1 | /* |
2 | * Copyright (c) 2013-2022 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | #ifndef _NET_NECP_H_ |
30 | #define _NET_NECP_H_ |
31 | |
32 | #include <net/net_kev.h> |
33 | #ifdef PRIVATE |
34 | |
35 | #include <netinet/in.h> |
36 | #include <netinet/in_stat.h> |
37 | #include <sys/socket.h> |
38 | #include <net/if.h> |
39 | |
40 | #if SKYWALK |
41 | #include <skywalk/os_nexus_private.h> |
42 | #else /* !SKYWALK */ |
43 | typedef uint16_t nexus_port_t; |
44 | #endif /* !SKYWALK */ |
45 | |
46 | /* |
47 | * Name registered by the NECP |
48 | */ |
49 | #define NECP_CONTROL_NAME "com.apple.net.necp_control" |
50 | |
51 | #define NECP_TLV_LENGTH_UINT32 1 |
52 | |
53 | struct { |
54 | u_int8_t ; |
55 | u_int8_t ; |
56 | u_int32_t ; |
57 | }; |
58 | |
59 | typedef struct { |
60 | uid_t uid; |
61 | uuid_t effective_uuid; |
62 | uid_t persona_id; |
63 | } necp_application_id_t; |
64 | |
65 | /* |
66 | * Control message commands |
67 | */ |
68 | #define NECP_PACKET_TYPE_POLICY_ADD 1 |
69 | #define NECP_PACKET_TYPE_POLICY_GET 2 |
70 | #define NECP_PACKET_TYPE_POLICY_DELETE 3 |
71 | #define NECP_PACKET_TYPE_POLICY_APPLY_ALL 4 |
72 | #define NECP_PACKET_TYPE_POLICY_LIST_ALL 5 |
73 | #define NECP_PACKET_TYPE_POLICY_DELETE_ALL 6 |
74 | #define NECP_PACKET_TYPE_SET_SESSION_PRIORITY 7 |
75 | #define NECP_PACKET_TYPE_LOCK_SESSION_TO_PROC 8 |
76 | #define NECP_PACKET_TYPE_REGISTER_SERVICE 9 |
77 | #define NECP_PACKET_TYPE_UNREGISTER_SERVICE 10 |
78 | #define NECP_PACKET_TYPE_POLICY_DUMP_ALL 11 |
79 | |
80 | /* |
81 | * Session actions |
82 | */ |
83 | #define NECP_SESSION_ACTION_POLICY_ADD 1 // In: Policy TLVs Out: necp_policy_id |
84 | #define NECP_SESSION_ACTION_POLICY_GET 2 // In: necp_policy_id Out: Policy TLVs |
85 | #define NECP_SESSION_ACTION_POLICY_DELETE 3 // In: necp_policy_id Out: None |
86 | #define NECP_SESSION_ACTION_POLICY_APPLY_ALL 4 // In: None Out: None |
87 | #define NECP_SESSION_ACTION_POLICY_LIST_ALL 5 // In: None Out: TLVs of IDs |
88 | #define NECP_SESSION_ACTION_POLICY_DELETE_ALL 6 // In: None Out: None |
89 | #define NECP_SESSION_ACTION_SET_SESSION_PRIORITY 7 // In: necp_session_priority Out: None |
90 | #define NECP_SESSION_ACTION_LOCK_SESSION_TO_PROC 8 // In: None Out: None |
91 | #define NECP_SESSION_ACTION_REGISTER_SERVICE 9 // In: uuid_t Out: None |
92 | #define NECP_SESSION_ACTION_UNREGISTER_SERVICE 10 // In: uuid_t Out: None |
93 | #define NECP_SESSION_ACTION_POLICY_DUMP_ALL 11 // In: None Out: uint32_t bytes length, then Policy TLVs |
94 | #define NECP_SESSION_ACTION_ADD_DOMAIN_FILTER 12 // In: struct net_bloom_filter Out: uint32_t, ID |
95 | #define NECP_SESSION_ACTION_REMOVE_DOMAIN_FILTER 13 // In: uint32_t, ID Out: None |
96 | #define NECP_SESSION_ACTION_REMOVE_ALL_DOMAIN_FILTERS 14 // In: None Out: None |
97 | |
98 | /* |
99 | * Control message flags |
100 | */ |
101 | #define NECP_PACKET_FLAGS_RESPONSE 0x01 // Used for acks, errors, and query responses |
102 | |
103 | /* |
104 | * Control message TLV types |
105 | */ |
106 | #define NECP_TLV_NIL 0 |
107 | #define NECP_TLV_ERROR 1 // u_int32_t |
108 | #define NECP_TLV_POLICY_ORDER 2 // u_int32_t |
109 | #define NECP_TLV_POLICY_CONDITION 3 |
110 | #define NECP_TLV_POLICY_RESULT 4 |
111 | #define NECP_TLV_POLICY_ID 5 // u_int32_t |
112 | #define NECP_TLV_SESSION_PRIORITY 6 // u_int32_t |
113 | #define NECP_TLV_ATTRIBUTE_DOMAIN 7 // char[] |
114 | #define NECP_TLV_ATTRIBUTE_ACCOUNT 8 // char[] |
115 | #define NECP_TLV_SERVICE_UUID 9 // uuid_t |
116 | #define NECP_TLV_ROUTE_RULE 10 |
117 | #define NECP_TLV_ATTRIBUTE_DOMAIN_OWNER 11 // char[] |
118 | #define NECP_TLV_ATTRIBUTE_TRACKER_DOMAIN 12 // char[] |
119 | #define NECP_TLV_ATTRIBUTE_DOMAIN_CONTEXT 13 // char[] |
120 | |
121 | /* |
122 | * Control message TLV sent only by the kernel to userspace |
123 | */ |
124 | #define NECP_TLV_POLICY_OWNER 100 // char [] |
125 | #define NECP_TLV_POLICY_DUMP 101 |
126 | #define NECP_TLV_POLICY_RESULT_STRING 102 // char [] |
127 | #define NECP_TLV_POLICY_SESSION_ORDER 103 // u_int32_t |
128 | |
129 | /* |
130 | * Condition flags |
131 | */ |
132 | #define NECP_POLICY_CONDITION_FLAGS_NEGATIVE 0x01 // Negative |
133 | #define NECP_POLICY_CONDITION_FLAGS_EXACT 0x02 // For conditions that would otherwise have more inclusive matching, require an exact match |
134 | |
135 | /* |
136 | * Conditions |
137 | * Used for setting policies as well as passing parameters to necp_match_policy. |
138 | */ |
139 | #define NECP_POLICY_CONDITION_DEFAULT 0 // N/A, not valid with any other conditions |
140 | // Socket/Application conditions |
141 | #define NECP_POLICY_CONDITION_APPLICATION 1 // uuid_t, uses effective UUID when possible |
142 | #define NECP_POLICY_CONDITION_REAL_APPLICATION 2 // uuid_t, never uses effective UUID. Only valid with NECP_POLICY_CONDITION_APPLICATION |
143 | #define NECP_POLICY_CONDITION_DOMAIN 3 // String, such as apple.com |
144 | #define NECP_POLICY_CONDITION_ACCOUNT 4 // String |
145 | #define NECP_POLICY_CONDITION_ENTITLEMENT 5 // String |
146 | #define NECP_POLICY_CONDITION_PID 6 // pid_t |
147 | #define NECP_POLICY_CONDITION_UID 7 // uid_t |
148 | #define NECP_POLICY_CONDITION_ALL_INTERFACES 8 // N/A |
149 | #define NECP_POLICY_CONDITION_BOUND_INTERFACE 9 // String |
150 | #define NECP_POLICY_CONDITION_TRAFFIC_CLASS 10 // necp_policy_condition_tc_range |
151 | // Socket/IP conditions |
152 | #define NECP_POLICY_CONDITION_IP_PROTOCOL 11 // u_int16_t |
153 | #define NECP_POLICY_CONDITION_LOCAL_ADDR 12 // necp_policy_condition_addr |
154 | #define NECP_POLICY_CONDITION_REMOTE_ADDR 13 // necp_policy_condition_addr |
155 | #define NECP_POLICY_CONDITION_LOCAL_ADDR_RANGE 14 // necp_policy_condition_addr_range |
156 | #define NECP_POLICY_CONDITION_REMOTE_ADDR_RANGE 15 // necp_policy_condition_addr_range |
157 | #define NECP_POLICY_CONDITION_AGENT_TYPE 16 // struct necp_policy_condition_agent_type |
158 | #define NECP_POLICY_CONDITION_HAS_CLIENT 17 // N/A |
159 | #define NECP_POLICY_CONDITION_LOCAL_NETWORKS 18 // Matches all local networks |
160 | // Socket-only conditions |
161 | #define NECP_POLICY_CONDITION_FLOW_IP_PROTOCOL 19 // u_int16_t |
162 | #define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR 20 // necp_policy_condition_addr |
163 | #define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR 21 // necp_policy_condition_addr |
164 | #define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_RANGE 22 // necp_policy_condition_addr_range |
165 | #define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_RANGE 23 // necp_policy_condition_addr_range |
166 | #define NECP_POLICY_CONDITION_FLOW_IS_LOOPBACK 31 // N/A |
167 | // Socket/Application conditions, continued |
168 | #define NECP_POLICY_CONDITION_CLIENT_FLAGS 24 // u_int32_t, values from NECP_CLIENT_PARAMETER_FLAG_* |
169 | #define NECP_POLICY_CONDITION_FLOW_LOCAL_ADDR_EMPTY 25 // N/A |
170 | #define NECP_POLICY_CONDITION_FLOW_REMOTE_ADDR_EMPTY 26 // N/A |
171 | #define NECP_POLICY_CONDITION_PLATFORM_BINARY 27 // N/A |
172 | #define NECP_POLICY_CONDITION_SDK_VERSION 28 // struct necp_policy_condition_sdk_version |
173 | #define NECP_POLICY_CONDITION_SIGNING_IDENTIFIER 29 // String |
174 | #define NECP_POLICY_CONDITION_PACKET_FILTER_TAGS 30 // u_int16_t |
175 | #define NECP_POLICY_CONDITION_DELEGATE_IS_PLATFORM_BINARY 32 // N/A |
176 | #define NECP_POLICY_CONDITION_DOMAIN_OWNER 33 // String, owner of domain (for example, "Google Inc") |
177 | #define NECP_POLICY_CONDITION_DOMAIN_CONTEXT 34 // String, eTLD+1 leading to networking activities to the domain |
178 | #define NECP_POLICY_CONDITION_TRACKER_DOMAIN 35 // String, tracker domain |
179 | #define NECP_POLICY_CONDITION_ATTRIBUTED_BUNDLE_IDENTIFIER 36 // String, app to which traffic is attributed to |
180 | #define NECP_POLICY_CONDITION_SCHEME_PORT 37 // u_int16_t, the port associated with the scheme for a connection |
181 | #define NECP_POLICY_CONDITION_DOMAIN_FILTER 38 // struct net_bloom_filter |
182 | #define NECP_POLICY_CONDITION_SYSTEM_SIGNED_RESULT 39 // N/A |
183 | #define NECP_POLICY_CONDITION_REAL_UID 40 // uid_t |
184 | #define NECP_POLICY_CONDITION_APPLICATION_ID 41 // necp_application_id_t |
185 | #define NECP_POLICY_CONDITION_URL 42 // String, URL |
186 | #define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS 43 // Interface flags: u_int32_t flags, u_int32_t eflags, u_int32_t xflags |
187 | |
188 | |
189 | /* |
190 | * Policy Condition Bound Interface Flags Order |
191 | */ |
192 | #define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS_IDX_FLAGS 0 |
193 | #define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS_IDX_EFLAGS 1 |
194 | #define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS_IDX_XFLAGS 2 |
195 | #define NECP_POLICY_CONDITION_BOUND_INTERFACE_FLAGS_IDX_MAX 3 |
196 | |
197 | /* |
198 | * Policy Packet tags |
199 | */ |
200 | #define NECP_POLICY_CONDITION_PACKET_FILTER_TAG_STACK_DROP 0x01 |
201 | #define NECP_POLICY_CONDITION_PACKET_FILTER_TAG_MAX NECP_POLICY_CONDITION_PACKET_FILTER_TAG_STACK_DROP |
202 | |
203 | /* |
204 | * Results |
205 | */ |
206 | #define NECP_POLICY_RESULT_PASS 1 // N/A |
207 | #define NECP_POLICY_RESULT_SKIP 2 // u_int32_t, policy order to skip to. 0 to skip all session policies. |
208 | #define NECP_POLICY_RESULT_DROP 3 // N/A |
209 | #define NECP_POLICY_RESULT_SOCKET_DIVERT 4 // u_int32_t, flow divert control unit |
210 | #define NECP_POLICY_RESULT_SOCKET_FILTER 5 // u_int32_t, filter control unit |
211 | #define NECP_POLICY_RESULT_IP_TUNNEL 6 // String, interface name |
212 | #define NECP_POLICY_RESULT_IP_FILTER 7 // ? |
213 | #define NECP_POLICY_RESULT_TRIGGER 8 // Deprecated |
214 | #define NECP_POLICY_RESULT_TRIGGER_IF_NEEDED 9 // Deprecated |
215 | #define NECP_POLICY_RESULT_TRIGGER_SCOPED 10 // Deprecated |
216 | #define NECP_POLICY_RESULT_NO_TRIGGER_SCOPED 11 // Deprecated |
217 | #define NECP_POLICY_RESULT_SOCKET_SCOPED 12 // String, interface name |
218 | #define NECP_POLICY_RESULT_ROUTE_RULES 13 // N/A, must have route rules defined |
219 | #define NECP_POLICY_RESULT_USE_NETAGENT 14 // netagent uuid_t |
220 | #define NECP_POLICY_RESULT_NETAGENT_SCOPED 15 // netagent uuid_t |
221 | #define NECP_POLICY_RESULT_SCOPED_DIRECT 16 // N/A, scopes to primary physical interface |
222 | #define NECP_POLICY_RESULT_ALLOW_UNENTITLED 17 // N/A |
223 | #define NECP_POLICY_RESULT_REMOVE_NETAGENT 18 // netagent uuid_t |
224 | |
225 | #define NECP_POLICY_RESULT_MAX NECP_POLICY_RESULT_REMOVE_NETAGENT |
226 | |
227 | /* |
228 | * PASS Result Flags |
229 | */ |
230 | #define NECP_POLICY_PASS_NO_SKIP_IPSEC 0x01 |
231 | #define NECP_POLICY_PASS_PF_TAG 0x02 |
232 | |
233 | /* |
234 | * DROP Result Flags |
235 | */ |
236 | #define NECP_POLICY_DROP_FLAG_LOCAL_NETWORK 0x01 |
237 | #define NECP_POLICY_DROP_FLAG_SUPPRESS_ALERTS 0x02 |
238 | |
239 | /* |
240 | * Route Rules |
241 | * Detailed parameters for NECP_POLICY_RESULT_ROUTE_RULES. |
242 | */ |
243 | #define NECP_ROUTE_RULE_NONE 0 // N/A |
244 | #define NECP_ROUTE_RULE_DENY_INTERFACE 1 // String, or empty to match all |
245 | #define NECP_ROUTE_RULE_ALLOW_INTERFACE 2 // String, or empty to match all |
246 | #define NECP_ROUTE_RULE_QOS_MARKING 3 // String, or empty to match all |
247 | #define NECP_ROUTE_RULE_DENY_LQM_ABORT 4 // String, or empty to match all |
248 | #define NECP_ROUTE_RULE_USE_NETAGENT 5 // UUID, followed by string or empty |
249 | #define NECP_ROUTE_RULE_REMOVE_NETAGENT 6 // UUID, followed by string or empty |
250 | #define NECP_ROUTE_RULE_DIVERT_SOCKET 7 // u_int32_t control unit, followed by string or empty |
251 | #define NECP_ROUTE_RULE_DENY_INTERFACE_WITH_TYPE 8 // u_int32_t effective type, followed by string or empty |
252 | |
253 | #define NECP_ROUTE_RULE_FLAG_CELLULAR 0x01 |
254 | #define NECP_ROUTE_RULE_FLAG_WIFI 0x02 |
255 | #define NECP_ROUTE_RULE_FLAG_WIRED 0x04 |
256 | #define NECP_ROUTE_RULE_FLAG_EXPENSIVE 0x08 |
257 | #define NECP_ROUTE_RULE_FLAG_CONSTRAINED 0x10 |
258 | #define NECP_ROUTE_RULE_FLAG_COMPANION 0x20 |
259 | |
260 | #define NECP_ROUTE_RULE_FLAG_NETAGENT 0x80 // Last bit, reserved to mark that this applies only when an agent UUID is present |
261 | |
262 | #define NECP_ROUTE_RULES_SUPPORT_NETAGENT_EXCEPTIONS 1 |
263 | |
264 | /* |
265 | * Error types |
266 | */ |
267 | #define NECP_ERROR_INTERNAL 0 |
268 | #define NECP_ERROR_UNKNOWN_PACKET_TYPE 1 |
269 | #define NECP_ERROR_INVALID_TLV 2 |
270 | #define NECP_ERROR_POLICY_RESULT_INVALID 3 |
271 | #define NECP_ERROR_POLICY_CONDITIONS_INVALID 4 |
272 | #define NECP_ERROR_POLICY_ID_NOT_FOUND 5 |
273 | #define NECP_ERROR_INVALID_PROCESS 6 |
274 | #define NECP_ERROR_ROUTE_RULES_INVALID 7 |
275 | |
276 | // Modifiers |
277 | #define NECP_MASK_USERSPACE_ONLY 0x80000000 // on filter_control_unit value |
278 | #define NECP_MASK_PRESERVE_CONNECTIONS 0x20000000 // on filter_control_unit value |
279 | |
280 | struct necp_policy_condition_tc_range { |
281 | u_int32_t start_tc; |
282 | u_int32_t end_tc; |
283 | } __attribute__((__packed__)); |
284 | |
285 | struct necp_policy_condition_addr { |
286 | u_int8_t prefix; |
287 | union { |
288 | #if !__has_ptrcheck |
289 | struct sockaddr sa; |
290 | #endif |
291 | struct __sockaddr_header sah; |
292 | struct sockaddr_in sin; |
293 | struct sockaddr_in6 sin6; |
294 | } address __attribute__((__packed__)); |
295 | } __attribute__((__packed__)); |
296 | |
297 | struct necp_policy_condition_addr_range { |
298 | union { |
299 | #if !__has_ptrcheck |
300 | struct sockaddr sa; |
301 | #endif |
302 | struct __sockaddr_header sah; |
303 | struct sockaddr_in sin; |
304 | struct sockaddr_in6 sin6; |
305 | } start_address __attribute__((__packed__)); |
306 | union { |
307 | #if !__has_ptrcheck |
308 | struct sockaddr sa; |
309 | #endif |
310 | struct __sockaddr_header sah; |
311 | struct sockaddr_in sin; |
312 | struct sockaddr_in6 sin6; |
313 | } end_address __attribute__((__packed__)); |
314 | } __attribute__((__packed__)); |
315 | |
316 | struct necp_policy_condition_agent_type { |
317 | char agent_domain[32]; |
318 | char agent_type[32]; |
319 | } __attribute__((__packed__)); |
320 | |
321 | struct necp_policy_condition_sdk_version { |
322 | uint32_t platform; // e.g., PLATFORM_IOS |
323 | uint32_t min_version; // Encoded as XXXX.YY.ZZ |
324 | uint32_t version; // Encoded as XXXX.YY.ZZ |
325 | } __attribute__((__packed__)); |
326 | |
327 | #define NECP_SESSION_PRIORITY_UNKNOWN 0 |
328 | #define NECP_SESSION_PRIORITY_CONTROL 1 |
329 | #define NECP_SESSION_PRIORITY_CONTROL_1 2 |
330 | #define NECP_SESSION_PRIORITY_PRIVILEGED_TUNNEL 3 |
331 | #define NECP_SESSION_PRIORITY_HIGH 4 |
332 | #define NECP_SESSION_PRIORITY_HIGH_1 5 |
333 | #define NECP_SESSION_PRIORITY_HIGH_2 6 |
334 | #define NECP_SESSION_PRIORITY_HIGH_3 7 |
335 | #define NECP_SESSION_PRIORITY_HIGH_4 8 |
336 | #define NECP_SESSION_PRIORITY_HIGH_RESTRICTED 9 |
337 | #define NECP_SESSION_PRIORITY_DEFAULT 10 |
338 | #define NECP_SESSION_PRIORITY_LOW 11 |
339 | #define NECP_SESSION_NUM_PRIORITIES NECP_SESSION_PRIORITY_LOW |
340 | |
341 | typedef u_int32_t necp_policy_id; |
342 | typedef u_int32_t necp_policy_order; |
343 | typedef u_int32_t necp_session_priority; |
344 | |
345 | typedef u_int32_t necp_kernel_policy_result; |
346 | typedef u_int32_t necp_kernel_policy_filter; |
347 | |
348 | typedef union { |
349 | u_int tunnel_interface_index; |
350 | u_int scoped_interface_index; |
351 | u_int32_t flow_divert_control_unit; |
352 | u_int32_t filter_control_unit; |
353 | u_int32_t pass_flags; |
354 | u_int32_t drop_flags; |
355 | } necp_kernel_policy_routing_result_parameter; |
356 | |
357 | #define NECP_SERVICE_FLAGS_REGISTERED 0x01 |
358 | #define NECP_MAX_NETAGENTS 16 |
359 | |
360 | #define NECP_AGENT_USE_FLAG_SCOPE 0x01 |
361 | #define NECP_AGENT_USE_FLAG_REMOVE 0x02 |
362 | |
363 | #define NECP_TFO_COOKIE_LEN_MAX 16 |
364 | struct necp_aggregate_result { |
365 | necp_kernel_policy_result routing_result; |
366 | necp_kernel_policy_routing_result_parameter routing_result_parameter; |
367 | necp_kernel_policy_filter filter_control_unit; |
368 | u_int32_t flow_divert_aggregate_unit; |
369 | necp_kernel_policy_result service_action; |
370 | uuid_t service_uuid; |
371 | u_int32_t service_flags; |
372 | u_int32_t service_data; |
373 | u_int routed_interface_index; |
374 | u_int32_t policy_id; |
375 | u_int32_t skip_policy_id; |
376 | uuid_t netagents[NECP_MAX_NETAGENTS]; |
377 | u_int32_t netagent_use_flags[NECP_MAX_NETAGENTS]; |
378 | struct ipv6_prefix nat64_prefixes[NAT64_MAX_NUM_PREFIXES]; |
379 | u_int8_t mss_recommended; |
380 | }; |
381 | |
382 | /* |
383 | * Statistics. It would be nice if the definitions in ntstat.h could be used, |
384 | * but they get entangled with #defines for v4 etc in pfvar.h and it may be better practice |
385 | * to have separate definitions here. |
386 | */ |
387 | struct necp_stat_counts { |
388 | /* Counters */ |
389 | u_int64_t necp_stat_rxpackets __attribute__((aligned(8))); |
390 | u_int64_t necp_stat_rxbytes __attribute__((aligned(8))); |
391 | u_int64_t necp_stat_txpackets __attribute__((aligned(8))); |
392 | u_int64_t necp_stat_txbytes __attribute__((aligned(8))); |
393 | |
394 | u_int32_t necp_stat_rxduplicatebytes; |
395 | u_int32_t necp_stat_rxoutoforderbytes; |
396 | u_int32_t necp_stat_txretransmit; |
397 | |
398 | u_int32_t necp_stat_connectattempts; |
399 | u_int32_t necp_stat_connectsuccesses; |
400 | |
401 | u_int32_t necp_stat_min_rtt; |
402 | u_int32_t necp_stat_avg_rtt; |
403 | u_int32_t necp_stat_var_rtt; |
404 | |
405 | #define NECP_STAT_ROUTE_FLAGS 1 |
406 | u_int32_t necp_stat_route_flags; |
407 | }; |
408 | |
409 | // Note, some metadata is implicit in the necp client itself: |
410 | // From the process itself : pid, upid, uuid, proc name. |
411 | // From the necp client parameters: local and remote addresses, euuid, traffic class, ifindex |
412 | // |
413 | // The following may well be supplied via future necp client parameters, |
414 | // but they are here so they don't get forgotten. |
415 | struct necp_basic_metadata { |
416 | u_int32_t rcvbufsize; |
417 | u_int32_t rcvbufused; |
418 | }; |
419 | |
420 | struct necp_connection_probe_status { |
421 | unsigned int probe_activated : 1; |
422 | unsigned int write_probe_failed : 1; |
423 | unsigned int read_probe_failed : 1; |
424 | unsigned int conn_probe_failed : 1; |
425 | }; |
426 | |
427 | struct { |
428 | struct necp_connection_probe_status ; |
429 | |
430 | u_int32_t ; |
431 | u_int32_t ; |
432 | u_int32_t ; |
433 | u_int32_t ; |
434 | u_int32_t ; |
435 | u_int32_t ; // use SOF_* |
436 | u_int32_t ; // use SOF1_* |
437 | u_int32_t ; |
438 | u_int32_t ; |
439 | u_int32_t ; |
440 | }; |
441 | |
442 | struct necp_stats_hdr { |
443 | u_int32_t necp_stats_type __attribute__((aligned(8))); |
444 | u_int32_t necp_stats_ver; |
445 | u_int64_t __necp_stats_reserved; // Pad the field for future use |
446 | }; |
447 | |
448 | #define NECP_CLIENT_STATISTICS_TYPE_TCP 1 // Identifies use of necp_tcp_stats |
449 | #define NECP_CLIENT_STATISTICS_TYPE_UDP 2 // Identifies use of necp_udp_stats |
450 | #define NECP_CLIENT_STATISTICS_TYPE_QUIC 3 // Identifies use of necp_quic_stats |
451 | |
452 | #define NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1 1 // Currently supported version for TCP |
453 | #define NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1 1 // Currently supported version for UDP |
454 | #define NECP_CLIENT_STATISTICS_TYPE_QUIC_VER_1 1 // Currently supported version for QUIC |
455 | |
456 | #define NECP_CLIENT_STATISTICS_TYPE_TCP_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_TCP_VER_1 |
457 | #define NECP_CLIENT_STATISTICS_TYPE_UDP_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_UDP_VER_1 |
458 | #define NECP_CLIENT_STATISTICS_TYPE_QUIC_CURRENT_VER NECP_CLIENT_STATISTICS_TYPE_QUIC_VER_1 |
459 | |
460 | #define NECP_CLIENT_STATISTICS_EVENT_INIT 0x00000000 // Register the flow |
461 | #define NECP_CLIENT_STATISTICS_EVENT_TIME_WAIT 0x00000001 // The flow is effectively finished but waiting on timer |
462 | |
463 | struct necp_tcp_stats { |
464 | struct necp_stats_hdr necp_tcp_hdr; |
465 | struct necp_stat_counts necp_tcp_counts; |
466 | struct necp_basic_metadata necp_tcp_basic; |
467 | struct necp_extra_tcp_metadata ; |
468 | }; |
469 | |
470 | struct necp_udp_stats { |
471 | struct necp_stats_hdr necp_udp_hdr; |
472 | struct necp_stat_counts necp_udp_counts; |
473 | struct necp_basic_metadata necp_udp_basic; |
474 | }; |
475 | |
476 | |
477 | /* |
478 | * The following reflects the special case for QUIC. |
479 | * It is a streaming protocol built on top of UDP. |
480 | * Therefore QUIC stats are defined as basic UDP stats |
481 | * with some extra meta data. |
482 | * TODO: For now the extra metadata is an exact replica |
483 | * of the metadata for TCP. However keeping that separate allows |
484 | * the structures to diverge later as new stats are added. |
485 | */ |
486 | #define QUIC_STATELESS_RESET_TOKEN_SIZE 16 |
487 | #define NECP_QUIC_HAS_PROBE_STATUS 1 |
488 | struct { |
489 | u_int32_t ; |
490 | u_int32_t ; |
491 | u_int32_t ; |
492 | u_int32_t ; |
493 | u_int32_t ; |
494 | u_int32_t ; |
495 | u_int32_t ; |
496 | u_int32_t ; |
497 | u_int8_t [QUIC_STATELESS_RESET_TOKEN_SIZE]; |
498 | struct necp_connection_probe_status ; |
499 | }; |
500 | |
501 | #define necp_quic_hdr necp_quic_udp_stats.necp_udp_hdr |
502 | #define necp_quic_counts necp_quic_udp_stats.necp_udp_counts |
503 | #define necp_quic_basic necp_quic_udp_stats.necp_udp_basic |
504 | struct necp_quic_stats { |
505 | struct necp_udp_stats necp_quic_udp_stats; |
506 | struct necp_extra_quic_metadata ; |
507 | }; |
508 | |
509 | typedef struct necp_all_stats { |
510 | union { |
511 | struct necp_tcp_stats tcp_stats; |
512 | struct necp_udp_stats udp_stats; |
513 | struct necp_quic_stats quic_stats; |
514 | } all_stats_u; |
515 | } necp_all_stats; |
516 | |
517 | // Memory for statistics is requested via a necp_stats_bufreq |
518 | // |
519 | struct necp_stats_bufreq { |
520 | u_int32_t necp_stats_bufreq_id __attribute__((aligned(8))); |
521 | u_int32_t necp_stats_bufreq_type; // NECP_CLIENT_STATISTICS_TYPE_* |
522 | u_int32_t necp_stats_bufreq_ver; // NECP_CLIENT_STATISTICS_TYPE_*_VER |
523 | u_int32_t necp_stats_bufreq_size; |
524 | union { |
525 | void *necp_stats_bufreq_addr; |
526 | mach_vm_address_t necp_stats_bufreq_uaddr; |
527 | }; |
528 | }; |
529 | |
530 | #define NECP_CLIENT_STATISTICS_BUFREQ_ID 0xbf // Distinguishes from statistics actions taking a necp_all_stats struct |
531 | |
532 | // There is a limit to the number of statistics structures that may be allocated per process, subject to change |
533 | // |
534 | #define NECP_MAX_PER_PROCESS_CLIENT_STATISTICS_STRUCTS 512 |
535 | |
536 | #define NECP_TCP_ECN_HEURISTICS_SYN_RST 1 |
537 | typedef struct necp_tcp_ecn_cache { |
538 | u_int8_t necp_tcp_ecn_heuristics_success:1; |
539 | u_int8_t necp_tcp_ecn_heuristics_loss:1; |
540 | u_int8_t necp_tcp_ecn_heuristics_drop_rst:1; |
541 | u_int8_t necp_tcp_ecn_heuristics_drop_rxmt:1; |
542 | u_int8_t necp_tcp_ecn_heuristics_aggressive:1; |
543 | u_int8_t necp_tcp_ecn_heuristics_syn_rst:1; |
544 | } necp_tcp_ecn_cache; |
545 | |
546 | #define NECP_TCP_TFO_HEURISTICS_RST 1 |
547 | typedef struct necp_tcp_tfo_cache { |
548 | u_int8_t necp_tcp_tfo_cookie[NECP_TFO_COOKIE_LEN_MAX]; |
549 | u_int8_t necp_tcp_tfo_cookie_len; |
550 | u_int8_t necp_tcp_tfo_heuristics_success:1; // TFO succeeded with data in the SYN |
551 | u_int8_t necp_tcp_tfo_heuristics_loss:1; // TFO SYN-loss with data |
552 | u_int8_t necp_tcp_tfo_heuristics_middlebox:1; // TFO middlebox detected |
553 | u_int8_t necp_tcp_tfo_heuristics_success_req:1; // TFO succeeded with the TFO-option in the SYN |
554 | u_int8_t necp_tcp_tfo_heuristics_loss_req:1; // TFO SYN-loss with the TFO-option |
555 | u_int8_t necp_tcp_tfo_heuristics_rst_data:1; // Recevied RST upon SYN with data in the SYN |
556 | u_int8_t necp_tcp_tfo_heuristics_rst_req:1; // Received RST upon SYN with the TFO-option |
557 | } necp_tcp_tfo_cache; |
558 | |
559 | #define NECP_CLIENT_CACHE_TYPE_ECN 1 // Identifies use of necp_tcp_ecn_cache |
560 | #define NECP_CLIENT_CACHE_TYPE_TFO 2 // Identifies use of necp_tcp_tfo_cache |
561 | |
562 | #define NECP_CLIENT_CACHE_TYPE_ECN_VER_1 1 // Currently supported version for ECN |
563 | #define NECP_CLIENT_CACHE_TYPE_TFO_VER_1 1 // Currently supported version for TFO |
564 | |
565 | typedef struct necp_cache_buffer { |
566 | u_int8_t necp_cache_buf_type; // NECP_CLIENT_CACHE_TYPE_* |
567 | u_int8_t necp_cache_buf_ver; // NECP_CLIENT_CACHE_TYPE_*_VER |
568 | u_int32_t necp_cache_buf_size; |
569 | mach_vm_address_t necp_cache_buf_addr; |
570 | } necp_cache_buffer; |
571 | |
572 | /* |
573 | * NECP Client definitions |
574 | */ |
575 | #define NECP_MAX_CLIENT_PARAMETERS_SIZE 1024 |
576 | #define NECP_MAX_CLIENT_RESULT_SIZE 512 // Legacy |
577 | #define NECP_BASE_CLIENT_RESULT_SIZE 1024 |
578 | #define NECP_CLIENT_FLOW_RESULT_SIZE 512 |
579 | |
580 | #define NECP_OPEN_FLAG_OBSERVER 0x01 // Observers can query clients they don't own |
581 | #define NECP_OPEN_FLAG_BACKGROUND 0x02 // Mark this fd as backgrounded |
582 | #define NECP_OPEN_FLAG_PUSH_OBSERVER 0x04 // When used with the OBSERVER flag, allows updates to be pushed. Adding clients is not allowed in this mode. |
583 | |
584 | #define NECP_FD_SUPPORTS_GUARD 1 |
585 | |
586 | #define NECP_CLIENT_ACTION_ADD 1 // Register a new client. Input: parameters in buffer; Output: client_id |
587 | #define NECP_CLIENT_ACTION_REMOVE 2 // Unregister a client. Input: client_id, optional struct ifnet_stats_per_flow |
588 | #define NECP_CLIENT_ACTION_COPY_PARAMETERS 3 // Copy client parameters. Input: client_id; Output: parameters in buffer |
589 | #define NECP_CLIENT_ACTION_COPY_RESULT 4 // Copy client result. Input: client_id; Output: result in buffer |
590 | #define NECP_CLIENT_ACTION_COPY_LIST 5 // Copy all client IDs. Output: struct necp_client_list in buffer |
591 | #define NECP_CLIENT_ACTION_REQUEST_NEXUS_INSTANCE 6 // Request a nexus instance from a nexus provider, optional struct necp_stats_bufreq |
592 | #define NECP_CLIENT_ACTION_AGENT 7 // Interact with agent. Input: client_id, agent parameters |
593 | #define NECP_CLIENT_ACTION_COPY_AGENT 8 // Copy agent content. Input: agent UUID; Output: struct netagent |
594 | #define NECP_CLIENT_ACTION_COPY_INTERFACE 9 // Copy interface details. Input: ifindex cast to UUID; Output: struct necp_interface_details |
595 | #define NECP_CLIENT_ACTION_SET_STATISTICS 10 // Deprecated |
596 | #define NECP_CLIENT_ACTION_COPY_ROUTE_STATISTICS 11 // Get route statistics. Input: client_id; Output: struct necp_stat_counts |
597 | #define NECP_CLIENT_ACTION_AGENT_USE 12 // Return the use count and increment the use count. Input/Output: struct necp_agent_use_parameters |
598 | #define NECP_CLIENT_ACTION_MAP_SYSCTLS 13 // Get the read-only sysctls memory location. Output: mach_vm_address_t |
599 | #define NECP_CLIENT_ACTION_UPDATE_CACHE 14 // Update heuristics and cache |
600 | #define NECP_CLIENT_ACTION_COPY_CLIENT_UPDATE 15 // Fetch an updated client for push-mode observer. Output: Client id, struct necp_client_observer_update in buffer |
601 | #define NECP_CLIENT_ACTION_COPY_UPDATED_RESULT 16 // Copy client result only if changed. Input: client_id; Output: result in buffer |
602 | #define NECP_CLIENT_ACTION_ADD_FLOW 17 // Add a flow. Input: client_id; Output: struct necp_client_add_flow |
603 | #define NECP_CLIENT_ACTION_REMOVE_FLOW 18 // Remove a flow. Input: flow_id, optional struct ifnet_stats_per_flow |
604 | #define NECP_CLIENT_ACTION_CLAIM 19 // Claim a client that has been added for this unique PID. Input: client_id |
605 | #define NECP_CLIENT_ACTION_SIGN 20 // Sign a query answer. Input: struct necp_client_signable; Output: struct necp_client_signature |
606 | #define NECP_CLIENT_ACTION_GET_INTERFACE_ADDRESS 21 // Get the best interface local address for given remote address. Input: ifindex, remote sockaddr; Output: matching local sockaddr |
607 | #define NECP_CLIENT_ACTION_ACQUIRE_AGENT_TOKEN 22 // Get a one-time use token from an agent. Input: agent UUID; Output: token buffer |
608 | #define NECP_CLIENT_ACTION_VALIDATE 23 // Validate a query answer. Input: struct necp_client_validatable; Output: None |
609 | #define NECP_CLIENT_ACTION_GET_SIGNED_CLIENT_ID 24 // Get a client ID for the appliction along with a signature. |
610 | #define NECP_CLIENT_ACTION_SET_SIGNED_CLIENT_ID 25 // Set a client ID for the appliction along with a signature. |
611 | |
612 | #define NECP_CLIENT_PARAMETER_APPLICATION NECP_POLICY_CONDITION_APPLICATION // Requires entitlement |
613 | #define NECP_CLIENT_PARAMETER_REAL_APPLICATION NECP_POLICY_CONDITION_REAL_APPLICATION // Requires entitlement |
614 | #define NECP_CLIENT_PARAMETER_DOMAIN NECP_POLICY_CONDITION_DOMAIN |
615 | #define NECP_CLIENT_PARAMETER_DOMAIN_OWNER NECP_POLICY_CONDITION_DOMAIN_OWNER |
616 | #define NECP_CLIENT_PARAMETER_DOMAIN_CONTEXT NECP_POLICY_CONDITION_DOMAIN_CONTEXT |
617 | #define NECP_CLIENT_PARAMETER_TRACKER_DOMAIN NECP_POLICY_CONDITION_TRACKER_DOMAIN |
618 | #define NECP_CLIENT_PARAMETER_URL NECP_POLICY_CONDITION_URL |
619 | #define NECP_CLIENT_PARAMETER_ATTRIBUTED_BUNDLE_IDENTIFIER NECP_POLICY_CONDITION_ATTRIBUTED_BUNDLE_IDENTIFIER |
620 | #define NECP_CLIENT_PARAMETER_ACCOUNT NECP_POLICY_CONDITION_ACCOUNT |
621 | #define NECP_CLIENT_PARAMETER_PID NECP_POLICY_CONDITION_PID // Requires entitlement |
622 | #define NECP_CLIENT_PARAMETER_UID NECP_POLICY_CONDITION_UID // Requires entitlement |
623 | #define NECP_CLIENT_PARAMETER_BOUND_INTERFACE NECP_POLICY_CONDITION_BOUND_INTERFACE |
624 | #define NECP_CLIENT_PARAMETER_TRAFFIC_CLASS NECP_POLICY_CONDITION_TRAFFIC_CLASS |
625 | #define NECP_CLIENT_PARAMETER_IP_PROTOCOL NECP_POLICY_CONDITION_IP_PROTOCOL |
626 | #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS NECP_POLICY_CONDITION_LOCAL_ADDR |
627 | #define NECP_CLIENT_PARAMETER_REMOTE_ADDRESS NECP_POLICY_CONDITION_REMOTE_ADDR |
628 | #define NECP_CLIENT_PARAMETER_SCHEME_PORT NECP_POLICY_CONDITION_SCHEME_PORT |
629 | #define NECP_CLIENT_PARAMETER_APPLICATION_ID NECP_POLICY_CONDITION_APPLICATION_ID |
630 | #define NECP_CLIENT_PARAMETER_NEXUS_KEY 102 |
631 | |
632 | // "Prohibit" will never choose an interface with that property |
633 | #define NECP_CLIENT_PARAMETER_PROHIBIT_INTERFACE 100 // String, interface name |
634 | #define NECP_CLIENT_PARAMETER_PROHIBIT_IF_TYPE 101 // u_int8_t, see ifru_functional_type in <net/if.h> |
635 | #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT 102 // uuid_t, network agent UUID |
636 | #define NECP_CLIENT_PARAMETER_PROHIBIT_AGENT_TYPE 103 // struct necp_client_parameter_netagent_type |
637 | |
638 | // "Require" will choose an interface with that property, or none if not found |
639 | #define NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE 111 // u_int8_t, see ifru_functional_type in <net/if.h> |
640 | #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT 112 // uuid_t, network agent UUID |
641 | #define NECP_CLIENT_PARAMETER_REQUIRE_AGENT_TYPE 113 // struct necp_client_parameter_netagent_type |
642 | |
643 | // "Prefer" will choose an interface with an agent, or best otherwise if not found |
644 | #define NECP_CLIENT_PARAMETER_PREFER_AGENT 122 // uuid_t, network agent UUID |
645 | #define NECP_CLIENT_PARAMETER_PREFER_AGENT_TYPE 123 // struct necp_client_parameter_netagent_type |
646 | |
647 | // "Avoid" will choose an interface without an agent, or best otherwise if unavoidable |
648 | #define NECP_CLIENT_PARAMETER_AVOID_AGENT 124 // uuid_t, network agent UUID |
649 | #define NECP_CLIENT_PARAMETER_AVOID_AGENT_TYPE 125 // struct necp_client_parameter_netagent_type |
650 | |
651 | // Use actions with NECP_CLIENT_ACTION_AGENT |
652 | #define NECP_CLIENT_PARAMETER_TRIGGER_AGENT 130 // uuid_t, network agent UUID |
653 | #define NECP_CLIENT_PARAMETER_ASSERT_AGENT 131 // uuid_t, network agent UUID |
654 | #define NECP_CLIENT_PARAMETER_UNASSERT_AGENT 132 // uuid_t, network agent UUID |
655 | #define NECP_CLIENT_PARAMETER_AGENT_ADD_GROUP_MEMBERS 133 // struct necp_client_group_action |
656 | #define NECP_CLIENT_PARAMETER_AGENT_REMOVE_GROUP_MEMBERS 134 // struct necp_client_group_action |
657 | #define NECP_CLIENT_PARAMETER_REPORT_AGENT_ERROR 135 // int32_t |
658 | |
659 | #define NECP_CLIENT_PARAMETER_FALLBACK_MODE 140 // u_int8_t, see SO_FALLBACK_MODE_* values |
660 | |
661 | #define NECP_CLIENT_PARAMETER_PARENT_ID 150 // uuid_t, client UUID |
662 | |
663 | #define NECP_CLIENT_PARAMETER_LOCAL_ENDPOINT 200 // struct necp_client_endpoint |
664 | #define NECP_CLIENT_PARAMETER_REMOTE_ENDPOINT 201 // struct necp_client_endpoint |
665 | #define NECP_CLIENT_PARAMETER_BROWSE_DESCRIPTOR 202 // struct necp_client_endpoint |
666 | #define NECP_CLIENT_PARAMETER_RESOLVER_TAG 203 // struct necp_client_validatable |
667 | #define NECP_CLIENT_PARAMETER_ADVERTISE_DESCRIPTOR 204 // struct necp_client_endpoint |
668 | #define NECP_CLIENT_PARAMETER_GROUP_DESCRIPTOR 205 // struct necp_client_group |
669 | |
670 | #define NECP_CLIENT_PARAMETER_DELEGATED_UPID 210 // u_int64_t, requires entitlement |
671 | |
672 | #define NECP_CLIENT_PARAMETER_ETHERTYPE 220 // u_int16_t, ethertype |
673 | #define NECP_CLIENT_PARAMETER_TRANSPORT_PROTOCOL 221 // u_int8_t, IPPROTO_ |
674 | |
675 | #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE 230 // u_int8_t, NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_ |
676 | |
677 | #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_DEFAULT 0 |
678 | #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_TEMPORARY 1 |
679 | #define NECP_CLIENT_PARAMETER_LOCAL_ADDRESS_PREFERENCE_STABLE 2 |
680 | |
681 | #define NECP_CLIENT_PARAMETER_FLAGS 250 // u_int32_t, see NECP_CLIENT_PAREMETER_FLAG_* values |
682 | #define NECP_CLIENT_PARAMETER_FLOW_DEMUX_PATTERN 251 // struct necp_demux_pattern |
683 | |
684 | #define NECP_CLIENT_PARAMETER_FLAG_MULTIPATH 0x0001 // Get multipath interface results |
685 | #define NECP_CLIENT_PARAMETER_FLAG_BROWSE 0x0002 // Agent assertions on nexuses are requests to browse |
686 | #define NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_EXPENSIVE 0x0004 // Prohibit expensive interfaces |
687 | #define NECP_CLIENT_PARAMETER_FLAG_LISTENER 0x0008 // Client is interested in listening for inbound connections |
688 | #define NECP_CLIENT_PARAMETER_FLAG_DISCRETIONARY 0x0010 // Client's traffic is discretionary, and eligible for early defuncting |
689 | #define NECP_CLIENT_PARAMETER_FLAG_ECN_ENABLE 0x0020 // Client is requesting to enable ECN |
690 | #define NECP_CLIENT_PARAMETER_FLAG_ECN_DISABLE 0x0040 // Client is requesting to disable ECN |
691 | #define NECP_CLIENT_PARAMETER_FLAG_TFO_ENABLE 0x0080 // Client is requesting to enable TFO |
692 | #define NECP_CLIENT_PARAMETER_FLAG_ONLY_PRIMARY_REQUIRES_TYPE 0x0100 // Interpret NECP_CLIENT_PARAMETER_REQUIRE_IF_TYPE only for primary interface, and allow exceptions for multipath or listeners |
693 | #define NECP_CLIENT_PARAMETER_FLAG_CUSTOM_ETHER 0x0200 // Client expects to open a custom ethernet channel |
694 | #define NECP_CLIENT_PARAMETER_FLAG_CUSTOM_IP 0x0400 // Client expects to open a custom IP protocol channel |
695 | #define NECP_CLIENT_PARAMETER_FLAG_INTERPOSE 0x0800 // Client expects to open an interpose filter channel |
696 | #define NECP_CLIENT_PARAMETER_FLAG_PROHIBIT_CONSTRAINED 0x1000 // Prohibit constrained interfaces |
697 | #define NECP_CLIENT_PARAMETER_FLAG_FALLBACK_TRAFFIC 0x2000 // Fallback traffic |
698 | #define NECP_CLIENT_PARAMETER_FLAG_INBOUND 0x4000 // Flow is inbound (passive) |
699 | #define NECP_CLIENT_PARAMETER_FLAG_SYSTEM_PROXY 0x8000 // Flow is a system proxy |
700 | #define NECP_CLIENT_PARAMETER_FLAG_KNOWN_TRACKER 0x10000 // Flow is contacting a known tracker |
701 | #define NECP_CLIENT_PARAMETER_FLAG_UNSAFE_SOCKET_ACCESS 0x20000 // Client allows direct access to sockets |
702 | #define NECP_CLIENT_PARAMETER_FLAG_NON_APP_INITIATED 0x40000 // Networking activities not initiated by application |
703 | #define NECP_CLIENT_PARAMETER_FLAG_THIRD_PARTY_WEB_CONTENT 0x80000 // Third-party web content, not main load |
704 | #define NECP_CLIENT_PARAMETER_FLAG_SILENT 0x100000 // Private browsing - do not log/track |
705 | #define NECP_CLIENT_PARAMETER_FLAG_APPROVED_APP_DOMAIN 0x200000 // Approved associated app domain; domain is "owned" by app |
706 | #define NECP_CLIENT_PARAMETER_FLAG_NO_WAKE_FROM_SLEEP 0x400000 // Don't wake from sleep on traffic for this client |
707 | #define NECP_CLIENT_PARAMETER_FLAG_REUSE_LOCAL 0x800000 // Request support for local address/port reuse |
708 | #define NECP_CLIENT_PARAMETER_FLAG_ENHANCED_PRIVACY 0x1000000 // Attempt protocol upgrade or proxy usage for more privacy |
709 | #define NECP_CLIENT_PARAMETER_FLAG_WEB_SEARCH_CONTENT 0x2000000 // Web search traffic |
710 | |
711 | #define NECP_CLIENT_RESULT_CLIENT_ID 1 // uuid_t |
712 | #define NECP_CLIENT_RESULT_POLICY_RESULT 2 // u_int32_t |
713 | #define NECP_CLIENT_RESULT_POLICY_RESULT_PARAMETER 3 // u_int32_t |
714 | #define NECP_CLIENT_RESULT_FILTER_CONTROL_UNIT 4 // u_int32_t |
715 | #define NECP_CLIENT_RESULT_INTERFACE_INDEX 5 // u_int32_t |
716 | #define NECP_CLIENT_RESULT_NETAGENT 6 // struct necp_client_result_netagent |
717 | #define NECP_CLIENT_RESULT_FLAGS 7 // u_int32_t, see NECP_CLIENT_RESULT_FLAG_* values |
718 | #define NECP_CLIENT_RESULT_INTERFACE 8 // struct necp_client_result_interface |
719 | #define NECP_CLIENT_RESULT_INTERFACE_OPTION 9 // struct necp_client_interface_option |
720 | #define NECP_CLIENT_RESULT_EFFECTIVE_MTU 10 // u_int32_t |
721 | #define NECP_CLIENT_RESULT_FLOW 11 // TLV array of a single flow's state |
722 | #define NECP_CLIENT_RESULT_PROTO_CTL_EVENT 12 |
723 | #define NECP_CLIENT_RESULT_TFO_COOKIE 13 // NECP_TFO_COOKIE_LEN_MAX |
724 | #define NECP_CLIENT_RESULT_TFO_FLAGS 14 // u_int8_t |
725 | #define NECP_CLIENT_RESULT_RECOMMENDED_MSS 15 // u_int8_t |
726 | #define NECP_CLIENT_RESULT_FLOW_ID 16 // uuid_t |
727 | #define NECP_CLIENT_RESULT_INTERFACE_TIME_DELTA 17 // u_int32_t, seconds since interface up/down |
728 | #define NECP_CLIENT_RESULT_REASON 18 // u_int32_t, see NECP_CLIENT_RESULT_REASON_* values |
729 | #define NECP_CLIENT_RESULT_FLOW_DIVERT_AGGREGATE_UNIT 19 // u_int32_t |
730 | #define NECP_CLIENT_RESULT_REQUEST_IN_PROCESS_FLOW_DIVERT 20 // Empty |
731 | |
732 | #define NECP_CLIENT_RESULT_NEXUS_INSTANCE 100 // uuid_t |
733 | #define NECP_CLIENT_RESULT_NEXUS_PORT 101 // nexus_port_t |
734 | #define NECP_CLIENT_RESULT_NEXUS_KEY 102 // uuid_t |
735 | #define NECP_CLIENT_RESULT_NEXUS_PORT_FLOW_INDEX 103 // u_int32_t |
736 | #define NECP_CLIENT_RESULT_NEXUS_FLOW_STATS 104 // struct sk_stats_flow * |
737 | |
738 | #define NECP_CLIENT_RESULT_LOCAL_ENDPOINT 200 // struct necp_client_endpoint |
739 | #define NECP_CLIENT_RESULT_REMOTE_ENDPOINT 201 // struct necp_client_endpoint |
740 | #define NECP_CLIENT_RESULT_DISCOVERED_ENDPOINT 202 // struct necp_client_endpoint, result of browse |
741 | #define NECP_CLIENT_RESULT_RESOLVED_ENDPOINT 203 // struct necp_client_endpoint, result of resolve |
742 | #define NECP_CLIENT_RESULT_LOCAL_ETHER_ADDR 204 // struct ether_addr |
743 | #define NECP_CLIENT_RESULT_REMOTE_ETHER_ADDR 205 // struct ether_addr |
744 | #define NECP_CLIENT_RESULT_EFFECTIVE_TRAFFIC_CLASS 210 // u_int32_t |
745 | #define NECP_CLIENT_RESULT_TRAFFIC_MGMT_BG 211 // u_int32_t, 1: background, 0: not background |
746 | #define NECP_CLIENT_RESULT_GATEWAY 212 // struct necp_client_endpoint |
747 | #define NECP_CLIENT_RESULT_GROUP_MEMBER 213 // struct necp_client_endpoint |
748 | #define NECP_CLIENT_RESULT_NAT64 214 // struct ipv6_prefix[NAT64_MAX_NUM_PREFIXES] |
749 | #define NECP_CLIENT_RESULT_ESTIMATED_THROUGHPUT 215 // struct necp_client_result_estimated_throughput |
750 | #define NECP_CLIENT_RESULT_AGENT_ERROR 216 // struct necp_client_result_agent_error |
751 | |
752 | #define NECP_CLIENT_RESULT_FLAG_IS_LOCAL 0x0001 // Routes to this device |
753 | #define NECP_CLIENT_RESULT_FLAG_IS_DIRECT 0x0002 // Routes to directly accessible peer |
754 | #define NECP_CLIENT_RESULT_FLAG_HAS_IPV4 0x0004 // Supports IPv4 |
755 | #define NECP_CLIENT_RESULT_FLAG_HAS_IPV6 0x0008 // Supports IPv6 |
756 | #define NECP_CLIENT_RESULT_FLAG_DEFUNCT 0x0010 // Defunct |
757 | #define NECP_CLIENT_RESULT_FLAG_SATISFIED 0x0020 // Satisfied path |
758 | #define NECP_CLIENT_RESULT_FLAG_FLOW_ASSIGNED 0x0040 // Assigned, the flow is active |
759 | #define NECP_CLIENT_RESULT_FLAG_FLOW_VIABLE 0x0080 // Viable, the flow has a valid route |
760 | #define NECP_CLIENT_RESULT_FLAG_PROBE_CONNECTIVITY 0x0100 // Flow should probe connectivity |
761 | #define NECP_CLIENT_RESULT_FLAG_ECN_ENABLED 0x0200 // ECN should be used |
762 | #define NECP_CLIENT_RESULT_FLAG_FAST_OPEN_BLOCKED 0x0400 // Fast open should not be used |
763 | #define NECP_CLIENT_RESULT_FLAG_LINK_QUALITY_ABORT 0x0800 // Link quality is very bad, recommend close connections |
764 | #define NECP_CLIENT_RESULT_FLAG_ALLOW_QOS_MARKING 0x1000 // QoS marking is allowed |
765 | #define NECP_CLIENT_RESULT_FLAG_HAS_NAT64 0x2000 // Has NAT64 prefix |
766 | #define NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER 0x4000 // Interface is in low-power mode |
767 | #define NECP_CLIENT_RESULT_FLAG_SPECIFIC_LISTENER 0x8000 // Listener should not listen on all interfaces |
768 | #define NECP_CLIENT_RESULT_FLAG_KEXT_FILTER_PRESENT 0x10000 // Kernel extension filter present |
769 | #define NECP_CLIENT_RESULT_FLAG_PF_RULES_PRESENT 0x20000 // Firewall rules present |
770 | #define NECP_CLIENT_RESULT_FLAG_ALF_PRESENT 0x40000 // Application Firewall enabled |
771 | #define NECP_CLIENT_RESULT_FLAG_PARENTAL_CONTROLS_PRESENT 0x80000 // Parental Controls present |
772 | #define NECP_CLIENT_RESULT_FLAG_IS_GLOBAL_INTERNET 0x100000 // Routes to global Internet |
773 | |
774 | |
775 | #define NECP_CLIENT_RESULT_FLAG_FORCE_UPDATE (NECP_CLIENT_RESULT_FLAG_HAS_IPV4 | NECP_CLIENT_RESULT_FLAG_HAS_IPV6 | NECP_CLIENT_RESULT_FLAG_HAS_NAT64 | NECP_CLIENT_RESULT_FLAG_INTERFACE_LOW_POWER) |
776 | |
777 | #define NECP_CLIENT_RESULT_FAST_OPEN_SND_PROBE 0x01 // DEPRECATED - Fast open send probe |
778 | #define NECP_CLIENT_RESULT_FAST_OPEN_RCV_PROBE 0x02 // DEPRECATED - Fast open receive probe |
779 | |
780 | #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_NONE 0x01 |
781 | #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_LOW 0x02 |
782 | #define NECP_CLIENT_RESULT_RECOMMENDED_MSS_MEDIUM 0x04 |
783 | |
784 | #define NECP_CLIENT_RESULT_REASON_EXPENSIVE_PROHIBITED 1 // Expensive networks were prohibited |
785 | #define NECP_CLIENT_RESULT_REASON_CONSTRAINED_PROHIBITED 2 // Constrained networks were prohibited |
786 | #define NECP_CLIENT_RESULT_REASON_CELLULAR_DENIED 3 // Denied by a cellular route rule |
787 | #define NECP_CLIENT_RESULT_REASON_WIFI_DENIED 4 // Denied by a wifi route rule |
788 | #define NECP_CLIENT_RESULT_REASON_LOCAL_NETWORK_PROHIBITED 5 // Local network access prohibited |
789 | |
790 | struct necp_interface_signature { |
791 | u_int8_t signature[IFNET_SIGNATURELEN]; |
792 | u_int8_t signature_len; |
793 | }; |
794 | |
795 | struct necp_interface_details { |
796 | char name[IFXNAMSIZ]; |
797 | u_int32_t index; |
798 | u_int32_t generation; |
799 | u_int32_t functional_type; |
800 | u_int32_t delegate_index; |
801 | u_int32_t flags; // see NECP_INTERFACE_FLAG_* |
802 | u_int32_t mtu; |
803 | struct necp_interface_signature ipv4_signature; |
804 | struct necp_interface_signature ipv6_signature; |
805 | u_int32_t ipv4_netmask; |
806 | u_int32_t ipv4_broadcast; |
807 | /* |
808 | * This serves as a temporary header guard to protect libnetcore builds |
809 | * until the xnu changes are available in the build. |
810 | * XXX: Should be removed in a future build. |
811 | */ |
812 | #define NECP_INTERFACE_SUPPORTS_TSO 1 |
813 | u_int32_t tso_max_segment_size_v4; |
814 | u_int32_t tso_max_segment_size_v6; |
815 | #define NECP_INTERFACE_SUPPORTS_HWCSUM 1 |
816 | u_int32_t hwcsum_flags; |
817 | u_int8_t radio_type; |
818 | u_int8_t radio_channel; |
819 | }; |
820 | |
821 | #define NECP_INTERFACE_FLAG_EXPENSIVE 0x0001 |
822 | #define NECP_INTERFACE_FLAG_TXSTART 0X0002 |
823 | #define NECP_INTERFACE_FLAG_NOACKPRI 0x0004 |
824 | #define NECP_INTERFACE_FLAG_3CARRIERAGG 0x0008 |
825 | #define NECP_INTERFACE_FLAG_IS_LOW_POWER 0x0010 |
826 | #define NECP_INTERFACE_FLAG_MPK_LOG 0x0020 // Multi-layer Packet Logging |
827 | #define NECP_INTERFACE_FLAG_CONSTRAINED 0x0040 |
828 | #define NECP_INTERFACE_FLAG_HAS_NETMASK 0x0080 |
829 | #define NECP_INTERFACE_FLAG_HAS_BROADCAST 0x0100 |
830 | #define NECP_INTERFACE_FLAG_SUPPORTS_MULTICAST 0x0200 |
831 | #define NECP_INTERFACE_FLAG_HAS_DNS 0x0400 |
832 | #define NECP_INTERFACE_FLAG_HAS_NAT64 0x0800 |
833 | #define NECP_INTERFACE_FLAG_IPV4_ROUTABLE 0x1000 |
834 | #define NECP_INTERFACE_FLAG_IPV6_ROUTABLE 0x2000 |
835 | |
836 | struct necp_client_parameter_netagent_type { |
837 | char netagent_domain[32]; |
838 | char netagent_type[32]; |
839 | }; |
840 | |
841 | struct necp_client_result_netagent { |
842 | u_int32_t generation; |
843 | uuid_t netagent_uuid; |
844 | }; |
845 | |
846 | struct necp_client_result_interface { |
847 | u_int32_t generation; |
848 | u_int32_t index; |
849 | }; |
850 | |
851 | struct necp_client_result_estimated_throughput { |
852 | u_int8_t up; |
853 | u_int8_t down; |
854 | }; |
855 | |
856 | struct necp_client_result_agent_error { |
857 | u_int32_t code; |
858 | u_int8_t domain; |
859 | }; |
860 | |
861 | #define NECP_USES_INTERFACE_OPTIONS_FOR_BROWSE 1 |
862 | |
863 | struct necp_client_interface_option { |
864 | u_int32_t interface_index; |
865 | u_int32_t interface_generation; |
866 | uuid_t nexus_agent; |
867 | }; |
868 | |
869 | #define NECP_CLIENT_ENDPOINT_TYPE_APPLICATION_SERVICE 6 |
870 | |
871 | struct necp_client_endpoint { |
872 | union { |
873 | struct sockaddr sa; |
874 | struct sockaddr_in sin; |
875 | struct sockaddr_in6 sin6; |
876 | struct { |
877 | u_int8_t endpoint_length; |
878 | u_int8_t endpoint_family; // Use AF_UNSPEC to target a name |
879 | u_int16_t endpoint_port; |
880 | u_int32_t endpoint_type; // Client-specific type |
881 | char endpoint_data[0]; // Type-specific endpoint value |
882 | } endpoint; |
883 | } u; |
884 | }; |
885 | |
886 | struct necp_client_group { |
887 | u_int32_t group_type; |
888 | uuid_t group_id; |
889 | }; |
890 | |
891 | struct necp_client_list { |
892 | u_int32_t client_count; |
893 | uuid_t clients[0]; |
894 | }; |
895 | |
896 | struct kev_necp_policies_changed_data { |
897 | u_int32_t changed_count; // Defaults to 0. |
898 | }; |
899 | |
900 | #define NECP_CLIENT_FLOW_FLAGS_ALLOW_NEXUS 0x01 // Request a nexus instance upon adding a flow |
901 | #define NECP_CLIENT_FLOW_FLAGS_USE_CLIENT_ID 0x02 // Register the client ID rather than the flow registration ID with network agents |
902 | #define NECP_CLIENT_FLOW_FLAGS_BROWSE 0x04 // Create request with a browse agent |
903 | #define NECP_CLIENT_FLOW_FLAGS_RESOLVE 0x08 // Create request with a resolution agent |
904 | #define NECP_CLIENT_FLOW_FLAGS_OVERRIDE_ADDRESS 0x10 // Flow has a different remote address than the parent flow |
905 | #define NECP_CLIENT_FLOW_FLAGS_OVERRIDE_IP_PROTOCOL 0x20 // Flow has a different IP protocol than the parent flow |
906 | |
907 | struct necp_client_flow_stats { |
908 | u_int32_t stats_type; // NECP_CLIENT_STATISTICS_TYPE_* |
909 | u_int32_t stats_version; // NECP_CLIENT_STATISTICS_TYPE_*_VER |
910 | u_int32_t stats_size; |
911 | mach_vm_address_t stats_addr; |
912 | }; |
913 | |
914 | struct necp_client_add_flow { |
915 | uuid_t agent_uuid; |
916 | uuid_t registration_id; |
917 | u_int16_t flags; // NECP_CLIENT_FLOW_FLAGS_* |
918 | u_int16_t stats_request_count; |
919 | struct necp_client_flow_stats stats_requests[0]; |
920 | // sockaddr for override endpoint |
921 | // uint8 for override ip protocol |
922 | } __attribute__((__packed__)); |
923 | |
924 | struct necp_agent_use_parameters { |
925 | uuid_t agent_uuid; |
926 | uint64_t out_use_count; |
927 | }; |
928 | |
929 | struct necp_client_group_action { |
930 | uuid_t agent_uuid; |
931 | u_int16_t group_member_count; |
932 | struct necp_client_endpoint group_members[0]; |
933 | } __attribute__((__packed__)); |
934 | |
935 | struct necp_client_flow_protoctl_event { |
936 | uint32_t protoctl_event_code; |
937 | uint32_t protoctl_event_val; |
938 | /* TCP seq number is in host byte order */ |
939 | uint32_t protoctl_event_tcp_seq_num; |
940 | }; |
941 | |
942 | #define NECP_CLIENT_UPDATE_TYPE_PARAMETERS 1 // Parameters, for a new client |
943 | #define NECP_CLIENT_UPDATE_TYPE_RESULT 2 // Result, for a udpated client |
944 | #define NECP_CLIENT_UPDATE_TYPE_REMOVE 3 // Empty, for a removed client |
945 | |
946 | struct necp_client_observer_update { |
947 | u_int32_t update_type; // NECP_CLIENT_UPDATE_TYPE_* |
948 | u_int8_t tlv_buffer[0]; // Parameters or result as TLVs, based on type |
949 | }; |
950 | |
951 | // These sign types are tied to specific clients. |
952 | // The client_id UUID is then the NECP client UUID that generated the query. |
953 | #define NECP_CLIENT_SIGN_TYPE_RESOLVER_ANSWER 1 // struct necp_client_host_resolver_answer |
954 | #define NECP_CLIENT_SIGN_TYPE_BROWSE_RESULT 2 // struct necp_client_browse_result |
955 | #define NECP_CLIENT_SIGN_TYPE_SERVICE_RESOLVER_ANSWER 3 // struct necp_client_service_resolver_answer |
956 | |
957 | // These sign types are valid for system-wide use. |
958 | // The client_id UUID is a unique per-query UUID. |
959 | // These should be generated only on behalf of trusted or entitled processes. |
960 | #define NECP_CLIENT_SIGN_TYPE_SYSTEM_RESOLVER_ANSWER 4 // struct necp_client_host_resolver_answer |
961 | #define NECP_CLIENT_SIGN_TYPE_SYSTEM_BROWSE_RESULT 5 // struct necp_client_browse_result |
962 | #define NECP_CLIENT_SIGN_TYPE_SYSTEM_SERVICE_RESOLVER_ANSWER 6 // struct necp_client_service_resolver_answer |
963 | |
964 | struct necp_client_signature { |
965 | u_int8_t signed_tag[32]; |
966 | } __attribute__((__packed__)); |
967 | |
968 | // |
969 | struct necp_client_signable { |
970 | uuid_t client_id; // Interpretation depends on sign_type |
971 | u_int32_t sign_type; |
972 | u_int8_t signable_data[0]; |
973 | } __attribute__((__packed__)); |
974 | |
975 | struct necp_client_resolver_answer { |
976 | uuid_t client_id; |
977 | u_int32_t sign_type; |
978 | union sockaddr_in_4_6 address_answer; // Can include port |
979 | u_int32_t hostname_length; |
980 | char hostname[0]; |
981 | } __attribute__((__packed__)); |
982 | |
983 | struct necp_client_host_resolver_answer { |
984 | struct necp_client_signable ; |
985 | u_int32_t metadata_hash; // Extra metadata that can be signed along with the answer, such as a network signature. |
986 | union sockaddr_in_4_6 address_answer; // Can include port |
987 | u_int32_t hostname_length; |
988 | char hostname[0]; |
989 | } __attribute__((__packed__)); |
990 | |
991 | struct necp_client_browse_result { |
992 | struct necp_client_signable ; |
993 | u_int32_t metadata_hash; // Extra metadata that can be signed along with the service, which may include a TXT record or a network signature |
994 | u_int16_t service_length; |
995 | char service[0]; |
996 | } __attribute__((__packed__)); |
997 | |
998 | struct necp_client_service_resolver_answer { |
999 | struct necp_client_signable ; |
1000 | u_int32_t metadata_hash; // Extra metadata that can be signed along with the service, which may include a TXT record or a network signature |
1001 | u_int16_t service_length; |
1002 | u_int16_t port; |
1003 | u_int16_t hostname_length; |
1004 | char service[0]; |
1005 | char hostname[0]; |
1006 | } __attribute__((__packed__)); |
1007 | |
1008 | struct necp_client_validatable { |
1009 | struct necp_client_signature signature; |
1010 | struct necp_client_signable signable; |
1011 | } __attribute__((__packed__)); |
1012 | |
1013 | #define NECP_CLIENT_ACTION_SIGN_MAX_STRING_LENGTH 1024 |
1014 | |
1015 | #define NECP_CLIENT_ACTION_SIGN_TAG_LENGTH 32 |
1016 | |
1017 | #define NECP_CLIENT_ACTION_SIGN_DEFAULT_DATA_LENGTH 128 |
1018 | #define NECP_CLIENT_ACTION_SIGN_MAX_TOTAL_LENGTH 4096 |
1019 | |
1020 | #define NECP_FILTER_UNIT_NO_FILTER UINT32_MAX // Reserved filter unit value that prohibits all filters and socket filters |
1021 | |
1022 | // Type of signed client ID requests. |
1023 | #define NECP_CLIENT_SIGNED_CLIENT_ID_TYPE_UUID 1 // struct necp_client_signed_client_id_uuid |
1024 | |
1025 | struct necp_client_signed_client_id_uuid { |
1026 | uuid_t client_id; |
1027 | u_int32_t signature_length; |
1028 | u_int8_t signature_data[NECP_CLIENT_ACTION_SIGN_TAG_LENGTH]; |
1029 | } __attribute__((__packed__)); |
1030 | |
1031 | /* |
1032 | * The sysctl "net.necp.necp_drop_dest_level" controls the global drop rule policy for |
1033 | * a set of destinations addresses at the given level -- the drop rule is the last one |
1034 | * to be evaluated at this level. |
1035 | */ |
1036 | #define MAX_NECP_DROP_DEST_LEVEL_ADDRS 8 |
1037 | |
1038 | struct necp_drop_dest_entry { |
1039 | u_int32_t level; // priority level |
1040 | u_int32_t order; // session order (read only via sysctl) |
1041 | struct necp_policy_condition_addr cond_addr; |
1042 | }; |
1043 | |
1044 | struct necp_drop_dest_policy { |
1045 | u_int32_t entry_count; |
1046 | struct necp_drop_dest_entry entries[MAX_NECP_DROP_DEST_LEVEL_ADDRS]; |
1047 | }; |
1048 | |
1049 | |
1050 | #define NECP_DEMUX_MAX_LEN 32 |
1051 | struct necp_demux_pattern { |
1052 | uint16_t offset; |
1053 | uint16_t len; |
1054 | uint8_t mask[NECP_DEMUX_MAX_LEN]; |
1055 | uint8_t value[NECP_DEMUX_MAX_LEN]; |
1056 | }; |
1057 | |
1058 | #ifdef BSD_KERNEL_PRIVATE |
1059 | #include <stdbool.h> |
1060 | #include <sys/socketvar.h> |
1061 | #include <sys/kern_control.h> |
1062 | #include <netinet/ip_var.h> |
1063 | #include <netinet6/ip6_var.h> |
1064 | #include <net/if_var.h> |
1065 | #include <sys/syslog.h> |
1066 | #include <net/network_agent.h> |
1067 | #include <net/ethernet.h> |
1068 | #include <os/log.h> |
1069 | #if SKYWALK |
1070 | #include <skywalk/namespace/netns.h> |
1071 | #endif /* SKYWALK */ |
1072 | |
1073 | |
1074 | SYSCTL_DECL(_net_necp); |
1075 | |
1076 | extern os_log_t necp_log_handle; |
1077 | extern os_log_t necp_data_trace_log_handle; |
1078 | |
1079 | #define NECPLOG(level, format, ...) do { \ |
1080 | if (level == LOG_ERR) { \ |
1081 | os_log_error(necp_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \ |
1082 | } else { \ |
1083 | os_log(necp_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \ |
1084 | } \ |
1085 | } while (0) |
1086 | |
1087 | #define NECPLOG0(level, msg) do { \ |
1088 | if (level == LOG_ERR) { \ |
1089 | os_log_error(necp_log_handle, "%s: %s\n", __FUNCTION__, msg); \ |
1090 | } else { \ |
1091 | os_log(necp_log_handle, "%s: %s\n", __FUNCTION__, msg); \ |
1092 | } \ |
1093 | } while (0) |
1094 | |
1095 | #define NECPDATATRACELOG(level, format, ...) do { \ |
1096 | if (level == LOG_ERR) { \ |
1097 | os_log_error(necp_data_trace_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \ |
1098 | } else { \ |
1099 | os_log(necp_data_trace_log_handle, "%s: " format "\n", __FUNCTION__, __VA_ARGS__); \ |
1100 | } \ |
1101 | } while (0) |
1102 | |
1103 | enum necp_fd_type_t { |
1104 | necp_fd_type_invalid = 0, |
1105 | necp_fd_type_session = 1, |
1106 | necp_fd_type_client = 2, |
1107 | }; |
1108 | |
1109 | union necp_sockaddr_union { |
1110 | #if !__has_ptrcheck |
1111 | struct sockaddr sa; |
1112 | #endif |
1113 | struct __sockaddr_header sah; |
1114 | struct sockaddr_in sin; |
1115 | struct sockaddr_in6 sin6; |
1116 | }; |
1117 | |
1118 | /* |
1119 | * kstats |
1120 | * The ustats and kstats region are mirrored. So when we allocate with |
1121 | * skmem_cache from kstats region, we also get an ustats object. To tie them |
1122 | * together, kstats has an extra *necp_stats_ustats pointer pointing to the |
1123 | * ustats object |
1124 | */ |
1125 | struct necp_all_kstats { |
1126 | struct necp_all_stats necp_stats_comm; /* kernel private stats snapshot */ |
1127 | struct necp_all_stats *necp_stats_ustats; /* points to user-visible stats (in shared ustats region) */ |
1128 | }; |
1129 | |
1130 | extern void necp_client_init(void); |
1131 | extern int necp_application_find_policy_match_internal(proc_t proc, u_int8_t *parameters, u_int32_t parameters_size, |
1132 | struct necp_aggregate_result *returned_result, |
1133 | u_int32_t *flags, u_int32_t *reason, u_int required_interface_index, |
1134 | const union necp_sockaddr_union *override_local_addr, |
1135 | const union necp_sockaddr_union *override_remote_addr, |
1136 | struct necp_client_endpoint *returned_v4_gateway, |
1137 | struct necp_client_endpoint *returned_v6_gateway, |
1138 | struct rtentry **returned_route, bool ignore_address, |
1139 | bool has_client, |
1140 | uuid_t *returned_override_euuid); |
1141 | /* |
1142 | * TLV utilities |
1143 | * |
1144 | * Note that these functions (other than necp_buffer_find_tlv) do not check the length of the entire buffer, |
1145 | * so the caller must be sure that the entire TLV is within bounds. |
1146 | */ |
1147 | struct { |
1148 | u_int8_t ; |
1149 | u_int32_t ; |
1150 | } __attribute__((__packed__)); |
1151 | |
1152 | extern u_int8_t *necp_buffer_write_tlv(u_int8_t *cursor, u_int8_t type, u_int32_t length, const void *value, |
1153 | u_int8_t *buffer, u_int32_t buffer_length); |
1154 | extern u_int8_t *necp_buffer_write_tlv_if_different(u_int8_t *cursor, u_int8_t type, |
1155 | u_int32_t length, const void *value, bool *updated, |
1156 | u_int8_t *buffer, u_int32_t buffer_length); |
1157 | extern u_int8_t necp_buffer_get_tlv_type(u_int8_t *buffer, int tlv_offset); |
1158 | extern u_int32_t necp_buffer_get_tlv_length(u_int8_t *buffer, int tlv_offset); |
1159 | extern u_int8_t *necp_buffer_get_tlv_value(u_int8_t *buffer, int tlv_offset, u_int32_t *value_size); |
1160 | extern int necp_buffer_find_tlv(u_int8_t *buffer, u_int32_t buffer_length, int offset, u_int8_t type, int *err, int next); |
1161 | |
1162 | #define NECPCTL_DROP_ALL_LEVEL 1 /* Drop all packets if no policy matches above this level */ |
1163 | #define NECPCTL_DEBUG 2 /* Log all kernel policy matches */ |
1164 | #define NECPCTL_PASS_LOOPBACK 3 /* Pass all loopback traffic */ |
1165 | #define NECPCTL_PASS_KEEPALIVES 4 /* Pass all kernel-generated keepalive traffic */ |
1166 | #define NECPCTL_SOCKET_POLICY_COUNT 5 /* Count of all socket-level policies */ |
1167 | #define NECPCTL_SOCKET_NON_APP_POLICY_COUNT 6 /* Count of non-per-app socket-level policies */ |
1168 | #define NECPCTL_IP_POLICY_COUNT 7 /* Count of all ip-level policies */ |
1169 | #define NECPCTL_SESSION_COUNT 8 /* Count of NECP sessions */ |
1170 | #define NECPCTL_CLIENT_FD_COUNT 9 /* Count of NECP client fds */ |
1171 | #define NECPCTL_CLIENT_COUNT 10 /* Count of NECP clients */ |
1172 | #define NECPCTL_ARENA_COUNT 11 /* Count of NECP arenas (stats, etc) */ |
1173 | #define NECPCTL_NEXUS_FLOW_COUNT 12 /* Count of NECP nexus flows */ |
1174 | #define NECPCTL_SOCKET_FLOW_COUNT 13 /* Count of NECP socket flows */ |
1175 | #define NECPCTL_IF_FLOW_COUNT 14 /* Count of NECP socket flows */ |
1176 | #define NECPCTL_OBSERVER_FD_COUNT 15 /* Count of NECP observer fds */ |
1177 | #define NECPCTL_OBSERVER_MESSAGE_LIMIT 16 /* Number of of NECP observer messages allowed to be queued */ |
1178 | #define NECPCTL_SYSCTL_ARENA_COUNT 17 /* Count of sysctl arenas */ |
1179 | #define NECPCTL_DROP_UNENTITLED_LEVEL 18 /* Drop unentitled process traffic above this level */ |
1180 | #define NECPCTL_PASS_INTERPOSE 19 /* Pass interpose */ |
1181 | #define NECPCTL_RESTRICT_MULTICAST 20 /* Restrict multicast access */ |
1182 | #define NECPCTL_DEDUP_POLICIES 21 /* Dedup overlapping policies */ |
1183 | #define NECPCTL_CLIENT_TRACING_LEVEL 22 /* Client tracing level */ |
1184 | #define NECPCTL_CLIENT_TRACING_PID 23 /* Apply client tracing only to specified pid */ |
1185 | #define NECPCTL_DROP_MANAGEMENT_LEVEL 24 /* Drop management traffic at this level */ |
1186 | |
1187 | #define NECP_LOOPBACK_PASS_ALL 1 // Pass all loopback traffic |
1188 | #define NECP_LOOPBACK_PASS_WITH_FILTER 2 // Pass all loopback traffic, but activate content filter and/or flow divert if applicable |
1189 | |
1190 | #define NECPCTL_NAMES { \ |
1191 | { 0, 0 }, \ |
1192 | { "drop_all_level", CTLTYPE_INT }, \ |
1193 | { "debug", CTLTYPE_INT }, \ |
1194 | { "pass_loopback", CTLTYPE_INT }, \ |
1195 | { "pass_keepalives", CTLTYPE_INT }, \ |
1196 | { "pass_interpose", CTLTYPE_INT }, \ |
1197 | } |
1198 | |
1199 | typedef u_int32_t necp_kernel_policy_id; |
1200 | #define NECP_KERNEL_POLICY_ID_NONE 0 |
1201 | #define NECP_KERNEL_POLICY_ID_NO_MATCH 1 |
1202 | #define NECP_KERNEL_POLICY_ID_FIRST_VALID_SOCKET 2 |
1203 | #define NECP_KERNEL_POLICY_ID_FIRST_VALID_IP UINT16_MAX |
1204 | |
1205 | typedef u_int32_t necp_app_id; |
1206 | |
1207 | #define NECP_KERNEL_POLICY_RESULT_NONE 0 |
1208 | #define NECP_KERNEL_POLICY_RESULT_PASS NECP_POLICY_RESULT_PASS |
1209 | #define NECP_KERNEL_POLICY_RESULT_SKIP NECP_POLICY_RESULT_SKIP |
1210 | #define NECP_KERNEL_POLICY_RESULT_DROP NECP_POLICY_RESULT_DROP |
1211 | #define NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT NECP_POLICY_RESULT_SOCKET_DIVERT |
1212 | #define NECP_KERNEL_POLICY_RESULT_SOCKET_FILTER NECP_POLICY_RESULT_SOCKET_FILTER |
1213 | #define NECP_KERNEL_POLICY_RESULT_IP_TUNNEL NECP_POLICY_RESULT_IP_TUNNEL |
1214 | #define NECP_KERNEL_POLICY_RESULT_IP_FILTER NECP_POLICY_RESULT_IP_FILTER |
1215 | #define NECP_KERNEL_POLICY_RESULT_SOCKET_SCOPED NECP_POLICY_RESULT_SOCKET_SCOPED |
1216 | #define NECP_KERNEL_POLICY_RESULT_ROUTE_RULES NECP_POLICY_RESULT_ROUTE_RULES |
1217 | #define NECP_KERNEL_POLICY_RESULT_USE_NETAGENT NECP_POLICY_RESULT_USE_NETAGENT |
1218 | #define NECP_KERNEL_POLICY_RESULT_NETAGENT_SCOPED NECP_POLICY_RESULT_NETAGENT_SCOPED |
1219 | #define NECP_KERNEL_POLICY_RESULT_SCOPED_DIRECT NECP_POLICY_RESULT_SCOPED_DIRECT |
1220 | #define NECP_KERNEL_POLICY_RESULT_ALLOW_UNENTITLED NECP_POLICY_RESULT_ALLOW_UNENTITLED |
1221 | #define NECP_KERNEL_POLICY_RESULT_REMOVE_NETAGENT NECP_POLICY_RESULT_REMOVE_NETAGENT |
1222 | |
1223 | #define NECP_KERNEL_POLICY_PASS_NO_SKIP_IPSEC NECP_POLICY_PASS_NO_SKIP_IPSEC |
1224 | #define NECP_KERNEL_POLICY_PASS_PF_TAG NECP_POLICY_PASS_PF_TAG |
1225 | |
1226 | #define NECP_KERNEL_POLICY_DROP_FLAG_LOCAL_NETWORK NECP_POLICY_DROP_FLAG_LOCAL_NETWORK |
1227 | #define NECP_KERNEL_POLICY_DROP_FLAG_SUPPRESS_ALERTS NECP_POLICY_DROP_FLAG_SUPPRESS_ALERTS |
1228 | |
1229 | typedef struct { |
1230 | u_int32_t identifier; |
1231 | u_int32_t data; |
1232 | } necp_kernel_policy_service; |
1233 | |
1234 | typedef union { |
1235 | u_int tunnel_interface_index; |
1236 | u_int scoped_interface_index; |
1237 | u_int32_t flow_divert_control_unit; |
1238 | u_int32_t filter_control_unit; |
1239 | u_int32_t skip_policy_order; |
1240 | u_int32_t route_rule_id; |
1241 | u_int32_t netagent_id; |
1242 | u_int32_t pass_flags; |
1243 | u_int32_t drop_flags; |
1244 | necp_kernel_policy_service service; |
1245 | } necp_kernel_policy_result_parameter; |
1246 | |
1247 | enum necp_boolean_state { |
1248 | necp_boolean_state_unknown = 0, |
1249 | necp_boolean_state_false = 1, |
1250 | necp_boolean_state_true = 2, |
1251 | }; |
1252 | |
1253 | struct necp_kernel_socket_policy { |
1254 | LIST_ENTRY(necp_kernel_socket_policy) chain; |
1255 | necp_kernel_policy_id id; |
1256 | necp_policy_order order; |
1257 | u_int32_t session_order; |
1258 | int session_pid; |
1259 | |
1260 | u_int64_t condition_mask; |
1261 | u_int64_t condition_negated_mask; |
1262 | u_int32_t cond_client_flags; |
1263 | necp_kernel_policy_id cond_policy_id; |
1264 | u_int32_t cond_app_id; // Locally assigned ID value stored |
1265 | u_int32_t cond_real_app_id; // Locally assigned ID value stored |
1266 | char *cond_custom_entitlement; // String |
1267 | u_int32_t cond_account_id; // Locally assigned ID value stored |
1268 | char *cond_domain; // String |
1269 | u_int8_t cond_domain_dot_count; // Number of dots in cond_domain |
1270 | u_int32_t cond_domain_filter; |
1271 | pid_t cond_pid; |
1272 | uid_t cond_uid; |
1273 | uid_t cond_real_uid; |
1274 | ifnet_t cond_bound_interface; // Matches specific binding only |
1275 | struct necp_policy_condition_tc_range cond_traffic_class; // Matches traffic class in range |
1276 | u_int16_t cond_protocol; // Matches IP protcol number |
1277 | union necp_sockaddr_union cond_local_start; // Matches local IP address (or start) |
1278 | union necp_sockaddr_union cond_local_end; // Matches IP address range |
1279 | u_int8_t cond_local_prefix; // Defines subnet |
1280 | union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start) |
1281 | union necp_sockaddr_union cond_remote_end; // Matches IP address range |
1282 | u_int8_t cond_remote_prefix; // Defines subnet |
1283 | struct necp_policy_condition_agent_type cond_agent_type; |
1284 | struct necp_policy_condition_sdk_version cond_sdk_version; |
1285 | char *cond_signing_identifier; // String |
1286 | char *cond_url;// String |
1287 | u_int16_t cond_packet_filter_tags; |
1288 | u_int16_t cond_scheme_port; |
1289 | int32_t cond_pid_version; |
1290 | u_int32_t cond_bound_interface_flags; |
1291 | u_int32_t cond_bound_interface_eflags; |
1292 | u_int32_t cond_bound_interface_xflags; |
1293 | |
1294 | necp_kernel_policy_result result; |
1295 | necp_kernel_policy_result_parameter result_parameter; |
1296 | }; |
1297 | |
1298 | struct necp_kernel_ip_output_policy { |
1299 | LIST_ENTRY(necp_kernel_ip_output_policy) chain; |
1300 | necp_kernel_policy_id id; |
1301 | necp_policy_order suborder; |
1302 | necp_policy_order order; |
1303 | u_int32_t session_order; |
1304 | int session_pid; |
1305 | |
1306 | u_int64_t condition_mask; |
1307 | u_int64_t condition_negated_mask; |
1308 | necp_kernel_policy_id cond_policy_id; |
1309 | ifnet_t cond_bound_interface; // Matches specific binding only |
1310 | u_int16_t cond_protocol; // Matches IP protcol number |
1311 | union necp_sockaddr_union cond_local_start; // Matches local IP address (or start) |
1312 | union necp_sockaddr_union cond_local_end; // Matches IP address range |
1313 | u_int8_t cond_local_prefix; // Defines subnet |
1314 | union necp_sockaddr_union cond_remote_start; // Matches remote IP address (or start) |
1315 | union necp_sockaddr_union cond_remote_end; // Matches IP address range |
1316 | u_int8_t cond_remote_prefix; // Defines subnet |
1317 | u_int32_t cond_last_interface_index; |
1318 | u_int16_t cond_packet_filter_tags; |
1319 | u_int16_t cond_scheme_port; |
1320 | u_int32_t cond_bound_interface_flags; |
1321 | u_int32_t cond_bound_interface_eflags; |
1322 | u_int32_t cond_bound_interface_xflags; |
1323 | |
1324 | necp_kernel_policy_result result; |
1325 | necp_kernel_policy_result_parameter result_parameter; |
1326 | }; |
1327 | |
1328 | #define MAX_KERNEL_SOCKET_POLICIES 1 |
1329 | #define MAX_KERNEL_IP_OUTPUT_POLICIES 4 |
1330 | struct necp_session_policy { |
1331 | LIST_ENTRY(necp_session_policy) chain; |
1332 | bool applied; // Applied into the kernel table |
1333 | bool pending_deletion; // Waiting to be removed from kernel table |
1334 | bool pending_update; // Policy has been modified since creation/last application |
1335 | necp_policy_id local_id; |
1336 | necp_policy_order order; |
1337 | u_int8_t *result; |
1338 | u_int32_t result_size; |
1339 | u_int8_t *conditions; // Array of conditions, each with a u_int32_t length at start |
1340 | u_int32_t conditions_size; |
1341 | u_int8_t *route_rules; // Array of route rules, each with a u_int32_t length at start |
1342 | u_int32_t route_rules_size; |
1343 | |
1344 | uuid_t applied_app_uuid; |
1345 | uuid_t applied_real_app_uuid; |
1346 | char *applied_account; |
1347 | u_int32_t applied_account_size; |
1348 | |
1349 | uuid_t applied_result_uuid; |
1350 | |
1351 | u_int32_t applied_route_rules_id; |
1352 | |
1353 | necp_kernel_policy_id kernel_socket_policies[MAX_KERNEL_SOCKET_POLICIES]; |
1354 | necp_kernel_policy_id kernel_ip_output_policies[MAX_KERNEL_IP_OUTPUT_POLICIES]; |
1355 | }; |
1356 | |
1357 | struct necp_aggregate_socket_result { |
1358 | necp_kernel_policy_result result; |
1359 | necp_kernel_policy_result_parameter result_parameter; |
1360 | necp_kernel_policy_filter filter_control_unit; |
1361 | u_int32_t flow_divert_aggregate_unit; |
1362 | u_int32_t route_rule_id; |
1363 | int32_t qos_marking_gencount; |
1364 | }; |
1365 | |
1366 | struct necp_inpcb_result { |
1367 | u_int32_t app_id; |
1368 | necp_kernel_policy_id policy_id; |
1369 | necp_kernel_policy_id skip_policy_id; |
1370 | int32_t policy_gencount; |
1371 | u_int32_t flowhash; |
1372 | u_int32_t network_denied_notifies;// Notification count |
1373 | struct necp_aggregate_socket_result results; |
1374 | }; |
1375 | |
1376 | extern void necp_init(void); |
1377 | |
1378 | struct inp_necp_attributes; |
1379 | extern errno_t necp_set_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt); |
1380 | extern errno_t necp_get_socket_attributes(struct inp_necp_attributes *attributes, struct sockopt *sopt); |
1381 | extern errno_t necp_set_socket_domain_attributes(struct socket *so, const char *domain, const char *domain_owner); |
1382 | extern int necp_set_socket_resolver_signature(struct inpcb *inp, struct sockopt *sopt); |
1383 | extern int necp_get_socket_resolver_signature(struct inpcb *inp, struct sockopt *sopt); |
1384 | extern bool necp_socket_has_resolver_signature(struct inpcb *inp); |
1385 | extern bool necp_socket_resolver_signature_matches_address(struct inpcb *inp, union necp_sockaddr_union *address); |
1386 | extern void necp_inpcb_remove_cb(struct inpcb *inp); |
1387 | extern void necp_inpcb_dispose(struct inpcb *inp); |
1388 | |
1389 | extern u_int32_t necp_socket_get_content_filter_control_unit(struct socket *so); |
1390 | |
1391 | extern bool necp_socket_should_use_flow_divert(struct inpcb *inp); |
1392 | extern u_int32_t necp_socket_get_flow_divert_control_unit(struct inpcb *inp, uint32_t *aggregate_unit); |
1393 | |
1394 | extern bool necp_socket_should_rescope(struct inpcb *inp); |
1395 | extern u_int necp_socket_get_rescope_if_index(struct inpcb *inp); |
1396 | extern u_int32_t necp_socket_get_effective_mtu(struct inpcb *inp, u_int32_t current_mtu); |
1397 | |
1398 | extern bool necp_socket_is_allowed_to_recv_on_interface(struct inpcb *inp, ifnet_t interface); |
1399 | |
1400 | extern bool necp_socket_is_allowed_to_send_recv(struct inpcb *inp, ifnet_t input_interface, u_int16_t pf_tag, |
1401 | necp_kernel_policy_id *return_policy_id, |
1402 | u_int32_t *return_route_rule_id, |
1403 | necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags); |
1404 | extern bool necp_socket_is_allowed_to_send_recv_v4(struct inpcb *inp, u_int16_t local_port, |
1405 | u_int16_t remote_port, struct in_addr *local_addr, |
1406 | struct in_addr *remote_addr, ifnet_t input_interface, u_int16_t pf_tag, |
1407 | necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id, |
1408 | necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags); |
1409 | extern bool necp_socket_is_allowed_to_send_recv_v6(struct inpcb *inp, u_int16_t local_port, |
1410 | u_int16_t remote_port, struct in6_addr *local_addr, |
1411 | struct in6_addr *remote_addr, ifnet_t input_interface, u_int16_t pf_tag, |
1412 | necp_kernel_policy_id *return_policy_id, u_int32_t *return_route_rule_id, |
1413 | necp_kernel_policy_id *return_skip_policy_id, u_int32_t *return_pass_flags); |
1414 | extern void necp_socket_update_qos_marking(struct inpcb *inp, struct rtentry *route, u_int32_t route_rule_id); |
1415 | extern bool necp_lookup_current_qos_marking(int32_t *qos_marking_gencount, struct rtentry *route, struct ifnet *interface, u_int32_t route_rule_id, bool old_qos_marking); |
1416 | extern int necp_mark_packet_from_socket(struct mbuf *packet, struct inpcb *inp, necp_kernel_policy_id policy_id, |
1417 | u_int32_t route_rule_id, necp_kernel_policy_id skip_policy_id, u_int32_t pass_flags); |
1418 | extern necp_kernel_policy_id necp_get_policy_id_from_packet(struct mbuf *packet); |
1419 | extern necp_kernel_policy_id necp_get_skip_policy_id_from_packet(struct mbuf *packet); |
1420 | extern u_int16_t necp_get_packet_filter_tags_from_packet(struct mbuf *packet); |
1421 | extern bool necp_packet_should_skip_filters(struct mbuf *packet); |
1422 | extern u_int32_t necp_get_last_interface_index_from_packet(struct mbuf *packet); |
1423 | extern u_int32_t necp_get_route_rule_id_from_packet(struct mbuf *packet); |
1424 | extern int necp_get_app_uuid_from_packet(struct mbuf *packet, |
1425 | uuid_t app_uuid); |
1426 | |
1427 | extern necp_kernel_policy_id necp_socket_find_policy_match(struct inpcb *inp, struct sockaddr *override_local_addr, |
1428 | struct sockaddr *override_remote_addr, u_int32_t override_bound_interface); |
1429 | extern necp_kernel_policy_id necp_ip_output_find_policy_match(struct mbuf *packet, int flags, struct ip_out_args *ipoa, |
1430 | struct rtentry *rt, |
1431 | necp_kernel_policy_result *result, |
1432 | necp_kernel_policy_result_parameter *result_parameter); |
1433 | extern necp_kernel_policy_id necp_ip6_output_find_policy_match(struct mbuf *packet, int flags, struct ip6_out_args *ip6oa, |
1434 | struct rtentry *rt, |
1435 | necp_kernel_policy_result *result, |
1436 | necp_kernel_policy_result_parameter *result_parameter); |
1437 | |
1438 | extern int necp_mark_packet_from_ip(struct mbuf *packet, necp_kernel_policy_id policy_id); |
1439 | extern int necp_mark_packet_from_ip_with_skip(struct mbuf *packet, necp_kernel_policy_id policy_id, necp_kernel_policy_id skip_policy_id); |
1440 | extern int necp_mark_packet_from_interface(struct mbuf *packet, ifnet_t interface); |
1441 | |
1442 | extern ifnet_t necp_get_ifnet_from_result_parameter(necp_kernel_policy_result_parameter *result_parameter); |
1443 | extern bool necp_packet_can_rebind_to_ifnet(struct mbuf *packet, struct ifnet *interface, struct route *new_route, int family); |
1444 | |
1445 | extern bool necp_packet_is_allowed_over_interface(struct mbuf *packet, struct ifnet *interface); |
1446 | |
1447 | extern int necp_mark_packet_as_keepalive(struct mbuf *packet, bool is_keepalive); |
1448 | extern bool necp_get_is_keepalive_from_packet(struct mbuf *packet); |
1449 | |
1450 | extern int necp_sign_resolver_answer(uuid_t client_id, u_int32_t sign_type, |
1451 | u_int8_t *data, size_t data_length, |
1452 | u_int8_t *tag, size_t *out_tag_length); |
1453 | |
1454 | extern bool necp_validate_resolver_answer(uuid_t client_id, u_int32_t sign_type, |
1455 | u_int8_t *data, size_t data_length, |
1456 | u_int8_t *tag, size_t tag_length); |
1457 | |
1458 | extern int necp_sign_application_id(uuid_t client_id, u_int32_t sign_type, |
1459 | u_int8_t *tag, size_t *out_tag_length); |
1460 | |
1461 | extern bool necp_validate_application_id(uuid_t client_id, u_int32_t sign_type, |
1462 | u_int8_t *tag, size_t tag_length); |
1463 | |
1464 | extern void necp_update_all_clients(void); // Handle general re-evaluate event |
1465 | extern void necp_update_all_clients_immediately_if_needed(bool should_update_immediately); // Handle general re-evaluate event |
1466 | |
1467 | extern void necp_force_update_client(uuid_t client_id, uuid_t remove_netagent_uuid, u_int32_t agent_generation); // Cause a single client to get an update event |
1468 | |
1469 | extern bool necp_set_client_as_background(proc_t proc, struct fileproc *fp, bool background); // Set all clients for an fp as background or not |
1470 | |
1471 | struct necp_fd_data; |
1472 | extern void necp_fd_memstatus(proc_t proc, uint32_t status, struct necp_fd_data *client_fd); // Purge memory of clients for the process |
1473 | extern void necp_fd_defunct(proc_t proc, struct necp_fd_data *client_fd); // Set all clients for an process as defunct |
1474 | |
1475 | extern void necp_client_request_in_process_flow_divert(pid_t pid); |
1476 | |
1477 | extern int necp_client_register_socket_flow(pid_t pid, uuid_t client_id, struct inpcb *inp); |
1478 | |
1479 | extern int necp_client_register_socket_listener(pid_t pid, uuid_t client_id, struct inpcb *inp); |
1480 | |
1481 | #if SKYWALK |
1482 | extern int necp_client_get_netns_flow_info(uuid_t client_id, struct ns_flow_info *flow_info); |
1483 | #endif /* SKYWALK */ |
1484 | |
1485 | extern int necp_client_assert_bb_radio_manager(uuid_t client_id, bool assert); |
1486 | |
1487 | extern int necp_client_assign_from_socket(pid_t pid, uuid_t client_id, struct inpcb *inp); |
1488 | |
1489 | extern int necp_assign_client_result(uuid_t netagent_uuid, uuid_t client_id, |
1490 | u_int8_t *assigned_results, size_t assigned_results_length); |
1491 | extern int necp_assign_client_group_members(uuid_t netagent_uuid, uuid_t client_id, |
1492 | u_int8_t *assigned_group_members, size_t assigned_group_members_length); |
1493 | |
1494 | struct skmem_obj_info; // forward declaration |
1495 | extern int necp_stats_ctor(struct skmem_obj_info *oi, struct skmem_obj_info *oim, void *arg, uint32_t skmflag); |
1496 | extern int necp_stats_dtor(void *addr, void *arg); |
1497 | |
1498 | /* value to denote invalid flow advisory index */ |
1499 | struct netagent_session; |
1500 | extern int |
1501 | necp_update_flow_protoctl_event(uuid_t netagent_uuid, uuid_t client_id, |
1502 | uint32_t protoctl_event_code, uint32_t protoctl_event_val, |
1503 | uint32_t protoctl_event_tcp_seq_num); |
1504 | |
1505 | #define NECP_FLOWADV_IDX_INVALID UINT32_MAX |
1506 | extern void *necp_create_nexus_assign_message(uuid_t nexus_instance, nexus_port_t nexus_port, void *key, uint32_t key_length, |
1507 | struct necp_client_endpoint *local_endpoint, struct necp_client_endpoint *remote_endpoint, |
1508 | struct ether_addr *local_ether_addr, |
1509 | u_int32_t flow_adv_index, void *flow_stats, size_t *message_length); |
1510 | |
1511 | |
1512 | #define NECP_MAX_DEMUX_PATTERNS 4 |
1513 | struct necp_client_nexus_parameters { |
1514 | pid_t pid; |
1515 | pid_t epid; |
1516 | uuid_t euuid; |
1517 | #if SKYWALK |
1518 | netns_token port_reservation; |
1519 | #else /* !SKYWALK */ |
1520 | void *reserved; |
1521 | #endif /* !SKYWALK */ |
1522 | union necp_sockaddr_union local_addr; |
1523 | union necp_sockaddr_union remote_addr; |
1524 | u_int8_t ip_protocol; |
1525 | u_int8_t transport_protocol; |
1526 | u_int16_t ethertype; |
1527 | u_int32_t traffic_class; |
1528 | necp_policy_id policy_id; |
1529 | necp_policy_id skip_policy_id; |
1530 | unsigned is_listener:1; |
1531 | unsigned is_interpose:1; |
1532 | unsigned is_custom_ether:1; |
1533 | unsigned allow_qos_marking:1; |
1534 | unsigned override_address_selection:1; |
1535 | unsigned use_stable_address:1; // Used if override_address_selection is set |
1536 | unsigned no_wake_from_sleep:1; |
1537 | unsigned is_demuxable_parent:1; |
1538 | unsigned reuse_port:1; |
1539 | |
1540 | uuid_t parent_flow_uuid; |
1541 | struct necp_demux_pattern demux_patterns[NECP_MAX_DEMUX_PATTERNS]; |
1542 | uint8_t demux_pattern_count; |
1543 | }; |
1544 | |
1545 | struct necp_client_group_members { |
1546 | size_t group_members_length; |
1547 | u_int8_t *group_members; |
1548 | }; |
1549 | |
1550 | struct necp_client_error_parameters { |
1551 | int32_t error; |
1552 | bool force_report; |
1553 | }; |
1554 | |
1555 | struct necp_client_agent_parameters { |
1556 | union { |
1557 | struct necp_client_nexus_parameters nexus_request; |
1558 | u_int8_t close_token[QUIC_STATELESS_RESET_TOKEN_SIZE]; |
1559 | struct necp_client_group_members group_members; |
1560 | struct necp_client_error_parameters error; |
1561 | } u; |
1562 | }; |
1563 | |
1564 | #define NECP_CLIENT_CBACTION_NONVIABLE 1 |
1565 | #define NECP_CLIENT_CBACTION_VIABLE 2 |
1566 | #define NECP_CLIENT_CBACTION_INITIAL 3 |
1567 | |
1568 | struct necp_client_add_flow_default { |
1569 | uuid_t agent_uuid; |
1570 | uuid_t registration_id; |
1571 | u_int16_t flags; // NECP_CLIENT_FLOW_FLAGS_* |
1572 | u_int16_t stats_request_count; |
1573 | struct necp_client_flow_stats stats_requests[1]; |
1574 | } __attribute__((__packed__)); |
1575 | |
1576 | typedef void (*necp_client_flow_cb)(void *handle, int action, uint32_t interface_index, uint32_t necp_flags, bool *viable); |
1577 | |
1578 | #if SKYWALK |
1579 | struct skmem_arena_mmap_info; |
1580 | |
1581 | extern pid_t necp_client_get_proc_pid_from_arena_info(struct skmem_arena_mmap_info *arena_info); |
1582 | |
1583 | extern void necp_client_early_close(uuid_t client_id); // Cause a single client to close stats, etc |
1584 | |
1585 | #endif /* SKYWALK */ |
1586 | |
1587 | #endif /* BSD_KERNEL_PRIVATE */ |
1588 | |
1589 | #ifdef KERNEL |
1590 | #ifdef KERNEL_PRIVATE |
1591 | struct nstat_domain_info; |
1592 | extern void necp_copy_inp_domain_info(struct inpcb *, struct socket *, struct nstat_domain_info *); |
1593 | extern void necp_with_inp_domain_name(struct socket *so, void *ctx, void (*with_func)(char *domain_name, void *ctx)); |
1594 | extern bool net_domain_contains_hostname(char *hostname_string, char *domain_string); |
1595 | #endif /* KERNEL_PRIVATE */ |
1596 | #endif /* KERNEL */ |
1597 | |
1598 | #ifndef KERNEL |
1599 | |
1600 | extern int necp_match_policy(const uint8_t *parameters, size_t parameters_size, struct necp_aggregate_result *returned_result); |
1601 | |
1602 | extern int necp_open(int flags); |
1603 | |
1604 | extern int necp_client_action(int necp_fd, uint32_t action, uuid_t client_id, |
1605 | size_t client_id_len, uint8_t *buffer, size_t buffer_size); |
1606 | |
1607 | extern int necp_session_open(int flags); |
1608 | |
1609 | extern int necp_session_action(int necp_fd, uint32_t action, |
1610 | uint8_t *in_buffer, size_t in_buffer_length, |
1611 | uint8_t *out_buffer, size_t out_buffer_length); |
1612 | |
1613 | #endif /* !KERNEL */ |
1614 | |
1615 | #endif /* PRIVATE */ |
1616 | |
1617 | #endif |
1618 | |