Documentation
¶
Overview ¶
Package shared holds the models, constants, and XPC protocol descriptors used by both the Warden network-extension daemon and the controlling app — mirroring Warden's Shared/ directory (Rule, consts, XPCDaemonProto, XPCUserProto).
Index ¶
Constants ¶
const ( RuleStateNotFound = -1 // no matching rule RuleStateBlock = 0 // deny the flow RuleStateAllow = 1 // permit the flow )
Rule states: the verdict a rule encodes for a flow.
const ( RuleDurationAlways = 101 RuleDurationOnce = 102 RuleDurationProcess = 103 RuleDurationCustom = 104 )
Rule durations (how long a rule persists).
const ( DaemonProtocolName = "WardenDaemonProtocol" UserProtocolName = "WardenUserProtocol" )
Protocol names for the runtime-built ObjC protocols used over NSXPCConnection.
const DaemonMachServiceName = "com.example.warden.daemon"
DaemonMachServiceName is the registered mach service the daemon vends and the app connects to. A real deployment uses a team-prefixed name matching the extension's NEMachServiceName entitlement.
Variables ¶
This section is empty.
Functions ¶
func DaemonProtocol ¶
func DaemonProtocol() rt.XPCProtocol
DaemonProtocol describes the daemon-side XPC interface (Warden's XPCDaemonProto): the app sends these to the extension's remote-object proxy. Reply-bearing methods carry their result in a reply block; fire-and-forget mutators do not.
func UserProtocol ¶
func UserProtocol() rt.XPCProtocol
UserProtocol describes the app-side XPC interface (Warden's XPCUserProto): the daemon sends these to the app's exported object — a rules-changed notification and an alert that expects the user's decision in its reply.
Types ¶
type EndpointType ¶
type EndpointType int
EndpointType classifies how a rule's endpoint address is matched.
const ( EndpointTypeExact EndpointType = 0 EndpointTypeRegex EndpointType = 1 EndpointTypeCIDR EndpointType = 2 )
type Rule ¶
type Rule struct {
UUID string `json:"uuid"`
// Key is the process identity the rule is filed under — the signing identifier
// when code-signed, otherwise the binary path.
Key string `json:"key"`
// Process identity.
Path string `json:"path"`
Name string `json:"name,omitempty"`
IsGlobal bool `json:"isGlobal,omitempty"`
IsDirectory bool `json:"isDirectory,omitempty"`
// Endpoint match. Empty EndpointAddr means "any endpoint".
EndpointAddr string `json:"endpointAddr,omitempty"`
EndpointHost string `json:"endpointHost,omitempty"`
EndpointPort string `json:"endpointPort,omitempty"`
EndpointType EndpointType `json:"endpointType,omitempty"`
// Verdict + lifecycle.
Action int `json:"action"` // RuleStateAllow / RuleStateBlock
Type int `json:"type,omitempty"`
Protocol int `json:"protocol,omitempty"`
IsDisabled bool `json:"isDisabled,omitempty"`
Creation time.Time `json:"creation"`
Expiration *time.Time `json:"expiration,omitempty"`
// Managed marks rules that originate from the declarative config (provenance,
// e.g. for display). Reconciliation is authoritative and prunes any rule not
// in the config regardless of this flag, so it is not a safety gate.
Managed bool `json:"managed,omitempty"`
}
Rule is a firewall rule, mirroring Warden's Shared/Rule. It is JSON-serializable so the daemon can persist the rule set to disk and ship it to the app over XPC (Warden uses NSData / NSKeyedArchiver; a Go port uses JSON for the same purpose).
Source Files