1 /*
2 * Copyright (c) 2021 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #include <stdbool.h>
30
31 #include <sys/systm.h>
32 #include <sys/sysctl.h>
33 #include <sys/sbuf.h>
34 #include <sys/types.h>
35 #include <sys/mcache.h>
36 #include <sys/malloc.h>
37
38 #include <os/log.h>
39
40 #include <net/nwk_wq.h>
41 #include <skywalk/lib/net_filter_event.h>
42
43 static uint32_t net_filter_event_state;
44 static bool net_filter_event_initialized;
45 static struct eventhandler_lists_ctxt net_filter_evhdlr_ctxt;
46
47 EVENTHANDLER_DECLARE(net_filter_event, net_filter_event_callback_t);
48
49 static struct sbuf *
net_filter_event_description(uint32_t state)50 net_filter_event_description(uint32_t state)
51 {
52 struct sbuf *sbuf;
53
54 sbuf = sbuf_new(NULL, NULL, 128, SBUF_AUTOEXTEND);
55 if (state & NET_FILTER_EVENT_PF) {
56 sbuf_cat(sbuf, "pf ");
57 }
58 if (state & NET_FILTER_EVENT_SOCKET) {
59 sbuf_cat(sbuf, "socket ");
60 }
61 if (state & NET_FILTER_EVENT_INTERFACE) {
62 sbuf_cat(sbuf, "interface ");
63 }
64 if (state & NET_FILTER_EVENT_IP) {
65 sbuf_cat(sbuf, "ip ");
66 }
67 if (state & NET_FILTER_EVENT_ALF) {
68 sbuf_cat(sbuf, "application-firewall ");
69 }
70 if (state & NET_FILTER_EVENT_PARENTAL_CONTROLS) {
71 sbuf_cat(sbuf, "parental-controls ");
72 }
73 sbuf_trim(sbuf);
74 sbuf_finish(sbuf);
75
76 return sbuf;
77 }
78
79
80 static void
net_filter_event_callback(struct eventhandler_entry_arg arg0 __unused,uint32_t state)81 net_filter_event_callback(struct eventhandler_entry_arg arg0 __unused,
82 uint32_t state)
83 {
84 struct sbuf *sbuf = net_filter_event_description(state);
85
86 os_log(OS_LOG_DEFAULT, "net_filter_event: new state (0x%x) %s",
87 state, sbuf_data(sbuf));
88 sbuf_delete(sbuf);
89 }
90
91 static void
net_filter_event_init(void)92 net_filter_event_init(void)
93 {
94 if (net_filter_event_initialized) {
95 return;
96 }
97 net_filter_event_initialized = true;
98 eventhandler_lists_ctxt_init(&net_filter_evhdlr_ctxt);
99 net_filter_event_register(net_filter_event_callback);
100 }
101
102 static void
net_filter_event_enqueue_callback(void * arg __unused)103 net_filter_event_enqueue_callback(void *arg __unused)
104 {
105 EVENTHANDLER_INVOKE(&net_filter_evhdlr_ctxt, net_filter_event,
106 net_filter_event_state);
107 }
108
109 static void
net_filter_event_enqueue(void)110 net_filter_event_enqueue(void)
111 {
112 struct nwk_wq_entry *nwk_wqe;
113
114 MALLOC(nwk_wqe, struct nwk_wq_entry *,
115 sizeof(struct nwk_wq_entry),
116 M_NWKWQ, M_WAITOK | M_ZERO);
117 if (nwk_wqe == NULL) {
118 os_log_error(OS_LOG_DEFAULT, "unable to allocate event");
119 return;
120 }
121 nwk_wqe->func = net_filter_event_enqueue_callback;
122 nwk_wq_enqueue(nwk_wqe);
123 }
124
125 void
net_filter_event_mark(enum net_filter_event_subsystems subsystem,bool compatible)126 net_filter_event_mark(enum net_filter_event_subsystems subsystem, bool compatible)
127 {
128 uint32_t old_state = net_filter_event_state;
129
130 net_filter_event_init();
131 if (!compatible) {
132 atomic_bitset_32(&net_filter_event_state, subsystem);
133 } else {
134 atomic_bitclear_32(&net_filter_event_state, subsystem);
135 }
136 if (old_state != net_filter_event_state) {
137 net_filter_event_enqueue();
138 }
139 }
140
141 enum net_filter_event_subsystems
net_filter_event_get_state(void)142 net_filter_event_get_state(void)
143 {
144 return net_filter_event_state;
145 }
146
147 void
net_filter_event_register(net_filter_event_callback_t callback)148 net_filter_event_register(net_filter_event_callback_t callback)
149 {
150 net_filter_event_init();
151 eventhandler_register(&net_filter_evhdlr_ctxt, NULL,
152 "net_filter_event",
153 ptrauth_nop_cast(void *, callback),
154 eventhandler_entry_dummy_arg,
155 EVENTHANDLER_PRI_ANY);
156 }
157
158
159 static int
net_filter_event_sysctl(struct sysctl_oid * oidp,void * arg1,int arg2,struct sysctl_req * req)160 net_filter_event_sysctl(struct sysctl_oid *oidp, void *arg1, int arg2,
161 struct sysctl_req *req)
162 {
163 #pragma unused(oidp, arg1, arg2)
164 struct sbuf *sbuf = net_filter_event_description(net_filter_event_state);
165
166 int error = sysctl_io_string(req, sbuf_data(sbuf), 0, 0, NULL);
167 sbuf_delete(sbuf);
168
169 return error;
170 }
171
172 SYSCTL_PROC(_net, OID_AUTO, filter_state,
173 CTLTYPE_STRING | CTLFLAG_LOCKED, NULL, 0,
174 net_filter_event_sysctl, "A", "State of the network filters");
175