EventFactory/IPMonitorParser.m

   1 /*
   2  * Copyright (c) 2018 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import <Foundation/Foundation.h>
  25 #import <EventFactory/EventFactory.h>
  26
  27 #import "IPMonitorParser.h"
  28
  29 #define TokenInterfaceNameV6 "interfaceNameV6"
  30 #define TokenAddressAction "addressAction"
  31 #define TokenAddressAction6 "addressAction6"
  32 #define TokenAddress "address"
  33 #define TokenAddress6 "address6"
  34 #define TokenServiceID "serviceID"
  35 #define TokenV4Changes "v4Changes"
  36 #define TokenV6Changes "v6Changes"
  37
  38 @interface IPMonitorParser ()
  39 @property (readonly, nonatomic) NSRegularExpression *netChangeRegex;
  40 @end
  41
  42 @implementation IPMonitorParser
  43
  44 - (instancetype)init
  45 {
  46         NSError *regexError = nil;
  47         _netChangeRegex = [[NSRegularExpression alloc] initWithPattern:@"(?<"TokenInterfaceName">\\w+)(?<"TokenAddressAction">[\\+\\-\\!\\/\\\\]?)(:(?<"TokenAddress">[:.0-9a-f]+))?" options:0 error:&regexError];
  48         if (_netChangeRegex == nil) {
  49                 specs_log_err("Failed to create the network change regex: %@", regexError);
  50                 return nil;
  51         }
  52
  53         NSArray<EFLogEventMatch *> *matches = @[
  54                 [[EFLogEventMatch alloc] initWithPattern:@"\\d+. (?<"TokenInterfaceName">\\w+) serviceID=(?<"TokenServiceID">[-\\w]+) addr=(?<"TokenAddress">) rank=\\w+"
  55                                          newEventHandler:
  56                  ^EFEvent *(NSTextCheckingResult *matchResult, EFLogEvent *logEvent, BOOL *isComplete) {
  57                          *isComplete = YES;
  58                          EFNetworkControlPathEvent *newEvent = nil;
  59                          NSString *serviceID = [logEvent substringForCaptureGroup:@TokenServiceID inMatchResult:matchResult];
  60                          NSString *addressString = [logEvent substringForCaptureGroup:@TokenAddress inMatchResult:matchResult];
  61                          if (serviceID != nil && addressString != nil) {
  62                                  newEvent = [self createInterfaceEventWithLogEvent:logEvent matchResult:matchResult];
  63                                  if (newEvent != nil) {
  64                                          newEvent.serviceID = serviceID;
  65                                          [self addAddress:addressString toInterfaceEvent:newEvent];
  66                                  }
  67                          }
  68                          return newEvent;
  69                  }],
  70                 [[EFLogEventMatch alloc] initWithPattern:@"network changed:( v4\\((?<"TokenV4Changes">[^\\)]+)\\))?( v6\\((?<"TokenV6Changes">[^\\)]+)\\))?"
  71                                  multipleNewEventHandler:
  72                  ^NSArray<EFEvent *> *(NSTextCheckingResult *matchResult, EFLogEvent *logEvent) {
  73                          NSMutableDictionary<NSString *, EFNetworkControlPathEvent *> *newEventsMap = nil;
  74                          NSArray<NSString *> *tokens = @[ @TokenV4Changes, @TokenV6Changes ];
  75                          for (NSString *token in tokens) {
  76                                  BOOL isIPv4 = [token isEqualToString:@TokenV4Changes];
  77                                  NSString *changes = [logEvent substringForCaptureGroup:token inMatchResult:matchResult];
  78                                  if (changes == nil) {
  79                                          continue;
  80                                  }
  81                                  NSArray<NSTextCheckingResult *> *matches = [self.netChangeRegex matchesInString:changes options:0 range:NSMakeRange(0, changes.length)];
  82                                  BOOL isPrimary = YES;
  83                                  for (NSTextCheckingResult *match in matches) {
  84                                          NSString *interfaceName = [self substringOfString:changes forCaptureGroup:@TokenInterfaceName inMatchResult:match];
  85                                          NSString *addressAction = [self substringOfString:changes forCaptureGroup:@TokenAddressAction inMatchResult:match];
  86                                          NSString *address = [self substringOfString:changes forCaptureGroup:@TokenAddress inMatchResult:match];
  87
  88                                          if (interfaceName == nil || address.length == 0) {
  89                                                  continue;
  90                                          }
  91
  92                                          EFNetworkControlPathEvent *event = newEventsMap[interfaceName];
  93                                          if (event == nil) {
  94                                                  event = [self createInterfaceEventWithLogEvent:logEvent interfaceName:interfaceName];
  95                                                  if (newEventsMap == nil) {
  96                                                          newEventsMap = [[NSMutableDictionary alloc] init];
  97                                                  }
  98                                                  newEventsMap[interfaceName] = event;
  99                                          }
 100
 101                                          if (addressAction.length > 0 && [addressAction isEqualToString:@"-"]) {
 102                                                  if (isPrimary) {
 103                                                          if (isIPv4) {
 104                                                                  event.primaryStateIPv4 = EFPrimaryStateNotPrimary;
 105                                                          } else {
 106                                                                  event.primaryStateIPv6 = EFPrimaryStateNotPrimary;
 107                                                          }
 108                                                  }
 109                                                  [self removeAddress:address fromInterfaceEvent:event];
 110                                          } else {
 111                                                  if (isPrimary) {
 112                                                          if (isIPv4) {
 113                                                                  event.primaryStateIPv4 = EFPrimaryStatePrimary;
 114                                                          } else {
 115                                                                  event.primaryStateIPv6 = EFPrimaryStatePrimary;
 116                                                          }
 117                                                          for (NSString *otherInterfaceName in SCLogParser.interfaceMap) {
 118                                                                  if ([otherInterfaceName isEqualToString:interfaceName]) {
 119                                                                          continue;
 120                                                                  }
 121                                                                  EFNetworkControlPathEvent *otherEvent = newEventsMap[otherInterfaceName];
 122                                                                  if (otherEvent == nil) {
 123                                                                          otherEvent = [self createInterfaceEventWithLogEvent:logEvent interfaceName:otherInterfaceName];
 124                                                                          if (newEventsMap == nil) {
 125                                                                                  newEventsMap = [[NSMutableDictionary alloc] init];
 126                                                                          }
 127                                                                          newEventsMap[otherInterfaceName] = otherEvent;
 128                                                                  }
 129                                                                  if (isIPv4) {
 130                                                                          otherEvent.primaryStateIPv4 = EFPrimaryStateNotPrimary;
 131                                                                  } else {
 132                                                                          otherEvent.primaryStateIPv6 = EFPrimaryStateNotPrimary;
 133                                                                  }
 134                                                          }
 135                                                          isPrimary = NO;
 136                                                  }
 137                                                  [self addAddress:address toInterfaceEvent:event];
 138                                          }
 139                                  }
 140                          }
 141                          return newEventsMap.allValues;
 142                  }],
 143         ];
 144         EFLogEventParser *parser = [[EFLogEventParser alloc] initWithMatches:matches];
 145         return [super initWithCategory:@"IPMonitor" eventParser:parser];
 146 }
 147
 148 @end