1 /*
2 * Copyright (c) 2013-2023 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #ifndef _NET_NECP_H_
30 #define _NET_NECP_H_
31
32 #include <net/net_kev.h>
33 #ifdef PRIVATE
34
35 #include <netinet/in.h>
36 #include <netinet/in_private.h>
37 #include <netinet/in_stat.h>
38 #include <sys/socket.h>
39 #include <net/if_private.h>
40 #include <net/if_var_private.h>
41 #include <netinet/tcp_private.h>
42
43 #if SKYWALK
44 #include <skywalk/os_nexus_private.h>
45 #else /* !SKYWALK */
46 typedef uint16_t nexus_port_t;
47 #endif /* !SKYWALK */
48
49 /*
50 * Name registered by the NECP
51 */
52 #define NECP_CONTROL_NAME "com.apple.net.necp_control"
53
54 #define NECP_TLV_LENGTH_UINT32 1
55
56 struct necp_packet_header {
57 u_int8_t packet_type;
58 u_int8_t flags;
59 u_int32_t message_id;
60 };
61
62 typedef struct {
63 uid_t uid;
64 uuid_t effective_uuid;
65 uid_t persona_id;
66 } necp_application_id_t;
67
68 #define NECP_DOMAIN_TRIE_SUPPORT 1
69
70 /*
71 * Request sent from user-space to create a domain trie
72 */
73 #define NECP_DOMAIN_TRIE_FLAG_REVERSE_SEARCH 0x1
74 #define NECP_DOMAIN_TRIE_FLAG_ALLOW_PARTIAL_MATCH 0x2
75
76 typedef struct necp_domain_trie_request {
77 uint32_t id;
78 uint32_t total_mem_size;
79 uint32_t nodes_mem_size;
80 uint32_t maps_mem_size;
81 uint32_t bytes_mem_size;
82 uint32_t nodes_count;
83 uint32_t maps_count;
84 uint32_t bytes_count;
85 uint32_t partial_match_terminator;
86 uint32_t flags;
87 uint8_t data[__counted_by(total_mem_size)];
88 } necp_domain_trie_request_t;
89
90 /*
91 * Control message commands
92 */
93 #define NECP_PACKET_TYPE_POLICY_ADD 1
94 #define NECP_PACKET_TYPE_POLICY_GET 2
95 #define NECP_PACKET_TYPE_POLICY_DELETE 3
96 #define NECP_PACKET_TYPE_POLICY_APPLY_ALL 4
97 #define NECP_PACKET_TYPE_POLICY_LIST_ALL 5
98 #define NECP_PACKET_TYPE_POLICY_DELETE_ALL 6
99 #define NECP_PACKET_TYPE_SET_SESSION_PRIORITY 7
100 #define NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC 8
101 #define NECP_PACKET_TYPE_REGISTER_SERVICE 9
102 #define NECP_PACKET_TYPE_UNREGISTER_SERVICE 10
103 #define NECP_PACKET_TYPE_POLICY_DUMP_ALL 11
104
105 /*
106 * Session actions
107 */
108 #define NECP_SESSION_ACTION_POLICY_ADD 1 // In: Policy TLVs Out: necp_policy_id
109 #define NECP_SESSION_ACTION_POLICY_GET 2 // In: necp_policy_id Out: Policy TLVs
110 #define NECP_SESSION_ACTION_POLICY_DELETE 3 // In: necp_policy_id Out: None
111 #define NECP_SESSION_ACTION_POLICY_APPLY_ALL 4 // In: None Out: None
112 #define NECP_SESSION_ACTION_POLICY_LIST_ALL 5 // In: None Out: TLVs of IDs
113 #define NECP_SESSION_ACTION_POLICY_DELETE_ALL 6 // In: None Out: None
114 #define NECP_SESSION_ACTION_SET_SESSION_PRIORITY 7 // In: necp_session_priority Out: None
115 #define NECP_SESSION_ACTION_LOCK_SESSION_TO_PROC 8 // In: None Out: None
116 #define NECP_SESSION_ACTION_REGISTER_SERVICE 9 // In: uuid_t Out: None
117 #define NECP_SESSION_ACTION_UNREGISTER_SERVICE 10 // In: uuid_t Out: None
118 #define NECP_SESSION_ACTION_POLICY_DUMP_ALL 11 // In: None Out: uint32_t bytes length, then Policy TLVs
119 #define NECP_SESSION_ACTION_ADD_DOMAIN_FILTER 12 // In: struct net_bloom_filter Out: uint32_t, ID
120 #define NECP_SESSION_ACTION_REMOVE_DOMAIN_FILTER 13 // In: uint32_t, ID Out: None
121 #define NECP_SESSION_ACTION_REMOVE_ALL_DOMAIN_FILTERS 14 // In: None Out: None
122 #define NECP_SESSION_ACTION_ADD_DOMAIN_TRIE 15 // In: struct necp_domain_trie_request Out: uint32_t, ID
123 #define NECP_SESSION_ACTION_REMOVE_DOMAIN_TRIE 16 // In: uint32_t, ID Out: None
124 #define NECP_SESSION_ACTION_REMOVE_ALL_DOMAIN_TRIES 17 // In: None Out: None
125 #define NECP_SESSION_ACTION_TRIE_DUMP_ALL 18 // In: None Out: uint8_t, count, then array of struct necp_domain_trie_request with no 'data'
126
127 /*
128 * Control message flags
129 */
130 #define NECP_PACKET_FLAGS_RESPONSE 0x01 // Used for acks, errors, and query responses
131
132 /*
133 * Control message TLV types
134 */
135 #define NECP_TLV_NIL 0
136 #define NECP_TLV_ERROR 1 // u_int32_t
137 #define NECP_TLV_POLICY_ORDER 2 // u_int32_t
138 #define NECP_TLV_POLICY_CONDITION 3
139 #define NECP_TLV_POLICY_RESULT 4
140 #define NECP_TLV_POLICY_ID 5 // u_int32_t
141 #define NECP_TLV_SESSION_PRIORITY 6 // u_int32_t
142 #define NECP_TLV_ATTRIBUTE_DOMAIN 7 // char[]
143 #define NECP_TLV_ATTRIBUTE_ACCOUNT 8 // char[]
144 #define NECP_TLV_SERVICE_UUID 9 // uuid_t
145 #define NECP_TLV_ROUTE_RULE 10
146 #define NECP_TLV_ATTRIBUTE_DOMAIN_OWNER 11 // char[]
147 #define NECP_TLV_ATTRIBUTE_TRACKER_DOMAIN 12 // char[]
148 #define NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT 13 // char[]
149
150 /*
151 * Control message TLV sent only by the kernel to userspace
152 */
153 #define NECP_TLV_POLICY_OWNER 100 // char []
154 #define NECP_TLV_POLICY_DUMP 101
155 #define NECP_TLV_POLICY_RESULT_STRING 102 // char []
156 #define NECP_TLV_POLICY_SESSION_ORDER 103 // u_int32_t
157
158 /*
159 * Condition flags
160 */
161 #define NECP_POLICY_CONDITION_FLAGS_NEGATIVE 0x01 // Negative
162 #define NECP_POLICY_CONDITION_FLAGS_EXACT 0x02 // For conditions that would otherwise have more inclusive matching, require an exact match
163
164 /*
165 * Added support for dumping negative conditions
166 */
167 #define NECP_POLICY_CONDITION_FLAGS_NEGATIVE_SUPPORTS_DUMP 1
168
169 /*
170 * Conditions
171 * Used for setting policies as well as passing parameters to necp_match_policy.
172 */
173 #define NECP_POLICY_CONDITION_DEFAULT 0 // N/A, not valid with any other conditions
174 // Socket/Application conditions
175 #define NECP_POLICY_CONDITION_APPLICATION 1 // uuid_t, uses effective UUID when possible
176 #define NECP_POLICY_CONDITION_REAL_APPLICATION 2 // uuid_t, never uses effective UUID. Only valid with NECP_POLICY_CONDITION_APPLICATION
177 #define NECP_POLICY_CONDITION_DOMAIN 3 // String, such as apple.com
178 #define NECP_POLICY_CONDITION_ACCOUNT 4 // String
179 #define NECP_POLICY_CONDITION_ENTITLEMENT 5 // String
180 #define NECP_POLICY_CONDITION_PID 6 // pid_t
181 #define NECP_POLICY_CONDITION_UID 7 // uid_t
182 #define NECP_POLICY_CONDITION_ALL_INTERFACES 8 // N/A
183 #define NECP_POLICY_CONDITION_BOUND_INTERFACE 9 // String
184 #define NECP_POLICY_CONDITION_TRAFFIC_CLASS 10 // necp_policy_condition_tc_range
185 // Socket/IP conditions
186 #define NECP_POLICY_CONDITION_IP_PROTOCOL 11 // u_int16_t
187 #define NECP_POLICY_CONDITION_LOCAL_ADDR 12 // necp_policy_condition_addr
188 #define NECP_POLICY_CONDITION_REMOTE_ADDR 13 // necp_policy_condition_addr
189 #define NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE 14 // necp_policy_condition_addr_range
190 #define NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE 15 // necp_policy_condition_addr_range
191 #define NECP_POLICY_CONDITION_AGENT_TYPE 16 // struct necp_policy_condition_agent_type
192 #define NECP_POLICY_CONDITION_HAS_CLIENT 17 // N/A
193 #define NECP_POLICY_CONDITION_LOCAL_NETWORKS 18 // Matches all local networks
194 // Socket-only conditions
195 #define NECP_POLICY_CONDITION_FLOW_IP_PROTOCOL 19 // u_int16_t
196 #define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR 20 // necp_policy_condition_addr
197 #define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR 21 // necp_policy_condition_addr
198 #define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_RANGE 22 // necp_policy_condition_addr_range
199 #define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_RANGE 23 // necp_policy_condition_addr_range
200 #define NECP_POLICY_CONDITION_FLOW_IS_LOOPBACK 31 // N/A
201 // Socket/Application conditions, continued
202 #define NECP_POLICY_CONDITION_CLIENT_FLAGS 24 // u_int32_t, values from NECP_CLIENT_PARAMETER_FLAG_*
203 #define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_EMPTY 25 // N/A
204 #define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_EMPTY 26 // N/A
205 #define NECP_POLICY_CONDITION_PLATFORM_BINARY 27 // N/A
206 #define NECP_POLICY_CONDITION_SDK_VERSION 28 // struct necp_policy_condition_sdk_version
207 #define NECP_POLICY_CONDITION_SIGNING_IDENTIFIER 29 // String
208 #define NECP_POLICY_CONDITION_PACKET_FILTER_TAGS 30 // u_int16_t
209 #define NECP_POLICY_CONDITION_DELEGATE_IS_PLATFORM_BINARY 32 // N/A
210 #define NECP_POLICY_CONDITION_DOMAIN_OWNER 33 // String, owner of domain (for example, "Google Inc")
211 #define NECP_POLICY_CONDITION_DOMAIN_CONTEXT 34 // String, eTLD+1 leading to networking activities to the domain
212 #define NECP_POLICY_CONDITION_TRACKER_DOMAIN 35 // String, tracker domain
213 #define NECP_POLICY_CONDITION_ATTRIBUTED_BUNDLE_IDENTIFIER 36 // String, app to which traffic is attributed to
214 #define NECP_POLICY_CONDITION_SCHEME_PORT 37 // u_int16_t, the port associated with the scheme for a connection
215 #define NECP_POLICY_CONDITION_DOMAIN_FILTER 38 // struct net_bloom_filter
216 #define NECP_POLICY_CONDITION_SYSTEM_SIGNED_RESULT 39 // N/A
217 #define NECP_POLICY_CONDITION_REAL_UID 40 // uid_t
218 #define NECP_POLICY_CONDITION_APPLICATION_ID 41 // necp_application_id_t
219 #define NECP_POLICY_CONDITION_URL 42 // String, URL
220 #define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS 43 // Interface flags: u_int32_t flags, u_int32_t eflags, u_int32_t xflags
221
222
223 /*
224 * Policy Condition Bound Interface Flags Order
225 */
226 #define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS_IDX_FLAGS 0
227 #define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS_IDX_EFLAGS 1
228 #define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS_IDX_XFLAGS 2
229 #define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS_IDX_MAX 3
230
231 /*
232 * Policy Packet tags
233 */
234 #define NECP_POLICY_CONDITION_PACKET_FILTER_TAG_STACK_DROP 0x01
235 #define NECP_POLICY_CONDITION_PACKET_FILTER_TAG_MAX NECP_POLICY_CONDITION_PACKET_FILTER_TAG_STACK_DROP
236
237 /*
238 * Results
239 */
240 #define NECP_POLICY_RESULT_PASS 1 // N/A
241 #define NECP_POLICY_RESULT_SKIP 2 // u_int32_t, policy order to skip to. 0 to skip all session policies.
242 #define NECP_POLICY_RESULT_DROP 3 // N/A
243 #define NECP_POLICY_RESULT_SOCKET_DIVERT 4 // u_int32_t, flow divert control unit
244 #define NECP_POLICY_RESULT_SOCKET_FILTER 5 // u_int32_t, filter control unit
245 #define NECP_POLICY_RESULT_IP_TUNNEL 6 // String, interface name
246 #define NECP_POLICY_RESULT_IP_FILTER 7 // ?
247 #define NECP_POLICY_RESULT_TRIGGER 8 // Deprecated
248 #define NECP_POLICY_RESULT_TRIGGER_IF_NEEDED 9 // Deprecated
249 #define NECP_POLICY_RESULT_TRIGGER_SCOPED 10 // Deprecated
250 #define NECP_POLICY_RESULT_NO_TRIGGER_SCOPED 11 // Deprecated
251 #define NECP_POLICY_RESULT_SOCKET_SCOPED 12 // String, interface name
252 #define NECP_POLICY_RESULT_ROUTE_RULES 13 // N/A, must have route rules defined
253 #define NECP_POLICY_RESULT_USE_NETAGENT 14 // netagent uuid_t
254 #define NECP_POLICY_RESULT_NETAGENT_SCOPED 15 // netagent uuid_t
255 #define NECP_POLICY_RESULT_SCOPED_DIRECT 16 // N/A, scopes to primary physical interface
256 #define NECP_POLICY_RESULT_ALLOW_UNENTITLED 17 // N/A
257 #define NECP_POLICY_RESULT_REMOVE_NETAGENT 18 // netagent uuid_t
258 #define NECP_POLICY_RESULT_REMOVE_NETAGENT_TYPE 19 // necp_policy_condition_agent_type
259
260 #define NECP_POLICY_RESULT_MAX NECP_POLICY_RESULT_REMOVE_NETAGENT_TYPE
261
262 /*
263 * PASS Result Flags
264 */
265 #define NECP_POLICY_PASS_NO_SKIP_IPSEC 0x01
266 #define NECP_POLICY_PASS_PF_TAG 0x02
267
268 /*
269 * DROP Result Flags
270 */
271 #define NECP_POLICY_DROP_FLAG_LOCAL_NETWORK 0x01
272 #define NECP_POLICY_DROP_FLAG_SUPPRESS_ALERTS 0x02
273 #define NECP_POLICY_DROP_FLAG_DEFUNCT_ALL_FLOWS 0x04
274
275 /*
276 * Local-Networks Condition Flags
277 */
278 #define NECP_POLICY_LOCAL_NETWORKS_FLAG_INCLUDE_LOCAL_ADDRESSES 0x01 // Include addresses on local interfaces for Local-Networks condition
279
280 /*
281 * Route Rules
282 * Detailed parameters for NECP_POLICY_RESULT_ROUTE_RULES.
283 */
284 #define NECP_ROUTE_RULE_NONE 0 // N/A
285 #define NECP_ROUTE_RULE_DENY_INTERFACE 1 // String, or empty to match all
286 #define NECP_ROUTE_RULE_ALLOW_INTERFACE 2 // String, or empty to match all
287 #define NECP_ROUTE_RULE_QOS_MARKING 3 // String, or empty to match all
288 #define NECP_ROUTE_RULE_DENY_LQM_ABORT 4 // String, or empty to match all
289 #define NECP_ROUTE_RULE_USE_NETAGENT 5 // UUID, followed by string or empty
290 #define NECP_ROUTE_RULE_REMOVE_NETAGENT 6 // UUID, followed by string or empty
291 #define NECP_ROUTE_RULE_DIVERT_SOCKET 7 // u_int32_t control unit, followed by string or empty
292 #define NECP_ROUTE_RULE_DENY_INTERFACE_WITH_TYPE 8 // u_int32_t effective type, followed by string or empty
293
294 #define NECP_ROUTE_RULE_FLAG_CELLULAR 0x01
295 #define NECP_ROUTE_RULE_FLAG_WIFI 0x02
296 #define NECP_ROUTE_RULE_FLAG_WIRED 0x04
297 #define NECP_ROUTE_RULE_FLAG_EXPENSIVE 0x08
298 #define NECP_ROUTE_RULE_FLAG_CONSTRAINED 0x10
299 #define NECP_ROUTE_RULE_FLAG_COMPANION 0x20
300 #define NECP_ROUTE_RULE_FLAG_VPN 0x40
301 #define NECP_ROUTE_RULE_FLAG_ULTRA_CONSTRAINED 0x90 // Note that this includes the 0x80 bit, so cannot be combined with agent UUID matching.
302
303 #define NECP_ROUTE_RULE_FLAG_NETAGENT 0x80 // Last bit, reserved to mark that this applies only when an agent UUID is present
304
305 #define NECP_ROUTE_RULES_SUPPORT_NETAGENT_EXCEPTIONS 1
306
307 /*
308 * Error types
309 */
310 #define NECP_ERROR_INTERNAL 0
311 #define NECP_ERROR_UNKNOWN_PACKET_TYPE 1
312 #define NECP_ERROR_INVALID_TLV 2
313 #define NECP_ERROR_POLICY_RESULT_INVALID 3
314 #define NECP_ERROR_POLICY_CONDITIONS_INVALID 4
315 #define NECP_ERROR_POLICY_ID_NOT_FOUND 5
316 #define NECP_ERROR_INVALID_PROCESS 6
317 #define NECP_ERROR_ROUTE_RULES_INVALID 7
318
319 // Modifiers
320 #define NECP_MASK_USERSPACE_ONLY 0x80000000 // on filter_control_unit value
321 #define NECP_MASK_PRESERVE_CONNECTIONS 0x20000000 // on filter_control_unit value
322
323 struct necp_policy_condition_tc_range {
324 u_int32_t start_tc;
325 u_int32_t end_tc;
326 } __attribute__((__packed__));
327
328 struct necp_policy_condition_addr {
329 u_int8_t prefix;
330 union {
331 struct sockaddr sa;
332 struct sockaddr_in sin;
333 struct sockaddr_in6 sin6;
334 } address __attribute__((__packed__));
335 } __attribute__((__packed__));
336
337 struct necp_policy_condition_addr_range {
338 union {
339 struct sockaddr sa;
340 struct sockaddr_in sin;
341 struct sockaddr_in6 sin6;
342 } start_address __attribute__((__packed__));
343 union {
344 struct sockaddr sa;
345 struct sockaddr_in sin;
346 struct sockaddr_in6 sin6;
347 } end_address __attribute__((__packed__));
348 } __attribute__((__packed__));
349
350 struct necp_policy_condition_agent_type {
351 char agent_domain[32];
352 char agent_type[32];
353 } __attribute__((__packed__));
354
355 struct necp_policy_condition_sdk_version {
356 uint32_t platform; // e.g., PLATFORM_IOS
357 uint32_t min_version; // Encoded as XXXX.YY.ZZ
358 uint32_t version; // Encoded as XXXX.YY.ZZ
359 } __attribute__((__packed__));
360
361 #define NECP_SESSION_PRIORITY_UNKNOWN 0
362 #define NECP_SESSION_PRIORITY_CONTROL 1
363 #define NECP_SESSION_PRIORITY_CONTROL_1 2
364 #define NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL 3
365 #define NECP_SESSION_PRIORITY_HIGH 4
366 #define NECP_SESSION_PRIORITY_HIGH_1 5
367 #define NECP_SESSION_PRIORITY_HIGH_2 6
368 #define NECP_SESSION_PRIORITY_HIGH_3 7
369 #define NECP_SESSION_PRIORITY_HIGH_4 8
370 #define NECP_SESSION_PRIORITY_HIGH_RESTRICTED 9
371 #define NECP_SESSION_PRIORITY_DEFAULT 10
372 #define NECP_SESSION_PRIORITY_LOW 11
373 #define NECP_SESSION_NUM_PRIORITIES NECP_SESSION_PRIORITY_LOW
374
375 typedef u_int32_t necp_policy_id;
376 typedef u_int32_t necp_policy_order;
377 typedef u_int32_t necp_session_priority;
378
379 typedef u_int32_t necp_kernel_policy_result;
380 typedef u_int32_t necp_kernel_policy_filter;
381
382 typedef union {
383 u_int tunnel_interface_index;
384 u_int scoped_interface_index;
385 u_int32_t flow_divert_control_unit;
386 u_int32_t filter_control_unit;
387 u_int32_t pass_flags;
388 u_int32_t drop_flags;
389 } necp_kernel_policy_routing_result_parameter;
390
391 #define NECP_SERVICE_FLAGS_REGISTERED 0x01
392 #define NECP_MAX_NETAGENTS 16
393 #define NECP_MAX_REMOVE_NETAGENT_TYPES 4
394
395 #define NECP_AGENT_USE_FLAG_SCOPE 0x01
396 #define NECP_AGENT_USE_FLAG_REMOVE 0x02
397
398 #define NECP_TFO_COOKIE_LEN_MAX 16
399 struct necp_aggregate_result {
400 necp_kernel_policy_result routing_result;
401 necp_kernel_policy_routing_result_parameter routing_result_parameter;
402 necp_kernel_policy_filter filter_control_unit;
403 u_int32_t flow_divert_aggregate_unit;
404 u_int routed_interface_index;
405 u_int32_t policy_id;
406 u_int32_t skip_policy_id;
407 uuid_t netagents[NECP_MAX_NETAGENTS];
408 u_int32_t netagent_use_flags[NECP_MAX_NETAGENTS];
409 struct necp_policy_condition_agent_type remove_netagent_types[NECP_MAX_REMOVE_NETAGENT_TYPES];
410 struct ipv6_prefix nat64_prefixes[NAT64_MAX_NUM_PREFIXES];
411 u_int8_t mss_recommended;
412 };
413
414 /*
415 * Statistics. It would be nice if the definitions in ntstat.h could be used,
416 * but they get entangled with #defines for v4 etc in pfvar.h and it may be better practice
417 * to have separate definitions here.
418 */
419 struct necp_stat_counts {
420 /* Counters */
421 u_int64_t necp_stat_rxpackets __attribute__((aligned(8)));
422 u_int64_t necp_stat_rxbytes __attribute__((aligned(8)));
423 u_int64_t necp_stat_txpackets __attribute__((aligned(8)));
424 u_int64_t necp_stat_txbytes __attribute__((aligned(8)));
425
426 u_int32_t necp_stat_rxduplicatebytes;
427 u_int32_t necp_stat_rxoutoforderbytes;
428 u_int32_t necp_stat_txretransmit;
429
430 u_int32_t necp_stat_connectattempts;
431 u_int32_t necp_stat_connectsuccesses;
432
433 u_int32_t necp_stat_min_rtt;
434 u_int32_t necp_stat_avg_rtt;
435 u_int32_t necp_stat_var_rtt;
436
437 #define NECP_STAT_ROUTE_FLAGS 1
438 u_int32_t necp_stat_route_flags;
439 };
440
441 // Note, some metadata is implicit in the necp client itself:
442 // From the process itself : pid, upid, uuid, proc name.
443 // From the necp client parameters: local and remote addresses, euuid, traffic class, ifindex
444 //
445 // The following may well be supplied via future necp client parameters,
446 // but they are here so they don't get forgotten.
447 struct necp_basic_metadata {
448 u_int32_t rcvbufsize;
449 u_int32_t rcvbufused;
450 };
451
452 struct necp_connection_probe_status {
453 unsigned int probe_activated : 1;
454 unsigned int write_probe_failed : 1;
455 unsigned int read_probe_failed : 1;
456 unsigned int conn_probe_failed : 1;
457 };
458
459 struct necp_extra_tcp_metadata {
460 struct necp_connection_probe_status probestatus;
461
462 u_int32_t sndbufsize;
463 u_int32_t sndbufused;
464 u_int32_t txunacked;
465 u_int32_t txwindow;
466 u_int32_t txcwindow;
467 u_int32_t flags; // use SOF_*
468 u_int32_t flags1; // use SOF1_*
469 u_int32_t traffic_mgt_flags;
470 u_int32_t cc_alg_index;
471 u_int32_t state;
472 };
473
474 struct necp_stats_hdr {
475 u_int32_t necp_stats_type __attribute__((aligned(8)));
476 u_int32_t necp_stats_ver;
477 u_int64_t __necp_stats_reserved; // Pad the field for future use
478 };
479
480 #define NECP_CLIENT_STATISTICS_TYPE_TCP 1 // Identifies use of necp_tcp_stats
481 #define NECP_CLIENT_STATISTICS_TYPE_UDP 2 // Identifies use of necp_udp_stats
482 #define NECP_CLIENT_STATISTICS_TYPE_QUIC 3 // Identifies use of necp_quic_stats
483
484 #define NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1 1 // Currently supported version for TCP
485 #define NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1 1 // Currently supported version for UDP
486 #define NECP_CLIENT_STATISTICS_TYPE_QUIC_VER_1 1 // Currently supported version for QUIC
487
488 #define NECP_CLIENT_STATISTICS_TYPE_TCP_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1
489 #define NECP_CLIENT_STATISTICS_TYPE_UDP_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1
490 #define NECP_CLIENT_STATISTICS_TYPE_QUIC_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_QUIC_VER_1
491
492 #define NECP_CLIENT_STATISTICS_EVENT_INIT 0x00000000 // Register the flow
493 #define NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT 0x00000001 // The flow is effectively finished but waiting on timer
494
495 struct necp_tcp_stats {
496 struct necp_stats_hdr necp_tcp_hdr;
497 struct necp_stat_counts necp_tcp_counts;
498 struct necp_basic_metadata necp_tcp_basic;
499 struct necp_extra_tcp_metadata necp_tcp_extra;
500 };
501
502 struct necp_udp_stats {
503 struct necp_stats_hdr necp_udp_hdr;
504 struct necp_stat_counts necp_udp_counts;
505 struct necp_basic_metadata necp_udp_basic;
506 };
507
508
509 /*
510 * The following reflects the special case for QUIC.
511 * It is a streaming protocol built on top of UDP.
512 * Therefore QUIC stats are defined as basic UDP stats
513 * with some extra meta data.
514 * TODO: For now the extra metadata is an exact replica
515 * of the metadata for TCP. However keeping that separate allows
516 * the structures to diverge later as new stats are added.
517 */
518 #define QUIC_STATELESS_RESET_TOKEN_SIZE 16
519 #define NECP_QUIC_HAS_FALLBACK 1
520
521 struct necp_extra_quic_metadata {
522 u_int32_t sndbufsize;
523 u_int32_t sndbufused;
524 u_int32_t txunacked;
525 u_int32_t txwindow;
526 u_int32_t txcwindow;
527 u_int32_t traffic_mgt_flags;
528 u_int32_t cc_alg_index;
529 u_int32_t state;
530 u_int32_t fallback : 1,
531 unused : 31;
532 u_int8_t ssr_token[QUIC_STATELESS_RESET_TOKEN_SIZE];
533 struct necp_connection_probe_status probestatus;
534 };
535
536 #define necp_quic_hdr necp_quic_udp_stats.necp_udp_hdr
537 #define necp_quic_counts necp_quic_udp_stats.necp_udp_counts
538 #define necp_quic_basic necp_quic_udp_stats.necp_udp_basic
539 struct necp_quic_stats {
540 struct necp_udp_stats necp_quic_udp_stats;
541 struct necp_extra_quic_metadata necp_quic_extra;
542 };
543
544 typedef struct necp_all_stats {
545 union {
546 struct necp_tcp_stats tcp_stats;
547 struct necp_udp_stats udp_stats;
548 struct necp_quic_stats quic_stats;
549 } all_stats_u;
550 } necp_all_stats;
551
552 // Memory for statistics is requested via a necp_stats_bufreq
553 //
554 struct necp_stats_bufreq {
555 u_int32_t necp_stats_bufreq_id __attribute__((aligned(8)));
556 u_int32_t necp_stats_bufreq_type; // NECP_CLIENT_STATISTICS_TYPE_*
557 u_int32_t necp_stats_bufreq_ver; // NECP_CLIENT_STATISTICS_TYPE_*_VER
558 u_int32_t necp_stats_bufreq_size;
559 union {
560 void *necp_stats_bufreq_addr;
561 mach_vm_address_t necp_stats_bufreq_uaddr;
562 };
563 };
564
565 #define NECP_CLIENT_STATISTICS_BUFREQ_ID 0xbf // Distinguishes from statistics actions taking a necp_all_stats struct
566
567 // There is a limit to the number of statistics structures that may be allocated per process, subject to change
568 //
569 #define NECP_MAX_PER_PROCESS_CLIENT_STATISTICS_STRUCTS 512
570
571 #define NECP_TCP_ECN_HEURISTICS_SYN_RST 1
572 typedef struct necp_tcp_ecn_cache {
573 u_int8_t necp_tcp_ecn_heuristics_success:1;
574 u_int8_t necp_tcp_ecn_heuristics_loss:1;
575 u_int8_t necp_tcp_ecn_heuristics_drop_rst:1;
576 u_int8_t necp_tcp_ecn_heuristics_drop_rxmt:1;
577 u_int8_t necp_tcp_ecn_heuristics_aggressive:1;
578 u_int8_t necp_tcp_ecn_heuristics_syn_rst:1;
579 } necp_tcp_ecn_cache;
580
581 #define NECP_TCP_TFO_HEURISTICS_RST 1
582 typedef struct necp_tcp_tfo_cache {
583 u_int8_t necp_tcp_tfo_cookie[NECP_TFO_COOKIE_LEN_MAX];
584 u_int8_t necp_tcp_tfo_cookie_len;
585 u_int8_t necp_tcp_tfo_heuristics_success:1; // TFO succeeded with data in the SYN
586 u_int8_t necp_tcp_tfo_heuristics_loss:1; // TFO SYN-loss with data
587 u_int8_t necp_tcp_tfo_heuristics_middlebox:1; // TFO middlebox detected
588 u_int8_t necp_tcp_tfo_heuristics_success_req:1; // TFO succeeded with the TFO-option in the SYN
589 u_int8_t necp_tcp_tfo_heuristics_loss_req:1; // TFO SYN-loss with the TFO-option
590 u_int8_t necp_tcp_tfo_heuristics_rst_data:1; // Recevied RST upon SYN with data in the SYN
591 u_int8_t necp_tcp_tfo_heuristics_rst_req:1; // Received RST upon SYN with the TFO-option
592 } necp_tcp_tfo_cache;
593
594 #define NECP_CLIENT_CACHE_TYPE_ECN 1 // Identifies use of necp_tcp_ecn_cache
595 #define NECP_CLIENT_CACHE_TYPE_TFO 2 // Identifies use of necp_tcp_tfo_cache
596
597 #define NECP_CLIENT_CACHE_TYPE_ECN_VER_1 1 // Currently supported version for ECN
598 #define NECP_CLIENT_CACHE_TYPE_TFO_VER_1 1 // Currently supported version for TFO
599
600 typedef struct necp_cache_buffer {
601 u_int8_t necp_cache_buf_type; // NECP_CLIENT_CACHE_TYPE_*
602 u_int8_t necp_cache_buf_ver; // NECP_CLIENT_CACHE_TYPE_*_VER
603 u_int32_t necp_cache_buf_size;
604 mach_vm_address_t necp_cache_buf_addr;
605 } necp_cache_buffer;
606
607 /*
608 * NECP Client definitions
609 */
610 #define NECP_MAX_CLIENT_PARAMETERS_SIZE 1024
611 #define NECP_MAX_CLIENT_RESULT_SIZE 512 // Legacy
612 #define NECP_BASE_CLIENT_RESULT_SIZE 1024
613 #define NECP_CLIENT_FLOW_RESULT_SIZE 512
614
615 #define NECP_OPEN_FLAG_OBSERVER 0x01 // Observers can query clients they don't own
616 #define NECP_OPEN_FLAG_BACKGROUND 0x02 // Mark this fd as backgrounded
617 #define NECP_OPEN_FLAG_PUSH_OBSERVER 0x04 // When used with the OBSERVER flag, allows updates to be pushed. Adding clients is not allowed in this mode.
618
619 #define NECP_FD_SUPPORTS_GUARD 1
620
621 #define NECP_CLIENT_ACTION_ADD 1 // Register a new client. Input: parameters in buffer; Output: client_id
622 #define NECP_CLIENT_ACTION_REMOVE 2 // Unregister a client. Input: client_id, optional struct ifnet_stats_per_flow
623 #define NECP_CLIENT_ACTION_COPY_PARAMETERS 3 // Copy client parameters. Input: client_id; Output: parameters in buffer
624 #define NECP_CLIENT_ACTION_COPY_RESULT 4 // Copy client result. Input: client_id; Output: result in buffer
625 #define NECP_CLIENT_ACTION_COPY_LIST 5 // Copy all client IDs. Output: struct necp_client_list in buffer
626 #define NECP_CLIENT_ACTION_REQUEST_NEXUS_INSTANCE 6 // Request a nexus instance from a nexus provider, optional struct necp_stats_bufreq
627 #define NECP_CLIENT_ACTION_AGENT 7 // Interact with agent. Input: client_id, agent parameters
628 #define NECP_CLIENT_ACTION_COPY_AGENT 8 // Copy agent content. Input: agent UUID; Output: struct netagent
629 #define NECP_CLIENT_ACTION_COPY_INTERFACE 9 // Copy interface details. Input: ifindex cast to UUID; Output: struct necp_interface_details
630 #define NECP_CLIENT_ACTION_SET_STATISTICS 10 // Deprecated
631 #define NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS 11 // Get route statistics. Input: client_id; Output: struct necp_stat_counts
632 #define NECP_CLIENT_ACTION_AGENT_USE 12 // Return the use count and increment the use count. Input/Output: struct necp_agent_use_parameters
633 #define NECP_CLIENT_ACTION_MAP_SYSCTLS 13 // Get the read-only sysctls memory location. Output: mach_vm_address_t
634 #define NECP_CLIENT_ACTION_UPDATE_CACHE 14 // Update heuristics and cache
635 #define NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE 15 // Fetch an updated client for push-mode observer. Output: Client id, struct necp_client_observer_update in buffer
636 #define NECP_CLIENT_ACTION_COPY_UPDATED_RESULT 16 // Copy client result only if changed. Input: client_id; Output: result in buffer
637 #define NECP_CLIENT_ACTION_ADD_FLOW 17 // Add a flow. Input: client_id; Output: struct necp_client_add_flow
638 #define NECP_CLIENT_ACTION_REMOVE_FLOW 18 // Remove a flow. Input: flow_id, optional struct ifnet_stats_per_flow
639 #define NECP_CLIENT_ACTION_CLAIM 19 // Claim a client that has been added for this unique PID. Input: client_id
640 #define NECP_CLIENT_ACTION_SIGN 20 // Sign a query answer. Input: struct necp_client_signable; Output: struct necp_client_signature
641 #define NECP_CLIENT_ACTION_GET_INTERFACE_ADDRESS 21 // Get the best interface local address for given remote address. Input: ifindex, remote sockaddr; Output: matching local sockaddr
642 #define NECP_CLIENT_ACTION_ACQUIRE_AGENT_TOKEN 22 // Get a one-time use token from an agent. Input: agent UUID; Output: token buffer
643 #define NECP_CLIENT_ACTION_VALIDATE 23 // Validate a query answer. Input: struct necp_client_validatable; Output: None
644 #define NECP_CLIENT_ACTION_GET_SIGNED_CLIENT_ID 24 // Get a client ID for the appliction along with a signature.
645 #define NECP_CLIENT_ACTION_SET_SIGNED_CLIENT_ID 25 // Set a client ID for the appliction along with a signature.
646 #define NECP_CLIENT_ACTION_COPY_UPDATED_RESULT_FINAL 26 // Copy client result only if changed, discard data if buffer is too small. Input: client_id; Output: result in buffer
647 #define NECP_CLIENT_ACTION_GET_FLOW_STATISTICS 27 // Get flow statistics for aop flow
648
649 #define NECP_CLIENT_PARAMETER_APPLICATION NECP_POLICY_CONDITION_APPLICATION // Requires entitlement
650 #define NECP_CLIENT_PARAMETER_REAL_APPLICATION NECP_POLICY_CONDITION_REAL_APPLICATION // Requires entitlement
651 #define NECP_CLIENT_PARAMETER_DOMAIN NECP_POLICY_CONDITION_DOMAIN
652 #define NECP_CLIENT_PARAMETER_DOMAIN_OWNER NECP_POLICY_CONDITION_DOMAIN_OWNER
653 #define NECP_CLIENT_PARAMETER_DOMAIN_CONTEXT NECP_POLICY_CONDITION_DOMAIN_CONTEXT
654 #define NECP_CLIENT_PARAMETER_TRACKER_DOMAIN NECP_POLICY_CONDITION_TRACKER_DOMAIN
655 #define NECP_CLIENT_PARAMETER_URL NECP_POLICY_CONDITION_URL
656 #define NECP_CLIENT_PARAMETER_ATTRIBUTED_BUNDLE_IDENTIFIER NECP_POLICY_CONDITION_ATTRIBUTED_BUNDLE_IDENTIFIER
657 #define NECP_CLIENT_PARAMETER_ACCOUNT NECP_POLICY_CONDITION_ACCOUNT
658 #define NECP_CLIENT_PARAMETER_PID NECP_POLICY_CONDITION_PID // Requires entitlement
659 #define NECP_CLIENT_PARAMETER_UID NECP_POLICY_CONDITION_UID // Requires entitlement
660 #define NECP_CLIENT_PARAMETER_BOUND_INTERFACE NECP_POLICY_CONDITION_BOUND_INTERFACE
661 #define NECP_CLIENT_PARAMETER_TRAFFIC_CLASS NECP_POLICY_CONDITION_TRAFFIC_CLASS
662 #define NECP_CLIENT_PARAMETER_IP_PROTOCOL NECP_POLICY_CONDITION_IP_PROTOCOL
663 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS NECP_POLICY_CONDITION_LOCAL_ADDR
664 #define NECP_CLIENT_PARAMETER_REMOTE_ADDRESS NECP_POLICY_CONDITION_REMOTE_ADDR
665 #define NECP_CLIENT_PARAMETER_SCHEME_PORT NECP_POLICY_CONDITION_SCHEME_PORT
666 #define NECP_CLIENT_PARAMETER_APPLICATION_ID NECP_POLICY_CONDITION_APPLICATION_ID
667 #define NECP_CLIENT_PARAMETER_NEXUS_KEY 102
668
669 // "Prohibit" will never choose an interface with that property
670 #define NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE 100 // String, interface name
671 #define NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE 101 // u_int8_t, see ifru_functional_type in <net/if.h>
672 #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT 102 // uuid_t, network agent UUID
673 #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE 103 // struct necp_client_parameter_netagent_type
674
675 // "Require" will choose an interface with that property, or none if not found
676 #define NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE 111 // u_int8_t, see ifru_functional_type in <net/if.h>
677 #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT 112 // uuid_t, network agent UUID
678 #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE 113 // struct necp_client_parameter_netagent_type
679
680 // "Prefer" will choose an interface with an agent, or best otherwise if not found
681 #define NECP_CLIENT_PARAMETER_PREFER_AGENT 122 // uuid_t, network agent UUID
682 #define NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE 123 // struct necp_client_parameter_netagent_type
683
684 // "Avoid" will choose an interface without an agent, or best otherwise if unavoidable
685 #define NECP_CLIENT_PARAMETER_AVOID_AGENT 124 // uuid_t, network agent UUID
686 #define NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE 125 // struct necp_client_parameter_netagent_type
687
688 // Use actions with NECP_CLIENT_ACTION_AGENT
689 #define NECP_CLIENT_PARAMETER_TRIGGER_AGENT 130 // uuid_t, network agent UUID
690 #define NECP_CLIENT_PARAMETER_ASSERT_AGENT 131 // uuid_t, network agent UUID
691 #define NECP_CLIENT_PARAMETER_UNASSERT_AGENT 132 // uuid_t, network agent UUID
692 #define NECP_CLIENT_PARAMETER_AGENT_ADD_GROUP_MEMBERS 133 // struct necp_client_group_action
693 #define NECP_CLIENT_PARAMETER_AGENT_REMOVE_GROUP_MEMBERS 134 // struct necp_client_group_action
694 #define NECP_CLIENT_PARAMETER_REPORT_AGENT_ERROR 135 // int32_t
695
696 #define NECP_CLIENT_PARAMETER_FALLBACK_MODE 140 // u_int8_t, see SO_FALLBACK_MODE_* values
697
698 #define NECP_CLIENT_PARAMETER_PARENT_ID 150 // uuid_t, client UUID
699
700 #define NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT 200 // struct necp_client_endpoint
701 #define NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT 201 // struct necp_client_endpoint
702 #define NECP_CLIENT_PARAMETER_BROWSE_DESCRIPTOR 202 // struct necp_client_endpoint
703 #define NECP_CLIENT_PARAMETER_RESOLVER_TAG 203 // struct necp_client_validatable
704 #define NECP_CLIENT_PARAMETER_ADVERTISE_DESCRIPTOR 204 // struct necp_client_endpoint
705 #define NECP_CLIENT_PARAMETER_GROUP_DESCRIPTOR 205 // struct necp_client_group
706
707 #define NECP_CLIENT_PARAMETER_DELEGATED_UPID 210 // u_int64_t, requires entitlement
708
709 #define NECP_CLIENT_PARAMETER_ETHERTYPE 220 // u_int16_t, ethertype
710 #define NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL 221 // u_int8_t, IPPROTO_
711
712 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE 230 // u_int8_t, NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_
713
714 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_DEFAULT 0
715 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_TEMPORARY 1
716 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_STABLE 2
717
718 #define NECP_CLIENT_PARAMETER_PERSONA_ID 231 // Used to send persona to agents
719
720 #define NECP_CLIENT_PARAMETER_FLAGS 250 // u_int32_t, see NECP_CLIENT_PAREMETER_FLAG_* values
721 #define NECP_CLIENT_PARAMETER_FLOW_DEMUX_PATTERN 251 // struct necp_demux_pattern
722 #define NECP_CLIENT_PARAMETER_EXTENDED_FLAGS 252 // u_int64_t, see NECP_CLIENT_PARAMETER_EXTENDED_FLAG_* values
723
724 #define NECP_CLIENT_PARAMETER_FLAG_MULTIPATH 0x0001 // Get multipath interface results
725 #define NECP_CLIENT_PARAMETER_FLAG_BROWSE 0x0002 // Agent assertions on nexuses are requests to browse
726 #define NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE 0x0004 // Prohibit expensive interfaces
727 #define NECP_CLIENT_PARAMETER_FLAG_LISTENER 0x0008 // Client is interested in listening for inbound connections
728 #define NECP_CLIENT_PARAMETER_FLAG_DISCRETIONARY 0x0010 // Client's traffic is discretionary, and eligible for early defuncting
729 #define NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE 0x0020 // Client is requesting to enable ECN
730 #define NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE 0x0040 // Client is requesting to disable ECN
731 #define NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE 0x0080 // Client is requesting to enable TFO
732 #define NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE 0x0100 // Interpret NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE only for primary interface, and allow exceptions for multipath or listeners
733 #define NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER 0x0200 // Client expects to open a custom ethernet channel
734 #define NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP 0x0400 // Client expects to open a custom IP protocol channel
735 #define NECP_CLIENT_PARAMETER_FLAG_INTERPOSE 0x0800 // Client expects to open an interpose filter channel
736 #define NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED 0x1000 // Prohibit constrained interfaces
737 #define NECP_CLIENT_PARAMETER_FLAG_FALLBACK_TRAFFIC 0x2000 // Fallback traffic
738 #define NECP_CLIENT_PARAMETER_FLAG_INBOUND 0x4000 // Flow is inbound (passive)
739 #define NECP_CLIENT_PARAMETER_FLAG_SYSTEM_PROXY 0x8000 // Flow is a system proxy
740 #define NECP_CLIENT_PARAMETER_FLAG_KNOWN_TRACKER 0x10000 // Flow is contacting a known tracker
741 #define NECP_CLIENT_PARAMETER_FLAG_UNSAFE_SOCKET_ACCESS 0x20000 // Client allows direct access to sockets
742 #define NECP_CLIENT_PARAMETER_FLAG_NON_APP_INITIATED 0x40000 // Networking activities not initiated by application
743 #define NECP_CLIENT_PARAMETER_FLAG_THIRD_PARTY_WEB_CONTENT 0x80000 // Third-party web content, not main load
744 #define NECP_CLIENT_PARAMETER_FLAG_SILENT 0x100000 // Private browsing - do not log/track
745 #define NECP_CLIENT_PARAMETER_FLAG_APPROVED_APP_DOMAIN 0x200000 // Approved associated app domain; domain is "owned" by app
746 #define NECP_CLIENT_PARAMETER_FLAG_NO_WAKE_FROM_SLEEP 0x400000 // Don't wake from sleep on traffic for this client
747 #define NECP_CLIENT_PARAMETER_FLAG_REUSE_LOCAL 0x800000 // Request support for local address/port reuse
748 #define NECP_CLIENT_PARAMETER_FLAG_ENHANCED_PRIVACY 0x1000000 // Attempt protocol upgrade or proxy usage for more privacy
749 #define NECP_CLIENT_PARAMETER_FLAG_WEB_SEARCH_CONTENT 0x2000000 // Web search traffic
750 #define NECP_CLIENT_PARAMETER_FLAG_ALLOW_ULTRA_CONSTRAINED 0x4000000 // Allow ultra-constrained interfaces
751 #define NECP_CLIENT_PARAMETER_FLAG_HAS_ACCOUNT_ID 0x8000000 // Client has provided an account identifier
752 #define NECP_CLIENT_PARAMETER_FLAG_PREFER_COMPANION 0x10000000 // Client prefers companion proxy for internet access
753 #define NECP_CLIENT_PARAMETER_FLAG_AVOID_COMPANION 0x20000000 // Client avoids companion proxy for internet access, potentially falling back
754 #define NECP_CLIENT_PARAMETER_FLAG_REQUIRE_COMPANION 0x40000000 // Client requires connecting to companion
755 #define NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_COMPANION 0x80000000 // Client prohibits connecting to companion
756
757 #define NECP_CLIENT_PARAMETER_EXTENDED_FLAG_AOP2_OFFLOAD 0x0000000000000001 // Flow is offloaded to AOP2
758
759 #define NECP_CLIENT_RESULT_CLIENT_ID 1 // uuid_t
760 #define NECP_CLIENT_RESULT_POLICY_RESULT 2 // u_int32_t
761 #define NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER 3 // u_int32_t
762 #define NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT 4 // u_int32_t
763 #define NECP_CLIENT_RESULT_INTERFACE_INDEX 5 // u_int32_t
764 #define NECP_CLIENT_RESULT_NETAGENT 6 // struct necp_client_result_netagent
765 #define NECP_CLIENT_RESULT_FLAGS 7 // u_int32_t, see NECP_CLIENT_RESULT_FLAG_* values
766 #define NECP_CLIENT_RESULT_INTERFACE 8 // struct necp_client_result_interface
767 #define NECP_CLIENT_RESULT_INTERFACE_OPTION 9 // struct necp_client_interface_option
768 #define NECP_CLIENT_RESULT_EFFECTIVE_MTU 10 // u_int32_t
769 #define NECP_CLIENT_RESULT_FLOW 11 // TLV array of a single flow's state
770 #define NECP_CLIENT_RESULT_PROTO_CTL_EVENT 12
771 #define NECP_CLIENT_RESULT_TFO_COOKIE 13 // NECP_TFO_COOKIE_LEN_MAX
772 #define NECP_CLIENT_RESULT_TFO_FLAGS 14 // u_int8_t
773 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS 15 // u_int8_t
774 #define NECP_CLIENT_RESULT_FLOW_ID 16 // uuid_t
775 #define NECP_CLIENT_RESULT_INTERFACE_TIME_DELTA 17 // u_int32_t, seconds since interface up/down
776 #define NECP_CLIENT_RESULT_REASON 18 // u_int32_t, see NECP_CLIENT_RESULT_REASON_* values
777 #define NECP_CLIENT_RESULT_FLOW_DIVERT_AGGREGATE_UNIT 19 // u_int32_t
778 #define NECP_CLIENT_RESULT_REQUEST_IN_PROCESS_FLOW_DIVERT 20 // Empty
779
780 #define NECP_CLIENT_RESULT_NEXUS_INSTANCE 100 // uuid_t
781 #define NECP_CLIENT_RESULT_NEXUS_PORT 101 // nexus_port_t
782 #define NECP_CLIENT_RESULT_NEXUS_KEY 102 // uuid_t
783 #define NECP_CLIENT_RESULT_NEXUS_PORT_FLOW_INDEX 103 // u_int32_t
784 #define NECP_CLIENT_RESULT_NEXUS_FLOW_STATS 104 // struct sk_stats_flow *
785
786 #define NECP_CLIENT_RESULT_LOCAL_ENDPOINT 200 // struct necp_client_endpoint
787 #define NECP_CLIENT_RESULT_REMOTE_ENDPOINT 201 // struct necp_client_endpoint
788 #define NECP_CLIENT_RESULT_DISCOVERED_ENDPOINT 202 // struct necp_client_endpoint, result of browse
789 #define NECP_CLIENT_RESULT_RESOLVED_ENDPOINT 203 // struct necp_client_endpoint, result of resolve
790 #define NECP_CLIENT_RESULT_LOCAL_ETHER_ADDR 204 // struct ether_addr
791 #define NECP_CLIENT_RESULT_REMOTE_ETHER_ADDR 205 // struct ether_addr
792 #define NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS 210 // u_int32_t
793 #define NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG 211 // u_int32_t, 1: background, 0: not background
794 #define NECP_CLIENT_RESULT_GATEWAY 212 // struct necp_client_endpoint
795 #define NECP_CLIENT_RESULT_GROUP_MEMBER 213 // struct necp_client_endpoint
796 #define NECP_CLIENT_RESULT_NAT64 214 // struct ipv6_prefix[NAT64_MAX_NUM_PREFIXES]
797 #define NECP_CLIENT_RESULT_ESTIMATED_THROUGHPUT 215 // struct necp_client_result_estimated_throughput
798 #define NECP_CLIENT_RESULT_AGENT_ERROR 216 // struct necp_client_result_agent_error
799 #define NECP_CLIENT_RESULT_UNIQUE_FLOW_TAG 217 // u_int32_t
800 #define NECP_CLIENT_RESULT_LINK_QUALITY 218 // int8_t
801 #define NECP_CLIENT_RESULT_FLOW_STATS_INDEX 219 // u_int32_t
802
803 #define NECP_CLIENT_RESULT_FLAG_IS_LOCAL 0x0001 // Routes to this device
804 #define NECP_CLIENT_RESULT_FLAG_IS_DIRECT 0x0002 // Routes to directly accessible peer
805 #define NECP_CLIENT_RESULT_FLAG_HAS_IPV4 0x0004 // Supports IPv4
806 #define NECP_CLIENT_RESULT_FLAG_HAS_IPV6 0x0008 // Supports IPv6
807 #define NECP_CLIENT_RESULT_FLAG_DEFUNCT 0x0010 // Defunct
808 #define NECP_CLIENT_RESULT_FLAG_SATISFIED 0x0020 // Satisfied path
809 #define NECP_CLIENT_RESULT_FLAG_FLOW_ASSIGNED 0x0040 // Assigned, the flow is active
810 #define NECP_CLIENT_RESULT_FLAG_FLOW_VIABLE 0x0080 // Viable, the flow has a valid route
811 #define NECP_CLIENT_RESULT_FLAG_PROBE_CONNECTIVITY 0x0100 // Flow should probe connectivity
812 #define NECP_CLIENT_RESULT_FLAG_ECN_ENABLED 0x0200 // ECN should be used
813 #define NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED 0x0400 // Fast open should not be used
814 #define NECP_CLIENT_RESULT_FLAG_LINK_QUALITY_ABORT 0x0800 // Link quality is very bad, recommend close connections
815 #define NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING 0x1000 // QoS marking is allowed
816 #define NECP_CLIENT_RESULT_FLAG_HAS_NAT64 0x2000 // Has NAT64 prefix
817 #define NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER 0x4000 // Interface is in low-power mode
818 #define NECP_CLIENT_RESULT_FLAG_SPECIFIC_LISTENER 0x8000 // Listener should not listen on all interfaces
819 #define NECP_CLIENT_RESULT_FLAG_KEXT_FILTER_PRESENT 0x10000 // Kernel extension filter present
820 #define NECP_CLIENT_RESULT_FLAG_PF_RULES_PRESENT 0x20000 // Firewall rules present
821 #define NECP_CLIENT_RESULT_FLAG_ALF_PRESENT 0x40000 // Application Firewall enabled
822 #define NECP_CLIENT_RESULT_FLAG_PARENTAL_CONTROLS_PRESENT 0x80000 // Parental Controls present
823 #define NECP_CLIENT_RESULT_FLAG_IS_GLOBAL_INTERNET 0x100000 // Routes to global Internet
824 #define NECP_CLIENT_RESULT_FLAG_LINK_HEURISTICS 0x200000 // Link heuristics enabled
825
826
827 #define NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE (NECP_CLIENT_RESULT_FLAG_HAS_IPV4 | NECP_CLIENT_RESULT_FLAG_HAS_IPV6 | NECP_CLIENT_RESULT_FLAG_HAS_NAT64 | NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER | NECP_CLIENT_RESULT_FLAG_LINK_HEURISTICS)
828
829 #define NECP_CLIENT_RESULT_FAST_OPEN_SND_PROBE 0x01 // DEPRECATED - Fast open send probe
830 #define NECP_CLIENT_RESULT_FAST_OPEN_RCV_PROBE 0x02 // DEPRECATED - Fast open receive probe
831
832 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_NONE 0x01
833 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_LOW 0x02
834 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_MEDIUM 0x04
835
836 #define NECP_CLIENT_RESULT_REASON_EXPENSIVE_PROHIBITED 1 // Expensive networks were prohibited
837 #define NECP_CLIENT_RESULT_REASON_CONSTRAINED_PROHIBITED 2 // Constrained networks were prohibited
838 #define NECP_CLIENT_RESULT_REASON_CELLULAR_DENIED 3 // Denied by a cellular route rule
839 #define NECP_CLIENT_RESULT_REASON_WIFI_DENIED 4 // Denied by a wifi route rule
840 #define NECP_CLIENT_RESULT_REASON_LOCAL_NETWORK_PROHIBITED 5 // Local network access prohibited
841 #define NECP_CLIENT_RESULT_REASON_ULTRA_CONSTRAINED_NOT_ALLOWED 6 // Ultra constrained networks not allowed
842
843 struct necp_interface_signature {
844 u_int8_t signature[IFNET_SIGNATURELEN];
845 u_int8_t signature_len;
846 };
847
848 struct necp_interface_details {
849 char name[IFXNAMSIZ];
850 u_int32_t index;
851 u_int32_t generation;
852 u_int32_t functional_type;
853 u_int32_t delegate_index;
854 u_int32_t flags; // see NECP_INTERFACE_FLAG_*
855 u_int32_t mtu;
856 struct necp_interface_signature ipv4_signature;
857 struct necp_interface_signature ipv6_signature;
858 u_int32_t ipv4_netmask;
859 u_int32_t ipv4_broadcast;
860 /*
861 * This serves as a temporary header guard to protect libnetcore builds
862 * until the xnu changes are available in the build.
863 * XXX: Should be removed in a future build.
864 */
865 #define NECP_INTERFACE_SUPPORTS_TSO 1
866 u_int32_t tso_max_segment_size_v4;
867 u_int32_t tso_max_segment_size_v6;
868 #define NECP_INTERFACE_SUPPORTS_HWCSUM 1
869 u_int32_t hwcsum_flags;
870 u_int8_t radio_type;
871 u_int8_t radio_channel;
872 #define NECP_INTERFACE_SUPPORTS_L4S 1
873 u_int8_t l4s_mode;
874 };
875
876 #define NECP_INTERFACE_FLAG_EXPENSIVE 0x0001
877 #define NECP_INTERFACE_FLAG_TXSTART 0X0002
878 #define NECP_INTERFACE_FLAG_NOACKPRI 0x0004
879 #define NECP_INTERFACE_FLAG_3CARRIERAGG 0x0008
880 #define NECP_INTERFACE_FLAG_IS_LOW_POWER 0x0010
881 #define NECP_INTERFACE_FLAG_MPK_LOG 0x0020 // Multi-layer Packet Logging
882 #define NECP_INTERFACE_FLAG_CONSTRAINED 0x0040
883 #define NECP_INTERFACE_FLAG_HAS_NETMASK 0x0080
884 #define NECP_INTERFACE_FLAG_HAS_BROADCAST 0x0100
885 #define NECP_INTERFACE_FLAG_SUPPORTS_MULTICAST 0x0200
886 #define NECP_INTERFACE_FLAG_HAS_DNS 0x0400
887 #define NECP_INTERFACE_FLAG_HAS_NAT64 0x0800
888 #define NECP_INTERFACE_FLAG_IPV4_ROUTABLE 0x1000
889 #define NECP_INTERFACE_FLAG_IPV6_ROUTABLE 0x2000
890 #define NECP_INTERFACE_FLAG_ULTRA_CONSTRAINED 0x4000
891 #define NECP_INTERFACE_FLAG_LOW_POWER_WAKE 0x8000
892
893 struct necp_client_parameter_netagent_type {
894 char netagent_domain[32];
895 char netagent_type[32];
896 };
897
898 struct necp_client_result_netagent {
899 u_int32_t generation;
900 uuid_t netagent_uuid;
901 };
902
903 struct necp_client_result_interface {
904 u_int32_t generation;
905 u_int32_t index;
906 };
907
908 struct necp_client_result_estimated_throughput {
909 u_int8_t up;
910 u_int8_t down;
911 };
912
913 struct necp_client_result_agent_error {
914 u_int32_t code;
915 u_int8_t domain;
916 };
917
918 #define NECP_USES_INTERFACE_OPTIONS_FOR_BROWSE 1
919
920 struct necp_client_interface_option {
921 u_int32_t interface_index;
922 u_int32_t interface_generation;
923 uuid_t nexus_agent;
924 };
925
926 #define NECP_CLIENT_ENDPOINT_TYPE_APPLICATION_SERVICE 6
927
928 struct necp_client_endpoint {
929 union {
930 struct sockaddr sa;
931 struct sockaddr_in sin;
932 struct sockaddr_in6 sin6;
933 struct {
934 u_int8_t endpoint_length;
935 u_int8_t endpoint_family; // Use AF_UNSPEC to target a name
936 u_int16_t endpoint_port;
937 u_int32_t endpoint_type; // Client-specific type
938 char endpoint_data[0]; // Type-specific endpoint value
939 } endpoint;
940 } u;
941 };
942
943 struct necp_client_group {
944 u_int32_t group_type;
945 uuid_t group_id;
946 };
947
948 struct necp_client_list {
949 u_int32_t client_count;
950 uuid_t clients[0];
951 };
952
953 struct kev_necp_policies_changed_data {
954 u_int32_t changed_count; // Defaults to 0.
955 };
956
957 #define NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS 0x01 // Request a nexus instance upon adding a flow
958 #define NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID 0x02 // Register the client ID rather than the flow registration ID with network agents
959 #define NECP_CLIENT_FLOW_FLAGS_BROWSE 0x04 // Create request with a browse agent
960 #define NECP_CLIENT_FLOW_FLAGS_RESOLVE 0x08 // Create request with a resolution agent
961 #define NECP_CLIENT_FLOW_FLAGS_OVERRIDE_ADDRESS 0x10 // Flow has a different remote address than the parent flow
962 #define NECP_CLIENT_FLOW_FLAGS_OVERRIDE_IP_PROTOCOL 0x20 // Flow has a different IP protocol than the parent flow
963 #define NECP_CLIENT_FLOW_FLAGS_OPEN_FLOW_ON_BEHALF_OF_CLIENT 0x40 // Flow is opened on behalf of a client
964
965 struct necp_client_flow_stats {
966 u_int32_t stats_type; // NECP_CLIENT_STATISTICS_TYPE_*
967 u_int32_t stats_version; // NECP_CLIENT_STATISTICS_TYPE_*_VER
968 u_int32_t stats_size;
969 mach_vm_address_t stats_addr;
970 };
971
972 struct necp_client_add_flow {
973 uuid_t agent_uuid;
974 uuid_t registration_id;
975 u_int16_t flags; // NECP_CLIENT_FLOW_FLAGS_*
976 u_int16_t stats_request_count;
977 struct necp_client_flow_stats stats_requests[0];
978 // sockaddr for override endpoint
979 // uint8 for override ip protocol
980 } __attribute__((__packed__));
981
982 struct necp_agent_use_parameters {
983 uuid_t agent_uuid;
984 uint64_t out_use_count;
985 };
986
987 struct necp_client_group_action {
988 uuid_t agent_uuid;
989 u_int16_t group_member_count;
990 struct necp_client_endpoint group_members[0];
991 } __attribute__((__packed__));
992
993 struct necp_client_flow_protoctl_event {
994 uint32_t protoctl_event_code;
995 uint32_t protoctl_event_val;
996 /* TCP seq number is in host byte order */
997 uint32_t protoctl_event_tcp_seq_num;
998 };
999
1000 #define NECP_CLIENT_UPDATE_TYPE_PARAMETERS 1 // Parameters, for a new client
1001 #define NECP_CLIENT_UPDATE_TYPE_RESULT 2 // Result, for a udpated client
1002 #define NECP_CLIENT_UPDATE_TYPE_REMOVE 3 // Empty, for a removed client
1003
1004 struct necp_client_observer_update {
1005 u_int32_t update_type; // NECP_CLIENT_UPDATE_TYPE_*
1006 u_int8_t tlv_buffer[0]; // Parameters or result as TLVs, based on type
1007 };
1008
1009 // These sign types are tied to specific clients.
1010 // The client_id UUID is then the NECP client UUID that generated the query.
1011 #define NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER 1 // struct necp_client_host_resolver_answer
1012 #define NECP_CLIENT_SIGN_TYPE_BROWSE_RESULT 2 // struct necp_client_browse_result
1013 #define NECP_CLIENT_SIGN_TYPE_SERVICE_RESOLVER_ANSWER 3 // struct necp_client_service_resolver_answer
1014
1015 // These sign types are valid for system-wide use.
1016 // The client_id UUID is a unique per-query UUID.
1017 // These should be generated only on behalf of trusted or entitled processes.
1018 #define NECP_CLIENT_SIGN_TYPE_SYSTEM_RESOLVER_ANSWER 4 // struct necp_client_host_resolver_answer
1019 #define NECP_CLIENT_SIGN_TYPE_SYSTEM_BROWSE_RESULT 5 // struct necp_client_browse_result
1020 #define NECP_CLIENT_SIGN_TYPE_SYSTEM_SERVICE_RESOLVER_ANSWER 6 // struct necp_client_service_resolver_answer
1021
1022 struct necp_client_signature {
1023 u_int8_t signed_tag[32];
1024 } __attribute__((__packed__));
1025
1026 //
1027 struct necp_client_signable {
1028 uuid_t client_id; // Interpretation depends on sign_type
1029 u_int32_t sign_type;
1030 u_int8_t signable_data[0];
1031 } __attribute__((__packed__));
1032
1033 struct necp_client_resolver_answer {
1034 uuid_t client_id;
1035 u_int32_t sign_type;
1036 union sockaddr_in_4_6 address_answer; // Can include port
1037 u_int32_t hostname_length;
1038 char hostname[0];
1039 } __attribute__((__packed__));
1040
1041 struct necp_client_host_resolver_answer {
1042 struct necp_client_signable header;
1043 u_int32_t metadata_hash; // Extra metadata that can be signed along with the answer, such as a network signature.
1044 union sockaddr_in_4_6 address_answer; // Can include port
1045 u_int32_t hostname_length;
1046 char hostname[0];
1047 } __attribute__((__packed__));
1048
1049 struct necp_client_browse_result {
1050 struct necp_client_signable header;
1051 u_int32_t metadata_hash; // Extra metadata that can be signed along with the service, which may include a TXT record or a network signature
1052 u_int16_t service_length;
1053 char service[0];
1054 } __attribute__((__packed__));
1055
1056 struct necp_client_service_resolver_answer {
1057 struct necp_client_signable header;
1058 u_int32_t metadata_hash; // Extra metadata that can be signed along with the service, which may include a TXT record or a network signature
1059 u_int16_t service_length;
1060 u_int16_t port;
1061 u_int16_t hostname_length;
1062 char service[0];
1063 char hostname[0];
1064 } __attribute__((__packed__));
1065
1066 struct necp_client_validatable {
1067 struct necp_client_signature signature;
1068 struct necp_client_signable signable;
1069 } __attribute__((__packed__));
1070
1071 #define NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH 1024
1072
1073 #define NECP_CLIENT_ACTION_SIGN_TAG_LENGTH 32
1074
1075 #define NECP_CLIENT_ACTION_SIGN_DEFAULT_DATA_LENGTH 128
1076 #define NECP_CLIENT_ACTION_SIGN_MAX_TOTAL_LENGTH 4096
1077
1078 #define NECP_FILTER_UNIT_NO_FILTER UINT32_MAX // Reserved filter unit value that prohibits all filters and socket filters
1079
1080 // Type of signed client ID requests.
1081 #define NECP_CLIENT_SIGNED_CLIENT_ID_TYPE_UUID 1 // struct necp_client_signed_client_id_uuid
1082
1083 struct necp_client_signed_client_id_uuid {
1084 uuid_t client_id;
1085 u_int32_t signature_length;
1086 u_int8_t signature_data[NECP_CLIENT_ACTION_SIGN_TAG_LENGTH];
1087 } __attribute__((__packed__));
1088
1089 /*
1090 * The sysctl "net.necp.necp_drop_dest_level" controls the global drop rule policy for
1091 * a set of destinations addresses at the given level -- the drop rule is the last one
1092 * to be evaluated at this level.
1093 */
1094 #define MAX_NECP_DROP_DEST_LEVEL_ADDRS 8
1095
1096 struct necp_drop_dest_entry {
1097 u_int32_t level; // priority level
1098 u_int32_t order; // session order (read only via sysctl)
1099 struct necp_policy_condition_addr cond_addr;
1100 };
1101
1102 struct necp_drop_dest_policy {
1103 u_int32_t entry_count;
1104 struct necp_drop_dest_entry entries[MAX_NECP_DROP_DEST_LEVEL_ADDRS];
1105 };
1106
1107
1108 #define NECP_DEMUX_MAX_LEN 32
1109 struct necp_demux_pattern {
1110 uint16_t offset;
1111 uint16_t len;
1112 uint8_t mask[NECP_DEMUX_MAX_LEN];
1113 uint8_t value[NECP_DEMUX_MAX_LEN];
1114 };
1115
1116 struct necp_flow_statistics {
1117 union {
1118 struct tcp_info tcpi;
1119 } transport;
1120 uint8_t transport_proto;
1121 uint8_t pad[3];
1122 };
1123
1124 #ifdef BSD_KERNEL_PRIVATE
1125 #include <stdbool.h>
1126 #include <sys/socketvar.h>
1127 #include <sys/kern_control.h>
1128 #include <netinet/ip_var.h>
1129 #include <netinet6/ip6_var.h>
1130 #include <net/if_var.h>
1131 #include <sys/syslog.h>
1132 #include <net/network_agent.h>
1133 #include <net/ethernet.h>
1134 #include <os/log.h>
1135 #if SKYWALK
1136 #include <skywalk/namespace/netns.h>
1137 #endif /* SKYWALK */
1138
1139
1140 SYSCTL_DECL(_net_necp);
1141
1142 extern os_log_t necp_log_handle;
1143 extern os_log_t necp_data_trace_log_handle;
1144
1145 #define NECPLOG(level, format, ...) do { \
1146 if (level == LOG_ERR) { \
1147 os_log_error(necp_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \
1148 } else { \
1149 os_log(necp_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \
1150 } \
1151 } while (0)
1152
1153 #define NECPLOG0(level, msg) do { \
1154 if (level == LOG_ERR) { \
1155 os_log_error(necp_log_handle, "%s: %s\n", __FUNCTION__, msg); \
1156 } else { \
1157 os_log(necp_log_handle, "%s: %s\n", __FUNCTION__, msg); \
1158 } \
1159 } while (0)
1160
1161 #define NECPDATATRACELOG(level, format, ...) do { \
1162 if (level == LOG_ERR) { \
1163 os_log_error(necp_data_trace_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \
1164 } else { \
1165 os_log(necp_data_trace_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \
1166 } \
1167 } while (0)
1168
1169 enum necp_fd_type_t {
1170 necp_fd_type_invalid = 0,
1171 necp_fd_type_session = 1,
1172 necp_fd_type_client = 2,
1173 };
1174
1175 union necp_sockaddr_union {
1176 struct sockaddr sa;
1177 struct sockaddr_in sin;
1178 struct sockaddr_in6 sin6;
1179 };
1180
1181 /*
1182 * kstats
1183 * The ustats and kstats region are mirrored. So when we allocate with
1184 * skmem_cache from kstats region, we also get an ustats object. To tie them
1185 * together, kstats has an extra *necp_stats_ustats pointer pointing to the
1186 * ustats object
1187 */
1188 struct necp_all_kstats {
1189 struct necp_all_stats necp_stats_comm; /* kernel private stats snapshot */
1190 struct necp_all_stats *necp_stats_ustats; /* points to user-visible stats (in shared ustats region) */
1191 };
1192
1193 extern void necp_client_init(void);
1194 extern int necp_application_find_policy_match_internal(proc_t proc, u_int8_t *parameters __sized_by(parameters_size), u_int32_t parameters_size,
1195 struct necp_aggregate_result *returned_result,
1196 u_int32_t *flags, u_int32_t *reason, u_int required_interface_index,
1197 const union necp_sockaddr_union *override_local_addr,
1198 const union necp_sockaddr_union *override_remote_addr,
1199 struct necp_client_endpoint *returned_v4_gateway,
1200 struct necp_client_endpoint *returned_v6_gateway,
1201 struct rtentry **returned_route, bool ignore_address,
1202 bool has_client,
1203 uuid_t *returned_override_euuid);
1204 /*
1205 * TLV utilities
1206 *
1207 * Note that these functions (other than necp_buffer_find_tlv) do not check the length of the entire buffer,
1208 * so the caller must be sure that the entire TLV is within bounds.
1209 */
1210 struct necp_tlv_header {
1211 u_int8_t type;
1212 u_int32_t length;
1213 } __attribute__((__packed__));
1214
1215 extern u_int8_t * __counted_by(0) necp_buffer_write_tlv(u_int8_t * __counted_by(0)cursor_, u_int8_t type, u_int32_t length, const void *value __sized_by(length), u_int8_t * buffer __sized_by(buffer_length), u_int32_t buffer_length);
1216 extern u_int8_t * __counted_by(0) necp_buffer_write_tlv_if_different(u_int8_t * __counted_by(0)cursor_, u_int8_t type,
1217 u_int32_t length, const void *value __sized_by(length), bool *updated,
1218 u_int8_t * buffer __sized_by(buffer_length), u_int32_t buffer_length);
1219 extern u_int8_t necp_buffer_get_tlv_type(u_int8_t * __counted_by(buffer_length)buffer, size_t buffer_length, u_int32_t tlv_offset);
1220 extern u_int32_t necp_buffer_get_tlv_length(u_int8_t * __counted_by(buffer_length)buffer, size_t buffer_length, u_int32_t tlv_offset);
1221 extern u_int8_t *__sized_by(*value_size) __necp_buffer_get_tlv_value(u_int8_t * __counted_by(buffer_length)buffer, size_t buffer_length, u_int32_t tlv_offset, u_int32_t * value_size);
1222 extern int necp_buffer_find_tlv(u_int8_t * buffer __sized_by(buffer_length), u_int32_t buffer_length, int offset, u_int8_t type, int *err, int next);
1223
1224 /*
1225 * Inline shim to safely convert the result of `__necp_buffer_get_tlv_value'
1226 * to an indexable pointer, when appropriate.
1227 */
1228 __attribute__((always_inline))
1229 static inline u_int8_t * __header_indexable
necp_buffer_get_tlv_value(u_int8_t * __counted_by (buffer_length)buffer,size_t buffer_length,u_int32_t tlv_offset,u_int32_t * value_size)1230 necp_buffer_get_tlv_value(u_int8_t * __counted_by(buffer_length)buffer, size_t buffer_length, u_int32_t tlv_offset, u_int32_t *value_size)
1231 {
1232 u_int32_t ensured_value_size = 0;
1233 u_int8_t *value = __necp_buffer_get_tlv_value(buffer, buffer_length, tlv_offset, &ensured_value_size);
1234 if (value_size) {
1235 *value_size = ensured_value_size;
1236 }
1237 return value;
1238 }
1239
1240 #define NECPCTL_DROP_ALL_LEVEL 1 /* Drop all packets if no policy matches above this level */
1241 #define NECPCTL_DEBUG 2 /* Log all kernel policy matches */
1242 #define NECPCTL_PASS_LOOPBACK 3 /* Pass all loopback traffic */
1243 #define NECPCTL_PASS_KEEPALIVES 4 /* Pass all kernel-generated keepalive traffic */
1244 #define NECPCTL_SOCKET_POLICY_COUNT 5 /* Count of all socket-level policies */
1245 #define NECPCTL_SOCKET_NON_APP_POLICY_COUNT 6 /* Count of non-per-app socket-level policies */
1246 #define NECPCTL_IP_POLICY_COUNT 7 /* Count of all ip-level policies */
1247 #define NECPCTL_SESSION_COUNT 8 /* Count of NECP sessions */
1248 #define NECPCTL_CLIENT_FD_COUNT 9 /* Count of NECP client fds */
1249 #define NECPCTL_CLIENT_COUNT 10 /* Count of NECP clients */
1250 #define NECPCTL_ARENA_COUNT 11 /* Count of NECP arenas (stats, etc) */
1251 #define NECPCTL_NEXUS_FLOW_COUNT 12 /* Count of NECP nexus flows */
1252 #define NECPCTL_SOCKET_FLOW_COUNT 13 /* Count of NECP socket flows */
1253 #define NECPCTL_IF_FLOW_COUNT 14 /* Count of NECP socket flows */
1254 #define NECPCTL_OBSERVER_FD_COUNT 15 /* Count of NECP observer fds */
1255 #define NECPCTL_OBSERVER_MESSAGE_LIMIT 16 /* Number of of NECP observer messages allowed to be queued */
1256 #define NECPCTL_SYSCTL_ARENA_COUNT 17 /* Count of sysctl arenas */
1257 #define NECPCTL_DROP_UNENTITLED_LEVEL 18 /* Drop unentitled process traffic above this level */
1258 #define NECPCTL_PASS_INTERPOSE 19 /* Pass interpose */
1259 #define NECPCTL_RESTRICT_MULTICAST 20 /* Restrict multicast access */
1260 #define NECPCTL_DEDUP_POLICIES 21 /* Dedup overlapping policies */
1261 #define NECPCTL_CLIENT_TRACING_LEVEL 22 /* Client tracing level */
1262 #define NECPCTL_CLIENT_TRACING_PID 23 /* Apply client tracing only to specified pid */
1263 #define NECPCTL_DROP_MANAGEMENT_LEVEL 24 /* Drop management traffic at this level */
1264 #define NECPCTL_TRIE_COUNT 25 /* Count of tries */
1265
1266 #define NECP_LOOPBACK_PASS_ALL 1 // Pass all loopback traffic
1267 #define NECP_LOOPBACK_PASS_WITH_FILTER 2 // Pass all loopback traffic, but activate content filter and/or flow divert if applicable
1268
1269 #define NECPCTL_NAMES { \
1270 { 0, 0 }, \
1271 { "drop_all_level", CTLTYPE_INT }, \
1272 { "debug", CTLTYPE_INT }, \
1273 { "pass_loopback", CTLTYPE_INT }, \
1274 { "pass_keepalives", CTLTYPE_INT }, \
1275 { "pass_interpose", CTLTYPE_INT }, \
1276 }
1277
1278 typedef u_int32_t necp_kernel_policy_id;
1279 #define NECP_KERNEL_POLICY_ID_NONE 0
1280 #define NECP_KERNEL_POLICY_ID_NO_MATCH 1
1281 #define NECP_KERNEL_POLICY_ID_FIRST_VALID_SOCKET 2
1282 #define NECP_KERNEL_POLICY_ID_FIRST_VALID_IP UINT16_MAX
1283
1284 typedef u_int32_t necp_app_id;
1285
1286 #define NECP_KERNEL_POLICY_RESULT_NONE 0
1287 #define NECP_KERNEL_POLICY_RESULT_PASS NECP_POLICY_RESULT_PASS
1288 #define NECP_KERNEL_POLICY_RESULT_SKIP NECP_POLICY_RESULT_SKIP
1289 #define NECP_KERNEL_POLICY_RESULT_DROP NECP_POLICY_RESULT_DROP
1290 #define NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT NECP_POLICY_RESULT_SOCKET_DIVERT
1291 #define NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER NECP_POLICY_RESULT_SOCKET_FILTER
1292 #define NECP_KERNEL_POLICY_RESULT_IP_TUNNEL NECP_POLICY_RESULT_IP_TUNNEL
1293 #define NECP_KERNEL_POLICY_RESULT_IP_FILTER NECP_POLICY_RESULT_IP_FILTER
1294 #define NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED NECP_POLICY_RESULT_SOCKET_SCOPED
1295 #define NECP_KERNEL_POLICY_RESULT_ROUTE_RULES NECP_POLICY_RESULT_ROUTE_RULES
1296 #define NECP_KERNEL_POLICY_RESULT_USE_NETAGENT NECP_POLICY_RESULT_USE_NETAGENT
1297 #define NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED NECP_POLICY_RESULT_NETAGENT_SCOPED
1298 #define NECP_KERNEL_POLICY_RESULT_SCOPED_DIRECT NECP_POLICY_RESULT_SCOPED_DIRECT
1299 #define NECP_KERNEL_POLICY_RESULT_ALLOW_UNENTITLED NECP_POLICY_RESULT_ALLOW_UNENTITLED
1300 #define NECP_KERNEL_POLICY_RESULT_REMOVE_NETAGENT NECP_POLICY_RESULT_REMOVE_NETAGENT
1301 #define NECP_KERNEL_POLICY_RESULT_REMOVE_NETAGENT_TYPE NECP_POLICY_RESULT_REMOVE_NETAGENT_TYPE
1302
1303 #define NECP_KERNEL_POLICY_PASS_NO_SKIP_IPSEC NECP_POLICY_PASS_NO_SKIP_IPSEC
1304 #define NECP_KERNEL_POLICY_PASS_PF_TAG NECP_POLICY_PASS_PF_TAG
1305
1306 #define NECP_KERNEL_POLICY_DROP_FLAG_LOCAL_NETWORK NECP_POLICY_DROP_FLAG_LOCAL_NETWORK
1307 #define NECP_KERNEL_POLICY_DROP_FLAG_SUPPRESS_ALERTS NECP_POLICY_DROP_FLAG_SUPPRESS_ALERTS
1308 #define NECP_KERNEL_POLICY_DROP_FLAG_DEFUNCT_ALL_FLOWS NECP_POLICY_DROP_FLAG_DEFUNCT_ALL_FLOWS
1309
1310 typedef union {
1311 u_int tunnel_interface_index;
1312 u_int scoped_interface_index;
1313 u_int32_t flow_divert_control_unit;
1314 u_int32_t filter_control_unit;
1315 u_int32_t skip_policy_order;
1316 u_int32_t route_rule_id;
1317 u_int32_t netagent_id;
1318 u_int32_t pass_flags;
1319 u_int32_t drop_flags;
1320 } necp_kernel_policy_result_parameter;
1321
1322 enum necp_boolean_state {
1323 necp_boolean_state_unknown = 0,
1324 necp_boolean_state_false = 1,
1325 necp_boolean_state_true = 2,
1326 };
1327
1328 struct necp_kernel_socket_policy {
1329 LIST_ENTRY(necp_kernel_socket_policy) chain;
1330 necp_kernel_policy_id id;
1331 necp_policy_order order;
1332 u_int32_t session_order;
1333 int session_pid;
1334
1335 u_int64_t condition_mask;
1336 u_int64_t condition_negated_mask;
1337 u_int32_t cond_client_flags;
1338 necp_kernel_policy_id cond_policy_id;
1339 u_int32_t cond_app_id; // Locally assigned ID value stored
1340 u_int32_t cond_real_app_id; // Locally assigned ID value stored
1341 char *cond_custom_entitlement __null_terminated; // String
1342 u_int32_t cond_account_id; // Locally assigned ID value stored
1343 char *cond_domain __null_terminated; // String
1344 u_int8_t cond_domain_dot_count; // Number of dots in cond_domain
1345 u_int32_t cond_domain_filter;
1346 pid_t cond_pid;
1347 uid_t cond_uid;
1348 uid_t cond_real_uid;
1349 ifnet_t cond_bound_interface; // Matches specific binding only
1350 struct necp_policy_condition_tc_range cond_traffic_class; // Matches traffic class in range
1351 u_int16_t cond_protocol; // Matches IP protcol number
1352 union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
1353 union necp_sockaddr_union cond_local_end; // Matches IP address range
1354 u_int8_t cond_local_prefix; // Defines subnet
1355 union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
1356 union necp_sockaddr_union cond_remote_end; // Matches IP address range
1357 u_int8_t cond_remote_prefix; // Defines subnet
1358 struct necp_policy_condition_agent_type cond_agent_type;
1359 struct necp_policy_condition_sdk_version cond_sdk_version;
1360 char *cond_signing_identifier __null_terminated; // String
1361 char *cond_url __null_terminated;// String
1362 u_int16_t cond_packet_filter_tags;
1363 u_int16_t cond_scheme_port;
1364 int32_t cond_pid_version;
1365 u_int32_t cond_bound_interface_flags;
1366 u_int32_t cond_bound_interface_eflags;
1367 u_int32_t cond_bound_interface_xflags;
1368 u_int8_t cond_local_networks_flags;
1369
1370 necp_kernel_policy_result result;
1371 necp_kernel_policy_result_parameter result_parameter;
1372 };
1373
1374 struct necp_kernel_ip_output_policy {
1375 LIST_ENTRY(necp_kernel_ip_output_policy) chain;
1376 necp_kernel_policy_id id;
1377 necp_policy_order suborder;
1378 necp_policy_order order;
1379 u_int32_t session_order;
1380 int session_pid;
1381
1382 u_int64_t condition_mask;
1383 u_int64_t condition_negated_mask;
1384 necp_kernel_policy_id cond_policy_id;
1385 ifnet_t cond_bound_interface; // Matches specific binding only
1386 u_int16_t cond_protocol; // Matches IP protcol number
1387 union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
1388 union necp_sockaddr_union cond_local_end; // Matches IP address range
1389 u_int8_t cond_local_prefix; // Defines subnet
1390 union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
1391 union necp_sockaddr_union cond_remote_end; // Matches IP address range
1392 u_int8_t cond_remote_prefix; // Defines subnet
1393 u_int32_t cond_last_interface_index;
1394 u_int16_t cond_packet_filter_tags;
1395 u_int16_t cond_scheme_port;
1396 u_int32_t cond_bound_interface_flags;
1397 u_int32_t cond_bound_interface_eflags;
1398 u_int32_t cond_bound_interface_xflags;
1399 u_int8_t cond_local_networks_flags;
1400
1401 necp_kernel_policy_result result;
1402 necp_kernel_policy_result_parameter result_parameter;
1403 };
1404
1405 #define MAX_KERNEL_SOCKET_POLICIES 1
1406 #define MAX_KERNEL_IP_OUTPUT_POLICIES 4
1407 struct necp_session_policy {
1408 LIST_ENTRY(necp_session_policy) chain;
1409 bool applied; // Applied into the kernel table
1410 bool pending_deletion; // Waiting to be removed from kernel table
1411 bool pending_update; // Policy has been modified since creation/last application
1412 necp_policy_id local_id;
1413 necp_policy_order order;
1414 u_int32_t result_size;
1415 u_int8_t *result __sized_by(result_size);
1416 u_int32_t conditions_size;
1417 u_int8_t *conditions __sized_by(conditions_size); // Array of conditions, each with a u_int32_t length at start
1418 u_int32_t route_rules_size;
1419 u_int8_t *route_rules __sized_by(route_rules_size); // Array of route rules, each with a u_int32_t length at start
1420
1421 uuid_t applied_app_uuid;
1422 uuid_t applied_real_app_uuid;
1423 u_int32_t applied_account_size;
1424 char *applied_account __sized_by(applied_account_size);
1425
1426 uuid_t applied_result_uuid;
1427
1428 u_int32_t applied_agent_type_id;
1429
1430 u_int32_t applied_route_rules_id;
1431
1432 necp_kernel_policy_id kernel_socket_policies[MAX_KERNEL_SOCKET_POLICIES];
1433 necp_kernel_policy_id kernel_ip_output_policies[MAX_KERNEL_IP_OUTPUT_POLICIES];
1434 };
1435
1436 struct necp_aggregate_socket_result {
1437 necp_kernel_policy_result result;
1438 necp_kernel_policy_result_parameter result_parameter;
1439 necp_kernel_policy_filter filter_control_unit;
1440 u_int32_t flow_divert_aggregate_unit;
1441 u_int32_t route_rule_id;
1442 int32_t qos_marking_gencount;
1443 };
1444
1445 struct necp_inpcb_result {
1446 u_int32_t app_id;
1447 necp_kernel_policy_id policy_id;
1448 necp_kernel_policy_id skip_policy_id;
1449 int32_t policy_gencount;
1450 u_int32_t flowhash;
1451 u_int32_t network_denied_notifies;// Notification count
1452 struct necp_aggregate_socket_result results;
1453 };
1454
1455 extern void necp_init(void);
1456
1457 struct inp_necp_attributes;
1458 extern errno_t necp_set_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt);
1459 extern errno_t necp_get_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt);
1460 extern errno_t necp_set_socket_domain_attributes(struct socket *so, const char *domain __null_terminated, const char *domain_owner __null_terminated);
1461 extern int necp_set_socket_resolver_signature(struct inpcb *inp, struct sockopt *sopt);
1462 extern int necp_get_socket_resolver_signature(struct inpcb *inp, struct sockopt *sopt);
1463 extern bool necp_socket_has_resolver_signature(struct inpcb *inp);
1464 extern bool necp_socket_resolver_signature_matches_address(struct inpcb *inp, union necp_sockaddr_union *address);
1465 extern void necp_inpcb_remove_cb(struct inpcb *inp);
1466 extern void necp_inpcb_dispose(struct inpcb *inp);
1467
1468 extern u_int32_t necp_socket_get_content_filter_control_unit(struct socket *so);
1469 extern u_int32_t necp_socket_get_policy_gencount(struct socket *so);
1470
1471 extern bool necp_socket_should_use_flow_divert(struct inpcb *inp);
1472 extern u_int32_t necp_socket_get_flow_divert_control_unit(struct inpcb *inp, uint32_t *aggregate_unit);
1473
1474 extern bool necp_socket_should_rescope(struct inpcb *inp);
1475 extern u_int necp_socket_get_rescope_if_index(struct inpcb *inp);
1476 extern u_int32_t necp_socket_get_effective_mtu(struct inpcb *inp, u_int32_t current_mtu);
1477
1478 extern bool necp_socket_is_allowed_to_recv_on_interface(struct inpcb *inp, ifnet_t interface);
1479
1480 extern bool necp_socket_is_allowed_to_send_recv(struct inpcb *inp, ifnet_t input_interface, u_int16_t pf_tag,
1481 necp_kernel_policy_id *return_policy_id,
1482 u_int32_t *return_route_rule_id,
1483 necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags);
1484 extern bool necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port,
1485 u_int16_t remote_port, struct in_addr *local_addr,
1486 struct in_addr *remote_addr, ifnet_t input_interface, u_int16_t pf_tag,
1487 necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id,
1488 necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags);
1489 extern bool necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port,
1490 u_int16_t remote_port, struct in6_addr *local_addr,
1491 struct in6_addr *remote_addr, ifnet_t input_interface, u_int16_t pf_tag,
1492 necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id,
1493 necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags);
1494 extern void necp_socket_update_qos_marking(struct inpcb *inp, struct rtentry *route, u_int32_t route_rule_id);
1495 extern bool necp_lookup_current_qos_marking(int32_t *qos_marking_gencount, struct rtentry *route, struct ifnet *interface, u_int32_t route_rule_id, bool old_qos_marking);
1496 extern int necp_mark_packet_from_socket(struct mbuf *packet, struct inpcb *inp, necp_kernel_policy_id policy_id,
1497 u_int32_t route_rule_id, necp_kernel_policy_id skip_policy_id, u_int32_t pass_flags);
1498 extern necp_kernel_policy_id necp_get_policy_id_from_packet(struct mbuf *packet);
1499 extern necp_kernel_policy_id necp_get_skip_policy_id_from_packet(struct mbuf *packet);
1500 extern u_int16_t necp_get_packet_filter_tags_from_packet(struct mbuf *packet);
1501 extern bool necp_packet_should_skip_filters(struct mbuf *packet);
1502 extern u_int32_t necp_get_last_interface_index_from_packet(struct mbuf *packet);
1503 extern u_int32_t necp_get_route_rule_id_from_packet(struct mbuf *packet);
1504 extern int necp_get_app_uuid_from_packet(struct mbuf *packet,
1505 uuid_t app_uuid);
1506
1507 extern necp_kernel_policy_id necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local_addr,
1508 struct sockaddr *override_remote_addr, u_int32_t override_bound_interface);
1509 extern necp_kernel_policy_id necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_args *ipoa,
1510 struct rtentry *rt,
1511 necp_kernel_policy_result *result,
1512 necp_kernel_policy_result_parameter *result_parameter);
1513 extern necp_kernel_policy_id necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out_args *ip6oa,
1514 struct rtentry *rt,
1515 necp_kernel_policy_result *result,
1516 necp_kernel_policy_result_parameter *result_parameter);
1517
1518 extern int necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id);
1519 extern int necp_mark_packet_from_ip_with_skip(struct mbuf *packet, necp_kernel_policy_id policy_id, necp_kernel_policy_id skip_policy_id);
1520 extern int necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface);
1521
1522 extern ifnet_t necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter);
1523 extern bool necp_packet_can_rebind_to_ifnet(struct mbuf *packet, struct ifnet *interface, struct route *new_route, int family);
1524
1525 extern bool necp_packet_is_allowed_over_interface(struct mbuf *packet, struct ifnet *interface);
1526
1527 extern int necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive);
1528 extern bool necp_get_is_keepalive_from_packet(struct mbuf *packet);
1529
1530 extern int necp_sign_resolver_answer(uuid_t client_id, u_int32_t sign_type,
1531 u_int8_t *data, size_t data_length,
1532 u_int8_t *tag, size_t *out_tag_length);
1533
1534 extern bool necp_validate_resolver_answer(uuid_t client_id, u_int32_t sign_type,
1535 u_int8_t *data __sized_by(data_length), size_t data_length,
1536 u_int8_t *tag __sized_by(tag_length), size_t tag_length);
1537
1538 extern int necp_sign_application_id(uuid_t client_id, u_int32_t sign_type,
1539 u_int8_t *__counted_by(*out_tag_length) tag, size_t *out_tag_length);
1540
1541 extern bool necp_validate_application_id(uuid_t client_id, u_int32_t sign_type,
1542 u_int8_t *tag __sized_by(tag_length), size_t tag_length);
1543
1544 extern void necp_update_all_clients(void); // Handle general re-evaluate event
1545 extern void necp_update_all_clients_immediately_if_needed(bool should_update_immediately); // Handle general re-evaluate event
1546
1547 extern void necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid, u_int32_t agent_generation); // Cause a single client to get an update event
1548
1549 extern bool necp_set_client_as_background(proc_t proc, struct fileproc *fp, bool background); // Set all clients for an fp as background or not
1550
1551 struct necp_fd_data;
1552 extern void necp_fd_memstatus(proc_t proc, uint32_t status, struct necp_fd_data *client_fd); // Purge memory of clients for the process
1553 extern void necp_fd_defunct(proc_t proc, struct necp_fd_data *client_fd); // Set all clients for an process as defunct
1554
1555 extern void necp_client_request_in_process_flow_divert(pid_t pid);
1556
1557 extern int necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp);
1558
1559 extern int necp_client_register_socket_listener(pid_t pid, uuid_t client_id, struct inpcb *inp);
1560
1561 #if SKYWALK
1562 extern int necp_client_get_netns_flow_info(uuid_t client_id, struct ns_flow_info *flow_info);
1563 #endif /* SKYWALK */
1564
1565 extern int necp_client_assert_bb_radio_manager(uuid_t client_id, bool assert);
1566
1567 extern int necp_client_assign_from_socket(pid_t pid, uuid_t client_id, struct inpcb *inp);
1568
1569 extern int necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id,
1570 u_int8_t *assigned_results __sized_by(assigned_results_length), size_t assigned_results_length);
1571 extern int necp_assign_client_group_members(uuid_t netagent_uuid, uuid_t client_id,
1572 u_int8_t *__counted_by(assigned_group_members_length) assigned_group_members,
1573 size_t assigned_group_members_length);
1574
1575 struct skmem_obj_info; // forward declaration
1576 extern int necp_stats_ctor(struct skmem_obj_info *oi, struct skmem_obj_info *oim, void *arg, uint32_t skmflag);
1577 extern int necp_stats_dtor(void *addr, void *arg);
1578
1579 /* value to denote invalid flow advisory index */
1580 struct netagent_session;
1581 extern int
1582 necp_update_flow_protoctl_event(uuid_t netagent_uuid, uuid_t client_id,
1583 uint32_t protoctl_event_code, uint32_t protoctl_event_val,
1584 uint32_t protoctl_event_tcp_seq_num);
1585
1586 #define NECP_FLOWADV_IDX_INVALID UINT32_MAX
1587 extern void * __sized_by(*message_length) necp_create_nexus_assign_message(uuid_t nexus_instance, nexus_port_t nexus_port, void *key __sized_by(key_length), uint32_t key_length,
1588 struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint,
1589 struct ether_addr *local_ether_addr,
1590 u_int32_t flow_adv_index, void *flow_stats, uint32_t flow_id, size_t *message_length);
1591
1592
1593 #define NECP_MAX_DEMUX_PATTERNS 4
1594 struct necp_client_nexus_parameters {
1595 pid_t pid;
1596 pid_t epid;
1597 uuid_t euuid;
1598 #if SKYWALK
1599 netns_token port_reservation;
1600 #else /* !SKYWALK */
1601 void *reserved;
1602 #endif /* !SKYWALK */
1603 union necp_sockaddr_union local_addr;
1604 union necp_sockaddr_union remote_addr;
1605 u_int8_t ip_protocol;
1606 u_int8_t transport_protocol;
1607 u_int16_t ethertype;
1608 u_int32_t traffic_class;
1609 necp_policy_id policy_id;
1610 necp_policy_id skip_policy_id;
1611 unsigned is_listener:1;
1612 unsigned is_interpose:1;
1613 unsigned is_custom_ether:1;
1614 unsigned allow_qos_marking:1;
1615 unsigned override_address_selection:1;
1616 unsigned use_stable_address:1; // Used if override_address_selection is set
1617 unsigned no_wake_from_sleep:1;
1618 unsigned is_demuxable_parent:1;
1619 unsigned reuse_port:1;
1620 unsigned use_aop_offload:1;
1621
1622 uuid_t parent_flow_uuid;
1623 struct necp_demux_pattern demux_patterns[NECP_MAX_DEMUX_PATTERNS];
1624 uint8_t demux_pattern_count;
1625 };
1626
1627 struct necp_client_group_members {
1628 size_t group_members_length;
1629 u_int8_t *group_members __sized_by(group_members_length);
1630 };
1631
1632 struct necp_client_error_parameters {
1633 int32_t error;
1634 bool force_report;
1635 };
1636
1637 struct necp_client_agent_parameters {
1638 union {
1639 struct necp_client_nexus_parameters nexus_request;
1640 u_int8_t close_token[QUIC_STATELESS_RESET_TOKEN_SIZE];
1641 struct necp_client_group_members group_members;
1642 struct necp_client_error_parameters error;
1643 } u;
1644 };
1645
1646 #define NECP_CLIENT_CBACTION_NONVIABLE 1
1647 #define NECP_CLIENT_CBACTION_VIABLE 2
1648 #define NECP_CLIENT_CBACTION_INITIAL 3
1649
1650 struct necp_client_add_flow_default {
1651 uuid_t agent_uuid;
1652 uuid_t registration_id;
1653 u_int16_t flags; // NECP_CLIENT_FLOW_FLAGS_*
1654 u_int16_t stats_request_count;
1655 struct necp_client_flow_stats stats_requests[1];
1656 } __attribute__((__packed__));
1657
1658 typedef void (*necp_client_flow_cb)(void *handle, int action, uint32_t interface_index, uint32_t necp_flags, bool *viable);
1659
1660 #if SKYWALK
1661 struct skmem_arena_mmap_info;
1662
1663 extern pid_t necp_client_get_proc_pid_from_arena_info(struct skmem_arena_mmap_info *arena_info);
1664
1665 extern void necp_client_early_close(uuid_t client_id); // Cause a single client to close stats, etc
1666
1667 #endif /* SKYWALK */
1668
1669 #endif /* BSD_KERNEL_PRIVATE */
1670
1671 #ifdef KERNEL
1672 #ifdef KERNEL_PRIVATE
1673 struct nstat_domain_info;
1674 extern void necp_copy_inp_domain_info(struct inpcb *, struct socket *, struct nstat_domain_info *);
1675 extern void necp_with_inp_domain_name(struct socket *so, void *ctx, void (*with_func)(char *domain_name __null_terminated, void *ctx));
1676 extern bool net_domain_contains_hostname(char *hostname_string __null_terminated, char *domain_string __null_terminated);
1677 #endif /* KERNEL_PRIVATE */
1678 #endif /* KERNEL */
1679
1680 #ifndef KERNEL
1681
1682 extern int necp_match_policy(const uint8_t *parameters, size_t parameters_size, struct necp_aggregate_result *returned_result);
1683
1684 extern int necp_open(int flags);
1685
1686 extern int necp_client_action(int necp_fd, uint32_t action, uuid_t client_id,
1687 size_t client_id_len, uint8_t *buffer, size_t buffer_size);
1688
1689 extern int necp_session_open(int flags);
1690
1691 extern int necp_session_action(int necp_fd, uint32_t action,
1692 uint8_t *in_buffer, size_t in_buffer_length,
1693 uint8_t *out_buffer, size_t out_buffer_length);
1694
1695 #endif /* !KERNEL */
1696
1697 #endif /* PRIVATE */
1698
1699 #endif
1700