Something went wrong. Try again.
Cider Isn't Darwin Emulation, Really
Something went wrong. Try again.
Objective-C
12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144/* * Copyright (c) 2015-2017 Apple Inc. All rights reserved. * * @APPLE_LICENSE_HEADER_START@ * * This file contains Original Code and/or Modifications of Original Code * as defined in and that are subject to the Apple Public Source License * Version 2.0 (the 'License'). You may not use this file except in * compliance with the License. Please obtain a copy of the License at * http://www.opensource.apple.com/apsl/ and read it before using this * file. * * The Original Code and all software distributed under the License are * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. * Please see the License for the specific language governing rights and * limitations under the License. * * @APPLE_LICENSE_HEADER_END@ */
#import "controller.h"#import <SystemConfiguration/SCPrivate.h>#import "ip_plugin.h"
#define numberToNSNumber(x) [NSNumber numberWithUnsignedInteger:x]
#define dnsAgentDefault "_defaultDNS"#define proxyAgentDefault "_defaultProxy"#define multipleEntitySuffix " #"#define prefixForInterfaceName "@"
/* These define the starting and ending order of each policy section */#define INIT_ORDER_FOR_SCOPED_INTERFACE_POLICY 100#define INIT_ORDER_FOR_DOMAIN_POLICY 500#define INIT_ORDER_FOR_DEFAULT_POLICY 1000
#define SKIP_ORDER_FOR_SCOPED_INTERFACE_POLICY 250#define SKIP_ORDER_FOR_DOMAIN_POLICY 750#define SKIP_ORDER_FOR_DEFAULT_POLICY 1250
#define POLICY_TYPE_NO_POLICY -1#define CONFIG_AGENT_DATA_LIMIT MIN(NETAGENT_MAX_DATA_SIZE, 1024)
typedef struct resolverList { dns_resolver_t **default_resolvers; uint32_t n_default_resolvers; dns_resolver_t **multicast_resolvers; uint32_t n_multicast_resolvers; dns_resolver_t **private_resolvers; uint32_t n_private_resolvers;} resolver_list_t;
@interface AgentController()
@property (nonatomic) NSMutableDictionary * floatingProxyAgentList;@property (nonatomic) NSMutableDictionary * floatingDNSAgentList;@property (nonatomic) NSMutableDictionary * policyDB;@property (nonatomic) NEPolicySession * policySession;@property (nonatomic) NEPolicySession * controlPolicySession;
@end
@implementation AgentController
#pragma mark Init
+ (AgentController *)sharedController{ static AgentController * gController = nil; static dispatch_once_t onceToken;
dispatch_once(&onceToken, ^{ gController = [[AgentController alloc] init]; });
@synchronized (gController) { if (![gController isControllerReady]) { if (![gController initializeController]) { return nil; } } }
return gController;}
- (instancetype)init{ self = [super init]; if (self) { [self initializeController]; }
return self;}
- (BOOL)initializeController{ const char *errorMessage = NULL;
do { /* The NE policy session for the controller */
if (self.policySession == nil) { self.policySession = [self createPolicySession]; if (self.policySession == nil) { errorMessage = "Failed to create a policy session"; break; } }
/* A dictionary of all floating proxy agents * Key : <entity-name> (can be an interface name or domain name) * Value : agent object */
if (self.floatingProxyAgentList == nil) { self.floatingProxyAgentList = [NSMutableDictionary dictionary]; if (self.floatingProxyAgentList == nil) { errorMessage = "Failed to create a dictionary"; break; } }
/* A dictionary of all floating dns agents * Key : <entity-name> (can be an interface name or domain name) * Value : agent object */
if (self.floatingDNSAgentList == nil) { self.floatingDNSAgentList = [NSMutableDictionary dictionary]; if (self.floatingDNSAgentList == nil) { errorMessage = "Failed to create a dictionary"; break; } }
/* A dictionary for the maintaining the policy IDs for all installed policy. * These IDs would be necessary to uninstall a policy when an agent goes away * Key : agent name (which can be retrieved by [agent getAgentName]) * Value : An array of integers, each being a policy ID for that agent */
if (self.policyDB == nil) { self.policyDB = [NSMutableDictionary dictionary]; if (self.policyDB == nil) { errorMessage = "Failed to create a dictionary"; break; } }
/* The queue to run the all processing on */
if (self.controllerQueue == nil) { self.controllerQueue = dispatch_queue_create("com.apple.SystemConfiguration.controllerQueue", NULL); if (self.controllerQueue == nil) { errorMessage = "Failed to create a queue"; break; } } } while (0);
if (errorMessage != NULL) { /* Some error occurred. This is unlikely during controller initialization... */ SC_log(LOG_ERR, "Error occured while initializing AgentController: %s", errorMessage); _SC_crash(errorMessage, NULL, NULL); return NO; }
return YES;}
- (NEPolicySession *)createPolicySession{ return [[NEPolicySession alloc] init];}
- (BOOL)isControllerReady{ /* Make sure that we have all our data structures in place */ return ((self.policySession != nil) && (self.floatingProxyAgentList != nil) && (self.floatingDNSAgentList != nil) && (self.policyDB != nil) && (self.controllerQueue != nil));}
/* ========================== proxy agent helpers =========================== */#pragma mark Proxy agent helper functions
- (NSData *)dataForProxyArray:(CFArrayRef)proxy_array_for_data{ CFDataRef data = NULL; (void)_SCSerialize(proxy_array_for_data, &data, NULL, NULL); return (__bridge_transfer NSData *)data;}
- (NSData *)dataForProxyDictionary:(CFDictionaryRef)domain_proxy{ NSData * data = nil; CFMutableDictionaryRef domain_proxy_dict;
if (domain_proxy == NULL) { SC_log(LOG_NOTICE, "Invalid domain proxy dict"); return nil; }
domain_proxy_dict = CFDictionaryCreateMutableCopy(NULL, 0, domain_proxy); CFDictionaryRemoveValue(domain_proxy_dict, kSCPropNetProxiesSupplementalMatchDomain);
data = (__bridge_transfer NSData *)(SCNetworkProxiesCreateProxyAgentData(domain_proxy_dict)); CFRelease(domain_proxy_dict);
return data;}
- (NSData *)getProxyDataFromCurrentConfig:(CFDictionaryRef)proxies domain:(NSString *)domain{ CFIndex count; CFIndex idx; CFArrayRef supplemental;
if (proxies == NULL || domain == nil) { SC_log(LOG_NOTICE, "Invalid proxies/domain"); return nil; }
supplemental = CFDictionaryGetValue(proxies, kSCPropNetProxiesSupplemental); count = supplemental ? CFArrayGetCount(supplemental) : 0;
for (idx = 0; idx < count; idx++) { CFDictionaryRef domain_proxy; CFStringRef match_domain;
domain_proxy = CFArrayGetValueAtIndex(supplemental, idx); match_domain = CFDictionaryGetValue(domain_proxy, kSCPropNetProxiesSupplementalMatchDomain); if (match_domain != NULL && CFEqual(match_domain, (__bridge CFTypeRef)(domain))) { return [self dataForProxyDictionary:domain_proxy]; } }
return nil;}
- (bool)getIntValue:(CFTypeRef)cf_value valuePtr:(int *) int_value_ptr{ bool valid = false; if (cf_value && CFGetTypeID(cf_value) == CFNumberGetTypeID() && CFNumberGetValue(cf_value, kCFNumberIntType, int_value_ptr)) { valid = true; } return valid;}
- (int)countProxyEntriesEnabled:(CFDictionaryRef)proxies{ int enabled = 0;
if (proxies == NULL) { SC_log(LOG_NOTICE, "Invalid proxies"); return 0; }
if (([self getIntValue:CFDictionaryGetValue(proxies, kSCPropNetProxiesHTTPEnable) valuePtr:&enabled] && enabled > 0) || ([self getIntValue:CFDictionaryGetValue(proxies, kSCPropNetProxiesHTTPSEnable) valuePtr:&enabled] && enabled > 0) || ([self getIntValue:CFDictionaryGetValue(proxies, kSCPropNetProxiesProxyAutoConfigEnable) valuePtr:&enabled] && enabled > 0) || ([self getIntValue:CFDictionaryGetValue(proxies, kSCPropNetProxiesFTPEnable) valuePtr:&enabled] && enabled > 0) || ([self getIntValue:CFDictionaryGetValue(proxies, kSCPropNetProxiesGopherEnable) valuePtr:&enabled] && enabled > 0) || ([self getIntValue:CFDictionaryGetValue(proxies, kSCPropNetProxiesRTSPEnable) valuePtr:&enabled] && enabled > 0) || ([self getIntValue:CFDictionaryGetValue(proxies, kSCPropNetProxiesSOCKSEnable) valuePtr:&enabled] && enabled > 0) || ([self getIntValue:CFDictionaryGetValue(proxies, kSCPropNetProxiesProxyAutoDiscoveryEnable) valuePtr:&enabled] && enabled > 0)) { return enabled; }
return 0;}
- (void)processSupplementalProxyChanges:(CFDictionaryRef)proxies{ CFIndex count; NSMutableArray * deleteList; NSCountedSet * duplicate_domain_list; CFIndex idx; NSMutableArray * new_domain_list; NSMutableArray * old_domain_list; CFArrayRef supplemental; NSMutableArray * update_agent_list;
if (proxies == NULL) { SC_log(LOG_INFO, "No proxy config to process"); return; }
old_domain_list = [self getAgentList:self.floatingProxyAgentList agentType:kAgentTypeProxy agentSubType:kAgentSubTypeSupplemental]; duplicate_domain_list = [[NSCountedSet alloc] initWithCapacity:0]; new_domain_list = [NSMutableArray array]; update_agent_list = [NSMutableArray array]; supplemental = CFDictionaryGetValue(proxies, kSCPropNetProxiesSupplemental); count = supplemental ? CFArrayGetCount(supplemental) : 0; deleteList = [NSMutableArray array];
for (idx = 0; idx < count; idx++) { CFDictionaryRef domain_proxy; CFStringRef match_domain; int proxy_count;
domain_proxy = CFArrayGetValueAtIndex(supplemental, idx); match_domain = CFDictionaryGetValue(domain_proxy, kSCPropNetProxiesSupplementalMatchDomain); if (match_domain == NULL) { continue; }
/* This domain is present in current config. But if it has generic (no protocols enabled) * proxy content, there is no real use of that agent. Do NOT add it to * the new_domain_list. * * This way, if there was an agent previously for this domain, * it will be destroyed AND since it is not present in the new domain list, we wont * spawn a new agent too! :) */
proxy_count = [self countProxyEntriesEnabled:domain_proxy]; if (proxy_count == 0) { SC_log(LOG_INFO, "Proxy settings on %@ are generic. Not recognizing as new domain", match_domain); continue; }
[new_domain_list addObject:(__bridge NSString *)match_domain]; }
[self cleanConflictingAgentsFromList:old_domain_list new_list:new_domain_list agentDictionary:self.floatingProxyAgentList];
for (NSString *key in old_domain_list) { BOOL domain_present;
domain_present = [new_domain_list containsObject:key]; if (domain_present == NO) { id agent;
agent = [self.floatingProxyAgentList objectForKey:key]; [self destroyFloatingAgent:agent]; } }
/* At this point, whatever is in the controller's floating agent list, * is present in the current proxy config. The current proxy config * might have even more configs, not known to the controller, YET */
for (NSString *domain in old_domain_list) { id agent; id mapped_agent;
agent = [self.floatingProxyAgentList objectForKey:domain]; if (agent == nil) { continue; }
/* Am I mapped to some agent? */ mapped_agent = [agent getAgentMapping]; if (mapped_agent) { /* OK, this agent is mapped to some other agent. We compare this agent's data * to the current data of the agent to which it is mapped. If different, we destroy * the agent and later map it to someone else OR spawn a new one. */ NSData * mapped_agent_data;
mapped_agent_data = [self getProxyDataFromCurrentConfig:proxies domain:[mapped_agent getAssociatedEntity]]; if (mapped_agent_data == nil || ![[agent getAgentData] isEqual:mapped_agent_data]) { /* Something changed for mapped agent */ [deleteList addObject:agent]; continue; } } else { /* Since this agent is NOT mapped to any other agent, this agent is * registered with the kernel. So instead of destroying the agent and * re-registering it, just update it here. * * All the agents which were mapped to this agent, will be deleted and * re-mapped, if the data changed. */ NSData * agent_data;
agent_data = [self getProxyDataFromCurrentConfig:proxies domain:[agent getAssociatedEntity]]; if (![[agent getAgentData] isEqual:agent_data]) { /* Something changed for agent */ [agent updateAgentData:agent_data];
/* The reason I don't publish the data to agent here is that, if there were * some agents mapping to this one, they will momentarily have a policy for * using this agent UUID for some domain based on this agent's previous data. */ [update_agent_list addObject:agent]; } } [new_domain_list removeObject:domain]; }
for (id agent in deleteList) { SC_log(LOG_INFO, "Destroying agent %@ because something changed!", [agent getAgentName]); [self destroyFloatingAgent:agent]; }
for (id agent in update_agent_list) { [self publishToAgent:agent]; }
for (idx = 0; idx < count; idx++) { CFDictionaryRef domain_proxy; CFStringRef match_domain;
domain_proxy = CFArrayGetValueAtIndex(supplemental, idx); match_domain = CFDictionaryGetValue(domain_proxy, kSCPropNetProxiesSupplementalMatchDomain);
if (match_domain != NULL) { NSData * data; NSUInteger found; id mapped_agent;
found = [new_domain_list indexOfObject:(__bridge id _Nonnull)(match_domain)]; if (found == NSNotFound) { continue; }
/* * We will only process agents which are mapped AND the agent they were mapped to, changed OR * agents for domains which we did not know before. */
NSUInteger domainInstance = [duplicate_domain_list countForObject:(__bridge id _Nonnull)(match_domain)]; if (domainInstance > 0) { /* domainInstance will be > 0, only if we have conflicting domains */ domainInstance++; NSString *ns_domain_name_copy = [NSString stringWithFormat:@"%@" multipleEntitySuffix "%lu", match_domain, (unsigned long)domainInstance];
data = [self dataForProxyDictionary:domain_proxy];
BOOL ok = [self spawnFloatingAgent:[ProxyAgent class] entity:ns_domain_name_copy agentSubType:kAgentSubTypeSupplemental addPolicyOfType:NEPolicyConditionTypeDomain publishData:data]; if (ok) { id agent = [self.floatingProxyAgentList objectForKey:ns_domain_name_copy]; SC_log(LOG_INFO, "Duplicate Proxy agent %@", [agent getAgentName]);; } } else { data = [self dataForProxyDictionary:domain_proxy]; mapped_agent = [self getAgentWithSameDataAndSubType:self.floatingProxyAgentList data:data subType:kAgentSubTypeSupplemental]; if (mapped_agent != nil) { [self spawnMappedFloatingAgent:mapped_agent entity:(__bridge NSString *)(match_domain) agentSubType:kAgentSubTypeSupplemental addPolicyOfType:NEPolicyConditionTypeDomain updateData:data]; } else { [self spawnFloatingAgent:[ProxyAgent class] entity:(__bridge NSString *)(match_domain) agentSubType:kAgentSubTypeSupplemental addPolicyOfType:NEPolicyConditionTypeDomain publishData:data]; } }
[new_domain_list removeObjectAtIndex:found]; [duplicate_domain_list addObject:(__bridge id _Nonnull)(match_domain)]; } }
return;}
- (void)processScopedProxyChanges:(CFDictionaryRef)proxies{ NSMutableArray * old_intf_list; CFDictionaryRef scoped_proxies; CFIndex scoped_proxies_count;
old_intf_list = [self getAgentList:self.floatingProxyAgentList agentType:kAgentTypeProxy agentSubType:kAgentSubTypeScoped];
scoped_proxies = CFDictionaryGetValue(proxies, kSCPropNetProxiesScoped); scoped_proxies_count = scoped_proxies ? CFDictionaryGetCount(scoped_proxies) : 0;
if (scoped_proxies_count > 0) { const void **keys;
keys = malloc(scoped_proxies_count * sizeof(void *)); CFDictionaryGetKeysAndValues(scoped_proxies, keys, NULL);
for (int i = 0; i < scoped_proxies_count; i++) { NSData * data = nil; NSUInteger idx; CFArrayRef matching; NSString * ns_if_name; NSString * ns_if_name_with_prefix; int proxy_count = 0; id proxyAgent;
ns_if_name = (__bridge NSString *)keys[i]; ns_if_name_with_prefix = [NSString stringWithFormat:@"%s%@", prefixForInterfaceName, ns_if_name];
/* Does the proxy config have any protocols enabled? */ proxy_count = [self countProxyEntriesEnabled:CFDictionaryGetValue(scoped_proxies, (__bridge const void *)(ns_if_name))];
if (proxy_count == 0) { SC_log(LOG_INFO, "Proxy settings on %@ are generic. Skipping", ns_if_name); continue; }
idx = [old_intf_list indexOfObject:ns_if_name_with_prefix];
matching = SCNetworkProxiesCopyMatching(proxies, NULL, (__bridge CFStringRef)(ns_if_name)); if (matching != NULL) { data = [self dataForProxyArray:matching]; CFRelease(matching); }
if (idx == NSNotFound) { /* We need to spawn an agent */ [self spawnFloatingAgent:[ProxyAgent class] entity:ns_if_name_with_prefix agentSubType:kAgentSubTypeScoped addPolicyOfType:NEPolicyConditionTypeScopedInterface publishData:data];
continue; } else { /* We have an agent for this interface. Update it */ [old_intf_list removeObjectAtIndex:idx]; }
proxyAgent = [self.floatingProxyAgentList objectForKey:ns_if_name_with_prefix]; if (proxyAgent != nil) { /* Do we need to update this agent? */ [proxyAgent updateAgentData:data]; if ([proxyAgent shouldUpdateAgent]) { [self publishToAgent:proxyAgent]; } } }
free(keys); }
[self deleteAgentList:self.floatingProxyAgentList list:old_intf_list];}
- (void)processServiceSpecificProxyChanges:(CFDictionaryRef)proxies{ NSMutableArray * old_service_list; CFDictionaryRef service_proxies; CFIndex service_proxies_count;
old_service_list = [self getAgentList:self.floatingProxyAgentList agentType:kAgentTypeProxy agentSubType:kAgentSubTypeServiceSpecific];
service_proxies = CFDictionaryGetValue(proxies, kSCPropNetProxiesServices); service_proxies_count = service_proxies ? CFDictionaryGetCount(service_proxies) : 0;
if (service_proxies_count > 0) { const void **keys;
keys = malloc(service_proxies_count * sizeof(void *)); CFDictionaryGetKeysAndValues(service_proxies, keys, NULL);
for (int i = 0; i < service_proxies_count; i++) { NSData * data = nil; NSUInteger idx; NSString * ns_service_identifier = nil; NSString * ns_service_with_prefix = nil; int proxy_count = 0; id proxyAgent; CFDictionaryRef proxyDict = NULL;
ns_service_identifier = (__bridge NSString *)keys[i]; ns_service_with_prefix = [NSString stringWithFormat:@"%s%@", prefixForInterfaceName, ns_service_identifier];
/* Does the proxy config have any protocols enabled? */ proxy_count = [self countProxyEntriesEnabled:CFDictionaryGetValue(service_proxies, (__bridge const void *)(ns_service_identifier))];
if (proxy_count == 0) { SC_log(LOG_INFO, "Proxy settings on %@ are generic. Skipping", ns_service_identifier); continue; }
proxyDict = CFDictionaryGetValue(service_proxies, (__bridge CFStringRef)ns_service_identifier); if (proxyDict != nil) { data = [self dataForProxyArray:(__bridge CFArrayRef)(@[ (__bridge NSDictionary *)proxyDict ])]; }
idx = [old_service_list indexOfObject:ns_service_with_prefix]; if (idx == NSNotFound) { /* We need to spawn an agent */ [self spawnFloatingAgent:[ProxyAgent class] entity:ns_service_with_prefix agentSubType:kAgentSubTypeServiceSpecific addPolicyOfType:(POLICY_TYPE_NO_POLICY) /* Don't install a policy */ publishData:data];
continue; } else { /* We have an agent for this service. Update it */ [old_service_list removeObjectAtIndex:idx]; }
proxyAgent = [self.floatingProxyAgentList objectForKey:ns_service_with_prefix]; if (proxyAgent != nil) { /* Do we need to update this agent? */ [proxyAgent updateAgentData:data]; if ([proxyAgent shouldUpdateAgent]) { [self publishToAgent:proxyAgent]; } } }
free(keys); }
[self deleteAgentList:self.floatingProxyAgentList list:old_service_list];}
- (BOOL)isGlobalProxy:(CFDictionaryRef)proxies{ if (CFDictionaryContainsKey(proxies, kSCPropNetProxiesBypassAllowed)) { /* * Since we did not ask to "bypass" the proxies, this key will always * be present in a managed (global) proxy configuration */ return YES; }
return NO;}
- (void)processDefaultProxyChanges:(CFDictionaryRef)proxies{ CFArrayRef global_proxy; CFIndex global_proxy_count; CFMutableDictionaryRef proxies_copy;
proxies_copy = CFDictionaryCreateMutableCopy(NULL, 0, proxies); CFDictionaryRemoveValue(proxies_copy, kSCPropNetProxiesScoped); CFDictionaryRemoveValue(proxies_copy, kSCPropNetProxiesServices); CFDictionaryRemoveValue(proxies_copy, kSCPropNetProxiesSupplemental);
global_proxy = CFArrayCreate(NULL, (const void **)&proxies_copy, 1, &kCFTypeArrayCallBacks); global_proxy_count = CFArrayGetCount(global_proxy); if (global_proxy_count > 0 && [self countProxyEntriesEnabled:proxies_copy] == 0) { SC_log(LOG_INFO, "Proxy settings on defaultProxy are generic. Skipping"); global_proxy_count = 0; } CFRelease(proxies_copy);
if (global_proxy_count > 0) { BOOL spawnAgent = YES; id proxyAgent; NSData * data;
data = [self dataForProxyArray:global_proxy]; proxyAgent = [self.floatingProxyAgentList objectForKey:@proxyAgentDefault]; if (proxyAgent != nil) { if (![data isEqual:[proxyAgent getAgentData]]) { [self destroyFloatingAgent:proxyAgent]; } else { spawnAgent = NO; } }
if (spawnAgent) { AgentSubType subtype = kAgentSubTypeDefault; NEPolicyConditionType conditionType = NEPolicyConditionTypeNone; if ([self isGlobalProxy:proxies_copy]) { SC_log(LOG_INFO, "Global proxy detected..."); conditionType = NEPolicyConditionTypeAllInterfaces; subtype = kAgentSubTypeGlobal; }
[self spawnFloatingAgent:[ProxyAgent class] entity:@proxyAgentDefault agentSubType:subtype addPolicyOfType:conditionType publishData:data]; } } else { /* No default proxy config OR generic (no protocols enabled) default proxy config. * Destroy the default agent if we had one */ id proxyAgent;
proxyAgent = [self.floatingProxyAgentList objectForKey:@proxyAgentDefault]; if (proxyAgent != nil) { [self destroyFloatingAgent:proxyAgent]; } }
CFRelease(global_proxy);}
- (void)processProxyChanges{ CFDictionaryRef proxies;
proxies = SCDynamicStoreCopyProxiesWithOptions(NULL, NULL); if (proxies == NULL) { SC_log(LOG_INFO, "No proxy information");
NSMutableDictionary *copy = [self.floatingProxyAgentList copy]; for (NSString *entity in copy) { id agent = [copy objectForKey:entity]; [self destroyFloatingAgent:agent]; }
return; }
[self processDefaultProxyChanges:proxies]; [self processScopedProxyChanges:proxies]; [self processSupplementalProxyChanges:proxies]; [self processServiceSpecificProxyChanges:proxies];
CFRelease(proxies);}
/* ========================== DNS agent helpers =========================== */#pragma mark DNS agent helper functions
- (void)freeResolverList:(resolver_list_t *)resolvers{ /* This is a shallow free of resolver_list_t only. * The actual resolver pointers are owned by 'dns_config' */ if (resolvers == NULL) { return; }
if (resolvers->default_resolvers != NULL) { free(resolvers->default_resolvers); } if (resolvers->multicast_resolvers != NULL) { free(resolvers->multicast_resolvers); } if (resolvers->private_resolvers != NULL) { free(resolvers->private_resolvers); }
free(resolvers);}
- (resolver_list_t *)copyResolverList:(dns_config_t *)dns_config{ resolver_list_t *resolvers = NULL;
if ((dns_config->n_resolver > 0) && (dns_config->resolver != NULL)) { uint32_t a = 0; uint32_t b = 0; uint32_t c = 0;
resolvers = calloc(1, sizeof(resolver_list_t)); for (int i = 0; i < dns_config->n_resolver; i++) { dns_resolver_t *r = dns_config->resolver[i];
if ([self isResolverMulticast:r]) { resolvers->n_multicast_resolvers++; continue;
} else if ([self isResolverPrivate:r]) { resolvers->n_private_resolvers++; continue; }
// do not consider default resolvers with no nameservers if (r->domain == NULL && r->n_nameserver > 0) { resolvers->n_default_resolvers++; } }
SC_log(LOG_INFO, "Resolvers: %d default, %d multicast, %d private", resolvers->n_default_resolvers, resolvers->n_multicast_resolvers, resolvers->n_private_resolvers);
if (resolvers->n_default_resolvers > 0) { resolvers->default_resolvers = calloc(resolvers->n_default_resolvers, sizeof(dns_resolver_t *)); } if (resolvers->n_multicast_resolvers > 0) { resolvers->multicast_resolvers = calloc(resolvers->n_multicast_resolvers, sizeof(dns_resolver_t *)); } if (resolvers->n_private_resolvers > 0) { resolvers->private_resolvers = calloc(resolvers->n_private_resolvers, sizeof(dns_resolver_t *)); }
for (int i = 0; i < dns_config->n_resolver; i++) { dns_resolver_t *r = dns_config->resolver[i];
if ([self isResolverMulticast:r] && (a < resolvers->n_multicast_resolvers)) { resolvers->multicast_resolvers[a++] = r; continue;
} else if ([self isResolverPrivate:r] && (b < resolvers->n_private_resolvers)) { resolvers->private_resolvers[b++] = r; continue; }
if ((r->domain == NULL) && (r->n_nameserver > 0) && (c < resolvers->n_default_resolvers)) { resolvers->default_resolvers[c++] = r; } } }
return resolvers;}
/* * Generate a data blob for the resolver. * Currently the blob only has: * - nameserver count * - sockaddr structs for each nameserver * - ifindex */
- (NSData *)dataForResolver:(dns_resolver_t *)resolver{ NSData * data = nil; CFMutableDictionaryRef resolverDict = nil;
if (resolver == NULL) { SC_log(LOG_NOTICE, "Invalid dns resolver"); return nil; }
if (resolver->n_search > 0) { if (resolverDict == nil) { resolverDict = CFDictionaryCreateMutable(NULL, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks); }
CFMutableArrayRef searchDomainArray = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
/* Append search domains */ for (int i = 0; i < resolver->n_search; i++) { CFArrayAppendValue(searchDomainArray, (__bridge CFStringRef)(@(resolver->search[i]))); }
CFDictionaryAddValue(resolverDict, CFSTR(kConfigAgentDNSSearchDomains), searchDomainArray); CFRelease(searchDomainArray); }
/* Get the count of nameservers */ if (resolver->n_nameserver > 0) { if (resolverDict == nil) { resolverDict = CFDictionaryCreateMutable(NULL, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks); }
CFMutableArrayRef nameserverArray = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
/* Get all the nameservers */ for (int i = 0; i < resolver->n_nameserver; i++) { char buf[128] = {0}; _SC_sockaddr_to_string(resolver->nameserver[i], buf, sizeof(buf)); if (*buf != '\0') { CFArrayAppendValue(nameserverArray, (__bridge CFStringRef)(@(buf))); } }
CFDictionaryAddValue(resolverDict, CFSTR(kConfigAgentDNSNameServers), nameserverArray); CFRelease(nameserverArray); }
if (resolverDict != nil) { data = [NSPropertyListSerialization dataWithPropertyList:(__bridge id _Nonnull)(resolverDict) format:NSPropertyListBinaryFormat_v1_0 options:0 error:nil];
CFRelease(resolverDict); }
return (NSData *)data;}
- (NSData *)getDNSDataFromCurrentConfig:(dns_config_t *)dns_config domain:(NSString *)domain{ if (dns_config == NULL || domain == nil) { SC_log(LOG_NOTICE, "Invalid dns_config/domain"); return nil; }
if ((dns_config->n_resolver > 0) && (dns_config->resolver != NULL)) { for (int i = 0; i < dns_config->n_resolver; i++) { dns_resolver_t * resolver;
resolver = dns_config->resolver[i]; if (resolver->domain != NULL && ![self isResolverMulticast:resolver]) { NSString * ns_domain_name;
ns_domain_name = @(resolver->domain); if ([ns_domain_name isEqualToString:domain]) { return [self dataForResolver:resolver]; } else { continue; } } } }
return nil;}
- (BOOL)isResolverMulticast:(dns_resolver_t *)resolver{ if (resolver->options == NULL) { return NO; }
if (!strstr(resolver->options, "mdns")) { return NO; }
return YES;}
- (BOOL)isResolverPrivate:(dns_resolver_t *)resolver{ if (resolver->options == NULL) { return NO; }
if (!strstr(resolver->options, "pdns")) { return NO; }
return YES;}
- (void)processSupplementalDNSResolvers:(dns_config_t *)dns_config{ NSMutableArray * deleteList; NSMutableArray * new_domain_list; NSCountedSet * duplicate_domain_list; NSMutableArray * old_domain_list; NSMutableArray * update_agent_list;
deleteList = [NSMutableArray array]; duplicate_domain_list = [[NSCountedSet alloc] initWithCapacity:0]; new_domain_list = [NSMutableArray array]; update_agent_list = [NSMutableArray array]; old_domain_list = [self getAgentList:self.floatingDNSAgentList agentType:kAgentTypeDNS agentSubType:kAgentSubTypeSupplemental];
if (dns_config->resolver == NULL) { dns_config->n_resolver = 0; } if (dns_config->n_resolver > 0) { for (int i = 0; i < dns_config->n_resolver; i++) { dns_resolver_t * resolver;
resolver = dns_config->resolver[i]; if (resolver->domain != NULL && ![self isResolverPrivate:resolver] && ![self isResolverMulticast:resolver]) { NSString * ns_domain_name;
ns_domain_name = [NSString stringWithCString:resolver->domain encoding:NSASCIIStringEncoding]; [new_domain_list addObject:ns_domain_name]; } } }
[self cleanConflictingAgentsFromList:old_domain_list new_list:new_domain_list agentDictionary:self.floatingDNSAgentList];
/* Sync between controller and current config */ for (NSString *key in old_domain_list) { BOOL domain_present = NO;
domain_present = [new_domain_list containsObject:key]; if (domain_present == NO) { id agent;
agent = [self.floatingDNSAgentList objectForKey:key]; [self destroyFloatingAgent:agent]; } }
/* At this point, whatever is in the controller's floating agent list, is present in the current DNS config. The current DNS config might have even more configs, not known to the controller, YET */
for (NSString *domain in old_domain_list) { id agent; id mapped_agent;
agent = [self.floatingDNSAgentList objectForKey:domain]; if (agent == nil) { continue; }
/* Am I mapped to some agent? */ mapped_agent = [agent getAgentMapping]; if (mapped_agent) { /* OK, this agent is mapped to some other agent. We compare this agent's data * to the current data of the agent to which it is mapped. If different, we destroy * the agent and later map it to someone else OR spawn a new one. */ NSData *mapped_agent_data;
mapped_agent_data = [self getDNSDataFromCurrentConfig:dns_config domain:[mapped_agent getAssociatedEntity]]; if (mapped_agent_data == nil || ![[agent getAgentData] isEqual:mapped_agent_data]) { /* Something changed for mapped agent */ [deleteList addObject:agent]; continue; } } else { /* Since this agent is NOT mapped to any other agent, this agent is * registered with the kernel. So instead of destroying the agent and * re-registering it, just update it here. * * All the agents which were mapped to this agent, will be deleted and * re-mapped, if the data changed. */ NSData *agent_data;
agent_data = [self getDNSDataFromCurrentConfig:dns_config domain:[agent getAssociatedEntity]]; if (![[agent getAgentData] isEqual:agent_data]) { /* Something changed for agent */ [agent updateAgentData:agent_data];
/* The reason I don't publish the data to agent here is that, if there were * some agents mapping to this one, they will momentarily have a policy for * using this agent UUID for some domain based on this agent's previous data. */ [update_agent_list addObject:agent];
} } [new_domain_list removeObject:domain]; }
for (id agent in deleteList) { SC_log(LOG_INFO, "Destroying agent %@ because something changed!", [agent getAgentName]); [self destroyFloatingAgent:agent]; }
for (id agent in update_agent_list) { [self publishToAgent:agent]; }
for (int idx = 0; idx < dns_config->n_resolver; idx++) { dns_resolver_t * resolver;
resolver = dns_config->resolver[idx]; if (resolver->domain != NULL && ![self isResolverPrivate:resolver] && ![self isResolverMulticast:resolver]) { NSData * data; NSUInteger found; id mapped_agent; NSString * ns_domain_name;
ns_domain_name = @(resolver->domain); found = [new_domain_list indexOfObject:ns_domain_name]; if (found == NSNotFound) { /* Nothing changed for this agent */ continue; }
/* We will only process agents which are mapped AND if the agent they were mapped to, changed OR * agents for domains which we did not know before. */
NSUInteger domainInstance = [duplicate_domain_list countForObject:ns_domain_name]; if (domainInstance > 0) { /* domainInstance will be > 0, only if we have conflicting domains */ domainInstance++; data = [self dataForResolver:resolver];
NSString *ns_domain_name_copy = [NSString stringWithFormat:@"%@" multipleEntitySuffix "%lu", ns_domain_name, (unsigned long)domainInstance];
BOOL ok = [self spawnFloatingAgent:[DNSAgent class] entity:ns_domain_name_copy agentSubType:kAgentSubTypeSupplemental addPolicyOfType:NEPolicyConditionTypeDomain publishData:data]; if (ok) { id agent = [self.floatingDNSAgentList objectForKey:ns_domain_name_copy]; SC_log(LOG_INFO, "Duplicate DNS agent %@", [agent getAgentName]);; } } else { data = [self dataForResolver:resolver]; mapped_agent = [self getAgentWithSameDataAndSubType:self.floatingDNSAgentList data:data subType:kAgentSubTypeSupplemental]; if (mapped_agent != nil) { [self spawnMappedFloatingAgent:mapped_agent entity:ns_domain_name agentSubType:kAgentSubTypeSupplemental addPolicyOfType:NEPolicyConditionTypeDomain updateData:data]; } else { [self spawnFloatingAgent:[DNSAgent class] entity:ns_domain_name agentSubType:kAgentSubTypeSupplemental addPolicyOfType:NEPolicyConditionTypeDomain publishData:data]; } }
[new_domain_list removeObjectAtIndex:found]; [duplicate_domain_list addObject:ns_domain_name]; } }
return;
}
- (void)processDNSResolvers:(dns_config_t *)dns_config{ resolver_list_t *resolvers = [self copyResolverList:dns_config]; if (resolvers) { /* Process Default resolvers */ NSMutableArray *old_default_resolver_list = [self getAgentList:self.floatingDNSAgentList agentType:kAgentTypeDNS agentSubType:kAgentSubTypeDefault];
// For default resolvers, their name will be '_defaultDNS', '_defaultDNS #2' so on... if (resolvers->n_default_resolvers > 0 && resolvers->default_resolvers != NULL) { for (uint32_t i = 0; i < resolvers->n_default_resolvers; i++) { dns_resolver_t *default_resolver = resolvers->default_resolvers[i]; NSData * data; id dnsAgent; NSString * resolverName;
data = [self dataForResolver:default_resolver]; if (i == 0) { resolverName = @(dnsAgentDefault); } else { resolverName = [NSString stringWithFormat:@dnsAgentDefault multipleEntitySuffix "%d", i+1 ]; }
dnsAgent = [self.floatingDNSAgentList objectForKey:resolverName];
if (dnsAgent != nil) { [old_default_resolver_list removeObject:resolverName]; if ([data isEqual:[dnsAgent getAgentData]]) { /* Leave this agent in place. Nothing changed! */ continue; } else { [self destroyFloatingAgent:dnsAgent]; } }
[self spawnFloatingAgent:[DNSAgent class] entity:resolverName agentSubType:kAgentSubTypeDefault addPolicyOfType:NEPolicyConditionTypeNone publishData:data]; } }
// Only agents that are NOT present in the new config, will be present in the list // and they need to be destroyed. [self deleteAgentList:self.floatingDNSAgentList list:old_default_resolver_list];
/* Process Multicast resolvers */
NSMutableArray *old_multicast_resolver_list = [self getAgentList:self.floatingDNSAgentList agentType:kAgentTypeDNS agentSubType:kAgentSubTypeMulticast];
if (resolvers->n_multicast_resolvers > 0 && resolvers->multicast_resolvers != NULL) { for (uint32_t i = 0; i < resolvers->n_multicast_resolvers; i++) { dns_resolver_t * multicast_resolver = resolvers->multicast_resolvers[i]; id dnsAgent; NSString * resolverName;
if (multicast_resolver == NULL) { continue; }
if (multicast_resolver->domain == NULL) { /* Multicast resolvers MUST have a domain */ continue; }
resolverName = @(multicast_resolver->domain); if (resolverName == NULL) { /* Multicast resolvers MUST have a domain */ continue; }
dnsAgent = [self.floatingDNSAgentList objectForKey:resolverName]; if (dnsAgent != nil) { [old_multicast_resolver_list removeObject:resolverName]; continue; }
[self spawnFloatingAgent:[DNSAgent class] entity:resolverName agentSubType:kAgentSubTypeMulticast addPolicyOfType:NEPolicyConditionTypeDomain publishData:nil]; // Don't care about data for mdns resolvers. Do we? } }
[self deleteAgentList:self.floatingDNSAgentList list:old_multicast_resolver_list];
/* Process Private resolvers */
NSMutableArray *old_private_resolver_list = [self getAgentList:self.floatingDNSAgentList agentType:kAgentTypeDNS agentSubType:kAgentSubTypePrivate];
if (resolvers->n_private_resolvers > 0 && resolvers->private_resolvers != NULL) { for (uint32_t i = 0; i < resolvers->n_private_resolvers; i++) { dns_resolver_t * private_resolver = resolvers->private_resolvers[i]; id dnsAgent; NSString * resolverName;
if (private_resolver == NULL) { continue; }
if (private_resolver->domain == NULL) { /* private resolvers MUST have a domain */ continue; }
resolverName = @(private_resolver->domain); if (resolverName == nil) { /* Private resolvers MUST have a domain */ continue; }
dnsAgent = [self.floatingDNSAgentList objectForKey:resolverName]; if (dnsAgent != nil) { [old_private_resolver_list removeObject:resolverName]; continue; }
[self spawnFloatingAgent:[DNSAgent class] entity:resolverName agentSubType:kAgentSubTypePrivate addPolicyOfType:NEPolicyConditionTypeDomain publishData:nil]; // Don't care about data for pdns resolvers. Do we? } }
[self deleteAgentList:self.floatingDNSAgentList list:old_private_resolver_list]; }
[self freeResolverList:resolvers];}
- (void)processScopedDNSResolvers:(dns_config_t *)dns_config{ NSMutableArray * old_intf_list; old_intf_list = [self getAgentList:self.floatingDNSAgentList agentType:kAgentTypeDNS agentSubType:kAgentSubTypeScoped];
if ((dns_config->n_scoped_resolver > 0) && (dns_config->scoped_resolver != NULL)) { for (int i = 0; i < dns_config->n_scoped_resolver; i++) { char buf[IFNAMSIZ]; NSData * data; id dnsAgent; NSUInteger idx; const char * if_name; NSString * ns_if_name; NSString * ns_if_name_with_prefix; dns_resolver_t * resolver;
resolver = dns_config->scoped_resolver[i]; if_name = my_if_indextoname(resolver->if_index, buf); if (if_name) { ns_if_name = @(if_name); ns_if_name_with_prefix = [NSString stringWithFormat:@"%s%@", prefixForInterfaceName, ns_if_name]; } else { continue; }
data = [self dataForResolver:resolver]; idx = [old_intf_list indexOfObject:ns_if_name_with_prefix];
if (idx == NSNotFound) { /* We need to spawn an agent */ [self spawnFloatingAgent:[DNSAgent class] entity:ns_if_name_with_prefix agentSubType:kAgentSubTypeScoped addPolicyOfType:NEPolicyConditionTypeScopedInterface publishData:data]; continue; } else { /* We have an agent on this interface. Update it */ [old_intf_list removeObjectAtIndex:idx]; }
/* Get the DNS agent for this interface? */ dnsAgent = [self.floatingDNSAgentList objectForKey:ns_if_name_with_prefix]; if (dnsAgent != nil) { /* Do we need to update this agent? */ [dnsAgent updateAgentData:data]; if ([dnsAgent shouldUpdateAgent]) { [self publishToAgent:dnsAgent]; } } } }
[self deleteAgentList:self.floatingDNSAgentList list:old_intf_list];}
- (void)processServiceSpecificDNSResolvers:(dns_config_t *)dns_config{ NSMutableArray * old_service_list; old_service_list = [self getAgentList:self.floatingDNSAgentList agentType:kAgentTypeDNS agentSubType:kAgentSubTypeServiceSpecific];
if ((dns_config->n_service_specific_resolver > 0) && (dns_config->service_specific_resolver != NULL)) { for (int i = 0; i < dns_config->n_service_specific_resolver; i++) { NSData * data; id dnsAgent; NSUInteger idx; uint32_t service_identifier; NSString * ns_service_identifier_with_prefix; dns_resolver_t * resolver;
resolver = dns_config->service_specific_resolver[i]; service_identifier = resolver->service_identifier; if (service_identifier != 0) { ns_service_identifier_with_prefix = [NSString stringWithFormat:@"%s%u", prefixForInterfaceName, service_identifier]; } else { continue; }
data = [self dataForResolver:resolver]; idx = [old_service_list indexOfObject:ns_service_identifier_with_prefix];
if (idx == NSNotFound) { /* We need to spawn an agent */ [self spawnFloatingAgent:[DNSAgent class] entity:ns_service_identifier_with_prefix agentSubType:kAgentSubTypeServiceSpecific addPolicyOfType:(POLICY_TYPE_NO_POLICY) /* Don't install a policy */ publishData:data]; continue; } else { /* We have an agent on this interface. Update it */ [old_service_list removeObjectAtIndex:idx]; }
/* Get the DNS agent for this interface? */ dnsAgent = [self.floatingDNSAgentList objectForKey:ns_service_identifier_with_prefix]; if (dnsAgent != nil) { /* Do we need to update this agent? */ [dnsAgent updateAgentData:data]; if ([dnsAgent shouldUpdateAgent]) { [self publishToAgent:dnsAgent]; } } } }
[self deleteAgentList:self.floatingDNSAgentList list:old_service_list];}
#define ONION_RESOLVER_DOMAIN "onion"- (BOOL)isResolverOnion:(dns_resolver_t *)resolver{ if (resolver->domain != NULL && (strcmp(resolver->domain, ONION_RESOLVER_DOMAIN) == 0)) { return YES; }
return NO;}
- (void)processOnionResolver:(dns_config_t *)dns_config{ static NSUInteger policy_id = 0;
if (dns_config == NULL) { goto remove_policy; }
/* Run through the resolver configurations. We only care for the supplemental resolvers. */ for (int32_t i = 0; i < dns_config->n_resolver; i++) { dns_resolver_t *resolver = dns_config->resolver[i]; if ([self isResolverOnion:resolver]) { goto remove_policy; } }
/* We do not have any such resolver. Add a system-wide "drop" policy for this domain */ if (policy_id == 0) { NEPolicy *policy = [[NEPolicy alloc] initWithOrder:INIT_ORDER_FOR_DOMAIN_POLICY result:[NEPolicyResult drop] conditions:@[[NEPolicyCondition domain:@ONION_RESOLVER_DOMAIN]]]; if (policy != nil) { policy_id = [self.policySession addPolicy:policy]; if (![self.policySession apply]) { policy_id = 0; SC_log(LOG_NOTICE, "Could not add a [." ONION_RESOLVER_DOMAIN "] drop policy"); } else { SC_log(LOG_INFO, "Added a [." ONION_RESOLVER_DOMAIN "] drop policy"); } } }
return;
remove_policy:
/* We have such a resolver in the config OR no DNS config at all. Remove the system-wide "drop" policy for this domain */ if (policy_id > 0) { [self.policySession removePolicyWithID:policy_id]; if (![self.policySession apply]) { SC_log(LOG_NOTICE, "Could not remove the [." ONION_RESOLVER_DOMAIN "] drop policy"); } else { policy_id = 0; SC_log(LOG_INFO, "Removed the [." ONION_RESOLVER_DOMAIN "] drop policy"); } }
return;}#undef ONION_RESOLVER_DOMAIN
- (void)processDNSChanges{ dns_config_t * dns_config;
dns_config = dns_configuration_copy(); if (dns_config == NULL) { SC_log(LOG_INFO, "No DNS configuration"); NSMutableDictionary *copy = [self.floatingDNSAgentList copy]; for (NSString *entity in copy) { id agent = [copy objectForKey:entity];
[self destroyFloatingAgent:agent]; } goto done; }
[self processDNSResolvers:dns_config]; [self processScopedDNSResolvers:dns_config]; [self processSupplementalDNSResolvers:dns_config]; [self processServiceSpecificDNSResolvers:dns_config];
done:
[self processOnionResolver:dns_config]; if (dns_config != NULL) { dns_configuration_free(dns_config); }}
#pragma mark Helper functions
- (const void *)copyConfigAgentData:(NSMutableDictionary *)controllerDict uuid:(uuid_t)requested_uuid length:(uint64_t *)length{ if (length == NULL) { SC_log(LOG_NOTICE, "Invalid parameters for copying agent data"); return NULL; }
id agent = nil; void *buffer = NULL; *length = 0;
for (NSString *key in controllerDict) { id temp_agent = [controllerDict objectForKey:key];
uuid_t agent_uuid;
[[temp_agent getAgentUUID] getUUIDBytes:agent_uuid]; if (uuid_compare(agent_uuid, requested_uuid) == 0) { agent = temp_agent; break; } }
if (agent == nil) { uuid_string_t uuid_str; uuid_unparse(requested_uuid, uuid_str); SC_log(LOG_NOTICE, "Invalid config agent uuid %s specified", uuid_str); return NULL; }
NSData *data = [agent getAgentData]; uint64_t len = [data length]; if (len > 0) { *length = len; buffer = malloc((size_t)len); memcpy(buffer, [data bytes], len); }
return (const void *)buffer;}
- (const void *)copyProxyAgentData:(uuid_t)requested_uuid length:(uint64_t *)length{ return [self copyConfigAgentData:self.floatingProxyAgentList uuid:requested_uuid length:length];}
- (const void *)copyDNSAgentData:(uuid_t)requested_uuid length:(uint64_t *)length{ return [self copyConfigAgentData:self.floatingDNSAgentList uuid:requested_uuid length:length];}
- (NSData *)dataLengthSanityCheck:(id)agent{ NSData * data = [agent getAgentData];
if ([data length] > CONFIG_AGENT_DATA_LIMIT) { /* We impose a limit on the config agent data as 1KB. * If we have a data blob larger than this limit, do NOT publish it into the agent. * Instead publish a key which will trigger fetching of the configuration directly * through NWI server. */ NSMutableDictionary *data_dict = [NSMutableDictionary dictionary];
NSUUID *uuid = [agent getAgentUUID]; uuid_t c_uuid; [uuid getUUIDBytes:c_uuid]; NSData *uuid_data = [[NSData alloc] initWithBytes:c_uuid length:sizeof(c_uuid)]; [data_dict setValue:uuid_data forKey:@kConfigAgentOutOfBandDataUUID];
NSData *new_data = [NSPropertyListSerialization dataWithPropertyList:data_dict format:NSPropertyListBinaryFormat_v1_0 options:0 error:nil];
return new_data; }
return nil;}
/* * For conflicting agents, the convention is that its name & entity, * will have a suffix " #<number>". This function will sanitize the * suffix and just return the entity name */- (NSString *)sanitizeEntity:(NSString *)entity{ NSRange range = [entity rangeOfString:@multipleEntitySuffix]; if (range.location != NSNotFound) { NSString *str = [entity substringToIndex:range.location]; return str; }
return entity;}
/* * For interface names, there is a prefix to differentiate then * from the domain name (iff there were conflicting domain names). * Returns the sanitized interface name */- (NSString *)sanitizeInterfaceName:(NSString *)intf{ NSRange range = [intf rangeOfString:@prefixForInterfaceName]; if (range.location != NSNotFound) { NSString *str = [intf substringFromIndex:(range.location + strlen(prefixForInterfaceName))]; return str; }
return intf;}
/* * For conflicting agents, the convention is that its name & entity, * will have a suffix " #<number>". This function will return that <number> */- (int)entityInstanceNumber:(NSString *)entity{ NSRange range = [entity rangeOfString:@multipleEntitySuffix]; if (range.location != NSNotFound) { NSString *str = [entity substringFromIndex:(range.location + strlen(multipleEntitySuffix))]; return str.intValue; }
return 0;}
/* * In case that we have conflicting DNS/Proxy domains * This function will remove all those conflicting agents, * so that we can start afresh with the new config */- (void)cleanConflictingAgentsFromList:(NSMutableArray *)old_list new_list:(NSMutableArray *)new_list agentDictionary:(NSMutableDictionary *)agent_list{ NSCountedSet * duplicate_domain_list;
for (NSString *domain in old_list) { /* If we had conflicting domains before, remove all of them */ NSString *sanitizedDomain = [self sanitizeEntity:domain]; if (![sanitizedDomain isEqualToString:domain]) { /* Destroy the original domain */ id agent = [agent_list objectForKey:sanitizedDomain]; [self destroyFloatingAgent:agent];
/* Destroy the conflicting domain */ agent = [agent_list objectForKey:domain]; [self destroyFloatingAgent:agent];
SC_log(LOG_INFO, "Removing conflicting domain: %@, %@", sanitizedDomain, domain); } }
duplicate_domain_list = [[NSCountedSet alloc] initWithArray:new_list]; for (NSString *domain in old_list) { if ([duplicate_domain_list countForObject:domain] > 1) { id agent = [agent_list objectForKey:domain]; [self destroyFloatingAgent:agent]; SC_log(LOG_INFO, "Removing domain %@ as it has duplicates in the current config", domain); } }}
/* * Get the list of agents from a specific dictionary. * The list of agents will only consist of the ones which * match the agent type and sub-type */
- (NSMutableArray *)getAgentList:(NSMutableDictionary *)all_agents agentType:(AgentType)type agentSubType:(AgentSubType)subtype{ NSMutableArray *list = [NSMutableArray array]; NSArray *agentObjects = [all_agents allValues];
for (id agent in agentObjects) { if (([agent getAgentType] == type) && ([agent getAgentSubType] == subtype)) {
[list addObject:[agent getAssociatedEntity]]; } }
return list;}
/* * Destroy all the agents are listed in "list" */
- (void)deleteAgentList:(NSMutableDictionary *)all_agents list:(NSMutableArray *)list{ for (NSString *intf in list) { id agent;
agent = [all_agents objectForKey:intf]; [self destroyFloatingAgent:agent]; }}
/* * In order to not duplicate agents with same content, * we map an agent X to agent Y, when their content is the same. * * This function tries to find that agent Y */
- (id)getAgentWithSameDataAndSubType:(NSMutableDictionary *)agentList data:(NSData *)data subType:(AgentSubType)subtype{ for (NSString *key in agentList) { id agent = [agentList objectForKey:key]; if ([[agent getAgentData] isEqual:data]) { /* Do not map to default agents */ if ([agent getAgentSubType] != subtype) { continue; }
/* Return only registered agents */ if ([agent getRegistrationObject] != nil) { return agent; } } }
return nil;}
#pragma mark Policy installation function
/* * Add NECP policies for an agent */- (BOOL)addPolicyToFloatingAgent:(id)agent domain:(NSString *)domain agentUUIDToUse:(NSUUID *)uuid policyType:(NEPolicyConditionType)policyType useControlPolicySession:(BOOL)useControlPolicySession{ NEPolicyCondition * condition = nil; NEPolicySession * session; uint32_t multiple_entity_offset; NEPolicy * newPolicy; BOOL ok; uint32_t order; uint32_t orderForSkip; NSMutableArray * policyArray; NSUInteger policyID1; NSUInteger policyID2; NEPolicyResult * result; uint32_t skipOrder; AgentType type; uint32_t typeOffset;
type = [agent getAgentType]; typeOffset = (type == kAgentTypeDNS) ? 0 : 5000; skipOrder = (type == kAgentTypeDNS) ? 5000 : 0;
multiple_entity_offset = (uint32_t)[self entityInstanceNumber:domain]; domain = [self sanitizeEntity:domain];
switch (policyType) { case NEPolicyConditionTypeScopedInterface: order = INIT_ORDER_FOR_SCOPED_INTERFACE_POLICY + typeOffset + multiple_entity_offset; domain = [self sanitizeInterfaceName:domain]; condition = [NEPolicyCondition scopedInterface:domain]; orderForSkip = SKIP_ORDER_FOR_SCOPED_INTERFACE_POLICY + typeOffset; break;
case NEPolicyConditionTypeDomain: order = INIT_ORDER_FOR_DOMAIN_POLICY + typeOffset + multiple_entity_offset; condition = [NEPolicyCondition domain:domain]; orderForSkip = SKIP_ORDER_FOR_DOMAIN_POLICY + typeOffset; break;
case NEPolicyConditionTypeAllInterfaces: order = INIT_ORDER_FOR_DEFAULT_POLICY + typeOffset + multiple_entity_offset; condition = [NEPolicyCondition allInterfaces]; orderForSkip = SKIP_ORDER_FOR_DEFAULT_POLICY + typeOffset; break;
case NEPolicyConditionTypeNone: order = INIT_ORDER_FOR_DEFAULT_POLICY + typeOffset + multiple_entity_offset; orderForSkip = SKIP_ORDER_FOR_DEFAULT_POLICY + typeOffset; break;
default: SC_log(LOG_NOTICE, "Invalid policy condition specified"); return NO; }
result = [NEPolicyResult netAgentUUID:uuid]; newPolicy = [[NEPolicy alloc] initWithOrder:order result:result conditions: (condition ? @[condition] : nil)];
if (newPolicy == nil) { SC_log(LOG_NOTICE, "Could not create a policy for agent %@", [agent getAgentName]); return NO; }
if (useControlPolicySession) { if (self.controlPolicySession == nil) { /* The NE policy session at "control" level for the controller */ self.controlPolicySession = [self createPolicySession]; if (self.controlPolicySession == nil) { SC_log(LOG_NOTICE, "Could not create a control policy session for agent %@", [agent getAgentName]); return NO; } [self.controlPolicySession setPriority:NEPolicySessionPriorityControl]; } ((ConfigAgent *)agent).preferredPolicySession = self.controlPolicySession; } else { ((ConfigAgent *)agent).preferredPolicySession = self.policySession; }
session = ((ConfigAgent *)agent).preferredPolicySession;
policyID1 = [session addPolicy:newPolicy]; if (policyID1 == 0) { SC_log(LOG_NOTICE, "Could not add a netagent policy for agent %@", [agent getAgentName]); return NO; }
result = [NEPolicyResult skipWithOrder:skipOrder]; newPolicy = [[NEPolicy alloc] initWithOrder:orderForSkip result:result conditions:(condition ? @[condition] : nil)];
if (newPolicy == nil) { SC_log(LOG_NOTICE, "Could not create a policy for agent %@", [agent getAgentName]); return NO; }
policyID2 = [session addPolicy:newPolicy]; if (policyID2 == 0) { SC_log(LOG_NOTICE, "Could not add a skip policy for agent %@", [agent getAgentName]); return NO; }
ok = [session apply]; if (!ok) { SC_log(LOG_NOTICE, "Could not apply policy for agent %@", [agent getAgentName]); return NO; }
policyArray = [self.policyDB objectForKey:[agent getAgentName]]; if (policyArray == nil) { policyArray = [NSMutableArray array]; }
[policyArray addObject:numberToNSNumber(policyID1)]; [policyArray addObject:numberToNSNumber(policyID2)]; [self.policyDB setObject:policyArray forKey:[agent getAgentName]];
return ok;}
#pragma mark Agent manipulation functions
/* * Create an agent */- (BOOL)spawnFloatingAgent:(Class)agentClass entity:(NSString *)entity agentSubType:(AgentSubType)subtype addPolicyOfType:(NEPolicyConditionType)policyType publishData:(NSData *)data{ id agent; BOOL ok; NSMutableDictionary * parameters;
parameters =[NSMutableDictionary dictionary]; [parameters setValue:entity forKey:@kEntityName]; [parameters setValue:numberToNSNumber(subtype) forKey:@kAgentSubType];
agent = [[agentClass alloc] initWithParameters:parameters]; ok = [self registerAgent:agent]; if (!ok) { return NO; }
if (data) { /* Since we just spawned this agent, update its data */ [agent updateAgentData:data]; [self publishToAgent:agent]; }
/* Add a policy if there is a valid type. If POLICY_TYPE_NO_POLICY, then ignore policies. * POLICY_TYPE_NO_POLICY will be set for service-specific agents, in which case we rely on * service owners to install custom policies to point at the agents. */ if (policyType >= NEPolicyConditionTypeNone) { BOOL useControlPolicySession = NO; if (subtype == kAgentSubTypeGlobal) { /* Policies for a Global scoped agents are at "control" level */ useControlPolicySession = YES; }
ok = [self addPolicyToFloatingAgent:agent domain:entity agentUUIDToUse:[agent agentUUID] policyType:policyType useControlPolicySession:useControlPolicySession];
if (!ok) { [self unregisterAgent:agent]; return NO; } }
SC_log(LOG_INFO, "Spawning floating agent for %@", entity);
if ([agent getAgentType] == kAgentTypeProxy) { [self.floatingProxyAgentList setObject:agent forKey:entity]; } else { [self.floatingDNSAgentList setObject:agent forKey:entity]; }
return ok;}
/* * Create an agent mapped to another agent. */- (BOOL)spawnMappedFloatingAgent:(id)mapped_agent entity:(NSString *)entity agentSubType:(AgentSubType)subtype addPolicyOfType:(NEPolicyConditionType)policyType updateData:(NSData *)data{ id dummyAgent; NSMutableDictionary * parameters;
parameters = [NSMutableDictionary dictionary]; [parameters setValue:entity forKey:@kEntityName]; [parameters setValue:numberToNSNumber(subtype) forKey:@kAgentSubType];
dummyAgent = [[[mapped_agent class] alloc] initWithParameters:parameters];
if (data) { /* Since we just spawned this agent, update its data. * We do not publish it since this agent is mapped * to an agent which already has the same data */ [dummyAgent updateAgentData:data]; }
BOOL useControlPolicySession = NO; if (subtype == kAgentSubTypeGlobal) { /* Policies for a Global scoped agents are at "control" level */ useControlPolicySession = YES; }
BOOL ok = [self addPolicyToFloatingAgent:dummyAgent domain:entity agentUUIDToUse:[mapped_agent agentUUID] policyType:policyType useControlPolicySession:useControlPolicySession];
if (!ok) { return NO; }
if ([mapped_agent getAgentType] == kAgentTypeProxy) { [self.floatingProxyAgentList setObject:dummyAgent forKey:entity]; } else { [self.floatingDNSAgentList setObject:dummyAgent forKey:entity]; }
[dummyAgent setAgentMapping:mapped_agent];
SC_log(LOG_INFO, "Mapped floating agent %@ to %@", [dummyAgent getAgentName], [mapped_agent getAgentName]); return YES;}
/* * Write into an agent */- (BOOL)publishToAgent:(id)agent{ /* Before any data goes into the kernel, do a sanity check. */ NSData *sanityCheckData = [self dataLengthSanityCheck:agent]; NSData *tempAgentData = nil;
if (sanityCheckData != nil) { /* Data length is more than the limit! for updateNetworkAgent, the data blob * has to be a part of the agent object. Thus the temporary data replacement! */ tempAgentData = [[agent getAgentData] copy]; [agent updateAgentData:sanityCheckData]; SC_log(LOG_NOTICE, "Data too large for %@ (%lu bytes)!", [agent getAgentName], (unsigned long)[tempAgentData length]); }
BOOL ok = NO;
NWNetworkAgentRegistration *regObject = [agent valueForKey:@"registrationObject"]; if (regObject != nil) { SC_log(LOG_NOTICE, "Publishing data to agent %@ (%lu bytes)", [agent getAgentName], (unsigned long)[[agent getAgentData] length]); ok = [regObject updateNetworkAgent:agent]; if (!ok) { SC_log(LOG_NOTICE, "Could not update config agent"); } } else { SC_log(LOG_NOTICE, "Config Agent not registered. Cannot Update"); }
if (tempAgentData != nil) { [agent updateAgentData:tempAgentData]; }
return ok;}
/* * Destroy an agent */- (BOOL)destroyFloatingAgent:(id)agent{ BOOL ok = NO;
if ( agent != nil) { NSMutableArray * policyArray;
policyArray = [self.policyDB objectForKey:[agent getAgentName]]; if (policyArray != nil) { NEPolicySession * session = ((ConfigAgent *)agent).preferredPolicySession; BOOL result = NO;
for (NSNumber *policyID in policyArray) { NSUInteger idVal;
idVal = [policyID unsignedIntegerValue]; result = [session removePolicyWithID:idVal]; if (result == NO) { SC_log(LOG_NOTICE, "Could not remove policy %@ for agent %@", [session policyWithID:idVal], [agent getAgentName]); } }
result = [session apply]; if (result == NO) { SC_log(LOG_NOTICE, "Could not apply removed policies for agent %@", [agent getAgentName]); }
[self.policyDB removeObjectForKey:[agent getAgentName]]; }
if ([agent getAgentType] == kAgentTypeProxy) { [self.floatingProxyAgentList removeObjectForKey:[agent getAssociatedEntity]]; } else { [self.floatingDNSAgentList removeObjectForKey:[agent getAssociatedEntity]]; }
if ([agent getRegistrationObject] != nil) { [self unregisterAgent:agent]; }
SC_log(LOG_INFO, "X - Destroyed agent %@", [agent getAgentName]);
/* Check if we need to close the "control" policy session */ if (self.controlPolicySession != nil) { NSMutableArray *globalProxyAgentList; NSMutableArray *globalDNSAgentList; globalProxyAgentList = [self getAgentList:self.floatingProxyAgentList agentType:kAgentTypeProxy agentSubType:kAgentSubTypeGlobal]; globalDNSAgentList = [self getAgentList:self.floatingDNSAgentList agentType:kAgentTypeDNS agentSubType:kAgentSubTypeGlobal];
if ([globalProxyAgentList count] == 0 && [globalDNSAgentList count] == 0) { ok = [self.controlPolicySession removeAllPolicies]; if (!ok) { SC_log(LOG_ERR, "Could not remove policies for agent %@", [agent getAgentName]); }
ok = [self.controlPolicySession apply]; if (!ok) { SC_log(LOG_ERR, "Could not apply policy change for agent %@", [agent getAgentName]); }
self.controlPolicySession = nil; SC_log(LOG_NOTICE, "Closed control policy session"); } }
ok = YES; }
return ok;}
/* * Register an agent */- (BOOL)registerAgent:(id)agent{ BOOL ok = NO;
NWNetworkAgentRegistration *registration = [[NWNetworkAgentRegistration alloc] initWithNetworkAgentClass:[agent class]];
ok = [registration registerNetworkAgent:agent]; if (!ok) { SC_log(LOG_NOTICE, "Could not register config agent"); goto done; }
[agent addAgentRegistrationObject:registration];
done: return ok;}
/* * Unregister an agent */- (BOOL)unregisterAgent:(id)agent{ BOOL ok = false;
NWNetworkAgentRegistration *regObject = [agent valueForKey:@"registrationObject"]; if (regObject != nil) { ok = [regObject unregisterNetworkAgent]; if (!ok) { SC_log(LOG_NOTICE, "Could not unregister config agent"); } } else { SC_log(LOG_NOTICE, "Config Agent not registered. Cannot unregister"); }
return ok;}
@end