from_buffer(buffer, length); - return (type == NECP_POLICY_CONDITION_REAL_APPLICATION); + return type == NECP_POLICY_CONDITION_REAL_APPLICATION; } static inline bool necp_policy_condition_requires_real_application(u_int8_t *buffer, u_int32_t length) { u_int8_t type = necp_policy_condition_get_type_from_buffer(buffer, length); - return (type == NECP_POLICY_CONDITION_ENTITLEMENT); + u_int32_t condition_length = necp_policy_condition_get_value_length_from_buffer(buffer, length); + return type == NECP_POLICY_CONDITION_ENTITLEMENT && condition_length > 0; } static bool @@ -2089,335 +1944,241 @@ necp_policy_condition_is_valid(u_int8_t *buffer, u_int32_t length, u_int8_t poli { bool validated = FALSE; bool result_cannot_have_ip_layer = (policy_result_type == NECP_POLICY_RESULT_SOCKET_DIVERT || - policy_result_type == NECP_POLICY_RESULT_SOCKET_FILTER || - policy_result_type == NECP_POLICY_RESULT_TRIGGER || - policy_result_type == NECP_POLICY_RESULT_TRIGGER_IF_NEEDED || - policy_result_type == NECP_POLICY_RESULT_TRIGGER_SCOPED || - policy_result_type == NECP_POLICY_RESULT_NO_TRIGGER_SCOPED || - policy_result_type == NECP_POLICY_RESULT_SOCKET_SCOPED || - policy_result_type == NECP_POLICY_RESULT_ROUTE_RULES || - policy_result_type == NECP_POLICY_RESULT_USE_NETAGENT || - policy_result_type == NECP_POLICY_RESULT_NETAGENT_SCOPED || - policy_result_type == NECP_POLICY_RESULT_SCOPED_DIRECT) ? TRUE : FALSE; + policy_result_type == NECP_POLICY_RESULT_SOCKET_FILTER || + policy_result_type == NECP_POLICY_RESULT_TRIGGER || + policy_result_type == NECP_POLICY_RESULT_TRIGGER_IF_NEEDED || + policy_result_type == NECP_POLICY_RESULT_TRIGGER_SCOPED || + policy_result_type == NECP_POLICY_RESULT_NO_TRIGGER_SCOPED || + policy_result_type == NECP_POLICY_RESULT_SOCKET_SCOPED || + policy_result_type == NECP_POLICY_RESULT_ROUTE_RULES || + policy_result_type == NECP_POLICY_RESULT_USE_NETAGENT || + policy_result_type == NECP_POLICY_RESULT_NETAGENT_SCOPED || + policy_result_type == NECP_POLICY_RESULT_SCOPED_DIRECT || + policy_result_type == NECP_POLICY_RESULT_ALLOW_UNENTITLED) ? TRUE : FALSE; u_int32_t condition_length = necp_policy_condition_get_value_length_from_buffer(buffer, length); u_int8_t *condition_value = necp_policy_condition_get_value_pointer_from_buffer(buffer, length); u_int8_t type = necp_policy_condition_get_type_from_buffer(buffer, length); u_int8_t flags = necp_policy_condition_get_flags_from_buffer(buffer, length); switch (type) { - case NECP_POLICY_CONDITION_APPLICATION: - case NECP_POLICY_CONDITION_REAL_APPLICATION: { - if (!(flags & NECP_POLICY_CONDITION_FLAGS_NEGATIVE) && - condition_length >= sizeof(uuid_t) && - condition_value != NULL && - !uuid_is_null(condition_value)) { - validated = TRUE; - } - break; - } - case NECP_POLICY_CONDITION_DOMAIN: - case NECP_POLICY_CONDITION_ACCOUNT: - case NECP_POLICY_CONDITION_BOUND_INTERFACE: { - if (condition_length > 0) { - validated = TRUE; - } - break; - } - case NECP_POLICY_CONDITION_TRAFFIC_CLASS: { - if (condition_length >= sizeof(struct necp_policy_condition_tc_range)) { - validated = TRUE; - } - break; + case NECP_POLICY_CONDITION_APPLICATION: + case NECP_POLICY_CONDITION_REAL_APPLICATION: { + if (!(flags & NECP_POLICY_CONDITION_FLAGS_NEGATIVE) && + condition_length >= sizeof(uuid_t) && + condition_value != NULL && + !uuid_is_null(condition_value)) { + validated = TRUE; } - case NECP_POLICY_CONDITION_DEFAULT: - case NECP_POLICY_CONDITION_ALL_INTERFACES: - case NECP_POLICY_CONDITION_ENTITLEMENT: { - if (!(flags & NECP_POLICY_CONDITION_FLAGS_NEGATIVE)) { - validated = TRUE; - } - break; + break; + } + case NECP_POLICY_CONDITION_DOMAIN: + case NECP_POLICY_CONDITION_ACCOUNT: + case NECP_POLICY_CONDITION_BOUND_INTERFACE: + case NECP_POLICY_CONDITION_SIGNING_IDENTIFIER: { + if (condition_length > 0) { + validated = TRUE; } - case NECP_POLICY_CONDITION_IP_PROTOCOL: { - if (condition_length >= sizeof(u_int16_t)) { - validated = TRUE; - } - break; + break; + } + case NECP_POLICY_CONDITION_TRAFFIC_CLASS: { + if (condition_length >= sizeof(struct necp_policy_condition_tc_range)) { + validated = TRUE; } - case NECP_POLICY_CONDITION_PID: { - if (condition_length >= sizeof(pid_t) && - condition_value != NULL && - *((pid_t *)(void *)condition_value) != 0) { - validated = TRUE; - } - break; + break; + } + case NECP_POLICY_CONDITION_DEFAULT: + case NECP_POLICY_CONDITION_ALL_INTERFACES: + case NECP_POLICY_CONDITION_ENTITLEMENT: + case NECP_POLICY_CONDITION_PLATFORM_BINARY: + case NECP_POLICY_CONDITION_HAS_CLIENT: + case NECP_POLICY_CONDITION_LOCAL_NETWORKS: { + if (!(flags & NECP_POLICY_CONDITION_FLAGS_NEGATIVE)) { + validated = TRUE; } - case NECP_POLICY_CONDITION_UID: { - if (condition_length >= sizeof(uid_t)) { - validated = TRUE; - } - break; + break; + } + case NECP_POLICY_CONDITION_SDK_VERSION: { + if (!(flags & NECP_POLICY_CONDITION_FLAGS_NEGATIVE) && + condition_length >= sizeof(struct necp_policy_condition_sdk_version)) { + validated = TRUE; } - case NECP_POLICY_CONDITION_LOCAL_ADDR: - case NECP_POLICY_CONDITION_REMOTE_ADDR: { - if (!result_cannot_have_ip_layer && condition_length >= sizeof(struct necp_policy_condition_addr) && - necp_address_is_valid(&((struct necp_policy_condition_addr *)(void *)condition_value)->address.sa)) { - validated = TRUE; - } - break; + break; + } + case NECP_POLICY_CONDITION_IP_PROTOCOL: { + if (condition_length >= sizeof(u_int16_t)) { + validated = TRUE; } - case NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE: - case NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE: { - if (!result_cannot_have_ip_layer && condition_length >= sizeof(struct necp_policy_condition_addr_range) && - necp_address_is_valid(&((struct necp_policy_condition_addr_range *)(void *)condition_value)->start_address.sa) && - necp_address_is_valid(&((struct necp_policy_condition_addr_range *)(void *)condition_value)->end_address.sa)) { - validated = TRUE; - } - break; + break; + } + case NECP_POLICY_CONDITION_PID: { + if (condition_length >= sizeof(pid_t) && + condition_value != NULL && + *((pid_t *)(void *)condition_value) != 0) { + validated = TRUE; } - case NECP_POLICY_CONDITION_AGENT_TYPE: { - if (!(flags & NECP_POLICY_CONDITION_FLAGS_NEGATIVE) && - condition_length >= sizeof(struct necp_policy_condition_agent_type)) { - validated = TRUE; - } - break; + break; + } + case NECP_POLICY_CONDITION_UID: { + if (condition_length >= sizeof(uid_t)) { + validated = TRUE; } - default: { - validated = FALSE; - break; + break; + } + case NECP_POLICY_CONDITION_LOCAL_ADDR: + case NECP_POLICY_CONDITION_REMOTE_ADDR: { + if (!result_cannot_have_ip_layer && condition_length >= sizeof(struct necp_policy_condition_addr) && + necp_address_is_valid(&((struct necp_policy_condition_addr *)(void *)condition_value)->address.sa)) { + validated = TRUE; } + break; } - - if (necp_debug) { - NECPLOG(LOG_DEBUG, "Policy condition type %d, valid %d", type, validated); + case NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE: + case NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE: { + if (!result_cannot_have_ip_layer && condition_length >= sizeof(struct necp_policy_condition_addr_range) && + necp_address_is_valid(&((struct necp_policy_condition_addr_range *)(void *)condition_value)->start_address.sa) && + necp_address_is_valid(&((struct necp_policy_condition_addr_range *)(void *)condition_value)->end_address.sa)) { + validated = TRUE; + } + break; } - - return (validated); -} - -static bool -necp_policy_route_rule_is_default(u_int8_t *buffer, u_int32_t length) -{ - return (necp_policy_condition_get_value_length_from_buffer(buffer, length) == 0 && - necp_policy_condition_get_flags_from_buffer(buffer, length) == 0); -} - -static bool -necp_policy_route_rule_is_valid(u_int8_t *buffer, u_int32_t length) -{ - bool validated = FALSE; - u_int8_t type = necp_policy_condition_get_type_from_buffer(buffer, length); - switch (type) { - case NECP_ROUTE_RULE_ALLOW_INTERFACE: { + case NECP_POLICY_CONDITION_AGENT_TYPE: { + if (!(flags & NECP_POLICY_CONDITION_FLAGS_NEGATIVE) && + condition_length >= sizeof(struct necp_policy_condition_agent_type)) { validated = TRUE; - break; } - case NECP_ROUTE_RULE_DENY_INTERFACE: { + break; + } + case NECP_POLICY_CONDITION_FLOW_IP_PROTOCOL: { + if (condition_length >= sizeof(u_int16_t)) { validated = TRUE; - break; } - case NECP_ROUTE_RULE_QOS_MARKING: { + break; + } + case NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR: + case NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR: { + if (condition_length >= sizeof(struct necp_policy_condition_addr) && + necp_address_is_valid(&((struct necp_policy_condition_addr *)(void *)condition_value)->address.sa)) { validated = TRUE; - break; } - case NECP_ROUTE_RULE_DENY_LQM_ABORT: { + break; + } + case NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_RANGE: + case NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_RANGE: { + if (condition_length >= sizeof(struct necp_policy_condition_addr_range) && + necp_address_is_valid(&((struct necp_policy_condition_addr_range *)(void *)condition_value)->start_address.sa) && + necp_address_is_valid(&((struct necp_policy_condition_addr_range *)(void *)condition_value)->end_address.sa)) { validated = TRUE; - break; } - default: { - validated = FALSE; - break; + break; + } + case NECP_POLICY_CONDITION_CLIENT_FLAGS: { + if (condition_length == 0 || condition_length >= sizeof(u_int32_t)) { + validated = TRUE; } + break; } - - if (necp_debug) { - NECPLOG(LOG_DEBUG, "Policy route rule type %d, valid %d", type, validated); + case NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_EMPTY: { + validated = TRUE; + break; } - - return (validated); -} - -static int -necp_get_posix_error_for_necp_error(int response_error) -{ - switch (response_error) { - case NECP_ERROR_UNKNOWN_PACKET_TYPE: - case NECP_ERROR_INVALID_TLV: - case NECP_ERROR_POLICY_RESULT_INVALID: - case NECP_ERROR_POLICY_CONDITIONS_INVALID: - case NECP_ERROR_ROUTE_RULES_INVALID: { - return (EINVAL); - } - case NECP_ERROR_POLICY_ID_NOT_FOUND: { - return (ENOENT); - } - case NECP_ERROR_INVALID_PROCESS: { - return (EPERM); - } - case NECP_ERROR_INTERNAL: - default: { - return (ENOMEM); + case NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_EMPTY: { + validated = TRUE; + break; + } + case NECP_POLICY_CONDITION_PACKET_FILTER_TAGS: { + if (condition_length >= sizeof(u_int16_t)) { + u_int16_t packet_filter_tags = *(u_int16_t *)(void *)condition_value; + if (packet_filter_tags > 0 && packet_filter_tags <= NECP_POLICY_CONDITION_PACKET_FILTER_TAG_MAX) { + validated = TRUE; + } } + break; } -} - -static void -necp_handle_set_session_priority(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset) -{ - int error; - struct necp_session_policy *policy = NULL; - struct necp_session_policy *temp_policy = NULL; - u_int32_t response_error = NECP_ERROR_INTERNAL; - u_int32_t requested_session_priority = NECP_SESSION_PRIORITY_UNKNOWN; - - // Read policy id - error = necp_get_tlv(packet, NULL, 0, offset, NECP_TLV_SESSION_PRIORITY, sizeof(requested_session_priority), &requested_session_priority, NULL); - if (error) { - NECPLOG(LOG_ERR, "Failed to get session priority: %d", error); - response_error = NECP_ERROR_INVALID_TLV; - goto fail; + case NECP_POLICY_CONDITION_FLOW_IS_LOOPBACK: { + validated = TRUE; + break; } - - if (session == NULL) { - NECPLOG0(LOG_ERR, "Failed to find session"); - response_error = NECP_ERROR_INTERNAL; - goto fail; + default: { + validated = FALSE; + break; } - - // Enforce special session priorities with entitlements - if (requested_session_priority == NECP_SESSION_PRIORITY_CONTROL || - requested_session_priority == NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL) { - errno_t cred_result = priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NECP_POLICIES, 0); - if (cred_result != 0) { - NECPLOG(LOG_ERR, "Session does not hold necessary entitlement to claim priority level %d", requested_session_priority); - goto fail; - } } - if (session->session_priority != requested_session_priority) { - session->session_priority = requested_session_priority; - session->session_order = necp_allocate_new_session_order(session->session_priority, session->control_unit); - session->dirty = TRUE; - - // Mark all policies as needing updates - LIST_FOREACH_SAFE(policy, &session->policies, chain, temp_policy) { - policy->pending_update = TRUE; - } + if (necp_debug) { + NECPLOG(LOG_DEBUG, "Policy condition type %d, valid %d", type, validated); } - necp_send_success_response(session, NECP_PACKET_TYPE_SET_SESSION_PRIORITY, message_id); - return; - -fail: - necp_send_error_response(session, NECP_PACKET_TYPE_SET_SESSION_PRIORITY, message_id, response_error); + return validated; } -static void -necp_handle_lock_session_to_proc(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset) +static bool +necp_policy_route_rule_is_default(u_int8_t *buffer, u_int32_t length) { -#pragma unused(packet, offset) - // proc_uuid already filled out - session->proc_locked = TRUE; - necp_send_success_response(session, NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC, message_id); + return necp_policy_condition_get_value_length_from_buffer(buffer, length) == 0 && + necp_policy_condition_get_flags_from_buffer(buffer, length) == 0; } -static void -necp_handle_register_service(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset) +static bool +necp_policy_route_rule_is_valid(u_int8_t *buffer, u_int32_t length) { - int error; - struct necp_service_registration *new_service = NULL; - u_int32_t response_error = NECP_ERROR_INTERNAL; - uuid_t service_uuid; - uuid_clear(service_uuid); - - if (session == NULL) { - NECPLOG0(LOG_ERR, "Failed to find session"); - response_error = NECP_ERROR_INTERNAL; - goto fail; + bool validated = FALSE; + u_int8_t type = necp_policy_condition_get_type_from_buffer(buffer, length); + switch (type) { + case NECP_ROUTE_RULE_ALLOW_INTERFACE: { + validated = TRUE; + break; } - - // Enforce entitlements - errno_t cred_result = priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NECP_POLICIES, 0); - if (cred_result != 0) { - NECPLOG0(LOG_ERR, "Session does not hold necessary entitlement to register service"); - goto fail; + case NECP_ROUTE_RULE_DENY_INTERFACE: { + validated = TRUE; + break; } - - // Read service uuid - error = necp_get_tlv(packet, NULL, 0, offset, NECP_TLV_SERVICE_UUID, sizeof(uuid_t), service_uuid, NULL); - if (error) { - NECPLOG(LOG_ERR, "Failed to get service UUID: %d", error); - response_error = NECP_ERROR_INVALID_TLV; - goto fail; + case NECP_ROUTE_RULE_QOS_MARKING: { + validated = TRUE; + break; + } + case NECP_ROUTE_RULE_DENY_LQM_ABORT: { + validated = TRUE; + break; + } + default: { + validated = FALSE; + break; } - - MALLOC(new_service, struct necp_service_registration *, sizeof(*new_service), M_NECP, M_WAITOK); - if (new_service == NULL) { - NECPLOG0(LOG_ERR, "Failed to allocate service registration"); - response_error = NECP_ERROR_INTERNAL; - goto fail; } - lck_rw_lock_exclusive(&necp_kernel_policy_lock); - memset(new_service, 0, sizeof(*new_service)); - new_service->service_id = necp_create_uuid_service_id_mapping(service_uuid); - LIST_INSERT_HEAD(&session->services, new_service, session_chain); - LIST_INSERT_HEAD(&necp_registered_service_list, new_service, kernel_chain); - lck_rw_done(&necp_kernel_policy_lock); + if (necp_debug) { + NECPLOG(LOG_DEBUG, "Policy route rule type %d, valid %d", type, validated); + } - necp_send_success_response(session, NECP_PACKET_TYPE_REGISTER_SERVICE, message_id); - return; -fail: - necp_send_error_response(session, NECP_PACKET_TYPE_REGISTER_SERVICE, message_id, response_error); + return validated; } -static void -necp_handle_unregister_service(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset) +static int +necp_get_posix_error_for_necp_error(int response_error) { - int error; - struct necp_service_registration *service = NULL; - struct necp_service_registration *temp_service = NULL; - u_int32_t response_error = NECP_ERROR_INTERNAL; - struct necp_uuid_id_mapping *mapping = NULL; - uuid_t service_uuid; - uuid_clear(service_uuid); - - if (session == NULL) { - NECPLOG0(LOG_ERR, "Failed to find session"); - response_error = NECP_ERROR_INTERNAL; - goto fail; + switch (response_error) { + case NECP_ERROR_UNKNOWN_PACKET_TYPE: + case NECP_ERROR_INVALID_TLV: + case NECP_ERROR_POLICY_RESULT_INVALID: + case NECP_ERROR_POLICY_CONDITIONS_INVALID: + case NECP_ERROR_ROUTE_RULES_INVALID: { + return EINVAL; } - - // Read service uuid - error = necp_get_tlv(packet, NULL, 0, offset, NECP_TLV_SERVICE_UUID, sizeof(uuid_t), service_uuid, NULL); - if (error) { - NECPLOG(LOG_ERR, "Failed to get service UUID: %d", error); - response_error = NECP_ERROR_INVALID_TLV; - goto fail; + case NECP_ERROR_POLICY_ID_NOT_FOUND: { + return ENOENT; + } + case NECP_ERROR_INVALID_PROCESS: { + return EPERM; + } + case NECP_ERROR_INTERNAL: + default: { + return ENOMEM; } - - // Mark remove all matching services for this session - lck_rw_lock_exclusive(&necp_kernel_policy_lock); - mapping = necp_uuid_lookup_service_id_locked(service_uuid); - if (mapping != NULL) { - LIST_FOREACH_SAFE(service, &session->services, session_chain, temp_service) { - if (service->service_id == mapping->id) { - LIST_REMOVE(service, session_chain); - LIST_REMOVE(service, kernel_chain); - FREE(service, M_NECP); - } - } - necp_remove_uuid_service_id_mapping(service_uuid); } - lck_rw_done(&necp_kernel_policy_lock); - - necp_send_success_response(session, NECP_PACKET_TYPE_UNREGISTER_SERVICE, message_id); - return; -fail: - necp_send_error_response(session, NECP_PACKET_TYPE_UNREGISTER_SERVICE, message_id, response_error); } static necp_policy_id -necp_handle_policy_add(struct necp_session *session, u_int32_t message_id, mbuf_t packet, - u_int8_t *tlv_buffer, size_t tlv_buffer_length, int offset, int *return_error) +necp_handle_policy_add(struct necp_session *session, + u_int8_t *tlv_buffer, size_t tlv_buffer_length, int offset, int *return_error) { bool has_default_condition = FALSE; bool has_non_default_condition = FALSE; @@ -2444,7 +2205,7 @@ necp_handle_policy_add(struct necp_session *session, u_int32_t message_id, mbuf_ u_int32_t policy_result_size = 0; // Read policy order - error = necp_get_tlv(packet, tlv_buffer, tlv_buffer_length, offset, NECP_TLV_POLICY_ORDER, sizeof(order), &order, NULL); + error = necp_get_tlv(tlv_buffer, tlv_buffer_length, offset, NECP_TLV_POLICY_ORDER, sizeof(order), &order, NULL); if (error) { NECPLOG(LOG_ERR, "Failed to get policy order: %d", error); response_error = NECP_ERROR_INVALID_TLV; @@ -2452,8 +2213,13 @@ necp_handle_policy_add(struct necp_session *session, u_int32_t message_id, mbuf_ } // Read policy result - cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, offset, NECP_TLV_POLICY_RESULT, &error, 0); - error = necp_get_tlv_at_offset(packet, tlv_buffer, tlv_buffer_length, cursor, 0, NULL, &policy_result_size); + cursor = necp_find_tlv(tlv_buffer, tlv_buffer_length, offset, NECP_TLV_POLICY_RESULT, &error, 0); + if (error || cursor < 0) { + NECPLOG(LOG_ERR, "Failed to find policy result TLV: %d", error); + response_error = NECP_ERROR_INVALID_TLV; + goto fail; + } + error = necp_get_tlv_at_offset(tlv_buffer, tlv_buffer_length, cursor, 0, NULL, &policy_result_size); if (error || policy_result_size == 0) { NECPLOG(LOG_ERR, "Failed to get policy result length: %d", error); response_error = NECP_ERROR_INVALID_TLV; @@ -2470,7 +2236,7 @@ necp_handle_policy_add(struct necp_session *session, u_int32_t message_id, mbuf_ response_error = NECP_ERROR_INTERNAL; goto fail; } - error = necp_get_tlv_at_offset(packet, tlv_buffer, tlv_buffer_length, cursor, policy_result_size, policy_result, NULL); + error = necp_get_tlv_at_offset(tlv_buffer, tlv_buffer_length, cursor, policy_result_size, policy_result, NULL); if (error) { NECPLOG(LOG_ERR, "Failed to get policy result: %d", error); response_error = NECP_ERROR_POLICY_RESULT_INVALID; @@ -2484,13 +2250,17 @@ necp_handle_policy_add(struct necp_session *session, u_int32_t message_id, mbuf_ if (necp_policy_result_requires_route_rules(policy_result, policy_result_size)) { // Read route rules conditions - for (cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, offset, NECP_TLV_ROUTE_RULE, &error, 0); - cursor >= 0; - cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, cursor, NECP_TLV_ROUTE_RULE, &error, 1)) { + for (cursor = necp_find_tlv(tlv_buffer, tlv_buffer_length, offset, NECP_TLV_ROUTE_RULE, &error, 0); + cursor >= 0; + cursor = necp_find_tlv(tlv_buffer, tlv_buffer_length, cursor, NECP_TLV_ROUTE_RULE, &error, 1)) { u_int32_t route_rule_size = 0; - necp_get_tlv_at_offset(packet, tlv_buffer, tlv_buffer_length, cursor, 0, NULL, &route_rule_size); - if (route_rule_size > 0) { - route_rules_array_size += (sizeof(u_int8_t) + sizeof(u_int32_t) + route_rule_size); + necp_get_tlv_at_offset(tlv_buffer, tlv_buffer_length, cursor, 0, NULL, &route_rule_size); + if (os_add_overflow(route_rules_array_size, + (sizeof(u_int8_t) + sizeof(u_int32_t) + route_rule_size), + &route_rules_array_size)) { + NECPLOG0(LOG_ERR, "Route rules size overflowed, too large"); + response_error = NECP_ERROR_INVALID_TLV; + goto fail; } } @@ -2512,13 +2282,14 @@ necp_handle_policy_add(struct necp_session *session, u_int32_t message_id, mbuf_ } route_rules_array_cursor = 0; - for (cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, offset, NECP_TLV_ROUTE_RULE, &error, 0); - cursor >= 0; - cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, cursor, NECP_TLV_ROUTE_RULE, &error, 1)) { + for (cursor = necp_find_tlv(tlv_buffer, tlv_buffer_length, offset, NECP_TLV_ROUTE_RULE, &error, 0); + cursor >= 0; + cursor = necp_find_tlv(tlv_buffer, tlv_buffer_length, cursor, NECP_TLV_ROUTE_RULE, &error, 1)) { u_int8_t route_rule_type = NECP_TLV_ROUTE_RULE; u_int32_t route_rule_size = 0; - necp_get_tlv_at_offset(packet, tlv_buffer, tlv_buffer_length, cursor, 0, NULL, &route_rule_size); - if (route_rule_size > 0 && route_rule_size <= (route_rules_array_size - route_rules_array_cursor)) { + necp_get_tlv_at_offset(tlv_buffer, tlv_buffer_length, cursor, 0, NULL, &route_rule_size); + if (route_rule_size > 0 && + (sizeof(route_rule_type) + sizeof(route_rule_size) + route_rule_size) <= (route_rules_array_size - route_rules_array_cursor)) { // Add type memcpy((route_rules_array + route_rules_array_cursor), &route_rule_type, sizeof(route_rule_type)); route_rules_array_cursor += sizeof(route_rule_type); @@ -2528,7 +2299,7 @@ necp_handle_policy_add(struct necp_session *session, u_int32_t message_id, mbuf_ route_rules_array_cursor += sizeof(route_rule_size); // Add value - necp_get_tlv_at_offset(packet, tlv_buffer, tlv_buffer_length, cursor, route_rule_size, (route_rules_array + route_rules_array_cursor), NULL); + necp_get_tlv_at_offset(tlv_buffer, tlv_buffer_length, cursor, route_rule_size, (route_rules_array + route_rules_array_cursor), NULL); if (!necp_policy_route_rule_is_valid((route_rules_array + route_rules_array_cursor), route_rule_size)) { NECPLOG0(LOG_ERR, "Failed to validate policy route rule"); @@ -2551,14 +2322,20 @@ necp_handle_policy_add(struct necp_session *session, u_int32_t message_id, mbuf_ } // Read policy conditions - for (cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, offset, NECP_TLV_POLICY_CONDITION, &error, 0); - cursor >= 0; - cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, cursor, NECP_TLV_POLICY_CONDITION, &error, 1)) { + for (cursor = necp_find_tlv(tlv_buffer, tlv_buffer_length, offset, NECP_TLV_POLICY_CONDITION, &error, 0); + cursor >= 0; + cursor = necp_find_tlv(tlv_buffer, tlv_buffer_length, cursor, NECP_TLV_POLICY_CONDITION, &error, 1)) { u_int32_t condition_size = 0; - necp_get_tlv_at_offset(packet, tlv_buffer, tlv_buffer_length, cursor, 0, NULL, &condition_size); + necp_get_tlv_at_offset(tlv_buffer, tlv_buffer_length, cursor, 0, NULL, &condition_size); if (condition_size > 0) { - conditions_array_size += (sizeof(u_int8_t) + sizeof(u_int32_t) + condition_size); + if (os_add_overflow(conditions_array_size, + (sizeof(u_int8_t) + sizeof(u_int32_t) + condition_size), + &conditions_array_size)) { + NECPLOG0(LOG_ERR, "Conditions size overflowed, too large"); + response_error = NECP_ERROR_INVALID_TLV; + goto fail; + } } } @@ -2580,13 +2357,14 @@ necp_handle_policy_add(struct necp_session *session, u_int32_t message_id, mbuf_ } conditions_array_cursor = 0; - for (cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, offset, NECP_TLV_POLICY_CONDITION, &error, 0); - cursor >= 0; - cursor = necp_find_tlv(packet, tlv_buffer, tlv_buffer_length, cursor, NECP_TLV_POLICY_CONDITION, &error, 1)) { + for (cursor = necp_find_tlv(tlv_buffer, tlv_buffer_length, offset, NECP_TLV_POLICY_CONDITION, &error, 0); + cursor >= 0; + cursor = necp_find_tlv(tlv_buffer, tlv_buffer_length, cursor, NECP_TLV_POLICY_CONDITION, &error, 1)) { u_int8_t condition_type = NECP_TLV_POLICY_CONDITION; u_int32_t condition_size = 0; - necp_get_tlv_at_offset(packet, tlv_buffer, tlv_buffer_length, cursor, 0, NULL, &condition_size); - if (condition_size > 0 && condition_size <= (conditions_array_size - conditions_array_cursor)) { + necp_get_tlv_at_offset(tlv_buffer, tlv_buffer_length, cursor, 0, NULL, &condition_size); + if (condition_size > 0 && + (sizeof(condition_type) + sizeof(condition_size) + condition_size) <= (conditions_array_size - conditions_array_cursor)) { // Add type memcpy((conditions_array + conditions_array_cursor), &condition_type, sizeof(condition_type)); conditions_array_cursor += sizeof(condition_type); @@ -2596,7 +2374,7 @@ necp_handle_policy_add(struct necp_session *session, u_int32_t message_id, mbuf_ conditions_array_cursor += sizeof(condition_size); // Add value - necp_get_tlv_at_offset(packet, tlv_buffer, tlv_buffer_length, cursor, condition_size, (conditions_array + conditions_array_cursor), NULL); + necp_get_tlv_at_offset(tlv_buffer, tlv_buffer_length, cursor, condition_size, (conditions_array + conditions_array_cursor), NULL); if (!necp_policy_condition_is_valid((conditions_array + conditions_array_cursor), condition_size, necp_policy_result_get_type_from_buffer(policy_result, policy_result_size))) { NECPLOG0(LOG_ERR, "Failed to validate policy condition"); response_error = NECP_ERROR_POLICY_CONDITIONS_INVALID; @@ -2651,182 +2429,23 @@ necp_handle_policy_add(struct necp_session *session, u_int32_t message_id, mbuf_ goto fail; } - if (packet != NULL) { - necp_send_policy_id_response(session, NECP_PACKET_TYPE_POLICY_ADD, message_id, policy->local_id); - } - return (policy->local_id); + return policy->local_id; fail: if (policy_result != NULL) { FREE(policy_result, M_NECP); } - if (conditions_array != NULL) { - FREE(conditions_array, M_NECP); - } - if (route_rules_array != NULL) { - FREE(route_rules_array, M_NECP); - } - - if (packet != NULL) { - necp_send_error_response(session, NECP_PACKET_TYPE_POLICY_ADD, message_id, response_error); - } - if (return_error != NULL) { - *return_error = necp_get_posix_error_for_necp_error(response_error); - } - return (0); -} - -static void -necp_handle_policy_get(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset) -{ -#pragma unused(offset) - int error; - u_int8_t *response = NULL; - u_int8_t *cursor = NULL; - u_int32_t response_error = NECP_ERROR_INTERNAL; - necp_policy_id policy_id = 0; - u_int32_t order_tlv_size = 0; - u_int32_t result_tlv_size = 0; - u_int32_t response_size = 0; - - struct necp_session_policy *policy = NULL; - - // Read policy id - error = necp_get_tlv(packet, NULL, 0, offset, NECP_TLV_POLICY_ID, sizeof(policy_id), &policy_id, NULL); - if (error) { - NECPLOG(LOG_ERR, "Failed to get policy id: %d", error); - response_error = NECP_ERROR_INVALID_TLV; - goto fail; - } - - policy = necp_policy_find(session, policy_id); - if (policy == NULL || policy->pending_deletion) { - NECPLOG(LOG_ERR, "Failed to find policy with id %d", policy_id); - response_error = NECP_ERROR_POLICY_ID_NOT_FOUND; - goto fail; - } - - order_tlv_size = sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(necp_policy_order); - result_tlv_size = (policy->result_size ? (sizeof(u_int8_t) + sizeof(u_int32_t) + policy->result_size) : 0); - response_size = sizeof(struct necp_packet_header) + order_tlv_size + result_tlv_size + policy->conditions_size; - MALLOC(response, u_int8_t *, response_size, M_NECP, M_WAITOK); - if (response == NULL) { - necp_send_error_response(session, NECP_PACKET_TYPE_POLICY_GET, message_id, NECP_ERROR_INTERNAL); - return; - } - - cursor = response; - cursor = necp_buffer_write_packet_header(cursor, NECP_PACKET_TYPE_POLICY_GET, NECP_PACKET_FLAGS_RESPONSE, message_id); - cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_ORDER, sizeof(necp_policy_order), &policy->order, response, response_size); - - if (result_tlv_size) { - cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_RESULT, policy->result_size, &policy->result, response, response_size); - } - if (policy->conditions_size) { - memcpy(((u_int8_t *)(void *)(cursor)), policy->conditions, policy->conditions_size); - } - - if (!necp_send_ctl_data(session, (u_int8_t *)response, response_size)) { - NECPLOG0(LOG_ERR, "Failed to send response"); - } - - FREE(response, M_NECP); - return; - -fail: - necp_send_error_response(session, NECP_PACKET_TYPE_POLICY_GET, message_id, response_error); -} - -static void -necp_handle_policy_delete(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset) -{ - int error; - u_int32_t response_error = NECP_ERROR_INTERNAL; - necp_policy_id policy_id = 0; - - struct necp_session_policy *policy = NULL; - - // Read policy id - error = necp_get_tlv(packet, NULL, 0, offset, NECP_TLV_POLICY_ID, sizeof(policy_id), &policy_id, NULL); - if (error) { - NECPLOG(LOG_ERR, "Failed to get policy id: %d", error); - response_error = NECP_ERROR_INVALID_TLV; - goto fail; - } - - policy = necp_policy_find(session, policy_id); - if (policy == NULL || policy->pending_deletion) { - NECPLOG(LOG_ERR, "Failed to find policy with id %d", policy_id); - response_error = NECP_ERROR_POLICY_ID_NOT_FOUND; - goto fail; - } - - necp_policy_mark_for_deletion(session, policy); - - necp_send_success_response(session, NECP_PACKET_TYPE_POLICY_DELETE, message_id); - return; - -fail: - necp_send_error_response(session, NECP_PACKET_TYPE_POLICY_DELETE, message_id, response_error); -} - -static void -necp_handle_policy_apply_all(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset) -{ -#pragma unused(packet, offset) - necp_policy_apply_all(session); - necp_send_success_response(session, NECP_PACKET_TYPE_POLICY_APPLY_ALL, message_id); -} - -static void -necp_handle_policy_list_all(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset) -{ -#pragma unused(packet, offset) - u_int32_t tlv_size = (sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(u_int32_t)); - u_int32_t response_size = 0; - u_int8_t *response = NULL; - u_int8_t *cursor = NULL; - int num_policies = 0; - int cur_policy_index = 0; - struct necp_session_policy *policy; - - LIST_FOREACH(policy, &session->policies, chain) { - if (!policy->pending_deletion) { - num_policies++; - } - } - - // Create a response with one Policy ID TLV for each policy - response_size = sizeof(struct necp_packet_header) + num_policies * tlv_size; - MALLOC(response, u_int8_t *, response_size, M_NECP, M_WAITOK); - if (response == NULL) { - necp_send_error_response(session, NECP_PACKET_TYPE_POLICY_LIST_ALL, message_id, NECP_ERROR_INTERNAL); - return; - } - - cursor = response; - cursor = necp_buffer_write_packet_header(cursor, NECP_PACKET_TYPE_POLICY_LIST_ALL, NECP_PACKET_FLAGS_RESPONSE, message_id); - - LIST_FOREACH(policy, &session->policies, chain) { - if (!policy->pending_deletion && cur_policy_index < num_policies) { - cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_ID, sizeof(u_int32_t), &policy->local_id, response, response_size); - cur_policy_index++; - } + if (conditions_array != NULL) { + FREE(conditions_array, M_NECP); } - - if (!necp_send_ctl_data(session, (u_int8_t *)response, response_size)) { - NECPLOG0(LOG_ERR, "Failed to send response"); + if (route_rules_array != NULL) { + FREE(route_rules_array, M_NECP); } - FREE(response, M_NECP); -} - -static void -necp_handle_policy_delete_all(struct necp_session *session, u_int32_t message_id, mbuf_t packet, int offset) -{ -#pragma unused(packet, offset) - necp_policy_mark_all_for_deletion(session); - necp_send_success_response(session, NECP_PACKET_TYPE_POLICY_DELETE_ALL, message_id); + if (return_error != NULL) { + *return_error = necp_get_posix_error_for_necp_error(response_error); + } + return 0; } static necp_policy_id @@ -2841,10 +2460,10 @@ necp_policy_get_new_id(struct necp_session *session) if (newid == 0) { NECPLOG0(LOG_ERR, "Allocate policy id failed.\n"); - return (0); + return 0; } - return (newid); + return newid; } /* @@ -2944,10 +2563,8 @@ necp_policy_get_new_id(struct necp_session *session) * ... */ static int -necp_handle_policy_dump_all(struct necp_session *session, u_int32_t message_id, mbuf_t packet, - user_addr_t out_buffer, size_t out_buffer_length, int offset) +necp_handle_policy_dump_all(user_addr_t out_buffer, size_t out_buffer_length) { -#pragma unused(offset) struct necp_kernel_socket_policy *policy = NULL; int policy_i; int policy_count = 0; @@ -2963,12 +2580,12 @@ necp_handle_policy_dump_all(struct necp_session *session, u_int32_t message_id, bool error_occured = false; u_int32_t response_error = NECP_ERROR_INTERNAL; -#define REPORT_ERROR(error) error_occured = true; \ - response_error = error; \ - goto done +#define REPORT_ERROR(error) error_occured = true; \ + response_error = error; \ + goto done -#define UNLOCK_AND_REPORT_ERROR(lock, error) lck_rw_done(lock); \ - REPORT_ERROR(error) +#define UNLOCK_AND_REPORT_ERROR(lock, error) lck_rw_done(lock); \ + REPORT_ERROR(error) errno_t cred_result = priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NECP_POLICIES, 0); if (cred_result != 0) { @@ -2985,15 +2602,15 @@ necp_handle_policy_dump_all(struct necp_session *session, u_int32_t message_id, policy_count = necp_kernel_application_policies_count; - MALLOC(tlv_buffer_pointers, u_int8_t **, sizeof(u_int8_t *) * policy_count, M_NECP, M_NOWAIT | M_ZERO); + MALLOC(tlv_buffer_pointers, u_int8_t * *, sizeof(u_int8_t *) * policy_count, M_NECP, M_NOWAIT | M_ZERO); if (tlv_buffer_pointers == NULL) { - NECPLOG(LOG_DEBUG, "Failed to allocate tlv_buffer_pointers (%u bytes)", sizeof(u_int8_t *) * policy_count); + NECPLOG(LOG_DEBUG, "Failed to allocate tlv_buffer_pointers (%lu bytes)", sizeof(u_int8_t *) * policy_count); UNLOCK_AND_REPORT_ERROR(&necp_kernel_policy_lock, NECP_ERROR_INTERNAL); } MALLOC(tlv_buffer_lengths, u_int32_t *, sizeof(u_int32_t) * policy_count, M_NECP, M_NOWAIT | M_ZERO); if (tlv_buffer_lengths == NULL) { - NECPLOG(LOG_DEBUG, "Failed to allocate tlv_buffer_lengths (%u bytes)", sizeof(u_int32_t) * policy_count); + NECPLOG(LOG_DEBUG, "Failed to allocate tlv_buffer_lengths (%lu bytes)", sizeof(u_int32_t) * policy_count); UNLOCK_AND_REPORT_ERROR(&necp_kernel_policy_lock, NECP_ERROR_INTERNAL); } @@ -3013,12 +2630,12 @@ necp_handle_policy_dump_all(struct necp_session *session, u_int32_t message_id, NECPLOG(LOG_DEBUG, "Policy: process: %s, result: %s", proc_name_string, result_string); } - u_int32_t total_allocated_bytes = sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(policy->id) + // NECP_TLV_POLICY_ID - sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(policy->order) + // NECP_TLV_POLICY_ORDER - sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(policy->session_order) + // NECP_TLV_POLICY_SESSION_ORDER - sizeof(u_int8_t) + sizeof(u_int32_t) + result_string_len + // NECP_TLV_POLICY_RESULT_STRING - sizeof(u_int8_t) + sizeof(u_int32_t) + proc_name_len + // NECP_TLV_POLICY_OWNER - sizeof(u_int8_t) + sizeof(u_int32_t); // NECP_TLV_POLICY_CONDITION + u_int32_t total_allocated_bytes = sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(policy->id) + // NECP_TLV_POLICY_ID + sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(policy->order) + // NECP_TLV_POLICY_ORDER + sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(policy->session_order) + // NECP_TLV_POLICY_SESSION_ORDER + sizeof(u_int8_t) + sizeof(u_int32_t) + result_string_len + // NECP_TLV_POLICY_RESULT_STRING + sizeof(u_int8_t) + sizeof(u_int32_t) + proc_name_len + // NECP_TLV_POLICY_OWNER + sizeof(u_int8_t) + sizeof(u_int32_t); // NECP_TLV_POLICY_CONDITION // We now traverse the condition_mask to see how much space we need to allocate u_int32_t condition_mask = policy->condition_mask; @@ -3034,6 +2651,9 @@ necp_handle_policy_dump_all(struct necp_session *session, u_int32_t message_id, if (condition_mask & NECP_KERNEL_CONDITION_ALL_INTERFACES) { num_conditions++; } + if (condition_mask & NECP_KERNEL_CONDITION_HAS_CLIENT) { + num_conditions++; + } if (condition_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE) { snprintf(if_name, IFXNAMSIZ, "%s%d", ifnet_name(policy->cond_bound_interface), ifnet_unit(policy->cond_bound_interface)); condition_tlv_length += strlen(if_name) + 1; @@ -3085,6 +2705,16 @@ necp_handle_policy_dump_all(struct necp_session *session, u_int32_t message_id, condition_tlv_length += entitlement_len; num_conditions++; } + if (condition_mask & NECP_KERNEL_CONDITION_PLATFORM_BINARY) { + num_conditions++; + } + if (condition_mask & NECP_KERNEL_CONDITION_SDK_VERSION) { + condition_tlv_length += sizeof(struct necp_policy_condition_sdk_version); + num_conditions++; + } + if (condition_mask & NECP_KERNEL_CONDITION_LOCAL_NETWORKS) { + num_conditions++; + } if (condition_mask & NECP_KERNEL_CONDITION_LOCAL_START) { if (condition_mask & NECP_KERNEL_CONDITION_LOCAL_END) { condition_tlv_length += sizeof(struct necp_policy_condition_addr_range); @@ -3105,6 +2735,28 @@ necp_handle_policy_dump_all(struct necp_session *session, u_int32_t message_id, condition_tlv_length += sizeof(struct necp_policy_condition_agent_type); num_conditions++; } + if (condition_mask & NECP_KERNEL_CONDITION_CLIENT_FLAGS) { + condition_tlv_length += sizeof(u_int32_t); + num_conditions++; + } + if (condition_mask & NECP_KERNEL_CONDITION_LOCAL_EMPTY) { + num_conditions++; + } + if (condition_mask & NECP_KERNEL_CONDITION_REMOTE_EMPTY) { + num_conditions++; + } + if (condition_mask & NECP_KERNEL_CONDITION_SIGNING_IDENTIFIER) { + u_int32_t identifier_len = strlen(policy->cond_signing_identifier) + 1; + condition_tlv_length += identifier_len; + num_conditions++; + } + if (condition_mask & NECP_KERNEL_CONDITION_PACKET_FILTER_TAGS) { + condition_tlv_length += sizeof(u_int16_t); + num_conditions++; + } + if (condition_mask & NECP_KERNEL_CONDITION_IS_LOOPBACK) { + num_conditions++; + } } condition_tlv_length += num_conditions * (sizeof(u_int8_t) + sizeof(u_int32_t)); // These are for the condition TLVs. The space for "value" is already accounted for above. @@ -3147,57 +2799,71 @@ necp_handle_policy_dump_all(struct necp_session *session, u_int32_t message_id, if (condition_mask & NECP_KERNEL_CONDITION_ALL_INTERFACES) { cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_ALL_INTERFACES, 0, "", cond_buf, condition_tlv_length); } + if (condition_mask & NECP_KERNEL_CONDITION_HAS_CLIENT) { + cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_HAS_CLIENT, 0, "", cond_buf, condition_tlv_length); + } + if (condition_mask & NECP_KERNEL_CONDITION_LOCAL_NETWORKS) { + cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_LOCAL_NETWORKS, 0, "", cond_buf, condition_tlv_length); + } if (condition_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE) { cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_BOUND_INTERFACE, strlen(if_name) + 1, - if_name, cond_buf, condition_tlv_length); + if_name, cond_buf, condition_tlv_length); } if (condition_mask & NECP_KERNEL_CONDITION_PROTOCOL) { cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_IP_PROTOCOL, sizeof(policy->cond_protocol), &policy->cond_protocol, - cond_buf, condition_tlv_length); + cond_buf, condition_tlv_length); } if (condition_mask & NECP_KERNEL_CONDITION_APP_ID) { struct necp_uuid_id_mapping *entry = necp_uuid_lookup_uuid_with_app_id_locked(policy->cond_app_id); if (entry != NULL) { cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_APPLICATION, sizeof(entry->uuid), entry->uuid, - cond_buf, condition_tlv_length); + cond_buf, condition_tlv_length); } } if (condition_mask & NECP_KERNEL_CONDITION_REAL_APP_ID) { struct necp_uuid_id_mapping *entry = necp_uuid_lookup_uuid_with_app_id_locked(policy->cond_real_app_id); if (entry != NULL) { cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_REAL_APPLICATION, sizeof(entry->uuid), entry->uuid, - cond_buf, condition_tlv_length); + cond_buf, condition_tlv_length); } } if (condition_mask & NECP_KERNEL_CONDITION_DOMAIN) { cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_DOMAIN, strlen(policy->cond_domain) + 1, policy->cond_domain, - cond_buf, condition_tlv_length); + cond_buf, condition_tlv_length); } if (condition_mask & NECP_KERNEL_CONDITION_ACCOUNT_ID) { if (account_id_entry != NULL) { cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_ACCOUNT, strlen(account_id_entry->string) + 1, account_id_entry->string, - cond_buf, condition_tlv_length); + cond_buf, condition_tlv_length); } } if (condition_mask & NECP_KERNEL_CONDITION_PID) { cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_PID, sizeof(policy->cond_pid), &policy->cond_pid, - cond_buf, condition_tlv_length); + cond_buf, condition_tlv_length); } if (condition_mask & NECP_KERNEL_CONDITION_UID) { cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_UID, sizeof(policy->cond_uid), &policy->cond_uid, - cond_buf, condition_tlv_length); + cond_buf, condition_tlv_length); } if (condition_mask & NECP_KERNEL_CONDITION_TRAFFIC_CLASS) { cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_TRAFFIC_CLASS, sizeof(policy->cond_traffic_class), &policy->cond_traffic_class, - cond_buf, condition_tlv_length); + cond_buf, condition_tlv_length); } if (condition_mask & NECP_KERNEL_CONDITION_ENTITLEMENT) { cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_ENTITLEMENT, 0, "", - cond_buf, condition_tlv_length); + cond_buf, condition_tlv_length); } if (condition_mask & NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT) { cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_ENTITLEMENT, strlen(policy->cond_custom_entitlement) + 1, policy->cond_custom_entitlement, - cond_buf, condition_tlv_length); + cond_buf, condition_tlv_length); + } + if (condition_mask & NECP_KERNEL_CONDITION_PLATFORM_BINARY) { + cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_PLATFORM_BINARY, 0, "", cond_buf, condition_tlv_length); + } + if (condition_mask & NECP_KERNEL_CONDITION_SDK_VERSION) { + cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_SDK_VERSION, + sizeof(policy->cond_sdk_version), &policy->cond_sdk_version, + cond_buf, condition_tlv_length); } if (condition_mask & NECP_KERNEL_CONDITION_LOCAL_START) { if (condition_mask & NECP_KERNEL_CONDITION_LOCAL_END) { @@ -3205,13 +2871,13 @@ necp_handle_policy_dump_all(struct necp_session *session, u_int32_t message_id, memcpy(&range.start_address, &policy->cond_local_start, sizeof(policy->cond_local_start)); memcpy(&range.end_address, &policy->cond_local_end, sizeof(policy->cond_local_end)); cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE, sizeof(range), &range, - cond_buf, condition_tlv_length); + cond_buf, condition_tlv_length); } else { struct necp_policy_condition_addr addr; addr.prefix = policy->cond_local_prefix; memcpy(&addr.address, &policy->cond_local_start, sizeof(policy->cond_local_start)); cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_LOCAL_ADDR, sizeof(addr), &addr, - cond_buf, condition_tlv_length); + cond_buf, condition_tlv_length); } } if (condition_mask & NECP_KERNEL_CONDITION_REMOTE_START) { @@ -3220,19 +2886,38 @@ necp_handle_policy_dump_all(struct necp_session *session, u_int32_t message_id, memcpy(&range.start_address, &policy->cond_remote_start, sizeof(policy->cond_remote_start)); memcpy(&range.end_address, &policy->cond_remote_end, sizeof(policy->cond_remote_end)); cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE, sizeof(range), &range, - cond_buf, condition_tlv_length); + cond_buf, condition_tlv_length); } else { struct necp_policy_condition_addr addr; addr.prefix = policy->cond_remote_prefix; memcpy(&addr.address, &policy->cond_remote_start, sizeof(policy->cond_remote_start)); cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_REMOTE_ADDR, sizeof(addr), &addr, - cond_buf, condition_tlv_length); + cond_buf, condition_tlv_length); } } if (condition_mask & NECP_KERNEL_CONDITION_AGENT_TYPE) { cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_AGENT_TYPE, - sizeof(policy->cond_agent_type), &policy->cond_agent_type, - cond_buf, condition_tlv_length); + sizeof(policy->cond_agent_type), &policy->cond_agent_type, + cond_buf, condition_tlv_length); + } + if (condition_mask & NECP_KERNEL_CONDITION_CLIENT_FLAGS) { + cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_CLIENT_FLAGS, sizeof(policy->cond_client_flags), &policy->cond_client_flags, cond_buf, condition_tlv_length); + } + if (condition_mask & NECP_KERNEL_CONDITION_LOCAL_EMPTY) { + cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_EMPTY, 0, "", cond_buf, condition_tlv_length); + } + if (condition_mask & NECP_KERNEL_CONDITION_REMOTE_EMPTY) { + cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_EMPTY, 0, "", cond_buf, condition_tlv_length); + } + if (condition_mask & NECP_KERNEL_CONDITION_SIGNING_IDENTIFIER) { + cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_SIGNING_IDENTIFIER, strlen(policy->cond_signing_identifier) + 1, policy->cond_signing_identifier, + cond_buf, condition_tlv_length); + } + if (condition_mask & NECP_KERNEL_CONDITION_PACKET_FILTER_TAGS) { + cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_PACKET_FILTER_TAGS, sizeof(policy->cond_packet_filter_tags), &policy->cond_packet_filter_tags, cond_buf, condition_tlv_length); + } + if (condition_mask & NECP_KERNEL_CONDITION_IS_LOOPBACK) { + cond_buf_cursor = necp_buffer_write_tlv(cond_buf_cursor, NECP_POLICY_CONDITION_FLOW_IS_LOOPBACK, 0, "", cond_buf, condition_tlv_length); } } @@ -3251,44 +2936,17 @@ necp_handle_policy_dump_all(struct necp_session *session, u_int32_t message_id, // UNLOCK lck_rw_done(&necp_kernel_policy_lock); - // Send packet - if (packet != NULL) { - u_int32_t total_result_length = sizeof(struct necp_packet_header) + total_tlv_len; - - // Allow malloc to wait, since the total buffer may be large and we are not holding any locks - MALLOC(result_buf, u_int8_t *, total_result_length, M_NECP, M_WAITOK | M_ZERO); - if (result_buf == NULL) { - NECPLOG(LOG_DEBUG, "Failed to allocate result_buffer (%u bytes)", total_result_length); - REPORT_ERROR(NECP_ERROR_INTERNAL); - } - - result_buf_cursor = result_buf; - result_buf_cursor = necp_buffer_write_packet_header(result_buf_cursor, NECP_PACKET_TYPE_POLICY_DUMP_ALL, NECP_PACKET_FLAGS_RESPONSE, message_id); - - for (int i = 0; i < policy_count; i++) { - if (tlv_buffer_pointers[i] != NULL) { - result_buf_cursor = necp_buffer_write_tlv(result_buf_cursor, NECP_TLV_POLICY_DUMP, tlv_buffer_lengths[i], tlv_buffer_pointers[i], result_buf, total_result_length); - } - } - - if (!necp_send_ctl_data(session, result_buf, result_buf_cursor - result_buf)) { - NECPLOG(LOG_ERR, "Failed to send response (%u bytes)", result_buf_cursor - result_buf); - } else { - NECPLOG(LOG_ERR, "Sent data worth %u bytes. Total result buffer length was %u bytes", result_buf_cursor - result_buf, total_result_length); - } - } - // Copy out if (out_buffer != 0) { if (out_buffer_length < total_tlv_len + sizeof(u_int32_t)) { - NECPLOG(LOG_DEBUG, "out_buffer_length too small (%u < %u)", out_buffer_length, total_tlv_len + sizeof(u_int32_t)); + NECPLOG(LOG_DEBUG, "out_buffer_length too small (%lu < %lu)", out_buffer_length, total_tlv_len + sizeof(u_int32_t)); REPORT_ERROR(NECP_ERROR_INVALID_TLV); } // Allow malloc to wait, since the total buffer may be large and we are not holding any locks MALLOC(result_buf, u_int8_t *, total_tlv_len + sizeof(u_int32_t), M_NECP, M_WAITOK | M_ZERO); if (result_buf == NULL) { - NECPLOG(LOG_DEBUG, "Failed to allocate result_buffer (%u bytes)", total_tlv_len + sizeof(u_int32_t)); + NECPLOG(LOG_DEBUG, "Failed to allocate result_buffer (%lu bytes)", total_tlv_len + sizeof(u_int32_t)); REPORT_ERROR(NECP_ERROR_INTERNAL); } @@ -3300,13 +2958,13 @@ necp_handle_policy_dump_all(struct necp_session *session, u_int32_t message_id, for (int i = 0; i < policy_count; i++) { if (tlv_buffer_pointers[i] != NULL) { result_buf_cursor = necp_buffer_write_tlv(result_buf_cursor, NECP_TLV_POLICY_DUMP, tlv_buffer_lengths[i], tlv_buffer_pointers[i], - result_buf, total_tlv_len + sizeof(u_int32_t)); + result_buf, total_tlv_len + sizeof(u_int32_t)); } } int copy_error = copyout(result_buf, out_buffer, total_tlv_len + sizeof(u_int32_t)); if (copy_error) { - NECPLOG(LOG_DEBUG, "Failed to copy out result_buffer (%u bytes)", total_tlv_len + sizeof(u_int32_t)); + NECPLOG(LOG_DEBUG, "Failed to copy out result_buffer (%lu bytes)", total_tlv_len + sizeof(u_int32_t)); REPORT_ERROR(NECP_ERROR_INTERNAL); } } @@ -3314,13 +2972,6 @@ necp_handle_policy_dump_all(struct necp_session *session, u_int32_t message_id, done: if (error_occured) { - if (packet != NULL) { - if(!necp_send_error_response(session, NECP_PACKET_TYPE_POLICY_DUMP_ALL, message_id, response_error)) { - NECPLOG0(LOG_ERR, "Failed to send error response"); - } else { - NECPLOG0(LOG_ERR, "Sent error response"); - } - } error_code = necp_get_posix_error_for_necp_error(response_error); } @@ -3346,7 +2997,7 @@ done: #undef REPORT_ERROR #undef UNLOCK_AND_REPORT_ERROR - return (error_code); + return error_code; } static struct necp_session_policy * @@ -3359,12 +3010,7 @@ necp_policy_create(struct necp_session *session, necp_policy_order order, u_int8 goto done; } - MALLOC_ZONE(new_policy, struct necp_session_policy *, sizeof(*new_policy), M_NECP_SESSION_POLICY, M_WAITOK); - if (new_policy == NULL) { - goto done; - } - - memset(new_policy, 0, sizeof(*new_policy)); // M_ZERO is not supported for MALLOC_ZONE + new_policy = zalloc_flags(necp_session_policy_zone, Z_WAITOK | Z_ZERO); new_policy->applied = FALSE; new_policy->pending_deletion = FALSE; new_policy->pending_update = FALSE; @@ -3385,7 +3031,7 @@ necp_policy_create(struct necp_session *session, necp_policy_order order, u_int8 NECPLOG(LOG_DEBUG, "Created NECP policy, order %d", order); } done: - return (new_policy); + return new_policy; } static struct necp_session_policy * @@ -3393,28 +3039,28 @@ necp_policy_find(struct necp_session *session, necp_policy_id policy_id) { struct necp_session_policy *policy = NULL; if (policy_id == 0) { - return (NULL); + return NULL; } LIST_FOREACH(policy, &session->policies, chain) { if (policy->local_id == policy_id) { - return (policy); + return policy; } } - return (NULL); + return NULL; } static inline u_int8_t necp_policy_get_result_type(struct necp_session_policy *policy) { - return (policy ? necp_policy_result_get_type_from_buffer(policy->result, policy->result_size) : 0); + return policy ? necp_policy_result_get_type_from_buffer(policy->result, policy->result_size) : 0; } static inline u_int32_t necp_policy_get_result_parameter_length(struct necp_session_policy *policy) { - return (policy ? necp_policy_result_get_parameter_length_from_buffer(policy->result, policy->result_size) : 0); + return policy ? necp_policy_result_get_parameter_length_from_buffer(policy->result, policy->result_size) : 0; } static bool @@ -3426,19 +3072,19 @@ necp_policy_get_result_parameter(struct necp_session_policy *policy, u_int8_t *p u_int8_t *parameter = necp_policy_result_get_parameter_pointer_from_buffer(policy->result, policy->result_size); if (parameter && parameter_buffer) { memcpy(parameter_buffer, parameter, parameter_length); - return (TRUE); + return TRUE; } } } - return (FALSE); + return FALSE; } static bool necp_policy_mark_for_deletion(struct necp_session *session, struct necp_session_policy *policy) { if (session == NULL || policy == NULL) { - return (FALSE); + return FALSE; } policy->pending_deletion = TRUE; @@ -3447,7 +3093,7 @@ necp_policy_mark_for_deletion(struct necp_session *session, struct necp_session_ if (necp_debug) { NECPLOG0(LOG_DEBUG, "Marked NECP policy for removal"); } - return (TRUE); + return TRUE; } static bool @@ -3460,14 +3106,14 @@ necp_policy_mark_all_for_deletion(struct necp_session *session) necp_policy_mark_for_deletion(session, policy); } - return (TRUE); + return TRUE; } static bool necp_policy_delete(struct necp_session *session, struct necp_session_policy *policy) { if (session == NULL || policy == NULL) { - return (FALSE); + return FALSE; } LIST_REMOVE(policy, chain); @@ -3487,12 +3133,12 @@ necp_policy_delete(struct necp_session *session, struct necp_session_policy *pol policy->route_rules = NULL; } - FREE_ZONE(policy, sizeof(*policy), M_NECP_SESSION_POLICY); + zfree(necp_session_policy_zone, policy); if (necp_debug) { NECPLOG0(LOG_DEBUG, "Removed NECP policy"); } - return (TRUE); + return TRUE; } static bool @@ -3500,7 +3146,7 @@ necp_policy_unapply(struct necp_session_policy *policy) { int i = 0; if (policy == NULL) { - return (FALSE); + return FALSE; } LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE); @@ -3554,13 +3200,13 @@ necp_policy_unapply(struct necp_session_policy *policy) policy->applied = FALSE; - return (TRUE); + return TRUE; } -#define NECP_KERNEL_POLICY_SUBORDER_ID_TUNNEL_CONDITION 0 -#define NECP_KERNEL_POLICY_SUBORDER_NON_ID_TUNNEL_CONDITION 1 -#define NECP_KERNEL_POLICY_SUBORDER_ID_CONDITION 2 -#define NECP_KERNEL_POLICY_SUBORDER_NON_ID_CONDITIONS 3 +#define NECP_KERNEL_POLICY_SUBORDER_ID_TUNNEL_CONDITION 0 +#define NECP_KERNEL_POLICY_SUBORDER_NON_ID_TUNNEL_CONDITION 1 +#define NECP_KERNEL_POLICY_SUBORDER_ID_CONDITION 2 +#define NECP_KERNEL_POLICY_SUBORDER_NON_ID_CONDITIONS 3 struct necp_policy_result_ip_tunnel { u_int32_t secondary_result; char interface_name[IFXNAMSIZ]; @@ -3591,6 +3237,7 @@ necp_policy_apply(struct necp_session *session, struct necp_session_policy *poli u_int32_t cond_account_id = 0; char *cond_domain = NULL; char *cond_custom_entitlement = NULL; + char *cond_signing_identifier = NULL; pid_t cond_pid = 0; uid_t cond_uid = 0; necp_app_id cond_app_id = 0; @@ -3605,10 +3252,13 @@ necp_policy_apply(struct necp_session *session, struct necp_session_policy *poli union necp_sockaddr_union cond_remote_start; union necp_sockaddr_union cond_remote_end; u_int8_t cond_remote_prefix = 0; + u_int32_t cond_client_flags = 0; u_int32_t offset = 0; u_int8_t ultimate_result = 0; u_int32_t secondary_result = 0; struct necp_policy_condition_agent_type cond_agent_type = {}; + struct necp_policy_condition_sdk_version cond_sdk_version = {}; + u_int16_t cond_packet_filter_tags = 0; necp_kernel_policy_result_parameter secondary_result_parameter; memset(&secondary_result_parameter, 0, sizeof(secondary_result_parameter)); u_int32_t cond_last_interface_index = 0; @@ -3616,7 +3266,7 @@ necp_policy_apply(struct necp_session *session, struct necp_session_policy *poli memset(&ultimate_result_parameter, 0, sizeof(ultimate_result_parameter)); if (policy == NULL) { - return (FALSE); + return FALSE; } LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE); @@ -3632,408 +3282,542 @@ necp_policy_apply(struct necp_session *session, struct necp_session_policy *poli u_int32_t condition_length = necp_policy_condition_get_value_length_from_buffer(value, length); u_int8_t *condition_value = necp_policy_condition_get_value_pointer_from_buffer(value, length); switch (condition_type) { - case NECP_POLICY_CONDITION_DEFAULT: { - socket_ip_conditions = TRUE; - break; - } - case NECP_POLICY_CONDITION_ALL_INTERFACES: { - master_condition_mask |= NECP_KERNEL_CONDITION_ALL_INTERFACES; - socket_ip_conditions = TRUE; - break; - } - case NECP_POLICY_CONDITION_ENTITLEMENT: { - if (condition_length > 0) { - if (cond_custom_entitlement == NULL) { - cond_custom_entitlement = necp_copy_string((char *)condition_value, condition_length); - if (cond_custom_entitlement != NULL) { - master_condition_mask |= NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT; - socket_only_conditions = TRUE; - } - } - } else { - master_condition_mask |= NECP_KERNEL_CONDITION_ENTITLEMENT; - socket_only_conditions = TRUE; - } - break; - } - case NECP_POLICY_CONDITION_DOMAIN: { - // Make sure there is only one such rule - if (condition_length > 0 && cond_domain == NULL) { - cond_domain = necp_create_trimmed_domain((char *)condition_value, condition_length); - if (cond_domain != NULL) { - master_condition_mask |= NECP_KERNEL_CONDITION_DOMAIN; - if (condition_is_negative) { - master_condition_negated_mask |= NECP_KERNEL_CONDITION_DOMAIN; - } + case NECP_POLICY_CONDITION_DEFAULT: { + socket_ip_conditions = TRUE; + break; + } + case NECP_POLICY_CONDITION_ALL_INTERFACES: { + master_condition_mask |= NECP_KERNEL_CONDITION_ALL_INTERFACES; + socket_ip_conditions = TRUE; + break; + } + case NECP_POLICY_CONDITION_HAS_CLIENT: { + master_condition_mask |= NECP_KERNEL_CONDITION_HAS_CLIENT; + socket_only_conditions = TRUE; + break; + } + case NECP_POLICY_CONDITION_ENTITLEMENT: { + if (condition_length > 0) { + if (cond_custom_entitlement == NULL) { + cond_custom_entitlement = necp_copy_string((char *)condition_value, condition_length); + if (cond_custom_entitlement != NULL) { + master_condition_mask |= NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT; socket_only_conditions = TRUE; } } - break; + } else { + master_condition_mask |= NECP_KERNEL_CONDITION_ENTITLEMENT; + socket_only_conditions = TRUE; } - case NECP_POLICY_CONDITION_ACCOUNT: { - // Make sure there is only one such rule - if (condition_length > 0 && cond_account_id == 0 && policy->applied_account == NULL) { - char *string = NULL; - MALLOC(string, char *, condition_length + 1, M_NECP, M_WAITOK); - if (string != NULL) { - memcpy(string, condition_value, condition_length); - string[condition_length] = 0; - cond_account_id = necp_create_string_to_id_mapping(&necp_account_id_list, string); - if (cond_account_id != 0) { - policy->applied_account = string; // Save the string in parent policy - master_condition_mask |= NECP_KERNEL_CONDITION_ACCOUNT_ID; - if (condition_is_negative) { - master_condition_negated_mask |= NECP_KERNEL_CONDITION_ACCOUNT_ID; - } - socket_only_conditions = TRUE; - } else { - FREE(string, M_NECP); - } - } - } - break; + break; + } + case NECP_POLICY_CONDITION_PLATFORM_BINARY: { + master_condition_mask |= NECP_KERNEL_CONDITION_PLATFORM_BINARY; + socket_only_conditions = TRUE; + break; + } + case NECP_POLICY_CONDITION_SDK_VERSION: { + if (condition_length >= sizeof(cond_sdk_version)) { + master_condition_mask |= NECP_KERNEL_CONDITION_SDK_VERSION; + memcpy(&cond_sdk_version, condition_value, sizeof(cond_sdk_version)); + socket_only_conditions = TRUE; } - case NECP_POLICY_CONDITION_APPLICATION: { - // Make sure there is only one such rule, because we save the uuid in the policy - if (condition_length >= sizeof(uuid_t) && cond_app_id == 0) { - bool allocated_mapping = FALSE; - uuid_t application_uuid; - memcpy(application_uuid, condition_value, sizeof(uuid_t)); - cond_app_id = necp_create_uuid_app_id_mapping(application_uuid, &allocated_mapping, TRUE); - if (cond_app_id != 0) { - if (allocated_mapping) { - necp_uuid_app_id_mappings_dirty = TRUE; - necp_num_uuid_app_id_mappings++; - } - uuid_copy(policy->applied_app_uuid, application_uuid); - master_condition_mask |= NECP_KERNEL_CONDITION_APP_ID; - if (condition_is_negative) { - master_condition_negated_mask |= NECP_KERNEL_CONDITION_APP_ID; - } - socket_only_conditions = TRUE; + break; + } + case NECP_POLICY_CONDITION_DOMAIN: { + // Make sure there is only one such rule + if (condition_length > 0 && cond_domain == NULL) { + cond_domain = necp_create_trimmed_domain((char *)condition_value, condition_length); + if (cond_domain != NULL) { + master_condition_mask |= NECP_KERNEL_CONDITION_DOMAIN; + if (condition_is_negative) { + master_condition_negated_mask |= NECP_KERNEL_CONDITION_DOMAIN; } + socket_only_conditions = TRUE; } - break; } - case NECP_POLICY_CONDITION_REAL_APPLICATION: { - // Make sure there is only one such rule, because we save the uuid in the policy - if (condition_length >= sizeof(uuid_t) && cond_real_app_id == 0) { - uuid_t real_application_uuid; - memcpy(real_application_uuid, condition_value, sizeof(uuid_t)); - cond_real_app_id = necp_create_uuid_app_id_mapping(real_application_uuid, NULL, FALSE); - if (cond_real_app_id != 0) { - uuid_copy(policy->applied_real_app_uuid, real_application_uuid); - master_condition_mask |= NECP_KERNEL_CONDITION_REAL_APP_ID; + break; + } + case NECP_POLICY_CONDITION_ACCOUNT: { + // Make sure there is only one such rule + if (condition_length > 0 && cond_account_id == 0 && policy->applied_account == NULL) { + char *string = NULL; + MALLOC(string, char *, condition_length + 1, M_NECP, M_WAITOK); + if (string != NULL) { + memcpy(string, condition_value, condition_length); + string[condition_length] = 0; + cond_account_id = necp_create_string_to_id_mapping(&necp_account_id_list, string); + if (cond_account_id != 0) { + policy->applied_account = string; // Save the string in parent policy + master_condition_mask |= NECP_KERNEL_CONDITION_ACCOUNT_ID; if (condition_is_negative) { - master_condition_negated_mask |= NECP_KERNEL_CONDITION_REAL_APP_ID; + master_condition_negated_mask |= NECP_KERNEL_CONDITION_ACCOUNT_ID; } socket_only_conditions = TRUE; + } else { + FREE(string, M_NECP); } } - break; } - case NECP_POLICY_CONDITION_PID: { - if (condition_length >= sizeof(pid_t)) { - master_condition_mask |= NECP_KERNEL_CONDITION_PID; + break; + } + case NECP_POLICY_CONDITION_APPLICATION: { + // Make sure there is only one such rule, because we save the uuid in the policy + if (condition_length >= sizeof(uuid_t) && cond_app_id == 0) { + bool allocated_mapping = FALSE; + uuid_t application_uuid; + memcpy(application_uuid, condition_value, sizeof(uuid_t)); + cond_app_id = necp_create_uuid_app_id_mapping(application_uuid, &allocated_mapping, TRUE); + if (cond_app_id != 0) { + if (allocated_mapping) { + necp_uuid_app_id_mappings_dirty = TRUE; + necp_num_uuid_app_id_mappings++; + } + uuid_copy(policy->applied_app_uuid, application_uuid); + master_condition_mask |= NECP_KERNEL_CONDITION_APP_ID; if (condition_is_negative) { - master_condition_negated_mask |= NECP_KERNEL_CONDITION_PID; + master_condition_negated_mask |= NECP_KERNEL_CONDITION_APP_ID; } - memcpy(&cond_pid, condition_value, sizeof(cond_pid)); socket_only_conditions = TRUE; } - break; } - case NECP_POLICY_CONDITION_UID: { - if (condition_length >= sizeof(uid_t)) { - master_condition_mask |= NECP_KERNEL_CONDITION_UID; + break; + } + case NECP_POLICY_CONDITION_REAL_APPLICATION: { + // Make sure there is only one such rule, because we save the uuid in the policy + if (condition_length >= sizeof(uuid_t) && cond_real_app_id == 0) { + uuid_t real_application_uuid; + memcpy(real_application_uuid, condition_value, sizeof(uuid_t)); + cond_real_app_id = necp_create_uuid_app_id_mapping(real_application_uuid, NULL, FALSE); + if (cond_real_app_id != 0) { + uuid_copy(policy->applied_real_app_uuid, real_application_uuid); + master_condition_mask |= NECP_KERNEL_CONDITION_REAL_APP_ID; if (condition_is_negative) { - master_condition_negated_mask |= NECP_KERNEL_CONDITION_UID; + master_condition_negated_mask |= NECP_KERNEL_CONDITION_REAL_APP_ID; } - memcpy(&cond_uid, condition_value, sizeof(cond_uid)); socket_only_conditions = TRUE; } - break; } - case NECP_POLICY_CONDITION_TRAFFIC_CLASS: { - if (condition_length >= sizeof(struct necp_policy_condition_tc_range)) { - master_condition_mask |= NECP_KERNEL_CONDITION_TRAFFIC_CLASS; - if (condition_is_negative) { - master_condition_negated_mask |= NECP_KERNEL_CONDITION_TRAFFIC_CLASS; - } - memcpy(&cond_traffic_class, condition_value, sizeof(cond_traffic_class)); - socket_only_conditions = TRUE; + break; + } + case NECP_POLICY_CONDITION_PID: { + if (condition_length >= sizeof(pid_t)) { + master_condition_mask |= NECP_KERNEL_CONDITION_PID; + if (condition_is_negative) { + master_condition_negated_mask |= NECP_KERNEL_CONDITION_PID; } - break; + memcpy(&cond_pid, condition_value, sizeof(cond_pid)); + socket_only_conditions = TRUE; } - case NECP_POLICY_CONDITION_BOUND_INTERFACE: { - if (condition_length <= IFXNAMSIZ && condition_length > 0) { - char interface_name[IFXNAMSIZ]; - memcpy(interface_name, condition_value, condition_length); - interface_name[condition_length - 1] = 0; // Make sure the string is NULL terminated - if (ifnet_find_by_name(interface_name, &cond_bound_interface) == 0) { - master_condition_mask |= NECP_KERNEL_CONDITION_BOUND_INTERFACE; - if (condition_is_negative) { - master_condition_negated_mask |= NECP_KERNEL_CONDITION_BOUND_INTERFACE; - } - } - socket_ip_conditions = TRUE; + break; + } + case NECP_POLICY_CONDITION_UID: { + if (condition_length >= sizeof(uid_t)) { + master_condition_mask |= NECP_KERNEL_CONDITION_UID; + if (condition_is_negative) { + master_condition_negated_mask |= NECP_KERNEL_CONDITION_UID; } - break; + memcpy(&cond_uid, condition_value, sizeof(cond_uid)); + socket_only_conditions = TRUE; + } + break; + } + case NECP_POLICY_CONDITION_TRAFFIC_CLASS: { + if (condition_length >= sizeof(struct necp_policy_condition_tc_range)) { + master_condition_mask |= NECP_KERNEL_CONDITION_TRAFFIC_CLASS; + if (condition_is_negative) { + master_condition_negated_mask |= NECP_KERNEL_CONDITION_TRAFFIC_CLASS; + } + memcpy(&cond_traffic_class, condition_value, sizeof(cond_traffic_class)); + socket_only_conditions = TRUE; } - case NECP_POLICY_CONDITION_IP_PROTOCOL: { - if (condition_length >= sizeof(u_int16_t)) { - master_condition_mask |= NECP_KERNEL_CONDITION_PROTOCOL; + break; + } + case NECP_POLICY_CONDITION_BOUND_INTERFACE: { + if (condition_length <= IFXNAMSIZ && condition_length > 0) { + char interface_name[IFXNAMSIZ]; + memcpy(interface_name, condition_value, condition_length); + interface_name[condition_length - 1] = 0; // Make sure the string is NULL terminated + if (ifnet_find_by_name(interface_name, &cond_bound_interface) == 0) { + master_condition_mask |= NECP_KERNEL_CONDITION_BOUND_INTERFACE; if (condition_is_negative) { - master_condition_negated_mask |= NECP_KERNEL_CONDITION_PROTOCOL; + master_condition_negated_mask |= NECP_KERNEL_CONDITION_BOUND_INTERFACE; } - memcpy(&cond_protocol, condition_value, sizeof(cond_protocol)); + } + socket_ip_conditions = TRUE; + } + break; + } + case NECP_POLICY_CONDITION_IP_PROTOCOL: + case NECP_POLICY_CONDITION_FLOW_IP_PROTOCOL: { + if (condition_length >= sizeof(u_int16_t)) { + master_condition_mask |= NECP_KERNEL_CONDITION_PROTOCOL; + if (condition_is_negative) { + master_condition_negated_mask |= NECP_KERNEL_CONDITION_PROTOCOL; + } + memcpy(&cond_protocol, condition_value, sizeof(cond_protocol)); + if (condition_type == NECP_POLICY_CONDITION_FLOW_IP_PROTOCOL) { + socket_only_conditions = TRUE; + } else { socket_ip_conditions = TRUE; } + } + break; + } + case NECP_POLICY_CONDITION_LOCAL_NETWORKS: { + master_condition_mask |= NECP_KERNEL_CONDITION_LOCAL_NETWORKS; + socket_ip_conditions = TRUE; + break; + } + case NECP_POLICY_CONDITION_LOCAL_ADDR: + case NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR: { + struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)condition_value; + if (!necp_address_is_valid(&address_struct->address.sa)) { break; } - case NECP_POLICY_CONDITION_LOCAL_ADDR: { - struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)condition_value; - if (!necp_address_is_valid(&address_struct->address.sa)) { - break; - } - cond_local_prefix = address_struct->prefix; - memcpy(&cond_local_start, &address_struct->address, sizeof(address_struct->address)); - master_condition_mask |= NECP_KERNEL_CONDITION_LOCAL_START; - master_condition_mask |= NECP_KERNEL_CONDITION_LOCAL_PREFIX; - if (condition_is_negative) { - master_condition_negated_mask |= NECP_KERNEL_CONDITION_LOCAL_START; - master_condition_negated_mask |= NECP_KERNEL_CONDITION_LOCAL_PREFIX; - } + cond_local_prefix = address_struct->prefix; + memcpy(&cond_local_start, &address_struct->address, sizeof(address_struct->address)); + master_condition_mask |= NECP_KERNEL_CONDITION_LOCAL_START; + master_condition_mask |= NECP_KERNEL_CONDITION_LOCAL_PREFIX; + if (condition_is_negative) { + master_condition_negated_mask |= NECP_KERNEL_CONDITION_LOCAL_START; + master_condition_negated_mask |= NECP_KERNEL_CONDITION_LOCAL_PREFIX; + } + if (condition_type == NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR) { + socket_only_conditions = TRUE; + } else { socket_ip_conditions = TRUE; + } + break; + } + case NECP_POLICY_CONDITION_REMOTE_ADDR: + case NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR: { + struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)condition_value; + if (!necp_address_is_valid(&address_struct->address.sa)) { break; } - case NECP_POLICY_CONDITION_REMOTE_ADDR: { - struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)condition_value; - if (!necp_address_is_valid(&address_struct->address.sa)) { - break; - } - cond_remote_prefix = address_struct->prefix; - memcpy(&cond_remote_start, &address_struct->address, sizeof(address_struct->address)); - master_condition_mask |= NECP_KERNEL_CONDITION_REMOTE_START; - master_condition_mask |= NECP_KERNEL_CONDITION_REMOTE_PREFIX; - if (condition_is_negative) { - master_condition_negated_mask |= NECP_KERNEL_CONDITION_REMOTE_START; - master_condition_negated_mask |= NECP_KERNEL_CONDITION_REMOTE_PREFIX; - } + cond_remote_prefix = address_struct->prefix; + memcpy(&cond_remote_start, &address_struct->address, sizeof(address_struct->address)); + master_condition_mask |= NECP_KERNEL_CONDITION_REMOTE_START; + master_condition_mask |= NECP_KERNEL_CONDITION_REMOTE_PREFIX; + if (condition_is_negative) { + master_condition_negated_mask |= NECP_KERNEL_CONDITION_REMOTE_START; + master_condition_negated_mask |= NECP_KERNEL_CONDITION_REMOTE_PREFIX; + } + if (condition_type == NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR) { + socket_only_conditions = TRUE; + } else { socket_ip_conditions = TRUE; + } + break; + } + case NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE: + case NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_RANGE: { + struct necp_policy_condition_addr_range *address_struct = (struct necp_policy_condition_addr_range *)(void *)condition_value; + if (!necp_address_is_valid(&address_struct->start_address.sa) || + !necp_address_is_valid(&address_struct->end_address.sa)) { break; } - case NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE: { - struct necp_policy_condition_addr_range *address_struct = (struct necp_policy_condition_addr_range *)(void *)condition_value; - if (!necp_address_is_valid(&address_struct->start_address.sa) || - !necp_address_is_valid(&address_struct->end_address.sa)) { - break; - } - memcpy(&cond_local_start, &address_struct->start_address, sizeof(address_struct->start_address)); - memcpy(&cond_local_end, &address_struct->end_address, sizeof(address_struct->end_address)); - master_condition_mask |= NECP_KERNEL_CONDITION_LOCAL_START; - master_condition_mask |= NECP_KERNEL_CONDITION_LOCAL_END; - if (condition_is_negative) { - master_condition_negated_mask |= NECP_KERNEL_CONDITION_LOCAL_START; - master_condition_negated_mask |= NECP_KERNEL_CONDITION_LOCAL_END; - } + memcpy(&cond_local_start, &address_struct->start_address, sizeof(address_struct->start_address)); + memcpy(&cond_local_end, &address_struct->end_address, sizeof(address_struct->end_address)); + master_condition_mask |= NECP_KERNEL_CONDITION_LOCAL_START; + master_condition_mask |= NECP_KERNEL_CONDITION_LOCAL_END; + if (condition_is_negative) { + master_condition_negated_mask |= NECP_KERNEL_CONDITION_LOCAL_START; + master_condition_negated_mask |= NECP_KERNEL_CONDITION_LOCAL_END; + } + if (condition_type == NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_RANGE) { + socket_only_conditions = TRUE; + } else { socket_ip_conditions = TRUE; + } + break; + } + case NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE: + case NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_RANGE: { + struct necp_policy_condition_addr_range *address_struct = (struct necp_policy_condition_addr_range *)(void *)condition_value; + if (!necp_address_is_valid(&address_struct->start_address.sa) || + !necp_address_is_valid(&address_struct->end_address.sa)) { break; } - case NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE: { - struct necp_policy_condition_addr_range *address_struct = (struct necp_policy_condition_addr_range *)(void *)condition_value; - if (!necp_address_is_valid(&address_struct->start_address.sa) || - !necp_address_is_valid(&address_struct->end_address.sa)) { - break; - } - memcpy(&cond_remote_start, &address_struct->start_address, sizeof(address_struct->start_address)); - memcpy(&cond_remote_end, &address_struct->end_address, sizeof(address_struct->end_address)); - master_condition_mask |= NECP_KERNEL_CONDITION_REMOTE_START; - master_condition_mask |= NECP_KERNEL_CONDITION_REMOTE_END; - if (condition_is_negative) { - master_condition_negated_mask |= NECP_KERNEL_CONDITION_REMOTE_START; - master_condition_negated_mask |= NECP_KERNEL_CONDITION_REMOTE_END; - } + memcpy(&cond_remote_start, &address_struct->start_address, sizeof(address_struct->start_address)); + memcpy(&cond_remote_end, &address_struct->end_address, sizeof(address_struct->end_address)); + master_condition_mask |= NECP_KERNEL_CONDITION_REMOTE_START; + master_condition_mask |= NECP_KERNEL_CONDITION_REMOTE_END; + if (condition_is_negative) { + master_condition_negated_mask |= NECP_KERNEL_CONDITION_REMOTE_START; + master_condition_negated_mask |= NECP_KERNEL_CONDITION_REMOTE_END; + } + if (condition_type == NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_RANGE) { + socket_only_conditions = TRUE; + } else { socket_ip_conditions = TRUE; - break; } - case NECP_POLICY_CONDITION_AGENT_TYPE: { - if (condition_length >= sizeof(cond_agent_type)) { - master_condition_mask |= NECP_KERNEL_CONDITION_AGENT_TYPE; - memcpy(&cond_agent_type, condition_value, sizeof(cond_agent_type)); - socket_only_conditions = TRUE; + break; + } + case NECP_POLICY_CONDITION_AGENT_TYPE: { + if (condition_length >= sizeof(cond_agent_type)) { + master_condition_mask |= NECP_KERNEL_CONDITION_AGENT_TYPE; + memcpy(&cond_agent_type, condition_value, sizeof(cond_agent_type)); + socket_only_conditions = TRUE; + } + break; + } + case NECP_POLICY_CONDITION_CLIENT_FLAGS: { + if (condition_is_negative) { + master_condition_negated_mask |= NECP_KERNEL_CONDITION_CLIENT_FLAGS; + } + master_condition_mask |= NECP_KERNEL_CONDITION_CLIENT_FLAGS; + socket_only_conditions = TRUE; + if (condition_length >= sizeof(u_int32_t)) { + memcpy(&cond_client_flags, condition_value, sizeof(cond_client_flags)); + } else { + // Empty means match on fallback traffic + cond_client_flags = NECP_CLIENT_PARAMETER_FLAG_FALLBACK_TRAFFIC; + } + break; + } + case NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_EMPTY: { + master_condition_mask |= NECP_KERNEL_CONDITION_LOCAL_EMPTY; + if (condition_is_negative) { + master_condition_negated_mask |= NECP_KERNEL_CONDITION_LOCAL_EMPTY; + } + socket_only_conditions = TRUE; + break; + } + case NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_EMPTY: { + master_condition_mask |= NECP_KERNEL_CONDITION_REMOTE_EMPTY; + if (condition_is_negative) { + master_condition_negated_mask |= NECP_KERNEL_CONDITION_REMOTE_EMPTY; + } + socket_only_conditions = TRUE; + break; + } + case NECP_POLICY_CONDITION_SIGNING_IDENTIFIER: { + if (condition_length > 0) { + if (cond_signing_identifier == NULL) { + cond_signing_identifier = necp_copy_string((char *)condition_value, condition_length); + if (cond_signing_identifier != NULL) { + master_condition_mask |= NECP_KERNEL_CONDITION_SIGNING_IDENTIFIER; + socket_only_conditions = TRUE; + if (condition_is_negative) { + master_condition_negated_mask |= NECP_KERNEL_CONDITION_SIGNING_IDENTIFIER; + } + } } - break; } - default: { - break; + break; + } + case NECP_POLICY_CONDITION_PACKET_FILTER_TAGS: { + if (condition_length >= sizeof(u_int16_t)) { + master_condition_mask |= NECP_KERNEL_CONDITION_PACKET_FILTER_TAGS; + if (condition_is_negative) { + master_condition_negated_mask |= NECP_KERNEL_CONDITION_PACKET_FILTER_TAGS; + } + memcpy(&cond_packet_filter_tags, condition_value, sizeof(cond_packet_filter_tags)); + socket_ip_conditions = TRUE; + } + break; + } + case NECP_POLICY_CONDITION_FLOW_IS_LOOPBACK: { + master_condition_mask |= NECP_KERNEL_CONDITION_IS_LOOPBACK; + if (condition_is_negative) { + master_condition_negated_mask |= NECP_KERNEL_CONDITION_IS_LOOPBACK; } + socket_only_conditions = TRUE; + break; + } + default: { + break; + } } offset += sizeof(u_int8_t) + sizeof(u_int32_t) + length; } - // Process result - ultimate_result = necp_policy_get_result_type(policy); - switch (ultimate_result) { - case NECP_POLICY_RESULT_PASS: { - if (socket_only_conditions) { // socket_ip_conditions can be TRUE or FALSE - socket_layer_non_id_conditions = TRUE; - ip_output_layer_id_condition = TRUE; - } else if (socket_ip_conditions) { - socket_layer_non_id_conditions = TRUE; - ip_output_layer_id_condition = TRUE; - ip_output_layer_non_id_conditions = TRUE; - } - break; + // Process result + ultimate_result = necp_policy_get_result_type(policy); + switch (ultimate_result) { + case NECP_POLICY_RESULT_PASS: { + u_int32_t pass_flags = 0; + if (necp_policy_result_get_parameter_length_from_buffer(policy->result, policy->result_size) > 0) { + if (necp_policy_get_result_parameter(policy, (u_int8_t *)&pass_flags, sizeof(pass_flags))) { + ultimate_result_parameter.pass_flags = pass_flags; + } + } + if (socket_only_conditions) { // socket_ip_conditions can be TRUE or FALSE + socket_layer_non_id_conditions = TRUE; + ip_output_layer_id_condition = TRUE; + } else if (socket_ip_conditions) { + socket_layer_non_id_conditions = TRUE; + ip_output_layer_id_condition = TRUE; + ip_output_layer_non_id_conditions = TRUE; + } + break; + } + case NECP_POLICY_RESULT_DROP: { + u_int32_t drop_flags = 0; + if (necp_policy_result_get_parameter_length_from_buffer(policy->result, policy->result_size) > 0) { + if (necp_policy_get_result_parameter(policy, (u_int8_t *)&drop_flags, sizeof(drop_flags))) { + ultimate_result_parameter.drop_flags = drop_flags; + } + } + if (socket_only_conditions) { // socket_ip_conditions can be TRUE or FALSE + socket_layer_non_id_conditions = TRUE; + } else if (socket_ip_conditions) { + socket_layer_non_id_conditions = TRUE; + ip_output_layer_non_id_conditions = TRUE; + ip_output_layer_non_id_only = TRUE; // Only apply drop to packets that didn't go through socket layer + } + break; + } + case NECP_POLICY_RESULT_SKIP: { + u_int32_t skip_policy_order = 0; + if (necp_policy_get_result_parameter(policy, (u_int8_t *)&skip_policy_order, sizeof(skip_policy_order))) { + ultimate_result_parameter.skip_policy_order = skip_policy_order; + } + + if (socket_only_conditions) { // socket_ip_conditions can be TRUE or FALSE + socket_layer_non_id_conditions = TRUE; + ip_output_layer_id_condition = TRUE; + } else if (socket_ip_conditions) { + socket_layer_non_id_conditions = TRUE; + ip_output_layer_non_id_conditions = TRUE; } - case NECP_POLICY_RESULT_DROP: { - if (socket_only_conditions) { // socket_ip_conditions can be TRUE or FALSE - socket_layer_non_id_conditions = TRUE; - } else if (socket_ip_conditions) { - socket_layer_non_id_conditions = TRUE; - ip_output_layer_non_id_conditions = TRUE; - ip_output_layer_non_id_only = TRUE; // Only apply drop to packets that didn't go through socket layer - } - break; + break; + } + case NECP_POLICY_RESULT_SOCKET_DIVERT: + case NECP_POLICY_RESULT_SOCKET_FILTER: { + u_int32_t control_unit = 0; + if (necp_policy_get_result_parameter(policy, (u_int8_t *)&control_unit, sizeof(control_unit))) { + ultimate_result_parameter.flow_divert_control_unit = control_unit; } - case NECP_POLICY_RESULT_SKIP: { - u_int32_t skip_policy_order = 0; - if (necp_policy_get_result_parameter(policy, (u_int8_t *)&skip_policy_order, sizeof(skip_policy_order))) { - ultimate_result_parameter.skip_policy_order = skip_policy_order; + socket_layer_non_id_conditions = TRUE; + break; + } + case NECP_POLICY_RESULT_IP_TUNNEL: { + struct necp_policy_result_ip_tunnel tunnel_parameters; + u_int32_t tunnel_parameters_length = necp_policy_get_result_parameter_length(policy); + if (tunnel_parameters_length > sizeof(u_int32_t) && + tunnel_parameters_length <= sizeof(struct necp_policy_result_ip_tunnel) && + necp_policy_get_result_parameter(policy, (u_int8_t *)&tunnel_parameters, sizeof(tunnel_parameters))) { + ifnet_t tunnel_interface = NULL; + tunnel_parameters.interface_name[tunnel_parameters_length - sizeof(u_int32_t) - 1] = 0; // Make sure the string is NULL terminated + if (ifnet_find_by_name(tunnel_parameters.interface_name, &tunnel_interface) == 0) { + ultimate_result_parameter.tunnel_interface_index = tunnel_interface->if_index; + ifnet_release(tunnel_interface); } - if (socket_only_conditions) { // socket_ip_conditions can be TRUE or FALSE - socket_layer_non_id_conditions = TRUE; - ip_output_layer_id_condition = TRUE; - } else if (socket_ip_conditions) { - socket_layer_non_id_conditions = TRUE; - ip_output_layer_non_id_conditions = TRUE; + secondary_result = tunnel_parameters.secondary_result; + if (secondary_result) { + cond_last_interface_index = ultimate_result_parameter.tunnel_interface_index; } - break; - } - case NECP_POLICY_RESULT_SOCKET_DIVERT: - case NECP_POLICY_RESULT_SOCKET_FILTER: { - u_int32_t control_unit = 0; - if (necp_policy_get_result_parameter(policy, (u_int8_t *)&control_unit, sizeof(control_unit))) { - ultimate_result_parameter.flow_divert_control_unit = control_unit; - } - socket_layer_non_id_conditions = TRUE; - break; } - case NECP_POLICY_RESULT_IP_TUNNEL: { - struct necp_policy_result_ip_tunnel tunnel_parameters; - u_int32_t tunnel_parameters_length = necp_policy_get_result_parameter_length(policy); - if (tunnel_parameters_length > sizeof(u_int32_t) && - tunnel_parameters_length <= sizeof(struct necp_policy_result_ip_tunnel) && - necp_policy_get_result_parameter(policy, (u_int8_t *)&tunnel_parameters, sizeof(tunnel_parameters))) { - ifnet_t tunnel_interface = NULL; - tunnel_parameters.interface_name[tunnel_parameters_length - sizeof(u_int32_t) - 1] = 0; // Make sure the string is NULL terminated - if (ifnet_find_by_name(tunnel_parameters.interface_name, &tunnel_interface) == 0) { - ultimate_result_parameter.tunnel_interface_index = tunnel_interface->if_index; - ifnet_release(tunnel_interface); - } - secondary_result = tunnel_parameters.secondary_result; - if (secondary_result) { - cond_last_interface_index = ultimate_result_parameter.tunnel_interface_index; - } + if (socket_only_conditions) { // socket_ip_conditions can be TRUE or FALSE + socket_layer_non_id_conditions = TRUE; + ip_output_layer_id_condition = TRUE; + if (secondary_result) { + ip_output_layer_tunnel_condition_from_id = TRUE; } - - if (socket_only_conditions) { // socket_ip_conditions can be TRUE or FALSE - socket_layer_non_id_conditions = TRUE; - ip_output_layer_id_condition = TRUE; - if (secondary_result) { - ip_output_layer_tunnel_condition_from_id = TRUE; - } - } else if (socket_ip_conditions) { + } else if (socket_ip_conditions) { + socket_layer_non_id_conditions = TRUE; + ip_output_layer_id_condition = TRUE; + ip_output_layer_non_id_conditions = TRUE; + if (secondary_result) { + ip_output_layer_tunnel_condition_from_id = TRUE; + ip_output_layer_tunnel_condition_from_non_id = TRUE; + } + } + break; + } + case NECP_POLICY_RESULT_TRIGGER: + case NECP_POLICY_RESULT_TRIGGER_IF_NEEDED: + case NECP_POLICY_RESULT_TRIGGER_SCOPED: + case NECP_POLICY_RESULT_NO_TRIGGER_SCOPED: { + struct necp_policy_result_service service_parameters; + u_int32_t service_result_length = necp_policy_get_result_parameter_length(policy); + bool has_extra_service_data = FALSE; + if (service_result_length >= (sizeof(service_parameters))) { + has_extra_service_data = TRUE; + } + if (necp_policy_get_result_parameter(policy, (u_int8_t *)&service_parameters, sizeof(service_parameters))) { + ultimate_result_parameter.service.identifier = necp_create_uuid_service_id_mapping(service_parameters.identifier); + if (ultimate_result_parameter.service.identifier != 0) { + uuid_copy(policy->applied_result_uuid, service_parameters.identifier); socket_layer_non_id_conditions = TRUE; - ip_output_layer_id_condition = TRUE; - ip_output_layer_non_id_conditions = TRUE; - if (secondary_result) { - ip_output_layer_tunnel_condition_from_id = TRUE; - ip_output_layer_tunnel_condition_from_non_id = TRUE; + if (has_extra_service_data) { + ultimate_result_parameter.service.data = service_parameters.data; + } else { + ultimate_result_parameter.service.data = 0; } } - break; } - case NECP_POLICY_RESULT_TRIGGER: - case NECP_POLICY_RESULT_TRIGGER_IF_NEEDED: - case NECP_POLICY_RESULT_TRIGGER_SCOPED: - case NECP_POLICY_RESULT_NO_TRIGGER_SCOPED: { - struct necp_policy_result_service service_parameters; - u_int32_t service_result_length = necp_policy_get_result_parameter_length(policy); - bool has_extra_service_data = FALSE; - if (service_result_length >= (sizeof(service_parameters))) { - has_extra_service_data = TRUE; - } - if (necp_policy_get_result_parameter(policy, (u_int8_t *)&service_parameters, sizeof(service_parameters))) { - ultimate_result_parameter.service.identifier = necp_create_uuid_service_id_mapping(service_parameters.identifier); - if (ultimate_result_parameter.service.identifier != 0) { - uuid_copy(policy->applied_result_uuid, service_parameters.identifier); - socket_layer_non_id_conditions = TRUE; - if (has_extra_service_data) { - ultimate_result_parameter.service.data = service_parameters.data; - } else { - ultimate_result_parameter.service.data = 0; - } - } + break; + } + case NECP_POLICY_RESULT_USE_NETAGENT: + case NECP_POLICY_RESULT_NETAGENT_SCOPED: { + uuid_t netagent_uuid; + if (necp_policy_get_result_parameter(policy, (u_int8_t *)&netagent_uuid, sizeof(netagent_uuid))) { + ultimate_result_parameter.netagent_id = necp_create_uuid_service_id_mapping(netagent_uuid); + if (ultimate_result_parameter.netagent_id != 0) { + uuid_copy(policy->applied_result_uuid, netagent_uuid); + socket_layer_non_id_conditions = TRUE; } - break; } - case NECP_POLICY_RESULT_USE_NETAGENT: - case NECP_POLICY_RESULT_NETAGENT_SCOPED: { - uuid_t netagent_uuid; - if (necp_policy_get_result_parameter(policy, (u_int8_t *)&netagent_uuid, sizeof(netagent_uuid))) { - ultimate_result_parameter.netagent_id = necp_create_uuid_service_id_mapping(netagent_uuid); - if (ultimate_result_parameter.netagent_id != 0) { - uuid_copy(policy->applied_result_uuid, netagent_uuid); - socket_layer_non_id_conditions = TRUE; - } + break; + } + case NECP_POLICY_RESULT_SOCKET_SCOPED: { + u_int32_t interface_name_length = necp_policy_get_result_parameter_length(policy); + if (interface_name_length <= IFXNAMSIZ && interface_name_length > 0) { + char interface_name[IFXNAMSIZ]; + ifnet_t scope_interface = NULL; + necp_policy_get_result_parameter(policy, (u_int8_t *)interface_name, interface_name_length); + interface_name[interface_name_length - 1] = 0; // Make sure the string is NULL terminated + if (ifnet_find_by_name(interface_name, &scope_interface) == 0) { + ultimate_result_parameter.scoped_interface_index = scope_interface->if_index; + socket_layer_non_id_conditions = TRUE; + ifnet_release(scope_interface); } - break; } - case NECP_POLICY_RESULT_SOCKET_SCOPED: { - u_int32_t interface_name_length = necp_policy_get_result_parameter_length(policy); - if (interface_name_length <= IFXNAMSIZ && interface_name_length > 0) { - char interface_name[IFXNAMSIZ]; - ifnet_t scope_interface = NULL; - necp_policy_get_result_parameter(policy, (u_int8_t *)interface_name, interface_name_length); - interface_name[interface_name_length - 1] = 0; // Make sure the string is NULL terminated - if (ifnet_find_by_name(interface_name, &scope_interface) == 0) { - ultimate_result_parameter.scoped_interface_index = scope_interface->if_index; + break; + } + case NECP_POLICY_RESULT_SCOPED_DIRECT: { + socket_layer_non_id_conditions = TRUE; + break; + } + case NECP_POLICY_RESULT_ALLOW_UNENTITLED: { + socket_layer_non_id_conditions = TRUE; + break; + } + case NECP_POLICY_RESULT_ROUTE_RULES: { + if (policy->route_rules != NULL && policy->route_rules_size > 0) { + u_int32_t route_rule_id = necp_create_route_rule(&necp_route_rules, policy->route_rules, policy->route_rules_size); + if (route_rule_id > 0) { + policy->applied_route_rules_id = route_rule_id; + ultimate_result_parameter.route_rule_id = route_rule_id; + if (socket_only_conditions) { // socket_ip_conditions can be TRUE or FALSE socket_layer_non_id_conditions = TRUE; - ifnet_release(scope_interface); - } - } - break; - } - case NECP_POLICY_RESULT_SCOPED_DIRECT: { - socket_layer_non_id_conditions = TRUE; - break; - } - case NECP_POLICY_RESULT_ROUTE_RULES: { - if (policy->route_rules != NULL && policy->route_rules_size > 0) { - u_int32_t route_rule_id = necp_create_route_rule(&necp_route_rules, policy->route_rules, policy->route_rules_size); - if (route_rule_id > 0) { - policy->applied_route_rules_id = route_rule_id; - ultimate_result_parameter.route_rule_id = route_rule_id; + } else if (socket_ip_conditions) { socket_layer_non_id_conditions = TRUE; + ip_output_layer_non_id_conditions = TRUE; + ip_output_layer_non_id_only = TRUE; // Only apply route rules to packets that didn't go through socket layer } } - break; - } - default: { - break; } + break; + } + default: { + break; + } } if (socket_layer_non_id_conditions) { - necp_kernel_policy_id policy_id = necp_kernel_socket_policy_add(policy->order, session->session_order, session->proc_pid, master_condition_mask, master_condition_negated_mask, cond_app_id, cond_real_app_id, cond_custom_entitlement, cond_account_id, cond_domain, cond_pid, cond_uid, cond_bound_interface, cond_traffic_class, cond_protocol, &cond_local_start, &cond_local_end, cond_local_prefix, &cond_remote_start, &cond_remote_end, cond_remote_prefix, &cond_agent_type, ultimate_result, ultimate_result_parameter); + necp_kernel_policy_id policy_id = necp_kernel_socket_policy_add(policy->order, session->session_order, session->proc_pid, master_condition_mask, master_condition_negated_mask, cond_app_id, cond_real_app_id, cond_custom_entitlement, cond_account_id, cond_domain, cond_pid, cond_uid, cond_bound_interface, cond_traffic_class, cond_protocol, &cond_local_start, &cond_local_end, cond_local_prefix, &cond_remote_start, &cond_remote_end, cond_remote_prefix, &cond_agent_type, &cond_sdk_version, cond_client_flags, cond_signing_identifier, cond_packet_filter_tags, ultimate_result, ultimate_result_parameter); if (policy_id == 0) { NECPLOG0(LOG_DEBUG, "Error applying socket kernel policy"); @@ -4049,7 +3833,8 @@ necp_policy_apply(struct necp_session *session, struct necp_session_policy *poli if (ip_output_layer_non_id_only) { condition_mask |= NECP_KERNEL_CONDITION_POLICY_ID; } - necp_kernel_policy_id policy_id = necp_kernel_ip_output_policy_add(policy->order, NECP_KERNEL_POLICY_SUBORDER_NON_ID_CONDITIONS, session->session_order, session->proc_pid, condition_mask, master_condition_negated_mask, NECP_KERNEL_POLICY_ID_NONE, cond_bound_interface, 0, cond_protocol, &cond_local_start, &cond_local_end, cond_local_prefix, &cond_remote_start, &cond_remote_end, cond_remote_prefix, ultimate_result, ultimate_result_parameter); + + necp_kernel_policy_id policy_id = necp_kernel_ip_output_policy_add(policy->order, NECP_KERNEL_POLICY_SUBORDER_NON_ID_CONDITIONS, session->session_order, session->proc_pid, condition_mask, master_condition_negated_mask, NECP_KERNEL_POLICY_ID_NONE, cond_bound_interface, 0, cond_protocol, &cond_local_start, &cond_local_end, cond_local_prefix, &cond_remote_start, &cond_remote_end, cond_remote_prefix, cond_packet_filter_tags, ultimate_result, ultimate_result_parameter); if (policy_id == 0) { NECPLOG0(LOG_DEBUG, "Error applying IP output kernel policy"); @@ -4060,7 +3845,7 @@ necp_policy_apply(struct necp_session *session, struct necp_session_policy *poli } if (ip_output_layer_id_condition) { - necp_kernel_policy_id policy_id = necp_kernel_ip_output_policy_add(policy->order, NECP_KERNEL_POLICY_SUBORDER_ID_CONDITION, session->session_order, session->proc_pid, NECP_KERNEL_CONDITION_POLICY_ID | NECP_KERNEL_CONDITION_ALL_INTERFACES, 0, cond_ip_output_layer_id, NULL, 0, 0, NULL, NULL, 0, NULL, NULL, 0, ultimate_result, ultimate_result_parameter); + necp_kernel_policy_id policy_id = necp_kernel_ip_output_policy_add(policy->order, NECP_KERNEL_POLICY_SUBORDER_ID_CONDITION, session->session_order, session->proc_pid, NECP_KERNEL_CONDITION_POLICY_ID | NECP_KERNEL_CONDITION_ALL_INTERFACES, 0, cond_ip_output_layer_id, NULL, 0, 0, NULL, NULL, 0, NULL, NULL, 0, 0, ultimate_result, ultimate_result_parameter); if (policy_id == 0) { NECPLOG0(LOG_DEBUG, "Error applying IP output kernel policy"); @@ -4072,7 +3857,7 @@ necp_policy_apply(struct necp_session *session, struct necp_session_policy *poli // Extra policies for IP Output tunnels for when packets loop back if (ip_output_layer_tunnel_condition_from_id) { - necp_kernel_policy_id policy_id = necp_kernel_ip_output_policy_add(policy->order, NECP_KERNEL_POLICY_SUBORDER_NON_ID_TUNNEL_CONDITION, session->session_order, session->proc_pid, NECP_KERNEL_CONDITION_POLICY_ID | NECP_KERNEL_CONDITION_LAST_INTERFACE | NECP_KERNEL_CONDITION_ALL_INTERFACES, 0, policy->kernel_ip_output_policies[NECP_KERNEL_POLICY_SUBORDER_NON_ID_CONDITIONS], NULL, cond_last_interface_index, 0, NULL, NULL, 0, NULL, NULL, 0, secondary_result, secondary_result_parameter); + necp_kernel_policy_id policy_id = necp_kernel_ip_output_policy_add(policy->order, NECP_KERNEL_POLICY_SUBORDER_NON_ID_TUNNEL_CONDITION, session->session_order, session->proc_pid, NECP_KERNEL_CONDITION_POLICY_ID | NECP_KERNEL_CONDITION_LAST_INTERFACE | NECP_KERNEL_CONDITION_ALL_INTERFACES, 0, policy->kernel_ip_output_policies[NECP_KERNEL_POLICY_SUBORDER_NON_ID_CONDITIONS], NULL, cond_last_interface_index, 0, NULL, NULL, 0, NULL, NULL, 0, 0, secondary_result, secondary_result_parameter); if (policy_id == 0) { NECPLOG0(LOG_DEBUG, "Error applying IP output kernel policy"); @@ -4083,7 +3868,7 @@ necp_policy_apply(struct necp_session *session, struct necp_session_policy *poli } if (ip_output_layer_tunnel_condition_from_id) { - necp_kernel_policy_id policy_id = necp_kernel_ip_output_policy_add(policy->order, NECP_KERNEL_POLICY_SUBORDER_ID_TUNNEL_CONDITION, session->session_order, session->proc_pid, NECP_KERNEL_CONDITION_POLICY_ID | NECP_KERNEL_CONDITION_LAST_INTERFACE | NECP_KERNEL_CONDITION_ALL_INTERFACES, 0, policy->kernel_ip_output_policies[NECP_KERNEL_POLICY_SUBORDER_ID_CONDITION], NULL, cond_last_interface_index, 0, NULL, NULL, 0, NULL, NULL, 0, secondary_result, secondary_result_parameter); + necp_kernel_policy_id policy_id = necp_kernel_ip_output_policy_add(policy->order, NECP_KERNEL_POLICY_SUBORDER_ID_TUNNEL_CONDITION, session->session_order, session->proc_pid, NECP_KERNEL_CONDITION_POLICY_ID | NECP_KERNEL_CONDITION_LAST_INTERFACE | NECP_KERNEL_CONDITION_ALL_INTERFACES, 0, policy->kernel_ip_output_policies[NECP_KERNEL_POLICY_SUBORDER_ID_CONDITION], NULL, cond_last_interface_index, 0, NULL, NULL, 0, NULL, NULL, 0, 0, secondary_result, secondary_result_parameter); if (policy_id == 0) { NECPLOG0(LOG_DEBUG, "Error applying IP output kernel policy"); @@ -4095,10 +3880,10 @@ necp_policy_apply(struct necp_session *session, struct necp_session_policy *poli policy->applied = TRUE; policy->pending_update = FALSE; - return (TRUE); + return TRUE; fail: - return (FALSE); + return FALSE; } static void @@ -4165,11 +3950,11 @@ necp_kernel_policy_get_new_id(bool socket_level) do { necp_last_kernel_socket_policy_id++; if (necp_last_kernel_socket_policy_id < NECP_KERNEL_POLICY_ID_FIRST_VALID_SOCKET || - necp_last_kernel_socket_policy_id >= NECP_KERNEL_POLICY_ID_FIRST_VALID_IP) { + necp_last_kernel_socket_policy_id >= NECP_KERNEL_POLICY_ID_FIRST_VALID_IP) { if (wrapped) { // Already wrapped, give up NECPLOG0(LOG_ERR, "Failed to find a free socket kernel policy ID.\n"); - return (NECP_KERNEL_POLICY_ID_NONE); + return NECP_KERNEL_POLICY_ID_NONE; } necp_last_kernel_socket_policy_id = NECP_KERNEL_POLICY_ID_FIRST_VALID_SOCKET; wrapped = TRUE; @@ -4184,7 +3969,7 @@ necp_kernel_policy_get_new_id(bool socket_level) if (wrapped) { // Already wrapped, give up NECPLOG0(LOG_ERR, "Failed to find a free IP kernel policy ID.\n"); - return (NECP_KERNEL_POLICY_ID_NONE); + return NECP_KERNEL_POLICY_ID_NONE; } necp_last_kernel_ip_policy_id = NECP_KERNEL_POLICY_ID_FIRST_VALID_IP; wrapped = TRUE; @@ -4195,25 +3980,22 @@ necp_kernel_policy_get_new_id(bool socket_level) if (newid == NECP_KERNEL_POLICY_ID_NONE) { NECPLOG0(LOG_ERR, "Allocate kernel policy id failed.\n"); - return (NECP_KERNEL_POLICY_ID_NONE); + return NECP_KERNEL_POLICY_ID_NONE; } - return (newid); + return newid; } -#define NECP_KERNEL_VALID_SOCKET_CONDITIONS (NECP_KERNEL_CONDITION_APP_ID | NECP_KERNEL_CONDITION_REAL_APP_ID | NECP_KERNEL_CONDITION_DOMAIN | NECP_KERNEL_CONDITION_ACCOUNT_ID | NECP_KERNEL_CONDITION_PID | NECP_KERNEL_CONDITION_UID | NECP_KERNEL_CONDITION_ALL_INTERFACES | NECP_KERNEL_CONDITION_BOUND_INTERFACE | NECP_KERNEL_CONDITION_TRAFFIC_CLASS | NECP_KERNEL_CONDITION_PROTOCOL | NECP_KERNEL_CONDITION_LOCAL_START | NECP_KERNEL_CONDITION_LOCAL_END | NECP_KERNEL_CONDITION_LOCAL_PREFIX | NECP_KERNEL_CONDITION_REMOTE_START | NECP_KERNEL_CONDITION_REMOTE_END | NECP_KERNEL_CONDITION_REMOTE_PREFIX | NECP_KERNEL_CONDITION_ENTITLEMENT | NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT | NECP_KERNEL_CONDITION_AGENT_TYPE) +#define NECP_KERNEL_VALID_SOCKET_CONDITIONS (NECP_KERNEL_CONDITION_APP_ID | NECP_KERNEL_CONDITION_REAL_APP_ID | NECP_KERNEL_CONDITION_DOMAIN | NECP_KERNEL_CONDITION_ACCOUNT_ID | NECP_KERNEL_CONDITION_PID | NECP_KERNEL_CONDITION_UID | NECP_KERNEL_CONDITION_ALL_INTERFACES | NECP_KERNEL_CONDITION_BOUND_INTERFACE | NECP_KERNEL_CONDITION_TRAFFIC_CLASS | NECP_KERNEL_CONDITION_PROTOCOL | NECP_KERNEL_CONDITION_LOCAL_START | NECP_KERNEL_CONDITION_LOCAL_END | NECP_KERNEL_CONDITION_LOCAL_PREFIX | NECP_KERNEL_CONDITION_REMOTE_START | NECP_KERNEL_CONDITION_REMOTE_END | NECP_KERNEL_CONDITION_REMOTE_PREFIX | NECP_KERNEL_CONDITION_ENTITLEMENT | NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT | NECP_KERNEL_CONDITION_AGENT_TYPE | NECP_KERNEL_CONDITION_HAS_CLIENT | NECP_KERNEL_CONDITION_LOCAL_NETWORKS | NECP_KERNEL_CONDITION_CLIENT_FLAGS | NECP_KERNEL_CONDITION_LOCAL_EMPTY | NECP_KERNEL_CONDITION_REMOTE_EMPTY | NECP_KERNEL_CONDITION_PLATFORM_BINARY | NECP_KERNEL_CONDITION_SDK_VERSION | NECP_KERNEL_CONDITION_SIGNING_IDENTIFIER | NECP_KERNEL_CONDITION_PACKET_FILTER_TAGS | NECP_KERNEL_CONDITION_IS_LOOPBACK) + static necp_kernel_policy_id -necp_kernel_socket_policy_add(necp_policy_order order, u_int32_t session_order, int session_pid, u_int32_t condition_mask, u_int32_t condition_negated_mask, necp_app_id cond_app_id, necp_app_id cond_real_app_id, char *cond_custom_entitlement, u_int32_t cond_account_id, char *cond_domain, pid_t cond_pid, uid_t cond_uid, ifnet_t cond_bound_interface, struct necp_policy_condition_tc_range cond_traffic_class, u_int16_t cond_protocol, union necp_sockaddr_union *cond_local_start, union necp_sockaddr_union *cond_local_end, u_int8_t cond_local_prefix, union necp_sockaddr_union *cond_remote_start, union necp_sockaddr_union *cond_remote_end, u_int8_t cond_remote_prefix, struct necp_policy_condition_agent_type *cond_agent_type, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter) +necp_kernel_socket_policy_add(necp_policy_order order, u_int32_t session_order, int session_pid, u_int32_t condition_mask, u_int32_t condition_negated_mask, necp_app_id cond_app_id, necp_app_id cond_real_app_id, char *cond_custom_entitlement, u_int32_t cond_account_id, char *cond_domain, pid_t cond_pid, uid_t cond_uid, ifnet_t cond_bound_interface, struct necp_policy_condition_tc_range cond_traffic_class, u_int16_t cond_protocol, union necp_sockaddr_union *cond_local_start, union necp_sockaddr_union *cond_local_end, u_int8_t cond_local_prefix, union necp_sockaddr_union *cond_remote_start, union necp_sockaddr_union *cond_remote_end, u_int8_t cond_remote_prefix, struct necp_policy_condition_agent_type *cond_agent_type, struct necp_policy_condition_sdk_version *cond_sdk_version, u_int32_t cond_client_flags, char *cond_signing_identifier, u_int16_t cond_packet_filter_tags, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter) { struct necp_kernel_socket_policy *new_kernel_policy = NULL; struct necp_kernel_socket_policy *tmp_kernel_policy = NULL; - MALLOC_ZONE(new_kernel_policy, struct necp_kernel_socket_policy *, sizeof(*new_kernel_policy), M_NECP_SOCKET_POLICY, M_WAITOK); - if (new_kernel_policy == NULL) { - goto done; - } + new_kernel_policy = zalloc_flags(necp_socket_policy_zone, Z_WAITOK | Z_ZERO); - memset(new_kernel_policy, 0, sizeof(*new_kernel_policy)); // M_ZERO is not supported for MALLOC_ZONE new_kernel_policy->id = necp_kernel_policy_get_new_id(true); new_kernel_policy->order = order; new_kernel_policy->session_order = session_order; @@ -4227,8 +4009,8 @@ necp_kernel_socket_policy_add(necp_policy_order order, u_int32_t session_order, if ((new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REAL_APP_ID) && !(new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_APP_ID)) { new_kernel_policy->condition_mask &= ~NECP_KERNEL_CONDITION_REAL_APP_ID; } - if ((new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_ENTITLEMENT) && !(new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_APP_ID)) { - new_kernel_policy->condition_mask &= ~NECP_KERNEL_CONDITION_ENTITLEMENT; + if ((new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT) && !(new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_APP_ID)) { + new_kernel_policy->condition_mask &= ~NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT; } if ((new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_END) && (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_PREFIX)) { new_kernel_policy->condition_mask &= ~NECP_KERNEL_CONDITION_LOCAL_PREFIX; @@ -4236,6 +4018,12 @@ necp_kernel_socket_policy_add(necp_policy_order order, u_int32_t session_order, if ((new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_END) && (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX)) { new_kernel_policy->condition_mask &= ~NECP_KERNEL_CONDITION_REMOTE_PREFIX; } + if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_EMPTY) { + new_kernel_policy->condition_mask &= ~(NECP_KERNEL_CONDITION_LOCAL_PREFIX | NECP_KERNEL_CONDITION_LOCAL_END); + } + if ((new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_EMPTY)) { + new_kernel_policy->condition_mask &= ~(NECP_KERNEL_CONDITION_REMOTE_PREFIX | NECP_KERNEL_CONDITION_REMOTE_END); + } new_kernel_policy->condition_negated_mask = condition_negated_mask & new_kernel_policy->condition_mask; // Set condition values @@ -4295,6 +4083,18 @@ necp_kernel_socket_policy_add(necp_policy_order order, u_int32_t session_order, if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_AGENT_TYPE) { memcpy(&new_kernel_policy->cond_agent_type, cond_agent_type, sizeof(*cond_agent_type)); } + if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_SDK_VERSION) { + memcpy(&new_kernel_policy->cond_sdk_version, cond_sdk_version, sizeof(*cond_sdk_version)); + } + if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_CLIENT_FLAGS) { + new_kernel_policy->cond_client_flags = cond_client_flags; + } + if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_SIGNING_IDENTIFIER) { + new_kernel_policy->cond_signing_identifier = cond_signing_identifier; + } + if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_PACKET_FILTER_TAGS) { + new_kernel_policy->cond_packet_filter_tags = cond_packet_filter_tags; + } new_kernel_policy->result = result; memcpy(&new_kernel_policy->result_parameter, &result_parameter, sizeof(result_parameter)); @@ -4303,8 +4103,8 @@ necp_kernel_socket_policy_add(necp_policy_order order, u_int32_t session_order, NECPLOG(LOG_DEBUG, "Added kernel policy: socket, id=%d, mask=%x\n", new_kernel_policy->id, new_kernel_policy->condition_mask); } LIST_INSERT_SORTED_TWICE_ASCENDING(&necp_kernel_socket_policies, new_kernel_policy, chain, session_order, order, tmp_kernel_policy); -done: - return (new_kernel_policy ? new_kernel_policy->id : 0); + + return new_kernel_policy ? new_kernel_policy->id : 0; } static struct necp_kernel_socket_policy * @@ -4314,16 +4114,16 @@ necp_kernel_socket_policy_find(necp_kernel_policy_id policy_id) struct necp_kernel_socket_policy *tmp_kernel_policy = NULL; if (policy_id == 0) { - return (NULL); + return NULL; } LIST_FOREACH_SAFE(kernel_policy, &necp_kernel_socket_policies, chain, tmp_kernel_policy) { if (kernel_policy->id == policy_id) { - return (kernel_policy); + return kernel_policy; } } - return (NULL); + return NULL; } static bool @@ -4352,11 +4152,16 @@ necp_kernel_socket_policy_delete(necp_kernel_policy_id policy_id) policy->cond_custom_entitlement = NULL; } - FREE_ZONE(policy, sizeof(*policy), M_NECP_SOCKET_POLICY); - return (TRUE); + if (policy->cond_signing_identifier) { + FREE(policy->cond_signing_identifier, M_NECP); + policy->cond_signing_identifier = NULL; + } + + zfree(necp_socket_policy_zone, policy); + return TRUE; } - return (FALSE); + return FALSE; } static inline const char * @@ -4364,214 +4169,221 @@ necp_get_result_description(char *result_string, necp_kernel_policy_result resul { uuid_string_t uuid_string; switch (result) { - case NECP_KERNEL_POLICY_RESULT_NONE: { - snprintf(result_string, MAX_RESULT_STRING_LEN, "None"); - break; - } - case NECP_KERNEL_POLICY_RESULT_PASS: { - snprintf(result_string, MAX_RESULT_STRING_LEN, "Pass"); - break; - } - case NECP_KERNEL_POLICY_RESULT_SKIP: { - snprintf(result_string, MAX_RESULT_STRING_LEN, "Skip (%u)", result_parameter.skip_policy_order); - break; - } - case NECP_KERNEL_POLICY_RESULT_DROP: { - snprintf(result_string, MAX_RESULT_STRING_LEN, "Drop"); - break; - } - case NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT: { - snprintf(result_string, MAX_RESULT_STRING_LEN, "SocketDivert (%d)", result_parameter.flow_divert_control_unit); - break; - } - case NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER: { - snprintf(result_string, MAX_RESULT_STRING_LEN, "SocketFilter (%d)", result_parameter.filter_control_unit); - break; - } - case NECP_KERNEL_POLICY_RESULT_IP_TUNNEL: { - ifnet_t interface = ifindex2ifnet[result_parameter.tunnel_interface_index]; - snprintf(result_string, MAX_RESULT_STRING_LEN, "IPTunnel (%s%d)", ifnet_name(interface), ifnet_unit(interface)); - break; - } - case NECP_KERNEL_POLICY_RESULT_IP_FILTER: { - snprintf(result_string, MAX_RESULT_STRING_LEN, "IPFilter"); - break; - } - case NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED: { - ifnet_t interface = ifindex2ifnet[result_parameter.scoped_interface_index]; - snprintf(result_string, MAX_RESULT_STRING_LEN, "SocketScoped (%s%d)", ifnet_name(interface), ifnet_unit(interface)); - break; - } - case NECP_KERNEL_POLICY_RESULT_SCOPED_DIRECT: { - snprintf(result_string, MAX_RESULT_STRING_LEN, "ScopedDirect"); - break; - } - case NECP_KERNEL_POLICY_RESULT_ROUTE_RULES: { - int index = 0; - char interface_names[IFXNAMSIZ][MAX_ROUTE_RULE_INTERFACES]; - struct necp_route_rule *route_rule = necp_lookup_route_rule_locked(&necp_route_rules, result_parameter.route_rule_id); - if (route_rule != NULL) { - for (index = 0; index < MAX_ROUTE_RULE_INTERFACES; index++) { - if (route_rule->exception_if_indices[index] != 0) { - ifnet_t interface = ifindex2ifnet[route_rule->exception_if_indices[index]]; - snprintf(interface_names[index], IFXNAMSIZ, "%s%d", ifnet_name(interface), ifnet_unit(interface)); - } else { - memset(interface_names[index], 0, IFXNAMSIZ); - } - } - switch (route_rule->default_action) { - case NECP_ROUTE_RULE_DENY_INTERFACE: - snprintf(result_string, MAX_RESULT_STRING_LEN, "RouteRules (Only %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s)", - (route_rule->cellular_action == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? "Cell " : "", - (route_rule->wifi_action == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? "WiFi " : "", - (route_rule->wired_action == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? "Wired " : "", - (route_rule->expensive_action == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? "Exp " : "", - (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[0] : "", - (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", - (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[1] : "", - (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", - (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[2] : "", - (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", - (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[3] : "", - (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", - (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[4] : "", - (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", - (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[5] : "", - (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", - (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[6] : "", - (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", - (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[7] : "", - (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", - (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[8] : "", - (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", - (route_rule->exception_if_actions[9] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[9] : ""); - break; - case NECP_ROUTE_RULE_ALLOW_INTERFACE: - snprintf(result_string, MAX_RESULT_STRING_LEN, "RouteRules (%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s)", - (route_rule->cellular_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!Cell " : "", - (route_rule->wifi_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!WiFi " : "", - (route_rule->wired_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!Wired " : "", - (route_rule->expensive_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!Exp " : "", - (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", - (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[0] : "", - (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", - (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[1] : "", - (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", - (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[2] : "", - (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", - (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[3] : "", - (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", - (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[4] : "", - (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", - (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[5] : "", - (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", - (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[6] : "", - (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", - (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[7] : "", - (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", - (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[8] : "", - (route_rule->exception_if_actions[9] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", - (route_rule->exception_if_actions[9] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[9] : ""); - break; - case NECP_ROUTE_RULE_QOS_MARKING: - snprintf(result_string, MAX_RESULT_STRING_LEN, "RouteRules (QoSMarking %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s)", - (route_rule->cellular_action == NECP_ROUTE_RULE_QOS_MARKING) ? "Cell " : "", - (route_rule->wifi_action == NECP_ROUTE_RULE_QOS_MARKING) ? "WiFi " : "", - (route_rule->wired_action == NECP_ROUTE_RULE_QOS_MARKING) ? "Wired " : "", - (route_rule->expensive_action == NECP_ROUTE_RULE_QOS_MARKING) ? "Exp " : "", - (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[0] : "", - (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", - (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[1] : "", - (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", - (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[2] : "", - (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", - (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[3] : "", - (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", - (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[4] : "", - (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", - (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[5] : "", - (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", - (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[6] : "", - (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", - (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[7] : "", - (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", - (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[8] : "", - (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", - (route_rule->exception_if_actions[9] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[9] : ""); - break; - default: - snprintf(result_string, MAX_RESULT_STRING_LEN, "RouteRules (Unknown)"); - break; - } - } - break; - } - case NECP_KERNEL_POLICY_RESULT_USE_NETAGENT: { - bool found_mapping = FALSE; - struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.netagent_id); - if (mapping != NULL) { - uuid_unparse(mapping->uuid, uuid_string); - found_mapping = TRUE; + case NECP_KERNEL_POLICY_RESULT_NONE: { + snprintf(result_string, MAX_RESULT_STRING_LEN, "None"); + break; + } + case NECP_KERNEL_POLICY_RESULT_PASS: { + snprintf(result_string, MAX_RESULT_STRING_LEN, "Pass (%X)", result_parameter.pass_flags); + break; + } + case NECP_KERNEL_POLICY_RESULT_SKIP: { + snprintf(result_string, MAX_RESULT_STRING_LEN, "Skip (%u)", result_parameter.skip_policy_order); + break; + } + case NECP_KERNEL_POLICY_RESULT_DROP: { + snprintf(result_string, MAX_RESULT_STRING_LEN, "Drop (%X)", result_parameter.drop_flags); + break; + } + case NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT: { + snprintf(result_string, MAX_RESULT_STRING_LEN, "SocketDivert (%d)", result_parameter.flow_divert_control_unit); + break; + } + case NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER: { + snprintf(result_string, MAX_RESULT_STRING_LEN, "SocketFilter (%d)", result_parameter.filter_control_unit); + break; + } + case NECP_KERNEL_POLICY_RESULT_IP_TUNNEL: { + ifnet_t interface = ifindex2ifnet[result_parameter.tunnel_interface_index]; + snprintf(result_string, MAX_RESULT_STRING_LEN, "IPTunnel (%s%d)", ifnet_name(interface), ifnet_unit(interface)); + break; + } + case NECP_KERNEL_POLICY_RESULT_IP_FILTER: { + snprintf(result_string, MAX_RESULT_STRING_LEN, "IPFilter"); + break; + } + case NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED: { + ifnet_t interface = ifindex2ifnet[result_parameter.scoped_interface_index]; + snprintf(result_string, MAX_RESULT_STRING_LEN, "SocketScoped (%s%d)", ifnet_name(interface), ifnet_unit(interface)); + break; + } + case NECP_KERNEL_POLICY_RESULT_SCOPED_DIRECT: { + snprintf(result_string, MAX_RESULT_STRING_LEN, "ScopedDirect"); + break; + } + case NECP_KERNEL_POLICY_RESULT_ALLOW_UNENTITLED: { + snprintf(result_string, MAX_RESULT_STRING_LEN, "AllowUnentitled"); + break; + } + case NECP_KERNEL_POLICY_RESULT_ROUTE_RULES: { + int index = 0; + char interface_names[MAX_ROUTE_RULE_INTERFACES][IFXNAMSIZ]; + struct necp_route_rule *route_rule = necp_lookup_route_rule_locked(&necp_route_rules, result_parameter.route_rule_id); + if (route_rule != NULL) { + for (index = 0; index < MAX_ROUTE_RULE_INTERFACES; index++) { + if (route_rule->exception_if_indices[index] != 0) { + ifnet_t interface = ifindex2ifnet[route_rule->exception_if_indices[index]]; + snprintf(interface_names[index], IFXNAMSIZ, "%s%d", ifnet_name(interface), ifnet_unit(interface)); + } else { + memset(interface_names[index], 0, IFXNAMSIZ); + } + } + switch (route_rule->default_action) { + case NECP_ROUTE_RULE_DENY_INTERFACE: + snprintf(result_string, MAX_RESULT_STRING_LEN, "RouteRules (Only %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s)", + (route_rule->cellular_action == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? "Cell " : "", + (route_rule->wifi_action == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? "WiFi " : "", + (route_rule->wired_action == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? "Wired " : "", + (route_rule->expensive_action == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? "Exp " : "", + (route_rule->constrained_action == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? "Constrained " : "", + (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[0] : "", + (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", + (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[1] : "", + (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", + (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[2] : "", + (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", + (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[3] : "", + (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", + (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[4] : "", + (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", + (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[5] : "", + (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", + (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[6] : "", + (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", + (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[7] : "", + (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", + (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[8] : "", + (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? " " : "", + (route_rule->exception_if_actions[9] == NECP_ROUTE_RULE_ALLOW_INTERFACE) ? interface_names[9] : ""); + break; + case NECP_ROUTE_RULE_ALLOW_INTERFACE: + snprintf(result_string, MAX_RESULT_STRING_LEN, "RouteRules (%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s)", + (route_rule->cellular_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!Cell " : "", + (route_rule->wifi_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!WiFi " : "", + (route_rule->wired_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!Wired " : "", + (route_rule->expensive_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!Exp " : "", + (route_rule->constrained_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!Constrained " : "", + (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", + (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[0] : "", + (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", + (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[1] : "", + (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", + (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[2] : "", + (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", + (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[3] : "", + (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", + (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[4] : "", + (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", + (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[5] : "", + (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", + (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[6] : "", + (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", + (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[7] : "", + (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", + (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[8] : "", + (route_rule->exception_if_actions[9] == NECP_ROUTE_RULE_DENY_INTERFACE) ? "!" : "", + (route_rule->exception_if_actions[9] == NECP_ROUTE_RULE_DENY_INTERFACE) ? interface_names[9] : ""); + break; + case NECP_ROUTE_RULE_QOS_MARKING: + snprintf(result_string, MAX_RESULT_STRING_LEN, "RouteRules (QoSMarking %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s)", + (route_rule->cellular_action == NECP_ROUTE_RULE_QOS_MARKING) ? "Cell " : "", + (route_rule->wifi_action == NECP_ROUTE_RULE_QOS_MARKING) ? "WiFi " : "", + (route_rule->wired_action == NECP_ROUTE_RULE_QOS_MARKING) ? "Wired " : "", + (route_rule->expensive_action == NECP_ROUTE_RULE_QOS_MARKING) ? "Exp " : "", + (route_rule->constrained_action == NECP_ROUTE_RULE_QOS_MARKING) ? "Constrained " : "", + (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[0] : "", + (route_rule->exception_if_actions[0] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", + (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[1] : "", + (route_rule->exception_if_actions[1] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", + (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[2] : "", + (route_rule->exception_if_actions[2] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", + (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[3] : "", + (route_rule->exception_if_actions[3] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", + (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[4] : "", + (route_rule->exception_if_actions[4] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", + (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[5] : "", + (route_rule->exception_if_actions[5] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", + (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[6] : "", + (route_rule->exception_if_actions[6] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", + (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[7] : "", + (route_rule->exception_if_actions[7] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", + (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[8] : "", + (route_rule->exception_if_actions[8] == NECP_ROUTE_RULE_QOS_MARKING) ? " " : "", + (route_rule->exception_if_actions[9] == NECP_ROUTE_RULE_QOS_MARKING) ? interface_names[9] : ""); + break; + default: + snprintf(result_string, MAX_RESULT_STRING_LEN, "RouteRules (Unknown)"); + break; } - snprintf(result_string, MAX_RESULT_STRING_LEN, "UseNetAgent (%s)", found_mapping ? uuid_string : "Unknown"); - break; } - case NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED: { - bool found_mapping = FALSE; - struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.netagent_id); - if (mapping != NULL) { - uuid_unparse(mapping->uuid, uuid_string); - found_mapping = TRUE; - } - snprintf(result_string, MAX_RESULT_STRING_LEN, "NetAgentScoped (%s)", found_mapping ? uuid_string : "Unknown"); - break; + break; + } + case NECP_KERNEL_POLICY_RESULT_USE_NETAGENT: { + bool found_mapping = FALSE; + struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.netagent_id); + if (mapping != NULL) { + uuid_unparse(mapping->uuid, uuid_string); + found_mapping = TRUE; } - case NECP_POLICY_RESULT_TRIGGER: { - bool found_mapping = FALSE; - struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.service.identifier); - if (mapping != NULL) { - uuid_unparse(mapping->uuid, uuid_string); - found_mapping = TRUE; - } - snprintf(result_string, MAX_RESULT_STRING_LEN, "Trigger (%s.%d)", found_mapping ? uuid_string : "Unknown", result_parameter.service.data); - break; + snprintf(result_string, MAX_RESULT_STRING_LEN, "UseNetAgent (%s)", found_mapping ? uuid_string : "Unknown"); + break; + } + case NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED: { + bool found_mapping = FALSE; + struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.netagent_id); + if (mapping != NULL) { + uuid_unparse(mapping->uuid, uuid_string); + found_mapping = TRUE; } - case NECP_POLICY_RESULT_TRIGGER_IF_NEEDED: { - bool found_mapping = FALSE; - struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.service.identifier); - if (mapping != NULL) { - uuid_unparse(mapping->uuid, uuid_string); - found_mapping = TRUE; - } - snprintf(result_string, MAX_RESULT_STRING_LEN, "TriggerIfNeeded (%s.%d)", found_mapping ? uuid_string : "Unknown", result_parameter.service.data); - break; + snprintf(result_string, MAX_RESULT_STRING_LEN, "NetAgentScoped (%s)", found_mapping ? uuid_string : "Unknown"); + break; + } + case NECP_POLICY_RESULT_TRIGGER: { + bool found_mapping = FALSE; + struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.service.identifier); + if (mapping != NULL) { + uuid_unparse(mapping->uuid, uuid_string); + found_mapping = TRUE; } - case NECP_POLICY_RESULT_TRIGGER_SCOPED: { - bool found_mapping = FALSE; - struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.service.identifier); - if (mapping != NULL) { - uuid_unparse(mapping->uuid, uuid_string); - found_mapping = TRUE; - } - snprintf(result_string, MAX_RESULT_STRING_LEN, "TriggerScoped (%s.%d)", found_mapping ? uuid_string : "Unknown", result_parameter.service.data); - break; + snprintf(result_string, MAX_RESULT_STRING_LEN, "Trigger (%s.%d)", found_mapping ? uuid_string : "Unknown", result_parameter.service.data); + break; + } + case NECP_POLICY_RESULT_TRIGGER_IF_NEEDED: { + bool found_mapping = FALSE; + struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.service.identifier); + if (mapping != NULL) { + uuid_unparse(mapping->uuid, uuid_string); + found_mapping = TRUE; } - case NECP_POLICY_RESULT_NO_TRIGGER_SCOPED: { - bool found_mapping = FALSE; - struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.service.identifier); - if (mapping != NULL) { - uuid_unparse(mapping->uuid, uuid_string); - found_mapping = TRUE; - } - snprintf(result_string, MAX_RESULT_STRING_LEN, "NoTriggerScoped (%s.%d)", found_mapping ? uuid_string : "Unknown", result_parameter.service.data); - break; + snprintf(result_string, MAX_RESULT_STRING_LEN, "TriggerIfNeeded (%s.%d)", found_mapping ? uuid_string : "Unknown", result_parameter.service.data); + break; + } + case NECP_POLICY_RESULT_TRIGGER_SCOPED: { + bool found_mapping = FALSE; + struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.service.identifier); + if (mapping != NULL) { + uuid_unparse(mapping->uuid, uuid_string); + found_mapping = TRUE; } - default: { - snprintf(result_string, MAX_RESULT_STRING_LEN, "Unknown %d (%d)", result, result_parameter.tunnel_interface_index); - break; + snprintf(result_string, MAX_RESULT_STRING_LEN, "TriggerScoped (%s.%d)", found_mapping ? uuid_string : "Unknown", result_parameter.service.data); + break; + } + case NECP_POLICY_RESULT_NO_TRIGGER_SCOPED: { + bool found_mapping = FALSE; + struct necp_uuid_id_mapping *mapping = necp_uuid_lookup_uuid_with_service_id_locked(result_parameter.service.identifier); + if (mapping != NULL) { + uuid_unparse(mapping->uuid, uuid_string); + found_mapping = TRUE; } + snprintf(result_string, MAX_RESULT_STRING_LEN, "NoTriggerScoped (%s.%d)", found_mapping ? uuid_string : "Unknown", result_parameter.service.data); + break; + } + default: { + snprintf(result_string, MAX_RESULT_STRING_LEN, "Unknown %d (%d)", result, result_parameter.tunnel_interface_index); + break; } - return (result_string); + } + return result_string; } static void @@ -4614,7 +4426,7 @@ necp_kernel_socket_policies_dump_all(void) static inline bool necp_kernel_socket_result_is_trigger_service_type(struct necp_kernel_socket_policy *kernel_policy) { - return (kernel_policy->result >= NECP_KERNEL_POLICY_RESULT_TRIGGER && kernel_policy->result <= NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED); + return kernel_policy->result >= NECP_KERNEL_POLICY_RESULT_TRIGGER && kernel_policy->result <= NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED; } static inline bool @@ -4622,34 +4434,35 @@ necp_kernel_socket_policy_results_overlap(struct necp_kernel_socket_policy *uppe { if (upper_policy->result == NECP_KERNEL_POLICY_RESULT_DROP) { // Drop always cancels out lower policies - return (TRUE); + return TRUE; } else if (upper_policy->result == NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER || - upper_policy->result == NECP_KERNEL_POLICY_RESULT_ROUTE_RULES || - upper_policy->result == NECP_KERNEL_POLICY_RESULT_USE_NETAGENT || - upper_policy->result == NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED) { + upper_policy->result == NECP_KERNEL_POLICY_RESULT_ROUTE_RULES || + upper_policy->result == NECP_KERNEL_POLICY_RESULT_USE_NETAGENT || + upper_policy->result == NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED || + upper_policy->result == NECP_KERNEL_POLICY_RESULT_ALLOW_UNENTITLED) { // Filters and route rules never cancel out lower policies - return (FALSE); + return FALSE; } else if (necp_kernel_socket_result_is_trigger_service_type(upper_policy)) { // Trigger/Scoping policies can overlap one another, but not other results - return (necp_kernel_socket_result_is_trigger_service_type(lower_policy)); + return necp_kernel_socket_result_is_trigger_service_type(lower_policy); } else if (upper_policy->result == NECP_KERNEL_POLICY_RESULT_SKIP) { if (upper_policy->session_order != lower_policy->session_order) { // A skip cannot override a policy of a different session - return (FALSE); + return FALSE; } else { if (upper_policy->result_parameter.skip_policy_order == 0 || - lower_policy->order >= upper_policy->result_parameter.skip_policy_order) { + lower_policy->order >= upper_policy->result_parameter.skip_policy_order) { // This policy is beyond the skip - return (FALSE); + return FALSE; } else { // This policy is inside the skip - return (TRUE); + return TRUE; } } } // A hard pass, flow divert, tunnel, or scope will currently block out lower policies - return (TRUE); + return TRUE; } static bool @@ -4665,7 +4478,7 @@ necp_kernel_socket_policy_is_unnecessary(struct necp_kernel_socket_policy *polic // For policies in a skip window, we can't mark conflicting policies as unnecessary if (can_skip) { if (highest_skip_session_order != compared_policy->session_order || - (highest_skip_order != 0 && compared_policy->order >= highest_skip_order)) { + (highest_skip_order != 0 && compared_policy->order >= highest_skip_order)) { // If we've moved on to the next session, or passed the skip window highest_skip_session_order = 0; highest_skip_order = 0; @@ -4698,9 +4511,14 @@ necp_kernel_socket_policy_is_unnecessary(struct necp_kernel_socket_policy *polic continue; } + // If new policy matches Local Networks, compared policy must also + if ((policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_NETWORKS) && !