openvpn3/openvpn/tun/mac/macdns_watchdog.hpp

//    OpenVPN -- An application to securely tunnel IP networks
//               over a single port, with support for SSL/TLS-based
//               session authentication and key exchange,
//               packet encryption, packet authentication, and
//               packet compression.
//
//    Copyright (C) 2012-2022 OpenVPN Inc.
//
//    This program is free software: you can redistribute it and/or modify
//    it under the terms of the GNU Affero General Public License Version 3
//    as published by the Free Software Foundation.
//
//    This program is distributed in the hope that it will be useful,
//    but WITHOUT ANY WARRANTY; without even the implied warranty of
//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
//    GNU Affero General Public License for more details.
//
//    You should have received a copy of the GNU Affero General Public License
//    along with this program in the COPYING file.
//    If not, see <http://www.gnu.org/licenses/>.

// DNS utilities for Mac

#ifndef OPENVPN_TUN_MAC_MACDNS_WATCHDOG_H
#define OPENVPN_TUN_MAC_MACDNS_WATCHDOG_H

#include <thread>
#include <mutex>

#include <openvpn/log/logthread.hpp>
#include <openvpn/common/action.hpp>
#include <openvpn/apple/cf/cftimer.hpp>
#include <openvpn/apple/cf/cfrunloop.hpp>
#include <openvpn/tun/mac/macdns.hpp>

namespace openvpn {
OPENVPN_EXCEPTION(macdns_watchdog_error);

class MacDNSWatchdog : public RC<thread_unsafe_refcount>
{
  public:
    typedef RCPtr<MacDNSWatchdog> Ptr;

    // flags
    enum
    {
        ENABLE_WATCHDOG = (1 << 0),
        SYNCHRONOUS = (1 << 1),
        FLUSH_RECONFIG = (1 << 2),
    };

    class DNSAction : public Action
    {
      public:
        typedef RCPtr<DNSAction> Ptr;

        DNSAction(const MacDNSWatchdog::Ptr &parent_arg,
                  const MacDNS::Config::Ptr &config_arg,
                  const unsigned int flags_arg)
            : parent(parent_arg),
              config(config_arg),
              flags(flags_arg)
        {
        }

        void execute(std::ostream &os) override
        {
            os << to_string() << std::endl;
            if (parent)
                parent->setdns(config, flags);
        }

        std::string to_string() const override
        {
            std::ostringstream os;
            os << "MacDNSAction: FLAGS=";
            if (flags & ENABLE_WATCHDOG)
                os << 'E';
            if (flags & SYNCHRONOUS)
                os << 'S';
            if (flags & FLUSH_RECONFIG)
                os << 'F';
            if (config)
                os << ' ' << config->to_string();
            return os.str();
        }

      private:
        const MacDNSWatchdog::Ptr parent;
        const MacDNS::Config::Ptr config;
        const unsigned int flags;
    };

    MacDNSWatchdog()
        : macdns(new MacDNS("OpenVPNConnect")),
          thread(nullptr)
    {
    }

    virtual ~MacDNSWatchdog()
    {
        stop_thread();
    }

    static void add_actions(const MacDNS::Config::Ptr &dns,
                            const unsigned int flags,
                            ActionList &create,
                            ActionList &destroy)
    {
        MacDNSWatchdog::Ptr watchdog(new MacDNSWatchdog);
        MacDNS::Config::Ptr dns_remove;
        DNSAction::Ptr create_action(new DNSAction(watchdog, dns, flags));
        DNSAction::Ptr destroy_action(new DNSAction(watchdog, dns_remove, flags));
        create.add(create_action);
        destroy.add(destroy_action);
    }

  private:
    bool setdns(const MacDNS::Config::Ptr &config, const unsigned int flags)
    {
        bool mod = false;
        if (config)
        {
            if ((flags & SYNCHRONOUS) || !(flags & ENABLE_WATCHDOG))
                stop_thread();
            config_ = config;
            if (flags & ENABLE_WATCHDOG)
            {
                if (!thread)
                {
                    mod = macdns->setdns(*config_);
                    thread = new std::thread(&MacDNSWatchdog::thread_func, this);
                }
                else
                {
                    if (runloop.defined())
                        schedule_push_timer(0);
                    else
                        OPENVPN_LOG("MacDNSWatchdog::setdns: runloop undefined");
                }
            }
            else
            {
                mod = macdns->setdns(*config_);
            }
        }
        else
        {
            stop_thread();
            config_.reset();
            mod = macdns->resetdns();
        }
        if (mod && (flags & FLUSH_RECONFIG))
        {
            macdns->flush_cache();
            macdns->signal_network_reconfiguration();
        }
        return mod;
    }

    std::string to_string() const
    {
        const MacDNS::Config::Ptr config(config_);
        if (config)
            return config->to_string();
        else
            return std::string("UNDEF");
    }

    void stop_thread()
    {
        if (thread)
        {
            if (runloop.defined())
                CFRunLoopStop(runloop());
            thread->join();
            delete thread;
            thread = nullptr;
        }
    }

    // All methods below this point called in the context of watchdog thread
    // except for schedule_push_timer which may be called from parent thread
    // as well.
    void thread_func()
    {
        runloop.reset(CFRunLoopGetCurrent(), CF::GET);
        Log::Context logctx(logwrap);

        try
        {
            SCDynamicStoreContext context = {0, this, nullptr, nullptr, nullptr};
            CF::DynamicStore ds(SCDynamicStoreCreate(kCFAllocatorDefault,
                                                     CFSTR("OpenVPN_MacDNSWatchdog"),
                                                     callback_static,
                                                     &context));
            if (!ds.defined())
                throw macdns_watchdog_error("SCDynamicStoreCreate");
            const CF::Array watched_keys(macdns->dskey_array());
            if (!watched_keys.defined())
                throw macdns_watchdog_error("watched_keys is undefined");
            if (!SCDynamicStoreSetNotificationKeys(ds(),
                                                   watched_keys(),
                                                   nullptr))
                throw macdns_watchdog_error("SCDynamicStoreSetNotificationKeys failed");
            CF::RunLoopSource rls(SCDynamicStoreCreateRunLoopSource(kCFAllocatorDefault, ds(), 0));
            if (!rls.defined())
                throw macdns_watchdog_error("SCDynamicStoreCreateRunLoopSource failed");
            CFRunLoopAddSource(CFRunLoopGetCurrent(), rls(), kCFRunLoopDefaultMode);

            // process event loop until CFRunLoopStop is called from parent thread
            CFRunLoopRun();
        }
        catch (const std::exception &e)
        {
            OPENVPN_LOG("MacDNSWatchdog::thread_func exception: " << e.what());
        }
        cancel_push_timer();
    }

    static void callback_static(SCDynamicStoreRef store, CFArrayRef changedKeys, void *arg)
    {
        MacDNSWatchdog *self = (MacDNSWatchdog *)arg;
        self->callback(store, changedKeys);
    }

    void callback(SCDynamicStoreRef store, CFArrayRef changedKeys)
    {
        // DNS Watchdog delay from the time that change is detected
        // to when we forcibly revert it (seconds).
        schedule_push_timer(1);
    }

    void schedule_push_timer(const int seconds)
    {
        std::lock_guard<std::mutex> lock(push_timer_lock);
        CFRunLoopTimerContext context = {0, this, nullptr, nullptr, nullptr};
        cancel_push_timer_nolock();
        push_timer.reset(CFRunLoopTimerCreate(kCFAllocatorDefault, CFAbsoluteTimeGetCurrent() + seconds, 0, 0, 0, push_timer_callback_static, &context));
        if (push_timer.defined())
            CFRunLoopAddTimer(runloop(), push_timer(), kCFRunLoopCommonModes);
        else
            OPENVPN_LOG("MacDNSWatchdog::schedule_push_timer: failed to create timer");
    }

    void cancel_push_timer_nolock()
    {
        if (push_timer.defined())
        {
            CFRunLoopTimerInvalidate(push_timer());
            push_timer.reset(nullptr);
        }
    }

    void cancel_push_timer()
    {
        std::lock_guard<std::mutex> lock(push_timer_lock);
        cancel_push_timer_nolock();
    }

    static void push_timer_callback_static(CFRunLoopTimerRef timer, void *info)
    {
        MacDNSWatchdog *self = (MacDNSWatchdog *)info;
        self->push_timer_callback(timer);
    }

    void push_timer_callback(CFRunLoopTimerRef timer)
    {
        try
        {
            // reset DNS settings after watcher detected modifications by third party
            const MacDNS::Config::Ptr config(config_);
            if (macdns->setdns(*config))
                OPENVPN_LOG("MacDNSWatchdog: updated DNS settings");
        }
        catch (const std::exception &e)
        {
            OPENVPN_LOG("MacDNSWatchdog::push_timer_callback exception: " << e.what());
        }
    }


    MacDNS::Config::Ptr config_;
    MacDNS::Ptr macdns;

    std::thread *thread;  // watcher thread
    CF::RunLoop runloop;  // run loop in watcher thread
    CF::Timer push_timer; // watcher thread timer
    std::mutex push_timer_lock;
    Log::Context::Wrapper logwrap; // used to carry forward the log context from parent thread
};
} // namespace openvpn

#endif