1 /* 2 * Copyright (c) 2013-2021 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 29 #ifndef _NET_NECP_H_ 30 #define _NET_NECP_H_ 31 32 #include <net/net_kev.h> 33 #ifdef PRIVATE 34 35 #include <netinet/in.h> 36 #include <netinet/in_stat.h> 37 #include <sys/socket.h> 38 #include <net/if.h> 39 40 /* 41 * Name registered by the NECP 42 */ 43 #define NECP_CONTROL_NAME "com.apple.net.necp_control" 44 45 #define NECP_TLV_LENGTH_UINT32 1 46 47 struct necp_packet_header { 48 u_int8_t packet_type; 49 u_int8_t flags; 50 u_int32_t message_id; 51 }; 52 53 /* 54 * Control message commands 55 */ 56 #define NECP_PACKET_TYPE_POLICY_ADD 1 57 #define NECP_PACKET_TYPE_POLICY_GET 2 58 #define NECP_PACKET_TYPE_POLICY_DELETE 3 59 #define NECP_PACKET_TYPE_POLICY_APPLY_ALL 4 60 #define NECP_PACKET_TYPE_POLICY_LIST_ALL 5 61 #define NECP_PACKET_TYPE_POLICY_DELETE_ALL 6 62 #define NECP_PACKET_TYPE_SET_SESSION_PRIORITY 7 63 #define NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC 8 64 #define NECP_PACKET_TYPE_REGISTER_SERVICE 9 65 #define NECP_PACKET_TYPE_UNREGISTER_SERVICE 10 66 #define NECP_PACKET_TYPE_POLICY_DUMP_ALL 11 67 68 /* 69 * Session actions 70 */ 71 #define NECP_SESSION_ACTION_POLICY_ADD 1 // In: Policy TLVs Out: necp_policy_id 72 #define NECP_SESSION_ACTION_POLICY_GET 2 // In: necp_policy_id Out: Policy TLVs 73 #define NECP_SESSION_ACTION_POLICY_DELETE 3 // In: necp_policy_id Out: None 74 #define NECP_SESSION_ACTION_POLICY_APPLY_ALL 4 // In: None Out: None 75 #define NECP_SESSION_ACTION_POLICY_LIST_ALL 5 // In: None Out: TLVs of IDs 76 #define NECP_SESSION_ACTION_POLICY_DELETE_ALL 6 // In: None Out: None 77 #define NECP_SESSION_ACTION_SET_SESSION_PRIORITY 7 // In: necp_session_priority Out: None 78 #define NECP_SESSION_ACTION_LOCK_SESSION_TO_PROC 8 // In: None Out: None 79 #define NECP_SESSION_ACTION_REGISTER_SERVICE 9 // In: uuid_t Out: None 80 #define NECP_SESSION_ACTION_UNREGISTER_SERVICE 10 // In: uuid_t Out: None 81 #define NECP_SESSION_ACTION_POLICY_DUMP_ALL 11 // In: None Out: uint32_t bytes length, then Policy TLVs 82 #define NECP_SESSION_ACTION_ADD_DOMAIN_FILTER 12 // In: struct net_bloom_filter Out: uint32_t, ID 83 #define NECP_SESSION_ACTION_REMOVE_DOMAIN_FILTER 13 // In: uint32_t, ID Out: None 84 #define NECP_SESSION_ACTION_REMOVE_ALL_DOMAIN_FILTERS 14 // In: None Out: None 85 86 /* 87 * Control message flags 88 */ 89 #define NECP_PACKET_FLAGS_RESPONSE 0x01 // Used for acks, errors, and query responses 90 91 /* 92 * Control message TLV types 93 */ 94 #define NECP_TLV_NIL 0 95 #define NECP_TLV_ERROR 1 // u_int32_t 96 #define NECP_TLV_POLICY_ORDER 2 // u_int32_t 97 #define NECP_TLV_POLICY_CONDITION 3 98 #define NECP_TLV_POLICY_RESULT 4 99 #define NECP_TLV_POLICY_ID 5 // u_int32_t 100 #define NECP_TLV_SESSION_PRIORITY 6 // u_int32_t 101 #define NECP_TLV_ATTRIBUTE_DOMAIN 7 // char[] 102 #define NECP_TLV_ATTRIBUTE_ACCOUNT 8 // char[] 103 #define NECP_TLV_SERVICE_UUID 9 // uuid_t 104 #define NECP_TLV_ROUTE_RULE 10 105 #define NECP_TLV_ATTRIBUTE_DOMAIN_OWNER 11 // char[] 106 #define NECP_TLV_ATTRIBUTE_TRACKER_DOMAIN 12 // char[] 107 #define NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT 13 // char[] 108 109 /* 110 * Control message TLV sent only by the kernel to userspace 111 */ 112 #define NECP_TLV_POLICY_OWNER 100 // char [] 113 #define NECP_TLV_POLICY_DUMP 101 114 #define NECP_TLV_POLICY_RESULT_STRING 102 // char [] 115 #define NECP_TLV_POLICY_SESSION_ORDER 103 // u_int32_t 116 117 /* 118 * Condition flags 119 */ 120 #define NECP_POLICY_CONDITION_FLAGS_NEGATIVE 0x01 // Negative 121 122 /* 123 * Conditions 124 * Used for setting policies as well as passing parameters to necp_match_policy. 125 */ 126 #define NECP_POLICY_CONDITION_DEFAULT 0 // N/A, not valid with any other conditions 127 // Socket/Application conditions 128 #define NECP_POLICY_CONDITION_APPLICATION 1 // uuid_t, uses effective UUID when possible 129 #define NECP_POLICY_CONDITION_REAL_APPLICATION 2 // uuid_t, never uses effective UUID. Only valid with NECP_POLICY_CONDITION_APPLICATION 130 #define NECP_POLICY_CONDITION_DOMAIN 3 // String, such as apple.com 131 #define NECP_POLICY_CONDITION_ACCOUNT 4 // String 132 #define NECP_POLICY_CONDITION_ENTITLEMENT 5 // String 133 #define NECP_POLICY_CONDITION_PID 6 // pid_t 134 #define NECP_POLICY_CONDITION_UID 7 // uid_t 135 #define NECP_POLICY_CONDITION_ALL_INTERFACES 8 // N/A 136 #define NECP_POLICY_CONDITION_BOUND_INTERFACE 9 // String 137 #define NECP_POLICY_CONDITION_TRAFFIC_CLASS 10 // necp_policy_condition_tc_range 138 // Socket/IP conditions 139 #define NECP_POLICY_CONDITION_IP_PROTOCOL 11 // u_int16_t 140 #define NECP_POLICY_CONDITION_LOCAL_ADDR 12 // necp_policy_condition_addr 141 #define NECP_POLICY_CONDITION_REMOTE_ADDR 13 // necp_policy_condition_addr 142 #define NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE 14 // necp_policy_condition_addr_range 143 #define NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE 15 // necp_policy_condition_addr_range 144 #define NECP_POLICY_CONDITION_AGENT_TYPE 16 // struct necp_policy_condition_agent_type 145 #define NECP_POLICY_CONDITION_HAS_CLIENT 17 // N/A 146 #define NECP_POLICY_CONDITION_LOCAL_NETWORKS 18 // Matches all local networks 147 // Socket-only conditions 148 #define NECP_POLICY_CONDITION_FLOW_IP_PROTOCOL 19 // u_int16_t 149 #define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR 20 // necp_policy_condition_addr 150 #define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR 21 // necp_policy_condition_addr 151 #define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_RANGE 22 // necp_policy_condition_addr_range 152 #define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_RANGE 23 // necp_policy_condition_addr_range 153 #define NECP_POLICY_CONDITION_FLOW_IS_LOOPBACK 31 // N/A 154 // Socket/Application conditions, continued 155 #define NECP_POLICY_CONDITION_CLIENT_FLAGS 24 // u_int32_t, values from NECP_CLIENT_PARAMETER_FLAG_* 156 #define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_EMPTY 25 // N/A 157 #define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_EMPTY 26 // N/A 158 #define NECP_POLICY_CONDITION_PLATFORM_BINARY 27 // N/A 159 #define NECP_POLICY_CONDITION_SDK_VERSION 28 // struct necp_policy_condition_sdk_version 160 #define NECP_POLICY_CONDITION_SIGNING_IDENTIFIER 29 // String 161 #define NECP_POLICY_CONDITION_PACKET_FILTER_TAGS 30 // u_int16_t 162 #define NECP_POLICY_CONDITION_DELEGATE_IS_PLATFORM_BINARY 32 // N/A 163 #define NECP_POLICY_CONDITION_DOMAIN_OWNER 33 // String, owner of domain (for example, "Google Inc") 164 #define NECP_POLICY_CONDITION_DOMAIN_CONTEXT 34 // String, eTLD+1 leading to networking activities to the domain 165 #define NECP_POLICY_CONDITION_TRACKER_DOMAIN 35 // String, tracker domain 166 #define NECP_POLICY_CONDITION_ATTRIBUTED_BUNDLE_IDENTIFIER 36 // String, app to which traffic is attributed to 167 #define NECP_POLICY_CONDITION_SCHEME_PORT 37 // u_int16_t, the port associated with the scheme for a connection 168 #define NECP_POLICY_CONDITION_DOMAIN_FILTER 38 // struct net_bloom_filter 169 170 /* 171 * Policy Packet tags 172 */ 173 #define NECP_POLICY_CONDITION_PACKET_FILTER_TAG_STACK_DROP 0x01 174 #define NECP_POLICY_CONDITION_PACKET_FILTER_TAG_MAX NECP_POLICY_CONDITION_PACKET_FILTER_TAG_STACK_DROP 175 176 /* 177 * Results 178 */ 179 #define NECP_POLICY_RESULT_PASS 1 // N/A 180 #define NECP_POLICY_RESULT_SKIP 2 // u_int32_t, policy order to skip to. 0 to skip all session policies. 181 #define NECP_POLICY_RESULT_DROP 3 // N/A 182 #define NECP_POLICY_RESULT_SOCKET_DIVERT 4 // u_int32_t, flow divert control unit 183 #define NECP_POLICY_RESULT_SOCKET_FILTER 5 // u_int32_t, filter control unit 184 #define NECP_POLICY_RESULT_IP_TUNNEL 6 // String, interface name 185 #define NECP_POLICY_RESULT_IP_FILTER 7 // ? 186 #define NECP_POLICY_RESULT_TRIGGER 8 // service uuid_t 187 #define NECP_POLICY_RESULT_TRIGGER_IF_NEEDED 9 // service uuid_t 188 #define NECP_POLICY_RESULT_TRIGGER_SCOPED 10 // service uuid_t 189 #define NECP_POLICY_RESULT_NO_TRIGGER_SCOPED 11 // service uuid_t 190 #define NECP_POLICY_RESULT_SOCKET_SCOPED 12 // String, interface name 191 #define NECP_POLICY_RESULT_ROUTE_RULES 13 // N/A, must have route rules defined 192 #define NECP_POLICY_RESULT_USE_NETAGENT 14 // netagent uuid_t 193 #define NECP_POLICY_RESULT_NETAGENT_SCOPED 15 // netagent uuid_t 194 #define NECP_POLICY_RESULT_SCOPED_DIRECT 16 // N/A, scopes to primary physical interface 195 #define NECP_POLICY_RESULT_ALLOW_UNENTITLED 17 // N/A 196 #define NECP_POLICY_RESULT_REMOVE_NETAGENT 18 // netagent uuid_t 197 198 #define NECP_POLICY_RESULT_MAX NECP_POLICY_RESULT_ALLOW_UNENTITLED 199 200 /* 201 * PASS Result Flags 202 */ 203 #define NECP_POLICY_PASS_NO_SKIP_IPSEC 0x01 204 #define NECP_POLICY_PASS_PF_TAG 0x02 205 206 /* 207 * DROP Result Flags 208 */ 209 #define NECP_POLICY_DROP_FLAG_LOCAL_NETWORK 0x01 210 211 /* 212 * Route Rules 213 * Detailed parameters for NECP_POLICY_RESULT_ROUTE_RULES. 214 */ 215 #define NECP_ROUTE_RULE_NONE 0 // N/A 216 #define NECP_ROUTE_RULE_DENY_INTERFACE 1 // String, or empty to match all 217 #define NECP_ROUTE_RULE_ALLOW_INTERFACE 2 // String, or empty to match all 218 #define NECP_ROUTE_RULE_QOS_MARKING 3 // String, or empty to match all 219 #define NECP_ROUTE_RULE_DENY_LQM_ABORT 4 // String, or empty to match all 220 #define NECP_ROUTE_RULE_USE_NETAGENT 5 // UUID, followed by string or empty 221 #define NECP_ROUTE_RULE_REMOVE_NETAGENT 6 // UUID, followed by string or empty 222 #define NECP_ROUTE_RULE_DIVERT_SOCKET 7 // u_int32_t control unit, followed by string or empty 223 224 #define NECP_ROUTE_RULE_FLAG_CELLULAR 0x01 225 #define NECP_ROUTE_RULE_FLAG_WIFI 0x02 226 #define NECP_ROUTE_RULE_FLAG_WIRED 0x04 227 #define NECP_ROUTE_RULE_FLAG_EXPENSIVE 0x08 228 #define NECP_ROUTE_RULE_FLAG_CONSTRAINED 0x10 229 230 #define NECP_ROUTE_RULE_FLAG_NETAGENT 0x80 // Last bit, reserved to mark that this applies only when an agent UUID is present 231 232 #define NECP_ROUTE_RULES_SUPPORT_NETAGENT_EXCEPTIONS 1 233 234 /* 235 * Error types 236 */ 237 #define NECP_ERROR_INTERNAL 0 238 #define NECP_ERROR_UNKNOWN_PACKET_TYPE 1 239 #define NECP_ERROR_INVALID_TLV 2 240 #define NECP_ERROR_POLICY_RESULT_INVALID 3 241 #define NECP_ERROR_POLICY_CONDITIONS_INVALID 4 242 #define NECP_ERROR_POLICY_ID_NOT_FOUND 5 243 #define NECP_ERROR_INVALID_PROCESS 6 244 #define NECP_ERROR_ROUTE_RULES_INVALID 7 245 246 // Modifiers 247 #define NECP_MASK_USERSPACE_ONLY 0x80000000 // on filter_control_unit value 248 #define NECP_MASK_PRESERVE_CONNECTIONS 0x20000000 // on filter_control_unit value 249 250 struct necp_policy_condition_tc_range { 251 u_int32_t start_tc; 252 u_int32_t end_tc; 253 } __attribute__((__packed__)); 254 255 struct necp_policy_condition_addr { 256 u_int8_t prefix; 257 union { 258 struct sockaddr sa; 259 struct sockaddr_in sin; 260 struct sockaddr_in6 sin6; 261 } address; 262 } __attribute__((__packed__)); 263 264 struct necp_policy_condition_addr_range { 265 union { 266 struct sockaddr sa; 267 struct sockaddr_in sin; 268 struct sockaddr_in6 sin6; 269 } start_address; 270 union { 271 struct sockaddr sa; 272 struct sockaddr_in sin; 273 struct sockaddr_in6 sin6; 274 } end_address; 275 } __attribute__((__packed__)); 276 277 struct necp_policy_condition_agent_type { 278 char agent_domain[32]; 279 char agent_type[32]; 280 } __attribute__((__packed__)); 281 282 struct necp_policy_condition_sdk_version { 283 uint32_t platform; // e.g., PLATFORM_IOS 284 uint32_t min_version; // Encoded as XXXX.YY.ZZ 285 uint32_t version; // Encoded as XXXX.YY.ZZ 286 } __attribute__((__packed__)); 287 288 #define NECP_SESSION_PRIORITY_UNKNOWN 0 289 #define NECP_SESSION_PRIORITY_CONTROL 1 290 #define NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL 2 291 #define NECP_SESSION_PRIORITY_HIGH 3 292 #define NECP_SESSION_PRIORITY_HIGH_1 4 293 #define NECP_SESSION_PRIORITY_HIGH_2 5 294 #define NECP_SESSION_PRIORITY_HIGH_3 6 295 #define NECP_SESSION_PRIORITY_HIGH_4 7 296 #define NECP_SESSION_PRIORITY_HIGH_RESTRICTED 8 297 #define NECP_SESSION_PRIORITY_DEFAULT 9 298 #define NECP_SESSION_PRIORITY_LOW 10 299 #define NECP_SESSION_NUM_PRIORITIES NECP_SESSION_PRIORITY_LOW 300 301 typedef u_int32_t necp_policy_id; 302 typedef u_int32_t necp_policy_order; 303 typedef u_int32_t necp_session_priority; 304 305 typedef u_int32_t necp_kernel_policy_result; 306 typedef u_int32_t necp_kernel_policy_filter; 307 308 typedef union { 309 u_int tunnel_interface_index; 310 u_int scoped_interface_index; 311 u_int32_t flow_divert_control_unit; 312 u_int32_t filter_control_unit; 313 u_int32_t pass_flags; 314 u_int32_t drop_flags; 315 } necp_kernel_policy_routing_result_parameter; 316 317 #define NECP_SERVICE_FLAGS_REGISTERED 0x01 318 #define NECP_MAX_NETAGENTS 16 319 320 #define NECP_AGENT_USE_FLAG_SCOPE 0x01 321 #define NECP_AGENT_USE_FLAG_REMOVE 0x02 322 323 #define NECP_TFO_COOKIE_LEN_MAX 16 324 struct necp_aggregate_result { 325 necp_kernel_policy_result routing_result; 326 necp_kernel_policy_routing_result_parameter routing_result_parameter; 327 necp_kernel_policy_filter filter_control_unit; 328 u_int32_t flow_divert_aggregate_unit; 329 necp_kernel_policy_result service_action; 330 uuid_t service_uuid; 331 u_int32_t service_flags; 332 u_int32_t service_data; 333 u_int routed_interface_index; 334 u_int32_t policy_id; 335 uuid_t netagents[NECP_MAX_NETAGENTS]; 336 u_int32_t netagent_use_flags[NECP_MAX_NETAGENTS]; 337 struct ipv6_prefix nat64_prefixes[NAT64_MAX_NUM_PREFIXES]; 338 u_int8_t mss_recommended; 339 }; 340 341 /* 342 * Statistics. It would be nice if the definitions in ntstat.h could be used, 343 * but they get entangled with #defines for v4 etc in pfvar.h and it may be better practice 344 * to have separate definitions here. 345 */ 346 struct necp_stat_counts { 347 /* Counters */ 348 u_int64_t necp_stat_rxpackets __attribute__((aligned(8))); 349 u_int64_t necp_stat_rxbytes __attribute__((aligned(8))); 350 u_int64_t necp_stat_txpackets __attribute__((aligned(8))); 351 u_int64_t necp_stat_txbytes __attribute__((aligned(8))); 352 353 u_int32_t necp_stat_rxduplicatebytes; 354 u_int32_t necp_stat_rxoutoforderbytes; 355 u_int32_t necp_stat_txretransmit; 356 357 u_int32_t necp_stat_connectattempts; 358 u_int32_t necp_stat_connectsuccesses; 359 360 u_int32_t necp_stat_min_rtt; 361 u_int32_t necp_stat_avg_rtt; 362 u_int32_t necp_stat_var_rtt; 363 364 #define NECP_STAT_ROUTE_FLAGS 1 365 u_int32_t necp_stat_route_flags; 366 }; 367 368 // Note, some metadata is implicit in the necp client itself: 369 // From the process itself : pid, upid, uuid, proc name. 370 // From the necp client parameters: local and remote addresses, euuid, traffic class, ifindex 371 // 372 // The following may well be supplied via future necp client parameters, 373 // but they are here so they don't get forgotten. 374 struct necp_basic_metadata { 375 u_int32_t rcvbufsize; 376 u_int32_t rcvbufused; 377 }; 378 379 struct necp_connection_probe_status { 380 unsigned int probe_activated : 1; 381 unsigned int write_probe_failed : 1; 382 unsigned int read_probe_failed : 1; 383 unsigned int conn_probe_failed : 1; 384 }; 385 386 struct necp_extra_tcp_metadata { 387 struct necp_connection_probe_status probestatus; 388 389 u_int32_t sndbufsize; 390 u_int32_t sndbufused; 391 u_int32_t txunacked; 392 u_int32_t txwindow; 393 u_int32_t txcwindow; 394 u_int32_t flags; // use SOF_* 395 u_int32_t flags1; // use SOF1_* 396 u_int32_t traffic_mgt_flags; 397 u_int32_t cc_alg_index; 398 u_int32_t state; 399 }; 400 401 struct necp_stats_hdr { 402 u_int32_t necp_stats_type __attribute__((aligned(8))); 403 u_int32_t necp_stats_ver; 404 u_int64_t __necp_stats_reserved; // Pad the field for future use 405 }; 406 407 #define NECP_CLIENT_STATISTICS_TYPE_TCP 1 // Identifies use of necp_tcp_stats 408 #define NECP_CLIENT_STATISTICS_TYPE_UDP 2 // Identifies use of necp_udp_stats 409 #define NECP_CLIENT_STATISTICS_TYPE_QUIC 3 // Identifies use of necp_quic_stats 410 411 #define NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1 1 // Currently supported version for TCP 412 #define NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1 1 // Currently supported version for UDP 413 #define NECP_CLIENT_STATISTICS_TYPE_QUIC_VER_1 1 // Currently supported version for QUIC 414 415 #define NECP_CLIENT_STATISTICS_TYPE_TCP_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1 416 #define NECP_CLIENT_STATISTICS_TYPE_UDP_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1 417 #define NECP_CLIENT_STATISTICS_TYPE_QUIC_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_QUIC_VER_1 418 419 #define NECP_CLIENT_STATISTICS_EVENT_INIT 0x00000000 // Register the flow 420 #define NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT 0x00000001 // The flow is effectively finished but waiting on timer 421 422 struct necp_tcp_stats { 423 struct necp_stats_hdr necp_tcp_hdr; 424 struct necp_stat_counts necp_tcp_counts; 425 struct necp_basic_metadata necp_tcp_basic; 426 struct necp_extra_tcp_metadata necp_tcp_extra; 427 }; 428 429 struct necp_udp_stats { 430 struct necp_stats_hdr necp_udp_hdr; 431 struct necp_stat_counts necp_udp_counts; 432 struct necp_basic_metadata necp_udp_basic; 433 }; 434 435 436 /* 437 * The following reflects the special case for QUIC. 438 * It is a streaming protocol built on top of UDP. 439 * Therefore QUIC stats are defined as basic UDP stats 440 * with some extra meta data. 441 * TODO: For now the extra metadata is an exact replica 442 * of the metadata for TCP. However keeping that separate allows 443 * the structures to diverge later as new stats are added. 444 */ 445 #define QUIC_STATELESS_RESET_TOKEN_SIZE 16 446 struct necp_extra_quic_metadata { 447 u_int32_t sndbufsize; 448 u_int32_t sndbufused; 449 u_int32_t txunacked; 450 u_int32_t txwindow; 451 u_int32_t txcwindow; 452 u_int32_t traffic_mgt_flags; 453 u_int32_t cc_alg_index; 454 u_int32_t state; 455 u_int8_t ssr_token[QUIC_STATELESS_RESET_TOKEN_SIZE]; 456 }; 457 458 #define necp_quic_hdr necp_quic_udp_stats.necp_udp_hdr 459 #define necp_quic_counts necp_quic_udp_stats.necp_udp_counts 460 #define necp_quic_basic necp_quic_udp_stats.necp_udp_basic 461 struct necp_quic_stats { 462 struct necp_udp_stats necp_quic_udp_stats; 463 struct necp_extra_quic_metadata necp_quic_extra; 464 }; 465 466 typedef struct necp_all_stats { 467 union { 468 struct necp_tcp_stats tcp_stats; 469 struct necp_udp_stats udp_stats; 470 struct necp_quic_stats quic_stats; 471 } all_stats_u; 472 } necp_all_stats; 473 474 // Memory for statistics is requested via a necp_stats_bufreq 475 // 476 struct necp_stats_bufreq { 477 u_int32_t necp_stats_bufreq_id __attribute__((aligned(8))); 478 u_int32_t necp_stats_bufreq_type; // NECP_CLIENT_STATISTICS_TYPE_* 479 u_int32_t necp_stats_bufreq_ver; // NECP_CLIENT_STATISTICS_TYPE_*_VER 480 u_int32_t necp_stats_bufreq_size; 481 union { 482 void *necp_stats_bufreq_addr; 483 mach_vm_address_t necp_stats_bufreq_uaddr; 484 }; 485 }; 486 487 #define NECP_CLIENT_STATISTICS_BUFREQ_ID 0xbf // Distinguishes from statistics actions taking a necp_all_stats struct 488 489 // There is a limit to the number of statistics structures that may be allocated per process, subject to change 490 // 491 #define NECP_MAX_PER_PROCESS_CLIENT_STATISTICS_STRUCTS 512 492 493 #define NECP_TCP_ECN_HEURISTICS_SYN_RST 1 494 typedef struct necp_tcp_ecn_cache { 495 u_int8_t necp_tcp_ecn_heuristics_success:1; 496 u_int8_t necp_tcp_ecn_heuristics_loss:1; 497 u_int8_t necp_tcp_ecn_heuristics_drop_rst:1; 498 u_int8_t necp_tcp_ecn_heuristics_drop_rxmt:1; 499 u_int8_t necp_tcp_ecn_heuristics_aggressive:1; 500 u_int8_t necp_tcp_ecn_heuristics_syn_rst:1; 501 } necp_tcp_ecn_cache; 502 503 #define NECP_TCP_TFO_HEURISTICS_RST 1 504 typedef struct necp_tcp_tfo_cache { 505 u_int8_t necp_tcp_tfo_cookie[NECP_TFO_COOKIE_LEN_MAX]; 506 u_int8_t necp_tcp_tfo_cookie_len; 507 u_int8_t necp_tcp_tfo_heuristics_success:1; // TFO succeeded with data in the SYN 508 u_int8_t necp_tcp_tfo_heuristics_loss:1; // TFO SYN-loss with data 509 u_int8_t necp_tcp_tfo_heuristics_middlebox:1; // TFO middlebox detected 510 u_int8_t necp_tcp_tfo_heuristics_success_req:1; // TFO succeeded with the TFO-option in the SYN 511 u_int8_t necp_tcp_tfo_heuristics_loss_req:1; // TFO SYN-loss with the TFO-option 512 u_int8_t necp_tcp_tfo_heuristics_rst_data:1; // Recevied RST upon SYN with data in the SYN 513 u_int8_t necp_tcp_tfo_heuristics_rst_req:1; // Received RST upon SYN with the TFO-option 514 } necp_tcp_tfo_cache; 515 516 #define NECP_CLIENT_CACHE_TYPE_ECN 1 // Identifies use of necp_tcp_ecn_cache 517 #define NECP_CLIENT_CACHE_TYPE_TFO 2 // Identifies use of necp_tcp_tfo_cache 518 519 #define NECP_CLIENT_CACHE_TYPE_ECN_VER_1 1 // Currently supported version for ECN 520 #define NECP_CLIENT_CACHE_TYPE_TFO_VER_1 1 // Currently supported version for TFO 521 522 typedef struct necp_cache_buffer { 523 u_int8_t necp_cache_buf_type; // NECP_CLIENT_CACHE_TYPE_* 524 u_int8_t necp_cache_buf_ver; // NECP_CLIENT_CACHE_TYPE_*_VER 525 u_int32_t necp_cache_buf_size; 526 mach_vm_address_t necp_cache_buf_addr; 527 } necp_cache_buffer; 528 529 /* 530 * NECP Client definitions 531 */ 532 #define NECP_MAX_CLIENT_PARAMETERS_SIZE 1024 533 #define NECP_MAX_CLIENT_RESULT_SIZE 512 // Legacy 534 #define NECP_BASE_CLIENT_RESULT_SIZE 1024 535 #define NECP_CLIENT_FLOW_RESULT_SIZE 512 536 537 #define NECP_OPEN_FLAG_OBSERVER 0x01 // Observers can query clients they don't own 538 #define NECP_OPEN_FLAG_BACKGROUND 0x02 // Mark this fd as backgrounded 539 #define NECP_OPEN_FLAG_PUSH_OBSERVER 0x04 // When used with the OBSERVER flag, allows updates to be pushed. Adding clients is not allowed in this mode. 540 541 #define NECP_FD_SUPPORTS_GUARD 1 542 543 #define NECP_CLIENT_ACTION_ADD 1 // Register a new client. Input: parameters in buffer; Output: client_id 544 #define NECP_CLIENT_ACTION_REMOVE 2 // Unregister a client. Input: client_id, optional struct ifnet_stats_per_flow 545 #define NECP_CLIENT_ACTION_COPY_PARAMETERS 3 // Copy client parameters. Input: client_id; Output: parameters in buffer 546 #define NECP_CLIENT_ACTION_COPY_RESULT 4 // Copy client result. Input: client_id; Output: result in buffer 547 #define NECP_CLIENT_ACTION_COPY_LIST 5 // Copy all client IDs. Output: struct necp_client_list in buffer 548 #define NECP_CLIENT_ACTION_REQUEST_NEXUS_INSTANCE 6 // Request a nexus instance from a nexus provider, optional struct necp_stats_bufreq 549 #define NECP_CLIENT_ACTION_AGENT 7 // Interact with agent. Input: client_id, agent parameters 550 #define NECP_CLIENT_ACTION_COPY_AGENT 8 // Copy agent content. Input: agent UUID; Output: struct netagent 551 #define NECP_CLIENT_ACTION_COPY_INTERFACE 9 // Copy interface details. Input: ifindex cast to UUID; Output: struct necp_interface_details 552 #define NECP_CLIENT_ACTION_SET_STATISTICS 10 // Deprecated 553 #define NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS 11 // Get route statistics. Input: client_id; Output: struct necp_stat_counts 554 #define NECP_CLIENT_ACTION_AGENT_USE 12 // Return the use count and increment the use count. Input/Output: struct necp_agent_use_parameters 555 #define NECP_CLIENT_ACTION_MAP_SYSCTLS 13 // Get the read-only sysctls memory location. Output: mach_vm_address_t 556 #define NECP_CLIENT_ACTION_UPDATE_CACHE 14 // Update heuristics and cache 557 #define NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE 15 // Fetch an updated client for push-mode observer. Output: Client id, struct necp_client_observer_update in buffer 558 #define NECP_CLIENT_ACTION_COPY_UPDATED_RESULT 16 // Copy client result only if changed. Input: client_id; Output: result in buffer 559 #define NECP_CLIENT_ACTION_ADD_FLOW 17 // Add a flow. Input: client_id; Output: struct necp_client_add_flow 560 #define NECP_CLIENT_ACTION_REMOVE_FLOW 18 // Remove a flow. Input: flow_id, optional struct ifnet_stats_per_flow 561 #define NECP_CLIENT_ACTION_CLAIM 19 // Claim a client that has been added for this unique PID. Input: client_id 562 #define NECP_CLIENT_ACTION_SIGN 20 // Sign a resolver answer. Input: struct necp_client_resolver_answer; Output: signed tag, expected to be 32 bytes 563 #define NECP_CLIENT_ACTION_GET_INTERFACE_ADDRESS 21 // Get the best interface local address for given remote address. Input: ifindex, remote sockaddr; Output: matching local sockaddr 564 #define NECP_CLIENT_ACTION_ACQUIRE_AGENT_TOKEN 22 // Get a one-time use token from an agent. Input: agent UUID; Output: token buffer 565 566 #define NECP_CLIENT_PARAMETER_APPLICATION NECP_POLICY_CONDITION_APPLICATION // Requires entitlement 567 #define NECP_CLIENT_PARAMETER_REAL_APPLICATION NECP_POLICY_CONDITION_REAL_APPLICATION // Requires entitlement 568 #define NECP_CLIENT_PARAMETER_DOMAIN NECP_POLICY_CONDITION_DOMAIN 569 #define NECP_CLIENT_PARAMETER_DOMAIN_OWNER NECP_POLICY_CONDITION_DOMAIN_OWNER 570 #define NECP_CLIENT_PARAMETER_DOMAIN_CONTEXT NECP_POLICY_CONDITION_DOMAIN_CONTEXT 571 #define NECP_CLIENT_PARAMETER_TRACKER_DOMAIN NECP_POLICY_CONDITION_TRACKER_DOMAIN 572 #define NECP_CLIENT_PARAMETER_ATTRIBUTED_BUNDLE_IDENTIFIER NECP_POLICY_CONDITION_ATTRIBUTED_BUNDLE_IDENTIFIER 573 #define NECP_CLIENT_PARAMETER_ACCOUNT NECP_POLICY_CONDITION_ACCOUNT 574 #define NECP_CLIENT_PARAMETER_PID NECP_POLICY_CONDITION_PID // Requires entitlement 575 #define NECP_CLIENT_PARAMETER_UID NECP_POLICY_CONDITION_UID // Requires entitlement 576 #define NECP_CLIENT_PARAMETER_BOUND_INTERFACE NECP_POLICY_CONDITION_BOUND_INTERFACE 577 #define NECP_CLIENT_PARAMETER_TRAFFIC_CLASS NECP_POLICY_CONDITION_TRAFFIC_CLASS 578 #define NECP_CLIENT_PARAMETER_IP_PROTOCOL NECP_POLICY_CONDITION_IP_PROTOCOL 579 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS NECP_POLICY_CONDITION_LOCAL_ADDR 580 #define NECP_CLIENT_PARAMETER_REMOTE_ADDRESS NECP_POLICY_CONDITION_REMOTE_ADDR 581 #define NECP_CLIENT_PARAMETER_SCHEME_PORT NECP_POLICY_CONDITION_SCHEME_PORT 582 #define NECP_CLIENT_PARAMETER_NEXUS_KEY 102 583 584 // "Prohibit" will never choose an interface with that property 585 #define NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE 100 // String, interface name 586 #define NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE 101 // u_int8_t, see ifru_functional_type in <net/if.h> 587 #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT 102 // uuid_t, network agent UUID 588 #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE 103 // struct necp_client_parameter_netagent_type 589 590 // "Require" will choose an interface with that property, or none if not found 591 #define NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE 111 // u_int8_t, see ifru_functional_type in <net/if.h> 592 #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT 112 // uuid_t, network agent UUID 593 #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE 113 // struct necp_client_parameter_netagent_type 594 595 // "Prefer" will choose an interface with an agent, or best otherwise if not found 596 #define NECP_CLIENT_PARAMETER_PREFER_AGENT 122 // uuid_t, network agent UUID 597 #define NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE 123 // struct necp_client_parameter_netagent_type 598 599 // "Avoid" will choose an interface without an agent, or best otherwise if unavoidable 600 #define NECP_CLIENT_PARAMETER_AVOID_AGENT 124 // uuid_t, network agent UUID 601 #define NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE 125 // struct necp_client_parameter_netagent_type 602 603 // Use actions with NECP_CLIENT_ACTION_AGENT 604 #define NECP_CLIENT_PARAMETER_TRIGGER_AGENT 130 // uuid_t, network agent UUID 605 #define NECP_CLIENT_PARAMETER_ASSERT_AGENT 131 // uuid_t, network agent UUID 606 #define NECP_CLIENT_PARAMETER_UNASSERT_AGENT 132 // uuid_t, network agent UUID 607 #define NECP_CLIENT_PARAMETER_AGENT_ADD_GROUP_MEMBERS 133 // struct necp_client_group_action 608 #define NECP_CLIENT_PARAMETER_AGENT_REMOVE_GROUP_MEMBERS 134 // struct necp_client_group_action 609 #define NECP_CLIENT_PARAMETER_REPORT_AGENT_ERROR 135 // int32_t 610 611 #define NECP_CLIENT_PARAMETER_FALLBACK_MODE 140 // u_int8_t, see SO_FALLBACK_MODE_* values 612 613 #define NECP_CLIENT_PARAMETER_PARENT_ID 150 // uuid_t, client UUID 614 615 #define NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT 200 // struct necp_client_endpoint 616 #define NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT 201 // struct necp_client_endpoint 617 #define NECP_CLIENT_PARAMETER_BROWSE_DESCRIPTOR 202 // struct necp_client_endpoint 618 #define NECP_CLIENT_PARAMETER_RESOLVER_TAG 203 // Tag as bytes, expected to be 32 bytes 619 #define NECP_CLIENT_PARAMETER_ADVERTISE_DESCRIPTOR 204 // struct necp_client_endpoint 620 #define NECP_CLIENT_PARAMETER_GROUP_DESCRIPTOR 205 // struct necp_client_group 621 622 #define NECP_CLIENT_PARAMETER_DELEGATED_UPID 210 // u_int64_t, requires entitlement 623 624 #define NECP_CLIENT_PARAMETER_ETHERTYPE 220 // u_int16_t, ethertype 625 #define NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL 221 // u_int8_t, IPPROTO_ 626 627 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE 230 // u_int8_t, NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_ 628 629 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_DEFAULT 0 630 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_TEMPORARY 1 631 #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_STABLE 2 632 633 #define NECP_CLIENT_PARAMETER_FLAGS 250 // u_int32_t, see NECP_CLIENT_PAREMETER_FLAG_* values 634 635 #define NECP_CLIENT_PARAMETER_FLAG_MULTIPATH 0x0001 // Get multipath interface results 636 #define NECP_CLIENT_PARAMETER_FLAG_BROWSE 0x0002 // Agent assertions on nexuses are requests to browse 637 #define NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE 0x0004 // Prohibit expensive interfaces 638 #define NECP_CLIENT_PARAMETER_FLAG_LISTENER 0x0008 // Client is interested in listening for inbound connections 639 #define NECP_CLIENT_PARAMETER_FLAG_DISCRETIONARY 0x0010 // Client's traffic is discretionary, and eligible for early defuncting 640 #define NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE 0x0020 // Client is requesting to enable ECN 641 #define NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE 0x0040 // Client is requesting to disable ECN 642 #define NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE 0x0080 // Client is requesting to enable TFO 643 #define NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE 0x0100 // Interpret NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE only for primary interface, and allow exceptions for multipath or listeners 644 #define NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER 0x0200 // Client expects to open a custom ethernet channel 645 #define NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP 0x0400 // Client expects to open a custom IP protocol channel 646 #define NECP_CLIENT_PARAMETER_FLAG_INTERPOSE 0x0800 // Client expects to open an interpose filter channel 647 #define NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED 0x1000 // Prohibit constrained interfaces 648 #define NECP_CLIENT_PARAMETER_FLAG_FALLBACK_TRAFFIC 0x2000 // Fallback traffic 649 #define NECP_CLIENT_PARAMETER_FLAG_INBOUND 0x4000 // Flow is inbound (passive) 650 #define NECP_CLIENT_PARAMETER_FLAG_SYSTEM_PROXY 0x8000 // Flow is a system proxy 651 #define NECP_CLIENT_PARAMETER_FLAG_KNOWN_TRACKER 0x10000 // Flow is contacting a known tracker 652 #define NECP_CLIENT_PARAMETER_FLAG_UNSAFE_SOCKET_ACCESS 0x20000 // Client allows direct access to sockets 653 #define NECP_CLIENT_PARAMETER_FLAG_NON_APP_INITIATED 0x40000 // Networking activities not initiated by application 654 #define NECP_CLIENT_PARAMETER_FLAG_THIRD_PARTY_WEB_CONTENT 0x80000 // Third-party web content, not main load 655 #define NECP_CLIENT_PARAMETER_FLAG_SILENT 0x100000 // Private browsing - do not log/track 656 #define NECP_CLIENT_PARAMETER_FLAG_APPROVED_APP_DOMAIN 0x200000 // Approved associated app domain; domain is "owned" by app 657 #define NECP_CLIENT_PARAMETER_FLAG_NO_WAKE_FROM_SLEEP 0x400000 // Don't wake from sleep on traffic for this client 658 659 660 #define NECP_CLIENT_RESULT_CLIENT_ID 1 // uuid_t 661 #define NECP_CLIENT_RESULT_POLICY_RESULT 2 // u_int32_t 662 #define NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER 3 // u_int32_t 663 #define NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT 4 // u_int32_t 664 #define NECP_CLIENT_RESULT_INTERFACE_INDEX 5 // u_int32_t 665 #define NECP_CLIENT_RESULT_NETAGENT 6 // struct necp_client_result_netagent 666 #define NECP_CLIENT_RESULT_FLAGS 7 // u_int32_t, see NECP_CLIENT_RESULT_FLAG_* values 667 #define NECP_CLIENT_RESULT_INTERFACE 8 // struct necp_client_result_interface 668 #define NECP_CLIENT_RESULT_INTERFACE_OPTION 9 // struct necp_client_interface_option 669 #define NECP_CLIENT_RESULT_EFFECTIVE_MTU 10 // u_int32_t 670 #define NECP_CLIENT_RESULT_FLOW 11 // TLV array of a single flow's state 671 #define NECP_CLIENT_RESULT_PROTO_CTL_EVENT 12 672 #define NECP_CLIENT_RESULT_TFO_COOKIE 13 // NECP_TFO_COOKIE_LEN_MAX 673 #define NECP_CLIENT_RESULT_TFO_FLAGS 14 // u_int8_t 674 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS 15 // u_int8_t 675 #define NECP_CLIENT_RESULT_FLOW_ID 16 // uuid_t 676 #define NECP_CLIENT_RESULT_INTERFACE_TIME_DELTA 17 // u_int32_t, seconds since interface up/down 677 #define NECP_CLIENT_RESULT_REASON 18 // u_int32_t, see NECP_CLIENT_RESULT_REASON_* values 678 #define NECP_CLIENT_RESULT_FLOW_DIVERT_AGGREGATE_UNIT 19 // u_int32_t 679 680 #define NECP_CLIENT_RESULT_NEXUS_INSTANCE 100 // uuid_t 681 #define NECP_CLIENT_RESULT_NEXUS_PORT 101 // u_int16_t 682 #define NECP_CLIENT_RESULT_NEXUS_KEY 102 // uuid_t 683 #define NECP_CLIENT_RESULT_NEXUS_PORT_FLOW_INDEX 103 // u_int32_t 684 #define NECP_CLIENT_RESULT_NEXUS_FLOW_STATS 104 // struct sk_stats_flow * 685 686 #define NECP_CLIENT_RESULT_LOCAL_ENDPOINT 200 // struct necp_client_endpoint 687 #define NECP_CLIENT_RESULT_REMOTE_ENDPOINT 201 // struct necp_client_endpoint 688 #define NECP_CLIENT_RESULT_DISCOVERED_ENDPOINT 202 // struct necp_client_endpoint, result of browse 689 #define NECP_CLIENT_RESULT_RESOLVED_ENDPOINT 203 // struct necp_client_endpoint, result of resolve 690 #define NECP_CLIENT_RESULT_LOCAL_ETHER_ADDR 204 // struct ether_addr 691 #define NECP_CLIENT_RESULT_REMOTE_ETHER_ADDR 205 // struct ether_addr 692 #define NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS 210 // u_int32_t 693 #define NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG 211 // u_int32_t, 1: background, 0: not background 694 #define NECP_CLIENT_RESULT_GATEWAY 212 // struct necp_client_endpoint 695 #define NECP_CLIENT_RESULT_GROUP_MEMBER 213 // struct necp_client_endpoint 696 #define NECP_CLIENT_RESULT_NAT64 214 // struct ipv6_prefix[NAT64_MAX_NUM_PREFIXES] 697 #define NECP_CLIENT_RESULT_ESTIMATED_THROUGHPUT 215 // struct necp_client_result_estimated_throughput 698 699 #define NECP_CLIENT_RESULT_FLAG_IS_LOCAL 0x0001 // Routes to this device 700 #define NECP_CLIENT_RESULT_FLAG_IS_DIRECT 0x0002 // Routes to directly accessible peer 701 #define NECP_CLIENT_RESULT_FLAG_HAS_IPV4 0x0004 // Supports IPv4 702 #define NECP_CLIENT_RESULT_FLAG_HAS_IPV6 0x0008 // Supports IPv6 703 #define NECP_CLIENT_RESULT_FLAG_DEFUNCT 0x0010 // Defunct 704 #define NECP_CLIENT_RESULT_FLAG_SATISFIED 0x0020 // Satisfied path 705 #define NECP_CLIENT_RESULT_FLAG_FLOW_ASSIGNED 0x0040 // Assigned, the flow is active 706 #define NECP_CLIENT_RESULT_FLAG_FLOW_VIABLE 0x0080 // Viable, the flow has a valid route 707 #define NECP_CLIENT_RESULT_FLAG_PROBE_CONNECTIVITY 0x0100 // Flow should probe connectivity 708 #define NECP_CLIENT_RESULT_FLAG_ECN_ENABLED 0x0200 // ECN should be used 709 #define NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED 0x0400 // Fast open should not be used 710 #define NECP_CLIENT_RESULT_FLAG_LINK_QUALITY_ABORT 0x0800 // Link quality is very bad, recommend close connections 711 #define NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING 0x1000 // QoS marking is allowed 712 #define NECP_CLIENT_RESULT_FLAG_HAS_NAT64 0x2000 // Has NAT64 prefix 713 #define NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER 0x4000 // Interface is in low-power mode 714 #define NECP_CLIENT_RESULT_FLAG_SPECIFIC_LISTENER 0x8000 // Listener should not listen on all interfaces 715 #define NECP_CLIENT_RESULT_FLAG_KEXT_FILTER_PRESENT 0x10000 // Kernel extension filter present 716 #define NECP_CLIENT_RESULT_FLAG_PF_RULES_PRESENT 0x20000 // Firewall rules present 717 #define NECP_CLIENT_RESULT_FLAG_ALF_PRESENT 0x40000 // Application Firewall enabled 718 #define NECP_CLIENT_RESULT_FLAG_PARENTAL_CONTROLS_PRESENT 0x80000 // Parental Controls present 719 #define NECP_CLIENT_RESULT_FLAG_IS_GLOBAL_INTERNET 0x100000 // Routes to global Internet 720 721 722 #define NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE (NECP_CLIENT_RESULT_FLAG_HAS_IPV4 | NECP_CLIENT_RESULT_FLAG_HAS_IPV6 | NECP_CLIENT_RESULT_FLAG_HAS_NAT64 | NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER) 723 724 #define NECP_CLIENT_RESULT_FAST_OPEN_SND_PROBE 0x01 // DEPRECATED - Fast open send probe 725 #define NECP_CLIENT_RESULT_FAST_OPEN_RCV_PROBE 0x02 // DEPRECATED - Fast open receive probe 726 727 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_NONE 0x01 728 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_LOW 0x02 729 #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_MEDIUM 0x04 730 731 #define NECP_CLIENT_RESULT_REASON_EXPENSIVE_PROHIBITED 1 // Expensive networks were prohibited 732 #define NECP_CLIENT_RESULT_REASON_CONSTRAINED_PROHIBITED 2 // Constrained networks were prohibited 733 #define NECP_CLIENT_RESULT_REASON_CELLULAR_DENIED 3 // Denied by a cellular route rule 734 #define NECP_CLIENT_RESULT_REASON_WIFI_DENIED 4 // Denied by a wifi route rule 735 #define NECP_CLIENT_RESULT_REASON_LOCAL_NETWORK_PROHIBITED 5 // Local network access prohibited 736 737 struct necp_interface_signature { 738 u_int8_t signature[IFNET_SIGNATURELEN]; 739 u_int8_t signature_len; 740 }; 741 742 struct necp_interface_details { 743 char name[IFXNAMSIZ]; 744 u_int32_t index; 745 u_int32_t generation; 746 u_int32_t functional_type; 747 u_int32_t delegate_index; 748 u_int32_t flags; // see NECP_INTERFACE_FLAG_* 749 u_int32_t mtu; 750 struct necp_interface_signature ipv4_signature; 751 struct necp_interface_signature ipv6_signature; 752 u_int32_t ipv4_netmask; 753 u_int32_t ipv4_broadcast; 754 u_int8_t radio_type; 755 u_int8_t radio_channel; 756 }; 757 758 #define NECP_INTERFACE_FLAG_EXPENSIVE 0x0001 759 #define NECP_INTERFACE_FLAG_TXSTART 0X0002 760 #define NECP_INTERFACE_FLAG_NOACKPRI 0x0004 761 #define NECP_INTERFACE_FLAG_3CARRIERAGG 0x0008 762 #define NECP_INTERFACE_FLAG_IS_LOW_POWER 0x0010 763 #define NECP_INTERFACE_FLAG_MPK_LOG 0x0020 // Multi-layer Packet Logging 764 #define NECP_INTERFACE_FLAG_CONSTRAINED 0x0040 765 #define NECP_INTERFACE_FLAG_HAS_NETMASK 0x0080 766 #define NECP_INTERFACE_FLAG_HAS_BROADCAST 0x0100 767 #define NECP_INTERFACE_FLAG_SUPPORTS_MULTICAST 0x0200 768 #define NECP_INTERFACE_FLAG_HAS_DNS 0x0400 769 #define NECP_INTERFACE_FLAG_HAS_NAT64 0x0800 770 #define NECP_INTERFACE_FLAG_IPV4_ROUTABLE 0x1000 771 #define NECP_INTERFACE_FLAG_IPV6_ROUTABLE 0x2000 772 773 struct necp_client_parameter_netagent_type { 774 char netagent_domain[32]; 775 char netagent_type[32]; 776 }; 777 778 struct necp_client_result_netagent { 779 u_int32_t generation; 780 uuid_t netagent_uuid; 781 }; 782 783 struct necp_client_result_interface { 784 u_int32_t generation; 785 u_int32_t index; 786 }; 787 788 struct necp_client_result_estimated_throughput { 789 u_int8_t up; 790 u_int8_t down; 791 }; 792 793 #define NECP_USES_INTERFACE_OPTIONS_FOR_BROWSE 1 794 795 struct necp_client_interface_option { 796 u_int32_t interface_index; 797 u_int32_t interface_generation; 798 uuid_t nexus_agent; 799 }; 800 801 struct necp_client_endpoint { 802 union { 803 struct sockaddr sa; 804 struct sockaddr_in sin; 805 struct sockaddr_in6 sin6; 806 struct { 807 u_int8_t endpoint_length; 808 u_int8_t endpoint_family; // Use AF_UNSPEC to target a name 809 u_int16_t endpoint_port; 810 u_int32_t endpoint_type; // Client-specific type 811 char endpoint_data[0]; // Type-specific endpoint value 812 } endpoint; 813 } u; 814 }; 815 816 struct necp_client_group { 817 u_int32_t group_type; 818 uuid_t group_id; 819 }; 820 821 struct necp_client_list { 822 u_int32_t client_count; 823 uuid_t clients[0]; 824 }; 825 826 struct kev_necp_policies_changed_data { 827 u_int32_t changed_count; // Defaults to 0. 828 }; 829 830 #define NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS 0x01 // Request a nexus instance upon adding a flow 831 #define NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID 0x02 // Register the client ID rather than the flow registration ID with network agents 832 #define NECP_CLIENT_FLOW_FLAGS_BROWSE 0x04 // Create request with a browse agent 833 #define NECP_CLIENT_FLOW_FLAGS_RESOLVE 0x08 // Create request with a resolution agent 834 #define NECP_CLIENT_FLOW_FLAGS_OVERRIDE_ADDRESS 0x10 // Flow has a different remote address than the parent flow 835 836 struct necp_client_flow_stats { 837 u_int32_t stats_type; // NECP_CLIENT_STATISTICS_TYPE_* 838 u_int32_t stats_version; // NECP_CLIENT_STATISTICS_TYPE_*_VER 839 u_int32_t stats_size; 840 mach_vm_address_t stats_addr; 841 }; 842 843 struct necp_client_add_flow { 844 uuid_t agent_uuid; 845 uuid_t registration_id; 846 u_int16_t flags; // NECP_CLIENT_FLOW_FLAGS_* 847 u_int16_t stats_request_count; 848 struct necp_client_flow_stats stats_requests[0]; 849 // sockaddr for override endpoint 850 } __attribute__((__packed__)); 851 852 struct necp_agent_use_parameters { 853 uuid_t agent_uuid; 854 uint64_t out_use_count; 855 }; 856 857 struct necp_client_group_action { 858 uuid_t agent_uuid; 859 u_int16_t group_member_count; 860 struct necp_client_endpoint group_members[0]; 861 } __attribute__((__packed__)); 862 863 struct necp_client_flow_protoctl_event { 864 uint32_t protoctl_event_code; 865 uint32_t protoctl_event_val; 866 /* TCP seq number is in host byte order */ 867 uint32_t protoctl_event_tcp_seq_num; 868 }; 869 870 #define NECP_CLIENT_UPDATE_TYPE_PARAMETERS 1 // Parameters, for a new client 871 #define NECP_CLIENT_UPDATE_TYPE_RESULT 2 // Result, for a udpated client 872 #define NECP_CLIENT_UPDATE_TYPE_REMOVE 3 // Empty, for a removed client 873 874 struct necp_client_observer_update { 875 u_int32_t update_type; // NECP_CLIENT_UPDATE_TYPE_* 876 u_int8_t tlv_buffer[0]; // Parameters or result as TLVs, based on type 877 }; 878 879 #define NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER 1 880 881 struct necp_client_signable { 882 uuid_t client_id; 883 u_int32_t sign_type; 884 } __attribute__((__packed__)); 885 886 struct necp_client_resolver_answer { 887 uuid_t client_id; 888 u_int32_t sign_type; 889 union sockaddr_in_4_6 address_answer; 890 u_int32_t hostname_length; 891 // hostname 892 } __attribute__((__packed__)); 893 894 #define NECP_FILTER_UNIT_NO_FILTER UINT32_MAX // Reserved filter unit value that prohibits all filters and socket filters 895 896 /* 897 * The sysctl "net.necp.necp_drop_dest_level" controls the global drop rule policy for 898 * a set of destinations addresses at the given level -- the drop rule is the last one 899 * to be evaluated at this level. 900 */ 901 #define MAX_NECP_DROP_DEST_LEVEL_ADDRS 8 902 903 struct necp_drop_dest_entry { 904 u_int32_t level; // priority level 905 u_int32_t order; // session order (read only via sysctl) 906 struct necp_policy_condition_addr cond_addr; 907 }; 908 909 struct necp_drop_dest_policy { 910 u_int32_t entry_count; 911 struct necp_drop_dest_entry entries[MAX_NECP_DROP_DEST_LEVEL_ADDRS]; 912 }; 913 914 #ifdef BSD_KERNEL_PRIVATE 915 #include <stdbool.h> 916 #include <sys/socketvar.h> 917 #include <sys/kern_control.h> 918 #include <netinet/ip_var.h> 919 #include <netinet6/ip6_var.h> 920 #include <net/if_var.h> 921 #include <sys/syslog.h> 922 #include <net/network_agent.h> 923 #include <net/ethernet.h> 924 #include <os/log.h> 925 #if SKYWALK 926 #include <skywalk/namespace/netns.h> 927 #endif /* SKYWALK */ 928 929 930 SYSCTL_DECL(_net_necp); 931 932 extern os_log_t necp_log_handle; 933 extern os_log_t necp_data_trace_log_handle; 934 935 #define NECPLOG(level, format, ...) do { \ 936 if (level == LOG_ERR) { \ 937 os_log_error(necp_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \ 938 } else { \ 939 os_log(necp_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \ 940 } \ 941 } while (0) 942 943 #define NECPLOG0(level, msg) do { \ 944 if (level == LOG_ERR) { \ 945 os_log_error(necp_log_handle, "%s: %s\n", __FUNCTION__, msg); \ 946 } else { \ 947 os_log(necp_log_handle, "%s: %s\n", __FUNCTION__, msg); \ 948 } \ 949 } while (0) 950 951 #define NECPDATATRACELOG(level, format, ...) do { \ 952 if (level == LOG_ERR) { \ 953 os_log_error(necp_data_trace_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \ 954 } else { \ 955 os_log(necp_data_trace_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \ 956 } \ 957 } while (0) 958 959 enum necp_fd_type_t { 960 necp_fd_type_invalid = 0, 961 necp_fd_type_session = 1, 962 necp_fd_type_client = 2, 963 }; 964 965 union necp_sockaddr_union { 966 struct sockaddr sa; 967 struct sockaddr_in sin; 968 struct sockaddr_in6 sin6; 969 }; 970 971 /* 972 * kstats 973 * The ustats and kstats region are mirrored. So when we allocate with 974 * skmem_cache from kstats region, we also get an ustats object. To tie them 975 * together, kstats has an extra *necp_stats_ustats pointer pointing to the 976 * ustats object 977 */ 978 struct necp_all_kstats { 979 struct necp_all_stats necp_stats_comm; /* kernel private stats snapshot */ 980 struct necp_all_stats *necp_stats_ustats; /* points to user-visible stats (in shared ustats region) */ 981 }; 982 983 extern void necp_client_init(void); 984 extern int necp_application_find_policy_match_internal(proc_t proc, u_int8_t *parameters, u_int32_t parameters_size, 985 struct necp_aggregate_result *returned_result, 986 u_int32_t *flags, u_int32_t *reason, u_int required_interface_index, 987 const union necp_sockaddr_union *override_local_addr, 988 const union necp_sockaddr_union *override_remote_addr, 989 struct necp_client_endpoint *returned_v4_gateway, 990 struct necp_client_endpoint *returned_v6_gateway, 991 struct rtentry **returned_route, bool ignore_address, 992 bool has_client, 993 uuid_t *returned_override_euuid); 994 /* 995 * TLV utilities 996 * 997 * Note that these functions (other than necp_buffer_find_tlv) do not check the length of the entire buffer, 998 * so the caller must be sure that the entire TLV is within bounds. 999 */ 1000 struct necp_tlv_header { 1001 u_int8_t type; 1002 u_int32_t length; 1003 } __attribute__((__packed__)); 1004 1005 extern u_int8_t *necp_buffer_write_tlv(u_int8_t *cursor, u_int8_t type, u_int32_t length, const void *value, 1006 u_int8_t *buffer, u_int32_t buffer_length); 1007 extern u_int8_t *necp_buffer_write_tlv_if_different(u_int8_t *cursor, u_int8_t type, 1008 u_int32_t length, const void *value, bool *updated, 1009 u_int8_t *buffer, u_int32_t buffer_length); 1010 extern u_int8_t necp_buffer_get_tlv_type(u_int8_t *buffer, int tlv_offset); 1011 extern u_int32_t necp_buffer_get_tlv_length(u_int8_t *buffer, int tlv_offset); 1012 extern u_int8_t *necp_buffer_get_tlv_value(u_int8_t *buffer, int tlv_offset, u_int32_t *value_size); 1013 extern int necp_buffer_find_tlv(u_int8_t *buffer, u_int32_t buffer_length, int offset, u_int8_t type, int *err, int next); 1014 1015 #define NECPCTL_DROP_ALL_LEVEL 1 /* Drop all packets if no policy matches above this level */ 1016 #define NECPCTL_DEBUG 2 /* Log all kernel policy matches */ 1017 #define NECPCTL_PASS_LOOPBACK 3 /* Pass all loopback traffic */ 1018 #define NECPCTL_PASS_KEEPALIVES 4 /* Pass all kernel-generated keepalive traffic */ 1019 #define NECPCTL_SOCKET_POLICY_COUNT 5 /* Count of all socket-level policies */ 1020 #define NECPCTL_SOCKET_NON_APP_POLICY_COUNT 6 /* Count of non-per-app socket-level policies */ 1021 #define NECPCTL_IP_POLICY_COUNT 7 /* Count of all ip-level policies */ 1022 #define NECPCTL_SESSION_COUNT 8 /* Count of NECP sessions */ 1023 #define NECPCTL_CLIENT_FD_COUNT 9 /* Count of NECP client fds */ 1024 #define NECPCTL_CLIENT_COUNT 10 /* Count of NECP clients */ 1025 #define NECPCTL_ARENA_COUNT 11 /* Count of NECP arenas (stats, etc) */ 1026 #define NECPCTL_NEXUS_FLOW_COUNT 12 /* Count of NECP nexus flows */ 1027 #define NECPCTL_SOCKET_FLOW_COUNT 13 /* Count of NECP socket flows */ 1028 #define NECPCTL_IF_FLOW_COUNT 14 /* Count of NECP socket flows */ 1029 #define NECPCTL_OBSERVER_FD_COUNT 15 /* Count of NECP observer fds */ 1030 #define NECPCTL_OBSERVER_MESSAGE_LIMIT 16 /* Number of of NECP observer messages allowed to be queued */ 1031 #define NECPCTL_SYSCTL_ARENA_COUNT 17 /* Count of sysctl arenas */ 1032 #define NECPCTL_DROP_UNENTITLED_LEVEL 18 /* Drop unentitled process traffic above this level */ 1033 #define NECPCTL_PASS_INTERPOSE 19 /* Pass interpose */ 1034 #define NECPCTL_RESTRICT_MULTICAST 20 /* Restrict multicast access */ 1035 #define NECPCTL_DEDUP_POLICIES 21 /* Dedup overlapping policies */ 1036 #define NECPCTL_CLIENT_TRACING_LEVEL 22 /* Client tracing level */ 1037 #define NECPCTL_CLIENT_TRACING_PID 23 /* Apply client tracing only to specified pid */ 1038 1039 #define NECP_LOOPBACK_PASS_ALL 1 // Pass all loopback traffic 1040 #define NECP_LOOPBACK_PASS_WITH_FILTER 2 // Pass all loopback traffic, but activate content filter and/or flow divert if applicable 1041 1042 #define NECPCTL_NAMES { \ 1043 { 0, 0 }, \ 1044 { "drop_all_level", CTLTYPE_INT }, \ 1045 { "debug", CTLTYPE_INT }, \ 1046 { "pass_loopback", CTLTYPE_INT }, \ 1047 { "pass_keepalives", CTLTYPE_INT }, \ 1048 { "pass_interpose", CTLTYPE_INT }, \ 1049 } 1050 1051 typedef u_int32_t necp_kernel_policy_id; 1052 #define NECP_KERNEL_POLICY_ID_NONE 0 1053 #define NECP_KERNEL_POLICY_ID_NO_MATCH 1 1054 #define NECP_KERNEL_POLICY_ID_FIRST_VALID_SOCKET 2 1055 #define NECP_KERNEL_POLICY_ID_FIRST_VALID_IP UINT16_MAX 1056 1057 typedef u_int32_t necp_app_id; 1058 1059 #define NECP_KERNEL_POLICY_RESULT_NONE 0 1060 #define NECP_KERNEL_POLICY_RESULT_PASS NECP_POLICY_RESULT_PASS 1061 #define NECP_KERNEL_POLICY_RESULT_SKIP NECP_POLICY_RESULT_SKIP 1062 #define NECP_KERNEL_POLICY_RESULT_DROP NECP_POLICY_RESULT_DROP 1063 #define NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT NECP_POLICY_RESULT_SOCKET_DIVERT 1064 #define NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER NECP_POLICY_RESULT_SOCKET_FILTER 1065 #define NECP_KERNEL_POLICY_RESULT_IP_TUNNEL NECP_POLICY_RESULT_IP_TUNNEL 1066 #define NECP_KERNEL_POLICY_RESULT_IP_FILTER NECP_POLICY_RESULT_IP_FILTER 1067 #define NECP_KERNEL_POLICY_RESULT_TRIGGER NECP_POLICY_RESULT_TRIGGER 1068 #define NECP_KERNEL_POLICY_RESULT_TRIGGER_IF_NEEDED NECP_POLICY_RESULT_TRIGGER_IF_NEEDED 1069 #define NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED NECP_POLICY_RESULT_TRIGGER_SCOPED 1070 #define NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED NECP_POLICY_RESULT_NO_TRIGGER_SCOPED 1071 #define NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED NECP_POLICY_RESULT_SOCKET_SCOPED 1072 #define NECP_KERNEL_POLICY_RESULT_ROUTE_RULES NECP_POLICY_RESULT_ROUTE_RULES 1073 #define NECP_KERNEL_POLICY_RESULT_USE_NETAGENT NECP_POLICY_RESULT_USE_NETAGENT 1074 #define NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED NECP_POLICY_RESULT_NETAGENT_SCOPED 1075 #define NECP_KERNEL_POLICY_RESULT_SCOPED_DIRECT NECP_POLICY_RESULT_SCOPED_DIRECT 1076 #define NECP_KERNEL_POLICY_RESULT_ALLOW_UNENTITLED NECP_POLICY_RESULT_ALLOW_UNENTITLED 1077 #define NECP_KERNEL_POLICY_RESULT_REMOVE_NETAGENT NECP_POLICY_RESULT_REMOVE_NETAGENT 1078 1079 #define NECP_KERNEL_POLICY_PASS_NO_SKIP_IPSEC NECP_POLICY_PASS_NO_SKIP_IPSEC 1080 #define NECP_KERNEL_POLICY_PASS_PF_TAG NECP_POLICY_PASS_PF_TAG 1081 1082 #define NECP_KERNEL_POLICY_DROP_FLAG_LOCAL_NETWORK NECP_POLICY_DROP_FLAG_LOCAL_NETWORK 1083 1084 typedef struct { 1085 u_int32_t identifier; 1086 u_int32_t data; 1087 } necp_kernel_policy_service; 1088 1089 typedef union { 1090 u_int tunnel_interface_index; 1091 u_int scoped_interface_index; 1092 u_int32_t flow_divert_control_unit; 1093 u_int32_t filter_control_unit; 1094 u_int32_t skip_policy_order; 1095 u_int32_t route_rule_id; 1096 u_int32_t netagent_id; 1097 u_int32_t pass_flags; 1098 u_int32_t drop_flags; 1099 necp_kernel_policy_service service; 1100 } necp_kernel_policy_result_parameter; 1101 1102 enum necp_boolean_state { 1103 necp_boolean_state_unknown = 0, 1104 necp_boolean_state_false = 1, 1105 necp_boolean_state_true = 2, 1106 }; 1107 1108 struct necp_kernel_socket_policy { 1109 LIST_ENTRY(necp_kernel_socket_policy) chain; 1110 necp_kernel_policy_id id; 1111 necp_policy_order order; 1112 u_int32_t session_order; 1113 int session_pid; 1114 1115 u_int64_t condition_mask; 1116 u_int64_t condition_negated_mask; 1117 u_int32_t cond_client_flags; 1118 necp_kernel_policy_id cond_policy_id; 1119 u_int32_t cond_app_id; // Locally assigned ID value stored 1120 u_int32_t cond_real_app_id; // Locally assigned ID value stored 1121 char *cond_custom_entitlement; // String 1122 u_int8_t cond_custom_entitlement_matched;// Boolean if entitlement matched app 1123 u_int32_t cond_account_id; // Locally assigned ID value stored 1124 char *cond_domain; // String 1125 u_int8_t cond_domain_dot_count; // Number of dots in cond_domain 1126 u_int32_t cond_domain_filter; 1127 pid_t cond_pid; 1128 uid_t cond_uid; 1129 ifnet_t cond_bound_interface; // Matches specific binding only 1130 struct necp_policy_condition_tc_range cond_traffic_class; // Matches traffic class in range 1131 u_int16_t cond_protocol; // Matches IP protcol number 1132 union necp_sockaddr_union cond_local_start; // Matches local IP address (or start) 1133 union necp_sockaddr_union cond_local_end; // Matches IP address range 1134 u_int8_t cond_local_prefix; // Defines subnet 1135 union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start) 1136 union necp_sockaddr_union cond_remote_end; // Matches IP address range 1137 u_int8_t cond_remote_prefix; // Defines subnet 1138 struct necp_policy_condition_agent_type cond_agent_type; 1139 struct necp_policy_condition_sdk_version cond_sdk_version; 1140 char *cond_signing_identifier; // String 1141 u_int16_t cond_packet_filter_tags; 1142 u_int16_t cond_scheme_port; 1143 int32_t cond_pid_version; 1144 1145 necp_kernel_policy_result result; 1146 necp_kernel_policy_result_parameter result_parameter; 1147 }; 1148 1149 struct necp_kernel_ip_output_policy { 1150 LIST_ENTRY(necp_kernel_ip_output_policy) chain; 1151 necp_kernel_policy_id id; 1152 necp_policy_order suborder; 1153 necp_policy_order order; 1154 u_int32_t session_order; 1155 int session_pid; 1156 1157 u_int64_t condition_mask; 1158 u_int64_t condition_negated_mask; 1159 necp_kernel_policy_id cond_policy_id; 1160 ifnet_t cond_bound_interface; // Matches specific binding only 1161 u_int16_t cond_protocol; // Matches IP protcol number 1162 union necp_sockaddr_union cond_local_start; // Matches local IP address (or start) 1163 union necp_sockaddr_union cond_local_end; // Matches IP address range 1164 u_int8_t cond_local_prefix; // Defines subnet 1165 union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start) 1166 union necp_sockaddr_union cond_remote_end; // Matches IP address range 1167 u_int8_t cond_remote_prefix; // Defines subnet 1168 u_int32_t cond_last_interface_index; 1169 u_int16_t cond_packet_filter_tags; 1170 u_int16_t cond_scheme_port; 1171 1172 necp_kernel_policy_result result; 1173 necp_kernel_policy_result_parameter result_parameter; 1174 }; 1175 1176 #define MAX_KERNEL_SOCKET_POLICIES 1 1177 #define MAX_KERNEL_IP_OUTPUT_POLICIES 4 1178 struct necp_session_policy { 1179 LIST_ENTRY(necp_session_policy) chain; 1180 bool applied; // Applied into the kernel table 1181 bool pending_deletion; // Waiting to be removed from kernel table 1182 bool pending_update; // Policy has been modified since creation/last application 1183 necp_policy_id local_id; 1184 necp_policy_order order; 1185 u_int8_t *result; 1186 u_int32_t result_size; 1187 u_int8_t *conditions; // Array of conditions, each with a u_int32_t length at start 1188 u_int32_t conditions_size; 1189 u_int8_t *route_rules; // Array of route rules, each with a u_int32_t length at start 1190 u_int32_t route_rules_size; 1191 1192 uuid_t applied_app_uuid; 1193 uuid_t applied_real_app_uuid; 1194 char *applied_account; 1195 u_int32_t applied_account_size; 1196 1197 uuid_t applied_result_uuid; 1198 1199 u_int32_t applied_route_rules_id; 1200 1201 necp_kernel_policy_id kernel_socket_policies[MAX_KERNEL_SOCKET_POLICIES]; 1202 necp_kernel_policy_id kernel_ip_output_policies[MAX_KERNEL_IP_OUTPUT_POLICIES]; 1203 }; 1204 1205 struct necp_aggregate_socket_result { 1206 necp_kernel_policy_result result; 1207 necp_kernel_policy_result_parameter result_parameter; 1208 necp_kernel_policy_filter filter_control_unit; 1209 u_int32_t flow_divert_aggregate_unit; 1210 u_int32_t route_rule_id; 1211 int32_t qos_marking_gencount; 1212 }; 1213 1214 struct necp_inpcb_result { 1215 u_int32_t app_id; 1216 necp_kernel_policy_id policy_id; 1217 necp_kernel_policy_id skip_policy_id; 1218 int32_t policy_gencount; 1219 u_int32_t flowhash; 1220 u_int32_t network_denied_notifies;// Notification count 1221 struct necp_aggregate_socket_result results; 1222 }; 1223 1224 extern void necp_init(void); 1225 1226 struct inp_necp_attributes; 1227 extern errno_t necp_set_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt); 1228 extern errno_t necp_get_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt); 1229 extern errno_t necp_set_socket_domain_attributes(struct socket *so, const char *domain, const char *domain_owner); 1230 extern void necp_inpcb_remove_cb(struct inpcb *inp); 1231 extern void necp_inpcb_dispose(struct inpcb *inp); 1232 1233 extern u_int32_t necp_socket_get_content_filter_control_unit(struct socket *so); 1234 1235 extern bool necp_socket_should_use_flow_divert(struct inpcb *inp); 1236 extern u_int32_t necp_socket_get_flow_divert_control_unit(struct inpcb *inp, uint32_t *aggregate_unit); 1237 1238 extern bool necp_socket_should_rescope(struct inpcb *inp); 1239 extern u_int necp_socket_get_rescope_if_index(struct inpcb *inp); 1240 extern u_int32_t necp_socket_get_effective_mtu(struct inpcb *inp, u_int32_t current_mtu); 1241 1242 extern bool necp_socket_is_allowed_to_recv_on_interface(struct inpcb *inp, ifnet_t interface); 1243 1244 extern bool necp_socket_is_allowed_to_send_recv(struct inpcb *inp, ifnet_t input_interface, u_int16_t pf_tag, 1245 necp_kernel_policy_id *return_policy_id, 1246 u_int32_t *return_route_rule_id, 1247 necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags); 1248 extern bool necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port, 1249 u_int16_t remote_port, struct in_addr *local_addr, 1250 struct in_addr *remote_addr, ifnet_t input_interface, u_int16_t pf_tag, 1251 necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id, 1252 necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags); 1253 extern bool necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port, 1254 u_int16_t remote_port, struct in6_addr *local_addr, 1255 struct in6_addr *remote_addr, ifnet_t input_interface, u_int16_t pf_tag, 1256 necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id, 1257 necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags); 1258 extern void necp_socket_update_qos_marking(struct inpcb *inp, struct rtentry *route, u_int32_t route_rule_id); 1259 extern bool necp_lookup_current_qos_marking(int32_t *qos_marking_gencount, struct rtentry *route, struct ifnet *interface, u_int32_t route_rule_id, bool old_qos_marking); 1260 extern int necp_mark_packet_from_socket(struct mbuf *packet, struct inpcb *inp, necp_kernel_policy_id policy_id, 1261 u_int32_t route_rule_id, necp_kernel_policy_id skip_policy_id, u_int32_t pass_flags); 1262 extern necp_kernel_policy_id necp_get_policy_id_from_packet(struct mbuf *packet); 1263 extern necp_kernel_policy_id necp_get_skip_policy_id_from_packet(struct mbuf *packet); 1264 extern u_int16_t necp_get_packet_filter_tags_from_packet(struct mbuf *packet); 1265 extern bool necp_packet_should_skip_filters(struct mbuf *packet); 1266 extern u_int32_t necp_get_last_interface_index_from_packet(struct mbuf *packet); 1267 extern u_int32_t necp_get_route_rule_id_from_packet(struct mbuf *packet); 1268 extern int necp_get_app_uuid_from_packet(struct mbuf *packet, 1269 uuid_t app_uuid); 1270 1271 extern necp_kernel_policy_id necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local_addr, 1272 struct sockaddr *override_remote_addr, u_int32_t override_bound_interface); 1273 extern necp_kernel_policy_id necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_args *ipoa, 1274 struct rtentry *rt, 1275 necp_kernel_policy_result *result, 1276 necp_kernel_policy_result_parameter *result_parameter); 1277 extern necp_kernel_policy_id necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out_args *ip6oa, 1278 struct rtentry *rt, 1279 necp_kernel_policy_result *result, 1280 necp_kernel_policy_result_parameter *result_parameter); 1281 1282 extern int necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id); 1283 extern int necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface); 1284 1285 extern ifnet_t necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter); 1286 extern bool necp_packet_can_rebind_to_ifnet(struct mbuf *packet, struct ifnet *interface, struct route *new_route, int family); 1287 1288 extern bool necp_packet_is_allowed_over_interface(struct mbuf *packet, struct ifnet *interface); 1289 1290 extern int necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive); 1291 extern bool necp_get_is_keepalive_from_packet(struct mbuf *packet); 1292 1293 extern int necp_sign_resolver_answer(uuid_t client_id, u_int8_t *query, u_int32_t query_length, 1294 u_int8_t *answer, u_int32_t answer_length, 1295 u_int8_t *tag, u_int32_t *out_tag_length); 1296 1297 extern bool necp_validate_resolver_answer(uuid_t client_id, u_int8_t *query, u_int32_t query_length, 1298 u_int8_t *answer, u_int32_t answer_length, 1299 u_int8_t *tag, u_int32_t tag_length); 1300 1301 extern void necp_update_all_clients(void); // Handle general re-evaluate event 1302 extern void necp_update_all_clients_immediately_if_needed(bool should_update_immediately); // Handle general re-evaluate event 1303 1304 extern void necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid, u_int32_t agent_generation); // Cause a single client to get an update event 1305 1306 extern bool necp_set_client_as_background(proc_t proc, struct fileproc *fp, bool background); // Set all clients for an fp as background or not 1307 1308 struct necp_fd_data; 1309 extern void necp_fd_memstatus(proc_t proc, uint32_t status, struct necp_fd_data *client_fd); // Purge memory of clients for the process 1310 extern void necp_fd_defunct(proc_t proc, struct necp_fd_data *client_fd); // Set all clients for an process as defunct 1311 1312 extern int necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp); 1313 1314 extern int necp_client_register_socket_listener(pid_t pid, uuid_t client_id, struct inpcb *inp); 1315 1316 #if SKYWALK 1317 extern int necp_client_get_netns_flow_info(uuid_t client_id, struct ns_flow_info *flow_info); 1318 #endif /* SKYWALK */ 1319 1320 extern int necp_client_assert_bb_radio_manager(uuid_t client_id, bool assert); 1321 1322 extern int necp_client_assign_from_socket(pid_t pid, uuid_t client_id, struct inpcb *inp); 1323 1324 extern int necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id, 1325 u_int8_t *assigned_results, size_t assigned_results_length); 1326 extern int necp_assign_client_group_members(uuid_t netagent_uuid, uuid_t client_id, 1327 u_int8_t *assigned_group_members, size_t assigned_group_members_length); 1328 1329 struct skmem_obj_info; // forward declaration 1330 extern int necp_stats_ctor(struct skmem_obj_info *oi, struct skmem_obj_info *oim, void *arg, uint32_t skmflag); 1331 extern int necp_stats_dtor(void *addr, void *arg); 1332 1333 /* value to denote invalid flow advisory index */ 1334 struct netagent_session; 1335 extern int 1336 necp_update_flow_protoctl_event(uuid_t netagent_uuid, uuid_t client_id, 1337 uint32_t protoctl_event_code, uint32_t protoctl_event_val, 1338 uint32_t protoctl_event_tcp_seq_num); 1339 1340 #define NECP_FLOWADV_IDX_INVALID UINT32_MAX 1341 extern void *necp_create_nexus_assign_message(uuid_t nexus_instance, u_int32_t nexus_port, void *key, uint32_t key_length, 1342 struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint, 1343 struct ether_addr *local_ether_addr, 1344 u_int32_t flow_adv_index, void *flow_stats, size_t *message_length); 1345 1346 struct necp_client_nexus_parameters { 1347 pid_t pid; 1348 pid_t epid; 1349 uuid_t euuid; 1350 #if SKYWALK 1351 netns_token port_reservation; 1352 #else /* !SKYWALK */ 1353 void *reserved; 1354 #endif /* !SKYWALK */ 1355 union necp_sockaddr_union local_addr; 1356 union necp_sockaddr_union remote_addr; 1357 u_int8_t ip_protocol; 1358 u_int8_t transport_protocol; 1359 u_int16_t ethertype; 1360 u_int32_t traffic_class; 1361 necp_policy_id policy_id; 1362 unsigned is_listener:1; 1363 unsigned is_interpose:1; 1364 unsigned is_custom_ether:1; 1365 unsigned allow_qos_marking:1; 1366 unsigned override_address_selection:1; 1367 unsigned use_stable_address:1; // Used if override_address_selection is set 1368 unsigned no_wake_from_sleep:1; 1369 }; 1370 1371 struct necp_client_group_members { 1372 size_t group_members_length; 1373 u_int8_t *group_members; 1374 }; 1375 1376 struct necp_client_agent_parameters { 1377 union { 1378 struct necp_client_nexus_parameters nexus_request; 1379 u_int8_t close_token[QUIC_STATELESS_RESET_TOKEN_SIZE]; 1380 struct necp_client_group_members group_members; 1381 int32_t error; 1382 } u; 1383 }; 1384 1385 #define NECP_CLIENT_CBACTION_NONVIABLE 1 1386 #define NECP_CLIENT_CBACTION_VIABLE 2 1387 #define NECP_CLIENT_CBACTION_INITIAL 3 1388 1389 struct necp_client_add_flow_default { 1390 uuid_t agent_uuid; 1391 uuid_t registration_id; 1392 u_int16_t flags; // NECP_CLIENT_FLOW_FLAGS_* 1393 u_int16_t stats_request_count; 1394 struct necp_client_flow_stats stats_requests[1]; 1395 } __attribute__((__packed__)); 1396 1397 typedef void (*necp_client_flow_cb)(void *handle, int action, uint32_t interface_index, uint32_t necp_flags, bool *viable); 1398 1399 extern void necp_client_reap_caches(boolean_t purge); 1400 1401 #if SKYWALK 1402 struct skmem_arena_mmap_info; 1403 1404 extern pid_t necp_client_get_proc_pid_from_arena_info(struct skmem_arena_mmap_info *arena_info); 1405 1406 extern void necp_client_early_close(uuid_t client_id); // Cause a single client to close stats, etc 1407 1408 #endif /* SKYWALK */ 1409 1410 #endif /* BSD_KERNEL_PRIVATE */ 1411 1412 #ifdef KERNEL 1413 #ifdef KERNEL_PRIVATE 1414 struct nstat_domain_info; 1415 extern void necp_copy_inp_domain_info(struct inpcb *, struct socket *, struct nstat_domain_info *); 1416 extern bool net_domain_contains_hostname(char *hostname_string, char *domain_string); 1417 #endif /* KERNEL_PRIVATE */ 1418 #endif /* KERNEL */ 1419 1420 #ifndef KERNEL 1421 1422 extern int necp_match_policy(const uint8_t *parameters, size_t parameters_size, struct necp_aggregate_result *returned_result); 1423 1424 extern int necp_open(int flags); 1425 1426 extern int necp_client_action(int necp_fd, uint32_t action, uuid_t client_id, 1427 size_t client_id_len, uint8_t *buffer, size_t buffer_size); 1428 1429 extern int necp_session_open(int flags); 1430 1431 extern int necp_session_action(int necp_fd, uint32_t action, 1432 uint8_t *in_buffer, size_t in_buffer_length, 1433 uint8_t *out_buffer, size_t out_buffer_length); 1434 1435 #endif /* !KERNEL */ 1436 1437 #endif /* PRIVATE */ 1438 1439 #endif 1440