(compared_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_NETWORKS)) { + continue; + } + // Default makes lower policies unecessary always if (compared_policy->condition_mask == 0) { - return (TRUE); + return TRUE; } // Compared must be more general than policy, and include only conditions within policy @@ -4714,58 +4532,63 @@ necp_kernel_socket_policy_is_unnecessary(struct necp_kernel_socket_policy *polic } if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_DOMAIN && - strcmp(compared_policy->cond_domain, policy->cond_domain) != 0) { + strcmp(compared_policy->cond_domain, policy->cond_domain) != 0) { continue; } if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT && - strcmp(compared_policy->cond_custom_entitlement, policy->cond_custom_entitlement) != 0) { + strcmp(compared_policy->cond_custom_entitlement, policy->cond_custom_entitlement) != 0) { continue; } if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_ACCOUNT_ID && - compared_policy->cond_account_id != policy->cond_account_id) { + compared_policy->cond_account_id != policy->cond_account_id) { continue; } if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_POLICY_ID && - compared_policy->cond_policy_id != policy->cond_policy_id) { + compared_policy->cond_policy_id != policy->cond_policy_id) { continue; } if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_APP_ID && - compared_policy->cond_app_id != policy->cond_app_id) { + compared_policy->cond_app_id != policy->cond_app_id) { continue; } if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_REAL_APP_ID && - compared_policy->cond_real_app_id != policy->cond_real_app_id) { + compared_policy->cond_real_app_id != policy->cond_real_app_id) { continue; } if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_PID && - compared_policy->cond_pid != policy->cond_pid) { + compared_policy->cond_pid != policy->cond_pid) { continue; } if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_UID && - compared_policy->cond_uid != policy->cond_uid) { + compared_policy->cond_uid != policy->cond_uid) { continue; } if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE && - compared_policy->cond_bound_interface != policy->cond_bound_interface) { + compared_policy->cond_bound_interface != policy->cond_bound_interface) { continue; } if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_PROTOCOL && - compared_policy->cond_protocol != policy->cond_protocol) { + compared_policy->cond_protocol != policy->cond_protocol) { + continue; + } + + if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_CLIENT_FLAGS && + compared_policy->cond_client_flags != policy->cond_client_flags) { continue; } if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_TRAFFIC_CLASS && - !(compared_policy->cond_traffic_class.start_tc <= policy->cond_traffic_class.start_tc && - compared_policy->cond_traffic_class.end_tc >= policy->cond_traffic_class.end_tc)) { + !(compared_policy->cond_traffic_class.start_tc <= policy->cond_traffic_class.start_tc && + compared_policy->cond_traffic_class.end_tc >= policy->cond_traffic_class.end_tc)) { continue; } @@ -4776,7 +4599,7 @@ necp_kernel_socket_policy_is_unnecessary(struct necp_kernel_socket_policy *polic } } else if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_PREFIX) { if (compared_policy->cond_local_prefix > policy->cond_local_prefix || - !necp_is_addr_in_subnet((struct sockaddr *)&policy->cond_local_start, (struct sockaddr *)&compared_policy->cond_local_start, compared_policy->cond_local_prefix)) { + !necp_is_addr_in_subnet((struct sockaddr *)&policy->cond_local_start, (struct sockaddr *)&compared_policy->cond_local_start, compared_policy->cond_local_prefix)) { continue; } } @@ -4789,21 +4612,31 @@ necp_kernel_socket_policy_is_unnecessary(struct necp_kernel_socket_policy *polic } } else if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX) { if (compared_policy->cond_remote_prefix > policy->cond_remote_prefix || - !necp_is_addr_in_subnet((struct sockaddr *)&policy->cond_remote_start, (struct sockaddr *)&compared_policy->cond_remote_start, compared_policy->cond_remote_prefix)) { + !necp_is_addr_in_subnet((struct sockaddr *)&policy->cond_remote_start, (struct sockaddr *)&compared_policy->cond_remote_start, compared_policy->cond_remote_prefix)) { continue; } } } if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_AGENT_TYPE && - memcmp(&compared_policy->cond_agent_type, &policy->cond_agent_type, sizeof(policy->cond_agent_type)) == 0) { + memcmp(&compared_policy->cond_agent_type, &policy->cond_agent_type, sizeof(policy->cond_agent_type)) == 0) { + continue; + } + + if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_SDK_VERSION && + memcmp(&compared_policy->cond_sdk_version, &policy->cond_sdk_version, sizeof(policy->cond_sdk_version)) == 0) { + continue; + } + + if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_PACKET_FILTER_TAGS && + memcmp(&compared_policy->cond_packet_filter_tags, &policy->cond_packet_filter_tags, sizeof(policy->cond_packet_filter_tags)) == 0) { continue; } - return (TRUE); + return TRUE; } - return (FALSE); + return FALSE; } static bool @@ -4857,7 +4690,7 @@ necp_kernel_socket_policies_reprocess(void) necp_kernel_socket_policies_count++; if (!(kernel_policy->condition_mask & NECP_KERNEL_CONDITION_APP_ID) || - kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_APP_ID) { + kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_APP_ID) { necp_kernel_socket_policies_non_app_count++; for (app_i = 0; app_i < NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS; app_i++) { bucket_allocation_counts[app_i]++; @@ -4890,7 +4723,7 @@ necp_kernel_socket_policies_reprocess(void) // Fill out maps LIST_FOREACH(kernel_policy, &necp_kernel_socket_policies, chain) { // Add app layer policies - if (!necp_kernel_socket_policy_is_unnecessary(kernel_policy, necp_kernel_socket_policies_app_layer_map, app_layer_current_free_index)) { + if (!necp_dedup_policies || !necp_kernel_socket_policy_is_unnecessary(kernel_policy, necp_kernel_socket_policies_app_layer_map, app_layer_current_free_index)) { necp_kernel_socket_policies_app_layer_map[app_layer_current_free_index] = kernel_policy; app_layer_current_free_index++; necp_kernel_socket_policies_app_layer_map[app_layer_current_free_index] = NULL; @@ -4903,9 +4736,9 @@ necp_kernel_socket_policies_reprocess(void) // Add socket policies if (!(kernel_policy->condition_mask & NECP_KERNEL_CONDITION_APP_ID) || - kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_APP_ID) { + kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_APP_ID) { for (app_i = 0; app_i < NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS; app_i++) { - if (!necp_kernel_socket_policy_is_unnecessary(kernel_policy, necp_kernel_socket_policies_map[app_i], bucket_current_free_index[app_i])) { + if (!necp_dedup_policies || !necp_kernel_socket_policy_is_unnecessary(kernel_policy, necp_kernel_socket_policies_map[app_i], bucket_current_free_index[app_i])) { (necp_kernel_socket_policies_map[app_i])[(bucket_current_free_index[app_i])] = kernel_policy; bucket_current_free_index[app_i]++; (necp_kernel_socket_policies_map[app_i])[(bucket_current_free_index[app_i])] = NULL; @@ -4913,7 +4746,7 @@ necp_kernel_socket_policies_reprocess(void) } } else { app_i = NECP_SOCKET_MAP_APP_ID_TO_BUCKET(kernel_policy->cond_app_id); - if (!necp_kernel_socket_policy_is_unnecessary(kernel_policy, necp_kernel_socket_policies_map[app_i], bucket_current_free_index[app_i])) { + if (!necp_dedup_policies || !necp_kernel_socket_policy_is_unnecessary(kernel_policy, necp_kernel_socket_policies_map[app_i], bucket_current_free_index[app_i])) { (necp_kernel_socket_policies_map[app_i])[(bucket_current_free_index[app_i])] = kernel_policy; bucket_current_free_index[app_i]++; (necp_kernel_socket_policies_map[app_i])[(bucket_current_free_index[app_i])] = NULL; @@ -4922,7 +4755,7 @@ necp_kernel_socket_policies_reprocess(void) } necp_kernel_socket_policies_dump_all(); BUMP_KERNEL_SOCKET_POLICIES_GENERATION_COUNT(); - return (TRUE); + return TRUE; fail: // Free memory, reset masks to 0 @@ -4941,7 +4774,7 @@ fail: FREE(necp_kernel_socket_policies_app_layer_map, M_NECP); necp_kernel_socket_policies_app_layer_map = NULL; } - return (FALSE); + return FALSE; } static u_int32_t @@ -4960,7 +4793,7 @@ necp_get_new_string_id(void) if (wrapped) { // Already wrapped, give up NECPLOG0(LOG_ERR, "Failed to find a free app UUID.\n"); - return (0); + return 0; } necp_last_string_id = 1; wrapped = TRUE; @@ -4970,10 +4803,10 @@ necp_get_new_string_id(void) if (newid == 0) { NECPLOG0(LOG_ERR, "Allocate string id failed.\n"); - return (0); + return 0; } - return (newid); + return newid; } static struct necp_string_id_mapping * @@ -4989,7 +4822,7 @@ necp_lookup_string_to_id_locked(struct necp_string_id_mapping_list *list, char * } } - return (foundentry); + return foundentry; } static struct necp_string_id_mapping * @@ -5005,7 +4838,7 @@ necp_lookup_string_with_id_locked(struct necp_string_id_mapping_list *list, u_in } } - return (foundentry); + return foundentry; } static u_int32_t @@ -5019,7 +4852,7 @@ necp_create_string_to_id_mapping(struct necp_string_id_mapping_list *list, char existing_mapping = necp_lookup_string_to_id_locked(list, string); if (existing_mapping != NULL) { string_id = existing_mapping->id; - existing_mapping->refcount++; + os_ref_retain_locked(&existing_mapping->refcount); } else { struct necp_string_id_mapping *new_mapping = NULL; MALLOC(new_mapping, struct necp_string_id_mapping *, sizeof(struct necp_string_id_mapping), M_NECP, M_WAITOK); @@ -5031,7 +4864,7 @@ necp_create_string_to_id_mapping(struct necp_string_id_mapping_list *list, char if (new_mapping->string != NULL) { memcpy(new_mapping->string, string, length); new_mapping->id = necp_get_new_string_id(); - new_mapping->refcount = 1; + os_ref_init(&new_mapping->refcount, &necp_refgrp); LIST_INSERT_HEAD(list, new_mapping, chain); string_id = new_mapping->id; } else { @@ -5040,7 +4873,7 @@ necp_create_string_to_id_mapping(struct necp_string_id_mapping_list *list, char } } } - return (string_id); + return string_id; } static bool @@ -5052,15 +4885,15 @@ necp_remove_string_to_id_mapping(struct necp_string_id_mapping_list *list, char existing_mapping = necp_lookup_string_to_id_locked(list, string); if (existing_mapping != NULL) { - if (--existing_mapping->refcount == 0) { + if (os_ref_release_locked(&existing_mapping->refcount) == 0) { LIST_REMOVE(existing_mapping, chain); FREE(existing_mapping->string, M_NECP); FREE(existing_mapping, M_NECP); } - return (TRUE); + return TRUE; } - return (FALSE); + return FALSE; } #define NECP_FIRST_VALID_ROUTE_RULE_ID 1 @@ -5081,11 +4914,11 @@ necp_get_new_route_rule_id(bool aggregate) do { necp_last_route_rule_id++; if (necp_last_route_rule_id < NECP_FIRST_VALID_ROUTE_RULE_ID || - necp_last_route_rule_id >= NECP_FIRST_VALID_AGGREGATE_ROUTE_RULE_ID) { + necp_last_route_rule_id >= NECP_FIRST_VALID_AGGREGATE_ROUTE_RULE_ID) { if (wrapped) { // Already wrapped, give up NECPLOG0(LOG_ERR, "Failed to find a free route rule id.\n"); - return (0); + return 0; } necp_last_route_rule_id = NECP_FIRST_VALID_ROUTE_RULE_ID; wrapped = TRUE; @@ -5103,7 +4936,7 @@ necp_get_new_route_rule_id(bool aggregate) if (wrapped) { // Already wrapped, give up NECPLOG0(LOG_ERR, "Failed to find a free aggregate route rule id.\n"); - return (0); + return 0; } necp_last_aggregate_route_rule_id = NECP_FIRST_VALID_AGGREGATE_ROUTE_RULE_ID; wrapped = TRUE; @@ -5114,10 +4947,10 @@ necp_get_new_route_rule_id(bool aggregate) if (newid == 0) { NECPLOG0(LOG_ERR, "Allocate route rule ID failed.\n"); - return (0); + return 0; } - return (newid); + return newid; } static struct necp_route_rule * @@ -5133,21 +4966,22 @@ necp_lookup_route_rule_locked(struct necp_route_rule_list *list, u_int32_t route } } - return (foundentry); + return foundentry; } static struct necp_route_rule * -necp_lookup_route_rule_by_contents_locked(struct necp_route_rule_list *list, u_int32_t default_action, u_int8_t cellular_action, u_int8_t wifi_action, u_int8_t wired_action, u_int8_t expensive_action, u_int32_t *if_indices, u_int8_t *if_actions) +necp_lookup_route_rule_by_contents_locked(struct necp_route_rule_list *list, u_int32_t default_action, u_int8_t cellular_action, u_int8_t wifi_action, u_int8_t wired_action, u_int8_t expensive_action, u_int8_t constrained_action, u_int32_t *if_indices, u_int8_t *if_actions) { struct necp_route_rule *searchentry = NULL; struct necp_route_rule *foundentry = NULL; LIST_FOREACH(searchentry, list, chain) { if (searchentry->default_action == default_action && - searchentry->cellular_action == cellular_action && - searchentry->wifi_action == wifi_action && - searchentry->wired_action == wired_action && - searchentry->expensive_action == expensive_action) { + searchentry->cellular_action == cellular_action && + searchentry->wifi_action == wifi_action && + searchentry->wired_action == wired_action && + searchentry->expensive_action == expensive_action && + searchentry->constrained_action == constrained_action) { bool match_failed = FALSE; size_t index_a = 0; size_t index_b = 0; @@ -5167,7 +5001,7 @@ necp_lookup_route_rule_by_contents_locked(struct necp_route_rule_list *list, u_i count_b = index_b + 1; } if (searchentry->exception_if_indices[index_a] == if_indices[index_b] && - searchentry->exception_if_actions[index_a] == if_actions[index_b]) { + searchentry->exception_if_actions[index_a] == if_actions[index_b]) { found_index = TRUE; break; } @@ -5184,7 +5018,7 @@ necp_lookup_route_rule_by_contents_locked(struct necp_route_rule_list *list, u_i } } - return (foundentry); + return foundentry; } static u_int32_t @@ -5198,6 +5032,7 @@ necp_create_route_rule(struct necp_route_rule_list *list, u_int8_t *route_rules_ u_int8_t wifi_action = NECP_ROUTE_RULE_NONE; u_int8_t wired_action = NECP_ROUTE_RULE_NONE; u_int8_t expensive_action = NECP_ROUTE_RULE_NONE; + u_int8_t constrained_action = NECP_ROUTE_RULE_NONE; u_int32_t if_indices[MAX_ROUTE_RULE_INTERFACES]; size_t num_valid_indices = 0; memset(&if_indices, 0, sizeof(if_indices)); @@ -5207,7 +5042,7 @@ necp_create_route_rule(struct necp_route_rule_list *list, u_int8_t *route_rules_ LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE); if (route_rules_array == NULL || route_rules_array_size == 0) { - return (0); + return 0; } // Process rules @@ -5240,6 +5075,9 @@ necp_create_route_rule(struct necp_route_rule_list *list, u_int8_t *route_rules_ if (rule_flags & NECP_ROUTE_RULE_FLAG_EXPENSIVE) { expensive_action = rule_type; } + if (rule_flags & NECP_ROUTE_RULE_FLAG_CONSTRAINED) { + constrained_action = rule_type; + } if (rule_flags == 0) { default_action = rule_type; } @@ -5264,10 +5102,10 @@ necp_create_route_rule(struct necp_route_rule_list *list, u_int8_t *route_rules_ offset += sizeof(u_int8_t) + sizeof(u_int32_t) + length; } - existing_rule = necp_lookup_route_rule_by_contents_locked(list, default_action, cellular_action, wifi_action, wired_action, expensive_action, if_indices, if_actions); + existing_rule = necp_lookup_route_rule_by_contents_locked(list, default_action, cellular_action, wifi_action, wired_action, expensive_action, constrained_action, if_indices, if_actions); if (existing_rule != NULL) { route_rule_id = existing_rule->id; - existing_rule->refcount++; + os_ref_retain_locked(&existing_rule->refcount); } else { struct necp_route_rule *new_rule = NULL; MALLOC(new_rule, struct necp_route_rule *, sizeof(struct necp_route_rule), M_NECP, M_WAITOK); @@ -5279,13 +5117,14 @@ necp_create_route_rule(struct necp_route_rule_list *list, u_int8_t *route_rules_ new_rule->wifi_action = wifi_action; new_rule->wired_action = wired_action; new_rule->expensive_action = expensive_action; + new_rule->constrained_action = constrained_action; memcpy(&new_rule->exception_if_indices, &if_indices, sizeof(if_indices)); memcpy(&new_rule->exception_if_actions, &if_actions, sizeof(if_actions)); - new_rule->refcount = 1; + os_ref_init(&new_rule->refcount, &necp_refgrp); LIST_INSERT_HEAD(list, new_rule, chain); } } - return (route_rule_id); + return route_rule_id; } static void @@ -5322,15 +5161,15 @@ necp_remove_route_rule(struct necp_route_rule_list *list, u_int32_t route_rule_i existing_rule = necp_lookup_route_rule_locked(list, route_rule_id); if (existing_rule != NULL) { - if (--existing_rule->refcount == 0) { + if (os_ref_release_locked(&existing_rule->refcount) == 0) { necp_remove_aggregate_route_rule_for_id(existing_rule->id); LIST_REMOVE(existing_rule, chain); FREE(existing_rule, M_NECP); } - return (TRUE); + return TRUE; } - return (FALSE); + return FALSE; } static struct necp_aggregate_route_rule * @@ -5350,7 +5189,7 @@ necp_lookup_aggregate_route_rule_locked(u_int32_t route_rule_id) lck_rw_done(&necp_route_rule_lock); - return (foundentry); + return foundentry; } static u_int32_t @@ -5360,19 +5199,13 @@ necp_create_aggregate_route_rule(u_int32_t *rule_ids) struct necp_aggregate_route_rule *new_rule = NULL; struct necp_aggregate_route_rule *existing_rule = NULL; - LIST_FOREACH(existing_rule, &necp_aggregate_route_rules, chain) { - if (memcmp(existing_rule->rule_ids, rule_ids, (sizeof(u_int32_t) * MAX_AGGREGATE_ROUTE_RULES)) == 0) { - return (existing_rule->id); - } - } - lck_rw_lock_exclusive(&necp_route_rule_lock); + // Check if the rule already exists LIST_FOREACH(existing_rule, &necp_aggregate_route_rules, chain) { - // Re-check, in case something else created the rule while we are waiting to lock if (memcmp(existing_rule->rule_ids, rule_ids, (sizeof(u_int32_t) * MAX_AGGREGATE_ROUTE_RULES)) == 0) { lck_rw_done(&necp_route_rule_lock); - return (existing_rule->id); + return existing_rule->id; } } @@ -5386,7 +5219,7 @@ necp_create_aggregate_route_rule(u_int32_t *rule_ids) } lck_rw_done(&necp_route_rule_lock); - return (aggregate_route_rule_id); + return aggregate_route_rule_id; } #define NECP_NULL_SERVICE_ID 1 @@ -5407,11 +5240,11 @@ necp_get_new_uuid_id(bool service) do { necp_last_service_uuid_id++; if (necp_last_service_uuid_id < NECP_FIRST_VALID_SERVICE_ID || - necp_last_service_uuid_id >= NECP_FIRST_VALID_APP_ID) { + necp_last_service_uuid_id >= NECP_FIRST_VALID_APP_ID) { if (wrapped) { // Already wrapped, give up NECPLOG0(LOG_ERR, "Failed to find a free service UUID.\n"); - return (NECP_NULL_SERVICE_ID); + return NECP_NULL_SERVICE_ID; } necp_last_service_uuid_id = NECP_FIRST_VALID_SERVICE_ID; wrapped = TRUE; @@ -5426,7 +5259,7 @@ necp_get_new_uuid_id(bool service) if (wrapped) { // Already wrapped, give up NECPLOG0(LOG_ERR, "Failed to find a free app UUID.\n"); - return (NECP_NULL_SERVICE_ID); + return NECP_NULL_SERVICE_ID; } necp_last_app_uuid_id = NECP_FIRST_VALID_APP_ID; wrapped = TRUE; @@ -5437,10 +5270,10 @@ necp_get_new_uuid_id(bool service) if (newid == NECP_NULL_SERVICE_ID) { NECPLOG0(LOG_ERR, "Allocate uuid ID failed.\n"); - return (NECP_NULL_SERVICE_ID); + return NECP_NULL_SERVICE_ID; } - return (newid); + return newid; } static struct necp_uuid_id_mapping * @@ -5456,7 +5289,7 @@ necp_uuid_lookup_app_id_locked(uuid_t uuid) } } - return (foundentry); + return foundentry; } static struct necp_uuid_id_mapping * @@ -5475,7 +5308,7 @@ necp_uuid_lookup_uuid_with_app_id_locked(u_int32_t local_id) } } - return (foundentry); + return foundentry; } static u_int32_t @@ -5493,9 +5326,9 @@ necp_create_uuid_app_id_mapping(uuid_t uuid, bool *allocated_mapping, bool uuid_ existing_mapping = necp_uuid_lookup_app_id_locked(uuid); if (existing_mapping != NULL) { local_id = existing_mapping->id; - existing_mapping->refcount++; + os_ref_retain_locked(&existing_mapping->refcount); if (uuid_policy_table) { - existing_mapping->table_refcount++; + existing_mapping->table_usecount++; } } else { struct necp_uuid_id_mapping *new_mapping = NULL; @@ -5503,11 +5336,11 @@ necp_create_uuid_app_id_mapping(uuid_t uuid, bool *allocated_mapping, bool uuid_ if (new_mapping != NULL) { uuid_copy(new_mapping->uuid, uuid); new_mapping->id = necp_get_new_uuid_id(false); - new_mapping->refcount = 1; + os_ref_init(&new_mapping->refcount, &necp_refgrp); if (uuid_policy_table) { - new_mapping->table_refcount = 1; + new_mapping->table_usecount = 1; } else { - new_mapping->table_refcount = 0; + new_mapping->table_usecount = 0; } LIST_INSERT_HEAD(APPUUIDHASH(uuid), new_mapping, chain); @@ -5520,7 +5353,7 @@ necp_create_uuid_app_id_mapping(uuid_t uuid, bool *allocated_mapping, bool uuid_ } } - return (local_id); + return local_id; } static bool @@ -5537,19 +5370,19 @@ necp_remove_uuid_app_id_mapping(uuid_t uuid, bool *removed_mapping, bool uuid_po existing_mapping = necp_uuid_lookup_app_id_locked(uuid); if (existing_mapping != NULL) { if (uuid_policy_table) { - existing_mapping->table_refcount--; + existing_mapping->table_usecount--; } - if (--existing_mapping->refcount == 0) { + if (os_ref_release_locked(&existing_mapping->refcount) == 0) { LIST_REMOVE(existing_mapping, chain); FREE(existing_mapping, M_NECP); if (removed_mapping) { *removed_mapping = TRUE; } } - return (TRUE); + return TRUE; } - return (FALSE); + return FALSE; } static struct necp_uuid_id_mapping * @@ -5559,7 +5392,7 @@ necp_uuid_get_null_service_id_mapping(void) uuid_clear(null_mapping.uuid); null_mapping.id = NECP_NULL_SERVICE_ID; - return (&null_mapping); + return &null_mapping; } static struct necp_uuid_id_mapping * @@ -5579,7 +5412,7 @@ necp_uuid_lookup_service_id_locked(uuid_t uuid) } } - return (foundentry); + return foundentry; } static struct necp_uuid_id_mapping * @@ -5599,7 +5432,7 @@ necp_uuid_lookup_uuid_with_service_id_locked(u_int32_t local_id) } } - return (foundentry); + return foundentry; } static u_int32_t @@ -5609,7 +5442,7 @@ necp_create_uuid_service_id_mapping(uuid_t uuid) struct necp_uuid_id_mapping *existing_mapping = NULL; if (uuid_is_null(uuid)) { - return (NECP_NULL_SERVICE_ID); + return NECP_NULL_SERVICE_ID; } LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE); @@ -5617,14 +5450,14 @@ necp_create_uuid_service_id_mapping(uuid_t uuid) existing_mapping = necp_uuid_lookup_service_id_locked(uuid); if (existing_mapping != NULL) { local_id = existing_mapping->id; - existing_mapping->refcount++; + os_ref_retain_locked(&existing_mapping->refcount); } else { struct necp_uuid_id_mapping *new_mapping = NULL; MALLOC(new_mapping, struct necp_uuid_id_mapping *, sizeof(*new_mapping), M_NECP, M_WAITOK); if (new_mapping != NULL) { uuid_copy(new_mapping->uuid, uuid); new_mapping->id = necp_get_new_uuid_id(true); - new_mapping->refcount = 1; + os_ref_init(&new_mapping->refcount, &necp_refgrp); LIST_INSERT_HEAD(&necp_uuid_service_id_list, new_mapping, chain); @@ -5632,7 +5465,7 @@ necp_create_uuid_service_id_mapping(uuid_t uuid) } } - return (local_id); + return local_id; } static bool @@ -5641,21 +5474,21 @@ necp_remove_uuid_service_id_mapping(uuid_t uuid) struct necp_uuid_id_mapping *existing_mapping = NULL; if (uuid_is_null(uuid)) { - return (TRUE); + return TRUE; } LCK_RW_ASSERT(&necp_kernel_policy_lock, LCK_RW_ASSERT_EXCLUSIVE); - existing_mapping = necp_uuid_lookup_app_id_locked(uuid); + existing_mapping = necp_uuid_lookup_service_id_locked(uuid); if (existing_mapping != NULL) { - if (--existing_mapping->refcount == 0) { + if (os_ref_release_locked(&existing_mapping->refcount) == 0) { LIST_REMOVE(existing_mapping, chain); FREE(existing_mapping, M_NECP); } - return (TRUE); + return TRUE; } - return (FALSE); + return FALSE; } @@ -5667,7 +5500,7 @@ necp_kernel_socket_policies_update_uuid_table(void) if (necp_uuid_app_id_mappings_dirty) { if (proc_uuid_policy_kernel(PROC_UUID_POLICY_OPERATION_CLEAR, NULL, PROC_UUID_NECP_APP_POLICY) < 0) { NECPLOG0(LOG_DEBUG, "Error clearing uuids from policy table\n"); - return (FALSE); + return FALSE; } if (necp_num_uuid_app_id_mappings > 0) { @@ -5675,8 +5508,8 @@ necp_kernel_socket_policies_update_uuid_table(void) for (uuid_list_head = &necp_uuid_app_id_hashtbl[necp_uuid_app_id_hash_num_buckets - 1]; uuid_list_head >= necp_uuid_app_id_hashtbl; uuid_list_head--) { struct necp_uuid_id_mapping *mapping = NULL; LIST_FOREACH(mapping, uuid_list_head, chain) { - if (mapping->table_refcount > 0 && - proc_uuid_policy_kernel(PROC_UUID_POLICY_OPERATION_ADD, mapping->uuid, PROC_UUID_NECP_APP_POLICY) < 0) { + if (mapping->table_usecount > 0 && + proc_uuid_policy_kernel(PROC_UUID_POLICY_OPERATION_ADD, mapping->uuid, PROC_UUID_NECP_APP_POLICY) < 0) { NECPLOG0(LOG_DEBUG, "Error adding uuid to policy table\n"); } } @@ -5686,22 +5519,17 @@ necp_kernel_socket_policies_update_uuid_table(void) necp_uuid_app_id_mappings_dirty = FALSE; } - return (TRUE); + return TRUE; } -#define NECP_KERNEL_VALID_IP_OUTPUT_CONDITIONS (NECP_KERNEL_CONDITION_ALL_INTERFACES | NECP_KERNEL_CONDITION_BOUND_INTERFACE | NECP_KERNEL_CONDITION_PROTOCOL | NECP_KERNEL_CONDITION_LOCAL_START | NECP_KERNEL_CONDITION_LOCAL_END | NECP_KERNEL_CONDITION_LOCAL_PREFIX | NECP_KERNEL_CONDITION_REMOTE_START | NECP_KERNEL_CONDITION_REMOTE_END | NECP_KERNEL_CONDITION_REMOTE_PREFIX | NECP_KERNEL_CONDITION_POLICY_ID | NECP_KERNEL_CONDITION_LAST_INTERFACE) +#define NECP_KERNEL_VALID_IP_OUTPUT_CONDITIONS (NECP_KERNEL_CONDITION_ALL_INTERFACES | NECP_KERNEL_CONDITION_BOUND_INTERFACE | NECP_KERNEL_CONDITION_PROTOCOL | NECP_KERNEL_CONDITION_LOCAL_START | NECP_KERNEL_CONDITION_LOCAL_END | NECP_KERNEL_CONDITION_LOCAL_PREFIX | NECP_KERNEL_CONDITION_REMOTE_START | NECP_KERNEL_CONDITION_REMOTE_END | NECP_KERNEL_CONDITION_REMOTE_PREFIX | NECP_KERNEL_CONDITION_POLICY_ID | NECP_KERNEL_CONDITION_LAST_INTERFACE | NECP_KERNEL_CONDITION_LOCAL_NETWORKS | NECP_KERNEL_CONDITION_PACKET_FILTER_TAGS) static necp_kernel_policy_id -necp_kernel_ip_output_policy_add(necp_policy_order order, necp_policy_order suborder, u_int32_t session_order, int session_pid, u_int32_t condition_mask, u_int32_t condition_negated_mask, necp_kernel_policy_id cond_policy_id, ifnet_t cond_bound_interface, u_int32_t cond_last_interface_index, u_int16_t cond_protocol, union necp_sockaddr_union *cond_local_start, union necp_sockaddr_union *cond_local_end, u_int8_t cond_local_prefix, union necp_sockaddr_union *cond_remote_start, union necp_sockaddr_union *cond_remote_end, u_int8_t cond_remote_prefix, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter) +necp_kernel_ip_output_policy_add(necp_policy_order order, necp_policy_order suborder, u_int32_t session_order, int session_pid, u_int32_t condition_mask, u_int32_t condition_negated_mask, necp_kernel_policy_id cond_policy_id, ifnet_t cond_bound_interface, u_int32_t cond_last_interface_index, u_int16_t cond_protocol, union necp_sockaddr_union *cond_local_start, union necp_sockaddr_union *cond_local_end, u_int8_t cond_local_prefix, union necp_sockaddr_union *cond_remote_start, union necp_sockaddr_union *cond_remote_end, u_int8_t cond_remote_prefix, u_int16_t cond_packet_filter_tags, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter) { struct necp_kernel_ip_output_policy *new_kernel_policy = NULL; struct necp_kernel_ip_output_policy *tmp_kernel_policy = NULL; - MALLOC_ZONE(new_kernel_policy, struct necp_kernel_ip_output_policy *, sizeof(*new_kernel_policy), M_NECP_IP_POLICY, M_WAITOK); - if (new_kernel_policy == NULL) { - goto done; - } - - memset(new_kernel_policy, 0, sizeof(*new_kernel_policy)); // M_ZERO is not supported for MALLOC_ZONE + new_kernel_policy = zalloc_flags(necp_ip_policy_zone, Z_WAITOK | Z_ZERO); new_kernel_policy->id = necp_kernel_policy_get_new_id(false); new_kernel_policy->suborder = suborder; new_kernel_policy->order = order; @@ -5755,6 +5583,9 @@ necp_kernel_ip_output_policy_add(necp_policy_order order, necp_policy_order subo if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX) { new_kernel_policy->cond_remote_prefix = cond_remote_prefix; } + if (new_kernel_policy->condition_mask & NECP_KERNEL_CONDITION_PACKET_FILTER_TAGS) { + new_kernel_policy->cond_packet_filter_tags = cond_packet_filter_tags; + } new_kernel_policy->result = result; memcpy(&new_kernel_policy->result_parameter, &result_parameter, sizeof(result_parameter)); @@ -5763,8 +5594,8 @@ necp_kernel_ip_output_policy_add(necp_policy_order order, necp_policy_order subo NECPLOG(LOG_DEBUG, "Added kernel policy: ip output, id=%d, mask=%x\n", new_kernel_policy->id, new_kernel_policy->condition_mask); } LIST_INSERT_SORTED_THRICE_ASCENDING(&necp_kernel_ip_output_policies, new_kernel_policy, chain, session_order, order, suborder, tmp_kernel_policy); -done: - return (new_kernel_policy ? new_kernel_policy->id : 0); + + return new_kernel_policy ? new_kernel_policy->id : 0; } static struct necp_kernel_ip_output_policy * @@ -5774,16 +5605,16 @@ necp_kernel_ip_output_policy_find(necp_kernel_policy_id policy_id) struct necp_kernel_ip_output_policy *tmp_kernel_policy = NULL; if (policy_id == 0) { - return (NULL); + return NULL; } LIST_FOREACH_SAFE(kernel_policy, &necp_kernel_ip_output_policies, chain, tmp_kernel_policy) { if (kernel_policy->id == policy_id) { - return (kernel_policy); + return kernel_policy; } } - return (NULL); + return NULL; } static bool @@ -5802,11 +5633,11 @@ necp_kernel_ip_output_policy_delete(necp_kernel_policy_id policy_id) policy->cond_bound_interface = NULL; } - FREE_ZONE(policy, sizeof(*policy), M_NECP_IP_POLICY); - return (TRUE); + zfree(necp_ip_policy_zone, policy); + return TRUE; } - return (FALSE); + return FALSE; } static void @@ -5841,21 +5672,21 @@ necp_kernel_ip_output_policy_results_overlap(struct necp_kernel_ip_output_policy if (upper_policy->result == NECP_KERNEL_POLICY_RESULT_SKIP) { if (upper_policy->session_order != lower_policy->session_order) { // A skip cannot override a policy of a different session - return (FALSE); + return FALSE; } else { if (upper_policy->result_parameter.skip_policy_order == 0 || - lower_policy->order >= upper_policy->result_parameter.skip_policy_order) { + lower_policy->order >= upper_policy->result_parameter.skip_policy_order) { // This policy is beyond the skip - return (FALSE); + return FALSE; } else { // This policy is inside the skip - return (TRUE); + return TRUE; } } } // All other IP Output policy results (drop, tunnel, hard pass) currently overlap - return (TRUE); + return TRUE; } static bool @@ -5871,7 +5702,7 @@ necp_kernel_ip_output_policy_is_unnecessary(struct necp_kernel_ip_output_policy // For policies in a skip window, we can't mark conflicting policies as unnecessary if (can_skip) { if (highest_skip_session_order != compared_policy->session_order || - (highest_skip_order != 0 && compared_policy->order >= highest_skip_order)) { + (highest_skip_order != 0 && compared_policy->order >= highest_skip_order)) { // If we've moved on to the next session, or passed the skip window highest_skip_session_order = 0; highest_skip_order = 0; @@ -5904,9 +5735,14 @@ necp_kernel_ip_output_policy_is_unnecessary(struct necp_kernel_ip_output_policy continue; } + // If new policy matches Local Networks, compared policy must also + if ((policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_NETWORKS) && !(compared_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_NETWORKS)) { + continue; + } + // Default makes lower policies unecessary always if (compared_policy->condition_mask == 0) { - return (TRUE); + return TRUE; } // Compared must be more general than policy, and include only conditions within policy @@ -5920,17 +5756,17 @@ necp_kernel_ip_output_policy_is_unnecessary(struct necp_kernel_ip_output_policy } if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_POLICY_ID && - compared_policy->cond_policy_id != policy->cond_policy_id) { + compared_policy->cond_policy_id != policy->cond_policy_id) { continue; } if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE && - compared_policy->cond_bound_interface != policy->cond_bound_interface) { + compared_policy->cond_bound_interface != policy->cond_bound_interface) { continue; } if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_PROTOCOL && - compared_policy->cond_protocol != policy->cond_protocol) { + compared_policy->cond_protocol != policy->cond_protocol) { continue; } @@ -5941,7 +5777,7 @@ necp_kernel_ip_output_policy_is_unnecessary(struct necp_kernel_ip_output_policy } } else if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_PREFIX) { if (compared_policy->cond_local_prefix > policy->cond_local_prefix || - !necp_is_addr_in_subnet((struct sockaddr *)&policy->cond_local_start, (struct sockaddr *)&compared_policy->cond_local_start, compared_policy->cond_local_prefix)) { + !necp_is_addr_in_subnet((struct sockaddr *)&policy->cond_local_start, (struct sockaddr *)&compared_policy->cond_local_start, compared_policy->cond_local_prefix)) { continue; } } @@ -5954,16 +5790,16 @@ necp_kernel_ip_output_policy_is_unnecessary(struct necp_kernel_ip_output_policy } } else if (compared_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX) { if (compared_policy->cond_remote_prefix > policy->cond_remote_prefix || - !necp_is_addr_in_subnet((struct sockaddr *)&policy->cond_remote_start, (struct sockaddr *)&compared_policy->cond_remote_start, compared_policy->cond_remote_prefix)) { + !necp_is_addr_in_subnet((struct sockaddr *)&policy->cond_remote_start, (struct sockaddr *)&compared_policy->cond_remote_start, compared_policy->cond_remote_prefix)) { continue; } } } - return (TRUE); + return TRUE; } - return (FALSE); + return FALSE; } static bool @@ -5998,9 +5834,11 @@ necp_kernel_ip_output_policies_reprocess(void) /* Update bucket counts: * Non-id and SKIP policies will be added to all buckets + * Add local networks policy to all buckets for incoming IP */ if (!(kernel_policy->condition_mask & NECP_KERNEL_CONDITION_POLICY_ID) || - kernel_policy->result == NECP_KERNEL_POLICY_RESULT_SKIP) { + (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_NETWORKS) || + kernel_policy->result == NECP_KERNEL_POLICY_RESULT_SKIP) { for (i = 0; i < NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS; i++) { bucket_allocation_counts[i]++; } @@ -6029,9 +5867,10 @@ necp_kernel_ip_output_policies_reprocess(void) LIST_FOREACH(kernel_policy, &necp_kernel_ip_output_policies, chain) { // Insert pointers into map if (!(kernel_policy->condition_mask & NECP_KERNEL_CONDITION_POLICY_ID) || - kernel_policy->result == NECP_KERNEL_POLICY_RESULT_SKIP) { + (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_NETWORKS) || + kernel_policy->result == NECP_KERNEL_POLICY_RESULT_SKIP) { for (i = 0; i < NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS; i++) { - if (!necp_kernel_ip_output_policy_is_unnecessary(kernel_policy, necp_kernel_ip_output_policies_map[i], bucket_current_free_index[i])) { + if (!necp_dedup_policies || !necp_kernel_ip_output_policy_is_unnecessary(kernel_policy, necp_kernel_ip_output_policies_map[i], bucket_current_free_index[i])) { (necp_kernel_ip_output_policies_map[i])[(bucket_current_free_index[i])] = kernel_policy; bucket_current_free_index[i]++; (necp_kernel_ip_output_policies_map[i])[(bucket_current_free_index[i])] = NULL; @@ -6039,7 +5878,7 @@ necp_kernel_ip_output_policies_reprocess(void) } } else { i = NECP_IP_OUTPUT_MAP_ID_TO_BUCKET(kernel_policy->cond_policy_id); - if (!necp_kernel_ip_output_policy_is_unnecessary(kernel_policy, necp_kernel_ip_output_policies_map[i], bucket_current_free_index[i])) { + if (!necp_dedup_policies || !necp_kernel_ip_output_policy_is_unnecessary(kernel_policy, necp_kernel_ip_output_policies_map[i], bucket_current_free_index[i])) { (necp_kernel_ip_output_policies_map[i])[(bucket_current_free_index[i])] = kernel_policy; bucket_current_free_index[i]++; (necp_kernel_ip_output_policies_map[i])[(bucket_current_free_index[i])] = NULL; @@ -6047,7 +5886,7 @@ necp_kernel_ip_output_policies_reprocess(void) } } necp_kernel_ip_output_policies_dump_all(); - return (TRUE); + return TRUE; fail: // Free memory, reset mask to 0 @@ -6060,7 +5899,7 @@ fail: necp_kernel_ip_output_policies_map[i] = NULL; } } - return (FALSE); + return FALSE; } // Outbound Policy Matching @@ -6086,7 +5925,7 @@ necp_trim_dots_and_stars(char *string, size_t length) sub.length--; } - return (sub); + return sub; } static char * @@ -6097,13 +5936,13 @@ necp_create_trimmed_domain(char *string, size_t length) MALLOC(trimmed_domain, char *, sub.length + 1, M_NECP, M_WAITOK); if (trimmed_domain == NULL) { - return (NULL); + return NULL; } memcpy(trimmed_domain, sub.string, sub.length); trimmed_domain[sub.length] = 0; - return (trimmed_domain); + return trimmed_domain; } static inline int @@ -6118,33 +5957,33 @@ necp_count_dots(char *string, size_t length) } } - return (dot_count); + return dot_count; } static bool necp_check_suffix(struct substring parent, struct substring suffix, bool require_dot_before_suffix) { if (parent.length <= suffix.length) { - return (FALSE); + return FALSE; } size_t length_difference = (parent.length - suffix.length); if (require_dot_before_suffix) { if (((char *)(parent.string + length_difference - 1))[0] != '.') { - return (FALSE); + return FALSE; } } // strncasecmp does case-insensitive check for all UTF-8 strings (ignores non-ASCII characters) - return (strncasecmp(parent.string + length_difference, suffix.string, suffix.length) == 0); + return strncasecmp(parent.string + length_difference, suffix.string, suffix.length) == 0; } static bool necp_hostname_matches_domain(struct substring hostname_substring, u_int8_t hostname_dot_count, char *domain, u_int8_t domain_dot_count) { if (hostname_substring.string == NULL || domain == NULL) { - return (hostname_substring.string == domain); + return hostname_substring.string == domain; } struct substring domain_substring; @@ -6154,32 +5993,56 @@ necp_hostname_matches_domain(struct substring hostname_substring, u_int8_t hostn if (hostname_dot_count == domain_dot_count) { // strncasecmp does case-insensitive check for all UTF-8 strings (ignores non-ASCII characters) if (hostname_substring.length == domain_substring.length && - strncasecmp(hostname_substring.string, domain_substring.string, hostname_substring.length) == 0) { - return (TRUE); + strncasecmp(hostname_substring.string, domain_substring.string, hostname_substring.length) == 0) { + return TRUE; } } else if (domain_dot_count < hostname_dot_count) { if (necp_check_suffix(hostname_substring, domain_substring, TRUE)) { - return (TRUE); + return TRUE; } } - return (FALSE); + return FALSE; +} + +bool +net_domain_contains_hostname(char *hostname_string, char *domain_string) +{ + if (hostname_string == NULL || + domain_string == NULL) { + return false; + } + + struct substring hostname_substring; + hostname_substring.string = hostname_string; + hostname_substring.length = strlen(hostname_string); + + return necp_hostname_matches_domain(hostname_substring, + necp_count_dots(hostname_string, hostname_substring.length), + domain_string, + necp_count_dots(domain_string, strlen(domain_string))); } +#define NECP_MAX_STRING_LEN 1024 + static char * necp_copy_string(char *string, size_t length) { char *copied_string = NULL; + if (length > NECP_MAX_STRING_LEN) { + return NULL; + } + MALLOC(copied_string, char *, length + 1, M_NECP, M_WAITOK); if (copied_string == NULL) { - return (NULL); + return NULL; } memcpy(copied_string, string, length); copied_string[length] = 0; - return (copied_string); + return copied_string; } static u_int32_t @@ -6192,7 +6055,7 @@ necp_get_primary_direct_interface_index(void) TAILQ_FOREACH(ordered_interface, &ifnet_ordered_head, if_ordered_link) { const u_int8_t functional_type = if_functional_type(ordered_interface, TRUE); if (functional_type != IFRTYPE_FUNCTIONAL_UNKNOWN && - functional_type != IFRTYPE_FUNCTIONAL_LOOPBACK) { + functional_type != IFRTYPE_FUNCTIONAL_LOOPBACK) { // All known, non-loopback functional types represent direct physical interfaces (Wi-Fi, Cellular, Wired) interface_index = ordered_interface->if_index; break; @@ -6207,34 +6070,106 @@ static inline void necp_get_parent_cred_result(proc_t proc, struct necp_socket_info *info) { task_t task = proc_task(proc ? proc : current_proc()); - coalition_t coal = COALITION_NULL; - Boolean is_leader = coalition_is_leader(task, COALITION_TYPE_JETSAM, &coal); + coalition_t coal = task_get_coalition(task, COALITION_TYPE_JETSAM); - if (is_leader == TRUE) { + if (coal == COALITION_NULL || coalition_is_leader(task, coal)) { // No parent, nothing to do return; } - if (coal != NULL) { - task_t lead_task = coalition_get_leader(coal); - if (lead_task != NULL) { - proc_t lead_proc = get_bsdtask_info(lead_task); - if (lead_proc != NULL) { - kauth_cred_t lead_cred = kauth_cred_proc_ref(lead_proc); - if (lead_cred != NULL) { - errno_t cred_result = priv_check_cred(lead_cred, PRIV_NET_PRIVILEGED_NECP_MATCH, 0); - kauth_cred_unref(&lead_cred); - info->cred_result = cred_result; - } + task_t lead_task = coalition_get_leader(coal); + if (lead_task != NULL) { + proc_t lead_proc = get_bsdtask_info(lead_task); + if (lead_proc != NULL) { + kauth_cred_t lead_cred = kauth_cred_proc_ref(lead_proc); + if (lead_cred != NULL) { + errno_t cred_result = priv_check_cred(lead_cred, PRIV_NET_PRIVILEGED_NECP_MATCH, 0); + kauth_cred_unref(&lead_cred); + info->cred_result = cred_result; } - task_deallocate(lead_task); } + task_deallocate(lead_task); + } +} + +// Some processes, due to particular entitlements, require using an NECP client to +// access networking. Returns true if the result should be a Drop. +static inline bool +necp_check_missing_client_drop(proc_t proc, struct necp_socket_info *info) +{ + task_t task = proc_task(proc ? proc : current_proc()); + + if (!info->has_client && + task != NULL && + IOTaskHasEntitlement(task, "com.apple.developer.on-demand-install-capable")) { + // Drop connections that don't use NECP clients and have the + // com.apple.developer.on-demand-install-capable entitlement. + // This effectively restricts those processes to only using + // an NECP-aware path for networking. + return true; + } else { + return false; + } +} + +static inline bool +necp_check_restricted_multicast_drop(proc_t proc, struct necp_socket_info *info, bool check_minor_version) +{ + if (!necp_restrict_multicast || proc == NULL) { + return false; + } + + // Check for multicast/broadcast here + if (info->remote_addr.sa.sa_family == AF_INET) { + if (!IN_MULTICAST(ntohl(info->remote_addr.sin.sin_addr.s_addr)) && + info->remote_addr.sin.sin_addr.s_addr != INADDR_BROADCAST) { + return false; + } + } else if (info->remote_addr.sa.sa_family == AF_INET6) { + if (!IN6_IS_ADDR_MULTICAST(&info->remote_addr.sin6.sin6_addr)) { + return false; + } + } else { + // Not IPv4/IPv6 + return false; + } + + if (necp_is_platform_binary(proc)) { + return false; + } + + const uint32_t platform = proc_platform(proc); + const uint32_t sdk = proc_sdk(proc); + + // Enforce for iOS, linked on or after version 14 + // If the caller set `check_minor_version`, only enforce starting at 14.TBD + if (platform != PLATFORM_IOS || + sdk == 0 || + (sdk >> 16) < 14 || +#if 0 + (check_minor_version && (sdk >> 16) == 14 && ((sdk >> 8) & 0xff) < TBD)) { +#else + (check_minor_version)) { +#endif + return false; + } + + // Allow entitled processes to use multicast + task_t task = proc_task(proc); + if (task != NULL && + IOTaskHasEntitlement(task, "com.apple.developer.networking.multicast")) { + return false; } + + const uint32_t min_sdk = proc_min_sdk(proc); + NECPLOG(LOG_INFO, "Dropping unentitled multicast (SDK 0x%x, min 0x%x)", sdk, min_sdk); + + return true; } -#define NECP_KERNEL_ADDRESS_TYPE_CONDITIONS (NECP_KERNEL_CONDITION_LOCAL_START | NECP_KERNEL_CONDITION_LOCAL_END | NECP_KERNEL_CONDITION_LOCAL_PREFIX | NECP_KERNEL_CONDITION_REMOTE_START | NECP_KERNEL_CONDITION_REMOTE_END | NECP_KERNEL_CONDITION_REMOTE_PREFIX) +#define NECP_KERNEL_ADDRESS_TYPE_CONDITIONS (NECP_KERNEL_CONDITION_LOCAL_START | NECP_KERNEL_CONDITION_LOCAL_END | NECP_KERNEL_CONDITION_LOCAL_PREFIX | NECP_KERNEL_CONDITION_REMOTE_START | NECP_KERNEL_CONDITION_REMOTE_END | NECP_KERNEL_CONDITION_REMOTE_PREFIX | NECP_KERNEL_CONDITION_LOCAL_EMPTY | NECP_KERNEL_CONDITION_REMOTE_EMPTY | NECP_KERNEL_CONDITION_LOCAL_NETWORKS) static void -necp_application_fillout_info_locked(uuid_t application_uuid, uuid_t real_application_uuid, char *account, char *domain, pid_t pid, uid_t uid, u_int16_t protocol, u_int32_t bound_interface_index, u_int32_t traffic_class, union necp_sockaddr_union *local_addr, union necp_sockaddr_union *remote_addr, proc_t proc, struct necp_socket_info *info) +necp_application_fillout_info_locked(uuid_t application_uuid, uuid_t real_application_uuid, uuid_t responsible_application_uuid, char *account, char *domain, pid_t pid, uid_t uid, u_int16_t protocol, u_int32_t bound_interface_index, u_int32_t traffic_class, union necp_sockaddr_union *local_addr, union necp_sockaddr_union *remote_addr, u_int16_t local_port, u_int16_t remote_port, bool has_client, proc_t proc, proc_t responsible_proc, u_int32_t drop_order, u_int32_t client_flags, struct necp_socket_info *info, bool is_loopback) { memset(info, 0, sizeof(struct necp_socket_info)); @@ -6243,14 +6178,10 @@ necp_application_fillout_info_locked(uuid_t application_uuid, uuid_t real_applic info->protocol = protocol; info->bound_interface_index = bound_interface_index; info->traffic_class = traffic_class; - - if (necp_kernel_application_policies_condition_mask & NECP_KERNEL_CONDITION_ENTITLEMENT && proc != NULL) { - info->cred_result = priv_check_cred(proc_ucred(proc), PRIV_NET_PRIVILEGED_NECP_MATCH, 0); - if (info->cred_result != 0) { - // Process does not have entitlement, check the parent process - necp_get_parent_cred_result(proc, info); - } - } + info->has_client = has_client; + info->drop_order = drop_order; + info->client_flags = client_flags; + info->is_loopback = is_loopback; if (necp_kernel_application_policies_condition_mask & NECP_KERNEL_CONDITION_APP_ID && !uuid_is_null(application_uuid)) { struct necp_uuid_id_mapping *existing_mapping = necp_uuid_lookup_app_id_locked(application_uuid); @@ -6270,6 +6201,31 @@ necp_application_fillout_info_locked(uuid_t application_uuid, uuid_t real_applic } } + if (necp_kernel_application_policies_condition_mask & NECP_KERNEL_CONDITION_APP_ID && !uuid_is_null(responsible_application_uuid)) { + struct necp_uuid_id_mapping *existing_mapping = necp_uuid_lookup_app_id_locked(responsible_application_uuid); + if (existing_mapping != NULL) { + info->real_application_id = info->application_id; + info->application_id = existing_mapping->id; + info->used_responsible_pid = true; + } + } + + if (info->used_responsible_pid) { + proc = responsible_proc; + } + + if (necp_kernel_application_policies_condition_mask & NECP_KERNEL_CONDITION_ENTITLEMENT && proc != NULL) { + info->cred_result = priv_check_cred(proc_ucred(proc), PRIV_NET_PRIVILEGED_NECP_MATCH, 0); + if (info->cred_result != 0) { + // Process does not have entitlement, check the parent process + necp_get_parent_cred_result(proc, info); + } + } + + if (necp_kernel_application_policies_condition_mask & NECP_KERNEL_CONDITION_PLATFORM_BINARY && proc != NULL) { + info->is_platform_binary = necp_is_platform_binary(proc) ? true : false; + } + if (necp_kernel_application_policies_condition_mask & NECP_KERNEL_CONDITION_ACCOUNT_ID && account != NULL) { struct necp_string_id_mapping *existing_mapping = necp_lookup_string_to_id_locked(&necp_account_id_list, account); if (existing_mapping) { @@ -6281,12 +6237,27 @@ necp_application_fillout_info_locked(uuid_t application_uuid, uuid_t real_applic info->domain = domain; } - if (necp_kernel_application_policies_condition_mask & NECP_KERNEL_ADDRESS_TYPE_CONDITIONS) { + if (necp_restrict_multicast || + (necp_kernel_application_policies_condition_mask & NECP_KERNEL_ADDRESS_TYPE_CONDITIONS)) { if (local_addr && local_addr->sa.sa_len > 0) { memcpy(&info->local_addr, local_addr, local_addr->sa.sa_len); + if (local_port != 0) { + info->local_addr.sin6.sin6_port = local_port; + } + } else if (local_port != 0) { + info->local_addr.sin6.sin6_len = sizeof(struct sockaddr_in6); + info->local_addr.sin6.sin6_family = AF_INET6; + info->local_addr.sin6.sin6_port = local_port; } if (remote_addr && remote_addr->sa.sa_len > 0) { memcpy(&info->remote_addr, remote_addr, remote_addr->sa.sa_len); + if (remote_port != 0) { + info->remote_addr.sin6.sin6_port = remote_port; + } + } else if (remote_port != 0) { + info->remote_addr.sin6.sin6_len = sizeof(struct sockaddr_in6); + info->remote_addr.sin6.sin6_family = AF_INET6; + info->remote_addr.sin6.sin6_port = remote_port; } } } @@ -6305,29 +6276,48 @@ necp_send_application_interface_denied_event(pid_t pid, uuid_t proc_uuid, u_int3 netpolicy_post_msg(KEV_NETPOLICY_IFDENIED, &ev_ifdenied.ev_data, sizeof(ev_ifdenied)); } +static void +necp_send_network_denied_event(pid_t pid, uuid_t proc_uuid, u_int32_t network_type) +{ + struct kev_netpolicy_netdenied ev_netdenied = {}; + + bzero(&ev_netdenied, sizeof(ev_netdenied)); + + ev_netdenied.ev_data.epid = pid; + uuid_copy(ev_netdenied.ev_data.euuid, proc_uuid); + ev_netdenied.ev_network_type = network_type; + + netpolicy_post_msg(KEV_NETPOLICY_NETDENIED, &ev_netdenied.ev_data, sizeof(ev_netdenied)); +} + extern char *proc_name_address(void *p); #define NECP_VERIFY_DELEGATION_ENTITLEMENT(_p, _d) \ if (!has_checked_delegation_entitlement) { \ - has_delegation_entitlement = (priv_check_cred(proc_ucred(_p), PRIV_NET_PRIVILEGED_SOCKET_DELEGATE, 0) == 0); \ - has_checked_delegation_entitlement = TRUE; \ + has_delegation_entitlement = (priv_check_cred(proc_ucred(_p), PRIV_NET_PRIVILEGED_SOCKET_DELEGATE, 0) == 0); \ + has_checked_delegation_entitlement = TRUE; \ } \ if (!has_delegation_entitlement) { \ - NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to delegate network traffic for other processes by %s", \ - proc_name_address(_p), proc_pid(_p), _d); \ - break; \ + NECPLOG(LOG_ERR, "%s(%d) does not hold the necessary entitlement to delegate network traffic for other processes by %s", \ + proc_name_address(_p), proc_pid(_p), _d); \ + break; \ } int necp_application_find_policy_match_internal(proc_t proc, - u_int8_t *parameters, - u_int32_t parameters_size, - struct necp_aggregate_result *returned_result, - u_int32_t *flags, - u_int required_interface_index, - const union necp_sockaddr_union *override_local_addr, - const union necp_sockaddr_union *override_remote_addr, - struct rtentry **returned_route, bool ignore_address) + u_int8_t *parameters, + u_int32_t parameters_size, + struct necp_aggregate_result *returned_result, + u_int32_t *flags, + u_int32_t *reason, + u_int required_interface_index, + const union necp_sockaddr_union *override_local_addr, + const union necp_sockaddr_union *override_remote_addr, + struct necp_client_endpoint *returned_v4_gateway, + struct necp_client_endpoint *returned_v6_gateway, + struct rtentry **returned_route, bool ignore_address, + bool has_client, + uuid_t *returned_override_euuid) { int error = 0; size_t offset = 0; @@ -6335,7 +6325,6 @@ necp_application_find_policy_match_internal(proc_t proc, struct necp_kernel_socket_policy *matched_policy = NULL; struct necp_socket_info info; necp_kernel_policy_filter filter_control_unit = 0; - u_int32_t route_rule_id = 0; necp_kernel_policy_result service_action = 0; necp_kernel_policy_service service = { 0, 0 }; @@ -6348,6 +6337,9 @@ necp_application_find_policy_match_internal(proc_t proc, bool no_remote_addr = FALSE; u_int8_t remote_family = 0; bool no_local_addr = FALSE; + u_int16_t local_port = 0; + u_int16_t remote_port = 0; + necp_drop_all_bypass_check_result_t drop_all_bypass = NECP_DROP_ALL_BYPASS_CHECK_RESULT_NONE; if (override_local_addr) { memcpy(&local_addr, override_local_addr, sizeof(local_addr)); @@ -6369,6 +6361,8 @@ necp_application_find_policy_match_internal(proc_t proc, uuid_clear(real_application_uuid); proc_getexecutableuuid(proc, real_application_uuid, sizeof(real_application_uuid)); uuid_copy(application_uuid, real_application_uuid); + uuid_t responsible_application_uuid; + uuid_clear(responsible_application_uuid); char *domain = NULL; char *account = NULL; @@ -6384,21 +6378,44 @@ necp_application_find_policy_match_internal(proc_t proc, memset(&netagent_use_flags, 0, sizeof(netagent_use_flags)); int netagent_cursor; - bool has_checked_delegation_entitlement = FALSE; - bool has_delegation_entitlement = FALSE; + bool has_checked_delegation_entitlement = FALSE; + bool has_delegation_entitlement = FALSE; + + proc_t responsible_proc = PROC_NULL; + proc_t effective_proc = proc; + bool release_eproc = false; + necp_socket_bypass_type_t bypass_type = NECP_BYPASS_TYPE_NONE; + + u_int32_t flow_divert_aggregate_unit = 0; + + if (returned_result == NULL) { + return EINVAL; + } + + if (returned_v4_gateway != NULL) { + memset(returned_v4_gateway, 0, sizeof(struct necp_client_endpoint)); + } + + if (returned_v6_gateway != NULL) { + memset(returned_v6_gateway, 0, sizeof(struct necp_client_endpoint)); + } - if (returned_result == NULL) { - return (EINVAL); + if (returned_override_euuid != NULL) { + uuid_clear(*returned_override_euuid); } memset(returned_result, 0, sizeof(struct necp_aggregate_result)); + u_int32_t drop_order = necp_process_drop_order(proc_ucred(proc)); + + necp_kernel_policy_result drop_dest_policy_result = NECP_KERNEL_POLICY_RESULT_NONE; + lck_rw_lock_shared(&necp_kernel_policy_lock); if (necp_kernel_application_policies_count == 0) { - if (necp_drop_all_order > 0) { + if (necp_drop_all_order > 0 || drop_order > 0) { returned_result->routing_result = NECP_KERNEL_POLICY_RESULT_DROP; lck_rw_done(&necp_kernel_policy_lock); - return (0); + return 0; } } lck_rw_done(&necp_kernel_policy_lock); @@ -6417,138 +6434,171 @@ necp_application_find_policy_match_internal(proc_t proc, u_int8_t *value = necp_buffer_get_tlv_value(parameters, offset, NULL); if (value != NULL) { switch (type) { - case NECP_CLIENT_PARAMETER_APPLICATION: { - if (length >= sizeof(uuid_t)) { - if (uuid_compare(application_uuid, value) == 0) { - // No delegation - break; - } + case NECP_CLIENT_PARAMETER_APPLICATION: { + if (length >= sizeof(uuid_t)) { + if (uuid_compare(application_uuid, value) == 0) { + // No delegation + break; + } - NECP_VERIFY_DELEGATION_ENTITLEMENT(proc, "euuid"); + NECP_VERIFY_DELEGATION_ENTITLEMENT(proc, "euuid"); - uuid_copy(application_uuid, value); - } - break; + uuid_copy(application_uuid, value); } - case NECP_CLIENT_PARAMETER_REAL_APPLICATION: { - if (length >= sizeof(uuid_t)) { - if (uuid_compare(real_application_uuid, value) == 0) { - // No delegation - break; - } + break; + } + case NECP_CLIENT_PARAMETER_REAL_APPLICATION: { + if (length >= sizeof(uuid_t)) { + if (uuid_compare(real_application_uuid, value) == 0) { + // No delegation + break; + } - NECP_VERIFY_DELEGATION_ENTITLEMENT(proc, "uuid"); + NECP_VERIFY_DELEGATION_ENTITLEMENT(proc, "uuid"); - uuid_copy(real_application_uuid, value); - } - break; + uuid_copy(real_application_uuid, value); } - case NECP_CLIENT_PARAMETER_PID: { - if (length >= sizeof(pid_t)) { - if (memcmp(&pid, value, sizeof(pid_t)) == 0) { - // No delegation - break; - } + break; + } + case NECP_CLIENT_PARAMETER_PID: { + if (length >= sizeof(pid_t)) { + if (memcmp(&pid, value, sizeof(pid_t)) == 0) { + // No delegation + break; + } - NECP_VERIFY_DELEGATION_ENTITLEMENT(proc, "pid"); + NECP_VERIFY_DELEGATION_ENTITLEMENT(proc, "pid"); - memcpy(&pid, value, sizeof(pid_t)); - } - break; + memcpy(&pid, value, sizeof(pid_t)); } - case NECP_CLIENT_PARAMETER_UID: { - if (length >= sizeof(uid_t)) { - if (memcmp(&uid, value, sizeof(uid_t)) == 0) { - // No delegation - break; - } + break; + } + case NECP_CLIENT_PARAMETER_UID: { + if (length >= sizeof(uid_t)) { + if (memcmp(&uid, value, sizeof(uid_t)) == 0) { + // No delegation + break; + } - NECP_VERIFY_DELEGATION_ENTITLEMENT(proc, "uid"); + NECP_VERIFY_DELEGATION_ENTITLEMENT(proc, "uid"); - memcpy(&uid, value, sizeof(uid_t)); - } - break; + memcpy(&uid, value, sizeof(uid_t)); } - case NECP_CLIENT_PARAMETER_DOMAIN: { - domain = (char *)value; - domain[length - 1] = 0; - break; + break; + } + case NECP_CLIENT_PARAMETER_DOMAIN: { + domain = (char *)value; + domain[length - 1] = 0; + break; + } + case NECP_CLIENT_PARAMETER_ACCOUNT: { + account = (char *)value; + account[length - 1] = 0; + break; + } + case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: { + if (length >= sizeof(u_int32_t)) { + memcpy(&traffic_class, value, sizeof(u_int32_t)); } - case NECP_CLIENT_PARAMETER_ACCOUNT: { - account = (char *)value; - account[length - 1] = 0; - break; + break; + } + case NECP_CLIENT_PARAMETER_IP_PROTOCOL: { + if (length >= sizeof(u_int16_t)) { + memcpy(&protocol, value, sizeof(u_int16_t)); + } else if (length >= sizeof(u_int8_t)) { + memcpy(&protocol, value, sizeof(u_int8_t)); } - case NECP_CLIENT_PARAMETER_TRAFFIC_CLASS: { - if (length >= sizeof(u_int32_t)) { - memcpy(&traffic_class, value, sizeof(u_int32_t)); + break; + } + case NECP_CLIENT_PARAMETER_BOUND_INTERFACE: { + if (length <= IFXNAMSIZ && length > 0) { + ifnet_t bound_interface = NULL; + char interface_name[IFXNAMSIZ]; + memcpy(interface_name, value, length); + interface_name[length - 1] = 0; // Make sure the string is NULL terminated + if (ifnet_find_by_name(interface_name, &bound_interface) == 0) { + bound_interface_index = bound_interface->if_index; + ifnet_release(bound_interface); } - break; } - case NECP_CLIENT_PARAMETER_IP_PROTOCOL: { - if (length >= sizeof(u_int16_t)) { - memcpy(&protocol, value, sizeof(u_int16_t)); - } + break; + } + case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: { + if (ignore_address || override_local_addr) { break; } - case NECP_CLIENT_PARAMETER_BOUND_INTERFACE: { - if (length <= IFXNAMSIZ && length > 0) { - ifnet_t bound_interface = NULL; - char interface_name[IFXNAMSIZ]; - memcpy(interface_name, value, length); - interface_name[length - 1] = 0; // Make sure the string is NULL terminated - if (ifnet_find_by_name(interface_name, &bound_interface) == 0) { - bound_interface_index = bound_interface->if_index; - ifnet_release(bound_interface); - } + + if (length >= sizeof(struct necp_policy_condition_addr)) { + struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value; + if (necp_address_is_valid(&address_struct->address.sa)) { + memcpy(&local_addr, &address_struct->address, sizeof(address_struct->address)); } + } + break; + } + case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: { + if (ignore_address || override_remote_addr) { break; } - case NECP_CLIENT_PARAMETER_LOCAL_ADDRESS: { - if (ignore_address) { - break; - } - if (length >= sizeof(struct necp_policy_condition_addr)) { - struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value; - if (necp_address_is_valid(&address_struct->address.sa)) { - memcpy(&local_addr, &address_struct->address, sizeof(address_struct->address)); - } + if (length >= sizeof(struct necp_policy_condition_addr)) { + struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value; + if (necp_address_is_valid(&address_struct->address.sa)) { + memcpy(&remote_addr, &address_struct->address, sizeof(address_struct->address)); } + } + break; + } + case NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT: { + if (ignore_address || override_local_addr) { break; } - case NECP_CLIENT_PARAMETER_REMOTE_ADDRESS: { - if (ignore_address) { - break; - } - if (length >= sizeof(struct necp_policy_condition_addr)) { - struct necp_policy_condition_addr *address_struct = (struct necp_policy_condition_addr *)(void *)value; - if (necp_address_is_valid(&address_struct->address.sa)) { - memcpy(&remote_addr, &address_struct->address, sizeof(address_struct->address)); - } + if (length >= sizeof(struct necp_client_endpoint)) { + struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value; + if (endpoint->u.endpoint.endpoint_family == AF_UNSPEC && + endpoint->u.endpoint.endpoint_port != 0) { + // Save port + local_port = endpoint->u.endpoint.endpoint_port; } - break; } - case NECP_CLIENT_PARAMETER_FLAGS: { - if (length >= sizeof(client_flags)) { - memcpy(&client_flags, value, sizeof(client_flags)); - } + break; + } + case NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT: { + if (ignore_address || override_remote_addr) { break; } - case NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE: { - if (num_required_agent_types >= NECP_MAX_REQUIRED_AGENTS) { - break; - } - if (length >= sizeof(struct necp_client_parameter_netagent_type)) { - memcpy(&required_agent_types[num_required_agent_types], value, sizeof(struct necp_client_parameter_netagent_type)); - num_required_agent_types++; + + if (length >= sizeof(struct necp_client_endpoint)) { + struct necp_client_endpoint *endpoint = (struct necp_client_endpoint *)(void *)value; + if (endpoint->u.endpoint.endpoint_family == AF_UNSPEC && + endpoint->u.endpoint.endpoint_port != 0) { + // Save port + remote_port = endpoint->u.endpoint.endpoint_port; } - break; } - default: { + break; + } + case NECP_CLIENT_PARAMETER_FLAGS: { + if (length >= sizeof(client_flags)) { + memcpy(&client_flags, value, sizeof(client_flags)); + } + break; + } + case NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE: + case NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE: { + if (num_required_agent_types >= NECP_MAX_REQUIRED_AGENTS) { break; } + if (length >= sizeof(struct necp_client_parameter_netagent_type)) { + memcpy(&required_agent_types[num_required_agent_types], value, sizeof(struct necp_client_parameter_netagent_type)); + num_required_agent_types++; + } + break; + } + default: { + break; + } } } } @@ -6556,24 +6606,105 @@ necp_application_find_policy_match_internal(proc_t proc, offset += sizeof(u_int8_t) + sizeof(u_int32_t) + length; } + // Check for loopback exception + if (necp_pass_loopback > 0 && necp_is_loopback(&local_addr.sa, &remote_addr.sa, NULL, NULL, bound_interface_index)) { + bypass_type = NECP_BYPASS_TYPE_LOOPBACK; + } + + if (bypass_type == NECP_BYPASS_TYPE_LOOPBACK && necp_pass_loopback == NECP_LOOPBACK_PASS_ALL) { + returned_result->policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; + returned_result->routing_result = NECP_KERNEL_POLICY_RESULT_PASS; + returned_result->routed_interface_index = lo_ifp->if_index; + *flags |= (NECP_CLIENT_RESULT_FLAG_IS_LOCAL | NECP_CLIENT_RESULT_FLAG_IS_DIRECT); + return 0; + } + + if (proc_pid(effective_proc) != pid) { + proc_t found_proc = proc_find(pid); + if (found_proc != PROC_NULL) { + effective_proc = found_proc; + release_eproc = true; + } + } +#if defined(XNU_TARGET_OS_OSX) + if (effective_proc->p_responsible_pid > 0 && effective_proc->p_responsible_pid != pid) { + responsible_proc = proc_find(effective_proc->p_responsible_pid); + if (responsible_proc != PROC_NULL) { + proc_getexecutableuuid(responsible_proc, responsible_application_uuid, sizeof(responsible_application_uuid)); + } + } +#endif /* defined(XNU_TARGET_OS_OSX) */ + // Lock lck_rw_lock_shared(&necp_kernel_policy_lock); - necp_application_fillout_info_locked(application_uuid, real_application_uuid, account, domain, pid, uid, protocol, bound_interface_index, traffic_class, &local_addr, &remote_addr, proc, &info); - matched_policy = necp_socket_find_policy_match_with_info_locked(necp_kernel_socket_policies_app_layer_map, &info, &filter_control_unit, &route_rule_id, &service_action, &service, netagent_ids, netagent_use_flags, NECP_MAX_NETAGENTS, required_agent_types, num_required_agent_types, proc, NULL); + u_int32_t route_rule_id_array[MAX_AGGREGATE_ROUTE_RULES]; + size_t route_rule_id_array_count = 0; + necp_application_fillout_info_locked(application_uuid, real_application_uuid, responsible_application_uuid, account, domain, pid, uid, protocol, bound_interface_index, traffic_class, &local_addr, &remote_addr, local_port, remote_port, has_client, effective_proc, responsible_proc, drop_order, client_flags, &info, (bypass_type == NECP_BYPASS_TYPE_LOOPBACK)); + matched_policy = necp_socket_find_policy_match_with_info_locked(necp_kernel_socket_policies_app_layer_map, &info, &filter_control_unit, route_rule_id_array, &route_rule_id_array_count, MAX_AGGREGATE_ROUTE_RULES, &service_action, &service, netagent_ids, netagent_use_flags, NECP_MAX_NETAGENTS, required_agent_types, num_required_agent_types, info.used_responsible_pid ? responsible_proc : effective_proc, 0, NULL, NULL, &drop_dest_policy_result, &drop_all_bypass, &flow_divert_aggregate_unit); + + // Check for loopback exception again after the policy match + if (bypass_type == NECP_BYPASS_TYPE_LOOPBACK && + necp_pass_loopback == NECP_LOOPBACK_PASS_WITH_FILTER && + (matched_policy == NULL || matched_policy->result != NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT)) { + if (filter_control_unit == NECP_FILTER_UNIT_NO_FILTER) { + returned_result->filter_control_unit = 0; + } else { + returned_result->filter_control_unit = filter_control_unit; + } + + if (flow_divert_aggregate_unit > 0) { + returned_result->flow_divert_aggregate_unit = flow_divert_aggregate_unit; + } + + returned_result->policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; + returned_result->routing_result = NECP_KERNEL_POLICY_RESULT_PASS; + returned_result->routed_interface_index = lo_ifp->if_index; + *flags |= (NECP_CLIENT_RESULT_FLAG_IS_LOCAL | NECP_CLIENT_RESULT_FLAG_IS_DIRECT); + error = 0; + goto done; + } + if (matched_policy) { returned_result->policy_id = matched_policy->id; returned_result->routing_result = matched_policy->result; memcpy(&returned_result->routing_result_parameter, &matched_policy->result_parameter, sizeof(returned_result->routing_result_parameter)); - } else if (necp_drop_all_order > 0) { - // Mark socket as a drop if drop_all is set + if (returned_override_euuid != NULL && info.used_responsible_pid && !(matched_policy->condition_mask & NECP_KERNEL_CONDITION_REAL_APP_ID)) { + uuid_copy(*returned_override_euuid, responsible_application_uuid); + } + } else { + bool drop_all = false; + if (necp_drop_all_order > 0 || info.drop_order > 0 || drop_dest_policy_result == NECP_KERNEL_POLICY_RESULT_DROP) { + // Mark socket as a drop if drop_all is set + drop_all = true; + if (drop_all_bypass == NECP_DROP_ALL_BYPASS_CHECK_RESULT_NONE) { + drop_all_bypass = necp_check_drop_all_bypass_result(proc); + } + } + if (drop_all && drop_all_bypass == NECP_DROP_ALL_BYPASS_CHECK_RESULT_FALSE) { + returned_result->policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; + returned_result->routing_result = NECP_KERNEL_POLICY_RESULT_DROP; + } else { + returned_result->policy_id = 0; + returned_result->routing_result = NECP_KERNEL_POLICY_RESULT_NONE; + } + } + if (necp_check_missing_client_drop(proc, &info) || + necp_check_restricted_multicast_drop(proc, &info, false)) { + // Mark as drop returned_result->policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; returned_result->routing_result = NECP_KERNEL_POLICY_RESULT_DROP; + } + if (filter_control_unit == NECP_FILTER_UNIT_NO_FILTER) { + returned_result->filter_control_unit = 0; } else { - returned_result->policy_id = 0; - returned_result->routing_result = NECP_KERNEL_POLICY_RESULT_NONE; + returned_result->filter_control_unit = filter_control_unit; + } + + if (flow_divert_aggregate_unit > 0) { + returned_result->flow_divert_aggregate_unit = flow_divert_aggregate_unit; } - returned_result->filter_control_unit = filter_control_unit; + returned_result->service_action = service_action; // Handle trigger service @@ -6627,15 +6758,24 @@ necp_application_find_policy_match_internal(proc_t proc, } } + if (returned_result->routing_result == NECP_KERNEL_POLICY_RESULT_DROP && + returned_result->routing_result_parameter.drop_flags & NECP_KERNEL_POLICY_DROP_FLAG_LOCAL_NETWORK) { + // Trigger the event that we dropped due to a local network policy + necp_send_network_denied_event(pid, application_uuid, NETPOLICY_NETWORKTYPE_LOCAL); + if (reason != NULL) { + *reason = NECP_CLIENT_RESULT_REASON_LOCAL_NETWORK_PROHIBITED; + } + } + if (local_addr.sa.sa_len == 0 || - (local_addr.sa.sa_family == AF_INET && local_addr.sin.sin_addr.s_addr == 0) || - (local_addr.sa.sa_family == AF_INET6 && IN6_IS_ADDR_UNSPECIFIED(&local_addr.sin6.sin6_addr))) { + (local_addr.sa.sa_family == AF_INET && local_addr.sin.sin_addr.s_addr == 0) || + (local_addr.sa.sa_family == AF_INET6 && IN6_IS_ADDR_UNSPECIFIED(&local_addr.sin6.sin6_addr))) { no_local_addr = TRUE; } if (remote_addr.sa.sa_len == 0 || - (remote_addr.sa.sa_family == AF_INET && remote_addr.sin.sin_addr.s_addr == 0) || - (remote_addr.sa.sa_family == AF_INET6 && IN6_IS_ADDR_UNSPECIFIED(&remote_addr.sin6.sin6_addr))) { + (remote_addr.sa.sa_family == AF_INET && remote_addr.sin.sin_addr.s_addr == 0) || + (remote_addr.sa.sa_family == AF_INET6 && IN6_IS_ADDR_UNSPECIFIED(&remote_addr.sin6.sin6_addr))) { no_remote_addr = TRUE; remote_family = remote_addr.sa.sa_family; } @@ -6661,7 +6801,7 @@ necp_application_find_policy_match_internal(proc_t proc, } rt = rtalloc1_scoped((struct sockaddr *)&remote_addr, 0, 0, - output_bound_interface); + output_bound_interface); if (remote_addr.sa.sa_family == AF_INET && rt != NULL && IS_INTF_CLAT46(rt->rt_ifp)) { @@ -6670,8 +6810,8 @@ necp_application_find_policy_match_internal(proc_t proc, returned_result->routed_interface_index = 0; } - if (no_remote_addr && remote_family == 0 && - (rt == NULL || rt->rt_ifp == NULL)) { + if (no_remote_addr && remote_family == AF_UNSPEC && + (rt == NULL || rt->rt_ifp == NULL)) { // Route lookup for default IPv4 failed, try IPv6 // Cleanup old route if necessary @@ -6687,11 +6827,11 @@ necp_application_find_policy_match_internal(proc_t proc, // Get route rt = rtalloc1_scoped((struct sockaddr *)&remote_addr, 0, 0, - output_bound_interface); + output_bound_interface); } if (rt != NULL && - rt->rt_ifp != NULL) { + rt->rt_ifp != NULL) { returned_result->routed_interface_index = rt->rt_ifp->if_index; /* * For local addresses, we allow the interface scope to be @@ -6699,10 +6839,10 @@ necp_application_find_policy_match_internal(proc_t proc, * local address. */ if (bound_interface_index != IFSCOPE_NONE && - rt->rt_ifa != NULL && rt->rt_ifa->ifa_ifp && - (output_bound_interface == lo_ifp->if_index || - rt->rt_ifp->if_index == lo_ifp->if_index || - rt->rt_ifa->ifa_ifp->if_index == bound_interface_index)) { + rt->rt_ifa != NULL && rt->rt_ifa->ifa_ifp && + (output_bound_interface == lo_ifp->if_index || + rt->rt_ifp->if_index == lo_ifp->if_index || + rt->rt_ifa->ifa_ifp->if_index == bound_interface_index)) { struct sockaddr_storage dst; unsigned int ifscope = bound_interface_index; @@ -6710,20 +6850,20 @@ necp_application_find_policy_match_internal(proc_t proc, * Transform dst into the internal routing table form */ (void) sa_copy((struct sockaddr *)&remote_addr, - &dst, &ifscope); + &dst, &ifscope); if ((rt->rt_ifp->if_index == lo_ifp->if_index) || - rt_ifa_is_dst((struct sockaddr *)&dst, rt->rt_ifa)) + rt_ifa_is_dst((struct sockaddr *)&dst, rt->rt_ifa)) { returned_result->routed_interface_index = - bound_interface_index; + bound_interface_index; + } } } } if (returned_result->routed_interface_index != 0 && - returned_result->routed_interface_index != lo_ifp->if_index && // Loopback can accept any local address - !no_local_addr) { - + returned_result->routed_interface_index != lo_ifp->if_index && // Loopback can accept any local address + !no_local_addr) { // Transform local_addr into the ifaddr form // IPv6 Scope IDs are always embedded in the ifaddr list struct sockaddr_storage local_address_sanitized; @@ -6756,7 +6896,7 @@ necp_application_find_policy_match_internal(proc_t proc, if (rt != NULL && (rt->rt_flags & RTF_LOCAL)) { is_local = TRUE; } else if (returned_result->routed_interface_index != 0 && - !no_remote_addr) { + !no_remote_addr) { // Clean up the address before comparison with interface addresses // Transform remote_addr into the ifaddr form @@ -6774,7 +6914,7 @@ necp_application_find_policy_match_internal(proc_t proc, if (ifa != NULL && ifa->ifa_ifp != NULL) { u_int if_index_for_remote_addr = ifa->ifa_ifp->if_index; if (if_index_for_remote_addr == returned_result->routed_interface_index || - if_index_for_remote_addr == lo_ifp->if_index) { + if_index_for_remote_addr == lo_ifp->if_index) { is_local = TRUE; } } @@ -6788,15 +6928,15 @@ necp_application_find_policy_match_internal(proc_t proc, *flags |= (NECP_CLIENT_RESULT_FLAG_IS_LOCAL | NECP_CLIENT_RESULT_FLAG_IS_DIRECT); } else { if (rt != NULL && - !(rt->rt_flags & RTF_GATEWAY) && - (rt->rt_ifa && rt->rt_ifa->ifa_ifp && !(rt->rt_ifa->ifa_ifp->if_flags & IFF_POINTOPOINT))) { + !(rt->rt_flags & RTF_GATEWAY) && + (rt->rt_ifa && rt->rt_ifa->ifa_ifp && !(rt->rt_ifa->ifa_ifp->if_flags & IFF_POINTOPOINT))) { // Route is directly accessible *flags |= NECP_CLIENT_RESULT_FLAG_IS_DIRECT; } } if (rt != NULL && - rt->rt_ifp != NULL) { + rt->rt_ifp != NULL) { // Check probe status if (rt->rt_ifp->if_eflags & IFEF_PROBE_CONNECTIVITY) { *flags |= NECP_CLIENT_RESULT_FLAG_PROBE_CONNECTIVITY; @@ -6827,19 +6967,34 @@ necp_application_find_policy_match_internal(proc_t proc, // Check link quality if ((client_flags & NECP_CLIENT_PARAMETER_FLAG_DISCRETIONARY) && - (rt->rt_ifp->if_interface_state.valid_bitmask & IF_INTERFACE_STATE_LQM_STATE_VALID) && - rt->rt_ifp->if_interface_state.lqm_state == IFNET_LQM_THRESH_ABORT) { + (rt->rt_ifp->if_interface_state.valid_bitmask & IF_INTERFACE_STATE_LQM_STATE_VALID) && + rt->rt_ifp->if_interface_state.lqm_state == IFNET_LQM_THRESH_ABORT) { *flags |= NECP_CLIENT_RESULT_FLAG_LINK_QUALITY_ABORT; } // Check QoS marking (fastlane) - if (necp_update_qos_marking(rt->rt_ifp, route_rule_id)) { - *flags |= NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING; + for (size_t route_rule_index = 0; route_rule_index < route_rule_id_array_count; route_rule_index++) { + if (necp_update_qos_marking(rt->rt_ifp, route_rule_id_array[route_rule_index])) { + *flags |= NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING; + // If the route can use QoS markings, stop iterating route rules + break; + } } if (IFNET_IS_LOW_POWER(rt->rt_ifp)) { *flags |= NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER; } + + if (traffic_class == SO_TC_BK_SYS) { + // Block BK_SYS traffic if interface is throttled + u_int32_t throttle_level = 0; + if (ifnet_get_throttle(rt->rt_ifp, &throttle_level) == 0) { + if (throttle_level == IFNET_THROTTLE_OPPORTUNISTIC) { + returned_result->routing_result = NECP_KERNEL_POLICY_RESULT_DROP; + memset(&returned_result->routing_result_parameter, 0, sizeof(returned_result->routing_result_parameter)); + } + } + } } } @@ -6866,6 +7021,12 @@ necp_application_find_policy_match_internal(proc_t proc, if (v4Route->rt_ifp != NULL && !IS_INTF_CLAT46(v4Route->rt_ifp)) { *flags |= NECP_CLIENT_RESULT_FLAG_HAS_IPV4; } + if (returned_v4_gateway != NULL && + v4Route->rt_gateway != NULL && + v4Route->rt_gateway->sa_len == sizeof(returned_v4_gateway->u.sin)) { + memcpy(&returned_v4_gateway->u.sin, v4Route->rt_gateway, sizeof(returned_v4_gateway->u.sin)); + memset(&returned_v4_gateway->u.sin.sin_zero, 0, sizeof(returned_v4_gateway->u.sin.sin_zero)); + } rtfree(v4Route); v4Route = NULL; } @@ -6878,21 +7039,56 @@ necp_application_find_policy_match_internal(proc_t proc, *flags |= NECP_CLIENT_RESULT_FLAG_HAS_NAT64; } } + if (returned_v6_gateway != NULL && + v6Route->rt_gateway != NULL && + v6Route->rt_gateway->sa_len == sizeof(returned_v6_gateway->u.sin6)) { + memcpy(&returned_v6_gateway->u.sin6, v6Route->rt_gateway, sizeof(returned_v6_gateway->u.sin6)); + } rtfree(v6Route); v6Route = NULL; } } } - u_int32_t interface_type_denied = IFRTYPE_FUNCTIONAL_UNKNOWN; - bool route_is_allowed = necp_route_is_allowed(rt, NULL, route_rule_id, &interface_type_denied); - if (!route_is_allowed) { - // If the route is blocked, treat the lookup as a drop - returned_result->routing_result = NECP_KERNEL_POLICY_RESULT_DROP; - memset(&returned_result->routing_result_parameter, 0, sizeof(returned_result->routing_result_parameter)); + for (size_t route_rule_index = 0; route_rule_index < route_rule_id_array_count; route_rule_index++) { + u_int32_t interface_type_denied = IFRTYPE_FUNCTIONAL_UNKNOWN; + bool route_is_allowed = necp_route_is_allowed(rt, NULL, route_rule_id_array[route_rule_index], &interface_type_denied); + if (!route_is_allowed) { + // If the route is blocked, treat the lookup as a drop + returned_result->routing_result = NECP_KERNEL_POLICY_RESULT_DROP; + memset(&returned_result->routing_result_parameter, 0, sizeof(returned_result->routing_result_parameter)); + + if (interface_type_denied != IFRTYPE_FUNCTIONAL_UNKNOWN) { + if (reason != NULL) { + if (interface_type_denied == IFRTYPE_FUNCTIONAL_CELLULAR) { + *reason = NECP_CLIENT_RESULT_REASON_CELLULAR_DENIED; + } else if (interface_type_denied == IFRTYPE_FUNCTIONAL_WIFI_INFRA) { + *reason = NECP_CLIENT_RESULT_REASON_WIFI_DENIED; + } + } + necp_send_application_interface_denied_event(pid, application_uuid, interface_type_denied); + } + // If the route gets denied, stop matching rules + break; + } + } - if (interface_type_denied != IFRTYPE_FUNCTIONAL_UNKNOWN) { - necp_send_application_interface_denied_event(pid, application_uuid, interface_type_denied); + if (rt != NULL && rt->rt_ifp != NULL) { + const bool expensive_prohibited = ((client_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE) && + IFNET_IS_EXPENSIVE(rt->rt_ifp)); + const bool constrained_prohibited = ((client_flags & NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED) && + IFNET_IS_CONSTRAINED(rt->rt_ifp)); + if (reason != NULL) { + if (expensive_prohibited) { + *reason = NECP_CLIENT_RESULT_REASON_EXPENSIVE_PROHIBITED; + } else if (constrained_prohibited) { + *reason = NECP_CLIENT_RESULT_REASON_CONSTRAINED_PROHIBITED; + } + } + if (expensive_prohibited || constrained_prohibited) { + // If the client flags prohibited a property of the interface, treat it as a drop + returned_result->routing_result = NECP_KERNEL_POLICY_RESULT_DROP; + memset(&returned_result->routing_result_parameter, 0, sizeof(returned_result->routing_result_parameter)); } } @@ -6904,14 +7100,76 @@ necp_application_find_policy_match_internal(proc_t proc, } rt = NULL; } + +done: // Unlock lck_rw_done(&necp_kernel_policy_lock); - return (error); + if (release_eproc && effective_proc != PROC_NULL) { + proc_rele(effective_proc); + } +#if defined(XNU_TARGET_OS_OSX) + if (responsible_proc != PROC_NULL) { + proc_rele(responsible_proc); + } +#endif + + return error; +} + +static bool +necp_is_route_local(union necp_sockaddr_union *remote_addr) +{ + bool no_remote_addr = FALSE; + u_int8_t remote_family = 0; + struct rtentry *rt = NULL; + bool is_local = FALSE; + + if (remote_addr == NULL) { + return NULL; + } + + if (remote_addr->sa.sa_len == 0 || + (remote_addr->sa.sa_family == AF_INET && remote_addr->sin.sin_addr.s_addr == 0) || + (remote_addr->sa.sa_family == AF_INET6 && IN6_IS_ADDR_UNSPECIFIED(&remote_addr->sin6.sin6_addr))) { + no_remote_addr = TRUE; + remote_family = remote_addr->sa.sa_family; + } + + if (no_remote_addr) { + memset(remote_addr, 0, sizeof(union necp_sockaddr_union)); + if (remote_family == AF_INET6) { + // Reset address to :: + remote_addr->sa.sa_family = AF_INET6; + remote_addr->sa.sa_len = sizeof(struct sockaddr_in6); + } else { + // Reset address to 0.0.0.0 + remote_addr->sa.sa_family = AF_INET; + remote_addr->sa.sa_len = sizeof(struct sockaddr_in); + } + } + + // Lookup route regardless of the scoped interface to check if + // remote address is in a local network. + rt = rtalloc1_scoped((struct sockaddr *)remote_addr, 0, 0, 0); + + if (rt == NULL) { + goto done; + } + if (remote_addr->sa.sa_family == AF_INET && IS_INTF_CLAT46(rt->rt_ifp)) { + goto free_rt; + } + is_local = IS_NECP_DEST_IN_LOCAL_NETWORKS(rt); + +free_rt: + rtfree(rt); + +done: + return is_local; } static bool -necp_socket_check_policy(struct necp_kernel_socket_policy *kernel_policy, necp_app_id app_id, necp_app_id real_app_id, errno_t cred_result, u_int32_t account_id, struct substring domain, u_int8_t domain_dot_count, pid_t pid, uid_t uid, u_int32_t bound_interface_index, u_int32_t traffic_class, u_int16_t protocol, union necp_sockaddr_union *local, union necp_sockaddr_union *remote, struct necp_client_parameter_netagent_type *required_agent_types, u_int32_t num_required_agent_types, proc_t proc) +necp_socket_check_policy(struct necp_kernel_socket_policy *kernel_policy, necp_app_id app_id, necp_app_id real_app_id, errno_t cred_result, u_int32_t account_id, struct substring domain, u_int8_t domain_dot_count, pid_t pid, uid_t uid, u_int32_t bound_interface_index, u_int32_t traffic_class, u_int16_t protocol, union necp_sockaddr_union *local, union necp_sockaddr_union *remote, struct necp_client_parameter_netagent_type *required_agent_types, u_int32_t num_required_agent_types, bool has_client, uint32_t client_flags, int is_platform_binary, proc_t proc, u_int16_t pf_tag, struct rtentry *rt, bool is_loopback) { if (!(kernel_policy->condition_mask & NECP_KERNEL_CONDITION_ALL_INTERFACES)) { if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE) { @@ -6919,36 +7177,60 @@ necp_socket_check_policy(struct necp_kernel_socket_policy *kernel_policy, necp_a if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE) { if (bound_interface_index == cond_bound_interface_index) { // No match, matches forbidden interface - return (FALSE); + return FALSE; } } else { if (bound_interface_index != cond_bound_interface_index) { // No match, does not match required interface - return (FALSE); + return FALSE; } } } else { if (bound_interface_index != 0) { // No match, requires a non-bound packet - return (FALSE); + return FALSE; } } } if (kernel_policy->condition_mask == 0) { - return (TRUE); + return TRUE; } if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_APP_ID) { if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_APP_ID) { if (app_id == kernel_policy->cond_app_id) { // No match, matches forbidden application - return (FALSE); + return FALSE; } } else { if (app_id != kernel_policy->cond_app_id) { // No match, does not match required application - return (FALSE); + return FALSE; + } + } + + // Check signing identifier only after APP ID matched + if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_SIGNING_IDENTIFIER || + kernel_policy->condition_mask & NECP_KERNEL_CONDITION_SIGNING_IDENTIFIER) { + u_int8_t matched = necp_boolean_state_false; + const char *signing_id = cs_identity_get(proc ? proc : current_proc()); + + if (signing_id != NULL) { + size_t signing_id_size = strlen(signing_id) + 1; + if (memcmp(signing_id, kernel_policy->cond_signing_identifier, signing_id_size) == 0) { + matched = necp_boolean_state_true; + } + } + + if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_SIGNING_IDENTIFIER) { + if (matched == necp_boolean_state_true) { + return FALSE; + } + } else { + if (matched != necp_boolean_state_true) { + return FALSE; + } } } } @@ -6957,39 +7239,77 @@ necp_socket_check_policy(struct necp_kernel_socket_policy *kernel_policy, necp_a if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_REAL_APP_ID) { if (real_app_id == kernel_policy->cond_real_app_id) { // No match, matches forbidden application - return (FALSE); + return FALSE; } } else { if (real_app_id != kernel_policy->cond_real_app_id) { // No match, does not match required application - return (FALSE); + return FALSE; } } } + if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_HAS_CLIENT) { + if (!has_client) { + return FALSE; + } + } + if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_ENTITLEMENT) { if (cred_result != 0) { // Process is missing entitlement - return (FALSE); + return FALSE; + } + } + + if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_PLATFORM_BINARY) { + if (is_platform_binary == 0) { + // Process is not platform binary + return FALSE; + } + } + + if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_SDK_VERSION) { + if (proc != NULL) { + if (kernel_policy->cond_sdk_version.platform != 0) { + if (kernel_policy->cond_sdk_version.platform != proc_platform(proc)) { + // Process does not match platform + return FALSE; + } + } + + if (kernel_policy->cond_sdk_version.min_version != 0) { + if (kernel_policy->cond_sdk_version.min_version > proc_min_sdk(proc)) { + // Process min version is older than required min version + return FALSE; + } + } + + if (kernel_policy->cond_sdk_version.version != 0) { + if (kernel_policy->cond_sdk_version.version > proc_sdk(proc)) { + // Process SDK version is older than required version + return FALSE; + } + } } } if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT) { if (kernel_policy->cond_custom_entitlement_matched == necp_boolean_state_false) { // Process is missing entitlement based on previous check - return (FALSE); + return FALSE; } else if (kernel_policy->cond_custom_entitlement_matched == necp_boolean_state_unknown) { if (kernel_policy->cond_custom_entitlement != NULL) { if (proc == NULL) { // No process found, cannot check entitlement - return (FALSE); + return FALSE; } task_t task = proc_task(proc); if (task == NULL || - !IOTaskHasEntitlement(task, kernel_policy->cond_custom_entitlement)) { + !IOTaskHasEntitlement(task, kernel_policy->cond_custom_entitlement)) { // Process is missing custom entitlement kernel_policy->cond_custom_entitlement_matched = necp_boolean_state_false; - return (FALSE); + return FALSE; } else { kernel_policy->cond_custom_entitlement_matched = necp_boolean_state_true; } @@ -7002,12 +7322,12 @@ necp_socket_check_policy(struct necp_kernel_socket_policy *kernel_policy, necp_a if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_DOMAIN) { if (domain_matches) { // No match, matches forbidden domain - return (FALSE); + return FALSE; } } else { if (!domain_matches) { // No match, does not match required domain - return (FALSE); + return FALSE; } } } @@ -7016,12 +7336,12 @@ necp_socket_check_policy(struct necp_kernel_socket_policy *kernel_policy, necp_a if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_ACCOUNT_ID) { if (account_id == kernel_policy->cond_account_id) { // No match, matches forbidden account - return (FALSE); + return FALSE; } } else { if (account_id != kernel_policy->cond_account_id) { // No match, does not match required account - return (FALSE); + return FALSE; } } } @@ -7030,12 +7350,12 @@ necp_socket_check_policy(struct necp_kernel_socket_policy *kernel_policy, necp_a if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_PID) { if (pid == kernel_policy->cond_pid) { // No match, matches forbidden pid - return (FALSE); + return FALSE; } } else { if (pid != kernel_policy->cond_pid) { // No match, does not match required pid - return (FALSE); + return FALSE; } } } @@ -7044,12 +7364,12 @@ necp_socket_check_policy(struct necp_kernel_socket_policy *kernel_policy, necp_a if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_UID) { if (uid == kernel_policy->cond_uid) { // No match, matches forbidden uid - return (FALSE); + return FALSE; } } else { if (uid != kernel_policy->cond_uid) { // No match, does not match required uid - return (FALSE); + return FALSE; } } } @@ -7057,15 +7377,15 @@ necp_socket_check_policy(struct necp_kernel_socket_policy *kernel_policy, necp_a if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_TRAFFIC_CLASS) { if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_TRAFFIC_CLASS) { if (traffic_class >= kernel_policy->cond_traffic_class.start_tc && - traffic_class <= kernel_policy->cond_traffic_class.end_tc) { + traffic_class <= kernel_policy->cond_traffic_class.end_tc) { // No match, matches forbidden traffic class - return (FALSE); + return FALSE; } } else { if (traffic_class < kernel_policy->cond_traffic_class.start_tc || - traffic_class > kernel_policy->cond_traffic_class.end_tc) { + traffic_class > kernel_policy->cond_traffic_class.end_tc) { // No match, does not match required traffic class - return (FALSE); + return FALSE; } } } @@ -7074,12 +7394,12 @@ necp_socket_check_policy(struct necp_kernel_socket_policy *kernel_policy, necp_a if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_PROTOCOL) { if (protocol == kernel_policy->cond_protocol) { // No match, matches forbidden protocol - return (FALSE); + return FALSE; } } else { if (protocol != kernel_policy->cond_protocol) { // No match, does not match required protocol - return (FALSE); + return FALSE; } } } @@ -7089,16 +7409,31 @@ necp_socket_check_policy(struct necp_kernel_socket_policy *kernel_policy, necp_a for (u_int32_t i = 0; i < num_required_agent_types; i++) { struct necp_client_parameter_netagent_type *required_agent_type = &required_agent_types[i]; if ((strlen(kernel_policy->cond_agent_type.agent_domain) == 0 || - strncmp(required_agent_type->netagent_domain, kernel_policy->cond_agent_type.agent_domain, NETAGENT_DOMAINSIZE) == 0) && - (strlen(kernel_policy->cond_agent_type.agent_type) == 0 || - strncmp(required_agent_type->netagent_type, kernel_policy->cond_agent_type.agent_type, NETAGENT_TYPESIZE) == 0)) { - // Found a required agent that matches - matches_agent_type = TRUE; - break; - } + strncmp(required_agent_type->netagent_domain, kernel_policy->cond_agent_type.agent_domain, NETAGENT_DOMAINSIZE) == 0) && + (strlen(kernel_policy->cond_agent_type.agent_type) == 0 || + strncmp(required_agent_type->netagent_type, kernel_policy->cond_agent_type.agent_type, NETAGENT_TYPESIZE) == 0)) { + // Found a required agent that matches + matches_agent_type = TRUE; + break; + } } if (!matches_agent_type) { - return (FALSE); + return FALSE; + } + } + + if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_NETWORKS) { + bool is_local = FALSE; + + if (rt != NULL) { + is_local = IS_NECP_DEST_IN_LOCAL_NETWORKS(rt); + } else { + is_local = necp_is_route_local(remote); + } + + if (!is_local) { + // Either no route to validate or no match for local networks + return FALSE; } } @@ -7107,22 +7442,22 @@ necp_socket_check_policy(struct necp_kernel_socket_policy *kernel_policy, necp_a bool inRange = necp_is_addr_in_range((struct sockaddr *)local, (struct sockaddr *)&kernel_policy->cond_local_start, (struct sockaddr *)&kernel_policy->cond_local_end); if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_LOCAL_END) { if (inRange) { - return (FALSE); + return FALSE; } } else { if (!inRange) { - return (FALSE); + return FALSE; } } } else if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_PREFIX) { bool inSubnet = necp_is_addr_in_subnet((struct sockaddr *)local, (struct sockaddr *)&kernel_policy->cond_local_start, kernel_policy->cond_local_prefix); if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_LOCAL_PREFIX) { if (inSubnet) { - return (FALSE); + return FALSE; } } else { if (!inSubnet) { - return (FALSE); + return FALSE; } } } @@ -7133,45 +7468,121 @@ necp_socket_check_policy(struct necp_kernel_socket_policy *kernel_policy, necp_a bool inRange = necp_is_addr_in_range((struct sockaddr *)remote, (struct sockaddr *)&kernel_policy->cond_remote_start, (struct sockaddr *)&kernel_policy->cond_remote_end); if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_REMOTE_END) { if (inRange) { - return (FALSE); + return FALSE; } } else { if (!inRange) { - return (FALSE); + return FALSE; } } } else if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX) { bool inSubnet = necp_is_addr_in_subnet((struct sockaddr *)remote, (struct sockaddr *)&kernel_policy->cond_remote_start, kernel_policy->cond_remote_prefix); if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX) { if (inSubnet) { - return (FALSE); + return FALSE; } } else { if (!inSubnet) { - return (FALSE); + return FALSE; } } } } - return (TRUE); + if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_CLIENT_FLAGS) { + if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_CLIENT_FLAGS) { + if ((client_flags & kernel_policy->cond_client_flags) == kernel_policy->cond_client_flags) { + // Flags do match, and condition is negative, fail. + return FALSE; + } + } else { + if ((client_flags & kernel_policy->cond_client_flags) != kernel_policy->cond_client_flags) { + // Flags do not match, fail. + return FALSE; + } + } + } + + if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_EMPTY) { + bool isEmpty = necp_addr_is_empty((struct sockaddr *)local); + if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_LOCAL_EMPTY) { + if (isEmpty) { + return FALSE; + } + } else { + if (!isEmpty) { + return FALSE; + } + } + } + + if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_EMPTY) { + bool isEmpty = necp_addr_is_empty((struct sockaddr *)remote); + if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_REMOTE_EMPTY) { + if (isEmpty) { + return FALSE; + } + } else { + if (!isEmpty) { + return FALSE; + } + } + } + + if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_PACKET_FILTER_TAGS) { + bool tags_matched = false; + if (kernel_policy->cond_packet_filter_tags & NECP_POLICY_CONDITION_PACKET_FILTER_TAG_STACK_DROP) { + if (pf_tag == PF_TAG_ID_STACK_DROP) { + tags_matched = true; + } + } + + if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_PACKET_FILTER_TAGS) { + if (tags_matched) { + return FALSE; + } + } else { + if (!tags_matched) { + return FALSE; + } + } + } + + if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_IS_LOOPBACK) { + if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_IS_LOOPBACK) { + if (is_loopback) { + return FALSE; + } + } else { + if (!is_loopback) { + return FALSE; + } + } + } + + return TRUE; } static inline u_int32_t necp_socket_calc_flowhash_locked(struct necp_socket_info *info) { - return (net_flowhash(info, sizeof(*info), necp_kernel_socket_policies_gencount)); + return net_flowhash(info, sizeof(*info), necp_kernel_socket_policies_gencount); } static void -necp_socket_fillout_info_locked(struct inpcb *inp, struct sockaddr *override_local_addr, struct sockaddr *override_remote_addr, u_int32_t override_bound_interface, struct necp_socket_info *info) +necp_socket_fillout_info_locked(struct inpcb *inp, struct sockaddr *override_local_addr, struct sockaddr *override_remote_addr, u_int32_t override_bound_interface, u_int32_t drop_order, proc_t *socket_proc, struct necp_socket_info *info, bool is_loopback) { struct socket *so = NULL; + proc_t sock_proc = NULL; + proc_t curr_proc = current_proc(); memset(info, 0, sizeof(struct necp_socket_info)); so = inp->inp_socket; + info->drop_order = drop_order; + info->is_loopback = is_loopback; + if (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_CONDITION_PID) { info->pid = ((so->so_flags & SOF_DELEGATED) ? so->e_pid : so->last_pid); } @@ -7184,6 +7595,30 @@ necp_socket_fillout_info_locked(struct inpcb *inp, struct sockaddr *override_loc info->traffic_class = so->so_traffic_class; } + if (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_CONDITION_HAS_CLIENT) { + info->has_client = !uuid_is_null(inp->necp_client_uuid); + } + + if (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_CONDITION_CLIENT_FLAGS) { + info->client_flags = 0; + if (INP_NO_CONSTRAINED(inp)) { + info->client_flags |= NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED; + } + if (INP_NO_EXPENSIVE(inp)) { + info->client_flags |= NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE; + } + if (inp->inp_socket->so_flags1 & SOF1_CELLFALLBACK) { + info->client_flags |= NECP_CLIENT_PARAMETER_FLAG_FALLBACK_TRAFFIC; + } + if (inp->inp_socket->so_flags1 & SOF1_INBOUND) { + info->client_flags |= NECP_CLIENT_PARAMETER_FLAG_INBOUND; + } + if (inp->inp_socket->so_options & SO_ACCEPTCONN || + inp->inp_flags2 & INP2_EXTERNAL_PORT) { + info->client_flags |= NECP_CLIENT_PARAMETER_FLAG_LISTENER; + } + } + if (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_CONDITION_PROTOCOL) { if (inp->inp_ip_p) { info->protocol = inp->inp_ip_p; @@ -7193,12 +7628,27 @@ necp_socket_fillout_info_locked(struct inpcb *inp, struct sockaddr *override_loc } if (inp->inp_flags2 & INP2_WANT_APP_POLICY && necp_kernel_socket_policies_condition_mask & NECP_KERNEL_CONDITION_APP_ID) { + u_int32_t responsible_application_id = 0; + struct necp_uuid_id_mapping *existing_mapping = necp_uuid_lookup_app_id_locked(((so->so_flags & SOF_DELEGATED) ? so->e_uuid : so->last_uuid)); if (existing_mapping) { info->application_id = existing_mapping->id; } - if (!(so->so_flags & SOF_DELEGATED)) { +#if defined(XNU_TARGET_OS_OSX) + if (so->so_rpid > 0) { + existing_mapping = necp_uuid_lookup_app_id_locked(so->so_ruuid); + if (existing_mapping != NULL) { + responsible_application_id = existing_mapping->id; + } + } +#endif + + if (responsible_application_id > 0) { + info->real_application_id = info->application_id; + info->application_id = responsible_application_id; + info->used_responsible_pid = true; + } else if (!(so->so_flags & SOF_DELEGATED)) { info->real_application_id = info->application_id; } else if (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_CONDITION_REAL_APP_ID) { struct necp_uuid_id_mapping *real_existing_mapping = necp_uuid_lookup_app_id_locked(so->last_uuid); @@ -7216,6 +7666,22 @@ necp_socket_fillout_info_locked(struct inpcb *inp, struct sockaddr *override_loc } } + pid_t socket_pid = +#if defined(XNU_TARGET_OS_OSX) + info->used_responsible_pid ? so->so_rpid : +#endif + ((so->so_flags & SOF_DELEGATED) ? so->e_pid : so->last_pid); + if (socket_pid && (socket_pid != proc_pid(curr_proc))) { + sock_proc = proc_find(socket_pid); + if (socket_proc) { + *socket_proc = sock_proc; + } + } + + if (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_CONDITION_PLATFORM_BINARY) { + info->is_platform_binary = necp_is_platform_binary(sock_proc ? sock_proc : curr_proc) ? true : false; + } + if (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_CONDITION_ACCOUNT_ID && inp->inp_necp_attributes.inp_account != NULL) { struct necp_string_id_mapping *existing_mapping = necp_lookup_string_to_id_locked(&necp_account_id_list, inp->inp_necp_attributes.inp_account); if (existing_mapping) { @@ -7235,46 +7701,53 @@ necp_socket_fillout_info_locked(struct inpcb *inp, struct sockaddr *override_loc } } - if (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_ADDRESS_TYPE_CONDITIONS) { - if (inp->inp_vflag & INP_IPV4) { - if (override_local_addr) { - if (override_local_addr->sa_len <= sizeof(struct sockaddr_in)) { - memcpy(&info->local_addr, override_local_addr, override_local_addr->sa_len); + if (necp_restrict_multicast || + (necp_kernel_socket_policies_condition_mask & NECP_KERNEL_ADDRESS_TYPE_CONDITIONS)) { + if (override_local_addr != NULL) { + if (override_local_addr->sa_family == AF_INET6 && override_local_addr->sa_len <= sizeof(struct sockaddr_in6)) { + memcpy(&info->local_addr, override_local_addr, override_local_addr->sa_len); + if (IN6_IS_ADDR_V4MAPPED(&(info->local_addr.sin6.sin6_addr))) { + struct sockaddr_in sin; + in6_sin6_2_sin(&sin, &(info->local_addr.sin6)); + memset(&info->local_addr, 0, sizeof(union necp_sockaddr_union)); + memcpy(&info->local_addr, &sin, sin.sin_len); } - } else { + } else if (override_local_addr->sa_family == AF_INET && override_local_addr->sa_len <= sizeof(struct sockaddr_in)) { + memcpy(&info->local_addr, override_local_addr, override_local_addr->sa_len); + } + } else { + if (inp->inp_vflag & INP_IPV4) { ((struct sockaddr_in *)&info->local_addr)->sin_family = AF_INET; ((struct sockaddr_in *)&info->local_addr)->sin_len = sizeof(struct sockaddr_in); ((struct sockaddr_in *)&info->local_addr)->sin_port = inp->inp_lport; memcpy(&((struct sockaddr_in *)&info->local_addr)->sin_addr, &inp->inp_laddr, sizeof(struct in_addr)); - } - - if (override_remote_addr) { - if (override_remote_addr->sa_len <= sizeof(struct sockaddr_in)) { - memcpy(&info->remote_addr, override_remote_addr, override_remote_addr->sa_len); - } - } else { - ((struct sockaddr_in *)&info->remote_addr)->sin_family = AF_INET; - ((struct sockaddr_in *)&info->remote_addr)->sin_len = sizeof(struct sockaddr_in); - ((struct sockaddr_in *)&info->remote_addr)->sin_port = inp->inp_fport; - memcpy(&((struct sockaddr_in *)&info->remote_addr)->sin_addr, &inp->inp_faddr, sizeof(struct in_addr)); - } - } else if (inp->inp_vflag & INP_IPV6) { - if (override_local_addr) { - if (override_local_addr->sa_len <= sizeof(struct sockaddr_in6)) { - memcpy(&info->local_addr, override_local_addr, override_local_addr->sa_len); - } - } else { + } else if (inp->inp_vflag & INP_IPV6) { ((struct sockaddr_in6 *)&info->local_addr)->sin6_family = AF_INET6; ((struct sockaddr_in6 *)&info->local_addr)->sin6_len = sizeof(struct sockaddr_in6); ((struct sockaddr_in6 *)&info->local_addr)->sin6_port = inp->inp_lport; memcpy(&((struct sockaddr_in6 *)&info->local_addr)->sin6_addr, &inp->in6p_laddr, sizeof(struct in6_addr)); } + } - if (override_remote_addr) { - if (override_remote_addr->sa_len <= sizeof(struct sockaddr_in6)) { - memcpy(&info->remote_addr, override_remote_addr, override_remote_addr->sa_len); + if (override_remote_addr != NULL) { + if (override_remote_addr->sa_family == AF_INET6 && override_remote_addr->sa_len <= sizeof(struct sockaddr_in6)) { + memcpy(&info->remote_addr, override_remote_addr, override_remote_addr->sa_len); + if (IN6_IS_ADDR_V4MAPPED(&(info->remote_addr.sin6.sin6_addr))) { + struct sockaddr_in sin; + in6_sin6_2_sin(&sin, &(info->remote_addr.sin6)); + memset(&info->remote_addr, 0, sizeof(union necp_sockaddr_union)); + memcpy(&info->remote_addr, &sin, sin.sin_len); } - } else { + } else if (override_remote_addr->sa_family == AF_INET && override_remote_addr->sa_len <= sizeof(struct sockaddr_in)) { + memcpy(&info->remote_addr, override_remote_addr, override_remote_addr->sa_len); + } + } else { + if (inp->inp_vflag & INP_IPV4) { + ((struct sockaddr_in *)&info->remote_addr)->sin_family = AF_INET; + ((struct sockaddr_in *)&info->remote_addr)->sin_len = sizeof(struct sockaddr_in); + ((struct sockaddr_in *)&info->remote_addr)->sin_port = inp->inp_fport; + memcpy(&((struct sockaddr_in *)&info->remote_addr)->sin_addr, &inp->inp_faddr, sizeof(struct in_addr)); + } else if (inp->inp_vflag & INP_IPV6) { ((struct sockaddr_in6 *)&info->remote_addr)->sin6_family = AF_INET6; ((struct sockaddr_in6 *)&info->remote_addr)->sin6_len = sizeof(struct sockaddr_in6); ((struct sockaddr_in6 *)&info->remote_addr)->sin6_port = inp->inp_fport; @@ -7286,45 +7759,76 @@ necp_socket_fillout_info_locked(struct inpcb *inp, struct sockaddr *override_loc static inline struct necp_kernel_socket_policy * necp_socket_find_policy_match_with_info_locked(struct necp_kernel_socket_policy **policy_search_array, struct necp_socket_info *info, - necp_kernel_policy_filter *return_filter, u_int32_t *return_route_rule_id, - necp_kernel_policy_result *return_service_action, necp_kernel_policy_service *return_service, - u_int32_t *return_netagent_array, u_int32_t *return_netagent_use_flags_array, size_t netagent_array_count, - struct necp_client_parameter_netagent_type *required_agent_types, - u_int32_t num_required_agent_types, proc_t proc, necp_kernel_policy_id *skip_policy_id) + necp_kernel_policy_filter *return_filter, + u_int32_t *return_route_rule_id_array, size_t *return_route_rule_id_array_count, size_t route_rule_id_array_count, + necp_kernel_policy_result *return_service_action, necp_kernel_policy_service *return_service, + u_int32_t *return_netagent_array, u_int32_t *return_netagent_use_flags_array, size_t netagent_array_count, + struct necp_client_parameter_netagent_type *required_agent_types, + u_int32_t num_required_agent_types, proc_t proc, u_int16_t pf_tag, necp_kernel_policy_id *skip_policy_id, struct rtentry *rt, + necp_kernel_policy_result *return_drop_dest_policy_result, necp_drop_all_bypass_check_result_t *return_drop_all_bypass, + u_int32_t *return_flow_divert_aggregate_unit) { struct necp_kernel_socket_policy *matched_policy = NULL; u_int32_t skip_order = 0; u_int32_t skip_session_order = 0; - u_int32_t route_rule_id_array[MAX_AGGREGATE_ROUTE_RULES]; size_t route_rule_id_count = 0; int i; size_t netagent_cursor = 0; + necp_drop_all_bypass_check_result_t drop_all_bypass = NECP_DROP_ALL_BYPASS_CHECK_RESULT_NONE; + if (return_drop_all_bypass != NULL) { + *return_drop_all_bypass = drop_all_bypass; + } // Pre-process domain for quick matching struct substring domain_substring = necp_trim_dots_and_stars(info->domain, info->domain ? strlen(info->domain) : 0); u_int8_t domain_dot_count = necp_count_dots(domain_substring.string, domain_substring.length); - if (return_filter) { + if (return_filter != NULL) { *return_filter = 0; } - if (return_route_rule_id) { - *return_route_rule_id = 0; + if (return_route_rule_id_array_count != NULL) { + *return_route_rule_id_array_count = 0; } - if (return_service_action) { + if (return_service_action != NULL) { *return_service_action = 0; } - if (return_service) { + if (return_service != NULL) { return_service->identifier = 0; return_service->data = 0; } + // Do not subject layer-2 filter to NECP policies, return a PASS policy + if (necp_pass_interpose > 0 && info->client_flags & NECP_CLIENT_PARAMETER_FLAG_INTERPOSE) { + return &pass_policy; + } + + *return_drop_dest_policy_result = NECP_KERNEL_POLICY_RESULT_NONE; + if (policy_search_array != NULL) { for (i = 0; policy_search_array[i] != NULL; i++) { if (necp_drop_all_order != 0 && policy_search_array[i]->session_order >= necp_drop_all_order) { // We've hit a drop all rule + if (drop_all_bypass == NECP_DROP_ALL_BYPASS_CHECK_RESULT_NONE) { + drop_all_bypass = necp_check_drop_all_bypass_result(proc); + if (return_drop_all_bypass != NULL) { + *return_drop_all_bypass = drop_all_bypass; + } + } + if (drop_all_bypass == NECP_DROP_ALL_BYPASS_CHECK_RESULT_FALSE) { + break; + } + } + if (necp_drop_dest_policy.entry_count != 0 && + necp_address_matches_drop_dest_policy(&info->remote_addr, policy_search_array[i]->session_order)) { + // We've hit a drop by destination address rule + *return_drop_dest_policy_result = NECP_KERNEL_POLICY_RESULT_DROP; + break; + } + if (info->drop_order != 0 && policy_search_array[i]->session_order >= info->drop_order) { + // We've hit a drop order for this socket break; } if (skip_session_order && policy_search_array[i]->session_order >= skip_session_order) { @@ -7345,18 +7849,24 @@ necp_socket_find_policy_match_with_info_locked(struct necp_kernel_socket_policy // Skip this policy continue; } - if (necp_socket_check_policy(policy_search_array[i], info->application_id, info->real_application_id, info->cred_result, info->account_id, domain_substring, domain_dot_count, info->pid, info->uid, info->bound_interface_index, info->traffic_class, info->protocol, &info->local_addr, &info->remote_addr, required_agent_types, num_required_agent_types, proc)) { + + if (necp_socket_check_policy(policy_search_array[i], info->application_id, info->real_application_id, info->cred_result, info->account_id, domain_substring, domain_dot_count, info->pid, info->uid, info->bound_interface_index, info->traffic_class, info->protocol, &info->local_addr, &info->remote_addr, required_agent_types, num_required_agent_types, info->has_client, info->client_flags, info->is_platform_binary, proc, pf_tag, rt, info->is_loopback)) { if (policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER) { - if (return_filter && *return_filter == 0) { - *return_filter = policy_search_array[i]->result_parameter.filter_control_unit; + if (return_filter && *return_filter != NECP_FILTER_UNIT_NO_FILTER) { + necp_kernel_policy_filter control_unit = policy_search_array[i]->result_parameter.filter_control_unit; + if (control_unit == NECP_FILTER_UNIT_NO_FILTER) { + *return_filter = control_unit; + } else { + *return_filter |= control_unit; + } if (necp_debug > 1) { NECPLOG(LOG_DEBUG, "Socket Policy: (Application %d Real Application %d BoundInterface %d Proto %d) Filter %d", info->application_id, info->real_application_id, info->bound_interface_index, info->protocol, policy_search_array[i]->result_parameter.filter_control_unit); } } continue; } else if (policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_ROUTE_RULES) { - if (return_route_rule_id && route_rule_id_count < MAX_AGGREGATE_ROUTE_RULES) { - route_rule_id_array[route_rule_id_count++] = policy_search_array[i]->result_parameter.route_rule_id; + if (return_route_rule_id_array && route_rule_id_count < route_rule_id_array_count) { + return_route_rule_id_array[route_rule_id_count++] = policy_search_array[i]->result_parameter.route_rule_id; if (necp_debug > 1) { NECPLOG(LOG_DEBUG, "Socket Policy: (Application %d Real Application %d BoundInterface %d Proto %d) Route Rule %d", info->application_id, info->real_application_id, info->bound_interface_index, info->protocol, policy_search_array[i]->result_parameter.route_rule_id); } @@ -7378,35 +7888,53 @@ necp_socket_find_policy_match_with_info_locked(struct necp_kernel_socket_policy } continue; } else if (policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_USE_NETAGENT || - policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED) { + policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED) { if (return_netagent_array != NULL && - netagent_cursor < netagent_array_count) { + netagent_cursor < netagent_array_count) { return_netagent_array[netagent_cursor] = policy_search_array[i]->result_parameter.netagent_id; if (return_netagent_use_flags_array != NULL && - policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED) { + policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED) { return_netagent_use_flags_array[netagent_cursor] |= NECP_AGENT_USE_FLAG_SCOPE; } netagent_cursor++; if (necp_debug > 1) { NECPLOG(LOG_DEBUG, "Socket Policy: (Application %d Real Application %d BoundInterface %d Proto %d) %s Netagent %d", - info->application_id, info->real_application_id, info->bound_interface_index, info->protocol, - policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_USE_NETAGENT ? "Use" : "Scope", - policy_search_array[i]->result_parameter.netagent_id); + info->application_id, info->real_application_id, info->bound_interface_index, info->protocol, + policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_USE_NETAGENT ? "Use" : "Scope", + policy_search_array[i]->result_parameter.netagent_id); } } continue; + } else if (policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT) { + u_int32_t control_unit = policy_search_array[i]->result_parameter.flow_divert_control_unit; + if (control_unit & FLOW_DIVERT_IS_TRANSPARENT) { + /* For transparent proxies, accumulate the control unit and continue to the next policy */ + if (return_flow_divert_aggregate_unit != NULL) { + *return_flow_divert_aggregate_unit |= (control_unit & ~FLOW_DIVERT_IS_TRANSPARENT); + if (necp_debug > 1) { + NECPLOG(LOG_DEBUG, "Socket Policy: (Application %d Real Application %d BoundInterface %d Proto %d) flow divert %u", info->application_id, info->real_application_id, info->bound_interface_index, info->protocol, control_unit); + } + } + continue; + } } // Matched policy is a skip. Do skip and continue. if (policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_SKIP) { skip_order = policy_search_array[i]->result_parameter.skip_policy_order; skip_session_order = policy_search_array[i]->session_order + 1; - if (skip_policy_id) { + if (skip_policy_id && *skip_policy_id == NECP_KERNEL_POLICY_ID_NONE) { *skip_policy_id = policy_search_array[i]->id; } continue; } + // Matched an allow unentitled, which clears any drop order + if (policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_ALLOW_UNENTITLED) { + info->drop_order = 0; + continue; + } + // Passed all tests, found a match matched_policy = policy_search_array[i]; break; @@ -7414,12 +7942,10 @@ necp_socket_find_policy_match_with_info_locked(struct necp_kernel_socket_policy } } - if (route_rule_id_count == 1) { - *return_route_rule_id = route_rule_id_array[0]; - } else if (route_rule_id_count > 1) { - *return_route_rule_id = necp_create_aggregate_route_rule(route_rule_id_array); + if (return_route_rule_id_array_count != NULL) { + *return_route_rule_id_array_count = route_rule_id_count; } - return (matched_policy); + return matched_policy; } static bool @@ -7434,7 +7960,7 @@ necp_socket_uses_interface(struct inpcb *inp, u_int32_t interface_index) ifnet_t interface = ifindex2ifnet[interface_index]; if (inp == NULL || interface == NULL) { - return (FALSE); + return FALSE; } if (inp->inp_vflag & INP_IPV4) { @@ -7446,7 +7972,7 @@ necp_socket_uses_interface(struct inpcb *inp, u_int32_t interface_index) result = ifnet_get_address_list_family(interface, &addresses, family); if (result != 0) { NECPLOG(LOG_ERR, "Failed to get address list for %s%d", ifnet_name(interface), ifnet_unit(interface)); - return (FALSE); + return FALSE; } for (i = 0; addresses[i] != NULL; i++) { @@ -7468,26 +7994,40 @@ necp_socket_uses_interface(struct inpcb *inp, u_int32_t interface_index) done: ifnet_free_address_list(addresses); addresses = NULL; - return (found_match); + return found_match; } static inline bool necp_socket_is_connected(struct inpcb *inp) { - return (inp->inp_socket->so_state & (SS_ISCONNECTING | SS_ISCONNECTED | SS_ISDISCONNECTING)); + return inp->inp_socket->so_state & (SS_ISCONNECTING | SS_ISCONNECTED | SS_ISDISCONNECTING); } -static inline bool +static inline necp_socket_bypass_type_t necp_socket_bypass(struct sockaddr *override_local_addr, struct sockaddr *override_remote_addr, struct inpcb *inp) { - - if (necp_pass_loopback > 0 && necp_is_loopback(override_local_addr, override_remote_addr, inp, NULL)) { - return (true); + if (necp_pass_loopback > 0 && necp_is_loopback(override_local_addr, override_remote_addr, inp, NULL, IFSCOPE_NONE)) { + return NECP_BYPASS_TYPE_LOOPBACK; } else if (necp_is_intcoproc(inp, NULL)) { - return (true); + return NECP_BYPASS_TYPE_INTCOPROC; } - return (false); + return NECP_BYPASS_TYPE_NONE; +} + +static inline void +necp_socket_ip_tunnel_tso(struct inpcb *inp) +{ + u_int tunnel_interface_index = inp->inp_policyresult.results.result_parameter.tunnel_interface_index; + ifnet_t tunnel_interface = NULL; + + ifnet_head_lock_shared(); + tunnel_interface = ifindex2ifnet[tunnel_interface_index]; + ifnet_head_done(); + + if (tunnel_interface != NULL) { + tcp_set_tso(intotcpcb(inp), tunnel_interface); + } } necp_kernel_policy_id @@ -7495,11 +8035,14 @@ necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local { struct socket *so = NULL; necp_kernel_policy_filter filter_control_unit = 0; - u_int32_t route_rule_id = 0; struct necp_kernel_socket_policy *matched_policy = NULL; necp_kernel_policy_id matched_policy_id = NECP_KERNEL_POLICY_ID_NONE; necp_kernel_policy_result service_action = 0; necp_kernel_policy_service service = { 0, 0 }; + u_int32_t drop_dest_policy_result = NECP_KERNEL_POLICY_RESULT_NONE; + necp_drop_all_bypass_check_result_t drop_all_bypass = NECP_DROP_ALL_BYPASS_CHECK_RESULT_NONE; + proc_t socket_proc = NULL; + necp_socket_bypass_type_t bypass_type = NECP_BYPASS_TYPE_NONE; u_int32_t netagent_ids[NECP_MAX_NETAGENTS]; memset(&netagent_ids, 0, sizeof(netagent_ids)); @@ -7507,44 +8050,55 @@ necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local struct necp_socket_info info; + u_int32_t flow_divert_aggregate_unit = 0; + if (inp == NULL) { - return (NECP_KERNEL_POLICY_ID_NONE); + return NECP_KERNEL_POLICY_ID_NONE; } // Ignore invalid addresses if (override_local_addr != NULL && - !necp_address_is_valid(override_local_addr)) { + !necp_address_is_valid(override_local_addr)) { override_local_addr = NULL; } if (override_remote_addr != NULL && - !necp_address_is_valid(override_remote_addr)) { + !necp_address_is_valid(override_remote_addr)) { override_remote_addr = NULL; } so = inp->inp_socket; + u_int32_t drop_order = necp_process_drop_order(so->so_cred); + // Don't lock. Possible race condition, but we don't want the performance hit. if (necp_kernel_socket_policies_count == 0 || - (!(inp->inp_flags2 & INP2_WANT_APP_POLICY) && necp_kernel_socket_policies_non_app_count == 0)) { - if (necp_drop_all_order > 0) { + (!(inp->inp_flags2 & INP2_WANT_APP_POLICY) && necp_kernel_socket_policies_non_app_count == 0)) { + if (necp_drop_all_order > 0 || drop_order > 0) { inp->inp_policyresult.policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; inp->inp_policyresult.skip_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; inp->inp_policyresult.policy_gencount = 0; inp->inp_policyresult.app_id = 0; inp->inp_policyresult.flowhash = 0; inp->inp_policyresult.results.filter_control_unit = 0; + inp->inp_policyresult.results.flow_divert_aggregate_unit = 0; inp->inp_policyresult.results.route_rule_id = 0; - if (necp_socket_bypass(override_local_addr, override_remote_addr, inp)) { + if (necp_socket_bypass(override_local_addr, override_remote_addr, inp) != NECP_BYPASS_TYPE_NONE) { inp->inp_policyresult.results.result = NECP_KERNEL_POLICY_RESULT_PASS; } else { inp->inp_policyresult.results.result = NECP_KERNEL_POLICY_RESULT_DROP; } } - return (NECP_KERNEL_POLICY_ID_NONE); + return NECP_KERNEL_POLICY_ID_NONE; } // Check for loopback exception - if (necp_socket_bypass(override_local_addr, override_remote_addr, inp)) { + bypass_type = necp_socket_bypass(override_local_addr, override_remote_addr, inp); + if (bypass_type == NECP_BYPASS_TYPE_INTCOPROC || (bypass_type == NECP_BYPASS_TYPE_LOOPBACK && necp_pass_loopback == NECP_LOOPBACK_PASS_ALL)) { + if (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) { + // If the previous policy result was "socket scoped", un-scope the socket. + inp->inp_flags &= ~INP_BOUND_IF; + inp->inp_boundifp = NULL; + } // Mark socket as a pass inp->inp_policyresult.policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; inp->inp_policyresult.skip_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; @@ -7552,39 +8106,77 @@ necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local inp->inp_policyresult.app_id = 0; inp->inp_policyresult.flowhash = 0; inp->inp_policyresult.results.filter_control_unit = 0; + inp->inp_policyresult.results.flow_divert_aggregate_unit = 0; inp->inp_policyresult.results.route_rule_id = 0; inp->inp_policyresult.results.result = NECP_KERNEL_POLICY_RESULT_PASS; - return (NECP_KERNEL_POLICY_ID_NONE); + return NECP_KERNEL_POLICY_ID_NONE; } // Lock lck_rw_lock_shared(&necp_kernel_policy_lock); - - necp_socket_fillout_info_locked(inp, override_local_addr, override_remote_addr, override_bound_interface, &info); - inp->inp_policyresult.app_id = info.application_id; + necp_socket_fillout_info_locked(inp, override_local_addr, override_remote_addr, override_bound_interface, drop_order, &socket_proc, &info, (bypass_type == NECP_BYPASS_TYPE_LOOPBACK)); // Check info u_int32_t flowhash = necp_socket_calc_flowhash_locked(&info); if (inp->inp_policyresult.policy_id != NECP_KERNEL_POLICY_ID_NONE && - inp->inp_policyresult.policy_gencount == necp_kernel_socket_policies_gencount && - inp->inp_policyresult.flowhash == flowhash) { + inp->inp_policyresult.policy_gencount == necp_kernel_socket_policies_gencount && + inp->inp_policyresult.flowhash == flowhash) { // If already matched this socket on this generation of table, skip // Unlock lck_rw_done(&necp_kernel_policy_lock); - return (inp->inp_policyresult.policy_id); + if (socket_proc) { + proc_rele(socket_proc); + } + + return inp->inp_policyresult.policy_id; } + inp->inp_policyresult.app_id = info.application_id; + // Match socket to policy - necp_kernel_policy_id skip_policy_id; - matched_policy = necp_socket_find_policy_match_with_info_locked(necp_kernel_socket_policies_map[NECP_SOCKET_MAP_APP_ID_TO_BUCKET(info.application_id)], &info, &filter_control_unit, &route_rule_id, &service_action, &service, netagent_ids, NULL, NECP_MAX_NETAGENTS, NULL, 0, current_proc(), &skip_policy_id); + necp_kernel_policy_id skip_policy_id = NECP_KERNEL_POLICY_ID_NONE; + u_int32_t route_rule_id_array[MAX_AGGREGATE_ROUTE_RULES]; + size_t route_rule_id_array_count = 0; + matched_policy = necp_socket_find_policy_match_with_info_locked(necp_kernel_socket_policies_map[NECP_SOCKET_MAP_APP_ID_TO_BUCKET(info.application_id)], &info, &filter_control_unit, route_rule_id_array, &route_rule_id_array_count, MAX_AGGREGATE_ROUTE_RULES, &service_action, &service, netagent_ids, NULL, NECP_MAX_NETAGENTS, NULL, 0, socket_proc ? socket_proc : current_proc(), 0, &skip_policy_id, inp->inp_route.ro_rt, &drop_dest_policy_result, &drop_all_bypass, &flow_divert_aggregate_unit); + + // Check for loopback exception again after the policy match + if (bypass_type == NECP_BYPASS_TYPE_LOOPBACK && + necp_pass_loopback == NECP_LOOPBACK_PASS_WITH_FILTER && + (matched_policy == NULL || matched_policy->result != NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT)) { + if (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) { + // If the previous policy result was "socket scoped", un-scope the socket. + inp->inp_flags &= ~INP_BOUND_IF; + inp->inp_boundifp = NULL; + } + // Mark socket as a pass + inp->inp_policyresult.policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; + inp->inp_policyresult.skip_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; + inp->inp_policyresult.policy_gencount = 0; + inp->inp_policyresult.app_id = 0; + inp->inp_policyresult.flowhash = 0; + inp->inp_policyresult.results.filter_control_unit = filter_control_unit; + inp->inp_policyresult.results.flow_divert_aggregate_unit = flow_divert_aggregate_unit; + inp->inp_policyresult.results.route_rule_id = 0; + inp->inp_policyresult.results.result = NECP_KERNEL_POLICY_RESULT_PASS; + + // Unlock + lck_rw_done(&necp_kernel_policy_lock); + + if (socket_proc) { + proc_rele(socket_proc); + } + + return NECP_KERNEL_POLICY_ID_NONE; + } + // If the socket matched a scoped service policy, mark as Drop if not registered. // This covers the cases in which a service is required (on demand) but hasn't started yet. if ((service_action == NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED || - service_action == NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED) && - service.identifier != 0 && - service.identifier != NECP_NULL_SERVICE_ID) { + service_action == NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED) && + service.identifier != 0 && + service.identifier != NECP_NULL_SERVICE_ID) { bool service_is_registered = FALSE; struct necp_service_registration *service_registration = NULL; LIST_FOREACH(service_registration, &necp_registered_service_list, kernel_chain) { @@ -7600,6 +8192,7 @@ necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local inp->inp_policyresult.policy_gencount = necp_kernel_socket_policies_gencount; inp->inp_policyresult.flowhash = flowhash; inp->inp_policyresult.results.filter_control_unit = 0; + inp->inp_policyresult.results.flow_divert_aggregate_unit = 0; inp->inp_policyresult.results.route_rule_id = 0; inp->inp_policyresult.results.result = NECP_KERNEL_POLICY_RESULT_DROP; @@ -7609,7 +8202,12 @@ necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local // Unlock lck_rw_done(&necp_kernel_policy_lock); - return (NECP_KERNEL_POLICY_ID_NONE); + + if (socket_proc) { + proc_rele(socket_proc); + } + + return NECP_KERNEL_POLICY_ID_NONE; } } // Verify netagents @@ -7641,6 +8239,7 @@ necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local inp->inp_policyresult.policy_gencount = necp_kernel_socket_policies_gencount; inp->inp_policyresult.flowhash = flowhash; inp->inp_policyresult.results.filter_control_unit = 0; + inp->inp_policyresult.results.flow_divert_aggregate_unit = 0; inp->inp_policyresult.results.route_rule_id = 0; inp->inp_policyresult.results.result = NECP_KERNEL_POLICY_RESULT_DROP; @@ -7650,11 +8249,26 @@ necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local // Unlock lck_rw_done(&necp_kernel_policy_lock); - return (NECP_KERNEL_POLICY_ID_NONE); + + if (socket_proc) { + proc_rele(socket_proc); + } + + return NECP_KERNEL_POLICY_ID_NONE; } } } } + + u_int32_t route_rule_id = 0; + if (route_rule_id_array_count == 1) { + route_rule_id = route_rule_id_array[0]; + } else if (route_rule_id_array_count > 1) { + route_rule_id = necp_create_aggregate_route_rule(route_rule_id_array); + } + + bool reset_tcp_tunnel_interface = false; + bool send_local_network_denied_event = false; if (matched_policy) { matched_policy_id = matched_policy->id; inp->inp_policyresult.policy_id = matched_policy->id; @@ -7662,55 +8276,108 @@ necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local inp->inp_policyresult.policy_gencount = necp_kernel_socket_policies_gencount; inp->inp_policyresult.flowhash = flowhash; inp->inp_policyresult.results.filter_control_unit = filter_control_unit; + inp->inp_policyresult.results.flow_divert_aggregate_unit = flow_divert_aggregate_unit; inp->inp_policyresult.results.route_rule_id = route_rule_id; inp->inp_policyresult.results.result = matched_policy->result; memcpy(&inp->inp_policyresult.results.result_parameter, &matched_policy->result_parameter, sizeof(matched_policy->result_parameter)); + if (info.used_responsible_pid && (matched_policy->condition_mask & NECP_KERNEL_CONDITION_REAL_APP_ID)) { + inp->inp_policyresult.app_id = info.real_application_id; + } + if (necp_socket_is_connected(inp) && - (matched_policy->result == NECP_KERNEL_POLICY_RESULT_DROP || - (matched_policy->result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL && !necp_socket_uses_interface(inp, matched_policy->result_parameter.tunnel_interface_index)))) { + (matched_policy->result == NECP_KERNEL_POLICY_RESULT_DROP || + (matched_policy->result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL && !necp_socket_uses_interface(inp, matched_policy->result_parameter.tunnel_interface_index)))) { if (necp_debug) { NECPLOG(LOG_DEBUG, "Marking socket in state %d as defunct", so->so_state); } sosetdefunct(current_proc(), so, SHUTDOWN_SOCKET_LEVEL_NECP | SHUTDOWN_SOCKET_LEVEL_DISCONNECT_ALL, TRUE); } else if (necp_socket_is_connected(inp) && - matched_policy->result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL && - info.protocol == IPPROTO_TCP) { - // Reset MSS on TCP socket if tunnel policy changes - tcp_mtudisc(inp, 0); + matched_policy->result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL && + info.protocol == IPPROTO_TCP) { + // Reset TCP socket interface based parameters if tunnel policy changes + reset_tcp_tunnel_interface = true; } if (necp_debug > 1) { NECPLOG(LOG_DEBUG, "Socket Policy: %p (BoundInterface %d Proto %d) Policy %d Result %d Parameter %d", inp->inp_socket, info.bound_interface_index, info.protocol, matched_policy->id, matched_policy->result, matched_policy->result_parameter.tunnel_interface_index); } - } else if (necp_drop_all_order > 0) { - // Mark socket as a drop if set + + if (matched_policy->result == NECP_KERNEL_POLICY_RESULT_DROP && + matched_policy->result_parameter.drop_flags & NECP_KERNEL_POLICY_DROP_FLAG_LOCAL_NETWORK) { + // Trigger the event that we dropped due to a local network policy + send_local_network_denied_event = true; + } + } else { + bool drop_all = false; + if (necp_drop_all_order > 0 || info.drop_order > 0 || drop_dest_policy_result == NECP_KERNEL_POLICY_RESULT_DROP) { + // Mark socket as a drop if set + drop_all = true; + if (drop_all_bypass == NECP_DROP_ALL_BYPASS_CHECK_RESULT_NONE) { + drop_all_bypass = necp_check_drop_all_bypass_result(socket_proc ? socket_proc : current_proc()); + } + } + if (drop_all && drop_all_bypass == NECP_DROP_ALL_BYPASS_CHECK_RESULT_FALSE) { + inp->inp_policyresult.policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; + inp->inp_policyresult.skip_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; + inp->inp_policyresult.policy_gencount = necp_kernel_socket_policies_gencount; + inp->inp_policyresult.flowhash = flowhash; + inp->inp_policyresult.results.filter_control_unit = 0; + inp->inp_policyresult.results.flow_divert_aggregate_unit = 0; + inp->inp_policyresult.results.route_rule_id = 0; + inp->inp_policyresult.results.result = NECP_KERNEL_POLICY_RESULT_DROP; + } else { + // Mark non-matching socket so we don't re-check it + inp->inp_policyresult.policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; + inp->inp_policyresult.skip_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; + inp->inp_policyresult.policy_gencount = necp_kernel_socket_policies_gencount; + inp->inp_policyresult.flowhash = flowhash; + inp->inp_policyresult.results.filter_control_unit = filter_control_unit; // We may have matched a filter, so mark it! + inp->inp_policyresult.results.flow_divert_aggregate_unit = flow_divert_aggregate_unit; + inp->inp_policyresult.results.route_rule_id = route_rule_id; // We may have matched a route rule, so mark it! + inp->inp_policyresult.results.result = NECP_KERNEL_POLICY_RESULT_NONE; + } + } + + if (necp_check_missing_client_drop(socket_proc ? socket_proc : current_proc(), &info) || + necp_check_restricted_multicast_drop(socket_proc ? socket_proc : current_proc(), &info, false)) { + // Mark as drop inp->inp_policyresult.policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; inp->inp_policyresult.skip_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; inp->inp_policyresult.policy_gencount = necp_kernel_socket_policies_gencount; inp->inp_policyresult.flowhash = flowhash; inp->inp_policyresult.results.filter_control_unit = 0; + inp->inp_policyresult.results.flow_divert_aggregate_unit = 0; inp->inp_policyresult.results.route_rule_id = 0; inp->inp_policyresult.results.result = NECP_KERNEL_POLICY_RESULT_DROP; - } else { - // Mark non-matching socket so we don't re-check it - inp->inp_policyresult.policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; - inp->inp_policyresult.skip_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; - inp->inp_policyresult.policy_gencount = necp_kernel_socket_policies_gencount; - inp->inp_policyresult.flowhash = flowhash; - inp->inp_policyresult.results.filter_control_unit = filter_control_unit; // We may have matched a filter, so mark it! - inp->inp_policyresult.results.route_rule_id = route_rule_id; // We may have matched a route rule, so mark it! - inp->inp_policyresult.results.result = NECP_KERNEL_POLICY_RESULT_NONE; } // Unlock lck_rw_done(&necp_kernel_policy_lock); - return (matched_policy_id); + if (reset_tcp_tunnel_interface) { + // Update MSS when not holding the policy lock to avoid recursive locking + tcp_mtudisc(inp, 0); + + // Update TSO flag based on the tunnel interface + necp_socket_ip_tunnel_tso(inp); + } + + if (send_local_network_denied_event) { + necp_send_network_denied_event(((so->so_flags & SOF_DELEGATED) ? so->e_pid : so->last_pid), + ((so->so_flags & SOF_DELEGATED) ? so->e_uuid : so->last_uuid), + NETPOLICY_NETWORKTYPE_LOCAL); + } + + if (socket_proc) { + proc_rele(socket_proc); + } + + return matched_policy_id; } static bool -necp_ip_output_check_policy(struct necp_kernel_ip_output_policy *kernel_policy, necp_kernel_policy_id socket_policy_id, necp_kernel_policy_id socket_skip_policy_id, u_int32_t bound_interface_index, u_int32_t last_interface_index, u_int16_t protocol, union necp_sockaddr_union *local, union necp_sockaddr_union *remote) +necp_ip_output_check_policy(struct necp_kernel_ip_output_policy *kernel_policy, necp_kernel_policy_id socket_policy_id, necp_kernel_policy_id socket_skip_policy_id, u_int32_t bound_interface_index, u_int32_t last_interface_index, u_int16_t protocol, union necp_sockaddr_union *local, union necp_sockaddr_union *remote, struct rtentry *rt, u_int16_t pf_tag) { if (!(kernel_policy->condition_mask & NECP_KERNEL_CONDITION_ALL_INTERFACES)) { if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE) { @@ -7718,38 +8385,38 @@ necp_ip_output_check_policy(struct necp_kernel_ip_output_policy *kernel_policy, if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_BOUND_INTERFACE) { if (bound_interface_index == cond_bound_interface_index) { // No match, matches forbidden interface - return (FALSE); + return FALSE; } } else { if (bound_interface_index != cond_bound_interface_index) { // No match, does not match required interface - return (FALSE); + return FALSE; } } } else { if (bound_interface_index != 0) { // No match, requires a non-bound packet - return (FALSE); + return FALSE; } } } if (kernel_policy->condition_mask == 0) { - return (TRUE); + return TRUE; } if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_POLICY_ID) { necp_kernel_policy_id matched_policy_id = - kernel_policy->result == NECP_KERNEL_POLICY_RESULT_SKIP ? socket_skip_policy_id : socket_policy_id; + kernel_policy->result == NECP_KERNEL_POLICY_RESULT_SKIP ? socket_skip_policy_id : socket_policy_id; if (matched_policy_id != kernel_policy->cond_policy_id) { // No match, does not match required id - return (FALSE); + return FALSE; } } if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LAST_INTERFACE) { if (last_interface_index != kernel_policy->cond_last_interface_index) { - return (FALSE); + return FALSE; } } @@ -7757,37 +8424,52 @@ necp_ip_output_check_policy(struct necp_kernel_ip_output_policy *kernel_policy, if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_PROTOCOL) { if (protocol == kernel_policy->cond_protocol) { // No match, matches forbidden protocol - return (FALSE); + return FALSE; } } else { if (protocol != kernel_policy->cond_protocol) { // No match, does not match required protocol - return (FALSE); + return FALSE; } } } + if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_NETWORKS) { + bool is_local = FALSE; + + if (rt != NULL) { + is_local = IS_NECP_DEST_IN_LOCAL_NETWORKS(rt); + } else { + is_local = necp_is_route_local(remote); + } + + if (!is_local) { + // Either no route to validate or no match for local networks + return FALSE; + } + } + if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_START) { if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_END) { bool inRange = necp_is_addr_in_range((struct sockaddr *)local, (struct sockaddr *)&kernel_policy->cond_local_start, (struct sockaddr *)&kernel_policy->cond_local_end); if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_LOCAL_END) { if (inRange) { - return (FALSE); + return FALSE; } } else { if (!inRange) { - return (FALSE); + return FALSE; } } } else if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_LOCAL_PREFIX) { bool inSubnet = necp_is_addr_in_subnet((struct sockaddr *)local, (struct sockaddr *)&kernel_policy->cond_local_start, kernel_policy->cond_local_prefix); if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_LOCAL_PREFIX) { if (inSubnet) { - return (FALSE); + return FALSE; } } else { if (!inSubnet) { - return (FALSE); + return FALSE; } } } @@ -7798,42 +8480,88 @@ necp_ip_output_check_policy(struct necp_kernel_ip_output_policy *kernel_policy, bool inRange = necp_is_addr_in_range((struct sockaddr *)remote, (struct sockaddr *)&kernel_policy->cond_remote_start, (struct sockaddr *)&kernel_policy->cond_remote_end); if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_REMOTE_END) { if (inRange) { - return (FALSE); + return FALSE; } } else { if (!inRange) { - return (FALSE); + return FALSE; } } } else if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX) { bool inSubnet = necp_is_addr_in_subnet((struct sockaddr *)remote, (struct sockaddr *)&kernel_policy->cond_remote_start, kernel_policy->cond_remote_prefix); if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_REMOTE_PREFIX) { if (inSubnet) { - return (FALSE); + return FALSE; } } else { if (!inSubnet) { - return (FALSE); + return FALSE; + } + } + } + } + + if (kernel_policy->condition_mask & NECP_KERNEL_CONDITION_PACKET_FILTER_TAGS) { + bool tags_matched = false; + + if (kernel_policy->cond_packet_filter_tags & NECP_POLICY_CONDITION_PACKET_FILTER_TAG_STACK_DROP) { + if ((pf_tag & PF_TAG_ID_STACK_DROP) == PF_TAG_ID_STACK_DROP) { + tags_matched = true; + } + + if (kernel_policy->condition_negated_mask & NECP_KERNEL_CONDITION_PACKET_FILTER_TAGS) { + if (tags_matched) { + return FALSE; + } + } else { + if (!tags_matched) { + return FALSE; } } } } - return (TRUE); + return TRUE; } static inline struct necp_kernel_ip_output_policy * -necp_ip_output_find_policy_match_locked(necp_kernel_policy_id socket_policy_id, necp_kernel_policy_id socket_skip_policy_id, u_int32_t bound_interface_index, u_int32_t last_interface_index, u_int16_t protocol, union necp_sockaddr_union *local_addr, union necp_sockaddr_union *remote_addr) +necp_ip_output_find_policy_match_locked(necp_kernel_policy_id socket_policy_id, necp_kernel_policy_id socket_skip_policy_id, u_int32_t bound_interface_index, u_int32_t last_interface_index, u_int16_t protocol, union necp_sockaddr_union *local_addr, union necp_sockaddr_union *remote_addr, struct rtentry *rt, u_int16_t pf_tag, u_int32_t *return_route_rule_id, necp_kernel_policy_result *return_drop_dest_policy_result, necp_drop_all_bypass_check_result_t *return_drop_all_bypass) { u_int32_t skip_order = 0; u_int32_t skip_session_order = 0; - int i; struct necp_kernel_ip_output_policy *matched_policy = NULL; struct necp_kernel_ip_output_policy **policy_search_array = necp_kernel_ip_output_policies_map[NECP_IP_OUTPUT_MAP_ID_TO_BUCKET(socket_policy_id)]; + u_int32_t route_rule_id_array[MAX_AGGREGATE_ROUTE_RULES]; + size_t route_rule_id_count = 0; + necp_drop_all_bypass_check_result_t drop_all_bypass = NECP_DROP_ALL_BYPASS_CHECK_RESULT_NONE; + if (return_drop_all_bypass != NULL) { + *return_drop_all_bypass = drop_all_bypass; + } + + if (return_route_rule_id != NULL) { + *return_route_rule_id = 0; + } + + *return_drop_dest_policy_result = NECP_KERNEL_POLICY_RESULT_NONE; + if (policy_search_array != NULL) { - for (i = 0; policy_search_array[i] != NULL; i++) { + for (int i = 0; policy_search_array[i] != NULL; i++) { if (necp_drop_all_order != 0 && policy_search_array[i]->session_order >= necp_drop_all_order) { // We've hit a drop all rule + if (drop_all_bypass == NECP_DROP_ALL_BYPASS_CHECK_RESULT_NONE) { + drop_all_bypass = necp_check_drop_all_bypass_result(NULL); + if (return_drop_all_bypass != NULL) { + *return_drop_all_bypass = drop_all_bypass; + } + } + if (drop_all_bypass == NECP_DROP_ALL_BYPASS_CHECK_RESULT_FALSE) { + break; + } + } + if (necp_drop_dest_policy.entry_count > 0 && + necp_address_matches_drop_dest_policy(remote_addr, policy_search_array[i]->session_order)) { + // We've hit a drop by destination address rule + *return_drop_dest_policy_result = NECP_KERNEL_POLICY_RESULT_DROP; break; } if (skip_session_order && policy_search_array[i]->session_order >= skip_session_order) { @@ -7854,41 +8582,53 @@ necp_ip_output_find_policy_match_locked(necp_kernel_policy_id socket_policy_id, // Skip this policy continue; } - if (necp_ip_output_check_policy(policy_search_array[i], socket_policy_id, socket_skip_policy_id, bound_interface_index, last_interface_index, protocol, local_addr, remote_addr)) { - // Passed all tests, found a match - matched_policy = policy_search_array[i]; - if (policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_SKIP) { + if (necp_ip_output_check_policy(policy_search_array[i], socket_policy_id, socket_skip_policy_id, bound_interface_index, last_interface_index, protocol, local_addr, remote_addr, rt, pf_tag)) { + if (policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_ROUTE_RULES) { + if (return_route_rule_id != NULL && route_rule_id_count < MAX_AGGREGATE_ROUTE_RULES) { + route_rule_id_array[route_rule_id_count++] = policy_search_array[i]->result_parameter.route_rule_id; + } + continue; + } else if (policy_search_array[i]->result == NECP_KERNEL_POLICY_RESULT_SKIP) { skip_order = policy_search_array[i]->result_parameter.skip_policy_order; skip_session_order = policy_search_array[i]->session_order + 1; continue; } + // Passed all tests, found a match + matched_policy = policy_search_array[i]; break; } } } - return (matched_policy); + if (route_rule_id_count == 1) { + *return_route_rule_id = route_rule_id_array[0]; + } else if (route_rule_id_count > 1) { + *return_route_rule_id = necp_create_aggregate_route_rule(route_rule_id_array); + } + + return matched_policy; } static inline bool necp_output_bypass(struct mbuf *packet) { - if (necp_pass_loopback > 0 && necp_is_loopback(NULL, NULL, NULL, packet)) { - return (true); + if (necp_pass_loopback > 0 && necp_is_loopback(NULL, NULL, NULL, packet, IFSCOPE_NONE)) { + return true; } if (necp_pass_keepalives > 0 && necp_get_is_keepalive_from_packet(packet)) { - return (true); + return true; } if (necp_is_intcoproc(NULL, packet)) { - return (true); + return true; } - return (false); + return false; } necp_kernel_policy_id -necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_args *ipoa, necp_kernel_policy_result *result, necp_kernel_policy_result_parameter *result_parameter) +necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_args *ipoa, struct rtentry *rt, + necp_kernel_policy_result *result, necp_kernel_policy_result_parameter *result_parameter) { struct ip *ip = NULL; int hlen = sizeof(struct ip); @@ -7901,6 +8641,9 @@ necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_a u_int32_t last_interface_index = 0; union necp_sockaddr_union local_addr; union necp_sockaddr_union remote_addr; + u_int32_t drop_dest_policy_result = NECP_KERNEL_POLICY_RESULT_NONE; + necp_drop_all_bypass_check_result_t drop_all_bypass = NECP_DROP_ALL_BYPASS_CHECK_RESULT_NONE; + u_int16_t pf_tag = 0; if (result) { *result = 0; @@ -7911,16 +8654,17 @@ necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_a } if (packet == NULL) { - return (NECP_KERNEL_POLICY_ID_NONE); + return NECP_KERNEL_POLICY_ID_NONE; } socket_policy_id = necp_get_policy_id_from_packet(packet); socket_skip_policy_id = necp_get_skip_policy_id_from_packet(packet); + pf_tag = necp_get_packet_filter_tags_from_packet(packet); // Exit early for an empty list // Don't lock. Possible race condition, but we don't want the performance hit. if (necp_kernel_ip_output_policies_count == 0 || - ((socket_policy_id == NECP_KERNEL_POLICY_ID_NONE) && necp_kernel_ip_output_policies_non_id_count == 0)) { + (socket_policy_id == NECP_KERNEL_POLICY_ID_NONE && necp_kernel_ip_output_policies_non_id_count == 0 && necp_drop_dest_policy.entry_count == 0)) { if (necp_drop_all_order > 0) { matched_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; if (result) { @@ -7932,7 +8676,7 @@ necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_a } } - return (matched_policy_id); + return matched_policy_id; } // Check for loopback exception @@ -7941,7 +8685,7 @@ necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_a if (result) { *result = NECP_KERNEL_POLICY_RESULT_PASS; } - return (matched_policy_id); + return matched_policy_id; } last_interface_index = necp_get_last_interface_index_from_packet(packet); @@ -7957,8 +8701,8 @@ necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_a protocol = ip->ip_p; if ((flags & IP_OUTARGS) && (ipoa != NULL) && - (ipoa->ipoa_flags & IPOAF_BOUND_IF) && - ipoa->ipoa_boundif != IFSCOPE_NONE) { + (ipoa->ipoa_flags & IPOAF_BOUND_IF) && + ipoa->ipoa_boundif != IFSCOPE_NONE) { bound_interface_index = ipoa->ipoa_boundif; } @@ -7971,34 +8715,35 @@ necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_a memcpy(&((struct sockaddr_in *)&remote_addr)->sin_addr, &ip->ip_dst, sizeof(ip->ip_dst)); switch (protocol) { - case IPPROTO_TCP: { - struct tcphdr th; - if ((int)(hlen + sizeof(th)) <= packet->m_pkthdr.len) { - m_copydata(packet, hlen, sizeof(th), (u_int8_t *)&th); - ((struct sockaddr_in *)&local_addr)->sin_port = th.th_sport; - ((struct sockaddr_in *)&remote_addr)->sin_port = th.th_dport; - } - break; - } - case IPPROTO_UDP: { - struct udphdr uh; - if ((int)(hlen + sizeof(uh)) <= packet->m_pkthdr.len) { - m_copydata(packet, hlen, sizeof(uh), (u_int8_t *)&uh); - ((struct sockaddr_in *)&local_addr)->sin_port = uh.uh_sport; - ((struct sockaddr_in *)&remote_addr)->sin_port = uh.uh_dport; - } - break; + case IPPROTO_TCP: { + struct tcphdr th; + if ((int)(hlen + sizeof(th)) <= packet->m_pkthdr.len) { + m_copydata(packet, hlen, sizeof(th), (u_int8_t *)&th); + ((struct sockaddr_in *)&local_addr)->sin_port = th.th_sport; + ((struct sockaddr_in *)&remote_addr)->sin_port = th.th_dport; } - default: { - ((struct sockaddr_in *)&local_addr)->sin_port = 0; - ((struct sockaddr_in *)&remote_addr)->sin_port = 0; - break; + break; + } + case IPPROTO_UDP: { + struct udphdr uh; + if ((int)(hlen + sizeof(uh)) <= packet->m_pkthdr.len) { + m_copydata(packet, hlen, sizeof(uh), (u_int8_t *)&uh); + ((struct sockaddr_in *)&local_addr)->sin_port = uh.uh_sport; + ((struct sockaddr_in *)&remote_addr)->sin_port = uh.uh_dport; } + break; + } + default: { + ((struct sockaddr_in *)&local_addr)->sin_port = 0; + ((struct sockaddr_in *)&remote_addr)->sin_port = 0; + break; + } } // Match packet to policy lck_rw_lock_shared(&necp_kernel_policy_lock); - matched_policy = necp_ip_output_find_policy_match_locked(socket_policy_id, socket_skip_policy_id, bound_interface_index, last_interface_index, protocol, &local_addr, &remote_addr); + u_int32_t route_rule_id = 0; + matched_policy = necp_ip_output_find_policy_match_locked(socket_policy_id, socket_skip_policy_id, bound_interface_index, last_interface_index, protocol, &local_addr, &remote_addr, rt, pf_tag, &route_rule_id, &drop_dest_policy_result, &drop_all_bypass); if (matched_policy) { matched_policy_id = matched_policy->id; if (result) { @@ -8009,23 +8754,47 @@ necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_a memcpy(result_parameter, &matched_policy->result_parameter, sizeof(matched_policy->result_parameter)); } + if (route_rule_id != 0 && + packet->m_pkthdr.necp_mtag.necp_route_rule_id == 0) { + packet->m_pkthdr.necp_mtag.necp_route_rule_id = route_rule_id; + } + if (necp_debug > 1) { - NECPLOG(LOG_DEBUG, "IP Output: (ID %d BoundInterface %d LastInterface %d Proto %d) Policy %d Result %d Parameter %d", socket_policy_id, bound_interface_index, last_interface_index, protocol, matched_policy->id, matched_policy->result, matched_policy->result_parameter.tunnel_interface_index); + NECPLOG(LOG_DEBUG, "IP Output: (ID %d BoundInterface %d LastInterface %d Proto %d) Policy %d Result %d Parameter %d Route Rule %u", socket_policy_id, bound_interface_index, last_interface_index, protocol, matched_policy->id, matched_policy->result, matched_policy->result_parameter.tunnel_interface_index, route_rule_id); } - } else if (necp_drop_all_order > 0) { - matched_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; - if (result) { - *result = NECP_KERNEL_POLICY_RESULT_DROP; + } else { + bool drop_all = false; + /* + * Apply drop-all only to packets which have never matched a primary policy (check + * if the packet saved policy id is none or falls within the socket policy id range). + */ + if (socket_policy_id < NECP_KERNEL_POLICY_ID_FIRST_VALID_IP && + (necp_drop_all_order > 0 || drop_dest_policy_result == NECP_KERNEL_POLICY_RESULT_DROP)) { + drop_all = true; + if (drop_all_bypass == NECP_DROP_ALL_BYPASS_CHECK_RESULT_NONE) { + drop_all_bypass = necp_check_drop_all_bypass_result(NULL); + } + } + if (drop_all && drop_all_bypass == NECP_DROP_ALL_BYPASS_CHECK_RESULT_FALSE) { + matched_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; + if (result) { + *result = NECP_KERNEL_POLICY_RESULT_DROP; + } + } else if (route_rule_id != 0 && + packet->m_pkthdr.necp_mtag.necp_route_rule_id == 0) { + // If we matched a route rule, mark it + packet->m_pkthdr.necp_mtag.necp_route_rule_id = route_rule_id; } } lck_rw_done(&necp_kernel_policy_lock); - return (matched_policy_id); + return matched_policy_id; } necp_kernel_policy_id -necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out_args *ip6oa, necp_kernel_policy_result *result, necp_kernel_policy_result_parameter *result_parameter) +necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out_args *ip6oa, struct rtentry *rt, + necp_kernel_policy_result *result, necp_kernel_policy_result_parameter *result_parameter) { struct ip6_hdr *ip6 = NULL; int next = -1; @@ -8039,6 +8808,9 @@ necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out u_int32_t last_interface_index = 0; union necp_sockaddr_union local_addr; union necp_sockaddr_union remote_addr; + u_int32_t drop_dest_policy_result = NECP_KERNEL_POLICY_RESULT_NONE; + necp_drop_all_bypass_check_result_t drop_all_bypass = NECP_DROP_ALL_BYPASS_CHECK_RESULT_NONE; + u_int16_t pf_tag = 0; if (result) { *result = 0; @@ -8049,16 +8821,17 @@ necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out } if (packet == NULL) { - return (NECP_KERNEL_POLICY_ID_NONE); + return NECP_KERNEL_POLICY_ID_NONE; } socket_policy_id = necp_get_policy_id_from_packet(packet); socket_skip_policy_id = necp_get_skip_policy_id_from_packet(packet); + pf_tag = necp_get_packet_filter_tags_from_packet(packet); // Exit early for an empty list // Don't lock. Possible race condition, but we don't want the performance hit. if (necp_kernel_ip_output_policies_count == 0 || - ((socket_policy_id == NECP_KERNEL_POLICY_ID_NONE) && necp_kernel_ip_output_policies_non_id_count == 0)) { + (socket_policy_id == NECP_KERNEL_POLICY_ID_NONE && necp_kernel_ip_output_policies_non_id_count == 0 && necp_drop_dest_policy.entry_count == 0)) { if (necp_drop_all_order > 0) { matched_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; if (result) { @@ -8070,7 +8843,7 @@ necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out } } - return (matched_policy_id); + return matched_policy_id; } // Check for loopback exception @@ -8079,7 +8852,7 @@ necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out if (result) { *result = NECP_KERNEL_POLICY_RESULT_PASS; } - return (matched_policy_id); + return matched_policy_id; } last_interface_index = necp_get_last_interface_index_from_packet(packet); @@ -8088,8 +8861,8 @@ necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out ip6 = mtod(packet, struct ip6_hdr *); if ((flags & IPV6_OUTARGS) && (ip6oa != NULL) && - (ip6oa->ip6oa_flags & IP6OAF_BOUND_IF) && - ip6oa->ip6oa_boundif != IFSCOPE_NONE) { + (ip6oa->ip6oa_flags & IP6OAF_BOUND_IF) && + ip6oa->ip6oa_boundif != IFSCOPE_NONE) { bound_interface_index = ip6oa->ip6oa_boundif; } @@ -8105,35 +8878,36 @@ necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out if (offset >= 0 && packet->m_pkthdr.len >= offset) { protocol = next; switch (protocol) { - case IPPROTO_TCP: { - struct tcphdr th; - if ((int)(offset + sizeof(th)) <= packet->m_pkthdr.len) { - m_copydata(packet, offset, sizeof(th), (u_int8_t *)&th); - ((struct sockaddr_in6 *)&local_addr)->sin6_port = th.th_sport; - ((struct sockaddr_in6 *)&remote_addr)->sin6_port = th.th_dport; - } - break; - } - case IPPROTO_UDP: { - struct udphdr uh; - if ((int)(offset + sizeof(uh)) <= packet->m_pkthdr.len) { - m_copydata(packet, offset, sizeof(uh), (u_int8_t *)&uh); - ((struct sockaddr_in6 *)&local_addr)->sin6_port = uh.uh_sport; - ((struct sockaddr_in6 *)&remote_addr)->sin6_port = uh.uh_dport; - } - break; + case IPPROTO_TCP: { + struct tcphdr th; + if ((int)(offset + sizeof(th)) <= packet->m_pkthdr.len) { + m_copydata(packet, offset, sizeof(th), (u_int8_t *)&th); + ((struct sockaddr_in6 *)&local_addr)->sin6_port = th.th_sport; + ((struct sockaddr_in6 *)&remote_addr)->sin6_port = th.th_dport; } - default: { - ((struct sockaddr_in6 *)&local_addr)->sin6_port = 0; - ((struct sockaddr_in6 *)&remote_addr)->sin6_port = 0; - break; + break; + } + case IPPROTO_UDP: { + struct udphdr uh; + if ((int)(offset + sizeof(uh)) <= packet->m_pkthdr.len) { + m_copydata(packet, offset, sizeof(uh), (u_int8_t *)&uh); + ((struct sockaddr_in6 *)&local_addr)->sin6_port = uh.uh_sport; + ((struct sockaddr_in6 *)&remote_addr)->sin6_port = uh.uh_dport; } + break; + } + default: { + ((struct sockaddr_in6 *)&local_addr)->sin6_port = 0; + ((struct sockaddr_in6 *)&remote_addr)->sin6_port = 0; + break; + } } } // Match packet to policy lck_rw_lock_shared(&necp_kernel_policy_lock); - matched_policy = necp_ip_output_find_policy_match_locked(socket_policy_id, socket_skip_policy_id, bound_interface_index, last_interface_index, protocol, &local_addr, &remote_addr); + u_int32_t route_rule_id = 0; + matched_policy = necp_ip_output_find_policy_match_locked(socket_policy_id, socket_skip_policy_id, bound_interface_index, last_interface_index, protocol, &local_addr, &remote_addr, rt, pf_tag, &route_rule_id, &drop_dest_policy_result, &drop_all_bypass); if (matched_policy) { matched_policy_id = matched_policy->id; if (result) { @@ -8144,19 +8918,42 @@ necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out memcpy(result_parameter, &matched_policy->result_parameter, sizeof(matched_policy->result_parameter)); } + if (route_rule_id != 0 && + packet->m_pkthdr.necp_mtag.necp_route_rule_id == 0) { + packet->m_pkthdr.necp_mtag.necp_route_rule_id = route_rule_id; + } + if (necp_debug > 1) { - NECPLOG(LOG_DEBUG, "IP6 Output: (ID %d BoundInterface %d LastInterface %d Proto %d) Policy %d Result %d Parameter %d", socket_policy_id, bound_interface_index, last_interface_index, protocol, matched_policy->id, matched_policy->result, matched_policy->result_parameter.tunnel_interface_index); + NECPLOG(LOG_DEBUG, "IP6 Output: (ID %d BoundInterface %d LastInterface %d Proto %d) Policy %d Result %d Parameter %d Route Rule %u", socket_policy_id, bound_interface_index, last_interface_index, protocol, matched_policy->id, matched_policy->result, matched_policy->result_parameter.tunnel_interface_index, route_rule_id); } - } else if (necp_drop_all_order > 0) { - matched_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; - if (result) { - *result = NECP_KERNEL_POLICY_RESULT_DROP; + } else { + bool drop_all = false; + /* + * Apply drop-all only to packets which have never matched a primary policy (check + * if the packet saved policy id is none or falls within the socket policy id range). + */ + if (socket_policy_id < NECP_KERNEL_POLICY_ID_FIRST_VALID_IP && + (necp_drop_all_order > 0 || drop_dest_policy_result == NECP_KERNEL_POLICY_RESULT_DROP)) { + drop_all = true; + if (drop_all_bypass == NECP_DROP_ALL_BYPASS_CHECK_RESULT_NONE) { + drop_all_bypass = necp_check_drop_all_bypass_result(NULL); + } + } + if (drop_all && drop_all_bypass == NECP_DROP_ALL_BYPASS_CHECK_RESULT_FALSE) { + matched_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; + if (result) { + *result = NECP_KERNEL_POLICY_RESULT_DROP; + } + } else if (route_rule_id != 0 && + packet->m_pkthdr.necp_mtag.necp_route_rule_id == 0) { + // If we matched a route rule, mark it + packet->m_pkthdr.necp_mtag.necp_route_rule_id = route_rule_id; } } lck_rw_done(&necp_kernel_policy_lock); - return (matched_policy_id); + return matched_policy_id; } // Utilities @@ -8166,22 +8963,22 @@ necp_is_addr_in_range(struct sockaddr *addr, struct sockaddr *range_start, struc int cmp = 0; if (addr == NULL || range_start == NULL || range_end == NULL) { - return (FALSE); + return FALSE; } /* Must be greater than or equal to start */ cmp = necp_addr_compare(addr, range_start, 1); if (cmp != 0 && cmp != 1) { - return (FALSE); + return FALSE; } /* Must be less than or equal to end */ cmp = necp_addr_compare(addr, range_end, 1); if (cmp != 0 && cmp != -1) { - return (FALSE); + return FALSE; } - return (TRUE); + return TRUE; } static bool @@ -8190,61 +8987,61 @@ necp_is_range_in_range(struct sockaddr *inner_range_start, struct sockaddr *inne int cmp = 0; if (inner_range_start == NULL || inner_range_end == NULL || range_start == NULL || range_end == NULL) { - return (FALSE); + return FALSE; } /* Must be greater than or equal to start */ cmp = necp_addr_compare(inner_range_start, range_start, 1); if (cmp != 0 && cmp != 1) { - return (FALSE); + return FALSE; } /* Must be less than or equal to end */ cmp = necp_addr_compare(inner_range_end, range_end, 1); if (cmp != 0 && cmp != -1) { - return (FALSE); + return FALSE; } - return (TRUE); + return TRUE; } static bool necp_is_addr_in_subnet(struct sockaddr *addr, struct sockaddr *subnet_addr, u_int8_t subnet_prefix) { if (addr == NULL || subnet_addr == NULL) { - return (FALSE); + return FALSE; } if (addr->sa_family != subnet_addr->sa_family || addr->sa_len != subnet_addr->sa_len) { - return (FALSE); + return FALSE; } switch (addr->sa_family) { - case AF_INET: { - if (satosin(subnet_addr)->sin_port != 0 && - satosin(addr)->sin_port != satosin(subnet_addr)->sin_port) { - return (FALSE); - } - return (necp_buffer_compare_with_bit_prefix((u_int8_t *)&satosin(addr)->sin_addr, (u_int8_t *)&satosin(subnet_addr)->sin_addr, subnet_prefix)); + case AF_INET: { + if (satosin(subnet_addr)->sin_port != 0 && + satosin(addr)->sin_port != satosin(subnet_addr)->sin_port) { + return FALSE; } - case AF_INET6: { - if (satosin6(subnet_addr)->sin6_port != 0 && - satosin6(addr)->sin6_port != satosin6(subnet_addr)->sin6_port) { - return (FALSE); - } - if (satosin6(addr)->sin6_scope_id && - satosin6(subnet_addr)->sin6_scope_id && - satosin6(addr)->sin6_scope_id != satosin6(subnet_addr)->sin6_scope_id) { - return (FALSE); - } - return (necp_buffer_compare_with_bit_prefix((u_int8_t *)&satosin6(addr)->sin6_addr, (u_int8_t *)&satosin6(subnet_addr)->sin6_addr, subnet_prefix)); + return necp_buffer_compare_with_bit_prefix((u_int8_t *)&satosin(addr)->sin_addr, (u_int8_t *)&satosin(subnet_addr)->sin_addr, subnet_prefix); + } + case AF_INET6: { + if (satosin6(subnet_addr)->sin6_port != 0 && + satosin6(addr)->sin6_port != satosin6(subnet_addr)->sin6_port) { + return FALSE; } - default: { - return (FALSE); + if (satosin6(addr)->sin6_scope_id && + satosin6(subnet_addr)->sin6_scope_id && + satosin6(addr)->sin6_scope_id != satosin6(subnet_addr)->sin6_scope_id) { + return FALSE; } + return necp_buffer_compare_with_bit_prefix((u_int8_t *)&satosin6(addr)->sin6_addr, (u_int8_t *)&satosin6(subnet_addr)->sin6_addr, subnet_prefix); + } + default: { + return FALSE; + } } - return (FALSE); + return FALSE; } /* @@ -8261,68 +9058,68 @@ necp_addr_compare(struct sockaddr *sa1, struct sockaddr *sa2, int check_port) int port_result = 0; if (sa1->sa_family != sa2->sa_family || sa1->sa_len != sa2->sa_len) { - return (2); + return 2; } if (sa1->sa_len == 0) { - return (0); + return 0; } switch (sa1->sa_family) { - case AF_INET: { - if (sa1->sa_len != sizeof(struct sockaddr_in)) { - return (2); - } - - result = memcmp(&satosin(sa1)->sin_addr.s_addr, &satosin(sa2)->sin_addr.s_addr, sizeof(satosin(sa1)->sin_addr.s_addr)); + case AF_INET: { + if (sa1->sa_len != sizeof(struct sockaddr_in)) { + return 2; + } - if (check_port) { - if (satosin(sa1)->sin_port < satosin(sa2)->sin_port) { - port_result = -1; - } else if (satosin(sa1)->sin_port > satosin(sa2)->sin_port) { - port_result = 1; - } + result = memcmp(&satosin(sa1)->sin_addr.s_addr, &satosin(sa2)->sin_addr.s_addr, sizeof(satosin(sa1)->sin_addr.s_addr)); - if (result == 0) { - result = port_result; - } else if ((result > 0 && port_result < 0) || (result < 0 && port_result > 0)) { - return (2); - } + if (check_port) { + if (satosin(sa1)->sin_port < satosin(sa2)->sin_port) { + port_result = -1; + } else if (satosin(sa1)->sin_port > satosin(sa2)->sin_port) { + port_result = 1; } - break; - } - case AF_INET6: { - if (sa1->sa_len != sizeof(struct sockaddr_in6)) { - return (2); + if (result == 0) { + result = port_result; + } else if ((result > 0 && port_result < 0) || (result < 0 && port_result > 0)) { + return 2; } + } - if (satosin6(sa1)->sin6_scope_id != satosin6(sa2)->sin6_scope_id) { - return (2); - } + break; + } + case AF_INET6: { + if (sa1->sa_len != sizeof(struct sockaddr_in6)) { + return 2; + } - result = memcmp(&satosin6(sa1)->sin6_addr.s6_addr[0], &satosin6(sa2)->sin6_addr.s6_addr[0], sizeof(struct in6_addr)); + if (satosin6(sa1)->sin6_scope_id != satosin6(sa2)->sin6_scope_id) { + return 2; + } - if (check_port) { - if (satosin6(sa1)->sin6_port < satosin6(sa2)->sin6_port) { - port_result = -1; - } else if (satosin6(sa1)->sin6_port > satosin6(sa2)->sin6_port) { - port_result = 1; - } + result = memcmp(&satosin6(sa1)->sin6_addr.s6_addr[0], &satosin6(sa2)->sin6_addr.s6_addr[0], sizeof(struct in6_addr)); - if (result == 0) { - result = port_result; - } else if ((result > 0 && port_result < 0) || (result < 0 && port_result > 0)) { - return (2); - } + if (check_port) { + if (satosin6(sa1)->sin6_port < satosin6(sa2)->sin6_port) { + port_result = -1; + } else if (satosin6(sa1)->sin6_port > satosin6(sa2)->sin6_port) { + port_result = 1; } - break; - } - default: { - result = memcmp(sa1, sa2, sa1->sa_len); - break; + if (result == 0) { + result = port_result; + } else if ((result > 0 && port_result < 0) || (result < 0 && port_result > 0)) { + return 2; + } } + + break; + } + default: { + result = memcmp(sa1, sa2, sa1->sa_len); + break; + } } if (result < 0) { @@ -8331,7 +9128,7 @@ necp_addr_compare(struct sockaddr *sa1, struct sockaddr *sa2, int check_port) result = (1); } - return (result); + return result; } static bool @@ -8341,23 +9138,71 @@ necp_buffer_compare_with_bit_prefix(u_int8_t *p1, u_int8_t *p2, u_int32_t bits) /* Handle null pointers */ if (p1 == NULL || p2 == NULL) { - return (p1 == p2); + return p1 == p2; } while (bits >= 8) { if (*p1++ != *p2++) { - return (FALSE); + return FALSE; } bits -= 8; } if (bits > 0) { - mask = ~((1<<(8-bits))-1); + mask = ~((1 << (8 - bits)) - 1); if ((*p1 & mask) != (*p2 & mask)) { - return (FALSE); + return FALSE; + } + } + return TRUE; +} + +static bool +necp_addr_is_empty(struct sockaddr *addr) +{ + if (addr == NULL) { + return TRUE; + } + + if (addr->sa_len == 0) { + return TRUE; + } + + switch (addr->sa_family) { + case AF_INET: { + static struct sockaddr_in ipv4_empty_address = { + .sin_len = sizeof(struct sockaddr_in), + .sin_family = AF_INET, + .sin_port = 0, + .sin_addr = { .s_addr = 0 }, // 0.0.0.0 + .sin_zero = {0}, + }; + if (necp_addr_compare(addr, (struct sockaddr *)&ipv4_empty_address, 0) == 0) { + return TRUE; + } else { + return FALSE; + } + } + case AF_INET6: { + static struct sockaddr_in6 ipv6_empty_address = { + .sin6_len = sizeof(struct sockaddr_in6), + .sin6_family = AF_INET6, + .sin6_port = 0, + .sin6_flowinfo = 0, + .sin6_addr = IN6ADDR_ANY_INIT, // :: + .sin6_scope_id = 0, + }; + if (necp_addr_compare(addr, (struct sockaddr *)&ipv6_empty_address, 0) == 0) { + return TRUE; + } else { + return FALSE; } } - return (TRUE); + default: + return FALSE; + } + + return FALSE; } static bool @@ -8399,12 +9244,13 @@ necp_update_qos_marking(struct ifnet *ifp, u_int32_t route_rule_id) if ((route_rule->cellular_action == NECP_ROUTE_RULE_QOS_MARKING && IFNET_IS_CELLULAR(ifp)) || (route_rule->wifi_action == NECP_ROUTE_RULE_QOS_MARKING && IFNET_IS_WIFI(ifp)) || (route_rule->wired_action == NECP_ROUTE_RULE_QOS_MARKING && IFNET_IS_WIRED(ifp)) || - (route_rule->expensive_action == NECP_ROUTE_RULE_QOS_MARKING && IFNET_IS_EXPENSIVE(ifp))) { + (route_rule->expensive_action == NECP_ROUTE_RULE_QOS_MARKING && IFNET_IS_EXPENSIVE(ifp)) || + (route_rule->constrained_action == NECP_ROUTE_RULE_QOS_MARKING && IFNET_IS_CONSTRAINED(ifp))) { qos_marking = TRUE; if (necp_debug > 2) { - NECPLOG(LOG_DEBUG, "QoS Marking: C:%d WF:%d W:%d E:%d for Rule %d Allowed %d", + NECPLOG(LOG_DEBUG, "QoS Marking: C:%d WF:%d W:%d E:%d Cn:%d for Rule %d Allowed %d", route_rule->cellular_action, route_rule->wifi_action, route_rule->wired_action, - route_rule->expensive_action, route_rule_id, qos_marking); + route_rule->expensive_action, route_rule->constrained_action, route_rule_id, qos_marking); } goto done; } @@ -8413,29 +9259,24 @@ done: NECPLOG(LOG_DEBUG, "QoS Marking: Rule %d ifp %s Allowed %d", route_rule_id, ifp ? ifp->if_xname : "", qos_marking); } - return (qos_marking); + return qos_marking; } -void -necp_socket_update_qos_marking(struct inpcb *inp, struct rtentry *route, struct ifnet *interface, u_int32_t route_rule_id) +bool +necp_lookup_current_qos_marking(int32_t *qos_marking_gencount, struct rtentry *route, struct ifnet *interface, u_int32_t route_rule_id, bool old_qos_marking) { - bool qos_marking = FALSE; - struct ifnet *ifp = interface = NULL; + bool new_qos_marking = old_qos_marking; + struct ifnet *ifp = interface; if (net_qos_policy_restricted == 0) { - return; - } - if (inp->inp_socket == NULL) { - return; - } - if ((inp->inp_socket->so_flags1 & SOF1_QOSMARKING_POLICY_OVERRIDE)) { - return; + return new_qos_marking; } + /* * This is racy but we do not need the performance hit of taking necp_kernel_policy_lock */ - if (inp->inp_policyresult.results.qos_marking_gencount == necp_kernel_socket_policies_gencount) { - return; + if (*qos_marking_gencount == necp_kernel_socket_policies_gencount) { + return new_qos_marking; } lck_rw_lock_shared(&necp_kernel_policy_lock); @@ -8447,7 +9288,7 @@ necp_socket_update_qos_marking(struct inpcb *inp, struct rtentry *route, struct * By default, until we have a interface, do not mark and reevaluate the Qos marking policy */ if (ifp == NULL || route_rule_id == 0) { - qos_marking = FALSE; + new_qos_marking = FALSE; goto done; } @@ -8460,22 +9301,41 @@ necp_socket_update_qos_marking(struct inpcb *inp, struct rtentry *route, struct if (sub_route_rule_id == 0) { break; } - qos_marking = necp_update_qos_marking(ifp, sub_route_rule_id); - if (qos_marking == TRUE) { + new_qos_marking = necp_update_qos_marking(ifp, sub_route_rule_id); + if (new_qos_marking == TRUE) { break; } } } } else { - qos_marking = necp_update_qos_marking(ifp, route_rule_id); + new_qos_marking = necp_update_qos_marking(ifp, route_rule_id); } /* * Now that we have an interface we remember the gencount */ - inp->inp_policyresult.results.qos_marking_gencount = necp_kernel_socket_policies_gencount; + *qos_marking_gencount = necp_kernel_socket_policies_gencount; done: lck_rw_done(&necp_kernel_policy_lock); + return new_qos_marking; +} + +void +necp_socket_update_qos_marking(struct inpcb *inp, struct rtentry *route, u_int32_t route_rule_id) +{ + bool qos_marking = inp->inp_socket->so_flags1 & SOF1_QOSMARKING_ALLOWED ? TRUE : FALSE; + + if (net_qos_policy_restricted == 0) { + return; + } + if (inp->inp_socket == NULL) { + return; + } + if ((inp->inp_socket->so_flags1 & SOF1_QOSMARKING_POLICY_OVERRIDE)) { + return; + } + + qos_marking = necp_lookup_current_qos_marking(&(inp->inp_policyresult.results.qos_marking_gencount), route, NULL, route_rule_id, qos_marking); if (qos_marking == TRUE) { inp->inp_socket->so_flags1 |= SOF1_QOSMARKING_ALLOWED; @@ -8488,13 +9348,13 @@ static bool necp_route_is_lqm_abort(struct ifnet *ifp, struct ifnet *delegated_ifp) { if (ifp != NULL && - (ifp->if_interface_state.valid_bitmask & IF_INTERFACE_STATE_LQM_STATE_VALID) && - ifp->if_interface_state.lqm_state == IFNET_LQM_THRESH_ABORT) { + (ifp->if_interface_state.valid_bitmask & IF_INTERFACE_STATE_LQM_STATE_VALID) && + ifp->if_interface_state.lqm_state == IFNET_LQM_THRESH_ABORT) { return true; } if (delegated_ifp != NULL && - (delegated_ifp->if_interface_state.valid_bitmask & IF_INTERFACE_STATE_LQM_STATE_VALID) && - delegated_ifp->if_interface_state.lqm_state == IFNET_LQM_THRESH_ABORT) { + (delegated_ifp->if_interface_state.valid_bitmask & IF_INTERFACE_STATE_LQM_STATE_VALID) && + delegated_ifp->if_interface_state.lqm_state == IFNET_LQM_THRESH_ABORT) { return true; } return false; @@ -8511,7 +9371,7 @@ necp_route_is_allowed_inner(struct rtentry *route, struct ifnet *ifp, u_int32_t route_rule = necp_lookup_route_rule_locked(&necp_route_rules, route_rule_id); if (route_rule == NULL) { - return (TRUE); + return TRUE; } default_is_allowed = (route_rule->default_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? FALSE : TRUE; @@ -8522,7 +9382,7 @@ necp_route_is_allowed_inner(struct rtentry *route, struct ifnet *ifp, u_int32_t if (necp_debug > 1 && !default_is_allowed) { NECPLOG(LOG_DEBUG, "Route Allowed: No interface for route, using default for Rule %d Allowed %d", route_rule_id, default_is_allowed); } - return (default_is_allowed); + return default_is_allowed; } delegated_ifp = ifp->if_delegated.ifp; @@ -8531,19 +9391,19 @@ necp_route_is_allowed_inner(struct rtentry *route, struct ifnet *ifp, u_int32_t break; } if (route_rule->exception_if_indices[exception_index] == ifp->if_index || - (delegated_ifp != NULL && route_rule->exception_if_indices[exception_index] == delegated_ifp->if_index)) { + (delegated_ifp != NULL && route_rule->exception_if_indices[exception_index] == delegated_ifp->if_index)) { if (route_rule->exception_if_actions[exception_index] == NECP_ROUTE_RULE_DENY_LQM_ABORT) { const bool lqm_abort = necp_route_is_lqm_abort(ifp, delegated_ifp); if (necp_debug > 1 && lqm_abort) { NECPLOG(LOG_DEBUG, "Route Allowed: Interface match %d for Rule %d Deny LQM Abort", - route_rule->exception_if_indices[exception_index], route_rule_id); + route_rule->exception_if_indices[exception_index], route_rule_id); } return false; } else if (IS_NECP_ROUTE_RULE_ALLOW_OR_DENY(route_rule->exception_if_actions[exception_index])) { if (necp_debug > 1) { NECPLOG(LOG_DEBUG, "Route Allowed: Interface match %d for Rule %d Allowed %d", route_rule->exception_if_indices[exception_index], route_rule_id, ((route_rule->exception_if_actions[exception_index] == NECP_ROUTE_RULE_DENY_INTERFACE) ? FALSE : TRUE)); } - return ((route_rule->exception_if_actions[exception_index] == NECP_ROUTE_RULE_DENY_INTERFACE) ? FALSE : TRUE); + return (route_rule->exception_if_actions[exception_index] == NECP_ROUTE_RULE_DENY_INTERFACE) ? FALSE : TRUE; } } } @@ -8562,11 +9422,11 @@ necp_route_is_allowed_inner(struct rtentry *route, struct ifnet *ifp, u_int32_t *interface_type_denied = IFRTYPE_FUNCTIONAL_CELLULAR; } if (type_aggregate_action == NECP_ROUTE_RULE_NONE || - (type_aggregate_action == NECP_ROUTE_RULE_ALLOW_INTERFACE && - route_rule->cellular_action == NECP_ROUTE_RULE_DENY_INTERFACE)) { - // Deny wins if there is a conflict - type_aggregate_action = route_rule->cellular_action; - } + (type_aggregate_action == NECP_ROUTE_RULE_ALLOW_INTERFACE && + route_rule->cellular_action == NECP_ROUTE_RULE_DENY_INTERFACE)) { + // Deny wins if there is a conflict + type_aggregate_action = route_rule->cellular_action; + } } } @@ -8584,11 +9444,11 @@ necp_route_is_allowed_inner(struct rtentry *route, struct ifnet *ifp, u_int32_t *interface_type_denied = IFRTYPE_FUNCTIONAL_WIFI_INFRA; } if (type_aggregate_action == NECP_ROUTE_RULE_NONE || - (type_aggregate_action == NECP_ROUTE_RULE_ALLOW_INTERFACE && - route_rule->wifi_action == NECP_ROUTE_RULE_DENY_INTERFACE)) { - // Deny wins if there is a conflict - type_aggregate_action = route_rule->wifi_action; - } + (type_aggregate_action == NECP_ROUTE_RULE_ALLOW_INTERFACE && + route_rule->wifi_action == NECP_ROUTE_RULE_DENY_INTERFACE)) { + // Deny wins if there is a conflict + type_aggregate_action = route_rule->wifi_action; + } } } @@ -8606,11 +9466,11 @@ necp_route_is_allowed_inner(struct rtentry *route, struct ifnet *ifp, u_int32_t *interface_type_denied = IFRTYPE_FUNCTIONAL_WIRED; } if (type_aggregate_action == NECP_ROUTE_RULE_NONE || - (type_aggregate_action == NECP_ROUTE_RULE_ALLOW_INTERFACE && - route_rule->wired_action == NECP_ROUTE_RULE_DENY_INTERFACE)) { - // Deny wins if there is a conflict - type_aggregate_action = route_rule->wired_action; - } + (type_aggregate_action == NECP_ROUTE_RULE_ALLOW_INTERFACE && + route_rule->wired_action == NECP_ROUTE_RULE_DENY_INTERFACE)) { + // Deny wins if there is a conflict + type_aggregate_action = route_rule->wired_action; + } } } @@ -8622,11 +9482,27 @@ necp_route_is_allowed_inner(struct rtentry *route, struct ifnet *ifp, u_int32_t } } else if (IS_NECP_ROUTE_RULE_ALLOW_OR_DENY(route_rule->expensive_action)) { if (type_aggregate_action == NECP_ROUTE_RULE_NONE || - (type_aggregate_action == NECP_ROUTE_RULE_ALLOW_INTERFACE && - route_rule->expensive_action == NECP_ROUTE_RULE_DENY_INTERFACE)) { - // Deny wins if there is a conflict - type_aggregate_action = route_rule->expensive_action; - } + (type_aggregate_action == NECP_ROUTE_RULE_ALLOW_INTERFACE && + route_rule->expensive_action == NECP_ROUTE_RULE_DENY_INTERFACE)) { + // Deny wins if there is a conflict + type_aggregate_action = route_rule->expensive_action; + } + } + } + + if (IFNET_IS_CONSTRAINED(ifp)) { + if (route_rule->constrained_action == NECP_ROUTE_RULE_DENY_LQM_ABORT) { + if (necp_route_is_lqm_abort(ifp, delegated_ifp)) { + // Mark aggregate action as deny + type_aggregate_action = NECP_ROUTE_RULE_DENY_INTERFACE; + } + } else if (IS_NECP_ROUTE_RULE_ALLOW_OR_DENY(route_rule->constrained_action)) { + if (type_aggregate_action == NECP_ROUTE_RULE_NONE || + (type_aggregate_action == NECP_ROUTE_RULE_ALLOW_INTERFACE && + route_rule->constrained_action == NECP_ROUTE_RULE_DENY_INTERFACE)) { + // Deny wins if there is a conflict + type_aggregate_action = route_rule->constrained_action; + } } } @@ -8634,13 +9510,13 @@ necp_route_is_allowed_inner(struct rtentry *route, struct ifnet *ifp, u_int32_t if (necp_debug > 1) { NECPLOG(LOG_DEBUG, "Route Allowed: C:%d WF:%d W:%d E:%d for Rule %d Allowed %d", route_rule->cellular_action, route_rule->wifi_action, route_rule->wired_action, route_rule->expensive_action, route_rule_id, ((type_aggregate_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? FALSE : TRUE)); } - return ((type_aggregate_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? FALSE : TRUE); + return (type_aggregate_action == NECP_ROUTE_RULE_DENY_INTERFACE) ? FALSE : TRUE; } if (necp_debug > 1 && !default_is_allowed) { NECPLOG(LOG_DEBUG, "Route Allowed: Using default for Rule %d Allowed %d", route_rule_id, default_is_allowed); } - return (default_is_allowed); + return default_is_allowed; } static bool @@ -8650,7 +9526,7 @@ necp_route_is_allowed(struct rtentry *route, struct ifnet *interface, u_int32_t if (necp_debug > 1) { NECPLOG(LOG_DEBUG, "Route Allowed: no route or interface, Rule %d Allowed %d", route_rule_id, TRUE); } - return (TRUE); + return TRUE; } if (ROUTE_RULE_IS_AGGREGATE(route_rule_id)) { @@ -8663,15 +9539,15 @@ necp_route_is_allowed(struct rtentry *route, struct ifnet *interface, u_int32_t break; } if (!necp_route_is_allowed_inner(route, interface, sub_route_rule_id, interface_type_denied)) { - return (FALSE); + return FALSE; } } } } else { - return (necp_route_is_allowed_inner(route, interface, route_rule_id, interface_type_denied)); + return necp_route_is_allowed_inner(route, interface, route_rule_id, interface_type_denied); } - return (TRUE); + return TRUE; } bool @@ -8680,12 +9556,12 @@ necp_packet_is_allowed_over_interface(struct mbuf *packet, struct ifnet *interfa bool is_allowed = TRUE; u_int32_t route_rule_id = necp_get_route_rule_id_from_packet(packet); if (route_rule_id != 0 && - interface != NULL) { + interface != NULL) { lck_rw_lock_shared(&necp_kernel_policy_lock); is_allowed = necp_route_is_allowed(NULL, interface, necp_get_route_rule_id_from_packet(packet), NULL); lck_rw_done(&necp_kernel_policy_lock); } - return (is_allowed); + return is_allowed; } static bool @@ -8706,16 +9582,29 @@ necp_netagents_allow_traffic(u_int32_t *netagent_ids, size_t netagent_id_count) if (agent_flags & NETAGENT_FLAG_ACTIVE) { continue; } else if ((agent_flags & NETAGENT_FLAG_VOLUNTARY) == 0) { - return (FALSE); + return FALSE; } } } } - return (TRUE); + return TRUE; +} + +static bool +necp_packet_filter_tags_receive(u_int16_t pf_tag, u_int32_t pass_flags) +{ + bool allowed_to_receive = TRUE; + + if (pf_tag == PF_TAG_ID_STACK_DROP && + (pass_flags & NECP_KERNEL_POLICY_PASS_PF_TAG) != NECP_KERNEL_POLICY_PASS_PF_TAG) { + allowed_to_receive = FALSE; + } + + return allowed_to_receive; } static bool -necp_socket_is_allowed_to_send_recv_internal(struct inpcb *inp, struct sockaddr *override_local_addr, struct sockaddr *override_remote_addr, ifnet_t interface, necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id, necp_kernel_policy_id *return_skip_policy_id) +necp_socket_is_allowed_to_send_recv_internal(struct inpcb *inp, struct sockaddr *override_local_addr, struct sockaddr *override_remote_addr, ifnet_t interface, u_int16_t pf_tag, necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id, necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags) { u_int32_t verifyifindex = interface ? interface->if_index : 0; bool allowed_to_receive = TRUE; @@ -8726,8 +9615,15 @@ necp_socket_is_allowed_to_send_recv_internal(struct inpcb *inp, struct sockaddr u_int32_t route_rule_id = 0; struct rtentry *route = NULL; u_int32_t interface_type_denied = IFRTYPE_FUNCTIONAL_UNKNOWN; - + necp_kernel_policy_result drop_dest_policy_result = NECP_KERNEL_POLICY_RESULT_NONE; + necp_drop_all_bypass_check_result_t drop_all_bypass = NECP_DROP_ALL_BYPASS_CHECK_RESULT_NONE; u_int32_t netagent_ids[NECP_MAX_NETAGENTS]; + proc_t socket_proc = NULL; + necp_kernel_policy_filter filter_control_unit = 0; + u_int32_t pass_flags = 0; + u_int32_t flow_divert_aggregate_unit = 0; + necp_socket_bypass_type_t bypass_type = NECP_BYPASS_TYPE_NONE; + memset(&netagent_ids, 0, sizeof(netagent_ids)); if (return_policy_id) { @@ -8739,6 +9635,9 @@ necp_socket_is_allowed_to_send_recv_internal(struct inpcb *inp, struct sockaddr if (return_route_rule_id) { *return_route_rule_id = 0; } + if (return_pass_flags) { + *return_pass_flags = 0; + } if (inp == NULL) { goto done; @@ -8746,11 +9645,15 @@ necp_socket_is_allowed_to_send_recv_internal(struct inpcb *inp, struct sockaddr route = inp->inp_route.ro_rt; + struct socket *so = inp->inp_socket; + + u_int32_t drop_order = necp_process_drop_order(so->so_cred); + // Don't lock. Possible race condition, but we don't want the performance hit. if (necp_kernel_socket_policies_count == 0 || - (!(inp->inp_flags2 & INP2_WANT_APP_POLICY) && necp_kernel_socket_policies_non_app_count == 0)) { - if (necp_drop_all_order > 0) { - if (necp_socket_bypass(override_local_addr, override_remote_addr, inp)) { + (!(inp->inp_flags2 & INP2_WANT_APP_POLICY) && necp_kernel_socket_policies_non_app_count == 0)) { + if (necp_drop_all_order > 0 || drop_order > 0) { + if (necp_socket_bypass(override_local_addr, override_remote_addr, inp) != NECP_BYPASS_TYPE_NONE) { allowed_to_receive = TRUE; } else { allowed_to_receive = FALSE; @@ -8778,46 +9681,50 @@ necp_socket_is_allowed_to_send_recv_internal(struct inpcb *inp, struct sockaddr if (!policies_have_changed) { if (!route_allowed || - inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_DROP || - inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT || - (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL && interface && - inp->inp_policyresult.results.result_parameter.tunnel_interface_index != verifyifindex)) { - allowed_to_receive = FALSE; - } else { - if (return_policy_id) { - *return_policy_id = inp->inp_policyresult.policy_id; - } - if (return_skip_policy_id) { - *return_skip_policy_id = inp->inp_policyresult.skip_policy_id; - } - if (return_route_rule_id) { - *return_route_rule_id = inp->inp_policyresult.results.route_rule_id; - } + inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_DROP || + inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT || + (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL && interface && + inp->inp_policyresult.results.result_parameter.tunnel_interface_index != verifyifindex)) { + allowed_to_receive = FALSE; + } else { + if (return_policy_id) { + *return_policy_id = inp->inp_policyresult.policy_id; + } + if (return_skip_policy_id) { + *return_skip_policy_id = inp->inp_policyresult.skip_policy_id; + } + if (return_route_rule_id) { + *return_route_rule_id = inp->inp_policyresult.results.route_rule_id; + } + if (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_PASS) { + pass_flags = inp->inp_policyresult.results.result_parameter.pass_flags; } + } goto done; } } // Check for loopback exception - if (necp_socket_bypass(override_local_addr, override_remote_addr, inp)) { + bypass_type = necp_socket_bypass(override_local_addr, override_remote_addr, inp); + if (bypass_type == NECP_BYPASS_TYPE_INTCOPROC || (bypass_type == NECP_BYPASS_TYPE_LOOPBACK && necp_pass_loopback == NECP_LOOPBACK_PASS_ALL)) { allowed_to_receive = TRUE; goto done; } // Actually calculate policy result lck_rw_lock_shared(&necp_kernel_policy_lock); - necp_socket_fillout_info_locked(inp, override_local_addr, override_remote_addr, 0, &info); + necp_socket_fillout_info_locked(inp, override_local_addr, override_remote_addr, 0, drop_order, &socket_proc, &info, (bypass_type == NECP_BYPASS_TYPE_LOOPBACK)); flowhash = necp_socket_calc_flowhash_locked(&info); if (inp->inp_policyresult.policy_id != NECP_KERNEL_POLICY_ID_NONE && - inp->inp_policyresult.policy_gencount == necp_kernel_socket_policies_gencount && - inp->inp_policyresult.flowhash == flowhash) { + inp->inp_policyresult.policy_gencount == necp_kernel_socket_policies_gencount && + inp->inp_policyresult.flowhash == flowhash) { if (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_DROP || - inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT || - (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL && interface && - inp->inp_policyresult.results.result_parameter.tunnel_interface_index != verifyifindex) || - (inp->inp_policyresult.results.route_rule_id != 0 && - !necp_route_is_allowed(route, interface, inp->inp_policyresult.results.route_rule_id, &interface_type_denied))) { + inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT || + (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL && interface && + inp->inp_policyresult.results.result_parameter.tunnel_interface_index != verifyifindex) || + (inp->inp_policyresult.results.route_rule_id != 0 && + !necp_route_is_allowed(route, interface, inp->inp_policyresult.results.route_rule_id, &interface_type_denied))) { allowed_to_receive = FALSE; } else { if (return_policy_id) { @@ -8826,23 +9733,61 @@ necp_socket_is_allowed_to_send_recv_internal(struct inpcb *inp, struct sockaddr if (return_route_rule_id) { *return_route_rule_id = inp->inp_policyresult.results.route_rule_id; } + if (return_skip_policy_id) { + *return_skip_policy_id = inp->inp_policyresult.skip_policy_id; + } + if (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_PASS) { + pass_flags = inp->inp_policyresult.results.result_parameter.pass_flags; + } + } + lck_rw_done(&necp_kernel_policy_lock); + goto done; + } + + u_int32_t route_rule_id_array[MAX_AGGREGATE_ROUTE_RULES]; + size_t route_rule_id_array_count = 0; + struct necp_kernel_socket_policy *matched_policy = necp_socket_find_policy_match_with_info_locked(necp_kernel_socket_policies_map[NECP_SOCKET_MAP_APP_ID_TO_BUCKET(info.application_id)], &info, &filter_control_unit, route_rule_id_array, &route_rule_id_array_count, MAX_AGGREGATE_ROUTE_RULES, &service_action, &service, netagent_ids, NULL, NECP_MAX_NETAGENTS, NULL, 0, socket_proc ? socket_proc : current_proc(), pf_tag, return_skip_policy_id, inp->inp_route.ro_rt, &drop_dest_policy_result, &drop_all_bypass, &flow_divert_aggregate_unit); + + // Check for loopback exception again after the policy match + if (bypass_type == NECP_BYPASS_TYPE_LOOPBACK && + necp_pass_loopback == NECP_LOOPBACK_PASS_WITH_FILTER && + (matched_policy == NULL || matched_policy->result != NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT)) { + // Polices have changed since last evaluation, update inp result with new filter state + if (inp->inp_policyresult.results.filter_control_unit != filter_control_unit) { + inp->inp_policyresult.results.filter_control_unit = filter_control_unit; } + if (inp->inp_policyresult.results.flow_divert_aggregate_unit != flow_divert_aggregate_unit) { + inp->inp_policyresult.results.flow_divert_aggregate_unit = flow_divert_aggregate_unit; + } + allowed_to_receive = TRUE; lck_rw_done(&necp_kernel_policy_lock); goto done; } - struct necp_kernel_socket_policy *matched_policy = necp_socket_find_policy_match_with_info_locked(necp_kernel_socket_policies_map[NECP_SOCKET_MAP_APP_ID_TO_BUCKET(info.application_id)], &info, NULL, &route_rule_id, &service_action, &service, netagent_ids, NULL, NECP_MAX_NETAGENTS, NULL, 0, current_proc(), return_skip_policy_id); + if (route_rule_id_array_count == 1) { + route_rule_id = route_rule_id_array[0]; + } else if (route_rule_id_array_count > 1) { + route_rule_id = necp_create_aggregate_route_rule(route_rule_id_array); + } + + bool send_local_network_denied_event = false; if (matched_policy != NULL) { + if (matched_policy->result == NECP_KERNEL_POLICY_RESULT_DROP && + matched_policy->result_parameter.drop_flags & NECP_KERNEL_POLICY_DROP_FLAG_LOCAL_NETWORK) { + // Trigger the event that we dropped due to a local network policy + send_local_network_denied_event = true; + } + if (matched_policy->result == NECP_KERNEL_POLICY_RESULT_DROP || - matched_policy->result == NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT || - (matched_policy->result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL && interface && - matched_policy->result_parameter.tunnel_interface_index != verifyifindex) || - ((service_action == NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED || - service_action == NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED) && - service.identifier != 0 && service.identifier != NECP_NULL_SERVICE_ID) || - (route_rule_id != 0 && - !necp_route_is_allowed(route, interface, route_rule_id, &interface_type_denied)) || - !necp_netagents_allow_traffic(netagent_ids, NECP_MAX_NETAGENTS)) { + matched_policy->result == NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT || + (matched_policy->result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL && interface && + matched_policy->result_parameter.tunnel_interface_index != verifyifindex) || + ((service_action == NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED || + service_action == NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED) && + service.identifier != 0 && service.identifier != NECP_NULL_SERVICE_ID) || + (route_rule_id != 0 && + !necp_route_is_allowed(route, interface, route_rule_id, &interface_type_denied)) || + !necp_netagents_allow_traffic(netagent_ids, NECP_MAX_NETAGENTS)) { allowed_to_receive = FALSE; } else { if (return_policy_id) { @@ -8851,36 +9796,83 @@ necp_socket_is_allowed_to_send_recv_internal(struct inpcb *inp, struct sockaddr if (return_route_rule_id) { *return_route_rule_id = route_rule_id; } + if (matched_policy->result == NECP_KERNEL_POLICY_RESULT_PASS) { + pass_flags = matched_policy->result_parameter.pass_flags; + } + // Polices has changed since last evaluation, update inp result with new filter state + if (inp->inp_policyresult.results.filter_control_unit != filter_control_unit) { + inp->inp_policyresult.results.filter_control_unit = filter_control_unit; + } + if (inp->inp_policyresult.results.flow_divert_aggregate_unit != flow_divert_aggregate_unit) { + inp->inp_policyresult.results.flow_divert_aggregate_unit = flow_divert_aggregate_unit; + } } - lck_rw_done(&necp_kernel_policy_lock); if (necp_debug > 1 && matched_policy->id != inp->inp_policyresult.policy_id) { NECPLOG(LOG_DEBUG, "Socket Send/Recv Policy: Policy %d Allowed %d", return_policy_id ? *return_policy_id : 0, allowed_to_receive); } - goto done; - } else if (necp_drop_all_order > 0) { - allowed_to_receive = FALSE; } else { - if (return_policy_id) { - *return_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; + bool drop_all = false; + if (necp_drop_all_order > 0 || info.drop_order > 0 || drop_dest_policy_result == NECP_KERNEL_POLICY_RESULT_DROP) { + drop_all = true; + if (drop_all_bypass == NECP_DROP_ALL_BYPASS_CHECK_RESULT_NONE) { + drop_all_bypass = necp_check_drop_all_bypass_result(socket_proc ? socket_proc : current_proc()); + } } - if (return_route_rule_id) { - *return_route_rule_id = route_rule_id; + if (drop_all && drop_all_bypass == NECP_DROP_ALL_BYPASS_CHECK_RESULT_FALSE) { + allowed_to_receive = FALSE; + } else { + if (return_policy_id) { + *return_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; + } + if (return_route_rule_id) { + *return_route_rule_id = route_rule_id; + } + + // Polices has changed since last evaluation, update inp result with new filter state + if (inp->inp_policyresult.results.filter_control_unit != filter_control_unit) { + inp->inp_policyresult.results.filter_control_unit = filter_control_unit; + } + if (inp->inp_policyresult.results.flow_divert_aggregate_unit != flow_divert_aggregate_unit) { + inp->inp_policyresult.results.flow_divert_aggregate_unit = flow_divert_aggregate_unit; + } } } + if (necp_check_restricted_multicast_drop(socket_proc ? socket_proc : current_proc(), &info, true)) { + allowed_to_receive = FALSE; + } + lck_rw_done(&necp_kernel_policy_lock); + if (send_local_network_denied_event) { + necp_send_network_denied_event(((so->so_flags & SOF_DELEGATED) ? so->e_pid : so->last_pid), + ((so->so_flags & SOF_DELEGATED) ? so->e_uuid : so->last_uuid), + NETPOLICY_NETWORKTYPE_LOCAL); + } + done: + if (return_pass_flags != NULL) { + *return_pass_flags = pass_flags; + } + + if (pf_tag != 0 && allowed_to_receive) { + allowed_to_receive = necp_packet_filter_tags_receive(pf_tag, pass_flags); + } + if (!allowed_to_receive && interface_type_denied != IFRTYPE_FUNCTIONAL_UNKNOWN) { soevent(inp->inp_socket, (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED)); } - return (allowed_to_receive); + if (socket_proc) { + proc_rele(socket_proc); + } + + return allowed_to_receive; } bool -necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port, u_int16_t remote_port, struct in_addr *local_addr, struct in_addr *remote_addr, ifnet_t interface, necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id, necp_kernel_policy_id *return_skip_policy_id) +necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port, u_int16_t remote_port, struct in_addr *local_addr, struct in_addr *remote_addr, ifnet_t interface, u_int16_t pf_tag, necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id, necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags) { struct sockaddr_in local = {}; struct sockaddr_in remote = {}; @@ -8891,12 +9883,12 @@ necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port, memcpy(&local.sin_addr, local_addr, sizeof(local.sin_addr)); memcpy(&remote.sin_addr, remote_addr, sizeof(remote.sin_addr)); - return (necp_socket_is_allowed_to_send_recv_internal(inp, (struct sockaddr *)&local, (struct sockaddr *)&remote, interface, - return_policy_id, return_route_rule_id, return_skip_policy_id)); + return necp_socket_is_allowed_to_send_recv_internal(inp, (struct sockaddr *)&local, (struct sockaddr *)&remote, interface, + pf_tag, return_policy_id, return_route_rule_id, return_skip_policy_id, return_pass_flags); } bool -necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port, u_int16_t remote_port, struct in6_addr *local_addr, struct in6_addr *remote_addr, ifnet_t interface, necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id, necp_kernel_policy_id *return_skip_policy_id) +necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port, u_int16_t remote_port, struct in6_addr *local_addr, struct in6_addr *remote_addr, ifnet_t interface, u_int16_t pf_tag, necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id, necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags) { struct sockaddr_in6 local = {}; struct sockaddr_in6 remote = {}; @@ -8907,30 +9899,32 @@ necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port, memcpy(&local.sin6_addr, local_addr, sizeof(local.sin6_addr)); memcpy(&remote.sin6_addr, remote_addr, sizeof(remote.sin6_addr)); - return (necp_socket_is_allowed_to_send_recv_internal(inp, (struct sockaddr *)&local, (struct sockaddr *)&remote, interface, - return_policy_id, return_route_rule_id, return_skip_policy_id)); + return necp_socket_is_allowed_to_send_recv_internal(inp, (struct sockaddr *)&local, (struct sockaddr *)&remote, interface, + pf_tag, return_policy_id, return_route_rule_id, return_skip_policy_id, return_pass_flags); } bool -necp_socket_is_allowed_to_send_recv(struct inpcb *inp, necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id, - necp_kernel_policy_id *return_skip_policy_id) +necp_socket_is_allowed_to_send_recv(struct inpcb *inp, ifnet_t interface, u_int16_t pf_tag, necp_kernel_policy_id *return_policy_id, + u_int32_t *return_route_rule_id, necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags) { - return (necp_socket_is_allowed_to_send_recv_internal(inp, NULL, NULL, NULL, return_policy_id, return_route_rule_id, return_skip_policy_id)); + return necp_socket_is_allowed_to_send_recv_internal(inp, NULL, NULL, interface, pf_tag, + return_policy_id, return_route_rule_id, + return_skip_policy_id, return_pass_flags); } int necp_mark_packet_from_socket(struct mbuf *packet, struct inpcb *inp, necp_kernel_policy_id policy_id, u_int32_t route_rule_id, - necp_kernel_policy_id skip_policy_id) + necp_kernel_policy_id skip_policy_id, u_int32_t pass_flags) { if (packet == NULL || inp == NULL || !(packet->m_flags & M_PKTHDR)) { - return (EINVAL); + return EINVAL; } // Mark ID for Pass and IP Tunnel if (policy_id != NECP_KERNEL_POLICY_ID_NONE) { packet->m_pkthdr.necp_mtag.necp_policy_id = policy_id; } else if (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_PASS || - inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL) { + inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL) { packet->m_pkthdr.necp_mtag.necp_policy_id = inp->inp_policyresult.policy_id; } else { packet->m_pkthdr.necp_mtag.necp_policy_id = NECP_KERNEL_POLICY_ID_NONE; @@ -8941,20 +9935,35 @@ necp_mark_packet_from_socket(struct mbuf *packet, struct inpcb *inp, necp_kernel } else { packet->m_pkthdr.necp_mtag.necp_route_rule_id = inp->inp_policyresult.results.route_rule_id; } - packet->m_pkthdr.necp_mtag.necp_app_id = inp->inp_policyresult.app_id; + packet->m_pkthdr.necp_mtag.necp_app_id = (inp->inp_policyresult.app_id > UINT16_MAX ? (inp->inp_policyresult.app_id - UINT16_MAX) : inp->inp_policyresult.app_id); - if (skip_policy_id != NECP_KERNEL_POLICY_ID_NONE) { + if (skip_policy_id != NECP_KERNEL_POLICY_ID_NONE && + skip_policy_id != NECP_KERNEL_POLICY_ID_NO_MATCH) { + // Only mark the skip policy if it is a valid policy ID packet->m_pkthdr.necp_mtag.necp_skip_policy_id = skip_policy_id; + } else if (inp->inp_policyresult.results.filter_control_unit == NECP_FILTER_UNIT_NO_FILTER) { + // Overload the meaning of "NECP_KERNEL_POLICY_ID_NO_MATCH" + // to indicate that NECP_FILTER_UNIT_NO_FILTER was set + // See necp_get_skip_policy_id_from_packet() and + // necp_packet_should_skip_filters(). + packet->m_pkthdr.necp_mtag.necp_skip_policy_id = NECP_KERNEL_POLICY_ID_NO_MATCH; + } else { + packet->m_pkthdr.necp_mtag.necp_skip_policy_id = NECP_KERNEL_POLICY_ID_NONE; + } + + if (((pass_flags & NECP_KERNEL_POLICY_PASS_PF_TAG) == NECP_KERNEL_POLICY_PASS_PF_TAG) || + ((inp->inp_policyresult.results.result_parameter.pass_flags & NECP_KERNEL_POLICY_PASS_PF_TAG) == NECP_KERNEL_POLICY_PASS_PF_TAG)) { + m_pftag(packet)->pftag_tag = PF_TAG_ID_SYSTEM_SERVICE; } - return (0); + return 0; } int necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id) { if (packet == NULL || !(packet->m_flags & M_PKTHDR)) { - return (EINVAL); + return EINVAL; } // Mark ID for Pass and IP Tunnel @@ -8964,14 +9973,14 @@ necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id) packet->m_pkthdr.necp_mtag.necp_policy_id = NECP_KERNEL_POLICY_ID_NONE; } - return (0); + return 0; } int necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface) { if (packet == NULL || !(packet->m_flags & M_PKTHDR)) { - return (EINVAL); + return EINVAL; } // Mark ID for Pass and IP Tunnel @@ -8979,14 +9988,14 @@ necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface) packet->m_pkthdr.necp_mtag.necp_last_interface_index = interface->if_index; } - return (0); + return 0; } int necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive) { if (packet == NULL || !(packet->m_flags & M_PKTHDR)) { - return (EINVAL); + return EINVAL; } if (is_keepalive) { @@ -8995,61 +10004,88 @@ necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive) packet->m_pkthdr.pkt_flags &= ~PKTF_KEEPALIVE; } - return (0); + return 0; } necp_kernel_policy_id necp_get_policy_id_from_packet(struct mbuf *packet) { if (packet == NULL || !(packet->m_flags & M_PKTHDR)) { - return (NECP_KERNEL_POLICY_ID_NONE); + return NECP_KERNEL_POLICY_ID_NONE; } - return (packet->m_pkthdr.necp_mtag.necp_policy_id); + return packet->m_pkthdr.necp_mtag.necp_policy_id; } necp_kernel_policy_id necp_get_skip_policy_id_from_packet(struct mbuf *packet) { if (packet == NULL || !(packet->m_flags & M_PKTHDR)) { - return (NECP_KERNEL_POLICY_ID_NONE); + return NECP_KERNEL_POLICY_ID_NONE; + } + + // Check for overloaded value. See necp_mark_packet_from_socket(). + if (packet->m_pkthdr.necp_mtag.necp_skip_policy_id == NECP_KERNEL_POLICY_ID_NO_MATCH) { + return NECP_KERNEL_POLICY_ID_NONE; + } + + return packet->m_pkthdr.necp_mtag.necp_skip_policy_id; +} + +u_int16_t +necp_get_packet_filter_tags_from_packet(struct mbuf *packet) +{ + if (packet == NULL || !(packet->m_flags & M_PKTHDR)) { + return 0; + } + + return m_pftag(packet)->pftag_tag; +} + +bool +necp_packet_should_skip_filters(struct mbuf *packet) +{ + if (packet == NULL || !(packet->m_flags & M_PKTHDR)) { + return false; } - return (packet->m_pkthdr.necp_mtag.necp_skip_policy_id); + // Check for overloaded value. See necp_mark_packet_from_socket(). + return packet->m_pkthdr.necp_mtag.necp_skip_policy_id == NECP_KERNEL_POLICY_ID_NO_MATCH; } u_int32_t necp_get_last_interface_index_from_packet(struct mbuf *packet) { if (packet == NULL || !(packet->m_flags & M_PKTHDR)) { - return (0); + return 0; } - return (packet->m_pkthdr.necp_mtag.necp_last_interface_index); + return packet->m_pkthdr.necp_mtag.necp_last_interface_index; } u_int32_t necp_get_route_rule_id_from_packet(struct mbuf *packet) { if (packet == NULL || !(packet->m_flags & M_PKTHDR)) { - return (0); + return 0; } - return (packet->m_pkthdr.necp_mtag.necp_route_rule_id); + return packet->m_pkthdr.necp_mtag.necp_route_rule_id; } int necp_get_app_uuid_from_packet(struct mbuf *packet, - uuid_t app_uuid) + uuid_t app_uuid) { if (packet == NULL || !(packet->m_flags & M_PKTHDR)) { - return (EINVAL); + return EINVAL; } bool found_mapping = FALSE; if (packet->m_pkthdr.necp_mtag.necp_app_id != 0) { lck_rw_lock_shared(&necp_kernel_policy_lock); - struct necp_uuid_id_mapping *entry = necp_uuid_lookup_uuid_with_app_id_locked(packet->m_pkthdr.necp_mtag.necp_app_id); + necp_app_id app_id = (packet->m_pkthdr.necp_mtag.necp_app_id < UINT16_MAX ? (packet->m_pkthdr.necp_mtag.necp_app_id + UINT16_MAX) : packet->m_pkthdr.necp_mtag.necp_app_id); + struct necp_uuid_id_mapping *entry = necp_uuid_lookup_uuid_with_app_id_locked(app_id); if (entry != NULL) { uuid_copy(app_uuid, entry->uuid); found_mapping = true; @@ -9059,17 +10095,17 @@ necp_get_app_uuid_from_packet(struct mbuf *packet, if (!found_mapping) { uuid_clear(app_uuid); } - return (0); + return 0; } bool necp_get_is_keepalive_from_packet(struct mbuf *packet) { if (packet == NULL || !(packet->m_flags & M_PKTHDR)) { - return (FALSE); + return FALSE; } - return (packet->m_pkthdr.pkt_flags & PKTF_KEEPALIVE); + return packet->m_pkthdr.pkt_flags & PKTF_KEEPALIVE; } u_int32_t @@ -9078,73 +10114,83 @@ necp_socket_get_content_filter_control_unit(struct socket *so) struct inpcb *inp = sotoinpcb(so); if (inp == NULL) { - return (0); + return 0; } - return (inp->inp_policyresult.results.filter_control_unit); + return inp->inp_policyresult.results.filter_control_unit; } bool necp_socket_should_use_flow_divert(struct inpcb *inp) { if (inp == NULL) { - return (FALSE); + return FALSE; } - return (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT); + return !(inp->inp_socket->so_flags1 & SOF1_FLOW_DIVERT_SKIP) && + (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT || + (inp->inp_policyresult.results.flow_divert_aggregate_unit != 0)); } u_int32_t -necp_socket_get_flow_divert_control_unit(struct inpcb *inp) +necp_socket_get_flow_divert_control_unit(struct inpcb *inp, uint32_t *aggregate_unit) { if (inp == NULL) { - return (0); + return 0; + } + + if (inp->inp_socket->so_flags1 & SOF1_FLOW_DIVERT_SKIP) { + return 0; + } + + if (aggregate_unit != NULL && + inp->inp_policyresult.results.flow_divert_aggregate_unit != 0) { + *aggregate_unit = inp->inp_policyresult.results.flow_divert_aggregate_unit; } if (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT) { - return (inp->inp_policyresult.results.result_parameter.flow_divert_control_unit); + return inp->inp_policyresult.results.result_parameter.flow_divert_control_unit; } - return (0); + return 0; } bool necp_socket_should_rescope(struct inpcb *inp) { if (inp == NULL) { - return (FALSE); + return FALSE; } - return (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED || - inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SCOPED_DIRECT); + return inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED || + inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SCOPED_DIRECT; } u_int necp_socket_get_rescope_if_index(struct inpcb *inp) { if (inp == NULL) { - return (0); + return 0; } if (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED) { - return (inp->inp_policyresult.results.result_parameter.scoped_interface_index); + return inp->inp_policyresult.results.result_parameter.scoped_interface_index; } else if (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_SCOPED_DIRECT) { - return (necp_get_primary_direct_interface_index()); + return necp_get_primary_direct_interface_index(); } - return (0); + return 0; } u_int32_t necp_socket_get_effective_mtu(struct inpcb *inp, u_int32_t current_mtu) { if (inp == NULL) { - return (current_mtu); + return current_mtu; } if (inp->inp_policyresult.results.result == NECP_KERNEL_POLICY_RESULT_IP_TUNNEL && - (inp->inp_flags & INP_BOUND_IF) && - inp->inp_boundifp) { - + (inp->inp_flags & INP_BOUND_IF) && + inp->inp_boundifp) { u_int bound_interface_index = inp->inp_boundifp->if_index; u_int tunnel_interface_index = inp->inp_policyresult.results.result_parameter.tunnel_interface_index; @@ -9160,40 +10206,40 @@ necp_socket_get_effective_mtu(struct inpcb *inp, u_int32_t current_mtu) u_int32_t direct_tunnel_mtu = tunnel_interface->if_mtu; u_int32_t delegate_tunnel_mtu = (tunnel_interface->if_delegated.ifp != NULL) ? tunnel_interface->if_delegated.ifp->if_mtu : 0; if (delegate_tunnel_mtu != 0 && - strncmp(tunnel_interface->if_name, "ipsec", strlen("ipsec")) == 0) { - // For ipsec interfaces, calculate the overhead from the delegate interface - u_int32_t tunnel_overhead = (u_int32_t)(esp_hdrsiz(NULL) + sizeof(struct ip6_hdr)); - if (delegate_tunnel_mtu > tunnel_overhead) { - delegate_tunnel_mtu -= tunnel_overhead; - } + strncmp(tunnel_interface->if_name, "ipsec", strlen("ipsec")) == 0) { + // For ipsec interfaces, calculate the overhead from the delegate interface + u_int32_t tunnel_overhead = (u_int32_t)(esp_hdrsiz(NULL) + sizeof(struct ip6_hdr)); + if (delegate_tunnel_mtu > tunnel_overhead) { + delegate_tunnel_mtu -= tunnel_overhead; + } - if (delegate_tunnel_mtu < direct_tunnel_mtu) { - // If the (delegate - overhead) < direct, return (delegate - overhead) - return (delegate_tunnel_mtu); - } else { - // Otherwise return direct - return (direct_tunnel_mtu); - } + if (delegate_tunnel_mtu < direct_tunnel_mtu) { + // If the (delegate - overhead) < direct, return (delegate - overhead) + return delegate_tunnel_mtu; + } else { + // Otherwise return direct + return direct_tunnel_mtu; + } } else { // For non-ipsec interfaces, just return the tunnel MTU - return (direct_tunnel_mtu); + return direct_tunnel_mtu; } } } } // By default, just return the MTU passed in - return (current_mtu); + return current_mtu; } ifnet_t necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter) { if (result_parameter == NULL) { - return (NULL); + return NULL; } - return (ifindex2ifnet[result_parameter->tunnel_interface_index]); + return ifindex2ifnet[result_parameter->tunnel_interface_index]; } bool @@ -9206,13 +10252,13 @@ necp_packet_can_rebind_to_ifnet(struct mbuf *packet, struct ifnet *interface, st int i; if (packet == NULL || interface == NULL || new_route == NULL || (family != AF_INET && family != AF_INET6)) { - return (FALSE); + return FALSE; } result = ifnet_get_address_list_family(interface, &addresses, family); if (result != 0) { NECPLOG(LOG_ERR, "Failed to get address list for %s%d", ifnet_name(interface), ifnet_unit(interface)); - return (FALSE); + return FALSE; } for (i = 0; addresses[i] != NULL; i++) { @@ -9251,27 +10297,27 @@ necp_packet_can_rebind_to_ifnet(struct mbuf *packet, struct ifnet *interface, st done: ifnet_free_address_list(addresses); addresses = NULL; - return (found_match); + return found_match; } static bool necp_addr_is_loopback(struct sockaddr *address) { if (address == NULL) { - return (FALSE); + return FALSE; } if (address->sa_family == AF_INET) { - return (ntohl(((struct sockaddr_in *)(void *)address)->sin_addr.s_addr) == INADDR_LOOPBACK); + return ntohl(((struct sockaddr_in *)(void *)address)->sin_addr.s_addr) == INADDR_LOOPBACK; } else if (address->sa_family == AF_INET6) { return IN6_IS_ADDR_LOOPBACK(&((struct sockaddr_in6 *)(void *)address)->sin6_addr); } - return (FALSE); + return FALSE; } static bool -necp_is_loopback(struct sockaddr *local_addr, struct sockaddr *remote_addr, struct inpcb *inp, struct mbuf *packet) +necp_is_loopback(struct sockaddr *local_addr, struct sockaddr *remote_addr, struct inpcb *inp, struct mbuf *packet, u_int32_t bound_interface_index) { // Note: This function only checks for the loopback addresses. // In the future, we may want to expand to also allow any traffic @@ -9279,59 +10325,70 @@ necp_is_loopback(struct sockaddr *local_addr, struct sockaddr *remote_addr, stru // check is cheaper. if (local_addr != NULL && necp_addr_is_loopback(local_addr)) { - return (TRUE); + return TRUE; } if (remote_addr != NULL && necp_addr_is_loopback(remote_addr)) { - return (TRUE); + return TRUE; } if (inp != NULL) { if ((inp->inp_flags & INP_BOUND_IF) && inp->inp_boundifp && (inp->inp_boundifp->if_flags & IFF_LOOPBACK)) { - return (TRUE); + return TRUE; } if (inp->inp_vflag & INP_IPV4) { if (ntohl(inp->inp_laddr.s_addr) == INADDR_LOOPBACK || - ntohl(inp->inp_faddr.s_addr) == INADDR_LOOPBACK) { - return (TRUE); + ntohl(inp->inp_faddr.s_addr) == INADDR_LOOPBACK) { + return TRUE; } } else if (inp->inp_vflag & INP_IPV6) { if (IN6_IS_ADDR_LOOPBACK(&inp->in6p_laddr) || - IN6_IS_ADDR_LOOPBACK(&inp->in6p_faddr)) { - return (TRUE); + IN6_IS_ADDR_LOOPBACK(&inp->in6p_faddr)) { + return TRUE; } } + } else if (bound_interface_index != IFSCOPE_NONE && lo_ifp->if_index == bound_interface_index) { + return TRUE; } if (packet != NULL) { struct ip *ip = mtod(packet, struct ip *); if (ip->ip_v == 4) { if (ntohl(ip->ip_src.s_addr) == INADDR_LOOPBACK) { - return (TRUE); + return TRUE; } if (ntohl(ip->ip_dst.s_addr) == INADDR_LOOPBACK) { - return (TRUE); + return TRUE; } } else if (ip->ip_v == 6) { struct ip6_hdr *ip6 = mtod(packet, struct ip6_hdr *); if (IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src)) { - return (TRUE); + return TRUE; } if (IN6_IS_ADDR_LOOPBACK(&ip6->ip6_dst)) { - return (TRUE); + return TRUE; } } } - return (FALSE); + return FALSE; } static bool necp_is_intcoproc(struct inpcb *inp, struct mbuf *packet) { - if (inp != NULL) { - return (sflt_permission_check(inp) ? true : false); + if (!(inp->inp_vflag & INP_IPV6)) { + return false; + } + if (INP_INTCOPROC_ALLOWED(inp)) { + return true; + } + if ((inp->inp_flags & INP_BOUND_IF) && + IFNET_IS_INTCOPROC(inp->inp_boundifp)) { + return true; + } + return false; } if (packet != NULL) { struct ip6_hdr *ip6 = mtod(packet, struct ip6_hdr *); @@ -9339,9 +10396,187 @@ necp_is_intcoproc(struct inpcb *inp, struct mbuf *packet) IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst) && ip6->ip6_dst.s6_addr32[2] == ntohl(0xaede48ff) && ip6->ip6_dst.s6_addr32[3] == ntohl(0xfe334455)) { - return (true); + return true; + } + } + + return false; +} + +static bool +necp_address_matches_drop_dest_policy(union necp_sockaddr_union *sau, u_int32_t session_order) +{ + char dest_str[MAX_IPv6_STR_LEN]; + + if (necp_drop_dest_debug > 0) { + if (sau->sa.sa_family == AF_INET) { + (void) inet_ntop(AF_INET, &sau->sin.sin_addr, dest_str, sizeof(dest_str)); + } else if (sau->sa.sa_family == AF_INET6) { + (void) inet_ntop(AF_INET6, &sau->sin6.sin6_addr, dest_str, sizeof(dest_str)); + } else { + dest_str[0] = 0; + } + } + for (u_int32_t i = 0; i < necp_drop_dest_policy.entry_count; i++) { + struct necp_drop_dest_entry *necp_drop_dest_entry = &necp_drop_dest_policy.entries[i]; + struct necp_policy_condition_addr *npca = &necp_drop_dest_entry->cond_addr; + + if (session_order >= necp_drop_dest_entry->order && necp_is_addr_in_subnet(&sau->sa, &npca->address.sa, npca->prefix)) { + if (necp_drop_dest_debug > 0) { + char subnet_str[MAX_IPv6_STR_LEN]; + struct proc *p = current_proc(); + pid_t pid = proc_pid(p); + + if (sau->sa.sa_family == AF_INET) { + (void) inet_ntop(AF_INET, &npca->address.sin, subnet_str, sizeof(subnet_str)); + os_log(OS_LOG_DEFAULT, "%s (process %s:%u) %s matches %s/%u", __func__, proc_best_name(p), pid, dest_str, subnet_str, npca->prefix); + } else if (sau->sa.sa_family == AF_INET6) { + (void) inet_ntop(AF_INET6, &npca->address.sin6, subnet_str, sizeof(subnet_str)); + os_log(OS_LOG_DEFAULT, "%s (process %s:%u) %s matches %s/%u", __func__, proc_best_name(p), pid, dest_str, subnet_str, npca->prefix); + } + } + return true; + } + } + if (necp_drop_dest_debug > 1) { + struct proc *p = current_proc(); + pid_t pid = proc_pid(p); + + os_log(OS_LOG_DEFAULT, "%s (process %s:%u) %s no match", __func__, proc_best_name(p), pid, dest_str); + } + return false; +} + +static int +sysctl_handle_necp_drop_dest_level SYSCTL_HANDLER_ARGS +{ +#pragma unused(arg1, arg2, oidp) + int changed = 0; + int error = 0; + struct necp_drop_dest_policy tmp_drop_dest_policy; + struct proc *p = current_proc(); + pid_t pid = proc_pid(p); + + if (req->newptr != USER_ADDR_NULL && proc_suser(current_proc()) != 0 && + priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NECP_POLICIES, 0) != 0) { + NECPLOG(LOG_ERR, "%s (process %s:%u) not permitted", __func__, proc_best_name(p), pid); + return EPERM; + } + if (req->newptr != USER_ADDR_NULL && req->newlen != sizeof(struct necp_drop_dest_policy)) { + NECPLOG(LOG_ERR, "%s (process %s:%u) bad newlen %lu", __func__, proc_best_name(p), pid, req->newlen); + return EINVAL; + } + + memcpy(&tmp_drop_dest_policy, &necp_drop_dest_policy, sizeof(struct necp_drop_dest_policy)); + error = sysctl_io_opaque(req, &tmp_drop_dest_policy, sizeof(struct necp_drop_dest_policy), &changed); + if (error != 0) { + NECPLOG(LOG_ERR, "%s (process %s:%u) sysctl_io_opaque() error %d", __func__, proc_best_name(p), pid, error); + return error; + } + if (changed == 0 || req->newptr == USER_ADDR_NULL) { + return error; + } + + // + // Validate the passed parameters + // + if (tmp_drop_dest_policy.entry_count >= MAX_NECP_DROP_DEST_LEVEL_ADDRS) { + NECPLOG(LOG_ERR, "%s (process %s:%u) bad entry_count %u", __func__, proc_best_name(p), pid, tmp_drop_dest_policy.entry_count); + return EINVAL; + } + for (u_int32_t i = 0; i < tmp_drop_dest_policy.entry_count; i++) { + struct necp_drop_dest_entry *tmp_drop_dest_entry = &tmp_drop_dest_policy.entries[i]; + struct necp_policy_condition_addr *npca = &tmp_drop_dest_entry->cond_addr; + + switch (tmp_drop_dest_entry->level) { + case NECP_SESSION_PRIORITY_UNKNOWN: + if (tmp_drop_dest_policy.entry_count != 0) { + NECPLOG(LOG_ERR, "%s (process %s:%u) NECP_SESSION_PRIORITY_UNKNOWN bad entry_count %u", __func__, proc_best_name(p), pid, tmp_drop_dest_policy.entry_count); + return EINVAL; + } + break; + case NECP_SESSION_PRIORITY_CONTROL: + case NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL: + case NECP_SESSION_PRIORITY_HIGH: + case NECP_SESSION_PRIORITY_HIGH_1: + case NECP_SESSION_PRIORITY_HIGH_2: + case NECP_SESSION_PRIORITY_HIGH_3: + case NECP_SESSION_PRIORITY_HIGH_4: + case NECP_SESSION_PRIORITY_HIGH_RESTRICTED: + case NECP_SESSION_PRIORITY_DEFAULT: + case NECP_SESSION_PRIORITY_LOW: + if (tmp_drop_dest_policy.entry_count == 0) { + NECPLOG(LOG_ERR, "%s (process %s:%u) priority %u entry_count 0", __func__, proc_best_name(p), pid, tmp_drop_dest_entry->level); + return EINVAL; + } + break; + default: { + NECPLOG(LOG_ERR, "%s (process %s:%u) bad level %u", __func__, proc_best_name(p), pid, tmp_drop_dest_entry->level); + return EINVAL; + } + } + + switch (npca->address.sa.sa_family) { + case AF_INET: { + if (npca->prefix > 32) { + NECPLOG(LOG_ERR, "%s (process %s:%u) AF_INET bad prefix %u", __func__, proc_best_name(p), pid, npca->prefix); + return EINVAL; + } + if (npca->address.sin.sin_len != sizeof(struct sockaddr_in)) { + NECPLOG(LOG_ERR, "%s (process %s:%u) AF_INET bad sin_len %u", __func__, proc_best_name(p), pid, npca->address.sin.sin_len); + return EINVAL; + } + if (npca->address.sin.sin_port != 0) { + NECPLOG(LOG_ERR, "%s (process %s:%u) AF_INET bad sin_port %u, not zero", __func__, proc_best_name(p), pid, npca->address.sin.sin_port); + return EINVAL; + } + break; + } + case AF_INET6: { + if (npca->prefix > 128) { + NECPLOG(LOG_ERR, "%s (process %s:%u) AF_INET6 bad prefix %u", __func__, proc_best_name(p), pid, npca->prefix); + return EINVAL; + } + if (npca->address.sin6.sin6_len != sizeof(struct sockaddr_in6)) { + NECPLOG(LOG_ERR, "%s (process %s:%u) AF_INET6 bad sin6_len %u", __func__, proc_best_name(p), pid, npca->address.sin6.sin6_len); + return EINVAL; + } + if (npca->address.sin6.sin6_port != 0) { + NECPLOG(LOG_ERR, "%s (process %s:%u) AF_INET6 bad sin6_port %u, not zero", __func__, proc_best_name(p), pid, npca->address.sin6.sin6_port); + return EINVAL; + } + if (npca->address.sin6.sin6_flowinfo != 0) { + NECPLOG(LOG_ERR, "%s (process %s:%u) AF_INET6 bad sin6_flowinfo %u, not zero", __func__, proc_best_name(p), pid, npca->address.sin6.sin6_flowinfo); + return EINVAL; + } + if (npca->address.sin6.sin6_scope_id != 0) { + NECPLOG(LOG_ERR, "%s (process %s:%u) AF_INET6 bad sin6_scope_id %u, not zero", __func__, proc_best_name(p), pid, npca->address.sin6.sin6_scope_id); + return EINVAL; + } + break; + } + default: { + return EINVAL; } + } + } + + // + // Commit the changed policy + // + lck_rw_lock_exclusive(&necp_kernel_policy_lock); + memset(&necp_drop_dest_policy, 0, sizeof(struct necp_drop_dest_policy)); + + necp_drop_dest_policy.entry_count = tmp_drop_dest_policy.entry_count; + for (u_int32_t i = 0; i < tmp_drop_dest_policy.entry_count; i++) { + struct necp_drop_dest_entry *tmp_drop_dest_entry = &tmp_drop_dest_policy.entries[i]; + struct necp_drop_dest_entry *necp_drop_dest_entry = &necp_drop_dest_policy.entries[i]; + + memcpy(necp_drop_dest_entry, tmp_drop_dest_entry, sizeof(struct necp_drop_dest_entry)); + + necp_drop_dest_entry->order = necp_get_first_order_for_priority(necp_drop_dest_entry->level); } + lck_rw_done(&necp_kernel_policy_lock); - return (false); + return 0; }