8570617896

Committed 05 Apr 2024 01:29PM UTC coverage: 63.568% (-0.03%) from 63.593%

Build # 8570617896

Build Type

Pull #1319

github

Committed by

web-flow

Commit Message

Merge f082e2a27 into 3b2d02f38

Pull Request Pull Request #1319: Fix CDHash value and formatting in santactl fileinfo

Run Details

4638 of 9532 branches covered (48.66%)

Branch coverage included in aggregate %.

0 of 17 new or added lines in 1 file covered. (0.0%)

1 existing line in 1 file now uncovered.

16194 of 23239 relevant lines covered (69.68%)

14156.91 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

19.43

/Source/santactl/Commands/SNTCommandFileInfo.m

/// Copyright 2015-2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import <Foundation/Foundation.h>
#import <MOLCertificate/MOLCertificate.h>
#import <MOLCodesignChecker/MOLCodesignChecker.h>
#import <MOLXPCConnection/MOLXPCConnection.h>
#import <objc/runtime.h>

#import "Source/common/SNTCachedDecision.h"
#import "Source/common/SNTFileInfo.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTRule.h"
#import "Source/common/SNTRuleIdentifiers.h"
#import "Source/common/SNTStoredEvent.h"
#import "Source/common/SNTXPCBundleServiceInterface.h"
#import "Source/common/SNTXPCControlInterface.h"
#import "Source/santactl/SNTCommand.h"
#import "Source/santactl/SNTCommandController.h"

// file info keys
static NSString *const kPath = @"Path";
static NSString *const kBundleName = @"Bundle Name";
static NSString *const kBundleVersion = @"Bundle Version";
static NSString *const kBundleVersionStr = @"Bundle Version Str";
static NSString *const kDownloadReferrerURL = @"Download Referrer URL";
static NSString *const kDownloadURL = @"Download URL";
static NSString *const kDownloadTimestamp = @"Download Timestamp";
static NSString *const kDownloadAgent = @"Download Agent";
static NSString *const kType = @"Type";
static NSString *const kPageZero = @"Page Zero";
static NSString *const kCodeSigned = @"Code-signed";
static NSString *const kRule = @"Rule";
static NSString *const kSigningChain = @"Signing Chain";
static NSString *const kUniversalSigningChain = @"Universal Signing Chain";
static NSString *const kTeamID = @"Team ID";
static NSString *const kSigningID = @"Signing ID";
static NSString *const kCDHash = @"CDHash";

// signing chain keys
static NSString *const kCommonName = @"Common Name";
static NSString *const kOrganization = @"Organization";
static NSString *const kOrganizationalUnit = @"Organizational Unit";
static NSString *const kValidFrom = @"Valid From";
static NSString *const kValidUntil = @"Valid Until";

// shared file info & signing chain keys
static NSString *const kSHA256 = @"SHA-256";
static NSString *const kSHA1 = @"SHA-1";

// bundle info keys
static NSString *const kBundleInfo = @"Bundle Info";
static NSString *const kBundlePath = @"Main Bundle Path";
static NSString *const kBundleID = @"Main Bundle ID";
static NSString *const kBundleHash = @"Bundle Hash";
static NSString *const kBundleHashes = @"Bundle Hashes";

// Message displayed when daemon communication fails
static NSString *const kCommunicationErrorMsg = @"Could not communicate with daemon";

// Used by longHelpText to display a list of valid keys passed in as an array.
NSString *formattedStringForKeyArray(NSArray<NSString *> *array) {
  NSMutableString *result = [[NSMutableString alloc] init];
  for (NSString *key in array) {
    [result appendString:[NSString stringWithFormat:@"                       \"%@\"\n", key]];
  }
  return result;
}

// Reformat the NSString for CDHash into a more presentable form.
// Normally we get NSStrings like:
// {length = 20, bytes = // 0x610424d2dff4a51646e287df11f79f1c163d19d3}
// from MOLCodesignChecker and want to format it into the cleaner.
//
// 610424d2dff4a51646e287df11f79f1c163d19d3.
NSString *formatCDHashStr(NSString *data) {
  if (!data) return nil;

  // Split the string and filterout 0x and the curly braces.
  NSString *fields = [data componentsSeparatedByString:@"="].lastObject;
  NSString *cleaned = [fields stringByReplacingOccurrencesOfString:@"0x" withString:@""];
  cleaned = [cleaned stringByReplacingOccurrencesOfString:@"}" withString:@""];
  return [cleaned stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceCharacterSet]];
}

@interface SNTCommandFileInfo : SNTCommand <SNTCommandProtocol>

// Properties set from commandline flags
@property(nonatomic) BOOL recursive;
@property(nonatomic) BOOL jsonOutput;
@property(nonatomic) BOOL bundleInfo;
@property(nonatomic) NSNumber *certIndex;
@property(nonatomic, copy) NSArray<NSString *> *outputKeyList;
@property(nonatomic, copy) NSDictionary<NSString *, NSRegularExpression *> *outputFilters;

// Flag indicating when to use TTY colors
@property(readonly, nonatomic) BOOL prettyOutput;

// Flag needed when printing JSON for multiple files to get commas right
@property(nonatomic) BOOL jsonPreviousEntry;

// Flag used to avoid multiple attempts to connect to daemon
@property(nonatomic) BOOL daemonUnavailable;

// Common date formatter
@property(nonatomic) NSDateFormatter *dateFormatter;

// Maximum length of output key name, used for formatting
@property(nonatomic) NSUInteger maxKeyWidth;

// Valid key lists
@property(readonly, nonatomic) NSArray<NSString *> *fileInfoKeys;
@property(readonly, nonatomic) NSArray<NSString *> *signingChainKeys;

// Block type to be used with propertyMap values.  The first SNTCommandFileInfo parameter
// is really required only for the the rule property getter which needs access to the daemon
// connection, but downloadTimestamp & signingChain also use it for a shared date formatter.
typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *, SNTFileInfo *);

// on read generated properties
@property(readonly, copy, nonatomic) SNTAttributeBlock path;
@property(readonly, copy, nonatomic) SNTAttributeBlock sha256;
@property(readonly, copy, nonatomic) SNTAttributeBlock sha1;
@property(readonly, copy, nonatomic) SNTAttributeBlock bundleName;
@property(readonly, copy, nonatomic) SNTAttributeBlock bundleVersion;
@property(readonly, copy, nonatomic) SNTAttributeBlock bundleShortVersionString;
@property(readonly, copy, nonatomic) SNTAttributeBlock downloadReferrerURL;
@property(readonly, copy, nonatomic) SNTAttributeBlock downloadURL;
@property(readonly, copy, nonatomic) SNTAttributeBlock downloadTimestamp;
@property(readonly, copy, nonatomic) SNTAttributeBlock downloadAgent;
@property(readonly, copy, nonatomic) SNTAttributeBlock teamID;
@property(readonly, copy, nonatomic) SNTAttributeBlock signingID;
@property(readonly, copy, nonatomic) SNTAttributeBlock cdhash;
@property(readonly, copy, nonatomic) SNTAttributeBlock type;
@property(readonly, copy, nonatomic) SNTAttributeBlock pageZero;
@property(readonly, copy, nonatomic) SNTAttributeBlock codeSigned;
@property(readonly, copy, nonatomic) SNTAttributeBlock rule;
@property(readonly, copy, nonatomic) SNTAttributeBlock signingChain;
@property(readonly, copy, nonatomic) SNTAttributeBlock universalSigningChain;

// Mapping between property string keys and SNTAttributeBlocks
@property(nonatomic) NSDictionary<NSString *, SNTAttributeBlock> *propertyMap;

// Serial queue and dispatch group used for printing output
@property(nonatomic) dispatch_queue_t printQueue;
@property(nonatomic) dispatch_group_t printGroup;

@end

@implementation SNTCommandFileInfo

REGISTER_COMMAND_NAME(@"fileinfo")

#pragma mark SNTCommand protocol methods

+ (BOOL)requiresRoot {
  return NO;
}

+ (BOOL)requiresDaemonConn {
  return NO;
}

+ (NSString *)shortHelpText {
  return @"Prints information about a file.";
}

+ (NSString *)longHelpText {
  return
    [NSString stringWithFormat:
                @"The details provided will be the same ones Santa uses to make a decision\n"
                @"about executables. This includes SHA-256, SHA-1, code signing information and\n"
                @"the type of file."
                @"\n"
                @"Usage: santactl fileinfo [options] [file-paths]\n"
                @"    --recursive (-r): Search directories recursively.\n"
                @"                      Incompatible with --bundleinfo.\n"
                @"    --json: Output in JSON format.\n"
                @"    --key: Search and return this one piece of information.\n"
                @"           You may specify multiple keys by repeating this flag.\n"
                @"           Valid Keys:\n"
                @"%@\n"
                @"           Valid keys when using --cert-index:\n"
                @"%@\n"
                @"    --cert-index: Supply an integer corresponding to a certificate of the\n"
                @"                  signing chain to show info only for that certificate.\n"
                @"                     0 up to n for the leaf certificate up to the root\n"
                @"                    -1 down to -n-1 for the root certificate down to the leaf\n"
                @"                  Incompatible with --bundleinfo."
                @"\n"
                @"    --filter: Use predicates of the form 'key=regex' to filter out which files\n"
                @"              are displayed. Valid keys are the same as for --key. Value is a\n"
                @"              case-insensitive regular expression which must match anywhere in\n"
                @"              the keyed property value for the file's info to be displayed.\n"
                @"              You may specify multiple filters by repeating this flag.\n"
                @"    --bundleinfo: If the file is part of a bundle, will also display bundle\n"
                @"                  hash information and hashes of all bundle executables.\n"
                @"                  Incompatible with --recursive and --cert-index.\n"
                @"\n"
                @"Examples: santactl fileinfo --cert-index 1 --key SHA-256 --json /usr/bin/yes\n"
                @"          santactl fileinfo --key SHA-256 --json /usr/bin/yes\n"
                @"          santactl fileinfo /usr/bin/yes /bin/*\n"
                @"          santactl fileinfo /usr/bin -r --key Path --key SHA-256 --key Rule\n"
                @"          santactl fileinfo /usr/bin/* --filter Type=Script --filter Path=zip",
                formattedStringForKeyArray(self.fileInfoKeys),
                formattedStringForKeyArray(self.signingChainKeys)];
}

+ (NSArray<NSString *> *)fileInfoKeys {
  return @[
    kPath, kSHA256, kSHA1, kBundleName, kBundleVersion, kBundleVersionStr, kDownloadReferrerURL,
    kDownloadURL, kDownloadTimestamp, kDownloadAgent, kTeamID, kSigningID, kCDHash, kType,
    kPageZero, kCodeSigned, kRule, kSigningChain, kUniversalSigningChain
  ];
}

+ (NSArray<NSString *> *)signingChainKeys {
  return
    @[ kSHA256, kSHA1, kCommonName, kOrganization, kOrganizationalUnit, kValidFrom, kValidUntil ];
}

- (instancetype)initWithDaemonConnection:(MOLXPCConnection *)daemonConn {
  self = [super initWithDaemonConnection:daemonConn];
  if (self) {
    _dateFormatter = [[NSDateFormatter alloc] init];
    _dateFormatter.dateFormat = @"yyyy/MM/dd HH:mm:ss Z";

    _propertyMap = @{
      kPath : self.path,
      kSHA256 : self.sha256,
      kSHA1 : self.sha1,
      kBundleName : self.bundleName,
      kBundleVersion : self.bundleVersion,
      kBundleVersionStr : self.bundleVersionStr,
      kDownloadReferrerURL : self.downloadReferrerURL,
      kDownloadURL : self.downloadURL,
      kDownloadTimestamp : self.downloadTimestamp,
      kDownloadAgent : self.downloadAgent,
      kType : self.type,
      kPageZero : self.pageZero,
      kCodeSigned : self.codeSigned,
      kRule : self.rule,
      kSigningChain : self.signingChain,
      kUniversalSigningChain : self.universalSigningChain,
      kTeamID : self.teamID,
      kSigningID : self.signingID,
      kCDHash : self.cdhash,
    };

    _printQueue = dispatch_queue_create("com.google.santactl.print_queue", DISPATCH_QUEUE_SERIAL);
  }
  return self;
}

#pragma mark property getters

- (SNTAttributeBlock)path {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    return fileInfo.path;
  };
}

- (SNTAttributeBlock)sha256 {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    return fileInfo.SHA256;
  };
}

- (SNTAttributeBlock)sha1 {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    return fileInfo.SHA1;
  };
}

- (SNTAttributeBlock)bundleName {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    return fileInfo.bundleName;
  };
}

- (SNTAttributeBlock)bundleVersion {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    return fileInfo.bundleVersion;
  };
}

- (SNTAttributeBlock)bundleVersionStr {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    return fileInfo.bundleShortVersionString;
  };
}

- (SNTAttributeBlock)downloadReferrerURL {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    return fileInfo.quarantineRefererURL;
  };
}

- (SNTAttributeBlock)downloadURL {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    return fileInfo.quarantineDataURL;
  };
}

- (SNTAttributeBlock)downloadTimestamp {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    return [cmd.dateFormatter stringFromDate:fileInfo.quarantineTimestamp];
  };
}

- (SNTAttributeBlock)downloadAgent {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    return fileInfo.quarantineAgentBundleID;
  };
}

- (SNTAttributeBlock)type {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    NSArray *archs = [fileInfo architectures];
    if (archs.count == 0) {
      return [fileInfo humanReadableFileType];
    }
    return [NSString stringWithFormat:@"%@ (%@)", [fileInfo humanReadableFileType],
                                      [archs componentsJoinedByString:@", "]];
  };
}

- (SNTAttributeBlock)pageZero {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    if ([fileInfo isMissingPageZero]) {
      return @"__PAGEZERO segment missing/bad!";
    }
    return nil;
  };
}

- (SNTAttributeBlock)codeSigned {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    NSError *error;
    MOLCodesignChecker *csc = [fileInfo codesignCheckerWithError:&error];
    if (error) {
      switch (error.code) {
        case errSecCSUnsigned: return @"No";
        case errSecCSSignatureFailed:
        case errSecCSStaticCodeChanged:
        case errSecCSSignatureNotVerifiable:
        case errSecCSSignatureUnsupported: return @"Yes, but code/signature changed/unverifiable";
        case errSecCSResourceDirectoryFailed:
        case errSecCSResourceNotSupported:
        case errSecCSResourceRulesInvalid:
        case errSecCSResourcesInvalid:
        case errSecCSResourcesNotFound:
        case errSecCSResourcesNotSealed: return @"Yes, but resources invalid";
        case errSecCSReqFailed:
        case errSecCSReqInvalid:
        case errSecCSReqUnsupported: return @"Yes, but failed requirement validation";
        case errSecCSInfoPlistFailed: return @"Yes, but can't validate as Info.plist is missing";
        case errSecCSSignatureInvalid:
          if ([error.domain isEqualToString:@"com.google.molcodesignchecker"]) {
            return @"Yes, but signing is not consistent for all architectures";
          }
        case CSSMERR_TP_CERT_REVOKED: return @"Yes, but the signing certificate was revoked";
        default: {
          return [NSString stringWithFormat:@"Yes, but failed to validate (%ld)", error.code];
        }
      }
    } else if (csc.signatureFlags & kSecCodeSignatureAdhoc) {
      return @"Yes, but ad-hoc";
    } else {
      return @"Yes";
    }
  };
}

- (SNTAttributeBlock)rule {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    // If we previously were unable to connect, don't try again.
    if (cmd.daemonUnavailable) return kCommunicationErrorMsg;
    static dispatch_once_t token;
    dispatch_once(&token, ^{
      [cmd.daemonConn resume];
    });
    __block SNTEventState state;
    dispatch_semaphore_t sema = dispatch_semaphore_create(0);
    NSError *err;
    MOLCodesignChecker *csc = [fileInfo codesignCheckerWithError:&err];

    NSData *cdhashData =
      (NSData *)[csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoUnique];
    NSString *cdhash = formatCDHashStr([[NSString alloc] initWithData:cdhashData
                                                             encoding:NSUTF8StringEncoding]);

    NSString *teamID = [[csc.signingInformation
      objectForKey:(__bridge NSString *)kSecCodeInfoTeamIdentifier] description];
    NSString *identifier =
      [csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoIdentifier];

    NSString *signingID;
    if (identifier) {
      if (teamID) {
        signingID = [NSString stringWithFormat:@"%@:%@", teamID, identifier];
      } else {
        id platformID =
          [csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoPlatformIdentifier];
        if ([platformID isKindOfClass:[NSNumber class]] && [platformID intValue] != 0) {
          signingID = [NSString stringWithFormat:@"platform:%@", identifier];
        }
      }
    }

    struct RuleIdentifiers identifiers = {
      .cdhash = cdhash,
      .binarySHA256 = fileInfo.SHA256,
      .signingID = signingID,
      .certificateSHA256 = err ? nil : csc.leafCertificate.SHA256,
      .teamID = teamID,
    };

    [[cmd.daemonConn remoteObjectProxy]
      decisionForFilePath:fileInfo.path
              identifiers:[[SNTRuleIdentifiers alloc] initWithRuleIdentifiers:identifiers]
                    reply:^(SNTEventState s) {
                      state = s;
                      dispatch_semaphore_signal(sema);
                    }];
    if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
      cmd.daemonUnavailable = YES;
      return kCommunicationErrorMsg;
    } else {
      NSMutableString *output =
        (SNTEventStateAllow & state) ? @"Allowed".mutableCopy : @"Blocked".mutableCopy;
      switch (state) {
        case SNTEventStateAllowUnknown:
        case SNTEventStateBlockUnknown: [output appendString:@" (Unknown)"]; break;
        case SNTEventStateAllowBinary:
        case SNTEventStateBlockBinary: [output appendString:@" (Binary)"]; break;
        case SNTEventStateAllowCertificate:
        case SNTEventStateBlockCertificate: [output appendString:@" (Certificate)"]; break;
        case SNTEventStateAllowTeamID:
        case SNTEventStateBlockTeamID: [output appendString:@" (TeamID)"]; break;
        case SNTEventStateAllowSigningID:
        case SNTEventStateBlockSigningID: [output appendString:@" (SigningID)"]; break;
        case SNTEventStateAllowCDHash:
        case SNTEventStateBlockCDHash: [output appendString:@" (CDHash)"]; break;
        case SNTEventStateAllowScope:
        case SNTEventStateBlockScope: [output appendString:@" (Scope)"]; break;
        case SNTEventStateAllowCompiler: [output appendString:@" (Compiler)"]; break;
        case SNTEventStateAllowTransitive: [output appendString:@" (Transitive)"]; break;
        case SNTEventStateBlockLongPath: [output appendString:@" (Long Path)"]; break;

        default: output = @"None".mutableCopy; break;
      }
      if (cmd.prettyOutput) {
        if ((SNTEventStateAllow & state)) {
          [output insertString:@"\033[32m" atIndex:0];
          [output appendString:@"\033[0m"];
        } else if ((SNTEventStateBlock & state)) {
          [output insertString:@"\033[31m" atIndex:0];
          [output appendString:@"\033[0m"];
        } else {
          [output insertString:@"\033[33m" atIndex:0];
          [output appendString:@"\033[0m"];
        }
      }
      return output.copy;
    }
  };
}

- (SNTAttributeBlock)signingChain {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    MOLCodesignChecker *csc = [fileInfo codesignCheckerWithError:NULL];
    if (!csc.certificates.count) return nil;
    NSMutableArray *certs = [[NSMutableArray alloc] initWithCapacity:csc.certificates.count];
    for (MOLCertificate *c in csc.certificates) {
      [certs addObject:@{
        kSHA256 : c.SHA256 ?: @"null",
        kSHA1 : c.SHA1 ?: @"null",
        kCommonName : c.commonName ?: @"null",
        kOrganization : c.orgName ?: @"null",
        kOrganizationalUnit : c.orgUnit ?: @"null",
        kValidFrom : [cmd.dateFormatter stringFromDate:c.validFrom] ?: @"null",
        kValidUntil : [cmd.dateFormatter stringFromDate:c.validUntil] ?: @"null"
      }];
    }
    return certs;
  };
}

- (SNTAttributeBlock)universalSigningChain {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    MOLCodesignChecker *csc = [fileInfo codesignCheckerWithError:NULL];
    if (csc.certificates.count) return nil;
    if (!csc.universalSigningInformation) return nil;
    NSMutableArray *universal = [NSMutableArray array];
    for (NSDictionary *arch in csc.universalSigningInformation) {
      [universal addObject:@{@"arch" : arch.allKeys.firstObject}];
      int flags = [arch.allValues.firstObject[(__bridge id)kSecCodeInfoFlags] intValue];
      if (flags & kSecCodeSignatureAdhoc) {
        [universal addObject:@{@"ad-hoc" : @YES}];
        continue;
      }
      NSArray *certs = arch.allValues.firstObject[(__bridge id)kSecCodeInfoCertificates];
      NSArray *chain = [MOLCertificate certificatesFromArray:certs];
      if (!chain.count) {
        [universal addObject:@{@"unsigned" : @YES}];
        continue;
      }
      for (MOLCertificate *c in chain) {
        [universal addObject:@{
          kSHA256 : c.SHA256 ?: @"null",
          kSHA1 : c.SHA1 ?: @"null",
          kCommonName : c.commonName ?: @"null",
          kOrganization : c.orgName ?: @"null",
          kOrganizationalUnit : c.orgUnit ?: @"null",
          kValidFrom : [cmd.dateFormatter stringFromDate:c.validFrom] ?: @"null",
          kValidUntil : [cmd.dateFormatter stringFromDate:c.validUntil] ?: @"null"
        }];
      }
    }
    NSMutableSet *set = [NSMutableSet set];
    for (NSDictionary *cert in universal) {
      if (cert[@"arch"]) continue;
      [set addObject:cert];
    }
    return (set.count > 1) ? universal : nil;
  };
}

- (SNTAttributeBlock)teamID {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    MOLCodesignChecker *csc = [fileInfo codesignCheckerWithError:NULL];
    return [csc.signingInformation valueForKey:@"teamid"];
  };
}

- (SNTAttributeBlock)signingID {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    MOLCodesignChecker *csc = [fileInfo codesignCheckerWithError:NULL];
    return [csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoIdentifier];
  };
}

- (SNTAttributeBlock)cdhash {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    MOLCodesignChecker *csc = [fileInfo codesignCheckerWithError:NULL];
    NSData *cdhashData =
      (NSData *)[csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoUnique];
    return formatCDHashStr([[NSString alloc] initWithData:cdhashData
                                                 encoding:NSUTF8StringEncoding]);
  };
}

#pragma mark -

// Entry point for the command.
- (void)runWithArguments:(NSArray *)arguments {
  if (!arguments.count) [self printErrorUsageAndExit:@"No arguments"];

  NSArray *filePaths = [self parseArguments:arguments];

  if (!self.outputKeyList || !self.outputKeyList.count) {
    if (self.certIndex) {
      self.outputKeyList = [[self class] signingChainKeys];
    } else {
      self.outputKeyList = [[self class] fileInfoKeys];
    }
  }
  // Figure out max field width from list of keys
  self.maxKeyWidth = 0;
  for (NSString *key in self.outputKeyList) {
    if (key.length > self.maxKeyWidth) self.maxKeyWidth = key.length;
  }

  // For consistency, JSON output is always returned as an array of file info objects, regardless of
  // how many file info objects are being outputted.  So both empty and singleton result sets are
  // still enclosed in brackets.
  if (self.jsonOutput) printf("[\n");

  NSFileManager *fm = [NSFileManager defaultManager];
  NSString *cwd = [fm currentDirectoryPath];

  // Dispatch group for tasks printing to stdout.
  self.printGroup = dispatch_group_create();

  [filePaths enumerateObjectsWithOptions:NSEnumerationConcurrent
                              usingBlock:^(NSString *path, NSUInteger idx, BOOL *stop) {
                                NSString *fullPath = [path stringByStandardizingPath];
                                if (path.length && [path characterAtIndex:0] != '/') {
                                  fullPath = [cwd stringByAppendingPathComponent:fullPath];
                                }
                                [self recurseAtPath:fullPath];
                              }];

  // Wait for all tasks in print queue to complete.
  dispatch_group_wait(self.printGroup, DISPATCH_TIME_FOREVER);

  if (self.jsonOutput) printf("\n]\n");  // print closing bracket of JSON output array

  exit(0);
}

// Returns YES if we should output colored text.
- (BOOL)prettyOutput {
  return isatty(STDOUT_FILENO) && !self.jsonOutput;
}

// Print out file info for the object at the given path or, if path is a directory and the
// --recursive flag is set, print out file info for all objects in directory tree.
- (void)recurseAtPath:(NSString *)path {
  NSFileManager *fm = [NSFileManager defaultManager];
  BOOL isDir = NO, isBundle = NO;
  if (![fm fileExistsAtPath:path isDirectory:&isDir]) {
    dispatch_group_async(self.printGroup, self.printQueue, ^{
      fprintf(stderr, "File does not exist: %s\n", [path UTF8String]);
    });
    return;
  }

  if (isDir) {
    NSBundle *bundle = [NSBundle bundleWithPath:path];
    isBundle = bundle && [bundle bundleIdentifier];
  }

  NSOperationQueue *operationQueue = [[NSOperationQueue alloc] init];
  operationQueue.qualityOfService = NSQualityOfServiceUserInitiated;

  if (isDir && self.recursive) {
    NSDirectoryEnumerator *dirEnum = [fm enumeratorAtPath:path];
    NSString *file = [dirEnum nextObject];
    while (file) {
      @autoreleasepool {
        NSString *filepath = [path stringByAppendingPathComponent:file];
        BOOL exists = [fm fileExistsAtPath:filepath isDirectory:&isDir];
        if (!(exists && isDir)) {  // don't display anything for a directory path
          [operationQueue addOperationWithBlock:^{
            [self printInfoForFile:filepath];
          }];
        }
        file = [dirEnum nextObject];
      }
    }
  } else if (isDir && !isBundle) {
    dispatch_group_async(self.printGroup, self.printQueue, ^{
      fprintf(stderr, "%s is a directory.  Use the -r flag to search recursively.\n",
              [path UTF8String]);
    });
  } else {
    [operationQueue addOperationWithBlock:^{
      [self printInfoForFile:path];
    }];
  }

  [operationQueue waitUntilAllOperationsAreFinished];
}

// Prints out the info for a single (non-directory) file.  Which info is printed is controlled
// by the keys in self.outputKeyList.
- (void)printInfoForFile:(NSString *)path {
  SNTFileInfo *fileInfo = [[SNTFileInfo alloc] initWithPath:path];
  if (!fileInfo) {
    dispatch_group_async(self.printGroup, self.printQueue, ^{
      fprintf(stderr, "Invalid or empty file: %s\n", [path UTF8String]);
    });
    return;
  }

  // First build up a dictionary containing all the information we want to print out
  NSMutableDictionary *outputDict = [NSMutableDictionary dictionary];
  if (self.certIndex) {
    int index = [self.certIndex intValue];

    // --cert-index flag implicitly means that we want only the signing chain.  So we find the
    // specified certificate in the signing chain, then print out values for all keys in cert.
    NSArray *signingChain = self.propertyMap[kSigningChain](self, fileInfo);
    if (!signingChain || !signingChain.count) return;  // check signing chain isn't empty
    if (index < 0) {
      index = (int)signingChain.count - -(index);
      if (index < 0) {
        fprintf(stderr, "Invalid --cert-index: %d\n", index);
        return;
      }
    } else {
      if (index >= (int)signingChain.count) {
        fprintf(stderr, "Invalid --cert-index: %d\n", index);
        return;
      }
    }
    NSDictionary *cert = signingChain[index];

    // Check if we should skip over this item based on outputFilters.
    BOOL filterMatch = self.outputFilters.count == 0;
    for (NSString *key in self.outputFilters) {
      NSString *value = cert[key] ?: @"";
      NSRegularExpression *regex = self.outputFilters[key];
      if (![regex firstMatchInString:value options:0 range:NSMakeRange(0, value.length)]) continue;
      filterMatch = YES;
      break;
    }

    if (!filterMatch) return;

    // Filter out the info we want now, in case JSON output
    for (NSString *key in self.outputKeyList) {
      outputDict[key] = cert[key];
    }
  } else {
    // Check if we should skip over this item based on outputFilters.  We do this before collecting
    // output info because there's a chance that we can bail out early if a filter doesn't match.
    // However we also don't want to recompute info, so we save any values that we plan to show.
    BOOL filterMatch = self.outputFilters.count == 0;
    for (NSString *key in self.outputFilters) {
      NSString *value = self.propertyMap[key](self, fileInfo) ?: @"";
      NSRegularExpression *regex = self.outputFilters[key];
      if (![regex firstMatchInString:value options:0 range:NSMakeRange(0, value.length)]) continue;
      // If this is a value we want to show, store it in the output dictionary.
      // This does a linear search on an array, but it's a small array.
      if (value.length && [self.outputKeyList containsObject:key]) {
        outputDict[key] = value;
      }
      filterMatch = YES;
      break;
    }

    if (!filterMatch) return;

    // Then fill the outputDict with the rest of the missing values.
    for (NSString *key in self.outputKeyList) {
      if (outputDict[key]) continue;  // ignore keys that we've already set due to a filter
      outputDict[key] = self.propertyMap[key](self, fileInfo);
    }

    if (self.bundleInfo) {
      SNTStoredEvent *se = [[SNTStoredEvent alloc] init];
      se.fileBundlePath = fileInfo.bundlePath;

      MOLXPCConnection *bc = [SNTXPCBundleServiceInterface configuredConnection];
      [bc resume];

      __block NSMutableDictionary *bundleInfo = [[NSMutableDictionary alloc] init];

      bundleInfo[kBundlePath] = fileInfo.bundle.bundlePath;
      bundleInfo[kBundleID] = fileInfo.bundle.bundleIdentifier;

      dispatch_semaphore_t sema = dispatch_semaphore_create(0);

      [[bc remoteObjectProxy]
        hashBundleBinariesForEvent:se
                             reply:^(NSString *hash, NSArray<SNTStoredEvent *> *events,
                                     NSNumber *time) {
                               bundleInfo[kBundleHash] = hash;

                               NSMutableArray *bundleHashes = [[NSMutableArray alloc] init];

                               for (SNTStoredEvent *event in events) {
                                 [bundleHashes
                                   addObject:@{kSHA256 : event.fileSHA256, kPath : event.filePath}];
                               }

                               bundleInfo[kBundleHashes] = bundleHashes;
                               [[bc remoteObjectProxy] spindown];
                               dispatch_semaphore_signal(sema);
                             }];

      int secondsToWait = 30;
      if (dispatch_semaphore_wait(sema,
                                  dispatch_time(DISPATCH_TIME_NOW, secondsToWait * NSEC_PER_SEC))) {
        fprintf(stderr, "The bundle service did not finish collecting hashes within %d seconds\n",
                secondsToWait);
      }

      outputDict[kBundleInfo] = bundleInfo;
    }
  }

  // If there's nothing in the outputDict, then don't need to print anything.
  if (!outputDict.count) return;

  // Then display the information in the dictionary.  How we display it depends on
  // a) do we want JSON output?
  // b) is there only one key?
  // c) are we displaying a cert?
  BOOL singleKey =
    (self.outputKeyList.count == 1 && ![self.outputKeyList.firstObject isEqual:kSigningChain]);
  NSMutableString *output = [NSMutableString string];
  if (self.jsonOutput) {
    [output appendString:[self jsonStringForDictionary:outputDict]];
  } else {
    for (NSString *key in self.outputKeyList) {
      if (![outputDict objectForKey:key]) continue;
      if ([key isEqual:kSigningChain] || [key isEqual:kUniversalSigningChain]) {
        [output appendString:[self stringForSigningChain:outputDict[key] key:key]];
      } else {
        if (singleKey) {
          [output appendFormat:@"%@\n", outputDict[key]];
        } else {
          [output
            appendFormat:@"%-*s: %@\n", (int)self.maxKeyWidth, key.UTF8String, outputDict[key]];
        }
      }
    }

    if (self.bundleInfo) {
      [output appendString:[self stringForBundleInfo:outputDict[kBundleInfo] key:kBundleInfo]];
    }

    if (!singleKey) [output appendString:@"\n"];
  }

  dispatch_group_async(self.printGroup, self.printQueue, ^{
    if (self.jsonOutput) {  // print commas between JSON entries
      if (self.jsonPreviousEntry) printf(",\n");
      self.jsonPreviousEntry = YES;
    }
    printf("%s", output.UTF8String);
  });
}

// Parses the arguments in order to set the property variables:
//   self.recursive from --recursive or -r
//   self.json from --json
//   self.certIndex from --cert-index argument
//   self.outputKeyList from multiple possible --key arguments
//   self.outputFilters from multiple possible --filter arguments
// and returns any non-flag args as path names in an NSArray.
- (NSArray *)parseArguments:(NSArray<NSString *> *)arguments {
  NSMutableArray *paths = [NSMutableArray array];
  NSMutableOrderedSet *keys = [NSMutableOrderedSet orderedSet];
  NSMutableDictionary *filters = [NSMutableDictionary dictionary];
  NSUInteger nargs = [arguments count];
  for (NSUInteger i = 0; i < nargs; i++) {
    NSString *arg = [arguments objectAtIndex:i];
    if ([arg caseInsensitiveCompare:@"--json"] == NSOrderedSame) {
      self.jsonOutput = YES;
    } else if ([arg caseInsensitiveCompare:@"--cert-index"] == NSOrderedSame) {
      if (self.bundleInfo) {
        [self printErrorUsageAndExit:@"\n--cert-index is incompatible with --bundleinfo"];
      }
      i += 1;  // advance to next argument and grab index
      if (i >= nargs || [arguments[i] hasPrefix:@"--"]) {
        [self printErrorUsageAndExit:@"\n--cert-index requires an argument"];
      }
      int index = 0;
      NSScanner *scanner = [NSScanner scannerWithString:arguments[i]];
      if (![scanner scanInt:&index] || !scanner.atEnd) {
        [self printErrorUsageAndExit:
                [NSString stringWithFormat:@"\n\"%@\" is an invalid argument for --cert-index\n",
                                           arguments[i]]];
      }
      self.certIndex = @(index);
    } else if ([arg caseInsensitiveCompare:@"--key"] == NSOrderedSame) {
      i += 1;  // advance to next argument and grab the key
      if (i >= nargs || [arguments[i] hasPrefix:@"--"]) {
        [self printErrorUsageAndExit:@"\n--key requires an argument"];
      }
      [keys addObject:arguments[i]];
    } else if ([arg caseInsensitiveCompare:@"--filter"] == NSOrderedSame) {
      i += 1;  // advance to next argument and grab the filter predicate
      if (i >= nargs || [arguments[i] hasPrefix:@"--"]) {
        [self printErrorUsageAndExit:@"\n--filter requires an argument"];
      }
      // Check that filter predicate has the format "key=regex".
      NSRange range = [arguments[i] rangeOfString:@"="];
      if (range.location == NSNotFound || range.location == 0 ||
          range.location == arguments[i].length - 1) {
        [self printErrorUsageAndExit:
                [NSString stringWithFormat:@"\n\"%@\" is an invalid filter predicate.\n"
                                           @"Filter predicates must be of the form key=regex"
                                           @" (with no spaces around \"=\")",
                                           arguments[i]]];
      }
      NSString *key = [arguments[i] substringToIndex:range.location];
      NSString *rhs = [arguments[i] substringFromIndex:range.location + 1];
      // Convert right-hand side of '=' into a regular expression object.
      NSError *error;
      NSRegularExpression *regex =
        [NSRegularExpression regularExpressionWithPattern:rhs
                                                  options:NSRegularExpressionCaseInsensitive
                                                    error:&error];
      if (error) {
        [self printErrorUsageAndExit:[NSString stringWithFormat:@"\n\"%@\" is an invalid regular "
                                                                @"expression in filter argument.\n",
                                                                rhs]];
      }
      filters[key] = regex;
    } else if ([arg caseInsensitiveCompare:@"--recursive"] == NSOrderedSame ||
               [arg caseInsensitiveCompare:@"-r"] == NSOrderedSame) {
      if (self.bundleInfo) {
        [self printErrorUsageAndExit:@"\n--recursive is incompatible with --bundleinfo"];
      }
      self.recursive = YES;
    } else if ([arg caseInsensitiveCompare:@"--bundleinfo"] == NSOrderedSame ||
               [arg caseInsensitiveCompare:@"-b"] == NSOrderedSame) {
      if (self.recursive || self.certIndex) {
        [self printErrorUsageAndExit:
                @"\n--bundleinfo is incompatible with --recursive and --cert-index"];
      }
      self.bundleInfo = YES;
    } else {
      [paths addObject:arg];
    }
  }

  // Do some error checking before returning to make sure that specified keys are valid.
  if (self.certIndex) {
    NSArray *validKeys = [[self class] signingChainKeys];
    for (NSString *key in keys) {
      if (![validKeys containsObject:key]) {
        [self
          printErrorUsageAndExit:
            [NSString stringWithFormat:@"\n\"%@\" is an invalid key when using --cert-index", key]];
      }
    }
    for (NSString *key in filters) {
      if (![validKeys containsObject:key]) {
        [self
          printErrorUsageAndExit:
            [NSString
              stringWithFormat:@"\n\"%@\" is an invalid filter key when using --cert-index", key]];
      }
    }
  } else {
    NSArray *validKeys = [[self class] fileInfoKeys];
    for (NSString *key in keys) {
      if (![validKeys containsObject:key]) {
        [self
          printErrorUsageAndExit:[NSString stringWithFormat:@"\n\"%@\" is an invalid key", key]];
      }
    }
    for (NSString *key in filters) {
      if (![validKeys containsObject:key] || [key isEqualToString:kSigningChain]) {
        [self printErrorUsageAndExit:[NSString
                                       stringWithFormat:@"\n\"%@\" is an invalid filter key", key]];
      }
    }
  }

  if (!paths.count) [self printErrorUsageAndExit:@"\nat least one file-path is needed"];

  self.outputKeyList = [keys array];
  self.outputFilters = [filters copy];
  return paths.copy;
}

- (NSString *)jsonStringForDictionary:(NSDictionary *)dict {
  NSData *jsonData = [NSJSONSerialization dataWithJSONObject:dict
                                                     options:NSJSONWritingPrettyPrinted
                                                       error:NULL];
  return [[NSString alloc] initWithData:jsonData encoding:NSUTF8StringEncoding];
}

- (NSString *)stringForSigningChain:(NSArray *)signingChain key:(NSString *)key {
  if (!signingChain) return @"";
  NSMutableString *result = [NSMutableString string];
  [result appendFormat:@"%@:\n", key];
  int i = 1;
  NSArray<NSString *> *certKeys = [[self class] signingChainKeys];
  for (NSDictionary *cert in signingChain) {
    if ([cert isEqual:[NSNull null]]) continue;
    if (cert[@"arch"]) {
      [result appendFormat:@"  %2@\n", [@"Architecture: " stringByAppendingString:cert[@"arch"]]];
      i = 1;
      continue;
    } else if (cert[@"ad-hoc"]) {
      [result appendFormat:@"    %2d. %-20@\n", i, @"ad-hoc"];
      continue;
    } else if (cert[@"unsigned"]) {
      [result appendFormat:@"    %2d. %-20@\n", i, @"unsigned"];
      continue;
    }
    if (i > 1) [result appendFormat:@"\n"];
    [result appendString:[self stringForCertificate:cert withKeys:certKeys index:i]];
    i += 1;
  }
  return result.copy;
}

- (NSString *)stringForBundleInfo:(NSDictionary *)bundleInfo key:(NSString *)key {
  NSMutableString *result = [NSMutableString string];

  [result appendFormat:@"%@:\n", key];

  [result appendFormat:@"       %-20s: %@\n", kBundlePath.UTF8String, bundleInfo[kBundlePath]];
  [result appendFormat:@"       %-20s: %@\n", kBundleID.UTF8String, bundleInfo[kBundleID]];
  [result appendFormat:@"       %-20s: %@\n", kBundleHash.UTF8String, bundleInfo[kBundleHash]];

  for (NSDictionary *hashPath in bundleInfo[kBundleHashes]) {
    [result appendFormat:@"              %@  %@\n", hashPath[kSHA256], hashPath[kPath]];
  }

  return [result copy];
}

- (NSString *)stringForCertificate:(NSDictionary *)cert withKeys:(NSArray *)keys index:(int)index {
  if (!cert) return @"";
  NSMutableString *result = [NSMutableString string];
  BOOL firstKey = YES;
  for (NSString *key in keys) {
    if (firstKey) {
      [result appendFormat:@"   %2d. %-20s: %@\n", index, key.UTF8String, cert[key]];
      firstKey = NO;
    } else {
      [result appendFormat:@"       %-20s: %@\n", key.UTF8String, cert[key]];
    }
  }
  return result.copy;
}

@end

google / santa / 8570617896

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous