1/*
2 * Copyright (c) 2013-2022 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29#ifndef _NET_NECP_H_
30#define _NET_NECP_H_
31
32#include <net/net_kev.h>
33#ifdef PRIVATE
34
35#include <netinet/in.h>
36#include <netinet/in_stat.h>
37#include <sys/socket.h>
38#include <net/if.h>
39
40#if SKYWALK
41#include <skywalk/os_nexus_private.h>
42#else /* !SKYWALK */
43typedef uint16_t nexus_port_t;
44#endif /* !SKYWALK */
45
46/*
47 * Name registered by the NECP
48 */
49#define NECP_CONTROL_NAME "com.apple.net.necp_control"
50
51#define NECP_TLV_LENGTH_UINT32 1
52
53struct necp_packet_header {
54 u_int8_t packet_type;
55 u_int8_t flags;
56 u_int32_t message_id;
57};
58
59typedef struct {
60 uid_t uid;
61 uuid_t effective_uuid;
62 uid_t persona_id;
63} necp_application_id_t;
64
65/*
66 * Control message commands
67 */
68#define NECP_PACKET_TYPE_POLICY_ADD 1
69#define NECP_PACKET_TYPE_POLICY_GET 2
70#define NECP_PACKET_TYPE_POLICY_DELETE 3
71#define NECP_PACKET_TYPE_POLICY_APPLY_ALL 4
72#define NECP_PACKET_TYPE_POLICY_LIST_ALL 5
73#define NECP_PACKET_TYPE_POLICY_DELETE_ALL 6
74#define NECP_PACKET_TYPE_SET_SESSION_PRIORITY 7
75#define NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC 8
76#define NECP_PACKET_TYPE_REGISTER_SERVICE 9
77#define NECP_PACKET_TYPE_UNREGISTER_SERVICE 10
78#define NECP_PACKET_TYPE_POLICY_DUMP_ALL 11
79
80/*
81 * Session actions
82 */
83#define NECP_SESSION_ACTION_POLICY_ADD 1 // In: Policy TLVs Out: necp_policy_id
84#define NECP_SESSION_ACTION_POLICY_GET 2 // In: necp_policy_id Out: Policy TLVs
85#define NECP_SESSION_ACTION_POLICY_DELETE 3 // In: necp_policy_id Out: None
86#define NECP_SESSION_ACTION_POLICY_APPLY_ALL 4 // In: None Out: None
87#define NECP_SESSION_ACTION_POLICY_LIST_ALL 5 // In: None Out: TLVs of IDs
88#define NECP_SESSION_ACTION_POLICY_DELETE_ALL 6 // In: None Out: None
89#define NECP_SESSION_ACTION_SET_SESSION_PRIORITY 7 // In: necp_session_priority Out: None
90#define NECP_SESSION_ACTION_LOCK_SESSION_TO_PROC 8 // In: None Out: None
91#define NECP_SESSION_ACTION_REGISTER_SERVICE 9 // In: uuid_t Out: None
92#define NECP_SESSION_ACTION_UNREGISTER_SERVICE 10 // In: uuid_t Out: None
93#define NECP_SESSION_ACTION_POLICY_DUMP_ALL 11 // In: None Out: uint32_t bytes length, then Policy TLVs
94#define NECP_SESSION_ACTION_ADD_DOMAIN_FILTER 12 // In: struct net_bloom_filter Out: uint32_t, ID
95#define NECP_SESSION_ACTION_REMOVE_DOMAIN_FILTER 13 // In: uint32_t, ID Out: None
96#define NECP_SESSION_ACTION_REMOVE_ALL_DOMAIN_FILTERS 14 // In: None Out: None
97
98/*
99 * Control message flags
100 */
101#define NECP_PACKET_FLAGS_RESPONSE 0x01 // Used for acks, errors, and query responses
102
103/*
104 * Control message TLV types
105 */
106#define NECP_TLV_NIL 0
107#define NECP_TLV_ERROR 1 // u_int32_t
108#define NECP_TLV_POLICY_ORDER 2 // u_int32_t
109#define NECP_TLV_POLICY_CONDITION 3
110#define NECP_TLV_POLICY_RESULT 4
111#define NECP_TLV_POLICY_ID 5 // u_int32_t
112#define NECP_TLV_SESSION_PRIORITY 6 // u_int32_t
113#define NECP_TLV_ATTRIBUTE_DOMAIN 7 // char[]
114#define NECP_TLV_ATTRIBUTE_ACCOUNT 8 // char[]
115#define NECP_TLV_SERVICE_UUID 9 // uuid_t
116#define NECP_TLV_ROUTE_RULE 10
117#define NECP_TLV_ATTRIBUTE_DOMAIN_OWNER 11 // char[]
118#define NECP_TLV_ATTRIBUTE_TRACKER_DOMAIN 12 // char[]
119#define NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT 13 // char[]
120
121/*
122 * Control message TLV sent only by the kernel to userspace
123 */
124#define NECP_TLV_POLICY_OWNER 100 // char []
125#define NECP_TLV_POLICY_DUMP 101
126#define NECP_TLV_POLICY_RESULT_STRING 102 // char []
127#define NECP_TLV_POLICY_SESSION_ORDER 103 // u_int32_t
128
129/*
130 * Condition flags
131 */
132#define NECP_POLICY_CONDITION_FLAGS_NEGATIVE 0x01 // Negative
133#define NECP_POLICY_CONDITION_FLAGS_EXACT 0x02 // For conditions that would otherwise have more inclusive matching, require an exact match
134
135/*
136 * Conditions
137 * Used for setting policies as well as passing parameters to necp_match_policy.
138 */
139#define NECP_POLICY_CONDITION_DEFAULT 0 // N/A, not valid with any other conditions
140// Socket/Application conditions
141#define NECP_POLICY_CONDITION_APPLICATION 1 // uuid_t, uses effective UUID when possible
142#define NECP_POLICY_CONDITION_REAL_APPLICATION 2 // uuid_t, never uses effective UUID. Only valid with NECP_POLICY_CONDITION_APPLICATION
143#define NECP_POLICY_CONDITION_DOMAIN 3 // String, such as apple.com
144#define NECP_POLICY_CONDITION_ACCOUNT 4 // String
145#define NECP_POLICY_CONDITION_ENTITLEMENT 5 // String
146#define NECP_POLICY_CONDITION_PID 6 // pid_t
147#define NECP_POLICY_CONDITION_UID 7 // uid_t
148#define NECP_POLICY_CONDITION_ALL_INTERFACES 8 // N/A
149#define NECP_POLICY_CONDITION_BOUND_INTERFACE 9 // String
150#define NECP_POLICY_CONDITION_TRAFFIC_CLASS 10 // necp_policy_condition_tc_range
151// Socket/IP conditions
152#define NECP_POLICY_CONDITION_IP_PROTOCOL 11 // u_int16_t
153#define NECP_POLICY_CONDITION_LOCAL_ADDR 12 // necp_policy_condition_addr
154#define NECP_POLICY_CONDITION_REMOTE_ADDR 13 // necp_policy_condition_addr
155#define NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE 14 // necp_policy_condition_addr_range
156#define NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE 15 // necp_policy_condition_addr_range
157#define NECP_POLICY_CONDITION_AGENT_TYPE 16 // struct necp_policy_condition_agent_type
158#define NECP_POLICY_CONDITION_HAS_CLIENT 17 // N/A
159#define NECP_POLICY_CONDITION_LOCAL_NETWORKS 18 // Matches all local networks
160// Socket-only conditions
161#define NECP_POLICY_CONDITION_FLOW_IP_PROTOCOL 19 // u_int16_t
162#define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR 20 // necp_policy_condition_addr
163#define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR 21 // necp_policy_condition_addr
164#define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_RANGE 22 // necp_policy_condition_addr_range
165#define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_RANGE 23 // necp_policy_condition_addr_range
166#define NECP_POLICY_CONDITION_FLOW_IS_LOOPBACK 31 // N/A
167// Socket/Application conditions, continued
168#define NECP_POLICY_CONDITION_CLIENT_FLAGS 24 // u_int32_t, values from NECP_CLIENT_PARAMETER_FLAG_*
169#define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_EMPTY 25 // N/A
170#define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_EMPTY 26 // N/A
171#define NECP_POLICY_CONDITION_PLATFORM_BINARY 27 // N/A
172#define NECP_POLICY_CONDITION_SDK_VERSION 28 // struct necp_policy_condition_sdk_version
173#define NECP_POLICY_CONDITION_SIGNING_IDENTIFIER 29 // String
174#define NECP_POLICY_CONDITION_PACKET_FILTER_TAGS 30 // u_int16_t
175#define NECP_POLICY_CONDITION_DELEGATE_IS_PLATFORM_BINARY 32 // N/A
176#define NECP_POLICY_CONDITION_DOMAIN_OWNER 33 // String, owner of domain (for example, "Google Inc")
177#define NECP_POLICY_CONDITION_DOMAIN_CONTEXT 34 // String, eTLD+1 leading to networking activities to the domain
178#define NECP_POLICY_CONDITION_TRACKER_DOMAIN 35 // String, tracker domain
179#define NECP_POLICY_CONDITION_ATTRIBUTED_BUNDLE_IDENTIFIER 36 // String, app to which traffic is attributed to
180#define NECP_POLICY_CONDITION_SCHEME_PORT 37 // u_int16_t, the port associated with the scheme for a connection
181#define NECP_POLICY_CONDITION_DOMAIN_FILTER 38 // struct net_bloom_filter
182#define NECP_POLICY_CONDITION_SYSTEM_SIGNED_RESULT 39 // N/A
183#define NECP_POLICY_CONDITION_REAL_UID 40 // uid_t
184#define NECP_POLICY_CONDITION_APPLICATION_ID 41 // necp_application_id_t
185#define NECP_POLICY_CONDITION_URL 42 // String, URL
186#define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS 43 // Interface flags: u_int32_t flags, u_int32_t eflags, u_int32_t xflags
187
188
189/*
190 * Policy Condition Bound Interface Flags Order
191 */
192#define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS_IDX_FLAGS 0
193#define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS_IDX_EFLAGS 1
194#define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS_IDX_XFLAGS 2
195#define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS_IDX_MAX 3
196
197/*
198 * Policy Packet tags
199 */
200#define NECP_POLICY_CONDITION_PACKET_FILTER_TAG_STACK_DROP 0x01
201#define NECP_POLICY_CONDITION_PACKET_FILTER_TAG_MAX NECP_POLICY_CONDITION_PACKET_FILTER_TAG_STACK_DROP
202
203/*
204 * Results
205 */
206#define NECP_POLICY_RESULT_PASS 1 // N/A
207#define NECP_POLICY_RESULT_SKIP 2 // u_int32_t, policy order to skip to. 0 to skip all session policies.
208#define NECP_POLICY_RESULT_DROP 3 // N/A
209#define NECP_POLICY_RESULT_SOCKET_DIVERT 4 // u_int32_t, flow divert control unit
210#define NECP_POLICY_RESULT_SOCKET_FILTER 5 // u_int32_t, filter control unit
211#define NECP_POLICY_RESULT_IP_TUNNEL 6 // String, interface name
212#define NECP_POLICY_RESULT_IP_FILTER 7 // ?
213#define NECP_POLICY_RESULT_TRIGGER 8 // Deprecated
214#define NECP_POLICY_RESULT_TRIGGER_IF_NEEDED 9 // Deprecated
215#define NECP_POLICY_RESULT_TRIGGER_SCOPED 10 // Deprecated
216#define NECP_POLICY_RESULT_NO_TRIGGER_SCOPED 11 // Deprecated
217#define NECP_POLICY_RESULT_SOCKET_SCOPED 12 // String, interface name
218#define NECP_POLICY_RESULT_ROUTE_RULES 13 // N/A, must have route rules defined
219#define NECP_POLICY_RESULT_USE_NETAGENT 14 // netagent uuid_t
220#define NECP_POLICY_RESULT_NETAGENT_SCOPED 15 // netagent uuid_t
221#define NECP_POLICY_RESULT_SCOPED_DIRECT 16 // N/A, scopes to primary physical interface
222#define NECP_POLICY_RESULT_ALLOW_UNENTITLED 17 // N/A
223#define NECP_POLICY_RESULT_REMOVE_NETAGENT 18 // netagent uuid_t
224
225#define NECP_POLICY_RESULT_MAX NECP_POLICY_RESULT_REMOVE_NETAGENT
226
227/*
228 * PASS Result Flags
229 */
230#define NECP_POLICY_PASS_NO_SKIP_IPSEC 0x01
231#define NECP_POLICY_PASS_PF_TAG 0x02
232
233/*
234 * DROP Result Flags
235 */
236#define NECP_POLICY_DROP_FLAG_LOCAL_NETWORK 0x01
237#define NECP_POLICY_DROP_FLAG_SUPPRESS_ALERTS 0x02
238
239/*
240 * Route Rules
241 * Detailed parameters for NECP_POLICY_RESULT_ROUTE_RULES.
242 */
243#define NECP_ROUTE_RULE_NONE 0 // N/A
244#define NECP_ROUTE_RULE_DENY_INTERFACE 1 // String, or empty to match all
245#define NECP_ROUTE_RULE_ALLOW_INTERFACE 2 // String, or empty to match all
246#define NECP_ROUTE_RULE_QOS_MARKING 3 // String, or empty to match all
247#define NECP_ROUTE_RULE_DENY_LQM_ABORT 4 // String, or empty to match all
248#define NECP_ROUTE_RULE_USE_NETAGENT 5 // UUID, followed by string or empty
249#define NECP_ROUTE_RULE_REMOVE_NETAGENT 6 // UUID, followed by string or empty
250#define NECP_ROUTE_RULE_DIVERT_SOCKET 7 // u_int32_t control unit, followed by string or empty
251#define NECP_ROUTE_RULE_DENY_INTERFACE_WITH_TYPE 8 // u_int32_t effective type, followed by string or empty
252
253#define NECP_ROUTE_RULE_FLAG_CELLULAR 0x01
254#define NECP_ROUTE_RULE_FLAG_WIFI 0x02
255#define NECP_ROUTE_RULE_FLAG_WIRED 0x04
256#define NECP_ROUTE_RULE_FLAG_EXPENSIVE 0x08
257#define NECP_ROUTE_RULE_FLAG_CONSTRAINED 0x10
258#define NECP_ROUTE_RULE_FLAG_COMPANION 0x20
259
260#define NECP_ROUTE_RULE_FLAG_NETAGENT 0x80 // Last bit, reserved to mark that this applies only when an agent UUID is present
261
262#define NECP_ROUTE_RULES_SUPPORT_NETAGENT_EXCEPTIONS 1
263
264/*
265 * Error types
266 */
267#define NECP_ERROR_INTERNAL 0
268#define NECP_ERROR_UNKNOWN_PACKET_TYPE 1
269#define NECP_ERROR_INVALID_TLV 2
270#define NECP_ERROR_POLICY_RESULT_INVALID 3
271#define NECP_ERROR_POLICY_CONDITIONS_INVALID 4
272#define NECP_ERROR_POLICY_ID_NOT_FOUND 5
273#define NECP_ERROR_INVALID_PROCESS 6
274#define NECP_ERROR_ROUTE_RULES_INVALID 7
275
276// Modifiers
277#define NECP_MASK_USERSPACE_ONLY 0x80000000 // on filter_control_unit value
278#define NECP_MASK_PRESERVE_CONNECTIONS 0x20000000 // on filter_control_unit value
279
280struct necp_policy_condition_tc_range {
281 u_int32_t start_tc;
282 u_int32_t end_tc;
283} __attribute__((__packed__));
284
285struct necp_policy_condition_addr {
286 u_int8_t prefix;
287 union {
288#if !__has_ptrcheck
289 struct sockaddr sa;
290#endif
291 struct __sockaddr_header sah;
292 struct sockaddr_in sin;
293 struct sockaddr_in6 sin6;
294 } address __attribute__((__packed__));
295} __attribute__((__packed__));
296
297struct necp_policy_condition_addr_range {
298 union {
299#if !__has_ptrcheck
300 struct sockaddr sa;
301#endif
302 struct __sockaddr_header sah;
303 struct sockaddr_in sin;
304 struct sockaddr_in6 sin6;
305 } start_address __attribute__((__packed__));
306 union {
307#if !__has_ptrcheck
308 struct sockaddr sa;
309#endif
310 struct __sockaddr_header sah;
311 struct sockaddr_in sin;
312 struct sockaddr_in6 sin6;
313 } end_address __attribute__((__packed__));
314} __attribute__((__packed__));
315
316struct necp_policy_condition_agent_type {
317 char agent_domain[32];
318 char agent_type[32];
319} __attribute__((__packed__));
320
321struct necp_policy_condition_sdk_version {
322 uint32_t platform; // e.g., PLATFORM_IOS
323 uint32_t min_version; // Encoded as XXXX.YY.ZZ
324 uint32_t version; // Encoded as XXXX.YY.ZZ
325} __attribute__((__packed__));
326
327#define NECP_SESSION_PRIORITY_UNKNOWN 0
328#define NECP_SESSION_PRIORITY_CONTROL 1
329#define NECP_SESSION_PRIORITY_CONTROL_1 2
330#define NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL 3
331#define NECP_SESSION_PRIORITY_HIGH 4
332#define NECP_SESSION_PRIORITY_HIGH_1 5
333#define NECP_SESSION_PRIORITY_HIGH_2 6
334#define NECP_SESSION_PRIORITY_HIGH_3 7
335#define NECP_SESSION_PRIORITY_HIGH_4 8
336#define NECP_SESSION_PRIORITY_HIGH_RESTRICTED 9
337#define NECP_SESSION_PRIORITY_DEFAULT 10
338#define NECP_SESSION_PRIORITY_LOW 11
339#define NECP_SESSION_NUM_PRIORITIES NECP_SESSION_PRIORITY_LOW
340
341typedef u_int32_t necp_policy_id;
342typedef u_int32_t necp_policy_order;
343typedef u_int32_t necp_session_priority;
344
345typedef u_int32_t necp_kernel_policy_result;
346typedef u_int32_t necp_kernel_policy_filter;
347
348typedef union {
349 u_int tunnel_interface_index;
350 u_int scoped_interface_index;
351 u_int32_t flow_divert_control_unit;
352 u_int32_t filter_control_unit;
353 u_int32_t pass_flags;
354 u_int32_t drop_flags;
355} necp_kernel_policy_routing_result_parameter;
356
357#define NECP_SERVICE_FLAGS_REGISTERED 0x01
358#define NECP_MAX_NETAGENTS 16
359
360#define NECP_AGENT_USE_FLAG_SCOPE 0x01
361#define NECP_AGENT_USE_FLAG_REMOVE 0x02
362
363#define NECP_TFO_COOKIE_LEN_MAX 16
364struct necp_aggregate_result {
365 necp_kernel_policy_result routing_result;
366 necp_kernel_policy_routing_result_parameter routing_result_parameter;
367 necp_kernel_policy_filter filter_control_unit;
368 u_int32_t flow_divert_aggregate_unit;
369 necp_kernel_policy_result service_action;
370 uuid_t service_uuid;
371 u_int32_t service_flags;
372 u_int32_t service_data;
373 u_int routed_interface_index;
374 u_int32_t policy_id;
375 u_int32_t skip_policy_id;
376 uuid_t netagents[NECP_MAX_NETAGENTS];
377 u_int32_t netagent_use_flags[NECP_MAX_NETAGENTS];
378 struct ipv6_prefix nat64_prefixes[NAT64_MAX_NUM_PREFIXES];
379 u_int8_t mss_recommended;
380};
381
382/*
383 * Statistics. It would be nice if the definitions in ntstat.h could be used,
384 * but they get entangled with #defines for v4 etc in pfvar.h and it may be better practice
385 * to have separate definitions here.
386 */
387struct necp_stat_counts {
388 /* Counters */
389 u_int64_t necp_stat_rxpackets __attribute__((aligned(8)));
390 u_int64_t necp_stat_rxbytes __attribute__((aligned(8)));
391 u_int64_t necp_stat_txpackets __attribute__((aligned(8)));
392 u_int64_t necp_stat_txbytes __attribute__((aligned(8)));
393
394 u_int32_t necp_stat_rxduplicatebytes;
395 u_int32_t necp_stat_rxoutoforderbytes;
396 u_int32_t necp_stat_txretransmit;
397
398 u_int32_t necp_stat_connectattempts;
399 u_int32_t necp_stat_connectsuccesses;
400
401 u_int32_t necp_stat_min_rtt;
402 u_int32_t necp_stat_avg_rtt;
403 u_int32_t necp_stat_var_rtt;
404
405#define NECP_STAT_ROUTE_FLAGS 1
406 u_int32_t necp_stat_route_flags;
407};
408
409// Note, some metadata is implicit in the necp client itself:
410// From the process itself : pid, upid, uuid, proc name.
411// From the necp client parameters: local and remote addresses, euuid, traffic class, ifindex
412//
413// The following may well be supplied via future necp client parameters,
414// but they are here so they don't get forgotten.
415struct necp_basic_metadata {
416 u_int32_t rcvbufsize;
417 u_int32_t rcvbufused;
418};
419
420struct necp_connection_probe_status {
421 unsigned int probe_activated : 1;
422 unsigned int write_probe_failed : 1;
423 unsigned int read_probe_failed : 1;
424 unsigned int conn_probe_failed : 1;
425};
426
427struct necp_extra_tcp_metadata {
428 struct necp_connection_probe_status probestatus;
429
430 u_int32_t sndbufsize;
431 u_int32_t sndbufused;
432 u_int32_t txunacked;
433 u_int32_t txwindow;
434 u_int32_t txcwindow;
435 u_int32_t flags; // use SOF_*
436 u_int32_t flags1; // use SOF1_*
437 u_int32_t traffic_mgt_flags;
438 u_int32_t cc_alg_index;
439 u_int32_t state;
440};
441
442struct necp_stats_hdr {
443 u_int32_t necp_stats_type __attribute__((aligned(8)));
444 u_int32_t necp_stats_ver;
445 u_int64_t __necp_stats_reserved; // Pad the field for future use
446};
447
448#define NECP_CLIENT_STATISTICS_TYPE_TCP 1 // Identifies use of necp_tcp_stats
449#define NECP_CLIENT_STATISTICS_TYPE_UDP 2 // Identifies use of necp_udp_stats
450#define NECP_CLIENT_STATISTICS_TYPE_QUIC 3 // Identifies use of necp_quic_stats
451
452#define NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1 1 // Currently supported version for TCP
453#define NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1 1 // Currently supported version for UDP
454#define NECP_CLIENT_STATISTICS_TYPE_QUIC_VER_1 1 // Currently supported version for QUIC
455
456#define NECP_CLIENT_STATISTICS_TYPE_TCP_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1
457#define NECP_CLIENT_STATISTICS_TYPE_UDP_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1
458#define NECP_CLIENT_STATISTICS_TYPE_QUIC_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_QUIC_VER_1
459
460#define NECP_CLIENT_STATISTICS_EVENT_INIT 0x00000000 // Register the flow
461#define NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT 0x00000001 // The flow is effectively finished but waiting on timer
462
463struct necp_tcp_stats {
464 struct necp_stats_hdr necp_tcp_hdr;
465 struct necp_stat_counts necp_tcp_counts;
466 struct necp_basic_metadata necp_tcp_basic;
467 struct necp_extra_tcp_metadata necp_tcp_extra;
468};
469
470struct necp_udp_stats {
471 struct necp_stats_hdr necp_udp_hdr;
472 struct necp_stat_counts necp_udp_counts;
473 struct necp_basic_metadata necp_udp_basic;
474};
475
476
477/*
478 * The following reflects the special case for QUIC.
479 * It is a streaming protocol built on top of UDP.
480 * Therefore QUIC stats are defined as basic UDP stats
481 * with some extra meta data.
482 * TODO: For now the extra metadata is an exact replica
483 * of the metadata for TCP. However keeping that separate allows
484 * the structures to diverge later as new stats are added.
485 */
486#define QUIC_STATELESS_RESET_TOKEN_SIZE 16
487#define NECP_QUIC_HAS_PROBE_STATUS 1
488struct necp_extra_quic_metadata {
489 u_int32_t sndbufsize;
490 u_int32_t sndbufused;
491 u_int32_t txunacked;
492 u_int32_t txwindow;
493 u_int32_t txcwindow;
494 u_int32_t traffic_mgt_flags;
495 u_int32_t cc_alg_index;
496 u_int32_t state;
497 u_int8_t ssr_token[QUIC_STATELESS_RESET_TOKEN_SIZE];
498 struct necp_connection_probe_status probestatus;
499};
500
501#define necp_quic_hdr necp_quic_udp_stats.necp_udp_hdr
502#define necp_quic_counts necp_quic_udp_stats.necp_udp_counts
503#define necp_quic_basic necp_quic_udp_stats.necp_udp_basic
504struct necp_quic_stats {
505 struct necp_udp_stats necp_quic_udp_stats;
506 struct necp_extra_quic_metadata necp_quic_extra;
507};
508
509typedef struct necp_all_stats {
510 union {
511 struct necp_tcp_stats tcp_stats;
512 struct necp_udp_stats udp_stats;
513 struct necp_quic_stats quic_stats;
514 } all_stats_u;
515} necp_all_stats;
516
517// Memory for statistics is requested via a necp_stats_bufreq
518//
519struct necp_stats_bufreq {
520 u_int32_t necp_stats_bufreq_id __attribute__((aligned(8)));
521 u_int32_t necp_stats_bufreq_type; // NECP_CLIENT_STATISTICS_TYPE_*
522 u_int32_t necp_stats_bufreq_ver; // NECP_CLIENT_STATISTICS_TYPE_*_VER
523 u_int32_t necp_stats_bufreq_size;
524 union {
525 void *necp_stats_bufreq_addr;
526 mach_vm_address_t necp_stats_bufreq_uaddr;
527 };
528};
529
530#define NECP_CLIENT_STATISTICS_BUFREQ_ID 0xbf // Distinguishes from statistics actions taking a necp_all_stats struct
531
532// There is a limit to the number of statistics structures that may be allocated per process, subject to change
533//
534#define NECP_MAX_PER_PROCESS_CLIENT_STATISTICS_STRUCTS 512
535
536#define NECP_TCP_ECN_HEURISTICS_SYN_RST 1
537typedef struct necp_tcp_ecn_cache {
538 u_int8_t necp_tcp_ecn_heuristics_success:1;
539 u_int8_t necp_tcp_ecn_heuristics_loss:1;
540 u_int8_t necp_tcp_ecn_heuristics_drop_rst:1;
541 u_int8_t necp_tcp_ecn_heuristics_drop_rxmt:1;
542 u_int8_t necp_tcp_ecn_heuristics_aggressive:1;
543 u_int8_t necp_tcp_ecn_heuristics_syn_rst:1;
544} necp_tcp_ecn_cache;
545
546#define NECP_TCP_TFO_HEURISTICS_RST 1
547typedef struct necp_tcp_tfo_cache {
548 u_int8_t necp_tcp_tfo_cookie[NECP_TFO_COOKIE_LEN_MAX];
549 u_int8_t necp_tcp_tfo_cookie_len;
550 u_int8_t necp_tcp_tfo_heuristics_success:1; // TFO succeeded with data in the SYN
551 u_int8_t necp_tcp_tfo_heuristics_loss:1; // TFO SYN-loss with data
552 u_int8_t necp_tcp_tfo_heuristics_middlebox:1; // TFO middlebox detected
553 u_int8_t necp_tcp_tfo_heuristics_success_req:1; // TFO succeeded with the TFO-option in the SYN
554 u_int8_t necp_tcp_tfo_heuristics_loss_req:1; // TFO SYN-loss with the TFO-option
555 u_int8_t necp_tcp_tfo_heuristics_rst_data:1; // Recevied RST upon SYN with data in the SYN
556 u_int8_t necp_tcp_tfo_heuristics_rst_req:1; // Received RST upon SYN with the TFO-option
557} necp_tcp_tfo_cache;
558
559#define NECP_CLIENT_CACHE_TYPE_ECN 1 // Identifies use of necp_tcp_ecn_cache
560#define NECP_CLIENT_CACHE_TYPE_TFO 2 // Identifies use of necp_tcp_tfo_cache
561
562#define NECP_CLIENT_CACHE_TYPE_ECN_VER_1 1 // Currently supported version for ECN
563#define NECP_CLIENT_CACHE_TYPE_TFO_VER_1 1 // Currently supported version for TFO
564
565typedef struct necp_cache_buffer {
566 u_int8_t necp_cache_buf_type; // NECP_CLIENT_CACHE_TYPE_*
567 u_int8_t necp_cache_buf_ver; // NECP_CLIENT_CACHE_TYPE_*_VER
568 u_int32_t necp_cache_buf_size;
569 mach_vm_address_t necp_cache_buf_addr;
570} necp_cache_buffer;
571
572/*
573 * NECP Client definitions
574 */
575#define NECP_MAX_CLIENT_PARAMETERS_SIZE 1024
576#define NECP_MAX_CLIENT_RESULT_SIZE 512 // Legacy
577#define NECP_BASE_CLIENT_RESULT_SIZE 1024
578#define NECP_CLIENT_FLOW_RESULT_SIZE 512
579
580#define NECP_OPEN_FLAG_OBSERVER 0x01 // Observers can query clients they don't own
581#define NECP_OPEN_FLAG_BACKGROUND 0x02 // Mark this fd as backgrounded
582#define NECP_OPEN_FLAG_PUSH_OBSERVER 0x04 // When used with the OBSERVER flag, allows updates to be pushed. Adding clients is not allowed in this mode.
583
584#define NECP_FD_SUPPORTS_GUARD 1
585
586#define NECP_CLIENT_ACTION_ADD 1 // Register a new client. Input: parameters in buffer; Output: client_id
587#define NECP_CLIENT_ACTION_REMOVE 2 // Unregister a client. Input: client_id, optional struct ifnet_stats_per_flow
588#define NECP_CLIENT_ACTION_COPY_PARAMETERS 3 // Copy client parameters. Input: client_id; Output: parameters in buffer
589#define NECP_CLIENT_ACTION_COPY_RESULT 4 // Copy client result. Input: client_id; Output: result in buffer
590#define NECP_CLIENT_ACTION_COPY_LIST 5 // Copy all client IDs. Output: struct necp_client_list in buffer
591#define NECP_CLIENT_ACTION_REQUEST_NEXUS_INSTANCE 6 // Request a nexus instance from a nexus provider, optional struct necp_stats_bufreq
592#define NECP_CLIENT_ACTION_AGENT 7 // Interact with agent. Input: client_id, agent parameters
593#define NECP_CLIENT_ACTION_COPY_AGENT 8 // Copy agent content. Input: agent UUID; Output: struct netagent
594#define NECP_CLIENT_ACTION_COPY_INTERFACE 9 // Copy interface details. Input: ifindex cast to UUID; Output: struct necp_interface_details
595#define NECP_CLIENT_ACTION_SET_STATISTICS 10 // Deprecated
596#define NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS 11 // Get route statistics. Input: client_id; Output: struct necp_stat_counts
597#define NECP_CLIENT_ACTION_AGENT_USE 12 // Return the use count and increment the use count. Input/Output: struct necp_agent_use_parameters
598#define NECP_CLIENT_ACTION_MAP_SYSCTLS 13 // Get the read-only sysctls memory location. Output: mach_vm_address_t
599#define NECP_CLIENT_ACTION_UPDATE_CACHE 14 // Update heuristics and cache
600#define NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE 15 // Fetch an updated client for push-mode observer. Output: Client id, struct necp_client_observer_update in buffer
601#define NECP_CLIENT_ACTION_COPY_UPDATED_RESULT 16 // Copy client result only if changed. Input: client_id; Output: result in buffer
602#define NECP_CLIENT_ACTION_ADD_FLOW 17 // Add a flow. Input: client_id; Output: struct necp_client_add_flow
603#define NECP_CLIENT_ACTION_REMOVE_FLOW 18 // Remove a flow. Input: flow_id, optional struct ifnet_stats_per_flow
604#define NECP_CLIENT_ACTION_CLAIM 19 // Claim a client that has been added for this unique PID. Input: client_id
605#define NECP_CLIENT_ACTION_SIGN 20 // Sign a query answer. Input: struct necp_client_signable; Output: struct necp_client_signature
606#define NECP_CLIENT_ACTION_GET_INTERFACE_ADDRESS 21 // Get the best interface local address for given remote address. Input: ifindex, remote sockaddr; Output: matching local sockaddr
607#define NECP_CLIENT_ACTION_ACQUIRE_AGENT_TOKEN 22 // Get a one-time use token from an agent. Input: agent UUID; Output: token buffer
608#define NECP_CLIENT_ACTION_VALIDATE 23 // Validate a query answer. Input: struct necp_client_validatable; Output: None
609#define NECP_CLIENT_ACTION_GET_SIGNED_CLIENT_ID 24 // Get a client ID for the appliction along with a signature.
610#define NECP_CLIENT_ACTION_SET_SIGNED_CLIENT_ID 25 // Set a client ID for the appliction along with a signature.
611
612#define NECP_CLIENT_PARAMETER_APPLICATION NECP_POLICY_CONDITION_APPLICATION // Requires entitlement
613#define NECP_CLIENT_PARAMETER_REAL_APPLICATION NECP_POLICY_CONDITION_REAL_APPLICATION // Requires entitlement
614#define NECP_CLIENT_PARAMETER_DOMAIN NECP_POLICY_CONDITION_DOMAIN
615#define NECP_CLIENT_PARAMETER_DOMAIN_OWNER NECP_POLICY_CONDITION_DOMAIN_OWNER
616#define NECP_CLIENT_PARAMETER_DOMAIN_CONTEXT NECP_POLICY_CONDITION_DOMAIN_CONTEXT
617#define NECP_CLIENT_PARAMETER_TRACKER_DOMAIN NECP_POLICY_CONDITION_TRACKER_DOMAIN
618#define NECP_CLIENT_PARAMETER_URL NECP_POLICY_CONDITION_URL
619#define NECP_CLIENT_PARAMETER_ATTRIBUTED_BUNDLE_IDENTIFIER NECP_POLICY_CONDITION_ATTRIBUTED_BUNDLE_IDENTIFIER
620#define NECP_CLIENT_PARAMETER_ACCOUNT NECP_POLICY_CONDITION_ACCOUNT
621#define NECP_CLIENT_PARAMETER_PID NECP_POLICY_CONDITION_PID // Requires entitlement
622#define NECP_CLIENT_PARAMETER_UID NECP_POLICY_CONDITION_UID // Requires entitlement
623#define NECP_CLIENT_PARAMETER_BOUND_INTERFACE NECP_POLICY_CONDITION_BOUND_INTERFACE
624#define NECP_CLIENT_PARAMETER_TRAFFIC_CLASS NECP_POLICY_CONDITION_TRAFFIC_CLASS
625#define NECP_CLIENT_PARAMETER_IP_PROTOCOL NECP_POLICY_CONDITION_IP_PROTOCOL
626#define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS NECP_POLICY_CONDITION_LOCAL_ADDR
627#define NECP_CLIENT_PARAMETER_REMOTE_ADDRESS NECP_POLICY_CONDITION_REMOTE_ADDR
628#define NECP_CLIENT_PARAMETER_SCHEME_PORT NECP_POLICY_CONDITION_SCHEME_PORT
629#define NECP_CLIENT_PARAMETER_APPLICATION_ID NECP_POLICY_CONDITION_APPLICATION_ID
630#define NECP_CLIENT_PARAMETER_NEXUS_KEY 102
631
632// "Prohibit" will never choose an interface with that property
633#define NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE 100 // String, interface name
634#define NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE 101 // u_int8_t, see ifru_functional_type in <net/if.h>
635#define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT 102 // uuid_t, network agent UUID
636#define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE 103 // struct necp_client_parameter_netagent_type
637
638// "Require" will choose an interface with that property, or none if not found
639#define NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE 111 // u_int8_t, see ifru_functional_type in <net/if.h>
640#define NECP_CLIENT_PARAMETER_REQUIRE_AGENT 112 // uuid_t, network agent UUID
641#define NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE 113 // struct necp_client_parameter_netagent_type
642
643// "Prefer" will choose an interface with an agent, or best otherwise if not found
644#define NECP_CLIENT_PARAMETER_PREFER_AGENT 122 // uuid_t, network agent UUID
645#define NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE 123 // struct necp_client_parameter_netagent_type
646
647// "Avoid" will choose an interface without an agent, or best otherwise if unavoidable
648#define NECP_CLIENT_PARAMETER_AVOID_AGENT 124 // uuid_t, network agent UUID
649#define NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE 125 // struct necp_client_parameter_netagent_type
650
651// Use actions with NECP_CLIENT_ACTION_AGENT
652#define NECP_CLIENT_PARAMETER_TRIGGER_AGENT 130 // uuid_t, network agent UUID
653#define NECP_CLIENT_PARAMETER_ASSERT_AGENT 131 // uuid_t, network agent UUID
654#define NECP_CLIENT_PARAMETER_UNASSERT_AGENT 132 // uuid_t, network agent UUID
655#define NECP_CLIENT_PARAMETER_AGENT_ADD_GROUP_MEMBERS 133 // struct necp_client_group_action
656#define NECP_CLIENT_PARAMETER_AGENT_REMOVE_GROUP_MEMBERS 134 // struct necp_client_group_action
657#define NECP_CLIENT_PARAMETER_REPORT_AGENT_ERROR 135 // int32_t
658
659#define NECP_CLIENT_PARAMETER_FALLBACK_MODE 140 // u_int8_t, see SO_FALLBACK_MODE_* values
660
661#define NECP_CLIENT_PARAMETER_PARENT_ID 150 // uuid_t, client UUID
662
663#define NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT 200 // struct necp_client_endpoint
664#define NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT 201 // struct necp_client_endpoint
665#define NECP_CLIENT_PARAMETER_BROWSE_DESCRIPTOR 202 // struct necp_client_endpoint
666#define NECP_CLIENT_PARAMETER_RESOLVER_TAG 203 // struct necp_client_validatable
667#define NECP_CLIENT_PARAMETER_ADVERTISE_DESCRIPTOR 204 // struct necp_client_endpoint
668#define NECP_CLIENT_PARAMETER_GROUP_DESCRIPTOR 205 // struct necp_client_group
669
670#define NECP_CLIENT_PARAMETER_DELEGATED_UPID 210 // u_int64_t, requires entitlement
671
672#define NECP_CLIENT_PARAMETER_ETHERTYPE 220 // u_int16_t, ethertype
673#define NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL 221 // u_int8_t, IPPROTO_
674
675#define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE 230 // u_int8_t, NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_
676
677#define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_DEFAULT 0
678#define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_TEMPORARY 1
679#define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_STABLE 2
680
681#define NECP_CLIENT_PARAMETER_FLAGS 250 // u_int32_t, see NECP_CLIENT_PAREMETER_FLAG_* values
682#define NECP_CLIENT_PARAMETER_FLOW_DEMUX_PATTERN 251 // struct necp_demux_pattern
683
684#define NECP_CLIENT_PARAMETER_FLAG_MULTIPATH 0x0001 // Get multipath interface results
685#define NECP_CLIENT_PARAMETER_FLAG_BROWSE 0x0002 // Agent assertions on nexuses are requests to browse
686#define NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE 0x0004 // Prohibit expensive interfaces
687#define NECP_CLIENT_PARAMETER_FLAG_LISTENER 0x0008 // Client is interested in listening for inbound connections
688#define NECP_CLIENT_PARAMETER_FLAG_DISCRETIONARY 0x0010 // Client's traffic is discretionary, and eligible for early defuncting
689#define NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE 0x0020 // Client is requesting to enable ECN
690#define NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE 0x0040 // Client is requesting to disable ECN
691#define NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE 0x0080 // Client is requesting to enable TFO
692#define NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE 0x0100 // Interpret NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE only for primary interface, and allow exceptions for multipath or listeners
693#define NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER 0x0200 // Client expects to open a custom ethernet channel
694#define NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP 0x0400 // Client expects to open a custom IP protocol channel
695#define NECP_CLIENT_PARAMETER_FLAG_INTERPOSE 0x0800 // Client expects to open an interpose filter channel
696#define NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED 0x1000 // Prohibit constrained interfaces
697#define NECP_CLIENT_PARAMETER_FLAG_FALLBACK_TRAFFIC 0x2000 // Fallback traffic
698#define NECP_CLIENT_PARAMETER_FLAG_INBOUND 0x4000 // Flow is inbound (passive)
699#define NECP_CLIENT_PARAMETER_FLAG_SYSTEM_PROXY 0x8000 // Flow is a system proxy
700#define NECP_CLIENT_PARAMETER_FLAG_KNOWN_TRACKER 0x10000 // Flow is contacting a known tracker
701#define NECP_CLIENT_PARAMETER_FLAG_UNSAFE_SOCKET_ACCESS 0x20000 // Client allows direct access to sockets
702#define NECP_CLIENT_PARAMETER_FLAG_NON_APP_INITIATED 0x40000 // Networking activities not initiated by application
703#define NECP_CLIENT_PARAMETER_FLAG_THIRD_PARTY_WEB_CONTENT 0x80000 // Third-party web content, not main load
704#define NECP_CLIENT_PARAMETER_FLAG_SILENT 0x100000 // Private browsing - do not log/track
705#define NECP_CLIENT_PARAMETER_FLAG_APPROVED_APP_DOMAIN 0x200000 // Approved associated app domain; domain is "owned" by app
706#define NECP_CLIENT_PARAMETER_FLAG_NO_WAKE_FROM_SLEEP 0x400000 // Don't wake from sleep on traffic for this client
707#define NECP_CLIENT_PARAMETER_FLAG_REUSE_LOCAL 0x800000 // Request support for local address/port reuse
708#define NECP_CLIENT_PARAMETER_FLAG_ENHANCED_PRIVACY 0x1000000 // Attempt protocol upgrade or proxy usage for more privacy
709#define NECP_CLIENT_PARAMETER_FLAG_WEB_SEARCH_CONTENT 0x2000000 // Web search traffic
710
711#define NECP_CLIENT_RESULT_CLIENT_ID 1 // uuid_t
712#define NECP_CLIENT_RESULT_POLICY_RESULT 2 // u_int32_t
713#define NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER 3 // u_int32_t
714#define NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT 4 // u_int32_t
715#define NECP_CLIENT_RESULT_INTERFACE_INDEX 5 // u_int32_t
716#define NECP_CLIENT_RESULT_NETAGENT 6 // struct necp_client_result_netagent
717#define NECP_CLIENT_RESULT_FLAGS 7 // u_int32_t, see NECP_CLIENT_RESULT_FLAG_* values
718#define NECP_CLIENT_RESULT_INTERFACE 8 // struct necp_client_result_interface
719#define NECP_CLIENT_RESULT_INTERFACE_OPTION 9 // struct necp_client_interface_option
720#define NECP_CLIENT_RESULT_EFFECTIVE_MTU 10 // u_int32_t
721#define NECP_CLIENT_RESULT_FLOW 11 // TLV array of a single flow's state
722#define NECP_CLIENT_RESULT_PROTO_CTL_EVENT 12
723#define NECP_CLIENT_RESULT_TFO_COOKIE 13 // NECP_TFO_COOKIE_LEN_MAX
724#define NECP_CLIENT_RESULT_TFO_FLAGS 14 // u_int8_t
725#define NECP_CLIENT_RESULT_RECOMMENDED_MSS 15 // u_int8_t
726#define NECP_CLIENT_RESULT_FLOW_ID 16 // uuid_t
727#define NECP_CLIENT_RESULT_INTERFACE_TIME_DELTA 17 // u_int32_t, seconds since interface up/down
728#define NECP_CLIENT_RESULT_REASON 18 // u_int32_t, see NECP_CLIENT_RESULT_REASON_* values
729#define NECP_CLIENT_RESULT_FLOW_DIVERT_AGGREGATE_UNIT 19 // u_int32_t
730#define NECP_CLIENT_RESULT_REQUEST_IN_PROCESS_FLOW_DIVERT 20 // Empty
731
732#define NECP_CLIENT_RESULT_NEXUS_INSTANCE 100 // uuid_t
733#define NECP_CLIENT_RESULT_NEXUS_PORT 101 // nexus_port_t
734#define NECP_CLIENT_RESULT_NEXUS_KEY 102 // uuid_t
735#define NECP_CLIENT_RESULT_NEXUS_PORT_FLOW_INDEX 103 // u_int32_t
736#define NECP_CLIENT_RESULT_NEXUS_FLOW_STATS 104 // struct sk_stats_flow *
737
738#define NECP_CLIENT_RESULT_LOCAL_ENDPOINT 200 // struct necp_client_endpoint
739#define NECP_CLIENT_RESULT_REMOTE_ENDPOINT 201 // struct necp_client_endpoint
740#define NECP_CLIENT_RESULT_DISCOVERED_ENDPOINT 202 // struct necp_client_endpoint, result of browse
741#define NECP_CLIENT_RESULT_RESOLVED_ENDPOINT 203 // struct necp_client_endpoint, result of resolve
742#define NECP_CLIENT_RESULT_LOCAL_ETHER_ADDR 204 // struct ether_addr
743#define NECP_CLIENT_RESULT_REMOTE_ETHER_ADDR 205 // struct ether_addr
744#define NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS 210 // u_int32_t
745#define NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG 211 // u_int32_t, 1: background, 0: not background
746#define NECP_CLIENT_RESULT_GATEWAY 212 // struct necp_client_endpoint
747#define NECP_CLIENT_RESULT_GROUP_MEMBER 213 // struct necp_client_endpoint
748#define NECP_CLIENT_RESULT_NAT64 214 // struct ipv6_prefix[NAT64_MAX_NUM_PREFIXES]
749#define NECP_CLIENT_RESULT_ESTIMATED_THROUGHPUT 215 // struct necp_client_result_estimated_throughput
750#define NECP_CLIENT_RESULT_AGENT_ERROR 216 // struct necp_client_result_agent_error
751
752#define NECP_CLIENT_RESULT_FLAG_IS_LOCAL 0x0001 // Routes to this device
753#define NECP_CLIENT_RESULT_FLAG_IS_DIRECT 0x0002 // Routes to directly accessible peer
754#define NECP_CLIENT_RESULT_FLAG_HAS_IPV4 0x0004 // Supports IPv4
755#define NECP_CLIENT_RESULT_FLAG_HAS_IPV6 0x0008 // Supports IPv6
756#define NECP_CLIENT_RESULT_FLAG_DEFUNCT 0x0010 // Defunct
757#define NECP_CLIENT_RESULT_FLAG_SATISFIED 0x0020 // Satisfied path
758#define NECP_CLIENT_RESULT_FLAG_FLOW_ASSIGNED 0x0040 // Assigned, the flow is active
759#define NECP_CLIENT_RESULT_FLAG_FLOW_VIABLE 0x0080 // Viable, the flow has a valid route
760#define NECP_CLIENT_RESULT_FLAG_PROBE_CONNECTIVITY 0x0100 // Flow should probe connectivity
761#define NECP_CLIENT_RESULT_FLAG_ECN_ENABLED 0x0200 // ECN should be used
762#define NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED 0x0400 // Fast open should not be used
763#define NECP_CLIENT_RESULT_FLAG_LINK_QUALITY_ABORT 0x0800 // Link quality is very bad, recommend close connections
764#define NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING 0x1000 // QoS marking is allowed
765#define NECP_CLIENT_RESULT_FLAG_HAS_NAT64 0x2000 // Has NAT64 prefix
766#define NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER 0x4000 // Interface is in low-power mode
767#define NECP_CLIENT_RESULT_FLAG_SPECIFIC_LISTENER 0x8000 // Listener should not listen on all interfaces
768#define NECP_CLIENT_RESULT_FLAG_KEXT_FILTER_PRESENT 0x10000 // Kernel extension filter present
769#define NECP_CLIENT_RESULT_FLAG_PF_RULES_PRESENT 0x20000 // Firewall rules present
770#define NECP_CLIENT_RESULT_FLAG_ALF_PRESENT 0x40000 // Application Firewall enabled
771#define NECP_CLIENT_RESULT_FLAG_PARENTAL_CONTROLS_PRESENT 0x80000 // Parental Controls present
772#define NECP_CLIENT_RESULT_FLAG_IS_GLOBAL_INTERNET 0x100000 // Routes to global Internet
773
774
775#define NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE (NECP_CLIENT_RESULT_FLAG_HAS_IPV4 | NECP_CLIENT_RESULT_FLAG_HAS_IPV6 | NECP_CLIENT_RESULT_FLAG_HAS_NAT64 | NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER)
776
777#define NECP_CLIENT_RESULT_FAST_OPEN_SND_PROBE 0x01 // DEPRECATED - Fast open send probe
778#define NECP_CLIENT_RESULT_FAST_OPEN_RCV_PROBE 0x02 // DEPRECATED - Fast open receive probe
779
780#define NECP_CLIENT_RESULT_RECOMMENDED_MSS_NONE 0x01
781#define NECP_CLIENT_RESULT_RECOMMENDED_MSS_LOW 0x02
782#define NECP_CLIENT_RESULT_RECOMMENDED_MSS_MEDIUM 0x04
783
784#define NECP_CLIENT_RESULT_REASON_EXPENSIVE_PROHIBITED 1 // Expensive networks were prohibited
785#define NECP_CLIENT_RESULT_REASON_CONSTRAINED_PROHIBITED 2 // Constrained networks were prohibited
786#define NECP_CLIENT_RESULT_REASON_CELLULAR_DENIED 3 // Denied by a cellular route rule
787#define NECP_CLIENT_RESULT_REASON_WIFI_DENIED 4 // Denied by a wifi route rule
788#define NECP_CLIENT_RESULT_REASON_LOCAL_NETWORK_PROHIBITED 5 // Local network access prohibited
789
790struct necp_interface_signature {
791 u_int8_t signature[IFNET_SIGNATURELEN];
792 u_int8_t signature_len;
793};
794
795struct necp_interface_details {
796 char name[IFXNAMSIZ];
797 u_int32_t index;
798 u_int32_t generation;
799 u_int32_t functional_type;
800 u_int32_t delegate_index;
801 u_int32_t flags; // see NECP_INTERFACE_FLAG_*
802 u_int32_t mtu;
803 struct necp_interface_signature ipv4_signature;
804 struct necp_interface_signature ipv6_signature;
805 u_int32_t ipv4_netmask;
806 u_int32_t ipv4_broadcast;
807 /*
808 * This serves as a temporary header guard to protect libnetcore builds
809 * until the xnu changes are available in the build.
810 * XXX: Should be removed in a future build.
811 */
812#define NECP_INTERFACE_SUPPORTS_TSO 1
813 u_int32_t tso_max_segment_size_v4;
814 u_int32_t tso_max_segment_size_v6;
815#define NECP_INTERFACE_SUPPORTS_HWCSUM 1
816 u_int32_t hwcsum_flags;
817 u_int8_t radio_type;
818 u_int8_t radio_channel;
819};
820
821#define NECP_INTERFACE_FLAG_EXPENSIVE 0x0001
822#define NECP_INTERFACE_FLAG_TXSTART 0X0002
823#define NECP_INTERFACE_FLAG_NOACKPRI 0x0004
824#define NECP_INTERFACE_FLAG_3CARRIERAGG 0x0008
825#define NECP_INTERFACE_FLAG_IS_LOW_POWER 0x0010
826#define NECP_INTERFACE_FLAG_MPK_LOG 0x0020 // Multi-layer Packet Logging
827#define NECP_INTERFACE_FLAG_CONSTRAINED 0x0040
828#define NECP_INTERFACE_FLAG_HAS_NETMASK 0x0080
829#define NECP_INTERFACE_FLAG_HAS_BROADCAST 0x0100
830#define NECP_INTERFACE_FLAG_SUPPORTS_MULTICAST 0x0200
831#define NECP_INTERFACE_FLAG_HAS_DNS 0x0400
832#define NECP_INTERFACE_FLAG_HAS_NAT64 0x0800
833#define NECP_INTERFACE_FLAG_IPV4_ROUTABLE 0x1000
834#define NECP_INTERFACE_FLAG_IPV6_ROUTABLE 0x2000
835
836struct necp_client_parameter_netagent_type {
837 char netagent_domain[32];
838 char netagent_type[32];
839};
840
841struct necp_client_result_netagent {
842 u_int32_t generation;
843 uuid_t netagent_uuid;
844};
845
846struct necp_client_result_interface {
847 u_int32_t generation;
848 u_int32_t index;
849};
850
851struct necp_client_result_estimated_throughput {
852 u_int8_t up;
853 u_int8_t down;
854};
855
856struct necp_client_result_agent_error {
857 u_int32_t code;
858 u_int8_t domain;
859};
860
861#define NECP_USES_INTERFACE_OPTIONS_FOR_BROWSE 1
862
863struct necp_client_interface_option {
864 u_int32_t interface_index;
865 u_int32_t interface_generation;
866 uuid_t nexus_agent;
867};
868
869#define NECP_CLIENT_ENDPOINT_TYPE_APPLICATION_SERVICE 6
870
871struct necp_client_endpoint {
872 union {
873 struct sockaddr sa;
874 struct sockaddr_in sin;
875 struct sockaddr_in6 sin6;
876 struct {
877 u_int8_t endpoint_length;
878 u_int8_t endpoint_family; // Use AF_UNSPEC to target a name
879 u_int16_t endpoint_port;
880 u_int32_t endpoint_type; // Client-specific type
881 char endpoint_data[0]; // Type-specific endpoint value
882 } endpoint;
883 } u;
884};
885
886struct necp_client_group {
887 u_int32_t group_type;
888 uuid_t group_id;
889};
890
891struct necp_client_list {
892 u_int32_t client_count;
893 uuid_t clients[0];
894};
895
896struct kev_necp_policies_changed_data {
897 u_int32_t changed_count; // Defaults to 0.
898};
899
900#define NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS 0x01 // Request a nexus instance upon adding a flow
901#define NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID 0x02 // Register the client ID rather than the flow registration ID with network agents
902#define NECP_CLIENT_FLOW_FLAGS_BROWSE 0x04 // Create request with a browse agent
903#define NECP_CLIENT_FLOW_FLAGS_RESOLVE 0x08 // Create request with a resolution agent
904#define NECP_CLIENT_FLOW_FLAGS_OVERRIDE_ADDRESS 0x10 // Flow has a different remote address than the parent flow
905#define NECP_CLIENT_FLOW_FLAGS_OVERRIDE_IP_PROTOCOL 0x20 // Flow has a different IP protocol than the parent flow
906
907struct necp_client_flow_stats {
908 u_int32_t stats_type; // NECP_CLIENT_STATISTICS_TYPE_*
909 u_int32_t stats_version; // NECP_CLIENT_STATISTICS_TYPE_*_VER
910 u_int32_t stats_size;
911 mach_vm_address_t stats_addr;
912};
913
914struct necp_client_add_flow {
915 uuid_t agent_uuid;
916 uuid_t registration_id;
917 u_int16_t flags; // NECP_CLIENT_FLOW_FLAGS_*
918 u_int16_t stats_request_count;
919 struct necp_client_flow_stats stats_requests[0];
920 // sockaddr for override endpoint
921 // uint8 for override ip protocol
922} __attribute__((__packed__));
923
924struct necp_agent_use_parameters {
925 uuid_t agent_uuid;
926 uint64_t out_use_count;
927};
928
929struct necp_client_group_action {
930 uuid_t agent_uuid;
931 u_int16_t group_member_count;
932 struct necp_client_endpoint group_members[0];
933} __attribute__((__packed__));
934
935struct necp_client_flow_protoctl_event {
936 uint32_t protoctl_event_code;
937 uint32_t protoctl_event_val;
938 /* TCP seq number is in host byte order */
939 uint32_t protoctl_event_tcp_seq_num;
940};
941
942#define NECP_CLIENT_UPDATE_TYPE_PARAMETERS 1 // Parameters, for a new client
943#define NECP_CLIENT_UPDATE_TYPE_RESULT 2 // Result, for a udpated client
944#define NECP_CLIENT_UPDATE_TYPE_REMOVE 3 // Empty, for a removed client
945
946struct necp_client_observer_update {
947 u_int32_t update_type; // NECP_CLIENT_UPDATE_TYPE_*
948 u_int8_t tlv_buffer[0]; // Parameters or result as TLVs, based on type
949};
950
951// These sign types are tied to specific clients.
952// The client_id UUID is then the NECP client UUID that generated the query.
953#define NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER 1 // struct necp_client_host_resolver_answer
954#define NECP_CLIENT_SIGN_TYPE_BROWSE_RESULT 2 // struct necp_client_browse_result
955#define NECP_CLIENT_SIGN_TYPE_SERVICE_RESOLVER_ANSWER 3 // struct necp_client_service_resolver_answer
956
957// These sign types are valid for system-wide use.
958// The client_id UUID is a unique per-query UUID.
959// These should be generated only on behalf of trusted or entitled processes.
960#define NECP_CLIENT_SIGN_TYPE_SYSTEM_RESOLVER_ANSWER 4 // struct necp_client_host_resolver_answer
961#define NECP_CLIENT_SIGN_TYPE_SYSTEM_BROWSE_RESULT 5 // struct necp_client_browse_result
962#define NECP_CLIENT_SIGN_TYPE_SYSTEM_SERVICE_RESOLVER_ANSWER 6 // struct necp_client_service_resolver_answer
963
964struct necp_client_signature {
965 u_int8_t signed_tag[32];
966} __attribute__((__packed__));
967
968//
969struct necp_client_signable {
970 uuid_t client_id; // Interpretation depends on sign_type
971 u_int32_t sign_type;
972 u_int8_t signable_data[0];
973} __attribute__((__packed__));
974
975struct necp_client_resolver_answer {
976 uuid_t client_id;
977 u_int32_t sign_type;
978 union sockaddr_in_4_6 address_answer; // Can include port
979 u_int32_t hostname_length;
980 char hostname[0];
981} __attribute__((__packed__));
982
983struct necp_client_host_resolver_answer {
984 struct necp_client_signable header;
985 u_int32_t metadata_hash; // Extra metadata that can be signed along with the answer, such as a network signature.
986 union sockaddr_in_4_6 address_answer; // Can include port
987 u_int32_t hostname_length;
988 char hostname[0];
989} __attribute__((__packed__));
990
991struct necp_client_browse_result {
992 struct necp_client_signable header;
993 u_int32_t metadata_hash; // Extra metadata that can be signed along with the service, which may include a TXT record or a network signature
994 u_int16_t service_length;
995 char service[0];
996} __attribute__((__packed__));
997
998struct necp_client_service_resolver_answer {
999 struct necp_client_signable header;
1000 u_int32_t metadata_hash; // Extra metadata that can be signed along with the service, which may include a TXT record or a network signature
1001 u_int16_t service_length;
1002 u_int16_t port;
1003 u_int16_t hostname_length;
1004 char service[0];
1005 char hostname[0];
1006} __attribute__((__packed__));
1007
1008struct necp_client_validatable {
1009 struct necp_client_signature signature;
1010 struct necp_client_signable signable;
1011} __attribute__((__packed__));
1012
1013#define NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH 1024
1014
1015#define NECP_CLIENT_ACTION_SIGN_TAG_LENGTH 32
1016
1017#define NECP_CLIENT_ACTION_SIGN_DEFAULT_DATA_LENGTH 128
1018#define NECP_CLIENT_ACTION_SIGN_MAX_TOTAL_LENGTH 4096
1019
1020#define NECP_FILTER_UNIT_NO_FILTER UINT32_MAX // Reserved filter unit value that prohibits all filters and socket filters
1021
1022// Type of signed client ID requests.
1023#define NECP_CLIENT_SIGNED_CLIENT_ID_TYPE_UUID 1 // struct necp_client_signed_client_id_uuid
1024
1025struct necp_client_signed_client_id_uuid {
1026 uuid_t client_id;
1027 u_int32_t signature_length;
1028 u_int8_t signature_data[NECP_CLIENT_ACTION_SIGN_TAG_LENGTH];
1029} __attribute__((__packed__));
1030
1031/*
1032 * The sysctl "net.necp.necp_drop_dest_level" controls the global drop rule policy for
1033 * a set of destinations addresses at the given level -- the drop rule is the last one
1034 * to be evaluated at this level.
1035 */
1036#define MAX_NECP_DROP_DEST_LEVEL_ADDRS 8
1037
1038struct necp_drop_dest_entry {
1039 u_int32_t level; // priority level
1040 u_int32_t order; // session order (read only via sysctl)
1041 struct necp_policy_condition_addr cond_addr;
1042};
1043
1044struct necp_drop_dest_policy {
1045 u_int32_t entry_count;
1046 struct necp_drop_dest_entry entries[MAX_NECP_DROP_DEST_LEVEL_ADDRS];
1047};
1048
1049
1050#define NECP_DEMUX_MAX_LEN 32
1051struct necp_demux_pattern {
1052 uint16_t offset;
1053 uint16_t len;
1054 uint8_t mask[NECP_DEMUX_MAX_LEN];
1055 uint8_t value[NECP_DEMUX_MAX_LEN];
1056};
1057
1058#ifdef BSD_KERNEL_PRIVATE
1059#include <stdbool.h>
1060#include <sys/socketvar.h>
1061#include <sys/kern_control.h>
1062#include <netinet/ip_var.h>
1063#include <netinet6/ip6_var.h>
1064#include <net/if_var.h>
1065#include <sys/syslog.h>
1066#include <net/network_agent.h>
1067#include <net/ethernet.h>
1068#include <os/log.h>
1069#if SKYWALK
1070#include <skywalk/namespace/netns.h>
1071#endif /* SKYWALK */
1072
1073
1074SYSCTL_DECL(_net_necp);
1075
1076extern os_log_t necp_log_handle;
1077extern os_log_t necp_data_trace_log_handle;
1078
1079#define NECPLOG(level, format, ...) do { \
1080 if (level == LOG_ERR) { \
1081 os_log_error(necp_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \
1082 } else { \
1083 os_log(necp_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \
1084 } \
1085} while (0)
1086
1087#define NECPLOG0(level, msg) do { \
1088 if (level == LOG_ERR) { \
1089 os_log_error(necp_log_handle, "%s: %s\n", __FUNCTION__, msg); \
1090 } else { \
1091 os_log(necp_log_handle, "%s: %s\n", __FUNCTION__, msg); \
1092 } \
1093} while (0)
1094
1095#define NECPDATATRACELOG(level, format, ...) do { \
1096 if (level == LOG_ERR) { \
1097 os_log_error(necp_data_trace_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \
1098 } else { \
1099 os_log(necp_data_trace_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \
1100 } \
1101} while (0)
1102
1103enum necp_fd_type_t {
1104 necp_fd_type_invalid = 0,
1105 necp_fd_type_session = 1,
1106 necp_fd_type_client = 2,
1107};
1108
1109union necp_sockaddr_union {
1110#if !__has_ptrcheck
1111 struct sockaddr sa;
1112#endif
1113 struct __sockaddr_header sah;
1114 struct sockaddr_in sin;
1115 struct sockaddr_in6 sin6;
1116};
1117
1118/*
1119 * kstats
1120 * The ustats and kstats region are mirrored. So when we allocate with
1121 * skmem_cache from kstats region, we also get an ustats object. To tie them
1122 * together, kstats has an extra *necp_stats_ustats pointer pointing to the
1123 * ustats object
1124 */
1125struct necp_all_kstats {
1126 struct necp_all_stats necp_stats_comm; /* kernel private stats snapshot */
1127 struct necp_all_stats *necp_stats_ustats; /* points to user-visible stats (in shared ustats region) */
1128};
1129
1130extern void necp_client_init(void);
1131extern int necp_application_find_policy_match_internal(proc_t proc, u_int8_t *parameters, u_int32_t parameters_size,
1132 struct necp_aggregate_result *returned_result,
1133 u_int32_t *flags, u_int32_t *reason, u_int required_interface_index,
1134 const union necp_sockaddr_union *override_local_addr,
1135 const union necp_sockaddr_union *override_remote_addr,
1136 struct necp_client_endpoint *returned_v4_gateway,
1137 struct necp_client_endpoint *returned_v6_gateway,
1138 struct rtentry **returned_route, bool ignore_address,
1139 bool has_client,
1140 uuid_t *returned_override_euuid);
1141/*
1142 * TLV utilities
1143 *
1144 * Note that these functions (other than necp_buffer_find_tlv) do not check the length of the entire buffer,
1145 * so the caller must be sure that the entire TLV is within bounds.
1146 */
1147struct necp_tlv_header {
1148 u_int8_t type;
1149 u_int32_t length;
1150} __attribute__((__packed__));
1151
1152extern u_int8_t *necp_buffer_write_tlv(u_int8_t *cursor, u_int8_t type, u_int32_t length, const void *value,
1153 u_int8_t *buffer, u_int32_t buffer_length);
1154extern u_int8_t *necp_buffer_write_tlv_if_different(u_int8_t *cursor, u_int8_t type,
1155 u_int32_t length, const void *value, bool *updated,
1156 u_int8_t *buffer, u_int32_t buffer_length);
1157extern u_int8_t necp_buffer_get_tlv_type(u_int8_t *buffer, int tlv_offset);
1158extern u_int32_t necp_buffer_get_tlv_length(u_int8_t *buffer, int tlv_offset);
1159extern u_int8_t *necp_buffer_get_tlv_value(u_int8_t *buffer, int tlv_offset, u_int32_t *value_size);
1160extern int necp_buffer_find_tlv(u_int8_t *buffer, u_int32_t buffer_length, int offset, u_int8_t type, int *err, int next);
1161
1162#define NECPCTL_DROP_ALL_LEVEL 1 /* Drop all packets if no policy matches above this level */
1163#define NECPCTL_DEBUG 2 /* Log all kernel policy matches */
1164#define NECPCTL_PASS_LOOPBACK 3 /* Pass all loopback traffic */
1165#define NECPCTL_PASS_KEEPALIVES 4 /* Pass all kernel-generated keepalive traffic */
1166#define NECPCTL_SOCKET_POLICY_COUNT 5 /* Count of all socket-level policies */
1167#define NECPCTL_SOCKET_NON_APP_POLICY_COUNT 6 /* Count of non-per-app socket-level policies */
1168#define NECPCTL_IP_POLICY_COUNT 7 /* Count of all ip-level policies */
1169#define NECPCTL_SESSION_COUNT 8 /* Count of NECP sessions */
1170#define NECPCTL_CLIENT_FD_COUNT 9 /* Count of NECP client fds */
1171#define NECPCTL_CLIENT_COUNT 10 /* Count of NECP clients */
1172#define NECPCTL_ARENA_COUNT 11 /* Count of NECP arenas (stats, etc) */
1173#define NECPCTL_NEXUS_FLOW_COUNT 12 /* Count of NECP nexus flows */
1174#define NECPCTL_SOCKET_FLOW_COUNT 13 /* Count of NECP socket flows */
1175#define NECPCTL_IF_FLOW_COUNT 14 /* Count of NECP socket flows */
1176#define NECPCTL_OBSERVER_FD_COUNT 15 /* Count of NECP observer fds */
1177#define NECPCTL_OBSERVER_MESSAGE_LIMIT 16 /* Number of of NECP observer messages allowed to be queued */
1178#define NECPCTL_SYSCTL_ARENA_COUNT 17 /* Count of sysctl arenas */
1179#define NECPCTL_DROP_UNENTITLED_LEVEL 18 /* Drop unentitled process traffic above this level */
1180#define NECPCTL_PASS_INTERPOSE 19 /* Pass interpose */
1181#define NECPCTL_RESTRICT_MULTICAST 20 /* Restrict multicast access */
1182#define NECPCTL_DEDUP_POLICIES 21 /* Dedup overlapping policies */
1183#define NECPCTL_CLIENT_TRACING_LEVEL 22 /* Client tracing level */
1184#define NECPCTL_CLIENT_TRACING_PID 23 /* Apply client tracing only to specified pid */
1185#define NECPCTL_DROP_MANAGEMENT_LEVEL 24 /* Drop management traffic at this level */
1186
1187#define NECP_LOOPBACK_PASS_ALL 1 // Pass all loopback traffic
1188#define NECP_LOOPBACK_PASS_WITH_FILTER 2 // Pass all loopback traffic, but activate content filter and/or flow divert if applicable
1189
1190#define NECPCTL_NAMES { \
1191 { 0, 0 }, \
1192 { "drop_all_level", CTLTYPE_INT }, \
1193 { "debug", CTLTYPE_INT }, \
1194 { "pass_loopback", CTLTYPE_INT }, \
1195 { "pass_keepalives", CTLTYPE_INT }, \
1196 { "pass_interpose", CTLTYPE_INT }, \
1197}
1198
1199typedef u_int32_t necp_kernel_policy_id;
1200#define NECP_KERNEL_POLICY_ID_NONE 0
1201#define NECP_KERNEL_POLICY_ID_NO_MATCH 1
1202#define NECP_KERNEL_POLICY_ID_FIRST_VALID_SOCKET 2
1203#define NECP_KERNEL_POLICY_ID_FIRST_VALID_IP UINT16_MAX
1204
1205typedef u_int32_t necp_app_id;
1206
1207#define NECP_KERNEL_POLICY_RESULT_NONE 0
1208#define NECP_KERNEL_POLICY_RESULT_PASS NECP_POLICY_RESULT_PASS
1209#define NECP_KERNEL_POLICY_RESULT_SKIP NECP_POLICY_RESULT_SKIP
1210#define NECP_KERNEL_POLICY_RESULT_DROP NECP_POLICY_RESULT_DROP
1211#define NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT NECP_POLICY_RESULT_SOCKET_DIVERT
1212#define NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER NECP_POLICY_RESULT_SOCKET_FILTER
1213#define NECP_KERNEL_POLICY_RESULT_IP_TUNNEL NECP_POLICY_RESULT_IP_TUNNEL
1214#define NECP_KERNEL_POLICY_RESULT_IP_FILTER NECP_POLICY_RESULT_IP_FILTER
1215#define NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED NECP_POLICY_RESULT_SOCKET_SCOPED
1216#define NECP_KERNEL_POLICY_RESULT_ROUTE_RULES NECP_POLICY_RESULT_ROUTE_RULES
1217#define NECP_KERNEL_POLICY_RESULT_USE_NETAGENT NECP_POLICY_RESULT_USE_NETAGENT
1218#define NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED NECP_POLICY_RESULT_NETAGENT_SCOPED
1219#define NECP_KERNEL_POLICY_RESULT_SCOPED_DIRECT NECP_POLICY_RESULT_SCOPED_DIRECT
1220#define NECP_KERNEL_POLICY_RESULT_ALLOW_UNENTITLED NECP_POLICY_RESULT_ALLOW_UNENTITLED
1221#define NECP_KERNEL_POLICY_RESULT_REMOVE_NETAGENT NECP_POLICY_RESULT_REMOVE_NETAGENT
1222
1223#define NECP_KERNEL_POLICY_PASS_NO_SKIP_IPSEC NECP_POLICY_PASS_NO_SKIP_IPSEC
1224#define NECP_KERNEL_POLICY_PASS_PF_TAG NECP_POLICY_PASS_PF_TAG
1225
1226#define NECP_KERNEL_POLICY_DROP_FLAG_LOCAL_NETWORK NECP_POLICY_DROP_FLAG_LOCAL_NETWORK
1227#define NECP_KERNEL_POLICY_DROP_FLAG_SUPPRESS_ALERTS NECP_POLICY_DROP_FLAG_SUPPRESS_ALERTS
1228
1229typedef struct {
1230 u_int32_t identifier;
1231 u_int32_t data;
1232} necp_kernel_policy_service;
1233
1234typedef union {
1235 u_int tunnel_interface_index;
1236 u_int scoped_interface_index;
1237 u_int32_t flow_divert_control_unit;
1238 u_int32_t filter_control_unit;
1239 u_int32_t skip_policy_order;
1240 u_int32_t route_rule_id;
1241 u_int32_t netagent_id;
1242 u_int32_t pass_flags;
1243 u_int32_t drop_flags;
1244 necp_kernel_policy_service service;
1245} necp_kernel_policy_result_parameter;
1246
1247enum necp_boolean_state {
1248 necp_boolean_state_unknown = 0,
1249 necp_boolean_state_false = 1,
1250 necp_boolean_state_true = 2,
1251};
1252
1253struct necp_kernel_socket_policy {
1254 LIST_ENTRY(necp_kernel_socket_policy) chain;
1255 necp_kernel_policy_id id;
1256 necp_policy_order order;
1257 u_int32_t session_order;
1258 int session_pid;
1259
1260 u_int64_t condition_mask;
1261 u_int64_t condition_negated_mask;
1262 u_int32_t cond_client_flags;
1263 necp_kernel_policy_id cond_policy_id;
1264 u_int32_t cond_app_id; // Locally assigned ID value stored
1265 u_int32_t cond_real_app_id; // Locally assigned ID value stored
1266 char *cond_custom_entitlement; // String
1267 u_int32_t cond_account_id; // Locally assigned ID value stored
1268 char *cond_domain; // String
1269 u_int8_t cond_domain_dot_count; // Number of dots in cond_domain
1270 u_int32_t cond_domain_filter;
1271 pid_t cond_pid;
1272 uid_t cond_uid;
1273 uid_t cond_real_uid;
1274 ifnet_t cond_bound_interface; // Matches specific binding only
1275 struct necp_policy_condition_tc_range cond_traffic_class; // Matches traffic class in range
1276 u_int16_t cond_protocol; // Matches IP protcol number
1277 union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
1278 union necp_sockaddr_union cond_local_end; // Matches IP address range
1279 u_int8_t cond_local_prefix; // Defines subnet
1280 union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
1281 union necp_sockaddr_union cond_remote_end; // Matches IP address range
1282 u_int8_t cond_remote_prefix; // Defines subnet
1283 struct necp_policy_condition_agent_type cond_agent_type;
1284 struct necp_policy_condition_sdk_version cond_sdk_version;
1285 char *cond_signing_identifier; // String
1286 char *cond_url;// String
1287 u_int16_t cond_packet_filter_tags;
1288 u_int16_t cond_scheme_port;
1289 int32_t cond_pid_version;
1290 u_int32_t cond_bound_interface_flags;
1291 u_int32_t cond_bound_interface_eflags;
1292 u_int32_t cond_bound_interface_xflags;
1293
1294 necp_kernel_policy_result result;
1295 necp_kernel_policy_result_parameter result_parameter;
1296};
1297
1298struct necp_kernel_ip_output_policy {
1299 LIST_ENTRY(necp_kernel_ip_output_policy) chain;
1300 necp_kernel_policy_id id;
1301 necp_policy_order suborder;
1302 necp_policy_order order;
1303 u_int32_t session_order;
1304 int session_pid;
1305
1306 u_int64_t condition_mask;
1307 u_int64_t condition_negated_mask;
1308 necp_kernel_policy_id cond_policy_id;
1309 ifnet_t cond_bound_interface; // Matches specific binding only
1310 u_int16_t cond_protocol; // Matches IP protcol number
1311 union necp_sockaddr_union cond_local_start; // Matches local IP address (or start)
1312 union necp_sockaddr_union cond_local_end; // Matches IP address range
1313 u_int8_t cond_local_prefix; // Defines subnet
1314 union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start)
1315 union necp_sockaddr_union cond_remote_end; // Matches IP address range
1316 u_int8_t cond_remote_prefix; // Defines subnet
1317 u_int32_t cond_last_interface_index;
1318 u_int16_t cond_packet_filter_tags;
1319 u_int16_t cond_scheme_port;
1320 u_int32_t cond_bound_interface_flags;
1321 u_int32_t cond_bound_interface_eflags;
1322 u_int32_t cond_bound_interface_xflags;
1323
1324 necp_kernel_policy_result result;
1325 necp_kernel_policy_result_parameter result_parameter;
1326};
1327
1328#define MAX_KERNEL_SOCKET_POLICIES 1
1329#define MAX_KERNEL_IP_OUTPUT_POLICIES 4
1330struct necp_session_policy {
1331 LIST_ENTRY(necp_session_policy) chain;
1332 bool applied; // Applied into the kernel table
1333 bool pending_deletion; // Waiting to be removed from kernel table
1334 bool pending_update; // Policy has been modified since creation/last application
1335 necp_policy_id local_id;
1336 necp_policy_order order;
1337 u_int8_t *result;
1338 u_int32_t result_size;
1339 u_int8_t *conditions; // Array of conditions, each with a u_int32_t length at start
1340 u_int32_t conditions_size;
1341 u_int8_t *route_rules; // Array of route rules, each with a u_int32_t length at start
1342 u_int32_t route_rules_size;
1343
1344 uuid_t applied_app_uuid;
1345 uuid_t applied_real_app_uuid;
1346 char *applied_account;
1347 u_int32_t applied_account_size;
1348
1349 uuid_t applied_result_uuid;
1350
1351 u_int32_t applied_route_rules_id;
1352
1353 necp_kernel_policy_id kernel_socket_policies[MAX_KERNEL_SOCKET_POLICIES];
1354 necp_kernel_policy_id kernel_ip_output_policies[MAX_KERNEL_IP_OUTPUT_POLICIES];
1355};
1356
1357struct necp_aggregate_socket_result {
1358 necp_kernel_policy_result result;
1359 necp_kernel_policy_result_parameter result_parameter;
1360 necp_kernel_policy_filter filter_control_unit;
1361 u_int32_t flow_divert_aggregate_unit;
1362 u_int32_t route_rule_id;
1363 int32_t qos_marking_gencount;
1364};
1365
1366struct necp_inpcb_result {
1367 u_int32_t app_id;
1368 necp_kernel_policy_id policy_id;
1369 necp_kernel_policy_id skip_policy_id;
1370 int32_t policy_gencount;
1371 u_int32_t flowhash;
1372 u_int32_t network_denied_notifies;// Notification count
1373 struct necp_aggregate_socket_result results;
1374};
1375
1376extern void necp_init(void);
1377
1378struct inp_necp_attributes;
1379extern errno_t necp_set_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt);
1380extern errno_t necp_get_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt);
1381extern errno_t necp_set_socket_domain_attributes(struct socket *so, const char *domain, const char *domain_owner);
1382extern int necp_set_socket_resolver_signature(struct inpcb *inp, struct sockopt *sopt);
1383extern int necp_get_socket_resolver_signature(struct inpcb *inp, struct sockopt *sopt);
1384extern bool necp_socket_has_resolver_signature(struct inpcb *inp);
1385extern bool necp_socket_resolver_signature_matches_address(struct inpcb *inp, union necp_sockaddr_union *address);
1386extern void necp_inpcb_remove_cb(struct inpcb *inp);
1387extern void necp_inpcb_dispose(struct inpcb *inp);
1388
1389extern u_int32_t necp_socket_get_content_filter_control_unit(struct socket *so);
1390
1391extern bool necp_socket_should_use_flow_divert(struct inpcb *inp);
1392extern u_int32_t necp_socket_get_flow_divert_control_unit(struct inpcb *inp, uint32_t *aggregate_unit);
1393
1394extern bool necp_socket_should_rescope(struct inpcb *inp);
1395extern u_int necp_socket_get_rescope_if_index(struct inpcb *inp);
1396extern u_int32_t necp_socket_get_effective_mtu(struct inpcb *inp, u_int32_t current_mtu);
1397
1398extern bool necp_socket_is_allowed_to_recv_on_interface(struct inpcb *inp, ifnet_t interface);
1399
1400extern bool necp_socket_is_allowed_to_send_recv(struct inpcb *inp, ifnet_t input_interface, u_int16_t pf_tag,
1401 necp_kernel_policy_id *return_policy_id,
1402 u_int32_t *return_route_rule_id,
1403 necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags);
1404extern bool necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port,
1405 u_int16_t remote_port, struct in_addr *local_addr,
1406 struct in_addr *remote_addr, ifnet_t input_interface, u_int16_t pf_tag,
1407 necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id,
1408 necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags);
1409extern bool necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port,
1410 u_int16_t remote_port, struct in6_addr *local_addr,
1411 struct in6_addr *remote_addr, ifnet_t input_interface, u_int16_t pf_tag,
1412 necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id,
1413 necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags);
1414extern void necp_socket_update_qos_marking(struct inpcb *inp, struct rtentry *route, u_int32_t route_rule_id);
1415extern bool necp_lookup_current_qos_marking(int32_t *qos_marking_gencount, struct rtentry *route, struct ifnet *interface, u_int32_t route_rule_id, bool old_qos_marking);
1416extern int necp_mark_packet_from_socket(struct mbuf *packet, struct inpcb *inp, necp_kernel_policy_id policy_id,
1417 u_int32_t route_rule_id, necp_kernel_policy_id skip_policy_id, u_int32_t pass_flags);
1418extern necp_kernel_policy_id necp_get_policy_id_from_packet(struct mbuf *packet);
1419extern necp_kernel_policy_id necp_get_skip_policy_id_from_packet(struct mbuf *packet);
1420extern u_int16_t necp_get_packet_filter_tags_from_packet(struct mbuf *packet);
1421extern bool necp_packet_should_skip_filters(struct mbuf *packet);
1422extern u_int32_t necp_get_last_interface_index_from_packet(struct mbuf *packet);
1423extern u_int32_t necp_get_route_rule_id_from_packet(struct mbuf *packet);
1424extern int necp_get_app_uuid_from_packet(struct mbuf *packet,
1425 uuid_t app_uuid);
1426
1427extern necp_kernel_policy_id necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local_addr,
1428 struct sockaddr *override_remote_addr, u_int32_t override_bound_interface);
1429extern necp_kernel_policy_id necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_args *ipoa,
1430 struct rtentry *rt,
1431 necp_kernel_policy_result *result,
1432 necp_kernel_policy_result_parameter *result_parameter);
1433extern necp_kernel_policy_id necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out_args *ip6oa,
1434 struct rtentry *rt,
1435 necp_kernel_policy_result *result,
1436 necp_kernel_policy_result_parameter *result_parameter);
1437
1438extern int necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id);
1439extern int necp_mark_packet_from_ip_with_skip(struct mbuf *packet, necp_kernel_policy_id policy_id, necp_kernel_policy_id skip_policy_id);
1440extern int necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface);
1441
1442extern ifnet_t necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter);
1443extern bool necp_packet_can_rebind_to_ifnet(struct mbuf *packet, struct ifnet *interface, struct route *new_route, int family);
1444
1445extern bool necp_packet_is_allowed_over_interface(struct mbuf *packet, struct ifnet *interface);
1446
1447extern int necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive);
1448extern bool necp_get_is_keepalive_from_packet(struct mbuf *packet);
1449
1450extern int necp_sign_resolver_answer(uuid_t client_id, u_int32_t sign_type,
1451 u_int8_t *data, size_t data_length,
1452 u_int8_t *tag, size_t *out_tag_length);
1453
1454extern bool necp_validate_resolver_answer(uuid_t client_id, u_int32_t sign_type,
1455 u_int8_t *data, size_t data_length,
1456 u_int8_t *tag, size_t tag_length);
1457
1458extern int necp_sign_application_id(uuid_t client_id, u_int32_t sign_type,
1459 u_int8_t *tag, size_t *out_tag_length);
1460
1461extern bool necp_validate_application_id(uuid_t client_id, u_int32_t sign_type,
1462 u_int8_t *tag, size_t tag_length);
1463
1464extern void necp_update_all_clients(void); // Handle general re-evaluate event
1465extern void necp_update_all_clients_immediately_if_needed(bool should_update_immediately); // Handle general re-evaluate event
1466
1467extern void necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid, u_int32_t agent_generation); // Cause a single client to get an update event
1468
1469extern bool necp_set_client_as_background(proc_t proc, struct fileproc *fp, bool background); // Set all clients for an fp as background or not
1470
1471struct necp_fd_data;
1472extern void necp_fd_memstatus(proc_t proc, uint32_t status, struct necp_fd_data *client_fd); // Purge memory of clients for the process
1473extern void necp_fd_defunct(proc_t proc, struct necp_fd_data *client_fd); // Set all clients for an process as defunct
1474
1475extern void necp_client_request_in_process_flow_divert(pid_t pid);
1476
1477extern int necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp);
1478
1479extern int necp_client_register_socket_listener(pid_t pid, uuid_t client_id, struct inpcb *inp);
1480
1481#if SKYWALK
1482extern int necp_client_get_netns_flow_info(uuid_t client_id, struct ns_flow_info *flow_info);
1483#endif /* SKYWALK */
1484
1485extern int necp_client_assert_bb_radio_manager(uuid_t client_id, bool assert);
1486
1487extern int necp_client_assign_from_socket(pid_t pid, uuid_t client_id, struct inpcb *inp);
1488
1489extern int necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id,
1490 u_int8_t *assigned_results, size_t assigned_results_length);
1491extern int necp_assign_client_group_members(uuid_t netagent_uuid, uuid_t client_id,
1492 u_int8_t *assigned_group_members, size_t assigned_group_members_length);
1493
1494struct skmem_obj_info; // forward declaration
1495extern int necp_stats_ctor(struct skmem_obj_info *oi, struct skmem_obj_info *oim, void *arg, uint32_t skmflag);
1496extern int necp_stats_dtor(void *addr, void *arg);
1497
1498/* value to denote invalid flow advisory index */
1499struct netagent_session;
1500extern int
1501necp_update_flow_protoctl_event(uuid_t netagent_uuid, uuid_t client_id,
1502 uint32_t protoctl_event_code, uint32_t protoctl_event_val,
1503 uint32_t protoctl_event_tcp_seq_num);
1504
1505#define NECP_FLOWADV_IDX_INVALID UINT32_MAX
1506extern void *necp_create_nexus_assign_message(uuid_t nexus_instance, nexus_port_t nexus_port, void *key, uint32_t key_length,
1507 struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint,
1508 struct ether_addr *local_ether_addr,
1509 u_int32_t flow_adv_index, void *flow_stats, size_t *message_length);
1510
1511
1512#define NECP_MAX_DEMUX_PATTERNS 4
1513struct necp_client_nexus_parameters {
1514 pid_t pid;
1515 pid_t epid;
1516 uuid_t euuid;
1517#if SKYWALK
1518 netns_token port_reservation;
1519#else /* !SKYWALK */
1520 void *reserved;
1521#endif /* !SKYWALK */
1522 union necp_sockaddr_union local_addr;
1523 union necp_sockaddr_union remote_addr;
1524 u_int8_t ip_protocol;
1525 u_int8_t transport_protocol;
1526 u_int16_t ethertype;
1527 u_int32_t traffic_class;
1528 necp_policy_id policy_id;
1529 necp_policy_id skip_policy_id;
1530 unsigned is_listener:1;
1531 unsigned is_interpose:1;
1532 unsigned is_custom_ether:1;
1533 unsigned allow_qos_marking:1;
1534 unsigned override_address_selection:1;
1535 unsigned use_stable_address:1; // Used if override_address_selection is set
1536 unsigned no_wake_from_sleep:1;
1537 unsigned is_demuxable_parent:1;
1538 unsigned reuse_port:1;
1539
1540 uuid_t parent_flow_uuid;
1541 struct necp_demux_pattern demux_patterns[NECP_MAX_DEMUX_PATTERNS];
1542 uint8_t demux_pattern_count;
1543};
1544
1545struct necp_client_group_members {
1546 size_t group_members_length;
1547 u_int8_t *group_members;
1548};
1549
1550struct necp_client_error_parameters {
1551 int32_t error;
1552 bool force_report;
1553};
1554
1555struct necp_client_agent_parameters {
1556 union {
1557 struct necp_client_nexus_parameters nexus_request;
1558 u_int8_t close_token[QUIC_STATELESS_RESET_TOKEN_SIZE];
1559 struct necp_client_group_members group_members;
1560 struct necp_client_error_parameters error;
1561 } u;
1562};
1563
1564#define NECP_CLIENT_CBACTION_NONVIABLE 1
1565#define NECP_CLIENT_CBACTION_VIABLE 2
1566#define NECP_CLIENT_CBACTION_INITIAL 3
1567
1568struct necp_client_add_flow_default {
1569 uuid_t agent_uuid;
1570 uuid_t registration_id;
1571 u_int16_t flags; // NECP_CLIENT_FLOW_FLAGS_*
1572 u_int16_t stats_request_count;
1573 struct necp_client_flow_stats stats_requests[1];
1574} __attribute__((__packed__));
1575
1576typedef void (*necp_client_flow_cb)(void *handle, int action, uint32_t interface_index, uint32_t necp_flags, bool *viable);
1577
1578#if SKYWALK
1579struct skmem_arena_mmap_info;
1580
1581extern pid_t necp_client_get_proc_pid_from_arena_info(struct skmem_arena_mmap_info *arena_info);
1582
1583extern void necp_client_early_close(uuid_t client_id); // Cause a single client to close stats, etc
1584
1585#endif /* SKYWALK */
1586
1587#endif /* BSD_KERNEL_PRIVATE */
1588
1589#ifdef KERNEL
1590#ifdef KERNEL_PRIVATE
1591struct nstat_domain_info;
1592extern void necp_copy_inp_domain_info(struct inpcb *, struct socket *, struct nstat_domain_info *);
1593extern void necp_with_inp_domain_name(struct socket *so, void *ctx, void (*with_func)(char *domain_name, void *ctx));
1594extern bool net_domain_contains_hostname(char *hostname_string, char *domain_string);
1595#endif /* KERNEL_PRIVATE */
1596#endif /* KERNEL */
1597
1598#ifndef KERNEL
1599
1600extern int necp_match_policy(const uint8_t *parameters, size_t parameters_size, struct necp_aggregate_result *returned_result);
1601
1602extern int necp_open(int flags);
1603
1604extern int necp_client_action(int necp_fd, uint32_t action, uuid_t client_id,
1605 size_t client_id_len, uint8_t *buffer, size_t buffer_size);
1606
1607extern int necp_session_open(int flags);
1608
1609extern int necp_session_action(int necp_fd, uint32_t action,
1610 uint8_t *in_buffer, size_t in_buffer_length,
1611 uint8_t *out_buffer, size_t out_buffer_length);
1612
1613#endif /* !KERNEL */
1614
1615#endif /* PRIVATE */
1616
1617#endif
1618