1 | /* |
2 | * Copyright (c) 2013-2018 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | #ifndef _NET_NECP_H_ |
30 | #define _NET_NECP_H_ |
31 | |
32 | #include <net/net_kev.h> |
33 | #ifdef PRIVATE |
34 | |
35 | #include <netinet/in.h> |
36 | #include <netinet/in_stat.h> |
37 | #include <sys/socket.h> |
38 | #include <net/if.h> |
39 | |
40 | /* |
41 | * Name registered by the ipsec kernel control |
42 | */ |
43 | #define NECP_CONTROL_NAME "com.apple.net.necp_control" |
44 | |
45 | #define NECP_TLV_LENGTH_UINT32 1 |
46 | |
47 | struct { |
48 | u_int8_t ; |
49 | u_int8_t ; |
50 | u_int32_t ; |
51 | }; |
52 | |
53 | /* |
54 | * Control message commands |
55 | */ |
56 | #define NECP_PACKET_TYPE_POLICY_ADD 1 |
57 | #define NECP_PACKET_TYPE_POLICY_GET 2 |
58 | #define NECP_PACKET_TYPE_POLICY_DELETE 3 |
59 | #define NECP_PACKET_TYPE_POLICY_APPLY_ALL 4 |
60 | #define NECP_PACKET_TYPE_POLICY_LIST_ALL 5 |
61 | #define NECP_PACKET_TYPE_POLICY_DELETE_ALL 6 |
62 | #define NECP_PACKET_TYPE_SET_SESSION_PRIORITY 7 |
63 | #define NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC 8 |
64 | #define NECP_PACKET_TYPE_REGISTER_SERVICE 9 |
65 | #define NECP_PACKET_TYPE_UNREGISTER_SERVICE 10 |
66 | #define NECP_PACKET_TYPE_POLICY_DUMP_ALL 11 |
67 | |
68 | /* |
69 | * Session actions |
70 | */ |
71 | #define NECP_SESSION_ACTION_POLICY_ADD 1 // In: Policy TLVs Out: necp_policy_id |
72 | #define NECP_SESSION_ACTION_POLICY_GET 2 // In: necp_policy_id Out: Policy TLVs |
73 | #define NECP_SESSION_ACTION_POLICY_DELETE 3 // In: necp_policy_id Out: None |
74 | #define NECP_SESSION_ACTION_POLICY_APPLY_ALL 4 // In: None Out: None |
75 | #define NECP_SESSION_ACTION_POLICY_LIST_ALL 5 // In: None Out: TLVs of IDs |
76 | #define NECP_SESSION_ACTION_POLICY_DELETE_ALL 6 // In: None Out: None |
77 | #define NECP_SESSION_ACTION_SET_SESSION_PRIORITY 7 // In: necp_session_priority Out: None |
78 | #define NECP_SESSION_ACTION_LOCK_SESSION_TO_PROC 8 // In: None Out: None |
79 | #define NECP_SESSION_ACTION_REGISTER_SERVICE 9 // In: uuid_t Out: None |
80 | #define NECP_SESSION_ACTION_UNREGISTER_SERVICE 10 // In: uuid_t Out: None |
81 | #define NECP_SESSION_ACTION_POLICY_DUMP_ALL 11 // In: None Out: uint32_t bytes length, then Policy TLVs |
82 | |
83 | /* |
84 | * Control message flags |
85 | */ |
86 | #define NECP_PACKET_FLAGS_RESPONSE 0x01 // Used for acks, errors, and query responses |
87 | |
88 | /* |
89 | * Control message TLV types |
90 | */ |
91 | #define NECP_TLV_NIL 0 |
92 | #define NECP_TLV_ERROR 1 // u_int32_t |
93 | #define NECP_TLV_POLICY_ORDER 2 // u_int32_t |
94 | #define NECP_TLV_POLICY_CONDITION 3 |
95 | #define NECP_TLV_POLICY_RESULT 4 |
96 | #define NECP_TLV_POLICY_ID 5 // u_int32_t |
97 | #define NECP_TLV_SESSION_PRIORITY 6 // u_int32_t |
98 | #define NECP_TLV_ATTRIBUTE_DOMAIN 7 // char[] |
99 | #define NECP_TLV_ATTRIBUTE_ACCOUNT 8 // char[] |
100 | #define NECP_TLV_SERVICE_UUID 9 // uuid_t |
101 | #define NECP_TLV_ROUTE_RULE 10 |
102 | |
103 | /* |
104 | * Control message TLV sent only by the kernel to userspace |
105 | */ |
106 | #define NECP_TLV_POLICY_OWNER 100 // char [] |
107 | #define NECP_TLV_POLICY_DUMP 101 |
108 | #define NECP_TLV_POLICY_RESULT_STRING 102 // char [] |
109 | #define NECP_TLV_POLICY_SESSION_ORDER 103 // u_int32_t |
110 | |
111 | /* |
112 | * Condition flags |
113 | */ |
114 | #define NECP_POLICY_CONDITION_FLAGS_NEGATIVE 0x01 // Negative |
115 | |
116 | /* |
117 | * Conditions |
118 | * Used for setting policies as well as passing parameters to necp_match_policy. |
119 | */ |
120 | #define NECP_POLICY_CONDITION_DEFAULT 0 // N/A, not valid with any other conditions |
121 | // Socket/Application conditions |
122 | #define NECP_POLICY_CONDITION_APPLICATION 1 // uuid_t, uses effective UUID when possible |
123 | #define NECP_POLICY_CONDITION_REAL_APPLICATION 2 // uuid_t, never uses effective UUID. Only valid with NECP_POLICY_CONDITION_APPLICATION |
124 | #define NECP_POLICY_CONDITION_DOMAIN 3 // String, such as apple.com |
125 | #define NECP_POLICY_CONDITION_ACCOUNT 4 // String |
126 | #define NECP_POLICY_CONDITION_ENTITLEMENT 5 // String |
127 | #define NECP_POLICY_CONDITION_PID 6 // pid_t |
128 | #define NECP_POLICY_CONDITION_UID 7 // uid_t |
129 | #define NECP_POLICY_CONDITION_ALL_INTERFACES 8 // N/A |
130 | #define NECP_POLICY_CONDITION_BOUND_INTERFACE 9 // String |
131 | #define NECP_POLICY_CONDITION_TRAFFIC_CLASS 10 // necp_policy_condition_tc_range |
132 | // Socket/IP conditions |
133 | #define NECP_POLICY_CONDITION_IP_PROTOCOL 11 // u_int8_t |
134 | #define NECP_POLICY_CONDITION_LOCAL_ADDR 12 // necp_policy_condition_addr |
135 | #define NECP_POLICY_CONDITION_REMOTE_ADDR 13 // necp_policy_condition_addr |
136 | #define NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE 14 // necp_policy_condition_addr_range |
137 | #define NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE 15 // necp_policy_condition_addr_range |
138 | #define NECP_POLICY_CONDITION_AGENT_TYPE 16 // struct necp_policy_condition_agent_type |
139 | |
140 | /* |
141 | * Results |
142 | */ |
143 | #define NECP_POLICY_RESULT_PASS 1 // N/A |
144 | #define NECP_POLICY_RESULT_SKIP 2 // u_int32_t, policy order to skip to. 0 to skip all session policies. |
145 | #define NECP_POLICY_RESULT_DROP 3 // N/A |
146 | #define NECP_POLICY_RESULT_SOCKET_DIVERT 4 // u_int32_t, flow divert control unit |
147 | #define NECP_POLICY_RESULT_SOCKET_FILTER 5 // u_int32_t, filter control unit |
148 | #define NECP_POLICY_RESULT_IP_TUNNEL 6 // String, interface name |
149 | #define NECP_POLICY_RESULT_IP_FILTER 7 // ? |
150 | #define NECP_POLICY_RESULT_TRIGGER 8 // service uuid_t |
151 | #define NECP_POLICY_RESULT_TRIGGER_IF_NEEDED 9 // service uuid_t |
152 | #define NECP_POLICY_RESULT_TRIGGER_SCOPED 10 // service uuid_t |
153 | #define NECP_POLICY_RESULT_NO_TRIGGER_SCOPED 11 // service uuid_t |
154 | #define NECP_POLICY_RESULT_SOCKET_SCOPED 12 // String, interface name |
155 | #define NECP_POLICY_RESULT_ROUTE_RULES 13 // N/A, must have route rules defined |
156 | #define NECP_POLICY_RESULT_USE_NETAGENT 14 // netagent uuid_t |
157 | #define NECP_POLICY_RESULT_NETAGENT_SCOPED 15 // netagent uuid_t |
158 | #define NECP_POLICY_RESULT_SCOPED_DIRECT 16 // N/A, scopes to primary physical interface |
159 | |
160 | #define NECP_POLICY_RESULT_MAX NECP_POLICY_RESULT_SCOPED_DIRECT |
161 | |
162 | /* |
163 | * Route Rules |
164 | * Detailed parameters for NECP_POLICY_RESULT_ROUTE_RULES. |
165 | */ |
166 | #define NECP_ROUTE_RULE_NONE 0 // N/A |
167 | #define NECP_ROUTE_RULE_DENY_INTERFACE 1 // String, or empty to match all |
168 | #define NECP_ROUTE_RULE_ALLOW_INTERFACE 2 // String, or empty to match all |
169 | #define NECP_ROUTE_RULE_QOS_MARKING 3 // String, or empty to match all |
170 | #define NECP_ROUTE_RULE_DENY_LQM_ABORT 4 // String, or empty to match all |
171 | |
172 | #define NECP_ROUTE_RULE_FLAG_CELLULAR 0x01 |
173 | #define NECP_ROUTE_RULE_FLAG_WIFI 0x02 |
174 | #define NECP_ROUTE_RULE_FLAG_WIRED 0x04 |
175 | #define NECP_ROUTE_RULE_FLAG_EXPENSIVE 0x08 |
176 | |
177 | /* |
178 | * Error types |
179 | */ |
180 | #define NECP_ERROR_INTERNAL 0 |
181 | #define NECP_ERROR_UNKNOWN_PACKET_TYPE 1 |
182 | #define NECP_ERROR_INVALID_TLV 2 |
183 | #define NECP_ERROR_POLICY_RESULT_INVALID 3 |
184 | #define NECP_ERROR_POLICY_CONDITIONS_INVALID 4 |
185 | #define NECP_ERROR_POLICY_ID_NOT_FOUND 5 |
186 | #define NECP_ERROR_INVALID_PROCESS 6 |
187 | #define NECP_ERROR_ROUTE_RULES_INVALID 7 |
188 | |
189 | // Modifiers |
190 | #define NECP_MASK_USERSPACE_ONLY 0x80000000 // on filter_control_unit value |
191 | |
192 | struct necp_policy_condition_tc_range { |
193 | u_int32_t start_tc; |
194 | u_int32_t end_tc; |
195 | } __attribute__((__packed__)); |
196 | |
197 | struct necp_policy_condition_addr { |
198 | u_int8_t prefix; |
199 | union { |
200 | struct sockaddr sa; |
201 | struct sockaddr_in sin; |
202 | struct sockaddr_in6 sin6; |
203 | } address; |
204 | } __attribute__((__packed__)); |
205 | |
206 | struct necp_policy_condition_addr_range { |
207 | union { |
208 | struct sockaddr sa; |
209 | struct sockaddr_in sin; |
210 | struct sockaddr_in6 sin6; |
211 | } start_address; |
212 | union { |
213 | struct sockaddr sa; |
214 | struct sockaddr_in sin; |
215 | struct sockaddr_in6 sin6; |
216 | } end_address; |
217 | } __attribute__((__packed__)); |
218 | |
219 | struct necp_policy_condition_agent_type { |
220 | char agent_domain[32]; |
221 | char agent_type[32]; |
222 | } __attribute__((__packed__)); |
223 | |
224 | #define NECP_SESSION_PRIORITY_UNKNOWN 0 |
225 | #define NECP_SESSION_PRIORITY_CONTROL 1 |
226 | #define NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL 2 |
227 | #define NECP_SESSION_PRIORITY_HIGH 3 |
228 | #define NECP_SESSION_PRIORITY_DEFAULT 4 |
229 | #define NECP_SESSION_PRIORITY_LOW 5 |
230 | |
231 | #define NECP_SESSION_NUM_PRIORITIES NECP_SESSION_PRIORITY_LOW |
232 | |
233 | typedef u_int32_t necp_policy_id; |
234 | typedef u_int32_t necp_policy_order; |
235 | typedef u_int32_t necp_session_priority; |
236 | |
237 | typedef u_int32_t necp_kernel_policy_result; |
238 | typedef u_int32_t necp_kernel_policy_filter; |
239 | |
240 | typedef union { |
241 | u_int tunnel_interface_index; |
242 | u_int scoped_interface_index; |
243 | u_int32_t flow_divert_control_unit; |
244 | u_int32_t filter_control_unit; |
245 | } necp_kernel_policy_routing_result_parameter; |
246 | |
247 | #define NECP_SERVICE_FLAGS_REGISTERED 0x01 |
248 | #define NECP_MAX_NETAGENTS 8 |
249 | |
250 | #define NECP_AGENT_USE_FLAG_SCOPE 0x01 |
251 | |
252 | #define NECP_TFO_COOKIE_LEN_MAX 16 |
253 | struct necp_aggregate_result { |
254 | necp_kernel_policy_result routing_result; |
255 | necp_kernel_policy_routing_result_parameter routing_result_parameter; |
256 | necp_kernel_policy_filter filter_control_unit; |
257 | necp_kernel_policy_result service_action; |
258 | uuid_t service_uuid; |
259 | u_int32_t service_flags; |
260 | u_int32_t service_data; |
261 | u_int routed_interface_index; |
262 | u_int32_t policy_id; |
263 | uuid_t netagents[NECP_MAX_NETAGENTS]; |
264 | u_int32_t netagent_use_flags[NECP_MAX_NETAGENTS]; |
265 | u_int8_t mss_recommended; |
266 | }; |
267 | |
268 | /* |
269 | * Statistics. It would be nice if the definitions in ntstat.h could be used, |
270 | * but they get entangled with #defines for v4 etc in pfvar.h and it may be better practice |
271 | * to have separate definitions here. |
272 | */ |
273 | struct necp_stat_counts |
274 | { |
275 | /* Counters */ |
276 | u_int64_t necp_stat_rxpackets __attribute__((aligned(8))); |
277 | u_int64_t necp_stat_rxbytes __attribute__((aligned(8))); |
278 | u_int64_t necp_stat_txpackets __attribute__((aligned(8))); |
279 | u_int64_t necp_stat_txbytes __attribute__((aligned(8))); |
280 | |
281 | u_int32_t necp_stat_rxduplicatebytes; |
282 | u_int32_t necp_stat_rxoutoforderbytes; |
283 | u_int32_t necp_stat_txretransmit; |
284 | |
285 | u_int32_t necp_stat_connectattempts; |
286 | u_int32_t necp_stat_connectsuccesses; |
287 | |
288 | u_int32_t necp_stat_min_rtt; |
289 | u_int32_t necp_stat_avg_rtt; |
290 | u_int32_t necp_stat_var_rtt; |
291 | |
292 | #define NECP_STAT_ROUTE_FLAGS 1 |
293 | u_int32_t necp_stat_route_flags; |
294 | }; |
295 | |
296 | // Note, some metadata is implicit in the necp client itself: |
297 | // From the process itself : pid, upid, uuid, proc name. |
298 | // From the necp client parameters: local and remote addresses, euuid, traffic class, ifindex |
299 | // |
300 | // The following may well be supplied via future necp client parameters, |
301 | // but they are here so they don't get forgotten. |
302 | struct necp_basic_metadata |
303 | { |
304 | u_int32_t rcvbufsize; |
305 | u_int32_t rcvbufused; |
306 | }; |
307 | |
308 | struct necp_tcp_probe_status { |
309 | unsigned int probe_activated : 1; |
310 | unsigned int write_probe_failed : 1; |
311 | unsigned int read_probe_failed : 1; |
312 | unsigned int conn_probe_failed : 1; |
313 | }; |
314 | |
315 | struct |
316 | { |
317 | struct necp_tcp_probe_status ; |
318 | |
319 | u_int32_t ; |
320 | u_int32_t ; |
321 | u_int32_t ; |
322 | u_int32_t ; |
323 | u_int32_t ; |
324 | u_int32_t ; // use SOF_* |
325 | u_int32_t ; // use SOF1_* |
326 | u_int32_t ; |
327 | u_int32_t ; |
328 | u_int32_t ; |
329 | activity_bitmap_t ; |
330 | }; |
331 | |
332 | struct necp_stats_hdr { |
333 | u_int32_t necp_stats_type __attribute__((aligned(8))); |
334 | u_int32_t necp_stats_ver; |
335 | u_int64_t __necp_stats_reserved; // Pad the field for future use |
336 | }; |
337 | |
338 | #define NECP_CLIENT_STATISTICS_TYPE_TCP 1 // Identifies use of necp_tcp_stats |
339 | #define NECP_CLIENT_STATISTICS_TYPE_UDP 2 // Identifies use of necp_udp_stats |
340 | #define NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1 1 // Currently supported version for TCP |
341 | #define NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1 1 // Currently supported version for UDP |
342 | |
343 | #define NECP_CLIENT_STATISTICS_TYPE_TCP_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1 |
344 | #define NECP_CLIENT_STATISTICS_TYPE_UDP_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1 |
345 | |
346 | #define NECP_CLIENT_STATISTICS_EVENT_INIT 0x00000000 // Register the flow |
347 | #define NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT 0x00000001 // The flow is effectively finished but waiting on timer |
348 | |
349 | struct necp_tcp_stats { |
350 | struct necp_stats_hdr necp_tcp_hdr; |
351 | struct necp_stat_counts necp_tcp_counts; |
352 | struct necp_basic_metadata necp_tcp_basic; |
353 | struct necp_extra_tcp_metadata ; |
354 | }; |
355 | |
356 | struct necp_udp_stats { |
357 | struct necp_stats_hdr necp_udp_hdr; |
358 | struct necp_stat_counts necp_udp_counts; |
359 | struct necp_basic_metadata necp_udp_basic; |
360 | }; |
361 | |
362 | typedef struct necp_all_stats { |
363 | union { |
364 | struct necp_tcp_stats tcp_stats; |
365 | struct necp_udp_stats udp_stats; |
366 | } all_stats_u; |
367 | } necp_all_stats; |
368 | |
369 | // Memory for statistics is requested via a necp_stats_bufreq |
370 | // |
371 | struct necp_stats_bufreq { |
372 | u_int32_t necp_stats_bufreq_id __attribute__((aligned(8))); |
373 | u_int32_t necp_stats_bufreq_type; // NECP_CLIENT_STATISTICS_TYPE_* |
374 | u_int32_t necp_stats_bufreq_ver; // NECP_CLIENT_STATISTICS_TYPE_*_VER |
375 | u_int32_t necp_stats_bufreq_size; |
376 | union { |
377 | void *necp_stats_bufreq_addr; |
378 | mach_vm_address_t necp_stats_bufreq_uaddr; |
379 | }; |
380 | }; |
381 | |
382 | #define NECP_CLIENT_STATISTICS_BUFREQ_ID 0xbf // Distinguishes from statistics actions taking a necp_all_stats struct |
383 | |
384 | // There is a limit to the number of statistics structures that may be allocated per process, subject to change |
385 | // |
386 | #define NECP_MAX_PER_PROCESS_CLIENT_STATISTICS_STRUCTS 512 |
387 | |
388 | #define NECP_TCP_ECN_HEURISTICS_SYN_RST 1 |
389 | typedef struct necp_tcp_ecn_cache { |
390 | u_int8_t necp_tcp_ecn_heuristics_success:1; |
391 | u_int8_t necp_tcp_ecn_heuristics_loss:1; |
392 | u_int8_t necp_tcp_ecn_heuristics_drop_rst:1; |
393 | u_int8_t necp_tcp_ecn_heuristics_drop_rxmt:1; |
394 | u_int8_t necp_tcp_ecn_heuristics_aggressive:1; |
395 | u_int8_t necp_tcp_ecn_heuristics_syn_rst:1; |
396 | } necp_tcp_ecn_cache; |
397 | |
398 | #define NECP_TCP_TFO_HEURISTICS_RST 1 |
399 | typedef struct necp_tcp_tfo_cache { |
400 | u_int8_t necp_tcp_tfo_cookie[NECP_TFO_COOKIE_LEN_MAX]; |
401 | u_int8_t necp_tcp_tfo_cookie_len; |
402 | u_int8_t necp_tcp_tfo_heuristics_success:1; // TFO succeeded with data in the SYN |
403 | u_int8_t necp_tcp_tfo_heuristics_loss:1; // TFO SYN-loss with data |
404 | u_int8_t necp_tcp_tfo_heuristics_middlebox:1; // TFO middlebox detected |
405 | u_int8_t necp_tcp_tfo_heuristics_success_req:1; // TFO succeeded with the TFO-option in the SYN |
406 | u_int8_t necp_tcp_tfo_heuristics_loss_req:1; // TFO SYN-loss with the TFO-option |
407 | u_int8_t necp_tcp_tfo_heuristics_rst_data:1; // Recevied RST upon SYN with data in the SYN |
408 | u_int8_t necp_tcp_tfo_heuristics_rst_req:1; // Received RST upon SYN with the TFO-option |
409 | } necp_tcp_tfo_cache; |
410 | |
411 | #define NECP_CLIENT_CACHE_TYPE_ECN 1 // Identifies use of necp_tcp_ecn_cache |
412 | #define NECP_CLIENT_CACHE_TYPE_TFO 2 // Identifies use of necp_tcp_tfo_cache |
413 | |
414 | #define NECP_CLIENT_CACHE_TYPE_ECN_VER_1 1 // Currently supported version for ECN |
415 | #define NECP_CLIENT_CACHE_TYPE_TFO_VER_1 1 // Currently supported version for TFO |
416 | |
417 | typedef struct necp_cache_buffer { |
418 | u_int8_t necp_cache_buf_type; // NECP_CLIENT_CACHE_TYPE_* |
419 | u_int8_t necp_cache_buf_ver; // NECP_CLIENT_CACHE_TYPE_*_VER |
420 | u_int32_t necp_cache_buf_size; |
421 | mach_vm_address_t necp_cache_buf_addr; |
422 | } necp_cache_buffer; |
423 | |
424 | /* |
425 | * NECP Client definitions |
426 | */ |
427 | #define NECP_MAX_CLIENT_PARAMETERS_SIZE 1024 |
428 | #define NECP_MAX_CLIENT_RESULT_SIZE 512 |
429 | |
430 | #define NECP_OPEN_FLAG_OBSERVER 0x01 // Observers can query clients they don't own |
431 | #define NECP_OPEN_FLAG_BACKGROUND 0x02 // Mark this fd as backgrounded |
432 | #define NECP_OPEN_FLAG_PUSH_OBSERVER 0x04 // When used with the OBSERVER flag, allows updates to be pushed. Adding clients is not allowed in this mode. |
433 | |
434 | #define NECP_FD_SUPPORTS_GUARD 1 |
435 | |
436 | #define NECP_CLIENT_ACTION_ADD 1 // Register a new client. Input: parameters in buffer; Output: client_id |
437 | #define NECP_CLIENT_ACTION_REMOVE 2 // Unregister a client. Input: client_id, optional struct ifnet_stats_per_flow |
438 | #define NECP_CLIENT_ACTION_COPY_PARAMETERS 3 // Copy client parameters. Input: client_id; Output: parameters in buffer |
439 | #define NECP_CLIENT_ACTION_COPY_RESULT 4 // Copy client result. Input: client_id; Output: result in buffer |
440 | #define NECP_CLIENT_ACTION_COPY_LIST 5 // Copy all client IDs. Output: struct necp_client_list in buffer |
441 | #define NECP_CLIENT_ACTION_REQUEST_NEXUS_INSTANCE 6 // Request a nexus instance from a nexus provider, optional struct necp_stats_bufreq |
442 | #define NECP_CLIENT_ACTION_AGENT 7 // Interact with agent. Input: client_id, agent parameters |
443 | #define NECP_CLIENT_ACTION_COPY_AGENT 8 // Copy agent content. Input: agent UUID; Output: struct netagent |
444 | #define NECP_CLIENT_ACTION_COPY_INTERFACE 9 // Copy interface details. Input: ifindex cast to UUID; Output: struct necp_interface_details |
445 | #define NECP_CLIENT_ACTION_SET_STATISTICS 10 // Deprecated |
446 | #define NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS 11 // Get route statistics. Input: client_id; Output: struct necp_stat_counts |
447 | #define NECP_CLIENT_ACTION_AGENT_USE 12 // Return the use count and increment the use count. Input/Output: struct necp_agent_use_parameters |
448 | #define NECP_CLIENT_ACTION_MAP_SYSCTLS 13 // Get the read-only sysctls memory location. Output: mach_vm_address_t |
449 | #define NECP_CLIENT_ACTION_UPDATE_CACHE 14 // Update heuristics and cache |
450 | #define NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE 15 // Fetch an updated client for push-mode observer. Output: Client id, struct necp_client_observer_update in buffer |
451 | #define NECP_CLIENT_ACTION_COPY_UPDATED_RESULT 16 // Copy client result only if changed. Input: client_id; Output: result in buffer |
