8161115396

Committed 05 Mar 2024 06:20PM UTC coverage: 63.429% (-1.2%) from 64.591%

Build # 8161115396

Build Type

Pull #1301

github

Committed by

web-flow

Commit Message

Merge f8ff21f2c into 6a697e00e

Pull Request Pull Request #1301: Add support for CDHash rule types

Run Details

4516 of 9280 branches covered (48.66%)

Branch coverage included in aggregate %.

266 of 352 new or added lines in 19 files covered. (75.57%)

330 existing lines in 8 files now uncovered.

15726 of 22633 relevant lines covered (69.48%)

12772.57 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

64.98

/Source/santasyncservice/SNTSyncEventUpload.m

/// Copyright 2015 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santasyncservice/SNTSyncEventUpload.h"

#import <MOLCertificate/MOLCertificate.h>
#import <MOLXPCConnection/MOLXPCConnection.h>

#import "Source/common/SNTCommonEnums.h"
#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTFileInfo.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTStoredEvent.h"
#import "Source/common/SNTSyncConstants.h"
#import "Source/common/SNTXPCControlInterface.h"
#import "Source/santasyncservice/NSData+Zlib.h"
#import "Source/santasyncservice/SNTSyncLogging.h"
#import "Source/santasyncservice/SNTSyncState.h"

@implementation SNTSyncEventUpload

- (NSURL *)stageURL {
  NSString *stageName = [@"eventupload" stringByAppendingFormat:@"/%@", self.syncState.machineID];
  return [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];
}

- (BOOL)sync {
  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
  [[self.daemonConn remoteObjectProxy] databaseEventsPending:^(NSArray *events) {
    if (events.count) {
      [self uploadEvents:events];
    }
    dispatch_semaphore_signal(sema);
  }];
  return (dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER) == 0);
}

- (BOOL)uploadEvents:(NSArray *)events {
  NSMutableArray *uploadEvents = [[NSMutableArray alloc] init];

  NSMutableSet *eventIds = [NSMutableSet setWithCapacity:events.count];
  for (SNTStoredEvent *event in events) {
    [uploadEvents addObject:[self dictionaryForEvent:event]];
    if (event.idx) [eventIds addObject:event.idx];
    if (uploadEvents.count >= self.syncState.eventBatchSize) break;
  }

  if (self.syncState.syncType == SNTSyncTypeNormal ||
      [[SNTConfigurator configurator] enableCleanSyncEventUpload]) {
    NSDictionary *r = [self performRequest:[self requestWithDictionary:@{kEvents : uploadEvents}]];
    if (!r) return NO;

    // A list of bundle hashes that require their related binary events to be uploaded.
    self.syncState.bundleBinaryRequests = r[kEventUploadBundleBinaries];

    SLOGI(@"Uploaded %lu events", uploadEvents.count);
  }

  // Remove event IDs. For Bundle Events the ID is 0 so nothing happens.
  [[self.daemonConn remoteObjectProxy] databaseRemoveEventsWithIDs:[eventIds allObjects]];

  // See if there are any events remaining to upload
  if (uploadEvents.count < events.count) {
    NSRange nextEventsRange = NSMakeRange(uploadEvents.count, events.count - uploadEvents.count);
    NSArray *nextEvents = [events subarrayWithRange:nextEventsRange];
    return [self uploadEvents:nextEvents];
  }

  return YES;
}

- (NSDictionary *)dictionaryForEvent:(SNTStoredEvent *)event {
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wobjc-literal-conversion"
#define ADDKEY(dict, key, value) \
  if (value) dict[key] = value
  NSMutableDictionary *newEvent = [NSMutableDictionary dictionary];

  ADDKEY(newEvent, kFileSHA256, event.fileSHA256);
  ADDKEY(newEvent, kFilePath, [event.filePath stringByDeletingLastPathComponent]);
  ADDKEY(newEvent, kFileName, [event.filePath lastPathComponent]);
  ADDKEY(newEvent, kExecutingUser, event.executingUser);
  ADDKEY(newEvent, kExecutionTime, @([event.occurrenceDate timeIntervalSince1970]));
  ADDKEY(newEvent, kLoggedInUsers, event.loggedInUsers);
  ADDKEY(newEvent, kCurrentSessions, event.currentSessions);

  switch (event.decision) {
    case SNTEventStateAllowUnknown: ADDKEY(newEvent, kDecision, kDecisionAllowUnknown); break;
    case SNTEventStateAllowBinary: ADDKEY(newEvent, kDecision, kDecisionAllowBinary); break;
    case SNTEventStateAllowCertificate:
      ADDKEY(newEvent, kDecision, kDecisionAllowCertificate);
      break;
    case SNTEventStateAllowScope: ADDKEY(newEvent, kDecision, kDecisionAllowScope); break;
    case SNTEventStateAllowTeamID: ADDKEY(newEvent, kDecision, kDecisionAllowTeamID); break;
    case SNTEventStateAllowSigningID: ADDKEY(newEvent, kDecision, kDecisionAllowSigningID); break;
    case SNTEventStateAllowCDHash: ADDKEY(newEvent, kDecision, kDecisionAllowCDHash); break;
    case SNTEventStateBlockUnknown: ADDKEY(newEvent, kDecision, kDecisionBlockUnknown); break;
    case SNTEventStateBlockBinary: ADDKEY(newEvent, kDecision, kDecisionBlockBinary); break;
    case SNTEventStateBlockCertificate:
      ADDKEY(newEvent, kDecision, kDecisionBlockCertificate);
      break;
    case SNTEventStateBlockScope: ADDKEY(newEvent, kDecision, kDecisionBlockScope); break;
    case SNTEventStateBlockTeamID: ADDKEY(newEvent, kDecision, kDecisionBlockTeamID); break;
    case SNTEventStateBlockSigningID: ADDKEY(newEvent, kDecision, kDecisionBlockSigningID); break;
    case SNTEventStateBlockCDHash: ADDKEY(newEvent, kDecision, kDecisionBlockCDHash); break;
    case SNTEventStateBundleBinary:
      ADDKEY(newEvent, kDecision, kDecisionBundleBinary);
      [newEvent removeObjectForKey:kExecutionTime];
      break;
    default: ADDKEY(newEvent, kDecision, kDecisionUnknown);
  }

  ADDKEY(newEvent, kFileBundleID, event.fileBundleID);
  ADDKEY(newEvent, kFileBundlePath, event.fileBundlePath);
  ADDKEY(newEvent, kFileBundleExecutableRelPath, event.fileBundleExecutableRelPath);
  ADDKEY(newEvent, kFileBundleName, event.fileBundleName);
  ADDKEY(newEvent, kFileBundleVersion, event.fileBundleVersion);
  ADDKEY(newEvent, kFileBundleShortVersionString, event.fileBundleVersionString);
  ADDKEY(newEvent, kFileBundleHash, event.fileBundleHash);
  ADDKEY(newEvent, kFileBundleHashMilliseconds, event.fileBundleHashMilliseconds);
  ADDKEY(newEvent, kFileBundleBinaryCount, event.fileBundleBinaryCount);

  ADDKEY(newEvent, kPID, event.pid);
  ADDKEY(newEvent, kPPID, event.ppid);
  ADDKEY(newEvent, kParentName, event.parentName);

  ADDKEY(newEvent, kQuarantineDataURL, event.quarantineDataURL);
  ADDKEY(newEvent, kQuarantineRefererURL, event.quarantineRefererURL);
  ADDKEY(newEvent, kQuarantineTimestamp, @([event.quarantineTimestamp timeIntervalSince1970]));
  ADDKEY(newEvent, kQuarantineAgentBundleID, event.quarantineAgentBundleID);

  NSMutableArray *signingChain = [NSMutableArray arrayWithCapacity:event.signingChain.count];
  for (NSUInteger i = 0; i < event.signingChain.count; ++i) {
    MOLCertificate *cert = [event.signingChain objectAtIndex:i];

    NSMutableDictionary *certDict = [NSMutableDictionary dictionary];
    ADDKEY(certDict, kCertSHA256, cert.SHA256);
    ADDKEY(certDict, kCertCN, cert.commonName);
    ADDKEY(certDict, kCertOrg, cert.orgName);
    ADDKEY(certDict, kCertOU, cert.orgUnit);
    ADDKEY(certDict, kCertValidFrom, @([cert.validFrom timeIntervalSince1970]));
    ADDKEY(certDict, kCertValidUntil, @([cert.validUntil timeIntervalSince1970]));

    [signingChain addObject:certDict];
  }
  newEvent[kSigningChain] = signingChain;
  ADDKEY(newEvent, kTeamID, event.teamID);
  ADDKEY(newEvent, kSigningID, event.signingID);
  ADDKEY(newEvent, kCDHash, event.cdhash);

  return newEvent;
#undef ADDKEY
#pragma clang diagnostic pop
}

@end

1	/// Copyright 2015 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santasyncservice/SNTSyncEventUpload.h"
16
17	#import <MOLCertificate/MOLCertificate.h>
18	#import <MOLXPCConnection/MOLXPCConnection.h>
19
20	#import "Source/common/SNTCommonEnums.h"
21	#import "Source/common/SNTConfigurator.h"
22	#import "Source/common/SNTFileInfo.h"
23	#import "Source/common/SNTLogging.h"
24	#import "Source/common/SNTStoredEvent.h"
25	#import "Source/common/SNTSyncConstants.h"
26	#import "Source/common/SNTXPCControlInterface.h"
27	#import "Source/santasyncservice/NSData+Zlib.h"
28	#import "Source/santasyncservice/SNTSyncLogging.h"
29	#import "Source/santasyncservice/SNTSyncState.h"
30
31	@implementation SNTSyncEventUpload
32
33	- (NSURL *)stageURL {	4✔
34	NSString *stageName = [@"eventupload" stringByAppendingFormat:@"/%@", self.syncState.machineID];	4✔
35	return [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];	4✔
36	}	4✔
37
38	- (BOOL)sync {	3✔
39	dispatch_semaphore_t sema = dispatch_semaphore_create(0);	3✔
40	[[self.daemonConn remoteObjectProxy] databaseEventsPending:^(NSArray *events) {	3✔
41	if (events.count) {	3!
42	[self uploadEvents:events];	3✔
43	}	3✔
44	dispatch_semaphore_signal(sema);	3✔
45	}];	3✔
46	return (dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER) == 0);	3✔
47	}	3✔
48
49	- (BOOL)uploadEvents:(NSArray *)events {	4✔
50	NSMutableArray *uploadEvents = [[NSMutableArray alloc] init];	4✔
51
52	NSMutableSet *eventIds = [NSMutableSet setWithCapacity:events.count];	4✔
53	for (SNTStoredEvent *event in events) {	5✔
54	[uploadEvents addObject:[self dictionaryForEvent:event]];	5✔
55	if (event.idx) [eventIds addObject:event.idx];	5!
56	if (uploadEvents.count >= self.syncState.eventBatchSize) break;	5✔
57	}	5✔
58
59	if (self.syncState.syncType == SNTSyncTypeNormal \|\|	4!
60	[[SNTConfigurator configurator] enableCleanSyncEventUpload]) {	4!
61	NSDictionary *r = [self performRequest:[self requestWithDictionary:@{kEvents : uploadEvents}]];	4✔
62	if (!r) return NO;	4!
63
64	// A list of bundle hashes that require their related binary events to be uploaded.
65	self.syncState.bundleBinaryRequests = r[kEventUploadBundleBinaries];	4✔
66
67	SLOGI(@"Uploaded %lu events", uploadEvents.count);	4✔
68	}	4✔
69
70	// Remove event IDs. For Bundle Events the ID is 0 so nothing happens.
71	[[self.daemonConn remoteObjectProxy] databaseRemoveEventsWithIDs:[eventIds allObjects]];	4✔
72
73	// See if there are any events remaining to upload
74	if (uploadEvents.count < events.count) {	4✔
75	NSRange nextEventsRange = NSMakeRange(uploadEvents.count, events.count - uploadEvents.count);	1✔
76	NSArray *nextEvents = [events subarrayWithRange:nextEventsRange];	1✔
77	return [self uploadEvents:nextEvents];	1✔
78	}	1✔
79
80	return YES;	3✔
81	}	3✔
82
83	- (NSDictionary )dictionaryForEvent:(SNTStoredEvent )event {	5✔
84	#pragma clang diagnostic push	5✔
85	#pragma clang diagnostic ignored "-Wobjc-literal-conversion"	5✔
86	#define ADDKEY(dict, key, value) \	5✔
87	if (value) dict[key] = value	189✔
88	NSMutableDictionary *newEvent = [NSMutableDictionary dictionary];	5✔
89
90	ADDKEY(newEvent, kFileSHA256, event.fileSHA256);	5!
91	ADDKEY(newEvent, kFilePath, [event.filePath stringByDeletingLastPathComponent]);	5!
92	ADDKEY(newEvent, kFileName, [event.filePath lastPathComponent]);	5!
93	ADDKEY(newEvent, kExecutingUser, event.executingUser);	5!
94	ADDKEY(newEvent, kExecutionTime, @([event.occurrenceDate timeIntervalSince1970]));	5!
95	ADDKEY(newEvent, kLoggedInUsers, event.loggedInUsers);	5!
96	ADDKEY(newEvent, kCurrentSessions, event.currentSessions);	5!
97
98	switch (event.decision) {	5✔
99	case SNTEventStateAllowUnknown: ADDKEY(newEvent, kDecision, kDecisionAllowUnknown); break;	×
100	case SNTEventStateAllowBinary: ADDKEY(newEvent, kDecision, kDecisionAllowBinary); break;	×
101	case SNTEventStateAllowCertificate:	×
102	ADDKEY(newEvent, kDecision, kDecisionAllowCertificate);	×
103	break;	×
104	case SNTEventStateAllowScope: ADDKEY(newEvent, kDecision, kDecisionAllowScope); break;	×
105	case SNTEventStateAllowTeamID: ADDKEY(newEvent, kDecision, kDecisionAllowTeamID); break;	×
106	case SNTEventStateAllowSigningID: ADDKEY(newEvent, kDecision, kDecisionAllowSigningID); break;	×
NEW 107	case SNTEventStateAllowCDHash: ADDKEY(newEvent, kDecision, kDecisionAllowCDHash); break;	×
UNCOV 108	case SNTEventStateBlockUnknown: ADDKEY(newEvent, kDecision, kDecisionBlockUnknown); break;	×
109	case SNTEventStateBlockBinary: ADDKEY(newEvent, kDecision, kDecisionBlockBinary); break;	2!
110	case SNTEventStateBlockCertificate:	×
111	ADDKEY(newEvent, kDecision, kDecisionBlockCertificate);	×
112	break;	×
113	case SNTEventStateBlockScope: ADDKEY(newEvent, kDecision, kDecisionBlockScope); break;	×
114	case SNTEventStateBlockTeamID: ADDKEY(newEvent, kDecision, kDecisionBlockTeamID); break;	×
115	case SNTEventStateBlockSigningID: ADDKEY(newEvent, kDecision, kDecisionBlockSigningID); break;	×
NEW 116	case SNTEventStateBlockCDHash: ADDKEY(newEvent, kDecision, kDecisionBlockCDHash); break;	×
117	case SNTEventStateBundleBinary:	3✔
118	ADDKEY(newEvent, kDecision, kDecisionBundleBinary);	3!
119	[newEvent removeObjectForKey:kExecutionTime];	3✔
120	break;	3✔
121	default: ADDKEY(newEvent, kDecision, kDecisionUnknown);	×
122	}	5✔
123
124	ADDKEY(newEvent, kFileBundleID, event.fileBundleID);	5✔
125	ADDKEY(newEvent, kFileBundlePath, event.fileBundlePath);	5✔
126	ADDKEY(newEvent, kFileBundleExecutableRelPath, event.fileBundleExecutableRelPath);	5!
127	ADDKEY(newEvent, kFileBundleName, event.fileBundleName);	5✔
128	ADDKEY(newEvent, kFileBundleVersion, event.fileBundleVersion);	5✔
129	ADDKEY(newEvent, kFileBundleShortVersionString, event.fileBundleVersionString);	5✔
130	ADDKEY(newEvent, kFileBundleHash, event.fileBundleHash);	5!
131	ADDKEY(newEvent, kFileBundleHashMilliseconds, event.fileBundleHashMilliseconds);	5!
132	ADDKEY(newEvent, kFileBundleBinaryCount, event.fileBundleBinaryCount);	5!
133
134	ADDKEY(newEvent, kPID, event.pid);	5!
135	ADDKEY(newEvent, kPPID, event.ppid);	5!
136	ADDKEY(newEvent, kParentName, event.parentName);	5!
137
138	ADDKEY(newEvent, kQuarantineDataURL, event.quarantineDataURL);	5✔
139	ADDKEY(newEvent, kQuarantineRefererURL, event.quarantineRefererURL);	5✔
140	ADDKEY(newEvent, kQuarantineTimestamp, @([event.quarantineTimestamp timeIntervalSince1970]));	5!
141	ADDKEY(newEvent, kQuarantineAgentBundleID, event.quarantineAgentBundleID);	5✔
142
143	NSMutableArray *signingChain = [NSMutableArray arrayWithCapacity:event.signingChain.count];	5✔
144	for (NSUInteger i = 0; i < event.signingChain.count; ++i) {	14✔
145	MOLCertificate *cert = [event.signingChain objectAtIndex:i];	9✔
146
147	NSMutableDictionary *certDict = [NSMutableDictionary dictionary];	9✔
148	ADDKEY(certDict, kCertSHA256, cert.SHA256);	9!
149	ADDKEY(certDict, kCertCN, cert.commonName);	9!
150	ADDKEY(certDict, kCertOrg, cert.orgName);	9!
151	ADDKEY(certDict, kCertOU, cert.orgUnit);	9!
152	ADDKEY(certDict, kCertValidFrom, @([cert.validFrom timeIntervalSince1970]));	9!
153	ADDKEY(certDict, kCertValidUntil, @([cert.validUntil timeIntervalSince1970]));	9!
154
155	[signingChain addObject:certDict];	9✔
156	}	9✔
157	newEvent[kSigningChain] = signingChain;	5✔
158	ADDKEY(newEvent, kTeamID, event.teamID);	5✔
159	ADDKEY(newEvent, kSigningID, event.signingID);	5✔
160	ADDKEY(newEvent, kCDHash, event.cdhash);	5✔
161
162	return newEvent;	5✔
163	#undef ADDKEY	5✔
164	#pragma clang diagnostic pop	5✔
165	}	5✔
166
167	@end

google / santa / 8161115396

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous