1 /*
2 * Copyright (c) 2021 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #include <stdbool.h>
30
31 #include <sys/systm.h>
32 #include <sys/sysctl.h>
33 #include <sys/sbuf.h>
34 #include <sys/types.h>
35 #include <sys/mcache.h>
36 #include <sys/malloc.h>
37
38 #include <os/log.h>
39
40 #include <net/nwk_wq.h>
41 #include <skywalk/lib/net_filter_event.h>
42
43 static uint32_t net_filter_event_state;
44 static bool net_filter_event_initialized;
45 static struct eventhandler_lists_ctxt net_filter_evhdlr_ctxt;
46
47 EVENTHANDLER_DECLARE(net_filter_event, net_filter_event_callback_t);
48
49 static struct sbuf *
net_filter_event_description(uint32_t state)50 net_filter_event_description(uint32_t state)
51 {
52 struct sbuf *sbuf;
53
54 sbuf = sbuf_new(NULL, NULL, 128, SBUF_AUTOEXTEND);
55 if (state & NET_FILTER_EVENT_PF) {
56 sbuf_cat(sbuf, "pf ");
57 }
58 if (state & NET_FILTER_EVENT_SOCKET) {
59 sbuf_cat(sbuf, "socket ");
60 }
61 if (state & NET_FILTER_EVENT_INTERFACE) {
62 sbuf_cat(sbuf, "interface ");
63 }
64 if (state & NET_FILTER_EVENT_IP) {
65 sbuf_cat(sbuf, "ip ");
66 }
67 if (state & NET_FILTER_EVENT_ALF) {
68 sbuf_cat(sbuf, "application-firewall ");
69 }
70 if (state & NET_FILTER_EVENT_PARENTAL_CONTROLS) {
71 sbuf_cat(sbuf, "parental-controls ");
72 }
73 sbuf_trim(sbuf);
74 sbuf_finish(sbuf);
75
76 return sbuf;
77 }
78
79
80 static void
net_filter_event_callback(struct eventhandler_entry_arg arg0 __unused,enum net_filter_event_subsystems state)81 net_filter_event_callback(struct eventhandler_entry_arg arg0 __unused,
82 enum net_filter_event_subsystems state)
83 {
84 struct sbuf *sbuf = net_filter_event_description(state);
85
86 os_log(OS_LOG_DEFAULT, "net_filter_event: new state (0x%x) %s",
87 state, sbuf_data(sbuf));
88 sbuf_delete(sbuf);
89 }
90
91 static void
net_filter_event_init(void)92 net_filter_event_init(void)
93 {
94 if (net_filter_event_initialized) {
95 return;
96 }
97 net_filter_event_initialized = true;
98 eventhandler_lists_ctxt_init(&net_filter_evhdlr_ctxt);
99 net_filter_event_register(net_filter_event_callback);
100 }
101
102 static void
net_filter_event_enqueue_callback(struct nwk_wq_entry * nwk_kwqe)103 net_filter_event_enqueue_callback(struct nwk_wq_entry *nwk_kwqe)
104 {
105 EVENTHANDLER_INVOKE(&net_filter_evhdlr_ctxt, net_filter_event,
106 net_filter_event_state);
107 kfree_type(struct nwk_wq_entry, nwk_kwqe);
108 }
109
110 static void
net_filter_event_enqueue(void)111 net_filter_event_enqueue(void)
112 {
113 struct nwk_wq_entry *nwk_wqe;
114
115 nwk_wqe = kalloc_type(struct nwk_wq_entry, Z_WAITOK | Z_ZERO | Z_NOFAIL);
116 nwk_wqe->func = net_filter_event_enqueue_callback;
117 nwk_wq_enqueue(nwk_wqe);
118 }
119
120 void
net_filter_event_mark(enum net_filter_event_subsystems subsystem,bool compatible)121 net_filter_event_mark(enum net_filter_event_subsystems subsystem, bool compatible)
122 {
123 uint32_t old_state = net_filter_event_state;
124
125 net_filter_event_init();
126 if (!compatible) {
127 os_atomic_or(&net_filter_event_state, subsystem, relaxed);
128 } else {
129 os_atomic_andnot(&net_filter_event_state, subsystem, relaxed);
130 }
131 if (old_state != net_filter_event_state) {
132 net_filter_event_enqueue();
133 }
134 }
135
136 enum net_filter_event_subsystems
net_filter_event_get_state(void)137 net_filter_event_get_state(void)
138 {
139 return net_filter_event_state;
140 }
141
142 void
net_filter_event_register(net_filter_event_callback_t callback)143 net_filter_event_register(net_filter_event_callback_t callback)
144 {
145 net_filter_event_init();
146 eventhandler_register(&net_filter_evhdlr_ctxt, NULL,
147 "net_filter_event",
148 ptrauth_nop_cast(void *, callback),
149 eventhandler_entry_dummy_arg,
150 EVENTHANDLER_PRI_ANY);
151 }
152
153
154 static int
net_filter_event_sysctl(struct sysctl_oid * oidp,void * arg1,int arg2,struct sysctl_req * req)155 net_filter_event_sysctl(struct sysctl_oid *oidp, void *arg1, int arg2,
156 struct sysctl_req *req)
157 {
158 #pragma unused(oidp, arg1, arg2)
159 struct sbuf *sbuf = net_filter_event_description(net_filter_event_state);
160
161 int error = sysctl_io_string(req, sbuf_data(sbuf), 0, 0, NULL);
162 sbuf_delete(sbuf);
163
164 return error;
165 }
166
167 SYSCTL_PROC(_net, OID_AUTO, filter_state,
168 CTLTYPE_STRING | CTLFLAG_LOCKED, NULL, 0,
169 net_filter_event_sysctl, "A", "State of the network filters");
170