svc · unix #98
connect
Initiates a connection on a socket to the specified peer address.
Prototype
int connect(int s, caddr_t name, socklen_t namelen);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| s | int | - | |
| name | caddr_t | - | |
| namelen | socklen_t | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 98 |
| xnu-1486.2.11 | — | 98 |
| xnu-1504.15.3 | — | 98 |
| xnu-1504.3.12 | — | 98 |
| xnu-1504.7.4 | — | 98 |
| xnu-1504.9.17 | — | 98 |
| xnu-1504.9.26 | — | 98 |
| xnu-1504.9.37 | — | 98 |
Examples
Non-blocking TCP connect
int flags = fcntl(fd, F_GETFL, 0);
fcntl(fd, F_SETFL, flags | O_NONBLOCK);
int rc = connect(fd, (struct sockaddr *)&sa, sizeof(sa));
if (rc < 0 && errno != EINPROGRESS) perror("connect");Notes
On AF_INET/AF_INET6 connect() triggers route lookup, NECP policy evaluation, and (for TCP) the SYN exchange; the call blocks until established unless the socket is non-blocking. macOS forwards the (proc, sockaddr) tuple through necp_socket_find_policy_match, which can deny the flow, force it to a VPN/proxy tunnel, or attach it to a Skywalk channel. Sandboxed apps without 'network.client' get EPERM here even before any packet is emitted.
Detection
Endpoint Security exposes no connect() event. NEFilterDataProvider.handleNewFlow with an NEFilterSocketFlow is the supported tap and gives you (sourceAppIdentifier, remoteEndpoint, protocol). DTrace syscall::connect:entry works only on Intel or with SIP disabled.