452 | #define NECP_CLIENT_ACTION_ADD_FLOW 17 // Add a flow. Input: client_id; Output: struct necp_client_add_flow |
453 | #define NECP_CLIENT_ACTION_REMOVE_FLOW 18 // Remove a flow. Input: flow_id, optional struct ifnet_stats_per_flow |
454 | |
455 | |
456 | #define NECP_CLIENT_PARAMETER_APPLICATION NECP_POLICY_CONDITION_APPLICATION // Requires entitlement |
457 | #define NECP_CLIENT_PARAMETER_REAL_APPLICATION NECP_POLICY_CONDITION_REAL_APPLICATION // Requires entitlement |
458 | #define NECP_CLIENT_PARAMETER_DOMAIN NECP_POLICY_CONDITION_DOMAIN |
459 | #define NECP_CLIENT_PARAMETER_ACCOUNT NECP_POLICY_CONDITION_ACCOUNT |
460 | #define NECP_CLIENT_PARAMETER_PID NECP_POLICY_CONDITION_PID // Requires entitlement |
461 | #define NECP_CLIENT_PARAMETER_UID NECP_POLICY_CONDITION_UID // Requires entitlement |
462 | #define NECP_CLIENT_PARAMETER_BOUND_INTERFACE NECP_POLICY_CONDITION_BOUND_INTERFACE |
463 | #define NECP_CLIENT_PARAMETER_TRAFFIC_CLASS NECP_POLICY_CONDITION_TRAFFIC_CLASS |
464 | #define NECP_CLIENT_PARAMETER_IP_PROTOCOL NECP_POLICY_CONDITION_IP_PROTOCOL |
465 | #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS NECP_POLICY_CONDITION_LOCAL_ADDR |
466 | #define NECP_CLIENT_PARAMETER_REMOTE_ADDRESS NECP_POLICY_CONDITION_REMOTE_ADDR |
467 | #define NECP_CLIENT_PARAMETER_NEXUS_KEY 102 |
468 | |
469 | // "Prohibit" will never choose an interface with that property |
470 | #define NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE 100 // String, interface name |
471 | #define NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE 101 // u_int8_t, see ifru_functional_type in <net/if.h> |
472 | #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT 102 // uuid_t, network agent UUID |
473 | #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE 103 // struct necp_client_parameter_netagent_type |
474 | |
475 | // "Require" will choose an interface with that property, or none if not found |
476 | #define NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE 111 // u_int8_t, see ifru_functional_type in <net/if.h> |
477 | #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT 112 // uuid_t, network agent UUID |
478 | #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE 113 // struct necp_client_parameter_netagent_type |
479 | |
480 | // "Prefer" will choose an interface with an agent, or best otherwise if not found |
481 | #define NECP_CLIENT_PARAMETER_PREFER_AGENT 122 // uuid_t, network agent UUID |
482 | #define NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE 123 // struct necp_client_parameter_netagent_type |
483 | |
484 | // "Avoid" will choose an interface without an agent, or best otherwise if unavoidable |
485 | #define NECP_CLIENT_PARAMETER_AVOID_AGENT 124 // uuid_t, network agent UUID |
486 | #define NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE 125 // struct necp_client_parameter_netagent_type |
487 | |
488 | // Use actions with NECP_CLIENT_ACTION_AGENT |
489 | #define NECP_CLIENT_PARAMETER_TRIGGER_AGENT 130 // uuid_t, network agent UUID |
490 | #define NECP_CLIENT_PARAMETER_ASSERT_AGENT 131 // uuid_t, network agent UUID |
491 | #define NECP_CLIENT_PARAMETER_UNASSERT_AGENT 132 // uuid_t, network agent UUID |
492 | |
493 | #define NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT 200 // struct necp_client_endpoint |
494 | #define NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT 201 // struct necp_client_endpoint |
495 | #define NECP_CLIENT_PARAMETER_BROWSE_CATEGORY 202 // struct necp_client_endpoint |
496 | |
497 | #define NECP_CLIENT_PARAMETER_FLAGS 250 // u_int32_t, see NECP_CLIENT_PAREMETER_FLAG_* values |
498 | |
499 | #define NECP_CLIENT_PARAMETER_FLAG_MULTIPATH 0x0001 // Get multipath interface results |
500 | #define NECP_CLIENT_PARAMETER_FLAG_BROWSE 0x0002 // Agent assertions on nexuses are requests to browse |
501 | #define NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE 0x0004 // Prohibit expensive interfaces |
502 | #define NECP_CLIENT_PARAMETER_FLAG_LISTENER 0x0008 // Client is interested in listening for inbound connections |
503 | #define NECP_CLIENT_PARAMETER_FLAG_DISCRETIONARY 0x0010 // Client's traffic is discretionary, and eligible for early defuncting |
504 | #define NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE 0x0020 // Client is requesting to enable ECN |
505 | #define NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE 0x0040 // Client is requesting to disable ECN |
506 | #define NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE 0x0080 // Client is requesting to enable TFO |
507 | #define NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE 0x0100 // Interpret NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE only for primary |
508 | // interface, and allow exceptions for multipath or listeners |
509 | |
510 | #define NECP_CLIENT_RESULT_CLIENT_ID 1 // uuid_t |
511 | #define NECP_CLIENT_RESULT_POLICY_RESULT 2 // u_int32_t |
512 | #define NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER 3 // u_int32_t |
513 | #define NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT 4 // u_int32_t |
514 | #define NECP_CLIENT_RESULT_INTERFACE_INDEX 5 // u_int32_t |
515 | #define NECP_CLIENT_RESULT_NETAGENT 6 // struct necp_client_result_netagent |
516 | #define NECP_CLIENT_RESULT_FLAGS 7 // u_int32_t, see NECP_CLIENT_RESULT_FLAG_* values |
517 | #define NECP_CLIENT_RESULT_INTERFACE 8 // struct necp_client_result_interface |
518 | #define NECP_CLIENT_RESULT_INTERFACE_OPTION 9 // struct necp_client_interface_option |
519 | #define NECP_CLIENT_RESULT_EFFECTIVE_MTU 10 // u_int32_t |
520 | #define NECP_CLIENT_RESULT_FLOW 11 // TLV array of a single flow's state |
521 | #define NECP_CLIENT_RESULT_PROTO_CTL_EVENT 12 |
522 | #define NECP_CLIENT_RESULT_TFO_COOKIE 13 // NECP_TFO_COOKIE_LEN_MAX |
523 | #define NECP_CLIENT_RESULT_TFO_FLAGS 14 // u_int8_t |
524 | #define NECP_CLIENT_RESULT_RECOMMENDED_MSS 15 // u_int8_t |
525 | #define NECP_CLIENT_RESULT_FLOW_ID 16 // uuid_t |
526 | #define NECP_CLIENT_RESULT_INTERFACE_TIME_DELTA 17 // u_int32_t, seconds since interface up/down |
527 | |
528 | #define NECP_CLIENT_RESULT_NEXUS_INSTANCE 100 // uuid_t |
529 | #define NECP_CLIENT_RESULT_NEXUS_PORT 101 // u_int16_t |
530 | #define NECP_CLIENT_RESULT_NEXUS_KEY 102 // uuid_t |
531 | #define NECP_CLIENT_RESULT_NEXUS_PORT_FLOW_INDEX 103 // u_int32_t |
532 | #define NECP_CLIENT_RESULT_NEXUS_FLOW_STATS 104 // struct sk_stats_flow * |
533 | |
534 | #define NECP_CLIENT_RESULT_LOCAL_ENDPOINT 200 // struct necp_client_endpoint |
535 | #define NECP_CLIENT_RESULT_REMOTE_ENDPOINT 201 // struct necp_client_endpoint |
536 | #define NECP_CLIENT_RESULT_DISCOVERED_ENDPOINT 202 // struct necp_client_endpoint, result of browse |
537 | #define NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS 210 // u_int32_t |
538 | #define NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG 211 // u_int32_t, 1: background, 0: not background |
539 | |
540 | #define NECP_CLIENT_RESULT_FLAG_IS_LOCAL 0x0001 // Routes to this device |
541 | #define NECP_CLIENT_RESULT_FLAG_IS_DIRECT 0x0002 // Routes to directly accessible peer |
542 | #define NECP_CLIENT_RESULT_FLAG_HAS_IPV4 0x0004 // Supports IPv4 |
543 | #define NECP_CLIENT_RESULT_FLAG_HAS_IPV6 0x0008 // Supports IPv6 |
544 | #define NECP_CLIENT_RESULT_FLAG_DEFUNCT 0x0010 // Defunct |
545 | #define NECP_CLIENT_RESULT_FLAG_SATISFIED 0x0020 // Satisfied path |
546 | #define NECP_CLIENT_RESULT_FLAG_FLOW_ASSIGNED 0x0040 // Assigned, the flow is active |
547 | #define NECP_CLIENT_RESULT_FLAG_FLOW_VIABLE 0x0080 // Viable, the flow has a valid route |
548 | #define NECP_CLIENT_RESULT_FLAG_PROBE_CONNECTIVITY 0x0100 // Flow should probe connectivity |
549 | #define NECP_CLIENT_RESULT_FLAG_ECN_ENABLED 0x0200 // ECN should be used |
550 | #define NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED 0x0400 // Fast open should not be used |
551 | #define NECP_CLIENT_RESULT_FLAG_LINK_QUALITY_ABORT 0x0800 // Link quality is very bad, recommend close connections |
552 | #define NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING 0x1000 // QoS marking is allowed |
553 | #define NECP_CLIENT_RESULT_FLAG_HAS_NAT64 0x2000 // Has NAT64 prefix |
554 | #define NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER 0x4000 // Interface is in low-power mode |
555 | |
556 | #define NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE (NECP_CLIENT_RESULT_FLAG_HAS_IPV4 | NECP_CLIENT_RESULT_FLAG_HAS_IPV6 | NECP_CLIENT_RESULT_FLAG_HAS_NAT64 | NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER) |
557 | |
558 | #define NECP_CLIENT_RESULT_FAST_OPEN_SND_PROBE 0x01 // DEPRECATED - Fast open send probe |
559 | #define NECP_CLIENT_RESULT_FAST_OPEN_RCV_PROBE 0x02 // DEPRECATED - Fast open receive probe |
560 | |
561 | #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_NONE 0x01 |
562 | #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_LOW 0x02 |
563 | #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_MEDIUM 0x04 |
564 | |
565 | struct necp_interface_signature { |
566 | u_int8_t signature[IFNET_SIGNATURELEN]; |
567 | u_int8_t signature_len; |
568 | }; |
569 | |
570 | struct necp_interface_details { |
571 | char name[IFXNAMSIZ]; |
572 | u_int32_t index; |
573 | u_int32_t generation; |
574 | u_int32_t functional_type; |
575 | u_int32_t delegate_index; |
576 | u_int32_t flags; // see NECP_INTERFACE_FLAG_* |
577 | u_int32_t mtu; |
578 | struct necp_interface_signature ipv4_signature; |
579 | struct necp_interface_signature ipv6_signature; |
580 | }; |
581 | |
582 | #define NECP_INTERFACE_FLAG_EXPENSIVE 0x0001 |
583 | #define NECP_INTERFACE_FLAG_TXSTART 0X0002 |
584 | #define NECP_INTERFACE_FLAG_NOACKPRI 0x0004 |
585 | #define NECP_INTERFACE_FLAG_3CARRIERAGG 0x0008 |
586 | #define NECP_INTERFACE_FLAG_IS_LOW_POWER 0x0010 |
587 | |
588 | struct necp_client_parameter_netagent_type { |
589 | char netagent_domain[32]; |
590 | char netagent_type[32]; |
591 | }; |
592 | |
593 | struct necp_client_result_netagent { |
594 | u_int32_t generation; |
595 | uuid_t netagent_uuid; |
596 | }; |
597 | |
598 | struct necp_client_result_interface { |
599 | u_int32_t generation; |
600 | u_int32_t index; |
601 | }; |
602 | |
603 | struct necp_client_interface_option { |
604 | u_int32_t interface_index; |
605 | u_int32_t interface_generation; |
606 | uuid_t nexus_agent; |
607 | }; |
608 | |
609 | struct necp_client_endpoint { |
610 | union { |
611 | struct sockaddr sa; |
612 | struct sockaddr_in sin; |
613 | struct sockaddr_in6 sin6; |
614 | struct { |
615 | u_int8_t endpoint_length; |
616 | u_int8_t endpoint_family; // Use AF_UNSPEC to target a name |
617 | u_int16_t endpoint_port; |
618 | u_int32_t endpoint_type; // Client-specific type |
619 | char endpoint_data[0]; // Type-specific endpoint value |
620 | } endpoint; |
621 | } u; |
622 | }; |
623 | |
624 | struct necp_client_list { |
625 | u_int32_t client_count; |
626 | uuid_t clients[0]; |
627 | }; |
628 | |
629 | struct kev_necp_policies_changed_data { |
630 | u_int32_t changed_count; // Defaults to 0. |
631 | }; |
632 | |
633 | #define NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS 0x01 // Request a nexus instance upon adding a flow |
634 | #define NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID 0x02 // Register the client ID rather than the flow registration ID with network agents |
635 | |
636 | struct necp_client_flow_stats { |
637 | u_int32_t stats_type; // NECP_CLIENT_STATISTICS_TYPE_* |
638 | u_int32_t stats_version; // NECP_CLIENT_STATISTICS_TYPE_*_VER |
639 | u_int32_t stats_size; |
640 | mach_vm_address_t stats_addr; |
641 | }; |
642 | |
643 | struct necp_client_add_flow { |
644 | uuid_t agent_uuid; |
645 | uuid_t registration_id; |
646 | u_int16_t flags; // NECP_CLIENT_FLOW_FLAGS_* |
647 | u_int16_t stats_request_count; |
648 | struct necp_client_flow_stats stats_requests[0]; |
649 | } __attribute__((__packed__)); |
650 | |
651 | struct necp_agent_use_parameters { |
652 | uuid_t agent_uuid; |
653 | uint64_t out_use_count; |
654 | }; |
655 | |
656 | struct necp_client_flow_protoctl_event { |
657 | uint32_t protoctl_event_code; |
658 | uint32_t protoctl_event_val; |
659 | /* TCP seq number is in host byte order */ |
660 | uint32_t protoctl_event_tcp_seq_num; |
661 | }; |
662 | |
663 | #define NECP_CLIENT_UPDATE_TYPE_PARAMETERS 1 // Parameters, for a new client |
664 | #define NECP_CLIENT_UPDATE_TYPE_RESULT 2 // Result, for a udpated client |
665 | #define NECP_CLIENT_UPDATE_TYPE_REMOVE 3 // Empty, for a removed client |
666 | |
667 | struct necp_client_observer_update { |
668 | u_int32_t update_type; // NECP_CLIENT_UPDATE_TYPE_* |
669 | u_int8_t tlv_buffer[0]; // Parameters or result as TLVs, based on type |
670 | }; |
671 | |
672 | #ifdef BSD_KERNEL_PRIVATE |
673 | #include <stdbool.h> |
674 | #include <sys/socketvar.h> |
675 | #include <sys/kern_control.h> |
676 | #include <netinet/ip_var.h> |
677 | #include <netinet6/ip6_var.h> |
678 | #include <net/if_var.h> |
679 | #include <sys/syslog.h> |
680 | #include <net/network_agent.h> |
681 | |
682 | SYSCTL_DECL(_net_necp); |
683 | |
684 | #define NECPLOG(level, format, ...) do { \ |
685 | log((level > LOG_NOTICE ? LOG_NOTICE : level), "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \ |
686 | } while (0) |
687 | |
688 | #define NECPLOG0(level, msg) do { \ |
689 | log((level > LOG_NOTICE ? LOG_NOTICE : level), "%s: %s\n", __FUNCTION__, msg); \ |
690 | } while (0) |
691 | |
692 | enum necp_fd_type_t { |
693 | necp_fd_type_invalid = 0, |
694 | necp_fd_type_session = 1, |
695 | necp_fd_type_client = 2, |
696 | }; |
697 | |
698 | union necp_sockaddr_union { |
699 | struct sockaddr sa; |
700 | struct sockaddr_in sin; |
701 | struct sockaddr_in6 sin6; |
702 | }; |
703 | |
704 | /* |
705 | * kstats |
706 | * The ustats and kstats region are mirrored. So when we allocate with |
707 | * skmem_cache from kstats region, we also get an ustats object. To tie them |
708 | * together, kstats has an extra *necp_stats_ustats pointer pointing to the |
709 | * ustats object |
710 | */ |
711 | struct necp_all_kstats { |
712 | struct necp_all_stats necp_stats_comm; /* kernel private stats snapshot */ |
713 | struct necp_all_stats *necp_stats_ustats; /* points to user-visible stats (in shared ustats region) */ |
714 | }; |
715 | |
716 | extern errno_t necp_client_init(void); |
717 | extern int necp_application_find_policy_match_internal(proc_t proc, u_int8_t *parameters, u_int32_t parameters_size, |
718 | struct necp_aggregate_result *returned_result, |
719 | u_int32_t *flags, u_int required_interface_index, |
720 | const union necp_sockaddr_union *override_local_addr, |
721 | const union necp_sockaddr_union *override_remote_addr, |
722 | struct rtentry **returned_route, bool ignore_address); |
723 | /* |
724 | * TLV utilities |
725 | * |
726 | * Note that these functions (other than necp_buffer_find_tlv) do not check the length of the entire buffer, |
727 | * so the caller must be sure that the entire TLV is within bounds. |
728 | */ |
729 | struct { |
730 | u_int8_t ; |
731 | u_int32_t ; |
732 | } __attribute__((__packed__)); |
733 | |
734 | extern u_int8_t *necp_buffer_write_tlv(u_int8_t *cursor, u_int8_t type, u_int32_t length, const void *value, |
735 | u_int8_t *buffer, u_int32_t buffer_length); |
736 | extern u_int8_t *necp_buffer_write_tlv_if_different(u_int8_t *cursor, u_int8_t type, |
737 | u_int32_t length, const void *value, bool *updated, |
738 | u_int8_t *buffer, u_int32_t buffer_length); |
739 | extern u_int8_t necp_buffer_get_tlv_type(u_int8_t *buffer, int tlv_offset); |
740 | extern u_int32_t necp_buffer_get_tlv_length(u_int8_t *buffer, int tlv_offset); |
741 | extern u_int8_t *necp_buffer_get_tlv_value(u_int8_t *buffer, int tlv_offset, u_int32_t *value_size); |
742 | extern int necp_buffer_find_tlv(u_int8_t *buffer, u_int32_t buffer_length, int offset, u_int8_t type, int next); |
743 | |
744 | #define NECPCTL_DROP_ALL_LEVEL 1 /* Drop all packets if no policy matches above this level */ |
745 | #define NECPCTL_DEBUG 2 /* Log all kernel policy matches */ |
746 | #define NECPCTL_PASS_LOOPBACK 3 /* Pass all loopback traffic */ |
747 | #define NECPCTL_PASS_KEEPALIVES 4 /* Pass all kernel-generated keepalive traffic */ |
748 | #define NECPCTL_SOCKET_POLICY_COUNT 5 /* Count of all socket-level policies */ |
749 | #define NECPCTL_SOCKET_NON_APP_POLICY_COUNT 6 /* Count of non-per-app socket-level policies */ |
750 | #define NECPCTL_IP_POLICY_COUNT 7 /* Count of all ip-level policies */ |
751 | #define NECPCTL_SESSION_COUNT 8 /* Count of NECP sessions */ |
752 | #define NECPCTL_CLIENT_FD_COUNT 9 /* Count of NECP client fds */ |
753 | #define NECPCTL_CLIENT_COUNT 10 /* Count of NECP clients */ |
754 | #define NECPCTL_ARENA_COUNT 11 /* Count of NECP arenas (stats, etc) */ |
755 | #define NECPCTL_NEXUS_FLOW_COUNT 12 /* Count of NECP nexus flows */ |
756 | #define NECPCTL_SOCKET_FLOW_COUNT 13 /* Count of NECP socket flows */ |
757 | #define NECPCTL_IF_FLOW_COUNT 14 /* Count of NECP socket flows */ |
758 | #define NECPCTL_OBSERVER_FD_COUNT 15 /* Count of NECP observer fds */ |
759 | #define NECPCTL_OBSERVER_MESSAGE_LIMIT 16 /* Number of of NECP observer messages allowed to be queued */ |
760 | #define NECPCTL_SYSCTL_ARENA_COUNT 17 /* Count of sysctl arenas */ |
761 | |
762 | #define NECPCTL_NAMES { \ |
763 | { 0, 0 }, \ |
764 | { "drop_all_level", CTLTYPE_INT }, \ |
765 | { "debug", CTLTYPE_INT }, \ |
766 | { "pass_loopback", CTLTYPE_INT }, \ |
767 | { "pass_keepalives", CTLTYPE_INT }, \ |
768 | } |
769 | |
770 | typedef u_int32_t necp_kernel_policy_id; |
771 | #define NECP_KERNEL_POLICY_ID_NONE 0 |
772 | #define NECP_KERNEL_POLICY_ID_NO_MATCH 1 |
773 | #define NECP_KERNEL_POLICY_ID_FIRST_VALID_SOCKET 2 |
774 | #define NECP_KERNEL_POLICY_ID_FIRST_VALID_IP UINT16_MAX |
775 | |
776 | typedef u_int32_t necp_app_id; |
777 | |
778 | #define NECP_KERNEL_POLICY_RESULT_NONE 0 |
779 | #define NECP_KERNEL_POLICY_RESULT_PASS NECP_POLICY_RESULT_PASS |
780 | #define NECP_KERNEL_POLICY_RESULT_SKIP NECP_POLICY_RESULT_SKIP |
781 | #define NECP_KERNEL_POLICY_RESULT_DROP NECP_POLICY_RESULT_DROP |
782 | #define NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT NECP_POLICY_RESULT_SOCKET_DIVERT |
783 | #define NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER NECP_POLICY_RESULT_SOCKET_FILTER |
784 | #define NECP_KERNEL_POLICY_RESULT_IP_TUNNEL NECP_POLICY_RESULT_IP_TUNNEL |
785 | #define NECP_KERNEL_POLICY_RESULT_IP_FILTER NECP_POLICY_RESULT_IP_FILTER |
786 | #define NECP_KERNEL_POLICY_RESULT_TRIGGER NECP_POLICY_RESULT_TRIGGER |
787 | #define NECP_KERNEL_POLICY_RESULT_TRIGGER_IF_NEEDED NECP_POLICY_RESULT_TRIGGER_IF_NEEDED |
788 | #define NECP_KERNEL_POLICY_RESULT_TRIGGER_SCOPED NECP_POLICY_RESULT_TRIGGER_SCOPED |
789 | #define NECP_KERNEL_POLICY_RESULT_NO_TRIGGER_SCOPED NECP_POLICY_RESULT_NO_TRIGGER_SCOPED |
790 | #define NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED NECP_POLICY_RESULT_SOCKET_SCOPED |
791 | #define NECP_KERNEL_POLICY_RESULT_ROUTE_RULES NECP_POLICY_RESULT_ROUTE_RULES |
792 | #define NECP_KERNEL_POLICY_RESULT_USE_NETAGENT NECP_POLICY_RESULT_USE_NETAGENT |
793 | #define NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED NECP_POLICY_RESULT_NETAGENT_SCOPED |
794 | #define NECP_KERNEL_POLICY_RESULT_SCOPED_DIRECT NECP_POLICY_RESULT_SCOPED_DIRECT |
795 | |
796 | typedef struct { |
797 | u_int32_t identifier; |
798 | u_int32_t data; |
799 | } necp_kernel_policy_service; |
800 | |
801 | typedef union { |
802 | u_int tunnel_interface_index; |
803 | u_int scoped_interface_index; |
804 | u_int32_t flow_divert_control_unit; |
805 | u_int32_t filter_control_unit; |
806 | u_int32_t skip_policy_order; |
807 | u_int32_t route_rule_id; |
808 | u_int32_t netagent_id; |
809 | necp_kernel_policy_service service; |
810 | } necp_kernel_policy_result_parameter; |
811 | |
812 | enum necp_boolean_state { |
813 | necp_boolean_state_unknown = 0, |
814 | necp_boolean_state_false = 1, |
815 | necp_boolean_state_true = 2, |
816 | }; |
817 | |
818 | struct necp_kernel_socket_policy { |
819 | LIST_ENTRY(necp_kernel_socket_policy) chain; |
820 | necp_kernel_policy_id id; |
821 | necp_policy_order order; |
822 | u_int32_t session_order; |
823 | int session_pid; |
824 | |
825 | u_int32_t condition_mask; |
826 | u_int32_t condition_negated_mask; |
827 | necp_kernel_policy_id cond_policy_id; |
828 | u_int32_t cond_app_id; // Locally assigned ID value stored |
829 | u_int32_t cond_real_app_id; // Locally assigned ID value stored |
830 | char *cond_custom_entitlement; // String |
831 | u_int8_t cond_custom_entitlement_matched;// Boolean if entitlement matched app |
832 | u_int32_t cond_account_id; // Locally assigned ID value stored |
833 | char *cond_domain; // String |
834 | u_int8_t cond_domain_dot_count; // Number of dots in cond_domain |
835 | pid_t cond_pid; |
836 | uid_t cond_uid; |
837 | ifnet_t cond_bound_interface; // Matches specific binding only |
838 | struct necp_policy_condition_tc_range cond_traffic_class; // Matches traffic class in range |
839 | u_int16_t cond_protocol; // Matches IP protcol number |
840 | union necp_sockaddr_union cond_local_start; // Matches local IP address (or start) |
841 | union necp_sockaddr_union cond_local_end; // Matches IP address range |
842 | u_int8_t cond_local_prefix; // Defines subnet |
843 | union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start) |
844 | union necp_sockaddr_union cond_remote_end; // Matches IP address range |
845 | u_int8_t cond_remote_prefix; // Defines subnet |
846 | struct necp_policy_condition_agent_type cond_agent_type; |
847 | |
848 | necp_kernel_policy_result result; |
849 | necp_kernel_policy_result_parameter result_parameter; |
850 | }; |
851 | |
852 | struct necp_kernel_ip_output_policy { |
853 | LIST_ENTRY(necp_kernel_ip_output_policy) chain; |
854 | necp_kernel_policy_id id; |
855 | necp_policy_order suborder; |
856 | necp_policy_order order; |
857 | u_int32_t session_order; |
858 | int session_pid; |
859 | |
860 | u_int32_t condition_mask; |
861 | u_int32_t condition_negated_mask; |
862 | necp_kernel_policy_id cond_policy_id; |
863 | ifnet_t cond_bound_interface; // Matches specific binding only |
864 | u_int16_t cond_protocol; // Matches IP protcol number |
865 | union necp_sockaddr_union cond_local_start; // Matches local IP address (or start) |
866 | union necp_sockaddr_union cond_local_end; // Matches IP address range |
867 | u_int8_t cond_local_prefix; // Defines subnet |
868 | union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start) |
869 | union necp_sockaddr_union cond_remote_end; // Matches IP address range |
870 | u_int8_t cond_remote_prefix; // Defines subnet |
871 | u_int32_t cond_last_interface_index; |
872 | |
873 | necp_kernel_policy_result result; |
874 | necp_kernel_policy_result_parameter result_parameter; |
875 | }; |
876 | |
877 | #define MAX_KERNEL_SOCKET_POLICIES 1 |
878 | #define MAX_KERNEL_IP_OUTPUT_POLICIES 4 |
879 | struct necp_session_policy { |
880 | LIST_ENTRY(necp_session_policy) chain; |
881 | bool applied; // Applied into the kernel table |
882 | bool pending_deletion; // Waiting to be removed from kernel table |
883 | bool pending_update; // Policy has been modified since creation/last application |
884 | necp_policy_id local_id; |
885 | necp_policy_order order; |
886 | u_int8_t *result; |
887 | u_int32_t result_size; |
888 | u_int8_t *conditions; // Array of conditions, each with a u_int32_t length at start |
889 | u_int32_t conditions_size; |
890 | u_int8_t *route_rules; // Array of route rules, each with a u_int32_t length at start |
891 | u_int32_t route_rules_size; |
892 | |
893 | uuid_t applied_app_uuid; |
894 | uuid_t applied_real_app_uuid; |
895 | char *applied_account; |
896 | |
897 | uuid_t applied_result_uuid; |
898 | |
899 | u_int32_t applied_route_rules_id; |
900 | |
901 | necp_kernel_policy_id kernel_socket_policies[MAX_KERNEL_SOCKET_POLICIES]; |
902 | necp_kernel_policy_id kernel_ip_output_policies[MAX_KERNEL_IP_OUTPUT_POLICIES]; |
903 | }; |
904 | |
905 | struct necp_aggregate_socket_result { |
906 | necp_kernel_policy_result result; |
907 | necp_kernel_policy_result_parameter result_parameter; |
908 | necp_kernel_policy_filter filter_control_unit; |
909 | u_int32_t route_rule_id; |
910 | int32_t qos_marking_gencount; |
911 | }; |
912 | |
913 | struct necp_inpcb_result { |
914 | u_int32_t app_id; |
915 | necp_kernel_policy_id policy_id; |
916 | necp_kernel_policy_id skip_policy_id; |
917 | int32_t policy_gencount; |
918 | u_int32_t flowhash; |
919 | struct necp_aggregate_socket_result results; |
920 | }; |
921 | |
922 | extern errno_t necp_init(void); |
923 | |
924 | extern errno_t necp_set_socket_attributes(struct socket *so, struct sockopt *sopt); |
925 | extern errno_t necp_get_socket_attributes(struct socket *so, struct sockopt *sopt); |
926 | extern void necp_inpcb_remove_cb(struct inpcb *inp); |
927 | extern void necp_inpcb_dispose(struct inpcb *inp); |
928 | |
929 | extern u_int32_t necp_socket_get_content_filter_control_unit(struct socket *so); |
930 | |
931 | extern bool necp_socket_should_use_flow_divert(struct inpcb *inp); |
932 | extern u_int32_t necp_socket_get_flow_divert_control_unit(struct inpcb *inp); |
933 | |
934 | extern bool necp_socket_should_rescope(struct inpcb *inp); |
935 | extern u_int necp_socket_get_rescope_if_index(struct inpcb *inp); |
936 | extern u_int32_t necp_socket_get_effective_mtu(struct inpcb *inp, u_int32_t current_mtu); |
937 | |
938 | extern bool necp_socket_is_allowed_to_send_recv(struct inpcb *inp, necp_kernel_policy_id *return_policy_id, |
939 | u_int32_t *return_route_rule_id, |
940 | necp_kernel_policy_id *return_skip_policy_id); |
941 | extern bool necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port, |
942 | u_int16_t remote_port, struct in_addr *local_addr, |
943 | struct in_addr *remote_addr, ifnet_t interface, |
944 | necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id, |
945 | necp_kernel_policy_id *return_skip_policy_id); |
946 | extern bool necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port, |
947 | u_int16_t remote_port, struct in6_addr *local_addr, |
948 | struct in6_addr *remote_addr, ifnet_t interface, |
949 | necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id, |
950 | necp_kernel_policy_id *return_skip_policy_id); |
951 | extern void necp_socket_update_qos_marking(struct inpcb *inp, struct rtentry *route, struct ifnet *interface, u_int32_t route_rule_id); |
952 | extern int necp_mark_packet_from_socket(struct mbuf *packet, struct inpcb *inp, necp_kernel_policy_id policy_id, |
953 | u_int32_t route_rule_id, necp_kernel_policy_id skip_policy_id); |
954 | extern necp_kernel_policy_id necp_get_policy_id_from_packet(struct mbuf *packet); |
955 | extern necp_kernel_policy_id necp_get_skip_policy_id_from_packet(struct mbuf *packet); |
956 | extern u_int32_t necp_get_last_interface_index_from_packet(struct mbuf *packet); |
957 | extern u_int32_t necp_get_route_rule_id_from_packet(struct mbuf *packet); |
958 | extern int necp_get_app_uuid_from_packet(struct mbuf *packet, |
959 | uuid_t app_uuid); |
960 | |
961 | extern necp_kernel_policy_id necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local_addr, |
962 | struct sockaddr *override_remote_addr, u_int32_t override_bound_interface); |
963 | extern necp_kernel_policy_id necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_args *ipoa, |
964 | necp_kernel_policy_result *result, |
965 | necp_kernel_policy_result_parameter *result_parameter); |
966 | extern necp_kernel_policy_id necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out_args *ip6oa, |
967 | necp_kernel_policy_result *result, |
968 | necp_kernel_policy_result_parameter *result_parameter); |
969 | |
970 | extern int necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id); |
971 | extern int necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface); |
972 | |
973 | extern ifnet_t necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter); |
974 | extern bool necp_packet_can_rebind_to_ifnet(struct mbuf *packet, struct ifnet *interface, struct route *new_route, int family); |
975 | |
976 | extern bool necp_packet_is_allowed_over_interface(struct mbuf *packet, struct ifnet *interface); |
977 | |
978 | extern int necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive); |
979 | extern bool necp_get_is_keepalive_from_packet(struct mbuf *packet); |
980 | |
981 | extern void necp_update_all_clients(void); // Handle general re-evaluate event |
982 | |
983 | extern void necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid, u_int32_t agent_generation); // Cause a single client to get an update event |
984 | |
985 | extern void necp_set_client_as_background(proc_t proc, struct fileproc *fp, bool background); // Set all clients for an fp as background or not |
986 | |
987 | struct necp_fd_data; |
988 | extern void necp_fd_memstatus(proc_t proc, uint32_t status, struct necp_fd_data *client_fd); // Purge memory of clients for the process |
989 | extern void necp_fd_defunct(proc_t proc, struct necp_fd_data *client_fd); // Set all clients for an process as defunct |
990 | |
991 | extern int necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp); |
992 | |
993 | extern int necp_client_assert_bb_radio_manager(uuid_t client_id, bool assert); |
994 | |
995 | extern int necp_client_assign_from_socket(pid_t pid, uuid_t client_id, struct inpcb *inp); |
996 | |
997 | extern int necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id, |
998 | u_int8_t *assigned_results, size_t assigned_results_length); |
999 | struct skmem_obj_info; // forward declaration |
1000 | extern int necp_stats_ctor(struct skmem_obj_info *oi, struct skmem_obj_info *oim, void *arg, uint32_t skmflag); |
1001 | extern int necp_stats_dtor(void *addr, void *arg); |
1002 | |
1003 | /* value to denote invalid flow advisory index */ |
1004 | struct netagent_session; |
1005 | extern int |
1006 | necp_update_flow_protoctl_event(uuid_t netagent_uuid, uuid_t client_id, |
1007 | uint32_t protoctl_event_code, uint32_t protoctl_event_val, |
1008 | uint32_t protoctl_event_tcp_seq_num); |
1009 | |
1010 | #define NECP_FLOWADV_IDX_INVALID UINT32_MAX |
1011 | extern void *necp_create_nexus_assign_message(uuid_t nexus_instance, u_int32_t nexus_port, void *key, uint32_t key_length, |
1012 | struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint, |
1013 | u_int32_t flow_adv_index, void *flow_stats, size_t *message_length); |
1014 | |
1015 | struct necp_client_nexus_parameters { |
1016 | pid_t pid; |
1017 | pid_t epid; |
1018 | uuid_t euuid; |
1019 | union necp_sockaddr_union local_addr; |
1020 | union necp_sockaddr_union remote_addr; |
1021 | u_int16_t ip_protocol; |
1022 | u_int32_t traffic_class; |
1023 | necp_policy_id policy_id; |
1024 | unsigned is_listener:1; |
1025 | unsigned allow_qos_marking:1; |
1026 | }; |
1027 | |
1028 | #define NECP_CLIENT_CBACTION_NONVIABLE 1 |
1029 | #define NECP_CLIENT_CBACTION_VIABLE 2 |
1030 | #define NECP_CLIENT_CBACTION_INITIAL 3 |
1031 | |
1032 | struct necp_client_add_flow_default { |
1033 | uuid_t agent_uuid; |
1034 | uuid_t registration_id; |
1035 | u_int16_t flags; // NECP_CLIENT_FLOW_FLAGS_* |
1036 | u_int16_t stats_request_count; |
1037 | struct necp_client_flow_stats stats_requests[1]; |
1038 | } __attribute__((__packed__)); |
1039 | |
1040 | typedef void (*necp_client_flow_cb)(void *handle, int action, uint32_t interface_index, uint32_t necp_flags, bool *viable); |
1041 | |
1042 | extern void necp_client_reap_caches(boolean_t purge); |
1043 | |
1044 | |
1045 | #endif /* BSD_KERNEL_PRIVATE */ |
1046 | #ifndef KERNEL |
1047 | |
1048 | extern int necp_match_policy(const uint8_t *parameters, size_t parameters_size, struct necp_aggregate_result *returned_result); |
1049 | |
1050 | extern int necp_open(int flags); |
1051 | |
1052 | extern int necp_client_action(int necp_fd, uint32_t action, uuid_t client_id, |
1053 | size_t client_id_len, uint8_t *buffer, size_t buffer_size); |
1054 | |
1055 | extern int necp_session_open(int flags); |
1056 | |
1057 | extern int necp_session_action(int necp_fd, uint32_t action, |
1058 | uint8_t *in_buffer, size_t in_buffer_length, |
1059 | uint8_t *out_buffer, size_t out_buffer_length); |
1060 | |
1061 | #endif /* !KERNEL */ |
1062 | |
1063 | #endif /* PRIVATE */ |
1064 | |
1065 | #endif |
1066 | |