4070762277

Build Type

github

Committed by GitHub

Commit Message

<a href="https://github.com/google/santa/commit/<a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/82f1757a16e2896d77feae6a374bfe924a64de8d">82f1757a1<a href="https://github.com/google/santa/commit/82f1757a16e2896d77feae6a374bfe924a64de8d">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/google/santa/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/82f1757a16e2896d77feae6a374bfe924a64de8d&quot;&gt;82f1757a1&lt;/a&gt;&lt;a href=&quot;https://github.com/google/santa/commit/82f1757a16e2896d77feae6a374bfe924a64de8d&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/google/santa/commit/82f1757a16e2896d77feae6a374bfe92&lt;/a&gt;4a64de8d">&quot;&gt;Merge &lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/google/santa/commit/<a class="double-link" href="https://github.com/google/santa/commit/20416372cbf541dcfdc34c860dac3c2d45216a7d">20416372c</a><a href="https://github.com/google/santa/commit/82f1757a16e2896d77feae6a374bfe924a64de8d">&amp;quot;&amp;gt;20416372c&amp;lt;/a&amp;gt;&amp;quot;&amp;gt;20416372c&amp;lt;/a&amp;gt;&amp;lt;a href=&amp;quot;https://github.com/google/santa/commit/82f1757a16e2896d77feae6a374bfe924a64d&lt;/a&gt;e8d&quot;&gt; into &lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/google/santa/commit/<a class="double-link" href="https://github.com/google/santa/commit/3acf3c1d0">3acf3c1d0">3acf3c1d0</a>

Pull Request Pull Request #1031: Restart daemon on log type change

Run Details

3827 of 7752 branches covered (49.37%)

Branch coverage included in aggregate %.

69 of 69 new or added lines in 9 files covered. (100.0%)

13551 of 19001 relevant lines covered (71.32%)

16656.85 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

84.9

/Source/santad/Metrics.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#include "Source/santad/Metrics.h"
#include <EndpointSecurity/ESTypes.h>

#include <memory>

#import "Source/common/SNTLogging.h"
#import "Source/common/SNTXPCMetricServiceInterface.h"
#import "Source/santad/SNTApplicationCoreMetrics.h"

static NSString *const kProcessorAuthorizer = @"Authorizer";
static NSString *const kProcessorDeviceManager = @"DeviceManager";
static NSString *const kProcessorRecorder = @"Recorder";
static NSString *const kProcessorTamperResistance = @"TamperResistance";
static NSString *const kProcessorFileAccessAuthorizer = @"FileAccessAuthorizer";

static NSString *const kEventTypeAuthClone = @"AuthClone";
static NSString *const kEventTypeAuthCopyfile = @"AuthCopyfile";
static NSString *const kEventTypeAuthCreate = @"AuthCreate";
static NSString *const kEventTypeAuthExchangedata = @"AuthExchangedata";
static NSString *const kEventTypeAuthExec = @"AuthExec";
static NSString *const kEventTypeAuthKextload = @"AuthKextload";
static NSString *const kEventTypeAuthLink = @"AuthLink";
static NSString *const kEventTypeAuthMount = @"AuthMount";
static NSString *const kEventTypeAuthOpen = @"AuthOpen";
static NSString *const kEventTypeAuthRemount = @"AuthRemount";
static NSString *const kEventTypeAuthRename = @"AuthRename";
static NSString *const kEventTypeAuthTruncate = @"AuthTruncate";
static NSString *const kEventTypeAuthUnlink = @"AuthUnlink";
static NSString *const kEventTypeNotifyClose = @"NotifyClose";
static NSString *const kEventTypeNotifyExchangedata = @"NotifyExchangedata";
static NSString *const kEventTypeNotifyExec = @"NotifyExec";
static NSString *const kEventTypeNotifyExit = @"NotifyExit";
static NSString *const kEventTypeNotifyFork = @"NotifyFork";
static NSString *const kEventTypeNotifyLink = @"NotifyLink";
static NSString *const kEventTypeNotifyRename = @"NotifyRename";
static NSString *const kEventTypeNotifyUnlink = @"NotifyUnlink";
static NSString *const kEventTypeNotifyUnmount = @"NotifyUnmount";

static NSString *const kEventDispositionDropped = @"Dropped";
static NSString *const kEventDispositionProcessed = @"Processed";

namespace santa::santad {

NSString *const ProcessorToString(Processor processor) {
  switch (processor) {
    case Processor::kAuthorizer: return kProcessorAuthorizer;
    case Processor::kDeviceManager: return kProcessorDeviceManager;
    case Processor::kRecorder: return kProcessorRecorder;
    case Processor::kTamperResistance: return kProcessorTamperResistance;
    case Processor::kFileAccessAuthorizer: return kProcessorFileAccessAuthorizer;
    default:
      [NSException raise:@"Invalid processor" format:@"Unknown processor value: %d", processor];
      return nil;
  }
}

NSString *const EventTypeToString(es_event_type_t eventType) {
  switch (eventType) {
    case ES_EVENT_TYPE_AUTH_CLONE: return kEventTypeAuthClone;
    case ES_EVENT_TYPE_AUTH_COPYFILE: return kEventTypeAuthCopyfile;
    case ES_EVENT_TYPE_AUTH_CREATE: return kEventTypeAuthCreate;
    case ES_EVENT_TYPE_AUTH_EXCHANGEDATA: return kEventTypeAuthExchangedata;
    case ES_EVENT_TYPE_AUTH_EXEC: return kEventTypeAuthExec;
    case ES_EVENT_TYPE_AUTH_KEXTLOAD: return kEventTypeAuthKextload;
    case ES_EVENT_TYPE_AUTH_LINK: return kEventTypeAuthLink;
    case ES_EVENT_TYPE_AUTH_MOUNT: return kEventTypeAuthMount;
    case ES_EVENT_TYPE_AUTH_OPEN: return kEventTypeAuthOpen;
    case ES_EVENT_TYPE_AUTH_REMOUNT: return kEventTypeAuthRemount;
    case ES_EVENT_TYPE_AUTH_RENAME: return kEventTypeAuthRename;
    case ES_EVENT_TYPE_AUTH_TRUNCATE: return kEventTypeAuthTruncate;
    case ES_EVENT_TYPE_AUTH_UNLINK: return kEventTypeAuthUnlink;
    case ES_EVENT_TYPE_NOTIFY_CLOSE: return kEventTypeNotifyClose;
    case ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA: return kEventTypeNotifyExchangedata;
    case ES_EVENT_TYPE_NOTIFY_EXEC: return kEventTypeNotifyExec;
    case ES_EVENT_TYPE_NOTIFY_EXIT: return kEventTypeNotifyExit;
    case ES_EVENT_TYPE_NOTIFY_FORK: return kEventTypeNotifyFork;
    case ES_EVENT_TYPE_NOTIFY_LINK: return kEventTypeNotifyLink;
    case ES_EVENT_TYPE_NOTIFY_RENAME: return kEventTypeNotifyRename;
    case ES_EVENT_TYPE_NOTIFY_UNLINK: return kEventTypeNotifyUnlink;
    case ES_EVENT_TYPE_NOTIFY_UNMOUNT: return kEventTypeNotifyUnmount;
    default:
      [NSException raise:@"Invalid event type" format:@"Invalid event type: %d", eventType];
      return nil;
  }
}

NSString *const EventDispositionToString(EventDisposition d) {
  switch (d) {
    case EventDisposition::kDropped: return kEventDispositionDropped;
    case EventDisposition::kProcessed: return kEventDispositionProcessed;
    default:
      [NSException raise:@"Invalid disposition" format:@"Unknown disposition value: %d", d];
      return nil;
  }
}

std::shared_ptr<Metrics> Metrics::Create(SNTMetricSet *metric_set, uint64_t interval) {
  dispatch_queue_t q = dispatch_queue_create("com.google.santa.santametricsservice.q",
                                             DISPATCH_QUEUE_SERIAL_WITH_AUTORELEASE_POOL);

  dispatch_source_t timer_source = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0, q);

  SNTMetricInt64Gauge *event_processing_times =
    [metric_set int64GaugeWithName:@"/santa/event_processing_time"
                        fieldNames:@[ @"Processor", @"Event" ]
                          helpText:@"Time to process various event types by each processor"];

  SNTMetricCounter *event_counts =
    [metric_set counterWithName:@"/santa/event_count"
                     fieldNames:@[ @"Processor", @"Event", @"Disposition" ]
                       helpText:@"Events received and processed by each processor"];

  std::shared_ptr<Metrics> metrics =
    std::make_shared<Metrics>(q, timer_source, interval, event_processing_times, event_counts,
                              metric_set, ^(Metrics *metrics) {
                                SNTRegisterCoreMetrics();
                                metrics->EstablishConnection();
                              });

  std::weak_ptr<Metrics> weak_metrics(metrics);
  dispatch_source_set_event_handler(metrics->timer_source_, ^{
    std::shared_ptr<Metrics> shared_metrics = weak_metrics.lock();
    if (!shared_metrics) {
      return;
    }

    shared_metrics->ExportLocked(metric_set);
  });

  return metrics;
}

Metrics::Metrics(dispatch_queue_t q, dispatch_source_t timer_source, uint64_t interval,
                 SNTMetricInt64Gauge *event_processing_times, SNTMetricCounter *event_counts,
                 SNTMetricSet *metric_set, void (^run_on_first_start)(Metrics *))
    : q_(q),
      timer_source_(timer_source),
      interval_(interval),
      event_processing_times_(event_processing_times),
      event_counts_(event_counts),
      metric_set_(metric_set),
      run_on_first_start_(run_on_first_start) {
  SetInterval(interval_);

  events_q_ = dispatch_queue_create("com.google.santa.santametricsservice.events_q",
                                    DISPATCH_QUEUE_SERIAL_WITH_AUTORELEASE_POOL);
}

Metrics::~Metrics() {
  if (!running_) {
    // The timer_source_ must be resumed to ensure it has a proper retain count before being
    // destroyed. Additionally, it should first be cancelled to ensure the timer isn't ever fired
    // (see man page for `dispatch_source_cancel(3)`).
    dispatch_source_cancel(timer_source_);
    dispatch_resume(timer_source_);
  }
}

void Metrics::EstablishConnection() {
  MOLXPCConnection *metrics_connection = [SNTXPCMetricServiceInterface configuredConnection];
  metrics_connection.invalidationHandler = ^{
    dispatch_sync(dispatch_get_main_queue(), ^{
      LOGW(@"Metrics service connection invalidated. Reconnecting...");
      EstablishConnection();
    });
  };
  [metrics_connection resume];
  metrics_connection_ = metrics_connection;
}

void Metrics::Export() {
  dispatch_sync(q_, ^{
    ExportLocked(metric_set_);
  });
}

void Metrics::ExportLocked(SNTMetricSet *metric_set) {
  FlushMetrics();
  [[metrics_connection_ remoteObjectProxy] exportForMonitoring:[metric_set export]];
}

void Metrics::FlushMetrics() {
  dispatch_sync(events_q_, ^{
    for (const auto &kv : event_counts_cache_) {
      NSString *processorName = ProcessorToString(std::get<Processor>(kv.first));
      NSString *eventName = EventTypeToString(std::get<es_event_type_t>(kv.first));
      NSString *dispositionName = EventDispositionToString(std::get<EventDisposition>(kv.first));

      [event_counts_ incrementBy:kv.second
                  forFieldValues:@[ processorName, eventName, dispositionName ]];
    }

    for (const auto &kv : event_times_cache_) {
      NSString *processorName = ProcessorToString(std::get<Processor>(kv.first));
      NSString *eventName = EventTypeToString(std::get<es_event_type_t>(kv.first));

      [event_processing_times_ set:kv.second forFieldValues:@[ processorName, eventName ]];
    }

    // Reset the maps so the next cycle begins with a clean state
    event_counts_cache_ = {};
    event_times_cache_ = {};
  });
}

void Metrics::SetInterval(uint64_t interval) {
  dispatch_sync(q_, ^{
    LOGI(@"Setting metrics interval to %llu (exporting? %s)", interval, running_ ? "YES" : "NO");
    interval_ = interval;
    dispatch_source_set_timer(timer_source_, dispatch_time(DISPATCH_TIME_NOW, 0),
                              interval_ * NSEC_PER_SEC, 250 * NSEC_PER_MSEC);
  });
}

void Metrics::StartPoll() {
  static dispatch_once_t once_token;
  dispatch_once(&once_token, ^{
    run_on_first_start_(this);
  });

  dispatch_sync(q_, ^{
    if (!running_) {
      LOGI(@"Starting to export metrics every %llu seconds", interval_);
      running_ = true;
      dispatch_resume(timer_source_);
    } else {
      LOGW(@"Attempted to start metrics poll while already started");
    }
  });
}

void Metrics::StopPoll() {
  dispatch_sync(q_, ^{
    if (running_) {
      LOGI(@"Stopping metrics export");
      dispatch_suspend(timer_source_);
      running_ = false;
    } else {
      LOGW(@"Attempted to stop metrics poll while already stopped");
    }
  });
}

void Metrics::SetEventMetrics(Processor processor, es_event_type_t event_type,
                              EventDisposition event_disposition, int64_t nanos) {
  dispatch_sync(events_q_, ^{
    event_counts_cache_[EventCountTuple{processor, event_type, event_disposition}]++;
    event_times_cache_[EventTimesTuple{processor, event_type}] = nanos;
  });
}

}  // namespace santa::santad

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#include "Source/santad/Metrics.h"
16	#include <EndpointSecurity/ESTypes.h>
17
18	#include <memory>
19
20	#import "Source/common/SNTLogging.h"
21	#import "Source/common/SNTXPCMetricServiceInterface.h"
22	#import "Source/santad/SNTApplicationCoreMetrics.h"
23
24	static NSString *const kProcessorAuthorizer = @"Authorizer";
25	static NSString *const kProcessorDeviceManager = @"DeviceManager";
26	static NSString *const kProcessorRecorder = @"Recorder";
27	static NSString *const kProcessorTamperResistance = @"TamperResistance";
28	static NSString *const kProcessorFileAccessAuthorizer = @"FileAccessAuthorizer";
29
30	static NSString *const kEventTypeAuthClone = @"AuthClone";
31	static NSString *const kEventTypeAuthCopyfile = @"AuthCopyfile";
32	static NSString *const kEventTypeAuthCreate = @"AuthCreate";
33	static NSString *const kEventTypeAuthExchangedata = @"AuthExchangedata";
34	static NSString *const kEventTypeAuthExec = @"AuthExec";
35	static NSString *const kEventTypeAuthKextload = @"AuthKextload";
36	static NSString *const kEventTypeAuthLink = @"AuthLink";
37	static NSString *const kEventTypeAuthMount = @"AuthMount";
38	static NSString *const kEventTypeAuthOpen = @"AuthOpen";
39	static NSString *const kEventTypeAuthRemount = @"AuthRemount";
40	static NSString *const kEventTypeAuthRename = @"AuthRename";
41	static NSString *const kEventTypeAuthTruncate = @"AuthTruncate";
42	static NSString *const kEventTypeAuthUnlink = @"AuthUnlink";
43	static NSString *const kEventTypeNotifyClose = @"NotifyClose";
44	static NSString *const kEventTypeNotifyExchangedata = @"NotifyExchangedata";
45	static NSString *const kEventTypeNotifyExec = @"NotifyExec";
46	static NSString *const kEventTypeNotifyExit = @"NotifyExit";
47	static NSString *const kEventTypeNotifyFork = @"NotifyFork";
48	static NSString *const kEventTypeNotifyLink = @"NotifyLink";
49	static NSString *const kEventTypeNotifyRename = @"NotifyRename";
50	static NSString *const kEventTypeNotifyUnlink = @"NotifyUnlink";
51	static NSString *const kEventTypeNotifyUnmount = @"NotifyUnmount";
52
53	static NSString *const kEventDispositionDropped = @"Dropped";
54	static NSString *const kEventDispositionProcessed = @"Processed";
55
56	namespace santa::santad {
57
58	NSString *const ProcessorToString(Processor processor) {	9✔
59	switch (processor) {	9✔
60	case Processor::kAuthorizer: return kProcessorAuthorizer;	5✔
61	case Processor::kDeviceManager: return kProcessorDeviceManager;	1✔
62	case Processor::kRecorder: return kProcessorRecorder;	1✔
63	case Processor::kTamperResistance: return kProcessorTamperResistance;	1✔
64	case Processor::kFileAccessAuthorizer: return kProcessorFileAccessAuthorizer;	×
65	default:	1✔
66	[NSException raise:@"Invalid processor" format:@"Unknown processor value: %d", processor];	1✔
67	return nil;	1✔
68	}	9✔
69	}	9✔
70
71	NSString *const EventTypeToString(es_event_type_t eventType) {	26✔
72	switch (eventType) {	26✔
73	case ES_EVENT_TYPE_AUTH_CLONE: return kEventTypeAuthClone;	1✔
74	case ES_EVENT_TYPE_AUTH_COPYFILE: return kEventTypeAuthCopyfile;	1✔
75	case ES_EVENT_TYPE_AUTH_CREATE: return kEventTypeAuthCreate;	1✔
76	case ES_EVENT_TYPE_AUTH_EXCHANGEDATA: return kEventTypeAuthExchangedata;	1✔
77	case ES_EVENT_TYPE_AUTH_EXEC: return kEventTypeAuthExec;	3✔
78	case ES_EVENT_TYPE_AUTH_KEXTLOAD: return kEventTypeAuthKextload;	1✔
79	case ES_EVENT_TYPE_AUTH_LINK: return kEventTypeAuthLink;	1✔
80	case ES_EVENT_TYPE_AUTH_MOUNT: return kEventTypeAuthMount;	1✔
81	case ES_EVENT_TYPE_AUTH_OPEN: return kEventTypeAuthOpen;	2✔
82	case ES_EVENT_TYPE_AUTH_REMOUNT: return kEventTypeAuthRemount;	1✔
83	case ES_EVENT_TYPE_AUTH_RENAME: return kEventTypeAuthRename;	1✔
84	case ES_EVENT_TYPE_AUTH_TRUNCATE: return kEventTypeAuthTruncate;	1✔
85	case ES_EVENT_TYPE_AUTH_UNLINK: return kEventTypeAuthUnlink;	1✔
86	case ES_EVENT_TYPE_NOTIFY_CLOSE: return kEventTypeNotifyClose;	1✔
87	case ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA: return kEventTypeNotifyExchangedata;	1✔
88	case ES_EVENT_TYPE_NOTIFY_EXEC: return kEventTypeNotifyExec;	1✔
89	case ES_EVENT_TYPE_NOTIFY_EXIT: return kEventTypeNotifyExit;	1✔
90	case ES_EVENT_TYPE_NOTIFY_FORK: return kEventTypeNotifyFork;	1✔
91	case ES_EVENT_TYPE_NOTIFY_LINK: return kEventTypeNotifyLink;	1✔
92	case ES_EVENT_TYPE_NOTIFY_RENAME: return kEventTypeNotifyRename;	1✔
93	case ES_EVENT_TYPE_NOTIFY_UNLINK: return kEventTypeNotifyUnlink;	1✔
94	case ES_EVENT_TYPE_NOTIFY_UNMOUNT: return kEventTypeNotifyUnmount;	1✔
95	default:	1✔
96	[NSException raise:@"Invalid event type" format:@"Invalid event type: %d", eventType];	1✔
97	return nil;	1✔
98	}	26✔
99	}	26✔
100
101	NSString *const EventDispositionToString(EventDisposition d) {	5✔
102	switch (d) {	5✔
103	case EventDisposition::kDropped: return kEventDispositionDropped;	1✔
104	case EventDisposition::kProcessed: return kEventDispositionProcessed;	3✔
105	default:	1✔
106	[NSException raise:@"Invalid disposition" format:@"Unknown disposition value: %d", d];	1✔
107	return nil;	1✔
108	}	5✔
109	}	5✔
110
111	std::shared_ptr<Metrics> Metrics::Create(SNTMetricSet *metric_set, uint64_t interval) {	14✔
112	dispatch_queue_t q = dispatch_queue_create("com.google.santa.santametricsservice.q",	14✔
113	DISPATCH_QUEUE_SERIAL_WITH_AUTORELEASE_POOL);	14✔
114
115	dispatch_source_t timer_source = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0, q);	14✔
116
117	SNTMetricInt64Gauge *event_processing_times =	14✔
118	[metric_set int64GaugeWithName:@"/santa/event_processing_time"	14✔
119	fieldNames:@[ @"Processor", @"Event" ]	14✔
120	helpText:@"Time to process various event types by each processor"];	14✔
121
122	SNTMetricCounter *event_counts =	14✔
123	[metric_set counterWithName:@"/santa/event_count"	14✔
124	fieldNames:@[ @"Processor", @"Event", @"Disposition" ]	14✔
125	helpText:@"Events received and processed by each processor"];	14✔
126
127	std::shared_ptr<Metrics> metrics =	14✔
128	std::make_shared<Metrics>(q, timer_source, interval, event_processing_times, event_counts,	14✔
129	metric_set, ^(Metrics *metrics) {	×
130	SNTRegisterCoreMetrics();	×
131	metrics->EstablishConnection();	×
132	});	×
133
134	std::weak_ptr<Metrics> weak_metrics(metrics);	14✔
135	dispatch_source_set_event_handler(metrics->timer_source_, ^{	×
136	std::shared_ptr<Metrics> shared_metrics = weak_metrics.lock();	×
137	if (!shared_metrics) {	×
138	return;	×
139	}	×
140
141	shared_metrics->ExportLocked(metric_set);	×
142	});	×
143
144	return metrics;	14✔
145	}	14✔
146
147	Metrics::Metrics(dispatch_queue_t q, dispatch_source_t timer_source, uint64_t interval,
148	SNTMetricInt64Gauge event_processing_times, SNTMetricCounter event_counts,
149	SNTMetricSet metric_set, void (^run_on_first_start)(Metrics ))
150	: q_(q),
151	timer_source_(timer_source),
152	interval_(interval),
153	event_processing_times_(event_processing_times),
154	event_counts_(event_counts),
155	metric_set_(metric_set),
156	run_on_first_start_(run_on_first_start) {	18✔
157	SetInterval(interval_);	18✔
158
159	events_q_ = dispatch_queue_create("com.google.santa.santametricsservice.events_q",	18✔
160	DISPATCH_QUEUE_SERIAL_WITH_AUTORELEASE_POOL);	18✔
161	}	18✔
162
163	Metrics::~Metrics() {	18✔
164	if (!running_) {	18!
165	// The timer_source_ must be resumed to ensure it has a proper retain count before being
166	// destroyed. Additionally, it should first be cancelled to ensure the timer isn't ever fired
167	// (see man page for `dispatch_source_cancel(3)`).
168	dispatch_source_cancel(timer_source_);	18✔
169	dispatch_resume(timer_source_);	18✔
170	}	18✔
171	}	18✔
172
173	void Metrics::EstablishConnection() {	×
174	MOLXPCConnection *metrics_connection = [SNTXPCMetricServiceInterface configuredConnection];	×
175	metrics_connection.invalidationHandler = ^{	×
176	dispatch_sync(dispatch_get_main_queue(), ^{	×
177	LOGW(@"Metrics service connection invalidated. Reconnecting...");	×
178	EstablishConnection();	×
179	});	×
180	};	×
181	[metrics_connection resume];	×
182	metrics_connection_ = metrics_connection;	×
183	}	×
184
185	void Metrics::Export() {	×
186	dispatch_sync(q_, ^{	×
187	ExportLocked(metric_set_);	×
188	});	×
189	}	×
190
191	void Metrics::ExportLocked(SNTMetricSet *metric_set) {	×
192	FlushMetrics();	×
193	[[metrics_connection_ remoteObjectProxy] exportForMonitoring:[metric_set export]];	×
194	}	×
195
196	void Metrics::FlushMetrics() {	1✔
197	dispatch_sync(events_q_, ^{	1✔
198	for (const auto &kv : event_counts_cache_) {	2✔
199	NSString *processorName = ProcessorToString(std::get<Processor>(kv.first));	2✔
200	NSString *eventName = EventTypeToString(std::get<es_event_type_t>(kv.first));	2✔
201	NSString *dispositionName = EventDispositionToString(std::get<EventDisposition>(kv.first));	2✔
202
203	[event_counts_ incrementBy:kv.second	2✔
204	forFieldValues:@[ processorName, eventName, dispositionName ]];	2✔
205	}	2✔
206
207	for (const auto &kv : event_times_cache_) {	2✔
208	NSString *processorName = ProcessorToString(std::get<Processor>(kv.first));	2✔
209	NSString *eventName = EventTypeToString(std::get<es_event_type_t>(kv.first));	2✔
210
211	[event_processing_times_ set:kv.second forFieldValues:@[ processorName, eventName ]];	2✔
212	}	2✔
213
214	// Reset the maps so the next cycle begins with a clean state
215	event_counts_cache_ = {};	1✔
216	event_times_cache_ = {};	1✔
217	});	1✔
218	}	1✔
219
220	void Metrics::SetInterval(uint64_t interval) {	19✔
221	dispatch_sync(q_, ^{	19✔
222	LOGI(@"Setting metrics interval to %llu (exporting? %s)", interval, running_ ? "YES" : "NO");	19!
223	interval_ = interval;	19✔
224	dispatch_source_set_timer(timer_source_, dispatch_time(DISPATCH_TIME_NOW, 0),	19✔
225	interval_ * NSEC_PER_SEC, 250 * NSEC_PER_MSEC);	19✔
226	});	19✔
227	}	19✔
228
229	void Metrics::StartPoll() {	2✔
230	static dispatch_once_t once_token;	2✔
231	dispatch_once(&once_token, ^{	1✔
232	run_on_first_start_(this);	1✔
233	});	1✔
234
235	dispatch_sync(q_, ^{	2✔
236	if (!running_) {	2✔
237	LOGI(@"Starting to export metrics every %llu seconds", interval_);	1✔
238	running_ = true;	1✔
239	dispatch_resume(timer_source_);	1✔
240	} else {	1✔
241	LOGW(@"Attempted to start metrics poll while already started");	1✔
242	}	1✔
243	});	2✔
244	}	2✔
245
246	void Metrics::StopPoll() {	2✔
247	dispatch_sync(q_, ^{	2✔
248	if (running_) {	2✔
249	LOGI(@"Stopping metrics export");	1✔
250	dispatch_suspend(timer_source_);	1✔
251	running_ = false;	1✔
252	} else {	1✔
253	LOGW(@"Attempted to stop metrics poll while already stopped");	1✔
254	}	1✔
255	});	2✔
256	}	2✔
257
258	void Metrics::SetEventMetrics(Processor processor, es_event_type_t event_type,
259	EventDisposition event_disposition, int64_t nanos) {	5✔
260	dispatch_sync(events_q_, ^{	5✔
261	event_counts_cache_[EventCountTuple{processor, event_type, event_disposition}]++;	5✔
262	event_times_cache_[EventTimesTuple{processor, event_type}] = nanos;	5✔
263	});	5✔
264	}	5✔
265
266	} // namespace santa::santad

google / santa / 4070762277

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous