8650924032

Committed 11 Apr 2024 05:35PM UTC coverage: 62.868% (-0.7%) from 63.61%

Build # 8650924032

Build Type

push

github

Committed by

web-flow

Commit Message

ProcessTree: add the first annotation, originator (4/4) (#1296)

Run Details

5324 of 12604 branches covered (42.24%)

Branch coverage included in aggregate %.

62 of 68 new or added lines in 4 files covered. (91.18%)

214 existing lines in 29 files now uncovered.

16932 of 22797 relevant lines covered (74.27%)

6458.81 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

59.55

/Source/santad/MetricsTest.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#include <EndpointSecurity/EndpointSecurity.h>
#import <Foundation/Foundation.h>
#import <OCMock/OCMock.h>
#import <XCTest/XCTest.h>
#include <dispatch/dispatch.h>

#include <map>

#include "Source/common/SNTMetricSet.h"
#include "Source/common/TestUtils.h"
#include "Source/santad/Metrics.h"

using santa::santad::EventCountTuple;
using santa::santad::EventDisposition;
using santa::santad::EventStatsTuple;
using santa::santad::EventTimesTuple;
using santa::santad::FileAccessEventCountTuple;
using santa::santad::Processor;

namespace santa::santad {

extern NSString *const ProcessorToString(Processor processor);
extern NSString *const EventTypeToString(es_event_type_t eventType);
extern NSString *const EventDispositionToString(EventDisposition d);
extern NSString *const FileAccessMetricStatusToString(FileAccessMetricStatus status);
extern NSString *const FileAccessPolicyDecisionToString(FileAccessPolicyDecision decision);

class MetricsPeer : public Metrics {
 public:
  // Make base class constructors visible
  using Metrics::Metrics;

  // Private methods
  using Metrics::FlushMetrics;

  // Private member variables
  using Metrics::drop_cache_;
  using Metrics::event_counts_cache_;
  using Metrics::event_times_cache_;
  using Metrics::faa_event_counts_cache_;
  using Metrics::interval_;
  using Metrics::rate_limit_counts_cache_;
  using Metrics::running_;

  using Metrics::SequenceStats;
};

}  // namespace santa::santad

using santa::santad::EventDispositionToString;
using santa::santad::EventTypeToString;
using santa::santad::FileAccessMetricStatus;
using santa::santad::FileAccessMetricStatusToString;
using santa::santad::FileAccessPolicyDecisionToString;
using santa::santad::Metrics;
using santa::santad::MetricsPeer;
using santa::santad::ProcessorToString;

std::shared_ptr<MetricsPeer> CreateBasicMetricsPeer(dispatch_queue_t q, void (^block)(Metrics *)) {
  dispatch_source_t timer = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0, q);
  return std::make_shared<MetricsPeer>(q, timer, 100, nil, nil, nil, nil, nil, nil, block);
}

@interface MetricsTest : XCTestCase
@property dispatch_queue_t q;
@property dispatch_semaphore_t sema;
@end

@implementation MetricsTest

- (void)setUp {
  self.q = dispatch_queue_create(NULL, DISPATCH_QUEUE_SERIAL);
  XCTAssertNotNil(self.q);
  self.sema = dispatch_semaphore_create(0);
}

- (void)testStartStop {
  std::shared_ptr<MetricsPeer> metrics = CreateBasicMetricsPeer(self.q, ^(Metrics *) {
    dispatch_semaphore_signal(self.sema);
  });

  XCTAssertFalse(metrics->running_);

  metrics->StartPoll();
  XCTAssertEqual(0, dispatch_semaphore_wait(self.sema, DISPATCH_TIME_NOW),
                 "Initialization block never called");

  // Should be marked running after starting
  XCTAssertTrue(metrics->running_);

  metrics->StartPoll();

  // Ensure the initialization block isn't called a second time
  XCTAssertNotEqual(0, dispatch_semaphore_wait(self.sema, DISPATCH_TIME_NOW),
                    "Initialization block called second time unexpectedly");

  // Double-start doesn't change the running state
  XCTAssertTrue(metrics->running_);

  metrics->StopPoll();

  // After stopping, the internal state is no longer marked running
  XCTAssertFalse(metrics->running_);

  metrics->StopPoll();

  // Double-stop doesn't change the running state
  XCTAssertFalse(metrics->running_);
}

- (void)testSetInterval {
  std::shared_ptr<MetricsPeer> metrics = CreateBasicMetricsPeer(self.q, ^(Metrics *){
                                                                });

  XCTAssertEqual(100, metrics->interval_);

  metrics->SetInterval(200);
  XCTAssertEqual(200, metrics->interval_);
}

- (void)testProcessorToString {
  std::map<Processor, NSString *> processorToString = {
    {Processor::kAuthorizer, @"Authorizer"},
    {Processor::kDeviceManager, @"DeviceManager"},
    {Processor::kRecorder, @"Recorder"},
    {Processor::kTamperResistance, @"TamperResistance"},
  };

  for (const auto &kv : processorToString) {
    XCTAssertEqualObjects(ProcessorToString(kv.first), kv.second);
  }

  XCTAssertThrows(ProcessorToString((Processor)12345));
}

- (void)testEventTypeToString {
  std::map<es_event_type_t, NSString *> eventTypeToString = {
    {ES_EVENT_TYPE_AUTH_CLONE, @"AuthClone"},
    {ES_EVENT_TYPE_AUTH_COPYFILE, @"AuthCopyfile"},
    {ES_EVENT_TYPE_AUTH_CREATE, @"AuthCreate"},
    {ES_EVENT_TYPE_AUTH_EXCHANGEDATA, @"AuthExchangedata"},
    {ES_EVENT_TYPE_AUTH_EXEC, @"AuthExec"},
    {ES_EVENT_TYPE_AUTH_KEXTLOAD, @"AuthKextload"},
    {ES_EVENT_TYPE_AUTH_LINK, @"AuthLink"},
    {ES_EVENT_TYPE_AUTH_MOUNT, @"AuthMount"},
    {ES_EVENT_TYPE_AUTH_REMOUNT, @"AuthRemount"},
    {ES_EVENT_TYPE_AUTH_RENAME, @"AuthRename"},
    {ES_EVENT_TYPE_AUTH_TRUNCATE, @"AuthTruncate"},
    {ES_EVENT_TYPE_AUTH_UNLINK, @"AuthUnlink"},
    {ES_EVENT_TYPE_NOTIFY_CLOSE, @"NotifyClose"},
    {ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA, @"NotifyExchangedata"},
    {ES_EVENT_TYPE_NOTIFY_EXEC, @"NotifyExec"},
    {ES_EVENT_TYPE_NOTIFY_EXIT, @"NotifyExit"},
    {ES_EVENT_TYPE_NOTIFY_FORK, @"NotifyFork"},
    {ES_EVENT_TYPE_NOTIFY_LINK, @"NotifyLink"},
    {ES_EVENT_TYPE_NOTIFY_RENAME, @"NotifyRename"},
    {ES_EVENT_TYPE_NOTIFY_UNLINK, @"NotifyUnlink"},
    {ES_EVENT_TYPE_NOTIFY_UNMOUNT, @"NotifyUnmount"},
    {ES_EVENT_TYPE_LAST, @"Global"},
  };

  for (const auto &kv : eventTypeToString) {
    XCTAssertEqualObjects(EventTypeToString(kv.first), kv.second);
  }

  XCTAssertThrows(EventTypeToString((es_event_type_t)12345));
}

- (void)testEventDispositionToString {
  std::map<EventDisposition, NSString *> dispositionToString = {
    {EventDisposition::kDropped, @"Dropped"},
    {EventDisposition::kProcessed, @"Processed"},
  };

  for (const auto &kv : dispositionToString) {
    XCTAssertEqualObjects(EventDispositionToString(kv.first), kv.second);
  }

  XCTAssertThrows(EventDispositionToString((EventDisposition)12345));
}

- (void)testFileAccessMetricStatusToString {
  std::map<FileAccessMetricStatus, NSString *> statusToString = {
    {FileAccessMetricStatus::kOK, @"OK"},
    {FileAccessMetricStatus::kBlockedUser, @"BLOCKED_USER"},
  };

  for (const auto &kv : statusToString) {
    XCTAssertEqualObjects(FileAccessMetricStatusToString(kv.first), kv.second);
  }

  XCTAssertThrows(FileAccessMetricStatusToString((FileAccessMetricStatus)12345));
}

- (void)testFileAccessPolicyDecisionToString {
  std::map<FileAccessPolicyDecision, NSString *> decisionToString = {
    {FileAccessPolicyDecision::kDenied, @"Denied"},
    {FileAccessPolicyDecision::kDeniedInvalidSignature, @"Denied"},
    {FileAccessPolicyDecision::kDeniedInvalidSignature, @"Denied"},
  };

  for (const auto &kv : decisionToString) {
    XCTAssertEqualObjects(FileAccessPolicyDecisionToString(kv.first), kv.second);
  }

  std::set<FileAccessPolicyDecision> decisionToStringThrows = {
    FileAccessPolicyDecision::kNoPolicy,
    FileAccessPolicyDecision::kAllowed,
    FileAccessPolicyDecision::kAllowedReadAccess,
    (FileAccessPolicyDecision)12345,
  };
  for (const auto &v : decisionToStringThrows) {
    XCTAssertThrows(FileAccessPolicyDecisionToString(v));
  }
}

- (void)testSetEventMetrics {
  int64_t nanos = 1234;

  std::shared_ptr<MetricsPeer> metrics = CreateBasicMetricsPeer(self.q, ^(Metrics *){
                                                                });

  // Initial maps are empty
  XCTAssertEqual(metrics->event_counts_cache_.size(), 0);
  XCTAssertEqual(metrics->event_times_cache_.size(), 0);

  metrics->SetEventMetrics(Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_EXEC,
                           EventDisposition::kProcessed, nanos);

  // Check sizes after setting metrics once
  XCTAssertEqual(metrics->event_counts_cache_.size(), 1);
  XCTAssertEqual(metrics->event_times_cache_.size(), 1);

  metrics->SetEventMetrics(Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_EXEC,
                           EventDisposition::kProcessed, nanos);
  metrics->SetEventMetrics(Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_OPEN,
                           EventDisposition::kProcessed, nanos * 2);

  // Re-check expected counts. One was an update, so should only be 2 items
  XCTAssertEqual(metrics->event_counts_cache_.size(), 2);
  XCTAssertEqual(metrics->event_times_cache_.size(), 2);

  // Check map values
  EventCountTuple ecExec{Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_EXEC,
                         EventDisposition::kProcessed};
  EventCountTuple ecOpen{Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_OPEN,
                         EventDisposition::kProcessed};
  EventTimesTuple etExec{Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_EXEC};
  EventTimesTuple etOpen{Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_OPEN};

  XCTAssertEqual(metrics->event_counts_cache_[ecExec], 2);
  XCTAssertEqual(metrics->event_counts_cache_[ecOpen], 1);
  XCTAssertEqual(metrics->event_times_cache_[etExec], nanos);
  XCTAssertEqual(metrics->event_times_cache_[etOpen], nanos * 2);
}

- (void)testSetRateLimitingMetrics {
  std::shared_ptr<MetricsPeer> metrics = CreateBasicMetricsPeer(self.q, ^(Metrics *){
                                                                });

  // Initial map is empty
  XCTAssertEqual(metrics->rate_limit_counts_cache_.size(), 0);

  metrics->SetRateLimitingMetrics(Processor::kFileAccessAuthorizer, 123);

  // Check sizes after setting metrics once
  XCTAssertEqual(metrics->rate_limit_counts_cache_.size(), 1);

  metrics->SetRateLimitingMetrics(Processor::kFileAccessAuthorizer, 456);
  metrics->SetRateLimitingMetrics(Processor::kAuthorizer, 789);

  // Re-check expected counts. One was an update, so should only be 2 items
  XCTAssertEqual(metrics->rate_limit_counts_cache_.size(), 2);

  // Check map values
  XCTAssertEqual(metrics->rate_limit_counts_cache_[Processor::kFileAccessAuthorizer], 123 + 456);
  XCTAssertEqual(metrics->rate_limit_counts_cache_[Processor::kAuthorizer], 789);
}

- (void)testSetFileAccessEventMetrics {
  std::shared_ptr<MetricsPeer> metrics = CreateBasicMetricsPeer(self.q, ^(Metrics *){
                                                                });

  // Initial map is empty
  XCTAssertEqual(metrics->faa_event_counts_cache_.size(), 0);

  metrics->SetFileAccessEventMetrics("v1.0", "rule_abc", FileAccessMetricStatus::kOK,
                                     ES_EVENT_TYPE_AUTH_OPEN, FileAccessPolicyDecision::kDenied);

  // Check sizes after setting metrics once
  XCTAssertEqual(metrics->faa_event_counts_cache_.size(), 1);

  // Update the previous metric
  metrics->SetFileAccessEventMetrics("v1.0", "rule_abc", FileAccessMetricStatus::kOK,
                                     ES_EVENT_TYPE_AUTH_OPEN, FileAccessPolicyDecision::kDenied);

  // Add a second metric
  metrics->SetFileAccessEventMetrics("v1.0", "rule_xyz", FileAccessMetricStatus::kOK,
                                     ES_EVENT_TYPE_AUTH_OPEN, FileAccessPolicyDecision::kDenied);

  // Re-check expected counts. One was an update, so should only be 2 items
  XCTAssertEqual(metrics->faa_event_counts_cache_.size(), 2);

  FileAccessEventCountTuple ruleAbc{"v1.0", "rule_abc", FileAccessMetricStatus::kOK,
                                    ES_EVENT_TYPE_AUTH_OPEN, FileAccessPolicyDecision::kDenied};
  FileAccessEventCountTuple ruleXyz{"v1.0", "rule_xyz", FileAccessMetricStatus::kOK,
                                    ES_EVENT_TYPE_AUTH_OPEN, FileAccessPolicyDecision::kDenied};

  XCTAssertEqual(metrics->faa_event_counts_cache_[ruleAbc], 2);
  XCTAssertEqual(metrics->faa_event_counts_cache_[ruleXyz], 1);
}

- (void)testUpdateEventStats {
  es_message_t esMsg = MakeESMessage(ES_EVENT_TYPE_NOTIFY_EXEC, NULL);
  esMsg.seq_num = 0;
  esMsg.global_seq_num = 0;

  std::shared_ptr<MetricsPeer> metrics = CreateBasicMetricsPeer(self.q, ^(Metrics *){
                                                                });

  EventStatsTuple eventStats{Processor::kRecorder, ES_EVENT_TYPE_NOTIFY_EXEC};
  EventStatsTuple globalStats{Processor::kRecorder, ES_EVENT_TYPE_LAST};

  // Map does not initially contain entries
  XCTAssertEqual(0, metrics->drop_cache_.size());

  metrics->UpdateEventStats(Processor::kRecorder, &esMsg);

  // After the first update, 2 entries exist, one for the event, and one for global
  XCTAssertEqual(2, metrics->drop_cache_.size());
  XCTAssertEqual(1, metrics->drop_cache_[eventStats].next_seq_num);
  XCTAssertEqual(0, metrics->drop_cache_[eventStats].drops);
  XCTAssertEqual(1, metrics->drop_cache_[globalStats].next_seq_num);
  XCTAssertEqual(0, metrics->drop_cache_[globalStats].drops);

  // Increment sequence numbers by 1 and check that no drop was detected
  esMsg.seq_num++;
  esMsg.global_seq_num++;

  metrics->UpdateEventStats(Processor::kRecorder, &esMsg);

  XCTAssertEqual(2, metrics->drop_cache_.size());
  XCTAssertEqual(2, metrics->drop_cache_[eventStats].next_seq_num);
  XCTAssertEqual(0, metrics->drop_cache_[eventStats].drops);
  XCTAssertEqual(2, metrics->drop_cache_[globalStats].next_seq_num);
  XCTAssertEqual(0, metrics->drop_cache_[globalStats].drops);

  // Now incremenet sequence numbers by a large amount to trigger drop detection
  esMsg.seq_num += 10;
  esMsg.global_seq_num += 10;

  metrics->UpdateEventStats(Processor::kRecorder, &esMsg);

  XCTAssertEqual(2, metrics->drop_cache_.size());
  XCTAssertEqual(12, metrics->drop_cache_[eventStats].next_seq_num);
  XCTAssertEqual(9, metrics->drop_cache_[eventStats].drops);
  XCTAssertEqual(12, metrics->drop_cache_[globalStats].next_seq_num);
  XCTAssertEqual(9, metrics->drop_cache_[globalStats].drops);
}

- (void)testFlushMetrics {
  id mockEventProcessingTimes = OCMClassMock([SNTMetricInt64Gauge class]);
  id mockEventCounts = OCMClassMock([SNTMetricCounter class]);
  int64_t nanos = 1234;

  // Initial update will have non-zero sequence numbers, triggering drop detection
  es_message_t esMsgWithDrops = MakeESMessage(ES_EVENT_TYPE_NOTIFY_EXEC, NULL);
  esMsgWithDrops.seq_num = 123;
  esMsgWithDrops.global_seq_num = 123;

  OCMStub([mockEventCounts incrementBy:0 forFieldValues:[OCMArg any]])
    .ignoringNonObjectArgs()
    .andDo(^(NSInvocation *inv) {
      dispatch_semaphore_signal(self.sema);
    });

  OCMStub([(SNTMetricInt64Gauge *)mockEventProcessingTimes set:nanos forFieldValues:[OCMArg any]])
    .ignoringNonObjectArgs()
    .andDo(^(NSInvocation *inv) {
      dispatch_semaphore_signal(self.sema);
    });

  dispatch_source_t timer = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0, self.q);
  auto metrics =
    std::make_shared<MetricsPeer>(self.q, timer, 100, mockEventProcessingTimes, mockEventCounts,
                                  mockEventCounts, mockEventCounts, mockEventCounts, nil,
                                  ^(santa::santad::Metrics *m){
                                    // This block intentionally left blank
                                  });

  metrics->SetEventMetrics(Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_EXEC,
                           EventDisposition::kProcessed, nanos);
  metrics->SetEventMetrics(Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_OPEN,
                           EventDisposition::kProcessed, nanos * 2);
  metrics->UpdateEventStats(Processor::kRecorder, &esMsgWithDrops);
  metrics->SetRateLimitingMetrics(Processor::kFileAccessAuthorizer, 123);
  metrics->SetFileAccessEventMetrics("v1.0", "rule_abc", FileAccessMetricStatus::kOK,
                                     ES_EVENT_TYPE_AUTH_OPEN, FileAccessPolicyDecision::kDenied);

  // First ensure we have the expected map sizes
  XCTAssertEqual(metrics->event_counts_cache_.size(), 2);
  XCTAssertEqual(metrics->event_times_cache_.size(), 2);
  XCTAssertEqual(metrics->rate_limit_counts_cache_.size(), 1);
  XCTAssertEqual(metrics->faa_event_counts_cache_.size(), 1);
  XCTAssertEqual(metrics->drop_cache_.size(), 2);

  EventStatsTuple eventStats{Processor::kRecorder, esMsgWithDrops.event_type};
  EventStatsTuple globalStats{Processor::kRecorder, ES_EVENT_TYPE_LAST};
  XCTAssertEqual(metrics->drop_cache_[eventStats].next_seq_num, 124);
  XCTAssertEqual(metrics->drop_cache_[eventStats].drops, 123);
  XCTAssertEqual(metrics->drop_cache_[globalStats].next_seq_num, 124);
  XCTAssertEqual(metrics->drop_cache_[globalStats].drops, 123);

  metrics->FlushMetrics();

  // Expected call count is 8:
  // 2: event counts
  // 2: event times
  // 1: rate limit
  // 1: FAA
  // 2: drops (1 event, 1 global)
  int expectedCalls = 8;
  for (int i = 0; i < expectedCalls; i++) {
    XCTAssertSemaTrue(self.sema, 5, "Failed waiting for metrics to flush");
  }

  // After a flush, map sizes should be reset to 0
  XCTAssertEqual(metrics->event_counts_cache_.size(), 0);
  XCTAssertEqual(metrics->event_times_cache_.size(), 0);
  XCTAssertEqual(metrics->rate_limit_counts_cache_.size(), 0);
  XCTAssertEqual(metrics->faa_event_counts_cache_.size(), 0);
  // Note: The drop_cache_ should not be reset back to size 0. Instead, each
  // entry has the sequence number left intact, but drop counts reset to 0.
  XCTAssertEqual(metrics->drop_cache_.size(), 2);
  XCTAssertEqual(metrics->drop_cache_[eventStats].next_seq_num, 124);
  XCTAssertEqual(metrics->drop_cache_[eventStats].drops, 0);
  XCTAssertEqual(metrics->drop_cache_[globalStats].next_seq_num, 124);
  XCTAssertEqual(metrics->drop_cache_[globalStats].drops, 0);
}

@end

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#include <EndpointSecurity/EndpointSecurity.h>
16	#import <Foundation/Foundation.h>
17	#import <OCMock/OCMock.h>
18	#import <XCTest/XCTest.h>
19	#include <dispatch/dispatch.h>
20
21	#include <map>
22
23	#include "Source/common/SNTMetricSet.h"
24	#include "Source/common/TestUtils.h"
25	#include "Source/santad/Metrics.h"
26
27	using santa::santad::EventCountTuple;
28	using santa::santad::EventDisposition;
29	using santa::santad::EventStatsTuple;
30	using santa::santad::EventTimesTuple;
31	using santa::santad::FileAccessEventCountTuple;
32	using santa::santad::Processor;
33
34	namespace santa::santad {
35
36	extern NSString *const ProcessorToString(Processor processor);
37	extern NSString *const EventTypeToString(es_event_type_t eventType);
38	extern NSString *const EventDispositionToString(EventDisposition d);
39	extern NSString *const FileAccessMetricStatusToString(FileAccessMetricStatus status);
40	extern NSString *const FileAccessPolicyDecisionToString(FileAccessPolicyDecision decision);
41
42	class MetricsPeer : public Metrics {
43	public:
44	// Make base class constructors visible
45	using Metrics::Metrics;
46
47	// Private methods
48	using Metrics::FlushMetrics;
49
50	// Private member variables
51	using Metrics::drop_cache_;
52	using Metrics::event_counts_cache_;
53	using Metrics::event_times_cache_;
54	using Metrics::faa_event_counts_cache_;
55	using Metrics::interval_;
56	using Metrics::rate_limit_counts_cache_;
57	using Metrics::running_;
58
59	using Metrics::SequenceStats;
60	};
61
62	} // namespace santa::santad
63
64	using santa::santad::EventDispositionToString;
65	using santa::santad::EventTypeToString;
66	using santa::santad::FileAccessMetricStatus;
67	using santa::santad::FileAccessMetricStatusToString;
68	using santa::santad::FileAccessPolicyDecisionToString;
69	using santa::santad::Metrics;
70	using santa::santad::MetricsPeer;
71	using santa::santad::ProcessorToString;
72
73	std::shared_ptr<MetricsPeer> CreateBasicMetricsPeer(dispatch_queue_t q, void (^block)(Metrics *)) {	6✔
74	dispatch_source_t timer = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0, q);	6✔
75	return std::make_shared<MetricsPeer>(q, timer, 100, nil, nil, nil, nil, nil, nil, block);	6✔
76	}	6✔
77
78	@interface MetricsTest : XCTestCase
79	@property dispatch_queue_t q;
80	@property dispatch_semaphore_t sema;
81	@end
82
83	@implementation MetricsTest
84
85	- (void)setUp {	12✔
86	self.q = dispatch_queue_create(NULL, DISPATCH_QUEUE_SERIAL);	12✔
87	XCTAssertNotNil(self.q);	12!
88	self.sema = dispatch_semaphore_create(0);	12✔
89	}	12✔
90
91	- (void)testStartStop {	1✔
92	std::shared_ptr<MetricsPeer> metrics = CreateBasicMetricsPeer(self.q, ^(Metrics *) {	1✔
93	dispatch_semaphore_signal(self.sema);	1✔
94	});	1✔
95
96	XCTAssertFalse(metrics->running_);	1!
97
98	metrics->StartPoll();	1✔
99	XCTAssertEqual(0, dispatch_semaphore_wait(self.sema, DISPATCH_TIME_NOW),	1!
UNCOV 100	"Initialization block never called");	×
101
102	// Should be marked running after starting
103	XCTAssertTrue(metrics->running_);	1!
104
105	metrics->StartPoll();	1✔
106
107	// Ensure the initialization block isn't called a second time
108	XCTAssertNotEqual(0, dispatch_semaphore_wait(self.sema, DISPATCH_TIME_NOW),	1!
UNCOV 109	"Initialization block called second time unexpectedly");	×
110
111	// Double-start doesn't change the running state
112	XCTAssertTrue(metrics->running_);	1!
113
114	metrics->StopPoll();	1✔
115
116	// After stopping, the internal state is no longer marked running
117	XCTAssertFalse(metrics->running_);	1!
118
119	metrics->StopPoll();	1✔
120
121	// Double-stop doesn't change the running state
122	XCTAssertFalse(metrics->running_);	1!
123	}	1✔
124
125	- (void)testSetInterval {	1✔
126	std::shared_ptr<MetricsPeer> metrics = CreateBasicMetricsPeer(self.q, ^(Metrics *){	1✔
127	});	×
128
129	XCTAssertEqual(100, metrics->interval_);	1!
130
131	metrics->SetInterval(200);	1✔
132	XCTAssertEqual(200, metrics->interval_);	1!
133	}	1✔
134
135	- (void)testProcessorToString {	1✔
136	std::map<Processor, NSString *> processorToString = {	1✔
137	{Processor::kAuthorizer, @"Authorizer"},	1✔
138	{Processor::kDeviceManager, @"DeviceManager"},	1✔
139	{Processor::kRecorder, @"Recorder"},	1✔
140	{Processor::kTamperResistance, @"TamperResistance"},	1✔
141	};	1✔
142
143	for (const auto &kv : processorToString) {	4✔
144	XCTAssertEqualObjects(ProcessorToString(kv.first), kv.second);	4!
145	}	4✔
146
147	XCTAssertThrows(ProcessorToString((Processor)12345));	2!
148	}	2✔
149
150	- (void)testEventTypeToString {	1✔
