enableProxy_darwin.go

//go:build darwin

package main

import (
	"bufio"
	"bytes"
	"fmt"
	"log"
	"os"
	"os/exec"
	"strconv"
	"strings"
)

func enableProxy(port int) error {
	if err := requireRoot(); err != nil {
		return err
	}
	services, err := listEnabledNetworkServices()
	if err != nil {
		return err
	}

	// If a state file already exists, an earlier enable left it behind (or
	// we're recovering from a crash). Don't overwrite it — those are the
	// real original settings.
	existing, _ := loadProxyState()
	if existing == nil {
		state := &proxyState{Platform: "darwin"}
		for _, svc := range services {
			ss, err := readServiceState(svc)
			if err != nil {
				log.Printf("read state for %q: %v", svc, err)
				ss = proxyServiceState{Service: svc}
			}
			state.Services = append(state.Services, ss)
		}
		if err := saveProxyState(state); err != nil {
			return fmt.Errorf("save proxy state: %w", err)
		}
	}

	portStr := strconv.Itoa(port)
	var firstErr error
	for _, svc := range services {
		for _, kind := range []string{"-setwebproxy", "-setsecurewebproxy"} {
			if err := runCmd("networksetup", kind, svc, "127.0.0.1", portStr); err != nil && firstErr == nil {
				firstErr = err
			}
		}
	}
	return firstErr
}

func disableProxy() error {
	if err := requireRoot(); err != nil {
		return err
	}

	state, err := loadProxyState()
	if err != nil {
		log.Printf("load proxy state: %v", err)
	}

	if state != nil && state.Platform == "darwin" && len(state.Services) > 0 {
		var firstErr error
		for _, ss := range state.Services {
			if err := restoreServiceState(ss); err != nil && firstErr == nil {
				firstErr = err
			}
		}
		_ = clearProxyState()
		return firstErr
	}

	// No saved state — fall back to "just turn off" so a hand-launched
	// recovery still works.
	services, err := listEnabledNetworkServices()
	if err != nil {
		return err
	}
	var firstErr error
	for _, svc := range services {
		for _, kind := range []string{"-setwebproxystate", "-setsecurewebproxystate"} {
			if err := runCmd("networksetup", kind, svc, "off"); err != nil && firstErr == nil {
				firstErr = err
			}
		}
	}
	_ = clearProxyState()
	return firstErr
}

// restoreServiceState restores the saved settings for one network service.
// `networksetup -setwebproxy` both sets host/port and enables; we then
// toggle the state off if the original was disabled, preserving host/port.
func restoreServiceState(ss proxyServiceState) error {
	svc := ss.Service
	if svc == "" {
		return nil
	}
	var firstErr error
	// HTTP
	if ss.HTTPHost != "" && ss.HTTPPort > 0 {
		if err := runCmd("networksetup", "-setwebproxy", svc, ss.HTTPHost, strconv.Itoa(ss.HTTPPort)); err != nil && firstErr == nil {
			firstErr = err
		}
		if !ss.HTTPEnabled {
			if err := runCmd("networksetup", "-setwebproxystate", svc, "off"); err != nil && firstErr == nil {
				firstErr = err
			}
		}
	} else {
		if err := runCmd("networksetup", "-setwebproxystate", svc, "off"); err != nil && firstErr == nil {
			firstErr = err
		}
	}
	// HTTPS
	if ss.HTTPSHost != "" && ss.HTTPSPort > 0 {
		if err := runCmd("networksetup", "-setsecurewebproxy", svc, ss.HTTPSHost, strconv.Itoa(ss.HTTPSPort)); err != nil && firstErr == nil {
			firstErr = err
		}
		if !ss.HTTPSEnabled {
			if err := runCmd("networksetup", "-setsecurewebproxystate", svc, "off"); err != nil && firstErr == nil {
				firstErr = err
			}
		}
	} else {
		if err := runCmd("networksetup", "-setsecurewebproxystate", svc, "off"); err != nil && firstErr == nil {
			firstErr = err
		}
	}
	return firstErr
}

// readServiceState captures the current HTTP + HTTPS proxy settings for a
// single network service so they can be restored later.
func readServiceState(svc string) (proxyServiceState, error) {
	ss := proxyServiceState{Service: svc}
	httpEnabled, httpHost, httpPort, err := parseNetworksetupProxy("networksetup", "-getwebproxy", svc)
	if err != nil {
		return ss, err
	}
	ss.HTTPEnabled = httpEnabled
	ss.HTTPHost = httpHost
	ss.HTTPPort = httpPort
	httpsEnabled, httpsHost, httpsPort, err := parseNetworksetupProxy("networksetup", "-getsecurewebproxy", svc)
	if err != nil {
		return ss, err
	}
	ss.HTTPSEnabled = httpsEnabled
	ss.HTTPSHost = httpsHost
	ss.HTTPSPort = httpsPort
	return ss, nil
}

// parseNetworksetupProxy runs `networksetup -getwebproxy <svc>` (or
// -getsecurewebproxy) and extracts Enabled/Server/Port. Sample output:
//
//	Enabled: Yes
//	Server: proxy.corp.com
//	Port: 3128
//	Authenticated Proxy Enabled: 0
func parseNetworksetupProxy(name string, args ...string) (bool, string, int, error) {
	out, err := exec.Command(name, args...).Output()
	if err != nil {
		return false, "", 0, fmt.Errorf("%s %s: %w", name, strings.Join(args, " "), err)
	}
	enabled, host, port := scanProxyFields(out)
	return enabled, host, port, nil
}

// scanProxyFields parses the key/value lines emitted by `networksetup
// -getwebproxy` / `-getsecurewebproxy`. Exported via package-internal use
// for testability — the test suite calls this directly with canned bytes.
func scanProxyFields(out []byte) (enabled bool, host string, port int) {
	scanner := bufio.NewScanner(bytes.NewReader(out))
	for scanner.Scan() {
		line := scanner.Text()
		if v, ok := strings.CutPrefix(line, "Enabled: "); ok {
			enabled = strings.EqualFold(strings.TrimSpace(v), "Yes")
		} else if v, ok := strings.CutPrefix(line, "Server: "); ok {
			host = strings.TrimSpace(v)
		} else if v, ok := strings.CutPrefix(line, "Port: "); ok {
			n, err := strconv.Atoi(strings.TrimSpace(v))
			if err == nil {
				port = n
			}
		}
	}
	return enabled, host, port
}

func requireRoot() error {
	if os.Geteuid() != 0 {
		return fmt.Errorf("modifying network proxy on macOS requires root; rerun with sudo")
	}
	return nil
}

func listEnabledNetworkServices() ([]string, error) {
	out, err := exec.Command("networksetup", "-listallnetworkservices").Output()
	if err != nil {
		return nil, fmt.Errorf("networksetup -listallnetworkservices: %w", err)
	}
	var services []string
	scanner := bufio.NewScanner(bytes.NewReader(out))
	first := true
	for scanner.Scan() {
		line := strings.TrimSpace(scanner.Text())
		if first {
			// "An asterisk (*) denotes that a network service is disabled." preamble
			first = false
			continue
		}
		if line == "" || strings.HasPrefix(line, "*") {
			continue
		}
		services = append(services, line)
	}
	return services, scanner.Err()
}

func runCmd(name string, args ...string) error {
	cmd := exec.Command(name, args...)
	out, err := cmd.CombinedOutput()
	if err != nil {
		return fmt.Errorf("%s %s: %w (%s)", name, strings.Join(args, " "), err, strings.TrimSpace(string(out)))
	}
	return nil
}