xref: /xnu-11215.41.3/bsd/net/necp.h (revision 33de042d024d46de5ff4e89f2471de6608e37fa4)
1 /*
2  * Copyright (c) 2013-2023 Apple Inc. All rights reserved.
3  *
4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5  *
6  * This file contains Original Code and/or Modifications of Original Code
7  * as defined in and that are subject to the Apple Public Source License
8  * Version 2.0 (the 'License'). You may not use this file except in
9  * compliance with the License. The rights granted to you under the License
10  * may not be used to create, or enable the creation or redistribution of,
11  * unlawful or unlicensed copies of an Apple operating system, or to
12  * circumvent, violate, or enable the circumvention or violation of, any
13  * terms of an Apple operating system software license agreement.
14  *
15  * Please obtain a copy of the License at
16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
17  *
18  * The Original Code and all software distributed under the License are
19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23  * Please see the License for the specific language governing rights and
24  * limitations under the License.
25  *
26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27  */
28 
29 #ifndef _NET_NECP_H_
30 #define _NET_NECP_H_
31 
32 #include <net/net_kev.h>
33 #ifdef PRIVATE
34 
35 #include <netinet/in.h>
36 #include <netinet/in_private.h>
37 #include <netinet/in_stat.h>
38 #include <sys/socket.h>
39 #include <net/if_private.h>
40 #include <net/if_var_private.h>
41 
42 #if SKYWALK
43 #include <skywalk/os_nexus_private.h>
44 #else /* !SKYWALK */
45 typedef uint16_t nexus_port_t;
46 #endif /* !SKYWALK */
47 
48 /*
49  * Name registered by the NECP
50  */
51 #define NECP_CONTROL_NAME "com.apple.net.necp_control"
52 
53 #define NECP_TLV_LENGTH_UINT32  1
54 
55 struct necp_packet_header {
56 	u_int8_t            packet_type;
57 	u_int8_t                flags;
58 	u_int32_t           message_id;
59 };
60 
61 typedef struct {
62 	uid_t               uid;
63 	uuid_t              effective_uuid;
64 	uid_t               persona_id;
65 } necp_application_id_t;
66 
67 /*
68  * Control message commands
69  */
70 #define NECP_PACKET_TYPE_POLICY_ADD                             1
71 #define NECP_PACKET_TYPE_POLICY_GET                             2
72 #define NECP_PACKET_TYPE_POLICY_DELETE                  3
73 #define NECP_PACKET_TYPE_POLICY_APPLY_ALL               4
74 #define NECP_PACKET_TYPE_POLICY_LIST_ALL                5
75 #define NECP_PACKET_TYPE_POLICY_DELETE_ALL              6
76 #define NECP_PACKET_TYPE_SET_SESSION_PRIORITY   7
77 #define NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC   8
78 #define NECP_PACKET_TYPE_REGISTER_SERVICE               9
79 #define NECP_PACKET_TYPE_UNREGISTER_SERVICE             10
80 #define NECP_PACKET_TYPE_POLICY_DUMP_ALL                11
81 
82 /*
83  * Session actions
84  */
85 #define NECP_SESSION_ACTION_POLICY_ADD                          1       // In: Policy TLVs				Out: necp_policy_id
86 #define NECP_SESSION_ACTION_POLICY_GET                          2       // In: necp_policy_id			Out: Policy TLVs
87 #define NECP_SESSION_ACTION_POLICY_DELETE                       3       // In: necp_policy_id			Out: None
88 #define NECP_SESSION_ACTION_POLICY_APPLY_ALL            4       // In: None						Out: None
89 #define NECP_SESSION_ACTION_POLICY_LIST_ALL                     5       // In: None						Out: TLVs of IDs
90 #define NECP_SESSION_ACTION_POLICY_DELETE_ALL           6       // In: None						Out: None
91 #define NECP_SESSION_ACTION_SET_SESSION_PRIORITY        7       // In: necp_session_priority	Out: None
92 #define NECP_SESSION_ACTION_LOCK_SESSION_TO_PROC        8       // In: None						Out: None
93 #define NECP_SESSION_ACTION_REGISTER_SERVICE            9       // In: uuid_t					Out: None
94 #define NECP_SESSION_ACTION_UNREGISTER_SERVICE          10      // In: uuid_t					Out: None
95 #define NECP_SESSION_ACTION_POLICY_DUMP_ALL                     11      // In: None						Out: uint32_t bytes length, then Policy TLVs
96 #define NECP_SESSION_ACTION_ADD_DOMAIN_FILTER           12      // In: struct net_bloom_filter  Out: uint32_t, ID
97 #define NECP_SESSION_ACTION_REMOVE_DOMAIN_FILTER        13      // In: uint32_t, ID             Out: None
98 #define NECP_SESSION_ACTION_REMOVE_ALL_DOMAIN_FILTERS   14      // In: None                     Out: None
99 
100 /*
101  * Control message flags
102  */
103 #define NECP_PACKET_FLAGS_RESPONSE                              0x01    // Used for acks, errors, and query responses
104 
105 /*
106  * Control message TLV types
107  */
108 #define NECP_TLV_NIL                                                    0
109 #define NECP_TLV_ERROR                                                  1       // u_int32_t
110 #define NECP_TLV_POLICY_ORDER                                   2       // u_int32_t
111 #define NECP_TLV_POLICY_CONDITION                               3
112 #define NECP_TLV_POLICY_RESULT                                  4
113 #define NECP_TLV_POLICY_ID                                              5       // u_int32_t
114 #define NECP_TLV_SESSION_PRIORITY                               6       // u_int32_t
115 #define NECP_TLV_ATTRIBUTE_DOMAIN                               7       // char[]
116 #define NECP_TLV_ATTRIBUTE_ACCOUNT                              8       // char[]
117 #define NECP_TLV_SERVICE_UUID                                   9       // uuid_t
118 #define NECP_TLV_ROUTE_RULE                                             10
119 #define NECP_TLV_ATTRIBUTE_DOMAIN_OWNER                        11       // char[]
120 #define NECP_TLV_ATTRIBUTE_TRACKER_DOMAIN                      12       // char[]
121 #define NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT                      13       // char[]
122 
123 /*
124  * Control message TLV sent only by the kernel to userspace
125  */
126 #define NECP_TLV_POLICY_OWNER                                   100     // char []
127 #define NECP_TLV_POLICY_DUMP                                    101
128 #define NECP_TLV_POLICY_RESULT_STRING                   102     // char []
129 #define NECP_TLV_POLICY_SESSION_ORDER                   103     // u_int32_t
130 
131 /*
132  * Condition flags
133  */
134 #define NECP_POLICY_CONDITION_FLAGS_NEGATIVE    0x01 // Negative
135 #define NECP_POLICY_CONDITION_FLAGS_EXACT       0x02 // For conditions that would otherwise have more inclusive matching, require an exact match
136 
137 /*
138  * Added support for dumping negative conditions
139  */
140 #define NECP_POLICY_CONDITION_FLAGS_NEGATIVE_SUPPORTS_DUMP    1
141 
142 /*
143  * Conditions
144  * Used for setting policies as well as passing parameters to necp_match_policy.
145  */
146 #define NECP_POLICY_CONDITION_DEFAULT                   0       // N/A, not valid with any other conditions
147 // Socket/Application conditions
148 #define NECP_POLICY_CONDITION_APPLICATION               1       // uuid_t, uses effective UUID when possible
149 #define NECP_POLICY_CONDITION_REAL_APPLICATION  2       // uuid_t, never uses effective UUID. Only valid with NECP_POLICY_CONDITION_APPLICATION
150 #define NECP_POLICY_CONDITION_DOMAIN                    3       // String, such as apple.com
151 #define NECP_POLICY_CONDITION_ACCOUNT                   4       // String
152 #define NECP_POLICY_CONDITION_ENTITLEMENT               5       // String
153 #define NECP_POLICY_CONDITION_PID                               6       // pid_t
154 #define NECP_POLICY_CONDITION_UID                               7       // uid_t
155 #define NECP_POLICY_CONDITION_ALL_INTERFACES    8       // N/A
156 #define NECP_POLICY_CONDITION_BOUND_INTERFACE   9       // String
157 #define NECP_POLICY_CONDITION_TRAFFIC_CLASS             10      // necp_policy_condition_tc_range
158 // Socket/IP conditions
159 #define NECP_POLICY_CONDITION_IP_PROTOCOL               11      // u_int16_t
160 #define NECP_POLICY_CONDITION_LOCAL_ADDR                12      // necp_policy_condition_addr
161 #define NECP_POLICY_CONDITION_REMOTE_ADDR               13      // necp_policy_condition_addr
162 #define NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE  14      // necp_policy_condition_addr_range
163 #define NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE 15      // necp_policy_condition_addr_range
164 #define NECP_POLICY_CONDITION_AGENT_TYPE                16      // struct necp_policy_condition_agent_type
165 #define NECP_POLICY_CONDITION_HAS_CLIENT                17      // N/A
166 #define NECP_POLICY_CONDITION_LOCAL_NETWORKS            18      // Matches all local networks
167 // Socket-only conditions
168 #define NECP_POLICY_CONDITION_FLOW_IP_PROTOCOL          19      // u_int16_t
169 #define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR           20      // necp_policy_condition_addr
170 #define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR          21      // necp_policy_condition_addr
171 #define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_RANGE     22      // necp_policy_condition_addr_range
172 #define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_RANGE    23      // necp_policy_condition_addr_range
173 #define NECP_POLICY_CONDITION_FLOW_IS_LOOPBACK          31      // N/A
174 // Socket/Application conditions, continued
175 #define NECP_POLICY_CONDITION_CLIENT_FLAGS              24      // u_int32_t, values from NECP_CLIENT_PARAMETER_FLAG_*
176 #define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_EMPTY     25      // N/A
177 #define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_EMPTY    26      // N/A
178 #define NECP_POLICY_CONDITION_PLATFORM_BINARY           27      // N/A
179 #define NECP_POLICY_CONDITION_SDK_VERSION               28      // struct necp_policy_condition_sdk_version
180 #define NECP_POLICY_CONDITION_SIGNING_IDENTIFIER        29      // String
181 #define NECP_POLICY_CONDITION_PACKET_FILTER_TAGS        30      // u_int16_t
182 #define NECP_POLICY_CONDITION_DELEGATE_IS_PLATFORM_BINARY      32      // N/A
183 #define NECP_POLICY_CONDITION_DOMAIN_OWNER              33      // String, owner of domain (for example, "Google Inc")
184 #define NECP_POLICY_CONDITION_DOMAIN_CONTEXT            34      // String, eTLD+1 leading to networking activities to the domain
185 #define NECP_POLICY_CONDITION_TRACKER_DOMAIN            35      // String, tracker domain
186 #define NECP_POLICY_CONDITION_ATTRIBUTED_BUNDLE_IDENTIFIER 36   // String, app to which traffic is attributed to
187 #define NECP_POLICY_CONDITION_SCHEME_PORT               37      // u_int16_t, the port associated with the scheme for a connection
188 #define NECP_POLICY_CONDITION_DOMAIN_FILTER             38      // struct net_bloom_filter
189 #define NECP_POLICY_CONDITION_SYSTEM_SIGNED_RESULT      39      // N/A
190 #define NECP_POLICY_CONDITION_REAL_UID                  40      // uid_t
191 #define NECP_POLICY_CONDITION_APPLICATION_ID            41      // necp_application_id_t
192 #define NECP_POLICY_CONDITION_URL                       42      // String, URL
193 #define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS     43      // Interface flags: u_int32_t flags, u_int32_t eflags, u_int32_t xflags
194 
195 
196 /*
197  * Policy Condition Bound Interface Flags Order
198  */
199 #define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS_IDX_FLAGS      0
200 #define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS_IDX_EFLAGS     1
201 #define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS_IDX_XFLAGS     2
202 #define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS_IDX_MAX        3
203 
204 /*
205  * Policy Packet tags
206  */
207 #define NECP_POLICY_CONDITION_PACKET_FILTER_TAG_STACK_DROP         0x01
208 #define NECP_POLICY_CONDITION_PACKET_FILTER_TAG_MAX                NECP_POLICY_CONDITION_PACKET_FILTER_TAG_STACK_DROP
209 
210 /*
211  * Results
212  */
213 #define NECP_POLICY_RESULT_PASS                                 1       // N/A
214 #define NECP_POLICY_RESULT_SKIP                                 2       // u_int32_t, policy order to skip to. 0 to skip all session policies.
215 #define NECP_POLICY_RESULT_DROP                                 3       // N/A
216 #define NECP_POLICY_RESULT_SOCKET_DIVERT                4       // u_int32_t, flow divert control unit
217 #define NECP_POLICY_RESULT_SOCKET_FILTER                5       // u_int32_t, filter control unit
218 #define NECP_POLICY_RESULT_IP_TUNNEL                    6       // String, interface name
219 #define NECP_POLICY_RESULT_IP_FILTER                    7       // ?
220 #define NECP_POLICY_RESULT_TRIGGER                              8       // Deprecated
221 #define NECP_POLICY_RESULT_TRIGGER_IF_NEEDED    9       // Deprecated
222 #define NECP_POLICY_RESULT_TRIGGER_SCOPED               10      // Deprecated
223 #define NECP_POLICY_RESULT_NO_TRIGGER_SCOPED    11      // Deprecated
224 #define NECP_POLICY_RESULT_SOCKET_SCOPED                12      // String, interface name
225 #define NECP_POLICY_RESULT_ROUTE_RULES                  13      // N/A, must have route rules defined
226 #define NECP_POLICY_RESULT_USE_NETAGENT                 14      // netagent uuid_t
227 #define NECP_POLICY_RESULT_NETAGENT_SCOPED              15      // netagent uuid_t
228 #define NECP_POLICY_RESULT_SCOPED_DIRECT                16      // N/A, scopes to primary physical interface
229 #define NECP_POLICY_RESULT_ALLOW_UNENTITLED             17      // N/A
230 #define NECP_POLICY_RESULT_REMOVE_NETAGENT              18      // netagent uuid_t
231 
232 #define NECP_POLICY_RESULT_MAX                          NECP_POLICY_RESULT_REMOVE_NETAGENT
233 
234 /*
235  * PASS Result Flags
236  */
237 #define NECP_POLICY_PASS_NO_SKIP_IPSEC                  0x01
238 #define NECP_POLICY_PASS_PF_TAG                         0x02
239 
240 /*
241  * DROP Result Flags
242  */
243 #define NECP_POLICY_DROP_FLAG_LOCAL_NETWORK             0x01
244 #define NECP_POLICY_DROP_FLAG_SUPPRESS_ALERTS           0x02
245 
246 /*
247  * Local-Networks Condition Flags
248  */
249 #define NECP_POLICY_LOCAL_NETWORKS_FLAG_INCLUDE_LOCAL_ADDRESSES 0x01     // Include addresses on local interfaces for Local-Networks condition
250 
251 /*
252  * Route Rules
253  * Detailed parameters for NECP_POLICY_RESULT_ROUTE_RULES.
254  */
255 #define NECP_ROUTE_RULE_NONE                                    0       // N/A
256 #define NECP_ROUTE_RULE_DENY_INTERFACE                  1       // String, or empty to match all
257 #define NECP_ROUTE_RULE_ALLOW_INTERFACE                 2       // String, or empty to match all
258 #define NECP_ROUTE_RULE_QOS_MARKING                             3       // String, or empty to match all
259 #define NECP_ROUTE_RULE_DENY_LQM_ABORT                  4       // String, or empty to match all
260 #define NECP_ROUTE_RULE_USE_NETAGENT                    5       // UUID, followed by string or empty
261 #define NECP_ROUTE_RULE_REMOVE_NETAGENT                 6       // UUID, followed by string or empty
262 #define NECP_ROUTE_RULE_DIVERT_SOCKET                   7       // u_int32_t control unit, followed by string or empty
263 #define NECP_ROUTE_RULE_DENY_INTERFACE_WITH_TYPE        8       // u_int32_t effective type, followed by string or empty
264 
265 #define NECP_ROUTE_RULE_FLAG_CELLULAR                   0x01
266 #define NECP_ROUTE_RULE_FLAG_WIFI                       0x02
267 #define NECP_ROUTE_RULE_FLAG_WIRED                      0x04
268 #define NECP_ROUTE_RULE_FLAG_EXPENSIVE                  0x08
269 #define NECP_ROUTE_RULE_FLAG_CONSTRAINED                0x10
270 #define NECP_ROUTE_RULE_FLAG_COMPANION                  0x20
271 #define NECP_ROUTE_RULE_FLAG_VPN                        0x40
272 
273 #define NECP_ROUTE_RULE_FLAG_NETAGENT                   0x80 // Last bit, reserved to mark that this applies only when an agent UUID is present
274 
275 #define NECP_ROUTE_RULES_SUPPORT_NETAGENT_EXCEPTIONS    1
276 
277 /*
278  * Error types
279  */
280 #define NECP_ERROR_INTERNAL                                             0
281 #define NECP_ERROR_UNKNOWN_PACKET_TYPE                  1
282 #define NECP_ERROR_INVALID_TLV                                  2
283 #define NECP_ERROR_POLICY_RESULT_INVALID                3
284 #define NECP_ERROR_POLICY_CONDITIONS_INVALID    4
285 #define NECP_ERROR_POLICY_ID_NOT_FOUND                  5
286 #define NECP_ERROR_INVALID_PROCESS                              6
287 #define NECP_ERROR_ROUTE_RULES_INVALID                  7
288 
289 // Modifiers
290 #define NECP_MASK_USERSPACE_ONLY        0x80000000      // on filter_control_unit value
291 #define NECP_MASK_PRESERVE_CONNECTIONS  0x20000000      // on filter_control_unit value
292 
293 struct necp_policy_condition_tc_range {
294 	u_int32_t start_tc;
295 	u_int32_t end_tc;
296 } __attribute__((__packed__));
297 
298 struct necp_policy_condition_addr {
299 	u_int8_t                prefix;
300 	union {
301 		struct sockaddr                 sa;
302 		struct sockaddr_in              sin;
303 		struct sockaddr_in6             sin6;
304 	} address __attribute__((__packed__));
305 } __attribute__((__packed__));
306 
307 struct necp_policy_condition_addr_range {
308 	union {
309 		struct sockaddr                 sa;
310 		struct sockaddr_in              sin;
311 		struct sockaddr_in6             sin6;
312 	} start_address __attribute__((__packed__));
313 	union {
314 		struct sockaddr                 sa;
315 		struct sockaddr_in              sin;
316 		struct sockaddr_in6             sin6;
317 	} end_address __attribute__((__packed__));
318 } __attribute__((__packed__));
319 
320 struct necp_policy_condition_agent_type {
321 	char agent_domain[32];
322 	char agent_type[32];
323 } __attribute__((__packed__));
324 
325 struct necp_policy_condition_sdk_version {
326 	uint32_t platform; // e.g., PLATFORM_IOS
327 	uint32_t min_version; // Encoded as XXXX.YY.ZZ
328 	uint32_t version; // Encoded as XXXX.YY.ZZ
329 } __attribute__((__packed__));
330 
331 #define NECP_SESSION_PRIORITY_UNKNOWN                   0
332 #define NECP_SESSION_PRIORITY_CONTROL                   1
333 #define NECP_SESSION_PRIORITY_CONTROL_1                 2
334 #define NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL         3
335 #define NECP_SESSION_PRIORITY_HIGH                      4
336 #define NECP_SESSION_PRIORITY_HIGH_1                    5
337 #define NECP_SESSION_PRIORITY_HIGH_2                    6
338 #define NECP_SESSION_PRIORITY_HIGH_3                    7
339 #define NECP_SESSION_PRIORITY_HIGH_4                    8
340 #define NECP_SESSION_PRIORITY_HIGH_RESTRICTED           9
341 #define NECP_SESSION_PRIORITY_DEFAULT                   10
342 #define NECP_SESSION_PRIORITY_LOW                       11
343 #define NECP_SESSION_NUM_PRIORITIES                             NECP_SESSION_PRIORITY_LOW
344 
345 typedef u_int32_t necp_policy_id;
346 typedef u_int32_t necp_policy_order;
347 typedef u_int32_t necp_session_priority;
348 
349 typedef u_int32_t necp_kernel_policy_result;
350 typedef u_int32_t necp_kernel_policy_filter;
351 
352 typedef union {
353 	u_int                                           tunnel_interface_index;
354 	u_int                                           scoped_interface_index;
355 	u_int32_t                                       flow_divert_control_unit;
356 	u_int32_t                                       filter_control_unit;
357 	u_int32_t                                       pass_flags;
358 	u_int32_t                                       drop_flags;
359 } necp_kernel_policy_routing_result_parameter;
360 
361 #define NECP_SERVICE_FLAGS_REGISTERED                   0x01
362 #define NECP_MAX_NETAGENTS                                              16
363 
364 #define NECP_AGENT_USE_FLAG_SCOPE                               0x01
365 #define NECP_AGENT_USE_FLAG_REMOVE                              0x02
366 
367 #define NECP_TFO_COOKIE_LEN_MAX      16
368 struct necp_aggregate_result {
369 	necp_kernel_policy_result                       routing_result;
370 	necp_kernel_policy_routing_result_parameter     routing_result_parameter;
371 	necp_kernel_policy_filter                       filter_control_unit;
372 	u_int32_t                                       flow_divert_aggregate_unit;
373 	necp_kernel_policy_result                       service_action;
374 	uuid_t                                                          service_uuid;
375 	u_int32_t                                                       service_flags;
376 	u_int32_t                                                       service_data;
377 	u_int                                                           routed_interface_index;
378 	u_int32_t                                                       policy_id;
379 	u_int32_t                                                       skip_policy_id;
380 	uuid_t                                                          netagents[NECP_MAX_NETAGENTS];
381 	u_int32_t                                                       netagent_use_flags[NECP_MAX_NETAGENTS];
382 	struct ipv6_prefix                                              nat64_prefixes[NAT64_MAX_NUM_PREFIXES];
383 	u_int8_t                                                        mss_recommended;
384 };
385 
386 /*
387  * Statistics.  It would be nice if the definitions in ntstat.h could be used,
388  * but they get entangled with #defines for v4 etc in pfvar.h and it may be better practice
389  * to have separate definitions here.
390  */
391 struct necp_stat_counts {
392 	/*	Counters	*/
393 	u_int64_t       necp_stat_rxpackets             __attribute__((aligned(8)));
394 	u_int64_t       necp_stat_rxbytes               __attribute__((aligned(8)));
395 	u_int64_t       necp_stat_txpackets             __attribute__((aligned(8)));
396 	u_int64_t       necp_stat_txbytes               __attribute__((aligned(8)));
397 
398 	u_int32_t       necp_stat_rxduplicatebytes;
399 	u_int32_t       necp_stat_rxoutoforderbytes;
400 	u_int32_t       necp_stat_txretransmit;
401 
402 	u_int32_t       necp_stat_connectattempts;
403 	u_int32_t       necp_stat_connectsuccesses;
404 
405 	u_int32_t       necp_stat_min_rtt;
406 	u_int32_t       necp_stat_avg_rtt;
407 	u_int32_t       necp_stat_var_rtt;
408 
409 #define NECP_STAT_ROUTE_FLAGS   1
410 	u_int32_t       necp_stat_route_flags;
411 };
412 
413 // Note, some metadata is implicit in the necp client itself:
414 // From the process itself : pid, upid, uuid, proc name.
415 // From the necp client parameters: local and remote addresses, euuid, traffic class, ifindex
416 //
417 // The following may well be supplied via future necp client parameters,
418 // but they are here so they don't get forgotten.
419 struct necp_basic_metadata {
420 	u_int32_t       rcvbufsize;
421 	u_int32_t       rcvbufused;
422 };
423 
424 struct necp_connection_probe_status {
425 	unsigned int    probe_activated : 1;
426 	unsigned int    write_probe_failed : 1;
427 	unsigned int    read_probe_failed : 1;
428 	unsigned int    conn_probe_failed : 1;
429 };
430 
431 struct necp_extra_tcp_metadata {
432 	struct necp_connection_probe_status probestatus;
433 
434 	u_int32_t       sndbufsize;
435 	u_int32_t       sndbufused;
436 	u_int32_t       txunacked;
437 	u_int32_t       txwindow;
438 	u_int32_t       txcwindow;
439 	u_int32_t       flags;                  // use SOF_*
440 	u_int32_t       flags1;                 // use SOF1_*
441 	u_int32_t       traffic_mgt_flags;
442 	u_int32_t       cc_alg_index;
443 	u_int32_t       state;
444 };
445 
446 struct necp_stats_hdr {
447 	u_int32_t                                       necp_stats_type __attribute__((aligned(8)));
448 	u_int32_t                                       necp_stats_ver;
449 	u_int64_t                                       __necp_stats_reserved; // Pad the field for future use
450 };
451 
452 #define NECP_CLIENT_STATISTICS_TYPE_TCP                         1       // Identifies use of necp_tcp_stats
453 #define NECP_CLIENT_STATISTICS_TYPE_UDP                         2       // Identifies use of necp_udp_stats
454 #define NECP_CLIENT_STATISTICS_TYPE_QUIC                        3       // Identifies use of necp_quic_stats
455 
456 #define NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1           1       // Currently supported version for TCP
457 #define NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1           1       // Currently supported version for UDP
458 #define NECP_CLIENT_STATISTICS_TYPE_QUIC_VER_1          1       // Currently supported version for QUIC
459 
460 #define NECP_CLIENT_STATISTICS_TYPE_TCP_CURRENT_VER             NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1
461 #define NECP_CLIENT_STATISTICS_TYPE_UDP_CURRENT_VER             NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1
462 #define NECP_CLIENT_STATISTICS_TYPE_QUIC_CURRENT_VER            NECP_CLIENT_STATISTICS_TYPE_QUIC_VER_1
463 
464 #define NECP_CLIENT_STATISTICS_EVENT_INIT                       0x00000000              // Register the flow
465 #define NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT          0x00000001              // The flow is effectively finished but waiting on timer
466 
467 struct necp_tcp_stats {
468 	struct necp_stats_hdr                   necp_tcp_hdr;
469 	struct necp_stat_counts                 necp_tcp_counts;
470 	struct necp_basic_metadata              necp_tcp_basic;
471 	struct necp_extra_tcp_metadata  necp_tcp_extra;
472 };
473 
474 struct necp_udp_stats {
475 	struct necp_stats_hdr           necp_udp_hdr;
476 	struct necp_stat_counts         necp_udp_counts;
477 	struct necp_basic_metadata      necp_udp_basic;
478 };
479 
480 
481 /*
482  * The following reflects the special case for QUIC.
483  * It is a streaming protocol built on top of UDP.
484  * Therefore QUIC stats are defined as basic UDP stats
485  * with some extra meta data.
486  * TODO: For now the extra metadata is an exact replica
487  * of the metadata for TCP. However keeping that separate allows
488  * the structures to diverge later as new stats are added.
489  */
490 #define QUIC_STATELESS_RESET_TOKEN_SIZE               16
491 #define NECP_QUIC_HAS_PROBE_STATUS 1
492 struct necp_extra_quic_metadata {
493 	u_int32_t       sndbufsize;
494 	u_int32_t       sndbufused;
495 	u_int32_t       txunacked;
496 	u_int32_t       txwindow;
497 	u_int32_t       txcwindow;
498 	u_int32_t       traffic_mgt_flags;
499 	u_int32_t       cc_alg_index;
500 	u_int32_t       state;
501 	u_int8_t        ssr_token[QUIC_STATELESS_RESET_TOKEN_SIZE];
502 	struct necp_connection_probe_status probestatus;
503 };
504 
505 #define necp_quic_hdr           necp_quic_udp_stats.necp_udp_hdr
506 #define necp_quic_counts        necp_quic_udp_stats.necp_udp_counts
507 #define necp_quic_basic         necp_quic_udp_stats.necp_udp_basic
508 struct necp_quic_stats {
509 	struct necp_udp_stats           necp_quic_udp_stats;
510 	struct necp_extra_quic_metadata necp_quic_extra;
511 };
512 
513 typedef struct necp_all_stats {
514 	union {
515 		struct necp_tcp_stats   tcp_stats;
516 		struct necp_udp_stats   udp_stats;
517 		struct necp_quic_stats  quic_stats;
518 	} all_stats_u;
519 } necp_all_stats;
520 
521 // Memory for statistics is requested via a necp_stats_bufreq
522 //
523 struct necp_stats_bufreq {
524 	u_int32_t                                       necp_stats_bufreq_id __attribute__((aligned(8)));
525 	u_int32_t                                       necp_stats_bufreq_type;         //  NECP_CLIENT_STATISTICS_TYPE_*
526 	u_int32_t                                       necp_stats_bufreq_ver;          //  NECP_CLIENT_STATISTICS_TYPE_*_VER
527 	u_int32_t                                       necp_stats_bufreq_size;
528 	union {
529 		void                                    *necp_stats_bufreq_addr;
530 		mach_vm_address_t               necp_stats_bufreq_uaddr;
531 	};
532 };
533 
534 #define NECP_CLIENT_STATISTICS_BUFREQ_ID                                0xbf    // Distinguishes from statistics actions taking a necp_all_stats struct
535 
536 // There is a limit to the number of statistics structures that may be allocated per process, subject to change
537 //
538 #define NECP_MAX_PER_PROCESS_CLIENT_STATISTICS_STRUCTS  512
539 
540 #define NECP_TCP_ECN_HEURISTICS_SYN_RST 1
541 typedef struct necp_tcp_ecn_cache {
542 	u_int8_t                necp_tcp_ecn_heuristics_success:1;
543 	u_int8_t                necp_tcp_ecn_heuristics_loss:1;
544 	u_int8_t                necp_tcp_ecn_heuristics_drop_rst:1;
545 	u_int8_t                necp_tcp_ecn_heuristics_drop_rxmt:1;
546 	u_int8_t                necp_tcp_ecn_heuristics_aggressive:1;
547 	u_int8_t                necp_tcp_ecn_heuristics_syn_rst:1;
548 } necp_tcp_ecn_cache;
549 
550 #define NECP_TCP_TFO_HEURISTICS_RST 1
551 typedef struct necp_tcp_tfo_cache {
552 	u_int8_t                necp_tcp_tfo_cookie[NECP_TFO_COOKIE_LEN_MAX];
553 	u_int8_t                necp_tcp_tfo_cookie_len;
554 	u_int8_t                necp_tcp_tfo_heuristics_success:1; // TFO succeeded with data in the SYN
555 	u_int8_t                necp_tcp_tfo_heuristics_loss:1; // TFO SYN-loss with data
556 	u_int8_t                necp_tcp_tfo_heuristics_middlebox:1; // TFO middlebox detected
557 	u_int8_t                necp_tcp_tfo_heuristics_success_req:1; // TFO succeeded with the TFO-option in the SYN
558 	u_int8_t                necp_tcp_tfo_heuristics_loss_req:1; // TFO SYN-loss with the TFO-option
559 	u_int8_t                necp_tcp_tfo_heuristics_rst_data:1; // Recevied RST upon SYN with data in the SYN
560 	u_int8_t                necp_tcp_tfo_heuristics_rst_req:1; // Received RST upon SYN with the TFO-option
561 } necp_tcp_tfo_cache;
562 
563 #define NECP_CLIENT_CACHE_TYPE_ECN                 1       // Identifies use of necp_tcp_ecn_cache
564 #define NECP_CLIENT_CACHE_TYPE_TFO                 2       // Identifies use of necp_tcp_tfo_cache
565 
566 #define NECP_CLIENT_CACHE_TYPE_ECN_VER_1           1       // Currently supported version for ECN
567 #define NECP_CLIENT_CACHE_TYPE_TFO_VER_1           1       // Currently supported version for TFO
568 
569 typedef struct necp_cache_buffer {
570 	u_int8_t                necp_cache_buf_type;    //  NECP_CLIENT_CACHE_TYPE_*
571 	u_int8_t                necp_cache_buf_ver;     //  NECP_CLIENT_CACHE_TYPE_*_VER
572 	u_int32_t               necp_cache_buf_size;
573 	mach_vm_address_t       necp_cache_buf_addr;
574 } necp_cache_buffer;
575 
576 /*
577  * NECP Client definitions
578  */
579 #define NECP_MAX_CLIENT_PARAMETERS_SIZE                                 1024
580 #define NECP_MAX_CLIENT_RESULT_SIZE                                     512 // Legacy
581 #define NECP_BASE_CLIENT_RESULT_SIZE                                    1024
582 #define NECP_CLIENT_FLOW_RESULT_SIZE                                    512
583 
584 #define NECP_OPEN_FLAG_OBSERVER                                                 0x01 // Observers can query clients they don't own
585 #define NECP_OPEN_FLAG_BACKGROUND                                               0x02 // Mark this fd as backgrounded
586 #define NECP_OPEN_FLAG_PUSH_OBSERVER                                    0x04 // When used with the OBSERVER flag, allows updates to be pushed. Adding clients is not allowed in this mode.
587 
588 #define NECP_FD_SUPPORTS_GUARD                                                  1
589 
590 #define NECP_CLIENT_ACTION_ADD                                                  1 // Register a new client. Input: parameters in buffer; Output: client_id
591 #define NECP_CLIENT_ACTION_REMOVE                                               2 // Unregister a client. Input: client_id, optional struct ifnet_stats_per_flow
592 #define NECP_CLIENT_ACTION_COPY_PARAMETERS                              3 // Copy client parameters. Input: client_id; Output: parameters in buffer
593 #define NECP_CLIENT_ACTION_COPY_RESULT                                  4 // Copy client result. Input: client_id; Output: result in buffer
594 #define NECP_CLIENT_ACTION_COPY_LIST                                    5 // Copy all client IDs. Output: struct necp_client_list in buffer
595 #define NECP_CLIENT_ACTION_REQUEST_NEXUS_INSTANCE               6 // Request a nexus instance from a nexus provider, optional struct necp_stats_bufreq
596 #define NECP_CLIENT_ACTION_AGENT                                                7 // Interact with agent. Input: client_id, agent parameters
597 #define NECP_CLIENT_ACTION_COPY_AGENT                                   8 // Copy agent content. Input: agent UUID; Output: struct netagent
598 #define NECP_CLIENT_ACTION_COPY_INTERFACE                               9 // Copy interface details. Input: ifindex cast to UUID; Output: struct necp_interface_details
599 #define NECP_CLIENT_ACTION_SET_STATISTICS                               10 // Deprecated
600 #define NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS                11 // Get route statistics. Input: client_id; Output: struct necp_stat_counts
601 #define NECP_CLIENT_ACTION_AGENT_USE                                    12 // Return the use count and increment the use count. Input/Output: struct necp_agent_use_parameters
602 #define NECP_CLIENT_ACTION_MAP_SYSCTLS                                  13 // Get the read-only sysctls memory location. Output: mach_vm_address_t
603 #define NECP_CLIENT_ACTION_UPDATE_CACHE                                 14 // Update heuristics and cache
604 #define NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE                   15 // Fetch an updated client for push-mode observer. Output: Client id, struct necp_client_observer_update in buffer
605 #define NECP_CLIENT_ACTION_COPY_UPDATED_RESULT                  16 // Copy client result only if changed. Input: client_id; Output: result in buffer
606 #define NECP_CLIENT_ACTION_ADD_FLOW                                             17 // Add a flow. Input: client_id; Output: struct necp_client_add_flow
607 #define NECP_CLIENT_ACTION_REMOVE_FLOW                                  18 // Remove a flow. Input: flow_id, optional struct ifnet_stats_per_flow
608 #define NECP_CLIENT_ACTION_CLAIM                                       19 // Claim a client that has been added for this unique PID. Input: client_id
609 #define NECP_CLIENT_ACTION_SIGN                                       20 // Sign a query answer. Input: struct necp_client_signable; Output: struct necp_client_signature
610 #define NECP_CLIENT_ACTION_GET_INTERFACE_ADDRESS                       21 // Get the best interface local address for given remote address. Input: ifindex, remote sockaddr; Output: matching local sockaddr
611 #define NECP_CLIENT_ACTION_ACQUIRE_AGENT_TOKEN                         22 // Get a one-time use token from an agent. Input: agent UUID; Output: token buffer
612 #define NECP_CLIENT_ACTION_VALIDATE                                    23 // Validate a query answer. Input: struct necp_client_validatable; Output: None
613 #define NECP_CLIENT_ACTION_GET_SIGNED_CLIENT_ID                        24 // Get a client ID for the appliction along with a signature.
614 #define NECP_CLIENT_ACTION_SET_SIGNED_CLIENT_ID                        25 // Set a client ID for the appliction along with a signature.
615 #define NECP_CLIENT_ACTION_COPY_UPDATED_RESULT_FINAL                   26 // Copy client result only if changed, discard data if buffer is too small. Input: client_id; Output: result in buffer
616 
617 #define NECP_CLIENT_PARAMETER_APPLICATION                               NECP_POLICY_CONDITION_APPLICATION               // Requires entitlement
618 #define NECP_CLIENT_PARAMETER_REAL_APPLICATION                  NECP_POLICY_CONDITION_REAL_APPLICATION  // Requires entitlement
619 #define NECP_CLIENT_PARAMETER_DOMAIN                                    NECP_POLICY_CONDITION_DOMAIN
620 #define NECP_CLIENT_PARAMETER_DOMAIN_OWNER                              NECP_POLICY_CONDITION_DOMAIN_OWNER
621 #define NECP_CLIENT_PARAMETER_DOMAIN_CONTEXT                            NECP_POLICY_CONDITION_DOMAIN_CONTEXT
622 #define NECP_CLIENT_PARAMETER_TRACKER_DOMAIN                            NECP_POLICY_CONDITION_TRACKER_DOMAIN
623 #define NECP_CLIENT_PARAMETER_URL                                       NECP_POLICY_CONDITION_URL
624 #define NECP_CLIENT_PARAMETER_ATTRIBUTED_BUNDLE_IDENTIFIER              NECP_POLICY_CONDITION_ATTRIBUTED_BUNDLE_IDENTIFIER
625 #define NECP_CLIENT_PARAMETER_ACCOUNT                                   NECP_POLICY_CONDITION_ACCOUNT
626 #define NECP_CLIENT_PARAMETER_PID                                               NECP_POLICY_CONDITION_PID                               // Requires entitlement
627 #define NECP_CLIENT_PARAMETER_UID                                               NECP_POLICY_CONDITION_UID                               // Requires entitlement
628 #define NECP_CLIENT_PARAMETER_BOUND_INTERFACE                   NECP_POLICY_CONDITION_BOUND_INTERFACE
629 #define NECP_CLIENT_PARAMETER_TRAFFIC_CLASS                             NECP_POLICY_CONDITION_TRAFFIC_CLASS
630 #define NECP_CLIENT_PARAMETER_IP_PROTOCOL                               NECP_POLICY_CONDITION_IP_PROTOCOL
631 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS                             NECP_POLICY_CONDITION_LOCAL_ADDR
632 #define NECP_CLIENT_PARAMETER_REMOTE_ADDRESS                    NECP_POLICY_CONDITION_REMOTE_ADDR
633 #define NECP_CLIENT_PARAMETER_SCHEME_PORT                                               NECP_POLICY_CONDITION_SCHEME_PORT
634 #define NECP_CLIENT_PARAMETER_APPLICATION_ID                            NECP_POLICY_CONDITION_APPLICATION_ID
635 #define NECP_CLIENT_PARAMETER_NEXUS_KEY                                 102
636 
637 // "Prohibit" will never choose an interface with that property
638 #define NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE                100             // String, interface name
639 #define NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE                  101             // u_int8_t, see ifru_functional_type in <net/if.h>
640 #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT                    102             // uuid_t, network agent UUID
641 #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE               103             // struct necp_client_parameter_netagent_type
642 
643 // "Require" will choose an interface with that property, or none if not found
644 #define NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE                   111             // u_int8_t, see ifru_functional_type in <net/if.h>
645 #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT                             112             // uuid_t, network agent UUID
646 #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE                113             // struct necp_client_parameter_netagent_type
647 
648 // "Prefer" will choose an interface with an agent, or best otherwise if not found
649 #define NECP_CLIENT_PARAMETER_PREFER_AGENT                              122             // uuid_t, network agent UUID
650 #define NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE                 123             // struct necp_client_parameter_netagent_type
651 
652 // "Avoid" will choose an interface without an agent, or best otherwise if unavoidable
653 #define NECP_CLIENT_PARAMETER_AVOID_AGENT                               124             // uuid_t, network agent UUID
654 #define NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE                  125             // struct necp_client_parameter_netagent_type
655 
656 // Use actions with NECP_CLIENT_ACTION_AGENT
657 #define NECP_CLIENT_PARAMETER_TRIGGER_AGENT                             130             // uuid_t, network agent UUID
658 #define NECP_CLIENT_PARAMETER_ASSERT_AGENT                              131             // uuid_t, network agent UUID
659 #define NECP_CLIENT_PARAMETER_UNASSERT_AGENT                    132             // uuid_t, network agent UUID
660 #define NECP_CLIENT_PARAMETER_AGENT_ADD_GROUP_MEMBERS                    133             // struct necp_client_group_action
661 #define NECP_CLIENT_PARAMETER_AGENT_REMOVE_GROUP_MEMBERS                    134             // struct necp_client_group_action
662 #define NECP_CLIENT_PARAMETER_REPORT_AGENT_ERROR                    135             // int32_t
663 
664 #define NECP_CLIENT_PARAMETER_FALLBACK_MODE                     140             // u_int8_t, see SO_FALLBACK_MODE_* values
665 
666 #define NECP_CLIENT_PARAMETER_PARENT_ID                                                 150 // uuid_t, client UUID
667 
668 #define NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT                    200             // struct necp_client_endpoint
669 #define NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT                   201             // struct necp_client_endpoint
670 #define NECP_CLIENT_PARAMETER_BROWSE_DESCRIPTOR                  202             // struct necp_client_endpoint
671 #define NECP_CLIENT_PARAMETER_RESOLVER_TAG                      203                             // struct necp_client_validatable
672 #define NECP_CLIENT_PARAMETER_ADVERTISE_DESCRIPTOR                  204             // struct necp_client_endpoint
673 #define NECP_CLIENT_PARAMETER_GROUP_DESCRIPTOR                  205             // struct necp_client_group
674 
675 #define NECP_CLIENT_PARAMETER_DELEGATED_UPID                              210 // u_int64_t, requires entitlement
676 
677 #define NECP_CLIENT_PARAMETER_ETHERTYPE                              220 // u_int16_t, ethertype
678 #define NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL                        221 // u_int8_t, IPPROTO_
679 
680 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE                        230 // u_int8_t, NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_
681 
682 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_DEFAULT                    0
683 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_TEMPORARY                    1
684 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_STABLE                    2
685 
686 #define NECP_CLIENT_PARAMETER_PERSONA_ID                                        231 // Used to send persona to agents
687 
688 #define NECP_CLIENT_PARAMETER_FLAGS                                             250             // u_int32_t, see NECP_CLIENT_PAREMETER_FLAG_* values
689 #define NECP_CLIENT_PARAMETER_FLOW_DEMUX_PATTERN                                251 // struct necp_demux_pattern
690 
691 #define NECP_CLIENT_PARAMETER_FLAG_MULTIPATH                    0x0001  // Get multipath interface results
692 #define NECP_CLIENT_PARAMETER_FLAG_BROWSE                               0x0002  // Agent assertions on nexuses are requests to browse
693 #define NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE   0x0004  // Prohibit expensive interfaces
694 #define NECP_CLIENT_PARAMETER_FLAG_LISTENER                             0x0008  // Client is interested in listening for inbound connections
695 #define NECP_CLIENT_PARAMETER_FLAG_DISCRETIONARY                0x0010  // Client's traffic is discretionary, and eligible for early defuncting
696 #define NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE                   0x0020  // Client is requesting to enable ECN
697 #define NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE                  0x0040  // Client is requesting to disable ECN
698 #define NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE                   0x0080  // Client is requesting to enable TFO
699 #define NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE   0x0100    // Interpret NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE only for primary interface, and allow exceptions for multipath or listeners
700 #define NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER                 0x0200  // Client expects to open a custom ethernet channel
701 #define NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP                    0x0400  // Client expects to open a custom IP protocol channel
702 #define NECP_CLIENT_PARAMETER_FLAG_INTERPOSE                    0x0800  // Client expects to open an interpose filter channel
703 #define NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED       0x1000  // Prohibit constrained interfaces
704 #define NECP_CLIENT_PARAMETER_FLAG_FALLBACK_TRAFFIC           0x2000  // Fallback traffic
705 #define NECP_CLIENT_PARAMETER_FLAG_INBOUND                    0x4000  // Flow is inbound (passive)
706 #define NECP_CLIENT_PARAMETER_FLAG_SYSTEM_PROXY               0x8000  // Flow is a system proxy
707 #define NECP_CLIENT_PARAMETER_FLAG_KNOWN_TRACKER              0x10000  // Flow is contacting a known tracker
708 #define NECP_CLIENT_PARAMETER_FLAG_UNSAFE_SOCKET_ACCESS       0x20000  // Client allows direct access to sockets
709 #define NECP_CLIENT_PARAMETER_FLAG_NON_APP_INITIATED          0x40000  // Networking activities not initiated by application
710 #define NECP_CLIENT_PARAMETER_FLAG_THIRD_PARTY_WEB_CONTENT    0x80000  // Third-party web content, not main load
711 #define NECP_CLIENT_PARAMETER_FLAG_SILENT                    0x100000  // Private browsing - do not log/track
712 #define NECP_CLIENT_PARAMETER_FLAG_APPROVED_APP_DOMAIN       0x200000  // Approved associated app domain; domain is "owned" by app
713 #define NECP_CLIENT_PARAMETER_FLAG_NO_WAKE_FROM_SLEEP        0x400000  // Don't wake from sleep on traffic for this client
714 #define NECP_CLIENT_PARAMETER_FLAG_REUSE_LOCAL               0x800000  // Request support for local address/port reuse
715 #define NECP_CLIENT_PARAMETER_FLAG_ENHANCED_PRIVACY         0x1000000  // Attempt protocol upgrade or proxy usage for more privacy
716 #define NECP_CLIENT_PARAMETER_FLAG_WEB_SEARCH_CONTENT       0x2000000  // Web search traffic
717 #define NECP_CLIENT_PARAMETER_FLAG_ALLOW_ULTRA_CONSTRAINED  0x4000000  // Allow ultra-constrained interfaces
718 #define NECP_CLIENT_PARAMETER_FLAG_HAS_ACCOUNT_ID           0x8000000  // Client has provided an account identifier
719 
720 #define NECP_CLIENT_RESULT_CLIENT_ID                                    1               // uuid_t
721 #define NECP_CLIENT_RESULT_POLICY_RESULT                                2               // u_int32_t
722 #define NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER              3               // u_int32_t
723 #define NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT                  4               // u_int32_t
724 #define NECP_CLIENT_RESULT_INTERFACE_INDEX                              5               // u_int32_t
725 #define NECP_CLIENT_RESULT_NETAGENT                                             6               // struct necp_client_result_netagent
726 #define NECP_CLIENT_RESULT_FLAGS                                                7               // u_int32_t, see NECP_CLIENT_RESULT_FLAG_* values
727 #define NECP_CLIENT_RESULT_INTERFACE                                    8               // struct necp_client_result_interface
728 #define NECP_CLIENT_RESULT_INTERFACE_OPTION                             9               // struct necp_client_interface_option
729 #define NECP_CLIENT_RESULT_EFFECTIVE_MTU                                10              // u_int32_t
730 #define NECP_CLIENT_RESULT_FLOW                                                 11              // TLV array of a single flow's state
731 #define NECP_CLIENT_RESULT_PROTO_CTL_EVENT                              12
732 #define NECP_CLIENT_RESULT_TFO_COOKIE                                   13              // NECP_TFO_COOKIE_LEN_MAX
733 #define NECP_CLIENT_RESULT_TFO_FLAGS                                    14              // u_int8_t
734 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS                              15              // u_int8_t
735 #define NECP_CLIENT_RESULT_FLOW_ID                                              16              // uuid_t
736 #define NECP_CLIENT_RESULT_INTERFACE_TIME_DELTA                 17              // u_int32_t, seconds since interface up/down
737 #define NECP_CLIENT_RESULT_REASON                                               18              // u_int32_t, see NECP_CLIENT_RESULT_REASON_* values
738 #define NECP_CLIENT_RESULT_FLOW_DIVERT_AGGREGATE_UNIT                   19              // u_int32_t
739 #define NECP_CLIENT_RESULT_REQUEST_IN_PROCESS_FLOW_DIVERT               20              // Empty
740 
741 #define NECP_CLIENT_RESULT_NEXUS_INSTANCE                               100             // uuid_t
742 #define NECP_CLIENT_RESULT_NEXUS_PORT                                   101             // nexus_port_t
743 #define NECP_CLIENT_RESULT_NEXUS_KEY                                    102             // uuid_t
744 #define NECP_CLIENT_RESULT_NEXUS_PORT_FLOW_INDEX                103             // u_int32_t
745 #define NECP_CLIENT_RESULT_NEXUS_FLOW_STATS                             104             // struct sk_stats_flow *
746 
747 #define NECP_CLIENT_RESULT_LOCAL_ENDPOINT                               200             // struct necp_client_endpoint
748 #define NECP_CLIENT_RESULT_REMOTE_ENDPOINT                              201             // struct necp_client_endpoint
749 #define NECP_CLIENT_RESULT_DISCOVERED_ENDPOINT                  202             // struct necp_client_endpoint, result of browse
750 #define NECP_CLIENT_RESULT_RESOLVED_ENDPOINT                  203             // struct necp_client_endpoint, result of resolve
751 #define NECP_CLIENT_RESULT_LOCAL_ETHER_ADDR                                     204                     // struct ether_addr
752 #define NECP_CLIENT_RESULT_REMOTE_ETHER_ADDR                                    205                     // struct ether_addr
753 #define NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS              210             // u_int32_t
754 #define NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG                              211             // u_int32_t, 1: background, 0: not background
755 #define NECP_CLIENT_RESULT_GATEWAY                                      212             // struct necp_client_endpoint
756 #define NECP_CLIENT_RESULT_GROUP_MEMBER                                      213             // struct necp_client_endpoint
757 #define NECP_CLIENT_RESULT_NAT64                                        214             // struct ipv6_prefix[NAT64_MAX_NUM_PREFIXES]
758 #define NECP_CLIENT_RESULT_ESTIMATED_THROUGHPUT                         215             // struct necp_client_result_estimated_throughput
759 #define NECP_CLIENT_RESULT_AGENT_ERROR                                  216             // struct necp_client_result_agent_error
760 
761 #define NECP_CLIENT_RESULT_FLAG_IS_LOCAL                                0x0001  // Routes to this device
762 #define NECP_CLIENT_RESULT_FLAG_IS_DIRECT                               0x0002  // Routes to directly accessible peer
763 #define NECP_CLIENT_RESULT_FLAG_HAS_IPV4                                0x0004  // Supports IPv4
764 #define NECP_CLIENT_RESULT_FLAG_HAS_IPV6                                0x0008  // Supports IPv6
765 #define NECP_CLIENT_RESULT_FLAG_DEFUNCT                                 0x0010  // Defunct
766 #define NECP_CLIENT_RESULT_FLAG_SATISFIED                               0x0020  // Satisfied path
767 #define NECP_CLIENT_RESULT_FLAG_FLOW_ASSIGNED                   0x0040  // Assigned, the flow is active
768 #define NECP_CLIENT_RESULT_FLAG_FLOW_VIABLE                             0x0080  // Viable, the flow has a valid route
769 #define NECP_CLIENT_RESULT_FLAG_PROBE_CONNECTIVITY              0x0100  // Flow should probe connectivity
770 #define NECP_CLIENT_RESULT_FLAG_ECN_ENABLED                             0x0200  // ECN should be used
771 #define NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED               0x0400  // Fast open should not be used
772 #define NECP_CLIENT_RESULT_FLAG_LINK_QUALITY_ABORT              0x0800  // Link quality is very bad, recommend close connections
773 #define NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING               0x1000  // QoS marking is allowed
774 #define NECP_CLIENT_RESULT_FLAG_HAS_NAT64                       0x2000  // Has NAT64 prefix
775 #define NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER             0x4000  // Interface is in low-power mode
776 #define NECP_CLIENT_RESULT_FLAG_SPECIFIC_LISTENER               0x8000  // Listener should not listen on all interfaces
777 #define NECP_CLIENT_RESULT_FLAG_KEXT_FILTER_PRESENT             0x10000 // Kernel extension filter present
778 #define NECP_CLIENT_RESULT_FLAG_PF_RULES_PRESENT                0x20000 // Firewall rules present
779 #define NECP_CLIENT_RESULT_FLAG_ALF_PRESENT                     0x40000 // Application Firewall enabled
780 #define NECP_CLIENT_RESULT_FLAG_PARENTAL_CONTROLS_PRESENT       0x80000 // Parental Controls present
781 #define NECP_CLIENT_RESULT_FLAG_IS_GLOBAL_INTERNET              0x100000 // Routes to global Internet
782 
783 
784 #define NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE (NECP_CLIENT_RESULT_FLAG_HAS_IPV4 | NECP_CLIENT_RESULT_FLAG_HAS_IPV6 | NECP_CLIENT_RESULT_FLAG_HAS_NAT64 | NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER)
785 
786 #define NECP_CLIENT_RESULT_FAST_OPEN_SND_PROBE                  0x01    // DEPRECATED - Fast open send probe
787 #define NECP_CLIENT_RESULT_FAST_OPEN_RCV_PROBE                  0x02    // DEPRECATED - Fast open receive probe
788 
789 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_NONE                 0x01
790 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_LOW                  0x02
791 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_MEDIUM               0x04
792 
793 #define NECP_CLIENT_RESULT_REASON_EXPENSIVE_PROHIBITED          1  // Expensive networks were prohibited
794 #define NECP_CLIENT_RESULT_REASON_CONSTRAINED_PROHIBITED                2  // Constrained networks were prohibited
795 #define NECP_CLIENT_RESULT_REASON_CELLULAR_DENIED                3  // Denied by a cellular route rule
796 #define NECP_CLIENT_RESULT_REASON_WIFI_DENIED                4  // Denied by a wifi route rule
797 #define NECP_CLIENT_RESULT_REASON_LOCAL_NETWORK_PROHIBITED       5  // Local network access prohibited
798 #define NECP_CLIENT_RESULT_REASON_ULTRA_CONSTRAINED_NOT_ALLOWED  6  // Ultra constrained networks not allowed
799 
800 struct necp_interface_signature {
801 	u_int8_t signature[IFNET_SIGNATURELEN];
802 	u_int8_t signature_len;
803 };
804 
805 struct necp_interface_details {
806 	char name[IFXNAMSIZ];
807 	u_int32_t index;
808 	u_int32_t generation;
809 	u_int32_t functional_type;
810 	u_int32_t delegate_index;
811 	u_int32_t flags; // see NECP_INTERFACE_FLAG_*
812 	u_int32_t mtu;
813 	struct necp_interface_signature ipv4_signature;
814 	struct necp_interface_signature ipv6_signature;
815 	u_int32_t ipv4_netmask;
816 	u_int32_t ipv4_broadcast;
817 	/*
818 	 * This serves as a temporary header guard to protect libnetcore builds
819 	 * until the xnu changes are available in the build.
820 	 * XXX: Should be removed in a future build.
821 	 */
822 #define NECP_INTERFACE_SUPPORTS_TSO    1
823 	u_int32_t tso_max_segment_size_v4;
824 	u_int32_t tso_max_segment_size_v6;
825 #define NECP_INTERFACE_SUPPORTS_HWCSUM   1
826 	u_int32_t hwcsum_flags;
827 	u_int8_t  radio_type;
828 	u_int8_t  radio_channel;
829 };
830 
831 #define NECP_INTERFACE_FLAG_EXPENSIVE                                   0x0001
832 #define NECP_INTERFACE_FLAG_TXSTART                                     0X0002
833 #define NECP_INTERFACE_FLAG_NOACKPRI                                    0x0004
834 #define NECP_INTERFACE_FLAG_3CARRIERAGG                                 0x0008
835 #define NECP_INTERFACE_FLAG_IS_LOW_POWER                                0x0010
836 #define NECP_INTERFACE_FLAG_MPK_LOG                                     0x0020 // Multi-layer Packet Logging
837 #define NECP_INTERFACE_FLAG_CONSTRAINED                                 0x0040
838 #define NECP_INTERFACE_FLAG_HAS_NETMASK                                 0x0080
839 #define NECP_INTERFACE_FLAG_HAS_BROADCAST                               0x0100
840 #define NECP_INTERFACE_FLAG_SUPPORTS_MULTICAST                          0x0200
841 #define NECP_INTERFACE_FLAG_HAS_DNS                                     0x0400
842 #define NECP_INTERFACE_FLAG_HAS_NAT64                                   0x0800
843 #define NECP_INTERFACE_FLAG_IPV4_ROUTABLE                               0x1000
844 #define NECP_INTERFACE_FLAG_IPV6_ROUTABLE                               0x2000
845 #define NECP_INTERFACE_FLAG_ULTRA_CONSTRAINED                           0x4000
846 
847 struct necp_client_parameter_netagent_type {
848 	char netagent_domain[32];
849 	char netagent_type[32];
850 };
851 
852 struct necp_client_result_netagent {
853 	u_int32_t generation;
854 	uuid_t netagent_uuid;
855 };
856 
857 struct necp_client_result_interface {
858 	u_int32_t generation;
859 	u_int32_t index;
860 };
861 
862 struct necp_client_result_estimated_throughput {
863 	u_int8_t up;
864 	u_int8_t down;
865 };
866 
867 struct necp_client_result_agent_error {
868 	u_int32_t code;
869 	u_int8_t domain;
870 };
871 
872 #define NECP_USES_INTERFACE_OPTIONS_FOR_BROWSE 1
873 
874 struct necp_client_interface_option {
875 	u_int32_t interface_index;
876 	u_int32_t interface_generation;
877 	uuid_t nexus_agent;
878 };
879 
880 #define NECP_CLIENT_ENDPOINT_TYPE_APPLICATION_SERVICE 6
881 
882 struct necp_client_endpoint {
883 	union {
884 		struct sockaddr sa;
885 		struct sockaddr_in sin;
886 		struct sockaddr_in6 sin6;
887 		struct {
888 			u_int8_t endpoint_length;
889 			u_int8_t endpoint_family; // Use AF_UNSPEC to target a name
890 			u_int16_t endpoint_port;
891 			u_int32_t endpoint_type; // Client-specific type
892 			char endpoint_data[0]; // Type-specific endpoint value
893 		} endpoint;
894 	} u;
895 };
896 
897 struct necp_client_group {
898 	u_int32_t group_type;
899 	uuid_t group_id;
900 };
901 
902 struct necp_client_list {
903 	u_int32_t client_count;
904 	uuid_t clients[0];
905 };
906 
907 struct kev_necp_policies_changed_data {
908 	u_int32_t               changed_count;  // Defaults to 0.
909 };
910 
911 #define NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS                      0x01    // Request a nexus instance upon adding a flow
912 #define NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID            0x02    // Register the client ID rather than the flow registration ID with network agents
913 #define NECP_CLIENT_FLOW_FLAGS_BROWSE                      0x04    // Create request with a browse agent
914 #define NECP_CLIENT_FLOW_FLAGS_RESOLVE                      0x08    // Create request with a resolution agent
915 #define NECP_CLIENT_FLOW_FLAGS_OVERRIDE_ADDRESS                      0x10    // Flow has a different remote address than the parent flow
916 #define NECP_CLIENT_FLOW_FLAGS_OVERRIDE_IP_PROTOCOL           0x20    // Flow has a different IP protocol than the parent flow
917 
918 struct necp_client_flow_stats {
919 	u_int32_t stats_type; // NECP_CLIENT_STATISTICS_TYPE_*
920 	u_int32_t stats_version; // NECP_CLIENT_STATISTICS_TYPE_*_VER
921 	u_int32_t stats_size;
922 	mach_vm_address_t stats_addr;
923 };
924 
925 struct necp_client_add_flow {
926 	uuid_t agent_uuid;
927 	uuid_t registration_id;
928 	u_int16_t flags; // NECP_CLIENT_FLOW_FLAGS_*
929 	u_int16_t stats_request_count;
930 	struct necp_client_flow_stats stats_requests[0];
931 	// sockaddr for override endpoint
932 	// uint8 for override ip protocol
933 } __attribute__((__packed__));
934 
935 struct necp_agent_use_parameters {
936 	uuid_t agent_uuid;
937 	uint64_t out_use_count;
938 };
939 
940 struct necp_client_group_action {
941 	uuid_t agent_uuid;
942 	u_int16_t group_member_count;
943 	struct necp_client_endpoint group_members[0];
944 } __attribute__((__packed__));
945 
946 struct necp_client_flow_protoctl_event {
947 	uint32_t        protoctl_event_code;
948 	uint32_t        protoctl_event_val;
949 	/* TCP seq number is in host byte order */
950 	uint32_t        protoctl_event_tcp_seq_num;
951 };
952 
953 #define NECP_CLIENT_UPDATE_TYPE_PARAMETERS              1       // Parameters, for a new client
954 #define NECP_CLIENT_UPDATE_TYPE_RESULT                  2       // Result, for a udpated client
955 #define NECP_CLIENT_UPDATE_TYPE_REMOVE                  3       // Empty, for a removed client
956 
957 struct necp_client_observer_update {
958 	u_int32_t update_type;  // NECP_CLIENT_UPDATE_TYPE_*
959 	u_int8_t tlv_buffer[0]; // Parameters or result as TLVs, based on type
960 };
961 
962 // These sign types are tied to specific clients.
963 // The client_id UUID is then the NECP client UUID that generated the query.
964 #define NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER                   1       // struct necp_client_host_resolver_answer
965 #define NECP_CLIENT_SIGN_TYPE_BROWSE_RESULT                     2       // struct necp_client_browse_result
966 #define NECP_CLIENT_SIGN_TYPE_SERVICE_RESOLVER_ANSWER           3       // struct necp_client_service_resolver_answer
967 
968 // These sign types are valid for system-wide use.
969 // The client_id UUID is a unique per-query UUID.
970 // These should be generated only on behalf of trusted or entitled processes.
971 #define NECP_CLIENT_SIGN_TYPE_SYSTEM_RESOLVER_ANSWER            4       // struct necp_client_host_resolver_answer
972 #define NECP_CLIENT_SIGN_TYPE_SYSTEM_BROWSE_RESULT              5       // struct necp_client_browse_result
973 #define NECP_CLIENT_SIGN_TYPE_SYSTEM_SERVICE_RESOLVER_ANSWER    6       // struct necp_client_service_resolver_answer
974 
975 struct necp_client_signature {
976 	u_int8_t signed_tag[32];
977 } __attribute__((__packed__));
978 
979 //
980 struct necp_client_signable {
981 	uuid_t client_id; // Interpretation depends on sign_type
982 	u_int32_t sign_type;
983 	u_int8_t signable_data[0];
984 } __attribute__((__packed__));
985 
986 struct necp_client_resolver_answer {
987 	uuid_t client_id;
988 	u_int32_t sign_type;
989 	union sockaddr_in_4_6 address_answer; // Can include port
990 	u_int32_t hostname_length;
991 	char hostname[0];
992 } __attribute__((__packed__));
993 
994 struct necp_client_host_resolver_answer {
995 	struct necp_client_signable header;
996 	u_int32_t metadata_hash; // Extra metadata that can be signed along with the answer, such as a network signature.
997 	union sockaddr_in_4_6 address_answer; // Can include port
998 	u_int32_t hostname_length;
999 	char hostname[0];
1000 } __attribute__((__packed__));
1001 
1002 struct necp_client_browse_result {
1003 	struct necp_client_signable header;
1004 	u_int32_t metadata_hash; // Extra metadata that can be signed along with the service, which may include a TXT record or a network signature
1005 	u_int16_t service_length;
1006 	char service[0];
1007 } __attribute__((__packed__));
1008 
1009 struct necp_client_service_resolver_answer {
1010 	struct necp_client_signable header;
1011 	u_int32_t metadata_hash; // Extra metadata that can be signed along with the service, which may include a TXT record or a network signature
1012 	u_int16_t service_length;
1013 	u_int16_t port;
1014 	u_int16_t hostname_length;
1015 	char service[0];
1016 	char hostname[0];
1017 } __attribute__((__packed__));
1018 
1019 struct necp_client_validatable {
1020 	struct necp_client_signature signature;
1021 	struct necp_client_signable signable;
1022 } __attribute__((__packed__));
1023 
1024 #define NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH 1024
1025 
1026 #define NECP_CLIENT_ACTION_SIGN_TAG_LENGTH 32
1027 
1028 #define NECP_CLIENT_ACTION_SIGN_DEFAULT_DATA_LENGTH 128
1029 #define NECP_CLIENT_ACTION_SIGN_MAX_TOTAL_LENGTH 4096
1030 
1031 #define NECP_FILTER_UNIT_NO_FILTER              UINT32_MAX // Reserved filter unit value that prohibits all filters and socket filters
1032 
1033 // Type of signed client ID requests.
1034 #define NECP_CLIENT_SIGNED_CLIENT_ID_TYPE_UUID                   1       // struct necp_client_signed_client_id_uuid
1035 
1036 struct necp_client_signed_client_id_uuid {
1037 	uuid_t client_id;
1038 	u_int32_t signature_length;
1039 	u_int8_t signature_data[NECP_CLIENT_ACTION_SIGN_TAG_LENGTH];
1040 } __attribute__((__packed__));
1041 
1042 /*
1043  * The sysctl "net.necp.necp_drop_dest_level" controls the global drop rule policy for
1044  * a set of destinations addresses at the given level -- the drop rule is the last one
1045  * to be evaluated at this level.
1046  */
1047 #define MAX_NECP_DROP_DEST_LEVEL_ADDRS 8
1048 
1049 struct necp_drop_dest_entry {
1050 	u_int32_t                           level;          // priority level
1051 	u_int32_t                           order;          // session order (read only via sysctl)
1052 	struct necp_policy_condition_addr   cond_addr;
1053 };
1054 
1055 struct necp_drop_dest_policy {
1056 	u_int32_t entry_count;
1057 	struct necp_drop_dest_entry entries[MAX_NECP_DROP_DEST_LEVEL_ADDRS];
1058 };
1059 
1060 
1061 #define NECP_DEMUX_MAX_LEN  32
1062 struct necp_demux_pattern {
1063 	uint16_t offset;
1064 	uint16_t len;
1065 	uint8_t mask[NECP_DEMUX_MAX_LEN];
1066 	uint8_t value[NECP_DEMUX_MAX_LEN];
1067 };
1068 
1069 #ifdef BSD_KERNEL_PRIVATE
1070 #include <stdbool.h>
1071 #include <sys/socketvar.h>
1072 #include <sys/kern_control.h>
1073 #include <netinet/ip_var.h>
1074 #include <netinet6/ip6_var.h>
1075 #include <net/if_var.h>
1076 #include <sys/syslog.h>
1077 #include <net/network_agent.h>
1078 #include <net/ethernet.h>
1079 #include <os/log.h>
1080 #if SKYWALK
1081 #include <skywalk/namespace/netns.h>
1082 #endif /* SKYWALK */
1083 
1084 
1085 SYSCTL_DECL(_net_necp);
1086 
1087 extern os_log_t necp_log_handle;
1088 extern os_log_t necp_data_trace_log_handle;
1089 
1090 #define NECPLOG(level, format, ...) do {                                                                                        \
1091 	if (level == LOG_ERR) {                                                          \
1092 	    os_log_error(necp_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \
1093 	} else {                                                                         \
1094 	    os_log(necp_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__);       \
1095 	}                                                                                \
1096 } while (0)
1097 
1098 #define NECPLOG0(level, msg) do {                                                                                       \
1099 	if (level == LOG_ERR) {                                                          \
1100 	    os_log_error(necp_log_handle, "%s: %s\n", __FUNCTION__, msg);                 \
1101 	} else {                                                                         \
1102 	    os_log(necp_log_handle, "%s: %s\n", __FUNCTION__, msg);                       \
1103 	}                                                                                \
1104 } while (0)
1105 
1106 #define NECPDATATRACELOG(level, format, ...) do {                                                                                        \
1107     if (level == LOG_ERR) {                                                          \
1108 	os_log_error(necp_data_trace_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \
1109     } else {                                                                         \
1110 	os_log(necp_data_trace_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__);       \
1111     }                                                                                \
1112 } while (0)
1113 
1114 enum necp_fd_type_t {
1115 	necp_fd_type_invalid = 0,
1116 	necp_fd_type_session = 1,
1117 	necp_fd_type_client = 2,
1118 };
1119 
1120 union necp_sockaddr_union {
1121 	struct sockaddr                 sa;
1122 	struct sockaddr_in              sin;
1123 	struct sockaddr_in6             sin6;
1124 };
1125 
1126 /*
1127  * kstats
1128  * The ustats and kstats region are mirrored. So when we allocate with
1129  * skmem_cache from kstats region, we also get an ustats object. To tie them
1130  * together, kstats has an extra *necp_stats_ustats pointer pointing to the
1131  * ustats object
1132  */
1133 struct necp_all_kstats {
1134 	struct necp_all_stats           necp_stats_comm;        /* kernel private stats snapshot */
1135 	struct necp_all_stats           *necp_stats_ustats;     /* points to user-visible stats (in shared ustats region) */
1136 };
1137 
1138 extern void necp_client_init(void);
1139 extern int necp_application_find_policy_match_internal(proc_t proc, u_int8_t *parameters __sized_by(parameters_size), u_int32_t parameters_size,
1140     struct necp_aggregate_result *returned_result,
1141     u_int32_t *flags, u_int32_t *reason, u_int required_interface_index,
1142     const union necp_sockaddr_union *override_local_addr,
1143     const union necp_sockaddr_union *override_remote_addr,
1144     struct necp_client_endpoint *returned_v4_gateway,
1145     struct necp_client_endpoint *returned_v6_gateway,
1146     struct rtentry **returned_route, bool ignore_address,
1147     bool has_client,
1148     uuid_t *returned_override_euuid);
1149 /*
1150  * TLV utilities
1151  *
1152  * Note that these functions (other than necp_buffer_find_tlv) do not check the length of the entire buffer,
1153  * so the caller must be sure that the entire TLV is within bounds.
1154  */
1155 struct necp_tlv_header {
1156 	u_int8_t type;
1157 	u_int32_t length;
1158 } __attribute__((__packed__));
1159 
1160 extern u_int8_t * __counted_by(0) necp_buffer_write_tlv(u_int8_t * __counted_by(0)cursor_, u_int8_t type, u_int32_t length, const void *value __sized_by(length), u_int8_t * buffer __sized_by(buffer_length), u_int32_t buffer_length);
1161 extern u_int8_t * __counted_by(0) necp_buffer_write_tlv_if_different(u_int8_t * __counted_by(0)cursor_, u_int8_t type,
1162     u_int32_t length, const void *value __sized_by(length), bool *updated,
1163     u_int8_t * buffer __sized_by(buffer_length), u_int32_t buffer_length);
1164 extern u_int8_t necp_buffer_get_tlv_type(u_int8_t * __counted_by(buffer_length)buffer, size_t buffer_length, u_int32_t tlv_offset);
1165 extern u_int32_t necp_buffer_get_tlv_length(u_int8_t * __counted_by(buffer_length)buffer, size_t buffer_length, u_int32_t tlv_offset);
1166 extern u_int8_t *__sized_by(*value_size) __necp_buffer_get_tlv_value(u_int8_t * __counted_by(buffer_length)buffer, size_t buffer_length, u_int32_t tlv_offset, u_int32_t * value_size);
1167 extern int necp_buffer_find_tlv(u_int8_t * buffer __sized_by(buffer_length), u_int32_t buffer_length, int offset, u_int8_t type, int *err, int next);
1168 
1169 /*
1170  * Inline shim to safely convert the result of `__necp_buffer_get_tlv_value'
1171  * to an indexable pointer, when appropriate.
1172  */
1173 __attribute__((always_inline))
1174 static inline u_int8_t * __header_indexable
necp_buffer_get_tlv_value(u_int8_t * __counted_by (buffer_length)buffer,size_t buffer_length,u_int32_t tlv_offset,u_int32_t * value_size)1175 necp_buffer_get_tlv_value(u_int8_t * __counted_by(buffer_length)buffer, size_t buffer_length, u_int32_t tlv_offset, u_int32_t *value_size)
1176 {
1177 	u_int32_t ensured_value_size = 0;
1178 	u_int8_t *value = __necp_buffer_get_tlv_value(buffer, buffer_length, tlv_offset, &ensured_value_size);
1179 	if (value_size) {
1180 		*value_size = ensured_value_size;
1181 	}
1182 	return value;
1183 }
1184 
1185 #define NECPCTL_DROP_ALL_LEVEL                          1       /* Drop all packets if no policy matches above this level */
1186 #define NECPCTL_DEBUG                                           2       /* Log all kernel policy matches */
1187 #define NECPCTL_PASS_LOOPBACK                           3       /* Pass all loopback traffic */
1188 #define NECPCTL_PASS_KEEPALIVES                         4       /* Pass all kernel-generated keepalive traffic */
1189 #define NECPCTL_SOCKET_POLICY_COUNT                     5       /* Count of all socket-level policies */
1190 #define NECPCTL_SOCKET_NON_APP_POLICY_COUNT     6       /* Count of non-per-app socket-level policies */
1191 #define NECPCTL_IP_POLICY_COUNT                         7       /* Count of all ip-level policies */
1192 #define NECPCTL_SESSION_COUNT                           8       /* Count of NECP sessions */
1193 #define NECPCTL_CLIENT_FD_COUNT                         9       /* Count of NECP client fds */
1194 #define NECPCTL_CLIENT_COUNT                            10      /* Count of NECP clients */
1195 #define NECPCTL_ARENA_COUNT                                     11      /* Count of NECP arenas (stats, etc) */
1196 #define NECPCTL_NEXUS_FLOW_COUNT                        12      /* Count of NECP nexus flows */
1197 #define NECPCTL_SOCKET_FLOW_COUNT                       13      /* Count of NECP socket flows */
1198 #define NECPCTL_IF_FLOW_COUNT                           14      /* Count of NECP socket flows */
1199 #define NECPCTL_OBSERVER_FD_COUNT                       15      /* Count of NECP observer fds */
1200 #define NECPCTL_OBSERVER_MESSAGE_LIMIT          16      /* Number of of NECP observer messages allowed to be queued */
1201 #define NECPCTL_SYSCTL_ARENA_COUNT                      17      /* Count of sysctl arenas */
1202 #define NECPCTL_DROP_UNENTITLED_LEVEL                   18      /* Drop unentitled process traffic above this level */
1203 #define NECPCTL_PASS_INTERPOSE                          19      /* Pass interpose */
1204 #define NECPCTL_RESTRICT_MULTICAST                      20      /* Restrict multicast access */
1205 #define NECPCTL_DEDUP_POLICIES                          21      /* Dedup overlapping policies */
1206 #define NECPCTL_CLIENT_TRACING_LEVEL                    22      /* Client tracing level */
1207 #define NECPCTL_CLIENT_TRACING_PID                      23      /* Apply client tracing only to specified pid */
1208 #define NECPCTL_DROP_MANAGEMENT_LEVEL                   24      /* Drop management traffic at this level */
1209 
1210 #define NECP_LOOPBACK_PASS_ALL         1  // Pass all loopback traffic
1211 #define NECP_LOOPBACK_PASS_WITH_FILTER 2  // Pass all loopback traffic, but activate content filter and/or flow divert if applicable
1212 
1213 #define NECPCTL_NAMES {                                 \
1214 	{ 0, 0 },                                                       \
1215 	{ "drop_all_level", CTLTYPE_INT },      \
1216 	{ "debug", CTLTYPE_INT },                       \
1217 	{ "pass_loopback", CTLTYPE_INT },       \
1218     { "pass_keepalives", CTLTYPE_INT },     \
1219     { "pass_interpose", CTLTYPE_INT },      \
1220 }
1221 
1222 typedef u_int32_t necp_kernel_policy_id;
1223 #define NECP_KERNEL_POLICY_ID_NONE                      0
1224 #define NECP_KERNEL_POLICY_ID_NO_MATCH          1
1225 #define NECP_KERNEL_POLICY_ID_FIRST_VALID_SOCKET        2
1226 #define NECP_KERNEL_POLICY_ID_FIRST_VALID_IP            UINT16_MAX
1227 
1228 typedef u_int32_t necp_app_id;
1229 
1230 #define NECP_KERNEL_POLICY_RESULT_NONE                                  0
1231 #define NECP_KERNEL_POLICY_RESULT_PASS                                  NECP_POLICY_RESULT_PASS
1232 #define NECP_KERNEL_POLICY_RESULT_SKIP                                  NECP_POLICY_RESULT_SKIP
1233 #define NECP_KERNEL_POLICY_RESULT_DROP                                  NECP_POLICY_RESULT_DROP
1234 #define NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT                 NECP_POLICY_RESULT_SOCKET_DIVERT
1235 #define NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER                 NECP_POLICY_RESULT_SOCKET_FILTER
1236 #define NECP_KERNEL_POLICY_RESULT_IP_TUNNEL                             NECP_POLICY_RESULT_IP_TUNNEL
1237 #define NECP_KERNEL_POLICY_RESULT_IP_FILTER                             NECP_POLICY_RESULT_IP_FILTER
1238 #define NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED                 NECP_POLICY_RESULT_SOCKET_SCOPED
1239 #define NECP_KERNEL_POLICY_RESULT_ROUTE_RULES                   NECP_POLICY_RESULT_ROUTE_RULES
1240 #define NECP_KERNEL_POLICY_RESULT_USE_NETAGENT                  NECP_POLICY_RESULT_USE_NETAGENT
1241 #define NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED               NECP_POLICY_RESULT_NETAGENT_SCOPED
1242 #define NECP_KERNEL_POLICY_RESULT_SCOPED_DIRECT                 NECP_POLICY_RESULT_SCOPED_DIRECT
1243 #define NECP_KERNEL_POLICY_RESULT_ALLOW_UNENTITLED              NECP_POLICY_RESULT_ALLOW_UNENTITLED
1244 #define NECP_KERNEL_POLICY_RESULT_REMOVE_NETAGENT               NECP_POLICY_RESULT_REMOVE_NETAGENT
1245 
1246 #define NECP_KERNEL_POLICY_PASS_NO_SKIP_IPSEC                   NECP_POLICY_PASS_NO_SKIP_IPSEC
1247 #define NECP_KERNEL_POLICY_PASS_PF_TAG                          NECP_POLICY_PASS_PF_TAG
1248 
1249 #define NECP_KERNEL_POLICY_DROP_FLAG_LOCAL_NETWORK              NECP_POLICY_DROP_FLAG_LOCAL_NETWORK
1250 #define NECP_KERNEL_POLICY_DROP_FLAG_SUPPRESS_ALERTS            NECP_POLICY_DROP_FLAG_SUPPRESS_ALERTS
1251 
1252 typedef struct {
1253 	u_int32_t identifier;
1254 	u_int32_t data;
1255 } necp_kernel_policy_service;
1256 
1257 typedef union {
1258 	u_int                                           tunnel_interface_index;
1259 	u_int                                           scoped_interface_index;
1260 	u_int32_t                                       flow_divert_control_unit;
1261 	u_int32_t                                       filter_control_unit;
1262 	u_int32_t                                       skip_policy_order;
1263 	u_int32_t                                       route_rule_id;
1264 	u_int32_t                                       netagent_id;
1265 	u_int32_t                                       pass_flags;
1266 	u_int32_t                                       drop_flags;
1267 	necp_kernel_policy_service      service;
1268 } necp_kernel_policy_result_parameter;
1269 
1270 enum necp_boolean_state {
1271 	necp_boolean_state_unknown = 0,
1272 	necp_boolean_state_false = 1,
1273 	necp_boolean_state_true = 2,
1274 };
1275 
1276 struct necp_kernel_socket_policy {
1277 	LIST_ENTRY(necp_kernel_socket_policy)   chain;
1278 	necp_kernel_policy_id           id;
1279 	necp_policy_order                       order;
1280 	u_int32_t                                       session_order;
1281 	int                                                     session_pid;
1282 
1283 	u_int64_t                                       condition_mask;
1284 	u_int64_t                                       condition_negated_mask;
1285 	u_int32_t                                       cond_client_flags;
1286 	necp_kernel_policy_id           cond_policy_id;
1287 	u_int32_t                                       cond_app_id;                                    // Locally assigned ID value stored
1288 	u_int32_t                                       cond_real_app_id;                               // Locally assigned ID value stored
1289 	char                                            *cond_custom_entitlement __null_terminated;     // String
1290 	u_int32_t                                       cond_account_id;                                // Locally assigned ID value stored
1291 	char                                            *cond_domain __null_terminated;                 // String
1292 	u_int8_t                                        cond_domain_dot_count;                  // Number of dots in cond_domain
1293 	u_int32_t                                       cond_domain_filter;
1294 	pid_t                                           cond_pid;
1295 	uid_t                                           cond_uid;
1296 	uid_t                                           cond_real_uid;
1297 	ifnet_t                                         cond_bound_interface;                   // Matches specific binding only
1298 	struct necp_policy_condition_tc_range cond_traffic_class;       // Matches traffic class in range
1299 	u_int16_t                                       cond_protocol;                                  // Matches IP protcol number
1300 	union necp_sockaddr_union       cond_local_start;                               // Matches local IP address (or start)
1301 	union necp_sockaddr_union       cond_local_end;                                 // Matches IP address range
1302 	u_int8_t                                        cond_local_prefix;                              // Defines subnet
1303 	union necp_sockaddr_union       cond_remote_start;                              // Matches remote IP address (or start)
1304 	union necp_sockaddr_union       cond_remote_end;                                // Matches IP address range
1305 	u_int8_t                                        cond_remote_prefix;                             // Defines subnet
1306 	struct necp_policy_condition_agent_type cond_agent_type;
1307 	struct necp_policy_condition_sdk_version cond_sdk_version;
1308 	char                                            *cond_signing_identifier __null_terminated;   // String
1309 	char                                            *cond_url __null_terminated;// String
1310 	u_int16_t                                       cond_packet_filter_tags;
1311 	u_int16_t                                       cond_scheme_port;
1312 	int32_t                                         cond_pid_version;
1313 	u_int32_t                                       cond_bound_interface_flags;
1314 	u_int32_t                                       cond_bound_interface_eflags;
1315 	u_int32_t                                       cond_bound_interface_xflags;
1316 	u_int8_t                                        cond_local_networks_flags;
1317 
1318 	necp_kernel_policy_result       result;
1319 	necp_kernel_policy_result_parameter     result_parameter;
1320 };
1321 
1322 struct necp_kernel_ip_output_policy {
1323 	LIST_ENTRY(necp_kernel_ip_output_policy)        chain;
1324 	necp_kernel_policy_id           id;
1325 	necp_policy_order                       suborder;
1326 	necp_policy_order                       order;
1327 	u_int32_t                                       session_order;
1328 	int                                                     session_pid;
1329 
1330 	u_int64_t                                       condition_mask;
1331 	u_int64_t                                       condition_negated_mask;
1332 	necp_kernel_policy_id           cond_policy_id;
1333 	ifnet_t                                         cond_bound_interface;                   // Matches specific binding only
1334 	u_int16_t                                       cond_protocol;                                  // Matches IP protcol number
1335 	union necp_sockaddr_union       cond_local_start;                               // Matches local IP address (or start)
1336 	union necp_sockaddr_union       cond_local_end;                                 // Matches IP address range
1337 	u_int8_t                                        cond_local_prefix;                              // Defines subnet
1338 	union necp_sockaddr_union       cond_remote_start;                              // Matches remote IP address (or start)
1339 	union necp_sockaddr_union       cond_remote_end;                                // Matches IP address range
1340 	u_int8_t                                        cond_remote_prefix;                             // Defines subnet
1341 	u_int32_t                                       cond_last_interface_index;
1342 	u_int16_t                       cond_packet_filter_tags;
1343 	u_int16_t                       cond_scheme_port;
1344 	u_int32_t                                       cond_bound_interface_flags;
1345 	u_int32_t                                       cond_bound_interface_eflags;
1346 	u_int32_t                                       cond_bound_interface_xflags;
1347 	u_int8_t                                        cond_local_networks_flags;
1348 
1349 	necp_kernel_policy_result       result;
1350 	necp_kernel_policy_result_parameter     result_parameter;
1351 };
1352 
1353 #define MAX_KERNEL_SOCKET_POLICIES                      1
1354 #define MAX_KERNEL_IP_OUTPUT_POLICIES           4
1355 struct necp_session_policy {
1356 	LIST_ENTRY(necp_session_policy) chain;
1357 	bool                            applied;                        // Applied into the kernel table
1358 	bool                            pending_deletion;       // Waiting to be removed from kernel table
1359 	bool                            pending_update;         // Policy has been modified since creation/last application
1360 	necp_policy_id          local_id;
1361 	necp_policy_order       order;
1362 	u_int32_t                       result_size;
1363 	u_int8_t                        *result __sized_by(result_size);
1364 	u_int32_t                       conditions_size;
1365 	u_int8_t                        *conditions __sized_by(conditions_size); // Array of conditions, each with a u_int32_t length at start
1366 	u_int32_t                       route_rules_size;
1367 	u_int8_t                        *route_rules __sized_by(route_rules_size); // Array of route rules, each with a u_int32_t length at start
1368 
1369 	uuid_t                          applied_app_uuid;
1370 	uuid_t                          applied_real_app_uuid;
1371 	u_int32_t                       applied_account_size;
1372 	char                            *applied_account __sized_by(applied_account_size);
1373 
1374 	uuid_t                          applied_result_uuid;
1375 
1376 	u_int32_t                       applied_route_rules_id;
1377 
1378 	necp_kernel_policy_id   kernel_socket_policies[MAX_KERNEL_SOCKET_POLICIES];
1379 	necp_kernel_policy_id   kernel_ip_output_policies[MAX_KERNEL_IP_OUTPUT_POLICIES];
1380 };
1381 
1382 struct necp_aggregate_socket_result {
1383 	necp_kernel_policy_result                       result;
1384 	necp_kernel_policy_result_parameter     result_parameter;
1385 	necp_kernel_policy_filter                       filter_control_unit;
1386 	u_int32_t                                       flow_divert_aggregate_unit;
1387 	u_int32_t                                                       route_rule_id;
1388 	int32_t                                         qos_marking_gencount;
1389 };
1390 
1391 struct necp_inpcb_result {
1392 	u_int32_t                                       app_id;
1393 	necp_kernel_policy_id                           policy_id;
1394 	necp_kernel_policy_id                           skip_policy_id;
1395 	int32_t                                         policy_gencount;
1396 	u_int32_t                                       flowhash;
1397 	u_int32_t                                       network_denied_notifies;// Notification count
1398 	struct necp_aggregate_socket_result             results;
1399 };
1400 
1401 extern void necp_init(void);
1402 
1403 struct inp_necp_attributes;
1404 extern errno_t necp_set_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt);
1405 extern errno_t necp_get_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt);
1406 extern errno_t necp_set_socket_domain_attributes(struct socket *so, const char *domain __null_terminated, const char *domain_owner __null_terminated);
1407 extern int necp_set_socket_resolver_signature(struct inpcb *inp, struct sockopt *sopt);
1408 extern int necp_get_socket_resolver_signature(struct inpcb *inp, struct sockopt *sopt);
1409 extern bool necp_socket_has_resolver_signature(struct inpcb *inp);
1410 extern bool necp_socket_resolver_signature_matches_address(struct inpcb *inp, union necp_sockaddr_union *address);
1411 extern void necp_inpcb_remove_cb(struct inpcb *inp);
1412 extern void necp_inpcb_dispose(struct inpcb *inp);
1413 
1414 extern u_int32_t necp_socket_get_content_filter_control_unit(struct socket *so);
1415 extern u_int32_t necp_socket_get_policy_gencount(struct socket *so);
1416 
1417 extern bool necp_socket_should_use_flow_divert(struct inpcb *inp);
1418 extern u_int32_t necp_socket_get_flow_divert_control_unit(struct inpcb *inp, uint32_t *aggregate_unit);
1419 
1420 extern bool necp_socket_should_rescope(struct inpcb *inp);
1421 extern u_int necp_socket_get_rescope_if_index(struct inpcb *inp);
1422 extern u_int32_t necp_socket_get_effective_mtu(struct inpcb *inp, u_int32_t current_mtu);
1423 
1424 extern bool necp_socket_is_allowed_to_recv_on_interface(struct inpcb *inp, ifnet_t interface);
1425 
1426 extern bool necp_socket_is_allowed_to_send_recv(struct inpcb *inp, ifnet_t input_interface, u_int16_t pf_tag,
1427     necp_kernel_policy_id *return_policy_id,
1428     u_int32_t *return_route_rule_id,
1429     necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags);
1430 extern bool necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port,
1431     u_int16_t remote_port, struct in_addr *local_addr,
1432     struct in_addr *remote_addr, ifnet_t input_interface, u_int16_t pf_tag,
1433     necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id,
1434     necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags);
1435 extern bool necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port,
1436     u_int16_t remote_port, struct in6_addr *local_addr,
1437     struct in6_addr *remote_addr, ifnet_t input_interface, u_int16_t pf_tag,
1438     necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id,
1439     necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags);
1440 extern void necp_socket_update_qos_marking(struct inpcb *inp, struct rtentry *route, u_int32_t route_rule_id);
1441 extern bool necp_lookup_current_qos_marking(int32_t *qos_marking_gencount, struct rtentry *route, struct ifnet *interface, u_int32_t route_rule_id, bool old_qos_marking);
1442 extern int necp_mark_packet_from_socket(struct mbuf *packet, struct inpcb *inp, necp_kernel_policy_id policy_id,
1443     u_int32_t route_rule_id, necp_kernel_policy_id skip_policy_id, u_int32_t pass_flags);
1444 extern necp_kernel_policy_id necp_get_policy_id_from_packet(struct mbuf *packet);
1445 extern necp_kernel_policy_id necp_get_skip_policy_id_from_packet(struct mbuf *packet);
1446 extern u_int16_t necp_get_packet_filter_tags_from_packet(struct mbuf *packet);
1447 extern bool necp_packet_should_skip_filters(struct mbuf *packet);
1448 extern u_int32_t necp_get_last_interface_index_from_packet(struct mbuf *packet);
1449 extern u_int32_t necp_get_route_rule_id_from_packet(struct mbuf *packet);
1450 extern int necp_get_app_uuid_from_packet(struct mbuf *packet,
1451     uuid_t app_uuid);
1452 
1453 extern necp_kernel_policy_id necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local_addr,
1454     struct sockaddr *override_remote_addr, u_int32_t override_bound_interface);
1455 extern necp_kernel_policy_id necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_args *ipoa,
1456     struct rtentry *rt,
1457     necp_kernel_policy_result *result,
1458     necp_kernel_policy_result_parameter *result_parameter);
1459 extern necp_kernel_policy_id necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out_args *ip6oa,
1460     struct rtentry *rt,
1461     necp_kernel_policy_result *result,
1462     necp_kernel_policy_result_parameter *result_parameter);
1463 
1464 extern int necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id);
1465 extern int necp_mark_packet_from_ip_with_skip(struct mbuf *packet, necp_kernel_policy_id policy_id, necp_kernel_policy_id skip_policy_id);
1466 extern int necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface);
1467 
1468 extern ifnet_t necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter);
1469 extern bool necp_packet_can_rebind_to_ifnet(struct mbuf *packet, struct ifnet *interface, struct route *new_route, int family);
1470 
1471 extern bool necp_packet_is_allowed_over_interface(struct mbuf *packet, struct ifnet *interface);
1472 
1473 extern int necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive);
1474 extern bool necp_get_is_keepalive_from_packet(struct mbuf *packet);
1475 
1476 extern int necp_sign_resolver_answer(uuid_t client_id, u_int32_t sign_type,
1477     u_int8_t *data, size_t data_length,
1478     u_int8_t *tag, size_t *out_tag_length);
1479 
1480 extern bool necp_validate_resolver_answer(uuid_t client_id, u_int32_t sign_type,
1481     u_int8_t *data __sized_by(data_length), size_t data_length,
1482     u_int8_t *tag __sized_by(tag_length), size_t tag_length);
1483 
1484 extern int necp_sign_application_id(uuid_t client_id, u_int32_t sign_type,
1485     u_int8_t *__counted_by(*out_tag_length) tag, size_t *out_tag_length);
1486 
1487 extern bool necp_validate_application_id(uuid_t client_id, u_int32_t sign_type,
1488     u_int8_t *tag __sized_by(tag_length), size_t tag_length);
1489 
1490 extern void necp_update_all_clients(void); // Handle general re-evaluate event
1491 extern void necp_update_all_clients_immediately_if_needed(bool should_update_immediately); // Handle general re-evaluate event
1492 
1493 extern void necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid, u_int32_t agent_generation); // Cause a single client to get an update event
1494 
1495 extern bool necp_set_client_as_background(proc_t proc, struct fileproc *fp, bool background); // Set all clients for an fp as background or not
1496 
1497 struct necp_fd_data;
1498 extern void necp_fd_memstatus(proc_t proc, uint32_t status, struct necp_fd_data *client_fd); // Purge memory of clients for the process
1499 extern void necp_fd_defunct(proc_t proc, struct necp_fd_data *client_fd); // Set all clients for an process as defunct
1500 
1501 extern void necp_client_request_in_process_flow_divert(pid_t pid);
1502 
1503 extern int necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp);
1504 
1505 extern int necp_client_register_socket_listener(pid_t pid, uuid_t client_id, struct inpcb *inp);
1506 
1507 #if SKYWALK
1508 extern int necp_client_get_netns_flow_info(uuid_t client_id, struct ns_flow_info *flow_info);
1509 #endif /* SKYWALK */
1510 
1511 extern int necp_client_assert_bb_radio_manager(uuid_t client_id, bool assert);
1512 
1513 extern int necp_client_assign_from_socket(pid_t pid, uuid_t client_id, struct inpcb *inp);
1514 
1515 extern int necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id,
1516     u_int8_t *assigned_results __sized_by(assigned_results_length), size_t assigned_results_length);
1517 extern int necp_assign_client_group_members(uuid_t netagent_uuid, uuid_t client_id,
1518     u_int8_t *__counted_by(assigned_group_members_length) assigned_group_members,
1519     size_t assigned_group_members_length);
1520 
1521 struct skmem_obj_info;  // forward declaration
1522 extern int necp_stats_ctor(struct skmem_obj_info *oi, struct skmem_obj_info *oim, void *arg, uint32_t skmflag);
1523 extern int necp_stats_dtor(void *addr, void *arg);
1524 
1525 /* value to denote invalid flow advisory index */
1526 struct netagent_session;
1527 extern int
1528 necp_update_flow_protoctl_event(uuid_t netagent_uuid, uuid_t client_id,
1529     uint32_t protoctl_event_code, uint32_t protoctl_event_val,
1530     uint32_t protoctl_event_tcp_seq_num);
1531 
1532 #define NECP_FLOWADV_IDX_INVALID        UINT32_MAX
1533 extern void * __sized_by(*message_length) necp_create_nexus_assign_message(uuid_t nexus_instance, nexus_port_t nexus_port, void *key __sized_by(key_length), uint32_t key_length,
1534     struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint,
1535     struct ether_addr *local_ether_addr,
1536     u_int32_t flow_adv_index, void *flow_stats, size_t *message_length);
1537 
1538 
1539 #define NECP_MAX_DEMUX_PATTERNS 4
1540 struct necp_client_nexus_parameters {
1541 	pid_t pid;
1542 	pid_t epid;
1543 	uuid_t euuid;
1544 #if SKYWALK
1545 	netns_token port_reservation;
1546 #else /* !SKYWALK */
1547 	void *reserved;
1548 #endif /* !SKYWALK */
1549 	union necp_sockaddr_union local_addr;
1550 	union necp_sockaddr_union remote_addr;
1551 	u_int8_t ip_protocol;
1552 	u_int8_t transport_protocol;
1553 	u_int16_t ethertype;
1554 	u_int32_t traffic_class;
1555 	necp_policy_id policy_id;
1556 	necp_policy_id skip_policy_id;
1557 	unsigned is_listener:1;
1558 	unsigned is_interpose:1;
1559 	unsigned is_custom_ether:1;
1560 	unsigned allow_qos_marking:1;
1561 	unsigned override_address_selection:1;
1562 	unsigned use_stable_address:1; // Used if override_address_selection is set
1563 	unsigned no_wake_from_sleep:1;
1564 	unsigned is_demuxable_parent:1;
1565 	unsigned reuse_port:1;
1566 
1567 	uuid_t parent_flow_uuid;
1568 	struct necp_demux_pattern demux_patterns[NECP_MAX_DEMUX_PATTERNS];
1569 	uint8_t demux_pattern_count;
1570 };
1571 
1572 struct necp_client_group_members {
1573 	size_t group_members_length;
1574 	u_int8_t *group_members __sized_by(group_members_length);
1575 };
1576 
1577 struct necp_client_error_parameters {
1578 	int32_t error;
1579 	bool force_report;
1580 };
1581 
1582 struct necp_client_agent_parameters {
1583 	union {
1584 		struct necp_client_nexus_parameters nexus_request;
1585 		u_int8_t close_token[QUIC_STATELESS_RESET_TOKEN_SIZE];
1586 		struct necp_client_group_members group_members;
1587 		struct necp_client_error_parameters error;
1588 	} u;
1589 };
1590 
1591 #define NECP_CLIENT_CBACTION_NONVIABLE  1
1592 #define NECP_CLIENT_CBACTION_VIABLE     2
1593 #define NECP_CLIENT_CBACTION_INITIAL    3
1594 
1595 struct necp_client_add_flow_default {
1596 	uuid_t agent_uuid;
1597 	uuid_t registration_id;
1598 	u_int16_t flags; // NECP_CLIENT_FLOW_FLAGS_*
1599 	u_int16_t stats_request_count;
1600 	struct necp_client_flow_stats stats_requests[1];
1601 } __attribute__((__packed__));
1602 
1603 typedef void (*necp_client_flow_cb)(void *handle, int action, uint32_t interface_index, uint32_t necp_flags, bool *viable);
1604 
1605 #if SKYWALK
1606 struct skmem_arena_mmap_info;
1607 
1608 extern pid_t necp_client_get_proc_pid_from_arena_info(struct skmem_arena_mmap_info *arena_info);
1609 
1610 extern void necp_client_early_close(uuid_t client_id); // Cause a single client to close stats, etc
1611 
1612 #endif /* SKYWALK */
1613 
1614 #endif /* BSD_KERNEL_PRIVATE */
1615 
1616 #ifdef KERNEL
1617 #ifdef KERNEL_PRIVATE
1618 struct nstat_domain_info;
1619 extern void necp_copy_inp_domain_info(struct inpcb *, struct socket *, struct nstat_domain_info *);
1620 extern void necp_with_inp_domain_name(struct socket *so, void *ctx, void (*with_func)(char *domain_name __null_terminated, void *ctx));
1621 extern bool net_domain_contains_hostname(char *hostname_string __null_terminated, char *domain_string __null_terminated);
1622 #endif /* KERNEL_PRIVATE */
1623 #endif /* KERNEL */
1624 
1625 #ifndef KERNEL
1626 
1627 extern int necp_match_policy(const uint8_t *parameters, size_t parameters_size, struct necp_aggregate_result *returned_result);
1628 
1629 extern int necp_open(int flags);
1630 
1631 extern int necp_client_action(int necp_fd, uint32_t action, uuid_t client_id,
1632     size_t client_id_len, uint8_t *buffer, size_t buffer_size);
1633 
1634 extern int necp_session_open(int flags);
1635 
1636 extern int necp_session_action(int necp_fd, uint32_t action,
1637     uint8_t *in_buffer, size_t in_buffer_length,
1638     uint8_t *out_buffer, size_t out_buffer_length);
1639 
1640 #endif /* !KERNEL */
1641 
1642 #endif /* PRIVATE */
1643 
1644 #endif
1645