151	std::map<es_event_type_t, NSString *> eventTypeToString = {	1✔
152	{ES_EVENT_TYPE_AUTH_CLONE, @"AuthClone"},	1✔
153	{ES_EVENT_TYPE_AUTH_COPYFILE, @"AuthCopyfile"},	1✔
154	{ES_EVENT_TYPE_AUTH_CREATE, @"AuthCreate"},	1✔
155	{ES_EVENT_TYPE_AUTH_EXCHANGEDATA, @"AuthExchangedata"},	1✔
156	{ES_EVENT_TYPE_AUTH_EXEC, @"AuthExec"},	1✔
157	{ES_EVENT_TYPE_AUTH_KEXTLOAD, @"AuthKextload"},	1✔
158	{ES_EVENT_TYPE_AUTH_LINK, @"AuthLink"},	1✔
159	{ES_EVENT_TYPE_AUTH_MOUNT, @"AuthMount"},	1✔
160	{ES_EVENT_TYPE_AUTH_REMOUNT, @"AuthRemount"},	1✔
161	{ES_EVENT_TYPE_AUTH_RENAME, @"AuthRename"},	1✔
162	{ES_EVENT_TYPE_AUTH_TRUNCATE, @"AuthTruncate"},	1✔
163	{ES_EVENT_TYPE_AUTH_UNLINK, @"AuthUnlink"},	1✔
164	{ES_EVENT_TYPE_NOTIFY_CLOSE, @"NotifyClose"},	1✔
165	{ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA, @"NotifyExchangedata"},	1✔
166	{ES_EVENT_TYPE_NOTIFY_EXEC, @"NotifyExec"},	1✔
167	{ES_EVENT_TYPE_NOTIFY_EXIT, @"NotifyExit"},	1✔
168	{ES_EVENT_TYPE_NOTIFY_FORK, @"NotifyFork"},	1✔
169	{ES_EVENT_TYPE_NOTIFY_LINK, @"NotifyLink"},	1✔
170	{ES_EVENT_TYPE_NOTIFY_RENAME, @"NotifyRename"},	1✔
171	{ES_EVENT_TYPE_NOTIFY_UNLINK, @"NotifyUnlink"},	1✔
172	{ES_EVENT_TYPE_NOTIFY_UNMOUNT, @"NotifyUnmount"},	1✔
173	{ES_EVENT_TYPE_LAST, @"Global"},	1✔
174	};	1✔
175
176	for (const auto &kv : eventTypeToString) {	22✔
177	XCTAssertEqualObjects(EventTypeToString(kv.first), kv.second);	22!
178	}	22✔
179
180	XCTAssertThrows(EventTypeToString((es_event_type_t)12345));	2!
181	}	2✔
182
183	- (void)testEventDispositionToString {	1✔
184	std::map<EventDisposition, NSString *> dispositionToString = {	1✔
185	{EventDisposition::kDropped, @"Dropped"},	1✔
186	{EventDisposition::kProcessed, @"Processed"},	1✔
187	};	1✔
188
189	for (const auto &kv : dispositionToString) {	2✔
190	XCTAssertEqualObjects(EventDispositionToString(kv.first), kv.second);	2!
191	}	2✔
192
193	XCTAssertThrows(EventDispositionToString((EventDisposition)12345));	2!
194	}	2✔
195
196	- (void)testFileAccessMetricStatusToString {	1✔
197	std::map<FileAccessMetricStatus, NSString *> statusToString = {	1✔
198	{FileAccessMetricStatus::kOK, @"OK"},	1✔
199	{FileAccessMetricStatus::kBlockedUser, @"BLOCKED_USER"},	1✔
200	};	1✔
201
202	for (const auto &kv : statusToString) {	2✔
203	XCTAssertEqualObjects(FileAccessMetricStatusToString(kv.first), kv.second);	2!
204	}	2✔
205
206	XCTAssertThrows(FileAccessMetricStatusToString((FileAccessMetricStatus)12345));	2!
207	}	2✔
208
209	- (void)testFileAccessPolicyDecisionToString {	1✔
210	std::map<FileAccessPolicyDecision, NSString *> decisionToString = {	1✔
211	{FileAccessPolicyDecision::kDenied, @"Denied"},	1✔
212	{FileAccessPolicyDecision::kDeniedInvalidSignature, @"Denied"},	1✔
213	{FileAccessPolicyDecision::kDeniedInvalidSignature, @"Denied"},	1✔
214	};	1✔
215
216	for (const auto &kv : decisionToString) {	2✔
217	XCTAssertEqualObjects(FileAccessPolicyDecisionToString(kv.first), kv.second);	2!
218	}	2✔
219
220	std::set<FileAccessPolicyDecision> decisionToStringThrows = {	1✔
221	FileAccessPolicyDecision::kNoPolicy,	1✔
222	FileAccessPolicyDecision::kAllowed,	1✔
223	FileAccessPolicyDecision::kAllowedReadAccess,	1✔
224	(FileAccessPolicyDecision)12345,	1✔
225	};	1✔
226	for (const auto &v : decisionToStringThrows) {	4✔
227	XCTAssertThrows(FileAccessPolicyDecisionToString(v));	4!
228	}	4✔
229	}	1✔
230
231	- (void)testSetEventMetrics {	1✔
232	int64_t nanos = 1234;	1✔
233
234	std::shared_ptr<MetricsPeer> metrics = CreateBasicMetricsPeer(self.q, ^(Metrics *){	1✔
235	});	×
236
237	// Initial maps are empty
238	XCTAssertEqual(metrics->event_counts_cache_.size(), 0);	1!
239	XCTAssertEqual(metrics->event_times_cache_.size(), 0);	1!
240
241	metrics->SetEventMetrics(Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_EXEC,	1✔
242	EventDisposition::kProcessed, nanos);	1✔
243
244	// Check sizes after setting metrics once
245	XCTAssertEqual(metrics->event_counts_cache_.size(), 1);	1!
246	XCTAssertEqual(metrics->event_times_cache_.size(), 1);	1!
247
248	metrics->SetEventMetrics(Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_EXEC,	1✔
249	EventDisposition::kProcessed, nanos);	1✔
250	metrics->SetEventMetrics(Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_OPEN,	1✔
251	EventDisposition::kProcessed, nanos * 2);	1✔
252
253	// Re-check expected counts. One was an update, so should only be 2 items
254	XCTAssertEqual(metrics->event_counts_cache_.size(), 2);	1!
255	XCTAssertEqual(metrics->event_times_cache_.size(), 2);	1!
256
257	// Check map values
258	EventCountTuple ecExec{Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_EXEC,	1✔
259	EventDisposition::kProcessed};	1✔
260	EventCountTuple ecOpen{Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_OPEN,	1✔
261	EventDisposition::kProcessed};	1✔
262	EventTimesTuple etExec{Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_EXEC};	1✔
263	EventTimesTuple etOpen{Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_OPEN};	1✔
264
265	XCTAssertEqual(metrics->event_counts_cache_[ecExec], 2);	1!
266	XCTAssertEqual(metrics->event_counts_cache_[ecOpen], 1);	1!
267	XCTAssertEqual(metrics->event_times_cache_[etExec], nanos);	1!
268	XCTAssertEqual(metrics->event_times_cache_[etOpen], nanos * 2);	1!
269	}	1✔
270
271	- (void)testSetRateLimitingMetrics {	1✔
272	std::shared_ptr<MetricsPeer> metrics = CreateBasicMetricsPeer(self.q, ^(Metrics *){	1✔
273	});	×
274
275	// Initial map is empty
276	XCTAssertEqual(metrics->rate_limit_counts_cache_.size(), 0);	1!
277
278	metrics->SetRateLimitingMetrics(Processor::kFileAccessAuthorizer, 123);	1✔
279
280	// Check sizes after setting metrics once
281	XCTAssertEqual(metrics->rate_limit_counts_cache_.size(), 1);	1!
282
283	metrics->SetRateLimitingMetrics(Processor::kFileAccessAuthorizer, 456);	1✔
284	metrics->SetRateLimitingMetrics(Processor::kAuthorizer, 789);	1✔
285
286	// Re-check expected counts. One was an update, so should only be 2 items
287	XCTAssertEqual(metrics->rate_limit_counts_cache_.size(), 2);	1!
288
289	// Check map values
290	XCTAssertEqual(metrics->rate_limit_counts_cache_[Processor::kFileAccessAuthorizer], 123 + 456);	1!
291	XCTAssertEqual(metrics->rate_limit_counts_cache_[Processor::kAuthorizer], 789);	1!
292	}	1✔
293
294	- (void)testSetFileAccessEventMetrics {	1✔
295	std::shared_ptr<MetricsPeer> metrics = CreateBasicMetricsPeer(self.q, ^(Metrics *){	1✔
296	});	×
297
298	// Initial map is empty
299	XCTAssertEqual(metrics->faa_event_counts_cache_.size(), 0);	1!
300
301	metrics->SetFileAccessEventMetrics("v1.0", "rule_abc", FileAccessMetricStatus::kOK,	1✔
302	ES_EVENT_TYPE_AUTH_OPEN, FileAccessPolicyDecision::kDenied);	1✔
303
304	// Check sizes after setting metrics once
305	XCTAssertEqual(metrics->faa_event_counts_cache_.size(), 1);	1!
306
307	// Update the previous metric
308	metrics->SetFileAccessEventMetrics("v1.0", "rule_abc", FileAccessMetricStatus::kOK,	1✔
309	ES_EVENT_TYPE_AUTH_OPEN, FileAccessPolicyDecision::kDenied);	1✔
310
311	// Add a second metric
312	metrics->SetFileAccessEventMetrics("v1.0", "rule_xyz", FileAccessMetricStatus::kOK,	1✔
313	ES_EVENT_TYPE_AUTH_OPEN, FileAccessPolicyDecision::kDenied);	1✔
314
315	// Re-check expected counts. One was an update, so should only be 2 items
316	XCTAssertEqual(metrics->faa_event_counts_cache_.size(), 2);	1!
317
318	FileAccessEventCountTuple ruleAbc{"v1.0", "rule_abc", FileAccessMetricStatus::kOK,	1✔
319	ES_EVENT_TYPE_AUTH_OPEN, FileAccessPolicyDecision::kDenied};	1✔
320	FileAccessEventCountTuple ruleXyz{"v1.0", "rule_xyz", FileAccessMetricStatus::kOK,	1✔
321	ES_EVENT_TYPE_AUTH_OPEN, FileAccessPolicyDecision::kDenied};	1✔
322
323	XCTAssertEqual(metrics->faa_event_counts_cache_[ruleAbc], 2);	1!
324	XCTAssertEqual(metrics->faa_event_counts_cache_[ruleXyz], 1);	1!
325	}	1✔
326
327	- (void)testUpdateEventStats {	1✔
328	es_message_t esMsg = MakeESMessage(ES_EVENT_TYPE_NOTIFY_EXEC, NULL);	1✔
329	esMsg.seq_num = 0;	1✔
330	esMsg.global_seq_num = 0;	1✔
331
332	std::shared_ptr<MetricsPeer> metrics = CreateBasicMetricsPeer(self.q, ^(Metrics *){	1✔
333	});	×
334
335	EventStatsTuple eventStats{Processor::kRecorder, ES_EVENT_TYPE_NOTIFY_EXEC};	1✔
336	EventStatsTuple globalStats{Processor::kRecorder, ES_EVENT_TYPE_LAST};	1✔
337
338	// Map does not initially contain entries
339	XCTAssertEqual(0, metrics->drop_cache_.size());	1!
340
341	metrics->UpdateEventStats(Processor::kRecorder, &esMsg);	1✔
342
343	// After the first update, 2 entries exist, one for the event, and one for global
344	XCTAssertEqual(2, metrics->drop_cache_.size());	1!
345	XCTAssertEqual(1, metrics->drop_cache_[eventStats].next_seq_num);	1!
346	XCTAssertEqual(0, metrics->drop_cache_[eventStats].drops);	1!
347	XCTAssertEqual(1, metrics->drop_cache_[globalStats].next_seq_num);	1!
348	XCTAssertEqual(0, metrics->drop_cache_[globalStats].drops);	1!
349
350	// Increment sequence numbers by 1 and check that no drop was detected
351	esMsg.seq_num++;	1✔
352	esMsg.global_seq_num++;	1✔
353
354	metrics->UpdateEventStats(Processor::kRecorder, &esMsg);	1✔
355
356	XCTAssertEqual(2, metrics->drop_cache_.size());	1!
357	XCTAssertEqual(2, metrics->drop_cache_[eventStats].next_seq_num);	1!
358	XCTAssertEqual(0, metrics->drop_cache_[eventStats].drops);	1!
359	XCTAssertEqual(2, metrics->drop_cache_[globalStats].next_seq_num);	1!
360	XCTAssertEqual(0, metrics->drop_cache_[globalStats].drops);	1!
361
362	// Now incremenet sequence numbers by a large amount to trigger drop detection
363	esMsg.seq_num += 10;	1✔
364	esMsg.global_seq_num += 10;	1✔
365
366	metrics->UpdateEventStats(Processor::kRecorder, &esMsg);	1✔
367
368	XCTAssertEqual(2, metrics->drop_cache_.size());	1!
369	XCTAssertEqual(12, metrics->drop_cache_[eventStats].next_seq_num);	1!
370	XCTAssertEqual(9, metrics->drop_cache_[eventStats].drops);	1!
371	XCTAssertEqual(12, metrics->drop_cache_[globalStats].next_seq_num);	1!
372	XCTAssertEqual(9, metrics->drop_cache_[globalStats].drops);	1!
373	}	1✔
374
375	- (void)testFlushMetrics {	1✔
376	id mockEventProcessingTimes = OCMClassMock([SNTMetricInt64Gauge class]);	1✔
377	id mockEventCounts = OCMClassMock([SNTMetricCounter class]);	1✔
378	int64_t nanos = 1234;	1✔
379
380	// Initial update will have non-zero sequence numbers, triggering drop detection
381	es_message_t esMsgWithDrops = MakeESMessage(ES_EVENT_TYPE_NOTIFY_EXEC, NULL);	1✔
382	esMsgWithDrops.seq_num = 123;	1✔
383	esMsgWithDrops.global_seq_num = 123;	1✔
384
385	OCMStub([mockEventCounts incrementBy:0 forFieldValues:[OCMArg any]])	1✔
386	.ignoringNonObjectArgs()	1✔
387	.andDo(^(NSInvocation *inv) {	1✔
388	dispatch_semaphore_signal(self.sema);	1✔
389	});	1✔
390
391	OCMStub([(SNTMetricInt64Gauge *)mockEventProcessingTimes set:nanos forFieldValues:[OCMArg any]])	1✔
392	.ignoringNonObjectArgs()	1✔
393	.andDo(^(NSInvocation *inv) {	1✔
394	dispatch_semaphore_signal(self.sema);	1✔
395	});	1✔
396
397	dispatch_source_t timer = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0, self.q);	1✔
398	auto metrics =	1✔
399	std::make_shared<MetricsPeer>(self.q, timer, 100, mockEventProcessingTimes, mockEventCounts,	1✔
400	mockEventCounts, mockEventCounts, mockEventCounts, nil,	1✔
401	^(santa::santad::Metrics *m){	1✔
402	// This block intentionally left blank
403	});	×
404
405	metrics->SetEventMetrics(Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_EXEC,	1✔
406	EventDisposition::kProcessed, nanos);	1✔
407	metrics->SetEventMetrics(Processor::kAuthorizer, ES_EVENT_TYPE_AUTH_OPEN,	1✔
408	EventDisposition::kProcessed, nanos * 2);	1✔
409	metrics->UpdateEventStats(Processor::kRecorder, &esMsgWithDrops);	1✔
410	metrics->SetRateLimitingMetrics(Processor::kFileAccessAuthorizer, 123);	1✔
411	metrics->SetFileAccessEventMetrics("v1.0", "rule_abc", FileAccessMetricStatus::kOK,	1✔
412	ES_EVENT_TYPE_AUTH_OPEN, FileAccessPolicyDecision::kDenied);	1✔
413
414	// First ensure we have the expected map sizes
415	XCTAssertEqual(metrics->event_counts_cache_.size(), 2);	1!
416	XCTAssertEqual(metrics->event_times_cache_.size(), 2);	1!
417	XCTAssertEqual(metrics->rate_limit_counts_cache_.size(), 1);	1!
418	XCTAssertEqual(metrics->faa_event_counts_cache_.size(), 1);	1!
419	XCTAssertEqual(metrics->drop_cache_.size(), 2);	1!
420
421	EventStatsTuple eventStats{Processor::kRecorder, esMsgWithDrops.event_type};	1✔
422	EventStatsTuple globalStats{Processor::kRecorder, ES_EVENT_TYPE_LAST};	1✔
423	XCTAssertEqual(metrics->drop_cache_[eventStats].next_seq_num, 124);	1!
424	XCTAssertEqual(metrics->drop_cache_[eventStats].drops, 123);	1!
425	XCTAssertEqual(metrics->drop_cache_[globalStats].next_seq_num, 124);	1!
426	XCTAssertEqual(metrics->drop_cache_[globalStats].drops, 123);	1!
427
428	metrics->FlushMetrics();	1✔
429
430	// Expected call count is 8:
431	// 2: event counts
432	// 2: event times
433	// 1: rate limit
434	// 1: FAA
435	// 2: drops (1 event, 1 global)
436	int expectedCalls = 8;	1✔
437	for (int i = 0; i < expectedCalls; i++) {	9✔
438	XCTAssertSemaTrue(self.sema, 5, "Failed waiting for metrics to flush");	8!
439	}	8✔
440
441	// After a flush, map sizes should be reset to 0
442	XCTAssertEqual(metrics->event_counts_cache_.size(), 0);	1!
443	XCTAssertEqual(metrics->event_times_cache_.size(), 0);	1!
444	XCTAssertEqual(metrics->rate_limit_counts_cache_.size(), 0);	1!
445	XCTAssertEqual(metrics->faa_event_counts_cache_.size(), 0);	1!
446	// Note: The drop_cache_ should not be reset back to size 0. Instead, each
447	// entry has the sequence number left intact, but drop counts reset to 0.
448	XCTAssertEqual(metrics->drop_cache_.size(), 2);	1!
449	XCTAssertEqual(metrics->drop_cache_[eventStats].next_seq_num, 124);	1!
450	XCTAssertEqual(metrics->drop_cache_[eventStats].drops, 0);	1!
451	XCTAssertEqual(metrics->drop_cache_[globalStats].next_seq_num, 124);	1!
452	XCTAssertEqual(metrics->drop_cache_[globalStats].drops, 0);	1!
453	}	1✔
454
455	@end

google / santa / 8650924032

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous