4076279996

Build Type

github

Committed by GitHub

Commit Message

<a href="https://github.com/google/santa/commit/<a class=hub.com/google/santa/commit/b0d9a8b62409bfab597d9a35662f5a72ac60a34c">b0d9a8b62<a href="https://github.com/google/santa/commit/b0d9a8b62409bfab597d9a35662f5a72ac60a34c">">Merge </a><a class="double-link" href="https://github.com/google/santa/commit/<a class="double-link" href="https://github.com/google/santa/commit/6e5d20165351c41cb2da05f20d7a0872115774bf">6e5d20165</a>">6e5d20165</a><a href="https://github.com/google/santa/commit/b0d9a8b62409bfab597d9a35662f5a72ac60a34c"> into dc11ea653">dc11ea653</a>

Pull Request Pull Request #1031: Restart daemon on log type change

Run Details

3818 of 7756 branches covered (49.23%)

Branch coverage included in aggregate %.

69 of 69 new or added lines in 9 files covered. (100.0%)

13503 of 19003 relevant lines covered (71.06%)

15165.9 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

94.55

/Source/santad/Logs/EndpointSecurity/Logger.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#include "Source/santad/Logs/EndpointSecurity/Logger.h"

#include "Source/common/SNTCommonEnums.h"
#include "Source/common/SNTLogging.h"
#include "Source/common/SNTStoredEvent.h"
#include "Source/santad/Logs/EndpointSecurity/Serializers/BasicString.h"
#include "Source/santad/Logs/EndpointSecurity/Serializers/Empty.h"
#include "Source/santad/Logs/EndpointSecurity/Serializers/Protobuf.h"
#include "Source/santad/Logs/EndpointSecurity/Writers/File.h"
#include "Source/santad/Logs/EndpointSecurity/Writers/Null.h"
#include "Source/santad/Logs/EndpointSecurity/Writers/Spool.h"
#include "Source/santad/Logs/EndpointSecurity/Writers/Syslog.h"

using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
using santa::santad::event_providers::endpoint_security::EnrichedMessage;
using santa::santad::event_providers::endpoint_security::EnrichedProcess;
using santa::santad::event_providers::endpoint_security::Message;
using santa::santad::logs::endpoint_security::serializers::BasicString;
using santa::santad::logs::endpoint_security::serializers::Empty;
using santa::santad::logs::endpoint_security::serializers::Protobuf;
using santa::santad::logs::endpoint_security::writers::File;
using santa::santad::logs::endpoint_security::writers::Null;
using santa::santad::logs::endpoint_security::writers::Spool;
using santa::santad::logs::endpoint_security::writers::Syslog;

namespace santa::santad::logs::endpoint_security {

// Flush the write buffer every 5 seconds
static const uint64_t kFlushBufferTimeoutMS = 10000;
// Batch writes up to 128kb
static const size_t kBufferBatchSizeBytes = (1024 * 128);
// Reserve an extra 4kb of buffer space to account for event overflow
static const size_t kMaxExpectedWriteSizeBytes = 4096;

// Translate configured log type to appropriate Serializer/Writer pairs
std::unique_ptr<Logger> Logger::Create(std::shared_ptr<EndpointSecurityAPI> esapi,
                                       SNTEventLogType log_type, NSString *event_log_path,
                                       NSString *spool_log_path, size_t spool_dir_size_threshold,
                                       size_t spool_file_size_threshold,
                                       uint64_t spool_flush_timeout_ms) {
  switch (log_type) {
    case SNTEventLogTypeFilelog:
      return std::make_unique<Logger>(
        BasicString::Create(esapi),
        File::Create(event_log_path, kFlushBufferTimeoutMS, kBufferBatchSizeBytes,
                     kMaxExpectedWriteSizeBytes));
    case SNTEventLogTypeSyslog:
      return std::make_unique<Logger>(BasicString::Create(esapi, false), Syslog::Create());
    case SNTEventLogTypeNull: return std::make_unique<Logger>(Empty::Create(), Null::Create());
    case SNTEventLogTypeProtobuf:
      LOGW(@"The EventLogType value protobuf is currently in beta. The protobuf schema is subject "
           @"to change.");
      return std::make_unique<Logger>(
        Protobuf::Create(esapi),
        Spool::Create([spool_log_path UTF8String], spool_dir_size_threshold,
                      spool_file_size_threshold, spool_flush_timeout_ms));
    default: LOGE(@"Invalid log type: %ld", log_type); return nullptr;
  }
}

Logger::Logger(std::shared_ptr<serializers::Serializer> serializer,
               std::shared_ptr<writers::Writer> writer)
    : serializer_(std::move(serializer)), writer_(std::move(writer)) {}

void Logger::Log(std::shared_ptr<EnrichedMessage> msg) {
  writer_->Write(serializer_->SerializeMessage(std::move(msg)));
}

void Logger::LogAllowlist(const Message &msg, const std::string_view hash) {
  writer_->Write(serializer_->SerializeAllowlist(msg, hash));
}

void Logger::LogBundleHashingEvents(NSArray<SNTStoredEvent *> *events) {
  for (SNTStoredEvent *se in events) {
    writer_->Write(serializer_->SerializeBundleHashingEvent(se));
  }
}

void Logger::LogDiskAppeared(NSDictionary *props) {
  writer_->Write(serializer_->SerializeDiskAppeared(props));
}

void Logger::LogDiskDisappeared(NSDictionary *props) {
  writer_->Write(serializer_->SerializeDiskDisappeared(props));
}

void Logger::LogFileAccess(
  const std::string &policy_version, const std::string &policy_name,
  const santa::santad::event_providers::endpoint_security::Message &msg,
  const santa::santad::event_providers::endpoint_security::EnrichedProcess &enriched_process,
  const std::string &target, FileAccessPolicyDecision decision) {
  writer_->Write(serializer_->SerializeFileAccess(policy_version, policy_name, msg,
                                                  enriched_process, target, decision));
}

void Logger::Flush() {
  writer_->Flush();
}

}  // namespace santa::santad::logs::endpoint_security

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#include "Source/santad/Logs/EndpointSecurity/Logger.h"
16
17	#include "Source/common/SNTCommonEnums.h"
18	#include "Source/common/SNTLogging.h"
19	#include "Source/common/SNTStoredEvent.h"
20	#include "Source/santad/Logs/EndpointSecurity/Serializers/BasicString.h"
21	#include "Source/santad/Logs/EndpointSecurity/Serializers/Empty.h"
22	#include "Source/santad/Logs/EndpointSecurity/Serializers/Protobuf.h"
23	#include "Source/santad/Logs/EndpointSecurity/Writers/File.h"
24	#include "Source/santad/Logs/EndpointSecurity/Writers/Null.h"
25	#include "Source/santad/Logs/EndpointSecurity/Writers/Spool.h"
26	#include "Source/santad/Logs/EndpointSecurity/Writers/Syslog.h"
27
28	using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
29	using santa::santad::event_providers::endpoint_security::EnrichedMessage;
30	using santa::santad::event_providers::endpoint_security::EnrichedProcess;
31	using santa::santad::event_providers::endpoint_security::Message;
32	using santa::santad::logs::endpoint_security::serializers::BasicString;
33	using santa::santad::logs::endpoint_security::serializers::Empty;
34	using santa::santad::logs::endpoint_security::serializers::Protobuf;
35	using santa::santad::logs::endpoint_security::writers::File;
36	using santa::santad::logs::endpoint_security::writers::Null;
37	using santa::santad::logs::endpoint_security::writers::Spool;
38	using santa::santad::logs::endpoint_security::writers::Syslog;
39
40	namespace santa::santad::logs::endpoint_security {
41
42	// Flush the write buffer every 5 seconds
43	static const uint64_t kFlushBufferTimeoutMS = 10000;
44	// Batch writes up to 128kb
45	static const size_t kBufferBatchSizeBytes = (1024 * 128);
46	// Reserve an extra 4kb of buffer space to account for event overflow
47	static const size_t kMaxExpectedWriteSizeBytes = 4096;
48
49	// Translate configured log type to appropriate Serializer/Writer pairs
50	std::unique_ptr<Logger> Logger::Create(std::shared_ptr<EndpointSecurityAPI> esapi,
51	SNTEventLogType log_type, NSString *event_log_path,
52	NSString *spool_log_path, size_t spool_dir_size_threshold,
53	size_t spool_file_size_threshold,
54	uint64_t spool_flush_timeout_ms) {	19✔
55	switch (log_type) {	19✔
56	case SNTEventLogTypeFilelog:	1✔
57	return std::make_unique<Logger>(	1✔
58	BasicString::Create(esapi),	1✔
59	File::Create(event_log_path, kFlushBufferTimeoutMS, kBufferBatchSizeBytes,	1✔
60	kMaxExpectedWriteSizeBytes));	1✔
61	case SNTEventLogTypeSyslog:	15✔
62	return std::make_unique<Logger>(BasicString::Create(esapi, false), Syslog::Create());	15✔
63	case SNTEventLogTypeNull: return std::make_unique<Logger>(Empty::Create(), Null::Create());	1✔
64	case SNTEventLogTypeProtobuf:	1✔
65	LOGW(@"The EventLogType value protobuf is currently in beta. The protobuf schema is subject "	1✔
66	@"to change.");	1✔
67	return std::make_unique<Logger>(	1✔
68	Protobuf::Create(esapi),	1✔
69	Spool::Create([spool_log_path UTF8String], spool_dir_size_threshold,	1✔
70	spool_file_size_threshold, spool_flush_timeout_ms));	1✔
71	default: LOGE(@"Invalid log type: %ld", log_type); return nullptr;	1✔
72	}	19✔
73	}	19✔
74
75	Logger::Logger(std::shared_ptr<serializers::Serializer> serializer,
76	std::shared_ptr<writers::Writer> writer)
77	: serializer_(std::move(serializer)), writer_(std::move(writer)) {}	29✔
78
79	void Logger::Log(std::shared_ptr<EnrichedMessage> msg) {	1✔
80	writer_->Write(serializer_->SerializeMessage(std::move(msg)));	1✔
81	}	1✔
82
83	void Logger::LogAllowlist(const Message &msg, const std::string_view hash) {	1✔
84	writer_->Write(serializer_->SerializeAllowlist(msg, hash));	1✔
85	}	1✔
86
87	void Logger::LogBundleHashingEvents(NSArray<SNTStoredEvent > events) {	1✔
88	for (SNTStoredEvent *se in events) {	3✔
89	writer_->Write(serializer_->SerializeBundleHashingEvent(se));	3✔
90	}	3✔
91	}	1✔
92
93	void Logger::LogDiskAppeared(NSDictionary *props) {	1✔
94	writer_->Write(serializer_->SerializeDiskAppeared(props));	1✔
95	}	1✔
96
97	void Logger::LogDiskDisappeared(NSDictionary *props) {	1✔
98	writer_->Write(serializer_->SerializeDiskDisappeared(props));	1✔
99	}	1✔
100
101	void Logger::LogFileAccess(
102	const std::string &policy_version, const std::string &policy_name,
103	const santa::santad::event_providers::endpoint_security::Message &msg,
104	const santa::santad::event_providers::endpoint_security::EnrichedProcess &enriched_process,
105	const std::string &target, FileAccessPolicyDecision decision) {	1✔
106	writer_->Write(serializer_->SerializeFileAccess(policy_version, policy_name, msg,	1✔
107	enriched_process, target, decision));	1✔
108	}	1✔
109
110	void Logger::Flush() {	×
111	writer_->Flush();	×
112	}	×
113
114	} // namespace santa::santad::logs::endpoint_security

google / santa / 4076279996

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous