Documentation
¶
Overview ¶
Package shared holds the models, constants, and XPC protocol descriptors used by both the Warden network-extension daemon and the controlling app — mirroring Warden's Shared/ directory (Rule, consts, XPCDaemonProto, XPCUserProto).
Index ¶
Constants ¶
const ( RuleDurationAlways = 101 RuleDurationOnce = 102 RuleDurationProcess = 103 RuleDurationCustom = 104 )
Rule durations (how long a rule persists).
const ( DaemonProtocolName = "WardenDaemonProtocol" UserProtocolName = "WardenUserProtocol" )
Protocol names for the runtime-built ObjC protocols used over NSXPCConnection.
const DaemonMachServiceName = "com.example.warden.daemon"
DaemonMachServiceName is the registered mach service the daemon vends and the app connects to. A real deployment uses a team-prefixed name matching the extension's NEMachServiceName entitlement.
Variables ¶
This section is empty.
Functions ¶
func BytesToNSData ¶ added in v0.13.0
BytesToNSData builds an NSData that copies b. An empty b yields an empty NSData (+[NSData data]) rather than nil, which XPC reply blocks expect.
func ClassID ¶ added in v0.13.0
ClassID returns an ObjC class object as an ID for class-method dispatch (e.g. ClassID("NSData") to send +dataWithBytes:length:). Both the app and the extension marshal NSData over XPC, so these helpers live here rather than being copied into each side.
func DaemonProtocol ¶
func DaemonProtocol() rt.XPCProtocol
DaemonProtocol describes the daemon-side XPC interface (Warden's XPCDaemonProto): the app sends these to the extension's remote-object proxy. Reply-bearing methods carry their result in a reply block; fire-and-forget mutators do not.
func NSDataBytes ¶ added in v0.13.0
NSDataBytes copies an NSData's bytes into a freshly allocated Go slice, so the result stays valid after the NSData is released. A nil or empty NSData yields nil.
func UserProtocol ¶
func UserProtocol() rt.XPCProtocol
UserProtocol describes the app-side XPC interface (Warden's XPCUserProto): the daemon sends these to the app's exported object — a rules-changed notification and an alert that expects the user's decision in its reply.
Types ¶
type EndpointType ¶
type EndpointType int
EndpointType classifies how a rule's endpoint address is matched.
const ( EndpointTypeExact EndpointType = 0 EndpointTypeRegex EndpointType = 1 EndpointTypeCIDR EndpointType = 2 )
type Rule ¶
type Rule struct {
UUID string `json:"uuid"`
// Key is the process identity the rule is filed under — the signing identifier
// when code-signed, otherwise the binary path.
Key string `json:"key"`
// Process identity.
Path string `json:"path"`
Name string `json:"name,omitempty"`
IsGlobal bool `json:"isGlobal,omitempty"`
IsDirectory bool `json:"isDirectory,omitempty"`
// Endpoint match. Empty EndpointAddr means "any endpoint".
EndpointAddr string `json:"endpointAddr,omitempty"`
EndpointPort string `json:"endpointPort,omitempty"`
EndpointType EndpointType `json:"endpointType,omitempty"`
// Verdict + lifecycle.
Action RuleState `json:"action"` // RuleStateAllow / RuleStateBlock
Type int `json:"type,omitempty"`
Protocol int `json:"protocol,omitempty"`
IsDisabled bool `json:"isDisabled,omitempty"`
Creation time.Time `json:"creation"`
Expiration *time.Time `json:"expiration,omitempty"`
// Managed marks rules that originate from the declarative config (provenance,
// e.g. for display). Reconciliation is authoritative and prunes any rule not
// in the config regardless of this flag, so it is not a safety gate.
Managed bool `json:"managed,omitempty"`
}
Rule is a firewall rule, mirroring Warden's Shared/Rule. It is JSON-serializable so the daemon can persist the rule set to disk and ship it to the app over XPC (Warden uses NSData / NSKeyedArchiver; a Go port uses JSON for the same purpose).
Source Files