2 * Copyright (c) 2000-2008, 2010-2013 Apple Inc. All rights reserved.
4 * @APPLE_LICENSE_HEADER_START@
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
21 * @APPLE_LICENSE_HEADER_END@
25 * Modification History
27 * December 3, 2002 Dieter Siegmund <dieter@apple.com>
28 * - handle the new KEV_INET_ARPCOLLISION event
29 * - format the event into a DynamicStore key
30 * State:/Network/Interface/ifname/IPv4Collision/ip_addr/hw_addr
31 * and send a notification on the key
33 * August 8, 2002 Allan Nathanson <ajn@apple.com>
34 * - added support for KEV_INET6_xxx events
36 * January 6, 2002 Jessica Vazquez <vazquez@apple.com>
37 * - added handling for KEV_ATALK_xxx events
39 * July 2, 2001 Dieter Siegmund <dieter@apple.com>
40 * - added handling for KEV_DL_PROTO_{ATTACHED, DETACHED}
41 * - mark an interface up if the number of protocols remaining is not 0,
42 * mark an interface down if the number is zero
43 * - allocate socket on demand instead of keeping it open all the time
45 * June 23, 2001 Allan Nathanson <ajn@apple.com>
46 * - update to public SystemConfiguration.framework APIs
48 * May 17, 2001 Allan Nathanson <ajn@apple.com>
49 * - add/maintain per-interface address/netmask/destaddr information
50 * in the dynamic store.
52 * June 30, 2000 Allan Nathanson <ajn@apple.com>
64 #define KEV_LOG_SUBCLASS 10
66 static const char *inetEventName
[] = {
69 "INET address changed",
70 "INET address deleted",
71 "INET destination address changed",
72 "INET broadcast address changed",
73 "INET netmask changed",
78 static const char *dlEventName
[] = {
89 "KEV_DL_IF_DETACHING",
93 "KEV_DL_PROTO_ATTACHED",
94 "KEV_DL_PROTO_DETACHED",
95 "KEV_DL_LINK_ADDRESS_CHANGED",
96 "KEV_DL_WAKEFLAGS_CHANGED",
97 #ifdef KEV_DL_IF_IDLE_ROUTE_REFCNT
98 "KEV_DL_IF_IDLE_ROUTE_REFCNT",
100 #ifdef KEV_DL_IFCAP_CHANGED
101 "KEV_DL_IFCAP_CHANGED",
103 #ifdef KEV_DL_LINK_QUALITY_METRIC_CHANGED
104 "KEV_DL_LINK_QUALITY_METRIC_CHANGED",
106 #ifdef KEV_DL_NODE_PRESENCE
107 "KEV_DL_NODE_PRESENCE"
109 #ifdef KEV_DL_NODE_ABSENCE
110 "KEV_DL_NODE_ABSENCE"
112 #ifdef KEV_DL_MASTER_ELECTED
113 "KEV_DL_MASTER_ELECTED"
120 static const char *inet6EventName
[] = {
122 "KEV_INET6_NEW_USER_ADDR",
123 "KEV_INET6_CHANGED_ADDR",
124 "KEV_INET6_ADDR_DELETED",
125 "KEV_INET6_NEW_LL_ADDR",
126 "KEV_INET6_NEW_RTADV_ADDR",
127 "KEV_INET6_DEFROUTER"
130 #ifdef KEV_ND6_SUBCLASS
131 static const char *nd6EventNameString
[] = {
135 #endif // KEV_ND6_SUBCLASS
137 __private_extern__ Boolean network_changed
= FALSE
;
138 __private_extern__ SCDynamicStoreRef store
= NULL
;
139 __private_extern__ Boolean _verbose
= FALSE
;
143 dgram_socket(int domain
)
145 return (socket(domain
, SOCK_DGRAM
, 0));
149 ifflags_set(int s
, char * name
, short flags
)
154 bzero(&ifr
, sizeof(ifr
));
155 strlcpy(ifr
.ifr_name
, name
, sizeof(ifr
.ifr_name
));
156 ret
= ioctl(s
, SIOCGIFFLAGS
, (caddr_t
)&ifr
);
160 ifr
.ifr_flags
|= flags
;
161 return (ioctl(s
, SIOCSIFFLAGS
, &ifr
));
165 ifflags_clear(int s
, char * name
, short flags
)
170 bzero(&ifr
, sizeof(ifr
));
171 strlcpy(ifr
.ifr_name
, name
, sizeof(ifr
.ifr_name
));
172 ret
= ioctl(s
, SIOCGIFFLAGS
, (caddr_t
)&ifr
);
176 ifr
.ifr_flags
&= ~flags
;
177 return (ioctl(s
, SIOCSIFFLAGS
, &ifr
));
181 mark_if_up(char * name
)
183 int s
= dgram_socket(AF_INET
);
186 ifflags_set(s
, name
, IFF_UP
);
191 mark_if_down(char * name
)
193 int s
= dgram_socket(AF_INET
);
196 ifflags_clear(s
, name
, IFF_UP
);
201 post_network_changed(void)
203 if (network_changed
) {
206 status
= notify_post(_SC_NOTIFY_NETWORK_CHANGE
);
207 if (status
!= NOTIFY_STATUS_OK
) {
208 SCLog(TRUE
, LOG_ERR
, CFSTR("notify_post() failed: error=%ld"), status
);
211 network_changed
= FALSE
;
218 logEvent(CFStringRef evStr
, struct kern_event_msg
*ev_msg
)
227 SCLog(TRUE
, LOG_DEBUG
, CFSTR("%@ event:"), evStr
);
228 SCLog(TRUE
, LOG_DEBUG
,
229 CFSTR(" Event size=%d, id=%d, vendor=%d, class=%d, subclass=%d, code=%d"),
234 ev_msg
->kev_subclass
,
236 for (i
= 0, j
= KEV_MSG_HEADER_SIZE
; j
< ev_msg
->total_size
; i
++, j
+=4) {
237 SCLog(TRUE
, LOG_DEBUG
, CFSTR(" Event data[%2d] = %08lx"), i
, ev_msg
->event_data
[i
]);
242 inetEventNameString(uint32_t event_code
)
244 if (event_code
< sizeof(inetEventName
) / sizeof(inetEventName
[0])) {
245 return (inetEventName
[event_code
]);
247 return ("New Apple network INET subcode");
251 inet6EventNameString(uint32_t event_code
)
253 if (event_code
< sizeof(inet6EventName
) / sizeof(inet6EventName
[0])) {
254 return (inet6EventName
[event_code
]);
256 return ("New Apple network INET6 subcode");
260 dlEventNameString(uint32_t event_code
)
262 if (event_code
< sizeof(dlEventName
) / sizeof(dlEventName
[0])) {
263 return (dlEventName
[event_code
]);
265 return ("New Apple network DL subcode");
269 copy_if_name(struct net_event_data
* ev
, char * ifr_name
, int ifr_len
)
271 snprintf(ifr_name
, ifr_len
, "%s%d", ev
->if_name
, ev
->if_unit
);
275 static uint8_t info_zero
[DLIL_MODARGLEN
];
278 processEvent_Apple_Network(struct kern_event_msg
*ev_msg
)
280 const char * eventName
= NULL
;
281 int dataLen
= (ev_msg
->total_size
- KEV_MSG_HEADER_SIZE
);
282 void * event_data
= &ev_msg
->event_data
[0];
283 Boolean handled
= TRUE
;
284 char ifr_name
[IFNAMSIZ
];
286 switch (ev_msg
->kev_subclass
) {
287 case KEV_INET_SUBCLASS
: {
288 eventName
= inetEventNameString(ev_msg
->event_code
);
289 switch (ev_msg
->event_code
) {
290 case KEV_INET_NEW_ADDR
:
291 case KEV_INET_CHANGED_ADDR
:
292 case KEV_INET_ADDR_DELETED
:
293 case KEV_INET_SIFDSTADDR
:
294 case KEV_INET_SIFBRDADDR
:
295 case KEV_INET_SIFNETMASK
: {
296 struct kev_in_data
* ev
;
298 ev
= (struct kev_in_data
*)event_data
;
299 if (dataLen
< sizeof(*ev
)) {
303 copy_if_name(&ev
->link_data
, ifr_name
, sizeof(ifr_name
));
304 interface_update_ipv4(NULL
, ifr_name
);
307 case KEV_INET_ARPCOLLISION
: {
308 struct kev_in_collision
* ev
;
310 ev
= (struct kev_in_collision
*)event_data
;
311 if ((dataLen
< sizeof(*ev
))
312 || (dataLen
< (sizeof(*ev
) + ev
->hw_len
))) {
316 copy_if_name(&ev
->link_data
, ifr_name
, sizeof(ifr_name
));
317 interface_collision_ipv4(ifr_name
,
323 #if !TARGET_OS_IPHONE
324 case KEV_INET_PORTINUSE
: {
325 struct kev_in_portinuse
* ev
;
326 ev
= (struct kev_in_portinuse
*)event_data
;
327 if (dataLen
< sizeof(*ev
)) {
331 port_in_use_ipv4(ev
->port
, ev
->req_pid
);
334 #endif /* !TARGET_OS_IPHONE */
341 case KEV_INET6_SUBCLASS
: {
342 struct kev_in6_data
* ev
;
344 eventName
= inet6EventNameString(ev_msg
->event_code
);
345 ev
= (struct kev_in6_data
*)event_data
;
346 switch (ev_msg
->event_code
) {
347 case KEV_INET6_NEW_USER_ADDR
:
348 case KEV_INET6_CHANGED_ADDR
:
349 case KEV_INET6_ADDR_DELETED
:
350 case KEV_INET6_NEW_LL_ADDR
:
351 case KEV_INET6_NEW_RTADV_ADDR
:
352 case KEV_INET6_DEFROUTER
:
353 if (dataLen
< sizeof(*ev
)) {
357 copy_if_name(&ev
->link_data
, ifr_name
, sizeof(ifr_name
));
358 interface_update_ipv6(NULL
, ifr_name
);
367 case KEV_DL_SUBCLASS
: {
368 struct net_event_data
* ev
;
370 eventName
= dlEventNameString(ev_msg
->event_code
);
371 ev
= (struct net_event_data
*)event_data
;
372 switch (ev_msg
->event_code
) {
373 case KEV_DL_IF_ATTACHED
:
375 * new interface added
377 if (dataLen
< sizeof(*ev
)) {
381 copy_if_name(ev
, ifr_name
, sizeof(ifr_name
));
385 case KEV_DL_IF_DETACHED
:
389 if (dataLen
< sizeof(*ev
)) {
393 copy_if_name(ev
, ifr_name
, sizeof(ifr_name
));
394 link_remove(ifr_name
);
397 case KEV_DL_IF_DETACHING
:
399 * interface detaching
401 if (dataLen
< sizeof(*ev
)) {
405 copy_if_name(ev
, ifr_name
, sizeof(ifr_name
));
406 interface_detaching(ifr_name
);
409 case KEV_DL_PROTO_ATTACHED
:
410 case KEV_DL_PROTO_DETACHED
: {
411 struct kev_dl_proto_data
* protoEvent
;
413 protoEvent
= (struct kev_dl_proto_data
*)event_data
;
414 if (dataLen
< sizeof(*protoEvent
)) {
418 copy_if_name(&protoEvent
->link_data
,
419 ifr_name
, sizeof(ifr_name
));
420 if (protoEvent
->proto_remaining_count
== 0) {
421 mark_if_down(ifr_name
);
423 mark_if_up(ifr_name
);
428 #ifdef KEV_DL_IF_IDLE_ROUTE_REFCNT
429 case KEV_DL_IF_IDLE_ROUTE_REFCNT
: {
431 * interface route refcnt idle
433 if (dataLen
< sizeof(*ev
)) {
437 copy_if_name(ev
, ifr_name
, sizeof(ifr_name
));
438 interface_update_idle_state(ifr_name
);
441 #endif // KEV_DL_IF_IDLE_ROUTE_REFCNT
443 case KEV_DL_LINK_OFF
:
444 case KEV_DL_LINK_ON
:
446 * update the link status in the store
448 if (dataLen
< sizeof(*ev
)) {
452 copy_if_name(ev
, ifr_name
, sizeof(ifr_name
));
453 link_update_status(ifr_name
, FALSE
);
456 #ifdef KEV_DL_LINK_QUALITY_METRIC_CHANGED
457 case KEV_DL_LINK_QUALITY_METRIC_CHANGED
: {
458 struct kev_dl_link_quality_metric_data
* lqm_data
;
459 lqm_data
= (struct kev_dl_link_quality_metric_data
*) event_data
;
461 if (dataLen
< sizeof(*ev
)) {
465 copy_if_name(ev
, ifr_name
, sizeof(ifr_name
));
466 interface_update_quality_metric(ifr_name
,
467 lqm_data
->link_quality_metric
);
470 #endif // KEV_DL_LINK_QUALITY_METRIC_CHANGED
473 case KEV_DL_ISSUES
: {
474 struct kev_dl_issues
*issues
;
476 issues
= (struct kev_dl_issues
*)event_data
;
477 if (dataLen
< sizeof(*ev
)) {
481 copy_if_name(ev
, ifr_name
, sizeof(ifr_name
));
482 interface_update_link_issues(ifr_name
,
487 (bcmp(issues
->info
, info_zero
, DLIL_MODIDLEN
) != 0)
492 #endif // KEV_DL_ISSUES
494 case KEV_DL_SIFFLAGS
:
495 case KEV_DL_SIFMETRICS
:
497 case KEV_DL_SIFPHYS
:
498 case KEV_DL_SIFMEDIA
:
499 case KEV_DL_SIFGENERIC
:
500 case KEV_DL_ADDMULTI
:
501 case KEV_DL_DELMULTI
:
502 case KEV_DL_LINK_ADDRESS_CHANGED
:
503 case KEV_DL_WAKEFLAGS_CHANGED
:
504 #ifdef KEV_DL_IFCAP_CHANGED
505 case KEV_DL_IFCAP_CHANGED
:
506 #endif // KEV_DL_IFCAP_CHANGED
515 #ifdef KEV_ND6_SUBCLASS
516 case KEV_ND6_SUBCLASS
: {
517 eventName
= nd6EventNameString(ev_msg
->event_code
);
518 switch (ev_msg
->event_code
) {
519 case KEV_KEV_ND6_RA
:
528 #endif // KEV_ND6_SUBCLASS
529 case KEV_LOG_SUBCLASS
: {
537 if (handled
== FALSE
) {
540 evStr
= CFStringCreateWithCString(NULL
,
541 (eventName
!= NULL
) ? eventName
: "New Apple network subclass",
542 kCFStringEncodingASCII
);
543 logEvent(evStr
, ev_msg
);
550 eventCallback(CFSocketRef s
, CFSocketCallBackType type
, CFDataRef address
, const void *data
, void *info
)
552 int so
= CFSocketGetNative(s
);
556 struct kern_event_msg ev_msg1
; // first kernel event
558 struct kern_event_msg
*ev_msg
= &buf
.ev_msg1
;
561 status
= recv(so
, &buf
, sizeof(buf
), 0);
563 SCLog(TRUE
, LOG_ERR
, CFSTR("recv() failed: %s"), strerror(errno
));
569 while (offset
< status
) {
570 if ((offset
+ ev_msg
->total_size
) > status
) {
571 SCLog(TRUE
, LOG_NOTICE
, CFSTR("missed SYSPROTO_EVENT event, buffer not big enough"));
575 switch (ev_msg
->vendor_code
) {
576 case KEV_VENDOR_APPLE
:
577 switch (ev_msg
->kev_class
) {
578 case KEV_NETWORK_CLASS
:
579 processEvent_Apple_Network(ev_msg
);
581 case KEV_IOKIT_CLASS
:
582 case KEV_SYSTEM_CLASS
:
583 case KEV_APPLESHARE_CLASS
:
584 case KEV_FIREWALL_CLASS
:
585 case KEV_IEEE80211_CLASS
:
588 /* unrecognized (Apple) event class */
589 logEvent(CFSTR("New (Apple) class"), ev_msg
);
594 /* unrecognized vendor code */
595 logEvent(CFSTR("New vendor"), ev_msg
);
598 offset
+= ev_msg
->total_size
;
599 ev_msg
= (struct kern_event_msg
*)(void *)&buf
.bytes
[offset
];
604 post_network_changed();
610 SCLog(TRUE
, LOG_ERR
, CFSTR("kernel event monitor disabled."));
611 CFSocketInvalidate(s
);
618 prime_KernelEventMonitor()
620 struct ifaddrs
*ifap
= NULL
;
621 struct ifaddrs
*scan
;
624 SCLog(_verbose
, LOG_DEBUG
, CFSTR("prime() called"));
628 sock
= dgram_socket(AF_INET
);
630 SCLog(TRUE
, LOG_ERR
, CFSTR("could not get interface list, socket() failed: %s"), strerror(errno
));
634 if (getifaddrs(&ifap
) == -1) {
637 CFSTR("could not get interface info, getifaddrs() failed: %s"),
642 /* update list of interfaces & link status */
643 for (scan
= ifap
; scan
!= NULL
; scan
= scan
->ifa_next
) {
644 if (scan
->ifa_addr
== NULL
645 || scan
->ifa_addr
->sa_family
!= AF_LINK
) {
648 /* get the per-interface link/media information */
649 link_add(scan
->ifa_name
);
653 * update IPv4 network addresses already assigned to
656 interface_update_ipv4(ifap
, NULL
);
659 * update IPv6 network addresses already assigned to
662 interface_update_ipv6(ifap
, NULL
);
673 network_changed
= TRUE
;
674 post_network_changed();
680 kevSocketCopyDescription(const void *info
)
682 return CFStringCreateWithFormat(NULL
, NULL
, CFSTR("<kernel event socket>"));
687 load_KernelEventMonitor(CFBundleRef bundle
, Boolean bundleVerbose
)
689 CFSocketContext context
= { 0
693 , kevSocketCopyDescription
696 struct kev_request kev_req
;
697 CFRunLoopSourceRef rls
;
705 SCLog(_verbose
, LOG_DEBUG
, CFSTR("load() called"));
706 SCLog(_verbose
, LOG_DEBUG
, CFSTR(" bundle ID = %@"), CFBundleGetIdentifier(bundle
));
708 /* open a "configd" session to allow cache updates */
709 store
= SCDynamicStoreCreate(NULL
,
710 CFSTR("Kernel Event Monitor plug-in"),
714 SCLog(TRUE
, LOG_ERR
, CFSTR("SCDnamicStoreCreate() failed: %s"), SCErrorString(SCError()));
715 SCLog(TRUE
, LOG_ERR
, CFSTR("kernel event monitor disabled."));
719 /* Open an event socket */
720 so
= socket(PF_SYSTEM
, SOCK_RAW
, SYSPROTO_EVENT
);
722 /* establish filter to return events of interest */
723 kev_req
.vendor_code
= KEV_VENDOR_APPLE
;
724 kev_req
.kev_class
= KEV_NETWORK_CLASS
;
725 kev_req
.kev_subclass
= KEV_ANY_SUBCLASS
;
726 status
= ioctl(so
, SIOCSKEVFILT
, &kev_req
);
728 SCLog(TRUE
, LOG_ERR
, CFSTR("could not establish event filter, ioctl() failed: %s"), strerror(errno
));
733 SCLog(TRUE
, LOG_ERR
, CFSTR("could not open event socket, socket() failed: %s"), strerror(errno
));
739 status
= ioctl(so
, FIONBIO
, &yes
);
741 SCLog(TRUE
, LOG_ERR
, CFSTR("could not set non-blocking io, ioctl() failed: %s"), strerror(errno
));
748 SCLog(TRUE
, LOG_ERR
, CFSTR("kernel event monitor disabled."));
753 /* Create a CFSocketRef for the PF_SYSTEM kernel event socket */
754 es
= CFSocketCreateWithNative(NULL
,
756 kCFSocketReadCallBack
,
760 /* Create and add a run loop source for the event socket */
761 rls
= CFSocketCreateRunLoopSource(NULL
, es
, 0);
762 CFRunLoopAddSource(CFRunLoopGetCurrent(), rls
, kCFRunLoopDefaultMode
);
773 #define appendAddress appendAddress_v4
774 #define getIF getIF_v4
775 #define updateStore updateStore_v4
781 #define appendAddress appendAddress_v6
782 #define getIF getIF_v6
783 #define updateStore updateStore_v6
790 main(int argc
, char **argv
)
793 _sc_verbose
= (argc
> 1) ? TRUE
: FALSE
;
795 load_KernelEventMonitor(CFBundleGetMainBundle(), (argc
> 1) ? TRUE
: FALSE
);
796 prime_KernelEventMonitor();