Add support for MAC and hostname rule items

Author: nekohasekai

ApplicationLibrary/Views/Setting/CoreView.swift

@@ -175,7 +175,7 @@ public struct CoreView: View {
                 self.helperUnavailable = helperUnavailable
             #endif
             self.dataSize = dataSize
-            self.dataSizeLoaded = true
+            dataSizeLoaded = true
         }
     }
 

HelperService/RootHelperService.swift

@@ -1,11 +1,32 @@
 import Foundation
+import Libbox
 import Library
+import Network
 import os
 
 private let logger = Logger(category: "RootHelper")
 
+private class NeighborGoListener: NSObject, LibboxNeighborUpdateListenerProtocol {
+    private weak var service: RootHelperService?
+
+    init(service: RootHelperService) {
+        self.service = service
+    }
+
+    func updateNeighborTable(_ entries: (any LibboxNeighborEntryIteratorProtocol)?) {
+        guard let entries, let service else { return }
+        service.pushNeighborTable(entries: entries)
+    }
+}
+
 class RootHelperService: NSObject {
     private var listener: NSXPCListener?
+    private var neighborSubscription: LibboxNeighborSubscription?
+    private var neighborCallbackConnection: NSXPCConnection?
+    private var neighborLeaseWatcher: DispatchSourceFileSystemObject?
+    private var pathMonitor: NWPathMonitor?
+    private var pendingNATFlush: DispatchWorkItem?
+    private var tunInterfaceName: String?
 
     func start() {
         listener = NSXPCListener(machServiceName: AppConfiguration.rootHelperMachService)
@@ -86,4 +107,249 @@ extension RootHelperService: RootHelperProtocol {
     func getVersion(reply: @escaping (String) -> Void) {
         reply(Bundle.main.version)
     }
+
+    func startNeighborMonitor(callbackEndpoint: NSXPCListenerEndpoint, reply: @escaping (NSError?) -> Void) {
+        logger.info("startNeighborMonitor")
+        closeNeighborMonitorInternal()
+
+        let callbackConnection = NSXPCConnection(listenerEndpoint: callbackEndpoint)
+        let listenerInterface = NSXPCInterface(with: NeighborTableListenerProtocol.self)
+        RootHelperXPC.configureListenerInterface(listenerInterface)
+        callbackConnection.remoteObjectInterface = listenerInterface
+        callbackConnection.resume()
+        neighborCallbackConnection = callbackConnection
+
+        let goListener = NeighborGoListener(service: self)
+        var error: NSError?
+        let subscription = LibboxSubscribeNeighborTable(goListener, &error)
+        if let error {
+            logger.error("startNeighborMonitor: \(error.localizedDescription)")
+            callbackConnection.invalidate()
+            neighborCallbackConnection = nil
+            reply(error)
+            return
+        }
+        neighborSubscription = subscription
+        startLeaseFileWatcher()
+        startNATCleaner()
+        reply(nil)
+    }
+
+    func registerMyInterface(name: String, reply: @escaping (NSError?) -> Void) {
+        logger.info("registerMyInterface: \(name)")
+        tunInterfaceName = name
+        flushInternetSharingNAT()
+        reply(nil)
+    }
+
+    func closeNeighborMonitor(reply: @escaping (NSError?) -> Void) {
+        logger.info("closeNeighborMonitor")
+        closeNeighborMonitorInternal()
+        reply(nil)
+    }
+
+    private func closeNeighborMonitorInternal() {
+        neighborSubscription?.close()
+        neighborSubscription = nil
+        neighborLeaseWatcher?.cancel()
+        neighborLeaseWatcher = nil
+        pendingNATFlush?.cancel()
+        pendingNATFlush = nil
+        pathMonitor?.cancel()
+        pathMonitor = nil
+        tunInterfaceName = nil
+        neighborCallbackConnection?.invalidate()
+        neighborCallbackConnection = nil
+    }
+
+    func pushNeighborTable(entries: LibboxNeighborEntryIteratorProtocol) {
+        guard let callbackConnection = neighborCallbackConnection else {
+            logger.warning("pushNeighborTable: no callback connection")
+            return
+        }
+        guard let proxy = callbackConnection.remoteObjectProxyWithErrorHandler({ error in
+            logger.error("pushNeighborTable XPC error: \(error.localizedDescription)")
+        }) as? NeighborTableListenerProtocol else {
+            logger.warning("pushNeighborTable: failed to get proxy")
+            return
+        }
+
+        let leaseIterator = LibboxReadBootpdLeases()
+        var leaseEntries: [NeighborEntryResult] = []
+        var leaseHostnamesByMAC: [String: String] = [:]
+        var leaseHostnamesByIP: [String: String] = [:]
+        if let leaseIterator {
+            while leaseIterator.hasNext() {
+                guard let entry = leaseIterator.next() else { continue }
+                leaseEntries.append(NeighborEntryResult(
+                    address: entry.address,
+                    macAddress: entry.macAddress,
+                    hostname: entry.hostname
+                ))
+                if !entry.hostname.isEmpty {
+                    leaseHostnamesByMAC[entry.macAddress] = entry.hostname
+                    leaseHostnamesByIP[entry.address] = entry.hostname
+                }
+            }
+        }
+        logger.debug("pushNeighborTable: leases=\(leaseEntries.count), hostnames=\(leaseHostnamesByMAC.count)")
+
+        var results: [NeighborEntryResult] = []
+        var seenAddresses: Set<String> = []
+        while entries.hasNext() {
+            guard let entry = entries.next() else { continue }
+            seenAddresses.insert(entry.address)
+            var hostname = entry.hostname
+            if hostname.isEmpty {
+                hostname = leaseHostnamesByIP[entry.address] ?? leaseHostnamesByMAC[entry.macAddress] ?? ""
+            }
+            results.append(NeighborEntryResult(
+                address: entry.address,
+                macAddress: entry.macAddress,
+                hostname: hostname
+            ))
+        }
+        for leaseEntry in leaseEntries {
+            if !seenAddresses.contains(leaseEntry.address) {
+                results.append(leaseEntry)
+            }
+        }
+        logger.debug("pushNeighborTable: \(results.count) entries")
+        proxy.updateNeighborTable(entries: results as NSArray)
+    }
+
+    private func startNATCleaner() {
+        flushInternetSharingNAT()
+        let monitor = NWPathMonitor()
+        let queue = DispatchQueue(label: "nat-cleaner")
+        monitor.pathUpdateHandler = { [weak self] path in
+            guard let self else { return }
+            logger.debug("NATCleaner: path update, status=\(String(describing: path.status)), interfaces=\(path.availableInterfaces.map(\.name))")
+            self.pendingNATFlush?.cancel()
+            let workItem = DispatchWorkItem { [weak self] in
+                self?.flushInternetSharingNAT()
+            }
+            self.pendingNATFlush = workItem
+            queue.asyncAfter(deadline: .now() + 2, execute: workItem)
+        }
+        monitor.start(queue: queue)
+        pathMonitor = monitor
+    }
+
+    private func flushInternetSharingNAT() {
+        guard let tunName = tunInterfaceName, !tunName.isEmpty else {
+            logger.debug("flushInternetSharingNAT: no tun interface name set")
+            return
+        }
+        let anchors = [
+            "com.apple.internet-sharing/shared_v4",
+            "com.apple.internet-sharing/shared_v6",
+        ]
+        let filter = " on \(tunName) "
+        for anchor in anchors {
+            removeNATRulesForInterface(anchor: anchor, filter: filter)
+        }
+    }
+
+    private func removeNATRulesForInterface(anchor: String, filter: String) {
+        let readProcess = Process()
+        readProcess.executableURL = URL(fileURLWithPath: "/sbin/pfctl")
+        readProcess.arguments = ["-a", anchor, "-s", "nat"]
+        let readPipe = Pipe()
+        readProcess.standardOutput = readPipe
+        readProcess.standardError = FileHandle.nullDevice
+        do {
+            try readProcess.run()
+        } catch {
+            logger.error("removeNATRules: failed to read \(anchor): \(error.localizedDescription)")
+            return
+        }
+        let output = String(data: readPipe.fileHandleForReading.readDataToEndOfFile(), encoding: .utf8) ?? ""
+        readProcess.waitUntilExit()
+        if readProcess.terminationStatus != 0 {
+            logger.warning("removeNATRules: pfctl -s nat exited with \(readProcess.terminationStatus) for \(anchor)")
+            return
+        }
+        if output.isEmpty {
+            logger.debug("removeNATRules: \(anchor) has no NAT rules")
+            return
+        }
+        guard output.contains(filter) else {
+            logger.debug("removeNATRules: \(anchor) has no rules matching \(filter)")
+            return
+        }
+        let lines = output.components(separatedBy: "\n")
+        let removed = lines.filter { $0.contains(filter) }
+        let remaining = lines.filter { !$0.contains(filter) }.joined(separator: "\n")
+        logger.info("removeNATRules: \(anchor): removing \(removed.count) rules matching \(filter), keeping \(lines.count - removed.count) rules")
+        for rule in removed {
+            logger.debug("removeNATRules: removing: \(rule)")
+        }
+        let writeProcess = Process()
+        writeProcess.executableURL = URL(fileURLWithPath: "/sbin/pfctl")
+        writeProcess.arguments = ["-a", anchor, "-N", "-f", "-"]
+        let writePipe = Pipe()
+        writePipe.fileHandleForWriting.write(remaining.data(using: .utf8) ?? Data())
+        writePipe.fileHandleForWriting.closeFile()
+        writeProcess.standardInput = writePipe
+        writeProcess.standardOutput = FileHandle.nullDevice
+        let writeErrorPipe = Pipe()
+        writeProcess.standardError = writeErrorPipe
+        do {
+            try writeProcess.run()
+        } catch {
+            logger.error("removeNATRules: failed to write \(anchor): \(error.localizedDescription)")
+            return
+        }
+        let stderrData = writeErrorPipe.fileHandleForReading.readDataToEndOfFile()
+        writeProcess.waitUntilExit()
+        let stderrOutput = String(data: stderrData, encoding: .utf8) ?? ""
+        if writeProcess.terminationStatus != 0 {
+            logger.error("removeNATRules: pfctl -f exited with \(writeProcess.terminationStatus) for \(anchor), stderr: \(stderrOutput)")
+        } else {
+            logger.debug("removeNATRules: successfully updated \(anchor)")
+        }
+    }
+
+    private func startLeaseFileWatcher() {
+        let leasePath = "/var/db/dhcpd_leases"
+        let fd = open(leasePath, O_EVTONLY)
+        guard fd >= 0 else {
+            logger.warning("startLeaseFileWatcher: failed to open \(leasePath), errno=\(errno)")
+            return
+        }
+        let source = DispatchSource.makeFileSystemObjectSource(
+            fileDescriptor: fd,
+            eventMask: [.write, .rename],
+            queue: DispatchQueue.global()
+        )
+        source.setEventHandler { [weak self] in
+            guard let self, neighborSubscription != nil else { return }
+            guard let callbackConnection = neighborCallbackConnection else { return }
+            guard let proxy = callbackConnection.remoteObjectProxyWithErrorHandler({ error in
+                logger.error("leaseWatcher push error: \(error.localizedDescription)")
+            }) as? NeighborTableListenerProtocol else {
+                return
+            }
+
+            let leaseIterator = LibboxReadBootpdLeases()
+            var results: [NeighborEntryResult] = []
+            if let leaseIterator {
+                while leaseIterator.hasNext() {
+                    guard let entry = leaseIterator.next() else { continue }
+                    results.append(NeighborEntryResult(
+                        address: entry.address,
+                        macAddress: entry.macAddress,
+                        hostname: entry.hostname
+                    ))
+                }
+            }
+            proxy.updateNeighborTable(entries: results as NSArray)
+        }
+        source.setCancelHandler {
+            close(fd)
+        }
+        source.resume()
+        neighborLeaseWatcher = source
+    }
 }