1/*
2 * Copyright (c) 2013-2018 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29#ifndef _NET_NECP_H_
30#define _NET_NECP_H_
31
32#include <net/net_kev.h>
33#ifdef PRIVATE
34
35#include <netinet/in.h>
36#include <netinet/in_stat.h>
37#include <sys/socket.h>
38#include <net/if.h>
39
40/*
41 * Name registered by the ipsec kernel control
42 */
43#define NECP_CONTROL_NAME "com.apple.net.necp_control"
44
45#define NECP_TLV_LENGTH_UINT32 1
46
47struct necp_packet_header {
48 u_int8_t packet_type;
49 u_int8_t flags;
50 u_int32_t message_id;
51};
52
53/*
54 * Control message commands
55 */
56#define NECP_PACKET_TYPE_POLICY_ADD 1
57#define NECP_PACKET_TYPE_POLICY_GET 2
58#define NECP_PACKET_TYPE_POLICY_DELETE 3
59#define NECP_PACKET_TYPE_POLICY_APPLY_ALL 4
60#define NECP_PACKET_TYPE_POLICY_LIST_ALL 5
61#define NECP_PACKET_TYPE_POLICY_DELETE_ALL 6
62#define NECP_PACKET_TYPE_SET_SESSION_PRIORITY 7
63#define NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC 8
64#define NECP_PACKET_TYPE_REGISTER_SERVICE 9
65#define NECP_PACKET_TYPE_UNREGISTER_SERVICE 10
66#define NECP_PACKET_TYPE_POLICY_DUMP_ALL 11
67
68/*
69 * Session actions
70 */
71#define NECP_SESSION_ACTION_POLICY_ADD 1 // In: Policy TLVs Out: necp_policy_id
72#define NECP_SESSION_ACTION_POLICY_GET 2 // In: necp_policy_id Out: Policy TLVs
73#define NECP_SESSION_ACTION_POLICY_DELETE 3 // In: necp_policy_id Out: None
74#define NECP_SESSION_ACTION_POLICY_APPLY_ALL 4 // In: None Out: None
75#define NECP_SESSION_ACTION_POLICY_LIST_ALL 5 // In: None Out: TLVs of IDs
76#define NECP_SESSION_ACTION_POLICY_DELETE_ALL 6 // In: None Out: None
77#define NECP_SESSION_ACTION_SET_SESSION_PRIORITY 7 // In: necp_session_priority Out: None
78#define NECP_SESSION_ACTION_LOCK_SESSION_TO_PROC 8 // In: None Out: None
79#define NECP_SESSION_ACTION_REGISTER_SERVICE 9 // In: uuid_t Out: None
80#define NECP_SESSION_ACTION_UNREGISTER_SERVICE 10 // In: uuid_t Out: None
81#define NECP_SESSION_ACTION_POLICY_DUMP_ALL 11 // In: None Out: uint32_t bytes length, then Policy TLVs
82
83/*
84 * Control message flags
85 */
86#define NECP_PACKET_FLAGS_RESPONSE 0x01 // Used for acks, errors, and query responses
87
88/*
89 * Control message TLV types
90 */
91#define NECP_TLV_NIL 0
92#define NECP_TLV_ERROR 1 // u_int32_t
93#define NECP_TLV_POLICY_ORDER 2 // u_int32_t
94#define NECP_TLV_POLICY_CONDITION 3
95#define NECP_TLV_POLICY_RESULT 4
96#define NECP_TLV_POLICY_ID 5 // u_int32_t
97#define NECP_TLV_SESSION_PRIORITY 6 // u_int32_t
98#define NECP_TLV_ATTRIBUTE_DOMAIN 7 // char[]
99#define NECP_TLV_ATTRIBUTE_ACCOUNT 8 // char[]
100#define NECP_TLV_SERVICE_UUID 9 // uuid_t
101#define NECP_TLV_ROUTE_RULE 10
102
103/*
104 * Control message TLV sent only by the kernel to userspace
105 */
106#define NECP_TLV_POLICY_OWNER 100 // char []
107#define NECP_TLV_POLICY_DUMP 101
108#define NECP_TLV_POLICY_RESULT_STRING 102 // char []
109#define NECP_TLV_POLICY_SESSION_ORDER 103 // u_int32_t
110
111/*
112 * Condition flags
113 */
114#define NECP_POLICY_CONDITION_FLAGS_NEGATIVE 0x01 // Negative
115
116/*
117 * Conditions
118 * Used for setting policies as well as passing parameters to necp_match_policy.
119 */
120#define NECP_POLICY_CONDITION_DEFAULT 0 // N/A, not valid with any other conditions
121// Socket/Application conditions
122#define NECP_POLICY_CONDITION_APPLICATION 1 // uuid_t, uses effective UUID when possible
123#define NECP_POLICY_CONDITION_REAL_APPLICATION 2 // uuid_t, never uses effective UUID. Only valid with NECP_POLICY_CONDITION_APPLICATION
124#define NECP_POLICY_CONDITION_DOMAIN 3 // String, such as apple.com
125#define NECP_POLICY_CONDITION_ACCOUNT 4 // String
126#define NECP_POLICY_CONDITION_ENTITLEMENT 5 // String
127#define NECP_POLICY_CONDITION_PID 6 // pid_t
128#define NECP_POLICY_CONDITION_UID 7 // uid_t
129#define NECP_POLICY_CONDITION_ALL_INTERFACES 8 // N/A
130#define NECP_POLICY_CONDITION_BOUND_INTERFACE 9 // String
131#define NECP_POLICY_CONDITION_TRAFFIC_CLASS 10 // necp_policy_condition_tc_range
132// Socket/IP conditions
133#define NECP_POLICY_CONDITION_IP_PROTOCOL 11 // u_int8_t
134#define NECP_POLICY_CONDITION_LOCAL_ADDR 12 // necp_policy_condition_addr
135#define NECP_POLICY_CONDITION_REMOTE_ADDR 13 // necp_policy_condition_addr
136#define NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE 14 // necp_policy_condition_addr_range
137#define NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE 15 // necp_policy_condition_addr_range
138#define NECP_POLICY_CONDITION_AGENT_TYPE 16 // struct necp_policy_condition_agent_type
139
140/*
141 * Results
142 */
143#define NECP_POLICY_RESULT_PASS 1 // N/A
144#define NECP_POLICY_RESULT_SKIP 2 // u_int32_t, policy order to skip to. 0 to skip all session policies.
145#define NECP_POLICY_RESULT_DROP 3 // N/A
146#define NECP_POLICY_RESULT_SOCKET_DIVERT 4 // u_int32_t, flow divert control unit
147#define NECP_POLICY_RESULT_SOCKET_FILTER 5 // u_int32_t, filter control unit
148#define NECP_POLICY_RESULT_IP_TUNNEL 6 // String, interface name
149#define NECP_POLICY_RESULT_IP_FILTER 7 // ?
150#define NECP_POLICY_RESULT_TRIGGER 8 // service uuid_t
151#define NECP_POLICY_RESULT_TRIGGER_IF_NEEDED 9 // service uuid_t
152#define NECP_POLICY_RESULT_TRIGGER_SCOPED 10 // service uuid_t
153#define NECP_POLICY_RESULT_NO_TRIGGER_SCOPED 11 // service uuid_t
154#define NECP_POLICY_RESULT_SOCKET_SCOPED 12 // String, interface name
155#define NECP_POLICY_RESULT_ROUTE_RULES 13 // N/A, must have route rules defined
156#define NECP_POLICY_RESULT_USE_NETAGENT 14 // netagent uuid_t
157#define NECP_POLICY_RESULT_NETAGENT_SCOPED 15 // netagent uuid_t
158#define NECP_POLICY_RESULT_SCOPED_DIRECT 16 // N/A, scopes to primary physical interface
159
160#define NECP_POLICY_RESULT_MAX NECP_POLICY_RESULT_SCOPED_DIRECT
161
162/*
163 * Route Rules
164 * Detailed parameters for NECP_POLICY_RESULT_ROUTE_RULES.
165 */
166#define NECP_ROUTE_RULE_NONE 0 // N/A
167#define NECP_ROUTE_RULE_DENY_INTERFACE 1 // String, or empty to match all
168#define NECP_ROUTE_RULE_ALLOW_INTERFACE 2 // String, or empty to match all
169#define NECP_ROUTE_RULE_QOS_MARKING 3 // String, or empty to match all
170#define NECP_ROUTE_RULE_DENY_LQM_ABORT 4 // String, or empty to match all
171
172#define NECP_ROUTE_RULE_FLAG_CELLULAR 0x01
173#define NECP_ROUTE_RULE_FLAG_WIFI 0x02
174#define NECP_ROUTE_RULE_FLAG_WIRED 0x04
175#define NECP_ROUTE_RULE_FLAG_EXPENSIVE 0x08
176
177/*
178 * Error types
179 */
180#define NECP_ERROR_INTERNAL 0
181#define NECP_ERROR_UNKNOWN_PACKET_TYPE 1
182#define NECP_ERROR_INVALID_TLV 2
183#define NECP_ERROR_POLICY_RESULT_INVALID 3
184#define NECP_ERROR_POLICY_CONDITIONS_INVALID 4
185#define NECP_ERROR_POLICY_ID_NOT_FOUND 5
186#define NECP_ERROR_INVALID_PROCESS 6
187#define NECP_ERROR_ROUTE_RULES_INVALID 7
188
189// Modifiers
190#define NECP_MASK_USERSPACE_ONLY 0x80000000 // on filter_control_unit value
191
192struct necp_policy_condition_tc_range {
193 u_int32_t start_tc;
194 u_int32_t end_tc;
195} __attribute__((__packed__));
196
197struct necp_policy_condition_addr {
198 u_int8_t prefix;
199 union {
200 struct sockaddr sa;
201 struct sockaddr_in sin;
202 struct sockaddr_in6 sin6;
203 } address;
204} __attribute__((__packed__));
205
206struct necp_policy_condition_addr_range {
207 union {
208 struct sockaddr sa;
209 struct sockaddr_in sin;
210 struct sockaddr_in6 sin6;
211 } start_address;
212 union {
213 struct sockaddr sa;
214 struct sockaddr_in sin;
215 struct sockaddr_in6 sin6;
216 } end_address;
217} __attribute__((__packed__));
218
219struct necp_policy_condition_agent_type {
220 char agent_domain[32];
221 char agent_type[32];
222} __attribute__((__packed__));
223
224#define NECP_SESSION_PRIORITY_UNKNOWN 0
225#define NECP_SESSION_PRIORITY_CONTROL 1
226#define NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL 2
227#define NECP_SESSION_PRIORITY_HIGH 3
228#define NECP_SESSION_PRIORITY_DEFAULT 4
229#define NECP_SESSION_PRIORITY_LOW 5
230
231#define NECP_SESSION_NUM_PRIORITIES NECP_SESSION_PRIORITY_LOW
232
233typedef u_int32_t necp_policy_id;
234typedef u_int32_t necp_policy_order;
235typedef u_int32_t necp_session_priority;
236
237typedef u_int32_t necp_kernel_policy_result;
238typedef u_int32_t necp_kernel_policy_filter;
239
240typedef union {
241 u_int tunnel_interface_index;
242 u_int scoped_interface_index;
243 u_int32_t flow_divert_control_unit;
244 u_int32_t filter_control_unit;
245} necp_kernel_policy_routing_result_parameter;
246
247#define NECP_SERVICE_FLAGS_REGISTERED 0x01
248#define NECP_MAX_NETAGENTS 8
249
250#define NECP_AGENT_USE_FLAG_SCOPE 0x01
251
252#define NECP_TFO_COOKIE_LEN_MAX 16
253struct necp_aggregate_result {
254 necp_kernel_policy_result routing_result;
255 necp_kernel_policy_routing_result_parameter routing_result_parameter;
256 necp_kernel_policy_filter filter_control_unit;
257 necp_kernel_policy_result service_action;
258 uuid_t service_uuid;
259 u_int32_t service_flags;
260 u_int32_t service_data;
261 u_int routed_interface_index;
262 u_int32_t policy_id;
263 uuid_t netagents[NECP_MAX_NETAGENTS];
264 u_int32_t netagent_use_flags[NECP_MAX_NETAGENTS];
265 u_int8_t mss_recommended;
266};
267
268/*
269 * Statistics. It would be nice if the definitions in ntstat.h could be used,
270 * but they get entangled with #defines for v4 etc in pfvar.h and it may be better practice
271 * to have separate definitions here.
272 */
273struct necp_stat_counts
274{
275 /* Counters */
276 u_int64_t necp_stat_rxpackets __attribute__((aligned(8)));
277 u_int64_t necp_stat_rxbytes __attribute__((aligned(8)));
278 u_int64_t necp_stat_txpackets __attribute__((aligned(8)));
279 u_int64_t necp_stat_txbytes __attribute__((aligned(8)));
280
281 u_int32_t necp_stat_rxduplicatebytes;
282 u_int32_t necp_stat_rxoutoforderbytes;
283 u_int32_t necp_stat_txretransmit;
284
285 u_int32_t necp_stat_connectattempts;
286 u_int32_t necp_stat_connectsuccesses;
287
288 u_int32_t necp_stat_min_rtt;
289 u_int32_t necp_stat_avg_rtt;
290 u_int32_t necp_stat_var_rtt;
291
292#define NECP_STAT_ROUTE_FLAGS 1
293 u_int32_t necp_stat_route_flags;
294};
295
296// Note, some metadata is implicit in the necp client itself:
297// From the process itself : pid, upid, uuid, proc name.
298// From the necp client parameters: local and remote addresses, euuid, traffic class, ifindex
299//
300// The following may well be supplied via future necp client parameters,
301// but they are here so they don't get forgotten.
302struct necp_basic_metadata
303{
304 u_int32_t rcvbufsize;
305 u_int32_t rcvbufused;
306};
307
308struct necp_tcp_probe_status {
309 unsigned int probe_activated : 1;
310 unsigned int write_probe_failed : 1;
311 unsigned int read_probe_failed : 1;
312 unsigned int conn_probe_failed : 1;
313};
314
315struct necp_extra_tcp_metadata
316{
317 struct necp_tcp_probe_status probestatus;
318
319 u_int32_t sndbufsize;
320 u_int32_t sndbufused;
321 u_int32_t txunacked;
322 u_int32_t txwindow;
323 u_int32_t txcwindow;
324 u_int32_t flags; // use SOF_*
325 u_int32_t flags1; // use SOF1_*
326 u_int32_t traffic_mgt_flags;
327 u_int32_t cc_alg_index;
328 u_int32_t state;
329 activity_bitmap_t activity_bitmap;
330};
331
332struct necp_stats_hdr {
333 u_int32_t necp_stats_type __attribute__((aligned(8)));
334 u_int32_t necp_stats_ver;
335 u_int64_t __necp_stats_reserved; // Pad the field for future use
336};
337
338#define NECP_CLIENT_STATISTICS_TYPE_TCP 1 // Identifies use of necp_tcp_stats
339#define NECP_CLIENT_STATISTICS_TYPE_UDP 2 // Identifies use of necp_udp_stats
340#define NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1 1 // Currently supported version for TCP
341#define NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1 1 // Currently supported version for UDP
342
343#define NECP_CLIENT_STATISTICS_TYPE_TCP_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1
344#define NECP_CLIENT_STATISTICS_TYPE_UDP_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1
345
346#define NECP_CLIENT_STATISTICS_EVENT_INIT 0x00000000 // Register the flow
347#define NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT 0x00000001 // The flow is effectively finished but waiting on timer
348
349struct necp_tcp_stats {
350 struct necp_stats_hdr necp_tcp_hdr;
351 struct necp_stat_counts necp_tcp_counts;
352 struct necp_basic_metadata necp_tcp_basic;
353 struct necp_extra_tcp_metadata necp_tcp_extra;
354};
355
356struct necp_udp_stats {
357 struct necp_stats_hdr necp_udp_hdr;
358 struct necp_stat_counts necp_udp_counts;
359 struct necp_basic_metadata necp_udp_basic;
360};
361
362typedef struct necp_all_stats {
363 union {
364 struct necp_tcp_stats tcp_stats;
365 struct necp_udp_stats udp_stats;
366 } all_stats_u;
367} necp_all_stats;
368
369// Memory for statistics is requested via a necp_stats_bufreq
370//
371struct necp_stats_bufreq {
372 u_int32_t necp_stats_bufreq_id __attribute__((aligned(8)));
373 u_int32_t necp_stats_bufreq_type; // NECP_CLIENT_STATISTICS_TYPE_*
374 u_int32_t necp_stats_bufreq_ver; // NECP_CLIENT_STATISTICS_TYPE_*_VER
375 u_int32_t necp_stats_bufreq_size;
376 union {
377 void *necp_stats_bufreq_addr;
378 mach_vm_address_t necp_stats_bufreq_uaddr;
379 };
380};
381
382#define NECP_CLIENT_STATISTICS_BUFREQ_ID 0xbf // Distinguishes from statistics actions taking a necp_all_stats struct
383
384// There is a limit to the number of statistics structures that may be allocated per process, subject to change
385//
386#define NECP_MAX_PER_PROCESS_CLIENT_STATISTICS_STRUCTS 512
387
388#define NECP_TCP_ECN_HEURISTICS_SYN_RST 1
389typedef struct necp_tcp_ecn_cache {
390 u_int8_t necp_tcp_ecn_heuristics_success:1;
391 u_int8_t necp_tcp_ecn_heuristics_loss:1;
392 u_int8_t necp_tcp_ecn_heuristics_drop_rst:1;
393 u_int8_t necp_tcp_ecn_heuristics_drop_rxmt:1;
394 u_int8_t necp_tcp_ecn_heuristics_aggressive:1;
395 u_int8_t necp_tcp_ecn_heuristics_syn_rst:1;
396} necp_tcp_ecn_cache;
397
398#define NECP_TCP_TFO_HEURISTICS_RST 1
399typedef struct necp_tcp_tfo_cache {
400 u_int8_t necp_tcp_tfo_cookie[NECP_TFO_COOKIE_LEN_MAX];
401 u_int8_t necp_tcp_tfo_cookie_len;
402 u_int8_t necp_tcp_tfo_heuristics_success:1; // TFO succeeded with data in the SYN
403 u_int8_t necp_tcp_tfo_heuristics_loss:1; // TFO SYN-loss with data
404 u_int8_t necp_tcp_tfo_heuristics_middlebox:1; // TFO middlebox detected
405 u_int8_t necp_tcp_tfo_heuristics_success_req:1; // TFO succeeded with the TFO-option in the SYN
406 u_int8_t necp_tcp_tfo_heuristics_loss_req:1; // TFO SYN-loss with the TFO-option
407 u_int8_t necp_tcp_tfo_heuristics_rst_data:1; // Recevied RST upon SYN with data in the SYN
408 u_int8_t necp_tcp_tfo_heuristics_rst_req:1; // Received RST upon SYN with the TFO-option
409} necp_tcp_tfo_cache;
410
411#define NECP_CLIENT_CACHE_TYPE_ECN 1 // Identifies use of necp_tcp_ecn_cache
412#define NECP_CLIENT_CACHE_TYPE_TFO 2 // Identifies use of necp_tcp_tfo_cache
413
414#define NECP_CLIENT_CACHE_TYPE_ECN_VER_1 1 // Currently supported version for ECN
415#define NECP_CLIENT_CACHE_TYPE_TFO_VER_1 1 // Currently supported version for TFO
416
417typedef struct necp_cache_buffer {
418 u_int8_t necp_cache_buf_type; // NECP_CLIENT_CACHE_TYPE_*
419 u_int8_t necp_cache_buf_ver; // NECP_CLIENT_CACHE_TYPE_*_VER
420 u_int32_t necp_cache_buf_size;
421 mach_vm_address_t necp_cache_buf_addr;
422} necp_cache_buffer;
423
424/*
425 * NECP Client definitions
426 */
427#define NECP_MAX_CLIENT_PARAMETERS_SIZE 1024
428#define NECP_MAX_CLIENT_RESULT_SIZE 512
429
430#define NECP_OPEN_FLAG_OBSERVER 0x01 // Observers can query clients they don't own
431#define NECP_OPEN_FLAG_BACKGROUND 0x02 // Mark this fd as backgrounded
432#define NECP_OPEN_FLAG_PUSH_OBSERVER 0x04 // When used with the OBSERVER flag, allows updates to be pushed. Adding clients is not allowed in this mode.
433
434#define NECP_FD_SUPPORTS_GUARD 1
435
436#define NECP_CLIENT_ACTION_ADD 1 // Register a new client. Input: parameters in buffer; Output: client_id
437#define NECP_CLIENT_ACTION_REMOVE 2 // Unregister a client. Input: client_id, optional struct ifnet_stats_per_flow
438#define NECP_CLIENT_ACTION_COPY_PARAMETERS 3 // Copy client parameters. Input: client_id; Output: parameters in buffer
439#define NECP_CLIENT_ACTION_COPY_RESULT 4 // Copy client result. Input: client_id; Output: result in buffer
440#define NECP_CLIENT_ACTION_COPY_LIST 5 // Copy all client IDs. Output: struct necp_client_list in buffer
441#define NECP_CLIENT_ACTION_REQUEST_NEXUS_INSTANCE 6 // Request a nexus instance from a nexus provider, optional struct necp_stats_bufreq
442#define NECP_CLIENT_ACTION_AGENT 7 // Interact with agent. Input: client_id, agent parameters
443#define NECP_CLIENT_ACTION_COPY_AGENT 8 // Copy agent content. Input: agent UUID; Output: struct netagent
444#define NECP_CLIENT_ACTION_COPY_INTERFACE 9 // Copy interface details. Input: ifindex cast to UUID; Output: struct necp_interface_details
445#define NECP_CLIENT_ACTION_SET_STATISTICS 10 // Deprecated
446#define NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS 11 // Get route statistics. Input: client_id; Output: struct necp_stat_counts
447#define NECP_CLIENT_ACTION_AGENT_USE 12 // Return the use count and increment the use count. Input/Output: struct necp_agent_use_parameters
448#define NECP_CLIENT_ACTION_MAP_SYSCTLS 13 // Get the read-only sysctls memory location. Output: mach_vm_address_t
449#define NECP_CLIENT_ACTION_UPDATE_CACHE 14 // Update heuristics and cache
450#define NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE 15 // Fetch an updated client for push-mode observer. Output: Client id, struct necp_client_observer_update in buffer
451#define NECP_CLIENT_ACTION_COPY_UPDATED_RESULT 16 // Copy client result only if changed. Input: client_id; Output: result in buffer
452#define NECP_CLIENT_ACTION_ADD_FLOW 17 // Add a flow. Input: client_id; Output: struct necp_client_add_flow
453#define NECP_CLIENT_ACTION_REMOVE_FLOW 18 // Remove a flow. Input: flow_id, optional struct ifnet_stats_per_flow
454
455
456#define NECP_CLIENT_PARAMETER_APPLICATION NECP_POLICY_CONDITION_APPLICATION // Requires entitlement
457#define NECP_CLIENT_PARAMETER_REAL_APPLICATION NECP_POLICY_CONDITION_REAL_APPLICATION // Requires entitlement
458#define NECP_CLIENT_PARAMETER_DOMAIN NECP_POLICY_CONDITION_DOMAIN
459#define NECP_CLIENT_PARAMETER_ACCOUNT NECP_POLICY_CONDITION_ACCOUNT
460#define NECP_CLIENT_PARAMETER_PID NECP_POLICY_CONDITION_PID // Requires entitlement
461#define NECP_CLIENT_PARAMETER_UID NECP_POLICY_CONDITION_UID // Requires entitlement
462#define NECP_CLIENT_PARAMETER_BOUND_INTERFACE NECP_POLICY_CONDITION_BOUND_INTERFACE
463#define NECP_CLIENT_PARAMETER_TRAFFIC_CLASS NECP_POLICY_CONDITION_TRAFFIC_CLASS
464#define NECP_CLIENT_PARAMETER_IP_PROTOCOL NECP_POLICY_CONDITION_IP_PROTOCOL
465#define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS NECP_POLICY_CONDITION_LOCAL_ADDR
466#define NECP_CLIENT_PARAMETER_REMOTE_ADDRESS NECP_POLICY_CONDITION_REMOTE_ADDR
467#define NECP_CLIENT_PARAMETER_NEXUS_KEY 102
468
469// "Prohibit" will never choose an interface with that property
470#define NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE 100 // String, interface name
471#define NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE 101 // u_int8_t, see ifru_functional_type in <net/if.h>
472#define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT 102 // uuid_t, network agent UUID
473#define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE 103 // struct necp_client_parameter_netagent_type
474
475// "Require" will choose an interface with that property, or none if not found
476#define NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE 111 // u_int8_t, see ifru_functional_type in <net/if.h>
477#define NECP_CLIENT_PARAMETER_REQUIRE_AGENT 112 // uuid_t, network agent UUID
478#define NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE 113 // struct necp_client_parameter_netagent_type
479
480// "Prefer" will choose an interface with an agent, or best otherwise if not found
481#define NECP_CLIENT_PARAMETER_PREFER_AGENT 122 // uuid_t, network agent UUID
482#define NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE 123 // struct necp_client_parameter_netagent_type
483
484// "Avoid" will choose an interface without an agent, or best otherwise if unavoidable
485#define NECP_CLIENT_PARAMETER_AVOID_AGENT 124 // uuid_t, network agent UUID
486#define NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE 125 // struct necp_client_parameter_netagent_type
487
488// Use actions with NECP_CLIENT_ACTION_AGENT
489#define NECP_CLIENT_PARAMETER_TRIGGER_AGENT 130 // uuid_t, network agent UUID
490#define NECP_CLIENT_PARAMETER_ASSERT_AGENT 131 // uuid_t, network agent UUID
491#define NECP_CLIENT_PARAMETER_UNASSERT_AGENT 132 // uuid_t, network agent UUID
492
493#define NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT 200 // struct necp_client_endpoint
494#define NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT 201 // struct necp_client_endpoint
495#define NECP_CLIENT_PARAMETER_BROWSE_CATEGORY 202 // struct necp_client_endpoint
496
497#define NECP_CLIENT_PARAMETER_FLAGS 250 // u_int32_t, see NECP_CLIENT_PAREMETER_FLAG_* values
498
499#define NECP_CLIENT_PARAMETER_FLAG_MULTIPATH 0x0001 // Get multipath interface results
500#define NECP_CLIENT_PARAMETER_FLAG_BROWSE 0x0002 // Agent assertions on nexuses are requests to browse
501#define NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE 0x0004 // Prohibit expensive interfaces
502#define NECP_CLIENT_PARAMETER_FLAG_LISTENER 0x0008 // Client is interested in listening for inbound connections
503#define NECP_CLIENT_PARAMETER_FLAG_DISCRETIONARY 0x0010 // Client's traffic is discretionary, and eligible for early defuncting
504#define NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE 0x0020 // Client is requesting to enable ECN
505#define NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE 0x0040 // Client is requesting to disable ECN
506#define NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE 0x0080 // Client is requesting to enable TFO
507#define NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE 0x0100 // Interpret NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE only for primary
508 // interface, and allow exceptions for multipath or listeners
509
510#define NECP_CLIENT_RESULT_CLIENT_ID 1 // uuid_t
511#define NECP_CLIENT_RESULT_POLICY_RESULT 2 // u_int32_t
512#define NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER 3 // u_int32_t
513#define NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT 4 // u_int32_t
514#define NECP_CLIENT_RESULT_INTERFACE_INDEX 5 // u_int32_t
515#define NECP_CLIENT_RESULT_NETAGENT 6 // struct necp_client_result_netagent
516#define NECP_CLIENT_RESULT_FLAGS 7 // u_int32_t, see NECP_CLIENT_RESULT_FLAG_* values
517#define NECP_CLIENT_RESULT_INTERFACE 8 // struct necp_client_result_interface
518#define NECP_CLIENT_RESULT_INTERFACE_OPTION 9 // struct necp_client_interface_option
519#define NECP_CLIENT_RESULT_EFFECTIVE_MTU 10 // u_int32_t
520#define NECP_CLIENT_RESULT_FLOW 11 // TLV array of a single flow's state
521#define NECP_CLIENT_RESULT_PROTO_CTL_EVENT 12
522#define NECP_CLIENT_RESULT_TFO_COOKIE 13 // NECP_TFO_COOKIE_LEN_MAX
523#define NECP_CLIENT_RESULT_TFO_FLAGS 14 // u_int8_t
524#define NECP_CLIENT_RESULT_RECOMMENDED_MSS 15 // u_int8_t
525#define NECP_CLIENT_RESULT_FLOW_ID 16 // uuid_t
526#define NECP_CLIENT_RESULT_INTERFACE_TIME_DELTA 17 // u_int32_t, seconds since interface up/down
527
528#define NECP_CLIENT_RESULT_NEXUS_INSTANCE 100 // uuid_t
529#define NECP_CLIENT_RESULT_NEXUS_PORT 101 // u_int16_t
530#define NECP_CLIENT_RESULT_NEXUS_KEY 102 // uuid_t
531#define NECP_CLIENT_RESULT_NEXUS_PORT_FLOW_INDEX 103 // u_int32_t
532#define NECP_CLIENT_RESULT_NEXUS_FLOW_STATS 104 // struct sk_stats_flow *
533
534#define NECP_CLIENT_RESULT_LOCAL_ENDPOINT 200 // struct necp_client_endpoint
535#define NECP_CLIENT_RESULT_REMOTE_ENDPOINT 201 // struct necp_client_endpoint
536#define NECP_CLIENT_RESULT_DISCOVERED_ENDPOINT 202 // struct necp_client_endpoint, result of browse
537#define NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS 210 // u_int32_t
538#define NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG 211 // u_int32_t, 1: background, 0: not background
539
540#define NECP_CLIENT_RESULT_FLAG_IS_LOCAL 0x0001 // Routes to this device
541#define NECP_CLIENT_RESULT_FLAG_IS_DIRECT 0x0002 // Routes to directly accessible peer
542#define NECP_CLIENT_RESULT_FLAG_HAS_IPV4 0x0004 // Supports IPv4
543#define NECP_CLIENT_RESULT_FLAG_HAS_IPV6 0x0008 // Supports IPv6
544#define NECP_CLIENT_RESULT_FLAG_DEFUNCT 0x0010 // Defunct
545#define NECP_CLIENT_RESULT_FLAG_SATISFIED 0x0020 // Satisfied path
546#define NECP_CLIENT_RESULT_FLAG_FLOW_ASSIGNED 0x0040 // Assigned, the flow is active
547#define NECP_CLIENT_RESULT_FLAG_FLOW_VIABLE 0x0080 // Viable, the flow has a valid route
548#define NECP_CLIENT_RESULT_FLAG_PROBE_CONNECTIVITY 0x0100 // Flow should probe connectivity
549#define NECP_CLIENT_RESULT_FLAG_ECN_ENABLED 0x0200 // ECN should be used
550#define NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED 0x0400 // Fast open should not be used
551#define NECP_CLIENT_RESULT_FLAG_LINK_QUALITY_ABORT 0x0800 // Link quality is very bad, recommend close connections
552#define NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING 0x1000 // QoS marking is allowed
553#define NECP_CLIENT_RESULT_FLAG_HAS_NAT64 0x2000 // Has NAT64 prefix
554#define NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER 0x4000 // Interface is in low-power mode
555
556#define NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE (NECP_CLIENT_RESULT_FLAG_HAS_IPV4 | NECP_CLIENT_RESULT_FLAG_HAS_IPV6 | NECP_CLIENT_RESULT_FLAG_HAS_NAT64 | NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER)
557
558#define NECP_CLIENT_RESULT_FAST_OPEN_SND_PROBE 0x01 // DEPRECATED - Fast open send probe
559#define NECP_CLIENT_RESULT_FAST_OPEN_RCV_PROBE 0x02 // DEPRECATED - Fast open receive probe
560
561#define NECP_CLIENT_RESULT_RECOMMENDED_MSS_NONE 0x01
562#define NECP_CLIENT_RESULT_RECOMMENDED_MSS_LOW 0x02
563#define NECP_CLIENT_RESULT_RECOMMENDED_MSS_MEDIUM 0x04
564
565struct necp_interface_signature {
566 u_int8_t signature[IFNET_SIGNATURELEN];
567 u_int8_t signature_len;
568};
569
570struct necp_interface_details {
571 char name[IFXNAMSIZ];
572 u_int32_t index;
573 u_int32_t generation;
574 u_int32_t functional_type;
575 u_int32_t delegate_index;
576 u_int32_t flags; // see NECP_INTERFACE_FLAG_*
577 u_int32_t mtu;
578 struct necp_interface_signature ipv4_signature;
579 struct necp_interface_signature ipv6_signature;
580};
581
582#define NECP_INTERFACE_FLAG_EXPENSIVE 0x0001
583#define NECP_INTERFACE_FLAG_TXSTART 0X0002
584#define NECP_INTERFACE_FLAG_NOACKPRI 0x0004
585#define NECP_INTERFACE_FLAG_3CARRIERAGG 0x0008
586#define NECP_INTERFACE_FLAG_IS_LOW_POWER 0x0010
587
588struct necp_client_parameter_netagent_type {
589 char netagent_domain[32];
590 char netagent_type[32];
591};
592
593struct necp_client_result_netagent {
594 u_int32_t generation;
595 uuid_t netagent_uuid;
596};
597
598struct necp_client_result_interface {
599 u_int32_t generation;
600 u_int32_t index;
601};
602
603struct necp_client_interface_option {
604 u_int32_t interface_index;
605 u_int32_t interface_generation;
606 uuid_t nexus_agent;
607};
608
609struct necp_client_endpoint {
610 union {
611 struct sockaddr sa;
612 struct sockaddr_in sin;
613 struct sockaddr_in6 sin6;
614 struct {
615 u_int8_t endpoint_length;
616 u_int8_t endpoint_family; // Use AF_UNSPEC to target a name
617 u_int16_t endpoint_port;
618 u_int32_t endpoint_type; // Client-specific type
619 char endpoint_data[0]; // Type-specific endpoint value
620 } endpoint;
621 } u;
622};
623
624struct necp_client_list {
625 u_int32_t client_count;
626 uuid_t clients[0];
627};
628
629struct kev_necp_policies_changed_data {
630 u_int32_t changed_count; // Defaults to 0.
631};
632
633#define NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS 0x01 // Request a nexus instance upon adding a flow
634#define NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID 0x02 // Register the client ID rather than the flow registration ID with network agents
635
636struct necp_client_flow_stats {
637 u_int32_t stats_type; // NECP_CLIENT_STATISTICS_TYPE_*
638 u_int32_t stats_version; // NECP_CLIENT_STATISTICS_TYPE_*_VER
639 u_int32_t stats_size;
640 mach_vm_address_t stats_addr;
641};
642
643struct necp_client_add_flow {
644 uuid_t agent_uuid;
645 uuid_t registration_id;
646 u_int16_t flags; // NECP_CLIENT_FLOW_FLAGS_*
647 u_int16_t stats_request_count;
648 struct necp_client_flow_stats stats_requests[0];
649} __attribute__((__packed__));
650
651struct necp_agent_use_parameters {
652 uuid_t agent_uuid;
653 uint64_t out_use_count;
654};
655
656struct necp_client_flow_protoctl_event {
657 uint32_t protoctl_event_code;
658 uint32_t protoctl_event_val;
659 /* TCP seq number is in host byte order */
660 uint32_t protoctl_event_tcp_seq_num;
661};
662
663#define NECP_CLIENT_UPDATE_TYPE_PARAMETERS 1 // Parameters, for a new client
664#define NECP_CLIENT_UPDATE_TYPE_RESULT 2 // Result, for a udpated client
665#define NECP_CLIENT_UPDATE_TYPE_REMOVE 3 // Empty, for a removed client
666
667struct necp_client_observer_update {
668 u_int32_t update_type; // NECP_CLIENT_UPDATE_TYPE_*
669 u_int8_t tlv_buffer[0]; // Parameters or result as TLVs, based on type
670};
671
672#ifdef BSD_KERNEL_PRIVATE
673#include <stdbool.h>
674#include <sys/socketvar.h>
675#include <sys/kern_control.h>
676#include <netinet/ip_var.h>
677#include <netinet6/ip6_var.h>
678#include <net/if_var.h>
679#include <sys/syslog.h>
680#include <net/network_agent.h>
681
682SYSCTL_DECL(_net_necp);
683
684#define NECPLOG(level, format, ...) do { \
685 log((level > LOG_NOTICE ? LOG_NOTICE : level), "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \
686} while (0)
687
688#define NECPLOG0(level, msg) do { \
689 log((level > LOG_NOTICE ? LOG_NOTICE : level), "%s: %s\n", __FUNCTION__, msg); \
690} while (0)
691
692enum necp_fd_type_t {
693 necp_fd_type_invalid = 0,
694 necp_fd_type_session = 1,
695 necp_fd_type_client = 2,
696};
697
698union necp_sockaddr_union {
699 struct sockaddr sa;
700 struct sockaddr_in sin;
701 struct sockaddr_in6 sin6;
702};
703
704/*
705 * kstats
706 * The ustats and kstats region are mirrored. So when we allocate with
707 * skmem_cache from kstats region, we also get an ustats object. To tie them
708 * together, kstats has an extra *necp_stats_ustats pointer pointing to the
709 * ustats object
710 */
711struct necp_all_kstats {
712 struct necp_all_stats necp_stats_comm; /* kernel private stats snapshot */
713 struct necp_all_stats *necp_stats_ustats; /* points to user-visible stats (in shared ustats region) */
714};
715
716extern errno_t necp_client_init(void);
717extern int necp_application_find_policy_match_internal(proc_t proc, u_int8_t *parameters, u_int32_t parameters_size,
718 struct necp_aggregate_result *returned_result,
719 u_int32_t *flags, u_int required_interface_index,
720 const union necp_sockaddr_union *override_local_addr,
721 const union necp_sockaddr_union *override_remote_addr,
722 struct rtentry **returned_route, bool ignore_address);
723/*
724 * TLV utilities
725 *
726 * Note that these functions (other than necp_buffer_find_tlv) do not check the length of the entire buffer,
727 * so the caller must be sure that the entire TLV is within bounds.
728 */
729struct necp_tlv_header {
730 u_int8_t type;
731 u_int32_t length;
732} __attribute__((__packed__));
733
734extern u_int8_t *necp_buffer_write_tlv(u_int8_t *cursor, u_int8_t type, u_int32_t length, const void *value,
735 u_int8_t *buffer, u_int32_t buffer_length);
736extern u_int8_t *necp_buffer_write_tlv_if_different(u_int8_t *cursor, u_int8_t type,
737 u_int32_t length, const void *value, bool *updated,
738 u_int8_t *buffer, u_int32_t buffer_length);
739extern u_int8_t necp_buffer_get_tlv_type(u_int8_t *buffer, int tlv_offset);
740extern u_int32_t necp_buffer_get_tlv_length(u_int8_t *buffer, int tlv_offset);
741extern u_int8_t *necp_buffer_get_tlv_value(u_int8_t *buffer, int tlv_offset, u_int32_t *value_size);
742extern int necp_buffer_find_tlv(u_int8_t *buffer, u_int32_t buffer_length, int offset, u_int8_t type, int next);
743
744#define NECPCTL_DROP_ALL_LEVEL 1 /* Drop all packets if no policy matches above this level */
745#define NECPCTL_DEBUG 2 /* Log all kernel policy matches */
746#define NECPCTL_PASS_LOOPBACK 3 /* Pass all loopback traffic */
747#define NECPCTL_PASS_KEEPALIVES 4 /* Pass all kernel-generated keepalive traffic */
748#define NECPCTL_SOCKET_POLICY_COUNT 5 /* Count of all socket-level policies */
749#define NECPCTL_SOCKET_NON_APP_POLICY_COUNT 6 /* Count of non-per-app socket-level policies */
750#define NECPCTL_IP_POLICY_COUNT 7 /* Count of all ip-level policies */
751#define NECPCTL_SESSION_COUNT 8 /* Count of NECP sessions */
752#define NECPCTL_CLIENT_FD_COUNT 9 /* Count of NECP client fds */
753#define NECPCTL_CLIENT_COUNT 10 /* Count of NECP clients */
754#define NECPCTL_ARENA_COUNT 11 /* Count of NECP arenas (stats, etc) */
755#define NECPCTL_NEXUS_FLOW_COUNT 12 /* Count of NECP nexus flows */
756#define NECPCTL_SOCKET_FLOW_COUNT 13 /* Count of NECP socket flows */
757#define NECPCTL_IF_FLOW_COUNT 14 /* Count of NECP socket flows */
758#define NECPCTL_OBSERVER_FD_COUNT 15 /* Count of NECP observer fds */
759#define NECPCTL_OBSERVER_MESSAGE_LIMIT 16 /* Number of of NECP observer messages allowed to be queued */
760#define NECPCTL_SYSCTL_ARENA_COUNT 17 /* Count of sysctl arenas */
761
762#define NECPCTL_NAMES { \
763 { 0, 0 }, \
764 { "drop_all_level", CTLTYPE_INT }, \
765 { "debug", CTLTYPE_INT }, \
766 { "pass_loopback", CTLTYPE_INT }, \
767 { "pass_keepalives", CTLTYPE_INT }, \
768}
769
770typedef u_int32_t necp_kernel_policy_id;
771#define NECP_KERNEL_POLICY_ID_NONE 0
772#define NECP_KERNEL_POLICY_ID_NO_MATCH 1
773#define NECP_KERNEL_POLICY_ID_FIRST_VALID_SOCKET 2
774#define NECP_KERNEL_POLICY_ID_FIRST_VALID_IP UINT16_MAX
775
776typedef u_int32_t necp_app_id;
777
778#define NECP_KERNEL_POLICY_RESULT_NONE 0
779#define NECP_KERNEL_POLICY_RESULT_PASS NECP_POLICY_RESULT_PASS
780#define NECP_KERNEL_POLICY_RESULT_SKIP NECP_POLICY_RESULT_SKIP
781#define NECP_KERNEL_POLICY_RESULT_DROP NECP_POLICY_RESULT_DROP
782#define NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT NECP_POLICY_RESULT_SOCKET_DIVERT
783#define NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER NECP_POLICY_RESULT_SOCKET_FILTER
784#define NECP_KERNEL_POLICY_RESULT_IP_TUNNEL NECP_POLICY_RESULT_IP_TUNNEL
785#define NECP_KERNEL_POLICY_RESULT_IP_FILTER NECP_POLICY_RESULT_IP_FILTER
786#define NECP_KERNEL_POLICY_RESULT_TRIGGER NECP_POLICY_RESULT_TRIGGER
787#define NECP_KERNEL_POLICY_RESULT_TRIGGER_IF_NEEDED NECP_POLICY_RESULT_TRIGGER_IF_NEEDED
788#define NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED NECP_POLICY_RESULT_TRIGGER_SCOPED
789#define NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED NECP_POLICY_RESULT_NO_TRIGGER_SCOPED
790#define NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED NECP_POLICY_RESULT_SOCKET_SCOPED
791#define NECP_KERNEL_POLICY_RESULT_ROUTE_RULES NECP_POLICY_RESULT_ROUTE_RULES
792#define NECP_KERNEL_POLICY_RESULT_USE_NETAGENT NECP_POLICY_RESULT_USE_NETAGENT
793#define NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED NECP_POLICY_RESULT_NETAGENT_SCOPED
794#define NECP_KERNEL_POLICY_RESULT_SCOPED_DIRECT NECP_POLICY_RESULT_SCOPED_DIRECT
795
796typedef struct {
797 u_int32_t identifier;
798 u_int32_t data;
799} necp_kernel_policy_service;
800
801typedef union {
802 u_int tunnel_interface_index;
803 u_int scoped_interface_index;
804 u_int32_t flow_divert_control_unit;
805 u_int32_t filter_control_unit;
806 u_int32_t skip_policy_order;
807 u_int32_t route_rule_id;
808 u_int32_t netagent_id;
809 necp_kernel_policy_service service;
810} necp_kernel_policy_result_parameter;
811
812enum necp_boolean_state {
813 necp_boolean_state_unknown = 0,
814 necp_boolean_state_false = 1,
815 necp_boolean_state_true = 2,
816};
817
818struct necp_kernel_socket_policy {
819 LIST_ENTRY(necp_kernel_socket_policy) chain;
820 necp_kernel_policy_id id;
821 necp_policy_order order;
822 u_int32_t session_order;
823 int session_pid;
824
825 u_int32_t condition_mask;
826 u_int32_t condition_negated_mask;
827 necp_kernel_policy_id cond_policy_id;
828 u_int32_t cond_app_id; // Locally assigned ID value stored
829 u_int32_t cond_real_app_id; // Locally assigned ID value stored
830 char *cond_custom_entitlement; // String
831 u_int8_t cond_custom_entitlement_matched;// Boolean if entitlement matched app
832 u_int32_t cond_account_id; // Locally assigned ID value stored
833 char *cond_domain; // String
834 u_int8_t cond_domain_dot_count; // Number of dots in cond_domain
835 pid_t cond_pid;
836 uid_t cond_uid;
837 ifnet_t cond_bound_interface; // Matches specific binding only
838 struct necp_policy_condition_tc_range cond_traffic_class; // Matches traffic class in range
839 u_int16_t cond_protocol; // Matches IP protcol number
840 union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
841 union necp_sockaddr_union cond_local_end; // Matches IP address range
842 u_int8_t cond_local_prefix; // Defines subnet
843 union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
844 union necp_sockaddr_union cond_remote_end; // Matches IP address range
845 u_int8_t cond_remote_prefix; // Defines subnet
846 struct necp_policy_condition_agent_type cond_agent_type;
847
848 necp_kernel_policy_result result;
849 necp_kernel_policy_result_parameter result_parameter;
850};
851
852struct necp_kernel_ip_output_policy {
853 LIST_ENTRY(necp_kernel_ip_output_policy) chain;
854 necp_kernel_policy_id id;
855 necp_policy_order suborder;
856 necp_policy_order order;
857 u_int32_t session_order;
858 int session_pid;
859
860 u_int32_t condition_mask;
861 u_int32_t condition_negated_mask;
862 necp_kernel_policy_id cond_policy_id;
863 ifnet_t cond_bound_interface; // Matches specific binding only
864 u_int16_t cond_protocol; // Matches IP protcol number
865 union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
866 union necp_sockaddr_union cond_local_end; // Matches IP address range
867 u_int8_t cond_local_prefix; // Defines subnet
868 union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
869 union necp_sockaddr_union cond_remote_end; // Matches IP address range
870 u_int8_t cond_remote_prefix; // Defines subnet
871 u_int32_t cond_last_interface_index;
872
873 necp_kernel_policy_result result;
874 necp_kernel_policy_result_parameter result_parameter;
875};
876
877#define MAX_KERNEL_SOCKET_POLICIES 1
878#define MAX_KERNEL_IP_OUTPUT_POLICIES 4
879struct necp_session_policy {
880 LIST_ENTRY(necp_session_policy) chain;
881 bool applied; // Applied into the kernel table
882 bool pending_deletion; // Waiting to be removed from kernel table
883 bool pending_update; // Policy has been modified since creation/last application
884 necp_policy_id local_id;
885 necp_policy_order order;
886 u_int8_t *result;
887 u_int32_t result_size;
888 u_int8_t *conditions; // Array of conditions, each with a u_int32_t length at start
889 u_int32_t conditions_size;
890 u_int8_t *route_rules; // Array of route rules, each with a u_int32_t length at start
891 u_int32_t route_rules_size;
892
893 uuid_t applied_app_uuid;
894 uuid_t applied_real_app_uuid;
895 char *applied_account;
896
897 uuid_t applied_result_uuid;
898
899 u_int32_t applied_route_rules_id;
900
901 necp_kernel_policy_id kernel_socket_policies[MAX_KERNEL_SOCKET_POLICIES];
902 necp_kernel_policy_id kernel_ip_output_policies[MAX_KERNEL_IP_OUTPUT_POLICIES];
903};
904
905struct necp_aggregate_socket_result {
906 necp_kernel_policy_result result;
907 necp_kernel_policy_result_parameter result_parameter;
908 necp_kernel_policy_filter filter_control_unit;
909 u_int32_t route_rule_id;
910 int32_t qos_marking_gencount;
911};
912
913struct necp_inpcb_result {
914 u_int32_t app_id;
915 necp_kernel_policy_id policy_id;
916 necp_kernel_policy_id skip_policy_id;
917 int32_t policy_gencount;
918 u_int32_t flowhash;
919 struct necp_aggregate_socket_result results;
920};
921
922extern errno_t necp_init(void);
923
924extern errno_t necp_set_socket_attributes(struct socket *so, struct sockopt *sopt);
925extern errno_t necp_get_socket_attributes(struct socket *so, struct sockopt *sopt);
926extern void necp_inpcb_remove_cb(struct inpcb *inp);
927extern void necp_inpcb_dispose(struct inpcb *inp);
928
929extern u_int32_t necp_socket_get_content_filter_control_unit(struct socket *so);
930
931extern bool necp_socket_should_use_flow_divert(struct inpcb *inp);
932extern u_int32_t necp_socket_get_flow_divert_control_unit(struct inpcb *inp);
933
934extern bool necp_socket_should_rescope(struct inpcb *inp);
935extern u_int necp_socket_get_rescope_if_index(struct inpcb *inp);
936extern u_int32_t necp_socket_get_effective_mtu(struct inpcb *inp, u_int32_t current_mtu);
937
938extern bool necp_socket_is_allowed_to_send_recv(struct inpcb *inp, necp_kernel_policy_id *return_policy_id,
939 u_int32_t *return_route_rule_id,
940 necp_kernel_policy_id *return_skip_policy_id);
941extern bool necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port,
942 u_int16_t remote_port, struct in_addr *local_addr,
943 struct in_addr *remote_addr, ifnet_t interface,
944 necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id,
945 necp_kernel_policy_id *return_skip_policy_id);
946extern bool necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port,
947 u_int16_t remote_port, struct in6_addr *local_addr,
948 struct in6_addr *remote_addr, ifnet_t interface,
949 necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id,
950 necp_kernel_policy_id *return_skip_policy_id);
951extern void necp_socket_update_qos_marking(struct inpcb *inp, struct rtentry *route, struct ifnet *interface, u_int32_t route_rule_id);
952extern int necp_mark_packet_from_socket(struct mbuf *packet, struct inpcb *inp, necp_kernel_policy_id policy_id,
953 u_int32_t route_rule_id, necp_kernel_policy_id skip_policy_id);
954extern necp_kernel_policy_id necp_get_policy_id_from_packet(struct mbuf *packet);
955extern necp_kernel_policy_id necp_get_skip_policy_id_from_packet(struct mbuf *packet);
956extern u_int32_t necp_get_last_interface_index_from_packet(struct mbuf *packet);
957extern u_int32_t necp_get_route_rule_id_from_packet(struct mbuf *packet);
958extern int necp_get_app_uuid_from_packet(struct mbuf *packet,
959 uuid_t app_uuid);
960
961extern necp_kernel_policy_id necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local_addr,
962 struct sockaddr *override_remote_addr, u_int32_t override_bound_interface);
963extern necp_kernel_policy_id necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_args *ipoa,
964 necp_kernel_policy_result *result,
965 necp_kernel_policy_result_parameter *result_parameter);
966extern necp_kernel_policy_id necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out_args *ip6oa,
967 necp_kernel_policy_result *result,
968 necp_kernel_policy_result_parameter *result_parameter);
969
970extern int necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id);
971extern int necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface);
972
973extern ifnet_t necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter);
974extern bool necp_packet_can_rebind_to_ifnet(struct mbuf *packet, struct ifnet *interface, struct route *new_route, int family);
975
976extern bool necp_packet_is_allowed_over_interface(struct mbuf *packet, struct ifnet *interface);
977
978extern int necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive);
979extern bool necp_get_is_keepalive_from_packet(struct mbuf *packet);
980
981extern void necp_update_all_clients(void); // Handle general re-evaluate event
982
983extern void necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid, u_int32_t agent_generation); // Cause a single client to get an update event
984
985extern void necp_set_client_as_background(proc_t proc, struct fileproc *fp, bool background); // Set all clients for an fp as background or not
986
987struct necp_fd_data;
988extern void necp_fd_memstatus(proc_t proc, uint32_t status, struct necp_fd_data *client_fd); // Purge memory of clients for the process
989extern void necp_fd_defunct(proc_t proc, struct necp_fd_data *client_fd); // Set all clients for an process as defunct
990
991extern int necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp);
992
993extern int necp_client_assert_bb_radio_manager(uuid_t client_id, bool assert);
994
995extern int necp_client_assign_from_socket(pid_t pid, uuid_t client_id, struct inpcb *inp);
996
997extern int necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id,
998 u_int8_t *assigned_results, size_t assigned_results_length);
999struct skmem_obj_info; // forward declaration
1000extern int necp_stats_ctor(struct skmem_obj_info *oi, struct skmem_obj_info *oim, void *arg, uint32_t skmflag);
1001extern int necp_stats_dtor(void *addr, void *arg);
1002
1003/* value to denote invalid flow advisory index */
1004struct netagent_session;
1005extern int
1006necp_update_flow_protoctl_event(uuid_t netagent_uuid, uuid_t client_id,
1007 uint32_t protoctl_event_code, uint32_t protoctl_event_val,
1008 uint32_t protoctl_event_tcp_seq_num);
1009
1010#define NECP_FLOWADV_IDX_INVALID UINT32_MAX
1011extern void *necp_create_nexus_assign_message(uuid_t nexus_instance, u_int32_t nexus_port, void *key, uint32_t key_length,
1012 struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint,
1013 u_int32_t flow_adv_index, void *flow_stats, size_t *message_length);
1014
1015struct necp_client_nexus_parameters {
1016 pid_t pid;
1017 pid_t epid;
1018 uuid_t euuid;
1019 union necp_sockaddr_union local_addr;
1020 union necp_sockaddr_union remote_addr;
1021 u_int16_t ip_protocol;
1022 u_int32_t traffic_class;
1023 necp_policy_id policy_id;
1024 unsigned is_listener:1;
1025 unsigned allow_qos_marking:1;
1026};
1027
1028#define NECP_CLIENT_CBACTION_NONVIABLE 1
1029#define NECP_CLIENT_CBACTION_VIABLE 2
1030#define NECP_CLIENT_CBACTION_INITIAL 3
1031
1032struct necp_client_add_flow_default {
1033 uuid_t agent_uuid;
1034 uuid_t registration_id;
1035 u_int16_t flags; // NECP_CLIENT_FLOW_FLAGS_*
1036 u_int16_t stats_request_count;
1037 struct necp_client_flow_stats stats_requests[1];
1038} __attribute__((__packed__));
1039
1040typedef void (*necp_client_flow_cb)(void *handle, int action, uint32_t interface_index, uint32_t necp_flags, bool *viable);
1041
1042extern void necp_client_reap_caches(boolean_t purge);
1043
1044
1045#endif /* BSD_KERNEL_PRIVATE */
1046#ifndef KERNEL
1047
1048extern int necp_match_policy(const uint8_t *parameters, size_t parameters_size, struct necp_aggregate_result *returned_result);
1049
1050extern int necp_open(int flags);
1051
1052extern int necp_client_action(int necp_fd, uint32_t action, uuid_t client_id,
1053 size_t client_id_len, uint8_t *buffer, size_t buffer_size);
1054
1055extern int necp_session_open(int flags);
1056
1057extern int necp_session_action(int necp_fd, uint32_t action,
1058 uint8_t *in_buffer, size_t in_buffer_length,
1059 uint8_t *out_buffer, size_t out_buffer_length);
1060
1061#endif /* !KERNEL */
1062
1063#endif /* PRIVATE */
1064
1065#endif
1066