macos-l4: sysext-owned MITM CA, SE-encrypted, XPC-rotated

Cargo.toml

@@ -19,6 +19,7 @@ rust-version = "1.93"
 [workspace.dependencies]
 apple-native-keyring-store = "0.2"
 arc-swap = "1.9"
+base64 = "0.22"
 bindgen = "0.71"
 clap = { version = "4.6" }
 humantime = "2.3"

docs/proxy/l4_proxy/apple.md

@@ -245,6 +245,7 @@ Export recent logs to a file for sharing or later analysis:
 
 ```bash
 mkdir -p .aikido/logs
+ts=$(date +%Y%m%dT%H%M%S)
 log show --last 30m --style compact --debug --info \
 --predicate 'subsystem == "com.aikido.endpoint.proxy.l4"
   OR process == "com.aikido.endpoint.proxy.l4.dev.extension"

justfile

@@ -215,10 +215,14 @@ macos-l4-log-stream:
         OR process == "com.aikido.endpoint.proxy.l4.dev.extension" \
         OR process == "Aikido Network Extension"'
 
+
+macos-l4-cli *ARGS:
+    "{{xcode_l4_installed_app_exe}}" {{ARGS}}
+
 macos-l4-start *ARGS:
-    "{{xcode_l4_installed_app_exe}}" start {{ARGS}}
+    just macos-l4-cli start {{ARGS}}
     @for i in $(seq 1 120); do \
-        status="$("{{xcode_l4_installed_app_exe}}" status | sed -n 's/^status: //p')"; \
+        status="$(just macos-l4-cli status | sed -n 's/^status: //p')"; \
         echo "$i) status: $status"; \
         case "$status" in \
             connected) \
@@ -229,13 +233,13 @@ macos-l4-start *ARGS:
         sleep 0.5; \
     done; \
     echo "timed out waiting for macOS L4 proxy to become active" >&2; \
-    "{{xcode_l4_installed_app_exe}}" status; \
+    just macos-l4-cli status; \
     exit 1
 
 macos-l4-stop:
-    "{{xcode_l4_installed_app_exe}}" stop
+    just macos-l4-cli stop
     @for i in $(seq 1 120); do \
-        status="$("{{xcode_l4_installed_app_exe}}" status | sed -n 's/^status: //p')"; \
+        status="$(just macos-l4-cli status | sed -n 's/^status: //p')"; \
         echo "$i) status: $status"; \
         case "$status" in \
             disconnected) \

packaging/macos/scripts/uninstall

@@ -48,7 +48,12 @@ if [ -x "$L4_HOST" ]; then
     if [ "$UPGRADE_MODE" = true ]; then
         "$L4_HOST" stop 2>/dev/null && echo "  ✓ L4 Proxy stopped" || echo "  L4 Proxy not running"
     else
-        "$L4_HOST" stop --clean-secrets --remove-profile --deactivate-extension 2>/dev/null && echo "  ✓ L4 Proxy stopped" || echo "  L4 Proxy not running"
+        if "$L4_HOST" stop --remove-profile --deactivate-extension 2>/dev/null; then
+            echo "  ✓ L4 Proxy stopped"
+        else
+            echo "  L4 Proxy not running"
+        fi
+        "$L4_HOST" delete-ca-crt 2>/dev/null || true
     fi
 fi
 

packaging/macos/xcode/l4-proxy/Extension/Extension.entitlements

@@ -6,11 +6,9 @@
 	<array>
 		<string>app-proxy-provider$(NE_ENTITLEMENT_SUFFIX)</string>
 	</array>
-	<key>com.apple.security.app-sandbox</key>
-	<true/>
-	<key>keychain-access-groups</key>
+	<key>com.apple.security.application-groups</key>
 	<array>
-		<string>$(AppIdentifierPrefix)$(AIKIDO_L4_SHARED_ACCESS_GROUP_BUNDLE_ID)</string>
+		<string>$(APP_GROUP_ID)</string>
 	</array>
 	<key>com.apple.security.network.client</key>
 	<true/>

packaging/macos/xcode/l4-proxy/Extension/Info.plist

@@ -25,6 +25,8 @@
       <key>com.apple.networkextension.app-proxy</key>
       <string>RamaAppleNetworkExtension.RamaTransparentProxyProvider</string>
     </dict>
+    <key>NEMachServiceName</key>
+    <string>$(APP_GROUP_ID).aikido-l4-xpc</string>
   </dict>
 </dict>
 </plist>

packaging/macos/xcode/l4-proxy/Host/Host.entitlements

@@ -8,8 +8,19 @@
 	</array>
 	<key>com.apple.developer.system-extension.install</key>
 	<true/>
-	<key>com.apple.security.app-sandbox</key>
-	<true/>
+	<key>com.apple.security.application-groups</key>
+	<array>
+		<string>$(APP_GROUP_ID)</string>
+	</array>
+	<!--
+	  DEPRECATED — graceful-period only. Pre-PR builds wrote the MITM CA
+	  to the data-protection keychain under this access group. Without the
+	  entitlement, the host CLI cannot see those items even though they are
+	  still physically present, which silently breaks the legacy passthrough
+	  in `start` and the cleanup in `cleanup-legacy-ca-crt` / `delete-ca-crt`.
+	  Drop this entitlement together with the legacy lookup/delete code in
+	  Host/main.swift once the graceful period ends.
+	-->
 	<key>keychain-access-groups</key>
 	<array>
 		<string>$(AppIdentifierPrefix)$(AIKIDO_L4_SHARED_ACCESS_GROUP_BUNDLE_ID)</string>

packaging/macos/xcode/l4-proxy/Host/Info.plist

@@ -22,5 +22,7 @@
 	<string>$(AIKIDO_L4_EXTENSION_BUNDLE_ID)</string>
 	<key>AikidoL4SharedAccessGroup</key>
 	<string>$(AppIdentifierPrefix)$(AIKIDO_L4_SHARED_ACCESS_GROUP_BUNDLE_ID)</string>
+	<key>AikidoL4ProviderMachServiceName</key>
+	<string>$(APP_GROUP_ID).aikido-l4-xpc</string>
 </dict>
 </plist>

packaging/macos/xcode/l4-proxy/Host/RamaTproxyXpcRoutes.swift

@@ -0,0 +1,30 @@
+import Foundation
+import RamaAppleXpcClient
+
+/// Typed XPC routes exposed by the L4 sysext's router in
+/// `proxy-lib-l4-macos/src/xpc_server.rs`. Selectors, field names, and
+/// shapes must stay in sync with the Rust `serde` types on each route.
+
+enum AikidoL4GenerateCaCrt: RamaXpcRoute {
+    static let selector = "generateCaCrt:withReply:"
+    typealias Reply = AikidoL4CaCommandReply
+}
+
+enum AikidoL4CommitCaCrt: RamaXpcRoute {
+    static let selector = "commitCaCrt:withReply:"
+    typealias Reply = AikidoL4CaCommandReply
+}
+
+/// Shared reply for `generateCaCrt` / `commitCaCrt` (matches Rust
+/// `CaCommandReply`).
+///
+/// - `generateCaCrt`: `cert_der_b64` carries the freshly-minted (pending)
+///   CA certificate so callers can install trust before committing.
+/// - `commitCaCrt`: `cert_der_b64` carries the *previous* active CA, so
+///   callers can drop its trust. Absent when there was nothing to displace
+///   (first-ever commit).
+struct AikidoL4CaCommandReply: Decodable {
+    let ok: Bool
+    let error: String?
+    let cert_der_b64: String?
+}