/*

 * Copyright (c) 2013-2021 Apple Inc. All rights reserved.

 *

 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@

 *

 * This file contains Original Code and/or Modifications of Original Code

 * as defined in and that are subject to the Apple Public Source License

 * Version 2.0 (the 'License'). You may not use this file except in

 * compliance with the License. The rights granted to you under the License

 * may not be used to create, or enable the creation or redistribution of,

 * unlawful or unlicensed copies of an Apple operating system, or to

 * circumvent, violate, or enable the circumvention or violation of, any

 * terms of an Apple operating system software license agreement.

 *

 * Please obtain a copy of the License at

 * http://www.opensource.apple.com/apsl/ and read it before using this file.

 *

 * The Original Code and all software distributed under the License are

 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER

 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,

 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,

 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.

 * Please see the License for the specific language governing rights and

 * limitations under the License.

 *

 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@

 */

#include <string.h>

#include <sys/systm.h>

#include <sys/types.h>

#include <sys/queue.h>

#include <sys/malloc.h>

#include <sys/kernel.h>

#include <sys/kern_control.h>

#include <sys/mbuf.h>

#include <sys/kpi_mbuf.h>

#include <sys/proc_uuid_policy.h>

#include <net/if.h>

#include <sys/domain.h>

#include <sys/protosw.h>

#include <sys/socket.h>

#include <sys/socketvar.h>

#include <sys/coalition.h>

#include <sys/ubc.h>

#include <sys/codesign.h>

#include <kern/cs_blobs.h>

#include <netinet/ip.h>

#include <netinet/ip6.h>

#include <netinet/tcp.h>

#include <netinet/tcp_var.h>

#include <netinet/tcp_cache.h>

#include <netinet/udp.h>

#include <netinet/in_pcb.h>

#include <netinet/in_tclass.h>

#include <netinet6/esp.h>

#include <net/flowhash.h>

#include <net/if_var.h>

#include <sys/kauth.h>

#include <sys/sysctl.h>

#include <sys/sysproto.h>

#include <sys/priv.h>

#include <sys/kern_event.h>

#include <sys/file_internal.h>

#include <IOKit/IOBSD.h>

#include <libkern/crypto/rand.h>

#include <corecrypto/cchmac.h>

#include <corecrypto/ccsha2.h>

#include <os/refcnt.h>

#include <mach-o/loader.h>

#include <net/network_agent.h>

#include <net/necp.h>

#include <netinet/flow_divert_proto.h>

/*

 * NECP - Network Extension Control Policy database

 * ------------------------------------------------

 * The goal of this module is to allow clients connecting via a

 * policy file descriptor to create high-level policy sessions, which

 * are ingested into low-level kernel policies that control and tag

 * traffic at the application, socket, and IP layers.

 *

 * ------------------------------------------------

 * Sessions

 * ------------------------------------------------

 * Each session owns a list of session policies, each of which can

 * specify any combination of conditions and a single result. Each

 * session also has a priority level (such as High, Default, or Low)

 * which is requested by the client. Based on the requested level,

 * a session order value is assigned to the session, which will be used

 * to sort kernel policies generated by the session. The session client

 * can specify the sub-order for each policy it creates which will be

 * used to further sort the kernel policies.

 *

 *  Policy fd --> 1 necp_session --> list of necp_session_policy structs

 *

 * ------------------------------------------------

 * Kernel Policies

 * ------------------------------------------------

 * Whenever a session send the Apply command, its policies are ingested

 * and generate kernel policies. There are two phases of kernel policy

 * ingestion.

 *

 * 1. The session policy is parsed to create kernel policies at the socket

 *    and IP layers, when applicable. For example, a policy that requires

 *    all traffic from App1 to Pass will generate a socket kernel policy to

 *    match App1 and mark packets with ID1, and also an IP policy to match

 *    ID1 and let the packet pass. This is handled in necp_apply_policy. The

 *    resulting kernel policies are added to the global socket and IP layer

 *    policy lists.

 *  necp_session_policy --> necp_kernel_socket_policy and necp_kernel_ip_output_policy

 *                                      ||                             ||

 *                                      \/                             \/

 *                          necp_kernel_socket_policies   necp_kernel_ip_output_policies

 *

 * 2. Once the global lists of kernel policies have been filled out, each

 *    list is traversed to create optimized sub-lists ("Maps") which are used during

 *    data-path evaluation. IP policies are sent into necp_kernel_ip_output_policies_map,

 *    which hashes incoming packets based on marked socket-layer policies, and removes

 *    duplicate or overlapping policies. Socket policies are sent into two maps,

 *    necp_kernel_socket_policies_map and necp_kernel_socket_policies_app_layer_map.

 *    The app layer map is used for policy checks coming in from user space, and is one

 *    list with duplicate and overlapping policies removed. The socket map hashes based

 *    on app UUID, and removes duplicate and overlapping policies.

 *  necp_kernel_socket_policy --> necp_kernel_socket_policies_app_layer_map

 *                            |-> necp_kernel_socket_policies_map

 *

 *  necp_kernel_ip_output_policies --> necp_kernel_ip_output_policies_map

 *

 * ------------------------------------------------

 * Drop All Level

 * ------------------------------------------------

 * The Drop All Level is a sysctl that controls the level at which policies are allowed

 * to override a global drop rule. If the value is 0, no drop rule is applied. If the value

 * is 1, all traffic is dropped. If the value is greater than 1, all kernel policies created

 * by a session with a priority level better than (numerically less than) the

 * Drop All Level will allow matching traffic to not be dropped. The Drop All Level is

 * dynamically interpreted into necp_drop_all_order, which specifies the equivalent assigned

 * session orders to be dropped.

 */

u_int32_t necp_drop_all_order = 0;

u_int32_t necp_drop_all_level = 0;

u_int32_t necp_pass_loopback = NECP_LOOPBACK_PASS_ALL;

u_int32_t necp_pass_keepalives = 1; // 0=Off, 1=On

u_int32_t necp_pass_interpose = 1; // 0=Off, 1=On

u_int32_t necp_restrict_multicast = 1; // 0=Off, 1=On

u_int32_t necp_dedup_policies = 0; // 0=Off, 1=On

u_int32_t necp_drop_unentitled_order = 0;

#ifdef XNU_TARGET_OS_WATCH

u_int32_t necp_drop_unentitled_level = NECP_SESSION_PRIORITY_CONTROL + 1; // Block all unentitled traffic from policies below control level

#else // XNU_TARGET_OS_WATCH

u_int32_t necp_drop_unentitled_level = 0;

#endif // XNU_TARGET_OS_WATCH

u_int32_t necp_debug = 0; // 0=None, 1=Basic, 2=EveryMatch

os_log_t necp_log_handle = NULL;

u_int32_t necp_session_count = 0;

ZONE_DECLARE(necp_session_policy_zone, "necp_session_policy",

    sizeof(struct necp_session_policy), ZC_ZFREE_CLEARMEM | ZC_NOENCRYPT);

ZONE_DECLARE(necp_socket_policy_zone, "necp_socket_policy",

    sizeof(struct necp_kernel_socket_policy), ZC_ZFREE_CLEARMEM | ZC_NOENCRYPT);

ZONE_DECLARE(necp_ip_policy_zone, "necp_ip_policy",

    sizeof(struct necp_kernel_ip_output_policy), ZC_ZFREE_CLEARMEM | ZC_NOENCRYPT);

#define LIST_INSERT_SORTED_ASCENDING(head, elm, field, sortfield, tmpelm) do {          \

  if (LIST_EMPTY((head)) || (LIST_FIRST(head)->sortfield >= (elm)->sortfield)) {  \

          LIST_INSERT_HEAD((head), elm, field);                                                                           \

  } else {                                                                                                                                                \

          LIST_FOREACH(tmpelm, head, field) {                                                                                     \

                  if (LIST_NEXT(tmpelm, field) == NULL || LIST_NEXT(tmpelm, field)->sortfield >= (elm)->sortfield) {      \

                          LIST_INSERT_AFTER(tmpelm, elm, field);                                                          \

                          break;                                                                                                                          \

                  }                                                                                                                                               \

          }                                                                                                                                                       \

  }                                                                                                                                                               \

} while (0)

#define LIST_INSERT_SORTED_TWICE_ASCENDING(head, elm, field, firstsortfield, secondsortfield, tmpelm) do {      \

  if (LIST_EMPTY((head)) || (LIST_FIRST(head)->firstsortfield > (elm)->firstsortfield) || ((LIST_FIRST(head)->firstsortfield == (elm)->firstsortfield) && (LIST_FIRST(head)->secondsortfield >= (elm)->secondsortfield))) {                                                                                                               \

          LIST_INSERT_HEAD((head), elm, field);                                                                           \

  } else {                                                                                                                                                \

          LIST_FOREACH(tmpelm, head, field) {                                                                                     \

                  if (LIST_NEXT(tmpelm, field) == NULL || (LIST_NEXT(tmpelm, field)->firstsortfield > (elm)->firstsortfield) || ((LIST_NEXT(tmpelm, field)->firstsortfield == (elm)->firstsortfield) && (LIST_NEXT(tmpelm, field)->secondsortfield >= (elm)->secondsortfield))) {         \

                          LIST_INSERT_AFTER(tmpelm, elm, field);                                                          \

                          break;                                                                                                                          \

                  }                                                                                                                                               \

          }                                                                                                                                                       \

  }                                                                                                                                                               \

} while (0)

#define LIST_INSERT_SORTED_THRICE_ASCENDING(head, elm, field, firstsortfield, secondsortfield, thirdsortfield, tmpelm) do { \

  if (LIST_EMPTY((head)) || (LIST_FIRST(head)->firstsortfield > (elm)->firstsortfield) || ((LIST_FIRST(head)->firstsortfield == (elm)->firstsortfield) && (LIST_FIRST(head)->secondsortfield >= (elm)->secondsortfield)) || ((LIST_FIRST(head)->firstsortfield == (elm)->firstsortfield) && (LIST_FIRST(head)->secondsortfield == (elm)->secondsortfield) && (LIST_FIRST(head)->thirdsortfield >= (elm)->thirdsortfield))) {                                                                                                                      \

          LIST_INSERT_HEAD((head), elm, field);                                                                           \

  } else {                                                                                                                                                \

          LIST_FOREACH(tmpelm, head, field) {                                                                                     \

                  if (LIST_NEXT(tmpelm, field) == NULL || (LIST_NEXT(tmpelm, field)->firstsortfield > (elm)->firstsortfield) || ((LIST_NEXT(tmpelm, field)->firstsortfield == (elm)->firstsortfield) && (LIST_NEXT(tmpelm, field)->secondsortfield >= (elm)->secondsortfield)) || ((LIST_NEXT(tmpelm, field)->firstsortfield == (elm)->firstsortfield) && (LIST_NEXT(tmpelm, field)->secondsortfield == (elm)->secondsortfield) && (LIST_NEXT(tmpelm, field)->thirdsortfield >= (elm)->thirdsortfield))) { \

                          LIST_INSERT_AFTER(tmpelm, elm, field);                                                          \

                          break;                                                                                                                          \

                  }                                                                                                                                               \

          }                                                                                                                                                       \

  }                                                                                                                                                               \

} while (0)

#define IS_NECP_ROUTE_RULE_ALLOW_OR_DENY(x)     ((x) == NECP_ROUTE_RULE_DENY_INTERFACE || (x) == NECP_ROUTE_RULE_ALLOW_INTERFACE)

#define IS_NECP_DEST_IN_LOCAL_NETWORKS(rt) \

    ((rt) != NULL && !((rt)->rt_flags & RTF_GATEWAY) && ((rt)->rt_ifa && (rt)->rt_ifa->ifa_ifp && !((rt)->rt_ifa->ifa_ifp->if_flags & IFF_POINTOPOINT)))

#define NECP_KERNEL_CONDITION_ALL_INTERFACES            0x000001

#define NECP_KERNEL_CONDITION_BOUND_INTERFACE           0x000002

#define NECP_KERNEL_CONDITION_PROTOCOL                          0x000004

#define NECP_KERNEL_CONDITION_LOCAL_START                       0x000008

#define NECP_KERNEL_CONDITION_LOCAL_END                         0x000010

#define NECP_KERNEL_CONDITION_LOCAL_PREFIX                      0x000020

#define NECP_KERNEL_CONDITION_REMOTE_START                      0x000040

#define NECP_KERNEL_CONDITION_REMOTE_END                        0x000080

#define NECP_KERNEL_CONDITION_REMOTE_PREFIX                     0x000100

#define NECP_KERNEL_CONDITION_APP_ID                            0x000200

#define NECP_KERNEL_CONDITION_REAL_APP_ID                       0x000400

#define NECP_KERNEL_CONDITION_DOMAIN                            0x000800

#define NECP_KERNEL_CONDITION_ACCOUNT_ID                        0x001000

#define NECP_KERNEL_CONDITION_POLICY_ID                         0x002000

#define NECP_KERNEL_CONDITION_PID                                       0x004000

#define NECP_KERNEL_CONDITION_UID                                       0x008000

#define NECP_KERNEL_CONDITION_LAST_INTERFACE            0x010000                        // Only set from packets looping between interfaces

#define NECP_KERNEL_CONDITION_TRAFFIC_CLASS                     0x020000

#define NECP_KERNEL_CONDITION_ENTITLEMENT                       0x040000

#define NECP_KERNEL_CONDITION_CUSTOM_ENTITLEMENT        0x080000

#define NECP_KERNEL_CONDITION_AGENT_TYPE                        0x100000

#define NECP_KERNEL_CONDITION_HAS_CLIENT                        0x200000

#define NECP_KERNEL_CONDITION_LOCAL_NETWORKS                    0x400000

#define NECP_KERNEL_CONDITION_CLIENT_FLAGS                      0x800000

#define NECP_KERNEL_CONDITION_LOCAL_EMPTY                       0x1000000

#define NECP_KERNEL_CONDITION_REMOTE_EMPTY                      0x2000000

#define NECP_KERNEL_CONDITION_PLATFORM_BINARY                   0x4000000

#define NECP_KERNEL_CONDITION_SDK_VERSION                       0x8000000

#define NECP_KERNEL_CONDITION_SIGNING_IDENTIFIER                0x10000000

#define NECP_KERNEL_CONDITION_PACKET_FILTER_TAGS                0x20000000

#define NECP_KERNEL_CONDITION_IS_LOOPBACK                       0x40000000

#define NECP_KERNEL_CONDITION_DELEGATE_IS_PLATFORM_BINARY       0x80000000

#define NECP_MAX_POLICY_RESULT_SIZE                                     512

#define NECP_MAX_ROUTE_RULES_ARRAY_SIZE                         1024

#define NECP_MAX_CONDITIONS_ARRAY_SIZE                          4096

#define NECP_MAX_POLICY_LIST_COUNT                                      1024

typedef enum {

  NECP_BYPASS_TYPE_NONE = 0,

  NECP_BYPASS_TYPE_INTCOPROC = 1,

  NECP_BYPASS_TYPE_LOOPBACK = 2,

} necp_socket_bypass_type_t;

// Cap the policy size at the max result + conditions size, with room for extra TLVs

#define NECP_MAX_POLICY_SIZE                                            (1024 + NECP_MAX_POLICY_RESULT_SIZE + NECP_MAX_CONDITIONS_ARRAY_SIZE)

struct necp_service_registration {

  LIST_ENTRY(necp_service_registration)   session_chain;

  LIST_ENTRY(necp_service_registration)   kernel_chain;

  u_int32_t                                                               service_id;

};

struct necp_session {

  u_int8_t                                        necp_fd_type;

  u_int32_t                                       control_unit;

  u_int32_t                                       session_priority; // Descriptive priority rating

  u_int32_t                                       session_order;

  necp_policy_id                          last_policy_id;

  decl_lck_mtx_data(, lock);

  bool                                            proc_locked; // Messages must come from proc_uuid

  uuid_t                                          proc_uuid;

  int                                                     proc_pid;

  bool                                            dirty;

  LIST_HEAD(_policies, necp_session_policy) policies;

  LIST_HEAD(_services, necp_service_registration) services;

  TAILQ_ENTRY(necp_session) chain;

};

#define NECP_SESSION_LOCK(_s) lck_mtx_lock(&_s->lock)

#define NECP_SESSION_UNLOCK(_s) lck_mtx_unlock(&_s->lock)

static TAILQ_HEAD(_necp_session_list, necp_session) necp_session_list;

struct necp_socket_info {

  pid_t pid;

  int32_t pid_version;

  uid_t uid;

  union necp_sockaddr_union local_addr;

  union necp_sockaddr_union remote_addr;

  u_int32_t bound_interface_index;

  u_int32_t traffic_class;

  u_int16_t protocol;

  u_int32_t application_id;

  u_int32_t real_application_id;

  u_int32_t account_id;

  u_int32_t drop_order;

  u_int32_t client_flags;

  char *domain;

  errno_t cred_result;

  unsigned has_client : 1;

  unsigned is_platform_binary : 1;

  unsigned used_responsible_pid : 1;

  unsigned is_loopback : 1;

  unsigned real_is_platform_binary : 1;

  unsigned is_delegated : 1;

  unsigned __pad_bits : 6;

};

static  lck_grp_attr_t  *necp_kernel_policy_grp_attr    = NULL;

static  lck_attr_t              *necp_kernel_policy_mtx_attr    = NULL;

static  lck_grp_t               *necp_kernel_policy_mtx_grp             = NULL;

decl_lck_rw_data(static, necp_kernel_policy_lock);

static  lck_grp_attr_t  *necp_route_rule_grp_attr       = NULL;

static  lck_attr_t              *necp_route_rule_mtx_attr       = NULL;

static  lck_grp_t               *necp_route_rule_mtx_grp        = NULL;

decl_lck_rw_data(static, necp_route_rule_lock);

os_refgrp_decl(static, necp_refgrp, "NECPRefGroup", NULL);

/*

 * On modification, invalidate cached lookups by bumping the generation count.

 * Other calls will need to take the slowpath of taking

 * the subsystem lock.

 */

static volatile int32_t necp_kernel_socket_policies_gencount;

#define BUMP_KERNEL_SOCKET_POLICIES_GENERATION_COUNT() do {                                                     \

  if (OSIncrementAtomic(&necp_kernel_socket_policies_gencount) == (INT32_MAX - 1)) {      \

          necp_kernel_socket_policies_gencount = 1;                                                                               \

  }                                                                                                                                                               \

} while (0)

/*

 * Drop-all Bypass:

 * Allow priviledged processes to bypass the default drop-all

 * via entitlement check.  For OSX, since entitlement check is

 * not supported for configd, configd signing identity is checked

 * instead.

 */

#define SIGNING_ID_CONFIGD "com.apple.configd"

#define SIGNING_ID_CONFIGD_LEN (sizeof(SIGNING_ID_CONFIGD) - 1)

typedef enum {

  NECP_DROP_ALL_BYPASS_CHECK_RESULT_NONE = 0,

  NECP_DROP_ALL_BYPASS_CHECK_RESULT_TRUE = 1,

  NECP_DROP_ALL_BYPASS_CHECK_RESULT_FALSE = 2,

} necp_drop_all_bypass_check_result_t;

static u_int32_t necp_kernel_application_policies_condition_mask;

static size_t necp_kernel_application_policies_count;

static u_int32_t necp_kernel_socket_policies_condition_mask;

static size_t necp_kernel_socket_policies_count;

static size_t necp_kernel_socket_policies_non_app_count;

static LIST_HEAD(_necpkernelsocketconnectpolicies, necp_kernel_socket_policy) necp_kernel_socket_policies;

#define NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS 5

#define NECP_SOCKET_MAP_APP_ID_TO_BUCKET(appid) (appid ? (appid%(NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS - 1) + 1) : 0)

static struct necp_kernel_socket_policy **necp_kernel_socket_policies_map[NECP_KERNEL_SOCKET_POLICIES_MAP_NUM_APP_ID_BUCKETS];

static struct necp_kernel_socket_policy **necp_kernel_socket_policies_app_layer_map;

/*

 * A note on policy 'maps': these are used for boosting efficiency when matching policies. For each dimension of the map,

 * such as an ID, the 0 bucket is reserved for sockets/packets that do not have this parameter, while the other

 * buckets lead to an array of policy pointers that form the list applicable when the (parameter%(NUM_BUCKETS - 1) + 1) == bucket_index.

 *

 * For example, a packet with policy ID of 7, when there are 4 ID buckets, will map to bucket (7%3 + 1) = 2.

 */

static u_int32_t necp_kernel_ip_output_policies_condition_mask;

static size_t necp_kernel_ip_output_policies_count;

static size_t necp_kernel_ip_output_policies_non_id_count;

static LIST_HEAD(_necpkernelipoutputpolicies, necp_kernel_ip_output_policy) necp_kernel_ip_output_policies;

#define NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS 5

#define NECP_IP_OUTPUT_MAP_ID_TO_BUCKET(id) (id ? (id%(NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS - 1) + 1) : 0)

static struct necp_kernel_ip_output_policy **necp_kernel_ip_output_policies_map[NECP_KERNEL_IP_OUTPUT_POLICIES_MAP_NUM_ID_BUCKETS];

static struct necp_kernel_socket_policy pass_policy =

{

  .id = NECP_KERNEL_POLICY_ID_NO_MATCH,

  .result = NECP_KERNEL_POLICY_RESULT_PASS,

};

static struct necp_session *necp_create_session(void);

static void necp_delete_session(struct necp_session *session);

static necp_policy_id necp_handle_policy_add(struct necp_session *session,

    u_int8_t *tlv_buffer, size_t tlv_buffer_length, int offset, int *error);

static int necp_handle_policy_dump_all(user_addr_t out_buffer, size_t out_buffer_length);

#define MAX_RESULT_STRING_LEN 64

static inline const char * necp_get_result_description(char *result_string, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter);

static struct necp_session_policy *necp_policy_create(struct necp_session *session, necp_policy_order order, u_int8_t *conditions_array, u_int32_t conditions_array_size, u_int8_t *route_rules_array, u_int32_t route_rules_array_size, u_int8_t *result, u_int32_t result_size);

static struct necp_session_policy *necp_policy_find(struct necp_session *session, necp_policy_id policy_id);

static bool necp_policy_mark_for_deletion(struct necp_session *session, struct necp_session_policy *policy);

static bool necp_policy_mark_all_for_deletion(struct necp_session *session);

static bool necp_policy_delete(struct necp_session *session, struct necp_session_policy *policy);

static void necp_policy_apply_all(struct necp_session *session);

static necp_kernel_policy_id necp_kernel_socket_policy_add(necp_policy_order order, u_int32_t session_order, int session_pid, u_int32_t condition_mask, u_int32_t condition_negated_mask, necp_app_id cond_app_id, necp_app_id cond_real_app_id, char *cond_custom_entitlement, u_int32_t cond_account_id, char *domain, pid_t cond_pid, int32_t cond_pidversion, uid_t cond_uid, ifnet_t cond_bound_interface, struct necp_policy_condition_tc_range cond_traffic_class, u_int16_t cond_protocol, union necp_sockaddr_union *cond_local_start, union necp_sockaddr_union *cond_local_end, u_int8_t cond_local_prefix, union necp_sockaddr_union *cond_remote_start, union necp_sockaddr_union *cond_remote_end, u_int8_t cond_remote_prefix, struct necp_policy_condition_agent_type *cond_agent_type, struct necp_policy_condition_sdk_version *cond_sdk_version, u_int32_t cond_client_flags, char *cond_signing_identifier, u_int16_t cond_packet_filter_tags, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter);

static bool necp_kernel_socket_policy_delete(necp_kernel_policy_id policy_id);

static bool necp_kernel_socket_policies_reprocess(void);

static bool necp_kernel_socket_policies_update_uuid_table(void);

static inline struct necp_kernel_socket_policy *necp_socket_find_policy_match_with_info_locked(struct necp_kernel_socket_policy **policy_search_array, struct necp_socket_info *info, necp_kernel_policy_filter *return_filter, u_int32_t *return_route_rule_id_array, size_t *return_route_rule_id_array_count, size_t route_rule_id_array_count, necp_kernel_policy_result *return_service_action, necp_kernel_policy_service *return_service, u_int32_t *return_netagent_array, u_int32_t *return_netagent_use_flags_array, size_t netagent_array_count, struct necp_client_parameter_netagent_type *required_agent_types, u_int32_t num_required_agent_types, proc_t proc, u_int16_t pf_tag, necp_kernel_policy_id *skip_policy_id, struct rtentry *rt, necp_kernel_policy_result *return_drop_dest_policy_result, necp_drop_all_bypass_check_result_t *return_drop_all_bypass, u_int32_t *return_flow_divert_aggregate_unit);

static necp_kernel_policy_id necp_kernel_ip_output_policy_add(necp_policy_order order, necp_policy_order suborder, u_int32_t session_order, int session_pid, u_int32_t condition_mask, u_int32_t condition_negated_mask, necp_kernel_policy_id cond_policy_id, ifnet_t cond_bound_interface, u_int32_t cond_last_interface_index, u_int16_t cond_protocol, union necp_sockaddr_union *cond_local_start, union necp_sockaddr_union *cond_local_end, u_int8_t cond_local_prefix, union necp_sockaddr_union *cond_remote_start, union necp_sockaddr_union *cond_remote_end, u_int8_t cond_remote_prefix, u_int16_t cond_packet_filter_tags, necp_kernel_policy_result result, necp_kernel_policy_result_parameter result_parameter);

static bool necp_kernel_ip_output_policy_delete(necp_kernel_policy_id policy_id);

static bool necp_kernel_ip_output_policies_reprocess(void);

static bool necp_is_addr_in_range(struct sockaddr *addr, struct sockaddr *range_start, struct sockaddr *range_end);

static bool necp_is_range_in_range(struct sockaddr *inner_range_start, struct sockaddr *inner_range_end, struct sockaddr *range_start, struct sockaddr *range_end);

static bool necp_is_addr_in_subnet(struct sockaddr *addr, struct sockaddr *subnet_addr, u_int8_t subnet_prefix);

static int necp_addr_compare(struct sockaddr *sa1, struct sockaddr *sa2, int check_port);

static bool necp_buffer_compare_with_bit_prefix(u_int8_t *p1, u_int8_t *p2, u_int32_t bits);

static bool necp_addr_is_empty(struct sockaddr *addr);

static bool necp_is_loopback(struct sockaddr *local_addr, struct sockaddr *remote_addr, struct inpcb *inp, struct mbuf *packet, u_int32_t bound_interface_index);

static bool necp_is_intcoproc(struct inpcb *inp, struct mbuf *packet);

struct necp_uuid_id_mapping {

  LIST_ENTRY(necp_uuid_id_mapping) chain;

  uuid_t          uuid;

  u_int32_t       id;

  os_refcnt_t     refcount;

  u_int32_t       table_usecount; // Add to UUID policy table count

};

static size_t necp_num_uuid_app_id_mappings;

static bool necp_uuid_app_id_mappings_dirty;

#define NECP_UUID_APP_ID_HASH_SIZE 64

static u_long necp_uuid_app_id_hash_mask;

static u_long necp_uuid_app_id_hash_num_buckets;

static LIST_HEAD(necp_uuid_id_mapping_head, necp_uuid_id_mapping) * necp_uuid_app_id_hashtbl, necp_uuid_service_id_list; // App map is real hash table, service map is just mapping

#define APPUUIDHASH(uuid) (&necp_uuid_app_id_hashtbl[uuid[0] & necp_uuid_app_id_hash_mask]) // Assume first byte of UUIDs are evenly distributed

static u_int32_t necp_create_uuid_app_id_mapping(uuid_t uuid, bool *allocated_mapping, bool uuid_policy_table);

static bool necp_remove_uuid_app_id_mapping(uuid_t uuid, bool *removed_mapping, bool uuid_policy_table);

static struct necp_uuid_id_mapping *necp_uuid_lookup_uuid_with_app_id_locked(u_int32_t local_id);

static struct necp_uuid_id_mapping *necp_uuid_lookup_service_id_locked(uuid_t uuid);

static struct necp_uuid_id_mapping *necp_uuid_lookup_uuid_with_service_id_locked(u_int32_t local_id);

static u_int32_t necp_create_uuid_service_id_mapping(uuid_t uuid);

static bool necp_remove_uuid_service_id_mapping(uuid_t uuid);

static bool necp_remove_uuid_service_id_mapping_with_service_id(u_int32_t service_id);

struct necp_string_id_mapping {

  LIST_ENTRY(necp_string_id_mapping) chain;

  char            *string;

  necp_app_id     id;

  os_refcnt_t     refcount;

};

static LIST_HEAD(necp_string_id_mapping_list, necp_string_id_mapping) necp_account_id_list;

static u_int32_t necp_create_string_to_id_mapping(struct necp_string_id_mapping_list *list, char *domain);

static bool necp_remove_string_to_id_mapping(struct necp_string_id_mapping_list *list, char *domain);

static struct necp_string_id_mapping *necp_lookup_string_with_id_locked(struct necp_string_id_mapping_list *list, u_int32_t local_id);

static struct necp_kernel_socket_policy *necp_kernel_socket_policy_find(necp_kernel_policy_id policy_id);

static struct necp_kernel_ip_output_policy *necp_kernel_ip_output_policy_find(necp_kernel_policy_id policy_id);

static LIST_HEAD(_necp_kernel_service_list, necp_service_registration) necp_registered_service_list;

static char *necp_create_trimmed_domain(char *string, size_t length);

static inline int necp_count_dots(char *string, size_t length);

static char *necp_copy_string(char *string, size_t length);

static bool necp_update_qos_marking(struct ifnet *ifp, u_int32_t route_rule_id);

#define ROUTE_RULE_IS_AGGREGATE(ruleid) (ruleid > UINT16_MAX)

#define MAX_ROUTE_RULE_INTERFACES 10

struct necp_route_rule {

  LIST_ENTRY(necp_route_rule) chain;

  u_int32_t       id;

  u_int32_t       netagent_id;

  u_int8_t        default_action;

  u_int8_t        cellular_action;

  u_int8_t        wifi_action;

  u_int8_t        wired_action;

  u_int8_t        expensive_action;

  u_int8_t        constrained_action;

  u_int           exception_if_indices[MAX_ROUTE_RULE_INTERFACES];

  u_int8_t        exception_if_actions[MAX_ROUTE_RULE_INTERFACES];

  os_refcnt_t     refcount;

};

static LIST_HEAD(necp_route_rule_list, necp_route_rule) necp_route_rules;

static u_int32_t necp_create_route_rule(struct necp_route_rule_list *list, u_int8_t *route_rules_array, u_int32_t route_rules_array_size);

static bool necp_remove_route_rule(struct necp_route_rule_list *list, u_int32_t route_rule_id);

static bool necp_route_is_allowed(struct rtentry *route, ifnet_t interface, u_int32_t route_rule_id, u_int32_t *interface_type_denied);

static uint32_t necp_route_get_netagent(struct rtentry *route, u_int32_t route_rule_id);

static struct necp_route_rule *necp_lookup_route_rule_locked(struct necp_route_rule_list *list, u_int32_t route_rule_id);

static inline void necp_get_parent_cred_result(proc_t proc, struct necp_socket_info *info);

#define MAX_AGGREGATE_ROUTE_RULES 16

struct necp_aggregate_route_rule {

  LIST_ENTRY(necp_aggregate_route_rule) chain;

  u_int32_t       id;

  u_int32_t       rule_ids[MAX_AGGREGATE_ROUTE_RULES];

};

static LIST_HEAD(necp_aggregate_route_rule_list, necp_aggregate_route_rule) necp_aggregate_route_rules;

static u_int32_t necp_create_aggregate_route_rule(u_int32_t *rule_ids);

// Sysctl definitions

static int sysctl_handle_necp_level SYSCTL_HANDLER_ARGS;

static int sysctl_handle_necp_unentitled_level SYSCTL_HANDLER_ARGS;

SYSCTL_NODE(_net, OID_AUTO, necp, CTLFLAG_RW | CTLFLAG_LOCKED, 0, "NECP");

SYSCTL_INT(_net_necp, NECPCTL_DEDUP_POLICIES, dedup_policies, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_dedup_policies, 0, "");

SYSCTL_INT(_net_necp, NECPCTL_RESTRICT_MULTICAST, restrict_multicast, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_restrict_multicast, 0, "");

SYSCTL_INT(_net_necp, NECPCTL_PASS_LOOPBACK, pass_loopback, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_pass_loopback, 0, "");

SYSCTL_INT(_net_necp, NECPCTL_PASS_KEEPALIVES, pass_keepalives, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_pass_keepalives, 0, "");

SYSCTL_INT(_net_necp, NECPCTL_PASS_INTERPOSE, pass_interpose, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_pass_interpose, 0, "");

SYSCTL_INT(_net_necp, NECPCTL_DEBUG, debug, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_debug, 0, "");

SYSCTL_PROC(_net_necp, NECPCTL_DROP_UNENTITLED_LEVEL, drop_unentitled_level, CTLTYPE_INT | CTLFLAG_LOCKED | CTLFLAG_RW, &necp_drop_unentitled_level, 0, &sysctl_handle_necp_unentitled_level, "IU", "");

SYSCTL_PROC(_net_necp, NECPCTL_DROP_ALL_LEVEL, drop_all_level, CTLTYPE_INT | CTLFLAG_LOCKED | CTLFLAG_RW, &necp_drop_all_level, 0, &sysctl_handle_necp_level, "IU", "");

SYSCTL_LONG(_net_necp, NECPCTL_SOCKET_POLICY_COUNT, socket_policy_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_kernel_socket_policies_count, "");

SYSCTL_LONG(_net_necp, NECPCTL_SOCKET_NON_APP_POLICY_COUNT, socket_non_app_policy_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_kernel_socket_policies_non_app_count, "");

SYSCTL_LONG(_net_necp, NECPCTL_IP_POLICY_COUNT, ip_policy_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_kernel_ip_output_policies_count, "");

SYSCTL_INT(_net_necp, NECPCTL_SESSION_COUNT, session_count, CTLFLAG_LOCKED | CTLFLAG_RD, &necp_session_count, 0, "");

static struct necp_drop_dest_policy necp_drop_dest_policy;

static int necp_drop_dest_debug = 0;    // 0: off, 1: match, >1: every evaluation

SYSCTL_INT(_net_necp, OID_AUTO, drop_dest_debug, CTLFLAG_LOCKED | CTLFLAG_RW, &necp_drop_dest_debug, 0, "");

static int sysctl_handle_necp_drop_dest_level SYSCTL_HANDLER_ARGS;

SYSCTL_PROC(_net_necp, OID_AUTO, drop_dest_level, CTLTYPE_STRUCT | CTLFLAG_LOCKED | CTLFLAG_ANYBODY | CTLFLAG_RW,

    0, 0, &sysctl_handle_necp_drop_dest_level, "S,necp_drop_dest_level", "");

static bool necp_address_matches_drop_dest_policy(union necp_sockaddr_union *, u_int32_t);

// Session order allocation

static u_int32_t

necp_allocate_new_session_order(u_int32_t priority, u_int32_t control_unit)

{

  u_int32_t new_order = 0;

  // For now, just allocate 1000 orders for each priority

  if (priority == NECP_SESSION_PRIORITY_UNKNOWN || priority > NECP_SESSION_NUM_PRIORITIES) {

    priority = NECP_SESSION_PRIORITY_DEFAULT;

  }

  // Use the control unit to decide the offset into the priority list

  new_order = (control_unit) + ((priority - 1) * 1000);

  return new_order;

}

static inline u_int32_t

necp_get_first_order_for_priority(u_int32_t priority)

{

  if (priority == 0) {

    return 0;

  }

  return ((priority - 1) * 1000) + 1;

}

// Sysctl handler

static int

sysctl_handle_necp_level SYSCTL_HANDLER_ARGS

{

#pragma unused(arg1, arg2)

  int error = sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2, req);

  necp_drop_all_order = necp_get_first_order_for_priority(necp_drop_all_level);

  return error;

}

static int

sysctl_handle_necp_unentitled_level SYSCTL_HANDLER_ARGS

{

#pragma unused(arg1, arg2)

  int error = sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2, req);

  necp_drop_unentitled_order = necp_get_first_order_for_priority(necp_drop_unentitled_level);

  return error;

}

// Use a macro here to avoid computing the kauth_cred_t when necp_drop_unentitled_level is 0

static inline u_int32_t

_necp_process_drop_order_inner(kauth_cred_t cred)

{

  if (priv_check_cred(cred, PRIV_NET_PRIVILEGED_CLIENT_ACCESS, 0) != 0 &&

      priv_check_cred(cred, PRIV_NET_PRIVILEGED_SERVER_ACCESS, 0) != 0) {

    return necp_drop_unentitled_order;

  } else {

    return 0;

  }

}

#define necp_process_drop_order(_cred) (necp_drop_unentitled_order != 0 ? _necp_process_drop_order_inner(_cred) : necp_drop_unentitled_order)

#pragma GCC poison _necp_process_drop_order_inner

// Session fd

static int necp_session_op_close(struct fileglob *, vfs_context_t);

static const struct fileops necp_session_fd_ops = {

  .fo_type     = DTYPE_NETPOLICY,

  .fo_read     = fo_no_read,

  .fo_write    = fo_no_write,

  .fo_ioctl    = fo_no_ioctl,

  .fo_select   = fo_no_select,

  .fo_close    = necp_session_op_close,

  .fo_drain    = fo_no_drain,

  .fo_kqfilter = fo_no_kqfilter,

};

static inline int

necp_is_platform_binary(proc_t proc)

{

  return (proc != NULL) ? (csproc_get_platform_binary(proc) && cs_valid(proc)) : 0;

}

static inline necp_drop_all_bypass_check_result_t

necp_check_drop_all_bypass_result(proc_t proc)

{

  if (proc == NULL) {

    proc = current_proc();

    if (proc == NULL) {

      return NECP_DROP_ALL_BYPASS_CHECK_RESULT_FALSE;

    }

  }

#if defined(XNU_TARGET_OS_OSX)

  const char *signing_id = NULL;

  const bool isConfigd = (necp_is_platform_binary(proc) &&

      (signing_id = cs_identity_get(proc)) &&

      (strlen(signing_id) == SIGNING_ID_CONFIGD_LEN) &&

      (memcmp(signing_id, SIGNING_ID_CONFIGD, SIGNING_ID_CONFIGD_LEN) == 0));

  if (isConfigd) {

    return NECP_DROP_ALL_BYPASS_CHECK_RESULT_TRUE;

  }

#endif

  const task_t task = proc_task(proc);

  if (task == NULL || !IOTaskHasEntitlement(task, "com.apple.private.necp.drop_all_bypass")) {

    return NECP_DROP_ALL_BYPASS_CHECK_RESULT_FALSE;

  } else {

    return NECP_DROP_ALL_BYPASS_CHECK_RESULT_TRUE;

  }

}

int

necp_session_open(struct proc *p, struct necp_session_open_args *uap, int *retval)

{

#pragma unused(uap)

  int error = 0;

  struct necp_session *session = NULL;

  struct fileproc *fp = NULL;

  int fd = -1;

  uid_t uid = kauth_cred_getuid(kauth_cred_get());

  if (uid != 0 && priv_check_cred(kauth_cred_get(), PRIV_NET_PRIVILEGED_NECP_POLICIES, 0) != 0) {

    NECPLOG0(LOG_ERR, "Process does not hold necessary entitlement to open NECP session");

    error = EACCES;

    goto done;

  }

  error = falloc(p, &fp, &fd, vfs_context_current());

  if (error != 0) {

    goto done;

  }

  session = necp_create_session();

  if (session == NULL) {

    error = ENOMEM;

    goto done;

  }

  fp->fp_glob->fg_flag = 0;

  fp->fp_glob->fg_ops = &necp_session_fd_ops;

  fp->fp_glob->fg_data = session;

  proc_fdlock(p);

  FDFLAGS_SET(p, fd, (UF_EXCLOSE | UF_FORKCLOSE));

  procfdtbl_releasefd(p, fd, NULL);

  fp_drop(p, fd, fp, 1);

  proc_fdunlock(p);

  *retval = fd;

done:

  if (error != 0) {

    if (fp != NULL) {

      fp_free(p, fd, fp);

      fp = NULL;

    }

  }

  return error;

}

static int

necp_session_op_close(struct fileglob *fg, vfs_context_t ctx)

{

#pragma unused(ctx)

  struct necp_session *session = (struct necp_session *)fg->fg_data;

  fg->fg_data = NULL;

  if (session != NULL) {

    necp_policy_mark_all_for_deletion(session);

    necp_policy_apply_all(session);

    necp_delete_session(session);

    return 0;

  } else {

    return ENOENT;

  }

}

static int

necp_session_find_from_fd(struct proc *p, int fd,

    struct fileproc **fpp, struct necp_session **session)

{

  struct fileproc *fp = NULL;

  int error = fp_get_ftype(p, fd, DTYPE_NETPOLICY, ENODEV, &fp);

  if (error == 0) {

    *fpp = fp;

    *session = (struct necp_session *)fp->fp_glob->fg_data;

    if ((*session)->necp_fd_type != necp_fd_type_session) {

      // Not a client fd, ignore

      fp_drop(p, fd, fp, 0);

      error = EINVAL;

    }

  }

  return error;

}

static int

necp_session_add_policy(struct necp_session *session, struct necp_session_action_args *uap, int *retval)

{

  int error = 0;

  u_int8_t *tlv_buffer = NULL;

  if (uap->in_buffer_length == 0 || uap->in_buffer_length > NECP_MAX_POLICY_SIZE || uap->in_buffer == 0) {

    NECPLOG(LOG_ERR, "necp_session_add_policy invalid input (%zu)", (size_t)uap->in_buffer_length);

    error = EINVAL;

    goto done;

  }

  if (uap->out_buffer_length < sizeof(necp_policy_id) || uap->out_buffer == 0) {

    NECPLOG(LOG_ERR, "necp_session_add_policy invalid output buffer (%zu)", (size_t)uap->out_buffer_length);

    error = EINVAL;

    goto done;

  }

  if ((tlv_buffer = _MALLOC(uap->in_buffer_length, M_NECP, M_WAITOK | M_ZERO)) == NULL) {

    error = ENOMEM;

    goto done;

  }

  error = copyin(uap->in_buffer, tlv_buffer, uap->in_buffer_length);

  if (error != 0) {

    NECPLOG(LOG_ERR, "necp_session_add_policy tlv copyin error (%d)", error);

    goto done;

  }

  necp_policy_id new_policy_id = necp_handle_policy_add(session, tlv_buffer, uap->in_buffer_length, 0, &error);

  if (error != 0) {

    NECPLOG(LOG_ERR, "necp_session_add_policy failed to add policy (%d)", error);

    goto done;

  }

  error = copyout(&new_policy_id, uap->out_buffer, sizeof(new_policy_id));

  if (error != 0) {

    NECPLOG(LOG_ERR, "necp_session_add_policy policy_id copyout error (%d)", error);

    goto done;

  }

done:

  if (tlv_buffer != NULL) {

    FREE(tlv_buffer, M_NECP);

    tlv_buffer = NULL;

  }

  *retval = error;

  return error;

}

static int

necp_session_get_policy(struct necp_session *session, struct necp_session_action_args *uap, int *retval)

{

  int error = 0;

  u_int8_t *response = NULL;

  if (uap->in_buffer_length < sizeof(necp_policy_id) || uap->in_buffer == 0) {

    NECPLOG(LOG_ERR, "necp_session_get_policy invalid input (%zu)", (size_t)uap->in_buffer_length);

    error = EINVAL;

    goto done;

  }

  necp_policy_id policy_id = 0;

  error = copyin(uap->in_buffer, &policy_id, sizeof(policy_id));

  if (error != 0) {

    NECPLOG(LOG_ERR, "necp_session_get_policy policy_id copyin error (%d)", error);

    goto done;

  }

  struct necp_session_policy *policy = necp_policy_find(session, policy_id);

  if (policy == NULL || policy->pending_deletion) {

    NECPLOG(LOG_ERR, "Failed to find policy with id %d", policy_id);

    error = ENOENT;

    goto done;

  }

  u_int32_t order_tlv_size = sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(necp_policy_order);

  u_int32_t result_tlv_size = (policy->result_size ? (sizeof(u_int8_t) + sizeof(u_int32_t) + policy->result_size) : 0);

  u_int32_t response_size = order_tlv_size + result_tlv_size + policy->conditions_size;

  if (uap->out_buffer_length < response_size || uap->out_buffer == 0) {

    NECPLOG(LOG_ERR, "necp_session_get_policy buffer not large enough (%zu < %u)", (size_t)uap->out_buffer_length, response_size);

    error = EINVAL;

    goto done;

  }

  if (response_size > NECP_MAX_POLICY_SIZE) {

    NECPLOG(LOG_ERR, "necp_session_get_policy size too large to copy (%u)", response_size);

    error = EINVAL;

    goto done;

  }

  MALLOC(response, u_int8_t *, response_size, M_NECP, M_WAITOK | M_ZERO);

  if (response == NULL) {

    error = ENOMEM;

    goto done;

  }

  u_int8_t *cursor = response;

  cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_ORDER, sizeof(necp_policy_order), &policy->order, response, response_size);

  if (result_tlv_size) {

    cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_RESULT, policy->result_size, &policy->result, response, response_size);

  }

  if (policy->conditions_size) {

    memcpy(((u_int8_t *)(void *)(cursor)), policy->conditions, policy->conditions_size);

  }

  error = copyout(response, uap->out_buffer, response_size);

  if (error != 0) {

    NECPLOG(LOG_ERR, "necp_session_get_policy TLV copyout error (%d)", error);

    goto done;

  }

done:

  if (response != NULL) {

    FREE(response, M_NECP);

    response = NULL;

  }

  *retval = error;

  return error;

}

static int

necp_session_delete_policy(struct necp_session *session, struct necp_session_action_args *uap, int *retval)

{

  int error = 0;

  if (uap->in_buffer_length < sizeof(necp_policy_id) || uap->in_buffer == 0) {

    NECPLOG(LOG_ERR, "necp_session_delete_policy invalid input (%zu)", (size_t)uap->in_buffer_length);

    error = EINVAL;

    goto done;

  }

  necp_policy_id delete_policy_id = 0;

  error = copyin(uap->in_buffer, &delete_policy_id, sizeof(delete_policy_id));

  if (error != 0) {

    NECPLOG(LOG_ERR, "necp_session_delete_policy policy_id copyin error (%d)", error);

    goto done;

  }

  struct necp_session_policy *policy = necp_policy_find(session, delete_policy_id);

  if (policy == NULL || policy->pending_deletion) {

    NECPLOG(LOG_ERR, "necp_session_delete_policy failed to find policy with id %u", delete_policy_id);

    error = ENOENT;

    goto done;

  }

  necp_policy_mark_for_deletion(session, policy);

done:

  *retval = error;

  return error;

}

static int

necp_session_apply_all(struct necp_session *session, struct necp_session_action_args *uap, int *retval)

{

#pragma unused(uap)

  necp_policy_apply_all(session);

  *retval = 0;

  return 0;

}

static int

necp_session_list_all(struct necp_session *session, struct necp_session_action_args *uap, int *retval)

{

  u_int32_t tlv_size = (sizeof(u_int8_t) + sizeof(u_int32_t) + sizeof(necp_policy_id));

  u_int32_t response_size = 0;

  u_int8_t *response = NULL;

  int num_policies = 0;

  int cur_policy_index = 0;

  int error = 0;

  struct necp_session_policy *policy;

  LIST_FOREACH(policy, &session->policies, chain) {

    if (!policy->pending_deletion) {

      num_policies++;

    }

  }

  if (num_policies > NECP_MAX_POLICY_LIST_COUNT) {

    NECPLOG(LOG_ERR, "necp_session_list_all size too large to copy (%u policies)", num_policies);

    error = EINVAL;

    goto done;

  }

  response_size = num_policies * tlv_size;

  if (uap->out_buffer_length < response_size || uap->out_buffer == 0) {

    NECPLOG(LOG_ERR, "necp_session_list_all buffer not large enough (%zu < %u)", (size_t)uap->out_buffer_length, response_size);

    error = EINVAL;

    goto done;

  }

  // Create a response with one Policy ID TLV for each policy

  MALLOC(response, u_int8_t *, response_size, M_NECP, M_WAITOK | M_ZERO);

  if (response == NULL) {

    error = ENOMEM;

    goto done;

  }

  u_int8_t *cursor = response;

  LIST_FOREACH(policy, &session->policies, chain) {

    if (!policy->pending_deletion && cur_policy_index < num_policies) {

      cursor = necp_buffer_write_tlv(cursor, NECP_TLV_POLICY_ID, sizeof(u_int32_t), &policy->local_id, response, response_size);

      cur_policy_index++;

    }

  }

  error = copyout(response, uap->out_buffer, response_size);

  if (error != 0) {

    NECPLOG(LOG_ERR, "necp_session_list_all TLV copyout error (%d)", error);

    goto done;

  }

done:

  if (response != NULL) {

    FREE(response, M_NECP);

    response = NULL;

  }